agentrinse 0.4.0 → 0.5.0

package/dist/core/provider-file-executor.js

@@ -0,0 +1,259 @@
+import { lstat, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { providerFileQuarantineActionSchema, } from "../contracts/action.js";
+import { providerFileQuarantineEntrySchema, } from "../contracts/provider-file-quarantine.js";
+import { ensurePrivateDirectory, syncDirectory, writeJsonAtomic } from "../state/json-file.js";
+import { renameAtNoReplace } from "./no-clobber-rename.js";
+import { openPinnedDirectory, openPinnedProviderFile } from "./pinned-file.js";
+import { inspectProviderFile, providerFileIdentityMatches, providerFileStatsMatch, } from "./provider-file-identity.js";
+import { revalidateProviderFileQuarantine, } from "./provider-file-revalidation.js";
+export class ProviderFileExecutionError extends Error {
+    outcome;
+    diagnosticCode;
+    entry;
+    name = "ProviderFileExecutionError";
+    constructor(message, outcome, diagnosticCode, entry, options) {
+        super(message, options);
+        this.outcome = outcome;
+        this.diagnosticCode = diagnosticCode;
+        this.entry = entry;
+        this.quarantinedBytes = options?.quarantinedBytes ?? 0;
+    }
+    quarantinedBytes;
+}
+export function providerFileQuarantinePath(quarantineDirectory, entryId) {
+    return join(quarantineDirectory, `${entryId}.payload`);
+}
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return false;
+        }
+        throw error;
+    }
+}
+async function persist(manifestPath, quarantineDirectory, entry) {
+    const parsed = providerFileQuarantineEntrySchema.parse(entry);
+    await writeJsonAtomic(manifestPath, parsed, {
+        privateDirectories: [quarantineDirectory],
+    });
+    return parsed;
+}
+async function finalizeUnmovedEntry(entry, manifestPath, quarantineDirectory, clock) {
+    try {
+        return await persist(manifestPath, quarantineDirectory, {
+            ...entry,
+            status: "restored",
+            restoredAt: clock().toISOString(),
+        });
+    }
+    catch (error) {
+        await rm(manifestPath, { force: true }).catch(() => undefined);
+        await syncDirectory(quarantineDirectory).catch(() => undefined);
+        throw error;
+    }
+}
+function assertAuthorized(dependencies, entry) {
+    if (dependencies.authorization !== undefined &&
+        dependencies.authorization.now().getTime() >= dependencies.authorization.expiresAtMs) {
+        throw new ProviderFileExecutionError("cleanup plan authorization expired before provider-file quarantine", "skipped-stale", "PLAN_EXPIRED_DURING_APPLY", entry);
+    }
+}
+export async function executeProviderFileQuarantine(action, options) {
+    const dependencies = options.dependencies ?? {};
+    const clock = dependencies.clock ?? (() => new Date());
+    const quarantinePath = providerFileQuarantinePath(options.quarantineDirectory, options.entryId);
+    const quarantineBasename = `${options.entryId}.payload`;
+    const manifestPath = join(options.quarantineDirectory, `${options.entryId}.json`);
+    if (!["darwin", "linux"].includes(dependencies.platform ?? process.platform)) {
+        throw new ProviderFileExecutionError(`provider-file quarantine is unsupported on ${dependencies.platform ?? process.platform}`, "skipped-stale", "PROVIDER_FILE_PLATFORM_UNSUPPORTED");
+    }
+    if (dependencies.authorizeTarget === undefined) {
+        throw new ProviderFileExecutionError("provider-file execution requires an approved provider policy", "skipped-stale", "PROVIDER_FILE_POLICY_REFUSED");
+    }
+    try {
+        await dependencies.authorizeTarget(action);
+    }
+    catch (error) {
+        throw new ProviderFileExecutionError(error instanceof Error ? error.message : String(error), "skipped-stale", "PROVIDER_FILE_POLICY_REFUSED", undefined, { cause: error });
+    }
+    await ensurePrivateDirectory(options.quarantineDirectory);
+    const quarantineDirectoryHandle = await openPinnedDirectory(options.quarantineDirectory);
+    let sourceHandle;
+    try {
+        sourceHandle = await openPinnedProviderFile(action.target.path, action.target.ownerRoot);
+        const [quarantineStats, sourceStats] = await Promise.all([
+            quarantineDirectoryHandle.stat(),
+            sourceHandle.stat(),
+        ]);
+        if (quarantineStats.dev !== sourceStats.dev) {
+            throw new ProviderFileExecutionError("provider-file recovery storage is on a different filesystem", "skipped-stale", "PROVIDER_FILE_QUARANTINE_CROSS_DEVICE");
+        }
+        if ((await pathExists(quarantinePath)) || (await pathExists(manifestPath))) {
+            throw new ProviderFileExecutionError("provider-file quarantine destination already exists", "failed", "PROVIDER_FILE_DESTINATION_OCCUPIED");
+        }
+    }
+    catch (error) {
+        await quarantineDirectoryHandle.close().catch(() => undefined);
+        if (error instanceof ProviderFileExecutionError) {
+            throw error;
+        }
+        throw new ProviderFileExecutionError(error instanceof Error ? error.message : String(error), "failed", "PROVIDER_FILE_QUARANTINE_FAILED", undefined, { cause: error });
+    }
+    let entry;
+    try {
+        entry = await persist(manifestPath, options.quarantineDirectory, {
+            schemaVersion: 1,
+            entryId: options.entryId,
+            runId: options.runId,
+            actionId: action.actionId,
+            resourceId: action.resourceId,
+            policyId: action.policyId,
+            status: "preparing",
+            originalPath: action.target.path,
+            quarantinePath,
+            createdAt: clock().toISOString(),
+            expiresAt: new Date(clock().getTime() + action.quarantineTtlMinutes * 60_000).toISOString(),
+            target: action.target,
+        });
+    }
+    catch (error) {
+        await Promise.all([
+            sourceHandle.close().catch(() => undefined),
+            quarantineDirectoryHandle.close().catch(() => undefined),
+        ]);
+        throw error;
+    }
+    let moved = false;
+    let modeSealed = false;
+    const originalMode = action.target.mode & 0o7777;
+    const chmodHandle = dependencies.chmodHandle ?? ((handle, mode) => handle.chmod(mode));
+    try {
+        if (!providerFileStatsMatch(await sourceHandle.stat(), action.target)) {
+            throw new ProviderFileExecutionError("provider file identity changed while acquiring exclusive access", "skipped-stale", "PROVIDER_FILE_IDENTITY_CHANGED", entry);
+        }
+        await chmodHandle(sourceHandle, originalMode & ~0o222);
+        modeSealed = true;
+        await sourceHandle.sync();
+        if (!providerFileStatsMatch(await sourceHandle.stat(), action.target, true)) {
+            throw new ProviderFileExecutionError("provider file identity changed while sealing exclusive access", "skipped-stale", "PROVIDER_FILE_IDENTITY_CHANGED", entry);
+        }
+        const sealed = await inspectProviderFile(action.target.path, action.target.ownerRoot, action.target.provider);
+        if (!providerFileIdentityMatches(sealed, action.target, true)) {
+            throw new ProviderFileExecutionError("provider file identity changed while acquiring exclusive access", "skipped-stale", "PROVIDER_FILE_IDENTITY_CHANGED", entry);
+        }
+        const readiness = await revalidateProviderFileQuarantine(providerFileQuarantineActionSchema.parse({
+            ...action,
+            target: sealed,
+        }), undefined, undefined, {
+            ...dependencies,
+            allowedHandlePids: new Set([...(dependencies.allowedHandlePids ?? []), process.pid]),
+        });
+        if (readiness.status === "stale") {
+            throw new ProviderFileExecutionError(readiness.diagnostic.message, "skipped-stale", readiness.diagnostic.code, entry);
+        }
+        assertAuthorized(dependencies, entry);
+        if (dependencies.move !== undefined) {
+            await dependencies.move(action.target.path, quarantinePath);
+        }
+        else {
+            await renameAtNoReplace(sourceHandle.parent.fd, sourceHandle.basename, quarantineDirectoryHandle.fd, quarantineBasename, dependencies.platform ?? process.platform);
+        }
+        moved = true;
+        const movedHandle = await openPinnedProviderFile(quarantinePath, options.quarantineDirectory).catch(() => undefined);
+        const movedStats = await movedHandle?.stat().catch(() => undefined);
+        await movedHandle?.close().catch(() => undefined);
+        if (movedStats === undefined || !providerFileStatsMatch(movedStats, action.target, true)) {
+            let rollbackError;
+            try {
+                if (dependencies.move !== undefined) {
+                    await dependencies.move(quarantinePath, action.target.path);
+                }
+                else {
+                    await renameAtNoReplace(quarantineDirectoryHandle.fd, quarantineBasename, sourceHandle.parent.fd, sourceHandle.basename, dependencies.platform ?? process.platform);
+                }
+                await Promise.all([sourceHandle.parent.sync(), quarantineDirectoryHandle.sync()]);
+                moved = false;
+            }
+            catch (error) {
+                rollbackError = error;
+            }
+            if (rollbackError !== undefined) {
+                throw new ProviderFileExecutionError("an unexpected inode was moved and rollback failed", "partially-applied", "PROVIDER_FILE_UNEXPECTED_INODE_PARTIAL", entry, { cause: rollbackError });
+            }
+            throw new ProviderFileExecutionError("source pathname changed before the atomic move; the unexpected inode was restored", "rolled-back", "PROVIDER_FILE_UNEXPECTED_INODE_ROLLED_BACK", entry);
+        }
+        await Promise.all([sourceHandle.parent.sync(), quarantineDirectoryHandle.sync()]);
+        await chmodHandle(sourceHandle, originalMode);
+        modeSealed = false;
+        await sourceHandle.sync();
+        const quarantineIdentity = await inspectProviderFile(quarantinePath, options.quarantineDirectory, action.target.provider);
+        if (quarantineIdentity.device !== action.target.device ||
+            quarantineIdentity.inode !== action.target.inode ||
+            quarantineIdentity.mode !== action.target.mode ||
+            quarantineIdentity.mtimeMs !== action.target.mtimeMs ||
+            quarantineIdentity.measuredBytes !== action.target.measuredBytes ||
+            quarantineIdentity.contentSha256 !== action.target.contentSha256) {
+            throw new ProviderFileExecutionError("quarantined provider file no longer matches the planned content identity", "partially-applied", "PROVIDER_FILE_QUARANTINE_IDENTITY_CHANGED", entry);
+        }
+        entry = await persist(manifestPath, options.quarantineDirectory, {
+            ...entry,
+            status: "quarantined",
+            quarantineIdentity,
+        });
+        return {
+            quarantineEntryId: entry.entryId,
+            quarantinePath: entry.quarantinePath,
+            quarantinedBytes: entry.target.measuredBytes,
+            manifestPath,
+        };
+    }
+    catch (error) {
+        if (!moved) {
+            if (modeSealed) {
+                try {
+                    await chmodHandle(sourceHandle, originalMode);
+                    await sourceHandle.sync();
+                    modeSealed = false;
+                }
+                catch (restoreError) {
+                    throw new ProviderFileExecutionError("provider file permissions could not be restored; recovery remains pending", "partially-applied", "PROVIDER_FILE_PERMISSION_RESTORE_FAILED", entry, { cause: new AggregateError([error, restoreError]) });
+                }
+            }
+            entry = await finalizeUnmovedEntry(entry, manifestPath, options.quarantineDirectory, clock);
+            if (error instanceof ProviderFileExecutionError) {
+                throw error;
+            }
+            throw new ProviderFileExecutionError(error instanceof Error ? error.message : String(error), "failed", "PROVIDER_FILE_QUARANTINE_FAILED", entry, { cause: error });
+        }
+        const quarantineIdentity = await inspectProviderFile(quarantinePath, options.quarantineDirectory, action.target.provider).catch(() => undefined);
+        if (quarantineIdentity !== undefined) {
+            entry = await persist(manifestPath, options.quarantineDirectory, {
+                ...entry,
+                status: "partial",
+                quarantineIdentity,
+                diagnostic: {
+                    severity: "error",
+                    code: "PROVIDER_FILE_QUARANTINE_PARTIAL",
+                    message: error instanceof Error ? error.message : String(error),
+                    adapter: action.adapter,
+                    resourceId: action.resourceId,
+                },
+            }).catch(() => entry);
+        }
+        throw new ProviderFileExecutionError(error instanceof Error ? error.message : String(error), "partially-applied", "PROVIDER_FILE_QUARANTINE_PARTIAL", entry, { cause: error, quarantinedBytes: moved ? action.target.measuredBytes : 0 });
+    }
+    finally {
+        await Promise.all([
+            sourceHandle.close().catch(() => undefined),
+            quarantineDirectoryHandle.close().catch(() => undefined),
+        ]);
+    }
+}
+//# sourceMappingURL=provider-file-executor.js.map

package/dist/core/provider-file-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-executor.js","sourceRoot":"","sources":["../../src/core/provider-file-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAmB,MAAM,kBAAkB,CAAC;AAChG,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,gCAAgC,GAEjC,MAAM,iCAAiC,CAAC;AAQzC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAKxC,OAAO;IACP,cAAc;IACd,KAAK;IANE,IAAI,GAAG,4BAA4B,CAAC;IAEtD,YACE,OAAe,EACN,OAAqC,EACrC,cAAsB,EACtB,KAAmC,EAC5C,OAAsD;QAEtD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;uBALf,OAAO;8BACP,cAAc;qBACd,KAAK;QAId,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,CAAC,CAAC;IACzD,CAAC;IAEQ,gBAAgB,CAAS;CACnC;AA2BD,MAAM,UAAU,0BAA0B,CAAC,mBAA2B,EAAE,OAAe;IACrF,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAClD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,YAAoB,EACpB,mBAA2B,EAC3B,KAAkC;IAElC,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE;QAC1C,kBAAkB,EAAE,CAAC,mBAAmB,CAAC;KAC1C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAkC,EAClC,YAAoB,EACpB,mBAA2B,EAC3B,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,YAAY,EAAE,mBAAmB,EAAE;YACtD,GAAG,KAAK;YACR,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,YAA8C,EAC9C,KAAmC;IAEnC,IACE,YAAY,CAAC,aAAa,KAAK,SAAS;QACxC,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,aAAa,CAAC,WAAW,EACpF,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,oEAAoE,EACpE,eAAe,EACf,2BAA2B,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAoC,EACpC,OAA6C;IAE7C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChG,MAAM,kBAAkB,GAAG,GAAG,OAAO,CAAC,OAAO,UAAU,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,OAAO,OAAO,CAAC,CAAC;IAElF,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,0BAA0B,CAClC,8CAA8C,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,EACzF,eAAe,EACf,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,0BAA0B,CAClC,8DAA8D,EAC9D,eAAe,EACf,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,eAAe,EACf,8BAA8B,EAC9B,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,yBAAyB,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzF,IAAI,YAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,yBAAyB,CAAC,IAAI,EAAE;YAChC,YAAY,CAAC,IAAI,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC5C,MAAM,IAAI,0BAA0B,CAClC,6DAA6D,EAC7D,eAAe,EACf,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,0BAA0B,CAClC,qDAAqD,EACrD,QAAQ,EACR,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,yBAAyB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;YAChD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,QAAQ,EACR,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,KAAkC,CAAC;IACvC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE;YAC/D,aAAa,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YAChC,cAAc;YACd,SAAS,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;YAC3F,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC3C,yBAAyB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC;IACjD,MAAM,WAAW,GACf,YAAY,CAAC,WAAW,IAAI,CAAC,CAAC,MAAkB,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,IAAI,CAAC,sBAAsB,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,0BAA0B,CAClC,iEAAiE,EACjE,eAAe,EACf,gCAAgC,EAChC,KAAK,CACN,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,CAAC,YAAY,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,sBAAsB,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,0BAA0B,CAClC,+DAA+D,EAC/D,eAAe,EACf,gCAAgC,EAChC,KAAK,CACN,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,MAAM,CAAC,MAAM,CAAC,SAAS,EACvB,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CAAC;QACF,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0BAA0B,CAClC,iEAAiE,EACjE,eAAe,EACf,gCAAgC,EAChC,KAAK,CACN,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,gCAAgC,CACtD,kCAAkC,CAAC,KAAK,CAAC;YACvC,GAAG,MAAM;YACT,MAAM,EAAE,MAAM;SACf,CAAC,EACF,SAAS,EACT,SAAS,EACT;YACE,GAAG,YAAY;YACf,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;SACrF,CACF,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,0BAA0B,CAClC,SAAS,CAAC,UAAU,CAAC,OAAO,EAC5B,eAAe,EACf,SAAS,CAAC,UAAU,CAAC,IAAI,EACzB,KAAK,CACN,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CACrB,YAAY,CAAC,MAAM,CAAC,EAAE,EACtB,YAAY,CAAC,QAAQ,EACrB,yBAAyB,CAAC,EAAE,EAC5B,kBAAkB,EAClB,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAC1C,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,cAAc,EACd,OAAO,CAAC,mBAAmB,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,WAAW,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACzF,IAAI,aAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACpC,MAAM,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,CACrB,yBAAyB,CAAC,EAAE,EAC5B,kBAAkB,EAClB,YAAY,CAAC,MAAM,CAAC,EAAE,EACtB,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAC1C,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAA0B,CAClC,mDAAmD,EACnD,mBAAmB,EACnB,wCAAwC,EACxC,KAAK,EACL,EAAE,KAAK,EAAE,aAAa,EAAE,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,mFAAmF,EACnF,aAAa,EACb,4CAA4C,EAC5C,KAAK,CACN,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC9C,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,MAAM,mBAAmB,CAClD,cAAc,EACd,OAAO,CAAC,mBAAmB,EAC3B,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM;YAClD,kBAAkB,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK;YAChD,kBAAkB,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI;YAC9C,kBAAkB,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO;YACpD,kBAAkB,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa;YAChE,kBAAkB,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAChE,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,0EAA0E,EAC1E,mBAAmB,EACnB,2CAA2C,EAC3C,KAAK,CACN,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE;YAC/D,GAAG,KAAK;YACR,MAAM,EAAE,aAAa;YACrB,kBAAkB;SACnB,CAAC,CAAC;QACH,OAAO;YACL,iBAAiB,EAAE,KAAK,CAAC,OAAO;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YAC5C,YAAY;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC9C,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;oBAC1B,UAAU,GAAG,KAAK,CAAC;gBACrB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,MAAM,IAAI,0BAA0B,CAClC,2EAA2E,EAC3E,mBAAmB,EACnB,yCAAyC,EACzC,KAAK,EACL,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CACrD,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAC5F,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,QAAQ,EACR,iCAAiC,EACjC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,mBAAmB,CAClD,cAAc,EACd,OAAO,CAAC,mBAAmB,EAC3B,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBAC/D,GAAG,KAAK;gBACR,MAAM,EAAE,SAAS;gBACjB,kBAAkB;gBAClB,UAAU,EAAE;oBACV,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,mBAAmB,EACnB,kCAAkC,EAClC,KAAK,EACL,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC3C,yBAAyB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/core/provider-file-identity.d.ts

@@ -0,0 +1,8 @@
+import type { Stats } from "node:fs";
+import type { ProviderFileIdentity, ProviderMutationId } from "../contracts/action.js";
+export declare function inspectProviderFile<T extends ProviderMutationId>(path: string, ownerRoot: string, provider: T): Promise<ProviderFileIdentity & {
+    provider: T;
+}>;
+export declare function providerFileIdentityMatches(actual: ProviderFileIdentity, expected: ProviderFileIdentity, allowSealedMode?: boolean): boolean;
+export declare function providerFileStatsMatch(stats: Stats, expected: ProviderFileIdentity, allowSealedMode?: boolean): boolean;
+//# sourceMappingURL=provider-file-identity.d.ts.map

package/dist/core/provider-file-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-identity.d.ts","sourceRoot":"","sources":["../../src/core/provider-file-identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAqCvF,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,kBAAkB,EACpE,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,GACV,OAAO,CAAC,oBAAoB,GAAG;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,CAyCjD;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,oBAAoB,EAC9B,eAAe,UAAQ,GACtB,OAAO,CA8BT;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,oBAAoB,EAC9B,eAAe,UAAQ,GACtB,OAAO,CAYT"}

package/dist/core/provider-file-identity.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { sha256Json } from "./digest.js";
+import { openPinnedProviderFile } from "./pinned-file.js";
+async function hashFileDescriptor(handle, measuredBytes) {
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let position = 0;
+    while (position < measuredBytes) {
+        const remaining = measuredBytes - position;
+        const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, remaining), position);
+        if (bytesRead === 0) {
+            throw new Error("provider file reached end-of-file before its measured size");
+        }
+        hash.update(buffer.subarray(0, bytesRead));
+        position += bytesRead;
+    }
+    return hash.digest("hex");
+}
+function stableFileStats(before, after) {
+    return (before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.nlink === after.nlink &&
+        before.mode === after.mode &&
+        before.mtimeMs === after.mtimeMs &&
+        before.ctimeMs === after.ctimeMs &&
+        before.size === after.size);
+}
+export async function inspectProviderFile(path, ownerRoot, provider) {
+    const handle = await openPinnedProviderFile(path, ownerRoot);
+    let after;
+    let contentSha256;
+    try {
+        const before = await handle.stat();
+        if (!before.isFile()) {
+            throw new Error(`provider cleanup target is not a regular file: ${path}`);
+        }
+        if (before.nlink !== 1) {
+            throw new Error(`provider cleanup target has multiple hard links: ${path}`);
+        }
+        contentSha256 = await hashFileDescriptor(handle, before.size);
+        after = await handle.stat();
+        if (!stableFileStats(before, after)) {
+            throw new Error(`provider file changed while its content identity was measured: ${path}`);
+        }
+        if (after.nlink !== 1) {
+            throw new Error(`provider cleanup target has multiple hard links: ${path}`);
+        }
+    }
+    finally {
+        await handle.close();
+    }
+    const identity = {
+        path: handle.path,
+        ownerRoot: handle.ownerRoot,
+        relativePath: handle.relativePath,
+        provider,
+        device: after.dev,
+        inode: after.ino,
+        linkCount: 1,
+        mode: after.mode,
+        mtimeMs: after.mtimeMs,
+        measuredBytes: after.size,
+        contentSha256,
+    };
+    return {
+        ...identity,
+        fingerprint: sha256Json(identity),
+    };
+}
+function modeMatches(actual, expected, allowSealedMode) {
+    return actual === expected || (allowSealedMode && actual === (expected & ~0o222));
+}
+export function providerFileIdentityMatches(actual, expected, allowSealedMode = false) {
+    return (actual.path === expected.path &&
+        actual.ownerRoot === expected.ownerRoot &&
+        actual.relativePath === expected.relativePath &&
+        actual.provider === expected.provider &&
+        actual.device === expected.device &&
+        actual.inode === expected.inode &&
+        actual.linkCount === expected.linkCount &&
+        modeMatches(actual.mode, expected.mode, allowSealedMode) &&
+        actual.mtimeMs === expected.mtimeMs &&
+        actual.measuredBytes === expected.measuredBytes &&
+        actual.contentSha256 === expected.contentSha256 &&
+        (actual.fingerprint === expected.fingerprint ||
+            (allowSealedMode &&
+                actual.fingerprint ===
+                    sha256Json({
+                        path: expected.path,
+                        ownerRoot: expected.ownerRoot,
+                        relativePath: expected.relativePath,
+                        provider: expected.provider,
+                        device: expected.device,
+                        inode: expected.inode,
+                        linkCount: expected.linkCount,
+                        mode: expected.mode & ~0o222,
+                        mtimeMs: expected.mtimeMs,
+                        measuredBytes: expected.measuredBytes,
+                        contentSha256: expected.contentSha256,
+                    }))));
+}
+export function providerFileStatsMatch(stats, expected, allowSealedMode = false) {
+    return (stats.isFile() &&
+        !stats.isSymbolicLink() &&
+        stats.dev === expected.device &&
+        stats.ino === expected.inode &&
+        stats.nlink === expected.linkCount &&
+        (stats.mode === expected.mode ||
+            (allowSealedMode && stats.mode === (expected.mode & ~0o222))) &&
+        stats.mtimeMs === expected.mtimeMs &&
+        stats.size === expected.measuredBytes);
+}
+//# sourceMappingURL=provider-file-identity.js.map

package/dist/core/provider-file-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-identity.js","sourceRoot":"","sources":["../../src/core/provider-file-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAmB,MAAM,kBAAkB,CAAC;AAE3E,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAqB;IACzE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAClC,QAAQ,CACT,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3C,QAAQ,IAAI,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,MAAa,EAAE,KAAY;IAClD,OAAO,CACL,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC5B,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAChC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,SAAiB,EACjB,QAAW;IAEX,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAY,CAAC;IACjB,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,aAAa,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kEAAkE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,GAAG;QACjB,KAAK,EAAE,KAAK,CAAC,GAAG;QAChB,SAAS,EAAE,CAAU;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,IAAI;QACzB,aAAa;KACd,CAAC;IACF,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,eAAwB;IAC7E,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,eAAe,IAAI,MAAM,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAA4B,EAC5B,QAA8B,EAC9B,eAAe,GAAG,KAAK;IAEvB,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC7B,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACvC,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC7C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAC/B,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACvC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QACxD,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QACnC,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC/C,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC/C,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC1C,CAAC,eAAe;gBACd,MAAM,CAAC,WAAW;oBAChB,UAAU,CAAC;wBACT,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK;wBAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;wBACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;qBACtC,CAAC,CAAC,CAAC,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAY,EACZ,QAA8B,EAC9B,eAAe,GAAG,KAAK;IAEvB,OAAO,CACL,KAAK,CAAC,MAAM,EAAE;QACd,CAAC,KAAK,CAAC,cAAc,EAAE;QACvB,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;QAC7B,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK;QAC5B,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS;QAClC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAC3B,CAAC,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;QAClC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,aAAa,CACtC,CAAC;AACJ,CAAC"}

package/dist/core/provider-file-policy.d.ts

@@ -0,0 +1,19 @@
+import type { AgentRinseConfig } from "../config/schema.js";
+import type { ProviderFileQuarantineAction, ProviderMutationId } from "../contracts/action.js";
+export type ProviderFilePolicy = {
+    id: string;
+    provider: ProviderMutationId;
+    matchesRelativePath(relativePath: string): boolean;
+    validateAction(action: ProviderFileQuarantineAction, now: Date): string | undefined;
+};
+export declare const CLAUDE_DEBUG_LOG_POLICY_ID = "claude.debug-log";
+export declare const CLAUDE_DEBUG_LOG_MIN_AGE_MINUTES: number;
+export declare const CLAUDE_DEBUG_LOG_QUARANTINE_TTL_MINUTES: number;
+export declare const CLAUDE_CHANGELOG_CACHE_POLICY_ID = "claude.changelog-cache";
+export declare const CLAUDE_CHANGELOG_CACHE_MIN_AGE_MINUTES: number;
+export declare const CLAUDE_CHANGELOG_CACHE_QUARANTINE_TTL_MINUTES: number;
+export declare function isClaudeDebugLogRelativePath(relativePath: string): boolean;
+export declare function isClaudeChangelogCacheRelativePath(relativePath: string): boolean;
+export declare const PROVIDER_FILE_POLICIES: readonly ProviderFilePolicy[];
+export declare function authorizeProviderFileAction(action: ProviderFileQuarantineAction, home: string, config: AgentRinseConfig, platform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv, now?: Date): Promise<void>;
+//# sourceMappingURL=provider-file-policy.d.ts.map

package/dist/core/provider-file-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-policy.d.ts","sourceRoot":"","sources":["../../src/core/provider-file-policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE/F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD,cAAc,CAAC,MAAM,EAAE,4BAA4B,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;CACrF,CAAC;AAEF,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAC7D,eAAO,MAAM,gCAAgC,QAAe,CAAC;AAC7D,eAAO,MAAM,uCAAuC,QAAc,CAAC;AACnE,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,sCAAsC,QAAe,CAAC;AACnE,eAAO,MAAM,6CAA6C,QAAc,CAAC;AAEzE,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQ1E;AAED,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAGhF;AAqBD,eAAO,MAAM,sBAAsB,EAAE,SAAS,kBAAkB,EA6B/D,CAAC;AAEF,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,4BAA4B,EACpC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,EACxB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/core/provider-file-policy.js

@@ -0,0 +1,72 @@
+import { realpath } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { resolveProviderRoot } from "../adapters/provider-root.js";
+import { PROVIDER_SPECS } from "../adapters/provider-specs.js";
+export const CLAUDE_DEBUG_LOG_POLICY_ID = "claude.debug-log";
+export const CLAUDE_DEBUG_LOG_MIN_AGE_MINUTES = 30 * 24 * 60;
+export const CLAUDE_DEBUG_LOG_QUARANTINE_TTL_MINUTES = 7 * 24 * 60;
+export const CLAUDE_CHANGELOG_CACHE_POLICY_ID = "claude.changelog-cache";
+export const CLAUDE_CHANGELOG_CACHE_MIN_AGE_MINUTES = 30 * 24 * 60;
+export const CLAUDE_CHANGELOG_CACHE_QUARANTINE_TTL_MINUTES = 7 * 24 * 60;
+export function isClaudeDebugLogRelativePath(relativePath) {
+    const components = relativePath.split(sep);
+    return (components.length === 2 &&
+        components[0] === "debug" &&
+        components[1] !== undefined &&
+        components[1].endsWith(".txt"));
+}
+export function isClaudeChangelogCacheRelativePath(relativePath) {
+    const components = relativePath.split(sep);
+    return components.length === 2 && components[0] === "cache" && components[1] === "changelog.md";
+}
+function validateAgeAndRecoveryWindow(action, now, label, minimumAgeMinutes, minimumTtlMinutes) {
+    if (action.pendingQuarantineBytes !== action.target.measuredBytes) {
+        return "pending quarantine bytes must match the exact file identity";
+    }
+    if (action.quarantineTtlMinutes < minimumTtlMinutes) {
+        return `${label} require at least seven days of recoverable quarantine`;
+    }
+    if (now.getTime() - action.target.mtimeMs < minimumAgeMinutes * 60_000) {
+        return `${label} must be at least 30 days old`;
+    }
+    return undefined;
+}
+export const PROVIDER_FILE_POLICIES = [
+    {
+        id: CLAUDE_DEBUG_LOG_POLICY_ID,
+        provider: "claude",
+        matchesRelativePath: isClaudeDebugLogRelativePath,
+        validateAction(action, now) {
+            return validateAgeAndRecoveryWindow(action, now, "Claude debug logs", CLAUDE_DEBUG_LOG_MIN_AGE_MINUTES, CLAUDE_DEBUG_LOG_QUARANTINE_TTL_MINUTES);
+        },
+    },
+    {
+        id: CLAUDE_CHANGELOG_CACHE_POLICY_ID,
+        provider: "claude",
+        matchesRelativePath: isClaudeChangelogCacheRelativePath,
+        validateAction(action, now) {
+            return validateAgeAndRecoveryWindow(action, now, "Claude changelog caches", CLAUDE_CHANGELOG_CACHE_MIN_AGE_MINUTES, CLAUDE_CHANGELOG_CACHE_QUARANTINE_TTL_MINUTES);
+        },
+    },
+];
+export async function authorizeProviderFileAction(action, home, config, platform = process.platform, environment = process.env, now = new Date()) {
+    const explicitRoot = config.adapters[action.adapter]?.root;
+    const configuredRoot = resolveProviderRoot(PROVIDER_SPECS[action.adapter], resolve(home), {
+        ...(explicitRoot === undefined ? {} : { root: explicitRoot }),
+        platform,
+        environment,
+    });
+    const physicalRoot = await realpath(configuredRoot);
+    if (action.target.ownerRoot !== physicalRoot) {
+        throw new Error(`provider-file target is outside the configured ${action.adapter} root`);
+    }
+    const policy = PROVIDER_FILE_POLICIES.find((candidate) => candidate.id === action.policyId && candidate.provider === action.adapter);
+    if (policy === undefined || !policy.matchesRelativePath(action.target.relativePath)) {
+        throw new Error(`provider-file target is not approved by policy ${action.adapter}:${action.policyId}`);
+    }
+    const refusal = policy.validateAction(action, now);
+    if (refusal !== undefined) {
+        throw new Error(`provider-file action violates policy ${action.adapter}:${action.policyId}: ${refusal}`);
+    }
+}
+//# sourceMappingURL=provider-file-policy.js.map

package/dist/core/provider-file-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-policy.js","sourceRoot":"","sources":["../../src/core/provider-file-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAW/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAC7D,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AACnE,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACnE,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzE,MAAM,UAAU,4BAA4B,CAAC,YAAoB;IAC/D,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;QACzB,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;QAC3B,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,YAAoB;IACrE,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC;AAClG,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAoC,EACpC,GAAS,EACT,KAAa,EACb,iBAAyB,EACzB,iBAAyB;IAEzB,IAAI,MAAM,CAAC,sBAAsB,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAClE,OAAO,6DAA6D,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAO,GAAG,KAAK,wDAAwD,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,iBAAiB,GAAG,MAAM,EAAE,CAAC;QACvE,OAAO,GAAG,KAAK,+BAA+B,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE;QACE,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,QAAQ;QAClB,mBAAmB,EAAE,4BAA4B;QACjD,cAAc,CAAC,MAAM,EAAE,GAAG;YACxB,OAAO,4BAA4B,CACjC,MAAM,EACN,GAAG,EACH,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,QAAQ,EAAE,QAAQ;QAClB,mBAAmB,EAAE,kCAAkC;QACvD,cAAc,CAAC,MAAM,EAAE,GAAG;YACxB,OAAO,4BAA4B,CACjC,MAAM,EACN,GAAG,EACH,yBAAyB,EACzB,sCAAsC,EACtC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAoC,EACpC,IAAY,EACZ,MAAwB,EACxB,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,WAAW,GAAsB,OAAO,CAAC,GAAG,EAC5C,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACxF,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC7D,QAAQ;QACR,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,OAAO,OAAO,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CACxC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CACzF,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CACxF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/provider-file-recovery.d.ts

@@ -0,0 +1,25 @@
+import { type ProviderFileQuarantineEntry } from "../contracts/provider-file-quarantine.js";
+import { type PinnedFile } from "./pinned-file.js";
+import { type ProviderProcessResult } from "./provider-processes.js";
+import { type ProcessOwnershipResult } from "./process-ownership.js";
+export type ProviderFileRecoveryDependencies = {
+    clock?: () => Date;
+    move?: (source: string, destination: string) => Promise<void>;
+    inspectProcesses?: (provider: ProviderFileQuarantineEntry["target"]["provider"]) => Promise<ProviderProcessResult>;
+    inspectOpenHandles?: (path: string) => Promise<ProcessOwnershipResult>;
+    truncateHandle?: (handle: PinnedFile) => Promise<void>;
+    platform?: NodeJS.Platform;
+};
+export type ProviderFileRecoveryOptions = {
+    manifestPath: string;
+    quarantineDirectory: string;
+    allowUnexpired?: boolean;
+    dependencies?: ProviderFileRecoveryDependencies;
+};
+export declare function providerFilePurgeIsolationPath(quarantineDirectory: string, entryId: string): string;
+export declare function undoProviderFileQuarantine(input: ProviderFileQuarantineEntry, options: ProviderFileRecoveryOptions): Promise<ProviderFileQuarantineEntry>;
+export declare function purgeProviderFileQuarantine(input: ProviderFileQuarantineEntry, options: ProviderFileRecoveryOptions): Promise<{
+    entry: ProviderFileQuarantineEntry;
+    reclaimedBytes: number;
+}>;
+//# sourceMappingURL=provider-file-recovery.d.ts.map

package/dist/core/provider-file-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-file-recovery.d.ts","sourceRoot":"","sources":["../../src/core/provider-file-recovery.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAA4B,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAE7F,MAAM,MAAM,gCAAgC,GAAG;IAC7C,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,CACjB,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KACxD,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpC,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,gCAAgC,CAAC;CACjD,CAAC;AAEF,wBAAgB,8BAA8B,CAC5C,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAsUD,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAyGtC;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC;IAAE,KAAK,EAAE,2BAA2B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA+HzE"}