@wjarka/cezarion 0.10.0-pr30.54

package/dist/skills-remote.js

@@ -0,0 +1,468 @@
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { loadConfig } from './config.js';
+import { parseFrontmatter } from './skills.js';
+/**
+ * Team skills from remote git repos (spec 005), janitor-style: a bare clone
+ * without a checkout, listed with `git ls-tree` and read with `git show`.
+ * The cache lives in `~/.cache/cez/skills/<owner>__<name>/` — global, so one
+ * fetch serves every project. Everything degrades: no network / no access to
+ * the skills repo means the team skills quietly disappear from the list while
+ * local skills keep working. Nothing here ever blocks startup.
+ */
+const LIST_TIMEOUT_MS = 10_000; // ls-tree / show / rev-parse
+const CLONE_TIMEOUT_MS = 60_000; // clone / fetch
+/**
+ * Hardening applied to *every* git invocation here (#428). The `repo`/`ref`
+ * strings ultimately come from a file — `.ai/cezar/config.json` — that an
+ * attacker might influence (a prompt-injected Write-only agent, a synced
+ * config), so git must never be able to pick a remote-helper transport:
+ *  - `protocol.ext.allow=never` / `fd.allow=never` kill the `ext::`/`fd::`
+ *    helpers — the arbitrary-command-execution vector (`ext::sh -c …`).
+ *  - `GIT_ALLOW_PROTOCOL` allowlists only real transports; anything else
+ *    (including `ext`) is refused even if a value slips past validation.
+ *  - `protocol.file.allow=user` keeps direct local-path clones (a documented
+ *    source shape) working while blocking submodule/recursive file abuse.
+ *  - `GIT_TERMINAL_PROMPT=0` stops git blocking on a credential prompt — this
+ *    runs on cockpit open and must never hang the boot.
+ */
+const GIT_HARDENING_ARGS = [
+    '-c',
+    'protocol.ext.allow=never',
+    '-c',
+    'protocol.fd.allow=never',
+    '-c',
+    'protocol.file.allow=user',
+];
+const GIT_HARDENING_ENV = {
+    GIT_ALLOW_PROTOCOL: 'https:http:ssh:git:file',
+    GIT_TERMINAL_PROMPT: '0',
+};
+function git(args, timeoutMs, cwd) {
+    return new Promise((resolve) => {
+        execFile('git', [...GIT_HARDENING_ARGS, ...args], {
+            cwd,
+            timeout: timeoutMs,
+            killSignal: 'SIGKILL',
+            maxBuffer: 16 * 1024 * 1024,
+            encoding: 'utf8',
+            env: { ...process.env, ...GIT_HARDENING_ENV },
+        }, (err, stdout, stderr) => resolve({ ok: !err, stdout: stdout ?? '', stderr: stderr ?? '' }));
+    });
+}
+const ALLOWED_URL_SCHEMES = new Set(['https', 'http', 'ssh', 'git', 'file']);
+/**
+ * The git remote for a configured source, or null when the value is unsafe to
+ * hand to `git` (#428). Team-skill repos are code-trusted — their skill bodies
+ * become agent system prompts — but the *string* is attacker-influenceable, so
+ * it must never be able to select a transport helper or pose as a git option.
+ * We accept exactly:
+ *  - `owner/name`         GitHub shorthand → canonical https
+ *  - `https://` `http://` web URLs
+ *  - `ssh://…` or scp-like `git@host:path`
+ *  - a local path (`/abs`, `./`, `../`, `~/…`, `C:\…`) or `file://…`
+ * and reject the RCE/argument-injection surface: a leading `-`, the `::`
+ * remote-helper syntax (`ext::sh -c …`, `fd::…`), and any other URL scheme.
+ *
+ * Every reject here maps to a real vector. Shapes that are merely *unusual* —
+ * a Windows drive path, `~/…` — stay accepted: `BACKWARD_COMPATIBILITY.md` §5
+ * protects the `skillsRepos` source shape, so narrowing it is a breaking change
+ * and needs a migration path, not a silent refusal.
+ */
+export function safeRemoteFor(repo) {
+    const value = repo.trim();
+    if (!value)
+        return null;
+    // git would read a leading `-` as an option, not a repo — argument injection.
+    if (value.startsWith('-'))
+        return null;
+    // `ext::`, `fd::`, and friends: remote-helper transports = command execution.
+    if (value.includes('::'))
+        return null;
+    // Local paths are matched before the `owner/name` shorthand: `.` and `-` are
+    // in the shorthand charset, so `./rel` would otherwise be read as the GitHub
+    // repo `./rel` and rewritten to `https://github.com/./rel.git`.
+    //
+    // `~/…` — git runs via execFile with no shell, so expand it here or git would
+    // look for a directory literally named `~`.
+    if (/^~\//.test(value))
+        return join(homedir(), value.slice(2));
+    if (/^(\/|\.\/|\.\.\/)/.test(value))
+        return value;
+    // Windows drive-letter path (`C:\repo`, `C:/repo`). Not a transport — no
+    // scheme, and a leading `-` is already refused above — and win32 is a
+    // supported platform, so this shape must keep working (BC §5, local path).
+    if (/^[A-Za-z]:[\\/]/.test(value))
+        return value;
+    // GitHub shorthand → the canonical https remote.
+    if (/^[\w.-]+\/[\w.-]+$/.test(value))
+        return `https://github.com/${value}.git`;
+    // Explicit URL scheme: allowlist safe transports only (blocks `ext:` etc.).
+    const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(value);
+    if (scheme) {
+        return ALLOWED_URL_SCHEMES.has(scheme[1].toLowerCase()) ? value : null;
+    }
+    // scp-like `user@host:path` (no scheme, host before the first colon).
+    if (/^[\w.-]+@[\w.-]+:/.test(value))
+        return value;
+    return null;
+}
+/**
+ * A ref safe to pass to `git` as a positional revision (#428): a branch, tag,
+ * or commit SHA. Rejects a leading `-` (argument injection against git's option
+ * surface), range/pathspec metacharacters, and anything outside the git
+ * ref-name charset — so `${ref}:${path}` in `git show` can never be a `-`-flag.
+ */
+export function isSafeRef(ref) {
+    return (ref.length > 0 &&
+        ref.length <= 256 &&
+        !ref.startsWith('-') &&
+        !ref.includes('..') &&
+        /^[A-Za-z0-9._/-]+$/.test(ref));
+}
+/** A full commit SHA (sha-1 or sha-256) — a pinned, immutable ref (#428). */
+export function isPinnedSha(ref) {
+    return /^[0-9a-f]{40}$/i.test(ref) || /^[0-9a-f]{64}$/i.test(ref);
+}
+/** Stable cache directory name: the last two path segments, `owner__name`. */
+export function bareDirFor(repo) {
+    const trimmed = repo
+        .replace(/\/+$/, '')
+        .replace(/\.git$/, '')
+        .replace(/^[a-z+]+:\/\//i, '')
+        .replace(/^~\//, '');
+    const segments = trimmed.split(/[/:]/).filter(Boolean).map(sanitizeSegment);
+    const key = segments.slice(-2).join('__') || 'skills';
+    return join(homedir(), '.cache', 'cez', 'skills', key);
+}
+function sanitizeSegment(s) {
+    return s.replace(/[^\w.-]/g, '-');
+}
+/** One warning per bad source per process — this runs on every cockpit open. */
+const warnedUnsafeRemotes = new Set();
+function warnUnsafeRemoteOnce(repo) {
+    if (warnedUnsafeRemotes.has(repo))
+        return;
+    warnedUnsafeRemotes.add(repo);
+    console.warn(`[cez] ignoring skills repo ${JSON.stringify(repo)} — not an accepted source shape ` +
+        `(owner/name, an https/http/ssh/git URL, git@host:path, or a local/file:// path). ` +
+        `Check "skillsRepos" in .ai/cezar/config.json.`);
+}
+/** Clone the skills repo bare (no checkout) into the global cache, once. */
+export async function ensureBareClone(repo) {
+    // Validate before anything else, cache hit or not: "this source is refusable"
+    // should never depend on whether a clone happens to exist already.
+    const remote = safeRemoteFor(repo);
+    if (!remote) {
+        // Everything else in this module degrades silently (offline, no access —
+        // all expected). A refusal is different: it means the config is wrong or
+        // tampered with, and the operator otherwise just sees skills disappear.
+        warnUnsafeRemoteOnce(repo);
+        throw new Error(`refusing unsafe skills repo remote: ${repo}`);
+    }
+    const bareDir = bareDirFor(repo);
+    if (existsSync(join(bareDir, 'HEAD')))
+        return { bareDir, created: false };
+    await mkdir(dirname(bareDir), { recursive: true });
+    // `--` separates options from the remote/dir operands: even a value that
+    // slipped past validation can't pose as a git option.
+    const res = await git(['clone', '--bare', '--', remote, bareDir], CLONE_TIMEOUT_MS);
+    if (!res.ok)
+        throw new Error(`git clone --bare ${remote} failed: ${res.stderr.trim()}`);
+    return { bareDir, created: true };
+}
+/** "Refresh" — update every branch head in the bare clone from origin. */
+export async function fetchAll(bareDir) {
+    const res = await git(['fetch', 'origin', '--prune', '+refs/heads/*:refs/heads/*'], CLONE_TIMEOUT_MS, bareDir);
+    if (!res.ok)
+        throw new Error(`git fetch failed: ${res.stderr.trim() || res.stdout.trim()}`);
+}
+/**
+ * Resolve a source ref to the immutable commit SHA it names, or null (#428).
+ * An unsafe ref is refused outright. A ref pinned to a full commit SHA is
+ * verified to name exactly that commit and is *never* replaced by a moving
+ * `HEAD` fallback — that is the whole point of pinning against a force-push /
+ * supply-chain swap. A branch/tag falls back through the usual candidates.
+ *
+ * Always returning a SHA (never the mutable name) means one listing reads every
+ * skill at a single commit: a concurrent `refreshTeamSkills` can move the branch
+ * head mid-read without the list and the bodies drifting apart.
+ */
+async function resolveRef(bareDir, ref) {
+    if (!isSafeRef(ref))
+        return null;
+    if (isPinnedSha(ref)) {
+        const sha = ref.toLowerCase();
+        const probe = await git(['rev-parse', '--verify', '--quiet', `${sha}^{commit}`], LIST_TIMEOUT_MS, bareDir);
+        // Pinned means pinned: only accept when rev-parse names exactly this commit.
+        return probe.ok && probe.stdout.trim() === sha ? sha : null;
+    }
+    for (const candidate of [ref, `refs/heads/${ref}`, 'HEAD']) {
+        const probe = await git(['rev-parse', '--verify', '--quiet', `${candidate}^{commit}`], LIST_TIMEOUT_MS, bareDir);
+        if (probe.ok && probe.stdout.trim())
+            return probe.stdout.trim();
+    }
+    return null;
+}
+/**
+ * Match the janitor conventions plus our own:
+ *  - `**\/SKILL.md`          → skill named after the parent directory (with references/)
+ *  - `**\/commands/<n>.md`   → skill `<n>`
+ *  - `.ai/skills/**\/*.md` or `.ai/cezar/skills/**\/*.md` → frontmatter/basename name
+ */
+function matchSkillPath(line) {
+    if (line === 'SKILL.md' || line.endsWith('/SKILL.md')) {
+        const parts = line.split('/');
+        if (parts.length < 2)
+            return null;
+        const parent = parts[parts.length - 2];
+        return parent && parent !== '.' ? { name: parent, kind: 'skill' } : null;
+    }
+    const cmd = /(?:^|\/)commands\/([^/]+)\.md$/.exec(line);
+    if (cmd)
+        return { name: cmd[1], kind: 'command' };
+    if (/(?:^|\/)\.ai\/(?:cezar\/)?skills\/.+\.md$/.test(line))
+        return { name: null, kind: 'markdown' };
+    return null;
+}
+/**
+ * Read one file from the bare clone at the source's ref. Null on any failure.
+ * `atCommit` pins the read to an already-resolved commit, so a caller listing
+ * many files reads them all at the same commit (and skips re-resolving).
+ */
+export async function readRemoteSkill(src, path, atCommit) {
+    const bareDir = bareDirFor(src.repo);
+    if (!existsSync(join(bareDir, 'HEAD')))
+        return null;
+    const ref = atCommit ?? (await resolveRef(bareDir, src.ref));
+    if (ref === null)
+        return null;
+    const res = await git(['show', `${ref}:${path}`], LIST_TIMEOUT_MS, bareDir);
+    return res.ok ? res.stdout : null;
+}
+/**
+ * List every skill the repo defines at `src.ref`. Reads from the local bare
+ * clone only — no network. Empty list when the clone doesn't exist yet or
+ * the ref can't be resolved.
+ */
+export async function listRemoteSkills(src) {
+    const bareDir = bareDirFor(src.repo);
+    if (!existsSync(join(bareDir, 'HEAD')))
+        return [];
+    // An immutable SHA (#428): the tree listing and every body below are read at
+    // this one commit, and it is what gets recorded on each skill.
+    const commit = await resolveRef(bareDir, src.ref);
+    if (commit === null)
+        return [];
+    // `--` after the ref keeps a `-`-leading value out of git's option surface.
+    const ls = await git(['ls-tree', '-r', '--name-only', commit, '--'], LIST_TIMEOUT_MS, bareDir);
+    if (!ls.ok)
+        return [];
+    const skills = [];
+    const seen = new Set();
+    for (const line of ls.stdout.split('\n')) {
+        if (!line)
+            continue;
+        const hit = matchSkillPath(line);
+        if (!hit)
+            continue;
+        const raw = await readRemoteSkill(src, line, commit);
+        if (raw === null)
+            continue;
+        const { frontmatter, body } = parseFrontmatter(raw);
+        const name = hit.name ??
+            (typeof frontmatter.name === 'string' && frontmatter.name.trim()
+                ? frontmatter.name.trim()
+                : basename(line, '.md'));
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const description = typeof frontmatter.description === 'string' && frontmatter.description.trim()
+            ? frontmatter.description.trim()
+            : undefined;
+        skills.push({
+            name,
+            description,
+            body,
+            path: `${src.repo}@${src.ref}:${line}`,
+            source: 'team',
+            team: { repo: src.repo, ref: src.ref, path: line, dir: hit.kind === 'skill', commit },
+        });
+    }
+    return skills;
+}
+// ---- materialization (directory skills) ---------------------------------------
+/**
+ * Copy a directory skill (SKILL.md + references/…) out of the bare clone into
+ * `<repoRoot>/.claude/skills/<name>/` so claude sees the references on disk,
+ * and keep it out of the user's git via `.git/info/exclude`. Returns false
+ * when there is nothing to materialize (not a directory skill, no clone…).
+ */
+export async function materializeSkillDir(repoRoot, skill) {
+    if (!skill.team?.dir || !skill.team.path.endsWith('SKILL.md'))
+        return false;
+    const bareDir = bareDirFor(skill.team.repo);
+    if (!existsSync(join(bareDir, 'HEAD')))
+        return false;
+    const ref = await resolveRef(bareDir, skill.team.ref);
+    if (ref === null)
+        return false;
+    const srcDir = skill.team.path.slice(0, -'/SKILL.md'.length);
+    const ls = await git(['ls-tree', '-r', '--name-only', ref, '--', srcDir], LIST_TIMEOUT_MS, bareDir);
+    if (!ls.ok)
+        return false;
+    const destDir = join(repoRoot, '.claude', 'skills', skill.name);
+    let wrote = 0;
+    for (const file of ls.stdout.split('\n').filter(Boolean)) {
+        const rel = file.slice(srcDir.length + 1);
+        // git paths are repo-relative and normalized, but never trust them blindly.
+        if (!rel || rel.split('/').includes('..'))
+            continue;
+        const show = await git(['show', `${ref}:${file}`], LIST_TIMEOUT_MS, bareDir);
+        if (!show.ok)
+            continue;
+        const target = join(destDir, rel);
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, show.stdout, 'utf8');
+        wrote++;
+    }
+    if (wrote === 0)
+        return false;
+    await excludeFromGit(repoRoot, `.claude/skills/${skill.name}/`);
+    return true;
+}
+/** Append a pattern to git's `info/exclude` (idempotent, non-fatal). */
+async function excludeFromGit(repoRoot, pattern) {
+    try {
+        // Resolve the real exclude file: in a linked worktree (spec 006) `.git`
+        // is a file and `info/exclude` lives in the shared common dir — which
+        // also means one exclude entry covers every task worktree.
+        const probe = await git(['rev-parse', '--path-format=absolute', '--git-common-dir'], LIST_TIMEOUT_MS, repoRoot);
+        const gitDir = probe.ok && probe.stdout.trim() ? probe.stdout.trim() : join(repoRoot, '.git');
+        const excludePath = join(gitDir, 'info', 'exclude');
+        let prev = '';
+        try {
+            prev = await readFile(excludePath, 'utf8');
+        }
+        catch {
+            // no exclude file yet
+        }
+        if (prev.split('\n').includes(pattern))
+            return;
+        await mkdir(dirname(excludePath), { recursive: true });
+        await writeFile(excludePath, prev + (prev && !prev.endsWith('\n') ? '\n' : '') + pattern + '\n', 'utf8');
+    }
+    catch {
+        // non-fatal — `.git` might be a linked file (worktree) or absent entirely
+    }
+}
+// ---- in-process cache ----------------------------------------------------------
+// Clone attempts are expensive when the network is down (git can hang on
+// DNS/TCP), so each source gets one implicit attempt per process. "Refresh"
+// always retries.
+const cloneAttempted = new Set();
+// Isolated review worktrees have no local `.agents/skills` (gitignored, absent
+// in a fresh checkout), so codex reads skills straight from this global bare
+// cache. A clone left by an earlier run — or one this long-running process
+// fetched hours ago — silently serves a stale template. Passive loads therefore
+// fetch on the first touch per process and then at most once per TTL, keeping
+// the cache current without a manual "Refresh" and without fetching on every
+// catalog read. `refresh` (the explicit button / #613's post-update
+// invalidateCatalog) still fetches unconditionally.
+const PASSIVE_FETCH_TTL_MS = 6 * 60 * 60 * 1_000;
+const lastFetchByRepo = new Map();
+/**
+ * Whether a passive (non-`refresh`) load should `git fetch` an existing bare
+ * clone: yes on the first touch this process, and yes once the last fetch is
+ * older than `ttlMs`. Pure so the freshness policy is unit-tested without git.
+ */
+export function shouldPassiveFetch(opts) {
+    return !opts.attempted || opts.now - opts.fetchedAt > opts.ttlMs;
+}
+// Both maps are keyed by `repoRoot` (multi-project workspace, step 2.6): each
+// project resolves its own `.ai/cezar/config.json` → `skillsRepos`, so one
+// project's team-skill list must never be served under another project's scope.
+const teamSkillsByRoot = new Map();
+const firstLoadByRoot = new Map();
+function initialTeamSkillsLoad(repoRoot) {
+    const existing = firstLoadByRoot.get(repoRoot);
+    if (existing)
+        return existing;
+    const load = loadTeamSkills(repoRoot, false).catch(() => teamSkillsByRoot.get(repoRoot) ?? []);
+    firstLoadByRoot.set(repoRoot, load);
+    return load;
+}
+/**
+ * The current team-skill list for this project, straight from memory. The
+ * first call per `repoRoot` kicks off an async background load (clone + list)
+ * and returns immediately — the GUI refetches, so remote skills appear moments
+ * later instead of blocking the first `GET /api/skills`.
+ */
+export function getTeamSkillsCached(repoRoot) {
+    void initialTeamSkillsLoad(repoRoot);
+    return teamSkillsByRoot.get(repoRoot) ?? [];
+}
+/**
+ * Wait for the same non-refreshing load kicked off by `getTeamSkillsCached`.
+ * The normal catalog read stays immediate; callers use this only for a
+ * background convergence read after they have already rendered local skills.
+ */
+export function waitForTeamSkills(repoRoot) {
+    return initialTeamSkillsLoad(repoRoot);
+}
+/** Refresh: clone missing sources, `git fetch` existing ones, reload the list. */
+export async function refreshTeamSkills(repoRoot) {
+    const load = loadTeamSkills(repoRoot, true).catch(() => teamSkillsByRoot.get(repoRoot) ?? []);
+    firstLoadByRoot.set(repoRoot, load);
+    return load;
+}
+async function loadTeamSkills(repoRoot, refresh) {
+    const config = await loadConfig(repoRoot);
+    const out = [];
+    const seen = new Set();
+    for (const src of config.skillsRepos) {
+        try {
+            if (refresh) {
+                const { bareDir, created } = await ensureBareClone(src.repo);
+                if (!created)
+                    await fetchAll(bareDir);
+                cloneAttempted.add(src.repo);
+                lastFetchByRepo.set(src.repo, Date.now());
+            }
+            else if (shouldPassiveFetch({
+                attempted: cloneAttempted.has(src.repo),
+                fetchedAt: lastFetchByRepo.get(src.repo) ?? 0,
+                now: Date.now(),
+                ttlMs: PASSIVE_FETCH_TTL_MS,
+            })) {
+                cloneAttempted.add(src.repo);
+                const { bareDir, created } = await ensureBareClone(src.repo);
+                // A clone left by an earlier run is very likely behind origin; fetch it
+                // so worktree reviews never read a stale skills template.
+                if (!created)
+                    await fetchAll(bareDir);
+                lastFetchByRepo.set(src.repo, Date.now());
+            }
+        }
+        catch {
+            // offline / no access — list whatever an older clone has (or nothing)
+        }
+        try {
+            for (const skill of await listRemoteSkills(src)) {
+                if (seen.has(skill.name))
+                    continue;
+                seen.add(skill.name);
+                out.push(skill);
+            }
+        }
+        catch {
+            // degrade: this source contributes nothing
+        }
+    }
+    teamSkillsByRoot.set(repoRoot, out);
+    return out;
+}
+//# sourceMappingURL=skills-remote.js.map

package/dist/skills-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-remote.js","sourceRoot":"","sources":["../src/skills-remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAyB,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAc,MAAM,aAAa,CAAC;AAE3D;;;;;;;GAOG;AAEH,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,6BAA6B;AAC7D,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,gBAAgB;AAUjD;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG;IACzB,IAAI;IACJ,0BAA0B;IAC1B,IAAI;IACJ,yBAAyB;IACzB,IAAI;IACJ,0BAA0B;CAC3B,CAAC;AACF,MAAM,iBAAiB,GAAG;IACxB,kBAAkB,EAAE,yBAAyB;IAC7C,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,SAAS,GAAG,CAAC,IAAc,EAAE,SAAiB,EAAE,GAAY;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,KAAK,EACL,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,EAChC;YACE,GAAG;YACH,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE;SAC9C,EACD,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAC3F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,8EAA8E;IAC9E,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,8EAA8E;IAC9E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,6EAA6E;IAC7E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,4CAA4C;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,iDAAiD;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,sBAAsB,KAAK,MAAM,CAAC;IAC/E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,sEAAsE;IACtE,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,CACL,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,MAAM,IAAI,GAAG;QACjB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI;SACjB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACtD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAC1C,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kCAAkC;QAClF,mFAAmF;QACnF,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1E,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,4BAA4B,CAAC,EAC5D,gBAAgB,EAChB,OAAO,CACR,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,GAAW;IACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,WAAW,CAAC,EACvD,eAAe,EACf,OAAO,CACR,CAAC;QACF,6EAA6E;QAC7E,OAAO,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,WAAW,CAAC,EAC7D,eAAe,EACf,OAAO,CACR,CAAC;QACF,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAqB,EACrB,IAAY,EACZ,QAAiB;IAEjB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAqB;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GACR,GAAG,CAAC,IAAI;YACR,CAAC,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC9D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE;gBACzB,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,WAAW,GACf,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YAC3E,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YAChC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,MAAM,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,KAAY;IACtE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1C,4EAA4E;QAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,cAAc,CAAC,QAAQ,EAAE,kBAAkB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC7D,IAAI,CAAC;QACH,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB,CAAC,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,EAC3D,eAAe,EACf,QAAQ,CACT,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9F,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO;QAC/C,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED,mFAAmF;AAEnF,yEAAyE;AACzE,4EAA4E;AAC5E,kBAAkB;AAClB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AACzC,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACjD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;AACnE,CAAC;AACD,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;AACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,KAAK,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7B,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,IACL,kBAAkB,CAAC;gBACjB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBACvC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;gBACf,KAAK,EAAE,oBAAoB;aAC5B,CAAC,EACF,CAAC;gBACD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7D,wEAAwE;gBACxE,0DAA0D;gBAC1D,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QACD,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skills-update.d.ts

@@ -0,0 +1,88 @@
+export type SkillsUpdateScope = 'project' | 'global';
+export type SkillsUpdateStatus = 'idle' | 'checking' | 'available' | 'updating' | 'current' | 'unavailable' | 'error';
+export interface SkillsUpdateScopeState {
+    scope: SkillsUpdateScope;
+    status: SkillsUpdateStatus;
+    available: boolean;
+    skills: string[];
+    checkedAt: string | null;
+    updatedAt: string | null;
+    reason?: string;
+}
+export interface SkillsUpdateState {
+    status: SkillsUpdateStatus;
+    available: boolean;
+    autoUpdateEnabled: boolean;
+    inherited: boolean;
+    checkedAt: string | null;
+    updatedAt: string | null;
+    scopes: SkillsUpdateScopeState[];
+    needsUpgradeNotes: boolean;
+}
+interface CommandResult {
+    stdout: string;
+    stderr: string;
+}
+export interface SkillsUpdateServiceOptions {
+    homeDir?: string;
+    now?: () => number;
+    timeoutMs?: number;
+    run?: (file: string, args: readonly string[], cwd: string, timeoutMs: number) => Promise<CommandResult>;
+    resolveNpx?: () => Promise<string | null>;
+    invalidateCatalog?: (repoRoot: string) => Promise<unknown> | unknown;
+}
+/** A manual apply distinguishes contention from ordinary unavailable state. */
+export declare class SkillsUpdateConflictError extends Error {
+    constructor();
+}
+/** Accept only GitHub's canonical host and the documented owner/repo shorthand. */
+export declare function isOpenMercatoSkillsSource(value: unknown): boolean;
+export declare class SkillsUpdateService {
+    private readonly home;
+    private readonly now;
+    private readonly timeoutMs;
+    private readonly runCommand;
+    private readonly resolveNpx;
+    private readonly invalidateCatalog;
+    private readonly states;
+    private readonly pending;
+    private globalScopeCache?;
+    private operationTail;
+    constructor(options?: SkillsUpdateServiceOptions);
+    snapshot(repoRoot: string): SkillsUpdateState;
+    check(repoRoot: string, force?: boolean): Promise<SkillsUpdateState>;
+    /** Apply only names proven available by the latest check. Browser callers
+     * cannot widen this list: ownership is re-read from the lock immediately
+     * before each fixed-argument invocation. */
+    update(repoRoot: string, rejectIfBusy?: boolean): Promise<SkillsUpdateState>;
+    evict(repoRoot: string): void;
+    private serialized;
+    private makeState;
+    private performCheck;
+    private performUpdate;
+    private checkScope;
+    private acquireLock;
+    private readLockMetadata;
+}
+export interface SkillsUpdateProject {
+    id: string;
+    root: string;
+    status?: string;
+}
+/** Post-listen owner for background checks. Its tail deliberately swallows
+ * failures: update availability can never reject or delay server startup. */
+export declare class SkillsUpdateCoordinator {
+    private readonly service;
+    private readonly autoUpdateEnabled;
+    private readonly roots;
+    private tail;
+    private stopped;
+    constructor(service: SkillsUpdateService, autoUpdateEnabled: () => Promise<boolean>);
+    start(projects: readonly SkillsUpdateProject[]): void;
+    add(id: string, root: string): void;
+    remove(id: string): void;
+    stop(): void;
+    /** Test/lifecycle hook: resolves after all work queued so far. */
+    settled(): Promise<void>;
+}
+export {};