@skillsmith/core 0.5.6 → 0.5.7

package/dist/sources/LocalFilesystemAdapter.helpers.d.ts

@@ -1,92 +0,0 @@
-/**
- * LocalFilesystemAdapter helpers (SMI-4287, SMI-4319, SMI-4320)
- *
- * Typed filesystem wrappers and symlink containment helpers used by
- * LocalFilesystemAdapter. These surface `AdapterError` return values instead
- * of throwing, so the adapter can continue scanning past individual failures
- * (permission, symlink escape, loop) and aggregate them into
- * `SourceSearchResult.warnings`.
- *
- * SMI-4320: drops platform-based `normaliseForFs` in favour of byte-wise
- * `startsWith(root + sep)` on realpath outputs. The FS itself canonicalises
- * case via `realpath` — platform heuristics miscategorise case-sensitive
- * volumes (HFS+ case-sensitive macOS volumes, ext4 case-folded dirs).
- * `resolveSafeRealpath` now accepts an `allowSymlinksOutsideRoot` opt-in
- * (see SMI-4287) so direct-access callers can inherit the same containment
- * policy as the scan loop.
- */
-import { type Dirent, type Stats } from 'fs';
-import type { AdapterError } from './types.js';
-/**
- * Success / failure result envelope used by `safeFs` helpers.
- *
- * @typeParam T - Type of the successful value
- */
-export type FsResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    error: AdapterError;
-};
-/**
- * Safe filesystem wrappers that return `FsResult<T>` instead of throwing.
- */
-export declare const safeFs: {
-    readonly readdir: (path: string) => Promise<FsResult<Dirent[]>>;
-    readonly stat: (path: string) => Promise<FsResult<Stats>>;
-    readonly readFile: (path: string, encoding?: BufferEncoding) => Promise<FsResult<string>>;
-    readonly realpath: (path: string) => Promise<FsResult<string>>;
-};
-/**
- * Byte-wise containment check on two realpath outputs (SMI-4320).
- *
- * Compares raw realpath bytes: `candidateReal === rootReal` or
- * `candidateReal.startsWith(rootReal + sep)`. No platform lowercasing — the
- * filesystem is authoritative. Case-insensitive volumes (APFS default, NTFS)
- * already canonicalise case through `fs.realpath`; case-sensitive volumes
- * (HFS+ case-sensitive, ext4 case-folded) keep distinct paths distinct.
- *
- * The trailing-separator guard is load-bearing: without `+ sep`,
- * `rootDir = /a/root` would accept `/a/rootfoo` as contained.
- */
-export declare function isRealpathContained(candidateReal: string, rootReal: string): boolean;
-/**
- * Options accepted by `resolveSafeRealpath`.
- *
- * - `allowSymlinksOutsideRoot` (SMI-4287): when `true`, skip the containment
- *   re-check and return the realpath unconditionally. Callers that opt in
- *   accept the security tradeoff — used by dev-install tooling that scans
- *   linked sibling packages.
- */
-export interface ResolveSafeRealpathOptions {
-    allowSymlinksOutsideRoot?: boolean;
-}
-/**
- * Resolve `candidate` to a realpath and verify it remains within `root`.
- *
- * Runs `fs.realpath` on both the candidate and the root, then performs a
- * byte-wise `startsWith(rootReal + sep)` check (SMI-4320). On case-insensitive
- * volumes the FS canonicalises case inside `realpath`; on case-sensitive
- * volumes distinct cases remain distinct — both outcomes are correct.
- *
- * Returns `{ ok: true, value: resolvedRealpath }` on success. On failure
- * returns an `AdapterError` with:
- * - `symlink-escape` if the target resolves outside the root
- * - `loop` on `ELOOP` (circular symlinks)
- * - `permission` / `not-found` / `io` for other filesystem errors
- *
- * Does NOT throw for containment violations (caller drives the warning list).
- *
- * SMI-4287 opt-in: when `opts.allowSymlinksOutsideRoot === true`, containment
- * is skipped entirely. The loop-detection + other realpath errors still apply.
- *
- * TOCTOU caveat: this is a check-then-use pattern. Between the realpath
- * check and a subsequent `fs.readFile`, a malicious actor with write access
- * inside `rootDir` could swap the symlink target. True atomicity requires
- * fd-based I/O (`fs.open` + fstat-by-fd + read-by-fd) and is out of scope
- * here — this helper closes the 99% case where the attack window is
- * scan-to-fetch (minutes to hours). See plan doc for the residual risk.
- */
-export declare function resolveSafeRealpath(candidate: string, root: string, opts?: ResolveSafeRealpathOptions): Promise<FsResult<string>>;
-//# sourceMappingURL=LocalFilesystemAdapter.helpers.d.ts.map

package/dist/sources/LocalFilesystemAdapter.helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalFilesystemAdapter.helpers.d.ts","sourceRoot":"","sources":["../../src/sources/LocalFilesystemAdapter.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAkB,KAAK,MAAM,EAAE,KAAK,KAAK,EAAE,MAAM,IAAI,CAAA;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAA;AA0DrF;;GAEG;AACH,eAAO,MAAM,MAAM;6BACH,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;0BAGvC,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;8BAG7B,MAAM,aAAY,cAAc,KAAa,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;8BAGtE,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CAGzC,CAAA;AAEV;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CA0B3B"}

package/dist/sources/LocalFilesystemAdapter.helpers.js

@@ -1,157 +0,0 @@
-/**
- * LocalFilesystemAdapter helpers (SMI-4287, SMI-4319, SMI-4320)
- *
- * Typed filesystem wrappers and symlink containment helpers used by
- * LocalFilesystemAdapter. These surface `AdapterError` return values instead
- * of throwing, so the adapter can continue scanning past individual failures
- * (permission, symlink escape, loop) and aggregate them into
- * `SourceSearchResult.warnings`.
- *
- * SMI-4320: drops platform-based `normaliseForFs` in favour of byte-wise
- * `startsWith(root + sep)` on realpath outputs. The FS itself canonicalises
- * case via `realpath` — platform heuristics miscategorise case-sensitive
- * volumes (HFS+ case-sensitive macOS volumes, ext4 case-folded dirs).
- * `resolveSafeRealpath` now accepts an `allowSymlinksOutsideRoot` opt-in
- * (see SMI-4287) so direct-access callers can inherit the same containment
- * policy as the scan loop.
- */
-import { promises as fs } from 'fs';
-import { sep } from 'path';
-/**
- * Map a Node filesystem error to an `AdapterError.code`.
- */
-function mapErrnoToCode(err) {
-    const code = err?.code;
-    switch (code) {
-        case 'EACCES':
-        case 'EPERM':
-            return 'permission';
-        case 'ENOENT':
-            return 'not-found';
-        case 'ELOOP':
-            return 'loop';
-        default:
-            return 'io';
-    }
-}
-/**
- * Build a human-friendly message for an AdapterError.
- */
-function describe(code, path) {
-    switch (code) {
-        case 'permission':
-            return `Cannot read: ${path}`;
-        case 'not-found':
-            return `Not found: ${path}`;
-        case 'loop':
-            return `Symlink loop detected: ${path}`;
-        case 'symlink-escape':
-            return `Symlink outside root, skipped: ${path}`;
-        case 'io':
-            return `Filesystem error: ${path}`;
-    }
-}
-/**
- * Wrap a throwing `fs` call into an `FsResult<T>`.
- */
-async function wrap(path, op) {
-    try {
-        return { ok: true, value: await op() };
-    }
-    catch (error) {
-        const code = mapErrnoToCode(error);
-        return {
-            ok: false,
-            error: {
-                code,
-                path,
-                message: describe(code, path),
-                cause: error,
-            },
-        };
-    }
-}
-/**
- * Safe filesystem wrappers that return `FsResult<T>` instead of throwing.
- */
-export const safeFs = {
-    readdir(path) {
-        return wrap(path, () => fs.readdir(path, { withFileTypes: true }));
-    },
-    stat(path) {
-        return wrap(path, () => fs.stat(path));
-    },
-    readFile(path, encoding = 'utf-8') {
-        return wrap(path, () => fs.readFile(path, encoding));
-    },
-    realpath(path) {
-        return wrap(path, () => fs.realpath(path));
-    },
-};
-/**
- * Byte-wise containment check on two realpath outputs (SMI-4320).
- *
- * Compares raw realpath bytes: `candidateReal === rootReal` or
- * `candidateReal.startsWith(rootReal + sep)`. No platform lowercasing — the
- * filesystem is authoritative. Case-insensitive volumes (APFS default, NTFS)
- * already canonicalise case through `fs.realpath`; case-sensitive volumes
- * (HFS+ case-sensitive, ext4 case-folded) keep distinct paths distinct.
- *
- * The trailing-separator guard is load-bearing: without `+ sep`,
- * `rootDir = /a/root` would accept `/a/rootfoo` as contained.
- */
-export function isRealpathContained(candidateReal, rootReal) {
-    return candidateReal === rootReal || candidateReal.startsWith(rootReal + sep);
-}
-/**
- * Resolve `candidate` to a realpath and verify it remains within `root`.
- *
- * Runs `fs.realpath` on both the candidate and the root, then performs a
- * byte-wise `startsWith(rootReal + sep)` check (SMI-4320). On case-insensitive
- * volumes the FS canonicalises case inside `realpath`; on case-sensitive
- * volumes distinct cases remain distinct — both outcomes are correct.
- *
- * Returns `{ ok: true, value: resolvedRealpath }` on success. On failure
- * returns an `AdapterError` with:
- * - `symlink-escape` if the target resolves outside the root
- * - `loop` on `ELOOP` (circular symlinks)
- * - `permission` / `not-found` / `io` for other filesystem errors
- *
- * Does NOT throw for containment violations (caller drives the warning list).
- *
- * SMI-4287 opt-in: when `opts.allowSymlinksOutsideRoot === true`, containment
- * is skipped entirely. The loop-detection + other realpath errors still apply.
- *
- * TOCTOU caveat: this is a check-then-use pattern. Between the realpath
- * check and a subsequent `fs.readFile`, a malicious actor with write access
- * inside `rootDir` could swap the symlink target. True atomicity requires
- * fd-based I/O (`fs.open` + fstat-by-fd + read-by-fd) and is out of scope
- * here — this helper closes the 99% case where the attack window is
- * scan-to-fetch (minutes to hours). See plan doc for the residual risk.
- */
-export async function resolveSafeRealpath(candidate, root, opts = {}) {
-    const candidateResult = await safeFs.realpath(candidate);
-    if (!candidateResult.ok)
-        return candidateResult;
-    if (opts.allowSymlinksOutsideRoot === true) {
-        return candidateResult;
-    }
-    const rootResult = await safeFs.realpath(root);
-    if (!rootResult.ok)
-        return rootResult;
-    if (!isRealpathContained(candidateResult.value, rootResult.value)) {
-        // Report the symlink path the user can identify (not the opaque
-        // realpath target). Including the target would leak the external
-        // location, which is exactly what the guard is protecting against.
-        return {
-            ok: false,
-            error: {
-                code: 'symlink-escape',
-                path: candidate,
-                message: describe('symlink-escape', candidate),
-            },
-        };
-    }
-    return { ok: true, value: candidateResult.value };
-}
-//# sourceMappingURL=LocalFilesystemAdapter.helpers.js.map

package/dist/sources/LocalFilesystemAdapter.helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalFilesystemAdapter.helpers.js","sourceRoot":"","sources":["../../src/sources/LocalFilesystemAdapter.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAA2B,MAAM,IAAI,CAAA;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAU1B;;GAEG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAA;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,YAAY,CAAA;QACrB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAA;QACpB,KAAK,OAAO;YACV,OAAO,MAAM,CAAA;QACf;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,IAA0B,EAAE,IAAY;IACxD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY;YACf,OAAO,gBAAgB,IAAI,EAAE,CAAA;QAC/B,KAAK,WAAW;YACd,OAAO,cAAc,IAAI,EAAE,CAAA;QAC7B,KAAK,MAAM;YACT,OAAO,0BAA0B,IAAI,EAAE,CAAA;QACzC,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,IAAI,EAAE,CAAA;QACjD,KAAK,IAAI;YACP,OAAO,qBAAqB,IAAI,EAAE,CAAA;IACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI,CAAI,IAAY,EAAE,EAAoB;IACvD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI;gBACJ,IAAI;gBACJ,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC7B,KAAK,EAAE,KAAK;aACb;SACF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,QAAQ,CAAC,IAAY,EAAE,WAA2B,OAAO;QACvD,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5C,CAAC;CACO,CAAA;AAEV;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB,EAAE,QAAgB;IACzE,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAA;AAC/E,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAAY,EACZ,OAAmC,EAAE;IAErC,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACxD,IAAI,CAAC,eAAe,CAAC,EAAE;QAAE,OAAO,eAAe,CAAA;IAE/C,IAAI,IAAI,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAA;IAErC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;aAC/C;SACF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,CAAA;AACnD,CAAC"}

package/dist/sources/LocalFilesystemAdapter.js

@@ -1,399 +0,0 @@
-/**
- * Local Filesystem Source Adapter (SMI-591, SMI-4287, SMI-4319, SMI-4320)
- *
- * Scans local directories for SKILL.md files.
- * Useful for local development and testing.
- *
- * SMI-4287 hardening:
- * - Symlink targets are resolved via `fs.realpath` and checked against the
- *   adapter's `rootDir`. Targets outside root are skipped with a
- *   `symlink-escape` warning (unless `allowSymlinksOutsideRoot` is `true`).
- * - Permission (EACCES/EPERM), not-found (ENOENT), and loop (ELOOP) errors
- *   are surfaced as `AdapterError` entries on `SourceSearchResult.warnings`
- *   instead of throwing, so siblings continue to be scanned.
- * - All `fs.*` calls route through the typed `safeFs` helpers; the historic
- *   bare `try/catch` for EACCES in `scanDirectory` is removed.
- *
- * SMI-4319 hardening:
- * - `runScan` allocates a fresh `visitedRealpaths: Set<string>` per
- *   invocation so mutually-recursive / self-looping directory symlinks are
- *   detected and skipped with a `loop` warning instead of silently wasting
- *   `maxDepth` traversals.
- *
- * SMI-4320 hardening:
- * - `resolveSkillPath` is now async and routes through `resolveSafeRealpath`
- *   (byte-wise `startsWith(rootReal + sep)` on realpath outputs — no
- *   platform lowercasing). Direct-access methods (`getRepository`,
- *   `fetchSkillContent`, `skillExists`) inherit containment instead of
- *   relying solely on lexical `validatePath`. This closes the scan-to-fetch
- *   TOCTOU window where an indexed-then-swapped symlink previously escaped
- *   containment. `allowSymlinksOutsideRoot` is honoured at every realpath
- *   callsite. Residual TOCTOU between `resolveSkillPath` and the subsequent
- *   `fs.readFile` is documented; closing it requires fd-based I/O and is
- *   tracked as a separate follow-up.
- */
-import { BaseSourceAdapter } from './BaseSourceAdapter.js';
-import { createHash } from 'crypto';
-import { basename, dirname, resolve, join } from 'path';
-import { createLogger } from '../utils/logger.js';
-import { validatePath, safePatternMatch } from '../validation/index.js';
-import { safeFs, resolveSafeRealpath } from './LocalFilesystemAdapter.helpers.js';
-import { scanDirectoryRecursive, } from './LocalFilesystemAdapter.scan.js';
-const log = createLogger('LocalFilesystemAdapter');
-/**
- * Local Filesystem Source Adapter
- *
- * Scans local directories to discover and index skills.
- *
- * @example
- * ```typescript
- * const adapter = new LocalFilesystemAdapter({
- *   id: 'local-skills',
- *   name: 'Local Skills',
- *   type: 'local',
- *   baseUrl: 'file://',
- *   enabled: true,
- *   rootDir: '/home/user/.claude/skills'
- * })
- *
- * await adapter.initialize()
- * const result = await adapter.search({})
- * for (const warning of result.warnings ?? []) {
- *   console.warn(`[${warning.code}] ${warning.message}`)
- * }
- * ```
- */
-export class LocalFilesystemAdapter extends BaseSourceAdapter {
-    rootDir;
-    maxDepth;
-    excludePatterns;
-    followSymlinks;
-    allowSymlinksOutsideRoot;
-    discoveredSkills = [];
-    /**
-     * Warnings accumulated during the most recent scan. Consumed and cleared
-     * by `search()` so each caller sees only the warnings from that call's
-     * underlying scan.
-     */
-    scanWarnings = [];
-    constructor(config) {
-        super(config);
-        this.rootDir = config.rootDir;
-        this.maxDepth = config.maxDepth ?? 5;
-        this.excludePatterns = config.excludePatterns ?? ['node_modules', '.git', '.svn', 'dist'];
-        this.followSymlinks = config.followSymlinks ?? false;
-        this.allowSymlinksOutsideRoot = config.allowSymlinksOutsideRoot ?? false;
-    }
-    /**
-     * Initialize by scanning the filesystem
-     */
-    async doInitialize() {
-        this.scanWarnings = [];
-        await this.runScan();
-    }
-    /**
-     * Check if root directory exists and is accessible.
-     *
-     * SMI-4287: routes `fs.stat(rootDir)` through `safeFs` so the raw Node
-     * error is translated to a typed `AdapterError` message.
-     */
-    async doHealthCheck() {
-        const statResult = await safeFs.stat(this.rootDir);
-        if (!statResult.ok) {
-            return {
-                healthy: false,
-                error: statResult.error.message,
-            };
-        }
-        return {
-            healthy: statResult.value.isDirectory(),
-            error: statResult.value.isDirectory() ? undefined : 'Root path is not a directory',
-        };
-    }
-    /**
-     * Search for skills in the scanned directories.
-     *
-     * SMI-4287: `warnings` collects non-fatal `AdapterError` entries from the
-     * scan (symlink escapes, permission denials, loops). An empty array is
-     * returned as `undefined` to keep the field strictly optional.
-     */
-    async search(options = {}) {
-        if (this.discoveredSkills.length === 0) {
-            this.scanWarnings = [];
-            await this.runScan();
-        }
-        let filtered = [...this.discoveredSkills];
-        if (options.query) {
-            const query = options.query.toLowerCase();
-            filtered = filtered.filter((skill) => skill.relativePath.toLowerCase().includes(query) ||
-                skill.directory.toLowerCase().includes(query));
-        }
-        const limit = options.limit ?? 100;
-        const limitedResults = filtered.slice(0, limit);
-        const repositoriesWithWarnings = await Promise.all(limitedResults.map((skill) => this.skillToRepository(skill)));
-        const repositories = repositoriesWithWarnings.map((r) => r.repo);
-        const repoWarnings = repositoriesWithWarnings.flatMap((r) => r.warnings);
-        const allWarnings = [...this.scanWarnings, ...repoWarnings];
-        return {
-            repositories,
-            totalCount: filtered.length,
-            hasMore: filtered.length > limit,
-            warnings: allWarnings.length > 0 ? allWarnings : undefined,
-        };
-    }
-    /**
-     * Get repository info for a skill location.
-     *
-     * SMI-4287: `fs.stat` is routed through `safeFs`; permission errors are
-     * converted to typed Error messages instead of raw Node throws.
-     */
-    async getRepository(location) {
-        const skillPath = await this.resolveSkillPath(location);
-        const skill = this.discoveredSkills.find((s) => s.path === skillPath);
-        if (skill) {
-            const { repo } = await this.skillToRepository(skill);
-            return repo;
-        }
-        const statResult = await safeFs.stat(skillPath);
-        if (!statResult.ok) {
-            throw new Error(`Skill not found at ${skillPath}: ${statResult.error.message}`);
-        }
-        const stats = statResult.value;
-        return {
-            id: this.generateId(skillPath),
-            name: basename(dirname(skillPath)),
-            url: `file://${skillPath}`,
-            description: null,
-            owner: 'local',
-            defaultBranch: 'main',
-            stars: 0,
-            forks: 0,
-            topics: ['local'],
-            updatedAt: stats.mtime.toISOString(),
-            createdAt: stats.ctime.toISOString(),
-            license: null,
-            metadata: {
-                sourceType: 'local',
-                path: skillPath,
-            },
-        };
-    }
-    /**
-     * Fetch skill content from local file.
-     *
-     * SMI-4287: both `fs.readFile` and `fs.stat` route through `safeFs`, so
-     * permission errors (EACCES/EPERM) raise typed Errors with path context
-     * instead of raw Node errors.
-     */
-    async fetchSkillContent(location) {
-        const skillPath = await this.resolveSkillPath(location);
-        const contentResult = await safeFs.readFile(skillPath);
-        if (!contentResult.ok) {
-            throw new Error(`Failed to read skill file at ${skillPath}: ${contentResult.error.message}`);
-        }
-        const statResult = await safeFs.stat(skillPath);
-        if (!statResult.ok) {
-            throw new Error(`Failed to stat skill file at ${skillPath}: ${statResult.error.message}`);
-        }
-        const rawContent = contentResult.value;
-        const stats = statResult.value;
-        const sha = this.generateSha(rawContent);
-        return {
-            rawContent,
-            sha,
-            location,
-            filePath: skillPath,
-            encoding: 'utf-8',
-            lastModified: stats.mtime.toISOString(),
-        };
-    }
-    /**
-     * Check if skill exists at location
-     */
-    async skillExists(location) {
-        // SMI-720 contract: lexical path-traversal attempts throw
-        // `ValidationError('Path traversal detected: ...')` from `resolveSkillPath`
-        // — callers (and the SMI-720 test suite) rely on this. Only absence on
-        // disk should return `false`; traversal attempts surface as exceptions.
-        const skillPath = await this.resolveSkillPath(location);
-        const statResult = await safeFs.stat(skillPath);
-        return statResult.ok;
-    }
-    /**
-     * Rescan the filesystem for new skills.
-     *
-     * Returns the count of discovered skills. Warnings from the rescan are
-     * available via the next call to `search()`.
-     */
-    async rescan() {
-        this.discoveredSkills = [];
-        this.scanWarnings = [];
-        await this.runScan();
-        return this.discoveredSkills.length;
-    }
-    /**
-     * Get count of discovered skills
-     */
-    get skillCount() {
-        return this.discoveredSkills.length;
-    }
-    /**
-     * Run the recursive scan starting at `rootDir`. Delegates to the extracted
-     * `scanDirectoryRecursive` helper (see `LocalFilesystemAdapter.scan.ts`).
-     *
-     * SMI-4319: allocates a fresh `visitedRealpaths` set per invocation so
-     * back-to-back scans don't share state. Sibling directories within a
-     * single scan share the set (they're in the same call tree), so
-     * cross-linked loops (A↔B) are caught even when the loop isn't on the
-     * descent path from `rootDir`.
-     */
-    async runScan() {
-        await scanDirectoryRecursive(this.rootDir, 0, {
-            rootDir: this.rootDir,
-            maxDepth: this.maxDepth,
-            followSymlinks: this.followSymlinks,
-            allowSymlinksOutsideRoot: this.allowSymlinksOutsideRoot,
-            isExcluded: (name) => this.isExcluded(name),
-            discovered: this.discoveredSkills,
-            warnings: this.scanWarnings,
-            visitedRealpaths: new Set(),
-            log,
-        });
-    }
-    /**
-     * Check if a path/name should be excluded (SMI-722, SMI-726)
-     * Uses centralized safe pattern matching to prevent RegExp injection
-     */
-    isExcluded(name) {
-        return this.excludePatterns.some((pattern) => safePatternMatch(name, pattern));
-    }
-    /**
-     * Resolve a skill location to a full filesystem path
-     * (SMI-720, SMI-726, SMI-4287, SMI-4320).
-     *
-     * Two-stage containment: (1) lexical `validatePath` fast-fails
-     * `../`-style traversal (SMI-720 contract — callers assert the
-     * "Path traversal detected" message), then (2) `resolveSafeRealpath`
-     * enforces realpath byte-wise containment so symlinks can't escape
-     * `rootDir` even when the lexical path is clean. Honours the SMI-4287
-     * `allowSymlinksOutsideRoot` opt-in.
-     *
-     * Not-found behaviour: realpath ENOENT falls back to the lexically
-     * resolved path so downstream `stat` / `readFile` produce the canonical
-     * caller-visible error. TOCTOU caveat: the window between this resolve
-     * and the caller's subsequent read remains open; closing it requires
-     * fd-based I/O and is tracked separately.
-     */
-    async resolveSkillPath(location) {
-        let resolvedPath;
-        if (location.path?.startsWith('/')) {
-            resolvedPath = location.path;
-        }
-        else if (location.path) {
-            resolvedPath = join(this.rootDir, location.path);
-        }
-        else if (location.owner && location.repo) {
-            resolvedPath = join(this.rootDir, location.owner, location.repo, 'SKILL.md');
-        }
-        else if (location.repo) {
-            resolvedPath = join(this.rootDir, location.repo, 'SKILL.md');
-        }
-        else {
-            throw new Error('Invalid location: must specify path or repo');
-        }
-        // Lexical fast-fail (SMI-720 contract — callers test for
-        // "Path traversal detected" on obvious traversal attempts).
-        validatePath(resolvedPath, this.rootDir);
-        const absolutePath = resolve(resolvedPath);
-        // SMI-4320: realpath-based containment. Honours SMI-4287 opt-in.
-        const realResult = await resolveSafeRealpath(absolutePath, this.rootDir, {
-            allowSymlinksOutsideRoot: this.allowSymlinksOutsideRoot,
-        });
-        if (realResult.ok) {
-            return realResult.value;
-        }
-        // `not-found` is expected for skillExists / fetchSkillContent on paths
-        // that the caller hasn't verified exist. Fall back to the lexically
-        // resolved path so downstream `stat` / `readFile` produce the canonical
-        // error message callers already depend on.
-        if (realResult.error.code === 'not-found') {
-            return absolutePath;
-        }
-        // `symlink-escape`, `loop`, `permission`, `io` all throw — the caller
-        // asked for a path that either escapes root or can't be validated.
-        throw new Error(`Path rejected by realpath containment: ${realResult.error.message}`);
-    }
-    /**
-     * Convert discovered skill to SourceRepository.
-     *
-     * Returns both the repository and any warnings encountered while reading
-     * the file (typically permission errors on SKILL.md after discovery).
-     */
-    async skillToRepository(skill) {
-        const dirName = basename(skill.directory);
-        const warnings = [];
-        let description = null;
-        let name = dirName;
-        const contentResult = await safeFs.readFile(skill.path);
-        if (contentResult.ok) {
-            const content = contentResult.value;
-            const nameMatch = content.match(/^---[\s\S]*?name:\s*["']?([^"'\n]+)["']?/m);
-            if (nameMatch) {
-                name = nameMatch[1].trim();
-            }
-            const descMatch = content.match(/^---[\s\S]*?description:\s*["']?([^"'\n]+)["']?/m);
-            if (descMatch) {
-                description = descMatch[1].trim();
-            }
-        }
-        else {
-            warnings.push(contentResult.error);
-        }
-        return {
-            repo: {
-                id: this.generateId(skill.path),
-                name,
-                url: `file://${skill.path}`,
-                description,
-                owner: 'local',
-                defaultBranch: 'main',
-                stars: 0,
-                forks: 0,
-                topics: ['local'],
-                updatedAt: skill.stats.mtime.toISOString(),
-                createdAt: skill.stats.ctime.toISOString(),
-                license: null,
-                metadata: {
-                    sourceType: 'local',
-                    path: skill.path,
-                    relativePath: skill.relativePath,
-                    size: skill.stats.size,
-                },
-            },
-            warnings,
-        };
-    }
-    /**
-     * Generate a deterministic ID from a path
-     */
-    generateId(path) {
-        return createHash('sha256').update(path).digest('hex').slice(0, 16);
-    }
-    /**
-     * Generate SHA hash for content
-     */
-    generateSha(content) {
-        return createHash('sha256').update(content).digest('hex');
-    }
-}
-/**
- * Factory function for creating local filesystem adapters
- */
-export function createLocalFilesystemAdapter(config) {
-    return new LocalFilesystemAdapter({
-        ...config,
-        type: 'local',
-        baseUrl: config.baseUrl ?? 'file://',
-    });
-}
-//# sourceMappingURL=LocalFilesystemAdapter.js.map

package/dist/sources/LocalFilesystemAdapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalFilesystemAdapter.js","sourceRoot":"","sources":["../../src/sources/LocalFilesystemAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAW1D,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AACjF,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAgClD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC1C,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,eAAe,CAAU;IACzB,cAAc,CAAS;IACvB,wBAAwB,CAAS;IAC1C,gBAAgB,GAA4B,EAAE,CAAA;IACtD;;;;OAIG;IACK,YAAY,GAAmB,EAAE,CAAA;IAEzC,YAAY,MAA6B;QACvC,KAAK,CAAC,MAAM,CAAC,CAAA;QACb,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;QACpC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACzF,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAA;QACpD,IAAI,CAAC,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,IAAI,KAAK,CAAA;IAC1E,CAAC;IAED;;OAEG;IACgB,KAAK,CAAC,YAAY;QACnC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;QACtB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,aAAa;QAC3B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;aAChC,CAAA;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B;SACnF,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,UAA+B,EAAE;QAC5C,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;YACtB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAEzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YACzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAChD,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAChD,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAA;QAClC,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,wBAAwB,GAAG,MAAM,OAAO,CAAC,GAAG,CAChD,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAC7D,CAAA;QACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACxE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,YAAY,CAAC,CAAA;QAE3D,OAAO;YACL,YAAY;YACZ,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,OAAO,EAAE,QAAQ,CAAC,MAAM,GAAG,KAAK;YAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,QAAwB;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QAErE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,GAAG,EAAE,UAAU,SAAS,EAAE;YAC1B,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,OAAO;YACd,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,CAAC,OAAO,CAAC;YACjB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO;gBACnB,IAAI,EAAE,SAAS;aAChB;SACF,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAwB;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAEvD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QACtD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,KAAK,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAA;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QAExC,OAAO;YACL,UAAU;YACV,GAAG;YACH,QAAQ;YACR,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;SACxC,CAAA;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW,CAAC,QAAwB;QACjD,0DAA0D;QAC1D,4EAA4E;QAC5E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QACvD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/C,OAAO,UAAU,CAAC,EAAE,CAAA;IACtB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;QACtB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAA;IACrC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,OAAO;QACnB,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;YACvD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3C,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,gBAAgB,EAAE,IAAI,GAAG,EAAU;YACnC,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAChF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAwB;QACrD,IAAI,YAAoB,CAAA;QAExB,IAAI,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC9B,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QAClD,CAAC;aAAM,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QAED,yDAAyD;QACzD,4DAA4D;QAC5D,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;QAE1C,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE;YACvE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;SACxD,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,UAAU,CAAC,KAAK,CAAA;QACzB,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,YAAY,CAAA;QACrB,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IACvF,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAC7B,KAA4B;QAE5B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAmB,EAAE,CAAA;QAEnC,IAAI,WAAW,GAAkB,IAAI,CAAA;QACrC,IAAI,IAAI,GAAG,OAAO,CAAA;QAElB,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvD,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAA;YACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC5E,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACnF,IAAI,SAAS,EAAE,CAAC;gBACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QAED,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,IAAI;gBACJ,GAAG,EAAE,UAAU,KAAK,CAAC,IAAI,EAAE;gBAC3B,WAAW;gBACX,KAAK,EAAE,OAAO;gBACd,aAAa,EAAE,MAAM;gBACrB,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,OAAO,CAAC;gBACjB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC1C,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC1C,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE;oBACR,UAAU,EAAE,OAAO;oBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;iBACvB;aACF;YACD,QAAQ;SACT,CAAA;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,IAAY;QAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe;QACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAA6B;IAE7B,OAAO,IAAI,sBAAsB,CAAC;QAChC,GAAG,MAAM;QACT,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;KACrC,CAAC,CAAA;AACJ,CAAC"}