looply-cli 0.0.0-stage → 0.2.0

package/dist/tool-worker.js

@@ -0,0 +1,478 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handle = handle;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * THE ONLY THING THAT TOUCHES PROJECT FILES.
+ *
+ * Every read, search, edit and write the model asks for happens HERE, inside an
+ * AppContainer granted the worktree and nothing else. The bridge above is
+ * trusted code, but it deliberately performs no filesystem work of its own: if
+ * its path checking were wrong tomorrow, this process still could not reach
+ * `.git`, `.looply/state`, another project or the daemon's home, because it was
+ * never granted them.
+ *
+ * SELF-CONTAINED BY CONSTRUCTION. It imports node builtins and one TYPE, so the
+ * emitted file requires nothing from the package and can be copied somewhere
+ * the container reads. Project root on argv, request on stdin, answer on stdout.
+ *
+ * IT SPAWNS NOTHING, and that is not an aesthetic choice: an AppContainer
+ * cannot create the named pipes libuv uses for piped stdio, so a child spawned
+ * with pipes hangs for ever. Doing the work in-process is what makes this whole
+ * architecture possible.
+ */
+const LIMITS = {
+    readBytes: 256 * 1024,
+    readLines: 4000,
+    globPaths: 1000,
+    grepMatches: 200,
+    writeBytes: 1024 * 1024,
+    walkFiles: 20_000,
+};
+/**
+ * Separators from char codes. An escaped backslash in this repository has been
+ * collapsed by tooling several times, and a path check that silently stops
+ * matching is the worst thing here to get wrong.
+ */
+const BS = String.fromCharCode(92);
+const SL = String.fromCharCode(47);
+const NL = String.fromCharCode(10);
+const NUL = String.fromCharCode(0);
+function fail(tool, code, because) {
+    return { ok: false, tool, because, code };
+}
+/** Project-relative, in one spelling, so comparisons mean something. */
+function toPosix(p) {
+    return p.split(BS).join(SL);
+}
+function physical(p) {
+    try {
+        return node_fs_1.realpathSync.native(p);
+    }
+    catch {
+        return (0, node_path_1.resolve)(p);
+    }
+}
+/** The real path of `p`, or of the closest ancestor that exists. */
+function physicalNearest(p) {
+    let cur = (0, node_path_1.resolve)(p);
+    for (let i = 0; i < 64; i += 1) {
+        if ((0, node_fs_1.existsSync)(cur))
+            return physical(cur);
+        const up = (0, node_path_1.dirname)(cur);
+        if (up === cur)
+            return cur;
+        cur = up;
+    }
+    return cur;
+}
+function within(root, p) {
+    let a = root.toLowerCase();
+    while (a.endsWith(node_path_1.sep) || a.endsWith(SL))
+        a = a.slice(0, -1);
+    const b = p.toLowerCase();
+    return b === a || b.startsWith(a + node_path_1.sep.toLowerCase()) || b.startsWith(a + SL);
+}
+/**
+ * Names a model may not read, whatever else it may do in this project.
+ *
+ * 🔴 THE PROJECT GRANT WAS THE ONLY GATE, AND IT IS THE WRONG SHAPE. The
+ * container grants the worktree so the model can work on the code, and the walk
+ * skipped exactly three DIRECTORY names — `.git`, `.looply`, `node_modules`.
+ * Nothing else was excluded and nothing read `.gitignore`, so `.env` and every
+ * credential cache sitting under a project root were listable, greppable and
+ * readable by a model-requested tool call.
+ *
+ * ⚠️ NOT `.gitignore`. An ignore file says what version control should skip; it
+ * is not an authorization policy, it is absent from most trees that need this
+ * most, and — decisively — it is a file inside the worktree that the model may
+ * EDIT. A protection a worker can rewrite is not a protection. This list is
+ * compiled in, and there is no configuration that removes an entry from it.
+ *
+ * ⚠️ AND NOT `protectedPaths`. That list is enforced by the OS, by purging the
+ * container SID, which is stronger — but it is shared with the GATE domain, and
+ * a gate step running the project's own tests may legitimately need `.env`.
+ * Denying it there would break ordinary builds to close a model-facing hole.
+ * The domains differ, so the check lives on the model-facing side only.
+ *
+ * ⚠️ THIS IS NOT CONFINEMENT OF THE PROVIDER EXECUTABLE. It governs what the
+ * MODEL may ask Looply's tools to do. The provider process itself still runs
+ * with host-user authority and can read these files directly; that is a
+ * separate, unchanged trust statement.
+ *
+ * Matched on the BASENAME of every segment, so a directory of secrets is
+ * refused along with a file, and case-insensitively, because Windows would
+ * otherwise let `.ENV` through a list written in lower case.
+ */
+/*
+ * ⚠️ `.git` AND `.looply` ARE DELIBERATELY ABSENT. They are protected by the
+ * OS: `protectedPaths` purges the container SID from them, and two tests assert
+ * the refusal arrives as EPERM precisely because it came from Windows "rather
+ * than from any check of ours". Adding them here would short-circuit that with
+ * a lexical refusal and quietly retire the stronger proof. This list covers
+ * only what the container grant does NOT already deny.
+ */
+const SENSITIVE_BASENAMES = new Set([
+    '.npmrc',
+    '.netrc',
+    '_netrc',
+    '.pgpass',
+    '.htpasswd',
+    'id_rsa',
+    'id_ed25519',
+    'credentials',
+    'secrets.json',
+]);
+/** `.env`, `.env.local`, `.env.production` — the whole family, not one name. */
+function isSensitiveName(seg) {
+    const s = seg.toLowerCase();
+    if (SENSITIVE_BASENAMES.has(s))
+        return true;
+    if (s === '.env' || s.startsWith('.env.'))
+        return true;
+    // `.pem`/`.pfx`/`.p12` are key material whatever they are called.
+    if (s.endsWith('.pem') || s.endsWith('.pfx') || s.endsWith('.p12') || s.endsWith('.key')) {
+        return true;
+    }
+    return false;
+}
+function isSensitive(rel) {
+    return toPosix(rel)
+        .split(SL)
+        .some((seg) => seg.length > 0 && isSensitiveName(seg));
+}
+/**
+ * The path this request really names, or why it may not have one.
+ *
+ * TWO CHECKS, AND THE SECOND IS THE ONE THAT MATTERS. The lexical check catches
+ * `..`, drive letters and UNC. The PHYSICAL check resolves reparse points: a
+ * junction inside the worktree pointing at the daemon's home is an ordinary
+ * relative path lexically, and only following it shows where it lands. For a
+ * file that does not exist yet the nearest existing ancestor is resolved
+ * instead, because a write through a junctioned directory is the same escape.
+ */
+function insideProject(root, tool, rel) {
+    if (typeof rel !== 'string' || rel.length === 0) {
+        return fail(tool, 'bad_request', 'a path is required');
+    }
+    if (rel.indexOf(NUL) >= 0)
+        return fail(tool, 'path_not_allowed', 'null byte in path');
+    if (toPosix(rel).split(SL).some((s) => s === '..')) {
+        return fail(tool, 'path_not_allowed', 'a path may not leave the project');
+    }
+    if (/^[A-Za-z]:/.test(rel) || rel.startsWith(SL) || rel.startsWith(BS)) {
+        return fail(tool, 'path_not_allowed', 'paths are project-relative');
+    }
+    // An alternate data stream is a second file hiding behind an ordinary name,
+    // and `resolve` keeps it silently. Checked here as well as in the bridge,
+    // because this is the side that is actually inside the boundary.
+    if (toPosix(rel).split(SL).some((seg) => seg.includes(':'))) {
+        return fail(tool, 'path_not_allowed', 'a path may not name a stream');
+    }
+    const abs = (0, node_path_1.resolve)(root, rel);
+    if (!within((0, node_path_1.resolve)(root), abs)) {
+        return fail(tool, 'path_not_allowed', 'that path is outside the project');
+    }
+    if (!within(physical(root), physicalNearest(abs))) {
+        return fail(tool, 'path_not_allowed', 'that path resolves outside the project');
+    }
+    if (isSensitive(rel)) {
+        return fail(tool, 'path_not_allowed', 'that path is not readable by a model');
+    }
+    return { abs };
+}
+/** A glob, as a regular expression over project-relative POSIX paths. */
+function globToRe(pattern) {
+    let out = '^';
+    for (let i = 0; i < pattern.length; i += 1) {
+        const c = pattern[i];
+        if (c === '*' && pattern[i + 1] === '*') {
+            out += '.*';
+            i += 1;
+            if (pattern[i + 1] === SL)
+                i += 1;
+        }
+        else if (c === '*') {
+            out += '[^' + SL + ']*';
+        }
+        else if (c === '?') {
+            out += '[^' + SL + ']';
+        }
+        else if (/[a-zA-Z0-9_-]/.test(c)) {
+            out += c;
+        }
+        else {
+            out += BS + c;
+        }
+    }
+    return new RegExp(out + '$', 'i');
+}
+/** Everything under `root`, project-relative, bounded. */
+function walk(root, under) {
+    const files = [];
+    const stack = [(0, node_path_1.resolve)(root, under)];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = (0, node_fs_1.readdirSync)(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            const abs = (0, node_path_1.join)(dir, e.name);
+            if (e.isDirectory()) {
+                // Never walked, never listed. The container refuses `.git` and
+                // `.looply` anyway; skipping keeps ordinary results clean rather than
+                // half-denied, and `node_modules` is noise rather than secrets.
+                if (e.name === '.git' || e.name === '.looply' || e.name === 'node_modules')
+                    continue;
+                if (isSensitiveName(e.name))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            // 🔴 LISTING IS DISCLOSURE TOO. A refused read is worth little if `glob`
+            // still returns `.env.production` and `grep` still reports a line from
+            // it — the filename alone tells a model where to aim, and grep would
+            // hand over the contents outright.
+            if (isSensitiveName(e.name))
+                continue;
+            if (files.length >= LIMITS.walkFiles)
+                return { files, truncated: true };
+            files.push(toPosix((0, node_path_1.relative)(root, abs)));
+        }
+    }
+    return { files, truncated: false };
+}
+function isText(buf) {
+    const n = Math.min(buf.length, 8192);
+    for (let i = 0; i < n; i += 1)
+        if (buf[i] === 0)
+            return false;
+    return true;
+}
+function readTextAt(abs, tool, shown) {
+    let buf;
+    try {
+        buf = (0, node_fs_1.readFileSync)(abs);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ENOENT')
+            return fail(tool, 'not_found', 'no such file: ' + shown);
+        return fail(tool, 'denied', 'cannot read ' + shown + ' (' + (code ?? 'error') + ')');
+    }
+    if (!isText(buf))
+        return fail(tool, 'not_text', shown + ' is not a text file');
+    return { text: buf.toString('utf8') };
+}
+/** Temp then rename, so a reader never sees a half-written file. */
+function atomicWrite(abs, text) {
+    const tmp = abs + '.looply-tmp';
+    try {
+        (0, node_fs_1.writeFileSync)(tmp, text, 'utf8');
+        (0, node_fs_1.renameSync)(tmp, abs);
+        return null;
+    }
+    catch (e) {
+        // Leave nothing behind. A rename onto a protected path fails AFTER the temp
+        // file exists, and a refused write that litters the worktree is a refused
+        // write the next round has to explain.
+        try {
+            if ((0, node_fs_1.existsSync)(tmp))
+                (0, node_fs_1.unlinkSync)(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+        const code = e.code;
+        return 'cannot write (' + (code ?? e.message) + ')';
+    }
+}
+function handle(root, req) {
+    if (req === null || typeof req !== 'object') {
+        return fail('unknown', 'bad_request', 'a tool request is required');
+    }
+    if (req.tool === 'read') {
+        const p = insideProject(root, 'read', req.path);
+        if ('ok' in p)
+            return p;
+        const r = readTextAt(p.abs, 'read', req.path);
+        if ('ok' in r)
+            return r;
+        const all = r.text.split(NL);
+        const from = Math.max(1, req.fromLine ?? 1);
+        const to = Math.min(all.length, req.toLine ?? all.length);
+        let lines = all.slice(from - 1, to);
+        let truncated = false;
+        if (lines.length > LIMITS.readLines) {
+            lines = lines.slice(0, LIMITS.readLines);
+            truncated = true;
+        }
+        let text = lines.join(NL);
+        if (Buffer.byteLength(text, 'utf8') > LIMITS.readBytes) {
+            text = text.slice(0, LIMITS.readBytes);
+            truncated = true;
+        }
+        return { ok: true, tool: 'read', text, truncated, bytes: Buffer.byteLength(text, 'utf8') };
+    }
+    if (req.tool === 'glob') {
+        if (typeof req.pattern !== 'string' || req.pattern.length === 0) {
+            return fail('glob', 'bad_request', 'a pattern is required');
+        }
+        const under = req.under ?? '';
+        if (under !== '') {
+            const u = insideProject(root, 'glob', under);
+            if ('ok' in u)
+                return u;
+        }
+        const re = globToRe(toPosix(req.pattern));
+        const w = walk(root, under);
+        let hits = w.files.filter((f) => re.test(f));
+        let truncated = w.truncated;
+        if (hits.length > LIMITS.globPaths) {
+            hits = hits.slice(0, LIMITS.globPaths);
+            truncated = true;
+        }
+        return { ok: true, tool: 'glob', text: hits.join(NL), truncated };
+    }
+    if (req.tool === 'grep') {
+        let re;
+        try {
+            re = new RegExp(req.pattern, req.ignoreCase === true ? 'i' : '');
+        }
+        catch (e) {
+            return fail('grep', 'bad_request', 'that is not a valid pattern: ' + e.message);
+        }
+        const under = req.under ?? '';
+        if (under !== '') {
+            const u = insideProject(root, 'grep', under);
+            if ('ok' in u)
+                return u;
+        }
+        const inc = req.include === undefined ? null : globToRe(toPosix(req.include));
+        const w = walk(root, under);
+        const out = [];
+        for (const f of w.files) {
+            if (inc !== null && !inc.test(f))
+                continue;
+            let buf;
+            try {
+                buf = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(root, f));
+            }
+            catch {
+                continue;
+            }
+            if (!isText(buf))
+                continue;
+            const lines = buf.toString('utf8').split(NL);
+            for (let i = 0; i < lines.length; i += 1) {
+                const line = lines[i];
+                if (!re.test(line))
+                    continue;
+                out.push(f + ':' + String(i + 1) + ':' + line.slice(0, 400));
+                if (out.length >= LIMITS.grepMatches) {
+                    return { ok: true, tool: 'grep', text: out.join(NL), truncated: true };
+                }
+            }
+        }
+        return { ok: true, tool: 'grep', text: out.join(NL), truncated: w.truncated };
+    }
+    if (req.tool === 'edit') {
+        const p = insideProject(root, 'edit', req.path);
+        if ('ok' in p)
+            return p;
+        if (typeof req.oldText !== 'string' || req.oldText.length === 0) {
+            return fail('edit', 'bad_request', 'oldText is required');
+        }
+        if (typeof req.newText !== 'string')
+            return fail('edit', 'bad_request', 'newText is required');
+        const r = readTextAt(p.abs, 'edit', req.path);
+        if ('ok' in r)
+            return r;
+        // COUNTED, NOT FUZZY. An edit that states what it expects can be applied at
+        // most once: replaying it finds the text gone and fails, which is what makes
+        // a retried turn safe rather than quietly destructive.
+        const want = req.expected ?? 1;
+        let seen = 0;
+        let at = r.text.indexOf(req.oldText);
+        while (at >= 0) {
+            seen += 1;
+            at = r.text.indexOf(req.oldText, at + req.oldText.length);
+        }
+        if (seen !== want) {
+            return fail('edit', 'precondition_failed', 'expected ' + String(want) + ' occurrence(s) in ' + req.path + ', found ' + String(seen));
+        }
+        const next = r.text.split(req.oldText).join(req.newText);
+        if (Buffer.byteLength(next, 'utf8') > LIMITS.writeBytes) {
+            return fail('edit', 'too_large', 'the result would be too large');
+        }
+        const w = atomicWrite(p.abs, next);
+        if (w !== null)
+            return fail('edit', 'denied', w);
+        return {
+            ok: true,
+            tool: 'edit',
+            text: 'replaced ' + String(seen) + ' occurrence(s) in ' + req.path,
+            bytes: Buffer.byteLength(next, 'utf8'),
+        };
+    }
+    if (req.tool === 'write') {
+        const p = insideProject(root, 'write', req.path);
+        if ('ok' in p)
+            return p;
+        if (typeof req.contents !== 'string') {
+            return fail('write', 'bad_request', 'contents are required');
+        }
+        if (req.intent !== 'create' && req.intent !== 'overwrite') {
+            return fail('write', 'bad_request', 'intent must be create or overwrite');
+        }
+        if (Buffer.byteLength(req.contents, 'utf8') > LIMITS.writeBytes) {
+            return fail('write', 'too_large', 'that is too large to write');
+        }
+        const there = (0, node_fs_1.existsSync)(p.abs);
+        if (req.intent === 'create' && there) {
+            return fail('write', 'precondition_failed', req.path + ' already exists');
+        }
+        if (req.intent === 'overwrite' && !there) {
+            return fail('write', 'precondition_failed', req.path + ' does not exist');
+        }
+        try {
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(p.abs), { recursive: true });
+        }
+        catch {
+            /* the write below reports it */
+        }
+        const w = atomicWrite(p.abs, req.contents);
+        if (w !== null)
+            return fail('write', 'denied', w);
+        return {
+            ok: true,
+            tool: 'write',
+            text: 'wrote ' + req.path,
+            bytes: Buffer.byteLength(req.contents, 'utf8'),
+        };
+    }
+    return fail('unknown', 'bad_request', 'no such tool');
+}
+/* c8 ignore start -- the entry point, exercised through real contained runs. */
+if (require.main === module) {
+    const root = process.argv[2];
+    const chunks = [];
+    process.stdin.on('data', (d) => chunks.push(d));
+    process.stdin.on('end', () => {
+        let out;
+        try {
+            out = handle(root, JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        }
+        catch (e) {
+            out = fail('unknown', 'bad_request', 'unreadable request: ' + e.message);
+        }
+        process.stdout.write(JSON.stringify(out));
+    });
+}
+/* c8 ignore stop */
+//# sourceMappingURL=tool-worker.js.map

package/dist/tool-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-worker.js","sourceRoot":"","sources":["../src/tool-worker.ts"],"names":[],"mappings":";;AAwSA,wBA+JC;AAvcD,qCASiB;AACjB,yCAAkE;AAGlE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,GAAG;IACb,SAAS,EAAE,GAAG,GAAG,IAAI;IACrB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI;IACvB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAInC,SAAS,IAAI,CAAC,IAAU,EAAE,IAAY,EAAE,OAAe;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAkB,CAAC;AAC5D,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,sBAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,GAAG,GAAG,IAAA,mBAAO,EAAC,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;QACxB,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAC3B,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,CAAS;IACrC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,eAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,cAAc;CACf,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,IAAU,EAAE,GAAW;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;QACzB,CAAC;aAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,0DAA0D;AAC1D,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAA,mBAAO,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,+DAA+D;gBAC/D,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBACrF,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,mCAAmC;YACnC,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAA,oBAAQ,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAU,EAAE,KAAa;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,GAAG,KAAK,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,qBAAqB,CAAC,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC;IAChC,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4EAA4E;QAC5E,0EAA0E;QAC1E,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC;gBAAE,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO,gBAAgB,GAAG,CAAC,IAAI,IAAK,CAAW,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,MAAM,CAAC,IAAY,EAAE,GAAgB;IACnD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACpC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,+BAA+B,GAAI,CAAW,CAAC,OAAO,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC3C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;gBAChC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IAChF,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxB,4EAA4E;QAC5E,6EAA6E;QAC7E,uDAAuD;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC;YACV,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CACT,MAAM,EACN,qBAAqB,EACrB,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,GAAG,GAAG,CAAC,IAAI,GAAG,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,+BAA+B,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,GAAG,GAAG,CAAC,IAAI;YAClE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,oCAAoC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,oBAAU,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,QAAQ,GAAG,GAAG,CAAC,IAAI;YACzB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAW,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,IAAI,GAAiB,CAAC;QACtB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,sBAAsB,GAAI,CAAW,CAAC,OAAO,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AACD,oBAAoB"}

package/dist/toolchain-mirror.d.ts

@@ -0,0 +1,86 @@
+/**
+ * A COPY OF THE RUNTIME THAT UNTRUSTED CODE IS ALLOWED TO EXECUTE.
+ *
+ * A contained process can run an image the launcher resolved for it, but it
+ * cannot resolve or spawn anything itself outside what it was granted. So the
+ * gate could not run `node check.js`: inside the container, `node` is not
+ * findable. And the installed toolchain cannot simply be granted — on this
+ * machine `node.exe` carries no app-container ACE, and the directory it appears
+ * in is `C:\Program Files\nodejs`, which an ordinary user cannot re-permission.
+ *
+ * So Looply keeps its own copy somewhere the user owns, and grants the
+ * container read-and-execute on that.
+ *
+ * THE CONTENTS ARE POLICY, NOT CONVENIENCE. Every file mirrored is another
+ * thing project code may execute, so this copies the runtime and the package
+ * manager and stops. It deliberately does NOT mirror the directory it came
+ * from: on this machine that directory also holds `claude`, `eas` and `heroku`
+ * shims, and a gate that could run those would be a gate that could deploy.
+ *
+ * WHAT THIS IS NOT: protection from a compromised host toolchain. The daemon
+ * reads the machine's own Node installation and trusts it. Host integrity is
+ * somebody else's problem, and a later phase's.
+ */
+/** What the mirror was built from, and what it contains. */
+export interface ToolchainManifest {
+    id: string;
+    nodeVersion: string;
+    npmVersion: string | null;
+    source: string;
+    /** Size of the source runtime, part of the identity. */
+    sourceBytes: number;
+    files: readonly string[];
+    createdAt: string;
+}
+export interface ToolchainDeps {
+    /** Where mirrors live. Overridable so tests never touch the real one. */
+    home?: string;
+    /** The runtime to mirror. Defaults to the one running this process. */
+    nodeExe?: string;
+}
+/**
+ * An identity that changes when the toolchain does.
+ *
+ * Version plus the runtime's own size, not a timestamp: an upgrade must produce
+ * a different id so the old mirror is not used for ever, and a rebuild of the
+ * same toolchain must produce the same one so it is not copied twice.
+ *
+ * Not a content hash of a 71-megabyte binary — that is minutes of work for a
+ * distinction the version and size already make, and this is a cache key rather
+ * than a security boundary.
+ */
+export declare function toolchainId(deps?: ToolchainDeps): string;
+/**
+ * A digest of what is actually mirrored — CONTENTS, not metadata.
+ *
+ * Version and size were not enough. A rebuild at the same version, or a patched
+ * binary of the same length, or a change anywhere in the npm tree while
+ * `node.exe` stands still, all left the old identity in place and the old mirror
+ * in use. That is a cache serving yesterday's runtime to today's gate.
+ *
+ * Sorted `path\u0000size\u0000sha256` lines, hashed as one canonical list, so the
+ * digest depends on the set of files and every byte in them and on nothing
+ * else — not on walk order, not on timestamps.
+ *
+ * This is a CACHE KEY, not an authority: it decides whether the copy is current,
+ * never whether anything is allowed.
+ */
+export declare function sourceFingerprint(src: string): string;
+/** For tests that change a fixture and need the next answer computed afresh. */
+export declare function forgetFingerprints(): void;
+/** Where mirrors live: outside every repository, under the user's own home. */
+export declare function toolchainsRoot(deps?: ToolchainDeps): string;
+export interface ToolchainMirror {
+    ok: true;
+    path: string;
+    id: string;
+    manifest: ToolchainManifest;
+    /** True when this call built it rather than finding it. */
+    built: boolean;
+}
+export type ToolchainResult = ToolchainMirror | {
+    ok: false;
+    because: string;
+};
+export declare function ensureToolchainMirror(deps?: ToolchainDeps): ToolchainResult;
+//# sourceMappingURL=toolchain-mirror.d.ts.map

package/dist/toolchain-mirror.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain-mirror.d.ts","sourceRoot":"","sources":["../src/toolchain-mirror.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAI5D;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsBrD;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAUD,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,GAAE,aAAkB,GAAG,MAAM,CAE/D;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAsD/E,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,aAAkB,GAAG,eAAe,CAkH/E"}