agy-worker-mcp 0.3.1

package/dist/contract/errors.js

@@ -0,0 +1,99 @@
+/**
+ * Structured errors. READ-ONLY after Stage 1.
+ *
+ * Every error carries a machine-readable `detail` so the *calling agent* can
+ * repair itself without another round trip: which job holds the lock, which rule
+ * string to add, which enum values exist.
+ */
+/** Base for everything in this module. `instanceof` works across all subclasses. */
+export class AgyWorkerError extends Error {
+    detail;
+    remedy;
+    constructor(message, detail, remedy) {
+        super(message);
+        this.name = new.target.name;
+        this.detail = detail;
+        this.remedy = remedy;
+        Error.captureStackTrace?.(this, new.target);
+    }
+    toJSON() {
+        return {
+            error: this.code,
+            message: this.message,
+            detail: this.detail,
+            remedy: this.remedy,
+        };
+    }
+}
+export function isAgyWorkerError(e) {
+    return e instanceof AgyWorkerError;
+}
+/** Normalizes anything thrown into an envelope so a tool handler never leaks a stack. */
+export function toErrorEnvelope(e) {
+    if (isAgyWorkerError(e))
+        return e.toJSON();
+    const message = e instanceof Error ? e.message : String(e);
+    return {
+        error: 'VALIDATION',
+        message,
+        detail: { unexpected: true },
+        remedy: 'This is an internal failure, not a usable input error. Retry once; if it repeats, report it.',
+    };
+}
+/**
+ * Losing a lock race is an error, never a silent serialization.
+ * The caller decides whether to wait on the holder or pick a different cwd.
+ */
+export class LockConflictError extends AgyWorkerError {
+    code = 'LOCK_CONFLICT';
+    constructor(detail, message) {
+        const holder = detail.holder_job_id;
+        super(message ??
+            (detail.reason === 'limit'
+                ? `project concurrency limit reached (${detail.limit} running)`
+                : `${detail.scope} lock on "${detail.key}" is held by job ${holder}`), detail, detail.reason === 'limit'
+            ? 'Wait for a running job to finish (agy_wait on one of running_job_ids), or cancel one with agy_cancel.'
+            : detail.scope === 'cwd_write'
+                ? `One writing job per cwd at a time; holder is job ${holder}. For parallel work start each job in its own git worktree inside the project root (cwd), or agy_wait on the holder.`
+                : `Call agy_wait({ job_id: "${holder}" }) to take over the holder, agy_cancel to stop it, or start this job in a different cwd.`);
+    }
+}
+/** A policy refusal, whether reported by the gate or replayed by the broker. */
+export class PolicyDeniedError extends AgyWorkerError {
+    code = 'POLICY_DENIED';
+    constructor(detail, message) {
+        super(message ??
+            `${detail.tool}${detail.command ? ` (${detail.command})` : ''} denied by ${detail.policy} under profile "${detail.profile}"`, detail, detail.immutable
+            ? `This rule cannot be lifted by a client request. Use a different approach, or a profile that permits it.`
+            : detail.required_rule
+                ? `Retry with permissions.allow including ${JSON.stringify(detail.required_rule)}.`
+                : 'Narrow the requested action, or choose a profile whose ceiling covers it.');
+    }
+}
+/** Containment failure. Checked *after* realpath, never before (see docs/permissions.md). */
+export class PathEscapeError extends AgyWorkerError {
+    code = 'PATH_ESCAPE';
+    constructor(detail, message) {
+        super(message ??
+            `path "${detail.input_path}" resolves to "${detail.resolved_path}", outside the allowed ${detail.kind} roots`, detail, `Use a path inside one of: ${detail.roots.join(', ')}. Symlinks are resolved before the check, so linking out does not work.`);
+    }
+}
+export class JobNotFoundError extends AgyWorkerError {
+    code = 'JOB_NOT_FOUND';
+    constructor(detail, message) {
+        super(message ?? `no job "${detail.job_id}" in project ${detail.project_root}`, detail, detail.known_recent.length
+            ? `Recent job ids: ${detail.known_recent.join(', ')}. Use agy_list_jobs for the full list.`
+            : 'Use agy_list_jobs to see what exists in this project. Jobs are per-project and never visible across projects.');
+    }
+}
+export class ValidationError extends AgyWorkerError {
+    code = 'VALIDATION';
+    constructor(detail, message) {
+        super(message ?? `invalid ${detail.field}: expected ${detail.expected}`, detail, detail.allowed
+            ? `Allowed values: ${detail.allowed.join(' | ')}.`
+            : detail.allowed_verbs
+                ? `A rule looks like verb(pattern). Verbs: ${detail.allowed_verbs.join(' | ')}. Prefix the pattern with "regex:" to opt into regular expressions.`
+                : `Correct ${detail.field} and call again.`);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/contract/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/contract/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwBH,oFAAoF;AACpF,MAAM,OAAgB,cAA4B,SAAQ,KAAK;IAEpD,MAAM,CAAG;IACT,MAAM,CAAQ;IAEvB,YAAsB,OAAe,EAAE,MAAS,EAAE,MAAc;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAA;IACH,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,OAAO,CAAC,YAAY,cAAc,CAAA;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,IAAI,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,OAAO;QACP,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE,8FAA8F;KACvG,CAAA;AACH,CAAC;AAqBD;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAAkC;IAC9D,IAAI,GAAG,eAAwB,CAAA;IAExC,YAAY,MAA0B,EAAE,OAAgB;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAA;QACnC,KAAK,CACH,OAAO;YACL,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO;gBACxB,CAAC,CAAC,sCAAsC,MAAM,CAAC,KAAK,WAAW;gBAC/D,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,GAAG,oBAAoB,MAAM,EAAE,CAAC,EACzE,MAAM,EACN,MAAM,CAAC,MAAM,KAAK,OAAO;YACvB,CAAC,CAAC,uGAAuG;YACzG,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW;gBAC5B,CAAC,CAAC,oDAAoD,MAAM,sHAAsH;gBAClL,CAAC,CAAC,4BAA4B,MAAM,4FAA4F,CACrI,CAAA;IACH,CAAC;CACF;AAuBD,gFAAgF;AAChF,MAAM,OAAO,iBAAkB,SAAQ,cAAkC;IAC9D,IAAI,GAAG,eAAwB,CAAA;IAExC,YAAY,MAA0B,EAAE,OAAgB;QACtD,KAAK,CACH,OAAO;YACL,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,MAAM,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,GAAG,EAC9H,MAAM,EACN,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,yGAAyG;YAC3G,CAAC,CAAC,MAAM,CAAC,aAAa;gBACpB,CAAC,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG;gBACnF,CAAC,CAAC,2EAA2E,CAClF,CAAA;IACH,CAAC;CACF;AAiBD,6FAA6F;AAC7F,MAAM,OAAO,eAAgB,SAAQ,cAAgC;IAC1D,IAAI,GAAG,aAAsB,CAAA;IAEtC,YAAY,MAAwB,EAAE,OAAgB;QACpD,KAAK,CACH,OAAO;YACL,SAAS,MAAM,CAAC,UAAU,kBAAkB,MAAM,CAAC,aAAa,0BAA0B,MAAM,CAAC,IAAI,QAAQ,EAC/G,MAAM,EACN,6BAA6B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAC9H,CAAA;IACH,CAAC;CACF;AAWD,MAAM,OAAO,gBAAiB,SAAQ,cAAiC;IAC5D,IAAI,GAAG,eAAwB,CAAA;IAExC,YAAY,MAAyB,EAAE,OAAgB;QACrD,KAAK,CACH,OAAO,IAAI,WAAW,MAAM,CAAC,MAAM,gBAAgB,MAAM,CAAC,YAAY,EAAE,EACxE,MAAM,EACN,MAAM,CAAC,YAAY,CAAC,MAAM;YACxB,CAAC,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAC3F,CAAC,CAAC,+GAA+G,CACpH,CAAA;IACH,CAAC;CACF;AAiBD,MAAM,OAAO,eAAgB,SAAQ,cAAgC;IAC1D,IAAI,GAAG,YAAqB,CAAA;IAErC,YAAY,MAAwB,EAAE,OAAgB;QACpD,KAAK,CACH,OAAO,IAAI,WAAW,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,QAAQ,EAAE,EACjE,MAAM,EACN,MAAM,CAAC,OAAO;YACZ,CAAC,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;YAClD,CAAC,CAAC,MAAM,CAAC,aAAa;gBACpB,CAAC,CAAC,2CAA2C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,qEAAqE;gBAClJ,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,kBAAkB,CAChD,CAAA;IACH,CAAC;CACF"}

package/dist/contract/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The frozen contract. Every other module imports from here (or from the three
+ * files directly); nothing else in `src/` may redefine these shapes.
+ *
+ * READ-ONLY after Stage 1 — see `contract_change_requests`.
+ */
+export * from './types.js';
+export * from './errors.js';
+export * from './paths.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA"}

package/dist/contract/index.js

@@ -0,0 +1,10 @@
+/**
+ * The frozen contract. Every other module imports from here (or from the three
+ * files directly); nothing else in `src/` may redefine these shapes.
+ *
+ * READ-ONLY after Stage 1 — see `contract_change_requests`.
+ */
+export * from './types.js';
+export * from './errors.js';
+export * from './paths.js';
+//# sourceMappingURL=index.js.map

package/dist/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA"}

package/dist/contract/paths.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Project discovery, on-disk layout, and path containment. READ-ONLY after Stage 1.
+ *
+ * Layout — deliberately outside the repo so nothing has to be
+ * gitignored (see docs/operations.md):
+ *
+ * ```
+ * ~/.agy-worker/projects/<sha256(canonical_root)[:16]>/
+ *     project.json  index.db
+ *     jobs/<job-id>/{request,effective-config,state}.json
+ *                   events.ndjson stderr.log exit_code
+ *                   inbox.jsonl policy.json gate-log.jsonl
+ *                   agent-result.json broker-result.json verification.json
+ *                   verify.log verify.json
+ * ```
+ */
+export type ProjectRootSource = 'env' | 'git' | 'cwd';
+export interface ProjectRootResolution {
+    root: string;
+    source: ProjectRootSource;
+}
+/**
+ * Resolve the project root.
+ *
+ * Precedence: `AGY_WORKER_PROJECT` (documented as an *override* in `docs/operations.md`) →
+ * nearest ancestor containing `.git` → the starting directory itself. The last
+ * branch ensures non-git directories are fully supported.
+ *
+ * The returned path is always canonical (symlinks resolved).
+ */
+export declare function resolveProjectRoot(startCwd?: string): ProjectRootResolution;
+/** Convenience wrapper when the caller does not care where the root came from. */
+export declare function projectRoot(startCwd?: string): string;
+/** Walks up looking for `.git` (a directory *or* a worktree/submodule file). */
+export declare function findGitRoot(startCanonical: string): string | null;
+/** `~/.agy-worker`, or `AGY_WORKER_HOME` when set (tests always set it). */
+export declare function stateHome(): string;
+/** `sha256(canonical_root)` truncated to 16 hex chars — the per-project directory name. */
+export declare function projectKey(canonicalRoot: string): string;
+export interface ProjectPaths {
+    /** Canonical project root inside the user's filesystem. */
+    root: string;
+    key: string;
+    /** `<stateHome>/projects/<key>` */
+    dir: string;
+    projectJson: string;
+    db: string;
+    jobsDir: string;
+}
+export declare function projectPaths(canonicalRoot: string): ProjectPaths;
+/** Chmod SQLite db and WAL/SHM files to 0o600. */
+export declare function chmodDbFiles(dbPath: string): void;
+/**
+ * Creates the project directory tree and writes `project.json` (the reverse
+ * lookup from hash back to path). Idempotent and safe to race.
+ */
+export declare function ensureProjectDirs(paths: ProjectPaths): ProjectPaths;
+export interface JobPaths {
+    jobId: string;
+    dir: string;
+    request: string;
+    effectiveConfig: string;
+    state: string;
+    /** agy stdout, redirected straight to this fd. Cursors are byte offsets into it. */
+    events: string;
+    stderr: string;
+    /** Written by the runner on exit. Its presence is what makes a job finalizable. */
+    exitCode: string;
+    inbox: string;
+    policy: string;
+    gateLog: string;
+    agentResult: string;
+    brokerResult: string;
+    verification: string;
+    /** stdout+stderr of `verify_command`, capped at 1 MiB (PR6 §6.2). */
+    verifyLog: string;
+    /** `VerifyRecord`, written once after `verify_command` exits (PR6 §6.2). */
+    verifyJson: string;
+}
+export declare function jobPaths(project: ProjectPaths, jobId: string): JobPaths;
+export declare function ensureJobDirs(paths: JobPaths): JobPaths;
+/** Sortable id: `<base36 ms>-<8 hex>`. Lexical order matches creation order. */
+export declare function newJobId(now?: number): string;
+/** Session ids are opaque; they never appear in a filesystem path. */
+export declare function newSessionId(): string;
+/**
+ * The DDL text. Resolved next to this module (`dist/contract/schema.sql` after a
+ * build, `src/contract/schema.sql` under vitest), with the source tree as fallback.
+ */
+export declare function loadSchemaSql(): string;
+/** Installed package root (the directory holding `package.json`). */
+export declare function packageRoot(): string;
+/**
+ * Absolute path to one of the three entry points. The gate path is written into
+ * generated `hooks.json` files, so it must be stable and absolute.
+ *
+ * `ENV.GATE_BIN` overrides the `'gate'` case only — a test-only escape hatch
+ * (`ENV.GATE_BIN`'s own comment) so a test can point `agy_start` at a
+ * nonexistent gate binary and exercise its `existsSync` failure path without
+ * disturbing the real `dist/gate.js` every other test also depends on.
+ */
+export declare function binPath(which: 'server' | 'runner' | 'gate'): string;
+/**
+ * Absolute, `..`-free, symlink-resolved path.
+ *
+ * When the path does not exist yet (a file the job is about to write) the deepest
+ * existing ancestor is resolved and the remaining segments are appended. That is
+ * what makes containment checks meaningful for not-yet-created files: the
+ * *directory* they would land in is what actually decides the answer.
+ */
+export declare function canonicalize(input: string): string;
+/** True when `candidate` is `root` itself or lives beneath it. Both must be canonical. */
+export declare function isWithin(candidate: string, root: string): boolean;
+/** True when the path traverses a symlink anywhere below `root`. */
+export declare function traversesSymlink(input: string): boolean;
+/**
+ * Canonicalize then check containment; throw {@link PathEscapeError} on escape.
+ *
+ * ⚠ Order matters and is the whole point: resolving *after* the check would let a
+ * symlink inside the workspace point anywhere (see docs/permissions.md). Returns the
+ * canonical path so callers use the resolved form from here on.
+ */
+export declare function assertContained(input: string, roots: string[], kind: 'read' | 'write'): string;
+/** Non-throwing form of {@link assertContained}. */
+export declare function containedOrNull(input: string, roots: string[]): string | null;
+/**
+ * Write via a sibling temp file plus `rename`, so a concurrent reader either sees
+ * the previous complete version or the new one — never a torn file. Several
+ * processes read `state.json` and `broker-result.json` without coordination.
+ */
+export declare function writeFileAtomic(target: string, data: string | Uint8Array): void;
+export declare function writeJsonAtomic(target: string, value: unknown): void;
+/** Returns null for a missing *or* unparsable file; a torn read is not fatal. */
+export declare function readJsonIfExists<T>(target: string): T | null;
+/** Appends one NDJSON line with a single `O_APPEND` write, which is atomic for small lines. */
+export declare function appendJsonLine(target: string, value: unknown): void;
+/** Current byte length, or 0 when the file does not exist yet. */
+export declare function fileSize(target: string): number;
+//# sourceMappingURL=paths.d.ts.map

package/dist/contract/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/contract/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;AAErD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,MAAsB,GAAG,qBAAqB,CAS1F;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjE;AAMD,4EAA4E;AAC5E,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,2FAA2F;AAC3F,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,YAAY,CAWhE;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAWjD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAanE;AAMD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAoBvE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CASvD;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM,CAEzD;AAED,sEAAsE;AACtE,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAQD;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAStC;AAED,qEAAqE;AACrE,wBAAgB,WAAW,IAAI,MAAM,CAQpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CASnE;AAMD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA0BlD;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,GAAG,OAAO,GACrB,MAAM,CAcR;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAM7E;AAMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAiB/E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEpE;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAM5D;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAQnE;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/contract/paths.js

@@ -0,0 +1,359 @@
+/**
+ * Project discovery, on-disk layout, and path containment. READ-ONLY after Stage 1.
+ *
+ * Layout — deliberately outside the repo so nothing has to be
+ * gitignored (see docs/operations.md):
+ *
+ * ```
+ * ~/.agy-worker/projects/<sha256(canonical_root)[:16]>/
+ *     project.json  index.db
+ *     jobs/<job-id>/{request,effective-config,state}.json
+ *                   events.ndjson stderr.log exit_code
+ *                   inbox.jsonl policy.json gate-log.jsonl
+ *                   agent-result.json broker-result.json verification.json
+ *                   verify.log verify.json
+ * ```
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync, writeSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, parse as parsePath, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PathEscapeError } from './errors.js';
+import { ENV } from './types.js';
+/**
+ * Resolve the project root.
+ *
+ * Precedence: `AGY_WORKER_PROJECT` (documented as an *override* in `docs/operations.md`) →
+ * nearest ancestor containing `.git` → the starting directory itself. The last
+ * branch ensures non-git directories are fully supported.
+ *
+ * The returned path is always canonical (symlinks resolved).
+ */
+export function resolveProjectRoot(startCwd = process.cwd()) {
+    const override = process.env[ENV.PROJECT_ROOT];
+    if (override && override.trim()) {
+        return { root: canonicalize(resolve(override.trim())), source: 'env' };
+    }
+    const start = canonicalize(resolve(startCwd));
+    const gitRoot = findGitRoot(start);
+    if (gitRoot)
+        return { root: gitRoot, source: 'git' };
+    return { root: start, source: 'cwd' };
+}
+/** Convenience wrapper when the caller does not care where the root came from. */
+export function projectRoot(startCwd) {
+    return resolveProjectRoot(startCwd).root;
+}
+/** Walks up looking for `.git` (a directory *or* a worktree/submodule file). */
+export function findGitRoot(startCanonical) {
+    let dir = startCanonical;
+    for (;;) {
+        if (existsSync(join(dir, '.git')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// State home and per-project directories
+// ─────────────────────────────────────────────────────────────────────────────
+/** `~/.agy-worker`, or `AGY_WORKER_HOME` when set (tests always set it). */
+export function stateHome() {
+    const override = process.env[ENV.STATE_HOME];
+    if (override && override.trim())
+        return resolve(override.trim());
+    return join(homedir(), '.agy-worker');
+}
+/** `sha256(canonical_root)` truncated to 16 hex chars — the per-project directory name. */
+export function projectKey(canonicalRoot) {
+    return createHash('sha256').update(canonicalRoot).digest('hex').slice(0, 16);
+}
+export function projectPaths(canonicalRoot) {
+    const key = projectKey(canonicalRoot);
+    const dir = join(stateHome(), 'projects', key);
+    return {
+        root: canonicalRoot,
+        key,
+        dir,
+        projectJson: join(dir, 'project.json'),
+        db: join(dir, 'index.db'),
+        jobsDir: join(dir, 'jobs'),
+    };
+}
+/** Chmod SQLite db and WAL/SHM files to 0o600. */
+export function chmodDbFiles(dbPath) {
+    for (const suffix of ['', '-wal', '-shm']) {
+        const p = `${dbPath}${suffix}`;
+        if (existsSync(p)) {
+            try {
+                chmodSync(p, 0o600);
+            }
+            catch {
+                // best-effort
+            }
+        }
+    }
+}
+/**
+ * Creates the project directory tree and writes `project.json` (the reverse
+ * lookup from hash back to path). Idempotent and safe to race.
+ */
+export function ensureProjectDirs(paths) {
+    mkdirSync(paths.jobsDir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(paths.dir, 0o700);
+        chmodSync(paths.jobsDir, 0o700);
+    }
+    catch {
+        // best-effort
+    }
+    if (!existsSync(paths.projectJson)) {
+        writeJsonAtomic(paths.projectJson, { root: paths.root, key: paths.key });
+    }
+    chmodDbFiles(paths.db);
+    return paths;
+}
+export function jobPaths(project, jobId) {
+    const dir = join(project.jobsDir, jobId);
+    return {
+        jobId,
+        dir,
+        request: join(dir, 'request.json'),
+        effectiveConfig: join(dir, 'effective-config.json'),
+        state: join(dir, 'state.json'),
+        events: join(dir, 'events.ndjson'),
+        stderr: join(dir, 'stderr.log'),
+        exitCode: join(dir, 'exit_code'),
+        inbox: join(dir, 'inbox.jsonl'),
+        policy: join(dir, 'policy.json'),
+        gateLog: join(dir, 'gate-log.jsonl'),
+        agentResult: join(dir, 'agent-result.json'),
+        brokerResult: join(dir, 'broker-result.json'),
+        verification: join(dir, 'verification.json'),
+        verifyLog: join(dir, 'verify.log'),
+        verifyJson: join(dir, 'verify.json'),
+    };
+}
+export function ensureJobDirs(paths) {
+    mkdirSync(paths.dir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(paths.dir, 0o700);
+    }
+    catch {
+        // best-effort
+    }
+    chmodDbFiles(join(paths.dir, '..', '..', 'index.db'));
+    return paths;
+}
+/** Sortable id: `<base36 ms>-<8 hex>`. Lexical order matches creation order. */
+export function newJobId(now = Date.now()) {
+    return `${now.toString(36)}-${randomUUID().replace(/-/g, '').slice(0, 8)}`;
+}
+/** Session ids are opaque; they never appear in a filesystem path. */
+export function newSessionId() {
+    return randomUUID();
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Package-relative resources
+// ─────────────────────────────────────────────────────────────────────────────
+const HERE = dirname(fileURLToPath(import.meta.url));
+/**
+ * The DDL text. Resolved next to this module (`dist/contract/schema.sql` after a
+ * build, `src/contract/schema.sql` under vitest), with the source tree as fallback.
+ */
+export function loadSchemaSql() {
+    const candidates = [
+        join(HERE, 'schema.sql'),
+        join(HERE, '..', '..', 'src', 'contract', 'schema.sql'),
+    ];
+    for (const c of candidates) {
+        if (existsSync(c))
+            return readFileSync(c, 'utf8');
+    }
+    throw new Error(`schema.sql not found; looked in: ${candidates.join(', ')}`);
+}
+/** Installed package root (the directory holding `package.json`). */
+export function packageRoot() {
+    let dir = HERE;
+    for (;;) {
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return HERE;
+        dir = parent;
+    }
+}
+/**
+ * Absolute path to one of the three entry points. The gate path is written into
+ * generated `hooks.json` files, so it must be stable and absolute.
+ *
+ * `ENV.GATE_BIN` overrides the `'gate'` case only — a test-only escape hatch
+ * (`ENV.GATE_BIN`'s own comment) so a test can point `agy_start` at a
+ * nonexistent gate binary and exercise its `existsSync` failure path without
+ * disturbing the real `dist/gate.js` every other test also depends on.
+ */
+export function binPath(which) {
+    if (which === 'gate') {
+        const override = process.env[ENV.GATE_BIN];
+        if (override && override.trim())
+            return override.trim();
+    }
+    const root = packageRoot();
+    const dist = join(root, 'dist', `${which}.js`);
+    if (existsSync(dist))
+        return dist;
+    return join(root, 'src', `${which}.ts`);
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Canonicalization and containment
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Absolute, `..`-free, symlink-resolved path.
+ *
+ * When the path does not exist yet (a file the job is about to write) the deepest
+ * existing ancestor is resolved and the remaining segments are appended. That is
+ * what makes containment checks meaningful for not-yet-created files: the
+ * *directory* they would land in is what actually decides the answer.
+ */
+export function canonicalize(input) {
+    const abs = isAbsolute(input) ? resolve(input) : resolve(process.cwd(), input);
+    try {
+        return realpathSync.native(abs);
+    }
+    catch {
+        // fall through to the partial-resolution path
+    }
+    const rootOf = parsePath(abs).root;
+    const tail = [];
+    let dir = abs;
+    for (;;) {
+        const parent = dirname(dir);
+        tail.unshift(dir.slice(parent === rootOf ? parent.length : parent.length + 1));
+        dir = parent;
+        if (dir === rootOf)
+            break;
+        try {
+            return join(realpathSync.native(dir), ...tail);
+        }
+        catch {
+            continue;
+        }
+    }
+    try {
+        return join(realpathSync.native(rootOf), ...tail);
+    }
+    catch {
+        return abs;
+    }
+}
+/** True when `candidate` is `root` itself or lives beneath it. Both must be canonical. */
+export function isWithin(candidate, root) {
+    if (candidate === root)
+        return true;
+    const rel = relative(root, candidate);
+    return rel !== '' && !rel.startsWith('..' + sep) && rel !== '..' && !isAbsolute(rel);
+}
+/** True when the path traverses a symlink anywhere below `root`. */
+export function traversesSymlink(input) {
+    const abs = isAbsolute(input) ? resolve(input) : resolve(process.cwd(), input);
+    return canonicalize(abs) !== abs;
+}
+/**
+ * Canonicalize then check containment; throw {@link PathEscapeError} on escape.
+ *
+ * ⚠ Order matters and is the whole point: resolving *after* the check would let a
+ * symlink inside the workspace point anywhere (see docs/permissions.md). Returns the
+ * canonical path so callers use the resolved form from here on.
+ */
+export function assertContained(input, roots, kind) {
+    const resolved = canonicalize(input);
+    const canonicalRoots = roots.map(canonicalize);
+    for (const root of canonicalRoots) {
+        if (isWithin(resolved, root))
+            return resolved;
+    }
+    const abs = isAbsolute(input) ? resolve(input) : resolve(process.cwd(), input);
+    throw new PathEscapeError({
+        input_path: input,
+        resolved_path: resolved,
+        kind,
+        roots: canonicalRoots,
+        via_symlink: resolved !== abs,
+    });
+}
+/** Non-throwing form of {@link assertContained}. */
+export function containedOrNull(input, roots) {
+    const resolved = canonicalize(input);
+    for (const root of roots) {
+        if (isWithin(resolved, canonicalize(root)))
+            return resolved;
+    }
+    return null;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Atomic file helpers
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Write via a sibling temp file plus `rename`, so a concurrent reader either sees
+ * the previous complete version or the new one — never a torn file. Several
+ * processes read `state.json` and `broker-result.json` without coordination.
+ */
+export function writeFileAtomic(target, data) {
+    mkdirSync(dirname(target), { recursive: true });
+    const tmp = `${target}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    const fd = openSync(tmp, 'wx', 0o600);
+    try {
+        if (typeof data === 'string')
+            writeSync(fd, data);
+        else
+            writeSync(fd, data);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch {
+        // best-effort
+    }
+    renameSync(tmp, target);
+}
+export function writeJsonAtomic(target, value) {
+    writeFileAtomic(target, JSON.stringify(value, null, 2) + '\n');
+}
+/** Returns null for a missing *or* unparsable file; a torn read is not fatal. */
+export function readJsonIfExists(target) {
+    try {
+        return JSON.parse(readFileSync(target, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Appends one NDJSON line with a single `O_APPEND` write, which is atomic for small lines. */
+export function appendJsonLine(target, value) {
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, JSON.stringify(value) + '\n', { flag: 'a', mode: 0o600 });
+    try {
+        chmodSync(target, 0o600);
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Current byte length, or 0 when the file does not exist yet. */
+export function fileSize(target) {
+    try {
+        return statSync(target).size;
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/contract/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/contract/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,IAAI,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAA;AAahC;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACpD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AACvC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,QAAiB;IAC3C,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,cAAsB;IAChD,IAAI,GAAG,GAAG,cAAc,CAAA;IACxB,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF,4EAA4E;AAC5E,MAAM,UAAU,SAAS;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAA;AACvC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC9E,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IAC9C,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,GAAG;QACH,GAAG;QACH,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QACtC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QACzB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;KAC3B,CAAA;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;QAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAmB;IACnD,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC3B,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtB,OAAO,KAAK,CAAA;AACd,CAAC;AA6BD,MAAM,UAAU,QAAQ,CAAC,OAAqB,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxC,OAAO;QACL,KAAK;QACL,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QAClC,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC;QACnD,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;QAC/B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAChC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;QACpC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC3C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QAC7C,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;QAClC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;KACrC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IACrD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/C,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AAC5E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,EAAE,CAAA;AACrB,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC;KACxD,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW;IACzB,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,KAAmC;IACzD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAA;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,KAAK,CAAC,CAAA;AACzC,CAAC;AAED,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IAClC,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,IAAI,GAAG,GAAG,GAAG,CAAA;IACb,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9E,GAAG,GAAG,MAAM,CAAA;QACZ,IAAI,GAAG,KAAK,MAAM;YAAE,MAAK;QACzB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,IAAY;IACtD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACtF,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9E,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,KAAe,EACf,IAAsB;IAEtB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC9C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAA;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9E,MAAM,IAAI,eAAe,CAAC;QACxB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,QAAQ;QACvB,IAAI;QACJ,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,QAAQ,KAAK,GAAG;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAe;IAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAyB;IACvE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAA;IACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,CAAC;QACH,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;;YAC5C,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxB,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAc;IAC5D,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAI,MAAc;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,KAAc;IAC3D,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC"}