craftar 0.9.0 → 0.11.0

package/dist/core/remote.js

@@ -0,0 +1,402 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { exists } from "./forge.js";
+import { hashNormalized } from "./text.js";
+/* ------------------------------------------------------------------ */
+/* What counts as a URL, and credentials (spec 13 §6.1, §4.3)          */
+/* ------------------------------------------------------------------ */
+const SCHEME_URL = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+/** The SCP-like form `<user>@<host>:<path>`; without a user, `host:path` stays a path (a drive letter looks the same). */
+const SCP_URL = /^[^\s/\\:@]+@[^\s/\\:]+:/;
+/** A `forge:` value is a git URL (a remote Forge) or a path resolved from the workspace root. */
+export function classifyForge(value) {
+    const v = value.trim();
+    return SCHEME_URL.test(v) || SCP_URL.test(v) ? "url" : "path";
+}
+/**
+ * True when a `forge:` value carries a credential: a user or password in an `http(s)` URL, a password
+ * in any other scheme, or a `<x>:<y>@` before the first `/` or `\` whatever the value reads as — so a
+ * password never reaches a message that prints the value (spec 13 §6.1, §14 item 11).
+ */
+export function credentialFault(raw) {
+    const value = raw.trim();
+    const head = value.split(/[/\\]/, 1)[0];
+    if (/^[^@]*:[^@]*@/.test(head) && !SCHEME_URL.test(value))
+        return true;
+    const scheme = SCHEME_URL.exec(value);
+    if (!scheme)
+        return false;
+    // Read the authority as written, never through a parser: a spelling WHATWG URL rejects
+    // (`host:badport`) must not slip through and be printed later. It runs to the first `/`, as git
+    // reads an ssh URL — a `?` or `#` in a password stays inside it. Fail closed.
+    const rest = value.slice(scheme[0].length);
+    const authority = rest.slice(0, rest.search(/\/|$/));
+    const at = authority.lastIndexOf("@");
+    if (at === -1)
+        return false;
+    const userinfo = authority.slice(0, at);
+    if (/^https?:\/\/$/i.test(scheme[0]))
+        return userinfo !== "";
+    return userinfo.includes(":");
+}
+/* ------------------------------------------------------------------ */
+/* The cache key (spec 13 §6.3)                                         */
+/* ------------------------------------------------------------------ */
+/** Scheme and host lowercased; a trailing `/`, then `.git`, dropped. */
+function normalizeUrl(url) {
+    let u = url.trim();
+    const scheme = SCHEME_URL.exec(u);
+    if (scheme) {
+        const rest = u.slice(scheme[0].length);
+        const slash = rest.indexOf("/");
+        const host = slash === -1 ? rest : rest.slice(0, slash);
+        u = scheme[0].toLowerCase() + host.toLowerCase() + (slash === -1 ? "" : rest.slice(slash));
+    }
+    else {
+        const at = u.indexOf("@");
+        const colon = u.indexOf(":", at);
+        if (at !== -1 && colon !== -1)
+            u = u.slice(0, at + 1) + u.slice(at + 1, colon).toLowerCase() + u.slice(colon);
+    }
+    u = u.replace(/\/+$/, "");
+    return u.replace(/\.git$/, "");
+}
+/** `<readable slug of host and path>-<first 12 hex of sha256(normalized url)>`. The URL holds no credentials (§4.3). */
+export function cacheKey(url) {
+    const normalized = normalizeUrl(url);
+    // The one hash helper (node-cli rule), though a URL has no line endings to normalize.
+    const hash = hashNormalized(normalized).slice("sha256:".length, "sha256:".length + 12);
+    const withoutScheme = normalized.replace(SCHEME_URL, "").replace(/^[^@/]*@/, "");
+    const slug = withoutScheme
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .toLowerCase()
+        .slice(0, 60)
+        .replace(/-+$/, "");
+    return `${slug}-${hash}`;
+}
+export function parseLsRemote(stdout) {
+    const out = { head: null, heads: new Map(), tags: new Map() };
+    for (const line of stdout.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        const symref = /^ref:\s+refs\/heads\/(\S+)\s+HEAD$/.exec(line);
+        if (symref) {
+            out.head = symref[1];
+            continue;
+        }
+        const [sha, name] = line.split("\t");
+        if (!sha || !name)
+            continue;
+        if (name.startsWith("refs/heads/"))
+            out.heads.set(name.slice("refs/heads/".length), sha);
+        else if (name.startsWith("refs/tags/")) {
+            const tag = name.slice("refs/tags/".length);
+            // An annotated tag's object comes first; its `^{}` line is the commit, which wins.
+            if (tag.endsWith("^{}"))
+                out.tags.set(tag.slice(0, -3), sha);
+            else if (!out.tags.has(tag))
+                out.tags.set(tag, sha);
+        }
+    }
+    return out;
+}
+const FULL_SHA = /^[0-9a-f]{40}$/;
+/**
+ * The commit a requested ref names, in the order of spec 13 §6.2. A full SHA is returned as is: the
+ * caller checks it exists once the fetch has run. Abbreviated SHAs are refused on purpose — their
+ * meaning changes as the repository grows.
+ */
+export function resolveRef(refs, ref, url) {
+    if (ref === null) {
+        const branch = refs.head;
+        const commit = branch === null ? undefined : refs.heads.get(branch);
+        if (branch === null || commit === undefined)
+            throw new Error(`${url} has no default branch to follow — set ref in craftar.yaml`);
+        return { commit, defaultBranch: branch };
+    }
+    if (FULL_SHA.test(ref))
+        return { commit: ref, defaultBranch: null };
+    const qualified = /^refs\/(heads|tags)\/(.+)$/.exec(ref);
+    if (qualified) {
+        const commit = (qualified[1] === "heads" ? refs.heads : refs.tags).get(qualified[2]);
+        if (commit === undefined)
+            throw new Error(`ref "${ref}" not found in ${url}`);
+        return { commit, defaultBranch: null };
+    }
+    const branch = refs.heads.get(ref);
+    const tag = refs.tags.get(ref);
+    if (branch !== undefined && tag !== undefined)
+        throw new Error(`ref "${ref}" is both a branch and a tag in ${url} — write refs/heads/${ref} or refs/tags/${ref}`);
+    const commit = branch ?? tag;
+    if (commit === undefined)
+        throw new Error(`ref "${ref}" not found in ${url}`);
+    return { commit, defaultBranch: null };
+}
+/** The remote could not be reached; `cached` says what the cache could still offer. */
+export class ForgeFetchError extends Error {
+    url;
+    gitMessage;
+    haveCopy;
+    cached;
+    constructor(url, gitMessage, 
+    /** A completed fetch left a copy, whether or not it can resolve the ref. */
+    haveCopy, cached) {
+        super(`cannot fetch the Forge ${url}: ${gitMessage}`);
+        this.url = url;
+        this.gitMessage = gitMessage;
+        this.haveCopy = haveCopy;
+        this.cached = cached;
+    }
+}
+/** Reading the cache only (`--offline`, `targets`) found no copy of this Forge. */
+export class NoCachedCopyError extends Error {
+    url;
+    constructor(url) {
+        super(`the Forge ${url} has no cached copy yet`);
+        this.url = url;
+    }
+}
+const execFileP = promisify(execFile);
+export const defaultGit = async (args, opts = {}) => {
+    const env = { ...process.env };
+    // CI fails fast instead of hanging on a credential prompt; a terminal may still prompt (spec 13 §14 item 4).
+    if (opts.remote && !process.stdin.isTTY)
+        env.GIT_TERMINAL_PROMPT = "0";
+    try {
+        const { stdout } = await execFileP("git", args, { env, maxBuffer: 64 * 1024 * 1024 });
+        return stdout;
+    }
+    catch (e) {
+        const err = e;
+        const line = (err.stderr ?? "").split(/\r?\n/).map((l) => l.trim()).find((l) => l) ?? err.message;
+        throw new Error(line.replace(/^fatal:\s*/, ""));
+    }
+};
+/** The tree for `ref` of the remote Forge at `url`, fetching first unless offline or the ref is a full SHA already cached. */
+export async function ensureTree(written, ref, opts) {
+    // As classifyForge reads it: git would choke on a stray leading space.
+    const url = written.trim();
+    const git = opts.git ?? defaultGit;
+    // Absolute once: `git -C repo.git worktree add <dir>` would read a relative dir from inside repo.git.
+    const home = path.resolve(opts.home);
+    const entry = path.join(home, "forges", cacheKey(url));
+    const repo = path.join(entry, "repo.git");
+    const stamp = path.join(entry, "fetched");
+    // A copy exists once a fetch completed: an init whose fetch then failed leaves no stamp.
+    const haveCopy = await exists(stamp);
+    const fetchedAt = async () => {
+        const text = (await exists(stamp)) ? (await fs.readFile(stamp, "utf8")).trim() : "";
+        return /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/.test(text) ? text : null;
+    };
+    const label = ref ?? "the default branch";
+    // A full SHA already in the cache names the same commit whatever the remote does: no fetch (§14 item 3).
+    const cachedSha = ref !== null && FULL_SHA.test(ref) && haveCopy && (await hasCommit(git, repo, ref));
+    let resolved;
+    let fetched = false;
+    if (opts.offline || cachedSha) {
+        if (!haveCopy)
+            throw new NoCachedCopyError(url);
+        resolved = cachedSha ? { commit: ref, defaultBranch: null } : resolveRef(await cachedRefs(git, repo), ref, url);
+        if (!(await hasCommit(git, repo, resolved.commit)))
+            throw new Error(`ref "${label}" not found in ${url}`);
+    }
+    else {
+        let refs;
+        try {
+            refs = parseLsRemote(await git(["ls-remote", "--symref", url], { remote: true }));
+        }
+        catch (e) {
+            throw new ForgeFetchError(url, e.message, haveCopy, await cachedFallback(git, repo, haveCopy, ref, url, await fetchedAt()));
+        }
+        resolved = resolveRef(refs, ref, url);
+        try {
+            await fs.mkdir(entry, { recursive: true });
+        }
+        catch (e) {
+            throw new Error(`cannot write the Forge cache in ${home}: ${e.code ?? e.message}`);
+        }
+        await withLock(entry, opts, async () => {
+            if (!(await exists(path.join(repo, "HEAD"))))
+                await git(["init", "--quiet", "--bare", repo]);
+            try {
+                await git(["-C", repo, "fetch", "--quiet", "--prune", url, "+refs/heads/*:refs/heads/*", "+refs/tags/*:refs/tags/*"], { remote: true });
+            }
+            catch (e) {
+                throw new ForgeFetchError(url, e.message, haveCopy, await cachedFallback(git, repo, haveCopy, ref, url, await fetchedAt()));
+            }
+            // A bare repository filled by fetch does not keep the remote's HEAD; --offline without a ref needs it.
+            if (refs.head)
+                await git(["-C", repo, "symbolic-ref", "HEAD", `refs/heads/${refs.head}`]);
+            await fs.writeFile(stamp, new Date().toISOString() + "\n");
+        });
+        fetched = true;
+        if (!(await hasCommit(git, repo, resolved.commit)))
+            throw new Error(`ref "${label}" not found in ${url}`);
+    }
+    const dir = await treeFor(git, entry, repo, resolved.commit, opts);
+    if (fetched)
+        await cleanup(git, entry, repo, resolved.commit, opts);
+    return { dir, commit: resolved.commit, defaultBranch: resolved.defaultBranch, fetched, fetchedAt: await fetchedAt() };
+}
+async function hasCommit(git, repo, sha) {
+    try {
+        await git(["-C", repo, "cat-file", "-e", `${sha}^{commit}`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The refs as the last fetch left them in the bare repository, in `ls-remote`'s shape. */
+async function cachedRefs(git, repo) {
+    const lines = [];
+    try {
+        lines.push(`ref: ${(await git(["-C", repo, "symbolic-ref", "HEAD"])).trim()}\tHEAD`);
+    }
+    catch {
+        // no recorded default branch
+    }
+    const listed = await git(["-C", repo, "for-each-ref", "--format=%(objectname)\t%(refname)\t%(*objectname)", "refs/heads", "refs/tags"]);
+    for (const line of listed.split(/\r?\n/)) {
+        const [sha, name, peeled] = line.split("\t");
+        if (!sha || !name)
+            continue;
+        lines.push(`${sha}\t${name}`);
+        if (peeled)
+            lines.push(`${peeled}\t${name}^{}`);
+    }
+    return parseLsRemote(lines.join("\n"));
+}
+async function cachedFallback(git, repo, haveRepo, ref, url, fetchedAt) {
+    if (!haveRepo)
+        return null;
+    try {
+        const { commit } = ref !== null && FULL_SHA.test(ref) ? { commit: ref } : resolveRef(await cachedRefs(git, repo), ref, url);
+        return (await hasCommit(git, repo, commit)) ? { commit, fetchedAt } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** One worktree per resolved commit; never written to after creation. A failure leaves no half-made tree. */
+async function treeFor(git, entry, repo, commit, opts) {
+    const dir = path.join(entry, "trees", commit);
+    // Complete once Craftar wrote `<commit>.ok` under the lock, after `worktree add` returned. Git's own
+    // `.git` file comes before the checkout, so a run cut short — or one still checking out in another
+    // process — leaves a tree without the marker: it is removed and made again, never loaded half.
+    const marker = `${dir}.ok`;
+    const complete = async () => (await exists(marker)) && (await exists(path.join(dir, ".git")));
+    if (!(await complete())) {
+        await withLock(entry, opts, async () => {
+            if (await complete())
+                return;
+            if (await exists(dir)) {
+                await git(["-C", repo, "worktree", "remove", "--force", dir]).catch(() => { });
+                await fs.rm(dir, { recursive: true, force: true });
+            }
+            await git(["-C", repo, "worktree", "prune"]).catch(() => { });
+            await fs.mkdir(path.dirname(dir), { recursive: true });
+            try {
+                // The commit's bytes, the same on every platform (spec 13 §8): no host setting rewrites the
+                // checkout — not core.autocrlf, not core.eol (native CRLF on Git for Windows, applied to a
+                // Forge's `text=auto`), not a global attributes file. A Forge's own `eol=` still applies: that
+                // is the Forge author's choice.
+                await git(["-c", "core.autocrlf=false", "-c", "core.eol=lf", "-c", "core.attributesFile=", "-C", repo, "worktree", "add", "--quiet", "--detach", dir, commit]);
+                await fs.writeFile(marker, `${new Date().toISOString()}\n`);
+            }
+            catch (e) {
+                await git(["-C", repo, "worktree", "remove", "--force", dir]).catch(() => { });
+                await fs.rm(dir, { recursive: true, force: true });
+                await git(["-C", repo, "worktree", "prune"]).catch(() => { });
+                throw new Error(`cannot create the Forge tree ${dir}: ${e.message}`);
+            }
+        });
+    }
+    const used = `${dir}.used`;
+    const now = new Date();
+    await fs.writeFile(used, "").catch(() => { });
+    await fs.utimes(used, now, now).catch(() => { });
+    return dir;
+}
+/** Trees unused for `cleanupMs` go, except the one in use; `repo.git` is left to git. */
+async function cleanup(git, entry, repo, inUse, opts) {
+    const trees = path.join(entry, "trees");
+    const limit = Date.now() - (opts.cleanupMs ?? 14 * 24 * 60 * 60 * 1000);
+    // When a tree was last used: its `.used` stamp, else its completion marker, else the directory — so a
+    // tree whose run died before stamping it still ages out.
+    const lastUse = async (commit) => {
+        for (const p of [`${commit}.used`, `${commit}.ok`, commit]) {
+            const st = await fs.stat(path.join(trees, p)).catch(() => null);
+            if (st)
+                return st.mtimeMs;
+        }
+        return null;
+    };
+    let removed = false;
+    for (const name of await fs.readdir(trees).catch(() => [])) {
+        if (name.includes(".") || name === inUse)
+            continue;
+        const used = await lastUse(name);
+        if (used === null || used >= limit)
+            continue;
+        await withLock(entry, opts, async () => {
+            // Again under the lock: a reader may have touched the stamp since (readers take no lock).
+            const again = await lastUse(name);
+            if (again === null || again >= limit)
+                return;
+            await git(["-C", repo, "worktree", "remove", "--force", path.join(trees, name)]).catch(() => { });
+            for (const p of [name, `${name}.used`, `${name}.ok`])
+                await fs.rm(path.join(trees, p), { recursive: true, force: true });
+            removed = true;
+        });
+    }
+    // A stamp or marker whose tree is gone (a reader stamped it as cleanup took the tree) goes too — under
+    // the lock, so it never races a rebuild between its `rm` of the tree and the `.ok` it then writes.
+    await withLock(entry, opts, async () => {
+        for (const name of await fs.readdir(trees).catch(() => [])) {
+            const m = /^(.+)\.(used|ok)$/.exec(name);
+            if (m && !(await exists(path.join(trees, m[1]))))
+                await fs.rm(path.join(trees, name), { force: true });
+        }
+    });
+    if (removed)
+        await git(["-C", repo, "worktree", "prune"]).catch(() => { });
+}
+/** The entry's lock: created exclusively, holding the PID and a timestamp; waited for, then refused; taken over when stale. */
+async function withLock(entry, opts, body) {
+    const file = path.join(entry, "lock");
+    const waitMs = opts.waitMs ?? 60_000;
+    const pollMs = opts.pollMs ?? 200;
+    const staleMs = opts.staleMs ?? 10 * 60 * 1000;
+    const start = Date.now();
+    for (;;) {
+        try {
+            await fs.writeFile(file, `${process.pid} ${new Date().toISOString()}\n`, { flag: "wx" });
+            break;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+            const stat = await fs.stat(file).catch(() => null);
+            if (stat && Date.now() - stat.mtimeMs > staleMs) {
+                await fs.rm(file, { force: true });
+                continue;
+            }
+            if (Date.now() - start >= waitMs) {
+                const held = (await fs.readFile(file, "utf8").catch(() => "")).split(/\s+/)[0] || "unknown";
+                throw new Error(`the Forge cache entry ${file} is busy (held by PID ${held})`);
+            }
+            await new Promise((r) => setTimeout(r, pollMs));
+        }
+    }
+    try {
+        return await body();
+    }
+    finally {
+        await fs.rm(file, { force: true });
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/core/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/core/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,UAAU,GAAG,+BAA+B,CAAC;AACnD,0HAA0H;AAC1H,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAE3C,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,uFAAuF;IACvF,gGAAgG;IAChG,8EAA8E;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;IAC7D,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE,wEAAwE;AACxE,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChH,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,sFAAsF;IACtF,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,aAAa;SACvB,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAaD,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;aACpF,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,mFAAmF;YACnF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,GAAkB,EAAE,GAAW;IACxE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4DAA4D,CAAC,CAAC;QACjI,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,kBAAkB,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;QAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,mCAAmC,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,EAAE,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAmCD,uFAAuF;AACvF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B;IACA;IAEA;IACA;IALX,YACW,GAAW,EACX,UAAkB;IAC3B,4EAA4E;IACnE,QAAiB,EACjB,MAA2D;QAEpE,KAAK,CAAC,0BAA0B,GAAG,KAAK,UAAU,EAAE,CAAC,CAAC;QAN7C,QAAG,GAAH,GAAG,CAAQ;QACX,eAAU,GAAV,UAAU,CAAQ;QAElB,aAAQ,GAAR,QAAQ,CAAS;QACjB,WAAM,GAAN,MAAM,CAAqD;IAGtE,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,GAAW;QAC9B,KAAK,CAAC,aAAa,GAAG,yBAAyB,CAAC,CAAC;QAD9B,QAAG,GAAH,GAAG,CAAQ;IAEhC,CAAC;CACF;AAED,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAc,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;IAC7D,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,6GAA6G;IAC7G,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,mBAAmB,GAAG,GAAG,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAyC,CAAC;QACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC;AAEF,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,GAAkB,EAAE,IAAkB;IACtF,uEAAuE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,yFAAyF;IACzF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,IAAI,oBAAoB,CAAC;IAE1C,yGAAyG;IACzG,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtG,IAAI,QAA0D,CAAC;IAC/D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChD,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjH,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;QACzI,CAAC;QACD,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,KAAM,CAA2B,CAAC,IAAI,IAAK,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,4BAA4B,EAAE,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1I,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;YACzI,CAAC;YACD,uGAAuG;YACvG,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;AACxH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,IAAY,EAAE,GAAW;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,UAAU,CAAC,GAAc,EAAE,IAAY;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,oDAAoD,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IACxI,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;YAAE,SAAS;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAc,EACd,IAAY,EACZ,QAAiB,EACjB,GAAkB,EAClB,GAAW,EACX,SAAwB;IAExB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5H,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,IAAkB;IACpG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,qGAAqG;IACrG,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YACrC,IAAI,MAAM,QAAQ,EAAE;gBAAE,OAAO;YAC7B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC9E,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,4FAA4F;gBAC5F,2FAA2F;gBAC3F,+FAA+F;gBAC/F,gCAAgC;gBAChC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC/J,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC9E,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,GAAG,OAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,IAAkB;IACnG,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,sGAAsG;IACtG,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACvC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE,GAAG,MAAM,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK;YAAE,SAAS;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK;YAAE,SAAS;QAC7C,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YACrC,0FAA0F;YAC1F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK;gBAAE,OAAO;YAC7C,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjG,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC;gBAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzH,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,uGAAuG;IACvG,mGAAmG;IACnG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACrC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,OAAO;QAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,+HAA+H;AAC/H,KAAK,UAAU,QAAQ,CAAI,KAAa,EAAE,IAAkB,EAAE,IAAsB;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,MAAM;QACR,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;gBAChD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,yBAAyB,IAAI,GAAG,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/core/sync.js

@@ -1,38 +1,121 @@
 import { promises as fs } from "node:fs";
+import os from "node:os";
 import path from "node:path";
-import YAML from "yaml";
+import { isDeepStrictEqual } from "node:util";
 import { loadForge, exists, listFiles, FORGE_MANIFEST } from "./forge.js";
 import { resolve, substitute, paramsFor, sectionKey, sectionsFor } from "./resolve.js";
 import { hashNormalized, stripBom, toLf } from "./text.js";
+import { parseWorkspaceYaml } from "./workspace-yaml.js";
+import { classifyForge, credentialFault, ensureTree, ForgeFetchError, NoCachedCopyError } from "./remote.js";
 import { deepMerge } from "./merge.js";
 import { canonicalValue, checkDeclaredOnce, expandSections, firstMarkerLine, markerLine, parseSections } from "./sections.js";
 import { placeholders, bodyFile, emittedFile } from "./extract.js";
-import { LockSchema, WorkspaceConfigSchema } from "../schema/index.js";
+import { LOCK_SCHEMAS, LockSchema, WorkspaceConfigSchema } from "../schema/index.js";
 import { claudeCode } from "../emitters/claude-code.js";
 import { kiro } from "../emitters/kiro.js";
 import { agentsMd } from "../emitters/agents-md.js";
+import { written } from "./capabilities.js";
 export const WORKSPACE_FILE = "craftar.yaml";
 export const LOCAL_FILE = "craftar.local.yaml";
 export const LOCK_FILE = "craftar.lock";
+// Mapped, not Record<Target, Emitter>: an emitter in another target's slot does not compile (spec 18 §3.3).
 const EMITTERS = { "claude-code": claudeCode, kiro, "agents-md": agentsMd };
-export async function loadWorkspace(root) {
+/**
+ * Runs one target's emitter on the walk of what the matrix says it writes. The walk warns about the
+ * rest, so an emitter that returns before finishing it would lose warnings: that fails the plan.
+ */
+export async function emitFor(t, emitter, base) {
+    const aimed = written(base.resolution, t, base.warn);
+    const files = await emitter.emit({ ...base, aimed });
+    if (!aimed.finished)
+        throw new Error(`internal: the ${t} emitter returned before walking every ingredient aimed at it`);
+    return files;
+}
+export async function loadWorkspace(root, opts = {}) {
     root = path.resolve(root);
     const file = path.join(root, WORKSPACE_FILE);
     if (!(await exists(file)))
         throw new Error(`${WORKSPACE_FILE} not found in ${root} — run \`craftar import --workspace "${root}" --from claude-code --forge <dir> --profile <name> --write-config\` to create it`);
-    const base = YAML.parse(await fs.readFile(file, "utf8")) ?? {};
+    const base = parseWorkspaceYaml(WORKSPACE_FILE, await fs.readFile(file, "utf8")) ?? {};
     const localFile = path.join(root, LOCAL_FILE);
     const hasLocal = await exists(localFile);
-    const local = hasLocal ? YAML.parse(await fs.readFile(localFile, "utf8")) ?? {} : {};
+    const local = hasLocal ? parseWorkspaceYaml(LOCAL_FILE, await fs.readFile(localFile, "utf8")) ?? {} : {};
+    // Before anything can print the value: a credential in either file is refused by file and field (spec 13 §4.3).
+    for (const [name, raw] of [[WORKSPACE_FILE, base], [LOCAL_FILE, local]]) {
+        const value = raw !== null && typeof raw === "object" ? raw.forge : undefined;
+        if (typeof value === "string" && credentialFault(value))
+            throw new Error(`${name} › forge holds credentials in the URL — remove them and let git authenticate (credential helper, SSH agent; see README › Remote Forge)`);
+    }
+    const fromLocalFile = local !== null && typeof local === "object" && Object.hasOwn(local, "forge");
     const parsed = WorkspaceConfigSchema.safeParse(deepMerge(base, local));
     // Named, as a Forge file is: a wrong-shape `overrides.sections` key fails here (spec 11 §5.2).
     if (!parsed.success)
         throw new Error(`invalid ${WORKSPACE_FILE}${hasLocal ? ` (merged with ${LOCAL_FILE})` : ""}: ${parsed.error.message}`);
     const config = parsed.data;
-    const forgeRoot = /^[a-z]+:\/\/|^git@/.test(config.forge) ? config.forge : path.resolve(root, config.forge);
+    const remote = classifyForge(config.forge) === "url";
+    const warnings = [];
+    if (fromLocalFile)
+        warnings.push(`Forge overridden by ${LOCAL_FILE} (${config.forge}) — do not commit ${LOCK_FILE} or the generated files`);
+    if (remote) {
+        if (opts.refuseRemote)
+            throw new Error(opts.refuseRemote(config.forge));
+        const { tree, origin, warning } = await remoteTree(config.forge, config.ref ?? null, opts, fromLocalFile);
+        if (warning)
+            warnings.push(warning);
+        return { root, config, forge: await loadForge(tree), origin, warnings };
+    }
+    const forgeRoot = path.resolve(root, config.forge);
     if (!(await exists(forgeRoot)))
-        throw new Error(`Forge not found at ${forgeRoot} (remote Forges are not supported yet — clone it and point \`forge:\` at the path)`);
-    return { root, config, forge: await loadForge(forgeRoot) };
+        throw new Error(`Forge not found at ${forgeRoot}`);
+    // A path means the working tree as it is; a ref beside it is ignored, said out loud (Ruling 9).
+    if (config.ref !== undefined)
+        warnings.unshift(`ref "${config.ref}" is ignored: the Forge is a path (${config.forge}), read as its working tree`);
+    const origin = { kind: "path", source: config.forge, ref: null, defaultBranch: null, fetched: false, fromLocalFile };
+    return { root, config, forge: await loadForge(forgeRoot), origin, warnings };
+}
+const short = (sha) => sha.slice(0, 8);
+/** Fetch (or not) by the rule of `opts.mode`, and say what was used (spec 13 §4.1, §4.8). */
+async function remoteTree(url, ref, opts, fromLocalFile) {
+    const home = opts.home ?? path.join(os.homedir(), ".craftar");
+    const mode = opts.mode ?? "read";
+    const offline = opts.offline || mode === "no-fetch";
+    const origin = (t) => ({
+        kind: "remote",
+        source: url,
+        ref,
+        defaultBranch: t.defaultBranch,
+        fetched: t.fetched,
+        ...(t.fetchedAt ? { fetchedAt: t.fetchedAt } : {}),
+        fromLocalFile,
+    });
+    const used = (t) => `the cached copy at ${short(t.commit)}, fetched ${t.fetchedAt ?? "never"}`;
+    if (offline) {
+        let t;
+        try {
+            t = await ensureTree(url, ref, { home, offline: true });
+        }
+        catch (e) {
+            if (!(e instanceof NoCachedCopyError))
+                throw e;
+            // `targets` (no-fetch) takes no --offline: point at a command that fetches.
+            throw new Error(`${e.message} — ${opts.offline ? "run without --offline once to fetch it" : "run craftar status once to fetch it"}`);
+        }
+        return { tree: t.dir, origin: origin(t), warning: opts.offline ? `Forge ${url} not fetched (--offline) — using ${used(t)}` : null };
+    }
+    try {
+        const t = await ensureTree(url, ref, { home });
+        return { tree: t.dir, origin: origin(t), warning: null };
+    }
+    catch (e) {
+        if (!(e instanceof ForgeFetchError))
+            throw e;
+        if (!e.cached)
+            throw new Error(`cannot fetch the Forge ${url}: ${e.gitMessage} — ${e.haveCopy ? `and the cached copy cannot resolve ${ref ?? "the default branch"}` : "and there is no cached copy to fall back on"}`);
+        if (mode === "sync")
+            throw new Error(`cannot fetch the Forge ${url}: ${e.gitMessage} — run with --offline to use the cached copy (${short(e.cached.commit)} fetched ${e.cached.fetchedAt ?? "never"})`);
+        const t = await ensureTree(url, ref, { home, offline: true });
+        return { tree: t.dir, origin: origin(t), warning: `Forge ${url} not fetched (${e.gitMessage}) — using ${used(t)}` };
+    }
 }
 /**
  * The Forge and (optionally) the workspace a command operates on.
@@ -43,13 +126,17 @@ export async function resolveForgeSource(opts) {
     if (opts.forge !== undefined && opts.workspace !== undefined) {
         throw new Error("pass either --forge or --workspace, not both — two sources for one Forge");
     }
-    if (opts.forge !== undefined)
+    if (opts.forge !== undefined) {
+        // A URL is not a directory to load: a remote Forge is read through a workspace that names it (spec 13 §4.4).
+        if (classifyForge(opts.forge) === "url")
+            throw new Error("--forge takes a directory; to read a remote Forge, run inside a workspace that names it");
         return { forge: await loadForge(path.resolve(opts.forge)) };
+    }
     const root = path.resolve(opts.workspace ?? ".");
     if (!(await exists(path.join(root, WORKSPACE_FILE)))) {
         throw new Error(`no ${WORKSPACE_FILE} in ${root} — run this inside a workspace, pass --workspace <dir>, or point at the Forge with --forge <dir>`);
     }
-    const workspace = await loadWorkspace(root);
+    const workspace = await loadWorkspace(root, opts);
     return { forge: workspace.forge, workspace };
 }
 /**
@@ -172,7 +259,7 @@ function guardOutput(ing, file, out, p, resolution, params) {
 }
 export async function plan(ws) {
     const resolution = resolve(ws.forge, ws.config);
-    const warnings = [...resolution.warnings];
+    const warnings = [...ws.warnings, ...resolution.warnings];
     if (resolution.targets.length === 0) {
         warnings.push("no targets resolved — nothing will be emitted and every file in craftar.lock becomes an orphan (an empty list in craftar.local.yaml replaces the workspace's)");
     }
@@ -225,7 +312,7 @@ export async function plan(ws) {
             warnings.push(`target "${t}" has no emitter yet`);
             continue;
         }
-        files.push(...(await em.emit(ctx)));
+        files.push(...(await emitFor(t, em, ctx)));
     }
     for (const [key, refs] of [...missingParams].sort(([a], [b]) => a.localeCompare(b))) {
         warnings.push(`param "${key}" has no value in any layer — left verbatim (${[...refs].sort().join(", ")})`);
@@ -253,7 +340,11 @@ export async function readLock(root) {
     const f = path.join(root, LOCK_FILE);
     if (!(await exists(f)))
         return null;
-    return LockSchema.parse(JSON.parse(await fs.readFile(f, "utf8")));
+    const raw = JSON.parse(await fs.readFile(f, "utf8"));
+    // A lock a later craftar wrote is refused by name, not with a zod dump (spec 13 §4.6).
+    if (raw !== null && typeof raw === "object" && Object.hasOwn(raw, "schema") && !LOCK_SCHEMAS.includes(raw.schema))
+        throw new Error(`${LOCK_FILE} declares schema ${JSON.stringify(raw.schema)}, which this craftar does not read — upgrade craftar`);
+    return LockSchema.parse(raw);
 }
 export async function writeLock(root, lock) {
     await fs.writeFile(path.join(root, LOCK_FILE), JSON.stringify(lock, null, 2) + "\n", "utf8");
@@ -353,14 +444,22 @@ export async function apply(ws, p, statuses, opts = {}) {
                 break;
         }
     }
-    const lock = {
-        schema: 1,
-        forge: { source: ws.config.forge, commit: ws.forge.commit },
+    // Schema 2, in this key order (spec 13 §5.2): what the sync used, not only what it wrote.
+    const built = {
+        schema: 2,
+        forge: { source: ws.config.forge, ref: ws.origin.ref, commit: ws.forge.commit },
         profile: ws.config.profile,
+        recipes: p.resolution.recipes,
+        targets: p.resolution.targets,
         generatedAt: new Date().toISOString(),
         files: entries.sort((a, b) => a.path.localeCompare(b.path)),
     };
-    if (!opts.dryRun)
+    // Rewritten only when its content changes: generatedAt is when it last did (Ruling 10). A schema 1
+    // lock always differs, so the first sync with this craftar upgrades it.
+    const onDisk = opts.dryRun ? null : await readLock(ws.root);
+    const unchanged = onDisk !== null && isDeepStrictEqual({ ...onDisk, generatedAt: null }, { ...built, generatedAt: null });
+    const lock = unchanged ? onDisk : built;
+    if (!opts.dryRun && !unchanged)
         await writeLock(ws.root, lock);
     return { written, removed, skipped, lock };
 }