@vibe-agent-toolkit/utils 0.2.0-rc.1 → 0.2.0-rc.10

package/dist/index.js

@@ -3,88 +3,133 @@
  * Core shared utilities with no dependencies on other packages
  *
  * Utilities are added as needed by other packages, not speculatively.
+ *
+ * **A module that brings a third-party dependency belongs on a subpath, not
+ * here.** This entry has ~245 in-repo importers plus published adopters, and
+ * every one of them pays for the whole graph reachable from it — a bundler that
+ * cannot tree-shake a dependency (a CJS package, or one reached through
+ * `new URL(..., import.meta.url)`) inlines it into every consumer that touched
+ * a path helper. The domains that carry weight each have their own entry:
+ * `./crawl`, `./git`, `./process`, `./skill-test`, `./template`, `./yaml`.
+ * `./skill-test` is there for a *transitive* reason rather than a direct one —
+ * it declares no dependency itself, but spawning a headless agent goes through
+ * `./process`, which reaches `which` and (because `safeExecSync` refuses `git`
+ * and delegates) `@vibe-validate/git`. Reachability is the criterion, not the
+ * import a module happens to write.
+ *
+ * The rule is enforced, not merely stated: `test/subpath-purity.test.ts` asserts
+ * this entry's reachable third-party set by equality, so a dependency arriving
+ * here — directly or transitively, through any module below — turns that row red
+ * and has to be an argued edit rather than an unnoticed one.
  */
-// Safe command execution (cross-platform, no shell injection)
-export * from './safe-exec.js';
-// Windows shell-invocation helpers (.cmd/.bat/.ps1 handling), shared by every spawn wrapper
-export * from './windows-shell.js';
-// Hardened async spawn (streaming stdio + correct Windows .cmd/.bat launching)
-export * from './spawn-hardened.js';
+// The base of every error VAT throws on purpose; `code` is what a catch
+// block dispatches on, never `message`.
+export * from './errors/vat-error.js';
 // Cross-platform path utilities
 export * from './path-utils.js';
-// Blocking stdio for published bins (process.exit must not truncate output)
-export * from './stdio-blocking.js';
+// The filesystem-backed containment verdict every delete/copy/uninstall sink asks.
+export * from './path-containment.js';
+// The Dirent classifiers a walk uses instead of a bare isFile()/isDirectory().
+export * from './dirent-kind.js';
+// THE content-decoding seam: bytes to text, in one place. `decodeTextContent` is
+// pure and also reachable from the dependency-free `./text` entry; the two
+// file-reading wrappers need `node:fs` and are also on `./fs`. Other routes from
+// bytes to text — `buf.toString('utf-8')`, `new TextDecoder()`,
+// `readFile(p, 'utf-8')` — are a lint error under `local/no-raw-text-decode`
+// WHERE IT IS REGISTERED (this package's `src` and `resources`' `src`); the rest
+// of the repo is a migration ledger in `eslint.config.js`, not a covered claim.
+export * from './text-content.js';
+export * from './text-file.js';
 // Asset reference resolution (paths + npm bare specifiers)
 export * from './asset-reference.js';
 // Filesystem utilities.
 //
-// Named rather than `export *` on purpose: `classifyFilenameCase` (the pure
-// judge over a hand-held row) and `siblingNamesFrom` (the table lookup that
-// throws on a miss) are internal members of the fill+judge pairs below, and a
-// star re-export would publish them on this barrel the moment they were written.
-// (The `./fs` subpath was already an explicit list and was never at risk.) The
-// public surface is a decision, not a side effect of module layout.
+// Named rather than `export *` on purpose: `fs-utils.ts` holds internal members
+// of the fill+judge pairs below — the per-directory index build, the table-key
+// derivation — and a star re-export would publish each of them on this barrel
+// the moment it was written. (The `./fs` subpath was already an explicit list
+// and was never at risk.) The public surface is a decision, not a side effect of
+// module layout.
 //
 // TWO materialized columns are published, both shaped fill-first-then-judge:
 //
-//   - sibling names — `fillSiblingNames` (every listing, once, up front) plus
-//     `classifyFilenameCaseFrom` (pure judgement over the filled table). Its row
-//     lookup `siblingNamesFrom` stays internal because a row there is not yet an
-//     answer: it still needs a judge, and that judge is what we export.
+//   - path spellings — `fillPathSpellings` plus `pathSpellingFrom`. It judges a
+//     WHOLE path, which is what a caller validating references needs: judging
+//     only the basename hands every directory component back to the host
+//     filesystem's own folding, so a link that resolves on macOS 404s on a
+//     case-sensitive filesystem. The `DirectorySpellingIndex` underneath is
+//     published too, for the lazy caller that cannot enumerate its targets up
+//     front.
 //   - realpaths — `fillRealpaths` (every canonicalization, once, up front) plus
-//     `realpathFrom`. Here the row lookup IS the judge: the canonical path is the
-//     answer, so there is nothing left to keep internal.
+//     `realpathFrom`.
+//
+// In both, the row lookup IS the judge: the row is the answer, so there is
+// nothing left to keep internal.
 //
 // There is deliberately no one-call wrapper composing either pair: handed one, a
 // caller with many paths loops over it, which reinstates the per-path `await` the
 // pairs exist to remove.
 //
-// The `SiblingNames` row type is withheld for the same reason its judge is: it is
-// only ever that judge's parameter, so publishing it would advertise a shape no
-// consumer can hand anywhere. `SiblingNamesTable` and `RealpathTable` — what the
-// fills return and the judges consume — are the ones a caller can name, as are
-// `FilenameCaseVerdict`/`FilenameMatch`, which a consumer does not hand in but
-// does receive and branch on.
+// `PathSpellingTable` and `RealpathTable` — what the fills return and the judges
+// consume — are the types a caller can name, as are `PathSpelling`,
+// `PathSpellingRequest`, `ComponentMatch` and `FilenameMatch`, which a consumer
+// receives and branches on.
 //
 // The cost of that decision, stated so it is not a surprise: a new *type* added
 // to `fs-utils.ts` no longer reaches consumers automatically, and
 // `barrel-exports.test.ts` pins runtime names only, so nothing will fail. The
 // symptom is a type that cannot be imported, which surfaces the first time
 // someone tries — not a silent break in existing code.
-export { classifyFilenameCaseFrom, copyDirectory, fillRealpaths, fillSiblingNames, FsLookupCache, realpathFrom, } from './fs-utils.js';
-// Directory crawling with glob patterns
-export * from './file-crawler.js';
-// Git ignore checking
-export * from './gitignore-checker.js';
-// Git URL parsing (parse/detect git URLs, GitHub shorthand, SSH forms)
-export * from './git-url.js';
-// Git utilities (using git commands directly)
-export * from './git-utils.js';
+// The lookups themselves, plus the memo every fill shares.
+export { isFilesystemAccessError, isPathAbsentError } from './errors/errno.js';
+export { copyDirectory, CopyLinkEscapesSourceError, FsLookupCache, transientRefusalClause, } from './fs-utils.js';
+// The two fill+judge pairs, in the order the note above lists them, plus the
+// lazy index a caller that cannot enumerate its targets up front reaches for.
+export { DirectorySpellingIndex, fillPathSpellings, fillRealpaths, pathSpellingFrom, realpathFrom, spellingWalkRoot, } from './fs-utils.js';
 // Project root discovery (canonical: config → git → null).
 // CLI-boundary use only — see docs/concepts/roots-and-config.md.
 export * from './project-utils.js';
-// Git tracking cache (for efficient git-ignore checking)
-export * from './git-tracker.js';
-// Test helpers for isolated test output directories
-export * from './test-helpers.js';
+// The runtime half of `test-helpers.ts`: symlink creation with its host
+// capability probe, and the git-environment detachment every child process
+// needs. Named rather than `export *` because the SAME module also holds the
+// fs-refusal fakes (`refuseSyncFs` and siblings), which are test scaffolding
+// and reach adopters on the `./testing` subpath only. A published runtime
+// barrel that carried them — eight such names, once — was the audit's finding,
+// and an `export *` here is how they got in.
+export { createSymlink, createSymlinkAsync, detachGitEnv, errnoError, INHERITED_GIT_ENV, symlinkCapability, } from './test-helpers.js';
 // Zod type introspection (version-agnostic)
 export * from './zod-introspection.js';
-// Handlebars template rendering (cached, no HTML escaping)
-export * from './template.js';
 // Skill target resolution (cross-platform flat skill install paths)
 export * from './skill-targets.js';
-// linkAuth pure engine — public API only (issue #113).
-// Internal helpers (rewrite, build-headers, etc.) stay module-private.
-export { resolveAuthenticatedUrl, } from './link-auth/resolve.js';
-export { defaultRunCommand } from './link-auth/resolve-token.js';
-export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
-// Skill testing utilities (environment management for headless agent runs)
-export * from './skill-test/index.js';
 // Glob pattern helpers (isGlob, staticGlobBase, globMagicRemainder)
 export * from './glob/glob-pattern.js';
 // Filesystem hashing (sha256 of raw file bytes)
 export * from './fs/file-hash.js';
-// Byte-surgical YAML value updater (replace/insert without reflowing the doc)
-export * from './yaml/surgical-yaml.js';
 export { parseWholeNumberAtLeast } from './numeric-args.js';
+// THE reading of an environment variable as a boolean. One implementation
+// because three switches each had their own `!== '0'` comparison and none of
+// them turned off for `=false`.
+export { parseEnvBoolean } from './env-flag.js';
+// Machine-independent string ordering for hashed/serialized output — never `localeCompare`.
+export { compareCodeUnits } from './compare-code-units.js';
+// The crawl-timing seam: which contributor, stratum and fixpoint pass owns the
+// time it takes to FIND documents.
+//
+// It lives HERE, at the bottom of the graph, because the work it measures is
+// spread across four packages above this one — `resources` builds the registry,
+// `agent-skills` walks the link graph, `claude-marketplace` enumerates an
+// inventory, and `utils` itself initializes the `GitTracker` both crawlers
+// consume. Both arms must record through ONE recorder or the two are not
+// comparable, and only `utils` is beneath all of them. See the module header.
+//
+// Named rather than `export *`: the accumulator internals (`addEntry`,
+// `keyOf`, `recordInheritedPass`) are not surface, and `timing-dump.ts` is
+// plumbing shared with `resources`' package-internal `parse-timing.ts` — a star
+// re-export would publish both the moment either grew a symbol.
+export { CRAWL_BLOB_POPULATE_ID, CRAWL_CLOSURE_CONTRIBUTE_ID, CRAWL_CLOSURE_RESOLVE_ID, CRAWL_PASS_INSIDE, CRAWL_REGISTRY_ADMIT_ID, CRAWL_REGISTRY_ENUMERATE_ID, CRAWL_REGISTRY_ID_PREFIX, CRAWL_REGISTRY_RESOLVE_LINKS_ID, CRAWL_SHARED_GIT_TRACKER_ID, CRAWL_STORE_READ_ID, CRAWL_STORE_WRITE_ID, CRAWL_STRATA, CRAWL_WALKER_GITIGNORE_ID, CRAWL_WALKER_ID, crawlTimingStart, recordContributorInvocation, recordCrawlPass, recordRegistryPass, recordSharedPass, withContributorStratum, withOuterBracket, } from './crawl-timing.js';
+// The three `__*ForTest` seams of the same module are on `./testing`, not here.
+// The on-disk plumbing both timing seams share. Exported because
+// `resources`' `parse-timing.ts` is the other consumer and now sits a package
+// away; nothing else should reach for it.
+export { ensureTimingDirectory, normalizeTimingDirectory, readTimingProcess, writeTimingDump, } from './timing-dump.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,4FAA4F;AAC5F,cAAc,oBAAoB,CAAC;AAEnC,+EAA+E;AAC/E,cAAc,qBAAqB,CAAC;AAEpC,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,4EAA4E;AAC5E,cAAc,qBAAqB,CAAC;AAEpC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,wBAAwB;AACxB,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,gFAAgF;AAChF,kFAAkF;AAClF,yDAAyD;AACzD,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAC;AAUvB,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC;AAEtC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAC9E,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,wEAAwE;AACxE,wCAAwC;AACxC,cAAc,uBAAuB,CAAC;AAEtC,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAChC,mFAAmF;AACnF,cAAc,uBAAuB,CAAC;AACtC,+EAA+E;AAC/E,cAAc,kBAAkB,CAAC;AAEjC,iFAAiF;AACjF,2EAA2E;AAC3E,iFAAiF;AACjF,gEAAgE;AAChE,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,wBAAwB;AACxB,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,iBAAiB;AACjB,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,aAAa;AACb,gFAAgF;AAChF,sBAAsB;AACtB,EAAE;AACF,2EAA2E;AAC3E,iCAAiC;AACjC,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,EAAE;AACF,iFAAiF;AACjF,oEAAoE;AACpE,gFAAgF;AAChF,4BAA4B;AAC5B,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,2DAA2D;AAC3D,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAcvB,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,wEAAwE;AACxE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6CAA6C;AAC7C,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,0EAA0E;AAC1E,6EAA6E;AAC7E,gCAAgC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,4FAA4F;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,gFAAgF;AAEhF,iEAAiE;AACjE,8EAA8E;AAC9E,0CAA0C;AAC1C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EAEjB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/listing-refusal.d.ts

@@ -0,0 +1,112 @@
+/**
+ * What a listing does with a directory it was refused — the vocabulary shared
+ * by the filesystem walk (`file-crawler.ts`) and the git listings
+ * (`git-utils.ts`), so a caller decides ONCE for both routes.
+ *
+ * 🚨 A refused listing is a gap in the POPULATION: every file beneath that
+ * directory the listing would have found was never seen and is absent from
+ * every count downstream. There are exactly two honest answers — stop, with a
+ * sentence the adopter can act on, or keep going and REPORT the gap — and
+ * which one is right is the caller's knowledge, not the crawler's. So the
+ * policy is {@link UnreadablePolicy}, it is REQUIRED wherever a listing is
+ * asked for, and it has no default.
+ *
+ * 🪤 It used to be `onUnreadable?`, an optional callback. Every caller that
+ * ignored it compiled; the two routes then defaulted differently (the walk
+ * threw a programmer-facing sentence, the git route dropped the refusal off
+ * its stderr without a word); and the miss surfaced one review round later as
+ * a HIGH. A required field is what makes `tsc` enumerate the callers.
+ */
+import { VatError } from './errors/vat-error.js';
+import { type DirectoryRefusal } from './fs-utils.js';
+/**
+ * What a caller that STOPS on a refusal tells the person reading the error.
+ *
+ * A caller that has decided to stop — a build that must not ship an incomplete
+ * bundle, a discovery that must not silently find fewer skills — owes the
+ * adopter the directory against the root they know, and the knob THEY have.
+ */
+export interface RefuseListingContext {
+    /**
+     * The root the refused directory is expressed against. An absolute path in
+     * an error is the developer's `$HOME` in every CI log.
+     */
+    root: string;
+    /**
+     * What the adopter can do about it — naming this lane's deliberate-drop
+     * mechanism (`resources.exclude`, a plugin `exclude:`, `--exclude`), which
+     * differs per caller and is why the crawler cannot supply it.
+     */
+    remedy: string;
+}
+/**
+ * The caller's decision about a directory the listing cannot open.
+ *
+ * - `{ refuse }` — STOP: the listing throws {@link DirectoryListingRefusedError}
+ *   with the adopter-facing sentence built from the context. Right for every
+ *   lane whose output is acted on as a complete population (a build, a
+ *   discovery, a fingerprint, a copy).
+ * - `{ degrade }` — KEEP GOING and hand the refusal over. The caller is
+ *   promising to REPORT the gap — as its own finding, with the directory and
+ *   errno the refusal carries — not to drop it. Right for a backstop appended
+ *   to a larger report, where one unlistable directory must not destroy every
+ *   finding beside it.
+ *
+ * A directory that VANISHED between being enumerated and being listed
+ * (`ENOENT` / `ENOTDIR`) is not a refusal under either arm: it is no longer in
+ * the population and is skipped without a call.
+ */
+export type UnreadablePolicy = {
+    readonly refuse: RefuseListingContext;
+} | {
+    readonly degrade: (refusal: DirectoryRefusal) => void;
+};
+/**
+ * Thrown by a listing under `{ refuse }` when a directory refused to be
+ * listed. The message is the adopter's sentence — see {@link refusedListingMessage}.
+ */
+export declare class DirectoryListingRefusedError extends VatError {
+    readonly refusal: DirectoryRefusal;
+    constructor(refusal: DirectoryRefusal, context: RefuseListingContext);
+}
+/**
+ * The adopter-facing sentence: root-relative directory, errno, the gap, and
+ * the caller's remedy — **the one owner of that sentence.**
+ *
+ * Exported so every lane that refuses says the same thing. Three lanes used to
+ * compose this by hand and had drifted by a clause each ("enumerated" /
+ * "scanned" / "the population could not be enumerated"); the transient clause
+ * in particular was written once in `fs-utils.ts` precisely so nobody would.
+ * See {@link REFUSAL_GAP_CLAUSE} for why it asserts nothing about what WAS
+ * enumerated beneath the directory.
+ *
+ * @param refusal - What was refused
+ * @param context - The root to express it against, and what the adopter can do
+ * @returns One sentence, root-relative, never containing the absolute path
+ */
+export declare function refusedListingMessage(refusal: DirectoryRefusal, context: RefuseListingContext): string;
+/**
+ * Apply the caller's policy to one refusal: throw under `{ refuse }`, hand it
+ * over under `{ degrade }`. The single place either route settles a refusal,
+ * so the two cannot drift.
+ *
+ * @param policy - The caller's decision
+ * @param refusal - The directory that could not be listed
+ */
+export declare function settleRefusal(policy: UnreadablePolicy, refusal: DirectoryRefusal): void;
+/**
+ * Refuse an omitted policy up front, by name, before any directory is listed.
+ *
+ * The type already makes `unreadable` required, and that is what enumerates
+ * the TypeScript callers. This is the runtime half, for the callers the type
+ * cannot reach — test files are not typechecked by the build, and a JavaScript
+ * adopter has no compiler at all. Without it an omitted policy would surface
+ * only on the first refusal, as a `TypeError` from the `in` operator, and a
+ * tree with nothing unreadable would keep returning complete lists — the
+ * optional seam back again, one layer down.
+ *
+ * @param policy - What the caller passed as `unreadable`
+ * @param api - The entry point, for the sentence
+ */
+export declare function requireUnreadablePolicy(policy: UnreadablePolicy | undefined, api: string): asserts policy is UnreadablePolicy;
+//# sourceMappingURL=listing-refusal.d.ts.map

package/dist/listing-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listing-refusal.d.ts","sourceRoot":"","sources":["../src/listing-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,KAAK,gBAAgB,EAA0B,MAAM,eAAe,CAAC;AAG9E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GACzC;IAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAA;CAAE,CAAC;AAE9D;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,QAAQ;IACxD,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAEvB,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB;CAIrE;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAOtG;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAGvF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAO7H"}

package/dist/listing-refusal.js

@@ -0,0 +1,105 @@
+/**
+ * What a listing does with a directory it was refused — the vocabulary shared
+ * by the filesystem walk (`file-crawler.ts`) and the git listings
+ * (`git-utils.ts`), so a caller decides ONCE for both routes.
+ *
+ * 🚨 A refused listing is a gap in the POPULATION: every file beneath that
+ * directory the listing would have found was never seen and is absent from
+ * every count downstream. There are exactly two honest answers — stop, with a
+ * sentence the adopter can act on, or keep going and REPORT the gap — and
+ * which one is right is the caller's knowledge, not the crawler's. So the
+ * policy is {@link UnreadablePolicy}, it is REQUIRED wherever a listing is
+ * asked for, and it has no default.
+ *
+ * 🪤 It used to be `onUnreadable?`, an optional callback. Every caller that
+ * ignored it compiled; the two routes then defaulted differently (the walk
+ * threw a programmer-facing sentence, the git route dropped the refusal off
+ * its stderr without a word); and the miss surfaced one review round later as
+ * a HIGH. A required field is what makes `tsc` enumerate the callers.
+ */
+import { VatError } from './errors/vat-error.js';
+import { transientRefusalClause } from './fs-utils.js';
+import { safePath, toForwardSlash } from './path-utils.js';
+/**
+ * Thrown by a listing under `{ refuse }` when a directory refused to be
+ * listed. The message is the adopter's sentence — see {@link refusedListingMessage}.
+ */
+export class DirectoryListingRefusedError extends VatError {
+    refusal;
+    constructor(refusal, context) {
+        super('DIRECTORY_LISTING_REFUSED', refusedListingMessage(refusal, context));
+        this.refusal = refusal;
+    }
+}
+/**
+ * What a refused listing costs, said so it is true on BOTH routes.
+ *
+ * 🪤 It used to read "so nothing beneath it was enumerated: every file there
+ * is in the declared scan". Both halves were the readdir walk's truth and the
+ * git route's lie: `git ls-files --others` reports the refusal while the index
+ * has already named every TRACKED file beneath the directory — the same run
+ * that printed the sentence had scanned one of them — and the projection's
+ * population is the whole non-ignored tree, which no `include`/`exclude`
+ * "declared". What holds on every route is the hazard itself: whatever the
+ * listing would have found and nothing else named is missing, and the shorter
+ * result is indistinguishable from a complete one.
+ */
+const REFUSAL_GAP_CLAUSE = 'any file beneath it that no other listing named is absent from every count, ' +
+    'and the result cannot be told from a complete one';
+/**
+ * The adopter-facing sentence: root-relative directory, errno, the gap, and
+ * the caller's remedy — **the one owner of that sentence.**
+ *
+ * Exported so every lane that refuses says the same thing. Three lanes used to
+ * compose this by hand and had drifted by a clause each ("enumerated" /
+ * "scanned" / "the population could not be enumerated"); the transient clause
+ * in particular was written once in `fs-utils.ts` precisely so nobody would.
+ * See {@link REFUSAL_GAP_CLAUSE} for why it asserts nothing about what WAS
+ * enumerated beneath the directory.
+ *
+ * @param refusal - What was refused
+ * @param context - The root to express it against, and what the adopter can do
+ * @returns One sentence, root-relative, never containing the absolute path
+ */
+export function refusedListingMessage(refusal, context) {
+    const relative = toForwardSlash(safePath.relative(context.root, refusal.directory));
+    const where = relative === '' ? 'the scan root itself' : `the directory '${relative}'`;
+    const remedy = refusal.transient
+        ? `${transientRefusalClause(refusal.code)}, so nothing is wrong with the tree — re-run before investigating anything.`
+        : context.remedy;
+    return `Listing ${where} was refused (${refusal.code}): ${REFUSAL_GAP_CLAUSE}. ${remedy}`;
+}
+/**
+ * Apply the caller's policy to one refusal: throw under `{ refuse }`, hand it
+ * over under `{ degrade }`. The single place either route settles a refusal,
+ * so the two cannot drift.
+ *
+ * @param policy - The caller's decision
+ * @param refusal - The directory that could not be listed
+ */
+export function settleRefusal(policy, refusal) {
+    if ('refuse' in policy)
+        throw new DirectoryListingRefusedError(refusal, policy.refuse);
+    policy.degrade(refusal);
+}
+/**
+ * Refuse an omitted policy up front, by name, before any directory is listed.
+ *
+ * The type already makes `unreadable` required, and that is what enumerates
+ * the TypeScript callers. This is the runtime half, for the callers the type
+ * cannot reach — test files are not typechecked by the build, and a JavaScript
+ * adopter has no compiler at all. Without it an omitted policy would surface
+ * only on the first refusal, as a `TypeError` from the `in` operator, and a
+ * tree with nothing unreadable would keep returning complete lists — the
+ * optional seam back again, one layer down.
+ *
+ * @param policy - What the caller passed as `unreadable`
+ * @param api - The entry point, for the sentence
+ */
+export function requireUnreadablePolicy(policy, api) {
+    if (policy === undefined) {
+        throw new TypeError(`${api}: \`unreadable\` is required — pass { refuse: { root, remedy } } to stop on a directory the listing cannot open, ` +
+            'or { degrade: (refusal) => … } to keep going and report the gap yourself.');
+    }
+}
+//# sourceMappingURL=listing-refusal.js.map

package/dist/listing-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listing-refusal.js","sourceRoot":"","sources":["../src/listing-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAyB,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA4C3D;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,QAAQ;IAC/C,OAAO,CAAmB;IAEnC,YAAY,OAAyB,EAAE,OAA6B;QAClE,KAAK,CAAC,2BAA2B,EAAE,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GACtB,8EAA8E;IAC9E,mDAAmD,CAAC;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAyB,EAAE,OAA6B;IAC5F,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB,QAAQ,GAAG,CAAC;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;QAC9B,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,6EAA6E;QACtH,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACnB,OAAO,WAAW,KAAK,iBAAiB,OAAO,CAAC,IAAI,MAAM,kBAAkB,KAAK,MAAM,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAwB,EAAE,OAAyB;IAC/E,IAAI,QAAQ,IAAI,MAAM;QAAE,MAAM,IAAI,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoC,EAAE,GAAW;IACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,GAAG,GAAG,mHAAmH;YACvH,2EAA2E,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/path-containment.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `isUnderRoot` — the containment question a SINK asks.
+ *
+ * A delete, a copy, an uninstall: each takes a path that somebody else spelled
+ * (a manifest's `name:`, a `flatSkills` entry, a positional the user typed) and
+ * is about to act on `join(root, that)`. The question is whether the action
+ * lands inside the root, and the only honest answer comes from the
+ * filesystem: `startsWith('..')` on a lexical `relative()` misses a symlink
+ * inside the root that points out, refuses a member named `..cache`, and is
+ * blind to a drive letter — the sweep behind this module watched all three
+ * happen at exit 0.
+ *
+ * Both sides are canonicalized the same way, through the deepest existing
+ * ancestor, so a root reached through a symlink (macOS `/tmp`, a linked
+ * `~/.claude`) still contains its members, and a candidate that does not exist
+ * yet is judged by where creating it would land. Absence is reported as its
+ * own answer rather than folded into either side, because a delete sink and a
+ * create sink want opposite things from it.
+ *
+ * Lexical classification of an already-relative path — a projection identity,
+ * a report relativizer — is a different question with a different helper:
+ * `relativeEscapesRoot` in `path-core.ts`, which touches no filesystem.
+ */
+/**
+ * Where a candidate stands relative to a root, as the filesystem sees it.
+ *
+ * - `inside` — the candidate exists and its realpath is a STRICT descendant of
+ *   the root's realpath. A delete or copy may proceed.
+ * - `outside` — its realpath (or, when it does not exist, the realpath of its
+ *   deepest existing ancestor with the missing remainder re-appended) is not
+ *   under the root. The root itself is `outside` too: nothing is under itself,
+ *   and a sink that could delete its own root has no business here.
+ * - `absent` — nothing exists at the candidate, and creating it would land
+ *   inside the root. A create sink proceeds; a delete sink has nothing to do.
+ */
+export type Containment = 'inside' | 'outside' | 'absent';
+/**
+ * Is `candidate` strictly under `root`, as the filesystem judges it?
+ *
+ * Both paths may be relative (resolved from cwd) or absolute, in either
+ * separator; neither has to exist. See {@link Containment} for the three
+ * answers and which sinks accept which.
+ *
+ * ⚠️ Costs one `lstat` per missing component plus two `realpath`s. That is
+ * nothing for a sink — a delete or a copy dwarfs it — and too much for a loop
+ * over every link in a corpus, which is why the projection and link lanes
+ * classify lexically with `relativeEscapesRoot` and never call this.
+ *
+ * @param root - The directory the action must stay inside
+ * @param candidate - The path the action is about to touch
+ * @returns `'inside'`, `'outside'`, or `'absent'`
+ * @throws When the OS refuses to examine either path for any reason but
+ *   absence — a refusal is reported, never read as "not there"
+ *
+ * @example
+ * // A delete sink: only an existing, contained target may go.
+ * if (isUnderRoot(skillsDir, target) !== 'inside') throw new Error(`refusing to remove ${target}: not inside ${skillsDir}`);
+ * await rm(target, { recursive: true, force: true });
+ *
+ * // A create sink: absent-but-contained is exactly the happy path.
+ * if (isUnderRoot(skillsDir, dest) === 'outside') throw new Error(`refusing to install to ${dest}: not inside ${skillsDir}`);
+ */
+export declare function isUnderRoot(root: string, candidate: string): Containment;
+//# sourceMappingURL=path-containment.d.ts.map

package/dist/path-containment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-containment.d.ts","sourceRoot":"","sources":["../src/path-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAkD1D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAQxE"}

package/dist/path-containment.js

@@ -0,0 +1,111 @@
+/**
+ * `isUnderRoot` — the containment question a SINK asks.
+ *
+ * A delete, a copy, an uninstall: each takes a path that somebody else spelled
+ * (a manifest's `name:`, a `flatSkills` entry, a positional the user typed) and
+ * is about to act on `join(root, that)`. The question is whether the action
+ * lands inside the root, and the only honest answer comes from the
+ * filesystem: `startsWith('..')` on a lexical `relative()` misses a symlink
+ * inside the root that points out, refuses a member named `..cache`, and is
+ * blind to a drive letter — the sweep behind this module watched all three
+ * happen at exit 0.
+ *
+ * Both sides are canonicalized the same way, through the deepest existing
+ * ancestor, so a root reached through a symlink (macOS `/tmp`, a linked
+ * `~/.claude`) still contains its members, and a candidate that does not exist
+ * yet is judged by where creating it would land. Absence is reported as its
+ * own answer rather than folded into either side, because a delete sink and a
+ * create sink want opposite things from it.
+ *
+ * Lexical classification of an already-relative path — a projection identity,
+ * a report relativizer — is a different question with a different helper:
+ * `relativeEscapesRoot` in `path-core.ts`, which touches no filesystem.
+ */
+import { lstatSync } from 'node:fs';
+import path from 'node:path';
+import { isPathAbsentError } from './errors/errno.js';
+import { normalizePath, safePath, toForwardSlash } from './path-utils.js';
+/**
+ * The canonical spelling of `target`, from its deepest existing ancestor.
+ *
+ * Walks up until `lstat` answers, canonicalizes THAT with the same realpath
+ * every path helper uses, and re-appends the missing tail. A refusal is not
+ * an absence: `EACCES` on an ancestor, `ELOOP` on a cycle, an invalid name —
+ * the OS is saying it cannot examine the path, and a containment verdict
+ * built on the spelling it refused is the bug this module exists to remove.
+ * Those stay loud.
+ *
+ * `lstat` rather than `stat`, so a dangling symlink counts as existing: it is
+ * an entry the sink can act on (a delete removes the link), and its realpath
+ * failing is answered by {@link normalizePath} with the lexical spelling, which
+ * is where the entry is.
+ */
+function canonicalFromAncestor(target) {
+    const absolute = safePath.resolve(target);
+    const missing = [];
+    let candidate = absolute;
+    for (;;) {
+        if (entryExists(candidate)) {
+            return {
+                canonical: safePath.join(toForwardSlash(normalizePath(candidate)), ...missing),
+                exists: missing.length === 0,
+            };
+        }
+        const parent = toForwardSlash(path.dirname(candidate));
+        // Fixpoint at a filesystem root: `dirname` returns its own input, nothing
+        // on the path resolved, and the lexical form is the only answer there is.
+        if (parent === candidate) {
+            return { canonical: absolute, exists: false };
+        }
+        missing.unshift(path.basename(candidate));
+        candidate = parent;
+    }
+}
+/** Whether an entry (a file, a directory, or a link — dangling or not) is at `p`. */
+function entryExists(p) {
+    try {
+        lstatSync(p);
+        return true;
+    }
+    catch (error) {
+        if (isPathAbsentError(error))
+            return false;
+        throw error;
+    }
+}
+/**
+ * Is `candidate` strictly under `root`, as the filesystem judges it?
+ *
+ * Both paths may be relative (resolved from cwd) or absolute, in either
+ * separator; neither has to exist. See {@link Containment} for the three
+ * answers and which sinks accept which.
+ *
+ * ⚠️ Costs one `lstat` per missing component plus two `realpath`s. That is
+ * nothing for a sink — a delete or a copy dwarfs it — and too much for a loop
+ * over every link in a corpus, which is why the projection and link lanes
+ * classify lexically with `relativeEscapesRoot` and never call this.
+ *
+ * @param root - The directory the action must stay inside
+ * @param candidate - The path the action is about to touch
+ * @returns `'inside'`, `'outside'`, or `'absent'`
+ * @throws When the OS refuses to examine either path for any reason but
+ *   absence — a refusal is reported, never read as "not there"
+ *
+ * @example
+ * // A delete sink: only an existing, contained target may go.
+ * if (isUnderRoot(skillsDir, target) !== 'inside') throw new Error(`refusing to remove ${target}: not inside ${skillsDir}`);
+ * await rm(target, { recursive: true, force: true });
+ *
+ * // A create sink: absent-but-contained is exactly the happy path.
+ * if (isUnderRoot(skillsDir, dest) === 'outside') throw new Error(`refusing to install to ${dest}: not inside ${skillsDir}`);
+ */
+export function isUnderRoot(root, candidate) {
+    const rootReal = canonicalFromAncestor(root).canonical;
+    const target = canonicalFromAncestor(candidate);
+    const prefix = rootReal.endsWith('/') ? rootReal : `${rootReal}/`;
+    if (!target.canonical.startsWith(prefix)) {
+        return 'outside';
+    }
+    return target.exists ? 'inside' : 'absent';
+}
+//# sourceMappingURL=path-containment.js.map

package/dist/path-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-containment.js","sourceRoot":"","sources":["../src/path-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAgB1E;;;;;;;;;;;;;;GAcG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,SAAS,CAAC;QACR,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC;gBAC9E,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7C,CAAC"}