@adea-ai/plugins 3.0.10 → 4.0.1

package/src/write-artifacts.test.ts

@@ -0,0 +1,375 @@
+import { spawnSync } from 'node:child_process'
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  symlink,
+  utimes,
+  writeFile,
+} from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, test } from 'bun:test'
+import {
+  catalogFingerprint,
+  withCatalogRead,
+  writeArtifacts,
+  type GeneratedArtifacts,
+  type PublicationStep,
+} from './index.js'
+import { catalogPathsIn } from './catalog-store.js'
+
+const artifacts = (name: string) =>
+  ({ 'catalog.v1.json': name, 'integrity.json': name }) as GeneratedArtifacts
+
+const child = fileURLToPath(new URL('../test-support/catalog-writer-child.ts', import.meta.url))
+
+/** Runs a writer in its own process, optionally with its own TMPDIR. */
+function runWriter(
+  output: string,
+  content: string,
+  crashAt: PublicationStep | 'none',
+  options: { waitMs?: number; tmp?: string } = {}
+) {
+  const result = spawnSync(
+    process.execPath,
+    [
+      child,
+      output,
+      content,
+      crashAt,
+      ...(options.waitMs === undefined ? [] : [String(options.waitMs)]),
+    ],
+    {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ...(options.tmp ? { TMPDIR: options.tmp, TMP: options.tmp, TEMP: options.tmp } : {}),
+      },
+    }
+  )
+  // Windows reports a forced termination as an exit status, not a signal.
+  const killed =
+    result.signal === 'SIGKILL' || (process.platform === 'win32' && result.status !== 0)
+  return { stdout: result.stdout.trim(), stderr: result.stderr, killed }
+}
+
+/** A promise the test resolves to let a paused writer continue. */
+function gate() {
+  let open!: () => void
+  const opened = new Promise<void>((resolve) => {
+    open = resolve
+  })
+  return { open, opened }
+}
+
+async function withParent(run: (parent: string) => Promise<void>) {
+  const parent = await mkdtemp(join(tmpdir(), 'catalog-writers-'))
+  try {
+    await run(parent)
+  } finally {
+    await rm(parent, { recursive: true, force: true })
+  }
+}
+
+const read = (output: string) => readFile(join(output, 'catalog.v1.json'), 'utf8')
+/** Coordination leftovers beside an output; a settled output has none. */
+const leftovers = async (parent: string) =>
+  (await readdir(parent)).filter(
+    (name) => name.startsWith('.catalog-') || name.endsWith('.previous')
+  )
+
+describe('writer coordination', () => {
+  test('writers with different temporary directories exclude each other', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('first'))
+      const otherTmp = join(parent, 'other-tmp')
+      await mkdir(otherTmp)
+      const paused = gate()
+      const reached = gate()
+      const holder = writeArtifacts(output, artifacts('holder'), {
+        onStep: async (step) => {
+          if (step !== 'staged') return
+          reached.open()
+          await paused.opened
+        },
+      })
+      await reached.opened
+      // The diagnosed race: the lock lived in TMPDIR, so a writer with another
+      // TMPDIR took its own lock and swapped concurrently. Both in-process and
+      // as a separate process with its own TMPDIR, the second writer now meets
+      // the first writer's lock.
+      const previousTmp = process.env.TMPDIR
+      process.env.TMPDIR = otherTmp
+      try {
+        await expect(writeArtifacts(output, artifacts('intruder'), { waitMs: 0 })).rejects.toThrow(
+          'CATALOG_WRITE_IN_PROGRESS'
+        )
+      } finally {
+        if (previousTmp === undefined) delete process.env.TMPDIR
+        else process.env.TMPDIR = previousTmp
+      }
+      const separate = runWriter(output, 'separate', 'none', { waitMs: 0, tmp: otherTmp })
+      expect(separate.stdout).toContain('CATALOG_WRITE_IN_PROGRESS')
+      expect(await read(output)).toBe('first')
+      paused.open()
+      await holder
+      expect(await read(output)).toBe('holder')
+      expect(await readdir(otherTmp)).toEqual([])
+      expect(await leftovers(parent)).toEqual([])
+    }))
+
+  test('a waiting writer publishes after the holder, never in between', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      const steps: string[] = []
+      const paused = gate()
+      const reached = gate()
+      const first = writeArtifacts(output, artifacts('first'), {
+        onStep: async (step) => {
+          steps.push(`first:${step}`)
+          if (step !== 'backed-up') return
+          reached.open()
+          await paused.opened
+        },
+      })
+      await reached.opened
+      const contending = gate()
+      const second = writeArtifacts(output, artifacts('second'), {
+        pollMs: 1,
+        onStep: (step) => {
+          steps.push(`second:${step}`)
+          if (step === 'acquiring') contending.open()
+        },
+      })
+      await contending.opened
+      // Let the second writer poll the held lock a few times.
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      paused.open()
+      await Promise.all([first, second])
+      expect(steps).toEqual([
+        'first:acquiring',
+        'first:staged',
+        'first:backed-up',
+        'second:acquiring',
+        'first:swapped',
+        'first:cleaned',
+        'second:staged',
+        'second:backed-up',
+        'second:swapped',
+        'second:cleaned',
+      ])
+      expect(await read(output)).toBe('second')
+      expect(await leftovers(parent)).toEqual([])
+    }))
+
+  test('outputs that differ only in case share one lock', () => {
+    expect(catalogPathsIn('/x', 'Generated').lock).toBe(catalogPathsIn('/x', 'generated').lock)
+    expect(catalogPathsIn('/x', 'generated').lock).not.toBe(catalogPathsIn('/x', 'other').lock)
+    expect(
+      catalogPathsIn('/x', 'generated').lock.startsWith(join('/x', '.catalog-generated-'))
+    ).toBe(true)
+  })
+})
+
+describe('publication against a read snapshot', () => {
+  test('refuses to overwrite a catalog replaced after the base was read', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('base'))
+      // The diagnosed race: a scoped sync validated the output and read its
+      // lock, another writer replaced the catalog, and the sync then published
+      // over it. The base read and the publication now compare fingerprints.
+      const base = await withCatalogRead(output, () => catalogFingerprint(output))
+      await writeArtifacts(output, artifacts('concurrent'))
+      await expect(
+        writeArtifacts(output, artifacts('stale'), { expectedBase: base })
+      ).rejects.toThrow('CATALOG_BASE_CHANGED')
+      expect(await read(output)).toBe('concurrent')
+      const fresh = await withCatalogRead(output, () => catalogFingerprint(output))
+      await writeArtifacts(output, artifacts('rebased'), { expectedBase: fresh })
+      expect(await read(output)).toBe('rebased')
+      expect(await leftovers(parent)).toEqual([])
+    }))
+
+  test('an absent output is a base, and a first publication must still find it absent', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      const base = await withCatalogRead(output, () => catalogFingerprint(output))
+      expect(base).toBe('absent')
+      await writeArtifacts(output, artifacts('other'))
+      await expect(
+        writeArtifacts(output, artifacts('mine'), { expectedBase: base })
+      ).rejects.toThrow('CATALOG_BASE_CHANGED')
+      expect(await read(output)).toBe('other')
+    }))
+
+  test('a coordinated reader never observes the swap window', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('old'))
+      const paused = gate()
+      const reached = gate()
+      const writer = writeArtifacts(output, artifacts('new'), {
+        onStep: async (step) => {
+          if (step !== 'backed-up') return
+          reached.open()
+          await paused.opened
+        },
+      })
+      await reached.opened
+      // Between the renames the output does not exist on disk.
+      await expect(read(output)).rejects.toThrow()
+      const reader = withCatalogRead(output, () => read(output), { pollMs: 1 })
+      await new Promise((resolve) => setTimeout(resolve, 10))
+      paused.open()
+      expect(await reader).toBe('new')
+      await writer
+    }))
+})
+
+describe('crash recovery', () => {
+  const cases: readonly { step: PublicationStep; expected: string }[] = [
+    { step: 'staged', expected: 'old' },
+    { step: 'backed-up', expected: 'old' },
+    { step: 'swapped', expected: 'new' },
+    { step: 'cleaned', expected: 'new' },
+  ]
+  for (const { step, expected } of cases) {
+    test(`a writer killed after "${step}" is ${expected === 'old' ? 'rolled back' : 'completed'} by the next reader`, () =>
+      withParent(async (parent) => {
+        const output = join(parent, 'generated')
+        await writeArtifacts(output, artifacts('old'))
+        const crashed = runWriter(output, 'new', step)
+        expect(crashed.killed).toBe(true)
+        expect(crashed.stdout).toBe('')
+        // The killed process left its lock behind; its holder is gone.
+        expect((await readdir(parent)).some((name) => name.endsWith('.lock'))).toBe(true)
+        expect(await withCatalogRead(output, () => read(output), { waitMs: 0 })).toBe(expected)
+        expect(await leftovers(parent)).toEqual([])
+        await writeArtifacts(output, artifacts('after'), { waitMs: 0 })
+        expect(await read(output)).toBe('after')
+      }))
+  }
+
+  test('a writer killed during a first publication leaves no output and no residue', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      expect(runWriter(output, 'new', 'staged').killed).toBe(true)
+      await writeArtifacts(output, artifacts('next'), { waitMs: 0 })
+      expect(await read(output)).toBe('next')
+      expect(await leftovers(parent)).toEqual([])
+    }))
+
+  test('a holder on another host is broken only after its heartbeat lease expires', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('old'))
+      const { lock, owner } = catalogPathsIn(parent, 'generated')
+      await mkdir(lock)
+      await writeFile(owner, JSON.stringify({ token: 'remote', pid: 1, host: 'elsewhere.invalid' }))
+      await expect(
+        writeArtifacts(output, artifacts('blocked'), { waitMs: 0, staleAfterMs: 60_000 })
+      ).rejects.toThrow(/CATALOG_WRITE_IN_PROGRESS: .*pid 1 on elsewhere\.invalid/)
+      const old = new Date(Date.now() - 120_000)
+      await utimes(owner, old, old)
+      await writeArtifacts(output, artifacts('new'), { waitMs: 0, staleAfterMs: 60_000 })
+      expect(await read(output)).toBe('new')
+      expect(await leftovers(parent)).toEqual([])
+    }))
+
+  test('a holder that lost its lock refuses to swap', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('old'))
+      const { lock, owner } = catalogPathsIn(parent, 'generated')
+      const writer = writeArtifacts(output, artifacts('late'), {
+        onStep: async (step) => {
+          if (step !== 'staged') return
+          // Another contender judged this holder stale and took the lock.
+          await rename(lock, `${lock}.taken`)
+          await mkdir(lock)
+          await writeFile(owner, JSON.stringify({ token: 'other', pid: process.pid, host: 'x' }))
+        },
+      })
+      await expect(writer).rejects.toThrow('CATALOG_LOCK_LOST')
+      expect(await read(output)).toBe('old')
+      expect(JSON.parse(await readFile(owner, 'utf8')).token).toBe('other')
+    }))
+
+  test('preserves a backup whose provenance is unknown', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await mkdir(output)
+      await writeFile(join(output, 'catalog.v1.json'), 'current')
+      await mkdir(`${output}.previous`)
+      await writeFile(join(`${output}.previous`, 'recovery'), 'saved')
+      await expect(writeArtifacts(output, artifacts('blocked'))).rejects.toThrow(
+        'CATALOG_RECOVERY_REQUIRED'
+      )
+      expect(await readFile(join(`${output}.previous`, 'recovery'), 'utf8')).toBe('saved')
+      expect(await read(output)).toBe('current')
+      expect(await withCatalogRead(output, () => read(output))).toBe('current')
+      expect(await readFile(join(`${output}.previous`, 'recovery'), 'utf8')).toBe('saved')
+    }))
+
+  test('a failed write keeps the previous catalog and releases the lock', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      await writeArtifacts(output, artifacts('previous'))
+      await expect(
+        writeArtifacts(output, { ...artifacts('broken'), 'missing/file': 'bad' })
+      ).rejects.toThrow('CATALOG_ARTIFACT_NAME_INVALID')
+      await expect(
+        writeArtifacts(output, artifacts('broken'), {
+          onStep: (step) => {
+            if (step === 'backed-up') throw new Error('injected failure')
+          },
+        })
+      ).rejects.toThrow('injected failure')
+      expect(await read(output)).toBe('previous')
+      expect(await leftovers(parent)).toEqual([])
+      await writeArtifacts(output, artifacts('later'), { waitMs: 0 })
+      expect(await read(output)).toBe('later')
+    }))
+})
+
+describe('reserved paths', () => {
+  test('refuses outputs inside coordination files or backups', () =>
+    withParent(async (parent) => {
+      const output = join(parent, 'generated')
+      const { lock } = catalogPathsIn(parent, 'generated')
+      for (const destination of [lock, `${output}.previous`, join(`${output}.previous`, 'x')])
+        await expect(writeArtifacts(destination, artifacts('blocked'))).rejects.toThrow(
+          'CATALOG_WRITE_LOCK_RESERVED'
+        )
+      await mkdir(lock)
+      const alias = join(parent, 'lock-alias')
+      await symlink(lock, alias, 'dir')
+      await expect(writeArtifacts(join(alias, 'nested'), artifacts('blocked'))).rejects.toThrow(
+        'CATALOG_WRITE_LOCK_RESERVED'
+      )
+      await rm(lock, { recursive: true })
+      // A backup can still be read by hand, without coordination.
+      await mkdir(`${output}.previous`)
+      await writeFile(join(`${output}.previous`, 'catalog.v1.json'), 'saved')
+      expect(await withCatalogRead(`${output}.previous`, () => read(`${output}.previous`))).toBe(
+        'saved'
+      )
+    }))
+
+  test('preserves filesystem semantics for a symlink followed by dot dot', () =>
+    withParent(async (parent) => {
+      const real = join(parent, 'real')
+      await mkdir(join(real, 'child'), { recursive: true })
+      await symlink(join(real, 'child'), join(parent, 'link'), 'dir')
+      await writeArtifacts(`${parent}/link/../generated`, artifacts('real target'))
+      expect(await read(join(real, 'generated'))).toBe('real target')
+      await expect(read(join(parent, 'generated'))).rejects.toThrow()
+    }))
+})

package/dist/agent-plugins-harness.d.ts

@@ -1,54 +0,0 @@
-import { type HarnessProfile, type McpServer, type InstallationPlan } from './agent-plugins-schema.js';
-import type { Catalog } from './schema.js';
-export interface InstallationInput {
-    readonly pluginId: string;
-    readonly releaseId: string;
-    readonly instanceId: string;
-    readonly source: InstallationPlan['source'];
-    readonly package: unknown;
-    readonly profile: HarnessProfile;
-    readonly requiredCredentials?: readonly string[];
-    readonly requiredConnectors?: readonly string[];
-    readonly allowPartial?: boolean;
-}
-export interface CatalogInstallationInput {
-    readonly catalog: Catalog;
-    readonly pluginId: string;
-    readonly releaseId?: string;
-    readonly instanceId: string;
-    readonly profile: HarnessProfile;
-    readonly allowPartial?: boolean;
-}
-/** Resolve the exact catalog release before planning. The caller must also authenticate
- * the catalog publisher and verify its artifact integrity before invoking this API.
- */
-export declare function createCatalogInstallationPlan(input: CatalogInstallationInput): InstallationPlan;
-/** A declarative proposal, never an execution grant. No brand-based support assumptions. */
-export declare function createInstallationPlan(input: InstallationInput): InstallationPlan;
-export interface RuntimeRoots {
-    readonly pluginRoot: string;
-    readonly pluginData: string;
-}
-/** Exact, single-pass expansion. Replacement text is never scanned recursively. */
-export declare function expandPluginPaths(value: string, roots: RuntimeRoots): string;
-export type McpBinding = {
-    type: 'stdio';
-    command: string;
-    args: string[];
-    cwd: string;
-    env: Record<string, string>;
-    shell: false;
-} | {
-    type: 'streamable-http' | 'sse';
-    url: string;
-    headers: Record<string, string>;
-    redirectPolicy: 'same-origin';
-    authorization: 'control-plane';
-};
-/** Produce concrete Control Plane launch/connect descriptors, without launching or connecting. */
-export declare function resolveMcpBinding(input: McpServer, roots: RuntimeRoots, baseEnv?: Readonly<Record<string, string>>, platform?: 'posix' | 'win32'): McpBinding;
-/** Mandatory filesystem preflight for Control Plane callers after safe materialization.
- * Call immediately before activation inside the same protected installation boundary;
- * a separate preflight is not a substitute for preventing concurrent filesystem mutation.
- */
-export declare function verifyBindingPaths(input: McpServer, roots: RuntimeRoots): Promise<void>;

package/dist/agent-plugins-harness.js

@@ -1,212 +0,0 @@
-import { isAbsolute, resolve, relative, sep } from 'node:path';
-import { realpath } from 'node:fs/promises';
-import { createHash } from 'node:crypto';
-import { HarnessProfileSchema, InstallationPlanSchema, } from './agent-plugins-schema.js';
-import { verifyPortableCatalog, PACKAGE_METADATA_KEY } from './portable-catalog.js';
-import { verifyAgentPackage, validateServer } from './agent-plugins-catalog.js';
-/** Resolve the exact catalog release before planning. The caller must also authenticate
- * the catalog publisher and verify its artifact integrity before invoking this API.
- */
-export function createCatalogInstallationPlan(input) {
-    verifyPortableCatalog(input.catalog);
-    const plugin = input.catalog.plugins.find((entry) => entry.pluginId === input.pluginId);
-    if (!plugin)
-        throw new Error(`PLUGIN_NOT_FOUND: ${input.pluginId}`);
-    const release = plugin.availableReleases.find((entry) => entry.releaseId === (input.releaseId ?? plugin.currentReleaseId));
-    if (!release)
-        throw new Error('RELEASE_NOT_FOUND');
-    if (release.contentResolution !== 'complete')
-        throw new Error('COMPLETE_SOURCE_REQUIRED');
-    const pkg = release.releaseMetadata[PACKAGE_METADATA_KEY];
-    if (pkg === undefined)
-        throw new Error('PORTABLE_RESYNC_REQUIRED: run a full catalog sync before planning portable installation');
-    return createInstallationPlan({
-        pluginId: plugin.pluginId,
-        releaseId: release.releaseId,
-        instanceId: input.instanceId,
-        profile: input.profile,
-        package: pkg,
-        allowPartial: input.allowPartial === true,
-        source: {
-            repositoryUrl: release.resolvedRepositoryUrl,
-            commitSha: release.resolvedCommitSha,
-            pluginSubdirectory: release.pluginSubdirectory,
-            contentDigest: release.canonicalContentDigest,
-        },
-        requiredCredentials: release.requiredCredentials,
-        requiredConnectors: release.requiredConnectors,
-    });
-}
-function identity(...parts) {
-    return createHash('sha256').update(JSON.stringify(parts)).digest('hex');
-}
-/** A declarative proposal, never an execution grant. No brand-based support assumptions. */
-export function createInstallationPlan(input) {
-    const profile = HarnessProfileSchema.parse(input.profile);
-    const pkg = verifyAgentPackage(input.package);
-    if (pkg.sourceDigest !== input.source.contentDigest)
-        throw new Error('Package recipe does not match the selected immutable release.');
-    if (!input.instanceId || input.instanceId.length > 256)
-        throw new Error('A stable installation instanceId is required.');
-    const disabled = [];
-    for (const item of pkg.nonPortable)
-        disabled.push({ component: item.kind, reason: item.reason });
-    for (const item of pkg.diagnostics.filter((entry) => entry.severity === 'error'))
-        disabled.push({ component: item.path, reason: item.message });
-    const nativeEligible = profile.agentPlugins.versions.includes(pkg.specVersion) &&
-        pkg.nonPortable.length === 0 &&
-        !Object.keys(pkg.manifest?.extensions ?? {}).length;
-    const nativeCoverage = (profile.agentPlugins.skills ? pkg.skills.length : 0) +
-        Object.values(pkg.mcpServers).filter((server) => profile.agentPlugins.mcpTransports.includes(server.type)).length;
-    const adapterCoverage = (profile.components.skillDirectories ? pkg.skills.length : 0) +
-        Object.values(pkg.mcpServers).filter((server) => profile.components.mcpTransports.includes(server.type)).length;
-    const native = nativeEligible && nativeCoverage > 0 && nativeCoverage >= adapterCoverage;
-    const strategy = pkg.status === 'unavailable'
-        ? 'unavailable'
-        : native
-            ? 'native-agent-plugin'
-            : 'component-adapter';
-    let skillDirectories = [];
-    const servers = new Map();
-    if (strategy !== 'unavailable') {
-        if (native ? profile.agentPlugins.skills : profile.components.skillDirectories)
-            skillDirectories = pkg.skills.map((skill) => skill.path);
-        else
-            for (const skill of pkg.skills)
-                disabled.push({
-                    component: `skill:${skill.name}`,
-                    reason: 'The selected adapter cannot expose skill directories.',
-                });
-        for (const [name, server] of Object.entries(pkg.mcpServers)) {
-            if ((native ? profile.agentPlugins.mcpTransports : profile.components.mcpTransports).includes(server.type))
-                servers.set(name, server);
-            else
-                disabled.push({
-                    component: `mcp:${name}`,
-                    reason: `No ${server.type} MCP binding on this harness adapter.`,
-                });
-        }
-    }
-    const hasContent = skillDirectories.length > 0 || servers.size > 0;
-    const compatibility = !hasContent ? 'unsupported' : disabled.length > 0 ? 'partial' : 'full';
-    const selectedStrategy = !hasContent || (compatibility === 'partial' && !input.allowPartial) ? 'unavailable' : strategy;
-    return InstallationPlanSchema.parse({
-        planVersion: 2,
-        pluginId: input.pluginId,
-        releaseId: input.releaseId,
-        instanceId: input.instanceId,
-        profile,
-        source: input.source,
-        package: pkg,
-        // Git source identity also pins executable modes, which the v1 byte snapshot omits.
-        packageKey: pkg.packageDigest
-            ? `packages/${identity(input.source.repositoryUrl, input.source.commitSha, input.source.pluginSubdirectory, pkg.packageDigest)}`
-            : '',
-        // Deliberately excludes release, package digest and harness. Switching harnesses or updating
-        // the same approved instance preserves data; distinct scopes use distinct instance IDs.
-        dataKey: `instances/${identity(input.pluginId, input.instanceId)}`,
-        preserveDataAcrossUpdates: true,
-        strategy: selectedStrategy,
-        compatibility,
-        allowedToActivate: false,
-        approvalRequired: true,
-        selection: selectedStrategy === 'unavailable'
-            ? { skillDirectories: [], mcpServers: {} }
-            : { skillDirectories, mcpServers: Object.fromEntries(servers) },
-        disabled,
-        requiredCredentials: [...(input.requiredCredentials ?? [])],
-        requiredConnectors: [...(input.requiredConnectors ?? [])],
-        preconditions: [
-            'Verify catalog integrity/provenance and exact source digest before applying the package recipe.',
-            'Use an immutable package root; preserve source file modes and complete skill directories/resources.',
-            'Create a writable data directory for this instance; never key it by release or copy credentials between instances.',
-            'Control Plane must authorize activation, filesystem/network access, executables and credential bindings.',
-            'Recheck the actual harness/runtime/adapter profile and realpath containment immediately before activation.',
-            'Native mode registers exactly one package root. Component mode registers only the selected skill directories and MCP bindings, never legacy hooks/config files.',
-            'Do not install dependencies or run lifecycle scripts implicitly; review required executables and skill compatibility requirements.',
-            'Skill allowed-tools metadata is advisory and never grants permission.',
-            'Namespace registrations by installation identity; detect skill/server name collisions instead of overwriting existing harness configuration.',
-            'Remote authorization is client-managed. Do not expand remote URLs/headers or forward configured headers to another origin without authorization.',
-        ],
-    });
-}
-/** Exact, single-pass expansion. Replacement text is never scanned recursively. */
-export function expandPluginPaths(value, roots) {
-    return value.replace(/\$\{(PLUGIN_ROOT|PLUGIN_DATA)\}/g, (_match, name) => name === 'PLUGIN_ROOT' ? roots.pluginRoot : roots.pluginData);
-}
-function within(path, root) {
-    const suffix = relative(root, path);
-    return suffix === '' || (suffix !== '..' && !suffix.startsWith(`..${sep}`) && !isAbsolute(suffix));
-}
-/** Produce concrete Control Plane launch/connect descriptors, without launching or connecting. */
-export function resolveMcpBinding(input, roots, baseEnv = {}, platform = process.platform === 'win32' ? 'win32' : 'posix') {
-    const server = validateServer(input);
-    if (!isAbsolute(roots.pluginRoot) || !isAbsolute(roots.pluginData))
-        throw new Error('Runtime plugin roots must be absolute paths.');
-    if (server.type !== 'stdio')
-        return {
-            type: server.type,
-            url: server.url,
-            headers: { ...server.headers },
-            redirectPolicy: 'same-origin',
-            authorization: 'control-plane',
-        };
-    const command = server.command.startsWith('./')
-        ? resolve(roots.pluginRoot, server.command)
-        : server.command;
-    if (server.command.startsWith('./') && !within(command, roots.pluginRoot))
-        throw new Error('Executable escapes the plugin root.');
-    const cwdInput = server.cwd ?? '${PLUGIN_ROOT}';
-    const cwdRoot = cwdInput.startsWith('${PLUGIN_DATA}') ? roots.pluginData : roots.pluginRoot;
-    const expanded = expandPluginPaths(cwdInput, roots);
-    const cwd = resolve(roots.pluginRoot, expanded);
-    if (!within(cwd, cwdRoot))
-        throw new Error('Working directory escapes its declared root.');
-    const env = {};
-    const overlay = (name, value) => {
-        if (platform === 'win32')
-            for (const existing of Object.keys(env))
-                if (existing.toUpperCase() === name.toUpperCase())
-                    delete env[existing];
-        Object.defineProperty(env, name, {
-            value,
-            enumerable: true,
-            configurable: true,
-            writable: true,
-        });
-    };
-    for (const [key, value] of Object.entries(baseEnv))
-        overlay(key, value);
-    for (const [key, value] of Object.entries(server.env ?? {}))
-        overlay(key, expandPluginPaths(value, roots));
-    overlay('PLUGIN_ROOT', roots.pluginRoot);
-    overlay('PLUGIN_DATA', roots.pluginData);
-    return {
-        type: 'stdio',
-        command,
-        args: (server.args ?? []).map((arg) => expandPluginPaths(arg, roots)),
-        cwd,
-        env,
-        shell: false,
-    };
-}
-/** Mandatory filesystem preflight for Control Plane callers after safe materialization.
- * Call immediately before activation inside the same protected installation boundary;
- * a separate preflight is not a substitute for preventing concurrent filesystem mutation.
- */
-export async function verifyBindingPaths(input, roots) {
-    const binding = resolveMcpBinding(input, roots);
-    if (binding.type !== 'stdio' || input.type !== 'stdio')
-        return;
-    const root = await realpath(roots.pluginRoot);
-    const data = await realpath(roots.pluginData);
-    if (root !== roots.pluginRoot || data !== roots.pluginData)
-        throw new Error('Supply canonical filesystem-resolved runtime roots.');
-    const cwd = await realpath(binding.cwd);
-    const expected = input.cwd?.startsWith('${PLUGIN_DATA}') ? data : root;
-    if (!within(cwd, expected))
-        throw new Error('Working directory resolves outside its declared root.');
-    if (input.command.startsWith('./') && !within(await realpath(binding.command), root))
-        throw new Error('Executable resolves outside the package root.');
-}
-//# sourceMappingURL=agent-plugins-harness.js.map

package/dist/agent-plugins-harness.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-plugins-harness.js","sourceRoot":"","sources":["../src/agent-plugins-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GAIvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAsB/E;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAA+B;IAC3E,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAC5E,CAAA;IACD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,OAAO,CAAC,iBAAiB,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACzF,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAA;IACzD,IAAI,GAAG,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAA;IACH,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,GAAG;QACZ,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,IAAI;QACzC,MAAM,EAAE;YACN,aAAa,EAAE,OAAO,CAAC,qBAAqB;YAC5C,SAAS,EAAE,OAAO,CAAC,iBAAiB;YACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,sBAAsB;SAC9C;QACD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAG,KAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzE,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CAAC,KAAwB;IAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,aAAa;QACjD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;QACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAiC,EAAE,CAAA;IACjD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAChG,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IAE/D,MAAM,cAAc,GAClB,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvD,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;IACrD,MAAM,cAAc,GAClB,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9C,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CACzD,CAAC,MAAM,CAAA;IACV,MAAM,eAAe,GACnB,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9C,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CACvD,CAAC,MAAM,CAAA;IACV,MAAM,MAAM,GAAG,cAAc,IAAI,cAAc,GAAG,CAAC,IAAI,cAAc,IAAI,eAAe,CAAA;IACxF,MAAM,QAAQ,GACZ,GAAG,CAAC,MAAM,KAAK,aAAa;QAC1B,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,mBAAmB,CAAA;IAC3B,IAAI,gBAAgB,GAAa,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC5C,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB;YAC5E,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;;YAExD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE;oBAChC,MAAM,EAAE,uDAAuD;iBAChE,CAAC,CAAA;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,IACE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,QAAQ,CACvF,MAAM,CAAC,IAAI,CACZ;gBAED,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;;gBAEzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,OAAO,IAAI,EAAE;oBACxB,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,uCAAuC;iBACjE,CAAC,CAAA;QACN,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5F,MAAM,gBAAgB,GACpB,CAAC,UAAU,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAA;IAChG,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,oFAAoF;QACpF,UAAU,EAAE,GAAG,CAAC,aAAa;YAC3B,CAAC,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE;YAChI,CAAC,CAAC,EAAE;QACN,6FAA6F;QAC7F,wFAAwF;QACxF,OAAO,EAAE,aAAa,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;QAClE,yBAAyB,EAAE,IAAI;QAC/B,QAAQ,EAAE,gBAAgB;QAC1B,aAAa;QACb,iBAAiB,EAAE,KAAK;QACxB,gBAAgB,EAAE,IAAI;QACtB,SAAS,EACP,gBAAgB,KAAK,aAAa;YAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE;QACnE,QAAQ;QACR,mBAAmB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC3D,kBAAkB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,EAAE;YACb,iGAAiG;YACjG,qGAAqG;YACrG,oHAAoH;YACpH,0GAA0G;YAC1G,4GAA4G;YAC5G,iKAAiK;YACjK,oIAAoI;YACpI,uEAAuE;YACvE,8IAA8I;YAC9I,kJAAkJ;SACnJ;KACF,CAAC,CAAA;AACJ,CAAC;AAMD,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAmB;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAChF,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAC7D,CAAA;AACH,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACnC,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACpG,CAAC;AAkBD,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAC/B,KAAgB,EAChB,KAAmB,EACnB,OAAO,GAAqC,EAAE,EAC9C,QAAQ,GAAsB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;IAE9E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QACzB,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;YAC9B,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,eAAe;SAC/B,CAAA;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAA;IAClB,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAA;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;IAC3F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAC1F,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACpD,IAAI,QAAQ,KAAK,OAAO;YACtB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE;oBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE;YAC/B,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACvE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC/C,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACxC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO;QACP,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,GAAG;QACH,GAAG;QACH,KAAK,EAAE,KAAK;KACb,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAgB,EAAE,KAAmB;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAM;IAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC,UAAU;QACxD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;AACpE,CAAC"}