@vibe-agent-toolkit/utils 0.2.0-rc.11 → 0.2.0-rc.12

package/dist/tree-change/link-containment.js

@@ -0,0 +1,196 @@
+/**
+ * The rule for a tree whose links are KEPT: none of them may lead outside it.
+ *
+ * A copy that preserves links carries each link's text verbatim, so a link out of the tree
+ * arrives pointing at whatever stands at that path beside the COPY — the installing user's own
+ * files — and every reader of the copy that follows links reads them as the tree's content. So a
+ * tree that came from somewhere VAT does not own (a cloned repository, a directory an operator
+ * installs from) is checked here before anything reads it.
+ */
+import { readdirSync, readlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { fsFaultOf } from '../errors/errno-table.js';
+import { assertUnresolvableLink, withFsFaultSync } from '../errors/fs-fault.js';
+import { VatError } from '../errors/vat-error.js';
+import { requireFollowedStatSync } from '../link-following.js';
+import { canonicalPath, isUnderRoot } from '../path-containment.js';
+import { safePath, toForwardSlash } from '../path-core.js';
+import { COPY_LINK_ESCAPES_SOURCE_CODE } from './followed-walk.js';
+import { hostPlaceKind, walkHostChain } from './host-chain.js';
+import { MAX_LINK_HOPS } from './link-chain.js';
+import { linkTextRefusal } from './link-walk.js';
+/**
+ * Where `candidate` stands relative to `root`, on real paths. The root itself counts as inside
+ * (`isUnderRoot` calls a root `outside` itself, which is right for a sink and wrong here).
+ *
+ * @param root - The tree
+ * @param candidate - A path in any spelling, existing or not
+ */
+export function treeContainment(root, candidate) {
+    if (canonicalPath(candidate, root) === canonicalPath(root, root))
+        return 'inside';
+    return isUnderRoot(root, candidate);
+}
+/**
+ * Where `path` leads in an UNTRUSTED tree, read link by link by the one resolver — `lstat` and
+ * `readlink` alone — before anything resolves it: an absolute, drive-relative or network text on
+ * the way (under either flavor: the tree may be read on the other host), a climb above `root`,
+ * or a chain longer than the hop limit that is not a cycle, is refused; a cycle leads to
+ * nothing, as a dangling link does; nothing outside `root` is probed.
+ *
+ * @param root - The tree, spelled as `path` spells it (its own components are never probed)
+ * @param path - A path below it (a link, or a subpath the operator named)
+ * @param flavor - Whose kernel will resolve it: bound from the host at the edge
+ * @throws The raw errno of an `lstat` or `readlink` the OS refused, for the caller to classify
+ */
+export function treeChain(root, path, flavor) {
+    return walkHostChain(path, { flavor, root: safePath.resolve(root), outside: 'refuse' });
+}
+/** The refusal of the link at `link`, named relative to the tree as the filesystem spells it. */
+function linkRefusal(check, link, what) {
+    return new VatError(COPY_LINK_ESCAPES_SOURCE_CODE, `Refusing ${check.tree}: ${safePath.relative(canonicalPath(check.root, check.root), link)} is a symbolic link ${what}. ` +
+        `${check.consequence} — replace the link with the files, or point it inside with a relative target.`);
+}
+/** How a refused chain reads, after "is a symbolic link "; `text` is the link's own. */
+function describedChainRefusal(check, text, refusal) {
+    switch (refusal.why) {
+        case 'network':
+        case 'absolute':
+        case 'drive-relative':
+            return `whose target leads through an absolute path (${refusal.text}), which names a place outside ${check.within}`;
+        case 'climbs-out':
+            return `to a path outside ${check.within} (${text})`;
+        case 'hop-limit':
+            return `whose target starts a chain of more than ${MAX_LINK_HOPS.toString()} symbolic links that is not a cycle, so where it ends cannot be shown`;
+        case 'unportable':
+            return `whose target names a component no Windows host can spell (${refusal.text}): a NUL, or a name ending in a dot or a space that Windows strips`;
+    }
+}
+/** How each refusal of a link's text reads, after "is a symbolic link ". */
+function describedRefusal(check, text, refusal) {
+    switch (refusal.why) {
+        case 'absolute':
+            return `with an absolute target (${text}), which would still point there once ${check.within} is copied`;
+        case 'climbs-out':
+            return `to a path outside ${check.within} (${text})`;
+        case 'through-link':
+            return `whose target passes through another symbolic link (${refusal.at}), so where ${text} leads depends on where ${check.within} is copied`;
+        case 'dangling':
+            return `to nothing (${refusal.at} does not exist), so where it would lead once ${check.within} is copied cannot be shown`;
+    }
+}
+/**
+ * The last lock on a link of a tree that will be relocated: the KERNEL's resolution of it, at
+ * the source, must exist and be inside the tree. Asked only once the chain from the link has been
+ * read and shown local ({@link treeChain}). The walk of the text ({@link linkTextRefusal}) shows
+ * the text stays inside wherever the tree goes; this shows the walk's reading of the text is the
+ * kernel's. A probe that failed because the link resolves to nothing
+ * (`isUnresolvableLinkError`: it dangles, it is part of a cycle, Windows cannot follow its reparse
+ * data) is a refusal of the link on every host: nothing can be shown about where it leads. Every
+ * other failure — the OS declining (`EACCES`, `EPERM`), running short (`EMFILE`), held (`EBUSY`) or
+ * unable to look (`EIO`, `ETIMEDOUT`, Windows' ambiguous `UNKNOWN`) — says nothing about the link:
+ * a fault on the tree, thrown classified by the one write-lane catch body
+ * (`assertUnresolvableLink`, on the side the caller names in `check.side`, found as content).
+ *
+ * Exported apart from the walk so the lock can be shown to hold ALONE: with a correct walk, a
+ * link the kernel resolves outside never reaches it from a real tree.
+ *
+ * @param root - The tree, as its canonical path
+ * @param link - The link, spelled by its real directory
+ * @param text - The link's own text, for the refusal
+ * @returns Why the link is refused, after "is a symbolic link ", or `undefined` when the kernel agrees
+ * @throws FsFaultError on `check.side` for a probe that failed for any other reason; an error that carries no errno as it was
+ */
+export function kernelRefusal(check, root, link, text) {
+    try {
+        // Followed to the end, as a reader of the link would: this fails where the kernel finds nothing.
+        requireFollowedStatSync(link, root);
+    }
+    catch (error) {
+        const fault = fsFaultOf(error);
+        if (fault === undefined)
+            throw error;
+        // The action names the link: a refusal on its chain names the place refused, which may be its target.
+        assertUnresolvableLink(error, { side: check.side, origin: 'content', action: `resolve the symbolic link ${link}`, path: link });
+        return `to nothing (${text} does not resolve: ${fault.errno}), so where it would lead once ${check.within} is copied cannot be shown`;
+    }
+    // It resolves, so its canonical path is its real one.
+    return treeContainment(root, link) === 'inside' ? undefined : `to a path outside ${check.within} (${text} resolves outside it)`;
+}
+/**
+ * Judge the link at `link` under `check.placement` — spelled by its REAL directory, so its text is
+ * read from where the link is, never from an alias of that directory, which reads a climbing text
+ * as staying inside.
+ *
+ * Either way the CHAIN is read first ({@link treeChain}) and the kernel last, so nothing the text
+ * names is resolved until every text on the way has been read. Relocated, the text is walked
+ * through no link before that ({@link linkTextRefusal}) and the kernel is asked after it
+ * ({@link kernelRefusal}); in place, the kernel's real path must be inside.
+ */
+function judgeLink(check, root, link) {
+    const text = readlinkSync(link);
+    if (check.placement === 'relocated') {
+        const below = safePath.relative(root, dirname(link));
+        const textRefusal = linkTextRefusal(below === '' ? [] : toForwardSlash(below).split('/'), text, (place) => hostPlaceKind(safePath.join(root, ...place)), check.flavor);
+        if (textRefusal !== undefined)
+            return { refusal: describedRefusal(check, text, textRefusal) };
+    }
+    const chain = treeChain(root, link, check.flavor);
+    if (chain.kind === 'refused')
+        return { refusal: describedChainRefusal(check, text, chain.refusal) };
+    if (check.placement === 'relocated') {
+        // Every text on the way was read and is local: the kernel may now be asked, as the last lock.
+        const refusal = kernelRefusal(check, root, link, text);
+        if (refusal !== undefined)
+            return { refusal };
+    }
+    else if (chain.kind === 'nothing') {
+        // A dangle or a cycle, every text read: in place it reads nothing.
+        return { enter: undefined };
+    }
+    else if (treeContainment(root, link) === 'outside') {
+        return { refusal: `to a path outside ${check.within}` };
+    }
+    return { enter: chain.kind === 'resolved' && chain.final === 'directory' ? canonicalPath(link, root) : undefined };
+}
+/**
+ * Refuse a tree holding a symbolic link that may not be kept: one leading outside it, and — for a
+ * tree that will be relocated — one whose text cannot be shown to stay inside wherever the tree
+ * goes ({@link LinkContainmentCheck.placement}). Every directory is walked at its REAL path, once: a
+ * link that stays inside is followed to the directory it names, so a link into a sibling cannot
+ * smuggle out a second hop, a link cycle ends, and a directory first reached through an alias still
+ * has its own links judged where they live.
+ *
+ * @param check - The tree, where in it to look, and how the refusal names it
+ * @throws VatError `COPY_LINK_ESCAPES_SOURCE` — the tree's own link, so the input's refusal —
+ *   naming the first link found leading out; FsFaultError on `check.side`, found as content, for
+ *   every probe of the tree the OS refused (a listing, an `lstat`, a `readlink`, a relocated link's
+ *   target)
+ */
+export function refuseEscapingLinks(check) {
+    withFsFaultSync({ side: check.side, origin: 'content', action: `examine the links of ${check.tree}`, path: check.subtree ?? check.root }, () => {
+        const skipped = check.skip === undefined ? undefined : canonicalPath(check.skip, check.root);
+        const visited = new Set();
+        const root = canonicalPath(check.root, check.root);
+        const pending = [canonicalPath(check.subtree ?? check.root, check.root)];
+        for (let dir = pending.pop(); dir !== undefined; dir = pending.pop()) {
+            if (dir === skipped || visited.has(dir))
+                continue;
+            visited.add(dir);
+            for (const entry of readdirSync(dir, { withFileTypes: true })) {
+                const entryPath = safePath.join(dir, entry.name);
+                const next = entry.isSymbolicLink() ? enterOrThrow(check, root, entryPath) : entry.isDirectory() && entryPath;
+                if (typeof next === 'string')
+                    pending.push(next);
+            }
+        }
+    });
+}
+/** The directory a kept link leads to, for the walk to enter; throws the link's refusal. */
+function enterOrThrow(check, root, link) {
+    const verdict = judgeLink(check, root, link);
+    if ('refusal' in verdict)
+        throw linkRefusal(check, link, verdict.refusal);
+    return verdict.enter;
+}
+//# sourceMappingURL=link-containment.js.map

package/dist/tree-change/link-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-containment.js","sourceRoot":"","sources":["../../src/tree-change/link-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAe,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAqC,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAwB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAqCvE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB;IAC7D,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClF,OAAO,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,MAAkB;IACtE,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,KAA2B,EAAE,IAAY,EAAE,IAAY;IAC1E,OAAO,IAAI,QAAQ,CACjB,6BAA6B,EAC7B,YAAY,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,uBAAuB,IAAI,IAAI;QACtH,GAAG,KAAK,CAAC,WAAW,gFAAgF,CACvG,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAA2B,EAAE,IAAY,EAAE,OAAqB;IAC7F,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACpB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,gDAAgD,OAAO,CAAC,IAAI,kCAAkC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtH,KAAK,YAAY;YACf,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC;QACvD,KAAK,WAAW;YACd,OAAO,4CAA4C,aAAa,CAAC,QAAQ,EAAE,uEAAuE,CAAC;QACrJ,KAAK,YAAY;YACf,OAAO,6DAA6D,OAAO,CAAC,IAAI,oEAAoE,CAAC;IACzJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,KAA2B,EAAE,IAAY,EAAE,OAAwB;IAC3F,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,4BAA4B,IAAI,yCAAyC,KAAK,CAAC,MAAM,YAAY,CAAC;QAC3G,KAAK,YAAY;YACf,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC;QACvD,KAAK,cAAc;YACjB,OAAO,sDAAsD,OAAO,CAAC,EAAE,eAAe,IAAI,2BAA2B,KAAK,CAAC,MAAM,YAAY,CAAC;QAChJ,KAAK,UAAU;YACb,OAAO,eAAe,OAAO,CAAC,EAAE,iDAAiD,KAAK,CAAC,MAAM,4BAA4B,CAAC;IAC9H,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,KAA2B,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IACjG,IAAI,CAAC;QACH,iGAAiG;QACjG,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC;QACrC,sGAAsG;QACtG,sBAAsB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChI,OAAO,eAAe,IAAI,sBAAsB,KAAK,CAAC,KAAK,kCAAkC,KAAK,CAAC,MAAM,4BAA4B,CAAC;IACxI,CAAC;IACD,sDAAsD;IACtD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,MAAM,KAAK,IAAI,uBAAuB,CAAC;AAClI,CAAC;AAKD;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAA2B,EAAE,IAAY,EAAE,IAAY;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvK,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACpG,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpC,8FAA8F;QAC9F,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,qBAAqB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACrH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC7I,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;gBAC9G,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,KAA2B,EAAE,IAAY,EAAE,IAAY;IAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,IAAI,OAAO;QAAE,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC"}

package/dist/tree-change/link-walk.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Where a symbolic link's text leads, decided by WALKING it — the rule for a link in a tree that
+ * will be RELOCATED (an install copies the tree, each link's text verbatim). Pure: the caller says
+ * what stands at each place.
+ *
+ * A lexical resolve cancels `x/..` without asking what `x` is, so `l -> up/../../../secret` beside
+ * `up -> ../..` reads as inside the tree while the kernel follows `up` first and lands three
+ * levels above it. And where such a link dangles at the source, its real path proves nothing: it
+ * resolves once the tree is copied somewhere those levels exist. So nothing is assumed:
+ *
+ * - the text is relative — an absolute one points at the same place wherever the copy lands;
+ * - walked one segment at a time from the link's own directory, the place never rises above the
+ *   tree's root — not even to come back in by the tree's own name, which the copy may not keep;
+ * - no component the walk passes THROUGH is a link: a link may point at something, never through
+ *   another link, whose own text decides where the rest of the walk goes;
+ * - the place it ends at exists. A link that dangles is refused, because nothing can be proved
+ *   about where it lands after the copy.
+ *
+ * The walk is a MODEL of the kernel's resolution, and a model can be wrong (it once split a text
+ * on a backslash the POSIX kernel reads as part of a name). So its caller holds two more locks
+ * beside it — the one link-chain resolver (`link-chain.ts`), which reads the chain from the link to
+ * its end before anything follows it, and then the kernel's own resolution of the link at the
+ * source — and a link is kept only when all three agree.
+ */
+import type { PathFlavor, PlaceKind } from './link-chain.js';
+/** Why a link's text is refused, with the place (root-relative, `/`-joined) the walk stopped at. */
+export type LinkTextRefusal = {
+    readonly why: 'absolute';
+} | {
+    readonly why: 'climbs-out';
+} | {
+    readonly why: 'through-link';
+    readonly at: string;
+} | {
+    readonly why: 'dangling';
+    readonly at: string;
+};
+/**
+ * Walk a link's text from the directory the link is in.
+ *
+ * @param linkDir - The link's REAL directory, as segments below the tree's root (`[]`: the root itself)
+ * @param text - The link's text, verbatim
+ * @param kindAt - What stands at a place below the root, never following a link there
+ * @param flavor - Whose kernel resolves the link: its separators split the text
+ * @returns `undefined` when the text leads to something that exists inside the tree, by a walk
+ *   that passes through no link; otherwise why it is refused
+ */
+export declare function linkTextRefusal(linkDir: readonly string[], text: string, kindAt: (place: readonly string[]) => PlaceKind, flavor: PathFlavor): LinkTextRefusal | undefined;
+//# sourceMappingURL=link-walk.d.ts.map

package/dist/tree-change/link-walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-walk.d.ts","sourceRoot":"","sources":["../../src/tree-change/link-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE7D,oGAAoG;AACpG,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAgBtD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,SAAS,CAiB1K"}

package/dist/tree-change/link-walk.js

@@ -0,0 +1,69 @@
+/**
+ * Where a symbolic link's text leads, decided by WALKING it — the rule for a link in a tree that
+ * will be RELOCATED (an install copies the tree, each link's text verbatim). Pure: the caller says
+ * what stands at each place.
+ *
+ * A lexical resolve cancels `x/..` without asking what `x` is, so `l -> up/../../../secret` beside
+ * `up -> ../..` reads as inside the tree while the kernel follows `up` first and lands three
+ * levels above it. And where such a link dangles at the source, its real path proves nothing: it
+ * resolves once the tree is copied somewhere those levels exist. So nothing is assumed:
+ *
+ * - the text is relative — an absolute one points at the same place wherever the copy lands;
+ * - walked one segment at a time from the link's own directory, the place never rises above the
+ *   tree's root — not even to come back in by the tree's own name, which the copy may not keep;
+ * - no component the walk passes THROUGH is a link: a link may point at something, never through
+ *   another link, whose own text decides where the rest of the walk goes;
+ * - the place it ends at exists. A link that dangles is refused, because nothing can be proved
+ *   about where it lands after the copy.
+ *
+ * The walk is a MODEL of the kernel's resolution, and a model can be wrong (it once split a text
+ * on a backslash the POSIX kernel reads as part of a name). So its caller holds two more locks
+ * beside it — the one link-chain resolver (`link-chain.ts`), which reads the chain from the link to
+ * its end before anything follows it, and then the kernel's own resolution of the link at the
+ * source — and a link is kept only when all three agree.
+ */
+/**
+ * What separates the components of a link's text is the answer of the kernel that resolves it,
+ * not VAT's. On POSIX only `/` does — a backslash is an ordinary character of a name, so `a\b` is
+ * one component, and reading it as two would count a `..` the kernel never takes.
+ */
+const SEPARATOR = { posix: /\//, win32: /[/\\]/ };
+/** A POSIX root, a UNC root or a drive prefix: absolute, or drive-relative, on some host. */
+const ABSOLUTE = /^([/\\]|[A-Za-z]:)/;
+/** The components of a link's text, as `flavor` splits it: `.` and empty ones dropped. */
+function segmentsOf(text, flavor) {
+    return text.split(SEPARATOR[flavor]).filter((segment) => segment !== '' && segment !== '.');
+}
+/**
+ * Walk a link's text from the directory the link is in.
+ *
+ * @param linkDir - The link's REAL directory, as segments below the tree's root (`[]`: the root itself)
+ * @param text - The link's text, verbatim
+ * @param kindAt - What stands at a place below the root, never following a link there
+ * @param flavor - Whose kernel resolves the link: its separators split the text
+ * @returns `undefined` when the text leads to something that exists inside the tree, by a walk
+ *   that passes through no link; otherwise why it is refused
+ */
+export function linkTextRefusal(linkDir, text, kindAt, flavor) {
+    if (ABSOLUTE.test(text))
+        return { why: 'absolute' };
+    const segments = segmentsOf(text, flavor);
+    const place = [...linkDir];
+    for (const [index, segment] of segments.entries()) {
+        if (segment === '..') {
+            // Every place the walk stands at is a real directory of the tree, so its parent is `place` less one.
+            if (place.pop() === undefined)
+                return { why: 'climbs-out' };
+            continue;
+        }
+        place.push(segment);
+        const kind = kindAt(place);
+        const last = index === segments.length - 1;
+        if (kind === 'absent' || (!last && kind === 'file'))
+            return { why: 'dangling', at: place.join('/') };
+        if (!last && kind === 'link')
+            return { why: 'through-link', at: place.join('/') };
+    }
+    return undefined;
+}
+//# sourceMappingURL=link-walk.js.map

package/dist/tree-change/link-walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-walk.js","sourceRoot":"","sources":["../../src/tree-change/link-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAWH;;;;GAIG;AACH,MAAM,SAAS,GAAyC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACxF,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC,0FAA0F;AAC1F,SAAS,UAAU,CAAC,IAAY,EAAE,MAAkB;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,IAAY,EAAE,MAA+C,EAAE,MAAkB;IAC3I,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,qGAAqG;YACrG,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tree-change/plan.d.ts

@@ -0,0 +1,206 @@
+/**
+ * The plan half of the tree-change primitive: every destructive verb describes
+ * what it wants as {@link TreeChange}s, and {@link planTreeChanges} decides, with
+ * no side effect, what will actually happen to each — before anything is written.
+ *
+ * The decisions, in order:
+ *
+ * 1. **What is there** at each destination (`lstat`; a destination the OS refuses
+ *    to examine throws, classified `destination`; "absent" is believed only when
+ *    the parent's listing agrees).
+ * 2. **Keep.** A `remove` with nothing there, or whose `keepIfSameAs` names an
+ *    entry that is `same` **or `unknown`** to it, is kept, with the reason. Only
+ *    the target's own unexaminability throws, never a sibling's. A `remove` that
+ *    holds a kept entry (or cannot be proven not to) is kept too: a kept entry is
+ *    kept whole, never taken away with a directory above it.
+ * 3. **Aliasing and containment, by identity.** A `remove` that is the same entry
+ *    as a `replace` (`plugins/Old` and `plugins/old` on APFS or NTFS, a link and its
+ *    target), or an earlier `remove`, or lies inside any other change's
+ *    destination, is `subsumed`: that change parks it. `unknown` is never a merge
+ *    and never a refusal — the two changes run as two, and a wrong guess fails the
+ *    apply, which rolls back; refusing would refuse every change on a filesystem
+ *    that reports `ino` 0. Any other two changes still active whose destinations
+ *    are one entry or nest are refused ({@link TREE_DESTS_OVERLAP_CODE}): the
+ *    calling verb's defect, never the user's input.
+ * 4. **Ownership** of whatever is there: `must-be-free` refuses anything but an
+ *    empty directory ({@link TREE_DEST_OCCUPIED_CODE}); `vat-made` refuses what its
+ *    `recognise` disowns ({@link TREE_DEST_NOT_OWNED_CODE}); `force` and
+ *    `vat-state` take anything — except that a `replace-file` never takes a directory
+ *    (or a link to one), under any ownership ({@link TREE_DEST_OCCUPIED_CODE}).
+ * 5. **Holding.** A `copy` source, or a `write` fill's declared `reads`, that is the
+ *    destination or inside it ({@link TREE_DEST_HOLDS_SOURCE_CODE}: the replace
+ *    would delete it — never asked of a destination that is a link, which holds
+ *    nothing: only the link is parked), or that holds the destination
+ *    ({@link TREE_SOURCE_HOLDS_DEST_CODE}: a copy into itself), is refused.
+ * 6. **Readable source.** Every `copy` source is proven readable (the one
+ *    special-file and link policy, `proveTreeReadable`, on the fill's declared `side`).
+ *
+ * Utils names no refusal code: these are library codes, and the CLI's refusal map
+ * decides which refusal each is.
+ */
+import { type FsSide } from '../errors/fs-fault.js';
+import type { EntryContainment, EntrySameness } from './identity-compare.js';
+import type { LinkPolicy } from './tree-walk.js';
+/** A destination that must be absent or an empty directory already holds something. */
+export declare const TREE_DEST_OCCUPIED_CODE = "TREE_DEST_OCCUPIED";
+/** A destination VAT may replace only when it made it holds something its recogniser disowns. */
+export declare const TREE_DEST_NOT_OWNED_CODE = "TREE_DEST_NOT_OWNED";
+/**
+ * Two changes of one plan whose destinations are one entry or nest (other than a remove the other
+ * change takes with it): they cannot be one transaction — the outer park would carry the inner
+ * change's staging away. The calling verb built a plan it must not, so it is VAT's defect.
+ */
+export declare const TREE_DESTS_OVERLAP_CODE = "TREE_DESTS_OVERLAP";
+/** A copy's destination lies inside its source: the copy would copy into itself. */
+export declare const TREE_SOURCE_HOLDS_DEST_CODE = "TREE_SOURCE_HOLDS_DEST";
+/** A copy's source is its destination or lies inside it: the replace would delete what it copies. */
+export declare const TREE_DEST_HOLDS_SOURCE_CODE = "TREE_DEST_HOLDS_SOURCE";
+/** What a recogniser says about a destination that is there. */
+export type OwnershipVerdict = {
+    readonly owned: true;
+} | {
+    readonly owned: false;
+    readonly reason: string;
+};
+/** Who may lose whatever is at a destination. */
+export type Ownership = 
+/** Only an absent destination or an empty directory; anything else is refused. */
+{
+    readonly kind: 'must-be-free';
+}
+/** The user said `--force`: whatever is there may go. */
+ | {
+    readonly kind: 'force';
+}
+/** Something VAT made before, as `recognise` judges it; anything else is refused. */
+ | {
+    readonly kind: 'vat-made';
+    readonly recognise: (dest: string) => OwnershipVerdict;
+}
+/** State VAT owns outright (a cache, a marketplace under `~/.claude`, `dist/`). */
+ | {
+    readonly kind: 'vat-state';
+};
+/** How a replacement tree is made, in a staged place beside its destination. */
+export type TreeFill = 
+/**
+ * `copy` copies `source` by the readable-tree walk. `side` is the side of the verb `source` is on — an input
+ * (`source`), VAT's staging (`environment`), or a copy already made into user state (`destination`) — and
+ * every read of it, by the proof and by the copy, is classified on it. Required: only the caller knows.
+ */
+{
+    readonly from: 'copy';
+    readonly source: string;
+    readonly side: FsSide;
+    readonly links: LinkPolicy;
+    readonly filter?: (relative: string) => boolean;
+}
+/** `write` fills the empty staged directory; `reads` are the inputs it reads, held to the same holding check as a copy source. */
+ | {
+    readonly from: 'write';
+    readonly write: (staged: string) => Promise<void>;
+    readonly reads?: readonly string[];
+}
+/** The staged entry is a link to `target` (a `--dev` lane). */
+ | {
+    readonly from: 'link';
+    readonly target: string;
+};
+/**
+ * A `replace-file`'s bytes: given, or made when the file is staged. Staging runs in the plan's order, so a
+ * function is called only after every earlier change of the plan has staged — a file made FROM a tree the
+ * same plan stages (an archive of a staged bundle) is one change of that plan, not a second transaction.
+ */
+export type FileContents = string | Uint8Array | (() => string | Uint8Array);
+/** One change a verb wants. `label` names it in the dry run and in every message. */
+export type TreeChange = {
+    readonly op: 'replace';
+    readonly dest: string;
+    readonly ownership: Ownership;
+    readonly fill: TreeFill;
+    readonly label: string;
+} | {
+    readonly op: 'replace-file';
+    readonly dest: string;
+    readonly ownership: Ownership;
+    readonly contents: FileContents;
+    readonly label: string;
+} | {
+    readonly op: 'remove';
+    readonly dest: string;
+    readonly ownership: Ownership;
+    readonly keepIfSameAs?: () => readonly string[];
+    readonly label: string;
+};
+/** What is at a destination. */
+export type EntryKind = 'absent' | 'directory' | 'file' | 'link' | 'special';
+/** What will happen to a destination. */
+export type PlannedAction = 'create' | 'replace' | 'remove' | 'keep' | 'subsumed';
+/** One change, decided. */
+export interface PlannedChange {
+    readonly change: TreeChange;
+    readonly existing: EntryKind;
+    readonly action: PlannedAction;
+    /** Why it is kept or subsumed. */
+    readonly reason?: string;
+    /**
+     * Set on a remove kept because the OS refused to examine an entry it may be (its `keepIfSameAs`):
+     * that entry. A caller that drops its own record of the kept entry names it, so the user can tell
+     * what stayed and why (ruling R7 d-I-1: never delete what may BE a kept sibling).
+     */
+    readonly unexaminedSibling?: string;
+}
+/** Every change, decided; `describe()` is the dry run, one line per change. */
+export interface TreePlan {
+    readonly changes: readonly PlannedChange[];
+    describe(): readonly string[];
+}
+/** The filesystem facts the planner decides by: live in {@link planTreeChanges}, faked in its unit test. */
+export interface PlanFacts {
+    /** What is at `dest`; throws when the OS refuses to examine it. */
+    readonly existing: (dest: string) => EntryKind;
+    readonly isEmptyDirectory: (dest: string) => boolean;
+    /** Whether the link at `dest` leads to a directory (false for a dangling link, or one to a file). */
+    readonly linksToDirectory: (dest: string) => boolean;
+    readonly sameEntry: (a: string, b: string) => EntrySameness;
+    readonly isInside: (child: string, ancestor: string) => EntryContainment;
+    /** Throws when the OS refuses to examine `dest`'s identity: a remove's own unexaminability is never a keep. */
+    readonly requireExaminable: (dest: string) => void;
+    /** Whether the OS refuses to examine `entry`'s identity (an `unknown` that is a refusal, not a fold that cannot tell). */
+    readonly refusesToExamine: (entry: string) => boolean;
+}
+/** Whether a planned change touches its destination (`keep` and `subsumed` do not). */
+export declare const isActive: ({ action }: PlannedChange) => boolean;
+/**
+ * The pure planner: every decision of {@link planTreeChanges} but the source
+ * proof, made from `facts`.
+ *
+ * @throws VatError coded `TREE_DESTS_OVERLAP` (a defect in the caller's plan), `TREE_DEST_OCCUPIED`,
+ *   `TREE_DEST_NOT_OWNED`, `TREE_DEST_HOLDS_SOURCE` or `TREE_SOURCE_HOLDS_DEST`; whatever `facts` throws
+ */
+export declare function planFromFacts(changes: readonly TreeChange[], facts: PlanFacts): TreePlan;
+/**
+ * What is at `dest` NOW, for the apply to hold against what the plan decided
+ * (`changedSincePlan`). The emptiness of a directory is read only where the plan took it as free.
+ *
+ * @throws FsFaultError side `destination` when the OS refuses to examine or list it
+ */
+export declare function destinationNow(dest: string, planned: PlannedChange): {
+    kind: EntryKind;
+    emptyDirectory: boolean;
+};
+/**
+ * Decide every change against the filesystem as it is, with no side effect. Each
+ * destination is taken in its canonical spelling (`safePath.resolve`: absolute,
+ * `.`/`..` resolved, forward slashes); `describe()` prints that spelling.
+ * Hand the result to `applyTreePlan`; print `describe()` for a dry run — the two
+ * cannot disagree, because the apply does exactly what the plan says.
+ *
+ * @param changes - What the verb wants, in the order it wants it
+ * @throws VatError coded `TREE_DEST_OCCUPIED`, `TREE_DEST_NOT_OWNED`,
+ *   `TREE_DEST_HOLDS_SOURCE` or `TREE_SOURCE_HOLDS_DEST`; `FsFaultError` side
+ *   `destination` for a destination the OS refuses to examine, on the fill's
+ *   declared side for a copy source it refuses to read
+ */
+export declare function planTreeChanges(changes: readonly TreeChange[]): Promise<TreePlan>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/tree-change/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/tree-change/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAA+B,KAAK,MAAM,EAAmB,MAAM,uBAAuB,CAAC;AAMlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,gEAAgE;AAChE,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7G,iDAAiD;AACjD,MAAM,MAAM,SAAS;AACnB,kFAAkF;AAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE;AACnC,yDAAyD;GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5B,qFAAqF;GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,CAAA;CAAE;AACvF,mFAAmF;GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnC,gFAAgF;AAChF,MAAM,MAAM,QAAQ;AAClB;;;;GAIG;AACD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;CAAE;AACxJ,kIAAkI;GAChI;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AACnH,+DAA+D;GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,CAAC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC;AAE7E,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjI;IAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9I;IAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7J,gCAAgC;AAChC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7E,yCAAyC;AACzC,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAElF,2BAA2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,QAAQ,IAAI,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,4GAA4G;AAC5G,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,qGAAqG;IACrG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC;IAC5D,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACzE,+GAA+G;IAC/G,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,0HAA0H;IAC1H,QAAQ,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACvD;AA8DD,uFAAuF;AACvF,eAAO,MAAM,QAAQ,GAAI,YAAY,aAAa,KAAG,OAA6E,CAAC;AAsFnI;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAYxF;AA8BD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAIjH;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOvF"}