wicked-crew 0.7.24 → 0.7.26

package/dist/skills/tree.js

@@ -0,0 +1,645 @@
+/**
+ * File-tree primitives for the skills store: walk, hash, copy, remove — POSIX-relative paths,
+ * sorted, symlinks never followed.
+ *
+ * NO-FOLLOW EVERYWHERE (design v3 §API; codex review of #480). A plugin tree is copied INTO the
+ * daemon's root and later handed to worker spawns, so a link anywhere on a path the store reads or
+ * writes would turn "copy the plugin" into "copy whatever the link reaches" and "write this skill
+ * file" into "write wherever the link points". Therefore:
+ *
+ *   - `walkFiles` refuses a symlinked ROOT (the skill dir itself replaced by a link) and skips
+ *     symlink entries (never followed, never copied, never hashed); `walkTree` is the variant a
+ *     VERIFICATION uses — it ENUMERATES link entries with their link text (still never followed)
+ *     so an injected link cannot hide from `current`'s hash (codex round 5); a PRUNED directory
+ *     (`SKIP_DIR_NAMES`: `.venv`, `node_modules`, `__pycache__`) is descended for CLASSIFICATION
+ *     only — every entry beneath it is reported with its kind and marked `pruned`, and stays out of
+ *     every file, hash and copy view (codex round 10: a link under `effective/node_modules/` used
+ *     to be invisible to the validators because the walk stopped at the directory);
+ *   - `copyFiles` PREFLIGHTS every destination — each `rel` must be a safe relative path (no `..`,
+ *     `.`, empty or separator-carrying segment, no absolute/drive prefix, no NUL:
+ *     `assertSafeRelSegments`) and symlink-free (`assertNoSymlinkComponents`) — BEFORE it creates a
+ *     parent or writes a byte, independent of where the record came from (codex round 4: a
+ *     manifest-sourced skill name became a copilot-view path `views/…/<name>/SKILL.md`, and a
+ *     `../…` name would have joined out of the staging dir). A refused record writes NOTHING —
+ *     not the records ahead of it either;
+ *   - `writeFileAtomic` refuses a symlink at the target, opens its temp file with `O_EXCL`
+ *     (fails on ANY pre-existing entry, a pre-planted symlink included) and `O_NOFOLLOW` under an
+ *     unpredictable name, and preserves the target's mode bits (an executable support script
+ *     stays executable across an in-place edit or a replace).
+ *
+ * # TOCTOU discipline inside the skills root (design v3.5 §3; codex round 8)
+ *
+ * The lstat walk is necessary, not sufficient: every file open inside the root uses `O_NOFOLLOW`
+ * where the platform has it (`readFileNoFollow`, `copyFileNoFollow`, `writeFileAtomic`'s temp
+ * file), and the lstat-then-open pattern is closed EVERYWHERE — Windows has no `O_NOFOLLOW` — with a
+ * post-open identity check (`fstat` dev/ino against the lstat result: the entry opened IS the entry
+ * the walk judged); copies read their SOURCE through such an open, never by path
+ * (`copyFileSync(path)` follows a source swapped for a link between enumeration and copy); a staged
+ * tree is re-walked (lstat) and re-hashed AFTER the copy and BEFORE the rename into place
+ * (store.ts `stagedTreeProblem`, `captureBaseline`, `publishSerialized`). Residual, documented: a
+ * directory component swapped between the walk and the rename by another writer with access to the
+ * crew-owned state home — mitigated by the single-writer daemon and the post-operation verification,
+ * not eliminated.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, renameSync, rmdirSync, rmSync, unlinkSync, writeSync, } from 'node:fs';
+import { dirname, join, relative, sep } from 'node:path';
+import { ATOMIC_TMP_INFIX } from './root-names.js';
+/** `O_NOFOLLOW` where the platform has it (POSIX); `0` on Windows, where the post-open identity check alone closes the gap. */
+const O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+/**
+ * Directory names PRUNED from every file, hash and copy view (build caches, vendored deps, the
+ * per-baseline `uv sync` env): nothing beneath one is bundle content — never copied into a baseline
+ * or a generation, never hashed. The walk still DESCENDS them for classification (codex round 10),
+ * so a validator sees what such a directory holds (`TreeEntry.pruned`, `TreeListing.pruned`).
+ */
+export const SKIP_DIR_NAMES = new Set(['__pycache__', 'node_modules', '.venv']);
+/** File names never copied into the root (Finder noise). */
+export const SKIP_FILE_NAMES = new Set(['.DS_Store']);
+export function toPosix(p) {
+    return sep === '/' ? p : p.split(sep).join('/');
+}
+/** A path the store would have to FOLLOW a symlink to reach — refused, never judged lexically. */
+export class SymlinkComponentError extends Error {
+    path;
+    component;
+    constructor(path, component) {
+        super(`${path} crosses a symlink at ${component} — the skills root never follows links`);
+        this.path = path;
+        this.component = component;
+        this.name = 'SymlinkComponentError';
+    }
+}
+/** A relative path whose SHAPE could join out of its root (`..`, an absolute piece, a separator in a
+ *  segment, a NUL) — refused before any lstat, whatever produced it. */
+export class UnsafePathSegmentError extends Error {
+    path;
+    reason;
+    constructor(path, reason) {
+        super(`unsafe path ${JSON.stringify(path)}: ${reason} — the joined path must stay inside its root`);
+        this.path = path;
+        this.reason = reason;
+        this.name = 'UnsafePathSegmentError';
+    }
+}
+/**
+ * Why ONE path component is not a safe segment, or `null`. A segment may not be empty, `.` or `..`,
+ * may not carry a separator (`/` or `\`), a NUL, or a drive prefix (`C:`). The ONE rule every
+ * joined component in the store goes through (contain.ts, `copyFiles`, the view generator).
+ */
+export function unsafeSegmentReason(seg) {
+    if (seg === '' || seg === '.' || seg === '..')
+        return `segment ${JSON.stringify(seg)}`;
+    if (seg.includes('/') || seg.includes('\\'))
+        return `segment ${JSON.stringify(seg)} carries a separator`;
+    if (seg.includes('\0'))
+        return 'NUL byte';
+    if (/^[A-Za-z]:/.test(seg))
+        return `segment ${JSON.stringify(seg)} carries a drive prefix`;
+    return null;
+}
+/**
+ * Split a POSIX-relative path into segments, refusing anything that could escape: empty, absolute
+ * (`/…`), drive-prefixed, backslashes, NUL, and a `.` / `..` / empty segment. Throws
+ * `UnsafePathSegmentError`. Lexical only — the caller walks the result for symlinks.
+ */
+export function assertSafeRelSegments(rel) {
+    if (rel === '')
+        throw new UnsafePathSegmentError(rel, 'empty — the root itself is not a file');
+    if (rel.includes('\0'))
+        throw new UnsafePathSegmentError(rel, 'NUL byte');
+    if (rel.includes('\\'))
+        throw new UnsafePathSegmentError(rel, 'backslash — paths are POSIX');
+    if (rel.startsWith('/'))
+        throw new UnsafePathSegmentError(rel, 'absolute');
+    if (/^[A-Za-z]:/.test(rel))
+        throw new UnsafePathSegmentError(rel, 'drive prefix');
+    const segments = rel.split('/');
+    for (const seg of segments) {
+        const why = unsafeSegmentReason(seg);
+        if (why !== null)
+            throw new UnsafePathSegmentError(rel, why);
+    }
+    return segments;
+}
+/**
+ * `join(root, ...segments)` after an lstat walk that refuses a symlink at ANY component — the
+ * leaf included. A component that does not exist yet ends the walk (a not-yet-written leaf, or
+ * its new parent dirs — the write creates them); so does a component whose parent turned out to
+ * be a REGULAR FILE (ENOTDIR — nothing below a file exists, and no link can be crossed through
+ * one; whether the caller may write there is the caller's preflight, `containedDestinations`).
+ * Any other filesystem error propagates: an unreadable component is not judged lexically. `root`
+ * itself is not walked — the caller decides what its root is (the store walks from the SKILLS
+ * root down, so a skill dir replaced by a link is a component, not a root).
+ */
+export function assertNoSymlinkComponents(root, segments) {
+    // The walk joins each segment onto its parent, so a `..` (or a separator smuggled inside a
+    // segment) would climb out of `root` before any lstat ran — refused lexically first, whatever
+    // the caller already checked (codex round 4: `copyFiles` used to trust its records' shape).
+    for (const seg of segments) {
+        const why = unsafeSegmentReason(seg);
+        if (why !== null)
+            throw new UnsafePathSegmentError(segments.join('/'), why);
+    }
+    let cur = root;
+    for (const seg of segments) {
+        cur = join(cur, seg);
+        let st;
+        try {
+            st = lstatSync(cur);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                break;
+            throw err;
+        }
+        if (st.isSymbolicLink())
+            throw new SymlinkComponentError(segments.join('/'), seg);
+    }
+    return join(root, ...segments);
+}
+/**
+ * THE walker (design v3 no-follow everywhere; codex round 9 on #480): every entry under `root` —
+ * the root itself excluded — classified by lstat as a regular file, a directory, a symlink or
+ * something else (a socket, fifo, device …), sorted by `rel`, never following a link and never
+ * descending into one. NOTHING is invisible: an empty directory is an entry, a symlink is an entry
+ * with its link text, a special node is an entry of kind `other`. A directory named in
+ * `SKIP_DIR_NAMES` (`.venv`, `node_modules`, `__pycache__`) is reported AND descended (codex round
+ * 10): every entry beneath it is classified like any other and marked `pruned` with that
+ * directory's `rel`, so a validator SEES a link or a special node planted there — while the file,
+ * hash and copy views (`walkFiles`, `walkTree`'s `files` / `links` / `dirs` / `others`, and
+ * therefore `hashTree` and `copyFiles`) exclude the whole subtree exactly as before: nothing under
+ * a pruned directory is ever copied or hashed. `skipDir(rel)` is the caller's CLOSURE prune (the
+ * bundle walk drops `scripts/` dev tooling with it): content outside the closure is not reported
+ * and not descended — it is never reached, so never copied either. Every other view derives from
+ * this one. A missing `root` yields `[]` — callers treat optional plugin dirs (`schemas/`) as
+ * empty, not as errors; a `root` that IS a symlink is refused (`readdirSync` would follow it, and
+ * "list this skill's own files" must never enumerate a tree outside the store).
+ */
+export function walkEntries(root, skipDir) {
+    const out = [];
+    try {
+        if (lstatSync(root).isSymbolicLink())
+            throw new SymlinkComponentError(root, root);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return out;
+        throw err;
+    }
+    const visit = (dir, relDir, pruned) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            if (err.code === 'ENOENT' && relDir === '')
+                return;
+            throw err;
+        }
+        for (const entry of entries) {
+            const rel = relDir === '' ? entry.name : `${relDir}/${entry.name}`;
+            const abs = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                out.push({ rel, abs, kind: 'symlink', target: readlinkSync(abs), pruned });
+            }
+            else if (entry.isDirectory()) {
+                out.push({ rel, abs, kind: 'dir', pruned });
+                if (skipDir !== undefined && skipDir(rel))
+                    continue;
+                // A pruned-name directory is descended for CLASSIFICATION: its entries carry the outermost
+                // pruned directory's rel (a `node_modules` inside a `.venv` is still pruned by the `.venv`).
+                visit(abs, rel, pruned ?? (SKIP_DIR_NAMES.has(entry.name) ? rel : null));
+            }
+            else if (entry.isFile()) {
+                out.push({ rel, abs, kind: 'file', pruned });
+            }
+            else {
+                out.push({ rel, abs, kind: 'other', pruned });
+            }
+        }
+    };
+    visit(root, '', null);
+    out.sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+    return out;
+}
+/**
+ * Whether a walk entry is a regular file the store CARRIES — copies, hashes, records: a regular
+ * file outside every pruned directory that is not Finder noise (`SKIP_FILE_NAMES`).
+ */
+export function isCarriedFile(e) {
+    return e.kind === 'file' && e.pruned === null && !SKIP_FILE_NAMES.has(e.rel.split('/').pop() ?? '');
+}
+/**
+ * Every regular file under `root`, sorted by `rel` — `walkEntries` filtered to the files the store
+ * carries (`isCarriedFile`: nothing beneath a pruned directory, no Finder noise). `skipDir(rel)`
+ * prunes a subtree; `SKIP_DIR_NAMES` / `SKIP_FILE_NAMES` always apply.
+ */
+export function walkFiles(root, skipDir) {
+    return walkEntries(root, skipDir)
+        .filter(isCarriedFile)
+        .map(({ rel, abs }) => ({ rel, abs }));
+}
+/**
+ * `walkEntries` split into what a verification consumes: files (Finder noise excluded), links
+ * (listed with their text, never followed or descended — codex round 5: a verification that skips
+ * links leaves an injected outside-pointing link invisible to the hash), directories and special
+ * nodes — each of these OUTSIDE every pruned directory — plus `pruned`: what the pruned
+ * directories hold. `SKIP_DIR_NAMES` (`.venv` / `node_modules` / `__pycache__`) keeps the
+ * subtree out of `files` / `links` / `dirs` / `others` (so out of every hash and copy) exactly as
+ * before, but the subtree is now WALKED and reported under `pruned` (codex round 10); the
+ * pruned-name directory entry itself is in `dirs`; a LINK bearing one of those names is listed like
+ * any link (the snapshot's `.venv` link is exactly that). `skipDir(rel)` is the caller's closure
+ * prune (the bundle walk drops the `scripts/` dev tooling with it — content there is never reached,
+ * and never copied either).
+ */
+export function walkTree(root, skipDir) {
+    const entries = walkEntries(root, skipDir);
+    const carried = entries.filter((e) => e.pruned === null);
+    return {
+        files: carried.filter(isCarriedFile).map(({ rel, abs }) => ({ rel, abs })),
+        links: carried.filter((e) => e.kind === 'symlink').map(({ rel, abs, target }) => ({ rel, abs, target: target ?? '' })),
+        dirs: carried.filter((e) => e.kind === 'dir').map((e) => e.rel),
+        others: carried.filter((e) => e.kind === 'other'),
+        pruned: entries.filter((e) => e.pruned !== null),
+    };
+}
+/** Every proper ancestor directory a set of POSIX-relative file paths implies (`a/b/c.md` → `a`, `a/b`), sorted. */
+export function impliedDirs(rels) {
+    const out = new Set();
+    for (const rel of rels) {
+        const segments = rel.split('/');
+        for (let i = 1; i < segments.length; i += 1)
+            out.add(segments.slice(0, i).join('/'));
+    }
+    return [...out].sort();
+}
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/** The leaf changed identity between the lstat and the open (a link swapped in, a file replaced) — refused, never read or copied (v3.5 §3). */
+export class EntrySwappedError extends Error {
+    path;
+    constructor(path) {
+        super(`${path} is not the entry the walk judged — it changed between lstat and open (a symlink swapped in, or the file replaced); refused`);
+        this.path = path;
+        this.name = 'EntrySwappedError';
+    }
+}
+/**
+ * Open the REGULAR FILE at `path` for reading without following a symlink at the leaf (`O_NOFOLLOW`
+ * where available), and prove the opened descriptor IS the entry lstat saw (dev/ino equal, a regular
+ * file) — the Windows close of the lstat-then-open gap, applied everywhere (v3.5 §3). Throws
+ * `SymlinkComponentError` for a link at the leaf, `EntrySwappedError` when the identity moved, and
+ * the filesystem's own error otherwise (ENOENT propagates). Answers the descriptor and its stats.
+ */
+export function openRegularNoFollow(path) {
+    const before = lstatSync(path);
+    if (before.isSymbolicLink())
+        throw new SymlinkComponentError(path, path);
+    if (!before.isFile())
+        throw new EntrySwappedError(path);
+    let fd;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | O_NOFOLLOW);
+    }
+    catch (err) {
+        // ELOOP: a link stood there by the time we opened — the swap this discipline exists for.
+        if (err.code === 'ELOOP')
+            throw new EntrySwappedError(path);
+        throw err;
+    }
+    let stat;
+    try {
+        stat = fstatSync(fd);
+    }
+    catch (err) {
+        closeSync(fd);
+        throw err;
+    }
+    if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino) {
+        closeSync(fd);
+        throw new EntrySwappedError(path);
+    }
+    return { fd, stat };
+}
+/** The bytes of the regular file at `path`, read through an `O_NOFOLLOW` open with the identity check (`openRegularNoFollow`). */
+export function readFileNoFollow(path) {
+    const { fd } = openRegularNoFollow(path);
+    try {
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Copy one regular file `src` → `dest`: the source is read through `openRegularNoFollow` (never by
+ * path — a source swapped for a link between enumeration and copy is refused), the destination is
+ * created `O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW` with the source's mode bits (an executable
+ * baseline script lands executable), so a pre-planted destination entry — a link included — fails
+ * the open instead of being written through.
+ */
+export function copyFileNoFollow(src, dest) {
+    const { fd: inFd, stat } = openRegularNoFollow(src);
+    let buf;
+    try {
+        buf = readFileSync(inFd);
+    }
+    finally {
+        closeSync(inFd);
+    }
+    const outFd = openSync(dest, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | O_NOFOLLOW, stat.mode & 0o777);
+    try {
+        let off = 0;
+        while (off < buf.length)
+            off += writeSync(outFd, buf, off, buf.length - off);
+    }
+    catch (err) {
+        closeSync(outFd);
+        rmSync(dest, { force: true });
+        throw err;
+    }
+    closeSync(outFd);
+}
+/**
+ * One hash over a file set: sorted relative paths + content digests (`rel \0 sha256(content) \n`
+ * per file). Two trees with the same relative layout and bytes hash equal wherever they live —
+ * which is what lets a baseline snapshot and the effective copy be compared by hash alone.
+ */
+export function hashFileSet(files) {
+    return hashTree(files, []);
+}
+/**
+ * One hash over a file set, its symlink entries AND its directory entries: the files as
+ * `hashFileSet` spells them, then every link as `rel \0 -> \0 <link text> \n` (sorted), then every
+ * directory as `rel \0 dir \n` (sorted; codex round 9 — an extra EMPTY directory planted in a
+ * generation used to leave the hash unchanged). With no links and no directories this IS
+ * `hashFileSet`, so a bundle's identity hashes as before; a link added, removed or re-pointed, or a
+ * directory added or removed, changes the hash — which is what lets `current` verification refuse
+ * an injected link or directory (codex rounds 5, 9). Only `rel`s, digests and link TEXT enter the
+ * hash, never what a link reaches: two trees with the same layout, bytes and link texts hash equal
+ * wherever they live. Publish hashes the directories its file set IMPLIES (`impliedDirs`); a
+ * verification hashes the directories it WALKED — equal iff the generation carries no directory
+ * beyond those.
+ */
+export function hashTree(files, links, dirs = []) {
+    const h = createHash('sha256');
+    for (const f of [...files].sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0))) {
+        h.update(f.rel);
+        h.update('\0');
+        h.update(sha256Hex(readFileNoFollow(f.abs)));
+        h.update('\n');
+    }
+    for (const l of [...links].sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0))) {
+        h.update(l.rel);
+        h.update('\0->\0');
+        h.update(l.target);
+        h.update('\n');
+    }
+    for (const d of [...dirs].sort()) {
+        h.update(d);
+        h.update('\0dir\n');
+    }
+    return h.digest('hex');
+}
+/**
+ * Copy every record to `destRoot/<rel>`, creating parents. EVERY destination is preflighted
+ * first — the shape (`assertSafeRelSegments`: a `..`, an absolute or drive-prefixed piece, a
+ * separator inside a segment, a NUL is refused, whatever produced the record) and the walk
+ * (`assertNoSymlinkComponents`: a pre-planted link under the destination would redirect the
+ * copy) — and only then does the first byte move, so a refused record leaves NOTHING written
+ * (codex round 4: the per-record check used to run only when the record was reached, after the
+ * ones ahead of it had landed). Each file goes through `copyFileNoFollow` (v3.5 §3): the source is
+ * read through an `O_NOFOLLOW` open with the identity check — a source swapped for a symlink between
+ * enumeration and copy is refused — and the destination is created `O_EXCL | O_NOFOLLOW` with the
+ * source's mode bits, so an executable baseline script lands executable.
+ */
+export function copyFiles(files, destRoot) {
+    const plan = [];
+    for (const f of files) {
+        const dest = assertNoSymlinkComponents(destRoot, assertSafeRelSegments(f.rel));
+        plan.push({ src: f.abs, dest });
+    }
+    for (const { src, dest } of plan) {
+        mkdirSync(dirname(dest), { recursive: true });
+        copyFileNoFollow(src, dest);
+    }
+}
+/**
+ * Atomic write (tmp + rename), creating parents — the settings-store discipline, hardened:
+ *
+ *   - the target is lstat'ed: a symlink there is refused (the rename would replace the link,
+ *     but the caller's containment already forbids links, and a write "over" one is never what
+ *     the file manager meant);
+ *   - the temp file is opened `O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW`: POSIX fails that open on ANY existing
+ *     entry — a symlink included, regardless of where it points — so a pre-planted temp symlink
+ *     cannot redirect the bytes; the name carries 64 random bits so it cannot be pre-planted by
+ *     guessing either;
+ *   - the target's mode bits survive (an in-place edit of an executable support script keeps
+ *     it executable); a new file takes `opts.mode` or the platform default.
+ */
+export function writeFileAtomic(path, content, opts = {}) {
+    mkdirSync(dirname(path), { recursive: true });
+    let mode = opts.mode;
+    try {
+        const st = lstatSync(path);
+        if (st.isSymbolicLink())
+            throw new SymlinkComponentError(path, path);
+        if (st.isFile())
+            mode = st.mode & 0o777;
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    const tmp = `${path}${ATOMIC_TMP_INFIX}${randomBytes(8).toString('hex')}`;
+    const flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | O_NOFOLLOW;
+    const fd = mode === undefined ? openSync(tmp, flags) : openSync(tmp, flags, mode);
+    try {
+        const buf = typeof content === 'string' ? Buffer.from(content, 'utf8') : content;
+        let off = 0;
+        while (off < buf.length)
+            off += writeSync(fd, buf, off, buf.length - off);
+    }
+    catch (err) {
+        closeSync(fd);
+        rmSync(tmp, { force: true });
+        throw err;
+    }
+    closeSync(fd);
+    try {
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        rmSync(tmp, { force: true });
+        throw err;
+    }
+}
+/**
+ * Remove the records, then prune directories left empty between each file and `upTo`
+ * (exclusive). Never removes a non-empty directory — a nested skill living under a disabled
+ * parent's directory stays exactly where it is.
+ */
+export function removeFiles(files, upTo) {
+    for (const f of files)
+        rmSync(f.abs, { force: true });
+    for (const f of files)
+        pruneEmptyDirs(dirname(f.abs), upTo);
+}
+/** Remove `dir` and its ancestors while they are empty, stopping at `upTo` (which is kept). */
+export function pruneEmptyDirs(dir, upTo) {
+    let cur = dir;
+    for (;;) {
+        const rel = relative(upTo, cur);
+        if (rel === '' || rel.startsWith('..'))
+            return;
+        try {
+            rmdirSync(cur); // ENOTEMPTY / ENOENT both end the climb
+        }
+        catch {
+            return;
+        }
+        cur = dirname(cur);
+    }
+}
+function isEnoent(err) {
+    return err.code === 'ENOENT';
+}
+/**
+ * Every directory under `root` (root included, deepest first), symlinks never followed. `strict`
+ * propagates every error but ENOENT (an entry that vanished mid-walk); the lenient mode (the
+ * force-remove's) skips what it cannot list — `rmSync` reports what matters there.
+ */
+function directoriesUnder(root, strict) {
+    const out = [];
+    const visit = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            if (strict && !isEnoent(err))
+                throw err;
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isSymbolicLink() || !entry.isDirectory())
+                continue;
+            visit(join(dir, entry.name));
+        }
+        out.push(dir);
+    };
+    try {
+        if (!lstatSync(root).isDirectory())
+            return out;
+    }
+    catch (err) {
+        if (strict && !isEnoent(err))
+            throw err;
+        return out;
+    }
+    visit(root);
+    return out;
+}
+const WRITE_BITS = 0o222;
+/**
+ * Strip the write bits from every directory and file under `root` — the shared per-baseline
+ * `.venv` is read-only by contract (design v3 §4): a worker's `uv run` from a snapshot must not
+ * install into, or remove from, an env every other snapshot links; a published snapshot is locked
+ * the same way (immutable by contract, verified by hash). Files first, then directories (deepest
+ * first), so the walk never has to re-open a directory it already closed. A permission failure
+ * PROPAGATES (codex round 2 on #480: "silently swallows permission failures while claiming to
+ * lock") — a tree this cannot lock is not locked, and the caller decides what that means (the
+ * store treats an unlockable env as a failed provisioning, blocking the publish). Only an entry
+ * that vanished mid-walk (ENOENT) is tolerated. A no-op on platforms without POSIX modes.
+ */
+export function makeTreeReadOnly(root) {
+    if (process.platform === 'win32')
+        return;
+    for (const dir of directoriesUnder(root, true)) {
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            if (isEnoent(err))
+                continue;
+            throw err;
+        }
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const p = join(dir, entry.name);
+            try {
+                chmodSync(p, lstatSync(p).mode & 0o777 & ~WRITE_BITS);
+            }
+            catch (err) {
+                if (!isEnoent(err))
+                    throw err;
+            }
+        }
+        try {
+            chmodSync(dir, lstatSync(dir).mode & 0o777 & ~WRITE_BITS);
+        }
+        catch (err) {
+            if (!isEnoent(err))
+                throw err;
+        }
+    }
+}
+/**
+ * `rmSync(root, { recursive: true, force: true })` that also removes a tree `makeTreeReadOnly`
+ * locked — OR a partial env whose lock FAILED, which can leave an UNLISTABLE directory (a `uv sync`
+ * that produced a `0o000`/`0o111` dir the lock choked on; codex round 3). Each directory has its
+ * owner `rwx` restored TOP-DOWN, before it is enumerated, so an unlistable dir becomes traversable
+ * and removable (unlinking an entry needs a writable, listable parent, whatever the entry's own
+ * mode). A missing root is a no-op.
+ */
+export function removeTreeForce(root) {
+    restoreDirPermsTopDown(root);
+    rmSync(root, { recursive: true, force: true });
+}
+/** Give every directory under `dir` (`dir` included, symlinks never followed) owner `rwx` — restored
+ *  before the dir is read, so even a `0o000` directory can be enumerated and removed. Best-effort. */
+function restoreDirPermsTopDown(dir) {
+    let st;
+    try {
+        st = lstatSync(dir);
+    }
+    catch {
+        return; // gone already
+    }
+    if (st.isSymbolicLink() || !st.isDirectory())
+        return;
+    try {
+        chmodSync(dir, (st.mode & 0o777) | 0o700);
+    }
+    catch {
+        /* not ours to chmod — rmSync below reports what matters */
+    }
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return; // still unreadable (not ours) — rmSync reports it
+    }
+    for (const entry of entries) {
+        if (entry.isSymbolicLink() || !entry.isDirectory())
+            continue;
+        restoreDirPermsTopDown(join(dir, entry.name));
+    }
+}
+/** Unlink one path without following it (a link is removed, its target untouched). */
+export function unlinkNoFollow(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}
+//# sourceMappingURL=tree.js.map

package/dist/skills/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/skills/tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,MAAM,EACN,UAAU,EACV,SAAS,GAEV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,+HAA+H;AAC/H,MAAM,UAAU,GAAY,WAAuC,CAAC,UAAU,IAAI,CAAC,CAAC;AAQpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AACrG,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAE3E,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,IAAY,EACZ,SAAiB;QAE1B,KAAK,CAAC,GAAG,IAAI,yBAAyB,SAAS,wCAAwC,CAAC,CAAC;QAHhF,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAQ;QAG1B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;wEACwE;AACxE,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,IAAY,EACZ,MAAc;QAEvB,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,8CAA8C,CAAC,CAAC;QAH3F,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACvF,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACzG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1C,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3E,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,QAA+B;IACrF,2FAA2F;IAC3F,8FAA8F;IAC9F,4FAA4F;IAC5F,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM;YACnD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AACjC,CAAC;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAkC;IAC1E,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACjE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,MAAqB,EAAQ,EAAE;QACzE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO;YAC9E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpD,2FAA2F;gBAC3F,6FAA6F;gBAC7F,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAY;IACxC,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAkC;IACxE,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;SAC9B,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AA6BD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAkC;IACvE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACzD,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACtH,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,WAAW,CAAC,IAAsB;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,+IAA+I;AAC/I,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,GAAG,IAAI,6HAA6H,CAAC,CAAC;QADzH,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACzE,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,UAAU,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAC9H,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM;YAAE,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAgC,EAChC,KAAwD,EACxD,OAA8B,EAAE;IAEhC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAgC,EAAE,QAAgB;IAC1E,MAAM,IAAI,GAAyC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAwB,EAAE,OAA2B,EAAE;IACnG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,MAAM,EAAE;YAAE,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC;IAC3F,MAAM,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjF,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM;YAAE,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC,EAAE,IAAY;IACxE,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAY;IACtD,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/C,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,wCAAwC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAQ,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAe;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC7D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,GAAG,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;sGACsG;AACtG,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,eAAe;IACzB,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO;IACrD,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,kDAAkD;IAC5D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QAC7D,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}