open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/package-gallery.js

@@ -0,0 +1,392 @@
+import { existsSync, realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { validateExactNpmVersion, validateGitRef, } from "./package-procurement.js";
+const RESOURCE_ORDER = ["extension", "skill", "prompt", "theme"];
+const CAPABILITY_ORDER = [
+    "tools",
+    "commands",
+    "hooks",
+    "provider",
+    "ui",
+    "compaction",
+];
+const IMAGE_EXTENSIONS = [".png", ".jpg", ".jpeg", ".gif", ".webp"];
+const FACET_ALIASES = {
+    extension: "extension",
+    extensions: "extension",
+    skill: "skill",
+    skills: "skill",
+    prompt: "prompt",
+    prompts: "prompt",
+    theme: "theme",
+    themes: "theme",
+};
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .filter((item) => typeof item === "string")
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function toOptionalString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function readManifestRecord(pkgJson) {
+    if (!isRecord(pkgJson))
+        return null;
+    if (isRecord(pkgJson.omk))
+        return { key: "omk", manifest: pkgJson.omk };
+    if (isRecord(pkgJson.pi))
+        return { key: "pi", manifest: pkgJson.pi };
+    return null;
+}
+export function normalizeGalleryManifest(pkgJson) {
+    const source = readManifestRecord(pkgJson);
+    if (!source)
+        return null;
+    return {
+        manifestKey: source.key,
+        extensions: toStringArray(source.manifest.extensions),
+        skills: toStringArray(source.manifest.skills),
+        prompts: toStringArray(source.manifest.prompts),
+        themes: toStringArray(source.manifest.themes),
+        video: toOptionalString(source.manifest.video),
+        image: toOptionalString(source.manifest.image),
+        description: toOptionalString(source.manifest.description),
+    };
+}
+export function hasGalleryKeyword(pkgJson) {
+    if (!isRecord(pkgJson) || !Array.isArray(pkgJson.keywords))
+        return false;
+    return pkgJson.keywords.some((keyword) => keyword === "omk-package" || keyword === "pi-package");
+}
+function hasManifestResources(manifest, type) {
+    if (!manifest)
+        return false;
+    if (type === "extension")
+        return manifest.extensions.length > 0;
+    if (type === "skill")
+        return manifest.skills.length > 0;
+    if (type === "prompt")
+        return manifest.prompts.length > 0;
+    return manifest.themes.length > 0;
+}
+export function resolveGalleryTypeFacet(facet) {
+    if (!facet)
+        return undefined;
+    return FACET_ALIASES[facet.trim().toLowerCase()];
+}
+export function classifyGalleryResourceTypes(manifest, conventionDirs = []) {
+    const types = new Set();
+    for (const type of RESOURCE_ORDER) {
+        if (hasManifestResources(manifest, type))
+            types.add(type);
+    }
+    for (const dir of conventionDirs) {
+        const firstSegment = dir.trim().replace(/\\/g, "/").split("/").filter(Boolean)[0];
+        const type = resolveGalleryTypeFacet(firstSegment);
+        if (type)
+            types.add(type);
+    }
+    return RESOURCE_ORDER.filter((type) => types.has(type));
+}
+export function filterGalleryEntriesByType(entries, facet) {
+    if (facet === undefined)
+        return [...entries];
+    const type = resolveGalleryTypeFacet(facet);
+    if (!type)
+        return [];
+    return entries.filter((entry) => entry.resourceTypes.includes(type));
+}
+function parseAllowedGalleryUrl(url) {
+    if (!url)
+        return null;
+    if (/[\s\u0000-\u001f\u007f]/.test(url))
+        return null;
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:")
+            return null;
+        if (parsed.username || parsed.password)
+            return null;
+        if (parsed.port)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function isValidGalleryVideoUrl(url) {
+    const parsed = parseAllowedGalleryUrl(url);
+    return parsed ? parsed.pathname.toLowerCase().endsWith(".mp4") : false;
+}
+export function isValidGalleryImageUrl(url) {
+    const parsed = parseAllowedGalleryUrl(url);
+    return parsed ? IMAGE_EXTENSIONS.some((extension) => parsed.pathname.toLowerCase().endsWith(extension)) : false;
+}
+export function selectGalleryPreview(input) {
+    if (isValidGalleryVideoUrl(input.video))
+        return { kind: "video", url: input.video };
+    if (isValidGalleryImageUrl(input.image))
+        return { kind: "image", url: input.image };
+    if (input.resourceTypes.includes("theme")) {
+        const marker = input.themeName?.trim() || "theme";
+        return { kind: "generated-theme", marker };
+    }
+    return null;
+}
+function isPathInsideRoot(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+function realpathIfPossible(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+export function isPathInsideRootByRealpath(packageRoot, candidatePath) {
+    const root = resolve(packageRoot);
+    const candidate = resolve(candidatePath);
+    if (!isPathInsideRoot(root, candidate))
+        return false;
+    if (!existsSync(candidate))
+        return true;
+    return isPathInsideRoot(realpathIfPossible(root), realpathIfPossible(candidate));
+}
+export function resolveManifestEntryInsideRoot(packageRoot, entry, baseDir = packageRoot) {
+    const trimmed = entry.trim();
+    if (!trimmed || isAbsolute(trimmed))
+        return undefined;
+    const root = resolve(packageRoot);
+    const base = resolve(baseDir);
+    if (!isPathInsideRootByRealpath(root, base))
+        return undefined;
+    const candidate = resolve(base, trimmed);
+    if (!isPathInsideRootByRealpath(root, candidate))
+        return undefined;
+    return (relative(root, candidate) || ".").replace(/\\/g, "/");
+}
+export function filterManifestEntriesInsideRoot(packageRoot, entries) {
+    const safeEntries = [];
+    for (const entry of entries) {
+        const safeEntry = resolveManifestEntryInsideRoot(packageRoot, entry);
+        if (safeEntry && safeEntry !== ".") {
+            safeEntries.push(safeEntry);
+        }
+    }
+    return safeEntries;
+}
+function requireNonEmpty(value, label) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new Error(`${label} must not be empty`);
+    return trimmed;
+}
+function buildGallerySource(source) {
+    if (source.kind === "npm") {
+        const name = requireNonEmpty(source.name, "npm package name");
+        const versionVerdict = validateExactNpmVersion(source.version);
+        if (!versionVerdict.ok) {
+            throw new Error(`Gallery npm installs require an exact pinned version for ${name}. ${versionVerdict.message}.`);
+        }
+        return { kind: "npm", source: `npm:${name}@${versionVerdict.version}` };
+    }
+    if (source.kind === "git") {
+        const repo = requireNonEmpty(source.repo, "git repository").replace(/^git:/, "");
+        const refVerdict = validateGitRef(source.ref);
+        if (!refVerdict.ok) {
+            throw new Error(`Gallery git installs require a full commit SHA for ${repo}. ${refVerdict.message}.`);
+        }
+        return { kind: "git", source: `git:${repo}@${refVerdict.commit}` };
+    }
+    return { kind: "local", source: requireNonEmpty(source.path, "local path") };
+}
+export function buildGalleryInstallSpec(input, hasExtension, options = {}) {
+    const source = buildGallerySource(input);
+    const localFlag = options.local ? " -l" : "";
+    return {
+        kind: source.kind,
+        source: source.source,
+        installCommand: `omk install ${source.source}${localFlag}`,
+        tryEphemeralCommand: `omk -e ${source.source}`,
+        trust: hasExtension ? "code-execution" : "declarative",
+    };
+}
+function stripComments(sourceText, stripStrings) {
+    let output = "";
+    let index = 0;
+    while (index < sourceText.length) {
+        const current = sourceText[index];
+        const next = sourceText[index + 1];
+        if (current === "/" && next === "/") {
+            index += 2;
+            while (index < sourceText.length && sourceText[index] !== "\n")
+                index += 1;
+            output += "\n";
+            index += 1;
+            continue;
+        }
+        if (current === "/" && next === "*") {
+            index += 2;
+            while (index < sourceText.length && !(sourceText[index] === "*" && sourceText[index + 1] === "/"))
+                index += 1;
+            index += 2;
+            output += " ";
+            continue;
+        }
+        if (stripStrings && (current === '"' || current === "'" || current === "`")) {
+            const quote = current;
+            index += 1;
+            while (index < sourceText.length) {
+                if (sourceText[index] === "\\") {
+                    index += 2;
+                    continue;
+                }
+                if (sourceText[index] === quote) {
+                    index += 1;
+                    break;
+                }
+                index += 1;
+            }
+            output += " ";
+            continue;
+        }
+        output += current;
+        index += 1;
+    }
+    return output;
+}
+function capabilityOrder(badge) {
+    return CAPABILITY_ORDER.indexOf(badge);
+}
+export function inferExtensionCapabilityBadges(sourceText) {
+    const withoutComments = stripComments(sourceText, false);
+    const code = stripComments(sourceText, true);
+    const badges = new Set();
+    if (/\bomk\s*\.\s*registerTool\s*\(/.test(code))
+        badges.add("tools");
+    if (/\bomk\s*\.\s*registerCommand\s*\(/.test(code))
+        badges.add("commands");
+    if (/\bomk\s*\.\s*on\s*\(/.test(code) || /\bregisterHook\s*\(/.test(code))
+        badges.add("hooks");
+    if (/\bomk\s*\.\s*registerProvider\s*\(/.test(code))
+        badges.add("provider");
+    if (/\bomk\s*\.\s*(registerShortcut|registerFlag|registerMessageRenderer|registerComponent|setFooter)\s*\(/.test(code)) {
+        badges.add("ui");
+    }
+    if (/\bomk\s*\.\s*on\s*\(\s*(["'`])(?:session_before_compact|session_compact|context)\1/.test(withoutComments)) {
+        badges.add("hooks");
+        badges.add("compaction");
+    }
+    return [...badges].sort((left, right) => capabilityOrder(left) - capabilityOrder(right));
+}
+function identityKey(identity) {
+    if (identity.kind === "npm")
+        return `npm:${identity.name.trim().toLowerCase()}`;
+    if (identity.kind === "git") {
+        const repo = identity.repo
+            .trim()
+            .replace(/^git:/, "")
+            .replace(/\.git$/i, "")
+            .toLowerCase();
+        return `git:${repo}`;
+    }
+    return `local:${resolve(identity.path)}`;
+}
+export function dedupeGalleryEntries(entries) {
+    const seen = new Set();
+    const result = [];
+    for (const entry of entries) {
+        const key = identityKey(entry.identity);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(entry);
+    }
+    return result;
+}
+const TRIAL_HARD_BLOCK_CAPABILITIES = new Set(["credential-read", "host-socket"]);
+const CODE_EXECUTION_RESOURCES = new Set(["extension", "tool"]);
+const CODE_EXECUTION_CAPABILITIES = new Set([
+    "browser-control",
+    "child-process",
+    "credential-read",
+    "filesystem-write",
+    "host-socket",
+    "network",
+]);
+function pushUniqueReason(reasons, reason) {
+    if (!reasons.includes(reason))
+        reasons.push(reason);
+}
+/**
+ * Classify whether a candidate package may be safely admitted to an unpromoted (ephemeral,
+ * sandboxed, `--ignore-scripts`) trial. Pure and deterministic: identical inputs always
+ * produce identical output, and no I/O is performed.
+ */
+export function assessGalleryTrialGate(identity, review) {
+    const hardBlocks = review.capabilities.filter((capability) => TRIAL_HARD_BLOCK_CAPABILITIES.has(capability));
+    const reasons = [];
+    if (!review.pinned)
+        pushUniqueReason(reasons, "exact-pin-required");
+    if (hardBlocks.length > 0)
+        pushUniqueReason(reasons, `capability-hard-block: ${hardBlocks.join(",")}`);
+    if (review.licenseVerdict === "reject")
+        pushUniqueReason(reasons, "license-blocked");
+    if (review.lifecycleVerdict === "reject")
+        pushUniqueReason(reasons, "lifecycle-scripts-blocked");
+    if (review.pathCompatibility === "pi-hardcoded")
+        pushUniqueReason(reasons, "pi-hardcoded-paths");
+    if (review.adoption === "reject") {
+        for (const reason of review.rejectedReasons)
+            pushUniqueReason(reasons, reason);
+    }
+    const blocked = !review.pinned ||
+        hardBlocks.length > 0 ||
+        review.licenseVerdict === "reject" ||
+        review.lifecycleVerdict === "reject" ||
+        review.pathCompatibility === "pi-hardcoded" ||
+        review.adoption === "reject";
+    return {
+        outcome: blocked ? "blocked" : "admitted",
+        identity: identityKey(identity),
+        adoption: review.adoption,
+        pinned: review.pinned,
+        reasons,
+    };
+}
+export function deriveGalleryInstallTrustFromReview(review) {
+    const expectedResources = review.candidate?.expectedResources ?? [];
+    if (expectedResources.some((resource) => CODE_EXECUTION_RESOURCES.has(resource)))
+        return "code-execution";
+    if (review.capabilities.some((capability) => CODE_EXECUTION_CAPABILITIES.has(capability)))
+        return "code-execution";
+    return "declarative";
+}
+export function buildGalleryInstallSpecFromReview(input, review, options = {}) {
+    const spec = buildGalleryInstallSpec(input, false, options);
+    const gate = assessGalleryTrialGate(galleryIdentityFromInstallSource(input), review);
+    if (gate.outcome === "blocked") {
+        throw new Error(`Gallery trial blocked for ${gate.identity}: ${gate.reasons.join(", ")}`);
+    }
+    return { ...spec, trust: deriveGalleryInstallTrustFromReview(review) };
+}
+function galleryIdentityFromInstallSource(input) {
+    if (input.kind === "npm")
+        return { kind: "npm", name: input.name };
+    if (input.kind === "git")
+        return { kind: "git", repo: input.repo, ref: input.ref };
+    return { kind: "local", path: input.path };
+}
+//# sourceMappingURL=package-gallery.js.map

package/dist/core/package-gallery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-gallery.js","sourceRoot":"","sources":["../../src/core/package-gallery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAIN,uBAAuB,EACvB,cAAc,GACd,MAAM,0BAA0B,CAAC;AA+DlC,MAAM,cAAc,GAAmC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjG,MAAM,gBAAgB,GAAwC;IAC7D,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,IAAI;IACJ,YAAY;CACZ,CAAC;AACF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE7E,MAAM,aAAa,GAAkD;IACpE,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,WAAW;IACvB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;CACf,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,aAAa,CAAC,KAAc,EAAY;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AAAA,CAClB;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAsB;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAChD;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAyE;IACpH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACxE,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACrE,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB,EAAoC;IAC5F,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrD,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7C,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC1D,CAAC;AAAA,CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAW;IAC5D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC;AAAA,CACjG;AAED,SAAS,oBAAoB,CAAC,QAA0C,EAAE,IAAyB,EAAW;IAC7G,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAAA,CAClC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAyB,EAAmC;IACnG,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAAA,CACjD;AAED,MAAM,UAAU,4BAA4B,CAC3C,QAA0C,EAC1C,cAAc,GAAsB,EAAE,EACd;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,0BAA0B,CACzC,OAAqB,EACrB,KAAyB,EACnB;IACN,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACrE;AAED,SAAS,sBAAsB,CAAC,GAAuB,EAAc;IACpE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB,EAAW;IACxE,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAAA,CACvE;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB,EAAW;IACxE,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAAA,CAChH;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA0B,EAAkC;IAChG,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACpF,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACpF,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,SAAiB,EAAW;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CACvF;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAU;IACjD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,aAAqB,EAAW;IAC/F,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,8BAA8B,CAC7C,WAAmB,EACnB,KAAa,EACb,OAAO,GAAG,WAAW,EACA;IACrB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAAA,CAC9D;AAED,MAAM,UAAU,+BAA+B,CAAC,WAAmB,EAAE,OAA0B,EAAY;IAC1G,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,8BAA8B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,SAAS,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AAAA,CACnB;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa,EAAU;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,kBAAkB,CAAC,MAA4B,EAAsD;IAC7G,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,4DAA4D,IAAI,KAAK,cAAc,CAAC,OAAO,GAAG,CAC9F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,KAAK,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;AAAA,CAC7E;AAED,MAAM,UAAU,uBAAuB,CACtC,KAA2B,EAC3B,YAAqB,EACrB,OAAO,GAA0B,EAAE,EACd;IACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,eAAe,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE;QAC1D,mBAAmB,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;QAC9C,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;KACtD,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,YAAqB,EAAU;IACzE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,KAAK,IAAI,CAAC,CAAC;YAC3E,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,OAAO,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YAC9G,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,OAAO,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChC,KAAK,IAAI,CAAC,CAAC;oBACX,SAAS;gBACV,CAAC;gBACD,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;oBACjC,KAAK,IAAI,CAAC,CAAC;oBACX,MAAM;gBACP,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC;YACd,SAAS;QACV,CAAC;QACD,MAAM,IAAI,OAAO,CAAC;QAClB,KAAK,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,eAAe,CAAC,KAA+B,EAAU;IACjE,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CACvC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB,EAA8B;IAC9F,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/F,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5E,IACC,uGAAuG,CAAC,IAAI,CAAC,IAAI,CAAC,EACjH,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,oFAAoF,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACzF;AAED,SAAS,WAAW,CAAC,QAA8B,EAAU;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI;aACxB,IAAI,EAAE;aACN,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;aACpB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,WAAW,EAAE,CAAC;QAChB,OAAO,OAAO,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,oBAAoB,CAAqC,OAAqB,EAAO;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAqCD,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AACvG,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AACrF,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAChE,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;IACb,SAAS;CACT,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAiB,EAAE,MAAc,EAAQ;IAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAAA,CACpD;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAA8B,EAC9B,MAA8B,EACL;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,gBAAgB,CAAC,OAAO,EAAE,0BAA0B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ;QAAE,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QAAE,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,iBAAiB,KAAK,cAAc;QAAE,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,eAAe;YAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GACZ,CAAC,MAAM,CAAC,MAAM;QACd,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,MAAM,CAAC,cAAc,KAAK,QAAQ;QAClC,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QACpC,MAAM,CAAC,iBAAiB,KAAK,cAAc;QAC3C,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAE9B,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACzC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;KACP,CAAC;AAAA,CACF;AAED,MAAM,UAAU,mCAAmC,CAAC,MAA8B,EAAuB;IACxG,MAAM,iBAAiB,GAAG,MAAM,CAAC,SAAS,EAAE,iBAAiB,IAAI,EAAE,CAAC;IACpE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC1G,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnH,OAAO,aAAa,CAAC;AAAA,CACrB;AAED,MAAM,UAAU,iCAAiC,CAChD,KAA2B,EAC3B,MAA8B,EAC9B,OAAO,GAA0B,EAAE,EACd;IACrB,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,sBAAsB,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,mCAAmC,CAAC,MAAM,CAAC,EAAE,CAAC;AAAA,CACvE;AAED,SAAS,gCAAgC,CAAC,KAA2B,EAAwB;IAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAAA,CAC3C","sourcesContent":["import { existsSync, realpathSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve, sep } from \"node:path\";\nimport {\n\ttype Adoption,\n\ttype GateVerdict,\n\ttype PathCompatibility,\n\tvalidateExactNpmVersion,\n\tvalidateGitRef,\n} from \"./package-procurement.ts\";\n\nexport type GalleryResourceType = \"extension\" | \"skill\" | \"prompt\" | \"theme\";\nexport type GalleryManifestKey = \"omk\" | \"pi\";\nexport type GalleryInstallSourceKind = \"npm\" | \"git\" | \"local\";\nexport type GalleryInstallTrust = \"code-execution\" | \"declarative\";\nexport type GalleryPreviewKind = \"video\" | \"image\" | \"generated-theme\";\nexport type ExtensionCapabilityBadge = \"tools\" | \"commands\" | \"hooks\" | \"provider\" | \"ui\" | \"compaction\";\n\nexport interface NormalizedGalleryManifest {\n\tmanifestKey: GalleryManifestKey;\n\textensions: string[];\n\tskills: string[];\n\tprompts: string[];\n\tthemes: string[];\n\tvideo: string | undefined;\n\timage: string | undefined;\n\tdescription: string | undefined;\n}\n\nexport interface GalleryTypedEntry {\n\tresourceTypes: readonly GalleryResourceType[];\n}\n\nexport interface GalleryPreviewInput {\n\tvideo?: string;\n\timage?: string;\n\tresourceTypes: readonly GalleryResourceType[];\n\tthemeName?: string;\n}\n\nexport interface GalleryPreviewSelection {\n\tkind: GalleryPreviewKind;\n\turl?: string;\n\tmarker?: string;\n}\n\nexport type GalleryInstallSource =\n\t| { kind: \"npm\"; name: string; version?: string }\n\t| { kind: \"git\"; repo: string; ref?: string }\n\t| { kind: \"local\"; path: string };\n\nexport interface GalleryInstallOptions {\n\tlocal?: boolean;\n}\n\nexport interface GalleryInstallSpec {\n\tkind: GalleryInstallSourceKind;\n\tsource: string;\n\tinstallCommand: string;\n\ttryEphemeralCommand: string;\n\ttrust: GalleryInstallTrust;\n}\n\nexport type GalleryEntryIdentity =\n\t| { kind: \"npm\"; name: string }\n\t| { kind: \"git\"; repo: string; ref?: string }\n\t| { kind: \"local\"; path: string };\n\nexport interface GalleryEntryWithIdentity {\n\tidentity: GalleryEntryIdentity;\n}\n\nconst RESOURCE_ORDER: readonly GalleryResourceType[] = [\"extension\", \"skill\", \"prompt\", \"theme\"];\nconst CAPABILITY_ORDER: readonly ExtensionCapabilityBadge[] = [\n\t\"tools\",\n\t\"commands\",\n\t\"hooks\",\n\t\"provider\",\n\t\"ui\",\n\t\"compaction\",\n];\nconst IMAGE_EXTENSIONS = [\".png\", \".jpg\", \".jpeg\", \".gif\", \".webp\"] as const;\n\nconst FACET_ALIASES: Readonly<Record<string, GalleryResourceType>> = {\n\textension: \"extension\",\n\textensions: \"extension\",\n\tskill: \"skill\",\n\tskills: \"skill\",\n\tprompt: \"prompt\",\n\tprompts: \"prompt\",\n\ttheme: \"theme\",\n\tthemes: \"theme\",\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction toStringArray(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\treturn value\n\t\t.filter((item): item is string => typeof item === \"string\")\n\t\t.map((item) => item.trim())\n\t\t.filter(Boolean);\n}\n\nfunction toOptionalString(value: unknown): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst trimmed = value.trim();\n\treturn trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction readManifestRecord(pkgJson: unknown): { key: GalleryManifestKey; manifest: Record<string, unknown> } | null {\n\tif (!isRecord(pkgJson)) return null;\n\tif (isRecord(pkgJson.omk)) return { key: \"omk\", manifest: pkgJson.omk };\n\tif (isRecord(pkgJson.pi)) return { key: \"pi\", manifest: pkgJson.pi };\n\treturn null;\n}\n\nexport function normalizeGalleryManifest(pkgJson: unknown): NormalizedGalleryManifest | null {\n\tconst source = readManifestRecord(pkgJson);\n\tif (!source) return null;\n\n\treturn {\n\t\tmanifestKey: source.key,\n\t\textensions: toStringArray(source.manifest.extensions),\n\t\tskills: toStringArray(source.manifest.skills),\n\t\tprompts: toStringArray(source.manifest.prompts),\n\t\tthemes: toStringArray(source.manifest.themes),\n\t\tvideo: toOptionalString(source.manifest.video),\n\t\timage: toOptionalString(source.manifest.image),\n\t\tdescription: toOptionalString(source.manifest.description),\n\t};\n}\n\nexport function hasGalleryKeyword(pkgJson: unknown): boolean {\n\tif (!isRecord(pkgJson) || !Array.isArray(pkgJson.keywords)) return false;\n\treturn pkgJson.keywords.some((keyword) => keyword === \"omk-package\" || keyword === \"pi-package\");\n}\n\nfunction hasManifestResources(manifest: NormalizedGalleryManifest | null, type: GalleryResourceType): boolean {\n\tif (!manifest) return false;\n\tif (type === \"extension\") return manifest.extensions.length > 0;\n\tif (type === \"skill\") return manifest.skills.length > 0;\n\tif (type === \"prompt\") return manifest.prompts.length > 0;\n\treturn manifest.themes.length > 0;\n}\n\nexport function resolveGalleryTypeFacet(facet: string | undefined): GalleryResourceType | undefined {\n\tif (!facet) return undefined;\n\treturn FACET_ALIASES[facet.trim().toLowerCase()];\n}\n\nexport function classifyGalleryResourceTypes(\n\tmanifest: NormalizedGalleryManifest | null,\n\tconventionDirs: readonly string[] = [],\n): GalleryResourceType[] {\n\tconst types = new Set<GalleryResourceType>();\n\tfor (const type of RESOURCE_ORDER) {\n\t\tif (hasManifestResources(manifest, type)) types.add(type);\n\t}\n\tfor (const dir of conventionDirs) {\n\t\tconst firstSegment = dir.trim().replace(/\\\\/g, \"/\").split(\"/\").filter(Boolean)[0];\n\t\tconst type = resolveGalleryTypeFacet(firstSegment);\n\t\tif (type) types.add(type);\n\t}\n\treturn RESOURCE_ORDER.filter((type) => types.has(type));\n}\n\nexport function filterGalleryEntriesByType<T extends GalleryTypedEntry>(\n\tentries: readonly T[],\n\tfacet: string | undefined,\n): T[] {\n\tif (facet === undefined) return [...entries];\n\tconst type = resolveGalleryTypeFacet(facet);\n\tif (!type) return [];\n\treturn entries.filter((entry) => entry.resourceTypes.includes(type));\n}\n\nfunction parseAllowedGalleryUrl(url: string | undefined): URL | null {\n\tif (!url) return null;\n\tif (/[\\s\\u0000-\\u001f\\u007f]/.test(url)) return null;\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\tif (parsed.protocol !== \"https:\") return null;\n\t\tif (parsed.username || parsed.password) return null;\n\t\tif (parsed.port) return null;\n\t\treturn parsed;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nexport function isValidGalleryVideoUrl(url: string | undefined): boolean {\n\tconst parsed = parseAllowedGalleryUrl(url);\n\treturn parsed ? parsed.pathname.toLowerCase().endsWith(\".mp4\") : false;\n}\n\nexport function isValidGalleryImageUrl(url: string | undefined): boolean {\n\tconst parsed = parseAllowedGalleryUrl(url);\n\treturn parsed ? IMAGE_EXTENSIONS.some((extension) => parsed.pathname.toLowerCase().endsWith(extension)) : false;\n}\n\nexport function selectGalleryPreview(input: GalleryPreviewInput): GalleryPreviewSelection | null {\n\tif (isValidGalleryVideoUrl(input.video)) return { kind: \"video\", url: input.video };\n\tif (isValidGalleryImageUrl(input.image)) return { kind: \"image\", url: input.image };\n\tif (input.resourceTypes.includes(\"theme\")) {\n\t\tconst marker = input.themeName?.trim() || \"theme\";\n\t\treturn { kind: \"generated-theme\", marker };\n\t}\n\treturn null;\n}\n\nfunction isPathInsideRoot(root: string, candidate: string): boolean {\n\tconst rel = relative(root, candidate);\n\treturn rel === \"\" || (rel !== \"..\" && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));\n}\n\nfunction realpathIfPossible(path: string): string {\n\ttry {\n\t\treturn realpathSync(path);\n\t} catch {\n\t\treturn resolve(path);\n\t}\n}\n\nexport function isPathInsideRootByRealpath(packageRoot: string, candidatePath: string): boolean {\n\tconst root = resolve(packageRoot);\n\tconst candidate = resolve(candidatePath);\n\tif (!isPathInsideRoot(root, candidate)) return false;\n\tif (!existsSync(candidate)) return true;\n\treturn isPathInsideRoot(realpathIfPossible(root), realpathIfPossible(candidate));\n}\n\nexport function resolveManifestEntryInsideRoot(\n\tpackageRoot: string,\n\tentry: string,\n\tbaseDir = packageRoot,\n): string | undefined {\n\tconst trimmed = entry.trim();\n\tif (!trimmed || isAbsolute(trimmed)) return undefined;\n\tconst root = resolve(packageRoot);\n\tconst base = resolve(baseDir);\n\tif (!isPathInsideRootByRealpath(root, base)) return undefined;\n\tconst candidate = resolve(base, trimmed);\n\tif (!isPathInsideRootByRealpath(root, candidate)) return undefined;\n\treturn (relative(root, candidate) || \".\").replace(/\\\\/g, \"/\");\n}\n\nexport function filterManifestEntriesInsideRoot(packageRoot: string, entries: readonly string[]): string[] {\n\tconst safeEntries: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst safeEntry = resolveManifestEntryInsideRoot(packageRoot, entry);\n\t\tif (safeEntry && safeEntry !== \".\") {\n\t\t\tsafeEntries.push(safeEntry);\n\t\t}\n\t}\n\treturn safeEntries;\n}\n\nfunction requireNonEmpty(value: string, label: string): string {\n\tconst trimmed = value.trim();\n\tif (!trimmed) throw new Error(`${label} must not be empty`);\n\treturn trimmed;\n}\n\nfunction buildGallerySource(source: GalleryInstallSource): { kind: GalleryInstallSourceKind; source: string } {\n\tif (source.kind === \"npm\") {\n\t\tconst name = requireNonEmpty(source.name, \"npm package name\");\n\t\tconst versionVerdict = validateExactNpmVersion(source.version);\n\t\tif (!versionVerdict.ok) {\n\t\t\tthrow new Error(\n\t\t\t\t`Gallery npm installs require an exact pinned version for ${name}. ${versionVerdict.message}.`,\n\t\t\t);\n\t\t}\n\t\treturn { kind: \"npm\", source: `npm:${name}@${versionVerdict.version}` };\n\t}\n\tif (source.kind === \"git\") {\n\t\tconst repo = requireNonEmpty(source.repo, \"git repository\").replace(/^git:/, \"\");\n\t\tconst refVerdict = validateGitRef(source.ref);\n\t\tif (!refVerdict.ok) {\n\t\t\tthrow new Error(`Gallery git installs require a full commit SHA for ${repo}. ${refVerdict.message}.`);\n\t\t}\n\t\treturn { kind: \"git\", source: `git:${repo}@${refVerdict.commit}` };\n\t}\n\treturn { kind: \"local\", source: requireNonEmpty(source.path, \"local path\") };\n}\n\nexport function buildGalleryInstallSpec(\n\tinput: GalleryInstallSource,\n\thasExtension: boolean,\n\toptions: GalleryInstallOptions = {},\n): GalleryInstallSpec {\n\tconst source = buildGallerySource(input);\n\tconst localFlag = options.local ? \" -l\" : \"\";\n\treturn {\n\t\tkind: source.kind,\n\t\tsource: source.source,\n\t\tinstallCommand: `omk install ${source.source}${localFlag}`,\n\t\ttryEphemeralCommand: `omk -e ${source.source}`,\n\t\ttrust: hasExtension ? \"code-execution\" : \"declarative\",\n\t};\n}\n\nfunction stripComments(sourceText: string, stripStrings: boolean): string {\n\tlet output = \"\";\n\tlet index = 0;\n\twhile (index < sourceText.length) {\n\t\tconst current = sourceText[index];\n\t\tconst next = sourceText[index + 1];\n\t\tif (current === \"/\" && next === \"/\") {\n\t\t\tindex += 2;\n\t\t\twhile (index < sourceText.length && sourceText[index] !== \"\\n\") index += 1;\n\t\t\toutput += \"\\n\";\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (current === \"/\" && next === \"*\") {\n\t\t\tindex += 2;\n\t\t\twhile (index < sourceText.length && !(sourceText[index] === \"*\" && sourceText[index + 1] === \"/\")) index += 1;\n\t\t\tindex += 2;\n\t\t\toutput += \" \";\n\t\t\tcontinue;\n\t\t}\n\t\tif (stripStrings && (current === '\"' || current === \"'\" || current === \"`\")) {\n\t\t\tconst quote = current;\n\t\t\tindex += 1;\n\t\t\twhile (index < sourceText.length) {\n\t\t\t\tif (sourceText[index] === \"\\\\\") {\n\t\t\t\t\tindex += 2;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (sourceText[index] === quote) {\n\t\t\t\t\tindex += 1;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\toutput += \" \";\n\t\t\tcontinue;\n\t\t}\n\t\toutput += current;\n\t\tindex += 1;\n\t}\n\treturn output;\n}\n\nfunction capabilityOrder(badge: ExtensionCapabilityBadge): number {\n\treturn CAPABILITY_ORDER.indexOf(badge);\n}\n\nexport function inferExtensionCapabilityBadges(sourceText: string): ExtensionCapabilityBadge[] {\n\tconst withoutComments = stripComments(sourceText, false);\n\tconst code = stripComments(sourceText, true);\n\tconst badges = new Set<ExtensionCapabilityBadge>();\n\n\tif (/\\bomk\\s*\\.\\s*registerTool\\s*\\(/.test(code)) badges.add(\"tools\");\n\tif (/\\bomk\\s*\\.\\s*registerCommand\\s*\\(/.test(code)) badges.add(\"commands\");\n\tif (/\\bomk\\s*\\.\\s*on\\s*\\(/.test(code) || /\\bregisterHook\\s*\\(/.test(code)) badges.add(\"hooks\");\n\tif (/\\bomk\\s*\\.\\s*registerProvider\\s*\\(/.test(code)) badges.add(\"provider\");\n\tif (\n\t\t/\\bomk\\s*\\.\\s*(registerShortcut|registerFlag|registerMessageRenderer|registerComponent|setFooter)\\s*\\(/.test(code)\n\t) {\n\t\tbadges.add(\"ui\");\n\t}\n\tif (/\\bomk\\s*\\.\\s*on\\s*\\(\\s*([\"'`])(?:session_before_compact|session_compact|context)\\1/.test(withoutComments)) {\n\t\tbadges.add(\"hooks\");\n\t\tbadges.add(\"compaction\");\n\t}\n\n\treturn [...badges].sort((left, right) => capabilityOrder(left) - capabilityOrder(right));\n}\n\nfunction identityKey(identity: GalleryEntryIdentity): string {\n\tif (identity.kind === \"npm\") return `npm:${identity.name.trim().toLowerCase()}`;\n\tif (identity.kind === \"git\") {\n\t\tconst repo = identity.repo\n\t\t\t.trim()\n\t\t\t.replace(/^git:/, \"\")\n\t\t\t.replace(/\\.git$/i, \"\")\n\t\t\t.toLowerCase();\n\t\treturn `git:${repo}`;\n\t}\n\treturn `local:${resolve(identity.path)}`;\n}\n\nexport function dedupeGalleryEntries<T extends GalleryEntryWithIdentity>(entries: readonly T[]): T[] {\n\tconst seen = new Set<string>();\n\tconst result: T[] = [];\n\tfor (const entry of entries) {\n\t\tconst key = identityKey(entry.identity);\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tresult.push(entry);\n\t}\n\treturn result;\n}\n\n/**\n * Procurement-derived safe-gate outcome for an unpromoted (ephemeral trial) gallery install.\n *\n * Closes G9: gallery trust is derived from capability scan and procurement verdicts, not\n * from manifest claims. A trial is \"admitted\" only when the source is exact-pinned, carries\n * no hard-block capability (credential reads, host sockets), and passed explicit license,\n * lifecycle, and path-compatibility gates. Procurement rejection reasons are surfaced\n * verbatim so callers can show why an unpromoted trial would be blocked.\n */\nexport type GalleryTrialGateOutcome = \"admitted\" | \"blocked\";\n\nexport interface GalleryTrialGateStatus {\n\treadonly outcome: GalleryTrialGateOutcome;\n\treadonly identity: string;\n\treadonly adoption: Adoption;\n\treadonly pinned: boolean;\n\treadonly reasons: readonly string[];\n}\n\n/**\n * Structural subset of a procurement review consumed by the trial gate. The full procurement\n * review (`ProcurementReview`) satisfies this shape, so callers may pass `procureCandidate(...)`\n * output directly; tests can construct focused reviews without the full procurement input.\n */\nexport interface GalleryTrialGateReview {\n\treadonly pinned: boolean;\n\treadonly capabilities: readonly string[];\n\treadonly adoption: Adoption;\n\treadonly rejectedReasons: readonly string[];\n\treadonly licenseVerdict?: GateVerdict;\n\treadonly lifecycleVerdict?: GateVerdict;\n\treadonly pathCompatibility?: PathCompatibility;\n\treadonly candidate?: { readonly expectedResources?: readonly string[] };\n}\n\nconst TRIAL_HARD_BLOCK_CAPABILITIES: ReadonlySet<string> = new Set([\"credential-read\", \"host-socket\"]);\nconst CODE_EXECUTION_RESOURCES: ReadonlySet<string> = new Set([\"extension\", \"tool\"]);\nconst CODE_EXECUTION_CAPABILITIES: ReadonlySet<string> = new Set([\n\t\"browser-control\",\n\t\"child-process\",\n\t\"credential-read\",\n\t\"filesystem-write\",\n\t\"host-socket\",\n\t\"network\",\n]);\n\nfunction pushUniqueReason(reasons: string[], reason: string): void {\n\tif (!reasons.includes(reason)) reasons.push(reason);\n}\n\n/**\n * Classify whether a candidate package may be safely admitted to an unpromoted (ephemeral,\n * sandboxed, `--ignore-scripts`) trial. Pure and deterministic: identical inputs always\n * produce identical output, and no I/O is performed.\n */\nexport function assessGalleryTrialGate(\n\tidentity: GalleryEntryIdentity,\n\treview: GalleryTrialGateReview,\n): GalleryTrialGateStatus {\n\tconst hardBlocks = review.capabilities.filter((capability) => TRIAL_HARD_BLOCK_CAPABILITIES.has(capability));\n\tconst reasons: string[] = [];\n\tif (!review.pinned) pushUniqueReason(reasons, \"exact-pin-required\");\n\tif (hardBlocks.length > 0) pushUniqueReason(reasons, `capability-hard-block: ${hardBlocks.join(\",\")}`);\n\tif (review.licenseVerdict === \"reject\") pushUniqueReason(reasons, \"license-blocked\");\n\tif (review.lifecycleVerdict === \"reject\") pushUniqueReason(reasons, \"lifecycle-scripts-blocked\");\n\tif (review.pathCompatibility === \"pi-hardcoded\") pushUniqueReason(reasons, \"pi-hardcoded-paths\");\n\tif (review.adoption === \"reject\") {\n\t\tfor (const reason of review.rejectedReasons) pushUniqueReason(reasons, reason);\n\t}\n\n\tconst blocked =\n\t\t!review.pinned ||\n\t\thardBlocks.length > 0 ||\n\t\treview.licenseVerdict === \"reject\" ||\n\t\treview.lifecycleVerdict === \"reject\" ||\n\t\treview.pathCompatibility === \"pi-hardcoded\" ||\n\t\treview.adoption === \"reject\";\n\n\treturn {\n\t\toutcome: blocked ? \"blocked\" : \"admitted\",\n\t\tidentity: identityKey(identity),\n\t\tadoption: review.adoption,\n\t\tpinned: review.pinned,\n\t\treasons,\n\t};\n}\n\nexport function deriveGalleryInstallTrustFromReview(review: GalleryTrialGateReview): GalleryInstallTrust {\n\tconst expectedResources = review.candidate?.expectedResources ?? [];\n\tif (expectedResources.some((resource) => CODE_EXECUTION_RESOURCES.has(resource))) return \"code-execution\";\n\tif (review.capabilities.some((capability) => CODE_EXECUTION_CAPABILITIES.has(capability))) return \"code-execution\";\n\treturn \"declarative\";\n}\n\nexport function buildGalleryInstallSpecFromReview(\n\tinput: GalleryInstallSource,\n\treview: GalleryTrialGateReview,\n\toptions: GalleryInstallOptions = {},\n): GalleryInstallSpec {\n\tconst spec = buildGalleryInstallSpec(input, false, options);\n\tconst gate = assessGalleryTrialGate(galleryIdentityFromInstallSource(input), review);\n\tif (gate.outcome === \"blocked\") {\n\t\tthrow new Error(`Gallery trial blocked for ${gate.identity}: ${gate.reasons.join(\", \")}`);\n\t}\n\treturn { ...spec, trust: deriveGalleryInstallTrustFromReview(review) };\n}\n\nfunction galleryIdentityFromInstallSource(input: GalleryInstallSource): GalleryEntryIdentity {\n\tif (input.kind === \"npm\") return { kind: \"npm\", name: input.name };\n\tif (input.kind === \"git\") return { kind: \"git\", repo: input.repo, ref: input.ref };\n\treturn { kind: \"local\", path: input.path };\n}\n"]}

package/dist/core/package-manager.d.ts

@@ -1,4 +1,27 @@
+import { type TrialAuditRecord } from "./package-trial-runtime.ts";
+import type { SandboxBackendStatus, SandboxPathResolver, SandboxPolicy } from "./sandbox/policy.ts";
 import type { SettingsManager } from "./settings-manager.ts";
+export declare function buildGitDependencyInstallArgs(hasConfiguredNpmCommand: boolean, allowScripts?: boolean): string[];
+export declare function buildNpmInstallArgs(packageManagerName: string, specs: string[], installRoot: string, allowScripts?: boolean): string[];
+/**
+ * Exact-match membership for npm install units. Returns true only when the install unit is non-empty and
+ * EVERY top-level spec is listed (by `npm:<name>` identity or `npm:<spec>`). Mixed/partial lists stay false
+ * so a single unlisted spec keeps the whole install fail-closed under --ignore-scripts.
+ */
+export declare function isNpmInstallAllowed(specs: string[], allowList: readonly string[]): boolean;
+/** Exact-match membership for a git install unit by `git:<host>/<path>` identity or `...@<ref>` spec. */
+export declare function isGitInstallAllowed(source: {
+    host: string;
+    path: string;
+    ref?: string;
+}, allowList: readonly string[]): boolean;
+export type InstallAllowScriptResolution = {
+    ok: true;
+    entry: string;
+} | {
+    ok: false;
+    expected: string[];
+};
 export interface PathMetadata {
     source: string;
     scope: SourceScope;
@@ -44,9 +67,11 @@ export interface PackageManager {
     resolve(onMissing?: (source: string) => Promise<MissingSourceAction>): Promise<ResolvedPaths>;
     install(source: string, options?: {
         local?: boolean;
+        resolvedCommit?: string;
     }): Promise<void>;
     installAndPersist(source: string, options?: {
         local?: boolean;
+        resolvedCommit?: string;
     }): Promise<void>;
     remove(source: string, options?: {
         local?: boolean;
@@ -67,12 +92,22 @@ export interface PackageManager {
         local?: boolean;
     }): boolean;
     setProgressCallback(callback: ProgressCallback | undefined): void;
+    cleanupTemporaryTrialInstalls(): void;
     getInstalledPath(source: string, scope: "user" | "project"): string | undefined;
+    resolveInstallAllowScriptEntry(source: string, requested: string): InstallAllowScriptResolution;
+}
+export interface PackageTrialRuntimeOptions {
+    readonly policy: SandboxPolicy;
+    readonly backend?: SandboxBackendStatus;
+    readonly resolver?: SandboxPathResolver;
+    readonly env?: () => NodeJS.ProcessEnv;
+    readonly onAudit?: (record: TrialAuditRecord) => void;
 }
 interface PackageManagerOptions {
     cwd: string;
     agentDir: string;
     settingsManager: SettingsManager;
+    trialRuntime?: PackageTrialRuntimeOptions;
 }
 type SourceScope = "user" | "project" | "temporary";
 export declare function getExtensionTempFolder(agentDir: string): string;
@@ -80,11 +115,14 @@ export declare class DefaultPackageManager implements PackageManager {
     private cwd;
     private agentDir;
     private settingsManager;
+    private trialRuntime;
+    private trialCleanups;
     private globalNpmRoot;
     private globalNpmRootCommandKey;
     private progressCallback;
     constructor(options: PackageManagerOptions);
     setProgressCallback(callback: ProgressCallback | undefined): void;
+    cleanupTemporaryTrialInstalls(): void;
     addSourceToSettings(source: string, options?: {
         local?: boolean;
     }): boolean;
@@ -94,6 +132,7 @@ export declare class DefaultPackageManager implements PackageManager {
     getInstalledPath(source: string, scope: "user" | "project"): string | undefined;
     private emitProgress;
     private withProgress;
+    private cleanupTrialInstall;
     resolve(onMissing?: (source: string) => Promise<MissingSourceAction>): Promise<ResolvedPaths>;
     resolveExtensionSources(sources: string[], options?: {
         local?: boolean;
@@ -102,10 +141,27 @@ export declare class DefaultPackageManager implements PackageManager {
     listConfiguredPackages(): ConfiguredPackage[];
     install(source: string, options?: {
         local?: boolean;
+        resolvedCommit?: string;
     }): Promise<void>;
     installAndPersist(source: string, options?: {
         local?: boolean;
+        resolvedCommit?: string;
     }): Promise<void>;
+    /**
+     * Procurement admission gate for explicit installs (and installAndPersist via install()).
+     *
+     * Pure check: no fetch, clone, npm install, or other dependency-install side effect. It reuses the
+     * native procurement validators (`validateExactNpmVersion`, `validateGitRef`) so the installer never
+     * runs against an unpinned, mutable, or range/dist-tag source. Rules:
+     *   - non-local npm packages must carry an exact pinned version (no missing/range/wildcard/dist-tag);
+     *   - git packages must use a full commit SHA, or a tag anchored to a reviewed resolved commit SHA
+     *     supplied through `options.resolvedCommit`.
+     * Local sources are exempt so local development paths keep working unchanged.
+     *
+     * Only the explicit install/persist entry point is gated. resolve()'s auto-install of
+     * already-configured packages is intentionally left unchanged so existing settings keep loading.
+     */
+    private assertInstallAdmission;
     remove(source: string, options?: {
         local?: boolean;
     }): Promise<void>;
@@ -122,6 +178,7 @@ export declare class DefaultPackageManager implements PackageManager {
     private warnPackageSourceFailure;
     private resolveLocalExtensionSource;
     private installParsedSource;
+    private installTemporaryTrialSource;
     private getPackageSourceString;
     private getSourceMatchKeyForInput;
     private getSourceMatchKeyForSettings;
@@ -155,10 +212,21 @@ export declare class DefaultPackageManager implements PackageManager {
     private parseNpmSpec;
     private getNpmCommand;
     private getPackageManagerName;
+    private getTrialPackageManagerName;
     private runNpmCommand;
     private getGitDependencyInstallArgs;
     private runNpmCommandSync;
     private getNpmInstallArgs;
+    private shouldAllowNpmInstallScripts;
+    private shouldAllowGitInstallScripts;
+    private logInstallScriptDecision;
+    /**
+     * Validate a CLI `--allow-scripts <name>` value against an install source and return the canonical allowlist
+     * entry to persist. Exact match only; an unrelated name yields `{ ok: false, expected }` so the CLI can abort
+     * and print the manual settings example.
+     */
+    resolveInstallAllowScriptEntry(source: string, requested: string): InstallAllowScriptResolution;
+    private installTemporaryNpmTrial;
     private installNpm;
     private uninstallNpm;
     private installGit;
@@ -172,6 +240,7 @@ export declare class DefaultPackageManager implements PackageManager {
     private getNpmInstallRoot;
     private getGlobalNpmRoot;
     private getPnpmGlobalPackagePath;
+    private getTemporaryNpmInstallRoot;
     private getManagedNpmInstallPath;
     private getLegacyGlobalNpmInstallPath;
     private getNpmInstallPath;