humanish 0.15.0 → 0.15.1

package/dist/labs.js

@@ -1,7 +1,9 @@
-import { readdir, readFile, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 import { parse } from "yaml";
 import { parseLabConfig } from "./lab-config.js";
+import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareSelectedOutputDirectory, readContainedRegularFile } from "./selected-output-paths.js";
 export { LAB_CONFIG_SCHEMA } from "./lab-config.js";
 export const LAB_LIST_SCHEMA = "humanish.lab-list.v1";
 export const LAB_INSPECT_SCHEMA = "humanish.lab-inspect.v1";
@@ -13,68 +15,126 @@ const ignoredLabsDirs = [
 export async function resolveLabManifest(cwd, lab) {
     const resolvedCwd = path.resolve(cwd);
     const warnings = [];
-    const candidates = labLooksLikePath(lab)
-        ? [{ origin: "explicit", path: path.resolve(resolvedCwd, lab) }]
-        : [
-            { origin: "committed", path: path.join(resolvedCwd, committedLabsDir, `${lab}.yaml`) },
-            { origin: "committed", path: path.join(resolvedCwd, committedLabsDir, `${lab}.yml`) },
-            ...ignoredLabsDirs.flatMap((dir) => [
-                { origin: "ignored", path: path.join(resolvedCwd, dir, `${lab}.yaml`) },
-                { origin: "ignored", path: path.join(resolvedCwd, dir, `${lab}.yml`) }
-            ])
-        ];
+    const projectRoot = await bindProjectRoot(resolvedCwd);
+    if (!projectRoot) {
+        return invalidLab({ cwd: resolvedCwd, lab, warnings }, "Project root failed containment validation.");
+    }
+    if (labLooksLikePath(lab)) {
+        const requestedPath = path.resolve(resolvedCwd, lab);
+        const read = await readExplicitManifest(projectRoot, requestedPath);
+        if (read.status === "missing") {
+            return labNotFound(resolvedCwd, lab, warnings);
+        }
+        if (read.status === "unsafe") {
+            return invalidLab({ cwd: resolvedCwd, lab, warnings }, read.message);
+        }
+        return parseResolvedLab({
+            cwd: resolvedCwd,
+            lab,
+            origin: "explicit",
+            path: requestedPath,
+            warnings,
+            contents: read.contents
+        });
+    }
+    const candidates = [
+        { origin: "committed", relativePath: path.join(committedLabsDir, `${lab}.yaml`) },
+        { origin: "committed", relativePath: path.join(committedLabsDir, `${lab}.yml`) },
+        ...ignoredLabsDirs.flatMap((dir) => [
+            { origin: "ignored", relativePath: path.join(dir, `${lab}.yaml`) },
+            { origin: "ignored", relativePath: path.join(dir, `${lab}.yml`) }
+        ])
+    ];
     for (const candidate of candidates) {
-        if (!await fileExists(candidate.path)) {
+        const requestedPath = path.join(resolvedCwd, candidate.relativePath);
+        const read = await readManagedManifest(projectRoot, candidate.relativePath);
+        if (read.status === "missing") {
             continue;
         }
+        if (read.status === "unsafe") {
+            return invalidLab({ cwd: resolvedCwd, lab, warnings }, read.message);
+        }
         return parseResolvedLab({
             cwd: resolvedCwd,
             lab,
             origin: candidate.origin,
-            path: candidate.path,
-            warnings
+            path: requestedPath,
+            warnings,
+            contents: read.contents
         });
     }
-    return {
-        ok: false,
-        cwd: resolvedCwd,
-        lab,
-        error: {
-            code: "HUMANISH_LAB_NOT_FOUND",
-            message: `Lab not found: ${lab}. Look in humanish/labs/ or pass a .yaml path.`
-        },
-        warnings
-    };
+    return labNotFound(resolvedCwd, lab, warnings);
 }
 export async function listLabManifests(cwd) {
     const resolvedCwd = path.resolve(cwd);
     const warnings = [];
     const labs = new Map();
+    const projectRoot = await bindProjectRoot(resolvedCwd);
+    if (!projectRoot) {
+        return {
+            schema: LAB_LIST_SCHEMA,
+            ok: true,
+            cwd: resolvedCwd,
+            labs: [],
+            warnings: ["Project root failed containment validation; managed lab manifests were skipped."]
+        };
+    }
     const dirs = [
-        { origin: "committed", dir: path.join(resolvedCwd, committedLabsDir) },
-        ...ignoredLabsDirs.map((dir) => ({ origin: "ignored", dir: path.join(resolvedCwd, dir) }))
+        { origin: "committed", relativeDir: committedLabsDir },
+        ...ignoredLabsDirs.map((relativeDir) => ({ origin: "ignored", relativeDir }))
     ];
     for (const entry of dirs) {
-        const names = await safeReadDir(entry.dir);
+        const directory = await bindManagedDirectory(projectRoot, entry.relativeDir);
+        if (directory.status === "missing") {
+            continue;
+        }
+        if (directory.status === "unsafe") {
+            warnings.push(`${entry.relativeDir}: ${directory.message}`);
+            continue;
+        }
+        let names;
+        try {
+            names = await readdir(directory.binding.physicalPath);
+            await assertManagedDirectoryBinding(projectRoot, entry.relativeDir, directory.binding);
+        }
+        catch {
+            warnings.push(`${entry.relativeDir}: unsafe managed lab directory; skipped.`);
+            continue;
+        }
         for (const name of names.filter((value) => value.endsWith(".yaml") || value.endsWith(".yml"))) {
-            const candidatePath = path.join(entry.dir, name);
-            const parsed = await parseResolvedLab({
+            let relativePath;
+            try {
+                assertSafeOutputPathSegment(name, "Lab manifest name");
+                relativePath = path.join(entry.relativeDir, name);
+            }
+            catch {
+                warnings.push(`${entry.relativeDir}: unsafe lab manifest name; skipped.`);
+                continue;
+            }
+            const requestedPath = path.join(resolvedCwd, relativePath);
+            const read = await readManagedManifest(projectRoot, relativePath);
+            if (read.status !== "ok") {
+                warnings.push(`${relativeToCwd(resolvedCwd, requestedPath)}: ${read.status === "unsafe" ? read.message : "manifest changed while it was listed; skipped."}`);
+                continue;
+            }
+            const parsed = parseResolvedLab({
                 cwd: resolvedCwd,
                 lab: name.replace(/\.(?:ya?ml)$/i, ""),
                 origin: entry.origin,
-                path: candidatePath,
-                warnings: []
+                path: requestedPath,
+                warnings: [],
+                contents: read.contents
             });
             if (!parsed.ok) {
-                warnings.push(`${relativeToCwd(resolvedCwd, candidatePath)}: ${parsed.error.message}`);
+                warnings.push(`${relativeToCwd(resolvedCwd, requestedPath)}: ${parsed.error.message}`);
                 continue;
             }
-            const key = `${parsed.config.id}:${entry.origin}:${relativeToCwd(resolvedCwd, candidatePath)}`;
+            const key = `${parsed.config.id}:${entry.origin}:${relativeToCwd(resolvedCwd, requestedPath)}`;
             labs.set(key, {
                 id: parsed.config.id,
                 source: parsed.config.subject.source,
                 origin: entry.origin,
-                path: relativeToCwd(resolvedCwd, candidatePath),
+                path: relativeToCwd(resolvedCwd, requestedPath),
                 ...(parsed.config.title ? { title: parsed.config.title } : {})
             });
         }
@@ -110,10 +170,10 @@ export async function inspectLabManifest(cwd, lab) {
         warnings: resolved.warnings
     };
 }
-async function parseResolvedLab(args) {
+function parseResolvedLab(args) {
     let raw;
     try {
-        raw = parse(await readFile(args.path, "utf8"));
+        raw = parse(args.contents);
     }
     catch (error) {
         return invalidLab(args, error instanceof Error ? error.message : "Lab YAML could not be parsed.");
@@ -134,6 +194,153 @@ async function parseResolvedLab(args) {
         warnings
     };
 }
+async function bindProjectRoot(cwd) {
+    try {
+        const lexical = await lstat(cwd);
+        if (!lexical.isDirectory() && !lexical.isSymbolicLink()) {
+            return null;
+        }
+        return await prepareSelectedOutputDirectory(path.dirname(cwd), cwd);
+    }
+    catch {
+        return null;
+    }
+}
+async function readManagedManifest(projectRoot, relativePath) {
+    const inspected = await inspectManagedPath(projectRoot, relativePath, "file");
+    if (inspected.status !== "ok") {
+        return inspected;
+    }
+    const contents = await readContainedRegularFile(projectRoot, relativePath.replace(/\\/g, "/"));
+    if (!contents) {
+        return { status: "unsafe", message: "Managed lab manifest changed or failed containment validation." };
+    }
+    return { status: "ok", contents: contents.toString("utf8") };
+}
+async function readExplicitManifest(projectRoot, requestedPath) {
+    try {
+        await assertPreparedSelectedOutputDirectory(projectRoot);
+        try {
+            await lstat(requestedPath);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ENOENT") {
+                return { status: "missing" };
+            }
+            throw error;
+        }
+        const physicalPath = await realpath(requestedPath);
+        const before = await lstat(physicalPath, { bigint: true });
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n) {
+            return { status: "unsafe", message: "Explicit lab manifest must resolve to a single-link regular file." };
+        }
+        const handle = await open(physicalPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const opened = await handle.stat({ bigint: true });
+            if (!opened.isFile()
+                || opened.nlink !== 1n
+                || opened.dev !== before.dev
+                || opened.ino !== before.ino) {
+                return { status: "unsafe", message: "Explicit lab manifest changed before it could be read safely." };
+            }
+            const contents = await handle.readFile();
+            const [currentPhysicalPath, after] = await Promise.all([
+                realpath(requestedPath),
+                lstat(physicalPath, { bigint: true })
+            ]);
+            await assertPreparedSelectedOutputDirectory(projectRoot);
+            if (currentPhysicalPath !== physicalPath
+                || !after.isFile()
+                || after.isSymbolicLink()
+                || after.nlink !== 1n
+                || after.dev !== before.dev
+                || after.ino !== before.ino) {
+                return { status: "unsafe", message: "Explicit lab manifest changed while it was being read." };
+            }
+            return { status: "ok", contents: contents.toString("utf8") };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return { status: "unsafe", message: "Explicit lab manifest failed containment validation." };
+    }
+}
+async function bindManagedDirectory(projectRoot, relativePath) {
+    const inspected = await inspectManagedPath(projectRoot, relativePath, "directory");
+    if (inspected.status !== "ok") {
+        return inspected;
+    }
+    return {
+        status: "ok",
+        binding: {
+            birthtimeNs: inspected.birthtimeNs,
+            dev: inspected.dev,
+            ino: inspected.ino,
+            physicalPath: inspected.physicalPath
+        }
+    };
+}
+async function inspectManagedPath(projectRoot, relativePath, expectedKind) {
+    try {
+        await assertPreparedSelectedOutputDirectory(projectRoot);
+        const segments = relativePath.replace(/\\/g, "/").split("/");
+        let current = projectRoot.physicalPath;
+        for (const [index, segment] of segments.entries()) {
+            assertSafeOutputPathSegment(segment, "Managed lab path segment");
+            current = path.join(current, segment);
+            let stats;
+            try {
+                stats = await lstat(current, { bigint: true });
+            }
+            catch (error) {
+                if (isNodeError(error) && error.code === "ENOENT") {
+                    return { status: "missing" };
+                }
+                throw error;
+            }
+            const leaf = index === segments.length - 1;
+            if (stats.isSymbolicLink()) {
+                return { status: "unsafe", message: "Managed lab paths must not contain symbolic links." };
+            }
+            if (!leaf && !stats.isDirectory()) {
+                return { status: "unsafe", message: "Managed lab path parents must be directories." };
+            }
+            if (leaf && expectedKind === "directory" && !stats.isDirectory()) {
+                return { status: "unsafe", message: "Managed lab directory has an unsafe file type." };
+            }
+            if (leaf && expectedKind === "file" && (!stats.isFile() || stats.nlink !== 1n)) {
+                return { status: "unsafe", message: "Managed lab manifest must be a single-link regular file." };
+            }
+            if (leaf) {
+                await assertPreparedSelectedOutputDirectory(projectRoot);
+                return {
+                    status: "ok",
+                    birthtimeNs: stats.birthtimeNs,
+                    dev: stats.dev,
+                    ino: stats.ino,
+                    physicalPath: current
+                };
+            }
+        }
+    }
+    catch {
+        return { status: "unsafe", message: "Managed lab path failed containment validation." };
+    }
+    return { status: "missing" };
+}
+async function assertManagedDirectoryBinding(projectRoot, relativePath, binding) {
+    await assertPreparedSelectedOutputDirectory(projectRoot);
+    const current = await inspectManagedPath(projectRoot, relativePath, "directory");
+    if (current.status !== "ok"
+        || current.physicalPath !== binding.physicalPath
+        || current.birthtimeNs !== binding.birthtimeNs
+        || current.dev !== binding.dev
+        || current.ino !== binding.ino) {
+        throw new Error("Managed lab directory identity changed after it was bound.");
+    }
+}
 function invalidLab(args, message) {
     return {
         ok: false,
@@ -146,6 +353,18 @@ function invalidLab(args, message) {
         warnings: args.warnings
     };
 }
+function labNotFound(cwd, lab, warnings) {
+    return {
+        ok: false,
+        cwd,
+        lab,
+        error: {
+            code: "HUMANISH_LAB_NOT_FOUND",
+            message: `Lab not found: ${lab}. Look in humanish/labs/ or pass a .yaml path.`
+        },
+        warnings
+    };
+}
 function labLooksLikePath(lab) {
     return lab.endsWith(".yaml")
         || lab.endsWith(".yml")
@@ -153,24 +372,11 @@ function labLooksLikePath(lab) {
         || lab.includes("\\")
         || lab.startsWith(".");
 }
-async function fileExists(filePath) {
-    try {
-        return (await stat(filePath)).isFile();
-    }
-    catch {
-        return false;
-    }
-}
-async function safeReadDir(dir) {
-    try {
-        return await readdir(dir);
-    }
-    catch {
-        return [];
-    }
-}
 function relativeToCwd(cwd, filePath) {
     const relative = path.relative(cwd, filePath);
     return relative && !relative.startsWith("..") ? relative : filePath;
 }
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
 //# sourceMappingURL=labs.js.map

package/dist/labs.js.map

@@ -1 +1 @@
-{"version":3,"file":"labs.js","sourceRoot":"","sources":["../src/labs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAsD5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG;IACtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC;QACtC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC;YACE,EAAE,MAAM,EAAE,WAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE;YAC/F,EAAE,MAAM,EAAE,WAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE;YAC9F,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClC,EAAE,MAAM,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE;gBAChF,EAAE,MAAM,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE;aAChF,CAAC;SACH,CAAC;IAEN,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,WAAW;YAChB,GAAG;YACH,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,WAAW;QAChB,GAAG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,kBAAkB,GAAG,gDAAgD;SAC/E;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,IAAI,GAAG;QACX,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;QAC/E,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;KACpG,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,GAAG,EAAE,WAAW;gBAChB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/F,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxH,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAC/D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,GAAG;QACH,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAM/B;IACC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;QACxC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAInB,EAAE,OAAe;IAChB,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO;SACR;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;WACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;WACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;WACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;WAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,QAAgB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC"}
+{"version":3,"file":"labs.js","sourceRoot":"","sources":["../src/labs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,qCAAqC,EACrC,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EAEzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAuE5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG;IACtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,WAAW;YAChB,GAAG;YACH,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,aAAa;YACnB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,EAAE,MAAM,EAAE,WAAoB,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE;QAC1F,EAAE,MAAM,EAAE,WAAoB,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE;QACzF,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,EAAE,MAAM,EAAE,SAAkB,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE;YAC3E,EAAE,MAAM,EAAE,SAAkB,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE;SAC3E,CAAC;KACH,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,WAAW;YAChB,GAAG;YACH,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,aAAa;YACnB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,WAAW;YAChB,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,CAAC,iFAAiF,CAAC;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE,MAAM,EAAE,WAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE;QAC/D,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;KACvF,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QAED,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,MAAM,6BAA6B,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,0CAA0C,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9F,IAAI,YAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,2BAA2B,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBACvD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,sCAAsC,CAAC,CAAC;gBAC1E,SAAS;YACX,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gDAAgD,EAAE,CAAC,CAAC;gBAC7J,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,GAAG,EAAE,WAAW;gBAChB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/F,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxH,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAC/D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,EAAE,EAAE,KAAK;YACT,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,GAAG;QACH,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAOzB;IACC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;QACxC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAA4C,EAC5C,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAA4C,EAC5C,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC;QAC5G,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;mBACb,MAAM,CAAC,KAAK,KAAK,EAAE;mBACnB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;mBACzB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAC5B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;YACxG,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrD,QAAQ,CAAC,aAAa,CAAC;gBACvB,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,qCAAqC,CAAC,WAAW,CAAC,CAAC;YACzD,IACE,mBAAmB,KAAK,YAAY;mBACjC,CAAC,KAAK,CAAC,MAAM,EAAE;mBACf,KAAK,CAAC,cAAc,EAAE;mBACtB,KAAK,CAAC,KAAK,KAAK,EAAE;mBAClB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;mBACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAC3B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;YACjG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAA4C,EAC5C,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACnF,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAA4C,EAC5C,YAAoB,EACpB,YAAkC;IAMlC,IAAI,CAAC;QACH,MAAM,qCAAqC,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC;QACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,2BAA2B,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;YACjE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;YACxF,CAAC;YACD,IAAI,IAAI,IAAI,YAAY,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,IAAI,YAAY,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC/E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;YACnG,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,qCAAqC,CAAC,WAAW,CAAC,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,YAAY,EAAE,OAAO;iBACtB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,WAA4C,EAC5C,YAAoB,EACpB,OAAgC;IAEhC,MAAM,qCAAqC,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,IACE,OAAO,CAAC,MAAM,KAAK,IAAI;WACpB,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;WAC7C,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;WAC3C,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;WAC3B,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAInB,EAAE,OAAe;IAChB,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO;SACR;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW,EAAE,QAAkB;IAC/D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG;QACH,GAAG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,kBAAkB,GAAG,gDAAgD;SAC/E;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;WACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;WACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;WACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;WAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,QAAgB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/dist/observer-static.js

@@ -1,5 +1,6 @@
+import { constants as fsConstants } from "node:fs";
 import { createServer } from "node:http";
-import { readFile, stat } from "node:fs/promises";
+import { lstat, open, realpath } from "node:fs/promises";
 import path from "node:path";
 // Loopback-only host for the Observer static server. We never bind 0.0.0.0:
 // the Observer surfaces local run evidence and must stay reachable only from
@@ -38,9 +39,22 @@ export function observerStaticContentType(filePath) {
  * socket.
  */
 export async function respondToObserverStaticRequest(options, request, response) {
-    const root = path.resolve(options.root);
+    try {
+        const root = await pinStaticRoot(options.root);
+        await respondToPinnedObserverStaticRequest(root, options, request, response);
+    }
+    catch {
+        if (response.headersSent) {
+            response.end();
+            return;
+        }
+        writeText(response, 500, "Observer request failed");
+    }
+}
+async function respondToPinnedObserverStaticRequest(root, options, request, response) {
     const indexRelative = options.indexPath ?? "index.html";
     try {
+        await assertPinnedStaticRoot(root);
         const method = request.method ?? "GET";
         if (method !== "GET" && method !== "HEAD") {
             writeText(response, 405, "Method Not Allowed");
@@ -81,32 +95,33 @@ export async function respondToObserverStaticRequest(options, request, response)
         if (relative === "" || relative.endsWith("/")) {
             relative = `${relative}${indexRelative}`;
         }
-        const target = path.resolve(root, relative);
-        if (!isPathInside(root, target)) {
+        const target = path.resolve(root.physicalPath, relative);
+        if (!isPathInside(root.physicalPath, target)) {
             writeText(response, 403, "Forbidden");
             return;
         }
         let info;
         try {
-            info = await stat(target);
+            info = await lstat(target);
         }
         catch {
             writeText(response, 404, "Not Found");
             return;
         }
+        if (info.isSymbolicLink()) {
+            writeText(response, 403, "Forbidden");
+            return;
+        }
         let filePath = target;
         if (info.isDirectory()) {
             filePath = path.resolve(target, indexRelative);
-            if (!isPathInside(root, filePath)) {
+            if (!isPathInside(root.physicalPath, filePath)) {
                 writeText(response, 403, "Forbidden");
                 return;
             }
         }
-        let body;
-        try {
-            body = await readFile(filePath);
-        }
-        catch {
+        const body = await readContainedRegularFile(root, filePath);
+        if (!body) {
             writeText(response, 404, "Not Found");
             return;
         }
@@ -121,26 +136,78 @@ export async function respondToObserverStaticRequest(options, request, response)
         }
         response.end(body);
     }
-    catch (error) {
+    catch {
         if (response.headersSent) {
             response.end();
             return;
         }
-        writeText(response, 500, error instanceof Error ? error.message : String(error));
+        writeText(response, 500, "Observer request failed");
+    }
+}
+async function readContainedRegularFile(root, filePathInput) {
+    const filePath = path.resolve(filePathInput);
+    if (!isPathInside(root.physicalPath, filePath))
+        return null;
+    try {
+        await assertPinnedStaticRoot(root);
+        const expectedStats = await inspectContainedStaticFile(root, filePath);
+        if (!expectedStats) {
+            return null;
+        }
+        const handle = await open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        try {
+            const openedStats = await handle.stat({ bigint: true });
+            if (!openedStats.isFile()
+                || openedStats.nlink !== 1n
+                || openedStats.dev !== expectedStats.dev
+                || openedStats.ino !== expectedStats.ino) {
+                return null;
+            }
+            const recheckedStats = await inspectContainedStaticFile(root, filePath);
+            if (!recheckedStats
+                || recheckedStats.dev !== expectedStats.dev
+                || recheckedStats.ino !== expectedStats.ino) {
+                return null;
+            }
+            await assertPinnedStaticRoot(root);
+            const body = await handle.readFile();
+            await assertPinnedStaticRoot(root);
+            return body;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return null;
     }
 }
 export function createObserverStaticHandler(options) {
+    let rootPromise;
     return (request, response) => {
-        void respondToObserverStaticRequest(options, request, response);
+        rootPromise ??= pinStaticRoot(options.root);
+        void rootPromise
+            .then((root) => respondToPinnedObserverStaticRequest(root, options, request, response))
+            .catch(() => {
+            if (response.headersSent) {
+                response.end();
+                return;
+            }
+            writeText(response, 500, "Observer request failed");
+        });
     };
 }
 export async function serveObserverStatic(options) {
     const entryPath = options.entryPath?.replace(/^\/+/, "") ?? "";
-    const handler = createObserverStaticHandler({
+    const handlerOptions = {
         root: options.root,
         ...(options.indexPath === undefined ? {} : { indexPath: options.indexPath }),
         ...(entryPath ? { redirectRootTo: entryPath } : {})
-    });
+    };
+    const root = await pinStaticRoot(options.root);
+    const handler = (request, response) => {
+        void respondToPinnedObserverStaticRequest(root, handlerOptions, request, response);
+    };
     const server = createServer(handler);
     const port = await listen(server, options.port ?? 0);
     return {
@@ -161,7 +228,54 @@ function writeText(response, status, message) {
 }
 function isPathInside(root, candidate) {
     const relative = path.relative(root, candidate);
-    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+    return relative === ""
+        || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+async function inspectContainedStaticFile(root, filePath) {
+    const relative = path.relative(root.physicalPath, filePath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return null;
+    }
+    const segments = relative.split(path.sep).filter(Boolean);
+    let current = root.physicalPath;
+    let fileIdentity = null;
+    for (const [index, segment] of segments.entries()) {
+        current = path.join(current, segment);
+        const stats = await lstat(current, { bigint: true });
+        if (stats.isSymbolicLink())
+            return null;
+        if (index < segments.length - 1) {
+            if (!stats.isDirectory())
+                return null;
+        }
+        else {
+            if (!stats.isFile() || stats.nlink !== 1n)
+                return null;
+            fileIdentity = { dev: stats.dev, ino: stats.ino };
+        }
+    }
+    if (await realpath(filePath) !== filePath)
+        return null;
+    return fileIdentity;
+}
+async function pinStaticRoot(rootInput) {
+    const physicalPath = await realpath(path.resolve(rootInput));
+    const stats = await lstat(physicalPath, { bigint: true });
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new Error("Observer static roots must be physical directories.");
+    }
+    return Object.freeze({ birthtimeNs: stats.birthtimeNs, dev: stats.dev, ino: stats.ino, physicalPath });
+}
+async function assertPinnedStaticRoot(root) {
+    const stats = await lstat(root.physicalPath, { bigint: true });
+    if (stats.isSymbolicLink()
+        || !stats.isDirectory()
+        || stats.birthtimeNs !== root.birthtimeNs
+        || stats.dev !== root.dev
+        || stats.ino !== root.ino
+        || await realpath(root.physicalPath) !== root.physicalPath) {
+        throw new Error("Observer static root identity changed.");
+    }
 }
 function listen(server, port) {
     return new Promise((resolve, reject) => {