wicked-crew 0.6.0 → 0.7.0

package/dist/interactive/repo-snapshot.js

@@ -0,0 +1,289 @@
+/**
+ * Launch-scoped REPO SNAPSHOTS for grounding governed interactive runs (CREW-UX-8 v4).
+ *
+ * WHY a snapshot instead of the live repo: the interactive seams launch their governed runs
+ * UNBOUND — on a repoRef-bound run the worker's ACP tool-permission stream closes on the first
+ * call that needs a permission prompt and the session dies (wicked-core#293) — and an unbound
+ * worker's governance boundary is {sandbox, extraWriteRoots, ~/.claude/plugins}, so even READS
+ * of the live repo root are governance-denied (wicked-core#294; the v3 "hand the worker the
+ * root path to read" design rested on read evidence gathered under a *bound* boundary, which
+ * does not transfer). The one location an unbound worker can always read is the inbox the run
+ * already writes to — write roots are readable (wicked-core#259) — so grounding means putting
+ * a copy of the repo INSIDE the inbox, crew-side, BEFORE the launch, and naming that snapshot
+ * in the task.
+ *
+ * Mechanism, in preference order:
+ *  1. `git clone --depth 1 --no-hardlinks file://<root> <dest>` — a shallow LOCAL clone:
+ *     one commit of history, `--no-hardlinks` so the snapshot never aliases the live object
+ *     store. Because a clone checks out EVERY tracked path, the result is then swept: tracked
+ *     `node_modules` trees and every symlink are removed (see below), and the swept snapshot
+ *     is re-measured against the budget before it counts as usable.
+ *  2. A plain file copy that skips `.git`/`node_modules` AND symlinks — for roots that are not
+ *     git repos (or where git itself is unavailable/failing).
+ *
+ * SYMLINKS NEVER SURVIVE into a snapshot, on either path (Copilot, crew#313): the snapshot
+ * lands inside the worker-visible inbox, so a repo symlink pointing OUTSIDE the repo would
+ * hand the worker readable reach beyond the governance boundary — and a link to a huge tree
+ * would bypass the size cap the preflight walk (which skips links) enforced. The copy filter
+ * refuses them and the post-clone sweep deletes the ones a clone checked out.
+ *
+ * The snapshot is CAPPED: a working tree whose (`.git`/`node_modules`/symlink-excluded) size
+ * exceeds the budget is not snapshotted at all — the caller degrades honestly to an ungrounded
+ * launch with a visible status note, never a truncated half-repo the worker would mistake for
+ * the whole. Snapshots are launch-scoped: the seams remove them when the run reaches a
+ * terminal state (finalize/failure folds), so the inbox never accretes dead clones.
+ *
+ * OVERLAP REFUSAL: a configured draft dir could place `dest` inside the live repo (or a repo
+ * could be registered AT the inbox). Clearing a stale dest with `rm -rf` before noticing that
+ * would DELETE live repository content — so source/dest containment is checked (realpath'd,
+ * both directions) BEFORE anything is removed, and any overlap refuses the snapshot outright.
+ * For the same reason THIS helper creates `dest`'s parent directory (after the check passes) —
+ * a caller that pre-created it would already have written into the live repo (Copilot round 2).
+ *
+ * Fully ASYNC on purpose: this runs inline in a bus handler whose process also feeds ~15s UI
+ * heartbeats — a synchronous clone/copy of a big repo would starve the event loop and the
+ * canvas would read frozen (Copilot, crew#313). All I/O is fs/promises; the clone goes through
+ * the daemon's capped exec chokepoint (`execCapped`, FINDING-016).
+ */
+import { cp, lstat, mkdir, readdir, realpath, rm, stat } from 'node:fs/promises';
+import path, { basename, dirname, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { execCapped } from '../core/exec.js';
+/** Default snapshot budget (~200MB). A repo whose working tree exceeds this is not
+ *  snapshotted — the launch proceeds ungrounded, honestly narrated. */
+export const REPO_SNAPSHOT_MAX_BYTES = 200 * 1024 * 1024;
+/** Never snapshotted: git's object store (the clone brings its own shallow one; the copy
+ *  fallback wants working files only) and dependency trees (huge, reproducible, ungrounding). */
+const SNAPSHOT_SKIP = new Set(['.git', 'node_modules']);
+/** `true` when the tree under `root` exceeds `cap` bytes, skipping {@link SNAPSHOT_SKIP} dirs
+ *  and symlinks (a link to a huge tree — or out of the repo — must not distort the estimate;
+ *  the copy filter and post-clone sweep exclude exactly the same set, so the preflight counts
+ *  what a snapshot would actually hold), with an early exit the moment the cap is passed so a
+ *  10GB monorepo is never fully walked just to learn it is too big. */
+async function treeExceeds(root, cap) {
+    let total = 0;
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // unreadable subdir — the clone/copy will surface a real error if it matters
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                if (!SNAPSHOT_SKIP.has(entry.name))
+                    stack.push(join(dir, entry.name));
+            }
+            else if (entry.isFile()) {
+                try {
+                    total += (await stat(join(dir, entry.name))).size;
+                }
+                catch {
+                    // raced deletion — ignore
+                }
+                if (total > cap)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/** Post-clone sweep: delete every symlink (junctions included — boundary escape, cap bypass)
+ *  and every {@link SNAPSHOT_SKIP} tree a `git clone` checked out (a clone materializes ALL
+ *  tracked paths — tracked `node_modules` ignores the skip list otherwise). The clone's own
+ *  top-level `.git` (its shallow object store) is the one deliberate survivor. */
+async function sweepSnapshot(root) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const p = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                await rm(p, { recursive: true, force: true });
+            }
+            else if (entry.isDirectory()) {
+                if (dir === root && entry.name === '.git')
+                    continue; // the shallow clone's own store
+                if (SNAPSHOT_SKIP.has(entry.name)) {
+                    await rm(p, { recursive: true, force: true });
+                }
+                else {
+                    stack.push(p);
+                }
+            }
+        }
+    }
+}
+/** Resolve `p` through its nearest EXISTING ancestor's realpath (the path itself may not exist
+ *  yet — a fresh dest usually does not), so symlinked parents cannot hide an overlap. Only
+ *  ENOENT falls to the ancestor walk (the `api/open-path.ts` rule, Copilot round 2): any OTHER
+ *  error (EACCES, ELOOP, …) means an EXISTING component could not be resolved — a lexical
+ *  reconstruction there could miss an overlap through the unresolved link, so it THROWS and
+ *  the caller's overlap-check catch fails closed (no snapshot, degrade). */
+async function realpathNearest(p) {
+    let existing = resolve(p);
+    const tail = [];
+    // Walk up until something exists; dirname() at the root returns itself, which always exists.
+    for (;;) {
+        try {
+            const real = await realpath(existing);
+            return tail.length > 0 ? join(real, ...tail) : real;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+            const parent = dirname(existing);
+            if (parent === existing)
+                return existing; // unreachable in practice — a root always resolves
+            tail.unshift(basename(existing));
+            existing = parent;
+        }
+    }
+}
+/** Is `child` equal to `parent` or inside it? `relative()`-based (the `api/open-path.ts`
+ *  containment pattern) — a plain `startsWith(base + sep)` never matches a ROOT base (`/`,
+ *  `C:\`), whose spelling already ends in the separator (Copilot round 2). */
+function contains(parent, child, p) {
+    const rel = p.relative(parent, child);
+    if (rel === '')
+        return true; // the same path
+    if (p.isAbsolute(rel))
+        return false; // different drive/tree entirely (win32)
+    return rel !== '..' && !rel.startsWith(`..${p.sep}`);
+}
+/** `true` when `a` and `b` name the same path or one contains the other — including when one
+ *  of them is a filesystem root (`/`, a win32 drive root). Exported for its unit tests. */
+export function pathsOverlap(a, b, p = path) {
+    return contains(a, b, p) || contains(b, a, p);
+}
+/**
+ * Materialize a snapshot of the repo at `rootPath` into `dest` (creating it), for a worker to
+ * READ as grounding context. Resolves `{ok: true}` when `dest` now holds a usable snapshot,
+ * `{ok: false, reason}` when it does not — see {@link SnapshotFailureReason}; the reason lets
+ * the caller narrate the RIGHT degrade (too large ≠ unreadable ≠ clone failed) — in which case
+ * any partial `dest` has been removed and the caller must launch UNGROUNDED (and say so on the
+ * thread). Never rejects: a grounding failure must degrade the launch, not kill it.
+ *
+ * The clone is the git-preferred path, so on a real repo the snapshot is HEAD's tracked
+ * content (uncommitted/untracked files are not included) minus swept symlinks/`node_modules`;
+ * the copy fallback takes the working tree as-is minus `.git`/`node_modules`/symlinks.
+ */
+export async function snapshotRepo(rootPath, dest, opts = {}) {
+    const log = opts.log ?? (() => { });
+    const maxBytes = opts.maxBytes ?? REPO_SNAPSHOT_MAX_BYTES;
+    try {
+        if (!(await stat(rootPath)).isDirectory()) {
+            log(`[repo-snapshot] repo root ${rootPath} is not a directory — no snapshot`);
+            return { ok: false, reason: 'root-unreadable' };
+        }
+    }
+    catch {
+        log(`[repo-snapshot] repo root ${rootPath} does not exist — no snapshot`);
+        return { ok: false, reason: 'root-unreadable' };
+    }
+    // Overlap refusal comes BEFORE the stale-dest clear (Copilot, crew#313): with a configurable
+    // draft dir, `dest` can sit inside the registered repo (or vice versa) — clearing it first
+    // would `rm -rf` live repository content, and a copy could recurse into its own output.
+    try {
+        const realRoot = await realpath(rootPath);
+        const realDest = await realpathNearest(dest);
+        if (pathsOverlap(realRoot, realDest)) {
+            log(`[repo-snapshot] refusing snapshot: destination ${dest} (${realDest}) overlaps the repo root ${rootPath} (${realRoot})`);
+            return { ok: false, reason: 'dest-overlap' };
+        }
+    }
+    catch (err) {
+        log(`[repo-snapshot] could not resolve ${rootPath} / ${dest} for the overlap check: ${err instanceof Error ? err.message : String(err)} — no snapshot`);
+        return { ok: false, reason: 'root-unreadable' };
+    }
+    if (await treeExceeds(rootPath, maxBytes)) {
+        log(`[repo-snapshot] repo at ${rootPath} exceeds the ${maxBytes}-byte snapshot budget — no snapshot`);
+        return { ok: false, reason: 'too-large' };
+    }
+    // The snapshot's PARENT (the caller's per-run dir) is created HERE — only after containment
+    // was validated. The caller must never pre-create it: with an overlapping config that mkdir
+    // would write into the live repository before the refusal above could fire (Copilot round 2).
+    try {
+        await mkdir(dirname(dest), { recursive: true });
+    }
+    catch (err) {
+        log(`[repo-snapshot] could not create the snapshot parent for ${dest}: ${err instanceof Error ? err.message : String(err)} — no snapshot`);
+        return { ok: false, reason: 'copy-failed' };
+    }
+    // A stale snapshot (crashed prior run, replayed key) never survives into a new launch.
+    try {
+        await rm(dest, { recursive: true, force: true });
+    }
+    catch (err) {
+        log(`[repo-snapshot] could not clear ${dest}: ${err instanceof Error ? err.message : String(err)}`);
+        return { ok: false, reason: 'dest-unclearable' };
+    }
+    // Preferred: shallow local clone. `file://` (not a plain path) is what makes --depth honored
+    // on a local source; pathToFileURL keeps the URL spelling right on Windows too.
+    try {
+        await execCapped('git', ['clone', '--depth', '1', '--no-hardlinks', pathToFileURL(rootPath).href, dest], {
+            timeout: 120_000,
+            windowsHide: true,
+        });
+        // The clone checked out EVERY tracked path — sweep what the snapshot contract excludes
+        // (tracked node_modules, all symlinks), then verify the SWEPT tree against the budget:
+        // the preflight measured the source with these exclusions, so a clean sweep normally
+        // passes, but the honest gate is what actually landed on disk.
+        await sweepSnapshot(dest);
+        if (await treeExceeds(dest, maxBytes)) {
+            log(`[repo-snapshot] clone of ${rootPath} exceeds the ${maxBytes}-byte budget after sweep — no snapshot`);
+            await rm(dest, { recursive: true, force: true }).catch(() => { });
+            return { ok: false, reason: 'too-large' };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        log(`[repo-snapshot] git clone of ${rootPath} failed (${err instanceof Error ? err.message : String(err)}) — falling back to a file copy`);
+    }
+    try {
+        await rm(dest, { recursive: true, force: true }); // whatever the failed clone left behind
+        await cp(rootPath, dest, {
+            recursive: true,
+            filter: async (src) => {
+                if (SNAPSHOT_SKIP.has(basename(src)))
+                    return false;
+                try {
+                    // Symlinks NEVER ride into the worker-visible inbox: a link out of the repo is a
+                    // boundary escape, a link to a huge tree a cap bypass (Copilot, crew#313).
+                    return !(await lstat(src)).isSymbolicLink();
+                }
+                catch {
+                    return false; // raced deletion / unreadable — leave it out
+                }
+            },
+        });
+        // The honest gate is what actually LANDED (same rule as the clone path's post-sweep
+        // re-measure): the preflight walked the SOURCE, and a file that grew between that walk and
+        // the copy would otherwise put an over-budget tree in the worker-visible inbox
+        // (Copilot round 2).
+        if (await treeExceeds(dest, maxBytes)) {
+            log(`[repo-snapshot] copy of ${rootPath} exceeds the ${maxBytes}-byte budget — no snapshot`);
+            await rm(dest, { recursive: true, force: true }).catch(() => { });
+            return { ok: false, reason: 'too-large' };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        log(`[repo-snapshot] file copy of ${rootPath} failed too (${err instanceof Error ? err.message : String(err)}) — no snapshot`);
+        await rm(dest, { recursive: true, force: true }).catch(() => { }); // never leave a partial snapshot
+        return { ok: false, reason: 'copy-failed' };
+    }
+}
+//# sourceMappingURL=repo-snapshot.js.map

package/dist/interactive/repo-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-snapshot.js","sourceRoot":"","sources":["../../src/interactive/repo-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;uEACuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzD;iGACiG;AACjG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAoBxD;;;;uEAIuE;AACvE,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,6EAA6E;QACzF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;gBACD,IAAI,KAAK,GAAG,GAAG;oBAAE,OAAO,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;kFAGkF;AAClF,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS,CAAC,gCAAgC;gBACrF,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;4EAK4E;AAC5E,KAAK,UAAU,eAAe,CAAC,CAAS;IACtC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,6FAA6F;IAC7F,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;YAChE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;YAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAMD;;8EAE8E;AAC9E,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa,EAAE,CAAW;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,wCAAwC;IAC7E,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS,EAAE,IAAc,IAAI;IACnE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,IAAY,EACZ,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,uBAAuB,CAAC;IAE1D,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,GAAG,CAAC,6BAA6B,QAAQ,mCAAmC,CAAC,CAAC;YAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,6BAA6B,QAAQ,+BAA+B,CAAC,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,6FAA6F;IAC7F,2FAA2F;IAC3F,wFAAwF;IACxF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,GAAG,CACD,kDAAkD,IAAI,KAAK,QAAQ,4BAA4B,QAAQ,KAAK,QAAQ,GAAG,CACxH,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,qCAAqC,QAAQ,MAAM,IAAI,2BACrD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,gBAAgB,CACjB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,2BAA2B,QAAQ,gBAAgB,QAAQ,qCAAqC,CAAC,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,8FAA8F;IAC9F,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,4DAA4D,IAAI,KAC9D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,gBAAgB,CACjB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,uFAAuF;IACvF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,mCAAmC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,6FAA6F;IAC7F,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YACvG,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,uFAAuF;QACvF,uFAAuF;QACvF,qFAAqF;QACrF,+DAA+D;QAC/D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,4BAA4B,QAAQ,gBAAgB,QAAQ,wCAAwC,CAAC,CAAC;YAC1G,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,gCAAgC,QAAQ,YACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,wCAAwC;QAC1F,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACnD,IAAI,CAAC;oBACH,iFAAiF;oBACjF,2EAA2E;oBAC3E,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC,CAAC,6CAA6C;gBAC7D,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,oFAAoF;QACpF,2FAA2F;QAC3F,+EAA+E;QAC/E,qBAAqB;QACrB,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,2BAA2B,QAAQ,gBAAgB,QAAQ,4BAA4B,CAAC,CAAC;YAC7F,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,gCAAgC,QAAQ,gBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,iCAAiC;QACnG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/projects/graph-paths.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Where a PROJECT's co-located code graph lives, and what each member repo is called inside it.
+ *
+ * # Why a module instead of a `join()` at each call site
+ *
+ * This is `repoPaths.ts`'s posture applied one level up (see that module's header for the bill:
+ * five spellings of the per-repo graph path against a sixth inside wicked-core, and every graph
+ * query answering "nothing found" about a repo full of code). One producer, one consumer. Nothing
+ * outside this module spells a project-graph path or mints a repo label.
+ *
+ * # Why NOT inside a repo checkout
+ *
+ * The per-repo graph lives at `<repo>/.codegraph/estate.db` — inside the working tree — and we have
+ * just spent the effort removing that directory from six checkouts it had polluted. A PROJECT graph
+ * is worse on that axis, not better: it holds N repos, so there is no one checkout it belongs to,
+ * and writing it into the first member's tree would make repo A's working directory grow with repo
+ * B's symbols. It goes in the daemon's own state directory.
+ *
+ * # Why `~/.wicked-crew/project-graphs/<projectId>/`
+ *
+ * `~/.wicked-crew/` is already where this package keeps crew-side per-project state that the engine
+ * does not own — `project-settings.json` (DES-MERGE-001 §7.1) sits there today. The project graph is
+ * exactly that kind of thing: crew-owned, per-project, derived, and rebuildable. A directory per
+ * project (rather than `<projectId>.db` files in one flat folder) keeps the db and the refresh
+ * manifest that describes it together, so removing a project's graph is one `rm -rf` that cannot
+ * leave a manifest describing a database that is gone.
+ *
+ * Overridable with `WICKED_CREW_PROJECT_GRAPH_ROOT` — the same escape hatch
+ * `WICKED_CREW_PROJECT_SETTINGS` gives the settings store, and what lets the tests and the proof
+ * scripts run without touching a developer's real home.
+ */
+/**
+ * The estate label charset, copied from the rule that enforces it
+ * (`wicked-estate/src/repo_scope.rs::validate_label`): 1–64 chars of `[A-Za-z0-9._-]`, and never
+ * `.` or `..`.
+ *
+ * The constraint is not cosmetic and not ours to relax. estate splices the label into `files.path`
+ * AND into every SymbolId derived from it, so a `/` or a `..` in a label would forge paths inside
+ * another repo's namespace — the exact collision the whole labelling mechanism exists to prevent.
+ * A label that fails this test is refused by estate before a single row is written; we mint labels
+ * that pass it instead of discovering that at index time.
+ */
+export declare function isValidRepoLabel(label: string): boolean;
+/**
+ * The label one registered repo carries inside a project graph — its REGISTRY ID when that id is
+ * already a legal estate label, and a deterministic sanitized form when it is not.
+ *
+ * WHY the registry id. The label becomes a path prefix on every row the repo writes and shows up in
+ * every result this surface returns, so it has to be a name an operator can map back to a repo
+ * without a lookup table. It also has to be STABLE: estate binds a label to a repo permanently
+ * (re-indexing under a second label is refused as a duplicate; re-using a label for a different repo
+ * is refused as a collision), so a label derived from anything mutable — the repo's display name,
+ * its root path, its position in the member list — would break the next refresh after a rename or a
+ * move. The registry id is the one identifier that is both stable and already unique per repo.
+ *
+ * Every repo id in the live registry today (`wicked-ledger`, `wicked-vault`, `pageindex-proof`, …)
+ * satisfies estate's rule as-is, so the common path is the identity function and the label IS the
+ * id. That is not guaranteed for ids minted later, so the fallback is real rather than theoretical:
+ * illegal characters collapse to `-`, the stem is capped, and a 12-hex digest of the FULL id is
+ * appended — the digest is what keeps `a/b` and `a:b` (which sanitize identically) apart, and what
+ * keeps a truncated 200-character id distinct from another that shares its first 51 characters.
+ *
+ * The mapping is a pure function of the id, which is what makes it safe against estate's permanent
+ * binding: the same repo resolves to the same label on every refresh, for the life of the graph.
+ */
+export declare function repoLabel(repoId: string): string;
+/**
+ * Project ids are REJECTED, never sanitized.
+ *
+ * A sanitizing map is what would let two distinct project ids land in one directory and share one
+ * database — the same class of silent collision that made a multi-repo graph impossible in the first
+ * place, reintroduced at the project level. It is also the traversal guard: the id is a path
+ * segment, so `../../x` must never be spelled into a path. Engine-minted ids (`proj_1787…`) and the
+ * synthesized `default` both pass; anything that does not is a bug worth hearing about.
+ */
+export declare function assertProjectIdIsPathSafe(projectId: string): void;
+/** The root every project graph directory hangs off. */
+export declare function projectGraphRoot(env?: NodeJS.ProcessEnv): string;
+/** One project's graph directory — holds the database and the manifest that describes it. */
+export declare function projectGraphDir(projectId: string, env?: NodeJS.ProcessEnv): string;
+/** The ONE database holding every member repo of this project, co-located under their labels. */
+export declare function projectGraphDb(projectId: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * What the last refresh put in that database, per repo — the record incremental refresh reads.
+ *
+ * Deliberately a SIDECAR rather than a read of estate's own `repo:<label>:commit` meta: estate
+ * exposes that only through `stats`, whose output is human text with no `--json`, and deciding
+ * whether to re-index a repo by regex-matching a report is the kind of coupling that breaks on a
+ * formatting change with no test to catch it.
+ */
+export declare function projectGraphManifest(projectId: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=graph-paths.d.ts.map

package/dist/projects/graph-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-paths.d.ts","sourceRoot":"","sources":["../../src/projects/graph-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQvD;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAcjE;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG/F;AAED,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEpG"}

package/dist/projects/graph-paths.js

@@ -0,0 +1,130 @@
+/**
+ * Where a PROJECT's co-located code graph lives, and what each member repo is called inside it.
+ *
+ * # Why a module instead of a `join()` at each call site
+ *
+ * This is `repoPaths.ts`'s posture applied one level up (see that module's header for the bill:
+ * five spellings of the per-repo graph path against a sixth inside wicked-core, and every graph
+ * query answering "nothing found" about a repo full of code). One producer, one consumer. Nothing
+ * outside this module spells a project-graph path or mints a repo label.
+ *
+ * # Why NOT inside a repo checkout
+ *
+ * The per-repo graph lives at `<repo>/.codegraph/estate.db` — inside the working tree — and we have
+ * just spent the effort removing that directory from six checkouts it had polluted. A PROJECT graph
+ * is worse on that axis, not better: it holds N repos, so there is no one checkout it belongs to,
+ * and writing it into the first member's tree would make repo A's working directory grow with repo
+ * B's symbols. It goes in the daemon's own state directory.
+ *
+ * # Why `~/.wicked-crew/project-graphs/<projectId>/`
+ *
+ * `~/.wicked-crew/` is already where this package keeps crew-side per-project state that the engine
+ * does not own — `project-settings.json` (DES-MERGE-001 §7.1) sits there today. The project graph is
+ * exactly that kind of thing: crew-owned, per-project, derived, and rebuildable. A directory per
+ * project (rather than `<projectId>.db` files in one flat folder) keeps the db and the refresh
+ * manifest that describes it together, so removing a project's graph is one `rm -rf` that cannot
+ * leave a manifest describing a database that is gone.
+ *
+ * Overridable with `WICKED_CREW_PROJECT_GRAPH_ROOT` — the same escape hatch
+ * `WICKED_CREW_PROJECT_SETTINGS` gives the settings store, and what lets the tests and the proof
+ * scripts run without touching a developer's real home.
+ */
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * The estate label charset, copied from the rule that enforces it
+ * (`wicked-estate/src/repo_scope.rs::validate_label`): 1–64 chars of `[A-Za-z0-9._-]`, and never
+ * `.` or `..`.
+ *
+ * The constraint is not cosmetic and not ours to relax. estate splices the label into `files.path`
+ * AND into every SymbolId derived from it, so a `/` or a `..` in a label would forge paths inside
+ * another repo's namespace — the exact collision the whole labelling mechanism exists to prevent.
+ * A label that fails this test is refused by estate before a single row is written; we mint labels
+ * that pass it instead of discovering that at index time.
+ */
+export function isValidRepoLabel(label) {
+    return (label.length > 0 &&
+        label.length <= 64 &&
+        label !== '.' &&
+        label !== '..' &&
+        /^[A-Za-z0-9._-]+$/.test(label));
+}
+/** Sanitized-label budget: 51 + `-` + 12 hex = exactly estate's 64-character ceiling. */
+const HASH_LEN = 12;
+const STEM_LEN = 64 - 1 - HASH_LEN;
+/**
+ * The label one registered repo carries inside a project graph — its REGISTRY ID when that id is
+ * already a legal estate label, and a deterministic sanitized form when it is not.
+ *
+ * WHY the registry id. The label becomes a path prefix on every row the repo writes and shows up in
+ * every result this surface returns, so it has to be a name an operator can map back to a repo
+ * without a lookup table. It also has to be STABLE: estate binds a label to a repo permanently
+ * (re-indexing under a second label is refused as a duplicate; re-using a label for a different repo
+ * is refused as a collision), so a label derived from anything mutable — the repo's display name,
+ * its root path, its position in the member list — would break the next refresh after a rename or a
+ * move. The registry id is the one identifier that is both stable and already unique per repo.
+ *
+ * Every repo id in the live registry today (`wicked-ledger`, `wicked-vault`, `pageindex-proof`, …)
+ * satisfies estate's rule as-is, so the common path is the identity function and the label IS the
+ * id. That is not guaranteed for ids minted later, so the fallback is real rather than theoretical:
+ * illegal characters collapse to `-`, the stem is capped, and a 12-hex digest of the FULL id is
+ * appended — the digest is what keeps `a/b` and `a:b` (which sanitize identically) apart, and what
+ * keeps a truncated 200-character id distinct from another that shares its first 51 characters.
+ *
+ * The mapping is a pure function of the id, which is what makes it safe against estate's permanent
+ * binding: the same repo resolves to the same label on every refresh, for the life of the graph.
+ */
+export function repoLabel(repoId) {
+    if (isValidRepoLabel(repoId))
+        return repoId;
+    const digest = createHash('sha256').update(repoId).digest('hex').slice(0, HASH_LEN);
+    const stem = repoId.replace(/[^A-Za-z0-9._-]/g, '-').slice(0, STEM_LEN);
+    return `${stem}-${digest}`;
+}
+/**
+ * Project ids are REJECTED, never sanitized.
+ *
+ * A sanitizing map is what would let two distinct project ids land in one directory and share one
+ * database — the same class of silent collision that made a multi-repo graph impossible in the first
+ * place, reintroduced at the project level. It is also the traversal guard: the id is a path
+ * segment, so `../../x` must never be spelled into a path. Engine-minted ids (`proj_1787…`) and the
+ * synthesized `default` both pass; anything that does not is a bug worth hearing about.
+ */
+export function assertProjectIdIsPathSafe(projectId) {
+    if (!isValidRepoLabel(projectId)) {
+        // Name the ACTUAL rule that rejected it (Copilot on #326). `.` and `..` match the stated
+        // character set, so a message quoting only the charset tells an operator their id is legal
+        // and rejected in the same breath — and sends them looking for an illegal character that
+        // is not there.
+        const why = projectId === '.' || projectId === '..'
+            ? `${JSON.stringify(projectId)} is a relative path segment, so it cannot name a directory`
+            : `expected 1-64 chars of [A-Za-z0-9._-]`;
+        throw new Error(`project id ${JSON.stringify(projectId)} cannot address a project graph directory: ${why}`);
+    }
+}
+/** The root every project graph directory hangs off. */
+export function projectGraphRoot(env = process.env) {
+    return env['WICKED_CREW_PROJECT_GRAPH_ROOT'] ?? join(homedir(), '.wicked-crew', 'project-graphs');
+}
+/** One project's graph directory — holds the database and the manifest that describes it. */
+export function projectGraphDir(projectId, env = process.env) {
+    assertProjectIdIsPathSafe(projectId);
+    return join(projectGraphRoot(env), projectId);
+}
+/** The ONE database holding every member repo of this project, co-located under their labels. */
+export function projectGraphDb(projectId, env = process.env) {
+    return join(projectGraphDir(projectId, env), 'code-graph.db');
+}
+/**
+ * What the last refresh put in that database, per repo — the record incremental refresh reads.
+ *
+ * Deliberately a SIDECAR rather than a read of estate's own `repo:<label>:commit` meta: estate
+ * exposes that only through `stats`, whose output is human text with no `--json`, and deciding
+ * whether to re-index a repo by regex-matching a report is the kind of coupling that breaks on a
+ * formatting change with no test to catch it.
+ */
+export function projectGraphManifest(projectId, env = process.env) {
+    return join(projectGraphDir(projectId, env), 'manifest.json');
+}
+//# sourceMappingURL=graph-paths.js.map

package/dist/projects/graph-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-paths.js","sourceRoot":"","sources":["../../src/projects/graph-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI;QACd,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxE,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,yFAAyF;QACzF,2FAA2F;QAC3F,yFAAyF;QACzF,gBAAgB;QAChB,MAAM,GAAG,GACP,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI;YACrC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,4DAA4D;YAC1F,CAAC,CAAC,uCAAuC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,8CAA8C,GAAG,EAAE,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,gCAAgC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;AACpG,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrF,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC1F,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;AAChE,CAAC"}