@wrongstack/tools 0.284.1 → 0.286.0

package/dist/search.js.map

@@ -1 +1,7 @@
-{"version":3,"sources":["../src/fetch.ts","../src/search.ts"],"names":["undiciFetch","ToolValidationError","FetchError"],"mappings":";;;;;;;;AAmBA,IAAM,EAAA,GAAK,IAAI,eAAA,CAAgB;AAAA;AAAA,EAE7B,YAAA,EAAc,KAAA;AAAA;AAAA,EAEd,cAAA,EAAgB;AAClB,CAAC,CAAA;AAMD,EAAA,CAAG,QAAQ,wBAAA,EAA0B;AAAA,EACnC,MAAA,EAAQ,CAAC,QAAA,EAAU,OAAA,EAAS,UAAU,CAAA;AAAA,EACtC,aAAa,MAAM;AACrB,CAAC,CAAA;AAgBD,IAAM,oBAAoB,UAAA,CAAW,KAAA;AAErC,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,gCAAgC,CAAA,KAAM,GAAA;AAExE,IAAI,aAAA,IAAiB,CAAC,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG;AACvC,EAAA,OAAA,CAAQ,IAAA;AAAA,IACN;AAAA,GAGF;AACF;AAqBO,SAAS,aAAA,CACd,QAAA,EACA,OAAA,EACA,QAAA,EACM;AACN,EACG,GAAA,CAAA,MAAA,CAAO,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA,CAC9B,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,IAAA,MAAM,SAAS,OAAA,EAAS,MAAA;AACxB,IAAA,MAAM,QAAA,GACJ,MAAA,KAAW,CAAA,IAAK,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,MAAM,CAAA,GAAI,OAAA;AAC9E,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,OAAA;AAC9C,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,KAAW,CAAA,GAAI,aAAA,CAAc,EAAE,OAAO,CAAA,GAAI,aAAA,CAAc,CAAA,CAAE,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,QAAA;AAAA,YACE,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,sCAAsC,CAAA,CAAE,OAAO,EAAE,CAAA,EAAG;AAAA,cAC1E,IAAA,EAAM;AAAA,aACP;AAAA,WACH;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,QAAA;AAAA,QACE,IAAA;AAAA,QACA,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE;AAAA,OAC5D;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,EAAA,CAAG,CAAC,CAAA;AACvB,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,QAAA;AAAA,QACE,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,QAAQ,CAAA,CAAE,CAAA,EAAG,EAAE,IAAA,EAAM,WAAA,EAAa;AAAA,OACrF;AACA,MAAA;AAAA,IACF;AACA,IAAA,QAAA,CAAS,IAAA,EAAM,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,EAC5C,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,GAAA,KAAQ,QAAA,CAAS,GAA4B,CAAC,CAAA;AAC1D;AAOA,IAAI,WAAA;AACJ,SAAS,mBAAA,GAA6B;AACpC,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,WAAA,GAAc,IAAI,MAAM,EAAE,OAAA,EAAS,EAAE,MAAA,EAAQ,aAAA,IAA0B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,WAAA;AACT;AAEA,SAAS,eAAA,GAA2C;AAOlD,EAAA,OAAO,UAAA,CAAW,KAAA,KAAU,iBAAA,GACvBA,KAAA,GACD,UAAA,CAAW,KAAA;AACjB;AAKA,IAAI,qBAAA,GAAwB,KAAA;AAC5B,IAAI,CAAC,qBAAA,EAAuB;AAC1B,EAAA,qBAAA,GAAwB,IAAA;AAExB,EAAA,OAAA,CAAQ,EAAA,CAAG,cAAc,MAAM;AAC7B,IAAA,WAAA,EAAa,OAAA,EAAQ;AACrB,IAAA,WAAA,GAAc,MAAA;AAAA,EAChB,CAAC,CAAA;AACH;AAUA,eAAsB,YAAA,CACpB,GAAA,EACA,YAAA,EACA,MAAA,EACA,OAAA,GAAkC;AAAA,EAChC,YAAA,EAAc,0CAAA;AAAA,EACd,MAAA,EAAQ;AACV,CAAA,EACmB;AACnB,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,IAAI,UAAA,GAAa,GAAA;AACjB,EAAA,WAAS;AAGP,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,UAAU,CAAA;AACjC,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/D,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,CAAA,yCAAA,EAA4C,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,QACpE,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,OAAA,IAAW,CAAC,aAAA,EAAe;AACjD,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,gEAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,MAAM,gBAAA,CAAiB,OAAO,QAAQ,CAAA;AAQtC,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,QAAA,EAAU,QAAA;AAAA,MACV,MAAA;AAAA,MACA,OAAA;AAAA,MACA,YAAY,mBAAA;AAAoB,KAClC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,eAAA,EAAgB,CAAE,YAAY,IAA4B,CAAA;AAC5E,IAAA,IAAI,GAAA,CAAI,MAAA,GAAS,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACxC,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,aAAA,EAAA;AACA,IAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,OAAA,EAAS,mBAAmB,YAAY,CAAA,UAAA,CAAA;AAAA,QACxC,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,EAAE,GAAA,EAAK,UAAA,EAAY,cAAc,aAAA;AAAc,OACzD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAC3C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,OAAA,EAAS,gDAAA;AAAA,QACT,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,EAAE,GAAA,EAAK,UAAA,EAAY,aAAA;AAAc,OAC3C,CAAA;AAAA,IACH;AACA,IAAA,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,EAAE,QAAA,EAAS;AAAA,EACtD;AACF;AA2LA,eAAe,iBAAiB,QAAA,EAAiC;AAC/D,EAAA,IAAI,aAAA,EAAe;AAEnB,EAAA,MAAM,IAAA,GACJ,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,GAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AAE/E,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,MAC5B,OAAA,EAAS,iCAAA;AAAA,MACT,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAgB,SAAK,IAAI,CAAA;AAC/B,EAAA,IAAI,cAAc,CAAA,EAAG;AACnB,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,4CAA4C,IAAI,CAAA,CAAA,CAAA;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAA,IAAW,cAAc,CAAA,EAAG;AAC1B,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,4CAA4C,IAAI,CAAA,CAAA,CAAA;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAO;AAOL,IAAA,IAAI;AAEF,MAAA,MAAM,UAAU,MAAU,GAAA,CAAA,MAAA,CAAO,MAAM,EAAE,GAAA,EAAK,MAAM,CAAA;AACpD,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,KAAW,CAAA,GAAI,aAAA,CAAc,EAAE,OAAO,CAAA,GAAI,aAAA,CAAc,CAAA,CAAE,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,YAC5B,OAAA,EAAS,CAAA,mCAAA,EAAsC,CAAA,CAAE,OAAO,CAAA,CAAA;AAAA,YACxD,KAAA,EAAO;AAAA,WACR,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,KAAA,IAAS,GAAA,CAAI,QAAQ,UAAA,CAAW,QAAQ,GAAG,MAAM,GAAA;AAAA,IAEtE;AAAA,EACF;AACF;ACvbA,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,WAAA,GAAc,EAAA;AACpB,IAAM,UAAA,GAAa,IAAA;AACnB,IAAM,YAAA,GAAe,GAAA;AAMrB,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAEnC,IAAM,UAAA,GAA8C;AAAA,EACzD,IAAA,EAAM,QAAA;AAAA,EACN,QAAA,EAAU,QAAA;AAAA,EACV,WAAA,EACE,yNAAA;AAAA,EACF,SAAA,EACE,maAAA;AAAA,EAMF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,YAAA,EAAc,CAAC,cAAc,CAAA;AAAA,EAC7B,IAAA,EAAM,QAAA;AAAA,EACN,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,cAAA,EAAe;AAAA,MACrD,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa,sCAAA;AAAA,QACb,OAAA,EAAS,CAAA;AAAA,QACT,OAAA,EAAS;AAAA,OACX;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,YAAA,EAAc,QAAA,EAAU,MAAM,CAAA;AAAA,QACrC,WAAA,EAAa;AAAA,OACf;AAAA,MACA,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,OAAO;AAAA,GACpB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,gBAAgB,UAAA,CAAW,aAAA;AACjC,IAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC9E,IAAA,WAAA,MAAiB,EAAA,IAAM,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACtD,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,0CAA0C,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,IAAA,EAAM,IAAA,EAAqD;AACrF,IAAA,IAAI,CAAC,KAAA,EAAO,KAAA,IAAS,MAAM,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AAC9C,MAAA,MAAM,IAAIC,mBAAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,0DAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,WAAA,IAAe,WAAA,EAAa,WAAW,CAAC,CAAA;AAC/E,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,YAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,MAAM,UAAA,IAAc,KAAA;AACtC,IAAA,MAAM,QAAA,GAAW,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,KAAK,CAAA,CAAA;AAGzC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AAChC,MAAA,IAAI,SAAS,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,YAAY,YAAA,EAAc;AACxD,QAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UACxC,OAAO,CAAA,CAAE,KAAA;AAAA,UACT,KAAK,CAAA,CAAE,GAAA;AAAA,UACP,SAAS,CAAA,CAAE;AAAA,SACb,CAAE,CAAA;AACF,QAAA,MAAM;AAAA,UACJ,IAAA,EAAM,KAAA;AAAA,UACN,IAAA,EAAM,CAAA,eAAA,EAAkB,KAAA,CAAM,KAAK,MAAM,MAAM,CAAA,CAAA,CAAA;AAAA,UAC/C,MAAM,EAAE,MAAA,EAAQ,OAAO,KAAA,CAAM,KAAA,EAAO,QAAQ,IAAA;AAAK,SACnD;AACA,QAAA,MAAM;AAAA,UACJ,IAAA,EAAM,gBAAA;AAAA,UACN,MAAM,CAAA,EAAG,OAAA,CAAQ,MAAM,CAAA,qBAAA,EAAwB,MAAM,MAAM,CAAA,CAAA;AAAA,UAC3D,IAAA,EAAM,EAAE,KAAA,EAAO,OAAA,CAAQ,QAAQ,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAQ,KAAA,CAAM,MAAA;AAAO,SACpE;AACA,QAAA,MAAM;AAAA,UACJ,IAAA,EAAM,OAAA;AAAA,UACN,MAAA,EAAQ;AAAA,YACN,OAAO,KAAA,CAAM,KAAA;AAAA,YACb,OAAA,EAAS,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAAA,YAC7B,QAAQ,KAAA,CAAM,MAAA;AAAA,YACd,SAAA,EAAW,QAAQ,MAAA,IAAU,GAAA;AAAA,YAC7B,MAAA,EAAQ;AAAA;AACV,SACF;AACA,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM;AAAA,MACJ,IAAA,EAAM,KAAA;AAAA,MACN,IAAA,EAAM,CAAA,SAAA,EAAY,MAAM,CAAA,MAAA,EAAS,MAAM,KAAK,CAAA,OAAA,CAAA;AAAA,MAC5C,MAAM,EAAE,MAAA,EAAQ,OAAO,KAAA,CAAM,KAAA,EAAO,QAAQ,KAAA;AAAM,KACpD;AAEA,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI,eAAA,GAA0C,MAAA;AAC9C,IAAA,QAAQ,MAAA;AAAQ,MACd,KAAK,YAAA;AACH,QAAA,UAAA,GAAa,MAAM,gBAAA,CAAiB,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AACjE,QAAA;AAAA,MACF,KAAK,QAAA;AACH,QAAA,UAAA,GAAa,MAAM,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AAC7D,QAAA;AAAA,MACF,KAAK,MAAA;AACH,QAAA,UAAA,GAAa,MAAM,UAAA,CAAW,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AAC3D,QAAA;AAAA,MACF;AACE,QAAA,MAAM,IAAIA,mBAAAA,CAAoB;AAAA,UAC5B,OAAA,EAAS,2BAA2B,MAAM,CAAA,CAAA,CAAA;AAAA,UAC1C,KAAA,EAAO;AAAA,SACR,CAAA;AAAA;AAGL,IAAA,IAAI,MAAA,GAAS,iBAAA,CAAkB,UAAA,EAAY,KAAA,CAAM,KAAK,CAAA;AACtD,IAAA,IAAI,WAAW,YAAA,IAAgB,0BAAA,CAA2B,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAC9E,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,KAAA;AAAA,QACN,IAAA,EAAM,GAAG,MAAM,CAAA,gEAAA,CAAA;AAAA,QACf,MAAM,EAAE,MAAA,EAAQ,UAAU,YAAA,EAAc,KAAA,EAAO,MAAM,KAAA;AAAM,OAC7D;AACA,MAAA,UAAA,GAAa,MAAM,gBAAA,CAAiB,KAAA,CAAM,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AACjE,MAAA,MAAA,GAAS,iBAAA,CAAkB,UAAA,EAAY,KAAA,CAAM,KAAK,CAAA;AAClD,MAAA,eAAA,GAAkB,YAAA;AAAA,IACpB;AAEA,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAGxC,IAAA,KAAA,CAAM,GAAA,CAAI,QAAA,EAAU,EAAE,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,eAAA,EAAiB,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AACvF,IAAA,sBAAA,EAAuB;AAEvB,IAAA,MAAM;AAAA,MACJ,IAAA,EAAM,gBAAA;AAAA,MACN,IAAA,EAAM,CAAA,EAAG,YAAA,CAAa,MAAM,iBAAiB,eAAe,CAAA,CAAA;AAAA,MAC5D,IAAA,EAAM,EAAE,KAAA,EAAO,YAAA,CAAa,QAAQ,MAAA,EAAQ,KAAA,EAAO,QAAQ,eAAA;AAAgB,KAC7E;AACA,IAAA,MAAM;AAAA,MACJ,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ;AAAA,QACN,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,OAAA,EAAS,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,UAChC,OAAO,CAAA,CAAE,KAAA;AAAA,UACT,KAAK,CAAA,CAAE,GAAA;AAAA,UACP,SAAS,CAAA,CAAE;AAAA,SACb,CAAE,CAAA;AAAA,QACF,MAAA,EAAQ,eAAA;AAAA,QACR,SAAA,EAAW,aAAa,MAAA,IAAU,GAAA;AAAA,QAClC,MAAA,EAAQ;AAAA;AACV,KACF;AAAA,EACF;AACF;AAOA,SAAS,sBAAA,GAA+B;AACtC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,CAAA;AAC3C,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAA,CAAM,SAAQ,EAAG;AAC1C,IAAA,IAAI,KAAA,CAAM,SAAA,GAAY,MAAA,EAAQ,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,EAChD;AACF;AAGO,SAAS,kBAAA,GAA2B;AACzC,EAAA,KAAA,CAAM,KAAA,EAAM;AACd;AAMA,SAAS,iBAAA,CAAkB,SAAyB,KAAA,EAA+B;AACjF,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,MAAM,OAAA,GAAU,EAAE,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,KAAK,CAAA,CAAE,GAAA;AACzC,IAAA,MAAM,aAAa,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,KAAK,CAAA,CAAE,GAAA;AAC9C,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,UAAU,KAAK,CAAA,CAAE,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AACzD,MAAA,QAAA,CAAS,IAAI,UAAU,CAAA;AACvB,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IAChB;AAAA,EACF;AACA,EAAA,OAAO,YAAA,CAAa,SAAS,KAAK,CAAA;AACpC;AAEA,SAAS,YAAA,CAAa,SAAyB,KAAA,EAA+B;AAC5E,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,EAAY,CAAE,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACzE,EAAA,OAAO,OAAA,CACJ,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,IAAA,MAAM,UAAA,GAAa,CAAA,CAAE,KAAA,CAAM,WAAA,EAAY;AACvC,IAAA,MAAM,YAAA,GAAe,CAAA,CAAE,OAAA,CAAQ,WAAA,EAAY;AAC3C,IAAA,IAAI,QAAQ,CAAA,CAAE,KAAA;AACd,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA,EAAG,KAAA,IAAS,CAAA;AACxC,MAAA,IAAI,YAAA,CAAa,QAAA,CAAS,IAAI,CAAA,EAAG,KAAA,IAAS,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,GAAG,CAAA,EAAG,KAAA,EAAM;AAAA,EACvB,CAAC,EACA,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,KAAK,CAAA;AACrC;AAEA,SAAS,0BAAA,CAA2B,SAAyB,KAAA,EAAwB;AACnF,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACjC,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,EAAY,CAAE,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,IAAU,CAAC,CAAA;AAC1E,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC/B,EAAA,OAAO,CAAC,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM;AAC1B,IAAA,MAAM,QAAA,GAAW,CAAA,EAAG,CAAA,CAAE,KAAK,CAAA,CAAA,EAAI,CAAA,CAAE,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAA,CAAG,WAAA,EAAY;AAChE,IAAA,OAAO,MAAM,IAAA,CAAK,CAAC,SAAS,QAAA,CAAS,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,EACrD,CAAC,CAAA;AACH;AAMA,eAAe,gBAAA,CACb,KAAA,EACA,GAAA,EACA,MAAA,EACyB;AACzB,EAAA,MAAM,OAAA,GAAU,mBAAmB,KAAK,CAAA;AACxC,EAAA,MAAM,GAAA,GAAM,uCAAuC,OAAO,CAAA,eAAA,CAAA;AAE1D,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,GAAA,EAAK,QAAQ,UAAU,CAAA;AAC/D,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,OAAO,eAAA,CAAgB,MAAM,GAAG,CAAA;AAAA,EAClC,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAO,KAAA,EAAO,cAAA,CAAe,GAAG,CAAA,EAAG;AAAA,KAC9F;AAIA,IAAA,OAAO,CAAC,EAAE,KAAA,EAAO,oBAAA,EAAsB,GAAA,EAAK,sCAAsC,OAAA,EAAS,4BAAA,EAA8B,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,EACrI;AACF;AAEA,SAAS,QAAA,CAAY,MAAmB,GAAA,EAAkB;AACxD,EAAA,MAAM,MAAW,EAAC;AAClB,EAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,IAAI,GAAA,CAAI,UAAU,GAAA,EAAK;AACvB,IAAA,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,EACf;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,eAAA,CAAgB,MAAc,GAAA,EAA6B;AAClE,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,MAAM,SAAA,GAAY,+EAAA;AAClB,EAAA,MAAM,YAAA,GACJ,6FAAA;AAEF,EAAA,MAAM,WAAA,GAAc,QAAA;AAAA,IAClB,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,SAAS,CAAC,CAAA,CACzB,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,MAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAA;AAChC,MAAA,MAAM,IAAA,GAAO,WAAA,CAAY,KAAA,EAAO,MAAM,CAAA;AACtC,MAAA,MAAM,QAAQ,SAAA,CAAU,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AAC3C,MAAA,OAAO,IAAA,IAAQ,QAAQ,EAAE,GAAA,EAAK,uBAAuB,IAAI,CAAA,EAAG,OAAM,GAAI,MAAA;AAAA,IACxE,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAA2C,MAAM,MAAS,CAAA;AAAA,IACrE;AAAA,GACF;AAEA,EAAA,MAAM,cAAA,GAAiB,QAAA;AAAA,IACrB,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,YAAY,CAAC,CAAA,CAC5B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAC,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,SAAA,CAAU,cAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5C;AAAA,GACF;AAEA,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,YAAY,MAAA,IAAU,CAAA,GAAI,KAAK,CAAA,EAAA,EAAK;AACtD,IAAA,MAAM,KAAA,GAAQ,YAAY,CAAC,CAAA;AAC3B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,MAAM,KAAA,IAAS,EAAA;AAAA,QACtB,GAAA,EAAK,MAAM,GAAA,IAAO,EAAA;AAAA,QAClB,OAAA,EAAS,cAAA,CAAe,CAAC,CAAA,IAAK,EAAA;AAAA,QAC9B,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,WAAA,CAAY,OAAe,IAAA,EAAkC;AACpE,EAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,CAAA,GAAA,EAAM,IAAI,CAAA,uBAAA,CAAA,EAA2B,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAC9E,EAAA,IAAI,SAAS,CAAC,CAAA,SAAU,kBAAA,CAAmB,MAAA,CAAO,CAAC,CAAC,CAAA;AACpD,EAAA,MAAM,QAAA,GAAW,IAAI,MAAA,CAAO,CAAA,GAAA,EAAM,IAAI,CAAA,mBAAA,CAAA,EAAuB,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAC5E,EAAA,OAAO,WAAW,CAAC,CAAA,GAAI,mBAAmB,QAAA,CAAS,CAAC,CAAC,CAAA,GAAI,MAAA;AAC3D;AAEA,SAAS,uBAAuB,GAAA,EAAqB;AACnD,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,SAAS,GAAG,CAAA,CAAA;AAC7C,EAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,GAAG,GAAG,OAAO,GAAA;AACjC,EAAA,IAAI,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,GAAG,OAAO,GAAA;AACnC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,EAAK,wBAAwB,CAAA;AACjD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,OAAO,MAAM,UAAA,CAAW,MAAM,CAAA,GAAI,IAAA,GAAO,IAAI,QAAA,EAAS;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,GAAA;AAAA,EACT;AACF;AAEA,eAAe,YAAA,CAAa,KAAA,EAAe,GAAA,EAAa,MAAA,EAA8C;AACpG,EAAA,MAAM,OAAA,GAAU,mBAAmB,KAAK,CAAA;AACxC,EAAA,MAAM,GAAA,GAAM,mCAAmC,OAAO,CAAA,MAAA,CAAA;AAEtD,EAAA,MAAM,OAAO,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA,CACxD,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,IAAA,EAAM,CAAA,CACpB,KAAA,CAAM,MAAM,EAAE,CAAA;AAEjB,EAAA,OAAO,kBAAA,CAAmB,MAAM,GAAG,CAAA;AACrC;AAEA,SAAS,kBAAA,CAAmB,MAAc,GAAA,EAA6B;AACrE,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,MAAM,UAAA,GAAa,iDAAA;AACnB,EAAA,MAAM,QAAA,GAAW,8BAAA;AACjB,EAAA,MAAM,YAAA,GAAe,qDAAA;AAErB,EAAA,MAAM,MAAA,GAAS,QAAA;AAAA,IACb,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,SAAA,CAAU,cAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,IAC5F;AAAA,GACF;AAEA,EAAA,MAAM,IAAA,GAAO,QAAA;AAAA,IACX,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA,CACxB,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,CAAC,CAAC,CAAA,CAClB,IAAI,CAAC,CAAA,KAAM,SAAA,CAAU,aAAA,CAAc,EAAE,CAAC,CAAC,CAAC,CAAA,CAAE,QAAQ,2BAAA,EAA6B,IAAI,CAAC,CAAA,CACpF,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,IACrC;AAAA,GACF;AAEA,EAAA,MAAM,QAAA,GAAW,QAAA;AAAA,IACf,CAAC,GAAG,IAAA,CAAK,QAAA,CAAS,YAAY,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,SAAA,CAAU,cAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAAA,IAC9F;AAAA,GACF;AAEA,EAAA,KAAA,IAAS,CAAA,GAAI,GAAG,CAAA,GAAI,IAAA,CAAK,IAAI,MAAA,CAAO,MAAA,EAAQ,GAAG,CAAA,EAAG,CAAA,EAAA,EAAK;AACrD,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,KAAA,EAAO,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA;AAAA,MACpB,GAAA,EAAK,IAAA,CAAK,CAAC,CAAA,IAAK,EAAA;AAAA,MAChB,OAAA,EAAS,QAAA,CAAS,CAAC,CAAA,IAAK,EAAA;AAAA,MACxB,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,UAAA,CAAW,KAAA,EAAe,GAAA,EAAa,MAAA,EAA8C;AAClG,EAAA,MAAM,OAAA,GAAU,mBAAmB,KAAK,CAAA;AACxC,EAAA,MAAM,GAAA,GAAM,iCAAiC,OAAO,CAAA,CAAA;AAEpD,EAAA,MAAM,OAAO,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA,CACxD,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,IAAA,EAAM,CAAA,CACpB,KAAA,CAAM,MAAM,EAAE,CAAA;AAEjB,EAAA,OAAO,gBAAA,CAAiB,MAAM,GAAG,CAAA;AACnC;AAEA,SAAS,gBAAA,CAAiB,MAAc,GAAA,EAA6B;AACnE,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,MAAM,MAAA,GAAS,CAAC,GAAG,IAAA,CAAK,SAAS,2HAA2H,CAAC,CAAA,CAC1J,GAAA,CAAI,CAAC,CAAA,KAAM,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA;AACjC,EAAA,MAAM,aAAa,MAAA,CAAO,MAAA,GAAS,CAAA,GAAI,MAAA,GAAS,CAAC,IAAI,CAAA;AAErD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,UAAA,CAAW,OAAA,CAAQ,CAAC,KAAA,KAAU;AACrD,IAAA,MAAM,UAAA,GAAa,mDAAA,CAAoD,IAAA,CAAK,KAAK,CAAA;AACjF,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,EAAC;AACzB,IAAA,MAAM,OAAO,WAAA,CAAY,aAAA,CAAc,WAAW,CAAC,CAAC,GAAG,MAAM,CAAA;AAC7D,IAAA,MAAM,QAAQ,SAAA,CAAU,aAAA,CAAc,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACpD,IAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,SAAc,EAAC;AAC7B,IAAA,MAAM,eAAe,2FAAA,CAA4F,IAAA,CAAK,KAAK,CAAA,IACtH,4BAAA,CAA6B,KAAK,KAAK,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,eAAe,SAAA,CAAU,aAAA,CAAc,aAAa,EAAA,CAAG,EAAE,CAAC,CAAC,CAAA,GAAI,EAAA;AAC/E,IAAA,OAAO,CAAC,EAAE,GAAA,EAAK,gBAAA,CAAiB,IAAI,GAAG,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,EACnE,CAAC,GAAG,GAAG,CAAA;AAEP,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,MAAM,KAAA,GAAQ,QAAQ,CAAC,CAAA;AACvB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,QACX,KAAA,EAAO,MAAM,KAAA,IAAS,EAAA;AAAA,QACtB,GAAA,EAAK,MAAM,GAAA,IAAO,EAAA;AAAA,QAClB,OAAA,EAAS,MAAM,OAAA,IAAW,EAAA;AAAA,QAC1B,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAG,CAAA;AACvB,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,CAAS,UAAU,KAAK,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AACxE,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACxC,MAAA,MAAM,OAAA,GAAU,iBAAiB,OAAO,CAAA;AACxC,MAAA,IAAI,OAAA,EAAS,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,OAAA;AAAA,IAC1C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,iBAAiB,OAAA,EAA4C;AACpE,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,OAAA,GAAU,QAAQ,UAAA,CAAW,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,GAAI,OAAA;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,OAAA,CAAQ,OAAA,CAAQ,MAAM,GAAG,CAAA,CAAE,QAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAC,CAAA,GAAI,GAAG,GAAG,CAAA;AAC1G,IAAA,OAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EACtD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAMA,eAAe,gBAAA,CACb,GAAA,EACA,MAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAE5D,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,MAAA,EAAQ,UAAA,CAAW,MAAM,CAAA;AACvD,EAAA,IAAI;AAKF,IAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,GAAA,EAAK,GAAG,WAAA,EAAa;AAAA,MAClD,YAAA,EACE;AAAA,KACH,CAAA;AACD,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,OAAO,GAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,YAAA,CAAa,KAAK,CAAA;AAClB,IAAA,IAAI,aAAaC,UAAAA,EAAY;AAC3B,MAAA,MAAM,CAAA;AAAA,IACR;AACA,IAAA,MAAM,IAAIA,UAAAA,CAAW;AAAA,MACnB,OAAA,EAAS,2BAA2B,GAAG,CAAA,CAAA;AAAA,MACvC,MAAA,EAAQ,CAAA;AAAA,MACR,OAAA,EAAS,EAAE,GAAA,EAAI;AAAA,MACf,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AACF;AAEA,SAAS,aAAa,OAAA,EAAqC;AAMzD,EAAA,OAAO,WAAA,CAAY,IAAI,OAAO,CAAA;AAChC;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,OAAO,mBAAmB,IAAA,CAAK,OAAA,CAAQ,YAAY,EAAE,CAAC,EAAE,IAAA,EAAK;AAC/D;AAEA,SAAS,mBAAmB,IAAA,EAAsB;AAChD,EAAA,OAAO,KACJ,OAAA,CAAQ,QAAA,EAAU,GAAG,CAAA,CACrB,OAAA,CAAQ,SAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,GAAG,EACpB,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA,CACtB,OAAA,CAAQ,UAAU,GAAG,CAAA;AAC1B","file":"search.js","sourcesContent":["import * as dns from 'node:dns/promises';\nimport * as net from 'node:net';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport {\n  FetchError,\n  ToolError,\n  ToolValidationError,\n  isPrivateIPv4,\n  isPrivateIPv6,\n} from '@wrongstack/core';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport TurndownService from 'turndown';\nimport { truncateMiddle } from './_util.js';\n\n/**\n * Singleton Turndown instance for HTML→Markdown conversion.\n * Pre-configured with sensible defaults; code blocks are handled via the\n * default fenced code rule. Reused across all fetch calls.\n */\nconst TD = new TurndownService({\n  // Use `# Title` for headings, not setext underline style (`Title\\n=====`).\n  headingStyle: 'atx',\n  // Don't wrap code blocks in <pre> — render them as triple-backtick blocks.\n  codeBlockStyle: 'fenced',\n});\n\n// Strip <script>/<style>/<noscript> before turndown sees them. The old\n// hand-rolled converter did this via regex; turndown's DOM-based approach\n// may keep their text content unless we remove the elements first.\n// Using turndown's own addRule mechanism keeps the logic co-located.\nTD.addRule('stripDangerousElements', {\n  filter: ['script', 'style', 'noscript'],\n  replacement: () => '',\n});\n\ninterface FetchInput {\n  url: string;\n  format?: 'markdown' | 'text' | 'raw' | undefined;\n}\n\ninterface FetchOutput {\n  content: string;\n  status: number;\n  content_type: string;\n  url: string;\n}\n\nconst MAX_BYTES = 131_072;\nconst TIMEOUT_MS = 20_000;\nconst nativeGlobalFetch = globalThis.fetch;\n\nconst ALLOW_PRIVATE = process.env['WRONGSTACK_FETCH_ALLOW_PRIVATE'] === '1';\n/* v8 ignore next 8 -- module-load-time opt-in warning; gated on an env var not set during tests. */\nif (ALLOW_PRIVATE && !process.env['CI']) {\n  console.warn(\n    '[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active —\\n' +\n    '  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\\n' +\n    '  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks.',\n  );\n}\n\n/** Abort when any of the signals abort (Node 22+ — AbortSignal.any shipped in Node 20). */\nconst combineSignals = (signals: AbortSignal[]): AbortSignal => AbortSignal.any(signals);\n\ntype LookupCallback = (\n  err: NodeJS.ErrnoException | null,\n  address?: string | Array<{ address: string | undefined; family: number }>,\n  family?: number | undefined,\n) => void;\n\n/**\n * DNS lookup used by the undici dispatcher below. It performs the SINGLE name\n * resolution that the TCP connection actually uses, and rejects if any\n * resolved address is private/loopback/link-local. Because the connection\n * reuses exactly this result, there is no DNS-rebinding TOCTOU window between\n * the security check and the connect — closing the gap the old code documented\n * (validate with one dns.lookup, then let fetch re-resolve independently).\n * TLS still validates the certificate against the hostname (SNI is set by\n * undici from the URL), so pinning the IP does not weaken cert checking.\n */\nexport function guardedLookup(\n  hostname: string,\n  options: { all?: boolean | undefined; family?: number | undefined },\n  callback: LookupCallback,\n): void {\n  dns\n    .lookup(hostname, { all: true })\n    .then((records) => {\n      const family = options?.family;\n      const byFamily =\n        family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;\n      const list = byFamily.length > 0 ? byFamily : records;\n      if (!ALLOW_PRIVATE) {\n        for (const r of list) {\n          const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n          if (bad) {\n            callback(\n              Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {\n                code: 'EAI_FAIL',\n              }),\n            );\n            return;\n          }\n        }\n      }\n      if (options?.all) {\n        callback(\n          null,\n          list.map((r) => ({ address: r.address, family: r.family })),\n        );\n        return;\n      }\n      const first = list.at(0);\n      if (!first) {\n        callback(\n          Object.assign(new Error(`fetch: no address for ${hostname}`), { code: 'ENOTFOUND' }),\n        );\n        return;\n      }\n      callback(null, first.address, first.family);\n    })\n    .catch((err) => callback(err as NodeJS.ErrnoException));\n}\n\n// Reused across requests; guardedLookup re-validates on every new connection,\n// so connection pooling is safe. Literal-IP targets bypass lookup entirely and\n// are caught by assertNotPrivate's pre-check instead.\n// Destroyed on process exit so long-running processes (eternal autonomy,\n// MCP server mode) don't let the connection pool grow unboundedly.\nlet pinnedAgent: Agent | undefined;\nfunction getPinnedDispatcher(): Agent {\n  if (!pinnedAgent) {\n    pinnedAgent = new Agent({ connect: { lookup: guardedLookup as never } });\n  }\n  return pinnedAgent;\n}\n\nfunction dispatcherFetch(): typeof globalThis.fetch {\n  // Node's built-in global fetch is backed by its own bundled undici version.\n  // Passing an Agent from the workspace's `undici` package to that different\n  // dispatcher ABI fails on recent Node with:\n  //   UND_ERR_INVALID_ARG: invalid onRequestStart method\n  // Use the matching package fetch+Agent pair in real runs, but keep honoring\n  // test/user fetch shims that replace globalThis.fetch after this module loads.\n  return globalThis.fetch === nativeGlobalFetch\n    ? (undiciFetch as unknown as typeof globalThis.fetch)\n    : globalThis.fetch;\n}\n// Clean up the global dispatcher on exit — undici Agents maintain connection\n// pools and DNS caches that should be torn down in long-running processes.\n// Guard against duplicate registration (module reload/HMR would otherwise\n// accumulate listeners).\nlet _beforeExitRegistered = false;\nif (!_beforeExitRegistered) {\n  _beforeExitRegistered = true;\n  /* v8 ignore next 4 -- process 'beforeExit' cleanup; not deterministically triggerable in-test. */\n  process.on('beforeExit', () => {\n    pinnedAgent?.destroy();\n    pinnedAgent = undefined;\n  });\n}\n\n/**\n * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so\n * other builtin tools (e.g. `search`) get the same protections instead of a\n * weaker `redirect: 'follow'`. Every hop is re-checked against private/loopback\n * ranges and the connection is pinned to the validated IP via the undici\n * dispatcher (no DNS-rebinding TOCTOU). `headers` defaults to the plain `fetch`\n * tool's; callers may override (e.g. a browser User-Agent for search engines).\n */\nexport async function guardedFetch(\n  url: string,\n  maxRedirects: number,\n  signal: AbortSignal,\n  headers: Record<string, string> = {\n    'user-agent': 'WrongStack/1.0 (+https://wrongstack.com)',\n    accept: 'text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1',\n  },\n): Promise<Response> {\n  let redirectCount = 0;\n  let currentUrl = url;\n  for (;;) {\n    // Re-validate every hop. A public host can 302 to 169.254.169.254 (cloud metadata),\n    // or DNS can rebind between hops; checking only the initial URL is insufficient.\n    const parsed = new URL(currentUrl);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: redirect to unsupported protocol \"${parsed.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (parsed.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: redirect to http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(parsed.hostname);\n\n    // The dispatcher pins the connection to the IP guardedLookup validated —\n    // no independent re-resolution, so DNS rebinding can't swap in a private\n    // address between check and connect. `dispatcher` is a runtime option of\n    // Node's undici-backed global fetch but isn't in lib.dom's RequestInit, and\n    // our undici Agent's type differs from the @types/node copy — hence the\n    // cast. (Verified: global fetch invokes the Agent's custom lookup.)\n    const init = {\n      redirect: 'manual' as const,\n      signal,\n      headers,\n      dispatcher: getPinnedDispatcher(),\n    };\n    const res = await dispatcherFetch()(currentUrl, init as never as RequestInit);\n    if (res.status < 300 || res.status > 399) {\n      return res;\n    }\n    redirectCount++;\n    if (redirectCount > maxRedirects) {\n      throw new FetchError({\n        message: `fetch: exceeded ${maxRedirects} redirects`,\n        status: res.status,\n        context: { url: currentUrl, maxRedirects, redirectCount },\n      });\n    }\n    const location = res.headers.get('location');\n    if (!location) {\n      throw new FetchError({\n        message: 'fetch: redirect status with no location header',\n        status: res.status,\n        context: { url: currentUrl, redirectCount },\n      });\n    }\n    currentUrl = new URL(location, currentUrl).toString();\n  }\n}\n\nexport const fetchTool: Tool<FetchInput, FetchOutput> = {\n  name: 'fetch',\n  category: 'Network',\n  description:\n    'Fetch a URL and return its content. HTML pages are automatically converted to clean markdown. ' +\n    'This tool has strong SSRF protections (private IPs, localhost, and cloud metadata endpoints are blocked by default).',\n  usageHint:\n    'Use this when you need external information (documentation, API responses, web pages, etc.).\\n\\n' +\n    'Security notes:\\n' +\n    '- Only HTTPS is allowed by default.\\n' +\n    '- Internal/private networks are blocked unless explicitly enabled via environment variable.\\n' +\n    '- Redirects are followed but re-validated at each hop.\\n' +\n    '- Output is capped (128KB by default) to avoid flooding context.\\n' +\n    'Prefer this over raw `bash curl` or `bash wget`.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['net.outbound'],\n  icon: 'web',\n  // Trust rules for fetch match on the literal URL — declare it explicitly\n  // so a user can trust `https://api.example.com/*` without accidentally\n  // matching that pattern on any other tool that happens to have a `url`\n  // input field.\n  subjectKey: 'url',\n  timeoutMs: TIMEOUT_MS,\n  maxOutputBytes: MAX_BYTES,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      url: {\n        type: 'string',\n        description: 'The target URL (must use https://).',\n      },\n      format: {\n        type: 'string',\n        enum: ['markdown', 'text', 'raw'],\n        description: 'Output format. \"markdown\" is recommended for HTML pages.',\n      },\n    },\n    required: ['url'],\n  },\n  async execute(input, ctx, opts) {\n    let final: FetchOutput | undefined;\n    const executeStream = fetchTool.executeStream;\n    if (!executeStream) {\n      throw new ToolError({\n        message: 'fetchTool: stream execution unavailable',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) {\n      throw new ToolError({\n        message: 'fetch: stream ended without final event',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<FetchOutput>> {\n    if (!input?.url) {\n      throw new ToolValidationError({\n        message: 'fetch: url is required',\n        field: 'url',\n      });\n    }\n    const u = new URL(input.url);\n    if (u.protocol !== 'https:' && u.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: unsupported protocol \"${u.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (u.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(u.hostname);\n\n    yield { type: 'log', text: `GET ${input.url}` };\n\n    const ctrl = new AbortController();\n    const timer = setTimeout(() => ctrl.abort(new ToolError({\n      message: 'fetch timeout',\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n    })), TIMEOUT_MS);\n    const combined = combineSignals([opts.signal, ctrl.signal]);\n\n    try {\n      let res: Response;\n      try {\n        res = await guardedFetch(input.url, 5, combined);\n      } catch (err) {\n        // A user-initiated cancel propagates unchanged. Our own timeout and any\n        // transport failure get a diagnostic message: undici throws an opaque\n        // `TypeError: fetch failed` whose real reason (ENOTFOUND, ECONNREFUSED,\n        // UND_ERR_CONNECT_TIMEOUT, a TLS/cert error, …) lives only on `.cause`.\n        // Surfacing just `.message` left users with \"fetch failed\" and no clue\n        // why HTTPS broke (see #100), so unwrap the cause chain here.\n        if (opts.signal.aborted) throw err;\n        throw describeFetchError(err, input.url, ctrl.signal.aborted);\n      }\n\n      const ct = res.headers.get('content-type') ?? 'application/octet-stream';\n      if (/^image\\/|^audio\\/|^video\\/|application\\/octet-stream/.test(ct)) {\n        throw new FetchError({\n          message: `fetch: refusing to read binary content-type \"${ct}\"`,\n          status: res.status,\n          context: { url: res.url, contentType: ct },\n        });\n      }\n\n      yield {\n        type: 'log',\n        text: `HTTP ${res.status} ${ct}`,\n        data: { status: res.status, contentType: ct },\n      };\n\n      const reader = res.body?.getReader();\n      let received = 0;\n      const chunks: Uint8Array[] = [];\n      let pendingBytes = 0;\n      const FLUSH_AT = 4 * 1024;\n      if (reader) {\n        for (;;) {\n          const { value, done } = await reader.read();\n          if (done) break;\n          if (!value) continue;\n          received += value.byteLength;\n          pendingBytes += value.byteLength;\n          chunks.push(value);\n          if (pendingBytes >= FLUSH_AT) {\n            // Snapshot recent bytes for the partial_output. Keep it cheap —\n            // don't try to decode UTF-8 boundaries; the TUI just needs a\n            // \"things are happening\" signal.\n            const recent = Buffer.from(value).toString('utf-8');\n            yield {\n              type: 'partial_output',\n              text: recent,\n              data: { received },\n            };\n            pendingBytes = 0;\n          }\n          if (received > MAX_BYTES) break;\n        }\n      }\n      const text = Buffer.concat(chunks.map((c) => Buffer.from(c))).toString('utf8');\n\n      const format = input.format ?? (ct.includes('text/html') ? 'markdown' : 'text');\n      let content: string;\n      if (format === 'raw') content = text;\n      else if (format === 'markdown' && ct.includes('text/html')) content = TD.turndown(text);\n      else if (ct.includes('application/json')) content = prettyJson(text);\n      else content = text;\n\n      yield {\n        type: 'final',\n        output: {\n          content: truncateMiddle(content, MAX_BYTES),\n          status: res.status,\n          content_type: ct,\n          url: res.url,\n        },\n      };\n      // P2 #5: record the network request as a structured side effect.\n      ctx.recordSideEffect?.({\n        toolUseId: `fetch-${Date.now()}`,\n        toolName: 'fetch',\n        ts: new Date().toISOString(),\n        input: { url: input.url, format: input.format },\n        outcome: `HTTP ${res.status} (${ct})`,\n        risk: 'network',\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n  },\n};\n\nasync function assertNotPrivate(hostname: string): Promise<void> {\n  if (ALLOW_PRIVATE) return;\n\n  const host =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n\n  if (host === 'localhost' || host.endsWith('.localhost')) {\n    throw new ToolValidationError({\n      message: 'fetch: blocked localhost target',\n      field: 'url',\n    });\n  }\n\n  const ipVersion = net.isIP(host);\n  if (ipVersion === 4) {\n    if (isPrivateIPv4(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else if (ipVersion === 6) {\n    if (isPrivateIPv6(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else {\n    // Hostname — pre-flight check: resolve and reject if any record is private,\n    // so we fail fast with a clear error before opening a socket. The\n    // authoritative anti-rebinding control is guardedLookup on the pinned\n    // undici dispatcher (see getPinnedDispatcher): it performs the single\n    // resolution the connection actually uses, so there is no TOCTOU between\n    // this check and the connect. Each redirect target is re-checked too.\n    try {\n      // Use dns.lookup for async hostname resolution (matches guardedLookup below).\n      const records = await dns.lookup(host, { all: true });\n      for (const r of records) {\n        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n        if (bad) {\n          throw new ToolValidationError({\n            message: `fetch: resolved to private address ${r.address}`,\n            field: 'url',\n          });\n        }\n      }\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('fetch:')) throw err;\n      // DNS failure — let fetch handle it\n    }\n  }\n}\n\n/**\n * Turn an opaque undici `TypeError: fetch failed` into an actionable message by\n * walking its `.cause` chain. undici buries the transport reason (a DNS/socket\n * errno or a TLS handshake failure) one or more `.cause` hops down, so the bare\n * `.message` is always just \"fetch failed\". We join each distinct\n * `code: message` link so the user sees, e.g.,\n * `fetch: GET https://x failed — UND_ERR_CONNECT_TIMEOUT: Connect Timeout Error`.\n */\nfunction describeFetchError(err: unknown, url: string, timedOut: boolean): FetchError | ToolError {\n  if (timedOut) {\n    return new ToolError({\n      message: `fetch: GET ${url} timed out after ${TIMEOUT_MS}ms`,\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n      context: { url, timedOut: true, timeoutMs: TIMEOUT_MS },\n      cause: err,\n    });\n  }\n  const parts: string[] = [];\n  const seen = new Set<unknown>();\n  let cur: unknown = err;\n  while (cur instanceof Error && !seen.has(cur)) {\n    seen.add(cur);\n    const code = (cur as NodeJS.ErrnoException).code;\n    const label = code ? `${code}: ${cur.message}` : cur.message;\n    // Skip undici's uninformative top-level \"fetch failed\" wrapper, but keep it\n    // as a fallback if it turns out to be the only thing we have.\n    if (label && label !== 'fetch failed' && !parts.includes(label)) parts.push(label);\n    cur = (cur as { cause?: unknown }).cause;\n  }\n  const detail = parts.length > 0 ? parts.join(' → ') : 'fetch failed';\n  return new FetchError({\n    message: `fetch: GET ${url} failed — ${detail}`,\n    status: 502,\n    context: { url, timedOut: false, transportErrors: parts },\n    // Preserve the original undici / DNS / TLS chain so callers can inspect\n    // it via `err.cause` and structured `instanceof` checks. The flattened\n    // text version stays in the message for human readability.\n    cause: err,\n  });\n}\n\nfunction prettyJson(s: string): string {\n  try {\n    return JSON.stringify(JSON.parse(s), null, 2);\n  } catch {\n    return s;\n  }\n}\n","import { expectDefined, FetchError, ToolValidationError } from '@wrongstack/core';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { guardedFetch } from './fetch.js';\nimport { toErrorMessage } from '@wrongstack/core/utils';\n\ninterface SearchResult {\n  title: string;\n  url: string;\n  snippet: string;\n  score: number;\n}\n\ninterface CacheEntry {\n  results: SearchResult[];\n  source: string;\n  timestamp: number;\n}\n\ninterface SearchInput {\n  query: string;\n  num_results?: number | undefined;\n  source?: 'duckduckgo' | 'google' | 'bing' | undefined;\n  skip_cache?: boolean | undefined;\n}\n\ninterface SearchOutput {\n  query: string;\n  results: { title: string; url: string; snippet: string }[];\n  source: string;\n  truncated: boolean;\n  cached: boolean;\n}\n\nconst DEFAULT_NUM = 10;\nconst MAX_RESULTS = 50;\nconst TIMEOUT_MS = 15_000;\nconst CACHE_TTL_MS = 300_000; // 5 minutes — matches the former web-search plugin default\n\n// Module-level cache shared across calls within a single agent run. Keyed by\n// `<source>:<query>`. This is intentionally process-local (not persisted) —\n// it exists to avoid hammering a search engine when the model rephrases the\n// same query a few turns apart.\nconst cache = new Map<string, CacheEntry>();\n\nexport const searchTool: Tool<SearchInput, SearchOutput> = {\n  name: 'search',\n  category: 'Search',\n  description:\n    'Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL.',\n  usageHint:\n    'Good for: API documentation, error messages, library usage examples, current best practices.\\n\\n' +\n    '- Prefer specific queries over very broad ones.\\n' +\n    '- Results go through the guarded fetch system (same protections as the `fetch` tool).\\n' +\n    '- Supports duckduckgo (default), google, and bing sources.\\n' +\n    '- Set `skip_cache: true` to force a fresh search.\\n' +\n    '- This is often better than the model trying to recall outdated knowledge.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['net.outbound'],\n  icon: 'search',\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      query: { type: 'string', description: 'Search query' },\n      num_results: {\n        type: 'integer',\n        description: 'Number of results (1-50, default 10)',\n        minimum: 1,\n        maximum: MAX_RESULTS,\n      },\n      source: {\n        type: 'string',\n        enum: ['duckduckgo', 'google', 'bing'],\n        description: 'Search engine to use (default: duckduckgo)',\n      },\n      skip_cache: {\n        type: 'boolean',\n        description: 'Skip the in-memory cache and force a fresh search (default: false)',\n      },\n    },\n    required: ['query'],\n  },\n  async execute(input, ctx, opts) {\n    let final: SearchOutput | undefined;\n    const executeStream = searchTool.executeStream;\n    if (!executeStream) throw new Error('searchTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('search: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, _ctx, opts): AsyncGenerator<ToolStreamEvent<SearchOutput>> {\n    if (!input?.query || input.query.trim() === '') {\n      throw new ToolValidationError({\n        message: 'search: query is required and must be a non-empty string',\n        field: 'query',\n      });\n    }\n\n    const num = Math.max(1, Math.min(input.num_results ?? DEFAULT_NUM, MAX_RESULTS));\n    const source = input.source ?? 'duckduckgo';\n    const skipCache = input.skip_cache ?? false;\n    const cacheKey = `${source}:${input.query}`;\n\n    // --- Cache hit ---\n    if (!skipCache) {\n      const entry = cache.get(cacheKey);\n      if (entry && Date.now() - entry.timestamp < CACHE_TTL_MS) {\n        const results = entry.results.map((r) => ({\n          title: r.title,\n          url: r.url,\n          snippet: r.snippet,\n        }));\n        yield {\n          type: 'log',\n          text: `Cache hit for \"${input.query}\" (${source})`,\n          data: { source, query: input.query, cached: true },\n        };\n        yield {\n          type: 'partial_output',\n          text: `${results.length} cached results from ${entry.source}`,\n          data: { count: results.length, cached: true, source: entry.source },\n        };\n        yield {\n          type: 'final',\n          output: {\n            query: input.query,\n            results: results.slice(0, num),\n            source: entry.source,\n            truncated: results.length >= num,\n            cached: true,\n          },\n        };\n        return;\n      }\n    }\n\n    yield {\n      type: 'log',\n      text: `Querying ${source} for \"${input.query}\"…`,\n      data: { source, query: input.query, cached: false },\n    };\n\n    let rawResults: SearchResult[];\n    let effectiveSource: SearchOutput['source'] = source;\n    switch (source) {\n      case 'duckduckgo':\n        rawResults = await duckduckgoSearch(input.query, num, opts.signal);\n        break;\n      case 'google':\n        rawResults = await googleSearch(input.query, num, opts.signal);\n        break;\n      case 'bing':\n        rawResults = await bingSearch(input.query, num, opts.signal);\n        break;\n      default:\n        throw new ToolValidationError({\n          message: `search: unknown source \"${source}\"`,\n          field: 'source',\n        });\n    }\n\n    let ranked = rankSearchResults(rawResults, input.query);\n    if (source !== 'duckduckgo' && shouldFallbackToDuckDuckGo(ranked, input.query)) {\n      yield {\n        type: 'log',\n        text: `${source} returned no relevant static results; falling back to duckduckgo`,\n        data: { source, fallback: 'duckduckgo', query: input.query },\n      };\n      rawResults = await duckduckgoSearch(input.query, num, opts.signal);\n      ranked = rankSearchResults(rawResults, input.query);\n      effectiveSource = 'duckduckgo';\n    }\n\n    const finalResults = ranked.slice(0, num);\n\n    // --- Store in cache ---\n    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });\n    pruneStaleCacheEntries();\n\n    yield {\n      type: 'partial_output',\n      text: `${finalResults.length} results from ${effectiveSource}`,\n      data: { count: finalResults.length, cached: false, source: effectiveSource },\n    };\n    yield {\n      type: 'final',\n      output: {\n        query: input.query,\n        results: finalResults.map((r) => ({\n          title: r.title,\n          url: r.url,\n          snippet: r.snippet,\n        })),\n        source: effectiveSource,\n        truncated: finalResults.length >= num,\n        cached: false,\n      },\n    };\n  },\n};\n\n// ---------------------------------------------------------------------------\n// Cache helpers\n// ---------------------------------------------------------------------------\n\n/** Drop entries older than 2× the TTL — bounded growth, cheap to run per write. */\nfunction pruneStaleCacheEntries(): void {\n  const cutoff = Date.now() - CACHE_TTL_MS * 2;\n  for (const [key, entry] of cache.entries()) {\n    if (entry.timestamp < cutoff) cache.delete(key);\n  }\n}\n\n/** Exposed for tests so they can reset the module-level cache between cases. */\nexport function __clearSearchCache(): void {\n  cache.clear();\n}\n\n// ---------------------------------------------------------------------------\n// Ranking\n// ---------------------------------------------------------------------------\n\nfunction rankSearchResults(results: SearchResult[], query: string): SearchResult[] {\n  const seenUrls = new Set<string>();\n  const deduped: SearchResult[] = [];\n  for (const r of results) {\n    const noQuery = r.url.split('?')[0] ?? r.url;\n    const normalized = noQuery.split('#')[0] ?? r.url;\n    if (!seenUrls.has(normalized) && r.url.startsWith('http')) {\n      seenUrls.add(normalized);\n      deduped.push(r);\n    }\n  }\n  return scoreResults(deduped, query);\n}\n\nfunction scoreResults(results: SearchResult[], query: string): SearchResult[] {\n  const terms = query.toLowerCase().split(/\\s+/).filter((t) => t.length > 0);\n  return results\n    .map((r) => {\n      const titleLower = r.title.toLowerCase();\n      const snippetLower = r.snippet.toLowerCase();\n      let score = r.score;\n      for (const term of terms) {\n        if (titleLower.includes(term)) score += 2;\n        if (snippetLower.includes(term)) score += 1;\n      }\n      return { ...r, score };\n    })\n    .sort((a, b) => b.score - a.score);\n}\n\nfunction shouldFallbackToDuckDuckGo(results: SearchResult[], query: string): boolean {\n  if (results.length === 0) return true;\n  const terms = query.toLowerCase().split(/\\s+/).filter((t) => t.length >= 3);\n  if (terms.length === 0) return false;\n  return !results.some((r) => {\n    const haystack = `${r.title} ${r.url} ${r.snippet}`.toLowerCase();\n    return terms.some((term) => haystack.includes(term));\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Search engines\n// ---------------------------------------------------------------------------\n\nasync function duckduckgoSearch(\n  query: string,\n  num: number,\n  signal: AbortSignal,\n): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;\n\n  try {\n    const response = await fetchWithTimeout(url, signal, TIMEOUT_MS);\n    const html = await response.text();\n    return parseDuckDuckGo(html, num);\n  } catch (err) {\n    console.log(\n      JSON.stringify({ level: 'debug', event: 'search_failed', query, error: toErrorMessage(err) }),\n    );\n    // Return a sentinel result that survives the dedup filter (which drops\n    // non-http URLs). Using a placeholder http URL keeps it visible to the\n    // caller so they know the search failed rather than silently getting [].\n    return [{ title: 'Search unavailable', url: 'https://duckduckgo.com/unavailable', snippet: 'Could not reach DuckDuckGo', score: 0 }];\n  }\n}\n\nfunction takeFrom<T>(iter: Iterable<T>, max: number): T[] {\n  const out: T[] = [];\n  for (const item of iter) {\n    if (out.length >= max) break;\n    out.push(item);\n  }\n  return out;\n}\n\nfunction parseDuckDuckGo(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const linkRegex = /<a\\b([^>]*\\bclass=([\"'])[^\"']*\\bresult-link\\b[^\"']*\\2[^>]*)>([\\s\\S]*?)<\\/a>/gi;\n  const snippetRegex =\n    /<([a-z0-9]+)\\b([^>]*\\bclass=([\"'])[^\"']*\\bresult-snippet\\b[^\"']*\\3[^>]*)>([\\s\\S]*?)<\\/\\1>/gi;\n\n  const linkMatches = takeFrom(\n    [...html.matchAll(linkRegex)]\n      .map((m) => {\n        const attrs = expectDefined(m[1]);\n        const href = getHtmlAttr(attrs, 'href');\n        const title = stripTags(expectDefined(m[3]));\n        return href && title ? { url: normalizeDuckDuckGoUrl(href), title } : undefined;\n      })\n      .filter((m): m is { url: string; title: string } => m !== undefined),\n    num,\n  );\n\n  const snippetMatches = takeFrom(\n    [...html.matchAll(snippetRegex)]\n      .filter((m) => m[4])\n      .map((m) => stripTags(expectDefined(m[4]))),\n    num,\n  );\n\n  for (let i = 0; i < linkMatches.length && i < num; i++) {\n    const entry = linkMatches[i];\n    if (entry) {\n      results.push({\n        title: entry.title ?? '',\n        url: entry.url ?? '',\n        snippet: snippetMatches[i] ?? '',\n        score: 1,\n      });\n    }\n  }\n\n  return results;\n}\n\nfunction getHtmlAttr(attrs: string, name: string): string | undefined {\n  const quoted = new RegExp(`\\\\b${name}\\\\s*=\\\\s*([\"'])(.*?)\\\\1`, 'i').exec(attrs);\n  if (quoted?.[2]) return decodeHtmlEntities(quoted[2]);\n  const unquoted = new RegExp(`\\\\b${name}\\\\s*=\\\\s*([^\\\\s>]+)`, 'i').exec(attrs);\n  return unquoted?.[1] ? decodeHtmlEntities(unquoted[1]) : undefined;\n}\n\nfunction normalizeDuckDuckGoUrl(raw: string): string {\n  if (raw.startsWith('//')) return `https:${raw}`;\n  if (!raw.startsWith('/')) return raw;\n  if (!raw.startsWith('/l/')) return raw;\n  try {\n    const url = new URL(raw, 'https://duckduckgo.com');\n    const uddg = url.searchParams.get('uddg');\n    return uddg?.startsWith('http') ? uddg : url.toString();\n  } catch {\n    return raw;\n  }\n}\n\nasync function googleSearch(query: string, num: number, signal: AbortSignal): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://www.google.com/search?q=${encoded}&hl=en`;\n\n  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS)\n    .then((r) => r.text())\n    .catch(() => '');\n\n  return parseGoogleResults(html, num);\n}\n\nfunction parseGoogleResults(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const titleRegex = /<h3[^>]*class=\"[^\"]*DKV84\"[^>]*>([^<]+)<\\/h3>/gi;\n  const urlRegex = /<cite[^>]*>([^<]+)<\\/cite>/gi;\n  const snippetRegex = /<span[^>]*class=\"[^\"]*aXCZ0b[^>]*>([^<]+)<\\/span>/gi;\n\n  const titles = takeFrom(\n    [...html.matchAll(titleRegex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),\n    num,\n  );\n\n  const urls = takeFrom(\n    [...html.matchAll(urlRegex)]\n      .filter((m) => m[1])\n      .map((m) => stripTags(expectDefined(m[1])).replace(/^\\*(https?:\\/\\/[^\\s]+).*$/, '$1'))\n      .filter((u) => u.startsWith('http')),\n    num,\n  );\n\n  const snippets = takeFrom(\n    [...html.matchAll(snippetRegex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),\n    num,\n  );\n\n  for (let i = 0; i < Math.min(titles.length, num); i++) {\n    results.push({\n      title: titles[i] ?? '',\n      url: urls[i] ?? '',\n      snippet: snippets[i] ?? '',\n      score: 1,\n    });\n  }\n\n  return results;\n}\n\nasync function bingSearch(query: string, num: number, signal: AbortSignal): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://www.bing.com/search?q=${encoded}`;\n\n  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS)\n    .then((r) => r.text())\n    .catch(() => '');\n\n  return parseBingResults(html, num);\n}\n\nfunction parseBingResults(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const blocks = [...html.matchAll(/<li\\b[^>]*class=([\"'])[^\"']*\\bb_algo\\b[^\"']*\\1[^>]*>([\\s\\S]*?)(?=<li\\b[^>]*class=([\"'])[^\"']*\\bb_algo\\b[^\"']*\\3|<\\/ol>)/gi)]\n    .map((m) => expectDefined(m[2]));\n  const candidates = blocks.length > 0 ? blocks : [html];\n\n  const entries = takeFrom(candidates.flatMap((block) => {\n    const titleMatch = /<h2[^>]*>\\s*<a\\b([^>]*)>([\\s\\S]*?)<\\/a>\\s*<\\/h2>/i.exec(block);\n    if (!titleMatch) return [];\n    const href = getHtmlAttr(expectDefined(titleMatch[1]), 'href');\n    const title = stripTags(expectDefined(titleMatch[2]));\n    if (!href || !title) return [];\n    const snippetMatch = /<p\\b[^>]*class=([\"'])[^\"']*\\b(?:b_paractl|b_lineclamp\\d*)\\b[^\"']*\\1[^>]*>([\\s\\S]*?)<\\/p>/i.exec(block)\n      ?? /<p\\b[^>]*>([\\s\\S]*?)<\\/p>/i.exec(block);\n    const snippet = snippetMatch ? stripTags(expectDefined(snippetMatch.at(-1))) : '';\n    return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];\n  }), num);\n\n  for (let i = 0; i < entries.length; i++) {\n    const entry = entries[i];\n    if (entry) {\n      results.push({\n        title: entry.title ?? '',\n        url: entry.url ?? '',\n        snippet: entry.snippet ?? '',\n        score: 1,\n      });\n    }\n  }\n\n  return results;\n}\n\nfunction normalizeBingUrl(raw: string): string {\n  try {\n    const url = new URL(raw);\n    if (url.hostname.endsWith('bing.com') && url.pathname.startsWith('/ck/')) {\n      const encoded = url.searchParams.get('u');\n      const decoded = decodeBingTarget(encoded);\n      if (decoded?.startsWith('http')) return decoded;\n    }\n  } catch {\n    // Fall through to the raw URL.\n  }\n  return raw;\n}\n\nfunction decodeBingTarget(encoded: string | null): string | undefined {\n  if (!encoded) return undefined;\n  const payload = encoded.startsWith('a1') ? encoded.slice(2) : encoded;\n  try {\n    const padded = payload.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(payload.length / 4) * 4, '=');\n    return Buffer.from(padded, 'base64').toString('utf8');\n  } catch {\n    return undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// HTTP helper\n// ---------------------------------------------------------------------------\n\nasync function fetchWithTimeout(\n  url: string,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n  const fetchSignal = anySignal(signal, controller.signal);\n  try {\n    // F-05: route through the SSRF-guarded fetch (private-IP blocking, HTTPS,\n    // DNS-pinned dispatcher, per-hop redirect re-validation) instead of a bare\n    // `fetch` with `redirect: 'follow'`. Search hosts are fixed/trusted, but\n    // this closes the residual \"engine 30x → internal address\" redirect risk.\n    const res = await guardedFetch(url, 5, fetchSignal, {\n      'user-agent':\n        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n    });\n    clearTimeout(timer);\n    return res;\n  } catch (e) {\n    clearTimeout(timer);\n    if (e instanceof FetchError) {\n      throw e;\n    }\n    throw new FetchError({\n      message: `search: failed to fetch ${url}`,\n      status: 0,\n      context: { url },\n      cause: e,\n    });\n  }\n}\n\nfunction anySignal(...signals: AbortSignal[]): AbortSignal {\n  // Native combinator (Node ≥ 20.3; this repo requires ≥ 22). The previous\n  // hand-rolled version registered a non-once 'abort' listener on every\n  // input signal and never removed it — the run-level signal outlives each\n  // request, so listeners (and their closures) accumulated one per search\n  // call for the life of the agent run.\n  return AbortSignal.any(signals);\n}\n\nfunction stripTags(html: string): string {\n  return decodeHtmlEntities(html.replace(/<[^>]+>/g, '')).trim();\n}\n\nfunction decodeHtmlEntities(text: string): string {\n  return text\n    .replace(/&amp;/g, '&')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\");\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../src/search.ts", "../src/_fetch-guard.ts"],
+  "sourcesContent": ["import { expectDefined, FetchError, ToolValidationError } from '@wrongstack/core';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { guardedFetch } from './_fetch-guard.js';\nimport { toErrorMessage } from '@wrongstack/core/utils';\n\ninterface SearchResult {\n  title: string;\n  url: string;\n  snippet: string;\n  score: number;\n}\n\ninterface CacheEntry {\n  results: SearchResult[];\n  source: string;\n  timestamp: number;\n}\n\ninterface SearchInput {\n  query: string;\n  num_results?: number | undefined;\n  source?: 'duckduckgo' | 'google' | 'bing' | undefined;\n  skip_cache?: boolean | undefined;\n}\n\ninterface SearchOutput {\n  query: string;\n  results: { title: string; url: string; snippet: string }[];\n  source: string;\n  truncated: boolean;\n  cached: boolean;\n}\n\nconst DEFAULT_NUM = 10;\nconst MAX_RESULTS = 50;\nconst TIMEOUT_MS = 15_000;\nconst CACHE_TTL_MS = 300_000; // 5 minutes \u2014 matches the former web-search plugin default\nconst CACHE_MAX_ENTRIES = 200;\n\n// Module-level cache shared across calls within a single agent run. Keyed by\n// `<source>:<query>`. This is intentionally process-local (not persisted) \u2014\n// it exists to avoid hammering a search engine when the model rephrases the\n// same query a few turns apart.\nconst cache = new Map<string, CacheEntry>();\n\nexport const searchTool: Tool<SearchInput, SearchOutput> = {\n  name: 'search',\n  category: 'Search',\n  description:\n    'Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL.',\n  usageHint:\n    'Good for: API documentation, error messages, library usage examples, current best practices.\\n\\n' +\n    '- Prefer specific queries over very broad ones.\\n' +\n    '- Results go through the guarded fetch system (same protections as the `fetch` tool).\\n' +\n    '- Supports duckduckgo (default), google, and bing sources.\\n' +\n    '- Set `skip_cache: true` to force a fresh search.\\n' +\n    '- This is often better than the model trying to recall outdated knowledge.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['net.outbound'],\n  icon: 'search',\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      query: { type: 'string', description: 'Search query' },\n      num_results: {\n        type: 'integer',\n        description: 'Number of results (1-50, default 10)',\n        minimum: 1,\n        maximum: MAX_RESULTS,\n      },\n      source: {\n        type: 'string',\n        enum: ['duckduckgo', 'google', 'bing'],\n        description: 'Search engine to use (default: duckduckgo)',\n      },\n      skip_cache: {\n        type: 'boolean',\n        description: 'Skip the in-memory cache and force a fresh search (default: false)',\n      },\n    },\n    required: ['query'],\n  },\n  async execute(input, ctx, opts) {\n    let final: SearchOutput | undefined;\n    const executeStream = searchTool.executeStream;\n    if (!executeStream) throw new Error('searchTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('search: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, _ctx, opts): AsyncGenerator<ToolStreamEvent<SearchOutput>> {\n    if (!input?.query || input.query.trim() === '') {\n      throw new ToolValidationError({\n        message: 'search: query is required and must be a non-empty string',\n        field: 'query',\n      });\n    }\n\n    const num = Math.max(1, Math.min(input.num_results ?? DEFAULT_NUM, MAX_RESULTS));\n    const source = input.source ?? 'duckduckgo';\n    const skipCache = input.skip_cache ?? false;\n    const cacheKey = `${source}:${input.query}`;\n\n    // --- Cache hit ---\n    if (!skipCache) {\n      const entry = cache.get(cacheKey);\n      if (entry && Date.now() - entry.timestamp < CACHE_TTL_MS) {\n        const results = entry.results.map((r) => ({\n          title: r.title,\n          url: r.url,\n          snippet: r.snippet,\n        }));\n        yield {\n          type: 'log',\n          text: `Cache hit for \"${input.query}\" (${source})`,\n          data: { source, query: input.query, cached: true },\n        };\n        yield {\n          type: 'partial_output',\n          text: `${results.length} cached results from ${entry.source}`,\n          data: { count: results.length, cached: true, source: entry.source },\n        };\n        yield {\n          type: 'final',\n          output: {\n            query: input.query,\n            results: results.slice(0, num),\n            source: entry.source,\n            truncated: results.length >= num,\n            cached: true,\n          },\n        };\n        return;\n      }\n    }\n\n    yield {\n      type: 'log',\n      text: `Querying ${source} for \"${input.query}\"\u2026`,\n      data: { source, query: input.query, cached: false },\n    };\n\n    let rawResults: SearchResult[];\n    let effectiveSource: SearchOutput['source'] = source;\n    switch (source) {\n      case 'duckduckgo':\n        rawResults = await duckduckgoSearch(input.query, num, opts.signal);\n        break;\n      case 'google':\n        rawResults = await googleSearch(input.query, num, opts.signal);\n        break;\n      case 'bing':\n        rawResults = await bingSearch(input.query, num, opts.signal);\n        break;\n      default:\n        throw new ToolValidationError({\n          message: `search: unknown source \"${source}\"`,\n          field: 'source',\n        });\n    }\n\n    let ranked = rankSearchResults(rawResults, input.query);\n    if (source !== 'duckduckgo' && shouldFallbackToDuckDuckGo(ranked, input.query)) {\n      yield {\n        type: 'log',\n        text: `${source} returned no relevant static results; falling back to duckduckgo`,\n        data: { source, fallback: 'duckduckgo', query: input.query },\n      };\n      rawResults = await duckduckgoSearch(input.query, num, opts.signal);\n      ranked = rankSearchResults(rawResults, input.query);\n      effectiveSource = 'duckduckgo';\n    }\n\n    const finalResults = ranked.slice(0, num);\n\n    // --- Store in cache ---\n    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });\n    pruneCacheEntries();\n\n    yield {\n      type: 'partial_output',\n      text: `${finalResults.length} results from ${effectiveSource}`,\n      data: { count: finalResults.length, cached: false, source: effectiveSource },\n    };\n    yield {\n      type: 'final',\n      output: {\n        query: input.query,\n        results: finalResults.map((r) => ({\n          title: r.title,\n          url: r.url,\n          snippet: r.snippet,\n        })),\n        source: effectiveSource,\n        truncated: finalResults.length >= num,\n        cached: false,\n      },\n    };\n  },\n};\n\n// ---------------------------------------------------------------------------\n// Cache helpers\n// ---------------------------------------------------------------------------\n\n/** Drop stale entries, then evict oldest insertions to cap retained result data. */\nfunction pruneCacheEntries(): void {\n  const cutoff = Date.now() - CACHE_TTL_MS * 2;\n  for (const [key, entry] of cache.entries()) {\n    if (entry.timestamp < cutoff) cache.delete(key);\n  }\n  while (cache.size > CACHE_MAX_ENTRIES) {\n    const oldestKey = cache.keys().next().value;\n    if (oldestKey === undefined) break;\n    cache.delete(oldestKey);\n  }\n}\n\n/** Exposed for tests so they can reset the module-level cache between cases. */\nexport function __clearSearchCache(): void {\n  cache.clear();\n}\n\n// ---------------------------------------------------------------------------\n// Ranking\n// ---------------------------------------------------------------------------\n\nfunction rankSearchResults(results: SearchResult[], query: string): SearchResult[] {\n  const seenUrls = new Set<string>();\n  const deduped: SearchResult[] = [];\n  for (const r of results) {\n    const noQuery = r.url.split('?')[0] ?? r.url;\n    const normalized = noQuery.split('#')[0] ?? r.url;\n    if (!seenUrls.has(normalized) && r.url.startsWith('http')) {\n      seenUrls.add(normalized);\n      deduped.push(r);\n    }\n  }\n  return scoreResults(deduped, query);\n}\n\nfunction scoreResults(results: SearchResult[], query: string): SearchResult[] {\n  const terms = query.toLowerCase().split(/\\s+/).filter((t) => t.length > 0);\n  return results\n    .map((r) => {\n      const titleLower = r.title.toLowerCase();\n      const snippetLower = r.snippet.toLowerCase();\n      let score = r.score;\n      for (const term of terms) {\n        if (titleLower.includes(term)) score += 2;\n        if (snippetLower.includes(term)) score += 1;\n      }\n      return { ...r, score };\n    })\n    .sort((a, b) => b.score - a.score);\n}\n\nfunction shouldFallbackToDuckDuckGo(results: SearchResult[], query: string): boolean {\n  if (results.length === 0) return true;\n  const terms = query.toLowerCase().split(/\\s+/).filter((t) => t.length >= 3);\n  if (terms.length === 0) return false;\n  return !results.some((r) => {\n    const haystack = `${r.title} ${r.url} ${r.snippet}`.toLowerCase();\n    return terms.some((term) => haystack.includes(term));\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Search engines\n// ---------------------------------------------------------------------------\n\nasync function duckduckgoSearch(\n  query: string,\n  num: number,\n  signal: AbortSignal,\n): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;\n\n  try {\n    const response = await fetchWithTimeout(url, signal, TIMEOUT_MS);\n    const html = await response.text();\n    return parseDuckDuckGo(html, num);\n  } catch (err) {\n    console.log(\n      JSON.stringify({ level: 'debug', event: 'search_failed', query, error: toErrorMessage(err) }),\n    );\n    // Return a sentinel result that survives the dedup filter (which drops\n    // non-http URLs). Using a placeholder http URL keeps it visible to the\n    // caller so they know the search failed rather than silently getting [].\n    return [{ title: 'Search unavailable', url: 'https://duckduckgo.com/unavailable', snippet: 'Could not reach DuckDuckGo', score: 0 }];\n  }\n}\n\nfunction takeFrom<T>(iter: Iterable<T>, max: number): T[] {\n  const out: T[] = [];\n  for (const item of iter) {\n    if (out.length >= max) break;\n    out.push(item);\n  }\n  return out;\n}\n\nfunction parseDuckDuckGo(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const linkRegex = /<a\\b([^>]*\\bclass=([\"'])[^\"']*\\bresult-link\\b[^\"']*\\2[^>]*)>([\\s\\S]*?)<\\/a>/gi;\n  const snippetRegex =\n    /<([a-z0-9]+)\\b([^>]*\\bclass=([\"'])[^\"']*\\bresult-snippet\\b[^\"']*\\3[^>]*)>([\\s\\S]*?)<\\/\\1>/gi;\n\n  const linkMatches = takeFrom(\n    [...html.matchAll(linkRegex)]\n      .map((m) => {\n        const attrs = expectDefined(m[1]);\n        const href = getHtmlAttr(attrs, 'href');\n        const title = stripTags(expectDefined(m[3]));\n        return href && title ? { url: normalizeDuckDuckGoUrl(href), title } : undefined;\n      })\n      .filter((m): m is { url: string; title: string } => m !== undefined),\n    num,\n  );\n\n  const snippetMatches = takeFrom(\n    [...html.matchAll(snippetRegex)]\n      .filter((m) => m[4])\n      .map((m) => stripTags(expectDefined(m[4]))),\n    num,\n  );\n\n  for (let i = 0; i < linkMatches.length && i < num; i++) {\n    const entry = linkMatches[i];\n    if (entry) {\n      results.push({\n        title: entry.title ?? '',\n        url: entry.url ?? '',\n        snippet: snippetMatches[i] ?? '',\n        score: 1,\n      });\n    }\n  }\n\n  return results;\n}\n\nfunction getHtmlAttr(attrs: string, name: string): string | undefined {\n  const quoted = new RegExp(`\\\\b${name}\\\\s*=\\\\s*([\"'])(.*?)\\\\1`, 'i').exec(attrs);\n  if (quoted?.[2]) return decodeHtmlEntities(quoted[2]);\n  const unquoted = new RegExp(`\\\\b${name}\\\\s*=\\\\s*([^\\\\s>]+)`, 'i').exec(attrs);\n  return unquoted?.[1] ? decodeHtmlEntities(unquoted[1]) : undefined;\n}\n\nfunction normalizeDuckDuckGoUrl(raw: string): string {\n  if (raw.startsWith('//')) return `https:${raw}`;\n  if (!raw.startsWith('/')) return raw;\n  if (!raw.startsWith('/l/')) return raw;\n  try {\n    const url = new URL(raw, 'https://duckduckgo.com');\n    const uddg = url.searchParams.get('uddg');\n    return uddg?.startsWith('http') ? uddg : url.toString();\n  } catch {\n    return raw;\n  }\n}\n\nasync function googleSearch(query: string, num: number, signal: AbortSignal): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://www.google.com/search?q=${encoded}&hl=en`;\n\n  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS)\n    .then((r) => r.text())\n    .catch(() => '');\n\n  return parseGoogleResults(html, num);\n}\n\nfunction parseGoogleResults(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const titleRegex = /<h3[^>]*class=\"[^\"]*DKV84\"[^>]*>([^<]+)<\\/h3>/gi;\n  const urlRegex = /<cite[^>]*>([^<]+)<\\/cite>/gi;\n  const snippetRegex = /<span[^>]*class=\"[^\"]*aXCZ0b[^>]*>([^<]+)<\\/span>/gi;\n\n  const titles = takeFrom(\n    [...html.matchAll(titleRegex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),\n    num,\n  );\n\n  const urls = takeFrom(\n    [...html.matchAll(urlRegex)]\n      .filter((m) => m[1])\n      .map((m) => stripTags(expectDefined(m[1])).replace(/^\\*(https?:\\/\\/[^\\s]+).*$/, '$1'))\n      .filter((u) => u.startsWith('http')),\n    num,\n  );\n\n  const snippets = takeFrom(\n    [...html.matchAll(snippetRegex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),\n    num,\n  );\n\n  for (let i = 0; i < Math.min(titles.length, num); i++) {\n    results.push({\n      title: titles[i] ?? '',\n      url: urls[i] ?? '',\n      snippet: snippets[i] ?? '',\n      score: 1,\n    });\n  }\n\n  return results;\n}\n\nasync function bingSearch(query: string, num: number, signal: AbortSignal): Promise<SearchResult[]> {\n  const encoded = encodeURIComponent(query);\n  const url = `https://www.bing.com/search?q=${encoded}`;\n\n  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS)\n    .then((r) => r.text())\n    .catch(() => '');\n\n  return parseBingResults(html, num);\n}\n\nfunction parseBingResults(html: string, num: number): SearchResult[] {\n  const results: SearchResult[] = [];\n  const blocks = [...html.matchAll(/<li\\b[^>]*class=([\"'])[^\"']*\\bb_algo\\b[^\"']*\\1[^>]*>([\\s\\S]*?)(?=<li\\b[^>]*class=([\"'])[^\"']*\\bb_algo\\b[^\"']*\\3|<\\/ol>)/gi)]\n    .map((m) => expectDefined(m[2]));\n  const candidates = blocks.length > 0 ? blocks : [html];\n\n  const entries = takeFrom(candidates.flatMap((block) => {\n    const titleMatch = /<h2[^>]*>\\s*<a\\b([^>]*)>([\\s\\S]*?)<\\/a>\\s*<\\/h2>/i.exec(block);\n    if (!titleMatch) return [];\n    const href = getHtmlAttr(expectDefined(titleMatch[1]), 'href');\n    const title = stripTags(expectDefined(titleMatch[2]));\n    if (!href || !title) return [];\n    const snippetMatch = /<p\\b[^>]*class=([\"'])[^\"']*\\b(?:b_paractl|b_lineclamp\\d*)\\b[^\"']*\\1[^>]*>([\\s\\S]*?)<\\/p>/i.exec(block)\n      ?? /<p\\b[^>]*>([\\s\\S]*?)<\\/p>/i.exec(block);\n    const snippet = snippetMatch ? stripTags(expectDefined(snippetMatch.at(-1))) : '';\n    return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];\n  }), num);\n\n  for (let i = 0; i < entries.length; i++) {\n    const entry = entries[i];\n    if (entry) {\n      results.push({\n        title: entry.title ?? '',\n        url: entry.url ?? '',\n        snippet: entry.snippet ?? '',\n        score: 1,\n      });\n    }\n  }\n\n  return results;\n}\n\nfunction normalizeBingUrl(raw: string): string {\n  try {\n    const url = new URL(raw);\n    if (url.hostname.endsWith('bing.com') && url.pathname.startsWith('/ck/')) {\n      const encoded = url.searchParams.get('u');\n      const decoded = decodeBingTarget(encoded);\n      if (decoded?.startsWith('http')) return decoded;\n    }\n  } catch {\n    // Fall through to the raw URL.\n  }\n  return raw;\n}\n\nfunction decodeBingTarget(encoded: string | null): string | undefined {\n  if (!encoded) return undefined;\n  const payload = encoded.startsWith('a1') ? encoded.slice(2) : encoded;\n  try {\n    const padded = payload.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(payload.length / 4) * 4, '=');\n    return Buffer.from(padded, 'base64').toString('utf8');\n  } catch {\n    return undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// HTTP helper\n// ---------------------------------------------------------------------------\n\nasync function fetchWithTimeout(\n  url: string,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n\n  const fetchSignal = anySignal(signal, controller.signal);\n  try {\n    // F-05: route through the SSRF-guarded fetch (private-IP blocking, HTTPS,\n    // DNS-pinned dispatcher, per-hop redirect re-validation) instead of a bare\n    // `fetch` with `redirect: 'follow'`. Search hosts are fixed/trusted, but\n    // this closes the residual \"engine 30x \u2192 internal address\" redirect risk.\n    const res = await guardedFetch(url, 5, fetchSignal, {\n      'user-agent':\n        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n    });\n    clearTimeout(timer);\n    return res;\n  } catch (e) {\n    clearTimeout(timer);\n    if (e instanceof FetchError) {\n      throw e;\n    }\n    throw new FetchError({\n      message: `search: failed to fetch ${url}`,\n      status: 0,\n      context: { url },\n      cause: e,\n    });\n  }\n}\n\nfunction anySignal(...signals: AbortSignal[]): AbortSignal {\n  // Native combinator (Node \u2265 20.3; this repo requires \u2265 22). The previous\n  // hand-rolled version registered a non-once 'abort' listener on every\n  // input signal and never removed it \u2014 the run-level signal outlives each\n  // request, so listeners (and their closures) accumulated one per search\n  // call for the life of the agent run.\n  return AbortSignal.any(signals);\n}\n\nfunction stripTags(html: string): string {\n  return decodeHtmlEntities(html.replace(/<[^>]+>/g, '')).trim();\n}\n\nfunction decodeHtmlEntities(text: string): string {\n  return text\n    .replace(/&amp;/g, '&')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\");\n}\n", "import * as dns from 'node:dns/promises';\nimport * as net from 'node:net';\nimport {\n  FetchError,\n  ToolValidationError,\n  isPrivateIPv4,\n  isPrivateIPv6,\n} from '@wrongstack/core';\nimport { Agent, fetch as undiciFetch } from 'undici';\n\n/**\n * SSRF guard machinery shared by the `fetch` and `search` tools. Split out of\n * fetch.ts so entries that only need `guardedFetch` (search) don't bundle the\n * whole fetch tool. Everything here is security-critical: the pinned undici\n * dispatcher performs the SINGLE DNS resolution the TCP connection uses, so\n * there is no DNS-rebinding TOCTOU between validation and connect.\n */\n\nconst nativeGlobalFetch = globalThis.fetch;\n\nexport const ALLOW_PRIVATE = process.env['WRONGSTACK_FETCH_ALLOW_PRIVATE'] === '1';\n/* v8 ignore next 8 -- module-load-time opt-in warning; gated on an env var not set during tests. */\nif (ALLOW_PRIVATE && !process.env['CI']) {\n  console.warn(\n    '[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active \u2014\\n' +\n    '  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\\n' +\n    '  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks.',\n  );\n}\n\ntype LookupCallback = (\n  err: NodeJS.ErrnoException | null,\n  address?: string | Array<{ address: string | undefined; family: number }>,\n  family?: number | undefined,\n) => void;\n\n/**\n * DNS lookup used by the undici dispatcher below. It performs the SINGLE name\n * resolution that the TCP connection actually uses, and rejects if any\n * resolved address is private/loopback/link-local. Because the connection\n * reuses exactly this result, there is no DNS-rebinding TOCTOU window between\n * the security check and the connect \u2014 closing the gap the old code documented\n * (validate with one dns.lookup, then let fetch re-resolve independently).\n * TLS still validates the certificate against the hostname (SNI is set by\n * undici from the URL), so pinning the IP does not weaken cert checking.\n */\nexport function guardedLookup(\n  hostname: string,\n  options: { all?: boolean | undefined; family?: number | undefined },\n  callback: LookupCallback,\n): void {\n  dns\n    .lookup(hostname, { all: true })\n    .then((records) => {\n      const family = options?.family;\n      const byFamily =\n        family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;\n      const list = byFamily.length > 0 ? byFamily : records;\n      if (!ALLOW_PRIVATE) {\n        for (const r of list) {\n          const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n          if (bad) {\n            callback(\n              Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {\n                code: 'EAI_FAIL',\n              }),\n            );\n            return;\n          }\n        }\n      }\n      if (options?.all) {\n        callback(\n          null,\n          list.map((r) => ({ address: r.address, family: r.family })),\n        );\n        return;\n      }\n      const first = list.at(0);\n      if (!first) {\n        callback(\n          Object.assign(new Error(`fetch: no address for ${hostname}`), { code: 'ENOTFOUND' }),\n        );\n        return;\n      }\n      callback(null, first.address, first.family);\n    })\n    .catch((err) => callback(err as NodeJS.ErrnoException));\n}\n\n// Reused across requests; guardedLookup re-validates on every new connection,\n// so connection pooling is safe. Literal-IP targets bypass lookup entirely and\n// are caught by assertNotPrivate's pre-check instead.\n// Destroyed on process exit so long-running processes (eternal autonomy,\n// MCP server mode) don't let the connection pool grow unboundedly.\nlet pinnedAgent: Agent | undefined;\nfunction getPinnedDispatcher(): Agent {\n  if (!pinnedAgent) {\n    pinnedAgent = new Agent({ connect: { lookup: guardedLookup as never } });\n  }\n  return pinnedAgent;\n}\n\nfunction dispatcherFetch(): typeof globalThis.fetch {\n  // Node's built-in global fetch is backed by its own bundled undici version.\n  // Passing an Agent from the workspace's `undici` package to that different\n  // dispatcher ABI fails on recent Node with:\n  //   UND_ERR_INVALID_ARG: invalid onRequestStart method\n  // Use the matching package fetch+Agent pair in real runs, but keep honoring\n  // test/user fetch shims that replace globalThis.fetch after this module loads.\n  return globalThis.fetch === nativeGlobalFetch\n    ? (undiciFetch as unknown as typeof globalThis.fetch)\n    : globalThis.fetch;\n}\n// Clean up the global dispatcher on exit \u2014 undici Agents maintain connection\n// pools and DNS caches that should be torn down in long-running processes.\n// Guard against duplicate registration (module reload/HMR would otherwise\n// accumulate listeners).\nlet _beforeExitRegistered = false;\nif (!_beforeExitRegistered) {\n  _beforeExitRegistered = true;\n  /* v8 ignore next 4 -- process 'beforeExit' cleanup; not deterministically triggerable in-test. */\n  process.on('beforeExit', () => {\n    pinnedAgent?.destroy();\n    pinnedAgent = undefined;\n  });\n}\n\n/**\n * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so\n * other builtin tools (e.g. `search`) get the same protections instead of a\n * weaker `redirect: 'follow'`. Every hop is re-checked against private/loopback\n * ranges and the connection is pinned to the validated IP via the undici\n * dispatcher (no DNS-rebinding TOCTOU). `headers` defaults to the plain `fetch`\n * tool's; callers may override (e.g. a browser User-Agent for search engines).\n */\nexport async function guardedFetch(\n  url: string,\n  maxRedirects: number,\n  signal: AbortSignal,\n  headers: Record<string, string> = {\n    'user-agent': 'WrongStack/1.0 (+https://wrongstack.com)',\n    accept: 'text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1',\n  },\n): Promise<Response> {\n  let redirectCount = 0;\n  let currentUrl = url;\n  for (;;) {\n    // Re-validate every hop. A public host can 302 to 169.254.169.254 (cloud metadata),\n    // or DNS can rebind between hops; checking only the initial URL is insufficient.\n    const parsed = new URL(currentUrl);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: redirect to unsupported protocol \"${parsed.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (parsed.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: redirect to http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(parsed.hostname);\n\n    // The dispatcher pins the connection to the IP guardedLookup validated \u2014\n    // no independent re-resolution, so DNS rebinding can't swap in a private\n    // address between check and connect. `dispatcher` is a runtime option of\n    // Node's undici-backed global fetch but isn't in lib.dom's RequestInit, and\n    // our undici Agent's type differs from the @types/node copy \u2014 hence the\n    // cast. (Verified: global fetch invokes the Agent's custom lookup.)\n    const init = {\n      redirect: 'manual' as const,\n      signal,\n      headers,\n      dispatcher: getPinnedDispatcher(),\n    };\n    const res = await dispatcherFetch()(currentUrl, init as never as RequestInit);\n    if (res.status < 300 || res.status > 399) {\n      return res;\n    }\n    redirectCount++;\n    if (redirectCount > maxRedirects) {\n      throw new FetchError({\n        message: `fetch: exceeded ${maxRedirects} redirects`,\n        status: res.status,\n        context: { url: currentUrl, maxRedirects, redirectCount },\n      });\n    }\n    const location = res.headers.get('location');\n    if (!location) {\n      throw new FetchError({\n        message: 'fetch: redirect status with no location header',\n        status: res.status,\n        context: { url: currentUrl, redirectCount },\n      });\n    }\n    currentUrl = new URL(location, currentUrl).toString();\n  }\n}\n\nexport async function assertNotPrivate(hostname: string): Promise<void> {\n  if (ALLOW_PRIVATE) return;\n\n  const host =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n\n  if (host === 'localhost' || host.endsWith('.localhost')) {\n    throw new ToolValidationError({\n      message: 'fetch: blocked localhost target',\n      field: 'url',\n    });\n  }\n\n  const ipVersion = net.isIP(host);\n  if (ipVersion === 4) {\n    if (isPrivateIPv4(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else if (ipVersion === 6) {\n    if (isPrivateIPv6(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else {\n    // Hostname \u2014 pre-flight check: resolve and reject if any record is private,\n    // so we fail fast with a clear error before opening a socket. The\n    // authoritative anti-rebinding control is guardedLookup on the pinned\n    // undici dispatcher (see getPinnedDispatcher): it performs the single\n    // resolution the connection actually uses, so there is no TOCTOU between\n    // this check and the connect. Each redirect target is re-checked too.\n    try {\n      // Use dns.lookup for async hostname resolution (matches guardedLookup above).\n      const records = await dns.lookup(host, { all: true });\n      for (const r of records) {\n        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n        if (bad) {\n          throw new ToolValidationError({\n            message: `fetch: resolved to private address ${r.address}`,\n            field: 'url',\n          });\n        }\n      }\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('fetch:')) throw err;\n      // DNS failure \u2014 let fetch handle it\n    }\n  }\n}\n"],
+  "mappings": ";AAAA,SAAS,eAAe,cAAAA,aAAY,uBAAAC,4BAA2B;;;ACA/D,YAAY,SAAS;AACrB,YAAY,SAAS;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,OAAO,SAAS,mBAAmB;AAU5C,IAAM,oBAAoB,WAAW;AAE9B,IAAM,gBAAgB,QAAQ,IAAI,gCAAgC,MAAM;AAE/E,IAAI,iBAAiB,CAAC,QAAQ,IAAI,IAAI,GAAG;AACvC,UAAQ;AAAA,IACN;AAAA,EAGF;AACF;AAkBO,SAAS,cACd,UACA,SACA,UACM;AACN,EACG,WAAO,UAAU,EAAE,KAAK,KAAK,CAAC,EAC9B,KAAK,CAAC,YAAY;AACjB,UAAM,SAAS,SAAS;AACxB,UAAM,WACJ,WAAW,KAAK,WAAW,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,IAAI;AAC9E,UAAM,OAAO,SAAS,SAAS,IAAI,WAAW;AAC9C,QAAI,CAAC,eAAe;AAClB,iBAAW,KAAK,MAAM;AACpB,cAAM,MAAM,EAAE,WAAW,IAAI,cAAc,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO;AAC/E,YAAI,KAAK;AACP;AAAA,YACE,OAAO,OAAO,IAAI,MAAM,sCAAsC,EAAE,OAAO,EAAE,GAAG;AAAA,cAC1E,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB;AAAA,QACE;AAAA,QACA,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO,EAAE;AAAA,MAC5D;AACA;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,GAAG,CAAC;AACvB,QAAI,CAAC,OAAO;AACV;AAAA,QACE,OAAO,OAAO,IAAI,MAAM,yBAAyB,QAAQ,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAAA,MACrF;AACA;AAAA,IACF;AACA,aAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,EAC5C,CAAC,EACA,MAAM,CAAC,QAAQ,SAAS,GAA4B,CAAC;AAC1D;AAOA,IAAI;AACJ,SAAS,sBAA6B;AACpC,MAAI,CAAC,aAAa;AAChB,kBAAc,IAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,cAAuB,EAAE,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,kBAA2C;AAOlD,SAAO,WAAW,UAAU,oBACvB,cACD,WAAW;AACjB;AAKA,IAAI,wBAAwB;AAC5B,IAAI,CAAC,uBAAuB;AAC1B,0BAAwB;AAExB,UAAQ,GAAG,cAAc,MAAM;AAC7B,iBAAa,QAAQ;AACrB,kBAAc;AAAA,EAChB,CAAC;AACH;AAUA,eAAsB,aACpB,KACA,cACA,QACA,UAAkC;AAAA,EAChC,cAAc;AAAA,EACd,QAAQ;AACV,GACmB;AACnB,MAAI,gBAAgB;AACpB,MAAI,aAAa;AACjB,aAAS;AAGP,UAAM,SAAS,IAAI,IAAI,UAAU;AACjC,QAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS;AAC/D,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,OAAO,QAAQ;AAAA,QACpE,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,OAAO,aAAa,WAAW,CAAC,eAAe;AACjD,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,iBAAiB,OAAO,QAAQ;AAQtC,UAAM,OAAO;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,oBAAoB;AAAA,IAClC;AACA,UAAM,MAAM,MAAM,gBAAgB,EAAE,YAAY,IAA4B;AAC5E,QAAI,IAAI,SAAS,OAAO,IAAI,SAAS,KAAK;AACxC,aAAO;AAAA,IACT;AACA;AACA,QAAI,gBAAgB,cAAc;AAChC,YAAM,IAAI,WAAW;AAAA,QACnB,SAAS,mBAAmB,YAAY;AAAA,QACxC,QAAQ,IAAI;AAAA,QACZ,SAAS,EAAE,KAAK,YAAY,cAAc,cAAc;AAAA,MAC1D,CAAC;AAAA,IACH;AACA,UAAM,WAAW,IAAI,QAAQ,IAAI,UAAU;AAC3C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,WAAW;AAAA,QACnB,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,SAAS,EAAE,KAAK,YAAY,cAAc;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,iBAAa,IAAI,IAAI,UAAU,UAAU,EAAE,SAAS;AAAA,EACtD;AACF;AAEA,eAAsB,iBAAiB,UAAiC;AACtE,MAAI,cAAe;AAEnB,QAAM,OACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAE/E,MAAI,SAAS,eAAe,KAAK,SAAS,YAAY,GAAG;AACvD,UAAM,IAAI,oBAAoB;AAAA,MAC5B,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,YAAgB,SAAK,IAAI;AAC/B,MAAI,cAAc,GAAG;AACnB,QAAI,cAAc,IAAI,GAAG;AACvB,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,IAAI;AAAA,QACzD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,WAAW,cAAc,GAAG;AAC1B,QAAI,cAAc,IAAI,GAAG;AACvB,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,IAAI;AAAA,QACzD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AAOL,QAAI;AAEF,YAAM,UAAU,MAAU,WAAO,MAAM,EAAE,KAAK,KAAK,CAAC;AACpD,iBAAW,KAAK,SAAS;AACvB,cAAM,MAAM,EAAE,WAAW,IAAI,cAAc,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO;AAC/E,YAAI,KAAK;AACP,gBAAM,IAAI,oBAAoB;AAAA,YAC5B,SAAS,sCAAsC,EAAE,OAAO;AAAA,YACxD,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,QAAQ,EAAG,OAAM;AAAA,IAEtE;AAAA,EACF;AACF;;;AD1PA,SAAS,sBAAsB;AA8B/B,IAAM,cAAc;AACpB,IAAM,cAAc;AACpB,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAM1B,IAAM,QAAQ,oBAAI,IAAwB;AAEnC,IAAM,aAA8C;AAAA,EACzD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EACF,WACE;AAAA,EAMF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,cAAc,CAAC,cAAc;AAAA,EAC7B,MAAM;AAAA,EACN,WAAW;AAAA,EACX,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,OAAO,EAAE,MAAM,UAAU,aAAa,eAAe;AAAA,MACrD,aAAa;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM,CAAC,cAAc,UAAU,MAAM;AAAA,QACrC,aAAa;AAAA,MACf;AAAA,MACA,YAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,QAAI;AACJ,UAAM,gBAAgB,WAAW;AACjC,QAAI,CAAC,cAAe,OAAM,IAAI,MAAM,0CAA0C;AAC9E,qBAAiB,MAAM,cAAc,OAAO,KAAK,IAAI,GAAG;AACtD,UAAI,GAAG,SAAS,QAAS,SAAQ,GAAG;AAAA,IACtC;AACA,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,0CAA0C;AACtE,WAAO;AAAA,EACT;AAAA,EACA,OAAO,cAAc,OAAO,MAAM,MAAqD;AACrF,QAAI,CAAC,OAAO,SAAS,MAAM,MAAM,KAAK,MAAM,IAAI;AAC9C,YAAM,IAAIC,qBAAoB;AAAA,QAC5B,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,UAAM,MAAM,KAAK,IAAI,GAAG,KAAK,IAAI,MAAM,eAAe,aAAa,WAAW,CAAC;AAC/E,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,YAAY,MAAM,cAAc;AACtC,UAAM,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;AAGzC,QAAI,CAAC,WAAW;AACd,YAAM,QAAQ,MAAM,IAAI,QAAQ;AAChC,UAAI,SAAS,KAAK,IAAI,IAAI,MAAM,YAAY,cAAc;AACxD,cAAM,UAAU,MAAM,QAAQ,IAAI,CAAC,OAAO;AAAA,UACxC,OAAO,EAAE;AAAA,UACT,KAAK,EAAE;AAAA,UACP,SAAS,EAAE;AAAA,QACb,EAAE;AACF,cAAM;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,kBAAkB,MAAM,KAAK,MAAM,MAAM;AAAA,UAC/C,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO,QAAQ,KAAK;AAAA,QACnD;AACA,cAAM;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,GAAG,QAAQ,MAAM,wBAAwB,MAAM,MAAM;AAAA,UAC3D,MAAM,EAAE,OAAO,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,MAAM,OAAO;AAAA,QACpE;AACA,cAAM;AAAA,UACJ,MAAM;AAAA,UACN,QAAQ;AAAA,YACN,OAAO,MAAM;AAAA,YACb,SAAS,QAAQ,MAAM,GAAG,GAAG;AAAA,YAC7B,QAAQ,MAAM;AAAA,YACd,WAAW,QAAQ,UAAU;AAAA,YAC7B,QAAQ;AAAA,UACV;AAAA,QACF;AACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,MAAM,YAAY,MAAM,SAAS,MAAM,KAAK;AAAA,MAC5C,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO,QAAQ,MAAM;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI,kBAA0C;AAC9C,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,qBAAa,MAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK,MAAM;AACjE;AAAA,MACF,KAAK;AACH,qBAAa,MAAM,aAAa,MAAM,OAAO,KAAK,KAAK,MAAM;AAC7D;AAAA,MACF,KAAK;AACH,qBAAa,MAAM,WAAW,MAAM,OAAO,KAAK,KAAK,MAAM;AAC3D;AAAA,MACF;AACE,cAAM,IAAIA,qBAAoB;AAAA,UAC5B,SAAS,2BAA2B,MAAM;AAAA,UAC1C,OAAO;AAAA,QACT,CAAC;AAAA,IACL;AAEA,QAAI,SAAS,kBAAkB,YAAY,MAAM,KAAK;AACtD,QAAI,WAAW,gBAAgB,2BAA2B,QAAQ,MAAM,KAAK,GAAG;AAC9E,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM,GAAG,MAAM;AAAA,QACf,MAAM,EAAE,QAAQ,UAAU,cAAc,OAAO,MAAM,MAAM;AAAA,MAC7D;AACA,mBAAa,MAAM,iBAAiB,MAAM,OAAO,KAAK,KAAK,MAAM;AACjE,eAAS,kBAAkB,YAAY,MAAM,KAAK;AAClD,wBAAkB;AAAA,IACpB;AAEA,UAAM,eAAe,OAAO,MAAM,GAAG,GAAG;AAGxC,UAAM,IAAI,UAAU,EAAE,SAAS,QAAQ,QAAQ,iBAAiB,WAAW,KAAK,IAAI,EAAE,CAAC;AACvF,sBAAkB;AAElB,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,MAAM,GAAG,aAAa,MAAM,iBAAiB,eAAe;AAAA,MAC5D,MAAM,EAAE,OAAO,aAAa,QAAQ,QAAQ,OAAO,QAAQ,gBAAgB;AAAA,IAC7E;AACA,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,QACN,OAAO,MAAM;AAAA,QACb,SAAS,aAAa,IAAI,CAAC,OAAO;AAAA,UAChC,OAAO,EAAE;AAAA,UACT,KAAK,EAAE;AAAA,UACP,SAAS,EAAE;AAAA,QACb,EAAE;AAAA,QACF,QAAQ;AAAA,QACR,WAAW,aAAa,UAAU;AAAA,QAClC,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAOA,SAAS,oBAA0B;AACjC,QAAM,SAAS,KAAK,IAAI,IAAI,eAAe;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAM,QAAQ,GAAG;AAC1C,QAAI,MAAM,YAAY,OAAQ,OAAM,OAAO,GAAG;AAAA,EAChD;AACA,SAAO,MAAM,OAAO,mBAAmB;AACrC,UAAM,YAAY,MAAM,KAAK,EAAE,KAAK,EAAE;AACtC,QAAI,cAAc,OAAW;AAC7B,UAAM,OAAO,SAAS;AAAA,EACxB;AACF;AAGO,SAAS,qBAA2B;AACzC,QAAM,MAAM;AACd;AAMA,SAAS,kBAAkB,SAAyB,OAA+B;AACjF,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,UAA0B,CAAC;AACjC,aAAW,KAAK,SAAS;AACvB,UAAM,UAAU,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE;AACzC,UAAM,aAAa,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE;AAC9C,QAAI,CAAC,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,WAAW,MAAM,GAAG;AACzD,eAAS,IAAI,UAAU;AACvB,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACA,SAAO,aAAa,SAAS,KAAK;AACpC;AAEA,SAAS,aAAa,SAAyB,OAA+B;AAC5E,QAAM,QAAQ,MAAM,YAAY,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACzE,SAAO,QACJ,IAAI,CAAC,MAAM;AACV,UAAM,aAAa,EAAE,MAAM,YAAY;AACvC,UAAM,eAAe,EAAE,QAAQ,YAAY;AAC3C,QAAI,QAAQ,EAAE;AACd,eAAW,QAAQ,OAAO;AACxB,UAAI,WAAW,SAAS,IAAI,EAAG,UAAS;AACxC,UAAI,aAAa,SAAS,IAAI,EAAG,UAAS;AAAA,IAC5C;AACA,WAAO,EAAE,GAAG,GAAG,MAAM;AAAA,EACvB,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AACrC;AAEA,SAAS,2BAA2B,SAAyB,OAAwB;AACnF,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,QAAQ,MAAM,YAAY,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;AAC1E,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SAAO,CAAC,QAAQ,KAAK,CAAC,MAAM;AAC1B,UAAM,WAAW,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,IAAI,EAAE,OAAO,GAAG,YAAY;AAChE,WAAO,MAAM,KAAK,CAAC,SAAS,SAAS,SAAS,IAAI,CAAC;AAAA,EACrD,CAAC;AACH;AAMA,eAAe,iBACb,OACA,KACA,QACyB;AACzB,QAAM,UAAU,mBAAmB,KAAK;AACxC,QAAM,MAAM,uCAAuC,OAAO;AAE1D,MAAI;AACF,UAAM,WAAW,MAAM,iBAAiB,KAAK,QAAQ,UAAU;AAC/D,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,gBAAgB,MAAM,GAAG;AAAA,EAClC,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,KAAK,UAAU,EAAE,OAAO,SAAS,OAAO,iBAAiB,OAAO,OAAO,eAAe,GAAG,EAAE,CAAC;AAAA,IAC9F;AAIA,WAAO,CAAC,EAAE,OAAO,sBAAsB,KAAK,sCAAsC,SAAS,8BAA8B,OAAO,EAAE,CAAC;AAAA,EACrI;AACF;AAEA,SAAS,SAAY,MAAmB,KAAkB;AACxD,QAAM,MAAW,CAAC;AAClB,aAAW,QAAQ,MAAM;AACvB,QAAI,IAAI,UAAU,IAAK;AACvB,QAAI,KAAK,IAAI;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,KAA6B;AAClE,QAAM,UAA0B,CAAC;AACjC,QAAM,YAAY;AAClB,QAAM,eACJ;AAEF,QAAM,cAAc;AAAA,IAClB,CAAC,GAAG,KAAK,SAAS,SAAS,CAAC,EACzB,IAAI,CAAC,MAAM;AACV,YAAM,QAAQ,cAAc,EAAE,CAAC,CAAC;AAChC,YAAM,OAAO,YAAY,OAAO,MAAM;AACtC,YAAM,QAAQ,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC;AAC3C,aAAO,QAAQ,QAAQ,EAAE,KAAK,uBAAuB,IAAI,GAAG,MAAM,IAAI;AAAA,IACxE,CAAC,EACA,OAAO,CAAC,MAA2C,MAAM,MAAS;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,iBAAiB;AAAA,IACrB,CAAC,GAAG,KAAK,SAAS,YAAY,CAAC,EAC5B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAClB,IAAI,CAAC,MAAM,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;AAAA,IAC5C;AAAA,EACF;AAEA,WAAS,IAAI,GAAG,IAAI,YAAY,UAAU,IAAI,KAAK,KAAK;AACtD,UAAM,QAAQ,YAAY,CAAC;AAC3B,QAAI,OAAO;AACT,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,SAAS;AAAA,QACtB,KAAK,MAAM,OAAO;AAAA,QAClB,SAAS,eAAe,CAAC,KAAK;AAAA,QAC9B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,YAAY,OAAe,MAAkC;AACpE,QAAM,SAAS,IAAI,OAAO,MAAM,IAAI,2BAA2B,GAAG,EAAE,KAAK,KAAK;AAC9E,MAAI,SAAS,CAAC,EAAG,QAAO,mBAAmB,OAAO,CAAC,CAAC;AACpD,QAAM,WAAW,IAAI,OAAO,MAAM,IAAI,uBAAuB,GAAG,EAAE,KAAK,KAAK;AAC5E,SAAO,WAAW,CAAC,IAAI,mBAAmB,SAAS,CAAC,CAAC,IAAI;AAC3D;AAEA,SAAS,uBAAuB,KAAqB;AACnD,MAAI,IAAI,WAAW,IAAI,EAAG,QAAO,SAAS,GAAG;AAC7C,MAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO;AACjC,MAAI,CAAC,IAAI,WAAW,KAAK,EAAG,QAAO;AACnC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK,wBAAwB;AACjD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,WAAO,MAAM,WAAW,MAAM,IAAI,OAAO,IAAI,SAAS;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,aAAa,OAAe,KAAa,QAA8C;AACpG,QAAM,UAAU,mBAAmB,KAAK;AACxC,QAAM,MAAM,mCAAmC,OAAO;AAEtD,QAAM,OAAO,MAAM,iBAAiB,KAAK,QAAQ,UAAU,EACxD,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EACpB,MAAM,MAAM,EAAE;AAEjB,SAAO,mBAAmB,MAAM,GAAG;AACrC;AAEA,SAAS,mBAAmB,MAAc,KAA6B;AACrE,QAAM,UAA0B,CAAC;AACjC,QAAM,aAAa;AACnB,QAAM,WAAW;AACjB,QAAM,eAAe;AAErB,QAAM,SAAS;AAAA,IACb,CAAC,GAAG,KAAK,SAAS,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;AAAA,IAC5F;AAAA,EACF;AAEA,QAAM,OAAO;AAAA,IACX,CAAC,GAAG,KAAK,SAAS,QAAQ,CAAC,EACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAClB,IAAI,CAAC,MAAM,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,6BAA6B,IAAI,CAAC,EACpF,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC;AAAA,IACrC;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,CAAC,GAAG,KAAK,SAAS,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;AAAA,IAC9F;AAAA,EACF;AAEA,WAAS,IAAI,GAAG,IAAI,KAAK,IAAI,OAAO,QAAQ,GAAG,GAAG,KAAK;AACrD,YAAQ,KAAK;AAAA,MACX,OAAO,OAAO,CAAC,KAAK;AAAA,MACpB,KAAK,KAAK,CAAC,KAAK;AAAA,MAChB,SAAS,SAAS,CAAC,KAAK;AAAA,MACxB,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,eAAe,WAAW,OAAe,KAAa,QAA8C;AAClG,QAAM,UAAU,mBAAmB,KAAK;AACxC,QAAM,MAAM,iCAAiC,OAAO;AAEpD,QAAM,OAAO,MAAM,iBAAiB,KAAK,QAAQ,UAAU,EACxD,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EACpB,MAAM,MAAM,EAAE;AAEjB,SAAO,iBAAiB,MAAM,GAAG;AACnC;AAEA,SAAS,iBAAiB,MAAc,KAA6B;AACnE,QAAM,UAA0B,CAAC;AACjC,QAAM,SAAS,CAAC,GAAG,KAAK,SAAS,2HAA2H,CAAC,EAC1J,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC;AACjC,QAAM,aAAa,OAAO,SAAS,IAAI,SAAS,CAAC,IAAI;AAErD,QAAM,UAAU,SAAS,WAAW,QAAQ,CAAC,UAAU;AACrD,UAAM,aAAa,oDAAoD,KAAK,KAAK;AACjF,QAAI,CAAC,WAAY,QAAO,CAAC;AACzB,UAAM,OAAO,YAAY,cAAc,WAAW,CAAC,CAAC,GAAG,MAAM;AAC7D,UAAM,QAAQ,UAAU,cAAc,WAAW,CAAC,CAAC,CAAC;AACpD,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO,CAAC;AAC7B,UAAM,eAAe,4FAA4F,KAAK,KAAK,KACtH,6BAA6B,KAAK,KAAK;AAC5C,UAAM,UAAU,eAAe,UAAU,cAAc,aAAa,GAAG,EAAE,CAAC,CAAC,IAAI;AAC/E,WAAO,CAAC,EAAE,KAAK,iBAAiB,IAAI,GAAG,OAAO,SAAS,OAAO,EAAE,CAAC;AAAA,EACnE,CAAC,GAAG,GAAG;AAEP,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,QAAQ,QAAQ,CAAC;AACvB,QAAI,OAAO;AACT,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,SAAS;AAAA,QACtB,KAAK,MAAM,OAAO;AAAA,QAClB,SAAS,MAAM,WAAW;AAAA,QAC1B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,iBAAiB,KAAqB;AAC7C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,SAAS,SAAS,UAAU,KAAK,IAAI,SAAS,WAAW,MAAM,GAAG;AACxE,YAAM,UAAU,IAAI,aAAa,IAAI,GAAG;AACxC,YAAM,UAAU,iBAAiB,OAAO;AACxC,UAAI,SAAS,WAAW,MAAM,EAAG,QAAO;AAAA,IAC1C;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA4C;AACpE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AAC9D,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,QAAQ,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1G,WAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,iBACb,KACA,QACA,WACmB;AACnB,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAE5D,QAAM,cAAc,UAAU,QAAQ,WAAW,MAAM;AACvD,MAAI;AAKF,UAAM,MAAM,MAAM,aAAa,KAAK,GAAG,aAAa;AAAA,MAClD,cACE;AAAA,IACJ,CAAC;AACD,iBAAa,KAAK;AAClB,WAAO;AAAA,EACT,SAAS,GAAG;AACV,iBAAa,KAAK;AAClB,QAAI,aAAaC,aAAY;AAC3B,YAAM;AAAA,IACR;AACA,UAAM,IAAIA,YAAW;AAAA,MACnB,SAAS,2BAA2B,GAAG;AAAA,MACvC,QAAQ;AAAA,MACR,SAAS,EAAE,IAAI;AAAA,MACf,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,aAAa,SAAqC;AAMzD,SAAO,YAAY,IAAI,OAAO;AAChC;AAEA,SAAS,UAAU,MAAsB;AACvC,SAAO,mBAAmB,KAAK,QAAQ,YAAY,EAAE,CAAC,EAAE,KAAK;AAC/D;AAEA,SAAS,mBAAmB,MAAsB;AAChD,SAAO,KACJ,QAAQ,UAAU,GAAG,EACrB,QAAQ,SAAS,GAAG,EACpB,QAAQ,SAAS,GAAG,EACpB,QAAQ,WAAW,GAAG,EACtB,QAAQ,UAAU,GAAG;AAC1B;",
+  "names": ["FetchError", "ToolValidationError", "ToolValidationError", "FetchError"]
+}

package/dist/set-working-dir.d.ts

@@ -0,0 +1,18 @@
+import type { Tool } from '@wrongstack/core';
+interface SetWorkingDirInput {
+    /** Relative or absolute path to navigate to. Must stay within projectRoot. */
+    path?: string | undefined;
+}
+interface SetWorkingDirOutput {
+    /** The new working directory (absolute path). */
+    current: string;
+    /** The previous working directory (absolute path). */
+    previous?: string | undefined;
+    /** Human-readable confirmation message. */
+    message?: string | undefined;
+    /** Error if the directory doesn't exist or is outside the project root. */
+    error?: string | undefined;
+}
+export declare const setWorkingDirTool: Tool<SetWorkingDirInput, SetWorkingDirOutput>;
+export {};
+//# sourceMappingURL=set-working-dir.d.ts.map

package/dist/set-working-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-working-dir.d.ts","sourceRoot":"","sources":["../src/set-working-dir.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAKtD,UAAU,kBAAkB;IAC1B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,UAAU,mBAAmB;IAC3B,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAID,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAwE3E,CAAC"}

package/dist/shim/node-sqlite.d.ts

@@ -0,0 +1,3 @@
+export type { DatabaseSync, StatementSync, Session } from 'node:sqlite';
+export { constants, backup } from 'node:sqlite';
+//# sourceMappingURL=node-sqlite.d.ts.map

package/dist/shim/node-sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite.d.ts","sourceRoot":"","sources":["../../src/shim/node-sqlite.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/skill.d.ts

@@ -0,0 +1,45 @@
+import { type SkillLoader, type Tool } from '@wrongstack/core';
+interface SkillToolInput {
+    name: string;
+    /** Optional relative path of a bundled resource to load (e.g. `references/REF.md`, `scripts/extract.py`, `assets/template.html`). Omit to list resources. */
+    resource?: string | undefined;
+}
+interface SkillResource {
+    /** Path relative to the skill directory (e.g. `scripts/extract.py`). */
+    path: string;
+    bytes: number;
+}
+interface LoadedResource {
+    rel: string;
+    absPath: string;
+    content: string;
+    bytes: number;
+    truncated: boolean;
+}
+interface SkillToolOutput {
+    name: string;
+    description: string;
+    /** Frontmatter-stripped SKILL.md body (capped). */
+    body: string;
+    /** All bundled resource files (recursive), when no specific resource was requested. */
+    resources: SkillResource[];
+    /** Absolute directory of the skill — run scripts via bash using paths under here. */
+    dir: string;
+    /** When `resource` was requested: the loaded file. */
+    loadedResource?: LoadedResource | undefined;
+}
+/**
+ * Skill tool — the agentskills.io progressive-disclosure primitive.
+ *
+ * - `skill({ name })` → SKILL.md body + a recursive listing of every bundled
+ *   resource file (scripts/ references/ assets/ templates/ … any subdir).
+ * - `skill({ name, resource })` → the content of that one resource file.
+ *
+ * Use this (not the `read` tool) to load skill resources: it works for foreign
+ * skills that live outside the project root (e.g. `~/.claude/skills/…`), which
+ * a project-root-restricted `read` tool may refuse. Scripts are returned with
+ * their absolute path so the agent can run them via `bash`.
+ */
+export declare function makeSkillTool(skillLoader: SkillLoader): Tool<SkillToolInput, SkillToolOutput>;
+export {};
+//# sourceMappingURL=skill.d.ts.map

package/dist/skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,WAAW,EAEhB,KAAK,IAAI,EAEV,MAAM,kBAAkB,CAAC;AAE1B,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,6JAA6J;IAC7J,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,aAAa;IACrB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC7C;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAiG7F"}

package/dist/skill.js

@@ -0,0 +1,175 @@
+// src/skill.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import {
+  SKILL_LIMITS,
+  stripFrontmatter,
+  ToolValidationError
+} from "@wrongstack/core";
+var MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;
+var MAX_RESOURCE_CHARS = SKILL_LIMITS.MAX_RESOURCE_CHARS;
+var MAX_LISTED_RESOURCES = SKILL_LIMITS.MAX_LISTED_RESOURCES;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build"]);
+function makeSkillTool(skillLoader) {
+  return {
+    name: "skill",
+    category: "Skills",
+    description: "Load a skill's instructions or a bundled resource on demand (agentskills.io progressive disclosure). With only `name`: returns the SKILL.md body + a list of bundled resource files. With `name` + `resource` (a relative path like `references/REF.md` or `scripts/extract.py`): returns that file content. Prefer this over the read tool for skill files \u2014 it reaches foreign skills outside the project root.",
+    usageHint: 'Load a skill body or one of its bundled resources (progressive disclosure).\n\nWHEN TO USE:\n- A task matches a skill trigger \u2192 load the body: skill({ name })\n- You need a reference/template/script bundled with the skill \u2192 skill({ name, resource: "references/REF.md" })\n\nThe body call lists every bundled resource; load the ones you need. Run scripts via bash using the returned abs path.',
+    permission: "auto",
+    mutating: false,
+    capabilities: ["fs.read"],
+    icon: "document",
+    timeoutMs: 5e3,
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Exact skill name (as shown in the available-skills list)."
+        },
+        resource: {
+          type: "string",
+          description: "Optional relative path of a bundled resource to load (e.g. references/REF.md, scripts/extract.py, assets/template.html). Omit to list resources."
+        }
+      },
+      required: ["name"]
+    },
+    async execute(input, ctx) {
+      const name = input?.name?.trim();
+      if (!name) {
+        throw new ToolValidationError({ message: "skill: name is required", field: "name" });
+      }
+      const manifest = await skillLoader.find(name);
+      if (!manifest) {
+        throw new ToolValidationError({
+          message: `skill "${name}" not found \u2014 use /skill to list available skills`,
+          field: "name"
+        });
+      }
+      const dir = path.dirname(manifest.path);
+      let loadedResource;
+      if (input.resource?.trim()) {
+        loadedResource = await loadResource(dir, input.resource.trim());
+      }
+      const raw = await skillLoader.readBody(name);
+      const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);
+      const resources = loadedResource ? [] : await listResources(dir);
+      try {
+        await ctx?.session?.append({
+          type: "skill_activated",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          skillName: manifest.name
+        });
+      } catch {
+      }
+      return {
+        name: manifest.name,
+        description: manifest.description,
+        body,
+        resources,
+        dir,
+        loadedResource
+      };
+    },
+    serialize(output) {
+      if (output.loadedResource) {
+        const lr = output.loadedResource;
+        const note = lr.truncated ? ` (truncated to ${lr.content.length} chars of ${lr.bytes} B)` : "";
+        return `# Resource: ${output.name}/${lr.rel}
+(abs path: ${lr.absPath})${note}
+
+${lr.content}`;
+      }
+      const head = `# Skill: ${output.name}
+${output.description}
+
+${output.body}`;
+      if (output.resources.length === 0) return head;
+      const listing = output.resources.map((r) => `- ${r.path} (${r.bytes} B)`).join("\n");
+      return `${head}
+
+## Bundled resources (load on demand)
+Load any with: \`skill({ name: "${output.name}", resource: "<path>" })\`. Run scripts via bash using their abs path under ${output.dir}.
+${listing}`;
+    }
+  };
+}
+async function loadResource(skillDir, rel) {
+  const norm = rel.replace(/\\/g, "/");
+  if (path.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
+    throw new ToolValidationError({
+      message: `skill: invalid resource path "${rel}"`,
+      field: "resource"
+    });
+  }
+  const absPath = path.resolve(skillDir, rel);
+  const root = path.resolve(skillDir);
+  if (absPath !== root && !absPath.startsWith(root + path.sep)) {
+    throw new ToolValidationError({
+      message: `skill: resource "${rel}" escapes the skill directory`,
+      field: "resource"
+    });
+  }
+  let buf;
+  try {
+    buf = await fs.readFile(absPath);
+  } catch {
+    throw new ToolValidationError({
+      message: `skill: resource "${rel}" not readable`,
+      field: "resource"
+    });
+  }
+  const raw = buf.toString("utf8");
+  const truncated = raw.length > MAX_RESOURCE_CHARS;
+  return {
+    rel: norm,
+    absPath,
+    content: truncated ? raw.slice(0, MAX_RESOURCE_CHARS) : raw,
+    bytes: buf.length,
+    truncated
+  };
+}
+async function listResources(skillDir) {
+  const out = [];
+  await walk(skillDir, skillDir, out);
+  out.sort((a, b) => a.path.localeCompare(b.path));
+  return out.slice(0, MAX_LISTED_RESOURCES);
+}
+async function walk(root, dir, out) {
+  if (out.length >= MAX_LISTED_RESOURCES) return;
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (out.length >= MAX_LISTED_RESOURCES) return;
+    const fullPath = path.join(dir, e.name);
+    let isDir = e.isDirectory();
+    if (e.isSymbolicLink()) {
+      try {
+        isDir = (await fs.stat(fullPath)).isDirectory();
+      } catch {
+        continue;
+      }
+    }
+    if (isDir) {
+      if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+      await walk(root, fullPath, out);
+    } else if (e.isFile()) {
+      if (e.name === "SKILL.md" || e.name === "SKILL.save.md") continue;
+      try {
+        const stat2 = await fs.stat(fullPath);
+        const rel = path.relative(root, fullPath).split(path.sep).join("/");
+        out.push({ path: rel, bytes: stat2.size });
+      } catch {
+      }
+    }
+  }
+}
+export {
+  makeSkillTool
+};
+//# sourceMappingURL=skill.js.map

package/dist/skill.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/skill.ts"],
+  "sourcesContent": ["import type { Dirent } from 'node:fs';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport {\n  SKILL_LIMITS,\n  type SkillLoader,\n  stripFrontmatter,\n  type Tool,\n  ToolValidationError,\n} from '@wrongstack/core';\n\ninterface SkillToolInput {\n  name: string;\n  /** Optional relative path of a bundled resource to load (e.g. `references/REF.md`, `scripts/extract.py`, `assets/template.html`). Omit to list resources. */\n  resource?: string | undefined;\n}\n\ninterface SkillResource {\n  /** Path relative to the skill directory (e.g. `scripts/extract.py`). */\n  path: string;\n  bytes: number;\n}\n\ninterface LoadedResource {\n  rel: string;\n  absPath: string;\n  content: string;\n  bytes: number;\n  truncated: boolean;\n}\n\ninterface SkillToolOutput {\n  name: string;\n  description: string;\n  /** Frontmatter-stripped SKILL.md body (capped). */\n  body: string;\n  /** All bundled resource files (recursive), when no specific resource was requested. */\n  resources: SkillResource[];\n  /** Absolute directory of the skill \u2014 run scripts via bash using paths under here. */\n  dir: string;\n  /** When `resource` was requested: the loaded file. */\n  loadedResource?: LoadedResource | undefined;\n}\n\nconst MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;\nconst MAX_RESOURCE_CHARS = SKILL_LIMITS.MAX_RESOURCE_CHARS;\nconst MAX_LISTED_RESOURCES = SKILL_LIMITS.MAX_LISTED_RESOURCES;\nconst SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build']);\n\n/**\n * Skill tool \u2014 the agentskills.io progressive-disclosure primitive.\n *\n * - `skill({ name })` \u2192 SKILL.md body + a recursive listing of every bundled\n *   resource file (scripts/ references/ assets/ templates/ \u2026 any subdir).\n * - `skill({ name, resource })` \u2192 the content of that one resource file.\n *\n * Use this (not the `read` tool) to load skill resources: it works for foreign\n * skills that live outside the project root (e.g. `~/.claude/skills/\u2026`), which\n * a project-root-restricted `read` tool may refuse. Scripts are returned with\n * their absolute path so the agent can run them via `bash`.\n */\nexport function makeSkillTool(skillLoader: SkillLoader): Tool<SkillToolInput, SkillToolOutput> {\n  return {\n    name: 'skill',\n    category: 'Skills',\n    description:\n      \"Load a skill's instructions or a bundled resource on demand (agentskills.io progressive disclosure). \" +\n      'With only `name`: returns the SKILL.md body + a list of bundled resource files. ' +\n      'With `name` + `resource` (a relative path like `references/REF.md` or `scripts/extract.py`): returns that file content. ' +\n      'Prefer this over the read tool for skill files \u2014 it reaches foreign skills outside the project root.',\n    usageHint:\n      'Load a skill body or one of its bundled resources (progressive disclosure).\\n\\n' +\n      'WHEN TO USE:\\n' +\n      '- A task matches a skill trigger \u2192 load the body: skill({ name })\\n' +\n      '- You need a reference/template/script bundled with the skill \u2192 skill({ name, resource: \"references/REF.md\" })\\n\\n' +\n      'The body call lists every bundled resource; load the ones you need. Run scripts via bash using the returned abs path.',\n    permission: 'auto',\n    mutating: false,\n    capabilities: ['fs.read'],\n    icon: 'document',\n    timeoutMs: 5_000,\n    inputSchema: {\n      type: 'object',\n      properties: {\n        name: {\n          type: 'string',\n          description: 'Exact skill name (as shown in the available-skills list).',\n        },\n        resource: {\n          type: 'string',\n          description:\n            'Optional relative path of a bundled resource to load (e.g. references/REF.md, scripts/extract.py, assets/template.html). Omit to list resources.',\n        },\n      },\n      required: ['name'],\n    },\n    async execute(input, ctx) {\n      const name = input?.name?.trim();\n      if (!name) {\n        throw new ToolValidationError({ message: 'skill: name is required', field: 'name' });\n      }\n      const manifest = await skillLoader.find(name);\n      if (!manifest) {\n        throw new ToolValidationError({\n          message: `skill \"${name}\" not found \u2014 use /skill to list available skills`,\n          field: 'name',\n        });\n      }\n      const dir = path.dirname(manifest.path);\n\n      // Loading a specific resource takes precedence; skip the (potentially large)\n      // full listing in that case to keep the response focused.\n      let loadedResource: LoadedResource | undefined;\n      if (input.resource?.trim()) {\n        loadedResource = await loadResource(dir, input.resource.trim());\n      }\n\n      const raw = await skillLoader.readBody(name);\n      const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);\n      const resources = loadedResource ? [] : await listResources(dir);\n\n      try {\n        await ctx?.session?.append({\n          type: 'skill_activated',\n          ts: new Date().toISOString(),\n          skillName: manifest.name,\n        });\n      } catch {\n        // best-effort: session recording must never break skill loading\n      }\n\n      return {\n        name: manifest.name,\n        description: manifest.description,\n        body,\n        resources,\n        dir,\n        loadedResource,\n      };\n    },\n    serialize(output) {\n      if (output.loadedResource) {\n        const lr = output.loadedResource;\n        const note = lr.truncated\n          ? ` (truncated to ${lr.content.length} chars of ${lr.bytes} B)`\n          : '';\n        return `# Resource: ${output.name}/${lr.rel}\\n(abs path: ${lr.absPath})${note}\\n\\n${lr.content}`;\n      }\n      const head = `# Skill: ${output.name}\\n${output.description}\\n\\n${output.body}`;\n      if (output.resources.length === 0) return head;\n      const listing = output.resources.map((r) => `- ${r.path} (${r.bytes} B)`).join('\\n');\n      return (\n        `${head}\\n\\n## Bundled resources (load on demand)\\n` +\n        `Load any with: \\`skill({ name: \"${output.name}\", resource: \"<path>\" })\\`. ` +\n        `Run scripts via bash using their abs path under ${output.dir}.\\n${listing}`\n      );\n    },\n  };\n}\n\n/** Load a single bundled resource by relative path, with a path-traversal guard. */\nasync function loadResource(skillDir: string, rel: string): Promise<LoadedResource> {\n  const norm = rel.replace(/\\\\/g, '/');\n  if (path.isAbsolute(rel) || norm.split('/').some((seg) => seg === '..')) {\n    throw new ToolValidationError({\n      message: `skill: invalid resource path \"${rel}\"`,\n      field: 'resource',\n    });\n  }\n  const absPath = path.resolve(skillDir, rel);\n  const root = path.resolve(skillDir);\n  if (absPath !== root && !absPath.startsWith(root + path.sep)) {\n    throw new ToolValidationError({\n      message: `skill: resource \"${rel}\" escapes the skill directory`,\n      field: 'resource',\n    });\n  }\n  let buf: Buffer;\n  try {\n    buf = await fs.readFile(absPath);\n  } catch {\n    throw new ToolValidationError({\n      message: `skill: resource \"${rel}\" not readable`,\n      field: 'resource',\n    });\n  }\n  const raw = buf.toString('utf8');\n  const truncated = raw.length > MAX_RESOURCE_CHARS;\n  return {\n    rel: norm,\n    absPath,\n    content: truncated ? raw.slice(0, MAX_RESOURCE_CHARS) : raw,\n    bytes: buf.length,\n    truncated,\n  };\n}\n\n/** Recursively list every file in the skill dir (any subdir), except SKILL.md. */\nasync function listResources(skillDir: string): Promise<SkillResource[]> {\n  const out: SkillResource[] = [];\n  await walk(skillDir, skillDir, out);\n  out.sort((a, b) => a.path.localeCompare(b.path));\n  return out.slice(0, MAX_LISTED_RESOURCES);\n}\n\nasync function walk(root: string, dir: string, out: SkillResource[]): Promise<void> {\n  if (out.length >= MAX_LISTED_RESOURCES) return;\n  let entries: Dirent[];\n  try {\n    entries = await fs.readdir(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const e of entries) {\n    if (out.length >= MAX_LISTED_RESOURCES) return;\n    const fullPath = path.join(dir, e.name);\n    let isDir = e.isDirectory();\n    if (e.isSymbolicLink()) {\n      try {\n        isDir = (await fs.stat(fullPath)).isDirectory();\n      } catch {\n        continue; // broken symlink\n      }\n    }\n    if (isDir) {\n      if (SKIP_DIRS.has(e.name) || e.name.startsWith('.')) continue;\n      await walk(root, fullPath, out);\n    } else if (e.isFile()) {\n      if (e.name === 'SKILL.md' || e.name === 'SKILL.save.md') continue;\n      try {\n        const stat = await fs.stat(fullPath);\n        const rel = path.relative(root, fullPath).split(path.sep).join('/');\n        out.push({ path: rel, bytes: stat.size });\n      } catch {\n        // skip unreadable entry\n      }\n    }\n  }\n}\n"],
+  "mappings": ";AACA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AAmCP,IAAM,iBAAiB,aAAa;AACpC,IAAM,qBAAqB,aAAa;AACxC,IAAM,uBAAuB,aAAa;AAC1C,IAAM,YAAY,oBAAI,IAAI,CAAC,gBAAgB,QAAQ,QAAQ,OAAO,CAAC;AAc5D,SAAS,cAAc,aAAiE;AAC7F,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aACE;AAAA,IAIF,WACE;AAAA,IAKF,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,cAAc,CAAC,SAAS;AAAA,IACxB,MAAM;AAAA,IACN,WAAW;AAAA,IACX,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY;AAAA,QACV,MAAM;AAAA,UACJ,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AAAA,QACA,UAAU;AAAA,UACR,MAAM;AAAA,UACN,aACE;AAAA,QACJ;AAAA,MACF;AAAA,MACA,UAAU,CAAC,MAAM;AAAA,IACnB;AAAA,IACA,MAAM,QAAQ,OAAO,KAAK;AACxB,YAAM,OAAO,OAAO,MAAM,KAAK;AAC/B,UAAI,CAAC,MAAM;AACT,cAAM,IAAI,oBAAoB,EAAE,SAAS,2BAA2B,OAAO,OAAO,CAAC;AAAA,MACrF;AACA,YAAM,WAAW,MAAM,YAAY,KAAK,IAAI;AAC5C,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,oBAAoB;AAAA,UAC5B,SAAS,UAAU,IAAI;AAAA,UACvB,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,YAAM,MAAW,aAAQ,SAAS,IAAI;AAItC,UAAI;AACJ,UAAI,MAAM,UAAU,KAAK,GAAG;AAC1B,yBAAiB,MAAM,aAAa,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,MAChE;AAEA,YAAM,MAAM,MAAM,YAAY,SAAS,IAAI;AAC3C,YAAM,OAAO,iBAAiB,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc;AACjE,YAAM,YAAY,iBAAiB,CAAC,IAAI,MAAM,cAAc,GAAG;AAE/D,UAAI;AACF,cAAM,KAAK,SAAS,OAAO;AAAA,UACzB,MAAM;AAAA,UACN,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,UAC3B,WAAW,SAAS;AAAA,QACtB,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,aAAO;AAAA,QACL,MAAM,SAAS;AAAA,QACf,aAAa,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU,QAAQ;AAChB,UAAI,OAAO,gBAAgB;AACzB,cAAM,KAAK,OAAO;AAClB,cAAM,OAAO,GAAG,YACZ,kBAAkB,GAAG,QAAQ,MAAM,aAAa,GAAG,KAAK,QACxD;AACJ,eAAO,eAAe,OAAO,IAAI,IAAI,GAAG,GAAG;AAAA,aAAgB,GAAG,OAAO,IAAI,IAAI;AAAA;AAAA,EAAO,GAAG,OAAO;AAAA,MAChG;AACA,YAAM,OAAO,YAAY,OAAO,IAAI;AAAA,EAAK,OAAO,WAAW;AAAA;AAAA,EAAO,OAAO,IAAI;AAC7E,UAAI,OAAO,UAAU,WAAW,EAAG,QAAO;AAC1C,YAAM,UAAU,OAAO,UAAU,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,IAAI;AACnF,aACE,GAAG,IAAI;AAAA;AAAA;AAAA,kCAC4B,OAAO,IAAI,+EACK,OAAO,GAAG;AAAA,EAAM,OAAO;AAAA,IAE9E;AAAA,EACF;AACF;AAGA,eAAe,aAAa,UAAkB,KAAsC;AAClF,QAAM,OAAO,IAAI,QAAQ,OAAO,GAAG;AACnC,MAAS,gBAAW,GAAG,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,GAAG;AACvE,UAAM,IAAI,oBAAoB;AAAA,MAC5B,SAAS,iCAAiC,GAAG;AAAA,MAC7C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAe,aAAQ,UAAU,GAAG;AAC1C,QAAM,OAAY,aAAQ,QAAQ;AAClC,MAAI,YAAY,QAAQ,CAAC,QAAQ,WAAW,OAAY,QAAG,GAAG;AAC5D,UAAM,IAAI,oBAAoB;AAAA,MAC5B,SAAS,oBAAoB,GAAG;AAAA,MAChC,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI;AACJ,MAAI;AACF,UAAM,MAAS,YAAS,OAAO;AAAA,EACjC,QAAQ;AACN,UAAM,IAAI,oBAAoB;AAAA,MAC5B,SAAS,oBAAoB,GAAG;AAAA,MAChC,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,SAAS,MAAM;AAC/B,QAAM,YAAY,IAAI,SAAS;AAC/B,SAAO;AAAA,IACL,KAAK;AAAA,IACL;AAAA,IACA,SAAS,YAAY,IAAI,MAAM,GAAG,kBAAkB,IAAI;AAAA,IACxD,OAAO,IAAI;AAAA,IACX;AAAA,EACF;AACF;AAGA,eAAe,cAAc,UAA4C;AACvE,QAAM,MAAuB,CAAC;AAC9B,QAAM,KAAK,UAAU,UAAU,GAAG;AAClC,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC/C,SAAO,IAAI,MAAM,GAAG,oBAAoB;AAC1C;AAEA,eAAe,KAAK,MAAc,KAAa,KAAqC;AAClF,MAAI,IAAI,UAAU,qBAAsB;AACxC,MAAI;AACJ,MAAI;AACF,cAAU,MAAS,WAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EACzD,QAAQ;AACN;AAAA,EACF;AACA,aAAW,KAAK,SAAS;AACvB,QAAI,IAAI,UAAU,qBAAsB;AACxC,UAAM,WAAgB,UAAK,KAAK,EAAE,IAAI;AACtC,QAAI,QAAQ,EAAE,YAAY;AAC1B,QAAI,EAAE,eAAe,GAAG;AACtB,UAAI;AACF,iBAAS,MAAS,QAAK,QAAQ,GAAG,YAAY;AAAA,MAChD,QAAQ;AACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO;AACT,UAAI,UAAU,IAAI,EAAE,IAAI,KAAK,EAAE,KAAK,WAAW,GAAG,EAAG;AACrD,YAAM,KAAK,MAAM,UAAU,GAAG;AAAA,IAChC,WAAW,EAAE,OAAO,GAAG;AACrB,UAAI,EAAE,SAAS,cAAc,EAAE,SAAS,gBAAiB;AACzD,UAAI;AACF,cAAMA,QAAO,MAAS,QAAK,QAAQ;AACnC,cAAM,MAAW,cAAS,MAAM,QAAQ,EAAE,MAAW,QAAG,EAAE,KAAK,GAAG;AAClE,YAAI,KAAK,EAAE,MAAM,KAAK,OAAOA,MAAK,KAAK,CAAC;AAAA,MAC1C,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["stat"]
+}