@warlock.js/ai-workspace 4.5.0

package/esm/tools/schema.mjs

@@ -0,0 +1,111 @@
+//#region ../@warlock.js/ai-workspace/src/tools/schema.ts
+/**
+* Tiny, dependency-free [Standard Schema](https://standardschema.dev)
+* builders for the workspace tools' input validation. The package pins
+* only `@warlock.js/ai` and `@warlock.js/fs` as runtime dependencies, so
+* rather than pull in a schema library we hand-roll the few shapes the
+* file tools need — exactly the pattern `@warlock.js/ai`'s own `tool()`
+* tests use. Each builder returns a `StandardSchemaV1`, which is what
+* `tool({ input })` validates against before calling `execute`.
+*
+* These intentionally cover only the primitive cases the FILE tools
+* require (`string`, `optional string`, `optional number`, `optional
+* boolean`, and an `object` of fields). They are not a general-purpose
+* validator.
+*/
+/** The vendor tag stamped on every issue these builders produce. */
+const VENDOR = "ai-workspace";
+/** Required string field — rejects anything that is not a string. */
+function stringField() {
+	return (value, key) => {
+		if (typeof value === "string") return { value };
+		return { issues: [{
+			message: `"${key}" must be a string`,
+			path: [key]
+		}] };
+	};
+}
+/**
+* Optional string field — accepts `undefined` (the property absent or
+* explicitly undefined) or a string, and rejects every other type.
+*/
+function optionalStringField() {
+	return (value, key) => {
+		if (value === void 0) return { value: void 0 };
+		if (typeof value === "string") return { value };
+		return { issues: [{
+			message: `"${key}" must be a string when provided`,
+			path: [key]
+		}] };
+	};
+}
+/**
+* Optional finite-number field — accepts `undefined` or a finite number,
+* rejecting `NaN`/`Infinity` and non-number types.
+*/
+function optionalNumberField() {
+	return (value, key) => {
+		if (value === void 0) return { value: void 0 };
+		if (typeof value === "number" && Number.isFinite(value)) return { value };
+		return { issues: [{
+			message: `"${key}" must be a finite number when provided`,
+			path: [key]
+		}] };
+	};
+}
+/** Optional boolean field — accepts `undefined` or a boolean. */
+function optionalBooleanField() {
+	return (value, key) => {
+		if (value === void 0) return { value: void 0 };
+		if (typeof value === "boolean") return { value };
+		return { issues: [{
+			message: `"${key}" must be a boolean when provided`,
+			path: [key]
+		}] };
+	};
+}
+/**
+* Build a {@link StandardSchemaV1} for a flat object whose every property
+* is validated by a {@link FieldValidator}. The input must be a non-null
+* object; each declared field is validated and the (possibly coerced)
+* values are collected into the typed result. All field issues are merged
+* so the caller sees every problem at once.
+*
+* `T` is constrained to `object` rather than `Record<string, unknown>` so
+* the tool IO `interface`s (which carry no implicit string index
+* signature) satisfy it directly — only the declared keys in `shape` are
+* ever read, so a string index signature is never required.
+*
+* @example
+* const schema = objectSchema<{ path: string; limit?: number }>({
+*   path: stringField(),
+*   limit: optionalNumberField(),
+* });
+*/
+function objectSchema(shape) {
+	return { "~standard": {
+		version: 1,
+		vendor: VENDOR,
+		validate(input) {
+			if (typeof input !== "object" || input === null || Array.isArray(input)) return { issues: [{ message: "input must be an object" }] };
+			const source = input;
+			const issues = [];
+			const result = {};
+			for (const key of Object.keys(shape)) {
+				const field = shape[key];
+				const outcome = field(source[key], key);
+				if ("issues" in outcome) {
+					issues.push(...outcome.issues);
+					continue;
+				}
+				if (outcome.value !== void 0) result[key] = outcome.value;
+			}
+			if (issues.length > 0) return { issues };
+			return { value: result };
+		}
+	} };
+}
+
+//#endregion
+export { objectSchema, optionalBooleanField, optionalNumberField, optionalStringField, stringField };
+//# sourceMappingURL=schema.mjs.map

package/esm/tools/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":[],"sources":["../../../../../../../@warlock.js/ai-workspace/src/tools/schema.ts"],"sourcesContent":["import type { StandardSchemaV1 } from \"@standard-schema/spec\";\n\n/**\n * Tiny, dependency-free [Standard Schema](https://standardschema.dev)\n * builders for the workspace tools' input validation. The package pins\n * only `@warlock.js/ai` and `@warlock.js/fs` as runtime dependencies, so\n * rather than pull in a schema library we hand-roll the few shapes the\n * file tools need — exactly the pattern `@warlock.js/ai`'s own `tool()`\n * tests use. Each builder returns a `StandardSchemaV1`, which is what\n * `tool({ input })` validates against before calling `execute`.\n *\n * These intentionally cover only the primitive cases the FILE tools\n * require (`string`, `optional string`, `optional number`, `optional\n * boolean`, and an `object` of fields). They are not a general-purpose\n * validator.\n */\n\n/** The vendor tag stamped on every issue these builders produce. */\nconst VENDOR = \"ai-workspace\";\n\n/**\n * A single field validator inside {@link objectSchema}: given a value,\n * return either the coerced value or a list of issues. Field validators\n * receive the raw property and the property name (for issue messages).\n */\ntype FieldValidator<T> = (\n  value: unknown,\n  key: string,\n) => { value: T } | { issues: StandardSchemaV1.Issue[] };\n\n/** Required string field — rejects anything that is not a string. */\nexport function stringField(): FieldValidator<string> {\n  return (value, key) => {\n    if (typeof value === \"string\") {\n      return { value };\n    }\n\n    return { issues: [{ message: `\"${key}\" must be a string`, path: [key] }] };\n  };\n}\n\n/**\n * Optional string field — accepts `undefined` (the property absent or\n * explicitly undefined) or a string, and rejects every other type.\n */\nexport function optionalStringField(): FieldValidator<string | undefined> {\n  return (value, key) => {\n    if (value === undefined) {\n      return { value: undefined };\n    }\n\n    if (typeof value === \"string\") {\n      return { value };\n    }\n\n    return {\n      issues: [{ message: `\"${key}\" must be a string when provided`, path: [key] }],\n    };\n  };\n}\n\n/**\n * Optional finite-number field — accepts `undefined` or a finite number,\n * rejecting `NaN`/`Infinity` and non-number types.\n */\nexport function optionalNumberField(): FieldValidator<number | undefined> {\n  return (value, key) => {\n    if (value === undefined) {\n      return { value: undefined };\n    }\n\n    if (typeof value === \"number\" && Number.isFinite(value)) {\n      return { value };\n    }\n\n    return {\n      issues: [\n        { message: `\"${key}\" must be a finite number when provided`, path: [key] },\n      ],\n    };\n  };\n}\n\n/** Optional boolean field — accepts `undefined` or a boolean. */\nexport function optionalBooleanField(): FieldValidator<boolean | undefined> {\n  return (value, key) => {\n    if (value === undefined) {\n      return { value: undefined };\n    }\n\n    if (typeof value === \"boolean\") {\n      return { value };\n    }\n\n    return {\n      issues: [{ message: `\"${key}\" must be a boolean when provided`, path: [key] }],\n    };\n  };\n}\n\n/** The per-key field validator map describing an object schema's shape. */\ntype ObjectShape<T> = {\n  [K in keyof T]-?: FieldValidator<T[K]>;\n};\n\n/**\n * Build a {@link StandardSchemaV1} for a flat object whose every property\n * is validated by a {@link FieldValidator}. The input must be a non-null\n * object; each declared field is validated and the (possibly coerced)\n * values are collected into the typed result. All field issues are merged\n * so the caller sees every problem at once.\n *\n * `T` is constrained to `object` rather than `Record<string, unknown>` so\n * the tool IO `interface`s (which carry no implicit string index\n * signature) satisfy it directly — only the declared keys in `shape` are\n * ever read, so a string index signature is never required.\n *\n * @example\n * const schema = objectSchema<{ path: string; limit?: number }>({\n *   path: stringField(),\n *   limit: optionalNumberField(),\n * });\n */\nexport function objectSchema<T extends object>(\n  shape: ObjectShape<T>,\n): StandardSchemaV1<T> {\n  return {\n    \"~standard\": {\n      version: 1,\n      vendor: VENDOR,\n      validate(input) {\n        if (typeof input !== \"object\" || input === null || Array.isArray(input)) {\n          return { issues: [{ message: \"input must be an object\" }] };\n        }\n\n        const source = input as Record<string, unknown>;\n        const issues: StandardSchemaV1.Issue[] = [];\n        const result: Record<string, unknown> = {};\n\n        for (const key of Object.keys(shape) as (keyof T)[]) {\n          const field = shape[key];\n          const outcome = field(source[key as string], key as string);\n\n          if (\"issues\" in outcome) {\n            issues.push(...outcome.issues);\n\n            continue;\n          }\n\n          // Only carry through keys that resolved to a defined value, so\n          // optional-absent fields stay absent rather than becoming\n          // explicit `undefined` properties.\n          if (outcome.value !== undefined) {\n            result[key as string] = outcome.value;\n          }\n        }\n\n        if (issues.length > 0) {\n          return { issues };\n        }\n\n        return { value: result as T };\n      },\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,MAAM,SAAS;;AAaf,SAAgB,cAAsC;CACpD,QAAQ,OAAO,QAAQ;EACrB,IAAI,OAAO,UAAU,UACnB,OAAO,EAAE,MAAM;EAGjB,OAAO,EAAE,QAAQ,CAAC;GAAE,SAAS,IAAI,IAAI;GAAqB,MAAM,CAAC,GAAG;EAAE,CAAC,EAAE;CAC3E;AACF;;;;;AAMA,SAAgB,sBAA0D;CACxE,QAAQ,OAAO,QAAQ;EACrB,IAAI,UAAU,QACZ,OAAO,EAAE,OAAO,OAAU;EAG5B,IAAI,OAAO,UAAU,UACnB,OAAO,EAAE,MAAM;EAGjB,OAAO,EACL,QAAQ,CAAC;GAAE,SAAS,IAAI,IAAI;GAAmC,MAAM,CAAC,GAAG;EAAE,CAAC,EAC9E;CACF;AACF;;;;;AAMA,SAAgB,sBAA0D;CACxE,QAAQ,OAAO,QAAQ;EACrB,IAAI,UAAU,QACZ,OAAO,EAAE,OAAO,OAAU;EAG5B,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACpD,OAAO,EAAE,MAAM;EAGjB,OAAO,EACL,QAAQ,CACN;GAAE,SAAS,IAAI,IAAI;GAA0C,MAAM,CAAC,GAAG;EAAE,CAC3E,EACF;CACF;AACF;;AAGA,SAAgB,uBAA4D;CAC1E,QAAQ,OAAO,QAAQ;EACrB,IAAI,UAAU,QACZ,OAAO,EAAE,OAAO,OAAU;EAG5B,IAAI,OAAO,UAAU,WACnB,OAAO,EAAE,MAAM;EAGjB,OAAO,EACL,QAAQ,CAAC;GAAE,SAAS,IAAI,IAAI;GAAoC,MAAM,CAAC,GAAG;EAAE,CAAC,EAC/E;CACF;AACF;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,aACd,OACqB;CACrB,OAAO,EACL,aAAa;EACX,SAAS;EACT,QAAQ;EACR,SAAS,OAAO;GACd,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,0BAA0B,CAAC,EAAE;GAG5D,MAAM,SAAS;GACf,MAAM,SAAmC,CAAC;GAC1C,MAAM,SAAkC,CAAC;GAEzC,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAkB;IACnD,MAAM,QAAQ,MAAM;IACpB,MAAM,UAAU,MAAM,OAAO,MAAgB,GAAa;IAE1D,IAAI,YAAY,SAAS;KACvB,OAAO,KAAK,GAAG,QAAQ,MAAM;KAE7B;IACF;IAKA,IAAI,QAAQ,UAAU,QACpB,OAAO,OAAiB,QAAQ;GAEpC;GAEA,IAAI,OAAO,SAAS,GAClB,OAAO,EAAE,OAAO;GAGlB,OAAO,EAAE,OAAO,OAAY;EAC9B;CACF,EACF;AACF"}

package/esm/tools/write-file.d.mts

@@ -0,0 +1,33 @@
+import { WriteFileInput, WriteFileResult } from "../contracts/tool-io.type.mjs";
+import { WorkspaceOps } from "../contracts/workspace-ops.contract.mjs";
+import { ToolContract } from "@warlock.js/ai";
+
+//#region ../@warlock.js/ai-workspace/src/tools/write-file.d.ts
+/**
+ * Build the agent-facing `write_file` tool over a workspace's policy-
+ * enforced {@link WorkspaceOps}.
+ *
+ * The tool validates `{ path, content }` against a Standard Schema, then
+ * delegates to `ops.writeFile`, which atomically writes the full content
+ * (creating parent directories) and returns the byte count and content
+ * `hash`. The tool re-attaches the workspace-relative `path` so the
+ * result matches the {@link WriteFileResult} wire shape.
+ *
+ * **Errors flow as data.** A jail escape is thrown by `ops`; the
+ * `tool()` wrapper catches it and surfaces it in the returned `{ error }`
+ * field — `invoke()` never throws.
+ *
+ * @param ops - The shared, policy-enforced operation layer.
+ * @param options - Optional overrides; `name` renames the LLM-visible tool.
+ *
+ * @example
+ * const writeTool = makeWriteFileTool(ops);
+ * const { data } = await writeTool.invoke({ path: "src/new.ts", content: "export {};" });
+ * console.log(data.bytesWritten, data.hash);
+ */
+declare function makeWriteFileTool(ops: WorkspaceOps, options?: {
+  name?: string;
+}): ToolContract<WriteFileInput, WriteFileResult>;
+//#endregion
+export { makeWriteFileTool };
+//# sourceMappingURL=write-file.d.mts.map

package/esm/tools/write-file.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-file.d.mts","names":[],"sources":["../../../../../../../@warlock.js/ai-workspace/src/tools/write-file.ts"],"mappings":";;;;;;;;;AAmCA;;;;;;;;;;;;;;;;;AAG+C;iBAH/B,iBAAA,CACd,GAAA,EAAK,YAAA,EACL,OAAA;EAAY,IAAA;AAAA,IACX,YAAA,CAAa,cAAA,EAAgB,eAAA"}

package/esm/tools/write-file.mjs

@@ -0,0 +1,52 @@
+import { objectSchema, stringField } from "./schema.mjs";
+import { tool } from "@warlock.js/ai";
+
+//#region ../@warlock.js/ai-workspace/src/tools/write-file.ts
+/** Default tool name exposed to the LLM. */
+const DEFAULT_NAME = "write_file";
+/** Input schema for the `write_file` tool. */
+const inputSchema = objectSchema({
+	path: stringField(),
+	content: stringField()
+});
+/**
+* Build the agent-facing `write_file` tool over a workspace's policy-
+* enforced {@link WorkspaceOps}.
+*
+* The tool validates `{ path, content }` against a Standard Schema, then
+* delegates to `ops.writeFile`, which atomically writes the full content
+* (creating parent directories) and returns the byte count and content
+* `hash`. The tool re-attaches the workspace-relative `path` so the
+* result matches the {@link WriteFileResult} wire shape.
+*
+* **Errors flow as data.** A jail escape is thrown by `ops`; the
+* `tool()` wrapper catches it and surfaces it in the returned `{ error }`
+* field — `invoke()` never throws.
+*
+* @param ops - The shared, policy-enforced operation layer.
+* @param options - Optional overrides; `name` renames the LLM-visible tool.
+*
+* @example
+* const writeTool = makeWriteFileTool(ops);
+* const { data } = await writeTool.invoke({ path: "src/new.ts", content: "export {};" });
+* console.log(data.bytesWritten, data.hash);
+*/
+function makeWriteFileTool(ops, options) {
+	return tool({
+		name: options?.name ?? DEFAULT_NAME,
+		description: "Write full content to a workspace file, creating it (and any parent directories) if absent and overwriting it otherwise. The write is atomic. Returns the bytes written and the new content hash.",
+		input: inputSchema,
+		async execute(input) {
+			const { hash, bytesWritten } = await ops.writeFile(input.path, input.content);
+			return {
+				path: input.path,
+				bytesWritten,
+				hash
+			};
+		}
+	});
+}
+
+//#endregion
+export { makeWriteFileTool };
+//# sourceMappingURL=write-file.mjs.map

package/esm/tools/write-file.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-file.mjs","names":[],"sources":["../../../../../../../@warlock.js/ai-workspace/src/tools/write-file.ts"],"sourcesContent":["import { tool, type ToolContract } from \"@warlock.js/ai\";\nimport { objectSchema, stringField } from \"./schema\";\nimport type { WorkspaceOps, WriteFileInput, WriteFileResult } from \"../contracts\";\n\n/** Default tool name exposed to the LLM. */\nconst DEFAULT_NAME = \"write_file\";\n\n/** Input schema for the `write_file` tool. */\nconst inputSchema = objectSchema<WriteFileInput>({\n  path: stringField(),\n  content: stringField(),\n});\n\n/**\n * Build the agent-facing `write_file` tool over a workspace's policy-\n * enforced {@link WorkspaceOps}.\n *\n * The tool validates `{ path, content }` against a Standard Schema, then\n * delegates to `ops.writeFile`, which atomically writes the full content\n * (creating parent directories) and returns the byte count and content\n * `hash`. The tool re-attaches the workspace-relative `path` so the\n * result matches the {@link WriteFileResult} wire shape.\n *\n * **Errors flow as data.** A jail escape is thrown by `ops`; the\n * `tool()` wrapper catches it and surfaces it in the returned `{ error }`\n * field — `invoke()` never throws.\n *\n * @param ops - The shared, policy-enforced operation layer.\n * @param options - Optional overrides; `name` renames the LLM-visible tool.\n *\n * @example\n * const writeTool = makeWriteFileTool(ops);\n * const { data } = await writeTool.invoke({ path: \"src/new.ts\", content: \"export {};\" });\n * console.log(data.bytesWritten, data.hash);\n */\nexport function makeWriteFileTool(\n  ops: WorkspaceOps,\n  options?: { name?: string },\n): ToolContract<WriteFileInput, WriteFileResult> {\n  return tool<WriteFileInput, WriteFileResult>({\n    name: options?.name ?? DEFAULT_NAME,\n    description:\n      \"Write full content to a workspace file, creating it (and any parent \" +\n      \"directories) if absent and overwriting it otherwise. The write is \" +\n      \"atomic. Returns the bytes written and the new content hash.\",\n    input: inputSchema,\n    async execute(input) {\n      const { hash, bytesWritten } = await ops.writeFile(input.path, input.content);\n\n      return { path: input.path, bytesWritten, hash };\n    },\n  });\n}\n"],"mappings":";;;;;AAKA,MAAM,eAAe;;AAGrB,MAAM,cAAc,aAA6B;CAC/C,MAAM,YAAY;CAClB,SAAS,YAAY;AACvB,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBD,SAAgB,kBACd,KACA,SAC+C;CAC/C,OAAO,KAAsC;EAC3C,MAAM,SAAS,QAAQ;EACvB,aACE;EAGF,OAAO;EACP,MAAM,QAAQ,OAAO;GACnB,MAAM,EAAE,MAAM,iBAAiB,MAAM,IAAI,UAAU,MAAM,MAAM,MAAM,OAAO;GAE5E,OAAO;IAAE,MAAM,MAAM;IAAM;IAAc;GAAK;EAChD;CACF,CAAC;AACH"}

package/esm/workspace.d.mts

@@ -0,0 +1,54 @@
+import { WorkspacePolicy } from "./contracts/workspace-policy.type.mjs";
+import { Workspace } from "./contracts/workspace.contract.mjs";
+//#region ../@warlock.js/ai-workspace/src/workspace.d.ts
+/**
+ * Build a {@link Workspace} — the integrator that wires a
+ * {@link WorkspacePolicy} to a backend, the shared policy-enforced ops
+ * layer, and the seven agent-facing tool factories.
+ *
+ * The backend is chosen from `policy.backend`: `"mock"` runs in memory
+ * (hermetic tests); the `"local"` default (and any absent value) runs
+ * over the real disk via `@warlock.js/fs` + `node:child_process`. The
+ * returned workspace exposes:
+ *
+ * - **`tools.*`** — `readFile` / `editFile` / `writeFile` / `runShell` /
+ *   `runTests` / `grep` / `glob`, plus `all()` (every tool) and
+ *   `pick(...)` (a least-privilege subset).
+ * - **direct methods** — `readFile` / `writeFile` / `editFile` / `exec` /
+ *   `grep` / `glob` / `exists` / `mkdir` / `remove`, each delegating 1:1
+ *   to the shared ops layer.
+ * - **`readonly()`** — a projection that vends only read/grep/glob and
+ *   rejects every mutating direct method.
+ * - **`scope(subdir)`** — a sub-jailed workspace rooted at `subdir`.
+ *
+ * Available at runtime as `ai.workspace(policy)` once this module is
+ * imported (it registers the verb on the shared `ai` object).
+ *
+ * @param policy - The policy bounding the workspace (its `cwd` is the jail root).
+ * @returns A fully-wired {@link Workspace}.
+ *
+ * @example
+ * const ws = workspace({ cwd: "/srv/acme-api", shell: { allow: ["npm"], inheritEnv: ["PATH"] } });
+ * const dev = ai.agent({ model, tools: ws.tools.all() });
+ * await dev.execute("Make the failing cart-total suite green.");
+ *
+ * @example
+ * // Least-privilege reviewer — no write, no shell.
+ * const reviewer = ai.agent({ model, tools: ws.readonly().tools.all() });
+ */
+declare function workspace(policy: WorkspacePolicy): Workspace;
+/**
+ * Attach the `workspace` verb to the `ai` namespace via module augmentation,
+ * per the `ai.`-namespace convention. `@warlock.js/ai` now exposes a named `Ai`
+ * interface for exactly this, so after a bare `import "@warlock.js/ai-workspace"`,
+ * `ai.workspace(...)` is globally typed — no view/cast needed.
+ */
+declare module "@warlock.js/ai" {
+  interface Ai {
+    /** Build a policy-jailed filesystem + shell {@link Workspace}. */
+    workspace(policy: WorkspacePolicy): Workspace;
+  }
+} //# sourceMappingURL=workspace.d.ts.map
+//#endregion
+export { workspace };
+//# sourceMappingURL=workspace.d.mts.map

package/esm/workspace.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.mts","names":[],"sources":["../../../../../../@warlock.js/ai-workspace/src/workspace.ts"],"mappings":";;;;;;;AA6RA;;;;;;;;AAA6D;AAE5D;;;;;;;;;;;AAWgD;;;;;;;;;;;iBAbjC,SAAA,CAAU,MAAA,EAAQ,eAAA,GAAkB,SAAS;;;;;;;;YAWjD,EAAA;;IAER,SAAA,CAAU,MAAA,EAAQ,eAAA,GAAkB,SAAS;EAAA;AAAA"}

package/esm/workspace.mjs

@@ -0,0 +1,210 @@
+import { WorkspacePolicyError } from "./errors.mjs";
+import { createOps } from "./ops.mjs";
+import { createLocalBackend } from "./backends/local.mjs";
+import { createMockBackend } from "./backends/mock.mjs";
+import { makeEditFileTool } from "./tools/edit-file.mjs";
+import { makeGlobTool } from "./tools/glob.mjs";
+import { makeGrepTool } from "./tools/grep.mjs";
+import { makeReadFileTool } from "./tools/read-file.mjs";
+import { makeRunShellTool } from "./tools/run-shell.mjs";
+import { makeRunTestsTool } from "./tools/run-tests.mjs";
+import { makeWriteFileTool } from "./tools/write-file.mjs";
+import { ai } from "@warlock.js/ai";
+import path from "node:path";
+
+//#region ../@warlock.js/ai-workspace/src/workspace.ts
+/**
+* The full set of tool names a writable workspace vends, in a stable
+* canonical order so `tools.all()` is deterministic.
+*/
+const ALL_TOOL_NAMES = [
+	"readFile",
+	"editFile",
+	"writeFile",
+	"runShell",
+	"runTests",
+	"grep",
+	"glob"
+];
+/**
+* The subset a {@link Workspace.readonly} projection exposes — the
+* non-mutating tools only. `editFile` / `writeFile` / `runShell` /
+* `runTests` are deliberately omitted so a reviewer agent has no path to
+* change the tree.
+*/
+const READONLY_TOOL_NAMES = [
+	"readFile",
+	"grep",
+	"glob"
+];
+/**
+* Choose the dumb IO executor for a policy. `"mock"` selects the
+* in-memory backend (hermetic tests); anything else — including the
+* `"local"` default and an absent `backend` — selects the real-disk
+* local backend.
+*/
+function selectBackend(policy) {
+	if (policy.backend === "mock") return createMockBackend();
+	return createLocalBackend();
+}
+/**
+* The internal {@link Workspace} implementation. Holds the resolved
+* backend, the policy, and the single shared {@link WorkspaceOps} seam
+* that both the agent-facing `.tools.*` factories and the human-facing
+* direct methods funnel through — one jail, one rule set, two callers.
+*
+* The `allowedTools` set narrows what `tools.*` will vend and which
+* mutating direct methods are permitted: a full workspace allows every
+* name; a {@link WorkspaceImpl.readonly} projection allows only the
+* read/grep/glob subset and rejects writes/edits/shell/mkdir/remove.
+*
+* Constructed via {@link workspace}; the class itself is internal.
+*/
+var WorkspaceImpl = class WorkspaceImpl {
+	constructor(policy, allowedTools = ALL_TOOL_NAMES) {
+		this.policy = policy;
+		this.allowedTools = new Set(allowedTools);
+		const backend = selectBackend(policy);
+		this.ops = createOps(backend, policy);
+		this.tools = this.buildTools();
+	}
+	/**
+	* Assemble the agent-facing tool namespace. Each factory builds its
+	* tool over the shared `ops`; `all()` returns every *allowed* tool in
+	* canonical order and `pick(...)` returns the named subset (silently
+	* dropping any name this projection does not allow, so a `readonly()`
+	* workspace can never be coaxed into vending a mutating tool).
+	*/
+	buildTools() {
+		const erase = (contract) => contract;
+		const factories = {
+			readFile: (opts) => erase(makeReadFileTool(this.ops, opts)),
+			editFile: (opts) => erase(makeEditFileTool(this.ops, opts)),
+			writeFile: (opts) => erase(makeWriteFileTool(this.ops, opts)),
+			runShell: (opts) => erase(makeRunShellTool(this.ops, opts)),
+			runTests: (opts) => erase(makeRunTestsTool(this.ops, opts)),
+			grep: (opts) => erase(makeGrepTool(this.ops, opts)),
+			glob: (opts) => erase(makeGlobTool(this.ops, opts))
+		};
+		const build = (name, opts) => factories[name](opts);
+		return {
+			all: () => ALL_TOOL_NAMES.filter((name) => this.allowedTools.has(name)).map((name) => build(name)),
+			pick: (...names) => names.filter((name) => this.allowedTools.has(name)).map((name) => build(name)),
+			readFile: (opts) => build("readFile", opts),
+			editFile: (opts) => build("editFile", opts),
+			writeFile: (opts) => build("writeFile", opts),
+			runShell: (opts) => build("runShell", opts),
+			runTests: (opts) => build("runTests", opts),
+			grep: (opts) => build("grep", opts),
+			glob: (opts) => build("glob", opts)
+		};
+	}
+	/**
+	* Reject a mutating direct method on a read-only projection — surfaced
+	* as a {@link WorkspacePolicyError} (the same typed error a denied
+	* command produces) so a caller branches on `error.type`.
+	*/
+	assertWritable(operation) {
+		if (this.allowedTools.has("writeFile")) return;
+		throw new WorkspacePolicyError(`Operation "${operation}" is not permitted on a read-only workspace.`, {
+			type: "denied-command",
+			command: operation
+		});
+	}
+	readFile(filePath, opts) {
+		return this.ops.readFile(filePath, opts);
+	}
+	async writeFile(filePath, content) {
+		this.assertWritable("writeFile");
+		return this.ops.writeFile(filePath, content);
+	}
+	async editFile(input) {
+		this.assertWritable("editFile");
+		return this.ops.editFile(input);
+	}
+	async exec(command, opts) {
+		this.assertWritable("exec");
+		return this.ops.exec(command, opts);
+	}
+	grep(pattern, opts) {
+		return this.ops.grep(pattern, opts);
+	}
+	glob(pattern) {
+		return this.ops.glob(pattern);
+	}
+	exists(filePath) {
+		return this.ops.exists(filePath);
+	}
+	async mkdir(filePath) {
+		this.assertWritable("mkdir");
+		return this.ops.mkdir(filePath);
+	}
+	async remove(filePath) {
+		this.assertWritable("remove");
+		return this.ops.remove(filePath);
+	}
+	/**
+	* A read-only projection over the SAME policy — only the read/grep/glob
+	* tools are vended and every mutating direct method rejects with a
+	* {@link WorkspacePolicyError}. A fresh ops/backend is built from the
+	* identical policy, so the projection sees the same jailed tree.
+	*/
+	readonly() {
+		return new WorkspaceImpl(this.policy, READONLY_TOOL_NAMES);
+	}
+	/**
+	* A sub-jailed view rooted at `subdir` (relative to this workspace's
+	* `cwd`). Returns a brand-new workspace whose policy is this policy
+	* with `cwd` narrowed to `join(cwd, subdir)` — same backend selection,
+	* same allow/deny/shell/read sub-policies, but a tighter jail root.
+	*/
+	scope(subdir) {
+		return new WorkspaceImpl({
+			...this.policy,
+			cwd: path.join(this.policy.cwd, subdir)
+		}, [...this.allowedTools]);
+	}
+};
+/**
+* Build a {@link Workspace} — the integrator that wires a
+* {@link WorkspacePolicy} to a backend, the shared policy-enforced ops
+* layer, and the seven agent-facing tool factories.
+*
+* The backend is chosen from `policy.backend`: `"mock"` runs in memory
+* (hermetic tests); the `"local"` default (and any absent value) runs
+* over the real disk via `@warlock.js/fs` + `node:child_process`. The
+* returned workspace exposes:
+*
+* - **`tools.*`** — `readFile` / `editFile` / `writeFile` / `runShell` /
+*   `runTests` / `grep` / `glob`, plus `all()` (every tool) and
+*   `pick(...)` (a least-privilege subset).
+* - **direct methods** — `readFile` / `writeFile` / `editFile` / `exec` /
+*   `grep` / `glob` / `exists` / `mkdir` / `remove`, each delegating 1:1
+*   to the shared ops layer.
+* - **`readonly()`** — a projection that vends only read/grep/glob and
+*   rejects every mutating direct method.
+* - **`scope(subdir)`** — a sub-jailed workspace rooted at `subdir`.
+*
+* Available at runtime as `ai.workspace(policy)` once this module is
+* imported (it registers the verb on the shared `ai` object).
+*
+* @param policy - The policy bounding the workspace (its `cwd` is the jail root).
+* @returns A fully-wired {@link Workspace}.
+*
+* @example
+* const ws = workspace({ cwd: "/srv/acme-api", shell: { allow: ["npm"], inheritEnv: ["PATH"] } });
+* const dev = ai.agent({ model, tools: ws.tools.all() });
+* await dev.execute("Make the failing cart-total suite green.");
+*
+* @example
+* // Least-privilege reviewer — no write, no shell.
+* const reviewer = ai.agent({ model, tools: ws.readonly().tools.all() });
+*/
+function workspace(policy) {
+	return new WorkspaceImpl(policy);
+}
+ai.workspace = workspace;
+
+//#endregion
+export { workspace };
+//# sourceMappingURL=workspace.mjs.map

package/esm/workspace.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.mjs","names":[],"sources":["../../../../../../@warlock.js/ai-workspace/src/workspace.ts"],"sourcesContent":["import path from \"node:path\";\nimport { ai, type ToolContract } from \"@warlock.js/ai\";\nimport { createLocalBackend } from \"./backends/local\";\nimport { createMockBackend } from \"./backends/mock\";\nimport { WorkspacePolicyError } from \"./errors\";\nimport { createOps } from \"./ops\";\nimport { makeEditFileTool } from \"./tools/edit-file\";\nimport { makeGlobTool } from \"./tools/glob\";\nimport { makeGrepTool } from \"./tools/grep\";\nimport { makeReadFileTool } from \"./tools/read-file\";\nimport { makeRunShellTool } from \"./tools/run-shell\";\nimport { makeRunTestsTool } from \"./tools/run-tests\";\nimport { makeWriteFileTool } from \"./tools/write-file\";\nimport type {\n  EditFileInput,\n  EditFileResult,\n  GrepResult,\n  RunShellResult,\n  Workspace,\n  WorkspaceBackend,\n  WorkspaceOps,\n  WorkspacePolicy,\n  WorkspaceToolName,\n  WorkspaceTools,\n} from \"./contracts\";\n\n/**\n * The full set of tool names a writable workspace vends, in a stable\n * canonical order so `tools.all()` is deterministic.\n */\nconst ALL_TOOL_NAMES: readonly WorkspaceToolName[] = [\n  \"readFile\",\n  \"editFile\",\n  \"writeFile\",\n  \"runShell\",\n  \"runTests\",\n  \"grep\",\n  \"glob\",\n];\n\n/**\n * The subset a {@link Workspace.readonly} projection exposes — the\n * non-mutating tools only. `editFile` / `writeFile` / `runShell` /\n * `runTests` are deliberately omitted so a reviewer agent has no path to\n * change the tree.\n */\nconst READONLY_TOOL_NAMES: readonly WorkspaceToolName[] = [\n  \"readFile\",\n  \"grep\",\n  \"glob\",\n];\n\n/**\n * Choose the dumb IO executor for a policy. `\"mock\"` selects the\n * in-memory backend (hermetic tests); anything else — including the\n * `\"local\"` default and an absent `backend` — selects the real-disk\n * local backend.\n */\nfunction selectBackend(policy: WorkspacePolicy): WorkspaceBackend {\n  if (policy.backend === \"mock\") {\n    return createMockBackend();\n  }\n\n  return createLocalBackend();\n}\n\n/**\n * The internal {@link Workspace} implementation. Holds the resolved\n * backend, the policy, and the single shared {@link WorkspaceOps} seam\n * that both the agent-facing `.tools.*` factories and the human-facing\n * direct methods funnel through — one jail, one rule set, two callers.\n *\n * The `allowedTools` set narrows what `tools.*` will vend and which\n * mutating direct methods are permitted: a full workspace allows every\n * name; a {@link WorkspaceImpl.readonly} projection allows only the\n * read/grep/glob subset and rejects writes/edits/shell/mkdir/remove.\n *\n * Constructed via {@link workspace}; the class itself is internal.\n */\nclass WorkspaceImpl implements Workspace {\n  /** The shared, policy-enforced operation layer (jail + guards). */\n  private readonly ops: WorkspaceOps;\n\n  /** Tool names this projection is permitted to vend / mutate through. */\n  private readonly allowedTools: ReadonlySet<WorkspaceToolName>;\n\n  public readonly policy: WorkspacePolicy;\n\n  public readonly tools: WorkspaceTools;\n\n  public constructor(\n    policy: WorkspacePolicy,\n    allowedTools: readonly WorkspaceToolName[] = ALL_TOOL_NAMES,\n  ) {\n    this.policy = policy;\n    this.allowedTools = new Set(allowedTools);\n\n    const backend = selectBackend(policy);\n    this.ops = createOps(backend, policy);\n    this.tools = this.buildTools();\n  }\n\n  /**\n   * Assemble the agent-facing tool namespace. Each factory builds its\n   * tool over the shared `ops`; `all()` returns every *allowed* tool in\n   * canonical order and `pick(...)` returns the named subset (silently\n   * dropping any name this projection does not allow, so a `readonly()`\n   * workspace can never be coaxed into vending a mutating tool).\n   */\n  private buildTools(): WorkspaceTools {\n    // Each `make*Tool` returns a precisely-typed\n    // `ToolContract<SpecificInput, SpecificOutput>`, but the agent-facing\n    // `WorkspaceTools` surface vends the type-erased `ToolContract`\n    // (`ToolContract<unknown, unknown>`). Because `ToolContract` puts its\n    // input in a contravariant position (`execute(input)` / `action(input)`),\n    // a specific contract is not assignable to the erased one — so erase it\n    // once, here, through `unknown`. The runtime object is identical; only\n    // the static input type is widened for the shared surface.\n    const erase = <TInput, TOutput>(\n      contract: ToolContract<TInput, TOutput>,\n    ): ToolContract => contract as unknown as ToolContract;\n\n    const factories: Record<\n      WorkspaceToolName,\n      (opts?: { name?: string; command?: string }) => ToolContract\n    > = {\n      readFile: (opts) => erase(makeReadFileTool(this.ops, opts)),\n      editFile: (opts) => erase(makeEditFileTool(this.ops, opts)),\n      writeFile: (opts) => erase(makeWriteFileTool(this.ops, opts)),\n      runShell: (opts) => erase(makeRunShellTool(this.ops, opts)),\n      runTests: (opts) => erase(makeRunTestsTool(this.ops, opts)),\n      grep: (opts) => erase(makeGrepTool(this.ops, opts)),\n      glob: (opts) => erase(makeGlobTool(this.ops, opts)),\n    };\n\n    const build = (name: WorkspaceToolName, opts?: { name?: string; command?: string }) =>\n      factories[name](opts);\n\n    return {\n      all: () =>\n        ALL_TOOL_NAMES.filter((name) => this.allowedTools.has(name)).map((name) =>\n          build(name),\n        ),\n      pick: (...names: WorkspaceToolName[]) =>\n        names.filter((name) => this.allowedTools.has(name)).map((name) => build(name)),\n      readFile: (opts) => build(\"readFile\", opts),\n      editFile: (opts) => build(\"editFile\", opts),\n      writeFile: (opts) => build(\"writeFile\", opts),\n      runShell: (opts) => build(\"runShell\", opts),\n      runTests: (opts) => build(\"runTests\", opts),\n      grep: (opts) => build(\"grep\", opts),\n      glob: (opts) => build(\"glob\", opts),\n    };\n  }\n\n  /**\n   * Reject a mutating direct method on a read-only projection — surfaced\n   * as a {@link WorkspacePolicyError} (the same typed error a denied\n   * command produces) so a caller branches on `error.type`.\n   */\n  private assertWritable(operation: string): void {\n    if (this.allowedTools.has(\"writeFile\")) {\n      return;\n    }\n\n    throw new WorkspacePolicyError(\n      `Operation \"${operation}\" is not permitted on a read-only workspace.`,\n      { type: \"denied-command\", command: operation },\n    );\n  }\n\n  public readFile(\n    filePath: string,\n    opts?: { offset?: number; limit?: number },\n  ): Promise<{ content: string; hash: string; totalLines: number }> {\n    return this.ops.readFile(filePath, opts);\n  }\n\n  public async writeFile(\n    filePath: string,\n    content: string,\n  ): Promise<{ hash: string; bytesWritten: number }> {\n    this.assertWritable(\"writeFile\");\n\n    return this.ops.writeFile(filePath, content);\n  }\n\n  public async editFile(input: EditFileInput): Promise<EditFileResult> {\n    this.assertWritable(\"editFile\");\n\n    return this.ops.editFile(input);\n  }\n\n  public async exec(command: string, opts?: { timeoutMs?: number }): Promise<RunShellResult> {\n    this.assertWritable(\"exec\");\n\n    return this.ops.exec(command, opts);\n  }\n\n  public grep(\n    pattern: string,\n    opts?: { glob?: string; ignoreCase?: boolean },\n  ): Promise<GrepResult> {\n    return this.ops.grep(pattern, opts);\n  }\n\n  public glob(pattern: string): Promise<string[]> {\n    return this.ops.glob(pattern);\n  }\n\n  public exists(filePath: string): Promise<boolean> {\n    return this.ops.exists(filePath);\n  }\n\n  public async mkdir(filePath: string): Promise<void> {\n    this.assertWritable(\"mkdir\");\n\n    return this.ops.mkdir(filePath);\n  }\n\n  public async remove(filePath: string): Promise<void> {\n    this.assertWritable(\"remove\");\n\n    return this.ops.remove(filePath);\n  }\n\n  /**\n   * A read-only projection over the SAME policy — only the read/grep/glob\n   * tools are vended and every mutating direct method rejects with a\n   * {@link WorkspacePolicyError}. A fresh ops/backend is built from the\n   * identical policy, so the projection sees the same jailed tree.\n   */\n  public readonly(): Workspace {\n    return new WorkspaceImpl(this.policy, READONLY_TOOL_NAMES);\n  }\n\n  /**\n   * A sub-jailed view rooted at `subdir` (relative to this workspace's\n   * `cwd`). Returns a brand-new workspace whose policy is this policy\n   * with `cwd` narrowed to `join(cwd, subdir)` — same backend selection,\n   * same allow/deny/shell/read sub-policies, but a tighter jail root.\n   */\n  public scope(subdir: string): Workspace {\n    return new WorkspaceImpl(\n      { ...this.policy, cwd: path.join(this.policy.cwd, subdir) },\n      [...this.allowedTools],\n    );\n  }\n}\n\n/**\n * Build a {@link Workspace} — the integrator that wires a\n * {@link WorkspacePolicy} to a backend, the shared policy-enforced ops\n * layer, and the seven agent-facing tool factories.\n *\n * The backend is chosen from `policy.backend`: `\"mock\"` runs in memory\n * (hermetic tests); the `\"local\"` default (and any absent value) runs\n * over the real disk via `@warlock.js/fs` + `node:child_process`. The\n * returned workspace exposes:\n *\n * - **`tools.*`** — `readFile` / `editFile` / `writeFile` / `runShell` /\n *   `runTests` / `grep` / `glob`, plus `all()` (every tool) and\n *   `pick(...)` (a least-privilege subset).\n * - **direct methods** — `readFile` / `writeFile` / `editFile` / `exec` /\n *   `grep` / `glob` / `exists` / `mkdir` / `remove`, each delegating 1:1\n *   to the shared ops layer.\n * - **`readonly()`** — a projection that vends only read/grep/glob and\n *   rejects every mutating direct method.\n * - **`scope(subdir)`** — a sub-jailed workspace rooted at `subdir`.\n *\n * Available at runtime as `ai.workspace(policy)` once this module is\n * imported (it registers the verb on the shared `ai` object).\n *\n * @param policy - The policy bounding the workspace (its `cwd` is the jail root).\n * @returns A fully-wired {@link Workspace}.\n *\n * @example\n * const ws = workspace({ cwd: \"/srv/acme-api\", shell: { allow: [\"npm\"], inheritEnv: [\"PATH\"] } });\n * const dev = ai.agent({ model, tools: ws.tools.all() });\n * await dev.execute(\"Make the failing cart-total suite green.\");\n *\n * @example\n * // Least-privilege reviewer — no write, no shell.\n * const reviewer = ai.agent({ model, tools: ws.readonly().tools.all() });\n */\nexport function workspace(policy: WorkspacePolicy): Workspace {\n  return new WorkspaceImpl(policy);\n}\n\n/**\n * Attach the `workspace` verb to the `ai` namespace via module augmentation,\n * per the `ai.`-namespace convention. `@warlock.js/ai` now exposes a named `Ai`\n * interface for exactly this, so after a bare `import \"@warlock.js/ai-workspace\"`,\n * `ai.workspace(...)` is globally typed — no view/cast needed.\n */\ndeclare module \"@warlock.js/ai\" {\n  interface Ai {\n    /** Build a policy-jailed filesystem + shell {@link Workspace}. */\n    workspace(policy: WorkspacePolicy): Workspace;\n  }\n}\n\n// Runtime registration: attach `workspace` onto the shared `ai` object the\n// moment this package is imported (the augmentation above types it).\nai.workspace = workspace;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA8BA,MAAM,iBAA+C;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;AAQA,MAAM,sBAAoD;CACxD;CACA;CACA;AACF;;;;;;;AAQA,SAAS,cAAc,QAA2C;CAChE,IAAI,OAAO,YAAY,QACrB,OAAO,kBAAkB;CAG3B,OAAO,mBAAmB;AAC5B;;;;;;;;;;;;;;AAeA,IAAM,gBAAN,MAAM,cAAmC;CAWvC,AAAO,YACL,QACA,eAA6C,gBAC7C;EACA,KAAK,SAAS;EACd,KAAK,eAAe,IAAI,IAAI,YAAY;EAExC,MAAM,UAAU,cAAc,MAAM;EACpC,KAAK,MAAM,UAAU,SAAS,MAAM;EACpC,KAAK,QAAQ,KAAK,WAAW;CAC/B;;;;;;;;CASA,AAAQ,aAA6B;EASnC,MAAM,SACJ,aACiB;EAEnB,MAAM,YAGF;GACF,WAAW,SAAS,MAAM,iBAAiB,KAAK,KAAK,IAAI,CAAC;GAC1D,WAAW,SAAS,MAAM,iBAAiB,KAAK,KAAK,IAAI,CAAC;GAC1D,YAAY,SAAS,MAAM,kBAAkB,KAAK,KAAK,IAAI,CAAC;GAC5D,WAAW,SAAS,MAAM,iBAAiB,KAAK,KAAK,IAAI,CAAC;GAC1D,WAAW,SAAS,MAAM,iBAAiB,KAAK,KAAK,IAAI,CAAC;GAC1D,OAAO,SAAS,MAAM,aAAa,KAAK,KAAK,IAAI,CAAC;GAClD,OAAO,SAAS,MAAM,aAAa,KAAK,KAAK,IAAI,CAAC;EACpD;EAEA,MAAM,SAAS,MAAyB,SACtC,UAAU,KAAK,CAAC,IAAI;EAEtB,OAAO;GACL,WACE,eAAe,QAAQ,SAAS,KAAK,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAChE,MAAM,IAAI,CACZ;GACF,OAAO,GAAG,UACR,MAAM,QAAQ,SAAS,KAAK,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,MAAM,IAAI,CAAC;GAC/E,WAAW,SAAS,MAAM,YAAY,IAAI;GAC1C,WAAW,SAAS,MAAM,YAAY,IAAI;GAC1C,YAAY,SAAS,MAAM,aAAa,IAAI;GAC5C,WAAW,SAAS,MAAM,YAAY,IAAI;GAC1C,WAAW,SAAS,MAAM,YAAY,IAAI;GAC1C,OAAO,SAAS,MAAM,QAAQ,IAAI;GAClC,OAAO,SAAS,MAAM,QAAQ,IAAI;EACpC;CACF;;;;;;CAOA,AAAQ,eAAe,WAAyB;EAC9C,IAAI,KAAK,aAAa,IAAI,WAAW,GACnC;EAGF,MAAM,IAAI,qBACR,cAAc,UAAU,+CACxB;GAAE,MAAM;GAAkB,SAAS;EAAU,CAC/C;CACF;CAEA,AAAO,SACL,UACA,MACgE;EAChE,OAAO,KAAK,IAAI,SAAS,UAAU,IAAI;CACzC;CAEA,MAAa,UACX,UACA,SACiD;EACjD,KAAK,eAAe,WAAW;EAE/B,OAAO,KAAK,IAAI,UAAU,UAAU,OAAO;CAC7C;CAEA,MAAa,SAAS,OAA+C;EACnE,KAAK,eAAe,UAAU;EAE9B,OAAO,KAAK,IAAI,SAAS,KAAK;CAChC;CAEA,MAAa,KAAK,SAAiB,MAAwD;EACzF,KAAK,eAAe,MAAM;EAE1B,OAAO,KAAK,IAAI,KAAK,SAAS,IAAI;CACpC;CAEA,AAAO,KACL,SACA,MACqB;EACrB,OAAO,KAAK,IAAI,KAAK,SAAS,IAAI;CACpC;CAEA,AAAO,KAAK,SAAoC;EAC9C,OAAO,KAAK,IAAI,KAAK,OAAO;CAC9B;CAEA,AAAO,OAAO,UAAoC;EAChD,OAAO,KAAK,IAAI,OAAO,QAAQ;CACjC;CAEA,MAAa,MAAM,UAAiC;EAClD,KAAK,eAAe,OAAO;EAE3B,OAAO,KAAK,IAAI,MAAM,QAAQ;CAChC;CAEA,MAAa,OAAO,UAAiC;EACnD,KAAK,eAAe,QAAQ;EAE5B,OAAO,KAAK,IAAI,OAAO,QAAQ;CACjC;;;;;;;CAQA,AAAO,WAAsB;EAC3B,OAAO,IAAI,cAAc,KAAK,QAAQ,mBAAmB;CAC3D;;;;;;;CAQA,AAAO,MAAM,QAA2B;EACtC,OAAO,IAAI,cACT;GAAE,GAAG,KAAK;GAAQ,KAAK,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM;EAAE,GAC1D,CAAC,GAAG,KAAK,YAAY,CACvB;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAgB,UAAU,QAAoC;CAC5D,OAAO,IAAI,cAAc,MAAM;AACjC;AAiBA,GAAG,YAAY"}