npm - @agent-vm/gateway-lifecycle - Versions diffs - 0.0.122 → 0.0.124 - Mend

@agent-vm/gateway-lifecycle 0.0.122 → 0.0.124

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -178,6 +178,16 @@ interface GatewayAuthConfig {
     readonly agentId: string;
   }) => string;
 }
+interface GatewayInteractiveSshSession {
+  readonly remoteShellCommand: string;
+  readonly requireSecretEnvironmentEnabled: boolean;
+  readonly secretEnvironment: 'default' | 'gateway-token' | 'all-secrets';
+}
+interface GatewayInteractiveSshConfig {
+  readonly buildSession: (options: {
+    readonly requestAllSecrets: boolean;
+  }) => GatewayInteractiveSshSession;
+}
 interface GatewayAuthProfilesRef {
   readonly source: '1password' | 'config' | 'environment';
 }
@@ -235,7 +245,7 @@ interface OpenClawGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig
 interface HermesGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {
   readonly type: 'hermes';
   readonly zoneFilesDir: string;
-  readonly discordBotTokenSecretsByAgent?: Readonly<Record<string, string>>;
+  readonly profileSecretProjectionsByAgent: Readonly<Record<string, Readonly<Record<string, string>>>>;
   readonly profilesByAgent: Readonly<Record<string, string>>;
 }
 interface WorkerGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {
@@ -403,11 +413,12 @@ interface ManagedFrameworkServiceConfigurationOnlyBootInputs extends ManagedFram
 }
 interface ManagedHermesFrameworkServiceBootInputs extends ManagedFrameworkServiceBootInputsBase {
   readonly kind: 'hermes-managed-scope';
-  readonly managedConfigurationSource: string;
 }
 type ManagedFrameworkServiceBootInputs = ManagedFrameworkServiceConfigurationOnlyBootInputs | ManagedHermesFrameworkServiceBootInputs;
 interface ManagedGatewayLifecycle extends GatewayLifecycleBase {
   readonly executionModel: 'managed-gateway';
+  /** Build the framework-owned interactive SSH session contract. */
+  readonly interactiveSsh: GatewayInteractiveSshConfig;
   /** Build the selected framework half of the exact managed boot contract. */
   buildFrameworkServiceBootMetadata(zone: GatewayZoneConfig): ManagedFrameworkServiceBootMetadata;
   /** Build service-scoped config and environment for protected materialization. */
@@ -1118,5 +1129,5 @@ interface ToolVmLeasePeek extends VmCapabilityLease<'ssh-sandbox'> {
 declare function isToolVmSshLease(value: unknown): value is ToolVmSshLease;
 declare function isToolVmLeasePeek(value: unknown): value is ToolVmLeasePeek;
 //#endregion
-export { type AgentChannelProviderHealthDetails, type AgentChannelProviderHealthKind, type AgentVmHealthEvent, type AgentVmHealthEventBase, type AgentVmHealthEventKind, type AgentVmHealthResultKind, type BuildGatewayVmRequirementsOptions, type BuildManagedFrameworkServiceBootInputsOptions, type ControllerRequestPolicy, type ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, type ControllerRequestPolicyTransportErrorCode, type CreateToolVmActiveUseHandleOptions, type DeriveZoneHealthSnapshotOptions, type DirectProcessGatewayLifecycle, type EgressHostConfig, type EndToolVmActiveUseRequest, type EnvInjectedGatewaySecretConfig, type ExternalControllerRoute, FORCE_IPV4_EGRESS_NODE_OPTIONS, GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV, GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV, GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES, type GatewayAuthConfig, type GatewayControlPrivateEnvironmentName, type GatewayControlSessionHealthOperation, type GatewayFrameworkTelemetryProducerConfig, type GatewayHealthCheck, type GatewayIngressConfig, type GatewayLifecycle, type GatewayLifecycleBase, type GatewayProcessSpec, type GatewayRecoveryEventAction, type GatewayRecoveryHealthReason, type GatewayRecoveryTimeoutErrorCode, type GatewayRecoveryVmAction, type GatewaySecretConfig, type GatewayTelemetryAdmissionLimits, type GatewayTelemetryProducerSafetyContract, type GatewayTelemetrySignalPolicy, type GatewayTelemetrySourcePolicy, type GatewayToolPortalTelemetryProducerConfig, type GatewayType, type GatewayVmRequirements, type GatewayZoneAgentConfig, type GatewayZoneConfig, type GatewayZoneMcpPortalConfig, type GatewayZoneObservabilityConfig, type GenericControllerRequestEventOperation, type HeartbeatToolVmActiveUseRequest, type HeartbeatToolVmActiveUseResponse, type HttpMediatedGatewaySecretConfig, type ManagedFrameworkBootEntry, type ManagedFrameworkIngressMetadata, type ManagedFrameworkKind, type ManagedFrameworkReadinessMetadata, type ManagedFrameworkServiceBootInputs, type ManagedFrameworkServiceBootMetadata, type ManagedGatewayBootContract, type ManagedGatewayLifecycle, type ManagedGatewayLogIdentity, type ManagedHermesServiceBootMetadata, type ManagedOpenClawServiceBootMetadata, type ManagedToolPortalReadinessMetadata, type ManagedToolPortalServiceBootMetadata, type NormalizedGitSshReadAllowlist, type NormalizedGitSshReadAllowlistEntry, OPENCLAW_STATE_SANDBOXES_VM_ROOT, OPENCLAW_STATE_VM_ROOT, type RuntimePathBacking, type RuntimePathCapabilities, type RuntimePathGuidanceVisibility, type RuntimePathLocations, type RuntimePathMapping, type RuntimePathNamespace, type RuntimePathPurpose, type RuntimePathRootMapping, type RuntimePathTranslation, type RuntimePathTranslationError, type RuntimePathTranslationErrorCode, type RuntimeVmAudience, type SecretInjectionConfig, type SplitResolvedGatewaySecretsResult, type SplitResolvedSecretsResult, type StartToolVmActiveUseRequest, type StartToolVmActiveUseResponse, TOOL_VM_SCRATCH_GUEST_ROOT, TOOL_VM_WORK_GUEST_ROOT, type ToolVmActiveUseCorrelation, type ToolVmActiveUseHandle, type ToolVmActiveUseOperationReport, type ToolVmActiveUseOutcome, type ToolVmLeaseId, type ToolVmLeasePeek, type ToolVmSshFailureKind, type ToolVmSshFailureReport, type ToolVmSshHealthOperation, type ToolVmSshLease, type ToolVmSshOperationPhase, type ToolVmSshOperationReport, type TranslateRuntimePathInput, type TranslateRuntimePathResult, type VmAudience, type VmCapabilityLease, type VmSshEndpoint, type VmSshLease, type VmSshPublicEndpoint, type WebSocketUpgradeConfig, type ZoneHealthIssue, type ZoneHealthIssueKind, type ZoneHealthSnapshot, type ZoneHealthStateKind, agentVmHealthEventKinds, agentVmHealthResultKinds, buildGatewaySessionLabel, buildToolSessionLabel, composeNodeOptions, controllerRequestPolicies, controllerVmHost, createGatewayTelemetryProducerSafetyContract, createToolVmActiveUseHandle, createToolVmActiveUseId, createToolVmLeaseId, createWebSocketUpgradeRequestGuard, defaultToolVmLeaseAuthorityTombstoneTtlMs, deriveZoneHealthSnapshot, drainControllerResponseBody, egressHostsForAudience, externalControllerRoutes, gatewayControlSessionHealthOperations, gatewayFrameworkTelemetryServiceNames, gatewayRecoveryHealthReasons, gatewayTelemetryAdmissionLimits, gatewayTelemetrySourcePolicy, gatewayToolPortalTelemetryServiceName, gatewayTypeValues, gatewayVmAllowedHosts, genericControllerRequestEventOperations, healthEventBucketKey, isAgentVmHealthEvent, isToolVmActiveUseId, isToolVmLeaseId, isToolVmLeasePeek, isToolVmSshLease, isVmCapabilityLease, isVmSshEndpoint, isVmSshPublicEndpoint, mergeRuntimeGatewaySecrets, normalizeGitHubRepoForSshReadAllowlist, normalizeGitHubReposForSshReadAllowlist, normalizeGitRepoForSshReadAllowlist, normalizeGitReposForSshReadAllowlist, normalizeToolVmActiveUseCorrelation, parseManagedGatewayBootContract, parseToolVmLeaseId, splitResolvedGatewaySecrets, splitResolvedSecretsByInjection, targetsAudience, translateRuntimePath, vmAudienceValues, websocketUpgradesForAudience, workerVmAllowedHosts, zoneHealthIssueKinds, zoneHealthStateKinds };
+export { type AgentChannelProviderHealthDetails, type AgentChannelProviderHealthKind, type AgentVmHealthEvent, type AgentVmHealthEventBase, type AgentVmHealthEventKind, type AgentVmHealthResultKind, type BuildGatewayVmRequirementsOptions, type BuildManagedFrameworkServiceBootInputsOptions, type ControllerRequestPolicy, type ControllerRequestPolicyOperation, ControllerRequestPolicyTransportError, type ControllerRequestPolicyTransportErrorCode, type CreateToolVmActiveUseHandleOptions, type DeriveZoneHealthSnapshotOptions, type DirectProcessGatewayLifecycle, type EgressHostConfig, type EndToolVmActiveUseRequest, type EnvInjectedGatewaySecretConfig, type ExternalControllerRoute, FORCE_IPV4_EGRESS_NODE_OPTIONS, GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV, GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV, GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES, type GatewayAuthConfig, type GatewayControlPrivateEnvironmentName, type GatewayControlSessionHealthOperation, type GatewayFrameworkTelemetryProducerConfig, type GatewayHealthCheck, type GatewayIngressConfig, type GatewayInteractiveSshConfig, type GatewayInteractiveSshSession, type GatewayLifecycle, type GatewayLifecycleBase, type GatewayProcessSpec, type GatewayRecoveryEventAction, type GatewayRecoveryHealthReason, type GatewayRecoveryTimeoutErrorCode, type GatewayRecoveryVmAction, type GatewaySecretConfig, type GatewayTelemetryAdmissionLimits, type GatewayTelemetryProducerSafetyContract, type GatewayTelemetrySignalPolicy, type GatewayTelemetrySourcePolicy, type GatewayToolPortalTelemetryProducerConfig, type GatewayType, type GatewayVmRequirements, type GatewayZoneAgentConfig, type GatewayZoneConfig, type GatewayZoneMcpPortalConfig, type GatewayZoneObservabilityConfig, type GenericControllerRequestEventOperation, type HeartbeatToolVmActiveUseRequest, type HeartbeatToolVmActiveUseResponse, type HttpMediatedGatewaySecretConfig, type ManagedFrameworkBootEntry, type ManagedFrameworkIngressMetadata, type ManagedFrameworkKind, type ManagedFrameworkReadinessMetadata, type ManagedFrameworkServiceBootInputs, type ManagedFrameworkServiceBootMetadata, type ManagedGatewayBootContract, type ManagedGatewayLifecycle, type ManagedGatewayLogIdentity, type ManagedHermesServiceBootMetadata, type ManagedOpenClawServiceBootMetadata, type ManagedToolPortalReadinessMetadata, type ManagedToolPortalServiceBootMetadata, type NormalizedGitSshReadAllowlist, type NormalizedGitSshReadAllowlistEntry, OPENCLAW_STATE_SANDBOXES_VM_ROOT, OPENCLAW_STATE_VM_ROOT, type RuntimePathBacking, type RuntimePathCapabilities, type RuntimePathGuidanceVisibility, type RuntimePathLocations, type RuntimePathMapping, type RuntimePathNamespace, type RuntimePathPurpose, type RuntimePathRootMapping, type RuntimePathTranslation, type RuntimePathTranslationError, type RuntimePathTranslationErrorCode, type RuntimeVmAudience, type SecretInjectionConfig, type SplitResolvedGatewaySecretsResult, type SplitResolvedSecretsResult, type StartToolVmActiveUseRequest, type StartToolVmActiveUseResponse, TOOL_VM_SCRATCH_GUEST_ROOT, TOOL_VM_WORK_GUEST_ROOT, type ToolVmActiveUseCorrelation, type ToolVmActiveUseHandle, type ToolVmActiveUseOperationReport, type ToolVmActiveUseOutcome, type ToolVmLeaseId, type ToolVmLeasePeek, type ToolVmSshFailureKind, type ToolVmSshFailureReport, type ToolVmSshHealthOperation, type ToolVmSshLease, type ToolVmSshOperationPhase, type ToolVmSshOperationReport, type TranslateRuntimePathInput, type TranslateRuntimePathResult, type VmAudience, type VmCapabilityLease, type VmSshEndpoint, type VmSshLease, type VmSshPublicEndpoint, type WebSocketUpgradeConfig, type ZoneHealthIssue, type ZoneHealthIssueKind, type ZoneHealthSnapshot, type ZoneHealthStateKind, agentVmHealthEventKinds, agentVmHealthResultKinds, buildGatewaySessionLabel, buildToolSessionLabel, composeNodeOptions, controllerRequestPolicies, controllerVmHost, createGatewayTelemetryProducerSafetyContract, createToolVmActiveUseHandle, createToolVmActiveUseId, createToolVmLeaseId, createWebSocketUpgradeRequestGuard, defaultToolVmLeaseAuthorityTombstoneTtlMs, deriveZoneHealthSnapshot, drainControllerResponseBody, egressHostsForAudience, externalControllerRoutes, gatewayControlSessionHealthOperations, gatewayFrameworkTelemetryServiceNames, gatewayRecoveryHealthReasons, gatewayTelemetryAdmissionLimits, gatewayTelemetrySourcePolicy, gatewayToolPortalTelemetryServiceName, gatewayTypeValues, gatewayVmAllowedHosts, genericControllerRequestEventOperations, healthEventBucketKey, isAgentVmHealthEvent, isToolVmActiveUseId, isToolVmLeaseId, isToolVmLeasePeek, isToolVmSshLease, isVmCapabilityLease, isVmSshEndpoint, isVmSshPublicEndpoint, mergeRuntimeGatewaySecrets, normalizeGitHubRepoForSshReadAllowlist, normalizeGitHubReposForSshReadAllowlist, normalizeGitRepoForSshReadAllowlist, normalizeGitReposForSshReadAllowlist, normalizeToolVmActiveUseCorrelation, parseManagedGatewayBootContract, parseToolVmLeaseId, splitResolvedGatewaySecrets, splitResolvedSecretsByInjection, targetsAudience, translateRuntimePath, vmAudienceValues, websocketUpgradesForAudience, workerVmAllowedHosts, zoneHealthIssueKinds, zoneHealthStateKinds };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","names":[],"sources":["../src/gateway-runtime-contract.ts","../src/audience.ts","../src/gateway-control-private-environment.ts","../src/gateway-process-spec.ts","../src/websocket-upgrade-policy.ts","../src/gateway-vm-spec.ts","../src/managed-gateway-boot-contract.ts","../src/gateway-lifecycle.ts","../src/health/controller-request-policy.ts","../src/health/agent-vm-health.ts","../src/git-read-allowlist.ts","../src/force-ipv4-egress.ts","../src/split-resolved-gateway-secrets.ts","../src/tool-vm-active-use.ts","../src/runtime-paths/runtime-path-mapping.ts","../src/tool-vm-lease-id.ts","../src/vm-capability-lease.ts","../src/tool-vm-lease.ts"],"mappings":";;;;cAAa,iBAAA;AAAA,KAED,WAAA,WAAsB,iBAAA;AAAA,iBAElB,wBAAA,CAAyB,gBAAA,UAA0B,MAAA;AAAA,iBAInD,qBAAA,CACf,gBAAA,UACA,MAAA,UACA,OAAA;;;cCXY,gBAAA;AAAA,KAED,UAAA,WAAqB,gBAAA;AAAA,KACrB,iBAAA,GAAoB,OAAA,CAAQ,UAAA;AAAA,UAEvB,gBAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA,EAAU,UAAA;AAAA;AAAA,cAGP,gBAAA;AAAA,iBAEG,eAAA,CACf,cAAA,EAAgB,UAAA,EAChB,eAAA,EAAiB,iBAAA;AAAA,iBAKF,sBAAA,CACf,WAAA,WAAsB,gBAAA,IACtB,eAAA,EAAiB,iBAAA;AAAA,iBAOF,qBAAA,CAAsB,WAAA,WAAsB,gBAAA;AAAA,iBAQ5C,oBAAA,CAAqB,WAAA,WAAsB,gBAAA;;;cCpC9C,4CAAA;AAAA,cAEA,uDAAA;AAAA,cAGA,yCAAA;AAAA,KAKD,oCAAA,WACH,yCAAA;;;KCXG,kBAAA;EAAA,SACE,IAAA;EAAA,SAAuB,IAAA;EAAA,SAAuB,IAAA;AAAA;EAAA,SAC9C,IAAA;EAAA,SAA0B,OAAA;AAAA;;AHAxC;;;UGMiB,kBAAA;EAAA,SACP,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,WAAA,EAAa,kBAAA;EAAA,SACb,kBAAA,GAAqB,kBAAA;EAAA,SACrB,eAAA;EAAA,SACA,OAAA;AAAA;;;UCZO,sBAAA;EAAA,SACP,QAAA,EAAU,UAAA;EAAA,SACV,MAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,yCAAA;EAAA,SACP,KAAA,WAAgB,sBAAA;EAAA,SAChB,eAAA,EAAiB,iBAAA;AAAA;AAAA,iBAkFX,4BAAA,CACf,KAAA,WAAgB,sBAAA,gBAChB,eAAA,EAAiB,iBAAA,YACN,sBAAA;AAAA,iBAII,kCAAA,CACf,OAAA,EAAS,yCAAA,IACN,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;;;;AJvGjC;;;;;UKWiB,qBAAA;EAAA,SACP,WAAA,EAAa,MAAA;EAAA,SACb,MAAA,EAAQ,MAAA,SAAe,cAAA;EAAA,SACvB,eAAA,EAAiB,MAAA,SAAe,kBAAA;EAAA,SAChC,QAAA,EAAU,MAAA;EAAA,SACV,SAAA,GAAY,6BAAA;EAAA,SACZ,YAAA;EAAA,SACA,iBAAA,YAA6B,sBAAA;EAAA,SAC7B,UAAA;EAAA,SACA,iBAAA;EAAA,SACA,YAAA;AAAA;;;KCrBE,oBAAA;AAAA,KAEA,yBAAA;AAAA,UAEK,yBAAA;EAAA,SACP,SAAA;EAAA,SACA,WAAA;AAAA;AAAA,UAGO,kCAAA;EAAA,SACP,YAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,SAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,+BAAA;EAAA,SACP,SAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,oCAAA;EAAA,SACP,SAAA;EAAA,SACA,sBAAA;EAAA,SACA,oBAAA;EAAA,SACA,WAAA,EAAa,yBAAA;EAAA,SACb,SAAA,EAAW,kCAAA;EAAA,SACX,IAAA;AAAA;AAAA,UAGA,uCAAA;EAAA,SACA,sBAAA;EAAA,SACA,oBAAA;EAAA,SACA,OAAA,EAAS,+BAAA;EAAA,SACT,WAAA,EAAa,yBAAA;EAAA,SACb,SAAA,EAAW,iCAAA;EAAA,SACX,IAAA;AAAA;AAAA,UAGO,kCAAA,SAA2C,uCAAA;EAAA,SAClD,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,UAGO,gCAAA,SAAyC,uCAAA;EAAA,SAChD,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,KAGE,mCAAA,GACT,kCAAA,GACA,gCAAA;;ALnDH;;;;;;UK4DiB,0BAAA;EAAA,SACP,eAAA;EAAA,SACA,gBAAA,EAAkB,mCAAA;EAAA,SAClB,IAAA;EAAA,SACA,iBAAA,EAAmB,oCAAA;AAAA;;;ALzD7B;;;iBK4QgB,+BAAA,CAAgC,KAAA,YAAiB,0BAAA;;;;ANtRjE;;;UOYiB,iBAAA;EPZkC;AAEnD;;;EAFmD,SOiBzC,oBAAA;EPfuE;AAIjF;;;EAJiF,SOqBvE,iBAAA,GACR,QAAA,UACA,OAAA;IAAA,SACU,UAAA;IAAA,SACA,OAAA;IAAA,SACA,SAAA;EAAA;EPnBI;;;;EAAA,SO2BN,uBAAA,GACR,QAAA,UACA,OAAA;IAAA,SACU,OAAA;EAAA;AAAA;AAAA,UAKF,sBAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,4BAAA,SAAqC,sBAAA;EAAA,SACrC,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,uBAAA;AAAA,UAEK,gBAAA;EAAA,SACP,SAAA,EAAW,uBAAA;AAAA;AAAA,UAGJ,oBAAA;EAAA,SACP,uBAAA;EAAA,SACA,yBAAA;AAAA;AAAA,UAGO,gCAAA;EAAA,SACP,IAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,+BAAA;EAAA,SACA,UAAA;AAAA;AAAA,UAGA,uBAAA;EAAA,SACA,YAAA;EAAA,SACA,SAAA,EAAW,QAAA,CAAS,MAAA,SAAe,+BAAA;AAAA;AAAA,UAGnC,4BAAA;EAAA,SACA,IAAA,EAAM,WAAA;EAAA,SACN,MAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA,GAAU,oBAAA;EAAA,SACV,MAAA;EAAA,SACA,QAAA;EAAA,SACA,iBAAA;EAAA,SACA,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGL,gCAAA,SAAyC,4BAAA;EAAA,SACzC,IAAA;EAAA,SACA,WAAA,EAAa,gCAAA;EAAA,SACb,YAAA;EAAA,SACA,eAAA,GACN,4BAAA,GACA,iCAAA,GACA,iCAAA;EAAA,SAEM,mBAAA,GAAsB,QAAA,CAC9B,MAAA,SAEG,4BAAA,GACA,iCAAA,GACA,iCAAA;EAAA,SAGK,SAAA,GAAY,uBAAA;EAAA,SACZ,aAAA;AAAA;AAAA,UAGA,8BAAA,SAAuC,4BAAA;EAAA,SACvC,IAAA;EAAA,SACA,YAAA;EAAA,SACA,6BAAA,GAAgC,QAAA,CAAS,MAAA;EAAA,SACzC,eAAA,EAAiB,QAAA,CAAS,MAAA;AAAA;AAAA,UAG1B,8BAAA,SAAuC,4BAAA;EAAA,SACvC,IAAA;AAAA;AAAA,KAGL,wBAAA,GACF,gCAAA,GACA,8BAAA,GACA,8BAAA;AAAA,UAEO,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,wBAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGL,kBAAA,GACF,6BAAA,GACA,6BAAA,GACA,wBAAA;AAAA,KAES,8BAAA,GAAiC,kBAAA;EAAA,SACnC,QAAA;EAAA,SACA,SAAA;AAAA;AAAA,KAGE,+BAAA,GAAkC,kBAAA;EAAA,SACpC,QAAA,EAAU,UAAA;EAAA,SACV,SAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,mBAAA,GAAsB,8BAAA,GAAiC,+BAAA;AAAA,cAEtD,qCAAA;AAAA,cACA,qCAAA,EAAqC,QAAA;;;;cAKrC,4BAAA,EAA4B,QAAA;;;;cAK5B,+BAAA,EAA+B,QAAA;;;;;KAMhC,4BAAA,UAAsC,4BAAA;AAAA,KACtC,+BAAA,UAAyC,+BAAA;AAAA,UAEpC,4BAAA;EAAA,SACP,MAAA;EAAA,SACA,OAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,sCAAA;EAAA,SACP,eAAA,EAAiB,+BAAA;EAAA,SACjB,YAAA,EAAc,4BAAA;AAAA;AAAA,UAGP,uCAAA,SACR,4BAAA,EAA8B,sCAAA;EAAA,SAC7B,WAAA,UAAqB,qCAAA,eAAoD,qCAAA;AAAA;AAAA,UAGlE,wCAAA,SACR,4BAAA,EAA8B,sCAAA;EAAA,SAC7B,WAAA,SAAoB,qCAAA;AAAA;AAAA,iBAGd,4CAAA,CAAA,GAAgD,sCAAA;AAAA,UAe/C,8BAAA;EAAA,SACP,IAAA;EAAA,SACA,SAAA;IAAA,SACC,IAAA;IAAA,SACA,QAAA;IAAA,SACA,QAAA;IAAA,SACA,UAAA;IAAA,SACA,cAAA;IAAA,SACA,cAAA;EAAA;EAAA,SAED,SAAA,EAAW,uCAAA;EAAA,SACX,QAAA;IAAA,SACC,gBAAA;EAAA;EAAA,SAED,UAAA,EAAY,wCAAA;AAAA;;;;;UAOL,iBAAA;EAAA,SACP,EAAA;EAAA,SACA,MAAA,YAAkB,sBAAA;EAAA,SAClB,OAAA,EAAS,wBAAA;EAAA,SACT,UAAA,GAAa,0BAAA;EAAA,SACb,iBAAA,GAAoB,QAAA,CAAS,MAAA,SAAe,0BAAA;EAAA,SAC5C,sBAAA,GAAyB,QAAA,CAAS,MAAA,SAAe,kBAAA;EAAA,SACjD,kBAAA,GAAqB,QAAA,CAAS,MAAA;EAAA,SAC9B,yBAAA,GAA4B,QAAA,CACpC,OAAA,CAAQ,MAAA,CAAO,oCAAA;EAAA,SAEP,oBAAA,GAAuB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;EAAA,SACxD,qBAAA;EAAA,SACA,aAAA,GAAgB,8BAAA;EAAA,SAChB,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,mBAAA;EAAA,SACjC,WAAA,WAAsB,gBAAA;EAAA,SACtB,iBAAA,YAA6B,sBAAA;EAAA,SAC7B,oBAAA;AAAA;AAAA,UAGO,sBAAA;EAAA,SACP,EAAA;EAAA,SACA,aAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,SAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,OAAA,GAAU,QAAA,CAAS,MAAA;EAAA,SACnB,SAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,cAAA;EAAA,SACA,eAAA;EAAA,SACA,gBAAA;EAAA,SACA,eAAA,EAAiB,MAAA;EAAA,SACjB,cAAA;EAAA,SACA,OAAA;IAAA,SACC,QAAA;IAAA,SACA,IAAA;EAAA;EAAA,SAED,IAAA,EAAM,iBAAA;AAAA;AAAA,UAGC,oBAAA;EF9RgB;;;;EAAA,SEmSvB,UAAA,GAAa,iBAAA;EFjSH;;;;EEuSnB,mBAAA,CAAoB,OAAA,EAAS,iCAAA,GAAoC,qBAAA;EFpS3B;;;;EE0StC,gBAAA,EAAkB,IAAA,EAAM,iBAAA,EAAmB,cAAA,EAAgB,cAAA,GAAiB,OAAA;EFvSvD;;;;ACrBtB;ECmUC,kBAAA,EAAoB,IAAA,EAAM,iBAAA,EAAmB,cAAA,EAAgB,cAAA,GAAiB,OAAA;AAAA;AAAA,UAG9D,6CAAA;EAAA,SACP,eAAA,EAAiB,MAAA;EAAA,SACjB,IAAA,EAAM,iBAAA;AAAA;;;;ADpUhB;;;;UC8UU,qCAAA;EAAA,SACA,aAAA;EAAA,SACA,WAAA,EAAa,QAAA,CAAS,MAAA;AAAA;AAAA,UAGtB,kDAAA,SAA2D,qCAAA;EAAA,SAC3D,IAAA;AAAA;AAAA,UAGA,uCAAA,SAAgD,qCAAA;EAAA,SAChD,IAAA;EAAA,SACA,0BAAA;AAAA;AAAA,KAGE,iCAAA,GACT,kDAAA,GACA,uCAAA;AAAA,UAEc,uBAAA,SAAgC,oBAAA;EAAA,SACvC,cAAA;EDrVA;ECwVT,iCAAA,CAAkC,IAAA,EAAM,iBAAA,GAAoB,mCAAA;EDtVnD;ECyVT,+BAAA,CACC,OAAA,EAAS,6CAAA,GACP,OAAA,CAAQ,iCAAA;AAAA;AAAA,UAGK,6BAAA,SAAsC,oBAAA;EAAA,SAC7C,cAAA;;;;ADvVV;EC6VC,gBAAA,CACC,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,kBAAA;AAAA;AAAA,KAGQ,gBAAA,GAAmB,uBAAA,GAA0B,6BAAA;;;cC7X5C,0CAAA;AAAA,KAYD,yCAAA,WACH,0CAAA;AAAA,KAEG,gCAAA,GAAmC,yCAAA;AAAA,cAElC,+CAAA;AAAA,KAKD,8CAAA,WACH,+CAAA;AAAA,KAEG,sCAAA,GAAyC,OAAA,CACpD,gCAAA,EACA,8CAAA;AAAA,cAaY,uCAAA,EAAuC,sCAAA;AAAA,cAIvC,wBAAA;AAAA,KAgBD,uBAAA,WAAkC,wBAAA;AAAA,KAElC,kCAAA;AAAA,UAEF,2BAAA;EAAA,SACA,WAAA,EAAa,kCAAA;EAAA,SACb,SAAA;AAAA;AAAA,KAGE,uBAAA,IACR,2BAAA;EAAA,SACQ,WAAA;EAAA,SACA,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,aAAA;AAAA,MAER,2BAAA;EAAA,SACQ,WAAA;EAAA,SACA,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,aAAA;AAAA;AAAA,KAGA,yCAAA;AAAA,cAIC,qCAAA,SAA8C,KAAA;EAAA,SACjD,IAAA,EAAM,yCAAA;EAAA,SACN,SAAA,EAAW,gCAAA;cAER,OAAA;IAAA,SACF,KAAA;IAAA,SACA,IAAA,EAAM,yCAAA;IAAA,SACN,SAAA,EAAW,gCAAA;EAAA;AAAA;AAAA,iBA0CA,2BAAA,CAA4B,QAAA,EAAU,QAAA,GAAW,OAAA;AAAA,cA+F1D,yBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjOA,uBAAA;AAAA,KAcD,sBAAA,WAAiC,uBAAA;AAAA,cAEhC,wBAAA;AAAA,KAED,uBAAA,WAAkC,wBAAA;AAAA,UAE7B,sBAAA;EAAA,SACP,WAAA;EAAA,SACA,aAAA;EAAA,SACA,YAAA;EAAA,SACA,SAAA;EAAA,SACA,MAAA,EAAQ,uBAAA;EAAA,SACR,KAAA;EAAA,SACA,gBAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,wBAAA;AAAA,cAEC,8BAAA;AAAA,KAED,6BAAA,WAAwC,8BAAA;AAAA,cAEvC,+BAAA;AAAA,KAUD,8BAAA,WAAyC,+BAAA;AAAA,cAE/C,yCAAA;AAAA,KAKD,wCAAA,WACI,yCAAA;AAAA,KAEJ,2CAAA,GAA8C,OAAA,CAClD,8BAAA,EACA,wCAAA;AAAA,cAGY,8BAAA;AAAA,KAQD,6BAAA,WAAwC,8BAAA;AAAA,cAEvC,2BAAA;AAAA,KAgBD,0BAAA,WAAqC,2BAAA;AAAA,UAEvC,gCAAA;EAAA,SACA,WAAA;EAAA,SACA,kBAAA,GAAqB,6BAAA;EAAA,SACrB,oBAAA,GAAuB,0BAAA;EAAA,SACvB,kBAAA,EAAoB,6BAAA;EAAA,SACpB,UAAA;EAAA,SACA,YAAA;AAAA;AAAA,KAGL,4BAAA,IACD,gCAAA;EAAA,SACQ,mBAAA,EAAqB,wCAAA;EAAA,SACrB,kBAAA;AAAA,MAER,gCAAA;EAAA,SACQ,mBAAA,EAAqB,2CAAA;EAAA,SACrB,kBAAA;AAAA;AAAA,UAGF,kCAAA;EAAA,SACA,WAAA;EAAA,SACA,kBAAA;EAAA,SACA,oBAAA;EAAA,SACA,kBAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,kBAAA;EAAA,SACA,YAAA;AAAA;AAAA,cAGG,+BAAA;AAAA,KAOD,8BAAA,WAAyC,+BAAA;AAAA,cAExC,oCAAA;AAAA,KASD,mCAAA,WACH,oCAAA;AAAA,KAEG,iCAAA,GAAoC,QAAA,CAC/C,OAAA,CAAQ,MAAA,CAAO,mCAAA;AAAA,cAGH,4BAAA;AAAA,KAMD,2BAAA,WAAsC,4BAAA;AAAA,KACtC,uBAAA;AAAA,KACA,0BAAA,GACT,uBAAA;AAAA,KAGS,+BAAA;AAAA,cAEC,qCAAA;AAAA,KAOD,oCAAA,WACH,qCAAA;AAAA,KAEG,kBAAA,IACR,sBAAA;EAAA,SACQ,IAAA;EAAA,SACA,SAAA;EAAA,SAUA,MAAA;EAAA,SAIA,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,SAAA,EAAW,oCAAA;EAAA,SACX,MAAA;EAAA,SACA,SAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA,EAAW,sCAAA;EAAA,SACX,UAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,KAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA,EAAW,wBAAA;AAAA,KACf,kCAAA,GAAqC,4BAAA,MACzC,sBAAA;EAAA,SACQ,cAAA,EAAgB,WAAA;EAAA,SAChB,IAAA;EAAA,SACA,KAAA;AAAA,MAER,sBAAA;EAAA,SACQ,iBAAA;EAAA,SACA,OAAA,GAAU,iCAAA;EAAA,SACV,MAAA,EAAQ,8BAAA;EAAA,SACR,IAAA;EAAA,SACA,qBAAA;EAAA,SACA,gBAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA,EAAW,+BAAA;EAAA,SACX,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA,EAAQ,0BAAA;EAAA,SACR,2BAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,qBAAA;EAAA,SACA,IAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA;AAAA,cAGC,oBAAA;AAAA,KAED,mBAAA,WAA8B,oBAAA;AAAA,cAE7B,oBAAA;AAAA,KAcD,mBAAA,WAA8B,oBAAA;AAAA,UAEzB,eAAA;EAAA,SACP,IAAA,EAAM,mBAAA;EAAA,SACN,WAAA,EAAa,kBAAA;EAAA,SACb,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGE,kBAAA;EAAA,SAEA,IAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,YAAA,WAAuB,kBAAA;EAAA,SACvB,MAAA;AAAA;EAAA,SAGA,MAAA,WAAiB,eAAA;EAAA,SACjB,IAAA;EAAA,SACA,YAAA,WAAuB,kBAAA;EAAA,SACvB,MAAA;AAAA;AAAA,UAGK,+BAAA;EAAA,SACP,KAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAmKM,oBAAA,CAAqB,KAAA,YAAiB,KAAA,IAAS,kBAAA;AAAA,iBA6M/C,oBAAA,CAAqB,KAAA,EAAO,kBAAA;AAAA,iBAoK5B,wBAAA,CACf,MAAA,WAAiB,kBAAA,IACjB,OAAA,EAAS,+BAAA,GACP,kBAAA;;;UC/4Bc,kCAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA;AAAA;AAAA,UAGO,6BAAA;EAAA,SACP,YAAA;EAAA,SACA,YAAA;AAAA;AAAA,iBAGM,mCAAA,CACf,OAAA,WACE,kCAAA;AAAA,iBA0Ca,oCAAA,CACf,QAAA,kCACE,6BAAA;AAAA,iBAmBa,sCAAA,CAAuC,OAAA;AAAA,iBAiCvC,uCAAA,CACf,QAAA;;;;;;;AVlID;;;;;AAEA;;;;;AAEA;;;;;AAIA;;;;;;;;;;;;ACRA;;;;cUmCa,8BAAA;AVjCb;;;;;AACA;;;;;AAEA;;;;;;;;;AAKA;;;;;AAEA;;;;;AAVA,iBUmEgB,kBAAA,CAAmB,SAAA;;;UChElB,0BAAA;EAAA,SACP,kBAAA,EAAoB,MAAA;EAAA,SACpB,eAAA,EAAiB,MAAA,SAAe,kBAAA;AAAA;AAAA,UAGzB,iCAAA;EAAA,SACP,SAAA;EAAA,SACA,kBAAA,GAAqB,QAAA,CAAS,MAAA;EAAA,SAC9B,sBAAA,GAAyB,QAAA,CAAS,MAAA,SAAe,kBAAA;AAAA;AAAA,KAG/C,qBAAA,GAAwB,mBAAA;AAAA,UAEnB,2BAAA;EAAA,SACP,QAAA,EAAU,iBAAA;EAAA,SACV,SAAA;AAAA;AAAA,iBAGM,+BAAA,CACf,aAAA,EAAe,QAAA,CAAS,MAAA,SAAe,qBAAA,IACvC,eAAA,EAAiB,MAAA,kBACjB,OAAA,EAAS,2BAAA,GACP,0BAAA;AAAA,KA2CS,iCAAA,GAAoC,0BAAA;AAAA,iBAEhC,2BAAA,CACf,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,iCAAA;AAAA,iBAgCa,0BAAA,CACf,WAAA,EAAa,0BAAA,EACb,OAAA,GAAS,iCAAA,GACP,0BAAA;;;KC5GS,sBAAA;AAAA,UAOK,0BAAA;EAAA,SACP,SAAA;EAAA,SACA,SAAA;EAAA,SACA,KAAA;EAAA,SACA,gBAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGE,uBAAA;AAAA,KAOA,oBAAA;AAAA,UAMK,sBAAA;EAAA,SACP,IAAA,EAAM,oBAAA;EAAA,SACN,OAAA;AAAA;AAAA,UAGO,wBAAA;EAAA,SACP,OAAA,GAAU,sBAAA;EAAA,SACV,cAAA;AAAA;AAAA,UAGO,8BAAA;EAAA,SACP,YAAA;EAAA,SACA,KAAA,EAAO,uBAAA;EAAA,SACP,GAAA,GAAM,wBAAA;AAAA;AAAA,UAGC,2BAAA;EAAA,SACP,WAAA,GAAc,0BAAA;EAAA,SACd,MAAA,GAAS,8BAAA;EAAA,SACT,KAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,KAAA;AAAA;AAAA,UAGO,gCAAA;EAAA,SACP,SAAA;EAAA,SACA,gBAAA;AAAA;AAAA,UAGO,+BAAA;EAAA,SACP,MAAA,GAAS,8BAAA;AAAA;AAAA,UAGF,yBAAA;EAAA,SACP,OAAA,EAAS,sBAAA;EAAA,SACT,MAAA,GAAS,8BAAA;AAAA;AAAA,UAGF,qBAAA;EAAA,SACP,MAAA,EAAQ,WAAA;EAAA,SACR,KAAA;EACT,OAAA,CAAQ,OAAA,GAAU,sBAAA,GAAyB,OAAA;EAC3C,GAAA,CAAI,OAAA,GAAU,sBAAA,GAAyB,OAAA;EACvC,MAAA,CAAO,MAAA,EAAQ,8BAAA;AAAA;AAAA,UAGC,kCAAA;EAAA,SACP,WAAA,GAAc,0BAAA;EAAA,SACd,YAAA,GAAe,KAAA,UAAe,OAAA,EAAS,yBAAA,KAA8B,OAAA;EAAA,SACrE,kBAAA,GACR,KAAA,UACA,OAAA,EAAS,+BAAA,KACL,OAAA,CAAQ,gCAAA;EAAA,SACJ,oBAAA;EAAA,SACA,mBAAA,IAAuB,KAAA;EAAA,SACvB,2BAAA,IAA+B,KAAA;EAAA,SAC/B,aAAA,IAAiB,KAAA;EAAA,SACjB,mBAAA,IAAuB,KAAA;EAAA,SACvB,sBAAA;EAAA,SACA,OAAA;EAAA,SACA,6BAAA,IAAiC,KAAA,cAAmB,OAAA;EAAA,SACpD,UAAA;EAAA,SACA,cAAA,GACR,OAAA,EAAS,2BAAA,KACL,OAAA,CAAQ,4BAAA;EAAA,SACJ,cAAA,UAAwB,UAAA;EAAA,SACxB,gBAAA,UAA0B,YAAA;AAAA;AAAA,iBAqBpB,uBAAA,CAAA;AAAA,iBAIA,mBAAA,CAAoB,KAAA;AAAA,iBAIpB,mCAAA,CACf,WAAA,YACE,0BAAA;AAAA,iBA2BmB,2BAAA,CACrB,OAAA,EAAS,kCAAA,GACP,OAAA,CAAQ,qBAAA;;;cChKE,0BAAA;AAAA,cACA,sBAAA;AAAA,cACA,gCAAA;AAAA,KAED,oBAAA;AAAA,KACA,kBAAA;AAAA,UAEK,uBAAA;EAAA,SACP,YAAA;EAAA,SACA,UAAA;AAAA;AAAA,KAGE,kBAAA;EAAA,SAEA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,MAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,UAAA;AAAA;AAAA,KAGA,oBAAA,GAAuB,OAAA,CAAQ,MAAA,CAAO,oBAAA;AAAA,KACtC,8BAAA;EAAA,SAEA,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;EAAA,SAGA,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAEK,kCAAA;EAAA,SACP,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;AAAA,KAEE,6BAAA,GAAgC,OAAA,CAAQ,MAAA,CAAO,oBAAA;AAAA,UAEjD,0BAAA;EAAA,SACA,YAAA,EAAc,uBAAA;EAAA,SACd,aAAA;EAAA,SACA,EAAA;;;;Ab3CV;WagDU,eAAA;EAAA,SACA,cAAA,GAAiB,6BAAA;AAAA;AAAA,KAGf,sBAAA,IACR,0BAAA;EAAA,SACQ,OAAA,EAAS,OAAA,CAAQ,kBAAA;IAAA,SAA+B,IAAA;EAAA;EAAA,SAChD,SAAA,EAAW,8BAAA;AAAA,MAEnB,0BAAA;EAAA,SACQ,OAAA,EAAS,OAAA,CAAQ,kBAAA;IAAA,SAA+B,IAAA;EAAA;EAAA,SAChD,YAAA,EAAc,uBAAA;IAAA,SAAqC,UAAA;EAAA;EAAA,SACnD,SAAA,EAAW,kCAAA;AAAA;AAAA,UAGN,kBAAA;EAAA,SACP,EAAA;EAAA,SACA,KAAA,WAAgB,sBAAA;AAAA;AAAA,UAGT,yBAAA;EAAA,SACP,SAAA;EAAA,SACA,OAAA,EAAS,kBAAA;EAAA,SACT,OAAA,EAAS,kBAAA;EAAA,SACT,eAAA,GAAkB,oBAAA;EAAA,SAClB,eAAA,EAAiB,oBAAA;AAAA;AAAA,UAGV,sBAAA;EAAA,SACP,OAAA,EAAS,kBAAA;EAAA,SACT,YAAA,EAAc,uBAAA;EAAA,SACd,cAAA,EAAgB,oBAAA;EAAA,SAChB,SAAA;EAAA,SACA,SAAA;EAAA,SACA,eAAA,EAAiB,oBAAA;EAAA,SACjB,UAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,+BAAA;AAAA,UASK,2BAAA;EAAA,SACP,gBAAA;EAAA,SACA,IAAA,EAAM,+BAAA;EAAA,SACN,SAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,OAAA,EAAS,kBAAA;EAAA,SACT,aAAA;AAAA;AAAA,KAGE,0BAAA;EAAA,SAEA,EAAA;EAAA,SACA,KAAA,EAAO,sBAAA;AAAA;EAAA,SAGP,EAAA;EAAA,SACA,KAAA,EAAO,2BAAA;AAAA;AAAA,iBA0IH,oBAAA,CAAqB,KAAA,EAAO,yBAAA,GAA4B,0BAAA;;;cC7P1D,kBAAA;AAAA,KAEF,aAAA;EAAA,UACD,kBAAA;AAAA;AAAA,iBAGK,mBAAA,CAAA,GAAuB,aAAA;AAAA,iBAIvB,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAA;AAAA,iBAI1C,kBAAA,CAAmB,KAAA,YAAiB,aAAA;;;;;;;AfhBpD;UgBOiB,iBAAA;EAAA,SACP,OAAA;EAAA,SACA,SAAA,EAAW,UAAA;AAAA;AAAA,UAGJ,aAAA;EAAA,SACP,IAAA;EAAA,SACA,WAAA;EAAA,SACA,cAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,mBAAA;EAAA,SACP,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,UAAA,oCAA8C,iBAAA,CAAkB,UAAA;EAAA,SACvE,GAAA,EAAK,aAAA;AAAA;AAAA,iBAWC,mBAAA,2BAAA,CACf,KAAA,WACA,SAAA,EAAW,UAAA,GACT,KAAA,IAAS,iBAAA,CAAkB,UAAA;AAAA,iBASd,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAA;AAAA,iBAY1C,qBAAA,CAAsB,KAAA,YAAiB,KAAA,IAAS,mBAAA;;;cCpDnD,yCAAA;AAAA,cACA,uBAAA;AAAA,UAEI,cAAA,SAAuB,UAAA;EAAA,SAC9B,OAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA,EAAS,aAAA;EAAA,SACT,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGO,eAAA,SAAwB,iBAAA;EAAA,SAC/B,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA,EAAS,aAAA;EAAA,SACT,SAAA;EAAA,SACA,GAAA,EAAK,mBAAA;EAAA,SACL,OAAA;EAAA,SACA,OAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBASM,gBAAA,CAAiB,KAAA,YAAiB,KAAA,IAAS,cAAA;AAAA,iBAc3C,iBAAA,CAAkB,KAAA,YAAiB,KAAA,IAAS,eAAA"}
1	+ {"version":3,"file":"index.d.ts","names":[],"sources":["../src/gateway-runtime-contract.ts","../src/audience.ts","../src/gateway-control-private-environment.ts","../src/gateway-process-spec.ts","../src/websocket-upgrade-policy.ts","../src/gateway-vm-spec.ts","../src/managed-gateway-boot-contract.ts","../src/gateway-lifecycle.ts","../src/health/controller-request-policy.ts","../src/health/agent-vm-health.ts","../src/git-read-allowlist.ts","../src/force-ipv4-egress.ts","../src/split-resolved-gateway-secrets.ts","../src/tool-vm-active-use.ts","../src/runtime-paths/runtime-path-mapping.ts","../src/tool-vm-lease-id.ts","../src/vm-capability-lease.ts","../src/tool-vm-lease.ts"],"mappings":";;;;cAAa,iBAAA;AAAA,KAED,WAAA,WAAsB,iBAAA;AAAA,iBAElB,wBAAA,CAAyB,gBAAA,UAA0B,MAAA;AAAA,iBAInD,qBAAA,CACf,gBAAA,UACA,MAAA,UACA,OAAA;;;cCXY,gBAAA;AAAA,KAED,UAAA,WAAqB,gBAAA;AAAA,KACrB,iBAAA,GAAoB,OAAA,CAAQ,UAAA;AAAA,UAEvB,gBAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA,EAAU,UAAA;AAAA;AAAA,cAGP,gBAAA;AAAA,iBAEG,eAAA,CACf,cAAA,EAAgB,UAAA,EAChB,eAAA,EAAiB,iBAAA;AAAA,iBAKF,sBAAA,CACf,WAAA,WAAsB,gBAAA,IACtB,eAAA,EAAiB,iBAAA;AAAA,iBAOF,qBAAA,CAAsB,WAAA,WAAsB,gBAAA;AAAA,iBAQ5C,oBAAA,CAAqB,WAAA,WAAsB,gBAAA;;;cCpC9C,4CAAA;AAAA,cAEA,uDAAA;AAAA,cAGA,yCAAA;AAAA,KAKD,oCAAA,WACH,yCAAA;;;KCXG,kBAAA;EAAA,SACE,IAAA;EAAA,SAAuB,IAAA;EAAA,SAAuB,IAAA;AAAA;EAAA,SAC9C,IAAA;EAAA,SAA0B,OAAA;AAAA;;AHAxC;;;UGMiB,kBAAA;EAAA,SACP,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,WAAA,EAAa,kBAAA;EAAA,SACb,kBAAA,GAAqB,kBAAA;EAAA,SACrB,eAAA;EAAA,SACA,OAAA;AAAA;;;UCZO,sBAAA;EAAA,SACP,QAAA,EAAU,UAAA;EAAA,SACV,MAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,yCAAA;EAAA,SACP,KAAA,WAAgB,sBAAA;EAAA,SAChB,eAAA,EAAiB,iBAAA;AAAA;AAAA,iBAkFX,4BAAA,CACf,KAAA,WAAgB,sBAAA,gBAChB,eAAA,EAAiB,iBAAA,YACN,sBAAA;AAAA,iBAII,kCAAA,CACf,OAAA,EAAS,yCAAA,IACN,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA;;;;AJvGjC;;;;;UKWiB,qBAAA;EAAA,SACP,WAAA,EAAa,MAAA;EAAA,SACb,MAAA,EAAQ,MAAA,SAAe,cAAA;EAAA,SACvB,eAAA,EAAiB,MAAA,SAAe,kBAAA;EAAA,SAChC,QAAA,EAAU,MAAA;EAAA,SACV,SAAA,GAAY,6BAAA;EAAA,SACZ,YAAA;EAAA,SACA,iBAAA,YAA6B,sBAAA;EAAA,SAC7B,UAAA;EAAA,SACA,iBAAA;EAAA,SACA,YAAA;AAAA;;;KCrBE,oBAAA;AAAA,KAEA,yBAAA;AAAA,UAEK,yBAAA;EAAA,SACP,SAAA;EAAA,SACA,WAAA;AAAA;AAAA,UAGO,kCAAA;EAAA,SACP,YAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,SAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,+BAAA;EAAA,SACP,SAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,oCAAA;EAAA,SACP,SAAA;EAAA,SACA,sBAAA;EAAA,SACA,oBAAA;EAAA,SACA,WAAA,EAAa,yBAAA;EAAA,SACb,SAAA,EAAW,kCAAA;EAAA,SACX,IAAA;AAAA;AAAA,UAGA,uCAAA;EAAA,SACA,sBAAA;EAAA,SACA,oBAAA;EAAA,SACA,OAAA,EAAS,+BAAA;EAAA,SACT,WAAA,EAAa,yBAAA;EAAA,SACb,SAAA,EAAW,iCAAA;EAAA,SACX,IAAA;AAAA;AAAA,UAGO,kCAAA,SAA2C,uCAAA;EAAA,SAClD,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,UAGO,gCAAA,SAAyC,uCAAA;EAAA,SAChD,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,KAGE,mCAAA,GACT,kCAAA,GACA,gCAAA;;ALnDH;;;;;;UK4DiB,0BAAA;EAAA,SACP,eAAA;EAAA,SACA,gBAAA,EAAkB,mCAAA;EAAA,SAClB,IAAA;EAAA,SACA,iBAAA,EAAmB,oCAAA;AAAA;;;ALzD7B;;;iBK4QgB,+BAAA,CAAgC,KAAA,YAAiB,0BAAA;;;;ANtRjE;;;UOYiB,iBAAA;EPZkC;AAEnD;;;EAFmD,SOiBzC,oBAAA;EPfuE;AAIjF;;;EAJiF,SOqBvE,iBAAA,GACR,QAAA,UACA,OAAA;IAAA,SACU,UAAA;IAAA,SACA,OAAA;IAAA,SACA,SAAA;EAAA;EPnBI;;;;EAAA,SO2BN,uBAAA,GACR,QAAA,UACA,OAAA;IAAA,SACU,OAAA;EAAA;AAAA;AAAA,UAKK,4BAAA;EAAA,SACP,kBAAA;EAAA,SACA,+BAAA;EAAA,SACA,iBAAA;AAAA;AAAA,UAGO,2BAAA;EAAA,SACP,YAAA,GAAe,OAAA;IAAA,SACd,iBAAA;EAAA,MACJ,4BAAA;AAAA;AAAA,UAGG,sBAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,4BAAA,SAAqC,sBAAA;EAAA,SACrC,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,uBAAA;AAAA,UAEK,gBAAA;EAAA,SACP,SAAA,EAAW,uBAAA;AAAA;AAAA,UAGJ,oBAAA;EAAA,SACP,uBAAA;EAAA,SACA,yBAAA;AAAA;AAAA,UAGO,gCAAA;EAAA,SACP,IAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,+BAAA;EAAA,SACA,UAAA;AAAA;AAAA,UAGA,uBAAA;EAAA,SACA,YAAA;EAAA,SACA,SAAA,EAAW,QAAA,CAAS,MAAA,SAAe,+BAAA;AAAA;AAAA,UAGnC,4BAAA;EAAA,SACA,IAAA,EAAM,WAAA;EAAA,SACN,MAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA,GAAU,oBAAA;EAAA,SACV,MAAA;EAAA,SACA,QAAA;EAAA,SACA,iBAAA;EAAA,SACA,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGL,gCAAA,SAAyC,4BAAA;EAAA,SACzC,IAAA;EAAA,SACA,WAAA,EAAa,gCAAA;EAAA,SACb,YAAA;EAAA,SACA,eAAA,GACN,4BAAA,GACA,iCAAA,GACA,iCAAA;EAAA,SAEM,mBAAA,GAAsB,QAAA,CAC9B,MAAA,SAEG,4BAAA,GACA,iCAAA,GACA,iCAAA;EAAA,SAGK,SAAA,GAAY,uBAAA;EAAA,SACZ,aAAA;AAAA;AAAA,UAGA,8BAAA,SAAuC,4BAAA;EAAA,SACvC,IAAA;EAAA,SACA,YAAA;EAAA,SACA,+BAAA,EAAiC,QAAA,CACzC,MAAA,SAAe,QAAA,CAAS,MAAA;EAAA,SAEhB,eAAA,EAAiB,QAAA,CAAS,MAAA;AAAA;AAAA,UAG1B,8BAAA,SAAuC,4BAAA;EAAA,SACvC,IAAA;AAAA;AAAA,KAGL,wBAAA,GACF,gCAAA,GACA,8BAAA,GACA,8BAAA;AAAA,UAEO,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,wBAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGL,kBAAA,GACF,6BAAA,GACA,6BAAA,GACA,wBAAA;AAAA,KAES,8BAAA,GAAiC,kBAAA;EAAA,SACnC,QAAA;EAAA,SACA,SAAA;AAAA;AAAA,KAGE,+BAAA,GAAkC,kBAAA;EAAA,SACpC,QAAA,EAAU,UAAA;EAAA,SACV,SAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,mBAAA,GAAsB,8BAAA,GAAiC,+BAAA;AAAA,cAEtD,qCAAA;AAAA,cACA,qCAAA,EAAqC,QAAA;;;;cAKrC,4BAAA,EAA4B,QAAA;;;;cAK5B,+BAAA,EAA+B,QAAA;;;;;KAMhC,4BAAA,UAAsC,4BAAA;AAAA,KACtC,+BAAA,UAAyC,+BAAA;AAAA,UAEpC,4BAAA;EAAA,SACP,MAAA;EAAA,SACA,OAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAGO,sCAAA;EAAA,SACP,eAAA,EAAiB,+BAAA;EAAA,SACjB,YAAA,EAAc,4BAAA;AAAA;AAAA,UAGP,uCAAA,SACR,4BAAA,EAA8B,sCAAA;EAAA,SAC7B,WAAA,UAAqB,qCAAA,eAAoD,qCAAA;AAAA;AAAA,UAGlE,wCAAA,SACR,4BAAA,EAA8B,sCAAA;EAAA,SAC7B,WAAA,SAAoB,qCAAA;AAAA;AAAA,iBAGd,4CAAA,CAAA,GAAgD,sCAAA;AAAA,UAe/C,8BAAA;EAAA,SACP,IAAA;EAAA,SACA,SAAA;IAAA,SACC,IAAA;IAAA,SACA,QAAA;IAAA,SACA,QAAA;IAAA,SACA,UAAA;IAAA,SACA,cAAA;IAAA,SACA,cAAA;EAAA;EAAA,SAED,SAAA,EAAW,uCAAA;EAAA,SACX,QAAA;IAAA,SACC,gBAAA;EAAA;EAAA,SAED,UAAA,EAAY,wCAAA;AAAA;;;;;UAOL,iBAAA;EAAA,SACP,EAAA;EAAA,SACA,MAAA,YAAkB,sBAAA;EAAA,SAClB,OAAA,EAAS,wBAAA;EAAA,SACT,UAAA,GAAa,0BAAA;EAAA,SACb,iBAAA,GAAoB,QAAA,CAAS,MAAA,SAAe,0BAAA;EAAA,SAC5C,sBAAA,GAAyB,QAAA,CAAS,MAAA,SAAe,kBAAA;EAAA,SACjD,kBAAA,GAAqB,QAAA,CAAS,MAAA;EAAA,SAC9B,yBAAA,GAA4B,QAAA,CACpC,OAAA,CAAQ,MAAA,CAAO,oCAAA;EAAA,SAEP,oBAAA,GAAuB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;EAAA,SACxD,qBAAA;EAAA,SACA,aAAA,GAAgB,8BAAA;EAAA,SAChB,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,mBAAA;EAAA,SACjC,WAAA,WAAsB,gBAAA;EAAA,SACtB,iBAAA,YAA6B,sBAAA;EAAA,SAC7B,oBAAA;AAAA;AAAA,UAGO,sBAAA;EAAA,SACP,EAAA;EAAA,SACA,aAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,SAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,OAAA,GAAU,QAAA,CAAS,MAAA;EAAA,SACnB,SAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,cAAA;EAAA,SACA,eAAA;EAAA,SACA,gBAAA;EAAA,SACA,eAAA,EAAiB,MAAA;EAAA,SACjB,cAAA;EAAA,SACA,OAAA;IAAA,SACC,QAAA;IAAA,SACA,IAAA;EAAA;EAAA,SAED,IAAA,EAAM,iBAAA;AAAA;AAAA,UAGC,oBAAA;EFvSsB;;;;EAAA,SE4S7B,UAAA,GAAa,iBAAA;EFzSD;;;;EE+SrB,mBAAA,CAAoB,OAAA,EAAS,iCAAA,GAAoC,qBAAA;EDpUlC;;;;EC0U/B,gBAAA,EAAkB,IAAA,EAAM,iBAAA,EAAmB,cAAA,EAAgB,cAAA,GAAiB,OAAA;EDxUxC;;;;AAErC;EC6UC,kBAAA,EAAoB,IAAA,EAAM,iBAAA,EAAmB,cAAA,EAAgB,cAAA,GAAiB,OAAA;AAAA;AAAA,UAG9D,6CAAA;EAAA,SACP,eAAA,EAAiB,MAAA;EAAA,SACjB,IAAA,EAAM,iBAAA;AAAA;;;;;;;;UAUN,qCAAA;EAAA,SACA,aAAA;EAAA,SACA,WAAA,EAAa,QAAA,CAAS,MAAA;AAAA;AAAA,UAGtB,kDAAA,SAA2D,qCAAA;EAAA,SAC3D,IAAA;AAAA;AAAA,UAGA,uCAAA,SAAgD,qCAAA;EAAA,SAChD,IAAA;AAAA;AAAA,KAGE,iCAAA,GACT,kDAAA,GACA,uCAAA;AAAA,UAEc,uBAAA,SAAgC,oBAAA;EAAA,SACvC,cAAA;ED3VI;EAAA,SC8VJ,cAAA,EAAgB,2BAAA;ED3V2B;EC8VpD,iCAAA,CAAkC,IAAA,EAAM,iBAAA,GAAoB,mCAAA;EDzVN;EC4VtD,+BAAA,CACC,OAAA,EAAS,6CAAA,GACP,OAAA,CAAQ,iCAAA;AAAA;AAAA,UAGK,6BAAA,SAAsC,oBAAA;EAAA,SAC7C,cAAA;EDnWa;;;;ECyWtB,gBAAA,CACC,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,kBAAA;AAAA;AAAA,KAGQ,gBAAA,GAAmB,uBAAA,GAA0B,6BAAA;;;cC7Y5C,0CAAA;AAAA,KAYD,yCAAA,WACH,0CAAA;AAAA,KAEG,gCAAA,GAAmC,yCAAA;AAAA,cAElC,+CAAA;AAAA,KAKD,8CAAA,WACH,+CAAA;AAAA,KAEG,sCAAA,GAAyC,OAAA,CACpD,gCAAA,EACA,8CAAA;AAAA,cAaY,uCAAA,EAAuC,sCAAA;AAAA,cAIvC,wBAAA;AAAA,KAgBD,uBAAA,WAAkC,wBAAA;AAAA,KAElC,kCAAA;AAAA,UAEF,2BAAA;EAAA,SACA,WAAA,EAAa,kCAAA;EAAA,SACb,SAAA;AAAA;AAAA,KAGE,uBAAA,IACR,2BAAA;EAAA,SACQ,WAAA;EAAA,SACA,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,aAAA;AAAA,MAER,2BAAA;EAAA,SACQ,WAAA;EAAA,SACA,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,aAAA;AAAA;AAAA,KAGA,yCAAA;AAAA,cAIC,qCAAA,SAA8C,KAAA;EAAA,SACjD,IAAA,EAAM,yCAAA;EAAA,SACN,SAAA,EAAW,gCAAA;cAER,OAAA;IAAA,SACF,KAAA;IAAA,SACA,IAAA,EAAM,yCAAA;IAAA,SACN,SAAA,EAAW,gCAAA;EAAA;AAAA;AAAA,iBA0CA,2BAAA,CAA4B,QAAA,EAAU,QAAA,GAAW,OAAA;AAAA,cA+F1D,yBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjOA,uBAAA;AAAA,KAcD,sBAAA,WAAiC,uBAAA;AAAA,cAEhC,wBAAA;AAAA,KAED,uBAAA,WAAkC,wBAAA;AAAA,UAE7B,sBAAA;EAAA,SACP,WAAA;EAAA,SACA,aAAA;EAAA,SACA,YAAA;EAAA,SACA,SAAA;EAAA,SACA,MAAA,EAAQ,uBAAA;EAAA,SACR,KAAA;EAAA,SACA,gBAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,wBAAA;AAAA,cAEC,8BAAA;AAAA,KAED,6BAAA,WAAwC,8BAAA;AAAA,cAEvC,+BAAA;AAAA,KAUD,8BAAA,WAAyC,+BAAA;AAAA,cAE/C,yCAAA;AAAA,KAKD,wCAAA,WACI,yCAAA;AAAA,KAEJ,2CAAA,GAA8C,OAAA,CAClD,8BAAA,EACA,wCAAA;AAAA,cAGY,8BAAA;AAAA,KAQD,6BAAA,WAAwC,8BAAA;AAAA,cAEvC,2BAAA;AAAA,KAgBD,0BAAA,WAAqC,2BAAA;AAAA,UAEvC,gCAAA;EAAA,SACA,WAAA;EAAA,SACA,kBAAA,GAAqB,6BAAA;EAAA,SACrB,oBAAA,GAAuB,0BAAA;EAAA,SACvB,kBAAA,EAAoB,6BAAA;EAAA,SACpB,UAAA;EAAA,SACA,YAAA;AAAA;AAAA,KAGL,4BAAA,IACD,gCAAA;EAAA,SACQ,mBAAA,EAAqB,wCAAA;EAAA,SACrB,kBAAA;AAAA,MAER,gCAAA;EAAA,SACQ,mBAAA,EAAqB,2CAAA;EAAA,SACrB,kBAAA;AAAA;AAAA,UAGF,kCAAA;EAAA,SACA,WAAA;EAAA,SACA,kBAAA;EAAA,SACA,oBAAA;EAAA,SACA,kBAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,kBAAA;EAAA,SACA,YAAA;AAAA;AAAA,cAGG,+BAAA;AAAA,KAOD,8BAAA,WAAyC,+BAAA;AAAA,cAExC,oCAAA;AAAA,KASD,mCAAA,WACH,oCAAA;AAAA,KAEG,iCAAA,GAAoC,QAAA,CAC/C,OAAA,CAAQ,MAAA,CAAO,mCAAA;AAAA,cAGH,4BAAA;AAAA,KAMD,2BAAA,WAAsC,4BAAA;AAAA,KACtC,uBAAA;AAAA,KACA,0BAAA,GACT,uBAAA;AAAA,KAGS,+BAAA;AAAA,cAEC,qCAAA;AAAA,KAOD,oCAAA,WACH,qCAAA;AAAA,KAEG,kBAAA,IACR,sBAAA;EAAA,SACQ,IAAA;EAAA,SACA,SAAA;EAAA,SAUA,MAAA;EAAA,SAIA,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,SAAA,EAAW,oCAAA;EAAA,SACX,MAAA;EAAA,SACA,SAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA,EAAW,sCAAA;EAAA,SACX,UAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,KAAA;AAAA,MAER,sBAAA;EAAA,SACQ,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA,EAAW,wBAAA;AAAA,KACf,kCAAA,GAAqC,4BAAA,MACzC,sBAAA;EAAA,SACQ,cAAA,EAAgB,WAAA;EAAA,SAChB,IAAA;EAAA,SACA,KAAA;AAAA,MAER,sBAAA;EAAA,SACQ,iBAAA;EAAA,SACA,OAAA,GAAU,iCAAA;EAAA,SACV,MAAA,EAAQ,8BAAA;EAAA,SACR,IAAA;EAAA,SACA,qBAAA;EAAA,SACA,gBAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA,EAAW,+BAAA;EAAA,SACX,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA,MAER,sBAAA;EAAA,SACQ,MAAA,EAAQ,0BAAA;EAAA,SACR,2BAAA;EAAA,SACA,mBAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,qBAAA;EAAA,SACA,IAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,2BAAA;EAAA,SACR,MAAA;AAAA;AAAA,cAGC,oBAAA;AAAA,KAED,mBAAA,WAA8B,oBAAA;AAAA,cAE7B,oBAAA;AAAA,KAcD,mBAAA,WAA8B,oBAAA;AAAA,UAEzB,eAAA;EAAA,SACP,IAAA,EAAM,mBAAA;EAAA,SACN,WAAA,EAAa,kBAAA;EAAA,SACb,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGE,kBAAA;EAAA,SAEA,IAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,YAAA,WAAuB,kBAAA;EAAA,SACvB,MAAA;AAAA;EAAA,SAGA,MAAA,WAAiB,eAAA;EAAA,SACjB,IAAA;EAAA,SACA,YAAA,WAAuB,kBAAA;EAAA,SACvB,MAAA;AAAA;AAAA,UAGK,+BAAA;EAAA,SACP,KAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBAmKM,oBAAA,CAAqB,KAAA,YAAiB,KAAA,IAAS,kBAAA;AAAA,iBA6M/C,oBAAA,CAAqB,KAAA,EAAO,kBAAA;AAAA,iBAoK5B,wBAAA,CACf,MAAA,WAAiB,kBAAA,IACjB,OAAA,EAAS,+BAAA,GACP,kBAAA;;;UC/4Bc,kCAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA;AAAA;AAAA,UAGO,6BAAA;EAAA,SACP,YAAA;EAAA,SACA,YAAA;AAAA;AAAA,iBAGM,mCAAA,CACf,OAAA,WACE,kCAAA;AAAA,iBA0Ca,oCAAA,CACf,QAAA,kCACE,6BAAA;AAAA,iBAmBa,sCAAA,CAAuC,OAAA;AAAA,iBAiCvC,uCAAA,CACf,QAAA;;;;;;;AVlID;;;;;AAEA;;;;;AAEA;;;;;AAIA;;;;;;;;;;;;ACRA;;;;cUmCa,8BAAA;AVjCb;;;;;AACA;;;;;AAEA;;;;;;;;;AAKA;;;;;AAEA;;;;;AAVA,iBUmEgB,kBAAA,CAAmB,SAAA;;;UChElB,0BAAA;EAAA,SACP,kBAAA,EAAoB,MAAA;EAAA,SACpB,eAAA,EAAiB,MAAA,SAAe,kBAAA;AAAA;AAAA,UAGzB,iCAAA;EAAA,SACP,SAAA;EAAA,SACA,kBAAA,GAAqB,QAAA,CAAS,MAAA;EAAA,SAC9B,sBAAA,GAAyB,QAAA,CAAS,MAAA,SAAe,kBAAA;AAAA;AAAA,KAG/C,qBAAA,GAAwB,mBAAA;AAAA,UAEnB,2BAAA;EAAA,SACP,QAAA,EAAU,iBAAA;EAAA,SACV,SAAA;AAAA;AAAA,iBAGM,+BAAA,CACf,aAAA,EAAe,QAAA,CAAS,MAAA,SAAe,qBAAA,IACvC,eAAA,EAAiB,MAAA,kBACjB,OAAA,EAAS,2BAAA,GACP,0BAAA;AAAA,KA2CS,iCAAA,GAAoC,0BAAA;AAAA,iBAEhC,2BAAA,CACf,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,iCAAA;AAAA,iBAgCa,0BAAA,CACf,WAAA,EAAa,0BAAA,EACb,OAAA,GAAS,iCAAA,GACP,0BAAA;;;KC5GS,sBAAA;AAAA,UAOK,0BAAA;EAAA,SACP,SAAA;EAAA,SACA,SAAA;EAAA,SACA,KAAA;EAAA,SACA,gBAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA;AAAA;AAAA,KAGE,uBAAA;AAAA,KAOA,oBAAA;AAAA,UAMK,sBAAA;EAAA,SACP,IAAA,EAAM,oBAAA;EAAA,SACN,OAAA;AAAA;AAAA,UAGO,wBAAA;EAAA,SACP,OAAA,GAAU,sBAAA;EAAA,SACV,cAAA;AAAA;AAAA,UAGO,8BAAA;EAAA,SACP,YAAA;EAAA,SACA,KAAA,EAAO,uBAAA;EAAA,SACP,GAAA,GAAM,wBAAA;AAAA;AAAA,UAGC,2BAAA;EAAA,SACP,WAAA,GAAc,0BAAA;EAAA,SACd,MAAA,GAAS,8BAAA;EAAA,SACT,KAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,KAAA;AAAA;AAAA,UAGO,gCAAA;EAAA,SACP,SAAA;EAAA,SACA,gBAAA;AAAA;AAAA,UAGO,+BAAA;EAAA,SACP,MAAA,GAAS,8BAAA;AAAA;AAAA,UAGF,yBAAA;EAAA,SACP,OAAA,EAAS,sBAAA;EAAA,SACT,MAAA,GAAS,8BAAA;AAAA;AAAA,UAGF,qBAAA;EAAA,SACP,MAAA,EAAQ,WAAA;EAAA,SACR,KAAA;EACT,OAAA,CAAQ,OAAA,GAAU,sBAAA,GAAyB,OAAA;EAC3C,GAAA,CAAI,OAAA,GAAU,sBAAA,GAAyB,OAAA;EACvC,MAAA,CAAO,MAAA,EAAQ,8BAAA;AAAA;AAAA,UAGC,kCAAA;EAAA,SACP,WAAA,GAAc,0BAAA;EAAA,SACd,YAAA,GAAe,KAAA,UAAe,OAAA,EAAS,yBAAA,KAA8B,OAAA;EAAA,SACrE,kBAAA,GACR,KAAA,UACA,OAAA,EAAS,+BAAA,KACL,OAAA,CAAQ,gCAAA;EAAA,SACJ,oBAAA;EAAA,SACA,mBAAA,IAAuB,KAAA;EAAA,SACvB,2BAAA,IAA+B,KAAA;EAAA,SAC/B,aAAA,IAAiB,KAAA;EAAA,SACjB,mBAAA,IAAuB,KAAA;EAAA,SACvB,sBAAA;EAAA,SACA,OAAA;EAAA,SACA,6BAAA,IAAiC,KAAA,cAAmB,OAAA;EAAA,SACpD,UAAA;EAAA,SACA,cAAA,GACR,OAAA,EAAS,2BAAA,KACL,OAAA,CAAQ,4BAAA;EAAA,SACJ,cAAA,UAAwB,UAAA;EAAA,SACxB,gBAAA,UAA0B,YAAA;AAAA;AAAA,iBAqBpB,uBAAA,CAAA;AAAA,iBAIA,mBAAA,CAAoB,KAAA;AAAA,iBAIpB,mCAAA,CACf,WAAA,YACE,0BAAA;AAAA,iBA2BmB,2BAAA,CACrB,OAAA,EAAS,kCAAA,GACP,OAAA,CAAQ,qBAAA;;;cChKE,0BAAA;AAAA,cACA,sBAAA;AAAA,cACA,gCAAA;AAAA,KAED,oBAAA;AAAA,KACA,kBAAA;AAAA,UAEK,uBAAA;EAAA,SACP,YAAA;EAAA,SACA,UAAA;AAAA;AAAA,KAGE,kBAAA;EAAA,SAEA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,MAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,UAAA;AAAA;AAAA,KAGA,oBAAA,GAAuB,OAAA,CAAQ,MAAA,CAAO,oBAAA;AAAA,KACtC,8BAAA;EAAA,SAEA,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;EAAA,SAGA,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;AAAA,UAEK,kCAAA;EAAA,SACP,iBAAA;EAAA,SACA,kBAAA;EAAA,SACA,eAAA;AAAA;AAAA,KAEE,6BAAA,GAAgC,OAAA,CAAQ,MAAA,CAAO,oBAAA;AAAA,UAEjD,0BAAA;EAAA,SACA,YAAA,EAAc,uBAAA;EAAA,SACd,aAAA;EAAA,SACA,EAAA;;;;Ab3CV;WagDU,eAAA;EAAA,SACA,cAAA,GAAiB,6BAAA;AAAA;AAAA,KAGf,sBAAA,IACR,0BAAA;EAAA,SACQ,OAAA,EAAS,OAAA,CAAQ,kBAAA;IAAA,SAA+B,IAAA;EAAA;EAAA,SAChD,SAAA,EAAW,8BAAA;AAAA,MAEnB,0BAAA;EAAA,SACQ,OAAA,EAAS,OAAA,CAAQ,kBAAA;IAAA,SAA+B,IAAA;EAAA;EAAA,SAChD,YAAA,EAAc,uBAAA;IAAA,SAAqC,UAAA;EAAA;EAAA,SACnD,SAAA,EAAW,kCAAA;AAAA;AAAA,UAGN,kBAAA;EAAA,SACP,EAAA;EAAA,SACA,KAAA,WAAgB,sBAAA;AAAA;AAAA,UAGT,yBAAA;EAAA,SACP,SAAA;EAAA,SACA,OAAA,EAAS,kBAAA;EAAA,SACT,OAAA,EAAS,kBAAA;EAAA,SACT,eAAA,GAAkB,oBAAA;EAAA,SAClB,eAAA,EAAiB,oBAAA;AAAA;AAAA,UAGV,sBAAA;EAAA,SACP,OAAA,EAAS,kBAAA;EAAA,SACT,YAAA,EAAc,uBAAA;EAAA,SACd,cAAA,EAAgB,oBAAA;EAAA,SAChB,SAAA;EAAA,SACA,SAAA;EAAA,SACA,eAAA,EAAiB,oBAAA;EAAA,SACjB,UAAA;EAAA,SACA,YAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,+BAAA;AAAA,UASK,2BAAA;EAAA,SACP,gBAAA;EAAA,SACA,IAAA,EAAM,+BAAA;EAAA,SACN,SAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,OAAA,EAAS,kBAAA;EAAA,SACT,aAAA;AAAA;AAAA,KAGE,0BAAA;EAAA,SAEA,EAAA;EAAA,SACA,KAAA,EAAO,sBAAA;AAAA;EAAA,SAGP,EAAA;EAAA,SACA,KAAA,EAAO,2BAAA;AAAA;AAAA,iBA0IH,oBAAA,CAAqB,KAAA,EAAO,yBAAA,GAA4B,0BAAA;;;cC7P1D,kBAAA;AAAA,KAEF,aAAA;EAAA,UACD,kBAAA;AAAA;AAAA,iBAGK,mBAAA,CAAA,GAAuB,aAAA;AAAA,iBAIvB,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAA;AAAA,iBAI1C,kBAAA,CAAmB,KAAA,YAAiB,aAAA;;;;;;;AfhBpD;UgBOiB,iBAAA;EAAA,SACP,OAAA;EAAA,SACA,SAAA,EAAW,UAAA;AAAA;AAAA,UAGJ,aAAA;EAAA,SACP,IAAA;EAAA,SACA,WAAA;EAAA,SACA,cAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,mBAAA;EAAA,SACP,IAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,UAAA,oCAA8C,iBAAA,CAAkB,UAAA;EAAA,SACvE,GAAA,EAAK,aAAA;AAAA;AAAA,iBAWC,mBAAA,2BAAA,CACf,KAAA,WACA,SAAA,EAAW,UAAA,GACT,KAAA,IAAS,iBAAA,CAAkB,UAAA;AAAA,iBASd,eAAA,CAAgB,KAAA,YAAiB,KAAA,IAAS,aAAA;AAAA,iBAY1C,qBAAA,CAAsB,KAAA,YAAiB,KAAA,IAAS,mBAAA;;;cCpDnD,yCAAA;AAAA,cACA,uBAAA;AAAA,UAEI,cAAA,SAAuB,UAAA;EAAA,SAC9B,OAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA,EAAS,aAAA;EAAA,SACT,OAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGO,eAAA,SAAwB,iBAAA;EAAA,SAC/B,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;EAAA,SACA,UAAA;EAAA,SACA,OAAA,EAAS,aAAA;EAAA,SACT,SAAA;EAAA,SACA,GAAA,EAAK,mBAAA;EAAA,SACL,OAAA;EAAA,SACA,OAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBASM,gBAAA,CAAiB,KAAA,YAAiB,KAAA,IAAS,cAAA;AAAA,iBAc3C,iBAAA,CAAkB,KAAA,YAAiB,KAAA,IAAS,eAAA"}

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":["uuidv7","validateUuid","uuidVersion","uuidv7","validateUuid","uuidVersion","objectValue"],"sources":["../src/gateway-runtime-contract.ts","../src/gateway-lifecycle.ts","../src/audience.ts","../src/websocket-upgrade-policy.ts","../src/gateway-control-private-environment.ts","../src/health/controller-request-policy.ts","../src/health/agent-vm-health.ts","../src/git-read-allowlist.ts","../src/force-ipv4-egress.ts","../src/managed-gateway-boot-contract.ts","../src/split-resolved-gateway-secrets.ts","../src/tool-vm-active-use.ts","../src/runtime-paths/runtime-path-mapping.ts","../src/tool-vm-lease-id.ts","../src/vm-capability-lease.ts","../src/tool-vm-lease.ts"],"sourcesContent":["export const gatewayTypeValues = ['openclaw', 'hermes', 'worker'] as const;\n\nexport type GatewayType = (typeof gatewayTypeValues)[number];\n\nexport function buildGatewaySessionLabel(projectNamespace: string, zoneId: string): string {\n\treturn `${projectNamespace}:${zoneId}:gateway`;\n}\n\nexport function buildToolSessionLabel(\n\tprojectNamespace: string,\n\tzoneId: string,\n\ttcpSlot: number,\n): string {\n\treturn `${projectNamespace}:${zoneId}:tool:${tcpSlot}`;\n}\n","import type { MediatedSecretSpec, SecretResolver } from '@agent-vm/secret-management';\n\nimport type { EgressHostConfig, VmAudience } from './audience.js';\nimport type { GatewayControlPrivateEnvironmentName } from './gateway-control-private-environment.js';\nimport type { GatewayProcessSpec } from './gateway-process-spec.js';\nimport type { GatewayType } from './gateway-runtime-contract.js';\nimport type { GatewayVmRequirements } from './gateway-vm-spec.js';\nimport type { ManagedFrameworkServiceBootMetadata } from './managed-gateway-boot-contract.js';\nimport type { WebSocketUpgradeConfig } from './websocket-upgrade-policy.js';\n\n/*\n Describes how to run interactive auth for a gateway type.\n * Static property — available without a running VM.\n /\nexport interface GatewayAuthConfig {\n\t/\n\t Shell command to list available auth providers inside the VM.\n\t * Should output one provider name per line to stdout.\n\t /\n\treadonly listProvidersCommand: string;\n\n\t/\n\t Build the shell command for interactive auth login.\n\t * The CLI passes this as the SSH remote command with -t (TTY).\n\t /\n\treadonly buildLoginCommand: (\n\t\tprovider: string,\n\t\toptions?: {\n\t\t\treadonly deviceCode?: boolean;\n\t\t\treadonly agentId?: string;\n\t\t\treadonly profileId?: string;\n\t\t},\n\t) => string;\n\n\t/\n\t Build the shell command for listing provider auth profiles for one agent.\n\t * The CLI uses this after login to verify requested profile IDs exist.\n\t /\n\treadonly buildProfileListCommand: (\n\t\tprovider: string,\n\t\toptions: {\n\t\t\treadonly agentId: string;\n\t\t},\n\t) => string;\n}\n\ninterface GatewayAuthProfilesRef {\n\treadonly source: '1password' \| 'config' \| 'environment';\n}\n\ninterface OnePasswordGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: '1password';\n\treadonly ref: string;\n}\n\ninterface EnvironmentGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: 'environment';\n\treadonly envVar: string;\n}\n\ninterface ConfigGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: 'config';\n\treadonly value: string;\n}\n\nexport type GatewaySshSecretEnvMode = 'always' \| 'explicit' \| 'never';\n\nexport interface GatewaySshConfig {\n\treadonly secretEnv: GatewaySshSecretEnvMode;\n}\n\nexport interface GatewayIngressConfig {\n\treadonly upstreamHeaderTimeoutMs?: number;\n\treadonly upstreamResponseTimeoutMs?: number;\n}\n\nexport interface OpenClawGatewayControlAuthConfig {\n\treadonly mode: 'token';\n\treadonly secret: string;\n}\n\ninterface OpenClawAuthLoginProviderConfig {\n\treadonly profileIds: readonly string[];\n}\n\ninterface OpenClawAuthLoginConfig {\n\treadonly defaultAgent?: string;\n\treadonly providers: Readonly<Record<string, OpenClawAuthLoginProviderConfig>>;\n}\n\ninterface GatewayZoneBaseGatewayConfig {\n\treadonly type: GatewayType;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly port: number;\n\treadonly ingress?: GatewayIngressConfig;\n\treadonly config: string;\n\treadonly stateDir: string;\n\treadonly runtimeRootfsSize?: string;\n\treadonly ssh: GatewaySshConfig;\n}\n\ninterface OpenClawGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'openclaw';\n\treadonly controlAuth: OpenClawGatewayControlAuthConfig;\n\treadonly zoneFilesDir: string;\n\treadonly authProfilesRef?:\n\t\t\| ConfigGatewayAuthProfilesRef\n\t\t\| OnePasswordGatewayAuthProfilesRef\n\t\t\| EnvironmentGatewayAuthProfilesRef\n\t\t\| undefined;\n\treadonly authProfilesByAgent?: Readonly<\n\t\tRecord<\n\t\t\tstring,\n\t\t\t\| ConfigGatewayAuthProfilesRef\n\t\t\t\| OnePasswordGatewayAuthProfilesRef\n\t\t\t\| EnvironmentGatewayAuthProfilesRef\n\t\t>\n\t>;\n\treadonly authLogin?: OpenClawAuthLoginConfig;\n\treadonly rawEnvSecrets?: readonly string[];\n}\n\ninterface HermesGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'hermes';\n\treadonly zoneFilesDir: string;\n\treadonly discordBotTokenSecretsByAgent?: Readonly<Record<string, string>>;\n\treadonly profilesByAgent: Readonly<Record<string, string>>;\n}\n\ninterface WorkerGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'worker';\n}\n\ntype GatewayZoneGatewayConfig =\n\t\| OpenClawGatewayZoneGatewayConfig\n\t\| HermesGatewayZoneGatewayConfig\n\t\| WorkerGatewayZoneGatewayConfig;\n\ninterface OnePasswordSecretSourceConfig {\n\treadonly source: '1password';\n\treadonly ref: string;\n}\n\ninterface EnvironmentSecretSourceConfig {\n\treadonly source: 'environment';\n\treadonly envVar: string;\n}\n\ninterface ConfigSecretSourceConfig {\n\treadonly source: 'config';\n\treadonly value: string;\n}\n\ntype SecretSourceConfig =\n\t\| OnePasswordSecretSourceConfig\n\t\| EnvironmentSecretSourceConfig\n\t\| ConfigSecretSourceConfig;\n\nexport type EnvInjectedGatewaySecretConfig = SecretSourceConfig & {\n\treadonly audience: 'gateway';\n\treadonly injection: 'env';\n};\n\nexport type HttpMediatedGatewaySecretConfig = SecretSourceConfig & {\n\treadonly audience: VmAudience;\n\treadonly injection: 'http-mediation';\n\treadonly hosts: readonly string[];\n};\n\nexport type GatewaySecretConfig = EnvInjectedGatewaySecretConfig \| HttpMediatedGatewaySecretConfig;\n\nexport const gatewayToolPortalTelemetryServiceName = 'agent-vm-tool-portal' as const;\nexport const gatewayFrameworkTelemetryServiceNames = Object.freeze({\n\thermes: 'agent-vm-hermes',\n\topenclaw: 'agent-vm-openclaw',\n});\n\nexport const gatewayTelemetrySourcePolicy = Object.freeze({\n\tadmitBaggage: false,\n\tcaptureContent: false,\n});\n\nexport const gatewayTelemetryAdmissionLimits = Object.freeze({\n\tmaxExportBatchRecords: 64,\n\tmaxQueuedRecordsPerSignal: 256,\n\tmaxRecordBytes: 65_536,\n});\n\nexport type GatewayTelemetrySourcePolicy = typeof gatewayTelemetrySourcePolicy;\nexport type GatewayTelemetryAdmissionLimits = typeof gatewayTelemetryAdmissionLimits;\n\nexport interface GatewayTelemetrySignalPolicy {\n\treadonly traces: boolean;\n\treadonly metrics: boolean;\n\treadonly logs: boolean;\n\treadonly sampleRate: number;\n\treadonly flushIntervalMs: number;\n}\n\nexport interface GatewayTelemetryProducerSafetyContract {\n\treadonly admissionLimits: GatewayTelemetryAdmissionLimits;\n\treadonly sourcePolicy: GatewayTelemetrySourcePolicy;\n}\n\nexport interface GatewayFrameworkTelemetryProducerConfig\n\textends GatewayTelemetrySignalPolicy, GatewayTelemetryProducerSafetyContract {\n\treadonly serviceName: (typeof gatewayFrameworkTelemetryServiceNames)[keyof typeof gatewayFrameworkTelemetryServiceNames];\n}\n\nexport interface GatewayToolPortalTelemetryProducerConfig\n\textends GatewayTelemetrySignalPolicy, GatewayTelemetryProducerSafetyContract {\n\treadonly serviceName: typeof gatewayToolPortalTelemetryServiceName;\n}\n\nexport function createGatewayTelemetryProducerSafetyContract(): GatewayTelemetryProducerSafetyContract {\n\tif (\n\t\tgatewayTelemetryAdmissionLimits.maxExportBatchRecords >\n\t\tgatewayTelemetryAdmissionLimits.maxQueuedRecordsPerSignal\n\t) {\n\t\tthrow new Error(\n\t\t\t'Gateway telemetry maxExportBatchRecords must not exceed maxQueuedRecordsPerSignal.',\n\t\t);\n\t}\n\treturn {\n\t\tadmissionLimits: { ...gatewayTelemetryAdmissionLimits },\n\t\tsourcePolicy: { ...gatewayTelemetrySourcePolicy },\n\t};\n}\n\nexport interface GatewayZoneObservabilityConfig {\n\treadonly mode: 'collector';\n\treadonly collector: {\n\t\treadonly host: string;\n\t\treadonly grpcPort: number;\n\t\treadonly httpPort: number;\n\t\treadonly targetHost: string;\n\t\treadonly targetGrpcPort: number;\n\t\treadonly targetHttpPort: number;\n\t};\n\treadonly framework: GatewayFrameworkTelemetryProducerConfig;\n\treadonly openclaw?: {\n\t\treadonly diagnosticsFlags: readonly string[];\n\t};\n\treadonly toolPortal: GatewayToolPortalTelemetryProducerConfig;\n}\n\n/\n Zone config as the lifecycle sees it.\n * Decoupled from SystemConfig — the controller maps into this shape.\n /\nexport interface GatewayZoneConfig {\n\treadonly id: string;\n\treadonly agents?: readonly GatewayZoneAgentConfig[];\n\treadonly gateway: GatewayZoneGatewayConfig;\n\treadonly toolPortal?: GatewayZoneMcpPortalConfig;\n\treadonly runtimeMcpServers?: Readonly<Record<string, GatewayZoneMcpServerConfig>>;\n\treadonly runtimeMediatedSecrets?: Readonly<Record<string, MediatedSecretSpec>>;\n\treadonly runtimeEnvironment?: Readonly<Record<string, string>>;\n\treadonly runtimePrivateEnvironment?: Readonly<\n\t\tPartial<Record<GatewayControlPrivateEnvironmentName, string>>\n\t>;\n\treadonly runtimePluginConfigs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;\n\treadonly gitReadAllowlistRepos?: readonly string[];\n\treadonly observability?: GatewayZoneObservabilityConfig;\n\treadonly secrets: Readonly<Record<string, GatewaySecretConfig>>;\n\treadonly egressHosts: readonly EgressHostConfig[];\n\treadonly websocketUpgrades?: readonly WebSocketUpgradeConfig[];\n\treadonly defaultToolVmProfile?: string;\n}\n\nexport interface GatewayZoneAgentConfig {\n\treadonly id: string;\n\treadonly toolVmProfile?: string \| undefined;\n}\n\nexport interface GatewayZoneMcpPortalConfig {\n\treadonly configDir: string;\n}\n\nexport interface GatewayZoneMcpServerConfig {\n\treadonly headers?: Readonly<Record<string, string>>;\n\treadonly transport: 'streamable-http';\n\treadonly url: string;\n}\n\nexport interface BuildGatewayVmRequirementsOptions {\n\treadonly controllerPort: number;\n\treadonly gatewayCacheDir: string;\n\treadonly projectNamespace: string;\n\treadonly resolvedSecrets: Record<string, string>;\n\treadonly zoneRuntimeDir: string;\n\treadonly tcpPool: {\n\t\treadonly basePort: number;\n\t\treadonly size: number;\n\t};\n\treadonly zone: GatewayZoneConfig;\n}\n\nexport interface GatewayLifecycleBase {\n\t/\n\t How to run interactive auth for this gateway type.\n\t * Absent means the gateway type does not support interactive auth.\n\t /\n\treadonly authConfig?: GatewayAuthConfig \| undefined;\n\n\t/\n\t Build backend-neutral guest workload requirements.\n\t * Pure data assembly — no side effects or controller authority.\n\t /\n\tbuildVmRequirements(options: BuildGatewayVmRequirementsOptions): GatewayVmRequirements;\n\n\t/\n\t Optional hook to prepare host-side state before the VM boots.\n\t * Example: writing auth-profiles.json from 1Password.\n\t /\n\tprepareHostState?(zone: GatewayZoneConfig, secretResolver: SecretResolver): Promise<void>;\n\n\t/\n\t Optional hook to resolve host-state secret dependencies without writing\n\t * host state. Protected restarts use this before closing a live gateway so\n\t * secret-resolution failures do not strand the zone without a VM.\n\t /\n\tpreflightHostState?(zone: GatewayZoneConfig, secretResolver: SecretResolver): Promise<void>;\n}\n\nexport interface BuildManagedFrameworkServiceBootInputsOptions {\n\treadonly resolvedSecrets: Record<string, string>;\n\treadonly zone: GatewayZoneConfig;\n}\n\n/\n Sensitive framework-service inputs that the controller materializes into\n * the protected, immutable Managed Gateway boot-input directory.\n \n This contract intentionally contains no executable, argv, callback,\n * process handle, or controller authority.\n /\ninterface ManagedFrameworkServiceBootInputsBase {\n\treadonly configuration: unknown;\n\treadonly environment: Readonly<Record<string, string>>;\n}\n\ninterface ManagedFrameworkServiceConfigurationOnlyBootInputs extends ManagedFrameworkServiceBootInputsBase {\n\treadonly kind: 'configuration-only';\n}\n\ninterface ManagedHermesFrameworkServiceBootInputs extends ManagedFrameworkServiceBootInputsBase {\n\treadonly kind: 'hermes-managed-scope';\n\treadonly managedConfigurationSource: string;\n}\n\nexport type ManagedFrameworkServiceBootInputs =\n\t\| ManagedFrameworkServiceConfigurationOnlyBootInputs\n\t\| ManagedHermesFrameworkServiceBootInputs;\n\nexport interface ManagedGatewayLifecycle extends GatewayLifecycleBase {\n\treadonly executionModel: 'managed-gateway';\n\n\t/* Build the selected framework half of the exact managed boot contract. /\n\tbuildFrameworkServiceBootMetadata(zone: GatewayZoneConfig): ManagedFrameworkServiceBootMetadata;\n\n\t/* Build service-scoped config and environment for protected materialization. /\n\tbuildFrameworkServiceBootInputs(\n\t\toptions: BuildManagedFrameworkServiceBootInputsOptions,\n\t): Promise<ManagedFrameworkServiceBootInputs>;\n}\n\nexport interface DirectProcessGatewayLifecycle extends GatewayLifecycleBase {\n\treadonly executionModel: 'direct-process';\n\n\t/\n\t Build the direct-process spec retained only by standalone Worker.\n\t * Pure data assembly — no side effects.\n\t /\n\tbuildProcessSpec(\n\t\tzone: GatewayZoneConfig,\n\t\tresolvedSecrets: Record<string, string>,\n\t): GatewayProcessSpec;\n}\n\nexport type GatewayLifecycle = ManagedGatewayLifecycle \| DirectProcessGatewayLifecycle;\n","export const vmAudienceValues = ['gateway', 'tool-vm', 'both'] as const;\n\nexport type VmAudience = (typeof vmAudienceValues)[number];\nexport type RuntimeVmAudience = Exclude<VmAudience, 'both'>;\n\nexport interface EgressHostConfig {\n\treadonly host: string;\n\treadonly audience: VmAudience;\n}\n\nexport const controllerVmHost = 'controller.vm.host';\n\nexport function targetsAudience(\n\tconfigAudience: VmAudience,\n\truntimeAudience: RuntimeVmAudience,\n): boolean {\n\treturn configAudience === runtimeAudience \|\| configAudience === 'both';\n}\n\nexport function egressHostsForAudience(\n\tegressHosts: readonly EgressHostConfig[],\n\truntimeAudience: RuntimeVmAudience,\n): readonly string[] {\n\treturn egressHosts\n\t\t.filter((egressHost) => targetsAudience(egressHost.audience, runtimeAudience))\n\t\t.map((egressHost) => egressHost.host);\n}\n\nexport function gatewayVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[] {\n\treturn Array.from(\n\t\tnew Set(\n\t\t\tegressHostsForAudience(egressHosts, 'gateway').filter((host) => host !== controllerVmHost),\n\t\t),\n\t);\n}\n\nexport function workerVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[] {\n\treturn Array.from(\n\t\tnew Set(\n\t\t\tegressHostsForAudience(egressHosts, 'gateway').filter((host) => host !== controllerVmHost),\n\t\t),\n\t);\n}\n","import { targetsAudience, type RuntimeVmAudience, type VmAudience } from './audience.js';\n\nexport interface WebSocketUpgradeConfig {\n\treadonly audience: VmAudience;\n\treadonly scheme: 'ws' \| 'wss';\n\treadonly host: string;\n\treadonly port?: number \| undefined;\n\treadonly path?: string \| undefined;\n}\n\nexport interface CreateWebSocketUpgradeRequestGuardOptions {\n\treadonly rules: readonly WebSocketUpgradeConfig[];\n\treadonly runtimeAudience: RuntimeVmAudience;\n}\n\nfunction escapeRegExpLiteral(value: string): string {\n\treturn value.replace(/[.+?^${}()\|[\\]\\\\]/gu, '\\\\$&');\n}\n\nfunction hostMatchesPattern(host: string, pattern: string): boolean {\n\tconst normalizedPattern = pattern.trim().toLowerCase();\n\tif (normalizedPattern === '') {\n\t\treturn false;\n\t}\n\tif (normalizedPattern === '') {\n\t\treturn true;\n\t}\n\n\tconst patternRegex = new RegExp(\n\t\t`^${normalizedPattern.split('').map(escapeRegExpLiteral).join('.')}$`,\n\t\t'iu',\n\t);\n\treturn patternRegex.test(host.toLowerCase());\n}\n\nfunction isWebSocketUpgradeRequest(request: Request): boolean {\n\tconst upgrade = request.headers.get('upgrade')?.toLowerCase() ?? '';\n\tconst connection = request.headers.get('connection')?.toLowerCase() ?? '';\n\treturn (\n\t\tupgrade === 'websocket' \|\|\n\t\tconnection\n\t\t\t.split(',')\n\t\t\t.map((token) => token.trim())\n\t\t\t.includes('upgrade') \|\|\n\t\trequest.headers.has('sec-websocket-key') \|\|\n\t\trequest.headers.has('sec-websocket-version')\n\t);\n}\n\nfunction requestSchemeForRule(url: URL): 'ws' \| 'wss' \| null {\n\tif (url.protocol === 'http:') {\n\t\treturn 'ws';\n\t}\n\tif (url.protocol === 'https:') {\n\t\treturn 'wss';\n\t}\n\treturn null;\n}\n\nfunction requestPortForScheme(url: URL, scheme: 'ws' \| 'wss'): number {\n\tif (url.port.length > 0) {\n\t\treturn Number.parseInt(url.port, 10);\n\t}\n\treturn scheme === 'wss' ? 443 : 80;\n}\n\nfunction defaultPortForScheme(scheme: 'ws' \| 'wss'): number {\n\treturn scheme === 'wss' ? 443 : 80;\n}\n\nfunction websocketRuleMatchesRequest(rule: WebSocketUpgradeConfig, request: Request): boolean {\n\tconst url = new URL(request.url);\n\tconst requestScheme = requestSchemeForRule(url);\n\tif (requestScheme !== rule.scheme) {\n\t\treturn false;\n\t}\n\n\tif (!hostMatchesPattern(url.hostname, rule.host)) {\n\t\treturn false;\n\t}\n\n\tif (\n\t\trequestPortForScheme(url, requestScheme) !== (rule.port ?? defaultPortForScheme(rule.scheme))\n\t) {\n\t\treturn false;\n\t}\n\n\tif (rule.path !== undefined && url.pathname !== rule.path) {\n\t\treturn false;\n\t}\n\n\treturn true;\n}\n\nexport function websocketUpgradesForAudience(\n\trules: readonly WebSocketUpgradeConfig[] \| undefined,\n\truntimeAudience: RuntimeVmAudience,\n): readonly WebSocketUpgradeConfig[] {\n\treturn (rules ?? []).filter((rule) => targetsAudience(rule.audience, runtimeAudience));\n}\n\nexport function createWebSocketUpgradeRequestGuard(\n\toptions: CreateWebSocketUpgradeRequestGuardOptions,\n): (request: Request) => Promise<Response \| void> {\n\tconst runtimeRules = websocketUpgradesForAudience(options.rules, options.runtimeAudience);\n\n\treturn async (request: Request): Promise<Response \| void> => {\n\t\tif (!isWebSocketUpgradeRequest(request)) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tif (runtimeRules.some((rule) => websocketRuleMatchesRequest(rule, request))) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn new Response('WebSocket upgrade blocked by agent-vm policy', {\n\t\t\tstatus: 403,\n\t\t\tstatusText: 'Forbidden',\n\t\t});\n\t};\n}\n","export const GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV =\n\t'AGENT_VM_GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY';\nexport const GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV =\n\t'AGENT_VM_GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS';\n\nexport const GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES = [\n\tGATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV,\n\tGATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV,\n] as const;\n\nexport type GatewayControlPrivateEnvironmentName =\n\t(typeof GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES)[number];\n","export const gatewayInternalControllerRequestOperations = [\n\t'workspace-git-push',\n\t'lease-create',\n\t'lease-get',\n\t'lease-peek',\n\t'lease-renew',\n\t'lease-release',\n\t'lease-use-start',\n\t'lease-heartbeat',\n\t'lease-use-end',\n] as const;\n\nexport type GatewayInternalControllerRequestOperation =\n\t(typeof gatewayInternalControllerRequestOperations)[number];\n\nexport type ControllerRequestPolicyOperation = GatewayInternalControllerRequestOperation;\n\nexport const dedicatedControllerRequestHealthEventOperations = [\n\t'lease-heartbeat',\n\t'lease-renew',\n] as const;\n\nexport type DedicatedControllerRequestHealthEventOperation =\n\t(typeof dedicatedControllerRequestHealthEventOperations)[number];\n\nexport type GenericControllerRequestEventOperation = Exclude<\n\tControllerRequestPolicyOperation,\n\tDedicatedControllerRequestHealthEventOperation\n>;\n\nconst dedicatedControllerRequestHealthEventOperationSet = new Set<ControllerRequestPolicyOperation>(\n\tdedicatedControllerRequestHealthEventOperations,\n);\n\nfunction isGenericControllerRequestEventOperation(\n\toperation: ControllerRequestPolicyOperation,\n): operation is GenericControllerRequestEventOperation {\n\treturn !dedicatedControllerRequestHealthEventOperationSet.has(operation);\n}\n\nexport const genericControllerRequestEventOperations = [\n\t...gatewayInternalControllerRequestOperations,\n].filter(isGenericControllerRequestEventOperation);\n\nexport const externalControllerRoutes = [\n\t'GET /controller-status',\n\t'GET /zones/:zoneId/status',\n\t'GET /zones/:zoneId/health',\n\t'GET /zones/:zoneId/logs',\n\t'POST /zones/:zoneId/credentials/refresh',\n\t'POST /zones/:zoneId/destroy',\n\t'POST /zones/:zoneId/upgrade',\n\t'GET /zones/:zoneId/tasks/:taskId',\n\t'POST /zones/:zoneId/worker-tasks',\n\t'POST /zones/:zoneId/tasks/:taskId/close',\n\t'POST /zones/:zoneId/enable-ssh',\n\t'POST /zones/:zoneId/execute-command',\n\t'POST /stop-controller',\n] as const;\n\nexport type ExternalControllerRoute = (typeof externalControllerRoutes)[number];\n\nexport type ControllerRequestPolicyIdempotency = 'read' \| 'safe-mutation' \| 'unsafe-mutation';\n\ninterface ControllerRequestPolicyBase {\n\treadonly idempotency: ControllerRequestPolicyIdempotency;\n\treadonly timeoutMs: number;\n}\n\nexport type ControllerRequestPolicy =\n\t\| (ControllerRequestPolicyBase & {\n\t\t\treadonly maxAttempts: 1;\n\t\t\treadonly retryBaseDelayMs: 0;\n\t\t\treadonly retryEnabled: false;\n\t\t\treadonly retryStatuses: readonly [];\n\t })\n\t\| (ControllerRequestPolicyBase & {\n\t\t\treadonly maxAttempts: number;\n\t\t\treadonly retryBaseDelayMs: number;\n\t\t\treadonly retryEnabled: true;\n\t\t\treadonly retryStatuses: readonly [number, ...number[]];\n\t });\n\nexport type ControllerRequestPolicyTransportErrorCode =\n\t\| 'controller-request-failed'\n\t\| 'controller-request-timeout';\n\nexport class ControllerRequestPolicyTransportError extends Error {\n\treadonly code: ControllerRequestPolicyTransportErrorCode;\n\treadonly operation: ControllerRequestPolicyOperation;\n\n\tconstructor(options: {\n\t\treadonly cause: unknown;\n\t\treadonly code: ControllerRequestPolicyTransportErrorCode;\n\t\treadonly operation: ControllerRequestPolicyOperation;\n\t}) {\n\t\tconst causeMessage =\n\t\t\toptions.cause instanceof Error ? options.cause.message : String(options.cause);\n\t\tsuper(`${options.operation} ${options.code}: ${causeMessage}`, {\n\t\t\tcause: options.cause,\n\t\t});\n\t\tthis.code = options.code;\n\t\tthis.operation = options.operation;\n\t}\n}\n\nexport interface FetchControllerWithPolicyOptions {\n\treadonly fetchImpl?: (input: string \| URL \| Request, init?: RequestInit) => Promise<Response>;\n\treadonly init?: RequestInit;\n\treadonly input: string \| URL \| Request;\n\treadonly operation: ControllerRequestPolicyOperation;\n\treadonly policy?: ControllerRequestPolicy;\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted === true) {\n\t\t\treject(signal.reason);\n\t\t\treturn;\n\t\t}\n\t\tconst timeout = setTimeout(() => {\n\t\t\tsignal?.removeEventListener('abort', onAbort);\n\t\t\tresolve();\n\t\t}, ms);\n\t\tconst onAbort = (): void => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(signal?.reason);\n\t\t};\n\t\tsignal?.addEventListener('abort', onAbort, { once: true });\n\t});\n}\n\nfunction shouldRetryResponse(response: Response, policy: ControllerRequestPolicy): boolean {\n\treturn policy.retryEnabled && policy.retryStatuses.includes(response.status);\n}\n\nexport async function drainControllerResponseBody(response: Response): Promise<void> {\n\tif (response.bodyUsed) {\n\t\treturn;\n\t}\n\tawait response.text().catch(() => undefined);\n}\n\nasync function fetchWithTimeout(options: {\n\treadonly fetchImpl: (input: string \| URL \| Request, init?: RequestInit) => Promise<Response>;\n\treadonly init?: RequestInit \| undefined;\n\treadonly input: string \| URL \| Request;\n\treadonly operation: ControllerRequestPolicyOperation;\n\treadonly timeoutMs: number;\n}): Promise<Response> {\n\tconst abortController = new AbortController();\n\tlet callerAborted = options.init?.signal?.aborted ?? false;\n\tlet timedOut = false;\n\tconst abortFromCaller = (): void => {\n\t\tcallerAborted = true;\n\t\tabortController.abort(options.init?.signal?.reason);\n\t};\n\tconst timeout = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tabortController.abort(\n\t\t\tnew Error(`${options.operation} timed out after ${String(options.timeoutMs)}ms`),\n\t\t);\n\t}, options.timeoutMs);\n\tif (callerAborted) {\n\t\tabortController.abort(options.init?.signal?.reason);\n\t} else {\n\t\toptions.init?.signal?.addEventListener('abort', abortFromCaller, { once: true });\n\t}\n\ttry {\n\t\treturn await options.fetchImpl(options.input, {\n\t\t\t...options.init,\n\t\t\tsignal: abortController.signal,\n\t\t});\n\t} catch (error) {\n\t\tif (callerAborted) {\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new ControllerRequestPolicyTransportError({\n\t\t\tcause: error,\n\t\t\tcode: timedOut ? 'controller-request-timeout' : 'controller-request-failed',\n\t\t\toperation: options.operation,\n\t\t});\n\t} finally {\n\t\tclearTimeout(timeout);\n\t\toptions.init?.signal?.removeEventListener('abort', abortFromCaller);\n\t}\n}\n\nexport async function fetchControllerWithPolicy(\n\toptions: FetchControllerWithPolicyOptions,\n): Promise<Response> {\n\tconst policy = options.policy ?? controllerRequestPolicies[options.operation];\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tlet lastTransportError: ControllerRequestPolicyTransportError \| undefined;\n\tfor (let attempt = 1; attempt <= policy.maxAttempts; attempt += 1) {\n\t\ttry {\n\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- controller retries must remain ordered by attempt and backoff.\n\t\t\tconst response = await fetchWithTimeout({\n\t\t\t\tfetchImpl,\n\t\t\t\tinit: options.init,\n\t\t\t\tinput: options.input,\n\t\t\t\toperation: options.operation,\n\t\t\t\ttimeoutMs: policy.timeoutMs,\n\t\t\t});\n\t\t\tif (attempt < policy.maxAttempts && shouldRetryResponse(response, policy)) {\n\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- drain before retrying so undici can release the response body.\n\t\t\t\tawait drainControllerResponseBody(response);\n\t\t\t\tif (policy.retryBaseDelayMs > 0) {\n\t\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- retry backoff is intentionally sequential.\n\t\t\t\t\tawait sleep(policy.retryBaseDelayMs, options.init?.signal ?? undefined);\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ControllerRequestPolicyTransportError)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastTransportError = error;\n\t\t\tif (!(policy.retryEnabled && attempt < policy.maxAttempts)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (policy.retryBaseDelayMs > 0) {\n\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- retry backoff is intentionally sequential.\n\t\t\t\tawait sleep(policy.retryBaseDelayMs, options.init?.signal ?? undefined);\n\t\t\t}\n\t\t}\n\t}\n\tthrow lastTransportError ?? new Error(`${options.operation} failed without a response`);\n}\n\nexport const controllerRequestPolicies = {\n\t'workspace-git-push': {\n\t\tidempotency: 'unsafe-mutation',\n\t\tmaxAttempts: 1,\n\t\tretryBaseDelayMs: 0,\n\t\tretryEnabled: false,\n\t\tretryStatuses: [],\n\t\ttimeoutMs: 120_000,\n\t},\n\t'lease-create': {\n\t\tidempotency: 'unsafe-mutation',\n\t\tmaxAttempts: 1,\n\t\tretryBaseDelayMs: 0,\n\t\tretryEnabled: false,\n\t\tretryStatuses: [],\n\t\ttimeoutMs: 180_000,\n\t},\n\t'lease-get': {\n\t\tidempotency: 'read',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-peek': {\n\t\tidempotency: 'read',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-renew': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 3,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 10_000,\n\t},\n\t'lease-release': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-use-start': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 10_000,\n\t},\n\t'lease-heartbeat': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-use-end': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n} satisfies Record<ControllerRequestPolicyOperation, ControllerRequestPolicy>;\n","import { gatewayTypeValues, type GatewayType } from '../gateway-runtime-contract.js';\nimport {\n\tgenericControllerRequestEventOperations,\n\ttype GenericControllerRequestEventOperation,\n} from './controller-request-policy.js';\n\nexport const agentVmHealthEventKinds = [\n\t'gateway-service-health',\n\t'gateway-control-session',\n\t'controller-request',\n\t'lease-renew',\n\t'lease-heartbeat',\n\t'caller-context-rejection',\n\t'tool-vm-ssh',\n\t'gateway-plugin-health',\n\t'agent-channel-provider-health',\n\t'gateway-recovery',\n\t'gateway-recovery-suspended',\n] as const;\n\nexport type AgentVmHealthEventKind = (typeof agentVmHealthEventKinds)[number];\n\nexport const agentVmHealthResultKinds = ['ok', 'failed', 'timeout', 'stale'] as const;\n\nexport type AgentVmHealthResultKind = (typeof agentVmHealthResultKinds)[number];\n\nexport interface AgentVmHealthEventBase {\n\treadonly causationId?: string \| undefined;\n\treadonly correlationId?: string \| undefined;\n\treadonly observedAtMs: number;\n\treadonly requestId?: string \| undefined;\n\treadonly result: AgentVmHealthResultKind;\n\treadonly runId?: string \| undefined;\n\treadonly sessionKeyDigest?: string \| undefined;\n\treadonly toolCallId?: string \| undefined;\n\treadonly traceId?: string \| undefined;\n\treadonly zoneId: string;\n}\n\nexport type ToolVmSshHealthOperation = 'command' \| 'file-bridge' \| 'finalize' \| 'probe';\n\nexport const toolVmLeaseLifecycleEventRoles = ['plugin_observation', 'controller_final'] as const;\n\nexport type ToolVmLeaseLifecycleEventRole = (typeof toolVmLeaseLifecycleEventRoles)[number];\n\nexport const toolVmLeaseLifecycleTransitions = [\n\t'current_to_stale',\n\t'current_to_retired',\n\t'deprecated_to_reacquired',\n\t'deprecated_to_retired',\n\t'stale_to_reacquired',\n\t'stale_to_retired',\n\t'retired_rejected',\n] as const;\n\nexport type ToolVmLeaseLifecycleTransition = (typeof toolVmLeaseLifecycleTransitions)[number];\n\nconst toolVmLeaseReacquiredLifecycleTransitions = [\n\t'deprecated_to_reacquired',\n\t'stale_to_reacquired',\n] as const satisfies readonly ToolVmLeaseLifecycleTransition[];\n\ntype ToolVmLeaseReacquiredLifecycleTransition =\n\t(typeof toolVmLeaseReacquiredLifecycleTransitions)[number];\n\ntype ToolVmLeaseNonReacquiredLifecycleTransition = Exclude<\n\tToolVmLeaseLifecycleTransition,\n\tToolVmLeaseReacquiredLifecycleTransition\n>;\n\nexport const toolVmLeaseCallerContextStates = [\n\t'ok',\n\t'absent',\n\t'stale',\n\t'session_mismatch',\n\t'not_applicable',\n] as const;\n\nexport type ToolVmLeaseCallerContextState = (typeof toolVmLeaseCallerContextStates)[number];\n\nexport const toolVmLeaseRejectionReasons = [\n\t'caller_context_absent',\n\t'caller_context_session_mismatch',\n\t'caller_context_stale',\n\t'lease_absent',\n\t'lease_authority_absent',\n\t'lease_force_released',\n\t'lease_generation_stale',\n\t'lease_reacquire_required',\n\t'lease_releasing',\n\t'lease_retired',\n\t'lease_use_tombstoned',\n\t'ownership_denied',\n\t'runtime_not_ready',\n] as const;\n\nexport type ToolVmLeaseRejectionReason = (typeof toolVmLeaseRejectionReasons)[number];\n\ninterface ToolVmLeaseLifecycleEvidenceBase {\n\treadonly activeUseId?: string \| undefined;\n\treadonly callerContextState?: ToolVmLeaseCallerContextState \| undefined;\n\treadonly leaseRejectionReason?: ToolVmLeaseRejectionReason \| undefined;\n\treadonly lifecycleEventRole: ToolVmLeaseLifecycleEventRole;\n\treadonly oldLeaseId: string;\n\treadonly transitionId: string;\n}\n\ntype ToolVmLeaseLifecycleEvidence =\n\t\| (ToolVmLeaseLifecycleEvidenceBase & {\n\t\t\treadonly lifecycleTransition: ToolVmLeaseReacquiredLifecycleTransition;\n\t\t\treadonly replacementLeaseId: string;\n\t })\n\t\| (ToolVmLeaseLifecycleEvidenceBase & {\n\t\t\treadonly lifecycleTransition: ToolVmLeaseNonReacquiredLifecycleTransition;\n\t\t\treadonly replacementLeaseId?: undefined;\n\t });\n\ninterface ToolVmLeaseLifecycleAbsentEvidence {\n\treadonly activeUseId?: undefined;\n\treadonly callerContextState?: undefined;\n\treadonly leaseRejectionReason?: undefined;\n\treadonly lifecycleEventRole?: undefined;\n\treadonly lifecycleTransition?: undefined;\n\treadonly oldLeaseId?: undefined;\n\treadonly replacementLeaseId?: undefined;\n\treadonly transitionId?: undefined;\n}\n\nexport const agentChannelProviderHealthKinds = [\n\t'healthy',\n\t'transitioning',\n\t'unhealthy-recoverable',\n\t'unhealthy-unrecoverable',\n] as const;\n\nexport type AgentChannelProviderHealthKind = (typeof agentChannelProviderHealthKinds)[number];\n\nexport const agentChannelProviderHealthDetailKeys = [\n\t'closeCode',\n\t'providerType',\n\t'reconnectAttempt',\n\t'reconnecting',\n\t'sleepResumeSuspected',\n\t'statusCode',\n] as const;\n\nexport type AgentChannelProviderHealthDetailKey =\n\t(typeof agentChannelProviderHealthDetailKeys)[number];\n\nexport type AgentChannelProviderHealthDetails = Readonly<\n\tPartial<Record<AgentChannelProviderHealthDetailKey, boolean \| number \| string>>\n>;\n\nexport const gatewayRecoveryHealthReasons = [\n\t'agent-channel-provider-unhealthy',\n\t'gateway-control-session-unhealthy',\n\t'gateway-service-unhealthy',\n] as const;\n\nexport type GatewayRecoveryHealthReason = (typeof gatewayRecoveryHealthReasons)[number];\nexport type GatewayRecoveryVmAction = 'gateway-vm-cold-start' \| 'gateway-vm-restart';\nexport type GatewayRecoveryEventAction =\n\t\| GatewayRecoveryVmAction\n\t\| 'observe-only'\n\t\| 'operator-required';\nexport type GatewayRecoveryTimeoutErrorCode = 'recovery-callback-unconfigured' \| 'recovery-timeout';\n\nexport const gatewayControlSessionHealthOperations = [\n\t'control-session-hello',\n\t'control-session-heartbeat',\n\t'control-session-disconnect',\n\t'control-session-reconnect',\n] as const;\n\nexport type GatewayControlSessionHealthOperation =\n\t(typeof gatewayControlSessionHealthOperations)[number];\n\nexport type AgentVmHealthEvent =\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly kind: 'caller-context-rejection';\n\t\t\treadonly operation:\n\t\t\t\t\| 'lease_create'\n\t\t\t\t\| 'lease_get'\n\t\t\t\t\| 'lease_peek'\n\t\t\t\t\| 'lease_reacquire'\n\t\t\t\t\| 'lease_release'\n\t\t\t\t\| 'lease_renew'\n\t\t\t\t\| 'lease_use_end'\n\t\t\t\t\| 'lease_use_heartbeat'\n\t\t\t\t\| 'lease_use_start';\n\t\t\treadonly reason:\n\t\t\t\t\| 'caller_context_absent'\n\t\t\t\t\| 'caller_context_session_mismatch'\n\t\t\t\t\| 'caller_context_stale';\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly kind: 'gateway-service-health';\n\t\t\treadonly path: string;\n\t\t\treadonly port: number;\n\t\t\treadonly statusCode?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly bootId?: string \| undefined;\n\t\t\treadonly connectionId?: string \| undefined;\n\t\t\treadonly domain: 'gateway_control';\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-control-session';\n\t\t\treadonly operation: GatewayControlSessionHealthOperation;\n\t\t\treadonly peerId: string;\n\t\t\treadonly sessionId?: string \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly attempt: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'controller-request';\n\t\t\treadonly maxAttempts: number;\n\t\t\treadonly operation: GenericControllerRequestEventOperation;\n\t\t\treadonly statusCode?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'lease-renew';\n\t\t\treadonly leaseId: string;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'lease-heartbeat';\n\t\t\treadonly leaseId: string;\n\t\t\treadonly useId: string;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'tool-vm-ssh';\n\t\t\treadonly leaseId: string;\n\t\t\treadonly operation: ToolVmSshHealthOperation;\n\t } & (ToolVmLeaseLifecycleAbsentEvidence \| ToolVmLeaseLifecycleEvidence))\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly gatewayService: GatewayType;\n\t\t\treadonly kind: 'gateway-plugin-health';\n\t\t\treadonly state: 'starting' \| 'ready' \| 'stopping' \| 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly channelProviderId: string;\n\t\t\treadonly details?: AgentChannelProviderHealthDetails \| undefined;\n\t\t\treadonly health: AgentChannelProviderHealthKind;\n\t\t\treadonly kind: 'agent-channel-provider-health';\n\t\t\treadonly transitionStartedAtMs?: number \| undefined;\n\t\t\treadonly unhealthySinceMs?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount: number;\n\t\t\treadonly newBootedAt: string;\n\t\t\treadonly newHostPid: number;\n\t\t\treadonly newVmId: string;\n\t\t\treadonly oldBootedAt: string;\n\t\t\treadonly oldHostPid: number;\n\t\t\treadonly oldVmId: string;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'ok';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-cold-start';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount: number;\n\t\t\treadonly newBootedAt: string;\n\t\t\treadonly newHostPid: number;\n\t\t\treadonly newVmId: string;\n\t\t\treadonly oldBootedAt?: undefined;\n\t\t\treadonly oldHostPid?: undefined;\n\t\t\treadonly oldVmId?: undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'ok';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: string;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: string \| undefined;\n\t\t\treadonly oldHostPid?: number \| undefined;\n\t\t\treadonly oldVmId: string;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: GatewayRecoveryTimeoutErrorCode;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: string \| undefined;\n\t\t\treadonly oldHostPid?: number \| undefined;\n\t\t\treadonly oldVmId?: string \| undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-cold-start' \| 'observe-only' \| 'operator-required';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: string;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: undefined;\n\t\t\treadonly oldHostPid?: undefined;\n\t\t\treadonly oldVmId?: undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: GatewayRecoveryEventAction;\n\t\t\treadonly consecutiveFailedRecoveries: number;\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly errorCode: 'max-failed-recoveries';\n\t\t\treadonly failedRecoveryResetMs: number;\n\t\t\treadonly kind: 'gateway-recovery-suspended';\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t });\n\nexport const zoneHealthStateKinds = ['unknown', 'ok', 'stale', 'failed'] as const;\n\nexport type ZoneHealthStateKind = (typeof zoneHealthStateKinds)[number];\n\nexport const zoneHealthIssueKinds = [\n\t'gateway-service-unhealthy',\n\t'gateway-control-session-unhealthy',\n\t'controller-request-failing',\n\t'lease-heartbeat-failing',\n\t'lease-renew-failing',\n\t'tool-vm-ssh-failing',\n\t'gateway-plugin-unhealthy',\n\t'agent-channel-provider-unhealthy',\n\t'gateway-recovery-failed',\n\t'gateway-recovery-suspended',\n\t'health-event-stale',\n] as const;\n\nexport type ZoneHealthIssueKind = (typeof zoneHealthIssueKinds)[number];\n\nexport interface ZoneHealthIssue {\n\treadonly kind: ZoneHealthIssueKind;\n\treadonly latestEvent: AgentVmHealthEvent;\n\treadonly message: string;\n\treadonly sinceMs: number;\n}\n\nexport type ZoneHealthSnapshot =\n\t\| {\n\t\t\treadonly kind: 'unknown';\n\t\t\treadonly reason: 'no-events';\n\t\t\treadonly zoneId: string;\n\t }\n\t\| {\n\t\t\treadonly kind: 'ok';\n\t\t\treadonly latestEvents: readonly AgentVmHealthEvent[];\n\t\t\treadonly zoneId: string;\n\t }\n\t\| {\n\t\t\treadonly issues: readonly ZoneHealthIssue[];\n\t\t\treadonly kind: 'stale' \| 'failed';\n\t\t\treadonly latestEvents: readonly AgentVmHealthEvent[];\n\t\t\treadonly zoneId: string;\n\t };\n\nexport interface DeriveZoneHealthSnapshotOptions {\n\treadonly nowMs: number;\n\treadonly staleAfterMs: number;\n\treadonly zoneId: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<TValues extends readonly string[]>(\n\tvalues: TValues,\n\tvalue: unknown,\n): value is TValues[number] {\n\treturn typeof value === 'string' && values.includes(value);\n}\n\nfunction isNonNegativeFiniteNumber(value: unknown): value is number {\n\treturn typeof value === 'number' && Number.isFinite(value) && value >= 0;\n}\n\nfunction hasBaseEventFields(record: Record<string, unknown>): boolean {\n\treturn (\n\t\tisNonNegativeFiniteNumber(record.observedAtMs) &&\n\t\tisOneOf(agentVmHealthResultKinds, record.result) &&\n\t\ttypeof record.zoneId === 'string' &&\n\t\trecord.zoneId.length > 0\n\t);\n}\n\nfunction optionalString(value: unknown): boolean {\n\treturn value === undefined \|\| typeof value === 'string';\n}\n\nfunction optionalNonEmptyString(value: unknown): boolean {\n\treturn value === undefined \|\| (typeof value === 'string' && value.length > 0);\n}\n\nfunction optionalOneOf<TValues extends readonly string[]>(\n\tvalues: TValues,\n\tvalue: unknown,\n): value is TValues[number] \| undefined {\n\treturn value === undefined \|\| isOneOf(values, value);\n}\n\nfunction isToolVmLeaseReacquiredTransition(\n\tvalue: unknown,\n): value is ToolVmLeaseReacquiredLifecycleTransition {\n\treturn isOneOf(toolVmLeaseReacquiredLifecycleTransitions, value);\n}\n\nfunction optionalStatusCode(value: unknown): boolean {\n\treturn value === undefined \|\| Number.isInteger(value);\n}\n\nfunction optionalNonNegativeInteger(value: unknown): boolean {\n\treturn value === undefined \|\| (Number.isInteger(value) && Number(value) >= 0);\n}\n\nfunction isNonNegativeInteger(value: unknown): value is number {\n\treturn Number.isInteger(value) && Number(value) >= 0;\n}\n\nfunction isPositiveInteger(value: unknown): value is number {\n\treturn Number.isInteger(value) && Number(value) > 0;\n}\n\nfunction isRedactedHealthDetails(value: unknown): value is AgentChannelProviderHealthDetails {\n\tif (value === undefined) {\n\t\treturn true;\n\t}\n\tif (!isRecord(value)) {\n\t\treturn false;\n\t}\n\tfor (const [key, detailValue] of Object.entries(value)) {\n\t\tif (!isOneOf(agentChannelProviderHealthDetailKeys, key)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (!isChannelProviderHealthDetailValue(key, detailValue)) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nfunction isChannelProviderHealthDetailValue(\n\tkey: AgentChannelProviderHealthDetailKey,\n\tvalue: unknown,\n): boolean {\n\tswitch (key) {\n\t\tcase 'closeCode':\n\t\tcase 'reconnectAttempt':\n\t\tcase 'statusCode':\n\t\t\treturn isNonNegativeInteger(value);\n\t\tcase 'providerType':\n\t\t\treturn typeof value === 'string' && /^[a-z][a-z0-9._-]{0,31}$/iu.test(value);\n\t\tcase 'reconnecting':\n\t\tcase 'sleepResumeSuspected':\n\t\t\treturn typeof value === 'boolean';\n\t}\n\treturn assertNeverAgentChannelProviderHealthDetailKey(key);\n}\n\nfunction assertNeverAgentChannelProviderHealthDetailKey(key: never): never {\n\tthrow new Error(`Unhandled agent channel provider health detail key: ${String(key)}`);\n}\n\nfunction isGatewayRecoveryTimeoutErrorCode(\n\tvalue: unknown,\n): value is GatewayRecoveryTimeoutErrorCode {\n\treturn value === 'recovery-callback-unconfigured' \|\| value === 'recovery-timeout';\n}\n\nfunction isAgentChannelProviderHealthResultConsistent(\n\thealth: AgentChannelProviderHealthKind,\n\tresult: AgentVmHealthResultKind,\n): boolean {\n\tswitch (health) {\n\t\tcase 'healthy':\n\t\tcase 'transitioning':\n\t\t\treturn result === 'ok';\n\t\tcase 'unhealthy-recoverable':\n\t\tcase 'unhealthy-unrecoverable':\n\t\t\treturn result === 'failed';\n\t}\n\treturn assertNeverAgentChannelProviderHealth(health);\n}\n\nfunction hasValidToolVmLeaseLifecycleFields(value: Record<string, unknown>): boolean {\n\tconst hasLifecycleField =\n\t\tvalue.activeUseId !== undefined \|\|\n\t\tvalue.callerContextState !== undefined \|\|\n\t\tvalue.leaseRejectionReason !== undefined \|\|\n\t\tvalue.lifecycleEventRole !== undefined \|\|\n\t\tvalue.lifecycleTransition !== undefined \|\|\n\t\tvalue.oldLeaseId !== undefined \|\|\n\t\tvalue.replacementLeaseId !== undefined \|\|\n\t\tvalue.transitionId !== undefined;\n\tif (!hasLifecycleField) {\n\t\treturn true;\n\t}\n\tif (\n\t\t!(\n\t\t\toptionalNonEmptyString(value.activeUseId) &&\n\t\t\toptionalOneOf(toolVmLeaseCallerContextStates, value.callerContextState) &&\n\t\t\toptionalOneOf(toolVmLeaseRejectionReasons, value.leaseRejectionReason) &&\n\t\t\tisOneOf(toolVmLeaseLifecycleEventRoles, value.lifecycleEventRole) &&\n\t\t\tisOneOf(toolVmLeaseLifecycleTransitions, value.lifecycleTransition) &&\n\t\t\ttypeof value.oldLeaseId === 'string' &&\n\t\t\tvalue.oldLeaseId.length > 0 &&\n\t\t\ttypeof value.transitionId === 'string' &&\n\t\t\tvalue.transitionId.length > 0\n\t\t)\n\t) {\n\t\treturn false;\n\t}\n\tif (isToolVmLeaseReacquiredTransition(value.lifecycleTransition)) {\n\t\treturn typeof value.replacementLeaseId === 'string' && value.replacementLeaseId.length > 0;\n\t}\n\treturn (\n\t\tvalue.replacementLeaseId === undefined &&\n\t\toptionalOneOf(toolVmLeaseLifecycleEventRoles, value.lifecycleEventRole) &&\n\t\toptionalOneOf(toolVmLeaseLifecycleTransitions, value.lifecycleTransition)\n\t);\n}\n\nexport function isAgentVmHealthEvent(value: unknown): value is AgentVmHealthEvent {\n\tif (!isRecord(value) \|\| !hasBaseEventFields(value)) {\n\t\treturn false;\n\t}\n\tswitch (value.kind) {\n\t\tcase 'caller-context-rejection':\n\t\t\treturn (\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'lease_create',\n\t\t\t\t\t\t'lease_get',\n\t\t\t\t\t\t'lease_peek',\n\t\t\t\t\t\t'lease_reacquire',\n\t\t\t\t\t\t'lease_release',\n\t\t\t\t\t\t'lease_renew',\n\t\t\t\t\t\t'lease_use_end',\n\t\t\t\t\t\t'lease_use_heartbeat',\n\t\t\t\t\t\t'lease_use_start',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.operation,\n\t\t\t\t) &&\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'caller_context_absent',\n\t\t\t\t\t\t'caller_context_session_mismatch',\n\t\t\t\t\t\t'caller_context_stale',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.reason,\n\t\t\t\t) &&\n\t\t\t\tvalue.result === 'failed'\n\t\t\t);\n\t\tcase 'gateway-service-health':\n\t\t\treturn (\n\t\t\t\ttypeof value.path === 'string' &&\n\t\t\t\tvalue.path.length > 0 &&\n\t\t\t\tNumber.isInteger(value.port) &&\n\t\t\t\toptionalStatusCode(value.statusCode)\n\t\t\t);\n\t\tcase 'gateway-control-session':\n\t\t\treturn (\n\t\t\t\toptionalString(value.bootId) &&\n\t\t\t\toptionalString(value.connectionId) &&\n\t\t\t\tvalue.domain === 'gateway_control' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\tisOneOf(gatewayControlSessionHealthOperations, value.operation) &&\n\t\t\t\ttypeof value.peerId === 'string' &&\n\t\t\t\tvalue.peerId.length > 0 &&\n\t\t\t\toptionalString(value.sessionId)\n\t\t\t);\n\t\tcase 'controller-request':\n\t\t\treturn (\n\t\t\t\tNumber.isInteger(value.attempt) &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\tNumber.isInteger(value.maxAttempts) &&\n\t\t\t\tisOneOf(genericControllerRequestEventOperations, value.operation) &&\n\t\t\t\toptionalStatusCode(value.statusCode)\n\t\t\t);\n\t\tcase 'lease-renew':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string'\n\t\t\t);\n\t\tcase 'lease-heartbeat':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string' &&\n\t\t\t\ttypeof value.useId === 'string'\n\t\t\t);\n\t\tcase 'tool-vm-ssh':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string' &&\n\t\t\t\tisOneOf(['command', 'file-bridge', 'finalize', 'probe'] as const, value.operation) &&\n\t\t\t\thasValidToolVmLeaseLifecycleFields(value)\n\t\t\t);\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn (\n\t\t\t\tisOneOf(gatewayTypeValues, value.gatewayService) &&\n\t\t\t\tisOneOf(['starting', 'ready', 'stopping', 'failed'] as const, value.state)\n\t\t\t);\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn (\n\t\t\t\ttypeof value.channelProviderId === 'string' &&\n\t\t\t\tvalue.channelProviderId.length > 0 &&\n\t\t\t\tisOneOf(agentChannelProviderHealthKinds, value.health) &&\n\t\t\t\tisOneOf(agentVmHealthResultKinds, value.result) &&\n\t\t\t\tisAgentChannelProviderHealthResultConsistent(value.health, value.result) &&\n\t\t\t\toptionalNonNegativeInteger(value.transitionStartedAtMs) &&\n\t\t\t\toptionalNonNegativeInteger(value.unhealthySinceMs) &&\n\t\t\t\tisRedactedHealthDetails(value.details)\n\t\t\t);\n\t\tcase 'gateway-recovery':\n\t\t\tif (\n\t\t\t\t!isOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'gateway-vm-cold-start',\n\t\t\t\t\t\t'gateway-vm-restart',\n\t\t\t\t\t\t'observe-only',\n\t\t\t\t\t\t'operator-required',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.action,\n\t\t\t\t) \|\|\n\t\t\t\t!isNonNegativeInteger(value.consecutiveFailures) \|\|\n\t\t\t\t!isPositiveInteger(value.cooldownMs) \|\|\n\t\t\t\t!isNonNegativeFiniteNumber(value.elapsedMs) \|\|\n\t\t\t\t!isOneOf(gatewayRecoveryHealthReasons, value.reason) \|\|\n\t\t\t\t!optionalString(value.operationId)\n\t\t\t) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (value.result === 'ok') {\n\t\t\t\tif (value.action !== 'gateway-vm-cold-start' && value.action !== 'gateway-vm-restart') {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tconst hasNewGatewayIdentity =\n\t\t\t\t\tisNonNegativeInteger(value.leaseReleaseFailureCount) &&\n\t\t\t\t\ttypeof value.newBootedAt === 'string' &&\n\t\t\t\t\tisNonNegativeInteger(value.newHostPid) &&\n\t\t\t\t\ttypeof value.newVmId === 'string' &&\n\t\t\t\t\tvalue.errorCode === undefined;\n\t\t\t\tif (!hasNewGatewayIdentity) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tif (value.action === 'gateway-vm-cold-start') {\n\t\t\t\t\treturn (\n\t\t\t\t\t\tvalue.oldBootedAt === undefined &&\n\t\t\t\t\t\tvalue.oldHostPid === undefined &&\n\t\t\t\t\t\tvalue.oldVmId === undefined\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn (\n\t\t\t\t\ttypeof value.oldBootedAt === 'string' &&\n\t\t\t\t\tisNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\ttypeof value.oldVmId === 'string'\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (value.result === 'failed') {\n\t\t\t\tif (\n\t\t\t\t\ttypeof value.errorCode !== 'string' \|\|\n\t\t\t\t\tvalue.errorCode.length === 0 \|\|\n\t\t\t\t\t!optionalNonNegativeInteger(value.leaseReleaseFailureCount) \|\|\n\t\t\t\t\tvalue.newBootedAt !== undefined \|\|\n\t\t\t\t\tvalue.newHostPid !== undefined \|\|\n\t\t\t\t\tvalue.newVmId !== undefined \|\|\n\t\t\t\t\t!optionalString(value.operationId)\n\t\t\t\t) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tif (value.action === 'gateway-vm-restart') {\n\t\t\t\t\tif (isGatewayRecoveryTimeoutErrorCode(value.errorCode)) {\n\t\t\t\t\t\treturn (\n\t\t\t\t\t\t\toptionalString(value.oldBootedAt) &&\n\t\t\t\t\t\t\toptionalNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\t\t\toptionalString(value.oldVmId)\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\treturn (\n\t\t\t\t\t\toptionalString(value.oldBootedAt) &&\n\t\t\t\t\t\toptionalNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\t\ttypeof value.oldVmId === 'string' &&\n\t\t\t\t\t\tvalue.oldVmId.length > 0\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn (\n\t\t\t\t\t(value.action === 'gateway-vm-cold-start' \|\|\n\t\t\t\t\t\tvalue.action === 'observe-only' \|\|\n\t\t\t\t\t\tvalue.action === 'operator-required') &&\n\t\t\t\t\tvalue.oldBootedAt === undefined &&\n\t\t\t\t\tvalue.oldHostPid === undefined &&\n\t\t\t\t\tvalue.oldVmId === undefined\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn false;\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn (\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'gateway-vm-cold-start',\n\t\t\t\t\t\t'gateway-vm-restart',\n\t\t\t\t\t\t'observe-only',\n\t\t\t\t\t\t'operator-required',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.action,\n\t\t\t\t) &&\n\t\t\t\tisNonNegativeInteger(value.consecutiveFailedRecoveries) &&\n\t\t\t\tisNonNegativeInteger(value.consecutiveFailures) &&\n\t\t\t\tisPositiveInteger(value.cooldownMs) &&\n\t\t\t\tvalue.errorCode === 'max-failed-recoveries' &&\n\t\t\t\tisPositiveInteger(value.failedRecoveryResetMs) &&\n\t\t\t\toptionalString(value.operationId) &&\n\t\t\t\tisOneOf(gatewayRecoveryHealthReasons, value.reason) &&\n\t\t\t\tvalue.result === 'failed'\n\t\t\t);\n\t\tdefault:\n\t\t\treturn false;\n\t}\n}\n\nexport function healthEventBucketKey(event: AgentVmHealthEvent): string {\n\tswitch (event.kind) {\n\t\tcase 'caller-context-rejection':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.operation}:${event.reason}`;\n\t\tcase 'gateway-control-session':\n\t\t\treturn `${event.zoneId}:${event.kind}`;\n\t\tcase 'gateway-service-health':\n\t\t\treturn `${event.zoneId}:${event.kind}`;\n\t\tcase 'controller-request':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.operation}`;\n\t\tcase 'lease-heartbeat':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}:${event.useId}`;\n\t\tcase 'lease-renew':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}`;\n\t\tcase 'tool-vm-ssh':\n\t\t\tif (event.transitionId !== undefined) {\n\t\t\t\treturn `${event.zoneId}:${event.kind}:lifecycle:${event.transitionId}`;\n\t\t\t}\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}:${event.operation}`;\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.gatewayService}`;\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.channelProviderId}`;\n\t\tcase 'gateway-recovery':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.action}`;\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.action}`;\n\t}\n\treturn assertNeverHealthEvent(event);\n}\n\ntype HealthIssueBearingEvent = Exclude<\n\tAgentVmHealthEvent,\n\t{ readonly kind: 'caller-context-rejection' }\n>;\n\nfunction isHealthIssueBearingEvent(event: AgentVmHealthEvent): event is HealthIssueBearingEvent {\n\treturn event.kind !== 'caller-context-rejection';\n}\n\nfunction failedIssueKindForEvent(event: HealthIssueBearingEvent): ZoneHealthIssueKind {\n\tswitch (event.kind) {\n\t\tcase 'gateway-service-health':\n\t\t\treturn 'gateway-service-unhealthy';\n\t\tcase 'gateway-control-session':\n\t\t\treturn 'gateway-control-session-unhealthy';\n\t\tcase 'controller-request':\n\t\t\treturn 'controller-request-failing';\n\t\tcase 'lease-heartbeat':\n\t\t\treturn 'lease-heartbeat-failing';\n\t\tcase 'lease-renew':\n\t\t\treturn 'lease-renew-failing';\n\t\tcase 'tool-vm-ssh':\n\t\t\treturn 'tool-vm-ssh-failing';\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn 'gateway-plugin-unhealthy';\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn 'agent-channel-provider-unhealthy';\n\t\tcase 'gateway-recovery':\n\t\t\treturn 'gateway-recovery-failed';\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn 'gateway-recovery-suspended';\n\t}\n\treturn assertNeverHealthEvent(event);\n}\n\nfunction assertNeverHealthEvent(event: never): never {\n\tthrow new Error(`Unhandled health event kind: ${JSON.stringify(event)}`);\n}\n\nfunction assertNeverAgentChannelProviderHealth(health: never): never {\n\tthrow new Error(`Unhandled agent channel provider health: ${String(health)}`);\n}\n\nfunction issueForEvent(\n\tevent: AgentVmHealthEvent,\n\toptions: DeriveZoneHealthSnapshotOptions,\n): ZoneHealthIssue \| undefined {\n\tif (!isHealthIssueBearingEvent(event)) {\n\t\treturn undefined;\n\t}\n\tif (\n\t\toptions.nowMs - event.observedAtMs > options.staleAfterMs &&\n\t\t!isNonStalingSuccessfulEvent(event)\n\t) {\n\t\treturn {\n\t\t\tkind: 'health-event-stale',\n\t\t\tlatestEvent: event,\n\t\t\tmessage: `${event.kind} health event is stale`,\n\t\t\tsinceMs: event.observedAtMs,\n\t\t};\n\t}\n\tif (event.result === 'failed' \|\| event.result === 'timeout' \|\| event.result === 'stale') {\n\t\treturn {\n\t\t\tkind: failedIssueKindForEvent(event),\n\t\t\tlatestEvent: event,\n\t\t\tmessage: `${event.kind} health event reported ${event.result}`,\n\t\t\tsinceMs: event.observedAtMs,\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction isNonStalingSuccessfulEvent(event: AgentVmHealthEvent): boolean {\n\treturn event.kind === 'gateway-recovery' && event.result === 'ok';\n}\n\ntype ReacquiredControllerFinalToolVmSshEvent = Extract<\n\tAgentVmHealthEvent,\n\t{ readonly kind: 'tool-vm-ssh' }\n> & {\n\treadonly lifecycleEventRole: 'controller_final';\n\treadonly lifecycleTransition: ToolVmLeaseReacquiredLifecycleTransition;\n\treadonly oldLeaseId: string;\n\treadonly replacementLeaseId: string;\n\treadonly transitionId: string;\n};\n\nfunction isReacquiredControllerFinalEvent(\n\tevent: AgentVmHealthEvent,\n): event is ReacquiredControllerFinalToolVmSshEvent {\n\treturn (\n\t\tevent.kind === 'tool-vm-ssh' &&\n\t\tevent.lifecycleEventRole === 'controller_final' &&\n\t\tisToolVmLeaseReacquiredTransition(event.lifecycleTransition) &&\n\t\tevent.result === 'ok'\n\t);\n}\n\nfunction latestReacquiredAtMsByOldLeaseId(\n\tevents: readonly AgentVmHealthEvent[],\n): ReadonlyMap<string, number> {\n\tconst latestByOldLeaseId = new Map<string, number>();\n\tfor (const event of events) {\n\t\tif (!isReacquiredControllerFinalEvent(event)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst previousObservedAtMs = latestByOldLeaseId.get(event.oldLeaseId);\n\t\tif (previousObservedAtMs === undefined \|\| previousObservedAtMs < event.observedAtMs) {\n\t\t\tlatestByOldLeaseId.set(event.oldLeaseId, event.observedAtMs);\n\t\t}\n\t}\n\treturn latestByOldLeaseId;\n}\n\nfunction isPlainToolVmSshEvent(\n\tevent: AgentVmHealthEvent,\n): event is Extract<AgentVmHealthEvent, { readonly kind: 'tool-vm-ssh' }> {\n\treturn event.kind === 'tool-vm-ssh' && event.transitionId === undefined;\n}\n\nfunction filterSupersededToolVmSshEvents(\n\tevents: readonly AgentVmHealthEvent[],\n): readonly AgentVmHealthEvent[] {\n\tconst latestReacquiredAtByOldLeaseId = latestReacquiredAtMsByOldLeaseId(events);\n\treturn events.filter((event) => {\n\t\tif (!isPlainToolVmSshEvent(event)) {\n\t\t\treturn true;\n\t\t}\n\t\tconst reacquiredAtMs = latestReacquiredAtByOldLeaseId.get(event.leaseId);\n\t\treturn reacquiredAtMs === undefined \|\| reacquiredAtMs < event.observedAtMs;\n\t});\n}\n\nexport function deriveZoneHealthSnapshot(\n\tevents: readonly AgentVmHealthEvent[],\n\toptions: DeriveZoneHealthSnapshotOptions,\n): ZoneHealthSnapshot {\n\tconst latestByKey = new Map<string, AgentVmHealthEvent>();\n\tfor (const event of events) {\n\t\tif (event.zoneId !== options.zoneId \|\| event.kind === 'caller-context-rejection') {\n\t\t\tcontinue;\n\t\t}\n\t\tconst key = healthEventBucketKey(event);\n\t\tconst previous = latestByKey.get(key);\n\t\tif (!previous \|\| previous.observedAtMs <= event.observedAtMs) {\n\t\t\tlatestByKey.set(key, event);\n\t\t}\n\t}\n\tconst latestEvents = filterSupersededToolVmSshEvents([...latestByKey.values()]).toSorted(\n\t\t(first, second) => second.observedAtMs - first.observedAtMs,\n\t);\n\tif (latestEvents.length === 0) {\n\t\treturn { kind: 'unknown', reason: 'no-events', zoneId: options.zoneId };\n\t}\n\tconst issues = latestEvents\n\t\t.map((event) => issueForEvent(event, options))\n\t\t.filter((issue): issue is ZoneHealthIssue => issue !== undefined);\n\tif (issues.length === 0) {\n\t\treturn { kind: 'ok', latestEvents, zoneId: options.zoneId };\n\t}\n\tif (issues.some((issue) => issue.kind === 'health-event-stale')) {\n\t\treturn { issues, kind: 'stale', latestEvents, zoneId: options.zoneId };\n\t}\n\treturn { issues, kind: 'failed', latestEvents, zoneId: options.zoneId };\n}\n","function trimGitSuffix(repoPath: string): string {\n\treturn repoPath.replace(/\\.git$/u, '');\n}\n\nfunction normalizeRepoPath(repoPath: string): string \| undefined {\n\tconst trimmedRepoPath = trimGitSuffix(repoPath.trim().replace(/^\\/+/u, ''));\n\tconst segments = trimmedRepoPath.split('/');\n\tif (segments.length < 2 \|\| segments.some((segment) => !/^[A-Za-z0-9_.-]+$/u.test(segment))) {\n\t\treturn undefined;\n\t}\n\treturn trimmedRepoPath;\n}\n\nfunction normalizeHost(host: string): string \| undefined {\n\tconst normalizedHost = host.trim().toLowerCase();\n\tif (!/^[a-z0-9.-]+$/u.test(normalizedHost) \|\| normalizedHost.startsWith('.')) {\n\t\treturn undefined;\n\t}\n\treturn normalizedHost;\n}\n\nexport interface NormalizedGitSshReadAllowlistEntry {\n\treadonly host: string;\n\treadonly repoPath: string;\n}\n\nexport interface NormalizedGitSshReadAllowlist {\n\treadonly allowedHosts: readonly string[];\n\treadonly allowedRepos: readonly string[];\n}\n\nexport function normalizeGitRepoForSshReadAllowlist(\n\trepoUrl: string,\n): NormalizedGitSshReadAllowlistEntry \| undefined {\n\tconst trimmedRepoUrl = repoUrl.trim();\n\tif (trimmedRepoUrl.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tlet parsedUrl: URL \| undefined;\n\ttry {\n\t\tparsedUrl = new URL(trimmedRepoUrl);\n\t} catch {\n\t\tparsedUrl = undefined;\n\t}\n\tif (parsedUrl !== undefined) {\n\t\tconst host = normalizeHost(parsedUrl.hostname);\n\t\tconst repoPath = normalizeRepoPath(parsedUrl.pathname);\n\t\treturn host === undefined \|\| repoPath === undefined ? undefined : { host, repoPath };\n\t}\n\n\tconst scpMatch = /^(?:[^@]+@)?(?<host>[A-Za-z0-9.-]+):(?<repoPath>[^:]+)$/u.exec(trimmedRepoUrl);\n\tif (scpMatch?.groups?.host !== undefined && scpMatch.groups.repoPath !== undefined) {\n\t\tconst host = normalizeHost(scpMatch.groups.host);\n\t\tconst repoPath = normalizeRepoPath(scpMatch.groups.repoPath);\n\t\treturn host === undefined \|\| repoPath === undefined ? undefined : { host, repoPath };\n\t}\n\n\tconst hostPathMatch = /^(?<host>[A-Za-z0-9.-]+)\\/(?<repoPath>.+)$/u.exec(trimmedRepoUrl);\n\tif (hostPathMatch?.groups?.host !== undefined && hostPathMatch.groups.repoPath !== undefined) {\n\t\tconst repoPathWithoutHost = normalizeRepoPath(hostPathMatch.groups.repoPath);\n\t\tconst host = normalizeHost(hostPathMatch.groups.host);\n\t\tif (host !== undefined && repoPathWithoutHost !== undefined && host.includes('.')) {\n\t\t\treturn { host, repoPath: repoPathWithoutHost };\n\t\t}\n\t}\n\n\tconst bareRepoPath = normalizeRepoPath(trimmedRepoUrl);\n\tif (bareRepoPath !== undefined) {\n\t\treturn { host: 'github.com', repoPath: bareRepoPath };\n\t}\n\n\treturn undefined;\n}\n\nexport function normalizeGitReposForSshReadAllowlist(\n\trepoUrls: readonly string[] \| undefined,\n): NormalizedGitSshReadAllowlist {\n\tif (repoUrls === undefined) {\n\t\treturn { allowedHosts: [], allowedRepos: [] };\n\t}\n\tconst allowedHosts = new Set<string>();\n\tconst allowedRepos = new Set<string>();\n\tfor (const repoUrl of repoUrls) {\n\t\tconst normalizedRepo = normalizeGitRepoForSshReadAllowlist(repoUrl);\n\t\tif (normalizedRepo !== undefined) {\n\t\t\tallowedHosts.add(normalizedRepo.host);\n\t\t\tallowedRepos.add(normalizedRepo.repoPath);\n\t\t}\n\t}\n\treturn {\n\t\tallowedHosts: [...allowedHosts].toSorted(),\n\t\tallowedRepos: [...allowedRepos].toSorted(),\n\t};\n}\n\nexport function normalizeGitHubRepoForSshReadAllowlist(repoUrl: string): string \| undefined {\n\tconst trimmedRepoUrl = repoUrl.trim();\n\tif (trimmedRepoUrl.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tconst scpMatch = /^git@github\\.com:(?<repoPath>[^:]+\\/[^/]+)$/iu.exec(trimmedRepoUrl);\n\tif (scpMatch?.groups?.repoPath !== undefined) {\n\t\treturn normalizeRepoPath(scpMatch.groups.repoPath);\n\t}\n\n\tconst hostPathMatch = /^(?:github\\.com\\/)(?<repoPath>[^/]+\\/[^/]+)$/iu.exec(trimmedRepoUrl);\n\tif (hostPathMatch?.groups?.repoPath !== undefined) {\n\t\treturn normalizeRepoPath(hostPathMatch.groups.repoPath);\n\t}\n\n\tconst bareRepoPath = normalizeRepoPath(trimmedRepoUrl);\n\tif (bareRepoPath !== undefined) {\n\t\treturn bareRepoPath;\n\t}\n\n\tlet parsedUrl: URL;\n\ttry {\n\t\tparsedUrl = new URL(trimmedRepoUrl);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (parsedUrl.hostname.toLowerCase() !== 'github.com') {\n\t\treturn undefined;\n\t}\n\treturn normalizeRepoPath(parsedUrl.pathname);\n}\n\nexport function normalizeGitHubReposForSshReadAllowlist(\n\trepoUrls: readonly string[] \| undefined,\n): readonly string[] {\n\treturn normalizeGitReposForSshReadAllowlist(repoUrls).allowedRepos;\n}\n","/\n Canonical NODE_OPTIONS value for forcing IPv4-preference egress\n * in agent-vm VMs.\n \n Background: the managed VM synthetic DNS path (when tcpHosts is enabled)\n * returns a per-host IPv4 (reverse-lookable) and a single shared\n * IPv4-mapped IPv6 (::ffff:198.18.0.1, NOT reverse-lookable). Node\n * 20+'s fetch (via undici, autoSelectFamily: true) races both\n * families; when the IPv6 race wins (~5-20% under sequential load),\n * the VM egress router cannot route it and the request fails with a non-JSON\n * 400 (HTTP) or 403 (TLS). The two flags below stop the race:\n \n --dns-result-order=ipv4first changes dns.lookup() so\n * IPv4 addresses are listed\n * before IPv6.\n \n --no-network-family-autoselection disables Node's Happy\n * Eyeballs entirely. This is\n * the load-bearing flag —\n * --dns-result-order alone\n * doesn't prevent Node from\n * racing both families if\n * IPv4 is slow.\n \n Composition: NODE_OPTIONS is whitespace-separated. To add more\n * flags downstream, append rather than replace. Example:\n \n NODE_OPTIONS: `${FORCE_IPV4_EGRESS_NODE_OPTIONS} --inspect`\n \n Reference: see `shravan-claw@0ddf5f2:docs/wip/debugging/\n * 2026-05-21-lease-keepalive-400-and-discord-403-ipv6-race.md`\n * for the full root-cause analysis. Node-side flag references:\n * https://github.com/nodejs/node/issues/54359 (autoSelectFamily\n * revert recommendation by the Node core team).\n /\nexport const FORCE_IPV4_EGRESS_NODE_OPTIONS =\n\t'--dns-result-order=ipv4first --no-network-family-autoselection';\n\nconst FORCE_IPV4_EGRESS_NODE_OPTION_FLAGS = FORCE_IPV4_EGRESS_NODE_OPTIONS.split(/\\s+/u);\n\n/\n Compose the forced IPv4-preference flags with a user-provided\n * NODE_OPTIONS value (if any).\n \n Use this at every site where NODE_OPTIONS is set into a VM env\n * block AFTER a spread of user-controlled secrets, to guarantee\n * the forced flags are always present in the final value even if\n * a zone secret happens to provide its own NODE_OPTIONS.\n \n Forced flags come FIRST so they are unambiguously applied.\n * User-provided flags are appended verbatim except for duplicate\n * forced IPv4-preference flags. Node treats NODE_OPTIONS as a\n * whitespace-separated list and all flags apply.\n \n Returns just the forced flags if the user value is undefined,\n * empty, or whitespace-only.\n \n Examples:\n \n composeNodeOptions(undefined)\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection'\n \n composeNodeOptions('')\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection'\n \n composeNodeOptions('--inspect=0.0.0.0:9229')\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection\n * --inspect=0.0.0.0:9229'\n /\nexport function composeNodeOptions(userValue: string \| undefined): string {\n\tconst trimmed = userValue?.trim() ?? '';\n\tif (trimmed === '') {\n\t\treturn FORCE_IPV4_EGRESS_NODE_OPTIONS;\n\t}\n\tconst userFlags = trimmed\n\t\t.split(/\\s+/u)\n\t\t.filter((flag) => !FORCE_IPV4_EGRESS_NODE_OPTION_FLAGS.includes(flag));\n\tif (userFlags.length === 0) {\n\t\treturn FORCE_IPV4_EGRESS_NODE_OPTIONS;\n\t}\n\treturn `${FORCE_IPV4_EGRESS_NODE_OPTIONS} ${userFlags.join(' ')}`;\n}\n","export type ManagedFrameworkKind = 'openclaw' \| 'hermes';\n\nexport type ManagedFrameworkBootEntry = 'openclaw-gateway' \| 'hermes-gateway';\n\nexport interface ManagedGatewayLogIdentity {\n\treadonly guestPath: string;\n\treadonly serviceName: string;\n}\n\nexport interface ManagedToolPortalReadinessMetadata {\n\treadonly evidencePath: string;\n\treadonly kind: 'tool-portal-evidence';\n\treadonly socketPath: string;\n}\n\nexport interface ManagedFrameworkReadinessMetadata {\n\treadonly guestPort: number;\n\treadonly kind: 'framework-http';\n\treadonly path: string;\n}\n\nexport interface ManagedFrameworkIngressMetadata {\n\treadonly guestPort: number;\n\treadonly kind: 'framework-http';\n}\n\nexport interface ManagedToolPortalServiceBootMetadata {\n\treadonly bootEntry: 'agent-vm-gateway-runtime';\n\treadonly configurationInputPath: string;\n\treadonly environmentInputPath: string;\n\treadonly logIdentity: ManagedGatewayLogIdentity;\n\treadonly readiness: ManagedToolPortalReadinessMetadata;\n\treadonly role: 'tool-portal-service';\n}\n\ninterface ManagedFrameworkServiceBootMetadataBase {\n\treadonly configurationInputPath: string;\n\treadonly environmentInputPath: string;\n\treadonly ingress: ManagedFrameworkIngressMetadata;\n\treadonly logIdentity: ManagedGatewayLogIdentity;\n\treadonly readiness: ManagedFrameworkReadinessMetadata;\n\treadonly role: 'framework-service';\n}\n\nexport interface ManagedOpenClawServiceBootMetadata extends ManagedFrameworkServiceBootMetadataBase {\n\treadonly bootEntry: 'openclaw-gateway';\n\treadonly framework: 'openclaw';\n}\n\nexport interface ManagedHermesServiceBootMetadata extends ManagedFrameworkServiceBootMetadataBase {\n\treadonly bootEntry: 'hermes-gateway';\n\treadonly framework: 'hermes';\n}\n\nexport type ManagedFrameworkServiceBootMetadata =\n\t\| ManagedOpenClawServiceBootMetadata\n\t\| ManagedHermesServiceBootMetadata;\n\n/\n Exact image-owned startup contract for a managed Gateway VM.\n \n This contract intentionally contains no executable, argv, shell command,\n * callback, process handle, or resolved environment value. The image build\n * maps each closed `bootEntry` discriminator to code-owned process startup.\n /\nexport interface ManagedGatewayBootContract {\n\treadonly contractVersion: 1;\n\treadonly frameworkService: ManagedFrameworkServiceBootMetadata;\n\treadonly kind: 'managed-gateway-exact-two-role';\n\treadonly toolPortalService: ManagedToolPortalServiceBootMetadata;\n}\n\ntype UnknownRecord = Readonly<Record<string, unknown>>;\n\nfunction assertPlainRecord(value: unknown, label: string): asserts value is UnknownRecord {\n\tif (value === null \|\| typeof value !== 'object' \|\| Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be a plain object.`);\n\t}\n\tconst prototype = Reflect.getPrototypeOf(value);\n\tif (prototype !== Object.prototype && prototype !== null) {\n\t\tthrow new Error(`${label} must be a plain object.`);\n\t}\n}\n\nfunction assertExactFields(\n\trecord: UnknownRecord,\n\tlabel: string,\n\trequiredFields: readonly string[],\n): void {\n\tconst requiredFieldSet = new Set(requiredFields);\n\tfor (const fieldKey of Reflect.ownKeys(record)) {\n\t\tif (typeof fieldKey !== 'string') {\n\t\t\tthrow new Error(`${label} has an unknown symbol field.`);\n\t\t}\n\t\tconst fieldName = fieldKey;\n\t\tif (!requiredFieldSet.has(fieldName)) {\n\t\t\tthrow new Error(`${label} has unknown field '${fieldName}'.`);\n\t\t}\n\t\tconst descriptor = Reflect.getOwnPropertyDescriptor(record, fieldName);\n\t\tif (descriptor === undefined \|\| !Object.hasOwn(descriptor, 'value')) {\n\t\t\tthrow new Error(`${label}.${fieldName} must be a data field.`);\n\t\t}\n\t}\n\tfor (const fieldName of requiredFields) {\n\t\tif (!Object.hasOwn(record, fieldName)) {\n\t\t\tthrow new Error(`${label} is missing required field '${fieldName}'.`);\n\t\t}\n\t}\n}\n\nfunction parseLiteral<TLiteral extends string \| number>(\n\tvalue: unknown,\n\texpected: TLiteral,\n\tlabel: string,\n): TLiteral {\n\tif (value !== expected) {\n\t\tthrow new Error(`${label} must be ${JSON.stringify(expected)}.`);\n\t}\n\treturn expected;\n}\n\nfunction parseNonEmptyString(value: unknown, label: string): string {\n\tif (typeof value !== 'string' \|\| value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string.`);\n\t}\n\treturn value;\n}\n\nfunction parseAbsoluteGuestPath(value: unknown, label: string): string {\n\tconst guestPath = parseNonEmptyString(value, label);\n\tif (\n\t\t!guestPath.startsWith('/') \|\|\n\t\tguestPath.includes('\\0') \|\|\n\t\tguestPath.includes('//') \|\|\n\t\t(guestPath.length > 1 && guestPath.endsWith('/')) \|\|\n\t\tguestPath.split('/').some((segment) => segment === '.' \|\| segment === '..')\n\t) {\n\t\tthrow new Error(`${label} must be a normalized absolute guest path.`);\n\t}\n\treturn guestPath;\n}\n\nfunction parseHttpPath(value: unknown, label: string): string {\n\tconst httpPath = parseNonEmptyString(value, label);\n\tif (!httpPath.startsWith('/') \|\| httpPath.includes('\\0')) {\n\t\tthrow new Error(`${label} must be an absolute HTTP path.`);\n\t}\n\treturn httpPath;\n}\n\nfunction parseGuestPort(value: unknown, label: string): number {\n\tif (!Number.isInteger(value) \|\| typeof value !== 'number' \|\| value < 1 \|\| value > 65_535) {\n\t\tthrow new Error(`${label} must be an integer TCP port from 1 through 65535.`);\n\t}\n\treturn value;\n}\n\nfunction parseLogIdentity(value: unknown, label: string): ManagedGatewayLogIdentity {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPath', 'serviceName']);\n\treturn Object.freeze({\n\t\tguestPath: parseAbsoluteGuestPath(value.guestPath, `${label}.guestPath`),\n\t\tserviceName: parseNonEmptyString(value.serviceName, `${label}.serviceName`),\n\t});\n}\n\nfunction parseToolPortalReadiness(\n\tvalue: unknown,\n\tlabel: string,\n): ManagedToolPortalReadinessMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['evidencePath', 'kind', 'socketPath']);\n\treturn Object.freeze({\n\t\tevidencePath: parseAbsoluteGuestPath(value.evidencePath, `${label}.evidencePath`),\n\t\tkind: parseLiteral(value.kind, 'tool-portal-evidence', `${label}.kind`),\n\t\tsocketPath: parseAbsoluteGuestPath(value.socketPath, `${label}.socketPath`),\n\t});\n}\n\nfunction parseFrameworkReadiness(value: unknown, label: string): ManagedFrameworkReadinessMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPort', 'kind', 'path']);\n\treturn Object.freeze({\n\t\tguestPort: parseGuestPort(value.guestPort, `${label}.guestPort`),\n\t\tkind: parseLiteral(value.kind, 'framework-http', `${label}.kind`),\n\t\tpath: parseHttpPath(value.path, `${label}.path`),\n\t});\n}\n\nfunction parseFrameworkIngress(value: unknown, label: string): ManagedFrameworkIngressMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPort', 'kind']);\n\treturn Object.freeze({\n\t\tguestPort: parseGuestPort(value.guestPort, `${label}.guestPort`),\n\t\tkind: parseLiteral(value.kind, 'framework-http', `${label}.kind`),\n\t});\n}\n\nfunction parseToolPortalService(value: unknown): ManagedToolPortalServiceBootMetadata {\n\tconst label = 'Managed Gateway boot contract toolPortalService';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'bootEntry',\n\t\t'configurationInputPath',\n\t\t'environmentInputPath',\n\t\t'logIdentity',\n\t\t'readiness',\n\t\t'role',\n\t]);\n\treturn Object.freeze({\n\t\tbootEntry: parseLiteral(value.bootEntry, 'agent-vm-gateway-runtime', `${label}.bootEntry`),\n\t\tconfigurationInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.configurationInputPath,\n\t\t\t`${label}.configurationInputPath`,\n\t\t),\n\t\tenvironmentInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.environmentInputPath,\n\t\t\t`${label}.environmentInputPath`,\n\t\t),\n\t\tlogIdentity: parseLogIdentity(value.logIdentity, `${label}.logIdentity`),\n\t\treadiness: parseToolPortalReadiness(value.readiness, `${label}.readiness`),\n\t\trole: parseLiteral(value.role, 'tool-portal-service', `${label}.role`),\n\t});\n}\n\nfunction parseFrameworkService(value: unknown): ManagedFrameworkServiceBootMetadata {\n\tconst label = 'Managed Gateway boot contract frameworkService';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'bootEntry',\n\t\t'configurationInputPath',\n\t\t'environmentInputPath',\n\t\t'framework',\n\t\t'ingress',\n\t\t'logIdentity',\n\t\t'readiness',\n\t\t'role',\n\t]);\n\tconst framework = value.framework;\n\tif (framework !== 'openclaw' && framework !== 'hermes') {\n\t\tthrow new Error(`${label}.framework must be \"openclaw\" or \"hermes\".`);\n\t}\n\tconst ingress = parseFrameworkIngress(value.ingress, `${label}.ingress`);\n\tconst readiness = parseFrameworkReadiness(value.readiness, `${label}.readiness`);\n\tif (ingress.guestPort !== readiness.guestPort) {\n\t\tthrow new Error(`${label} ingress and readiness must identify the same guest port.`);\n\t}\n\tconst commonFields = {\n\t\tconfigurationInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.configurationInputPath,\n\t\t\t`${label}.configurationInputPath`,\n\t\t),\n\t\tenvironmentInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.environmentInputPath,\n\t\t\t`${label}.environmentInputPath`,\n\t\t),\n\t\tingress,\n\t\tlogIdentity: parseLogIdentity(value.logIdentity, `${label}.logIdentity`),\n\t\treadiness,\n\t\trole: parseLiteral(value.role, 'framework-service', `${label}.role`),\n\t};\n\tif (framework === 'openclaw') {\n\t\treturn Object.freeze({\n\t\t\t...commonFields,\n\t\t\tbootEntry: parseLiteral(value.bootEntry, 'openclaw-gateway', `${label}.bootEntry`),\n\t\t\tframework,\n\t\t});\n\t}\n\treturn Object.freeze({\n\t\t...commonFields,\n\t\tbootEntry: parseLiteral(value.bootEntry, 'hermes-gateway', `${label}.bootEntry`),\n\t\tframework,\n\t});\n}\n\n/\n Parses untrusted or serialized boot metadata into the exact V1 contract.\n * Unknown fields are rejected at every level and a fresh deeply frozen value\n * is returned so callers cannot retain mutation authority after validation.\n /\nexport function parseManagedGatewayBootContract(value: unknown): ManagedGatewayBootContract {\n\tconst label = 'Managed Gateway boot contract';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'contractVersion',\n\t\t'frameworkService',\n\t\t'kind',\n\t\t'toolPortalService',\n\t]);\n\treturn Object.freeze({\n\t\tcontractVersion: parseLiteral(value.contractVersion, 1, `${label}.contractVersion`),\n\t\tframeworkService: parseFrameworkService(value.frameworkService),\n\t\tkind: parseLiteral(value.kind, 'managed-gateway-exact-two-role', `${label}.kind`),\n\t\ttoolPortalService: parseToolPortalService(value.toolPortalService),\n\t});\n}\n","import type { MediatedSecretSpec } from '@agent-vm/secret-management';\n\nimport { targetsAudience, type RuntimeVmAudience } from './audience.js';\nimport type { GatewaySecretConfig, GatewayZoneConfig } from './gateway-lifecycle.js';\n\nexport interface SplitResolvedSecretsResult {\n\treadonly environmentSecrets: Record<string, string>;\n\treadonly mediatedSecrets: Record<string, MediatedSecretSpec>;\n}\n\nexport interface MergeRuntimeGatewaySecretsOptions {\n\treadonly logPrefix?: string;\n\treadonly runtimeEnvironment?: Readonly<Record<string, string>> \| undefined;\n\treadonly runtimeMediatedSecrets?: Readonly<Record<string, MediatedSecretSpec>> \| undefined;\n}\n\nexport type SecretInjectionConfig = GatewaySecretConfig;\n\nexport interface SplitResolvedSecretsOptions {\n\treadonly audience: RuntimeVmAudience;\n\treadonly logPrefix?: string;\n}\n\nexport function splitResolvedSecretsByInjection(\n\tsecretConfigs: Readonly<Record<string, SecretInjectionConfig>>,\n\tresolvedSecrets: Record<string, string>,\n\toptions: SplitResolvedSecretsOptions,\n): SplitResolvedSecretsResult {\n\tconst environmentSecrets: Record<string, string> = {};\n\tconst mediatedSecrets: Record<string, MediatedSecretSpec> = {};\n\tconst logPrefix = options.logPrefix ?? 'split-resolved-secrets';\n\n\tfor (const [secretName, secretValue] of Object.entries(resolvedSecrets)) {\n\t\tconst secretConfig = secretConfigs[secretName];\n\t\tif (!secretConfig) {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' was resolved but has no matching secret config.`,\n\t\t\t);\n\t\t}\n\t\tif (!targetsAudience(secretConfig.audience, options.audience)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (secretConfig.injection === 'http-mediation') {\n\t\t\tif (secretConfig.hosts.length === 0) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses http-mediation but declares no hosts.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tmediatedSecrets[secretName] = {\n\t\t\t\thosts: [...secretConfig.hosts],\n\t\t\t\tvalue: secretValue,\n\t\t\t};\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst envSecretAudience = (secretConfig as { readonly audience: string }).audience;\n\t\tif (envSecretAudience !== 'gateway') {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses env injection with non-gateway audience '${envSecretAudience}'.`,\n\t\t\t);\n\t\t}\n\t\tif (options.audience === 'gateway') {\n\t\t\tenvironmentSecrets[secretName] = secretValue;\n\t\t}\n\t}\n\n\treturn { environmentSecrets, mediatedSecrets };\n}\n\nexport type SplitResolvedGatewaySecretsResult = SplitResolvedSecretsResult;\n\nexport function splitResolvedGatewaySecrets(\n\tzone: GatewayZoneConfig,\n\tresolvedSecrets: Record<string, string>,\n): SplitResolvedGatewaySecretsResult {\n\treturn splitResolvedSecretsByInjection(zone.secrets, resolvedSecrets, {\n\t\taudience: 'gateway',\n\t\tlogPrefix: 'split-resolved-gateway-secrets',\n\t});\n}\n\nfunction assertNoRuntimeSecretCollision(\n\tsecretName: string,\n\ttarget: 'environment' \| 'http-mediation',\n\tbaseSecrets: SplitResolvedSecretsResult,\n\truntimeSeen: Set<string>,\n\tlogPrefix: string,\n): void {\n\tif (runtimeSeen.has(secretName)) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway secret '${secretName}' is declared for both environment and http-mediation injection.`,\n\t\t);\n\t}\n\tif (secretName in baseSecrets.environmentSecrets) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway ${target} secret '${secretName}' would overwrite an authored environment secret.`,\n\t\t);\n\t}\n\tif (secretName in baseSecrets.mediatedSecrets) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway ${target} secret '${secretName}' would overwrite an authored http-mediation secret.`,\n\t\t);\n\t}\n\truntimeSeen.add(secretName);\n}\n\nexport function mergeRuntimeGatewaySecrets(\n\tbaseSecrets: SplitResolvedSecretsResult,\n\toptions: MergeRuntimeGatewaySecretsOptions = {},\n): SplitResolvedSecretsResult {\n\tconst logPrefix = options.logPrefix ?? 'merge-runtime-gateway-secrets';\n\tconst runtimeSeen = new Set<string>();\n\tfor (const secretName of Object.keys(options.runtimeEnvironment ?? {})) {\n\t\tassertNoRuntimeSecretCollision(secretName, 'environment', baseSecrets, runtimeSeen, logPrefix);\n\t}\n\tfor (const secretName of Object.keys(options.runtimeMediatedSecrets ?? {})) {\n\t\tassertNoRuntimeSecretCollision(\n\t\t\tsecretName,\n\t\t\t'http-mediation',\n\t\t\tbaseSecrets,\n\t\t\truntimeSeen,\n\t\t\tlogPrefix,\n\t\t);\n\t}\n\n\treturn {\n\t\tenvironmentSecrets: {\n\t\t\t...baseSecrets.environmentSecrets,\n\t\t\t...options.runtimeEnvironment,\n\t\t},\n\t\tmediatedSecrets: {\n\t\t\t...baseSecrets.mediatedSecrets,\n\t\t\t...options.runtimeMediatedSecrets,\n\t\t},\n\t};\n}\n","import { v7 as uuidv7, validate as validateUuid, version as uuidVersion } from 'uuid';\n\nexport type ToolVmActiveUseOutcome =\n\t\| 'abandoned'\n\t\| 'cancelled'\n\t\| 'completed'\n\t\| 'failed'\n\t\| 'timed-out';\n\nexport interface ToolVmActiveUseCorrelation {\n\treadonly messageId?: string \| undefined;\n\treadonly requestId?: string \| undefined;\n\treadonly runId?: string \| undefined;\n\treadonly sessionKeyDigest?: string \| undefined;\n\treadonly toolCallId?: string \| undefined;\n\treadonly traceId?: string \| undefined;\n}\n\nexport type ToolVmSshOperationPhase =\n\t\| 'completed'\n\t\| 'failed'\n\t\| 'probe-succeeded'\n\t\| 'running'\n\t\| 'starting';\n\nexport type ToolVmSshFailureKind =\n\t\| 'active-use-refreshable-failure'\n\t\| 'ssh-command-failed'\n\t\| 'ssh-command-timed-out'\n\t\| 'ssh-probe-failed';\n\nexport interface ToolVmSshFailureReport {\n\treadonly kind: ToolVmSshFailureKind;\n\treadonly message: string;\n}\n\nexport interface ToolVmSshOperationReport {\n\treadonly failure?: ToolVmSshFailureReport \| undefined;\n\treadonly probeSucceeded?: boolean \| undefined;\n}\n\nexport interface ToolVmActiveUseOperationReport {\n\treadonly observedAtMs: number;\n\treadonly phase: ToolVmSshOperationPhase;\n\treadonly ssh?: ToolVmSshOperationReport \| undefined;\n}\n\nexport interface StartToolVmActiveUseRequest {\n\treadonly correlation?: ToolVmActiveUseCorrelation \| undefined;\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n\treadonly useId: string;\n}\n\nexport interface StartToolVmActiveUseResponse {\n\treadonly expiresAt: number;\n\treadonly heartbeatAfterMs: number;\n\treadonly useId: string;\n}\n\nexport interface HeartbeatToolVmActiveUseResponse {\n\treadonly expiresAt: number;\n\treadonly heartbeatAfterMs: number;\n}\n\nexport interface HeartbeatToolVmActiveUseRequest {\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n}\n\nexport interface EndToolVmActiveUseRequest {\n\treadonly outcome: ToolVmActiveUseOutcome;\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n}\n\nexport interface ToolVmActiveUseHandle {\n\treadonly signal: AbortSignal;\n\treadonly useId: string;\n\tdispose(outcome?: ToolVmActiveUseOutcome): Promise<void>;\n\tend(outcome?: ToolVmActiveUseOutcome): Promise<void>;\n\treport(report: ToolVmActiveUseOperationReport): void;\n}\n\nexport interface CreateToolVmActiveUseHandleOptions {\n\treadonly correlation?: ToolVmActiveUseCorrelation \| undefined;\n\treadonly endActiveUse: (useId: string, request: EndToolVmActiveUseRequest) => Promise<void>;\n\treadonly heartbeatActiveUse: (\n\t\tuseId: string,\n\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t) => Promise<HeartbeatToolVmActiveUseResponse>;\n\treadonly heartbeatJitterRatio?: number \| undefined;\n\treadonly isEndErrorTolerable?: (error: unknown) => boolean;\n\treadonly isHeartbeatErrorRefreshable?: (error: unknown) => boolean;\n\treadonly logEndFailure?: (error: unknown) => void;\n\treadonly logHeartbeatFailure?: (error: unknown) => void;\n\treadonly maxHeartbeatDurationMs?: number \| undefined;\n\treadonly nowImpl?: (() => number) \| undefined;\n\treadonly onRefreshableHeartbeatFailure?: (error: unknown) => Promise<void>;\n\treadonly randomImpl?: (() => number) \| undefined;\n\treadonly startActiveUse: (\n\t\trequest: StartToolVmActiveUseRequest,\n\t) => Promise<StartToolVmActiveUseResponse>;\n\treadonly setTimeoutImpl?: typeof setTimeout \| undefined;\n\treadonly clearTimeoutImpl?: typeof clearTimeout \| undefined;\n}\n\ntype HeartbeatTimer = ReturnType<typeof setTimeout>;\n\nconst defaultMaxHeartbeatDurationMs = 12 60 * 60 * 1000;\n\nfunction jitterDelayMs(params: {\n\treadonly delayMs: number;\n\treadonly jitterRatio: number;\n\treadonly random: () => number;\n}): number {\n\tif (params.jitterRatio <= 0) {\n\t\treturn params.delayMs;\n\t}\n\tconst spreadMs = params.delayMs * params.jitterRatio;\n\tconst minMs = params.delayMs - spreadMs;\n\tconst jitteredMs = minMs + params.random() * spreadMs * 2;\n\treturn Math.max(1, Math.round(jitteredMs));\n}\n\nexport function createToolVmActiveUseId(): string {\n\treturn uuidv7();\n}\n\nexport function isToolVmActiveUseId(value: string): boolean {\n\treturn validateUuid(value) && uuidVersion(value) === 7;\n}\n\nexport function normalizeToolVmActiveUseCorrelation(\n\tcorrelation: unknown,\n): ToolVmActiveUseCorrelation \| undefined {\n\tif (!isToolVmActiveUseCorrelationRecord(correlation)) {\n\t\treturn undefined;\n\t}\n\tconst getString = (key: keyof ToolVmActiveUseCorrelation): string \| undefined => {\n\t\tconst value = correlation[key];\n\t\treturn typeof value === 'string' && value.length > 0 ? value : undefined;\n\t};\n\tconst normalizedCorrelation = {\n\t\t...(getString('messageId') !== undefined ? { messageId: getString('messageId') } : {}),\n\t\t...(getString('requestId') !== undefined ? { requestId: getString('requestId') } : {}),\n\t\t...(getString('runId') !== undefined ? { runId: getString('runId') } : {}),\n\t\t...(getString('sessionKeyDigest') !== undefined\n\t\t\t? { sessionKeyDigest: getString('sessionKeyDigest') }\n\t\t\t: {}),\n\t\t...(getString('toolCallId') !== undefined ? { toolCallId: getString('toolCallId') } : {}),\n\t\t...(getString('traceId') !== undefined ? { traceId: getString('traceId') } : {}),\n\t} satisfies ToolVmActiveUseCorrelation;\n\treturn Object.keys(normalizedCorrelation).length > 0 ? normalizedCorrelation : undefined;\n}\n\nfunction isToolVmActiveUseCorrelationRecord(\n\tvalue: unknown,\n): value is Readonly<Record<keyof ToolVmActiveUseCorrelation, unknown>> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport async function createToolVmActiveUseHandle(\n\toptions: CreateToolVmActiveUseHandleOptions,\n): Promise<ToolVmActiveUseHandle> {\n\tconst useId = createToolVmActiveUseId();\n\tconst startedUse = await options.startActiveUse({\n\t\t...(options.correlation ? { correlation: options.correlation } : {}),\n\t\tuseId,\n\t});\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst now = options.nowImpl ?? Date.now;\n\tconst startedAt = now();\n\tconst maxHeartbeatDurationMs = options.maxHeartbeatDurationMs ?? defaultMaxHeartbeatDurationMs;\n\tconst heartbeatJitterRatio = options.heartbeatJitterRatio ?? 0.1;\n\tconst random = options.randomImpl ?? Math.random;\n\tconst operationAbortController = new AbortController();\n\tlet ended = false;\n\tlet heartbeatTimer: HeartbeatTimer \| undefined;\n\tlet latestReport: ToolVmActiveUseOperationReport \| undefined;\n\n\tconst clearHeartbeatTimer = (): void => {\n\t\tif (heartbeatTimer) {\n\t\t\tclearTimeoutImpl(heartbeatTimer);\n\t\t\theartbeatTimer = undefined;\n\t\t}\n\t};\n\n\tconst scheduleHeartbeat = (delayMs: number): void => {\n\t\tif (now() - startedAt >= maxHeartbeatDurationMs) {\n\t\t\treturn;\n\t\t}\n\t\tclearHeartbeatTimer();\n\t\theartbeatTimer = setTimeoutImpl(\n\t\t\t() => {\n\t\t\t\tif (now() - startedAt >= maxHeartbeatDurationMs) {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst heartbeatRequest: HeartbeatToolVmActiveUseRequest =\n\t\t\t\t\tlatestReport === undefined ? {} : { report: latestReport };\n\t\t\t\tvoid options\n\t\t\t\t\t.heartbeatActiveUse(startedUse.useId, heartbeatRequest)\n\t\t\t\t\t.then((heartbeat) => {\n\t\t\t\t\t\tif (!ended) {\n\t\t\t\t\t\t\tscheduleHeartbeat(heartbeat.heartbeatAfterMs);\n\t\t\t\t\t\t}\n\t\t\t\t\t})\n\t\t\t\t\t.catch((error: unknown) => {\n\t\t\t\t\t\toptions.logHeartbeatFailure?.(error);\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\toptions.isHeartbeatErrorRefreshable?.(error) === true &&\n\t\t\t\t\t\t\toptions.onRefreshableHeartbeatFailure\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\toperationAbortController.abort(error);\n\t\t\t\t\t\t\tended = true;\n\t\t\t\t\t\t\tclearHeartbeatTimer();\n\t\t\t\t\t\t\tvoid options.onRefreshableHeartbeatFailure(error).catch((staleError: unknown) => {\n\t\t\t\t\t\t\t\toptions.logHeartbeatFailure?.(staleError);\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (!ended) {\n\t\t\t\t\t\t\tscheduleHeartbeat(startedUse.heartbeatAfterMs);\n\t\t\t\t\t\t}\n\t\t\t\t\t});\n\t\t\t},\n\t\t\tjitterDelayMs({ delayMs, jitterRatio: heartbeatJitterRatio, random }),\n\t\t);\n\t};\n\n\tscheduleHeartbeat(startedUse.heartbeatAfterMs);\n\n\tconst end = async (outcome: ToolVmActiveUseOutcome = 'completed'): Promise<void> => {\n\t\tif (ended) {\n\t\t\treturn;\n\t\t}\n\t\tended = true;\n\t\tclearHeartbeatTimer();\n\t\ttry {\n\t\t\tawait options.endActiveUse(startedUse.useId, {\n\t\t\t\toutcome,\n\t\t\t\t...(latestReport === undefined ? {} : { report: latestReport }),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (options.isEndErrorTolerable?.(error) === true) {\n\t\t\t\toptions.logEndFailure?.(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\treturn {\n\t\tsignal: operationAbortController.signal,\n\t\tuseId: startedUse.useId,\n\t\tdispose: end,\n\t\tend,\n\t\treport: (report): void => {\n\t\t\tif (ended) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlatestReport = report;\n\t\t},\n\t};\n}\n","export const TOOL_VM_WORK_GUEST_ROOT = '/work';\nexport const TOOL_VM_SCRATCH_GUEST_ROOT = '/scratch';\nexport const OPENCLAW_STATE_VM_ROOT = '/home/openclaw/.openclaw/state';\nexport const OPENCLAW_STATE_SANDBOXES_VM_ROOT = `${OPENCLAW_STATE_VM_ROOT}/sandboxes`;\n\nexport type RuntimePathNamespace = 'controller-host' \| 'openclaw-gateway' \| 'tool-vm-guest';\nexport type RuntimePathPurpose = 'executionCwd' \| 'leaseMount';\n\nexport interface RuntimePathCapabilities {\n\treadonly executionCwd: boolean;\n\treadonly leaseMount: boolean;\n}\n\nexport type RuntimePathBacking =\n\t\| {\n\t\t\treadonly kind: 'host-realfs';\n\t\t\treadonly durability: 'durable' \| 'runtime' \| 'cache';\n\t\t\treadonly backup: 'included' \| 'excluded';\n\t }\n\t\| {\n\t\t\treadonly kind: 'guest-rootfs-cow';\n\t\t\treadonly durability: 'vm-lifetime';\n\t };\n\nexport type RuntimePathLocations = Partial<Record<RuntimePathNamespace, string>>;\nexport type RuntimePathHostRealfsLocations =\n\t\| {\n\t\t\treadonly 'controller-host': string;\n\t\t\treadonly 'openclaw-gateway'?: string;\n\t\t\treadonly 'tool-vm-guest'?: string;\n\t }\n\t\| {\n\t\t\treadonly 'controller-host'?: string;\n\t\t\treadonly 'openclaw-gateway': string;\n\t\t\treadonly 'tool-vm-guest'?: string;\n\t };\nexport interface RuntimePathGuestRootfsCowLocations {\n\treadonly 'controller-host'?: never;\n\treadonly 'openclaw-gateway'?: never;\n\treadonly 'tool-vm-guest': string;\n}\nexport type RuntimePathGuidanceVisibility = Partial<Record<RuntimePathNamespace, boolean>>;\n\ninterface RuntimePathRootMappingBase {\n\treadonly capabilities: RuntimePathCapabilities;\n\treadonly guidanceLabel: string;\n\treadonly id: string;\n\t/*\n\t False for broad roots like /zone where mounting the root would expose\n\t * unrelated children; callers must request an explicit child path.\n\t /\n\treadonly rootPathAllowed: boolean;\n\treadonly showInGuidance?: RuntimePathGuidanceVisibility;\n}\n\nexport type RuntimePathRootMapping =\n\t\| (RuntimePathRootMappingBase & {\n\t\t\treadonly backing: Extract<RuntimePathBacking, { readonly kind: 'host-realfs' }>;\n\t\t\treadonly locations: RuntimePathHostRealfsLocations;\n\t })\n\t\| (RuntimePathRootMappingBase & {\n\t\t\treadonly backing: Extract<RuntimePathBacking, { readonly kind: 'guest-rootfs-cow' }>;\n\t\t\treadonly capabilities: RuntimePathCapabilities & { readonly leaseMount: false };\n\t\t\treadonly locations: RuntimePathGuestRootfsCowLocations;\n\t });\n\nexport interface RuntimePathMapping {\n\treadonly id: string;\n\treadonly roots: readonly RuntimePathRootMapping[];\n}\n\nexport interface TranslateRuntimePathInput {\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly purpose: RuntimePathPurpose;\n\treadonly sourceNamespace?: RuntimePathNamespace;\n\treadonly targetNamespace: RuntimePathNamespace;\n}\n\nexport interface RuntimePathTranslation {\n\treadonly backing: RuntimePathBacking;\n\treadonly capabilities: RuntimePathCapabilities;\n\treadonly inputNamespace: RuntimePathNamespace;\n\treadonly inputPath: string;\n\treadonly mappingId: string;\n\treadonly outputNamespace: RuntimePathNamespace;\n\treadonly outputPath: string;\n\treadonly relativePath: string;\n\treadonly rootId: string;\n}\n\nexport type RuntimePathTranslationErrorCode =\n\t\| 'path-not-absolute'\n\t\| 'path-parent-traversal'\n\t\| 'invalid-runtime-root'\n\t\| 'unknown-runtime-path'\n\t\| 'purpose-not-allowed'\n\t\| 'root-path-not-allowed'\n\t\| 'target-namespace-not-available';\n\nexport interface RuntimePathTranslationError {\n\treadonly allowedPathForms: readonly string[];\n\treadonly code: RuntimePathTranslationErrorCode;\n\treadonly inputPath: string;\n\treadonly mappingId: string;\n\treadonly message: string;\n\treadonly purpose: RuntimePathPurpose;\n\treadonly retryGuidance: string;\n}\n\nexport type TranslateRuntimePathResult =\n\t\| {\n\t\t\treadonly ok: true;\n\t\t\treadonly value: RuntimePathTranslation;\n\t }\n\t\| {\n\t\t\treadonly ok: false;\n\t\t\treadonly error: RuntimePathTranslationError;\n\t };\n\ninterface RuntimePathRootMatch {\n\treadonly inputNamespace: RuntimePathNamespace;\n\treadonly matchedRoot: string;\n\treadonly root: RuntimePathRootMapping;\n}\n\nconst guidanceNamespaceOrder = [\n\t'tool-vm-guest',\n\t'openclaw-gateway',\n\t'controller-host',\n] as const satisfies readonly RuntimePathNamespace[];\n\nfunction pathContainsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction normalizeAbsolutePath(inputPath: string): string {\n\tconst rawSegments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${rawSegments.join('/')}`;\n}\n\nfunction normalizeRoot(rootPath: string): string {\n\tconst normalizedRoot = normalizeAbsolutePath(rootPath);\n\treturn normalizedRoot === '/' ? normalizedRoot : normalizedRoot.replace(/\\/+$/u, '');\n}\n\nfunction pathMatchesRoot(candidatePath: string, rootPath: string): boolean {\n\treturn candidatePath === rootPath \|\| candidatePath.startsWith(`${rootPath}/`);\n}\n\nfunction relativePathForRoot(candidatePath: string, rootPath: string): string {\n\treturn candidatePath === rootPath ? '' : candidatePath.slice(rootPath.length + 1);\n}\n\nfunction joinRootAndRelative(rootPath: string, relativePath: string): string {\n\treturn relativePath === '' ? rootPath : `${rootPath}/${relativePath}`;\n}\n\nfunction runtimeRootIsInvalid(rootPath: string): boolean {\n\treturn (\n\t\trootPath.trim() === '' \|\| !rootPath.startsWith('/') \|\| pathContainsParentTraversal(rootPath)\n\t);\n}\n\nfunction namespaceShouldShowInGuidance(\n\troot: RuntimePathRootMapping,\n\tnamespace: RuntimePathNamespace,\n): boolean {\n\tif (root.showInGuidance?.[namespace] !== undefined) {\n\t\treturn root.showInGuidance[namespace];\n\t}\n\treturn namespace !== 'controller-host';\n}\n\nfunction allowedPathFormsForMapping(\n\tmapping: RuntimePathMapping,\n\tpurpose: RuntimePathPurpose,\n): readonly string[] {\n\treturn mapping.roots.flatMap((root) => {\n\t\tif (!root.capabilities[purpose]) {\n\t\t\treturn [];\n\t\t}\n\t\tconst suffix = root.rootPathAllowed ? '[/subpath]' : '/<child>';\n\t\treturn guidanceNamespaceOrder.flatMap((namespace): string[] => {\n\t\t\tconst rootPath = root.locations[namespace];\n\t\t\tif (rootPath === undefined \|\| !namespaceShouldShowInGuidance(root, namespace)) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\treturn [`${normalizeRoot(rootPath)}${suffix}`];\n\t\t});\n\t});\n}\n\nfunction retryGuidanceForMapping(mapping: RuntimePathMapping, purpose: RuntimePathPurpose): string {\n\treturn `Use one of the allowed path forms for ${mapping.id} ${purpose}: ${allowedPathFormsForMapping(mapping, purpose).join(', ')}.`;\n}\n\nfunction errorResult(params: {\n\treadonly code: RuntimePathTranslationErrorCode;\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly message: string;\n\treadonly purpose: RuntimePathPurpose;\n}): TranslateRuntimePathResult {\n\treturn {\n\t\terror: {\n\t\t\tallowedPathForms: allowedPathFormsForMapping(params.mapping, params.purpose),\n\t\t\tcode: params.code,\n\t\t\tinputPath: params.inputPath,\n\t\t\tmappingId: params.mapping.id,\n\t\t\tmessage: params.message,\n\t\t\tpurpose: params.purpose,\n\t\t\tretryGuidance: retryGuidanceForMapping(params.mapping, params.purpose),\n\t\t},\n\t\tok: false,\n\t};\n}\n\nfunction findBestRootMatch(params: {\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly sourceNamespace?: RuntimePathNamespace;\n}): RuntimePathRootMatch \| undefined {\n\tconst matches = params.mapping.roots.flatMap((root): RuntimePathRootMatch[] =>\n\t\tguidanceNamespaceOrder.flatMap((inputNamespace) => {\n\t\t\tconst rootPath = root.locations[inputNamespace];\n\t\t\tif (rootPath === undefined) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tif (params.sourceNamespace !== undefined && inputNamespace !== params.sourceNamespace) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tconst normalizedRoot = normalizeRoot(rootPath);\n\t\t\treturn pathMatchesRoot(params.inputPath, normalizedRoot)\n\t\t\t\t? [{ inputNamespace, matchedRoot: normalizedRoot, root }]\n\t\t\t\t: [];\n\t\t}),\n\t);\n\treturn matches.toSorted((left, right) => right.matchedRoot.length - left.matchedRoot.length)[0];\n}\n\nfunction findInvalidRoot(\n\tmapping: RuntimePathMapping,\n): { readonly rootId: string; readonly rootPath: string } \| undefined {\n\tfor (const root of mapping.roots) {\n\t\tfor (const namespace of guidanceNamespaceOrder) {\n\t\t\tconst rootPath = root.locations[namespace];\n\t\t\tif (rootPath !== undefined && runtimeRootIsInvalid(rootPath)) {\n\t\t\t\treturn { rootId: root.id, rootPath };\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n\nexport function translateRuntimePath(input: TranslateRuntimePathInput): TranslateRuntimePathResult {\n\tif (!input.inputPath.startsWith('/')) {\n\t\treturn errorResult({\n\t\t\tcode: 'path-not-absolute',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${input.inputPath}' must be absolute.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\t// Reject traversal before normalization so /work/../secret cannot\n\t// collapse into a seemingly valid path under a trusted root.\n\tif (pathContainsParentTraversal(input.inputPath)) {\n\t\treturn errorResult({\n\t\t\tcode: 'path-parent-traversal',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${input.inputPath}' must not contain parent traversal.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst invalidRoot = findInvalidRoot(input.mapping);\n\tif (invalidRoot !== undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'invalid-runtime-root',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Runtime path root '${invalidRoot.rootId}' has invalid path '${invalidRoot.rootPath}'.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst normalizedInputPath = normalizeAbsolutePath(input.inputPath);\n\tconst match = findBestRootMatch({\n\t\tinputPath: normalizedInputPath,\n\t\tmapping: input.mapping,\n\t\t...(input.sourceNamespace === undefined ? {} : { sourceNamespace: input.sourceNamespace }),\n\t});\n\tif (match === undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'unknown-runtime-path',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' is not part of runtime path mapping '${input.mapping.id}'.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst relativePath = relativePathForRoot(normalizedInputPath, match.matchedRoot);\n\tif (relativePath === '' && !match.root.rootPathAllowed) {\n\t\treturn errorResult({\n\t\t\tcode: 'root-path-not-allowed',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel}, but the root itself is not allowed for ${input.purpose}.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tif (!match.root.capabilities[input.purpose]) {\n\t\treturn errorResult({\n\t\t\tcode: 'purpose-not-allowed',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel} but cannot be used for ${input.purpose}.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst targetRoot = match.root.locations[input.targetNamespace];\n\tif (targetRoot === undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'target-namespace-not-available',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel}, but '${input.targetNamespace}' is not available for that root.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst normalizedTargetRoot = normalizeRoot(targetRoot);\n\treturn {\n\t\tok: true,\n\t\tvalue: {\n\t\t\tbacking: match.root.backing,\n\t\t\tcapabilities: match.root.capabilities,\n\t\t\tinputNamespace: match.inputNamespace,\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmappingId: input.mapping.id,\n\t\t\toutputNamespace: input.targetNamespace,\n\t\t\toutputPath: joinRootAndRelative(normalizedTargetRoot, relativePath),\n\t\t\trelativePath,\n\t\t\trootId: match.root.id,\n\t\t},\n\t};\n}\n","import { v7 as uuidv7, validate as validateUuid, version as uuidVersion } from 'uuid';\n\ndeclare const toolVmLeaseIdBrand: unique symbol;\n\nexport type ToolVmLeaseId = string & {\n\treadonly [toolVmLeaseIdBrand]: true;\n};\n\nexport function createToolVmLeaseId(): ToolVmLeaseId {\n\treturn parseToolVmLeaseId(uuidv7());\n}\n\nexport function isToolVmLeaseId(value: unknown): value is ToolVmLeaseId {\n\treturn typeof value === 'string' && validateUuid(value) && uuidVersion(value) === 7;\n}\n\nexport function parseToolVmLeaseId(value: unknown): ToolVmLeaseId {\n\tif (isToolVmLeaseId(value)) {\n\t\treturn value;\n\t}\n\tthrow new TypeError('Tool VM lease id must be an opaque UUIDv7 string.');\n}\n","const VM_SSH_PUBLIC_ENDPOINT_KEYS = new Set(['host', 'port', 'user']);\n\n/\n Small host-issued capability envelope shared by VM-backed transports. The\n * transport tag keeps SSH Tool VM leases distinct from future host-side\n * VM RPC or bridge capabilities without inventing a transport object.\n /\nexport interface VmCapabilityLease<TTransport extends string> {\n\treadonly leaseId: string;\n\treadonly transport: TTransport;\n}\n\nexport interface VmSshEndpoint {\n\treadonly host: string;\n\treadonly identityPem: string;\n\treadonly knownHostsLine: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface VmSshPublicEndpoint {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface VmSshLease<TTransport extends string> extends VmCapabilityLease<TTransport> {\n\treadonly ssh: VmSshEndpoint;\n}\n\nfunction objectValue(value: unknown): object \| undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === 'string' && value.trim().length > 0;\n}\n\nexport function isVmCapabilityLease<TTransport extends string>(\n\tvalue: unknown,\n\ttransport: TTransport,\n): value is VmCapabilityLease<TTransport> {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'leaseId') === 'string' &&\n\t\tReflect.get(record, 'transport') === transport\n\t);\n}\n\nexport function isVmSshEndpoint(value: unknown): value is VmSshEndpoint {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'host') === 'string' &&\n\t\tisNonEmptyString(Reflect.get(record, 'identityPem')) &&\n\t\tisNonEmptyString(Reflect.get(record, 'knownHostsLine')) &&\n\t\ttypeof Reflect.get(record, 'port') === 'number' &&\n\t\ttypeof Reflect.get(record, 'user') === 'string'\n\t);\n}\n\nexport function isVmSshPublicEndpoint(value: unknown): value is VmSshPublicEndpoint {\n\tconst record = objectValue(value);\n\tif (record === undefined) {\n\t\treturn false;\n\t}\n\tfor (const key of Object.keys(record)) {\n\t\tif (!VM_SSH_PUBLIC_ENDPOINT_KEYS.has(key)) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn (\n\t\ttypeof Reflect.get(record, 'host') === 'string' &&\n\t\ttypeof Reflect.get(record, 'port') === 'number' &&\n\t\ttypeof Reflect.get(record, 'user') === 'string'\n\t);\n}\n","import { isToolVmLeaseId, type ToolVmLeaseId } from './tool-vm-lease-id.js';\nimport {\n\tisVmCapabilityLease,\n\tisVmSshEndpoint,\n\tisVmSshPublicEndpoint,\n\ttype VmCapabilityLease,\n\ttype VmSshLease,\n\ttype VmSshPublicEndpoint,\n} from './vm-capability-lease.js';\n\nexport const defaultToolVmLeaseAuthorityTombstoneTtlMs = 10 60 * 1000;\nexport const TOOL_VM_WORK_GUEST_ROOT = '/work';\n\nexport interface ToolVmSshLease extends VmSshLease<'ssh-sandbox'> {\n\treadonly agentId: string;\n\treadonly idleTtlMs: number;\n\treadonly leaseId: ToolVmLeaseId;\n\treadonly tcpSlot: number;\n\treadonly workdir: string;\n}\n\nexport interface ToolVmLeasePeek extends VmCapabilityLease<'ssh-sandbox'> {\n\treadonly agentId: string;\n\treadonly createdAt: number;\n\treadonly idleTtlMs: number;\n\treadonly lastUsedAt: number;\n\treadonly leaseId: ToolVmLeaseId;\n\treadonly profileId: string;\n\treadonly ssh: VmSshPublicEndpoint;\n\treadonly tcpSlot: number;\n\treadonly workdir: string;\n\treadonly zoneId: string;\n}\n\nfunction objectValue(value: unknown): object \| undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nconst deprecatedScopeKeyPropertyName = ['scope', 'Key'].join('');\n\nexport function isToolVmSshLease(value: unknown): value is ToolVmSshLease {\n\tconst record = objectValue(value);\n\treturn (\n\t\tisVmCapabilityLease(record, 'ssh-sandbox') &&\n\t\tisToolVmLeaseId(Reflect.get(record, 'leaseId')) &&\n\t\tisVmSshEndpoint(Reflect.get(record, 'ssh')) &&\n\t\ttypeof Reflect.get(record, 'agentId') === 'string' &&\n\t\ttypeof Reflect.get(record, 'idleTtlMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'tcpSlot') === 'number' &&\n\t\ttypeof Reflect.get(record, 'workdir') === 'string' &&\n\t\t!Reflect.has(record, deprecatedScopeKeyPropertyName)\n\t);\n}\n\nexport function isToolVmLeasePeek(value: unknown): value is ToolVmLeasePeek {\n\tconst record = objectValue(value);\n\treturn (\n\t\tisVmCapabilityLease(record, 'ssh-sandbox') &&\n\t\tisToolVmLeaseId(Reflect.get(record, 'leaseId')) &&\n\t\ttypeof Reflect.get(record, 'agentId') === 'string' &&\n\t\ttypeof Reflect.get(record, 'createdAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'idleTtlMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'lastUsedAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'profileId') === 'string' &&\n\t\tisVmSshPublicEndpoint(Reflect.get(record, 'ssh')) &&\n\t\ttypeof Reflect.get(record, 'tcpSlot') === 'number' &&\n\t\ttypeof Reflect.get(record, 'workdir') === 'string' &&\n\t\ttypeof Reflect.get(record, 'zoneId') === 'string' &&\n\t\t!Reflect.has(record, deprecatedScopeKeyPropertyName)\n\t);\n}\n"],"mappings":";;AAAA,MAAa,oBAAoB;CAAC;CAAY;CAAU;CAAS;AAIjE,SAAgB,yBAAyB,kBAA0B,QAAwB;CAC1F,OAAO,GAAG,iBAAiB,GAAG,OAAO;;AAGtC,SAAgB,sBACf,kBACA,QACA,SACS;CACT,OAAO,GAAG,iBAAiB,GAAG,OAAO,QAAQ;;;;AC+J9C,MAAa,wCAAwC;AACrD,MAAa,wCAAwC,OAAO,OAAO;CAClE,QAAQ;CACR,UAAU;CACV,CAAC;AAEF,MAAa,+BAA+B,OAAO,OAAO;CACzD,cAAc;CACd,gBAAgB;CAChB,CAAC;AAEF,MAAa,kCAAkC,OAAO,OAAO;CAC5D,uBAAuB;CACvB,2BAA2B;CAC3B,gBAAgB;CAChB,CAAC;AA4BF,SAAgB,+CAAuF;CACtG,IACC,gCAAgC,wBAChC,gCAAgC,2BAEhC,MAAM,IAAI,MACT,qFACA;CAEF,OAAO;EACN,iBAAiB,EAAE,GAAG,iCAAiC;EACvD,cAAc,EAAE,GAAG,8BAA8B;EACjD;;;;ACnOF,MAAa,mBAAmB;CAAC;CAAW;CAAW;CAAO;AAU9D,MAAa,mBAAmB;AAEhC,SAAgB,gBACf,gBACA,iBACU;CACV,OAAO,mBAAmB,mBAAmB,mBAAmB;;AAGjE,SAAgB,uBACf,aACA,iBACoB;CACpB,OAAO,YACL,QAAQ,eAAe,gBAAgB,WAAW,UAAU,gBAAgB,CAAC,CAC7E,KAAK,eAAe,WAAW,KAAK;;AAGvC,SAAgB,sBAAsB,aAA6D;CAClG,OAAO,MAAM,KACZ,IAAI,IACH,uBAAuB,aAAa,UAAU,CAAC,QAAQ,SAAS,SAAS,iBAAiB,CAC1F,CACD;;AAGF,SAAgB,qBAAqB,aAA6D;CACjG,OAAO,MAAM,KACZ,IAAI,IACH,uBAAuB,aAAa,UAAU,CAAC,QAAQ,SAAS,SAAS,iBAAiB,CAC1F,CACD;;;;AC1BF,SAAS,oBAAoB,OAAuB;CACnD,OAAO,MAAM,QAAQ,wBAAwB,OAAO;;AAGrD,SAAS,mBAAmB,MAAc,SAA0B;CACnE,MAAM,oBAAoB,QAAQ,MAAM,CAAC,aAAa;CACtD,IAAI,sBAAsB,IACzB,OAAO;CAER,IAAI,sBAAsB,KACzB,OAAO;CAOR,OAAO,IAJkB,OACxB,IAAI,kBAAkB,MAAM,IAAI,CAAC,IAAI,oBAAoB,CAAC,KAAK,KAAK,CAAC,IACrE,KAEkB,CAAC,KAAK,KAAK,aAAa,CAAC;;AAG7C,SAAS,0BAA0B,SAA2B;CAC7D,MAAM,UAAU,QAAQ,QAAQ,IAAI,UAAU,EAAE,aAAa,IAAI;CACjE,MAAM,aAAa,QAAQ,QAAQ,IAAI,aAAa,EAAE,aAAa,IAAI;CACvE,OACC,YAAY,eACZ,WACE,MAAM,IAAI,CACV,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,SAAS,UAAU,IACrB,QAAQ,QAAQ,IAAI,oBAAoB,IACxC,QAAQ,QAAQ,IAAI,wBAAwB;;AAI9C,SAAS,qBAAqB,KAA+B;CAC5D,IAAI,IAAI,aAAa,SACpB,OAAO;CAER,IAAI,IAAI,aAAa,UACpB,OAAO;CAER,OAAO;;AAGR,SAAS,qBAAqB,KAAU,QAA8B;CACrE,IAAI,IAAI,KAAK,SAAS,GACrB,OAAO,OAAO,SAAS,IAAI,MAAM,GAAG;CAErC,OAAO,WAAW,QAAQ,MAAM;;AAGjC,SAAS,qBAAqB,QAA8B;CAC3D,OAAO,WAAW,QAAQ,MAAM;;AAGjC,SAAS,4BAA4B,MAA8B,SAA2B;CAC7F,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,gBAAgB,qBAAqB,IAAI;CAC/C,IAAI,kBAAkB,KAAK,QAC1B,OAAO;CAGR,IAAI,CAAC,mBAAmB,IAAI,UAAU,KAAK,KAAK,EAC/C,OAAO;CAGR,IACC,qBAAqB,KAAK,cAAc,MAAM,KAAK,QAAQ,qBAAqB,KAAK,OAAO,GAE5F,OAAO;CAGR,IAAI,KAAK,SAAS,KAAA,KAAa,IAAI,aAAa,KAAK,MACpD,OAAO;CAGR,OAAO;;AAGR,SAAgB,6BACf,OACA,iBACoC;CACpC,QAAQ,SAAS,EAAE,EAAE,QAAQ,SAAS,gBAAgB,KAAK,UAAU,gBAAgB,CAAC;;AAGvF,SAAgB,mCACf,SACiD;CACjD,MAAM,eAAe,6BAA6B,QAAQ,OAAO,QAAQ,gBAAgB;CAEzF,OAAO,OAAO,YAA+C;EAC5D,IAAI,CAAC,0BAA0B,QAAQ,EACtC;EAGD,IAAI,aAAa,MAAM,SAAS,4BAA4B,MAAM,QAAQ,CAAC,EAC1E;EAGD,OAAO,IAAI,SAAS,gDAAgD;GACnE,QAAQ;GACR,YAAY;GACZ,CAAC;;;;;ACtHJ,MAAa,+CACZ;AACD,MAAa,0DACZ;AAED,MAAa,4CAA4C,CACxD,yDACA,6CACA;;;ACRD,MAAa,6CAA6C;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAoBD,MAAM,oDAAoD,IAAI,IAC7D,CAbA,mBACA,cAYA,CACA;AAED,SAAS,yCACR,WACsD;CACtD,OAAO,CAAC,kDAAkD,IAAI,UAAU;;AAGzE,MAAa,0CAA0C,CACtD,GAAG,2CACH,CAAC,OAAO,yCAAyC;AAElD,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AA6BD,IAAa,wCAAb,cAA2D,MAAM;CAChE;CACA;CAEA,YAAY,SAIT;EACF,MAAM,eACL,QAAQ,iBAAiB,QAAQ,QAAQ,MAAM,UAAU,OAAO,QAAQ,MAAM;EAC/E,MAAM,GAAG,QAAQ,UAAU,GAAG,QAAQ,KAAK,IAAI,gBAAgB,EAC9D,OAAO,QAAQ,OACf,CAAC;EACF,KAAK,OAAO,QAAQ;EACpB,KAAK,YAAY,QAAQ;;;AAkC3B,eAAsB,4BAA4B,UAAmC;CACpF,IAAI,SAAS,UACZ;CAED,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;AA2F7C,MAAa,4BAA4B;CACxC,sBAAsB;EACrB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,EAAE;EACjB,WAAW;EACX;CACD,gBAAgB;EACf,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,EAAE;EACjB,WAAW;EACX;CACD,aAAa;EACZ,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,cAAc;EACb,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,eAAe;EACd,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,iBAAiB;EAChB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,mBAAmB;EAClB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,mBAAmB;EAClB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,iBAAiB;EAChB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD;;;AC1SD,MAAa,0BAA0B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAa,2BAA2B;CAAC;CAAM;CAAU;CAAW;CAAQ;AAmB5E,MAAa,iCAAiC,CAAC,sBAAsB,mBAAmB;AAIxF,MAAa,kCAAkC;CAC9C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAM,4CAA4C,CACjD,4BACA,sBACA;AAUD,MAAa,iCAAiC;CAC7C;CACA;CACA;CACA;CACA;CACA;AAID,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAkCD,MAAa,kCAAkC;CAC9C;CACA;CACA;CACA;CACA;AAID,MAAa,uCAAuC;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;AASD,MAAa,+BAA+B;CAC3C;CACA;CACA;CACA;AAUD,MAAa,wCAAwC;CACpD;CACA;CACA;CACA;CACA;AAiLD,MAAa,uBAAuB;CAAC;CAAW;CAAM;CAAS;CAAS;AAIxE,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAmCD,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,QACR,QACA,OAC2B;CAC3B,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM;;AAG3D,SAAS,0BAA0B,OAAiC;CACnE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,SAAS;;AAGxE,SAAS,mBAAmB,QAA0C;CACrE,OACC,0BAA0B,OAAO,aAAa,IAC9C,QAAQ,0BAA0B,OAAO,OAAO,IAChD,OAAO,OAAO,WAAW,YACzB,OAAO,OAAO,SAAS;;AAIzB,SAAS,eAAe,OAAyB;CAChD,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU;;AAGhD,SAAS,uBAAuB,OAAyB;CACxD,OAAO,UAAU,KAAA,KAAc,OAAO,UAAU,YAAY,MAAM,SAAS;;AAG5E,SAAS,cACR,QACA,OACuC;CACvC,OAAO,UAAU,KAAA,KAAa,QAAQ,QAAQ,MAAM;;AAGrD,SAAS,kCACR,OACoD;CACpD,OAAO,QAAQ,2CAA2C,MAAM;;AAGjE,SAAS,mBAAmB,OAAyB;CACpD,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,MAAM;;AAGtD,SAAS,2BAA2B,OAAyB;CAC5D,OAAO,UAAU,KAAA,KAAc,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,IAAI;;AAG5E,SAAS,qBAAqB,OAAiC;CAC9D,OAAO,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,IAAI;;AAGpD,SAAS,kBAAkB,OAAiC;CAC3D,OAAO,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,GAAG;;AAGnD,SAAS,wBAAwB,OAA4D;CAC5F,IAAI,UAAU,KAAA,GACb,OAAO;CAER,IAAI,CAAC,SAAS,MAAM,EACnB,OAAO;CAER,KAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,MAAM,EAAE;EACvD,IAAI,CAAC,QAAQ,sCAAsC,IAAI,EACtD,OAAO;EAER,IAAI,CAAC,mCAAmC,KAAK,YAAY,EACxD,OAAO;;CAGT,OAAO;;AAGR,SAAS,mCACR,KACA,OACU;CACV,QAAQ,KAAR;EACC,KAAK;EACL,KAAK;EACL,KAAK,cACJ,OAAO,qBAAqB,MAAM;EACnC,KAAK,gBACJ,OAAO,OAAO,UAAU,YAAY,6BAA6B,KAAK,MAAM;EAC7E,KAAK;EACL,KAAK,wBACJ,OAAO,OAAO,UAAU;;CAE1B,OAAO,+CAA+C,IAAI;;AAG3D,SAAS,+CAA+C,KAAmB;CAC1E,MAAM,IAAI,MAAM,uDAAuD,OAAO,IAAI,GAAG;;AAGtF,SAAS,kCACR,OAC2C;CAC3C,OAAO,UAAU,oCAAoC,UAAU;;AAGhE,SAAS,6CACR,QACA,QACU;CACV,QAAQ,QAAR;EACC,KAAK;EACL,KAAK,iBACJ,OAAO,WAAW;EACnB,KAAK;EACL,KAAK,2BACJ,OAAO,WAAW;;CAEpB,OAAO,sCAAsC,OAAO;;AAGrD,SAAS,mCAAmC,OAAyC;CAUpF,IAAI,EARH,MAAM,gBAAgB,KAAA,KACtB,MAAM,uBAAuB,KAAA,KAC7B,MAAM,yBAAyB,KAAA,KAC/B,MAAM,uBAAuB,KAAA,KAC7B,MAAM,wBAAwB,KAAA,KAC9B,MAAM,eAAe,KAAA,KACrB,MAAM,uBAAuB,KAAA,KAC7B,MAAM,iBAAiB,KAAA,IAEvB,OAAO;CAER,IACC,EACC,uBAAuB,MAAM,YAAY,IACzC,cAAc,gCAAgC,MAAM,mBAAmB,IACvE,cAAc,6BAA6B,MAAM,qBAAqB,IACtE,QAAQ,gCAAgC,MAAM,mBAAmB,IACjE,QAAQ,iCAAiC,MAAM,oBAAoB,IACnE,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,OAAO,MAAM,iBAAiB,YAC9B,MAAM,aAAa,SAAS,IAG7B,OAAO;CAER,IAAI,kCAAkC,MAAM,oBAAoB,EAC/D,OAAO,OAAO,MAAM,uBAAuB,YAAY,MAAM,mBAAmB,SAAS;CAE1F,OACC,MAAM,uBAAuB,KAAA,KAC7B,cAAc,gCAAgC,MAAM,mBAAmB,IACvE,cAAc,iCAAiC,MAAM,oBAAoB;;AAI3E,SAAgB,qBAAqB,OAA6C;CACjF,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,mBAAmB,MAAM,EACjD,OAAO;CAER,QAAQ,MAAM,MAAd;EACC,KAAK,4BACJ,OACC,QACC;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,EACD,MAAM,UACN,IACD,QACC;GACC;GACA;GACA;GACA,EACD,MAAM,OACN,IACD,MAAM,WAAW;EAEnB,KAAK,0BACJ,OACC,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,SAAS,KACpB,OAAO,UAAU,MAAM,KAAK,IAC5B,mBAAmB,MAAM,WAAW;EAEtC,KAAK,2BACJ,OACC,eAAe,MAAM,OAAO,IAC5B,eAAe,MAAM,aAAa,IAClC,MAAM,WAAW,qBACjB,0BAA0B,MAAM,UAAU,IAC1C,QAAQ,uCAAuC,MAAM,UAAU,IAC/D,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS,KACtB,eAAe,MAAM,UAAU;EAEjC,KAAK,sBACJ,OACC,OAAO,UAAU,MAAM,QAAQ,IAC/B,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,UAAU,MAAM,YAAY,IACnC,QAAQ,yCAAyC,MAAM,UAAU,IACjE,mBAAmB,MAAM,WAAW;EAEtC,KAAK,eACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY;EAE3B,KAAK,mBACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,UAAU;EAEzB,KAAK,eACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY,YACzB,QAAQ;GAAC;GAAW;GAAe;GAAY;GAAQ,EAAW,MAAM,UAAU,IAClF,mCAAmC,MAAM;EAE3C,KAAK,yBACJ,OACC,QAAQ,mBAAmB,MAAM,eAAe,IAChD,QAAQ;GAAC;GAAY;GAAS;GAAY;GAAS,EAAW,MAAM,MAAM;EAE5E,KAAK,iCACJ,OACC,OAAO,MAAM,sBAAsB,YACnC,MAAM,kBAAkB,SAAS,KACjC,QAAQ,iCAAiC,MAAM,OAAO,IACtD,QAAQ,0BAA0B,MAAM,OAAO,IAC/C,6CAA6C,MAAM,QAAQ,MAAM,OAAO,IACxE,2BAA2B,MAAM,sBAAsB,IACvD,2BAA2B,MAAM,iBAAiB,IAClD,wBAAwB,MAAM,QAAQ;EAExC,KAAK;GACJ,IACC,CAAC,QACA;IACC;IACA;IACA;IACA;IACA,EACD,MAAM,OACN,IACD,CAAC,qBAAqB,MAAM,oBAAoB,IAChD,CAAC,kBAAkB,MAAM,WAAW,IACpC,CAAC,0BAA0B,MAAM,UAAU,IAC3C,CAAC,QAAQ,8BAA8B,MAAM,OAAO,IACpD,CAAC,eAAe,MAAM,YAAY,EAElC,OAAO;GAER,IAAI,MAAM,WAAW,MAAM;IAC1B,IAAI,MAAM,WAAW,2BAA2B,MAAM,WAAW,sBAChE,OAAO;IAQR,IAAI,EALH,qBAAqB,MAAM,yBAAyB,IACpD,OAAO,MAAM,gBAAgB,YAC7B,qBAAqB,MAAM,WAAW,IACtC,OAAO,MAAM,YAAY,YACzB,MAAM,cAAc,KAAA,IAEpB,OAAO;IAER,IAAI,MAAM,WAAW,yBACpB,OACC,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA;IAGpB,OACC,OAAO,MAAM,gBAAgB,YAC7B,qBAAqB,MAAM,WAAW,IACtC,OAAO,MAAM,YAAY;;GAG3B,IAAI,MAAM,WAAW,UAAU;IAC9B,IACC,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,WAAW,KAC3B,CAAC,2BAA2B,MAAM,yBAAyB,IAC3D,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA,KAClB,CAAC,eAAe,MAAM,YAAY,EAElC,OAAO;IAER,IAAI,MAAM,WAAW,sBAAsB;KAC1C,IAAI,kCAAkC,MAAM,UAAU,EACrD,OACC,eAAe,MAAM,YAAY,IACjC,2BAA2B,MAAM,WAAW,IAC5C,eAAe,MAAM,QAAQ;KAG/B,OACC,eAAe,MAAM,YAAY,IACjC,2BAA2B,MAAM,WAAW,IAC5C,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS;;IAGzB,QACE,MAAM,WAAW,2BACjB,MAAM,WAAW,kBACjB,MAAM,WAAW,wBAClB,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA;;GAGpB,OAAO;EACR,KAAK,8BACJ,OACC,QACC;GACC;GACA;GACA;GACA;GACA,EACD,MAAM,OACN,IACD,qBAAqB,MAAM,4BAA4B,IACvD,qBAAqB,MAAM,oBAAoB,IAC/C,kBAAkB,MAAM,WAAW,IACnC,MAAM,cAAc,2BACpB,kBAAkB,MAAM,sBAAsB,IAC9C,eAAe,MAAM,YAAY,IACjC,QAAQ,8BAA8B,MAAM,OAAO,IACnD,MAAM,WAAW;EAEnB,SACC,OAAO;;;AAIV,SAAgB,qBAAqB,OAAmC;CACvE,QAAQ,MAAM,MAAd;EACC,KAAK,4BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,UAAU,GAAG,MAAM;EAClE,KAAK,2BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM;EACjC,KAAK,0BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM;EACjC,KAAK,sBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,mBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,GAAG,MAAM;EAChE,KAAK,eACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK;GACJ,IAAI,MAAM,iBAAiB,KAAA,GAC1B,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,aAAa,MAAM;GAEzD,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,GAAG,MAAM;EAChE,KAAK,yBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,iCACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,oBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,8BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;;CAEhD,OAAO,uBAAuB,MAAM;;AAQrC,SAAS,0BAA0B,OAA6D;CAC/F,OAAO,MAAM,SAAS;;AAGvB,SAAS,wBAAwB,OAAqD;CACrF,QAAQ,MAAM,MAAd;EACC,KAAK,0BACJ,OAAO;EACR,KAAK,2BACJ,OAAO;EACR,KAAK,sBACJ,OAAO;EACR,KAAK,mBACJ,OAAO;EACR,KAAK,eACJ,OAAO;EACR,KAAK,eACJ,OAAO;EACR,KAAK,yBACJ,OAAO;EACR,KAAK,iCACJ,OAAO;EACR,KAAK,oBACJ,OAAO;EACR,KAAK,8BACJ,OAAO;;CAET,OAAO,uBAAuB,MAAM;;AAGrC,SAAS,uBAAuB,OAAqB;CACpD,MAAM,IAAI,MAAM,gCAAgC,KAAK,UAAU,MAAM,GAAG;;AAGzE,SAAS,sCAAsC,QAAsB;CACpE,MAAM,IAAI,MAAM,4CAA4C,OAAO,OAAO,GAAG;;AAG9E,SAAS,cACR,OACA,SAC8B;CAC9B,IAAI,CAAC,0BAA0B,MAAM,EACpC;CAED,IACC,QAAQ,QAAQ,MAAM,eAAe,QAAQ,gBAC7C,CAAC,4BAA4B,MAAM,EAEnC,OAAO;EACN,MAAM;EACN,aAAa;EACb,SAAS,GAAG,MAAM,KAAK;EACvB,SAAS,MAAM;EACf;CAEF,IAAI,MAAM,WAAW,YAAY,MAAM,WAAW,aAAa,MAAM,WAAW,SAC/E,OAAO;EACN,MAAM,wBAAwB,MAAM;EACpC,aAAa;EACb,SAAS,GAAG,MAAM,KAAK,yBAAyB,MAAM;EACtD,SAAS,MAAM;EACf;;AAKH,SAAS,4BAA4B,OAAoC;CACxE,OAAO,MAAM,SAAS,sBAAsB,MAAM,WAAW;;AAc9D,SAAS,iCACR,OACmD;CACnD,OACC,MAAM,SAAS,iBACf,MAAM,uBAAuB,sBAC7B,kCAAkC,MAAM,oBAAoB,IAC5D,MAAM,WAAW;;AAInB,SAAS,iCACR,QAC8B;CAC9B,MAAM,qCAAqB,IAAI,KAAqB;CACpD,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,CAAC,iCAAiC,MAAM,EAC3C;EAED,MAAM,uBAAuB,mBAAmB,IAAI,MAAM,WAAW;EACrE,IAAI,yBAAyB,KAAA,KAAa,uBAAuB,MAAM,cACtE,mBAAmB,IAAI,MAAM,YAAY,MAAM,aAAa;;CAG9D,OAAO;;AAGR,SAAS,sBACR,OACyE;CACzE,OAAO,MAAM,SAAS,iBAAiB,MAAM,iBAAiB,KAAA;;AAG/D,SAAS,gCACR,QACgC;CAChC,MAAM,iCAAiC,iCAAiC,OAAO;CAC/E,OAAO,OAAO,QAAQ,UAAU;EAC/B,IAAI,CAAC,sBAAsB,MAAM,EAChC,OAAO;EAER,MAAM,iBAAiB,+BAA+B,IAAI,MAAM,QAAQ;EACxE,OAAO,mBAAmB,KAAA,KAAa,iBAAiB,MAAM;GAC7D;;AAGH,SAAgB,yBACf,QACA,SACqB;CACrB,MAAM,8BAAc,IAAI,KAAiC;CACzD,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,MAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,4BACrD;EAED,MAAM,MAAM,qBAAqB,MAAM;EACvC,MAAM,WAAW,YAAY,IAAI,IAAI;EACrC,IAAI,CAAC,YAAY,SAAS,gBAAgB,MAAM,cAC/C,YAAY,IAAI,KAAK,MAAM;;CAG7B,MAAM,eAAe,gCAAgC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,UAC9E,OAAO,WAAW,OAAO,eAAe,MAAM,aAC/C;CACD,IAAI,aAAa,WAAW,GAC3B,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAa,QAAQ,QAAQ;EAAQ;CAExE,MAAM,SAAS,aACb,KAAK,UAAU,cAAc,OAAO,QAAQ,CAAC,CAC7C,QAAQ,UAAoC,UAAU,KAAA,EAAU;CAClE,IAAI,OAAO,WAAW,GACrB,OAAO;EAAE,MAAM;EAAM;EAAc,QAAQ,QAAQ;EAAQ;CAE5D,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,qBAAqB,EAC9D,OAAO;EAAE;EAAQ,MAAM;EAAS;EAAc,QAAQ,QAAQ;EAAQ;CAEvE,OAAO;EAAE;EAAQ,MAAM;EAAU;EAAc,QAAQ,QAAQ;EAAQ;;;;AC/7BxE,SAAS,cAAc,UAA0B;CAChD,OAAO,SAAS,QAAQ,WAAW,GAAG;;AAGvC,SAAS,kBAAkB,UAAsC;CAChE,MAAM,kBAAkB,cAAc,SAAS,MAAM,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC3E,MAAM,WAAW,gBAAgB,MAAM,IAAI;CAC3C,IAAI,SAAS,SAAS,KAAK,SAAS,MAAM,YAAY,CAAC,qBAAqB,KAAK,QAAQ,CAAC,EACzF;CAED,OAAO;;AAGR,SAAS,cAAc,MAAkC;CACxD,MAAM,iBAAiB,KAAK,MAAM,CAAC,aAAa;CAChD,IAAI,CAAC,iBAAiB,KAAK,eAAe,IAAI,eAAe,WAAW,IAAI,EAC3E;CAED,OAAO;;AAaR,SAAgB,oCACf,SACiD;CACjD,MAAM,iBAAiB,QAAQ,MAAM;CACrC,IAAI,eAAe,WAAW,GAC7B;CAGD,IAAI;CACJ,IAAI;EACH,YAAY,IAAI,IAAI,eAAe;SAC5B;EACP,YAAY,KAAA;;CAEb,IAAI,cAAc,KAAA,GAAW;EAC5B,MAAM,OAAO,cAAc,UAAU,SAAS;EAC9C,MAAM,WAAW,kBAAkB,UAAU,SAAS;EACtD,OAAO,SAAS,KAAA,KAAa,aAAa,KAAA,IAAY,KAAA,IAAY;GAAE;GAAM;GAAU;;CAGrF,MAAM,WAAW,2DAA2D,KAAK,eAAe;CAChG,IAAI,UAAU,QAAQ,SAAS,KAAA,KAAa,SAAS,OAAO,aAAa,KAAA,GAAW;EACnF,MAAM,OAAO,cAAc,SAAS,OAAO,KAAK;EAChD,MAAM,WAAW,kBAAkB,SAAS,OAAO,SAAS;EAC5D,OAAO,SAAS,KAAA,KAAa,aAAa,KAAA,IAAY,KAAA,IAAY;GAAE;GAAM;GAAU;;CAGrF,MAAM,gBAAgB,8CAA8C,KAAK,eAAe;CACxF,IAAI,eAAe,QAAQ,SAAS,KAAA,KAAa,cAAc,OAAO,aAAa,KAAA,GAAW;EAC7F,MAAM,sBAAsB,kBAAkB,cAAc,OAAO,SAAS;EAC5E,MAAM,OAAO,cAAc,cAAc,OAAO,KAAK;EACrD,IAAI,SAAS,KAAA,KAAa,wBAAwB,KAAA,KAAa,KAAK,SAAS,IAAI,EAChF,OAAO;GAAE;GAAM,UAAU;GAAqB;;CAIhD,MAAM,eAAe,kBAAkB,eAAe;CACtD,IAAI,iBAAiB,KAAA,GACpB,OAAO;EAAE,MAAM;EAAc,UAAU;EAAc;;AAMvD,SAAgB,qCACf,UACgC;CAChC,IAAI,aAAa,KAAA,GAChB,OAAO;EAAE,cAAc,EAAE;EAAE,cAAc,EAAE;EAAE;CAE9C,MAAM,+BAAe,IAAI,KAAa;CACtC,MAAM,+BAAe,IAAI,KAAa;CACtC,KAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,iBAAiB,oCAAoC,QAAQ;EACnE,IAAI,mBAAmB,KAAA,GAAW;GACjC,aAAa,IAAI,eAAe,KAAK;GACrC,aAAa,IAAI,eAAe,SAAS;;;CAG3C,OAAO;EACN,cAAc,CAAC,GAAG,aAAa,CAAC,UAAU;EAC1C,cAAc,CAAC,GAAG,aAAa,CAAC,UAAU;EAC1C;;AAGF,SAAgB,uCAAuC,SAAqC;CAC3F,MAAM,iBAAiB,QAAQ,MAAM;CACrC,IAAI,eAAe,WAAW,GAC7B;CAGD,MAAM,WAAW,gDAAgD,KAAK,eAAe;CACrF,IAAI,UAAU,QAAQ,aAAa,KAAA,GAClC,OAAO,kBAAkB,SAAS,OAAO,SAAS;CAGnD,MAAM,gBAAgB,iDAAiD,KAAK,eAAe;CAC3F,IAAI,eAAe,QAAQ,aAAa,KAAA,GACvC,OAAO,kBAAkB,cAAc,OAAO,SAAS;CAGxD,MAAM,eAAe,kBAAkB,eAAe;CACtD,IAAI,iBAAiB,KAAA,GACpB,OAAO;CAGR,IAAI;CACJ,IAAI;EACH,YAAY,IAAI,IAAI,eAAe;SAC5B;EACP;;CAED,IAAI,UAAU,SAAS,aAAa,KAAK,cACxC;CAED,OAAO,kBAAkB,UAAU,SAAS;;AAG7C,SAAgB,wCACf,UACoB;CACpB,OAAO,qCAAqC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjGvD,MAAa,iCACZ;AAED,MAAM,sCAAsC,+BAA+B,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BxF,SAAgB,mBAAmB,WAAuC;CACzE,MAAM,UAAU,WAAW,MAAM,IAAI;CACrC,IAAI,YAAY,IACf,OAAO;CAER,MAAM,YAAY,QAChB,MAAM,OAAO,CACb,QAAQ,SAAS,CAAC,oCAAoC,SAAS,KAAK,CAAC;CACvE,IAAI,UAAU,WAAW,GACxB,OAAO;CAER,OAAO,GAAG,+BAA+B,GAAG,UAAU,KAAK,IAAI;;;;ACNhE,SAAS,kBAAkB,OAAgB,OAA+C;CACzF,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,EACtE,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;CAEpD,MAAM,YAAY,QAAQ,eAAe,MAAM;CAC/C,IAAI,cAAc,OAAO,aAAa,cAAc,MACnD,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;;AAIrD,SAAS,kBACR,QACA,OACA,gBACO;CACP,MAAM,mBAAmB,IAAI,IAAI,eAAe;CAChD,KAAK,MAAM,YAAY,QAAQ,QAAQ,OAAO,EAAE;EAC/C,IAAI,OAAO,aAAa,UACvB,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B;EAEzD,MAAM,YAAY;EAClB,IAAI,CAAC,iBAAiB,IAAI,UAAU,EACnC,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,UAAU,IAAI;EAE9D,MAAM,aAAa,QAAQ,yBAAyB,QAAQ,UAAU;EACtE,IAAI,eAAe,KAAA,KAAa,CAAC,OAAO,OAAO,YAAY,QAAQ,EAClE,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,UAAU,wBAAwB;;CAGhE,KAAK,MAAM,aAAa,gBACvB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,EACpC,MAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B,UAAU,IAAI;;AAKxE,SAAS,aACR,OACA,UACA,OACW;CACX,IAAI,UAAU,UACb,MAAM,IAAI,MAAM,GAAG,MAAM,WAAW,KAAK,UAAU,SAAS,CAAC,GAAG;CAEjE,OAAO;;AAGR,SAAS,oBAAoB,OAAgB,OAAuB;CACnE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,MAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B;CAExD,OAAO;;AAGR,SAAS,uBAAuB,OAAgB,OAAuB;CACtE,MAAM,YAAY,oBAAoB,OAAO,MAAM;CACnD,IACC,CAAC,UAAU,WAAW,IAAI,IAC1B,UAAU,SAAS,KAAK,IACxB,UAAU,SAAS,KAAK,IACvB,UAAU,SAAS,KAAK,UAAU,SAAS,IAAI,IAChD,UAAU,MAAM,IAAI,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,KAAK,EAE3E,MAAM,IAAI,MAAM,GAAG,MAAM,4CAA4C;CAEtE,OAAO;;AAGR,SAAS,cAAc,OAAgB,OAAuB;CAC7D,MAAM,WAAW,oBAAoB,OAAO,MAAM;CAClD,IAAI,CAAC,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,KAAK,EACvD,MAAM,IAAI,MAAM,GAAG,MAAM,iCAAiC;CAE3D,OAAO;;AAGR,SAAS,eAAe,OAAgB,OAAuB;CAC9D,IAAI,CAAC,OAAO,UAAU,MAAM,IAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,QAAQ,OACjF,MAAM,IAAI,MAAM,GAAG,MAAM,oDAAoD;CAE9E,OAAO;;AAGR,SAAS,iBAAiB,OAAgB,OAA0C;CACnF,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO,CAAC,aAAa,cAAc,CAAC;CAC7D,OAAO,OAAO,OAAO;EACpB,WAAW,uBAAuB,MAAM,WAAW,GAAG,MAAM,YAAY;EACxE,aAAa,oBAAoB,MAAM,aAAa,GAAG,MAAM,cAAc;EAC3E,CAAC;;AAGH,SAAS,yBACR,OACA,OACqC;CACrC,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAAC;EAAgB;EAAQ;EAAa,CAAC;CACvE,OAAO,OAAO,OAAO;EACpB,cAAc,uBAAuB,MAAM,cAAc,GAAG,MAAM,eAAe;EACjF,MAAM,aAAa,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO;EACvE,YAAY,uBAAuB,MAAM,YAAY,GAAG,MAAM,aAAa;EAC3E,CAAC;;AAGH,SAAS,wBAAwB,OAAgB,OAAkD;CAClG,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAAC;EAAa;EAAQ;EAAO,CAAC;CAC9D,OAAO,OAAO,OAAO;EACpB,WAAW,eAAe,MAAM,WAAW,GAAG,MAAM,YAAY;EAChE,MAAM,aAAa,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO;EACjE,MAAM,cAAc,MAAM,MAAM,GAAG,MAAM,OAAO;EAChD,CAAC;;AAGH,SAAS,sBAAsB,OAAgB,OAAgD;CAC9F,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO,CAAC,aAAa,OAAO,CAAC;CACtD,OAAO,OAAO,OAAO;EACpB,WAAW,eAAe,MAAM,WAAW,GAAG,MAAM,YAAY;EAChE,MAAM,aAAa,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO;EACjE,CAAC;;AAGH,SAAS,uBAAuB,OAAsD;CACrF,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,OAAO,OAAO,OAAO;EACpB,WAAW,aAAa,MAAM,WAAW,4BAA4B,GAAG,MAAM,YAAY;EAC1F,wBAAwB,uBACvB,MAAM,wBACN,GAAG,MAAM,yBACT;EACD,sBAAsB,uBACrB,MAAM,sBACN,GAAG,MAAM,uBACT;EACD,aAAa,iBAAiB,MAAM,aAAa,GAAG,MAAM,cAAc;EACxE,WAAW,yBAAyB,MAAM,WAAW,GAAG,MAAM,YAAY;EAC1E,MAAM,aAAa,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO;EACtE,CAAC;;AAGH,SAAS,sBAAsB,OAAqD;CACnF,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,MAAM,YAAY,MAAM;CACxB,IAAI,cAAc,cAAc,cAAc,UAC7C,MAAM,IAAI,MAAM,GAAG,MAAM,4CAA4C;CAEtE,MAAM,UAAU,sBAAsB,MAAM,SAAS,GAAG,MAAM,UAAU;CACxE,MAAM,YAAY,wBAAwB,MAAM,WAAW,GAAG,MAAM,YAAY;CAChF,IAAI,QAAQ,cAAc,UAAU,WACnC,MAAM,IAAI,MAAM,GAAG,MAAM,2DAA2D;CAErF,MAAM,eAAe;EACpB,wBAAwB,uBACvB,MAAM,wBACN,GAAG,MAAM,yBACT;EACD,sBAAsB,uBACrB,MAAM,sBACN,GAAG,MAAM,uBACT;EACD;EACA,aAAa,iBAAiB,MAAM,aAAa,GAAG,MAAM,cAAc;EACxE;EACA,MAAM,aAAa,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO;EACpE;CACD,IAAI,cAAc,YACjB,OAAO,OAAO,OAAO;EACpB,GAAG;EACH,WAAW,aAAa,MAAM,WAAW,oBAAoB,GAAG,MAAM,YAAY;EAClF;EACA,CAAC;CAEH,OAAO,OAAO,OAAO;EACpB,GAAG;EACH,WAAW,aAAa,MAAM,WAAW,kBAAkB,GAAG,MAAM,YAAY;EAChF;EACA,CAAC;;;;;;;AAQH,SAAgB,gCAAgC,OAA4C;CAC3F,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA,CAAC;CACF,OAAO,OAAO,OAAO;EACpB,iBAAiB,aAAa,MAAM,iBAAiB,GAAG,GAAG,MAAM,kBAAkB;EACnF,kBAAkB,sBAAsB,MAAM,iBAAiB;EAC/D,MAAM,aAAa,MAAM,MAAM,kCAAkC,GAAG,MAAM,OAAO;EACjF,mBAAmB,uBAAuB,MAAM,kBAAkB;EAClE,CAAC;;;;AC/QH,SAAgB,gCACf,eACA,iBACA,SAC6B;CAC7B,MAAM,qBAA6C,EAAE;CACrD,MAAM,kBAAsD,EAAE;CAC9D,MAAM,YAAY,QAAQ,aAAa;CAEvC,KAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,EAAE;EACxE,MAAM,eAAe,cAAc;EACnC,IAAI,CAAC,cACJ,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,mDACrC;EAEF,IAAI,CAAC,gBAAgB,aAAa,UAAU,QAAQ,SAAS,EAC5D;EAGD,IAAI,aAAa,cAAc,kBAAkB;GAChD,IAAI,aAAa,MAAM,WAAW,GACjC,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,8CACrC;GAEF,gBAAgB,cAAc;IAC7B,OAAO,CAAC,GAAG,aAAa,MAAM;IAC9B,OAAO;IACP;GACD;;EAGD,MAAM,oBAAqB,aAA+C;EAC1E,IAAI,sBAAsB,WACzB,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,kDAAkD,kBAAkB,IACzG;EAEF,IAAI,QAAQ,aAAa,WACxB,mBAAmB,cAAc;;CAInC,OAAO;EAAE;EAAoB;EAAiB;;AAK/C,SAAgB,4BACf,MACA,iBACoC;CACpC,OAAO,gCAAgC,KAAK,SAAS,iBAAiB;EACrE,UAAU;EACV,WAAW;EACX,CAAC;;AAGH,SAAS,+BACR,YACA,QACA,aACA,aACA,WACO;CACP,IAAI,YAAY,IAAI,WAAW,EAC9B,MAAM,IAAI,MACT,IAAI,UAAU,4BAA4B,WAAW,kEACrD;CAEF,IAAI,cAAc,YAAY,oBAC7B,MAAM,IAAI,MACT,IAAI,UAAU,oBAAoB,OAAO,WAAW,WAAW,mDAC/D;CAEF,IAAI,cAAc,YAAY,iBAC7B,MAAM,IAAI,MACT,IAAI,UAAU,oBAAoB,OAAO,WAAW,WAAW,sDAC/D;CAEF,YAAY,IAAI,WAAW;;AAG5B,SAAgB,2BACf,aACA,UAA6C,EAAE,EAClB;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,8BAAc,IAAI,KAAa;CACrC,KAAK,MAAM,cAAc,OAAO,KAAK,QAAQ,sBAAsB,EAAE,CAAC,EACrE,+BAA+B,YAAY,eAAe,aAAa,aAAa,UAAU;CAE/F,KAAK,MAAM,cAAc,OAAO,KAAK,QAAQ,0BAA0B,EAAE,CAAC,EACzE,+BACC,YACA,kBACA,aACA,aACA,UACA;CAGF,OAAO;EACN,oBAAoB;GACnB,GAAG,YAAY;GACf,GAAG,QAAQ;GACX;EACD,iBAAiB;GAChB,GAAG,YAAY;GACf,GAAG,QAAQ;GACX;EACD;;;;AC7BF,MAAM,gCAAgC,MAAU,KAAK;AAErD,SAAS,cAAc,QAIZ;CACV,IAAI,OAAO,eAAe,GACzB,OAAO,OAAO;CAEf,MAAM,WAAW,OAAO,UAAU,OAAO;CAEzC,MAAM,aADQ,OAAO,UAAU,WACJ,OAAO,QAAQ,GAAG,WAAW;CACxD,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;;AAG3C,SAAgB,0BAAkC;CACjD,OAAOA,IAAQ;;AAGhB,SAAgB,oBAAoB,OAAwB;CAC3D,OAAOC,SAAa,MAAM,IAAIC,QAAY,MAAM,KAAK;;AAGtD,SAAgB,oCACf,aACyC;CACzC,IAAI,CAAC,mCAAmC,YAAY,EACnD;CAED,MAAM,aAAa,QAA8D;EAChF,MAAM,QAAQ,YAAY;EAC1B,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;;CAEhE,MAAM,wBAAwB;EAC7B,GAAI,UAAU,YAAY,KAAK,KAAA,IAAY,EAAE,WAAW,UAAU,YAAY,EAAE,GAAG,EAAE;EACrF,GAAI,UAAU,YAAY,KAAK,KAAA,IAAY,EAAE,WAAW,UAAU,YAAY,EAAE,GAAG,EAAE;EACrF,GAAI,UAAU,QAAQ,KAAK,KAAA,IAAY,EAAE,OAAO,UAAU,QAAQ,EAAE,GAAG,EAAE;EACzE,GAAI,UAAU,mBAAmB,KAAK,KAAA,IACnC,EAAE,kBAAkB,UAAU,mBAAmB,EAAE,GACnD,EAAE;EACL,GAAI,UAAU,aAAa,KAAK,KAAA,IAAY,EAAE,YAAY,UAAU,aAAa,EAAE,GAAG,EAAE;EACxF,GAAI,UAAU,UAAU,KAAK,KAAA,IAAY,EAAE,SAAS,UAAU,UAAU,EAAE,GAAG,EAAE;EAC/E;CACD,OAAO,OAAO,KAAK,sBAAsB,CAAC,SAAS,IAAI,wBAAwB,KAAA;;AAGhF,SAAS,mCACR,OACuE;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,eAAsB,4BACrB,SACiC;CACjC,MAAM,QAAQ,yBAAyB;CACvC,MAAM,aAAa,MAAM,QAAQ,eAAe;EAC/C,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,EAAE;EACnE;EACA,CAAC;CACF,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,MAAM,QAAQ,WAAW,KAAK;CACpC,MAAM,YAAY,KAAK;CACvB,MAAM,yBAAyB,QAAQ,0BAA0B;CACjE,MAAM,uBAAuB,QAAQ,wBAAwB;CAC7D,MAAM,SAAS,QAAQ,cAAc,KAAK;CAC1C,MAAM,2BAA2B,IAAI,iBAAiB;CACtD,IAAI,QAAQ;CACZ,IAAI;CACJ,IAAI;CAEJ,MAAM,4BAAkC;EACvC,IAAI,gBAAgB;GACnB,iBAAiB,eAAe;GAChC,iBAAiB,KAAA;;;CAInB,MAAM,qBAAqB,YAA0B;EACpD,IAAI,KAAK,GAAG,aAAa,wBACxB;EAED,qBAAqB;EACrB,iBAAiB,qBACV;GACL,IAAI,KAAK,GAAG,aAAa,wBACxB;GAED,MAAM,mBACL,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,cAAc;GAC3D,QACE,mBAAmB,WAAW,OAAO,iBAAiB,CACtD,MAAM,cAAc;IACpB,IAAI,CAAC,OACJ,kBAAkB,UAAU,iBAAiB;KAE7C,CACD,OAAO,UAAmB;IAC1B,QAAQ,sBAAsB,MAAM;IACpC,IACC,QAAQ,8BAA8B,MAAM,KAAK,QACjD,QAAQ,+BACP;KACD,yBAAyB,MAAM,MAAM;KACrC,QAAQ;KACR,qBAAqB;KACrB,QAAa,8BAA8B,MAAM,CAAC,OAAO,eAAwB;MAChF,QAAQ,sBAAsB,WAAW;OACxC;KACF;;IAED,IAAI,CAAC,OACJ,kBAAkB,WAAW,iBAAiB;KAE9C;KAEJ,cAAc;GAAE;GAAS,aAAa;GAAsB;GAAQ,CAAC,CACrE;;CAGF,kBAAkB,WAAW,iBAAiB;CAE9C,MAAM,MAAM,OAAO,UAAkC,gBAA+B;EACnF,IAAI,OACH;EAED,QAAQ;EACR,qBAAqB;EACrB,IAAI;GACH,MAAM,QAAQ,aAAa,WAAW,OAAO;IAC5C;IACA,GAAI,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,cAAc;IAC9D,CAAC;WACM,OAAO;GACf,IAAI,QAAQ,sBAAsB,MAAM,KAAK,MAAM;IAClD,QAAQ,gBAAgB,MAAM;IAC9B;;GAED,MAAM;;;CAIR,OAAO;EACN,QAAQ,yBAAyB;EACjC,OAAO,WAAW;EAClB,SAAS;EACT;EACA,SAAS,WAAiB;GACzB,IAAI,OACH;GAED,eAAe;;EAEhB;;;;ACpQF,MAAa,6BAA6B;AAC1C,MAAa,yBAAyB;AACtC,MAAa,mCAAmC,GAAG,uBAAuB;AA2H1E,MAAM,yBAAyB;CAC9B;CACA;CACA;CACA;AAED,SAAS,4BAA4B,WAA4B;CAChE,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,sBAAsB,WAA2B;CAEzD,OAAO,IADa,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAGjC,SAAS,cAAc,UAA0B;CAChD,MAAM,iBAAiB,sBAAsB,SAAS;CACtD,OAAO,mBAAmB,MAAM,iBAAiB,eAAe,QAAQ,SAAS,GAAG;;AAGrF,SAAS,gBAAgB,eAAuB,UAA2B;CAC1E,OAAO,kBAAkB,YAAY,cAAc,WAAW,GAAG,SAAS,GAAG;;AAG9E,SAAS,oBAAoB,eAAuB,UAA0B;CAC7E,OAAO,kBAAkB,WAAW,KAAK,cAAc,MAAM,SAAS,SAAS,EAAE;;AAGlF,SAAS,oBAAoB,UAAkB,cAA8B;CAC5E,OAAO,iBAAiB,KAAK,WAAW,GAAG,SAAS,GAAG;;AAGxD,SAAS,qBAAqB,UAA2B;CACxD,OACC,SAAS,MAAM,KAAK,MAAM,CAAC,SAAS,WAAW,IAAI,IAAI,4BAA4B,SAAS;;AAI9F,SAAS,8BACR,MACA,WACU;CACV,IAAI,KAAK,iBAAiB,eAAe,KAAA,GACxC,OAAO,KAAK,eAAe;CAE5B,OAAO,cAAc;;AAGtB,SAAS,2BACR,SACA,SACoB;CACpB,OAAO,QAAQ,MAAM,SAAS,SAAS;EACtC,IAAI,CAAC,KAAK,aAAa,UACtB,OAAO,EAAE;EAEV,MAAM,SAAS,KAAK,kBAAkB,eAAe;EACrD,OAAO,uBAAuB,SAAS,cAAwB;GAC9D,MAAM,WAAW,KAAK,UAAU;GAChC,IAAI,aAAa,KAAA,KAAa,CAAC,8BAA8B,MAAM,UAAU,EAC5E,OAAO,EAAE;GAEV,OAAO,CAAC,GAAG,cAAc,SAAS,GAAG,SAAS;IAC7C;GACD;;AAGH,SAAS,wBAAwB,SAA6B,SAAqC;CAClG,OAAO,yCAAyC,QAAQ,GAAG,GAAG,QAAQ,IAAI,2BAA2B,SAAS,QAAQ,CAAC,KAAK,KAAK,CAAC;;AAGnI,SAAS,YAAY,QAMU;CAC9B,OAAO;EACN,OAAO;GACN,kBAAkB,2BAA2B,OAAO,SAAS,OAAO,QAAQ;GAC5E,MAAM,OAAO;GACb,WAAW,OAAO;GAClB,WAAW,OAAO,QAAQ;GAC1B,SAAS,OAAO;GAChB,SAAS,OAAO;GAChB,eAAe,wBAAwB,OAAO,SAAS,OAAO,QAAQ;GACtE;EACD,IAAI;EACJ;;AAGF,SAAS,kBAAkB,QAIU;CAgBpC,OAfgB,OAAO,QAAQ,MAAM,SAAS,SAC7C,uBAAuB,SAAS,mBAAmB;EAClD,MAAM,WAAW,KAAK,UAAU;EAChC,IAAI,aAAa,KAAA,GAChB,OAAO,EAAE;EAEV,IAAI,OAAO,oBAAoB,KAAA,KAAa,mBAAmB,OAAO,iBACrE,OAAO,EAAE;EAEV,MAAM,iBAAiB,cAAc,SAAS;EAC9C,OAAO,gBAAgB,OAAO,WAAW,eAAe,GACrD,CAAC;GAAE;GAAgB,aAAa;GAAgB;GAAM,CAAC,GACvD,EAAE;GACJ,CAEW,CAAC,UAAU,MAAM,UAAU,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,CAAC;;AAG9F,SAAS,gBACR,SACqE;CACrE,KAAK,MAAM,QAAQ,QAAQ,OAC1B,KAAK,MAAM,aAAa,wBAAwB;EAC/C,MAAM,WAAW,KAAK,UAAU;EAChC,IAAI,aAAa,KAAA,KAAa,qBAAqB,SAAS,EAC3D,OAAO;GAAE,QAAQ,KAAK;GAAI;GAAU;;;AAOxC,SAAgB,qBAAqB,OAA8D;CAClG,IAAI,CAAC,MAAM,UAAU,WAAW,IAAI,EACnC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,SAAS,MAAM,UAAU;EAClC,SAAS,MAAM;EACf,CAAC;CAIH,IAAI,4BAA4B,MAAM,UAAU,EAC/C,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,SAAS,MAAM,UAAU;EAClC,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,cAAc,gBAAgB,MAAM,QAAQ;CAClD,IAAI,gBAAgB,KAAA,GACnB,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,sBAAsB,YAAY,OAAO,sBAAsB,YAAY,SAAS;EAC7F,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,sBAAsB,sBAAsB,MAAM,UAAU;CAClE,MAAM,QAAQ,kBAAkB;EAC/B,WAAW;EACX,SAAS,MAAM;EACf,GAAI,MAAM,oBAAoB,KAAA,IAAY,EAAE,GAAG,EAAE,iBAAiB,MAAM,iBAAiB;EACzF,CAAC;CACF,IAAI,UAAU,KAAA,GACb,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,yCAAyC,MAAM,QAAQ,GAAG;EAChG,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,eAAe,oBAAoB,qBAAqB,MAAM,YAAY;CAChF,IAAI,iBAAiB,MAAM,CAAC,MAAM,KAAK,iBACtC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,2CAA2C,MAAM,QAAQ;EACpI,SAAS,MAAM;EACf,CAAC;CAEH,IAAI,CAAC,MAAM,KAAK,aAAa,MAAM,UAClC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,0BAA0B,MAAM,QAAQ;EACnH,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,aAAa,MAAM,KAAK,UAAU,MAAM;CAC9C,IAAI,eAAe,KAAA,GAClB,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,SAAS,MAAM,gBAAgB;EAC1G,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,uBAAuB,cAAc,WAAW;CACtD,OAAO;EACN,IAAI;EACJ,OAAO;GACN,SAAS,MAAM,KAAK;GACpB,cAAc,MAAM,KAAK;GACzB,gBAAgB,MAAM;GACtB,WAAW;GACX,WAAW,MAAM,QAAQ;GACzB,iBAAiB,MAAM;GACvB,YAAY,oBAAoB,sBAAsB,aAAa;GACnE;GACA,QAAQ,MAAM,KAAK;GACnB;EACD;;;;AChVF,SAAgB,sBAAqC;CACpD,OAAO,mBAAmBC,IAAQ,CAAC;;AAGpC,SAAgB,gBAAgB,OAAwC;CACvE,OAAO,OAAO,UAAU,YAAYC,SAAa,MAAM,IAAIC,QAAY,MAAM,KAAK;;AAGnF,SAAgB,mBAAmB,OAA+B;CACjE,IAAI,gBAAgB,MAAM,EACzB,OAAO;CAER,MAAM,IAAI,UAAU,oDAAoD;;;;ACpBzE,MAAM,8BAA8B,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAO,CAAC;AA8BrE,SAASC,cAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,SAAS,iBAAiB,OAAiC;CAC1D,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,CAAC,SAAS;;AAG3D,SAAgB,oBACf,OACA,WACyC;CACzC,MAAM,SAASA,cAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,QAAQ,IAAI,QAAQ,YAAY,KAAK;;AAIvC,SAAgB,gBAAgB,OAAwC;CACvE,MAAM,SAASA,cAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,iBAAiB,QAAQ,IAAI,QAAQ,cAAc,CAAC,IACpD,iBAAiB,QAAQ,IAAI,QAAQ,iBAAiB,CAAC,IACvD,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK;;AAIzC,SAAgB,sBAAsB,OAA8C;CACnF,MAAM,SAASA,cAAY,MAAM;CACjC,IAAI,WAAW,KAAA,GACd,OAAO;CAER,KAAK,MAAM,OAAO,OAAO,KAAK,OAAO,EACpC,IAAI,CAAC,4BAA4B,IAAI,IAAI,EACxC,OAAO;CAGT,OACC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK;;;;ACjEzC,MAAa,4CAA4C,MAAU;AACnE,MAAa,0BAA0B;AAuBvC,SAAS,YAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,MAAM,iCAAiC,CAAC,SAAS,MAAM,CAAC,KAAK,GAAG;AAEhE,SAAgB,iBAAiB,OAAyC;CACzE,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,oBAAoB,QAAQ,cAAc,IAC1C,gBAAgB,QAAQ,IAAI,QAAQ,UAAU,CAAC,IAC/C,gBAAgB,QAAQ,IAAI,QAAQ,MAAM,CAAC,IAC3C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,CAAC,QAAQ,IAAI,QAAQ,+BAA+B;;AAItD,SAAgB,kBAAkB,OAA0C;CAC3E,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,oBAAoB,QAAQ,cAAc,IAC1C,gBAAgB,QAAQ,IAAI,QAAQ,UAAU,CAAC,IAC/C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,aAAa,KAAK,YAC7C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,sBAAsB,QAAQ,IAAI,QAAQ,MAAM,CAAC,IACjD,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,SAAS,KAAK,YACzC,CAAC,QAAQ,IAAI,QAAQ,+BAA+B"}
1	+ {"version":3,"file":"index.js","names":["uuidv7","validateUuid","uuidVersion","uuidv7","validateUuid","uuidVersion","objectValue"],"sources":["../src/gateway-runtime-contract.ts","../src/gateway-lifecycle.ts","../src/audience.ts","../src/websocket-upgrade-policy.ts","../src/gateway-control-private-environment.ts","../src/health/controller-request-policy.ts","../src/health/agent-vm-health.ts","../src/git-read-allowlist.ts","../src/force-ipv4-egress.ts","../src/managed-gateway-boot-contract.ts","../src/split-resolved-gateway-secrets.ts","../src/tool-vm-active-use.ts","../src/runtime-paths/runtime-path-mapping.ts","../src/tool-vm-lease-id.ts","../src/vm-capability-lease.ts","../src/tool-vm-lease.ts"],"sourcesContent":["export const gatewayTypeValues = ['openclaw', 'hermes', 'worker'] as const;\n\nexport type GatewayType = (typeof gatewayTypeValues)[number];\n\nexport function buildGatewaySessionLabel(projectNamespace: string, zoneId: string): string {\n\treturn `${projectNamespace}:${zoneId}:gateway`;\n}\n\nexport function buildToolSessionLabel(\n\tprojectNamespace: string,\n\tzoneId: string,\n\ttcpSlot: number,\n): string {\n\treturn `${projectNamespace}:${zoneId}:tool:${tcpSlot}`;\n}\n","import type { MediatedSecretSpec, SecretResolver } from '@agent-vm/secret-management';\n\nimport type { EgressHostConfig, VmAudience } from './audience.js';\nimport type { GatewayControlPrivateEnvironmentName } from './gateway-control-private-environment.js';\nimport type { GatewayProcessSpec } from './gateway-process-spec.js';\nimport type { GatewayType } from './gateway-runtime-contract.js';\nimport type { GatewayVmRequirements } from './gateway-vm-spec.js';\nimport type { ManagedFrameworkServiceBootMetadata } from './managed-gateway-boot-contract.js';\nimport type { WebSocketUpgradeConfig } from './websocket-upgrade-policy.js';\n\n/*\n Describes how to run interactive auth for a gateway type.\n * Static property — available without a running VM.\n /\nexport interface GatewayAuthConfig {\n\t/\n\t Shell command to list available auth providers inside the VM.\n\t * Should output one provider name per line to stdout.\n\t /\n\treadonly listProvidersCommand: string;\n\n\t/\n\t Build the shell command for interactive auth login.\n\t * The CLI passes this as the SSH remote command with -t (TTY).\n\t /\n\treadonly buildLoginCommand: (\n\t\tprovider: string,\n\t\toptions?: {\n\t\t\treadonly deviceCode?: boolean;\n\t\t\treadonly agentId?: string;\n\t\t\treadonly profileId?: string;\n\t\t},\n\t) => string;\n\n\t/\n\t Build the shell command for listing provider auth profiles for one agent.\n\t * The CLI uses this after login to verify requested profile IDs exist.\n\t /\n\treadonly buildProfileListCommand: (\n\t\tprovider: string,\n\t\toptions: {\n\t\t\treadonly agentId: string;\n\t\t},\n\t) => string;\n}\n\nexport interface GatewayInteractiveSshSession {\n\treadonly remoteShellCommand: string;\n\treadonly requireSecretEnvironmentEnabled: boolean;\n\treadonly secretEnvironment: 'default' \| 'gateway-token' \| 'all-secrets';\n}\n\nexport interface GatewayInteractiveSshConfig {\n\treadonly buildSession: (options: {\n\t\treadonly requestAllSecrets: boolean;\n\t}) => GatewayInteractiveSshSession;\n}\n\ninterface GatewayAuthProfilesRef {\n\treadonly source: '1password' \| 'config' \| 'environment';\n}\n\ninterface OnePasswordGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: '1password';\n\treadonly ref: string;\n}\n\ninterface EnvironmentGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: 'environment';\n\treadonly envVar: string;\n}\n\ninterface ConfigGatewayAuthProfilesRef extends GatewayAuthProfilesRef {\n\treadonly source: 'config';\n\treadonly value: string;\n}\n\nexport type GatewaySshSecretEnvMode = 'always' \| 'explicit' \| 'never';\n\nexport interface GatewaySshConfig {\n\treadonly secretEnv: GatewaySshSecretEnvMode;\n}\n\nexport interface GatewayIngressConfig {\n\treadonly upstreamHeaderTimeoutMs?: number;\n\treadonly upstreamResponseTimeoutMs?: number;\n}\n\nexport interface OpenClawGatewayControlAuthConfig {\n\treadonly mode: 'token';\n\treadonly secret: string;\n}\n\ninterface OpenClawAuthLoginProviderConfig {\n\treadonly profileIds: readonly string[];\n}\n\ninterface OpenClawAuthLoginConfig {\n\treadonly defaultAgent?: string;\n\treadonly providers: Readonly<Record<string, OpenClawAuthLoginProviderConfig>>;\n}\n\ninterface GatewayZoneBaseGatewayConfig {\n\treadonly type: GatewayType;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly port: number;\n\treadonly ingress?: GatewayIngressConfig;\n\treadonly config: string;\n\treadonly stateDir: string;\n\treadonly runtimeRootfsSize?: string;\n\treadonly ssh: GatewaySshConfig;\n}\n\ninterface OpenClawGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'openclaw';\n\treadonly controlAuth: OpenClawGatewayControlAuthConfig;\n\treadonly zoneFilesDir: string;\n\treadonly authProfilesRef?:\n\t\t\| ConfigGatewayAuthProfilesRef\n\t\t\| OnePasswordGatewayAuthProfilesRef\n\t\t\| EnvironmentGatewayAuthProfilesRef\n\t\t\| undefined;\n\treadonly authProfilesByAgent?: Readonly<\n\t\tRecord<\n\t\t\tstring,\n\t\t\t\| ConfigGatewayAuthProfilesRef\n\t\t\t\| OnePasswordGatewayAuthProfilesRef\n\t\t\t\| EnvironmentGatewayAuthProfilesRef\n\t\t>\n\t>;\n\treadonly authLogin?: OpenClawAuthLoginConfig;\n\treadonly rawEnvSecrets?: readonly string[];\n}\n\ninterface HermesGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'hermes';\n\treadonly zoneFilesDir: string;\n\treadonly profileSecretProjectionsByAgent: Readonly<\n\t\tRecord<string, Readonly<Record<string, string>>>\n\t>;\n\treadonly profilesByAgent: Readonly<Record<string, string>>;\n}\n\ninterface WorkerGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {\n\treadonly type: 'worker';\n}\n\ntype GatewayZoneGatewayConfig =\n\t\| OpenClawGatewayZoneGatewayConfig\n\t\| HermesGatewayZoneGatewayConfig\n\t\| WorkerGatewayZoneGatewayConfig;\n\ninterface OnePasswordSecretSourceConfig {\n\treadonly source: '1password';\n\treadonly ref: string;\n}\n\ninterface EnvironmentSecretSourceConfig {\n\treadonly source: 'environment';\n\treadonly envVar: string;\n}\n\ninterface ConfigSecretSourceConfig {\n\treadonly source: 'config';\n\treadonly value: string;\n}\n\ntype SecretSourceConfig =\n\t\| OnePasswordSecretSourceConfig\n\t\| EnvironmentSecretSourceConfig\n\t\| ConfigSecretSourceConfig;\n\nexport type EnvInjectedGatewaySecretConfig = SecretSourceConfig & {\n\treadonly audience: 'gateway';\n\treadonly injection: 'env';\n};\n\nexport type HttpMediatedGatewaySecretConfig = SecretSourceConfig & {\n\treadonly audience: VmAudience;\n\treadonly injection: 'http-mediation';\n\treadonly hosts: readonly string[];\n};\n\nexport type GatewaySecretConfig = EnvInjectedGatewaySecretConfig \| HttpMediatedGatewaySecretConfig;\n\nexport const gatewayToolPortalTelemetryServiceName = 'agent-vm-tool-portal' as const;\nexport const gatewayFrameworkTelemetryServiceNames = Object.freeze({\n\thermes: 'agent-vm-hermes',\n\topenclaw: 'agent-vm-openclaw',\n});\n\nexport const gatewayTelemetrySourcePolicy = Object.freeze({\n\tadmitBaggage: false,\n\tcaptureContent: false,\n});\n\nexport const gatewayTelemetryAdmissionLimits = Object.freeze({\n\tmaxExportBatchRecords: 64,\n\tmaxQueuedRecordsPerSignal: 256,\n\tmaxRecordBytes: 65_536,\n});\n\nexport type GatewayTelemetrySourcePolicy = typeof gatewayTelemetrySourcePolicy;\nexport type GatewayTelemetryAdmissionLimits = typeof gatewayTelemetryAdmissionLimits;\n\nexport interface GatewayTelemetrySignalPolicy {\n\treadonly traces: boolean;\n\treadonly metrics: boolean;\n\treadonly logs: boolean;\n\treadonly sampleRate: number;\n\treadonly flushIntervalMs: number;\n}\n\nexport interface GatewayTelemetryProducerSafetyContract {\n\treadonly admissionLimits: GatewayTelemetryAdmissionLimits;\n\treadonly sourcePolicy: GatewayTelemetrySourcePolicy;\n}\n\nexport interface GatewayFrameworkTelemetryProducerConfig\n\textends GatewayTelemetrySignalPolicy, GatewayTelemetryProducerSafetyContract {\n\treadonly serviceName: (typeof gatewayFrameworkTelemetryServiceNames)[keyof typeof gatewayFrameworkTelemetryServiceNames];\n}\n\nexport interface GatewayToolPortalTelemetryProducerConfig\n\textends GatewayTelemetrySignalPolicy, GatewayTelemetryProducerSafetyContract {\n\treadonly serviceName: typeof gatewayToolPortalTelemetryServiceName;\n}\n\nexport function createGatewayTelemetryProducerSafetyContract(): GatewayTelemetryProducerSafetyContract {\n\tif (\n\t\tgatewayTelemetryAdmissionLimits.maxExportBatchRecords >\n\t\tgatewayTelemetryAdmissionLimits.maxQueuedRecordsPerSignal\n\t) {\n\t\tthrow new Error(\n\t\t\t'Gateway telemetry maxExportBatchRecords must not exceed maxQueuedRecordsPerSignal.',\n\t\t);\n\t}\n\treturn {\n\t\tadmissionLimits: { ...gatewayTelemetryAdmissionLimits },\n\t\tsourcePolicy: { ...gatewayTelemetrySourcePolicy },\n\t};\n}\n\nexport interface GatewayZoneObservabilityConfig {\n\treadonly mode: 'collector';\n\treadonly collector: {\n\t\treadonly host: string;\n\t\treadonly grpcPort: number;\n\t\treadonly httpPort: number;\n\t\treadonly targetHost: string;\n\t\treadonly targetGrpcPort: number;\n\t\treadonly targetHttpPort: number;\n\t};\n\treadonly framework: GatewayFrameworkTelemetryProducerConfig;\n\treadonly openclaw?: {\n\t\treadonly diagnosticsFlags: readonly string[];\n\t};\n\treadonly toolPortal: GatewayToolPortalTelemetryProducerConfig;\n}\n\n/\n Zone config as the lifecycle sees it.\n * Decoupled from SystemConfig — the controller maps into this shape.\n /\nexport interface GatewayZoneConfig {\n\treadonly id: string;\n\treadonly agents?: readonly GatewayZoneAgentConfig[];\n\treadonly gateway: GatewayZoneGatewayConfig;\n\treadonly toolPortal?: GatewayZoneMcpPortalConfig;\n\treadonly runtimeMcpServers?: Readonly<Record<string, GatewayZoneMcpServerConfig>>;\n\treadonly runtimeMediatedSecrets?: Readonly<Record<string, MediatedSecretSpec>>;\n\treadonly runtimeEnvironment?: Readonly<Record<string, string>>;\n\treadonly runtimePrivateEnvironment?: Readonly<\n\t\tPartial<Record<GatewayControlPrivateEnvironmentName, string>>\n\t>;\n\treadonly runtimePluginConfigs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;\n\treadonly gitReadAllowlistRepos?: readonly string[];\n\treadonly observability?: GatewayZoneObservabilityConfig;\n\treadonly secrets: Readonly<Record<string, GatewaySecretConfig>>;\n\treadonly egressHosts: readonly EgressHostConfig[];\n\treadonly websocketUpgrades?: readonly WebSocketUpgradeConfig[];\n\treadonly defaultToolVmProfile?: string;\n}\n\nexport interface GatewayZoneAgentConfig {\n\treadonly id: string;\n\treadonly toolVmProfile?: string \| undefined;\n}\n\nexport interface GatewayZoneMcpPortalConfig {\n\treadonly configDir: string;\n}\n\nexport interface GatewayZoneMcpServerConfig {\n\treadonly headers?: Readonly<Record<string, string>>;\n\treadonly transport: 'streamable-http';\n\treadonly url: string;\n}\n\nexport interface BuildGatewayVmRequirementsOptions {\n\treadonly controllerPort: number;\n\treadonly gatewayCacheDir: string;\n\treadonly projectNamespace: string;\n\treadonly resolvedSecrets: Record<string, string>;\n\treadonly zoneRuntimeDir: string;\n\treadonly tcpPool: {\n\t\treadonly basePort: number;\n\t\treadonly size: number;\n\t};\n\treadonly zone: GatewayZoneConfig;\n}\n\nexport interface GatewayLifecycleBase {\n\t/\n\t How to run interactive auth for this gateway type.\n\t * Absent means the gateway type does not support interactive auth.\n\t /\n\treadonly authConfig?: GatewayAuthConfig \| undefined;\n\n\t/\n\t Build backend-neutral guest workload requirements.\n\t * Pure data assembly — no side effects or controller authority.\n\t /\n\tbuildVmRequirements(options: BuildGatewayVmRequirementsOptions): GatewayVmRequirements;\n\n\t/\n\t Optional hook to prepare host-side state before the VM boots.\n\t * Example: writing auth-profiles.json from 1Password.\n\t /\n\tprepareHostState?(zone: GatewayZoneConfig, secretResolver: SecretResolver): Promise<void>;\n\n\t/\n\t Optional hook to resolve host-state secret dependencies without writing\n\t * host state. Protected restarts use this before closing a live gateway so\n\t * secret-resolution failures do not strand the zone without a VM.\n\t /\n\tpreflightHostState?(zone: GatewayZoneConfig, secretResolver: SecretResolver): Promise<void>;\n}\n\nexport interface BuildManagedFrameworkServiceBootInputsOptions {\n\treadonly resolvedSecrets: Record<string, string>;\n\treadonly zone: GatewayZoneConfig;\n}\n\n/\n Sensitive framework-service inputs that the controller materializes into\n * the protected, immutable Managed Gateway boot-input directory.\n \n This contract intentionally contains no executable, argv, callback,\n * process handle, or controller authority.\n /\ninterface ManagedFrameworkServiceBootInputsBase {\n\treadonly configuration: unknown;\n\treadonly environment: Readonly<Record<string, string>>;\n}\n\ninterface ManagedFrameworkServiceConfigurationOnlyBootInputs extends ManagedFrameworkServiceBootInputsBase {\n\treadonly kind: 'configuration-only';\n}\n\ninterface ManagedHermesFrameworkServiceBootInputs extends ManagedFrameworkServiceBootInputsBase {\n\treadonly kind: 'hermes-managed-scope';\n}\n\nexport type ManagedFrameworkServiceBootInputs =\n\t\| ManagedFrameworkServiceConfigurationOnlyBootInputs\n\t\| ManagedHermesFrameworkServiceBootInputs;\n\nexport interface ManagedGatewayLifecycle extends GatewayLifecycleBase {\n\treadonly executionModel: 'managed-gateway';\n\n\t/* Build the framework-owned interactive SSH session contract. /\n\treadonly interactiveSsh: GatewayInteractiveSshConfig;\n\n\t/* Build the selected framework half of the exact managed boot contract. /\n\tbuildFrameworkServiceBootMetadata(zone: GatewayZoneConfig): ManagedFrameworkServiceBootMetadata;\n\n\t/* Build service-scoped config and environment for protected materialization. /\n\tbuildFrameworkServiceBootInputs(\n\t\toptions: BuildManagedFrameworkServiceBootInputsOptions,\n\t): Promise<ManagedFrameworkServiceBootInputs>;\n}\n\nexport interface DirectProcessGatewayLifecycle extends GatewayLifecycleBase {\n\treadonly executionModel: 'direct-process';\n\n\t/\n\t Build the direct-process spec retained only by standalone Worker.\n\t * Pure data assembly — no side effects.\n\t /\n\tbuildProcessSpec(\n\t\tzone: GatewayZoneConfig,\n\t\tresolvedSecrets: Record<string, string>,\n\t): GatewayProcessSpec;\n}\n\nexport type GatewayLifecycle = ManagedGatewayLifecycle \| DirectProcessGatewayLifecycle;\n","export const vmAudienceValues = ['gateway', 'tool-vm', 'both'] as const;\n\nexport type VmAudience = (typeof vmAudienceValues)[number];\nexport type RuntimeVmAudience = Exclude<VmAudience, 'both'>;\n\nexport interface EgressHostConfig {\n\treadonly host: string;\n\treadonly audience: VmAudience;\n}\n\nexport const controllerVmHost = 'controller.vm.host';\n\nexport function targetsAudience(\n\tconfigAudience: VmAudience,\n\truntimeAudience: RuntimeVmAudience,\n): boolean {\n\treturn configAudience === runtimeAudience \|\| configAudience === 'both';\n}\n\nexport function egressHostsForAudience(\n\tegressHosts: readonly EgressHostConfig[],\n\truntimeAudience: RuntimeVmAudience,\n): readonly string[] {\n\treturn egressHosts\n\t\t.filter((egressHost) => targetsAudience(egressHost.audience, runtimeAudience))\n\t\t.map((egressHost) => egressHost.host);\n}\n\nexport function gatewayVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[] {\n\treturn Array.from(\n\t\tnew Set(\n\t\t\tegressHostsForAudience(egressHosts, 'gateway').filter((host) => host !== controllerVmHost),\n\t\t),\n\t);\n}\n\nexport function workerVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[] {\n\treturn Array.from(\n\t\tnew Set(\n\t\t\tegressHostsForAudience(egressHosts, 'gateway').filter((host) => host !== controllerVmHost),\n\t\t),\n\t);\n}\n","import { targetsAudience, type RuntimeVmAudience, type VmAudience } from './audience.js';\n\nexport interface WebSocketUpgradeConfig {\n\treadonly audience: VmAudience;\n\treadonly scheme: 'ws' \| 'wss';\n\treadonly host: string;\n\treadonly port?: number \| undefined;\n\treadonly path?: string \| undefined;\n}\n\nexport interface CreateWebSocketUpgradeRequestGuardOptions {\n\treadonly rules: readonly WebSocketUpgradeConfig[];\n\treadonly runtimeAudience: RuntimeVmAudience;\n}\n\nfunction escapeRegExpLiteral(value: string): string {\n\treturn value.replace(/[.+?^${}()\|[\\]\\\\]/gu, '\\\\$&');\n}\n\nfunction hostMatchesPattern(host: string, pattern: string): boolean {\n\tconst normalizedPattern = pattern.trim().toLowerCase();\n\tif (normalizedPattern === '') {\n\t\treturn false;\n\t}\n\tif (normalizedPattern === '') {\n\t\treturn true;\n\t}\n\n\tconst patternRegex = new RegExp(\n\t\t`^${normalizedPattern.split('').map(escapeRegExpLiteral).join('.')}$`,\n\t\t'iu',\n\t);\n\treturn patternRegex.test(host.toLowerCase());\n}\n\nfunction isWebSocketUpgradeRequest(request: Request): boolean {\n\tconst upgrade = request.headers.get('upgrade')?.toLowerCase() ?? '';\n\tconst connection = request.headers.get('connection')?.toLowerCase() ?? '';\n\treturn (\n\t\tupgrade === 'websocket' \|\|\n\t\tconnection\n\t\t\t.split(',')\n\t\t\t.map((token) => token.trim())\n\t\t\t.includes('upgrade') \|\|\n\t\trequest.headers.has('sec-websocket-key') \|\|\n\t\trequest.headers.has('sec-websocket-version')\n\t);\n}\n\nfunction requestSchemeForRule(url: URL): 'ws' \| 'wss' \| null {\n\tif (url.protocol === 'http:') {\n\t\treturn 'ws';\n\t}\n\tif (url.protocol === 'https:') {\n\t\treturn 'wss';\n\t}\n\treturn null;\n}\n\nfunction requestPortForScheme(url: URL, scheme: 'ws' \| 'wss'): number {\n\tif (url.port.length > 0) {\n\t\treturn Number.parseInt(url.port, 10);\n\t}\n\treturn scheme === 'wss' ? 443 : 80;\n}\n\nfunction defaultPortForScheme(scheme: 'ws' \| 'wss'): number {\n\treturn scheme === 'wss' ? 443 : 80;\n}\n\nfunction websocketRuleMatchesRequest(rule: WebSocketUpgradeConfig, request: Request): boolean {\n\tconst url = new URL(request.url);\n\tconst requestScheme = requestSchemeForRule(url);\n\tif (requestScheme !== rule.scheme) {\n\t\treturn false;\n\t}\n\n\tif (!hostMatchesPattern(url.hostname, rule.host)) {\n\t\treturn false;\n\t}\n\n\tif (\n\t\trequestPortForScheme(url, requestScheme) !== (rule.port ?? defaultPortForScheme(rule.scheme))\n\t) {\n\t\treturn false;\n\t}\n\n\tif (rule.path !== undefined && url.pathname !== rule.path) {\n\t\treturn false;\n\t}\n\n\treturn true;\n}\n\nexport function websocketUpgradesForAudience(\n\trules: readonly WebSocketUpgradeConfig[] \| undefined,\n\truntimeAudience: RuntimeVmAudience,\n): readonly WebSocketUpgradeConfig[] {\n\treturn (rules ?? []).filter((rule) => targetsAudience(rule.audience, runtimeAudience));\n}\n\nexport function createWebSocketUpgradeRequestGuard(\n\toptions: CreateWebSocketUpgradeRequestGuardOptions,\n): (request: Request) => Promise<Response \| void> {\n\tconst runtimeRules = websocketUpgradesForAudience(options.rules, options.runtimeAudience);\n\n\treturn async (request: Request): Promise<Response \| void> => {\n\t\tif (!isWebSocketUpgradeRequest(request)) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tif (runtimeRules.some((rule) => websocketRuleMatchesRequest(rule, request))) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn new Response('WebSocket upgrade blocked by agent-vm policy', {\n\t\t\tstatus: 403,\n\t\t\tstatusText: 'Forbidden',\n\t\t});\n\t};\n}\n","export const GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV =\n\t'AGENT_VM_GATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY';\nexport const GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV =\n\t'AGENT_VM_GATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS';\n\nexport const GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES = [\n\tGATEWAY_CONTROL_CALLER_CONTEXT_AGENT_AUTHORITY_KEYS_ENV,\n\tGATEWAY_CONTROL_CALLER_CONTEXT_PROOF_KEY_ENV,\n] as const;\n\nexport type GatewayControlPrivateEnvironmentName =\n\t(typeof GATEWAY_CONTROL_PRIVATE_ENVIRONMENT_NAMES)[number];\n","export const gatewayInternalControllerRequestOperations = [\n\t'workspace-git-push',\n\t'lease-create',\n\t'lease-get',\n\t'lease-peek',\n\t'lease-renew',\n\t'lease-release',\n\t'lease-use-start',\n\t'lease-heartbeat',\n\t'lease-use-end',\n] as const;\n\nexport type GatewayInternalControllerRequestOperation =\n\t(typeof gatewayInternalControllerRequestOperations)[number];\n\nexport type ControllerRequestPolicyOperation = GatewayInternalControllerRequestOperation;\n\nexport const dedicatedControllerRequestHealthEventOperations = [\n\t'lease-heartbeat',\n\t'lease-renew',\n] as const;\n\nexport type DedicatedControllerRequestHealthEventOperation =\n\t(typeof dedicatedControllerRequestHealthEventOperations)[number];\n\nexport type GenericControllerRequestEventOperation = Exclude<\n\tControllerRequestPolicyOperation,\n\tDedicatedControllerRequestHealthEventOperation\n>;\n\nconst dedicatedControllerRequestHealthEventOperationSet = new Set<ControllerRequestPolicyOperation>(\n\tdedicatedControllerRequestHealthEventOperations,\n);\n\nfunction isGenericControllerRequestEventOperation(\n\toperation: ControllerRequestPolicyOperation,\n): operation is GenericControllerRequestEventOperation {\n\treturn !dedicatedControllerRequestHealthEventOperationSet.has(operation);\n}\n\nexport const genericControllerRequestEventOperations = [\n\t...gatewayInternalControllerRequestOperations,\n].filter(isGenericControllerRequestEventOperation);\n\nexport const externalControllerRoutes = [\n\t'GET /controller-status',\n\t'GET /zones/:zoneId/status',\n\t'GET /zones/:zoneId/health',\n\t'GET /zones/:zoneId/logs',\n\t'POST /zones/:zoneId/credentials/refresh',\n\t'POST /zones/:zoneId/destroy',\n\t'POST /zones/:zoneId/upgrade',\n\t'GET /zones/:zoneId/tasks/:taskId',\n\t'POST /zones/:zoneId/worker-tasks',\n\t'POST /zones/:zoneId/tasks/:taskId/close',\n\t'POST /zones/:zoneId/enable-ssh',\n\t'POST /zones/:zoneId/execute-command',\n\t'POST /stop-controller',\n] as const;\n\nexport type ExternalControllerRoute = (typeof externalControllerRoutes)[number];\n\nexport type ControllerRequestPolicyIdempotency = 'read' \| 'safe-mutation' \| 'unsafe-mutation';\n\ninterface ControllerRequestPolicyBase {\n\treadonly idempotency: ControllerRequestPolicyIdempotency;\n\treadonly timeoutMs: number;\n}\n\nexport type ControllerRequestPolicy =\n\t\| (ControllerRequestPolicyBase & {\n\t\t\treadonly maxAttempts: 1;\n\t\t\treadonly retryBaseDelayMs: 0;\n\t\t\treadonly retryEnabled: false;\n\t\t\treadonly retryStatuses: readonly [];\n\t })\n\t\| (ControllerRequestPolicyBase & {\n\t\t\treadonly maxAttempts: number;\n\t\t\treadonly retryBaseDelayMs: number;\n\t\t\treadonly retryEnabled: true;\n\t\t\treadonly retryStatuses: readonly [number, ...number[]];\n\t });\n\nexport type ControllerRequestPolicyTransportErrorCode =\n\t\| 'controller-request-failed'\n\t\| 'controller-request-timeout';\n\nexport class ControllerRequestPolicyTransportError extends Error {\n\treadonly code: ControllerRequestPolicyTransportErrorCode;\n\treadonly operation: ControllerRequestPolicyOperation;\n\n\tconstructor(options: {\n\t\treadonly cause: unknown;\n\t\treadonly code: ControllerRequestPolicyTransportErrorCode;\n\t\treadonly operation: ControllerRequestPolicyOperation;\n\t}) {\n\t\tconst causeMessage =\n\t\t\toptions.cause instanceof Error ? options.cause.message : String(options.cause);\n\t\tsuper(`${options.operation} ${options.code}: ${causeMessage}`, {\n\t\t\tcause: options.cause,\n\t\t});\n\t\tthis.code = options.code;\n\t\tthis.operation = options.operation;\n\t}\n}\n\nexport interface FetchControllerWithPolicyOptions {\n\treadonly fetchImpl?: (input: string \| URL \| Request, init?: RequestInit) => Promise<Response>;\n\treadonly init?: RequestInit;\n\treadonly input: string \| URL \| Request;\n\treadonly operation: ControllerRequestPolicyOperation;\n\treadonly policy?: ControllerRequestPolicy;\n}\n\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted === true) {\n\t\t\treject(signal.reason);\n\t\t\treturn;\n\t\t}\n\t\tconst timeout = setTimeout(() => {\n\t\t\tsignal?.removeEventListener('abort', onAbort);\n\t\t\tresolve();\n\t\t}, ms);\n\t\tconst onAbort = (): void => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(signal?.reason);\n\t\t};\n\t\tsignal?.addEventListener('abort', onAbort, { once: true });\n\t});\n}\n\nfunction shouldRetryResponse(response: Response, policy: ControllerRequestPolicy): boolean {\n\treturn policy.retryEnabled && policy.retryStatuses.includes(response.status);\n}\n\nexport async function drainControllerResponseBody(response: Response): Promise<void> {\n\tif (response.bodyUsed) {\n\t\treturn;\n\t}\n\tawait response.text().catch(() => undefined);\n}\n\nasync function fetchWithTimeout(options: {\n\treadonly fetchImpl: (input: string \| URL \| Request, init?: RequestInit) => Promise<Response>;\n\treadonly init?: RequestInit \| undefined;\n\treadonly input: string \| URL \| Request;\n\treadonly operation: ControllerRequestPolicyOperation;\n\treadonly timeoutMs: number;\n}): Promise<Response> {\n\tconst abortController = new AbortController();\n\tlet callerAborted = options.init?.signal?.aborted ?? false;\n\tlet timedOut = false;\n\tconst abortFromCaller = (): void => {\n\t\tcallerAborted = true;\n\t\tabortController.abort(options.init?.signal?.reason);\n\t};\n\tconst timeout = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tabortController.abort(\n\t\t\tnew Error(`${options.operation} timed out after ${String(options.timeoutMs)}ms`),\n\t\t);\n\t}, options.timeoutMs);\n\tif (callerAborted) {\n\t\tabortController.abort(options.init?.signal?.reason);\n\t} else {\n\t\toptions.init?.signal?.addEventListener('abort', abortFromCaller, { once: true });\n\t}\n\ttry {\n\t\treturn await options.fetchImpl(options.input, {\n\t\t\t...options.init,\n\t\t\tsignal: abortController.signal,\n\t\t});\n\t} catch (error) {\n\t\tif (callerAborted) {\n\t\t\tthrow error;\n\t\t}\n\t\tthrow new ControllerRequestPolicyTransportError({\n\t\t\tcause: error,\n\t\t\tcode: timedOut ? 'controller-request-timeout' : 'controller-request-failed',\n\t\t\toperation: options.operation,\n\t\t});\n\t} finally {\n\t\tclearTimeout(timeout);\n\t\toptions.init?.signal?.removeEventListener('abort', abortFromCaller);\n\t}\n}\n\nexport async function fetchControllerWithPolicy(\n\toptions: FetchControllerWithPolicyOptions,\n): Promise<Response> {\n\tconst policy = options.policy ?? controllerRequestPolicies[options.operation];\n\tconst fetchImpl = options.fetchImpl ?? fetch;\n\tlet lastTransportError: ControllerRequestPolicyTransportError \| undefined;\n\tfor (let attempt = 1; attempt <= policy.maxAttempts; attempt += 1) {\n\t\ttry {\n\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- controller retries must remain ordered by attempt and backoff.\n\t\t\tconst response = await fetchWithTimeout({\n\t\t\t\tfetchImpl,\n\t\t\t\tinit: options.init,\n\t\t\t\tinput: options.input,\n\t\t\t\toperation: options.operation,\n\t\t\t\ttimeoutMs: policy.timeoutMs,\n\t\t\t});\n\t\t\tif (attempt < policy.maxAttempts && shouldRetryResponse(response, policy)) {\n\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- drain before retrying so undici can release the response body.\n\t\t\t\tawait drainControllerResponseBody(response);\n\t\t\t\tif (policy.retryBaseDelayMs > 0) {\n\t\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- retry backoff is intentionally sequential.\n\t\t\t\t\tawait sleep(policy.retryBaseDelayMs, options.init?.signal ?? undefined);\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn response;\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ControllerRequestPolicyTransportError)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastTransportError = error;\n\t\t\tif (!(policy.retryEnabled && attempt < policy.maxAttempts)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (policy.retryBaseDelayMs > 0) {\n\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop -- retry backoff is intentionally sequential.\n\t\t\t\tawait sleep(policy.retryBaseDelayMs, options.init?.signal ?? undefined);\n\t\t\t}\n\t\t}\n\t}\n\tthrow lastTransportError ?? new Error(`${options.operation} failed without a response`);\n}\n\nexport const controllerRequestPolicies = {\n\t'workspace-git-push': {\n\t\tidempotency: 'unsafe-mutation',\n\t\tmaxAttempts: 1,\n\t\tretryBaseDelayMs: 0,\n\t\tretryEnabled: false,\n\t\tretryStatuses: [],\n\t\ttimeoutMs: 120_000,\n\t},\n\t'lease-create': {\n\t\tidempotency: 'unsafe-mutation',\n\t\tmaxAttempts: 1,\n\t\tretryBaseDelayMs: 0,\n\t\tretryEnabled: false,\n\t\tretryStatuses: [],\n\t\ttimeoutMs: 180_000,\n\t},\n\t'lease-get': {\n\t\tidempotency: 'read',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-peek': {\n\t\tidempotency: 'read',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-renew': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 3,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 10_000,\n\t},\n\t'lease-release': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-use-start': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 10_000,\n\t},\n\t'lease-heartbeat': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [429, 503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n\t'lease-use-end': {\n\t\tidempotency: 'safe-mutation',\n\t\tmaxAttempts: 2,\n\t\tretryBaseDelayMs: 250,\n\t\tretryEnabled: true,\n\t\tretryStatuses: [503, 504],\n\t\ttimeoutMs: 5_000,\n\t},\n} satisfies Record<ControllerRequestPolicyOperation, ControllerRequestPolicy>;\n","import { gatewayTypeValues, type GatewayType } from '../gateway-runtime-contract.js';\nimport {\n\tgenericControllerRequestEventOperations,\n\ttype GenericControllerRequestEventOperation,\n} from './controller-request-policy.js';\n\nexport const agentVmHealthEventKinds = [\n\t'gateway-service-health',\n\t'gateway-control-session',\n\t'controller-request',\n\t'lease-renew',\n\t'lease-heartbeat',\n\t'caller-context-rejection',\n\t'tool-vm-ssh',\n\t'gateway-plugin-health',\n\t'agent-channel-provider-health',\n\t'gateway-recovery',\n\t'gateway-recovery-suspended',\n] as const;\n\nexport type AgentVmHealthEventKind = (typeof agentVmHealthEventKinds)[number];\n\nexport const agentVmHealthResultKinds = ['ok', 'failed', 'timeout', 'stale'] as const;\n\nexport type AgentVmHealthResultKind = (typeof agentVmHealthResultKinds)[number];\n\nexport interface AgentVmHealthEventBase {\n\treadonly causationId?: string \| undefined;\n\treadonly correlationId?: string \| undefined;\n\treadonly observedAtMs: number;\n\treadonly requestId?: string \| undefined;\n\treadonly result: AgentVmHealthResultKind;\n\treadonly runId?: string \| undefined;\n\treadonly sessionKeyDigest?: string \| undefined;\n\treadonly toolCallId?: string \| undefined;\n\treadonly traceId?: string \| undefined;\n\treadonly zoneId: string;\n}\n\nexport type ToolVmSshHealthOperation = 'command' \| 'file-bridge' \| 'finalize' \| 'probe';\n\nexport const toolVmLeaseLifecycleEventRoles = ['plugin_observation', 'controller_final'] as const;\n\nexport type ToolVmLeaseLifecycleEventRole = (typeof toolVmLeaseLifecycleEventRoles)[number];\n\nexport const toolVmLeaseLifecycleTransitions = [\n\t'current_to_stale',\n\t'current_to_retired',\n\t'deprecated_to_reacquired',\n\t'deprecated_to_retired',\n\t'stale_to_reacquired',\n\t'stale_to_retired',\n\t'retired_rejected',\n] as const;\n\nexport type ToolVmLeaseLifecycleTransition = (typeof toolVmLeaseLifecycleTransitions)[number];\n\nconst toolVmLeaseReacquiredLifecycleTransitions = [\n\t'deprecated_to_reacquired',\n\t'stale_to_reacquired',\n] as const satisfies readonly ToolVmLeaseLifecycleTransition[];\n\ntype ToolVmLeaseReacquiredLifecycleTransition =\n\t(typeof toolVmLeaseReacquiredLifecycleTransitions)[number];\n\ntype ToolVmLeaseNonReacquiredLifecycleTransition = Exclude<\n\tToolVmLeaseLifecycleTransition,\n\tToolVmLeaseReacquiredLifecycleTransition\n>;\n\nexport const toolVmLeaseCallerContextStates = [\n\t'ok',\n\t'absent',\n\t'stale',\n\t'session_mismatch',\n\t'not_applicable',\n] as const;\n\nexport type ToolVmLeaseCallerContextState = (typeof toolVmLeaseCallerContextStates)[number];\n\nexport const toolVmLeaseRejectionReasons = [\n\t'caller_context_absent',\n\t'caller_context_session_mismatch',\n\t'caller_context_stale',\n\t'lease_absent',\n\t'lease_authority_absent',\n\t'lease_force_released',\n\t'lease_generation_stale',\n\t'lease_reacquire_required',\n\t'lease_releasing',\n\t'lease_retired',\n\t'lease_use_tombstoned',\n\t'ownership_denied',\n\t'runtime_not_ready',\n] as const;\n\nexport type ToolVmLeaseRejectionReason = (typeof toolVmLeaseRejectionReasons)[number];\n\ninterface ToolVmLeaseLifecycleEvidenceBase {\n\treadonly activeUseId?: string \| undefined;\n\treadonly callerContextState?: ToolVmLeaseCallerContextState \| undefined;\n\treadonly leaseRejectionReason?: ToolVmLeaseRejectionReason \| undefined;\n\treadonly lifecycleEventRole: ToolVmLeaseLifecycleEventRole;\n\treadonly oldLeaseId: string;\n\treadonly transitionId: string;\n}\n\ntype ToolVmLeaseLifecycleEvidence =\n\t\| (ToolVmLeaseLifecycleEvidenceBase & {\n\t\t\treadonly lifecycleTransition: ToolVmLeaseReacquiredLifecycleTransition;\n\t\t\treadonly replacementLeaseId: string;\n\t })\n\t\| (ToolVmLeaseLifecycleEvidenceBase & {\n\t\t\treadonly lifecycleTransition: ToolVmLeaseNonReacquiredLifecycleTransition;\n\t\t\treadonly replacementLeaseId?: undefined;\n\t });\n\ninterface ToolVmLeaseLifecycleAbsentEvidence {\n\treadonly activeUseId?: undefined;\n\treadonly callerContextState?: undefined;\n\treadonly leaseRejectionReason?: undefined;\n\treadonly lifecycleEventRole?: undefined;\n\treadonly lifecycleTransition?: undefined;\n\treadonly oldLeaseId?: undefined;\n\treadonly replacementLeaseId?: undefined;\n\treadonly transitionId?: undefined;\n}\n\nexport const agentChannelProviderHealthKinds = [\n\t'healthy',\n\t'transitioning',\n\t'unhealthy-recoverable',\n\t'unhealthy-unrecoverable',\n] as const;\n\nexport type AgentChannelProviderHealthKind = (typeof agentChannelProviderHealthKinds)[number];\n\nexport const agentChannelProviderHealthDetailKeys = [\n\t'closeCode',\n\t'providerType',\n\t'reconnectAttempt',\n\t'reconnecting',\n\t'sleepResumeSuspected',\n\t'statusCode',\n] as const;\n\nexport type AgentChannelProviderHealthDetailKey =\n\t(typeof agentChannelProviderHealthDetailKeys)[number];\n\nexport type AgentChannelProviderHealthDetails = Readonly<\n\tPartial<Record<AgentChannelProviderHealthDetailKey, boolean \| number \| string>>\n>;\n\nexport const gatewayRecoveryHealthReasons = [\n\t'agent-channel-provider-unhealthy',\n\t'gateway-control-session-unhealthy',\n\t'gateway-service-unhealthy',\n] as const;\n\nexport type GatewayRecoveryHealthReason = (typeof gatewayRecoveryHealthReasons)[number];\nexport type GatewayRecoveryVmAction = 'gateway-vm-cold-start' \| 'gateway-vm-restart';\nexport type GatewayRecoveryEventAction =\n\t\| GatewayRecoveryVmAction\n\t\| 'observe-only'\n\t\| 'operator-required';\nexport type GatewayRecoveryTimeoutErrorCode = 'recovery-callback-unconfigured' \| 'recovery-timeout';\n\nexport const gatewayControlSessionHealthOperations = [\n\t'control-session-hello',\n\t'control-session-heartbeat',\n\t'control-session-disconnect',\n\t'control-session-reconnect',\n] as const;\n\nexport type GatewayControlSessionHealthOperation =\n\t(typeof gatewayControlSessionHealthOperations)[number];\n\nexport type AgentVmHealthEvent =\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly kind: 'caller-context-rejection';\n\t\t\treadonly operation:\n\t\t\t\t\| 'lease_create'\n\t\t\t\t\| 'lease_get'\n\t\t\t\t\| 'lease_peek'\n\t\t\t\t\| 'lease_reacquire'\n\t\t\t\t\| 'lease_release'\n\t\t\t\t\| 'lease_renew'\n\t\t\t\t\| 'lease_use_end'\n\t\t\t\t\| 'lease_use_heartbeat'\n\t\t\t\t\| 'lease_use_start';\n\t\t\treadonly reason:\n\t\t\t\t\| 'caller_context_absent'\n\t\t\t\t\| 'caller_context_session_mismatch'\n\t\t\t\t\| 'caller_context_stale';\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly kind: 'gateway-service-health';\n\t\t\treadonly path: string;\n\t\t\treadonly port: number;\n\t\t\treadonly statusCode?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly bootId?: string \| undefined;\n\t\t\treadonly connectionId?: string \| undefined;\n\t\t\treadonly domain: 'gateway_control';\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-control-session';\n\t\t\treadonly operation: GatewayControlSessionHealthOperation;\n\t\t\treadonly peerId: string;\n\t\t\treadonly sessionId?: string \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly attempt: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'controller-request';\n\t\t\treadonly maxAttempts: number;\n\t\t\treadonly operation: GenericControllerRequestEventOperation;\n\t\t\treadonly statusCode?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'lease-renew';\n\t\t\treadonly leaseId: string;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'lease-heartbeat';\n\t\t\treadonly leaseId: string;\n\t\t\treadonly useId: string;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly agentId: string;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode?: string \| undefined;\n\t\t\treadonly kind: 'tool-vm-ssh';\n\t\t\treadonly leaseId: string;\n\t\t\treadonly operation: ToolVmSshHealthOperation;\n\t } & (ToolVmLeaseLifecycleAbsentEvidence \| ToolVmLeaseLifecycleEvidence))\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly gatewayService: GatewayType;\n\t\t\treadonly kind: 'gateway-plugin-health';\n\t\t\treadonly state: 'starting' \| 'ready' \| 'stopping' \| 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly channelProviderId: string;\n\t\t\treadonly details?: AgentChannelProviderHealthDetails \| undefined;\n\t\t\treadonly health: AgentChannelProviderHealthKind;\n\t\t\treadonly kind: 'agent-channel-provider-health';\n\t\t\treadonly transitionStartedAtMs?: number \| undefined;\n\t\t\treadonly unhealthySinceMs?: number \| undefined;\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount: number;\n\t\t\treadonly newBootedAt: string;\n\t\t\treadonly newHostPid: number;\n\t\t\treadonly newVmId: string;\n\t\t\treadonly oldBootedAt: string;\n\t\t\treadonly oldHostPid: number;\n\t\t\treadonly oldVmId: string;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'ok';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-cold-start';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount: number;\n\t\t\treadonly newBootedAt: string;\n\t\t\treadonly newHostPid: number;\n\t\t\treadonly newVmId: string;\n\t\t\treadonly oldBootedAt?: undefined;\n\t\t\treadonly oldHostPid?: undefined;\n\t\t\treadonly oldVmId?: undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'ok';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: string;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: string \| undefined;\n\t\t\treadonly oldHostPid?: number \| undefined;\n\t\t\treadonly oldVmId: string;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-restart';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: GatewayRecoveryTimeoutErrorCode;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: string \| undefined;\n\t\t\treadonly oldHostPid?: number \| undefined;\n\t\t\treadonly oldVmId?: string \| undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: 'gateway-vm-cold-start' \| 'observe-only' \| 'operator-required';\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly elapsedMs: number;\n\t\t\treadonly errorCode: string;\n\t\t\treadonly kind: 'gateway-recovery';\n\t\t\treadonly leaseReleaseFailureCount?: number \| undefined;\n\t\t\treadonly oldBootedAt?: undefined;\n\t\t\treadonly oldHostPid?: undefined;\n\t\t\treadonly oldVmId?: undefined;\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t })\n\t\| (AgentVmHealthEventBase & {\n\t\t\treadonly action: GatewayRecoveryEventAction;\n\t\t\treadonly consecutiveFailedRecoveries: number;\n\t\t\treadonly consecutiveFailures: number;\n\t\t\treadonly cooldownMs: number;\n\t\t\treadonly errorCode: 'max-failed-recoveries';\n\t\t\treadonly failedRecoveryResetMs: number;\n\t\t\treadonly kind: 'gateway-recovery-suspended';\n\t\t\treadonly operationId?: string \| undefined;\n\t\t\treadonly reason: GatewayRecoveryHealthReason;\n\t\t\treadonly result: 'failed';\n\t });\n\nexport const zoneHealthStateKinds = ['unknown', 'ok', 'stale', 'failed'] as const;\n\nexport type ZoneHealthStateKind = (typeof zoneHealthStateKinds)[number];\n\nexport const zoneHealthIssueKinds = [\n\t'gateway-service-unhealthy',\n\t'gateway-control-session-unhealthy',\n\t'controller-request-failing',\n\t'lease-heartbeat-failing',\n\t'lease-renew-failing',\n\t'tool-vm-ssh-failing',\n\t'gateway-plugin-unhealthy',\n\t'agent-channel-provider-unhealthy',\n\t'gateway-recovery-failed',\n\t'gateway-recovery-suspended',\n\t'health-event-stale',\n] as const;\n\nexport type ZoneHealthIssueKind = (typeof zoneHealthIssueKinds)[number];\n\nexport interface ZoneHealthIssue {\n\treadonly kind: ZoneHealthIssueKind;\n\treadonly latestEvent: AgentVmHealthEvent;\n\treadonly message: string;\n\treadonly sinceMs: number;\n}\n\nexport type ZoneHealthSnapshot =\n\t\| {\n\t\t\treadonly kind: 'unknown';\n\t\t\treadonly reason: 'no-events';\n\t\t\treadonly zoneId: string;\n\t }\n\t\| {\n\t\t\treadonly kind: 'ok';\n\t\t\treadonly latestEvents: readonly AgentVmHealthEvent[];\n\t\t\treadonly zoneId: string;\n\t }\n\t\| {\n\t\t\treadonly issues: readonly ZoneHealthIssue[];\n\t\t\treadonly kind: 'stale' \| 'failed';\n\t\t\treadonly latestEvents: readonly AgentVmHealthEvent[];\n\t\t\treadonly zoneId: string;\n\t };\n\nexport interface DeriveZoneHealthSnapshotOptions {\n\treadonly nowMs: number;\n\treadonly staleAfterMs: number;\n\treadonly zoneId: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<TValues extends readonly string[]>(\n\tvalues: TValues,\n\tvalue: unknown,\n): value is TValues[number] {\n\treturn typeof value === 'string' && values.includes(value);\n}\n\nfunction isNonNegativeFiniteNumber(value: unknown): value is number {\n\treturn typeof value === 'number' && Number.isFinite(value) && value >= 0;\n}\n\nfunction hasBaseEventFields(record: Record<string, unknown>): boolean {\n\treturn (\n\t\tisNonNegativeFiniteNumber(record.observedAtMs) &&\n\t\tisOneOf(agentVmHealthResultKinds, record.result) &&\n\t\ttypeof record.zoneId === 'string' &&\n\t\trecord.zoneId.length > 0\n\t);\n}\n\nfunction optionalString(value: unknown): boolean {\n\treturn value === undefined \|\| typeof value === 'string';\n}\n\nfunction optionalNonEmptyString(value: unknown): boolean {\n\treturn value === undefined \|\| (typeof value === 'string' && value.length > 0);\n}\n\nfunction optionalOneOf<TValues extends readonly string[]>(\n\tvalues: TValues,\n\tvalue: unknown,\n): value is TValues[number] \| undefined {\n\treturn value === undefined \|\| isOneOf(values, value);\n}\n\nfunction isToolVmLeaseReacquiredTransition(\n\tvalue: unknown,\n): value is ToolVmLeaseReacquiredLifecycleTransition {\n\treturn isOneOf(toolVmLeaseReacquiredLifecycleTransitions, value);\n}\n\nfunction optionalStatusCode(value: unknown): boolean {\n\treturn value === undefined \|\| Number.isInteger(value);\n}\n\nfunction optionalNonNegativeInteger(value: unknown): boolean {\n\treturn value === undefined \|\| (Number.isInteger(value) && Number(value) >= 0);\n}\n\nfunction isNonNegativeInteger(value: unknown): value is number {\n\treturn Number.isInteger(value) && Number(value) >= 0;\n}\n\nfunction isPositiveInteger(value: unknown): value is number {\n\treturn Number.isInteger(value) && Number(value) > 0;\n}\n\nfunction isRedactedHealthDetails(value: unknown): value is AgentChannelProviderHealthDetails {\n\tif (value === undefined) {\n\t\treturn true;\n\t}\n\tif (!isRecord(value)) {\n\t\treturn false;\n\t}\n\tfor (const [key, detailValue] of Object.entries(value)) {\n\t\tif (!isOneOf(agentChannelProviderHealthDetailKeys, key)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (!isChannelProviderHealthDetailValue(key, detailValue)) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nfunction isChannelProviderHealthDetailValue(\n\tkey: AgentChannelProviderHealthDetailKey,\n\tvalue: unknown,\n): boolean {\n\tswitch (key) {\n\t\tcase 'closeCode':\n\t\tcase 'reconnectAttempt':\n\t\tcase 'statusCode':\n\t\t\treturn isNonNegativeInteger(value);\n\t\tcase 'providerType':\n\t\t\treturn typeof value === 'string' && /^[a-z][a-z0-9._-]{0,31}$/iu.test(value);\n\t\tcase 'reconnecting':\n\t\tcase 'sleepResumeSuspected':\n\t\t\treturn typeof value === 'boolean';\n\t}\n\treturn assertNeverAgentChannelProviderHealthDetailKey(key);\n}\n\nfunction assertNeverAgentChannelProviderHealthDetailKey(key: never): never {\n\tthrow new Error(`Unhandled agent channel provider health detail key: ${String(key)}`);\n}\n\nfunction isGatewayRecoveryTimeoutErrorCode(\n\tvalue: unknown,\n): value is GatewayRecoveryTimeoutErrorCode {\n\treturn value === 'recovery-callback-unconfigured' \|\| value === 'recovery-timeout';\n}\n\nfunction isAgentChannelProviderHealthResultConsistent(\n\thealth: AgentChannelProviderHealthKind,\n\tresult: AgentVmHealthResultKind,\n): boolean {\n\tswitch (health) {\n\t\tcase 'healthy':\n\t\tcase 'transitioning':\n\t\t\treturn result === 'ok';\n\t\tcase 'unhealthy-recoverable':\n\t\tcase 'unhealthy-unrecoverable':\n\t\t\treturn result === 'failed';\n\t}\n\treturn assertNeverAgentChannelProviderHealth(health);\n}\n\nfunction hasValidToolVmLeaseLifecycleFields(value: Record<string, unknown>): boolean {\n\tconst hasLifecycleField =\n\t\tvalue.activeUseId !== undefined \|\|\n\t\tvalue.callerContextState !== undefined \|\|\n\t\tvalue.leaseRejectionReason !== undefined \|\|\n\t\tvalue.lifecycleEventRole !== undefined \|\|\n\t\tvalue.lifecycleTransition !== undefined \|\|\n\t\tvalue.oldLeaseId !== undefined \|\|\n\t\tvalue.replacementLeaseId !== undefined \|\|\n\t\tvalue.transitionId !== undefined;\n\tif (!hasLifecycleField) {\n\t\treturn true;\n\t}\n\tif (\n\t\t!(\n\t\t\toptionalNonEmptyString(value.activeUseId) &&\n\t\t\toptionalOneOf(toolVmLeaseCallerContextStates, value.callerContextState) &&\n\t\t\toptionalOneOf(toolVmLeaseRejectionReasons, value.leaseRejectionReason) &&\n\t\t\tisOneOf(toolVmLeaseLifecycleEventRoles, value.lifecycleEventRole) &&\n\t\t\tisOneOf(toolVmLeaseLifecycleTransitions, value.lifecycleTransition) &&\n\t\t\ttypeof value.oldLeaseId === 'string' &&\n\t\t\tvalue.oldLeaseId.length > 0 &&\n\t\t\ttypeof value.transitionId === 'string' &&\n\t\t\tvalue.transitionId.length > 0\n\t\t)\n\t) {\n\t\treturn false;\n\t}\n\tif (isToolVmLeaseReacquiredTransition(value.lifecycleTransition)) {\n\t\treturn typeof value.replacementLeaseId === 'string' && value.replacementLeaseId.length > 0;\n\t}\n\treturn (\n\t\tvalue.replacementLeaseId === undefined &&\n\t\toptionalOneOf(toolVmLeaseLifecycleEventRoles, value.lifecycleEventRole) &&\n\t\toptionalOneOf(toolVmLeaseLifecycleTransitions, value.lifecycleTransition)\n\t);\n}\n\nexport function isAgentVmHealthEvent(value: unknown): value is AgentVmHealthEvent {\n\tif (!isRecord(value) \|\| !hasBaseEventFields(value)) {\n\t\treturn false;\n\t}\n\tswitch (value.kind) {\n\t\tcase 'caller-context-rejection':\n\t\t\treturn (\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'lease_create',\n\t\t\t\t\t\t'lease_get',\n\t\t\t\t\t\t'lease_peek',\n\t\t\t\t\t\t'lease_reacquire',\n\t\t\t\t\t\t'lease_release',\n\t\t\t\t\t\t'lease_renew',\n\t\t\t\t\t\t'lease_use_end',\n\t\t\t\t\t\t'lease_use_heartbeat',\n\t\t\t\t\t\t'lease_use_start',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.operation,\n\t\t\t\t) &&\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'caller_context_absent',\n\t\t\t\t\t\t'caller_context_session_mismatch',\n\t\t\t\t\t\t'caller_context_stale',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.reason,\n\t\t\t\t) &&\n\t\t\t\tvalue.result === 'failed'\n\t\t\t);\n\t\tcase 'gateway-service-health':\n\t\t\treturn (\n\t\t\t\ttypeof value.path === 'string' &&\n\t\t\t\tvalue.path.length > 0 &&\n\t\t\t\tNumber.isInteger(value.port) &&\n\t\t\t\toptionalStatusCode(value.statusCode)\n\t\t\t);\n\t\tcase 'gateway-control-session':\n\t\t\treturn (\n\t\t\t\toptionalString(value.bootId) &&\n\t\t\t\toptionalString(value.connectionId) &&\n\t\t\t\tvalue.domain === 'gateway_control' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\tisOneOf(gatewayControlSessionHealthOperations, value.operation) &&\n\t\t\t\ttypeof value.peerId === 'string' &&\n\t\t\t\tvalue.peerId.length > 0 &&\n\t\t\t\toptionalString(value.sessionId)\n\t\t\t);\n\t\tcase 'controller-request':\n\t\t\treturn (\n\t\t\t\tNumber.isInteger(value.attempt) &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\tNumber.isInteger(value.maxAttempts) &&\n\t\t\t\tisOneOf(genericControllerRequestEventOperations, value.operation) &&\n\t\t\t\toptionalStatusCode(value.statusCode)\n\t\t\t);\n\t\tcase 'lease-renew':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string'\n\t\t\t);\n\t\tcase 'lease-heartbeat':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string' &&\n\t\t\t\ttypeof value.useId === 'string'\n\t\t\t);\n\t\tcase 'tool-vm-ssh':\n\t\t\treturn (\n\t\t\t\ttypeof value.agentId === 'string' &&\n\t\t\t\tisNonNegativeFiniteNumber(value.elapsedMs) &&\n\t\t\t\toptionalString(value.errorCode) &&\n\t\t\t\ttypeof value.leaseId === 'string' &&\n\t\t\t\tisOneOf(['command', 'file-bridge', 'finalize', 'probe'] as const, value.operation) &&\n\t\t\t\thasValidToolVmLeaseLifecycleFields(value)\n\t\t\t);\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn (\n\t\t\t\tisOneOf(gatewayTypeValues, value.gatewayService) &&\n\t\t\t\tisOneOf(['starting', 'ready', 'stopping', 'failed'] as const, value.state)\n\t\t\t);\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn (\n\t\t\t\ttypeof value.channelProviderId === 'string' &&\n\t\t\t\tvalue.channelProviderId.length > 0 &&\n\t\t\t\tisOneOf(agentChannelProviderHealthKinds, value.health) &&\n\t\t\t\tisOneOf(agentVmHealthResultKinds, value.result) &&\n\t\t\t\tisAgentChannelProviderHealthResultConsistent(value.health, value.result) &&\n\t\t\t\toptionalNonNegativeInteger(value.transitionStartedAtMs) &&\n\t\t\t\toptionalNonNegativeInteger(value.unhealthySinceMs) &&\n\t\t\t\tisRedactedHealthDetails(value.details)\n\t\t\t);\n\t\tcase 'gateway-recovery':\n\t\t\tif (\n\t\t\t\t!isOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'gateway-vm-cold-start',\n\t\t\t\t\t\t'gateway-vm-restart',\n\t\t\t\t\t\t'observe-only',\n\t\t\t\t\t\t'operator-required',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.action,\n\t\t\t\t) \|\|\n\t\t\t\t!isNonNegativeInteger(value.consecutiveFailures) \|\|\n\t\t\t\t!isPositiveInteger(value.cooldownMs) \|\|\n\t\t\t\t!isNonNegativeFiniteNumber(value.elapsedMs) \|\|\n\t\t\t\t!isOneOf(gatewayRecoveryHealthReasons, value.reason) \|\|\n\t\t\t\t!optionalString(value.operationId)\n\t\t\t) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (value.result === 'ok') {\n\t\t\t\tif (value.action !== 'gateway-vm-cold-start' && value.action !== 'gateway-vm-restart') {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tconst hasNewGatewayIdentity =\n\t\t\t\t\tisNonNegativeInteger(value.leaseReleaseFailureCount) &&\n\t\t\t\t\ttypeof value.newBootedAt === 'string' &&\n\t\t\t\t\tisNonNegativeInteger(value.newHostPid) &&\n\t\t\t\t\ttypeof value.newVmId === 'string' &&\n\t\t\t\t\tvalue.errorCode === undefined;\n\t\t\t\tif (!hasNewGatewayIdentity) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tif (value.action === 'gateway-vm-cold-start') {\n\t\t\t\t\treturn (\n\t\t\t\t\t\tvalue.oldBootedAt === undefined &&\n\t\t\t\t\t\tvalue.oldHostPid === undefined &&\n\t\t\t\t\t\tvalue.oldVmId === undefined\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn (\n\t\t\t\t\ttypeof value.oldBootedAt === 'string' &&\n\t\t\t\t\tisNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\ttypeof value.oldVmId === 'string'\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (value.result === 'failed') {\n\t\t\t\tif (\n\t\t\t\t\ttypeof value.errorCode !== 'string' \|\|\n\t\t\t\t\tvalue.errorCode.length === 0 \|\|\n\t\t\t\t\t!optionalNonNegativeInteger(value.leaseReleaseFailureCount) \|\|\n\t\t\t\t\tvalue.newBootedAt !== undefined \|\|\n\t\t\t\t\tvalue.newHostPid !== undefined \|\|\n\t\t\t\t\tvalue.newVmId !== undefined \|\|\n\t\t\t\t\t!optionalString(value.operationId)\n\t\t\t\t) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t\tif (value.action === 'gateway-vm-restart') {\n\t\t\t\t\tif (isGatewayRecoveryTimeoutErrorCode(value.errorCode)) {\n\t\t\t\t\t\treturn (\n\t\t\t\t\t\t\toptionalString(value.oldBootedAt) &&\n\t\t\t\t\t\t\toptionalNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\t\t\toptionalString(value.oldVmId)\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\treturn (\n\t\t\t\t\t\toptionalString(value.oldBootedAt) &&\n\t\t\t\t\t\toptionalNonNegativeInteger(value.oldHostPid) &&\n\t\t\t\t\t\ttypeof value.oldVmId === 'string' &&\n\t\t\t\t\t\tvalue.oldVmId.length > 0\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn (\n\t\t\t\t\t(value.action === 'gateway-vm-cold-start' \|\|\n\t\t\t\t\t\tvalue.action === 'observe-only' \|\|\n\t\t\t\t\t\tvalue.action === 'operator-required') &&\n\t\t\t\t\tvalue.oldBootedAt === undefined &&\n\t\t\t\t\tvalue.oldHostPid === undefined &&\n\t\t\t\t\tvalue.oldVmId === undefined\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn false;\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn (\n\t\t\t\tisOneOf(\n\t\t\t\t\t[\n\t\t\t\t\t\t'gateway-vm-cold-start',\n\t\t\t\t\t\t'gateway-vm-restart',\n\t\t\t\t\t\t'observe-only',\n\t\t\t\t\t\t'operator-required',\n\t\t\t\t\t] as const,\n\t\t\t\t\tvalue.action,\n\t\t\t\t) &&\n\t\t\t\tisNonNegativeInteger(value.consecutiveFailedRecoveries) &&\n\t\t\t\tisNonNegativeInteger(value.consecutiveFailures) &&\n\t\t\t\tisPositiveInteger(value.cooldownMs) &&\n\t\t\t\tvalue.errorCode === 'max-failed-recoveries' &&\n\t\t\t\tisPositiveInteger(value.failedRecoveryResetMs) &&\n\t\t\t\toptionalString(value.operationId) &&\n\t\t\t\tisOneOf(gatewayRecoveryHealthReasons, value.reason) &&\n\t\t\t\tvalue.result === 'failed'\n\t\t\t);\n\t\tdefault:\n\t\t\treturn false;\n\t}\n}\n\nexport function healthEventBucketKey(event: AgentVmHealthEvent): string {\n\tswitch (event.kind) {\n\t\tcase 'caller-context-rejection':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.operation}:${event.reason}`;\n\t\tcase 'gateway-control-session':\n\t\t\treturn `${event.zoneId}:${event.kind}`;\n\t\tcase 'gateway-service-health':\n\t\t\treturn `${event.zoneId}:${event.kind}`;\n\t\tcase 'controller-request':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.operation}`;\n\t\tcase 'lease-heartbeat':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}:${event.useId}`;\n\t\tcase 'lease-renew':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}`;\n\t\tcase 'tool-vm-ssh':\n\t\t\tif (event.transitionId !== undefined) {\n\t\t\t\treturn `${event.zoneId}:${event.kind}:lifecycle:${event.transitionId}`;\n\t\t\t}\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.leaseId}:${event.operation}`;\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.gatewayService}`;\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.channelProviderId}`;\n\t\tcase 'gateway-recovery':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.action}`;\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn `${event.zoneId}:${event.kind}:${event.action}`;\n\t}\n\treturn assertNeverHealthEvent(event);\n}\n\ntype HealthIssueBearingEvent = Exclude<\n\tAgentVmHealthEvent,\n\t{ readonly kind: 'caller-context-rejection' }\n>;\n\nfunction isHealthIssueBearingEvent(event: AgentVmHealthEvent): event is HealthIssueBearingEvent {\n\treturn event.kind !== 'caller-context-rejection';\n}\n\nfunction failedIssueKindForEvent(event: HealthIssueBearingEvent): ZoneHealthIssueKind {\n\tswitch (event.kind) {\n\t\tcase 'gateway-service-health':\n\t\t\treturn 'gateway-service-unhealthy';\n\t\tcase 'gateway-control-session':\n\t\t\treturn 'gateway-control-session-unhealthy';\n\t\tcase 'controller-request':\n\t\t\treturn 'controller-request-failing';\n\t\tcase 'lease-heartbeat':\n\t\t\treturn 'lease-heartbeat-failing';\n\t\tcase 'lease-renew':\n\t\t\treturn 'lease-renew-failing';\n\t\tcase 'tool-vm-ssh':\n\t\t\treturn 'tool-vm-ssh-failing';\n\t\tcase 'gateway-plugin-health':\n\t\t\treturn 'gateway-plugin-unhealthy';\n\t\tcase 'agent-channel-provider-health':\n\t\t\treturn 'agent-channel-provider-unhealthy';\n\t\tcase 'gateway-recovery':\n\t\t\treturn 'gateway-recovery-failed';\n\t\tcase 'gateway-recovery-suspended':\n\t\t\treturn 'gateway-recovery-suspended';\n\t}\n\treturn assertNeverHealthEvent(event);\n}\n\nfunction assertNeverHealthEvent(event: never): never {\n\tthrow new Error(`Unhandled health event kind: ${JSON.stringify(event)}`);\n}\n\nfunction assertNeverAgentChannelProviderHealth(health: never): never {\n\tthrow new Error(`Unhandled agent channel provider health: ${String(health)}`);\n}\n\nfunction issueForEvent(\n\tevent: AgentVmHealthEvent,\n\toptions: DeriveZoneHealthSnapshotOptions,\n): ZoneHealthIssue \| undefined {\n\tif (!isHealthIssueBearingEvent(event)) {\n\t\treturn undefined;\n\t}\n\tif (\n\t\toptions.nowMs - event.observedAtMs > options.staleAfterMs &&\n\t\t!isNonStalingSuccessfulEvent(event)\n\t) {\n\t\treturn {\n\t\t\tkind: 'health-event-stale',\n\t\t\tlatestEvent: event,\n\t\t\tmessage: `${event.kind} health event is stale`,\n\t\t\tsinceMs: event.observedAtMs,\n\t\t};\n\t}\n\tif (event.result === 'failed' \|\| event.result === 'timeout' \|\| event.result === 'stale') {\n\t\treturn {\n\t\t\tkind: failedIssueKindForEvent(event),\n\t\t\tlatestEvent: event,\n\t\t\tmessage: `${event.kind} health event reported ${event.result}`,\n\t\t\tsinceMs: event.observedAtMs,\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction isNonStalingSuccessfulEvent(event: AgentVmHealthEvent): boolean {\n\treturn event.kind === 'gateway-recovery' && event.result === 'ok';\n}\n\ntype ReacquiredControllerFinalToolVmSshEvent = Extract<\n\tAgentVmHealthEvent,\n\t{ readonly kind: 'tool-vm-ssh' }\n> & {\n\treadonly lifecycleEventRole: 'controller_final';\n\treadonly lifecycleTransition: ToolVmLeaseReacquiredLifecycleTransition;\n\treadonly oldLeaseId: string;\n\treadonly replacementLeaseId: string;\n\treadonly transitionId: string;\n};\n\nfunction isReacquiredControllerFinalEvent(\n\tevent: AgentVmHealthEvent,\n): event is ReacquiredControllerFinalToolVmSshEvent {\n\treturn (\n\t\tevent.kind === 'tool-vm-ssh' &&\n\t\tevent.lifecycleEventRole === 'controller_final' &&\n\t\tisToolVmLeaseReacquiredTransition(event.lifecycleTransition) &&\n\t\tevent.result === 'ok'\n\t);\n}\n\nfunction latestReacquiredAtMsByOldLeaseId(\n\tevents: readonly AgentVmHealthEvent[],\n): ReadonlyMap<string, number> {\n\tconst latestByOldLeaseId = new Map<string, number>();\n\tfor (const event of events) {\n\t\tif (!isReacquiredControllerFinalEvent(event)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst previousObservedAtMs = latestByOldLeaseId.get(event.oldLeaseId);\n\t\tif (previousObservedAtMs === undefined \|\| previousObservedAtMs < event.observedAtMs) {\n\t\t\tlatestByOldLeaseId.set(event.oldLeaseId, event.observedAtMs);\n\t\t}\n\t}\n\treturn latestByOldLeaseId;\n}\n\nfunction isPlainToolVmSshEvent(\n\tevent: AgentVmHealthEvent,\n): event is Extract<AgentVmHealthEvent, { readonly kind: 'tool-vm-ssh' }> {\n\treturn event.kind === 'tool-vm-ssh' && event.transitionId === undefined;\n}\n\nfunction filterSupersededToolVmSshEvents(\n\tevents: readonly AgentVmHealthEvent[],\n): readonly AgentVmHealthEvent[] {\n\tconst latestReacquiredAtByOldLeaseId = latestReacquiredAtMsByOldLeaseId(events);\n\treturn events.filter((event) => {\n\t\tif (!isPlainToolVmSshEvent(event)) {\n\t\t\treturn true;\n\t\t}\n\t\tconst reacquiredAtMs = latestReacquiredAtByOldLeaseId.get(event.leaseId);\n\t\treturn reacquiredAtMs === undefined \|\| reacquiredAtMs < event.observedAtMs;\n\t});\n}\n\nexport function deriveZoneHealthSnapshot(\n\tevents: readonly AgentVmHealthEvent[],\n\toptions: DeriveZoneHealthSnapshotOptions,\n): ZoneHealthSnapshot {\n\tconst latestByKey = new Map<string, AgentVmHealthEvent>();\n\tfor (const event of events) {\n\t\tif (event.zoneId !== options.zoneId \|\| event.kind === 'caller-context-rejection') {\n\t\t\tcontinue;\n\t\t}\n\t\tconst key = healthEventBucketKey(event);\n\t\tconst previous = latestByKey.get(key);\n\t\tif (!previous \|\| previous.observedAtMs <= event.observedAtMs) {\n\t\t\tlatestByKey.set(key, event);\n\t\t}\n\t}\n\tconst latestEvents = filterSupersededToolVmSshEvents([...latestByKey.values()]).toSorted(\n\t\t(first, second) => second.observedAtMs - first.observedAtMs,\n\t);\n\tif (latestEvents.length === 0) {\n\t\treturn { kind: 'unknown', reason: 'no-events', zoneId: options.zoneId };\n\t}\n\tconst issues = latestEvents\n\t\t.map((event) => issueForEvent(event, options))\n\t\t.filter((issue): issue is ZoneHealthIssue => issue !== undefined);\n\tif (issues.length === 0) {\n\t\treturn { kind: 'ok', latestEvents, zoneId: options.zoneId };\n\t}\n\tif (issues.some((issue) => issue.kind === 'health-event-stale')) {\n\t\treturn { issues, kind: 'stale', latestEvents, zoneId: options.zoneId };\n\t}\n\treturn { issues, kind: 'failed', latestEvents, zoneId: options.zoneId };\n}\n","function trimGitSuffix(repoPath: string): string {\n\treturn repoPath.replace(/\\.git$/u, '');\n}\n\nfunction normalizeRepoPath(repoPath: string): string \| undefined {\n\tconst trimmedRepoPath = trimGitSuffix(repoPath.trim().replace(/^\\/+/u, ''));\n\tconst segments = trimmedRepoPath.split('/');\n\tif (segments.length < 2 \|\| segments.some((segment) => !/^[A-Za-z0-9_.-]+$/u.test(segment))) {\n\t\treturn undefined;\n\t}\n\treturn trimmedRepoPath;\n}\n\nfunction normalizeHost(host: string): string \| undefined {\n\tconst normalizedHost = host.trim().toLowerCase();\n\tif (!/^[a-z0-9.-]+$/u.test(normalizedHost) \|\| normalizedHost.startsWith('.')) {\n\t\treturn undefined;\n\t}\n\treturn normalizedHost;\n}\n\nexport interface NormalizedGitSshReadAllowlistEntry {\n\treadonly host: string;\n\treadonly repoPath: string;\n}\n\nexport interface NormalizedGitSshReadAllowlist {\n\treadonly allowedHosts: readonly string[];\n\treadonly allowedRepos: readonly string[];\n}\n\nexport function normalizeGitRepoForSshReadAllowlist(\n\trepoUrl: string,\n): NormalizedGitSshReadAllowlistEntry \| undefined {\n\tconst trimmedRepoUrl = repoUrl.trim();\n\tif (trimmedRepoUrl.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tlet parsedUrl: URL \| undefined;\n\ttry {\n\t\tparsedUrl = new URL(trimmedRepoUrl);\n\t} catch {\n\t\tparsedUrl = undefined;\n\t}\n\tif (parsedUrl !== undefined) {\n\t\tconst host = normalizeHost(parsedUrl.hostname);\n\t\tconst repoPath = normalizeRepoPath(parsedUrl.pathname);\n\t\treturn host === undefined \|\| repoPath === undefined ? undefined : { host, repoPath };\n\t}\n\n\tconst scpMatch = /^(?:[^@]+@)?(?<host>[A-Za-z0-9.-]+):(?<repoPath>[^:]+)$/u.exec(trimmedRepoUrl);\n\tif (scpMatch?.groups?.host !== undefined && scpMatch.groups.repoPath !== undefined) {\n\t\tconst host = normalizeHost(scpMatch.groups.host);\n\t\tconst repoPath = normalizeRepoPath(scpMatch.groups.repoPath);\n\t\treturn host === undefined \|\| repoPath === undefined ? undefined : { host, repoPath };\n\t}\n\n\tconst hostPathMatch = /^(?<host>[A-Za-z0-9.-]+)\\/(?<repoPath>.+)$/u.exec(trimmedRepoUrl);\n\tif (hostPathMatch?.groups?.host !== undefined && hostPathMatch.groups.repoPath !== undefined) {\n\t\tconst repoPathWithoutHost = normalizeRepoPath(hostPathMatch.groups.repoPath);\n\t\tconst host = normalizeHost(hostPathMatch.groups.host);\n\t\tif (host !== undefined && repoPathWithoutHost !== undefined && host.includes('.')) {\n\t\t\treturn { host, repoPath: repoPathWithoutHost };\n\t\t}\n\t}\n\n\tconst bareRepoPath = normalizeRepoPath(trimmedRepoUrl);\n\tif (bareRepoPath !== undefined) {\n\t\treturn { host: 'github.com', repoPath: bareRepoPath };\n\t}\n\n\treturn undefined;\n}\n\nexport function normalizeGitReposForSshReadAllowlist(\n\trepoUrls: readonly string[] \| undefined,\n): NormalizedGitSshReadAllowlist {\n\tif (repoUrls === undefined) {\n\t\treturn { allowedHosts: [], allowedRepos: [] };\n\t}\n\tconst allowedHosts = new Set<string>();\n\tconst allowedRepos = new Set<string>();\n\tfor (const repoUrl of repoUrls) {\n\t\tconst normalizedRepo = normalizeGitRepoForSshReadAllowlist(repoUrl);\n\t\tif (normalizedRepo !== undefined) {\n\t\t\tallowedHosts.add(normalizedRepo.host);\n\t\t\tallowedRepos.add(normalizedRepo.repoPath);\n\t\t}\n\t}\n\treturn {\n\t\tallowedHosts: [...allowedHosts].toSorted(),\n\t\tallowedRepos: [...allowedRepos].toSorted(),\n\t};\n}\n\nexport function normalizeGitHubRepoForSshReadAllowlist(repoUrl: string): string \| undefined {\n\tconst trimmedRepoUrl = repoUrl.trim();\n\tif (trimmedRepoUrl.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tconst scpMatch = /^git@github\\.com:(?<repoPath>[^:]+\\/[^/]+)$/iu.exec(trimmedRepoUrl);\n\tif (scpMatch?.groups?.repoPath !== undefined) {\n\t\treturn normalizeRepoPath(scpMatch.groups.repoPath);\n\t}\n\n\tconst hostPathMatch = /^(?:github\\.com\\/)(?<repoPath>[^/]+\\/[^/]+)$/iu.exec(trimmedRepoUrl);\n\tif (hostPathMatch?.groups?.repoPath !== undefined) {\n\t\treturn normalizeRepoPath(hostPathMatch.groups.repoPath);\n\t}\n\n\tconst bareRepoPath = normalizeRepoPath(trimmedRepoUrl);\n\tif (bareRepoPath !== undefined) {\n\t\treturn bareRepoPath;\n\t}\n\n\tlet parsedUrl: URL;\n\ttry {\n\t\tparsedUrl = new URL(trimmedRepoUrl);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (parsedUrl.hostname.toLowerCase() !== 'github.com') {\n\t\treturn undefined;\n\t}\n\treturn normalizeRepoPath(parsedUrl.pathname);\n}\n\nexport function normalizeGitHubReposForSshReadAllowlist(\n\trepoUrls: readonly string[] \| undefined,\n): readonly string[] {\n\treturn normalizeGitReposForSshReadAllowlist(repoUrls).allowedRepos;\n}\n","/\n Canonical NODE_OPTIONS value for forcing IPv4-preference egress\n * in agent-vm VMs.\n \n Background: the managed VM synthetic DNS path (when tcpHosts is enabled)\n * returns a per-host IPv4 (reverse-lookable) and a single shared\n * IPv4-mapped IPv6 (::ffff:198.18.0.1, NOT reverse-lookable). Node\n * 20+'s fetch (via undici, autoSelectFamily: true) races both\n * families; when the IPv6 race wins (~5-20% under sequential load),\n * the VM egress router cannot route it and the request fails with a non-JSON\n * 400 (HTTP) or 403 (TLS). The two flags below stop the race:\n \n --dns-result-order=ipv4first changes dns.lookup() so\n * IPv4 addresses are listed\n * before IPv6.\n \n --no-network-family-autoselection disables Node's Happy\n * Eyeballs entirely. This is\n * the load-bearing flag —\n * --dns-result-order alone\n * doesn't prevent Node from\n * racing both families if\n * IPv4 is slow.\n \n Composition: NODE_OPTIONS is whitespace-separated. To add more\n * flags downstream, append rather than replace. Example:\n \n NODE_OPTIONS: `${FORCE_IPV4_EGRESS_NODE_OPTIONS} --inspect`\n \n Reference: see `shravan-claw@0ddf5f2:docs/wip/debugging/\n * 2026-05-21-lease-keepalive-400-and-discord-403-ipv6-race.md`\n * for the full root-cause analysis. Node-side flag references:\n * https://github.com/nodejs/node/issues/54359 (autoSelectFamily\n * revert recommendation by the Node core team).\n /\nexport const FORCE_IPV4_EGRESS_NODE_OPTIONS =\n\t'--dns-result-order=ipv4first --no-network-family-autoselection';\n\nconst FORCE_IPV4_EGRESS_NODE_OPTION_FLAGS = FORCE_IPV4_EGRESS_NODE_OPTIONS.split(/\\s+/u);\n\n/\n Compose the forced IPv4-preference flags with a user-provided\n * NODE_OPTIONS value (if any).\n \n Use this at every site where NODE_OPTIONS is set into a VM env\n * block AFTER a spread of user-controlled secrets, to guarantee\n * the forced flags are always present in the final value even if\n * a zone secret happens to provide its own NODE_OPTIONS.\n \n Forced flags come FIRST so they are unambiguously applied.\n * User-provided flags are appended verbatim except for duplicate\n * forced IPv4-preference flags. Node treats NODE_OPTIONS as a\n * whitespace-separated list and all flags apply.\n \n Returns just the forced flags if the user value is undefined,\n * empty, or whitespace-only.\n \n Examples:\n \n composeNodeOptions(undefined)\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection'\n \n composeNodeOptions('')\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection'\n \n composeNodeOptions('--inspect=0.0.0.0:9229')\n * ──► '--dns-result-order=ipv4first --no-network-family-autoselection\n * --inspect=0.0.0.0:9229'\n /\nexport function composeNodeOptions(userValue: string \| undefined): string {\n\tconst trimmed = userValue?.trim() ?? '';\n\tif (trimmed === '') {\n\t\treturn FORCE_IPV4_EGRESS_NODE_OPTIONS;\n\t}\n\tconst userFlags = trimmed\n\t\t.split(/\\s+/u)\n\t\t.filter((flag) => !FORCE_IPV4_EGRESS_NODE_OPTION_FLAGS.includes(flag));\n\tif (userFlags.length === 0) {\n\t\treturn FORCE_IPV4_EGRESS_NODE_OPTIONS;\n\t}\n\treturn `${FORCE_IPV4_EGRESS_NODE_OPTIONS} ${userFlags.join(' ')}`;\n}\n","export type ManagedFrameworkKind = 'openclaw' \| 'hermes';\n\nexport type ManagedFrameworkBootEntry = 'openclaw-gateway' \| 'hermes-gateway';\n\nexport interface ManagedGatewayLogIdentity {\n\treadonly guestPath: string;\n\treadonly serviceName: string;\n}\n\nexport interface ManagedToolPortalReadinessMetadata {\n\treadonly evidencePath: string;\n\treadonly kind: 'tool-portal-evidence';\n\treadonly socketPath: string;\n}\n\nexport interface ManagedFrameworkReadinessMetadata {\n\treadonly guestPort: number;\n\treadonly kind: 'framework-http';\n\treadonly path: string;\n}\n\nexport interface ManagedFrameworkIngressMetadata {\n\treadonly guestPort: number;\n\treadonly kind: 'framework-http';\n}\n\nexport interface ManagedToolPortalServiceBootMetadata {\n\treadonly bootEntry: 'agent-vm-gateway-runtime';\n\treadonly configurationInputPath: string;\n\treadonly environmentInputPath: string;\n\treadonly logIdentity: ManagedGatewayLogIdentity;\n\treadonly readiness: ManagedToolPortalReadinessMetadata;\n\treadonly role: 'tool-portal-service';\n}\n\ninterface ManagedFrameworkServiceBootMetadataBase {\n\treadonly configurationInputPath: string;\n\treadonly environmentInputPath: string;\n\treadonly ingress: ManagedFrameworkIngressMetadata;\n\treadonly logIdentity: ManagedGatewayLogIdentity;\n\treadonly readiness: ManagedFrameworkReadinessMetadata;\n\treadonly role: 'framework-service';\n}\n\nexport interface ManagedOpenClawServiceBootMetadata extends ManagedFrameworkServiceBootMetadataBase {\n\treadonly bootEntry: 'openclaw-gateway';\n\treadonly framework: 'openclaw';\n}\n\nexport interface ManagedHermesServiceBootMetadata extends ManagedFrameworkServiceBootMetadataBase {\n\treadonly bootEntry: 'hermes-gateway';\n\treadonly framework: 'hermes';\n}\n\nexport type ManagedFrameworkServiceBootMetadata =\n\t\| ManagedOpenClawServiceBootMetadata\n\t\| ManagedHermesServiceBootMetadata;\n\n/\n Exact image-owned startup contract for a managed Gateway VM.\n \n This contract intentionally contains no executable, argv, shell command,\n * callback, process handle, or resolved environment value. The image build\n * maps each closed `bootEntry` discriminator to code-owned process startup.\n /\nexport interface ManagedGatewayBootContract {\n\treadonly contractVersion: 1;\n\treadonly frameworkService: ManagedFrameworkServiceBootMetadata;\n\treadonly kind: 'managed-gateway-exact-two-role';\n\treadonly toolPortalService: ManagedToolPortalServiceBootMetadata;\n}\n\ntype UnknownRecord = Readonly<Record<string, unknown>>;\n\nfunction assertPlainRecord(value: unknown, label: string): asserts value is UnknownRecord {\n\tif (value === null \|\| typeof value !== 'object' \|\| Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be a plain object.`);\n\t}\n\tconst prototype = Reflect.getPrototypeOf(value);\n\tif (prototype !== Object.prototype && prototype !== null) {\n\t\tthrow new Error(`${label} must be a plain object.`);\n\t}\n}\n\nfunction assertExactFields(\n\trecord: UnknownRecord,\n\tlabel: string,\n\trequiredFields: readonly string[],\n): void {\n\tconst requiredFieldSet = new Set(requiredFields);\n\tfor (const fieldKey of Reflect.ownKeys(record)) {\n\t\tif (typeof fieldKey !== 'string') {\n\t\t\tthrow new Error(`${label} has an unknown symbol field.`);\n\t\t}\n\t\tconst fieldName = fieldKey;\n\t\tif (!requiredFieldSet.has(fieldName)) {\n\t\t\tthrow new Error(`${label} has unknown field '${fieldName}'.`);\n\t\t}\n\t\tconst descriptor = Reflect.getOwnPropertyDescriptor(record, fieldName);\n\t\tif (descriptor === undefined \|\| !Object.hasOwn(descriptor, 'value')) {\n\t\t\tthrow new Error(`${label}.${fieldName} must be a data field.`);\n\t\t}\n\t}\n\tfor (const fieldName of requiredFields) {\n\t\tif (!Object.hasOwn(record, fieldName)) {\n\t\t\tthrow new Error(`${label} is missing required field '${fieldName}'.`);\n\t\t}\n\t}\n}\n\nfunction parseLiteral<TLiteral extends string \| number>(\n\tvalue: unknown,\n\texpected: TLiteral,\n\tlabel: string,\n): TLiteral {\n\tif (value !== expected) {\n\t\tthrow new Error(`${label} must be ${JSON.stringify(expected)}.`);\n\t}\n\treturn expected;\n}\n\nfunction parseNonEmptyString(value: unknown, label: string): string {\n\tif (typeof value !== 'string' \|\| value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string.`);\n\t}\n\treturn value;\n}\n\nfunction parseAbsoluteGuestPath(value: unknown, label: string): string {\n\tconst guestPath = parseNonEmptyString(value, label);\n\tif (\n\t\t!guestPath.startsWith('/') \|\|\n\t\tguestPath.includes('\\0') \|\|\n\t\tguestPath.includes('//') \|\|\n\t\t(guestPath.length > 1 && guestPath.endsWith('/')) \|\|\n\t\tguestPath.split('/').some((segment) => segment === '.' \|\| segment === '..')\n\t) {\n\t\tthrow new Error(`${label} must be a normalized absolute guest path.`);\n\t}\n\treturn guestPath;\n}\n\nfunction parseHttpPath(value: unknown, label: string): string {\n\tconst httpPath = parseNonEmptyString(value, label);\n\tif (!httpPath.startsWith('/') \|\| httpPath.includes('\\0')) {\n\t\tthrow new Error(`${label} must be an absolute HTTP path.`);\n\t}\n\treturn httpPath;\n}\n\nfunction parseGuestPort(value: unknown, label: string): number {\n\tif (!Number.isInteger(value) \|\| typeof value !== 'number' \|\| value < 1 \|\| value > 65_535) {\n\t\tthrow new Error(`${label} must be an integer TCP port from 1 through 65535.`);\n\t}\n\treturn value;\n}\n\nfunction parseLogIdentity(value: unknown, label: string): ManagedGatewayLogIdentity {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPath', 'serviceName']);\n\treturn Object.freeze({\n\t\tguestPath: parseAbsoluteGuestPath(value.guestPath, `${label}.guestPath`),\n\t\tserviceName: parseNonEmptyString(value.serviceName, `${label}.serviceName`),\n\t});\n}\n\nfunction parseToolPortalReadiness(\n\tvalue: unknown,\n\tlabel: string,\n): ManagedToolPortalReadinessMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['evidencePath', 'kind', 'socketPath']);\n\treturn Object.freeze({\n\t\tevidencePath: parseAbsoluteGuestPath(value.evidencePath, `${label}.evidencePath`),\n\t\tkind: parseLiteral(value.kind, 'tool-portal-evidence', `${label}.kind`),\n\t\tsocketPath: parseAbsoluteGuestPath(value.socketPath, `${label}.socketPath`),\n\t});\n}\n\nfunction parseFrameworkReadiness(value: unknown, label: string): ManagedFrameworkReadinessMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPort', 'kind', 'path']);\n\treturn Object.freeze({\n\t\tguestPort: parseGuestPort(value.guestPort, `${label}.guestPort`),\n\t\tkind: parseLiteral(value.kind, 'framework-http', `${label}.kind`),\n\t\tpath: parseHttpPath(value.path, `${label}.path`),\n\t});\n}\n\nfunction parseFrameworkIngress(value: unknown, label: string): ManagedFrameworkIngressMetadata {\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, ['guestPort', 'kind']);\n\treturn Object.freeze({\n\t\tguestPort: parseGuestPort(value.guestPort, `${label}.guestPort`),\n\t\tkind: parseLiteral(value.kind, 'framework-http', `${label}.kind`),\n\t});\n}\n\nfunction parseToolPortalService(value: unknown): ManagedToolPortalServiceBootMetadata {\n\tconst label = 'Managed Gateway boot contract toolPortalService';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'bootEntry',\n\t\t'configurationInputPath',\n\t\t'environmentInputPath',\n\t\t'logIdentity',\n\t\t'readiness',\n\t\t'role',\n\t]);\n\treturn Object.freeze({\n\t\tbootEntry: parseLiteral(value.bootEntry, 'agent-vm-gateway-runtime', `${label}.bootEntry`),\n\t\tconfigurationInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.configurationInputPath,\n\t\t\t`${label}.configurationInputPath`,\n\t\t),\n\t\tenvironmentInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.environmentInputPath,\n\t\t\t`${label}.environmentInputPath`,\n\t\t),\n\t\tlogIdentity: parseLogIdentity(value.logIdentity, `${label}.logIdentity`),\n\t\treadiness: parseToolPortalReadiness(value.readiness, `${label}.readiness`),\n\t\trole: parseLiteral(value.role, 'tool-portal-service', `${label}.role`),\n\t});\n}\n\nfunction parseFrameworkService(value: unknown): ManagedFrameworkServiceBootMetadata {\n\tconst label = 'Managed Gateway boot contract frameworkService';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'bootEntry',\n\t\t'configurationInputPath',\n\t\t'environmentInputPath',\n\t\t'framework',\n\t\t'ingress',\n\t\t'logIdentity',\n\t\t'readiness',\n\t\t'role',\n\t]);\n\tconst framework = value.framework;\n\tif (framework !== 'openclaw' && framework !== 'hermes') {\n\t\tthrow new Error(`${label}.framework must be \"openclaw\" or \"hermes\".`);\n\t}\n\tconst ingress = parseFrameworkIngress(value.ingress, `${label}.ingress`);\n\tconst readiness = parseFrameworkReadiness(value.readiness, `${label}.readiness`);\n\tif (ingress.guestPort !== readiness.guestPort) {\n\t\tthrow new Error(`${label} ingress and readiness must identify the same guest port.`);\n\t}\n\tconst commonFields = {\n\t\tconfigurationInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.configurationInputPath,\n\t\t\t`${label}.configurationInputPath`,\n\t\t),\n\t\tenvironmentInputPath: parseAbsoluteGuestPath(\n\t\t\tvalue.environmentInputPath,\n\t\t\t`${label}.environmentInputPath`,\n\t\t),\n\t\tingress,\n\t\tlogIdentity: parseLogIdentity(value.logIdentity, `${label}.logIdentity`),\n\t\treadiness,\n\t\trole: parseLiteral(value.role, 'framework-service', `${label}.role`),\n\t};\n\tif (framework === 'openclaw') {\n\t\treturn Object.freeze({\n\t\t\t...commonFields,\n\t\t\tbootEntry: parseLiteral(value.bootEntry, 'openclaw-gateway', `${label}.bootEntry`),\n\t\t\tframework,\n\t\t});\n\t}\n\treturn Object.freeze({\n\t\t...commonFields,\n\t\tbootEntry: parseLiteral(value.bootEntry, 'hermes-gateway', `${label}.bootEntry`),\n\t\tframework,\n\t});\n}\n\n/\n Parses untrusted or serialized boot metadata into the exact V1 contract.\n * Unknown fields are rejected at every level and a fresh deeply frozen value\n * is returned so callers cannot retain mutation authority after validation.\n /\nexport function parseManagedGatewayBootContract(value: unknown): ManagedGatewayBootContract {\n\tconst label = 'Managed Gateway boot contract';\n\tassertPlainRecord(value, label);\n\tassertExactFields(value, label, [\n\t\t'contractVersion',\n\t\t'frameworkService',\n\t\t'kind',\n\t\t'toolPortalService',\n\t]);\n\treturn Object.freeze({\n\t\tcontractVersion: parseLiteral(value.contractVersion, 1, `${label}.contractVersion`),\n\t\tframeworkService: parseFrameworkService(value.frameworkService),\n\t\tkind: parseLiteral(value.kind, 'managed-gateway-exact-two-role', `${label}.kind`),\n\t\ttoolPortalService: parseToolPortalService(value.toolPortalService),\n\t});\n}\n","import type { MediatedSecretSpec } from '@agent-vm/secret-management';\n\nimport { targetsAudience, type RuntimeVmAudience } from './audience.js';\nimport type { GatewaySecretConfig, GatewayZoneConfig } from './gateway-lifecycle.js';\n\nexport interface SplitResolvedSecretsResult {\n\treadonly environmentSecrets: Record<string, string>;\n\treadonly mediatedSecrets: Record<string, MediatedSecretSpec>;\n}\n\nexport interface MergeRuntimeGatewaySecretsOptions {\n\treadonly logPrefix?: string;\n\treadonly runtimeEnvironment?: Readonly<Record<string, string>> \| undefined;\n\treadonly runtimeMediatedSecrets?: Readonly<Record<string, MediatedSecretSpec>> \| undefined;\n}\n\nexport type SecretInjectionConfig = GatewaySecretConfig;\n\nexport interface SplitResolvedSecretsOptions {\n\treadonly audience: RuntimeVmAudience;\n\treadonly logPrefix?: string;\n}\n\nexport function splitResolvedSecretsByInjection(\n\tsecretConfigs: Readonly<Record<string, SecretInjectionConfig>>,\n\tresolvedSecrets: Record<string, string>,\n\toptions: SplitResolvedSecretsOptions,\n): SplitResolvedSecretsResult {\n\tconst environmentSecrets: Record<string, string> = {};\n\tconst mediatedSecrets: Record<string, MediatedSecretSpec> = {};\n\tconst logPrefix = options.logPrefix ?? 'split-resolved-secrets';\n\n\tfor (const [secretName, secretValue] of Object.entries(resolvedSecrets)) {\n\t\tconst secretConfig = secretConfigs[secretName];\n\t\tif (!secretConfig) {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' was resolved but has no matching secret config.`,\n\t\t\t);\n\t\t}\n\t\tif (!targetsAudience(secretConfig.audience, options.audience)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (secretConfig.injection === 'http-mediation') {\n\t\t\tif (secretConfig.hosts.length === 0) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses http-mediation but declares no hosts.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tmediatedSecrets[secretName] = {\n\t\t\t\thosts: [...secretConfig.hosts],\n\t\t\t\tvalue: secretValue,\n\t\t\t};\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst envSecretAudience = (secretConfig as { readonly audience: string }).audience;\n\t\tif (envSecretAudience !== 'gateway') {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses env injection with non-gateway audience '${envSecretAudience}'.`,\n\t\t\t);\n\t\t}\n\t\tif (options.audience === 'gateway') {\n\t\t\tenvironmentSecrets[secretName] = secretValue;\n\t\t}\n\t}\n\n\treturn { environmentSecrets, mediatedSecrets };\n}\n\nexport type SplitResolvedGatewaySecretsResult = SplitResolvedSecretsResult;\n\nexport function splitResolvedGatewaySecrets(\n\tzone: GatewayZoneConfig,\n\tresolvedSecrets: Record<string, string>,\n): SplitResolvedGatewaySecretsResult {\n\treturn splitResolvedSecretsByInjection(zone.secrets, resolvedSecrets, {\n\t\taudience: 'gateway',\n\t\tlogPrefix: 'split-resolved-gateway-secrets',\n\t});\n}\n\nfunction assertNoRuntimeSecretCollision(\n\tsecretName: string,\n\ttarget: 'environment' \| 'http-mediation',\n\tbaseSecrets: SplitResolvedSecretsResult,\n\truntimeSeen: Set<string>,\n\tlogPrefix: string,\n): void {\n\tif (runtimeSeen.has(secretName)) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway secret '${secretName}' is declared for both environment and http-mediation injection.`,\n\t\t);\n\t}\n\tif (secretName in baseSecrets.environmentSecrets) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway ${target} secret '${secretName}' would overwrite an authored environment secret.`,\n\t\t);\n\t}\n\tif (secretName in baseSecrets.mediatedSecrets) {\n\t\tthrow new Error(\n\t\t\t`[${logPrefix}] Runtime gateway ${target} secret '${secretName}' would overwrite an authored http-mediation secret.`,\n\t\t);\n\t}\n\truntimeSeen.add(secretName);\n}\n\nexport function mergeRuntimeGatewaySecrets(\n\tbaseSecrets: SplitResolvedSecretsResult,\n\toptions: MergeRuntimeGatewaySecretsOptions = {},\n): SplitResolvedSecretsResult {\n\tconst logPrefix = options.logPrefix ?? 'merge-runtime-gateway-secrets';\n\tconst runtimeSeen = new Set<string>();\n\tfor (const secretName of Object.keys(options.runtimeEnvironment ?? {})) {\n\t\tassertNoRuntimeSecretCollision(secretName, 'environment', baseSecrets, runtimeSeen, logPrefix);\n\t}\n\tfor (const secretName of Object.keys(options.runtimeMediatedSecrets ?? {})) {\n\t\tassertNoRuntimeSecretCollision(\n\t\t\tsecretName,\n\t\t\t'http-mediation',\n\t\t\tbaseSecrets,\n\t\t\truntimeSeen,\n\t\t\tlogPrefix,\n\t\t);\n\t}\n\n\treturn {\n\t\tenvironmentSecrets: {\n\t\t\t...baseSecrets.environmentSecrets,\n\t\t\t...options.runtimeEnvironment,\n\t\t},\n\t\tmediatedSecrets: {\n\t\t\t...baseSecrets.mediatedSecrets,\n\t\t\t...options.runtimeMediatedSecrets,\n\t\t},\n\t};\n}\n","import { v7 as uuidv7, validate as validateUuid, version as uuidVersion } from 'uuid';\n\nexport type ToolVmActiveUseOutcome =\n\t\| 'abandoned'\n\t\| 'cancelled'\n\t\| 'completed'\n\t\| 'failed'\n\t\| 'timed-out';\n\nexport interface ToolVmActiveUseCorrelation {\n\treadonly messageId?: string \| undefined;\n\treadonly requestId?: string \| undefined;\n\treadonly runId?: string \| undefined;\n\treadonly sessionKeyDigest?: string \| undefined;\n\treadonly toolCallId?: string \| undefined;\n\treadonly traceId?: string \| undefined;\n}\n\nexport type ToolVmSshOperationPhase =\n\t\| 'completed'\n\t\| 'failed'\n\t\| 'probe-succeeded'\n\t\| 'running'\n\t\| 'starting';\n\nexport type ToolVmSshFailureKind =\n\t\| 'active-use-refreshable-failure'\n\t\| 'ssh-command-failed'\n\t\| 'ssh-command-timed-out'\n\t\| 'ssh-probe-failed';\n\nexport interface ToolVmSshFailureReport {\n\treadonly kind: ToolVmSshFailureKind;\n\treadonly message: string;\n}\n\nexport interface ToolVmSshOperationReport {\n\treadonly failure?: ToolVmSshFailureReport \| undefined;\n\treadonly probeSucceeded?: boolean \| undefined;\n}\n\nexport interface ToolVmActiveUseOperationReport {\n\treadonly observedAtMs: number;\n\treadonly phase: ToolVmSshOperationPhase;\n\treadonly ssh?: ToolVmSshOperationReport \| undefined;\n}\n\nexport interface StartToolVmActiveUseRequest {\n\treadonly correlation?: ToolVmActiveUseCorrelation \| undefined;\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n\treadonly useId: string;\n}\n\nexport interface StartToolVmActiveUseResponse {\n\treadonly expiresAt: number;\n\treadonly heartbeatAfterMs: number;\n\treadonly useId: string;\n}\n\nexport interface HeartbeatToolVmActiveUseResponse {\n\treadonly expiresAt: number;\n\treadonly heartbeatAfterMs: number;\n}\n\nexport interface HeartbeatToolVmActiveUseRequest {\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n}\n\nexport interface EndToolVmActiveUseRequest {\n\treadonly outcome: ToolVmActiveUseOutcome;\n\treadonly report?: ToolVmActiveUseOperationReport \| undefined;\n}\n\nexport interface ToolVmActiveUseHandle {\n\treadonly signal: AbortSignal;\n\treadonly useId: string;\n\tdispose(outcome?: ToolVmActiveUseOutcome): Promise<void>;\n\tend(outcome?: ToolVmActiveUseOutcome): Promise<void>;\n\treport(report: ToolVmActiveUseOperationReport): void;\n}\n\nexport interface CreateToolVmActiveUseHandleOptions {\n\treadonly correlation?: ToolVmActiveUseCorrelation \| undefined;\n\treadonly endActiveUse: (useId: string, request: EndToolVmActiveUseRequest) => Promise<void>;\n\treadonly heartbeatActiveUse: (\n\t\tuseId: string,\n\t\trequest: HeartbeatToolVmActiveUseRequest,\n\t) => Promise<HeartbeatToolVmActiveUseResponse>;\n\treadonly heartbeatJitterRatio?: number \| undefined;\n\treadonly isEndErrorTolerable?: (error: unknown) => boolean;\n\treadonly isHeartbeatErrorRefreshable?: (error: unknown) => boolean;\n\treadonly logEndFailure?: (error: unknown) => void;\n\treadonly logHeartbeatFailure?: (error: unknown) => void;\n\treadonly maxHeartbeatDurationMs?: number \| undefined;\n\treadonly nowImpl?: (() => number) \| undefined;\n\treadonly onRefreshableHeartbeatFailure?: (error: unknown) => Promise<void>;\n\treadonly randomImpl?: (() => number) \| undefined;\n\treadonly startActiveUse: (\n\t\trequest: StartToolVmActiveUseRequest,\n\t) => Promise<StartToolVmActiveUseResponse>;\n\treadonly setTimeoutImpl?: typeof setTimeout \| undefined;\n\treadonly clearTimeoutImpl?: typeof clearTimeout \| undefined;\n}\n\ntype HeartbeatTimer = ReturnType<typeof setTimeout>;\n\nconst defaultMaxHeartbeatDurationMs = 12 60 * 60 * 1000;\n\nfunction jitterDelayMs(params: {\n\treadonly delayMs: number;\n\treadonly jitterRatio: number;\n\treadonly random: () => number;\n}): number {\n\tif (params.jitterRatio <= 0) {\n\t\treturn params.delayMs;\n\t}\n\tconst spreadMs = params.delayMs * params.jitterRatio;\n\tconst minMs = params.delayMs - spreadMs;\n\tconst jitteredMs = minMs + params.random() * spreadMs * 2;\n\treturn Math.max(1, Math.round(jitteredMs));\n}\n\nexport function createToolVmActiveUseId(): string {\n\treturn uuidv7();\n}\n\nexport function isToolVmActiveUseId(value: string): boolean {\n\treturn validateUuid(value) && uuidVersion(value) === 7;\n}\n\nexport function normalizeToolVmActiveUseCorrelation(\n\tcorrelation: unknown,\n): ToolVmActiveUseCorrelation \| undefined {\n\tif (!isToolVmActiveUseCorrelationRecord(correlation)) {\n\t\treturn undefined;\n\t}\n\tconst getString = (key: keyof ToolVmActiveUseCorrelation): string \| undefined => {\n\t\tconst value = correlation[key];\n\t\treturn typeof value === 'string' && value.length > 0 ? value : undefined;\n\t};\n\tconst normalizedCorrelation = {\n\t\t...(getString('messageId') !== undefined ? { messageId: getString('messageId') } : {}),\n\t\t...(getString('requestId') !== undefined ? { requestId: getString('requestId') } : {}),\n\t\t...(getString('runId') !== undefined ? { runId: getString('runId') } : {}),\n\t\t...(getString('sessionKeyDigest') !== undefined\n\t\t\t? { sessionKeyDigest: getString('sessionKeyDigest') }\n\t\t\t: {}),\n\t\t...(getString('toolCallId') !== undefined ? { toolCallId: getString('toolCallId') } : {}),\n\t\t...(getString('traceId') !== undefined ? { traceId: getString('traceId') } : {}),\n\t} satisfies ToolVmActiveUseCorrelation;\n\treturn Object.keys(normalizedCorrelation).length > 0 ? normalizedCorrelation : undefined;\n}\n\nfunction isToolVmActiveUseCorrelationRecord(\n\tvalue: unknown,\n): value is Readonly<Record<keyof ToolVmActiveUseCorrelation, unknown>> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport async function createToolVmActiveUseHandle(\n\toptions: CreateToolVmActiveUseHandleOptions,\n): Promise<ToolVmActiveUseHandle> {\n\tconst useId = createToolVmActiveUseId();\n\tconst startedUse = await options.startActiveUse({\n\t\t...(options.correlation ? { correlation: options.correlation } : {}),\n\t\tuseId,\n\t});\n\tconst setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;\n\tconst clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;\n\tconst now = options.nowImpl ?? Date.now;\n\tconst startedAt = now();\n\tconst maxHeartbeatDurationMs = options.maxHeartbeatDurationMs ?? defaultMaxHeartbeatDurationMs;\n\tconst heartbeatJitterRatio = options.heartbeatJitterRatio ?? 0.1;\n\tconst random = options.randomImpl ?? Math.random;\n\tconst operationAbortController = new AbortController();\n\tlet ended = false;\n\tlet heartbeatTimer: HeartbeatTimer \| undefined;\n\tlet latestReport: ToolVmActiveUseOperationReport \| undefined;\n\n\tconst clearHeartbeatTimer = (): void => {\n\t\tif (heartbeatTimer) {\n\t\t\tclearTimeoutImpl(heartbeatTimer);\n\t\t\theartbeatTimer = undefined;\n\t\t}\n\t};\n\n\tconst scheduleHeartbeat = (delayMs: number): void => {\n\t\tif (now() - startedAt >= maxHeartbeatDurationMs) {\n\t\t\treturn;\n\t\t}\n\t\tclearHeartbeatTimer();\n\t\theartbeatTimer = setTimeoutImpl(\n\t\t\t() => {\n\t\t\t\tif (now() - startedAt >= maxHeartbeatDurationMs) {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst heartbeatRequest: HeartbeatToolVmActiveUseRequest =\n\t\t\t\t\tlatestReport === undefined ? {} : { report: latestReport };\n\t\t\t\tvoid options\n\t\t\t\t\t.heartbeatActiveUse(startedUse.useId, heartbeatRequest)\n\t\t\t\t\t.then((heartbeat) => {\n\t\t\t\t\t\tif (!ended) {\n\t\t\t\t\t\t\tscheduleHeartbeat(heartbeat.heartbeatAfterMs);\n\t\t\t\t\t\t}\n\t\t\t\t\t})\n\t\t\t\t\t.catch((error: unknown) => {\n\t\t\t\t\t\toptions.logHeartbeatFailure?.(error);\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\toptions.isHeartbeatErrorRefreshable?.(error) === true &&\n\t\t\t\t\t\t\toptions.onRefreshableHeartbeatFailure\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\toperationAbortController.abort(error);\n\t\t\t\t\t\t\tended = true;\n\t\t\t\t\t\t\tclearHeartbeatTimer();\n\t\t\t\t\t\t\tvoid options.onRefreshableHeartbeatFailure(error).catch((staleError: unknown) => {\n\t\t\t\t\t\t\t\toptions.logHeartbeatFailure?.(staleError);\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (!ended) {\n\t\t\t\t\t\t\tscheduleHeartbeat(startedUse.heartbeatAfterMs);\n\t\t\t\t\t\t}\n\t\t\t\t\t});\n\t\t\t},\n\t\t\tjitterDelayMs({ delayMs, jitterRatio: heartbeatJitterRatio, random }),\n\t\t);\n\t};\n\n\tscheduleHeartbeat(startedUse.heartbeatAfterMs);\n\n\tconst end = async (outcome: ToolVmActiveUseOutcome = 'completed'): Promise<void> => {\n\t\tif (ended) {\n\t\t\treturn;\n\t\t}\n\t\tended = true;\n\t\tclearHeartbeatTimer();\n\t\ttry {\n\t\t\tawait options.endActiveUse(startedUse.useId, {\n\t\t\t\toutcome,\n\t\t\t\t...(latestReport === undefined ? {} : { report: latestReport }),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tif (options.isEndErrorTolerable?.(error) === true) {\n\t\t\t\toptions.logEndFailure?.(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\treturn {\n\t\tsignal: operationAbortController.signal,\n\t\tuseId: startedUse.useId,\n\t\tdispose: end,\n\t\tend,\n\t\treport: (report): void => {\n\t\t\tif (ended) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlatestReport = report;\n\t\t},\n\t};\n}\n","export const TOOL_VM_WORK_GUEST_ROOT = '/work';\nexport const TOOL_VM_SCRATCH_GUEST_ROOT = '/scratch';\nexport const OPENCLAW_STATE_VM_ROOT = '/home/openclaw/.openclaw/state';\nexport const OPENCLAW_STATE_SANDBOXES_VM_ROOT = `${OPENCLAW_STATE_VM_ROOT}/sandboxes`;\n\nexport type RuntimePathNamespace = 'controller-host' \| 'openclaw-gateway' \| 'tool-vm-guest';\nexport type RuntimePathPurpose = 'executionCwd' \| 'leaseMount';\n\nexport interface RuntimePathCapabilities {\n\treadonly executionCwd: boolean;\n\treadonly leaseMount: boolean;\n}\n\nexport type RuntimePathBacking =\n\t\| {\n\t\t\treadonly kind: 'host-realfs';\n\t\t\treadonly durability: 'durable' \| 'runtime' \| 'cache';\n\t\t\treadonly backup: 'included' \| 'excluded';\n\t }\n\t\| {\n\t\t\treadonly kind: 'guest-rootfs-cow';\n\t\t\treadonly durability: 'vm-lifetime';\n\t };\n\nexport type RuntimePathLocations = Partial<Record<RuntimePathNamespace, string>>;\nexport type RuntimePathHostRealfsLocations =\n\t\| {\n\t\t\treadonly 'controller-host': string;\n\t\t\treadonly 'openclaw-gateway'?: string;\n\t\t\treadonly 'tool-vm-guest'?: string;\n\t }\n\t\| {\n\t\t\treadonly 'controller-host'?: string;\n\t\t\treadonly 'openclaw-gateway': string;\n\t\t\treadonly 'tool-vm-guest'?: string;\n\t };\nexport interface RuntimePathGuestRootfsCowLocations {\n\treadonly 'controller-host'?: never;\n\treadonly 'openclaw-gateway'?: never;\n\treadonly 'tool-vm-guest': string;\n}\nexport type RuntimePathGuidanceVisibility = Partial<Record<RuntimePathNamespace, boolean>>;\n\ninterface RuntimePathRootMappingBase {\n\treadonly capabilities: RuntimePathCapabilities;\n\treadonly guidanceLabel: string;\n\treadonly id: string;\n\t/*\n\t False for broad roots like /zone where mounting the root would expose\n\t * unrelated children; callers must request an explicit child path.\n\t /\n\treadonly rootPathAllowed: boolean;\n\treadonly showInGuidance?: RuntimePathGuidanceVisibility;\n}\n\nexport type RuntimePathRootMapping =\n\t\| (RuntimePathRootMappingBase & {\n\t\t\treadonly backing: Extract<RuntimePathBacking, { readonly kind: 'host-realfs' }>;\n\t\t\treadonly locations: RuntimePathHostRealfsLocations;\n\t })\n\t\| (RuntimePathRootMappingBase & {\n\t\t\treadonly backing: Extract<RuntimePathBacking, { readonly kind: 'guest-rootfs-cow' }>;\n\t\t\treadonly capabilities: RuntimePathCapabilities & { readonly leaseMount: false };\n\t\t\treadonly locations: RuntimePathGuestRootfsCowLocations;\n\t });\n\nexport interface RuntimePathMapping {\n\treadonly id: string;\n\treadonly roots: readonly RuntimePathRootMapping[];\n}\n\nexport interface TranslateRuntimePathInput {\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly purpose: RuntimePathPurpose;\n\treadonly sourceNamespace?: RuntimePathNamespace;\n\treadonly targetNamespace: RuntimePathNamespace;\n}\n\nexport interface RuntimePathTranslation {\n\treadonly backing: RuntimePathBacking;\n\treadonly capabilities: RuntimePathCapabilities;\n\treadonly inputNamespace: RuntimePathNamespace;\n\treadonly inputPath: string;\n\treadonly mappingId: string;\n\treadonly outputNamespace: RuntimePathNamespace;\n\treadonly outputPath: string;\n\treadonly relativePath: string;\n\treadonly rootId: string;\n}\n\nexport type RuntimePathTranslationErrorCode =\n\t\| 'path-not-absolute'\n\t\| 'path-parent-traversal'\n\t\| 'invalid-runtime-root'\n\t\| 'unknown-runtime-path'\n\t\| 'purpose-not-allowed'\n\t\| 'root-path-not-allowed'\n\t\| 'target-namespace-not-available';\n\nexport interface RuntimePathTranslationError {\n\treadonly allowedPathForms: readonly string[];\n\treadonly code: RuntimePathTranslationErrorCode;\n\treadonly inputPath: string;\n\treadonly mappingId: string;\n\treadonly message: string;\n\treadonly purpose: RuntimePathPurpose;\n\treadonly retryGuidance: string;\n}\n\nexport type TranslateRuntimePathResult =\n\t\| {\n\t\t\treadonly ok: true;\n\t\t\treadonly value: RuntimePathTranslation;\n\t }\n\t\| {\n\t\t\treadonly ok: false;\n\t\t\treadonly error: RuntimePathTranslationError;\n\t };\n\ninterface RuntimePathRootMatch {\n\treadonly inputNamespace: RuntimePathNamespace;\n\treadonly matchedRoot: string;\n\treadonly root: RuntimePathRootMapping;\n}\n\nconst guidanceNamespaceOrder = [\n\t'tool-vm-guest',\n\t'openclaw-gateway',\n\t'controller-host',\n] as const satisfies readonly RuntimePathNamespace[];\n\nfunction pathContainsParentTraversal(inputPath: string): boolean {\n\treturn inputPath.split(/\\/+/u).includes('..');\n}\n\nfunction normalizeAbsolutePath(inputPath: string): string {\n\tconst rawSegments = inputPath.split('/').filter((segment) => segment !== '' && segment !== '.');\n\treturn `/${rawSegments.join('/')}`;\n}\n\nfunction normalizeRoot(rootPath: string): string {\n\tconst normalizedRoot = normalizeAbsolutePath(rootPath);\n\treturn normalizedRoot === '/' ? normalizedRoot : normalizedRoot.replace(/\\/+$/u, '');\n}\n\nfunction pathMatchesRoot(candidatePath: string, rootPath: string): boolean {\n\treturn candidatePath === rootPath \|\| candidatePath.startsWith(`${rootPath}/`);\n}\n\nfunction relativePathForRoot(candidatePath: string, rootPath: string): string {\n\treturn candidatePath === rootPath ? '' : candidatePath.slice(rootPath.length + 1);\n}\n\nfunction joinRootAndRelative(rootPath: string, relativePath: string): string {\n\treturn relativePath === '' ? rootPath : `${rootPath}/${relativePath}`;\n}\n\nfunction runtimeRootIsInvalid(rootPath: string): boolean {\n\treturn (\n\t\trootPath.trim() === '' \|\| !rootPath.startsWith('/') \|\| pathContainsParentTraversal(rootPath)\n\t);\n}\n\nfunction namespaceShouldShowInGuidance(\n\troot: RuntimePathRootMapping,\n\tnamespace: RuntimePathNamespace,\n): boolean {\n\tif (root.showInGuidance?.[namespace] !== undefined) {\n\t\treturn root.showInGuidance[namespace];\n\t}\n\treturn namespace !== 'controller-host';\n}\n\nfunction allowedPathFormsForMapping(\n\tmapping: RuntimePathMapping,\n\tpurpose: RuntimePathPurpose,\n): readonly string[] {\n\treturn mapping.roots.flatMap((root) => {\n\t\tif (!root.capabilities[purpose]) {\n\t\t\treturn [];\n\t\t}\n\t\tconst suffix = root.rootPathAllowed ? '[/subpath]' : '/<child>';\n\t\treturn guidanceNamespaceOrder.flatMap((namespace): string[] => {\n\t\t\tconst rootPath = root.locations[namespace];\n\t\t\tif (rootPath === undefined \|\| !namespaceShouldShowInGuidance(root, namespace)) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\treturn [`${normalizeRoot(rootPath)}${suffix}`];\n\t\t});\n\t});\n}\n\nfunction retryGuidanceForMapping(mapping: RuntimePathMapping, purpose: RuntimePathPurpose): string {\n\treturn `Use one of the allowed path forms for ${mapping.id} ${purpose}: ${allowedPathFormsForMapping(mapping, purpose).join(', ')}.`;\n}\n\nfunction errorResult(params: {\n\treadonly code: RuntimePathTranslationErrorCode;\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly message: string;\n\treadonly purpose: RuntimePathPurpose;\n}): TranslateRuntimePathResult {\n\treturn {\n\t\terror: {\n\t\t\tallowedPathForms: allowedPathFormsForMapping(params.mapping, params.purpose),\n\t\t\tcode: params.code,\n\t\t\tinputPath: params.inputPath,\n\t\t\tmappingId: params.mapping.id,\n\t\t\tmessage: params.message,\n\t\t\tpurpose: params.purpose,\n\t\t\tretryGuidance: retryGuidanceForMapping(params.mapping, params.purpose),\n\t\t},\n\t\tok: false,\n\t};\n}\n\nfunction findBestRootMatch(params: {\n\treadonly inputPath: string;\n\treadonly mapping: RuntimePathMapping;\n\treadonly sourceNamespace?: RuntimePathNamespace;\n}): RuntimePathRootMatch \| undefined {\n\tconst matches = params.mapping.roots.flatMap((root): RuntimePathRootMatch[] =>\n\t\tguidanceNamespaceOrder.flatMap((inputNamespace) => {\n\t\t\tconst rootPath = root.locations[inputNamespace];\n\t\t\tif (rootPath === undefined) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tif (params.sourceNamespace !== undefined && inputNamespace !== params.sourceNamespace) {\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\tconst normalizedRoot = normalizeRoot(rootPath);\n\t\t\treturn pathMatchesRoot(params.inputPath, normalizedRoot)\n\t\t\t\t? [{ inputNamespace, matchedRoot: normalizedRoot, root }]\n\t\t\t\t: [];\n\t\t}),\n\t);\n\treturn matches.toSorted((left, right) => right.matchedRoot.length - left.matchedRoot.length)[0];\n}\n\nfunction findInvalidRoot(\n\tmapping: RuntimePathMapping,\n): { readonly rootId: string; readonly rootPath: string } \| undefined {\n\tfor (const root of mapping.roots) {\n\t\tfor (const namespace of guidanceNamespaceOrder) {\n\t\t\tconst rootPath = root.locations[namespace];\n\t\t\tif (rootPath !== undefined && runtimeRootIsInvalid(rootPath)) {\n\t\t\t\treturn { rootId: root.id, rootPath };\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n\nexport function translateRuntimePath(input: TranslateRuntimePathInput): TranslateRuntimePathResult {\n\tif (!input.inputPath.startsWith('/')) {\n\t\treturn errorResult({\n\t\t\tcode: 'path-not-absolute',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${input.inputPath}' must be absolute.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\t// Reject traversal before normalization so /work/../secret cannot\n\t// collapse into a seemingly valid path under a trusted root.\n\tif (pathContainsParentTraversal(input.inputPath)) {\n\t\treturn errorResult({\n\t\t\tcode: 'path-parent-traversal',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${input.inputPath}' must not contain parent traversal.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst invalidRoot = findInvalidRoot(input.mapping);\n\tif (invalidRoot !== undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'invalid-runtime-root',\n\t\t\tinputPath: input.inputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Runtime path root '${invalidRoot.rootId}' has invalid path '${invalidRoot.rootPath}'.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst normalizedInputPath = normalizeAbsolutePath(input.inputPath);\n\tconst match = findBestRootMatch({\n\t\tinputPath: normalizedInputPath,\n\t\tmapping: input.mapping,\n\t\t...(input.sourceNamespace === undefined ? {} : { sourceNamespace: input.sourceNamespace }),\n\t});\n\tif (match === undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'unknown-runtime-path',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' is not part of runtime path mapping '${input.mapping.id}'.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst relativePath = relativePathForRoot(normalizedInputPath, match.matchedRoot);\n\tif (relativePath === '' && !match.root.rootPathAllowed) {\n\t\treturn errorResult({\n\t\t\tcode: 'root-path-not-allowed',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel}, but the root itself is not allowed for ${input.purpose}.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tif (!match.root.capabilities[input.purpose]) {\n\t\treturn errorResult({\n\t\t\tcode: 'purpose-not-allowed',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel} but cannot be used for ${input.purpose}.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst targetRoot = match.root.locations[input.targetNamespace];\n\tif (targetRoot === undefined) {\n\t\treturn errorResult({\n\t\t\tcode: 'target-namespace-not-available',\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmapping: input.mapping,\n\t\t\tmessage: `Path '${normalizedInputPath}' matched ${match.root.guidanceLabel}, but '${input.targetNamespace}' is not available for that root.`,\n\t\t\tpurpose: input.purpose,\n\t\t});\n\t}\n\tconst normalizedTargetRoot = normalizeRoot(targetRoot);\n\treturn {\n\t\tok: true,\n\t\tvalue: {\n\t\t\tbacking: match.root.backing,\n\t\t\tcapabilities: match.root.capabilities,\n\t\t\tinputNamespace: match.inputNamespace,\n\t\t\tinputPath: normalizedInputPath,\n\t\t\tmappingId: input.mapping.id,\n\t\t\toutputNamespace: input.targetNamespace,\n\t\t\toutputPath: joinRootAndRelative(normalizedTargetRoot, relativePath),\n\t\t\trelativePath,\n\t\t\trootId: match.root.id,\n\t\t},\n\t};\n}\n","import { v7 as uuidv7, validate as validateUuid, version as uuidVersion } from 'uuid';\n\ndeclare const toolVmLeaseIdBrand: unique symbol;\n\nexport type ToolVmLeaseId = string & {\n\treadonly [toolVmLeaseIdBrand]: true;\n};\n\nexport function createToolVmLeaseId(): ToolVmLeaseId {\n\treturn parseToolVmLeaseId(uuidv7());\n}\n\nexport function isToolVmLeaseId(value: unknown): value is ToolVmLeaseId {\n\treturn typeof value === 'string' && validateUuid(value) && uuidVersion(value) === 7;\n}\n\nexport function parseToolVmLeaseId(value: unknown): ToolVmLeaseId {\n\tif (isToolVmLeaseId(value)) {\n\t\treturn value;\n\t}\n\tthrow new TypeError('Tool VM lease id must be an opaque UUIDv7 string.');\n}\n","const VM_SSH_PUBLIC_ENDPOINT_KEYS = new Set(['host', 'port', 'user']);\n\n/\n Small host-issued capability envelope shared by VM-backed transports. The\n * transport tag keeps SSH Tool VM leases distinct from future host-side\n * VM RPC or bridge capabilities without inventing a transport object.\n /\nexport interface VmCapabilityLease<TTransport extends string> {\n\treadonly leaseId: string;\n\treadonly transport: TTransport;\n}\n\nexport interface VmSshEndpoint {\n\treadonly host: string;\n\treadonly identityPem: string;\n\treadonly knownHostsLine: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface VmSshPublicEndpoint {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface VmSshLease<TTransport extends string> extends VmCapabilityLease<TTransport> {\n\treadonly ssh: VmSshEndpoint;\n}\n\nfunction objectValue(value: unknown): object \| undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === 'string' && value.trim().length > 0;\n}\n\nexport function isVmCapabilityLease<TTransport extends string>(\n\tvalue: unknown,\n\ttransport: TTransport,\n): value is VmCapabilityLease<TTransport> {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'leaseId') === 'string' &&\n\t\tReflect.get(record, 'transport') === transport\n\t);\n}\n\nexport function isVmSshEndpoint(value: unknown): value is VmSshEndpoint {\n\tconst record = objectValue(value);\n\treturn (\n\t\trecord !== undefined &&\n\t\ttypeof Reflect.get(record, 'host') === 'string' &&\n\t\tisNonEmptyString(Reflect.get(record, 'identityPem')) &&\n\t\tisNonEmptyString(Reflect.get(record, 'knownHostsLine')) &&\n\t\ttypeof Reflect.get(record, 'port') === 'number' &&\n\t\ttypeof Reflect.get(record, 'user') === 'string'\n\t);\n}\n\nexport function isVmSshPublicEndpoint(value: unknown): value is VmSshPublicEndpoint {\n\tconst record = objectValue(value);\n\tif (record === undefined) {\n\t\treturn false;\n\t}\n\tfor (const key of Object.keys(record)) {\n\t\tif (!VM_SSH_PUBLIC_ENDPOINT_KEYS.has(key)) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn (\n\t\ttypeof Reflect.get(record, 'host') === 'string' &&\n\t\ttypeof Reflect.get(record, 'port') === 'number' &&\n\t\ttypeof Reflect.get(record, 'user') === 'string'\n\t);\n}\n","import { isToolVmLeaseId, type ToolVmLeaseId } from './tool-vm-lease-id.js';\nimport {\n\tisVmCapabilityLease,\n\tisVmSshEndpoint,\n\tisVmSshPublicEndpoint,\n\ttype VmCapabilityLease,\n\ttype VmSshLease,\n\ttype VmSshPublicEndpoint,\n} from './vm-capability-lease.js';\n\nexport const defaultToolVmLeaseAuthorityTombstoneTtlMs = 10 60 * 1000;\nexport const TOOL_VM_WORK_GUEST_ROOT = '/work';\n\nexport interface ToolVmSshLease extends VmSshLease<'ssh-sandbox'> {\n\treadonly agentId: string;\n\treadonly idleTtlMs: number;\n\treadonly leaseId: ToolVmLeaseId;\n\treadonly tcpSlot: number;\n\treadonly workdir: string;\n}\n\nexport interface ToolVmLeasePeek extends VmCapabilityLease<'ssh-sandbox'> {\n\treadonly agentId: string;\n\treadonly createdAt: number;\n\treadonly idleTtlMs: number;\n\treadonly lastUsedAt: number;\n\treadonly leaseId: ToolVmLeaseId;\n\treadonly profileId: string;\n\treadonly ssh: VmSshPublicEndpoint;\n\treadonly tcpSlot: number;\n\treadonly workdir: string;\n\treadonly zoneId: string;\n}\n\nfunction objectValue(value: unknown): object \| undefined {\n\treturn typeof value === 'object' && value !== null ? value : undefined;\n}\n\nconst deprecatedScopeKeyPropertyName = ['scope', 'Key'].join('');\n\nexport function isToolVmSshLease(value: unknown): value is ToolVmSshLease {\n\tconst record = objectValue(value);\n\treturn (\n\t\tisVmCapabilityLease(record, 'ssh-sandbox') &&\n\t\tisToolVmLeaseId(Reflect.get(record, 'leaseId')) &&\n\t\tisVmSshEndpoint(Reflect.get(record, 'ssh')) &&\n\t\ttypeof Reflect.get(record, 'agentId') === 'string' &&\n\t\ttypeof Reflect.get(record, 'idleTtlMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'tcpSlot') === 'number' &&\n\t\ttypeof Reflect.get(record, 'workdir') === 'string' &&\n\t\t!Reflect.has(record, deprecatedScopeKeyPropertyName)\n\t);\n}\n\nexport function isToolVmLeasePeek(value: unknown): value is ToolVmLeasePeek {\n\tconst record = objectValue(value);\n\treturn (\n\t\tisVmCapabilityLease(record, 'ssh-sandbox') &&\n\t\tisToolVmLeaseId(Reflect.get(record, 'leaseId')) &&\n\t\ttypeof Reflect.get(record, 'agentId') === 'string' &&\n\t\ttypeof Reflect.get(record, 'createdAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'idleTtlMs') === 'number' &&\n\t\ttypeof Reflect.get(record, 'lastUsedAt') === 'number' &&\n\t\ttypeof Reflect.get(record, 'profileId') === 'string' &&\n\t\tisVmSshPublicEndpoint(Reflect.get(record, 'ssh')) &&\n\t\ttypeof Reflect.get(record, 'tcpSlot') === 'number' &&\n\t\ttypeof Reflect.get(record, 'workdir') === 'string' &&\n\t\ttypeof Reflect.get(record, 'zoneId') === 'string' &&\n\t\t!Reflect.has(record, deprecatedScopeKeyPropertyName)\n\t);\n}\n"],"mappings":";;AAAA,MAAa,oBAAoB;CAAC;CAAY;CAAU;CAAS;AAIjE,SAAgB,yBAAyB,kBAA0B,QAAwB;CAC1F,OAAO,GAAG,iBAAiB,GAAG,OAAO;;AAGtC,SAAgB,sBACf,kBACA,QACA,SACS;CACT,OAAO,GAAG,iBAAiB,GAAG,OAAO,QAAQ;;;;AC6K9C,MAAa,wCAAwC;AACrD,MAAa,wCAAwC,OAAO,OAAO;CAClE,QAAQ;CACR,UAAU;CACV,CAAC;AAEF,MAAa,+BAA+B,OAAO,OAAO;CACzD,cAAc;CACd,gBAAgB;CAChB,CAAC;AAEF,MAAa,kCAAkC,OAAO,OAAO;CAC5D,uBAAuB;CACvB,2BAA2B;CAC3B,gBAAgB;CAChB,CAAC;AA4BF,SAAgB,+CAAuF;CACtG,IACC,gCAAgC,wBAChC,gCAAgC,2BAEhC,MAAM,IAAI,MACT,qFACA;CAEF,OAAO;EACN,iBAAiB,EAAE,GAAG,iCAAiC;EACvD,cAAc,EAAE,GAAG,8BAA8B;EACjD;;;;ACjPF,MAAa,mBAAmB;CAAC;CAAW;CAAW;CAAO;AAU9D,MAAa,mBAAmB;AAEhC,SAAgB,gBACf,gBACA,iBACU;CACV,OAAO,mBAAmB,mBAAmB,mBAAmB;;AAGjE,SAAgB,uBACf,aACA,iBACoB;CACpB,OAAO,YACL,QAAQ,eAAe,gBAAgB,WAAW,UAAU,gBAAgB,CAAC,CAC7E,KAAK,eAAe,WAAW,KAAK;;AAGvC,SAAgB,sBAAsB,aAA6D;CAClG,OAAO,MAAM,KACZ,IAAI,IACH,uBAAuB,aAAa,UAAU,CAAC,QAAQ,SAAS,SAAS,iBAAiB,CAC1F,CACD;;AAGF,SAAgB,qBAAqB,aAA6D;CACjG,OAAO,MAAM,KACZ,IAAI,IACH,uBAAuB,aAAa,UAAU,CAAC,QAAQ,SAAS,SAAS,iBAAiB,CAC1F,CACD;;;;AC1BF,SAAS,oBAAoB,OAAuB;CACnD,OAAO,MAAM,QAAQ,wBAAwB,OAAO;;AAGrD,SAAS,mBAAmB,MAAc,SAA0B;CACnE,MAAM,oBAAoB,QAAQ,MAAM,CAAC,aAAa;CACtD,IAAI,sBAAsB,IACzB,OAAO;CAER,IAAI,sBAAsB,KACzB,OAAO;CAOR,OAAO,IAJkB,OACxB,IAAI,kBAAkB,MAAM,IAAI,CAAC,IAAI,oBAAoB,CAAC,KAAK,KAAK,CAAC,IACrE,KAEkB,CAAC,KAAK,KAAK,aAAa,CAAC;;AAG7C,SAAS,0BAA0B,SAA2B;CAC7D,MAAM,UAAU,QAAQ,QAAQ,IAAI,UAAU,EAAE,aAAa,IAAI;CACjE,MAAM,aAAa,QAAQ,QAAQ,IAAI,aAAa,EAAE,aAAa,IAAI;CACvE,OACC,YAAY,eACZ,WACE,MAAM,IAAI,CACV,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,SAAS,UAAU,IACrB,QAAQ,QAAQ,IAAI,oBAAoB,IACxC,QAAQ,QAAQ,IAAI,wBAAwB;;AAI9C,SAAS,qBAAqB,KAA+B;CAC5D,IAAI,IAAI,aAAa,SACpB,OAAO;CAER,IAAI,IAAI,aAAa,UACpB,OAAO;CAER,OAAO;;AAGR,SAAS,qBAAqB,KAAU,QAA8B;CACrE,IAAI,IAAI,KAAK,SAAS,GACrB,OAAO,OAAO,SAAS,IAAI,MAAM,GAAG;CAErC,OAAO,WAAW,QAAQ,MAAM;;AAGjC,SAAS,qBAAqB,QAA8B;CAC3D,OAAO,WAAW,QAAQ,MAAM;;AAGjC,SAAS,4BAA4B,MAA8B,SAA2B;CAC7F,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;CAChC,MAAM,gBAAgB,qBAAqB,IAAI;CAC/C,IAAI,kBAAkB,KAAK,QAC1B,OAAO;CAGR,IAAI,CAAC,mBAAmB,IAAI,UAAU,KAAK,KAAK,EAC/C,OAAO;CAGR,IACC,qBAAqB,KAAK,cAAc,MAAM,KAAK,QAAQ,qBAAqB,KAAK,OAAO,GAE5F,OAAO;CAGR,IAAI,KAAK,SAAS,KAAA,KAAa,IAAI,aAAa,KAAK,MACpD,OAAO;CAGR,OAAO;;AAGR,SAAgB,6BACf,OACA,iBACoC;CACpC,QAAQ,SAAS,EAAE,EAAE,QAAQ,SAAS,gBAAgB,KAAK,UAAU,gBAAgB,CAAC;;AAGvF,SAAgB,mCACf,SACiD;CACjD,MAAM,eAAe,6BAA6B,QAAQ,OAAO,QAAQ,gBAAgB;CAEzF,OAAO,OAAO,YAA+C;EAC5D,IAAI,CAAC,0BAA0B,QAAQ,EACtC;EAGD,IAAI,aAAa,MAAM,SAAS,4BAA4B,MAAM,QAAQ,CAAC,EAC1E;EAGD,OAAO,IAAI,SAAS,gDAAgD;GACnE,QAAQ;GACR,YAAY;GACZ,CAAC;;;;;ACtHJ,MAAa,+CACZ;AACD,MAAa,0DACZ;AAED,MAAa,4CAA4C,CACxD,yDACA,6CACA;;;ACRD,MAAa,6CAA6C;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAoBD,MAAM,oDAAoD,IAAI,IAC7D,CAbA,mBACA,cAYA,CACA;AAED,SAAS,yCACR,WACsD;CACtD,OAAO,CAAC,kDAAkD,IAAI,UAAU;;AAGzE,MAAa,0CAA0C,CACtD,GAAG,2CACH,CAAC,OAAO,yCAAyC;AAElD,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AA6BD,IAAa,wCAAb,cAA2D,MAAM;CAChE;CACA;CAEA,YAAY,SAIT;EACF,MAAM,eACL,QAAQ,iBAAiB,QAAQ,QAAQ,MAAM,UAAU,OAAO,QAAQ,MAAM;EAC/E,MAAM,GAAG,QAAQ,UAAU,GAAG,QAAQ,KAAK,IAAI,gBAAgB,EAC9D,OAAO,QAAQ,OACf,CAAC;EACF,KAAK,OAAO,QAAQ;EACpB,KAAK,YAAY,QAAQ;;;AAkC3B,eAAsB,4BAA4B,UAAmC;CACpF,IAAI,SAAS,UACZ;CAED,MAAM,SAAS,MAAM,CAAC,YAAY,KAAA,EAAU;;AA2F7C,MAAa,4BAA4B;CACxC,sBAAsB;EACrB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,EAAE;EACjB,WAAW;EACX;CACD,gBAAgB;EACf,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,EAAE;EACjB,WAAW;EACX;CACD,aAAa;EACZ,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,cAAc;EACb,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,eAAe;EACd,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,iBAAiB;EAChB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD,mBAAmB;EAClB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,mBAAmB;EAClB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe;GAAC;GAAK;GAAK;GAAI;EAC9B,WAAW;EACX;CACD,iBAAiB;EAChB,aAAa;EACb,aAAa;EACb,kBAAkB;EAClB,cAAc;EACd,eAAe,CAAC,KAAK,IAAI;EACzB,WAAW;EACX;CACD;;;AC1SD,MAAa,0BAA0B;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAa,2BAA2B;CAAC;CAAM;CAAU;CAAW;CAAQ;AAmB5E,MAAa,iCAAiC,CAAC,sBAAsB,mBAAmB;AAIxF,MAAa,kCAAkC;CAC9C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAM,4CAA4C,CACjD,4BACA,sBACA;AAUD,MAAa,iCAAiC;CAC7C;CACA;CACA;CACA;CACA;CACA;AAID,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAkCD,MAAa,kCAAkC;CAC9C;CACA;CACA;CACA;CACA;AAID,MAAa,uCAAuC;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;AASD,MAAa,+BAA+B;CAC3C;CACA;CACA;CACA;AAUD,MAAa,wCAAwC;CACpD;CACA;CACA;CACA;CACA;AAiLD,MAAa,uBAAuB;CAAC;CAAW;CAAM;CAAS;CAAS;AAIxE,MAAa,uBAAuB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAmCD,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,QACR,QACA,OAC2B;CAC3B,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM;;AAG3D,SAAS,0BAA0B,OAAiC;CACnE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,SAAS;;AAGxE,SAAS,mBAAmB,QAA0C;CACrE,OACC,0BAA0B,OAAO,aAAa,IAC9C,QAAQ,0BAA0B,OAAO,OAAO,IAChD,OAAO,OAAO,WAAW,YACzB,OAAO,OAAO,SAAS;;AAIzB,SAAS,eAAe,OAAyB;CAChD,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU;;AAGhD,SAAS,uBAAuB,OAAyB;CACxD,OAAO,UAAU,KAAA,KAAc,OAAO,UAAU,YAAY,MAAM,SAAS;;AAG5E,SAAS,cACR,QACA,OACuC;CACvC,OAAO,UAAU,KAAA,KAAa,QAAQ,QAAQ,MAAM;;AAGrD,SAAS,kCACR,OACoD;CACpD,OAAO,QAAQ,2CAA2C,MAAM;;AAGjE,SAAS,mBAAmB,OAAyB;CACpD,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,MAAM;;AAGtD,SAAS,2BAA2B,OAAyB;CAC5D,OAAO,UAAU,KAAA,KAAc,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,IAAI;;AAG5E,SAAS,qBAAqB,OAAiC;CAC9D,OAAO,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,IAAI;;AAGpD,SAAS,kBAAkB,OAAiC;CAC3D,OAAO,OAAO,UAAU,MAAM,IAAI,OAAO,MAAM,GAAG;;AAGnD,SAAS,wBAAwB,OAA4D;CAC5F,IAAI,UAAU,KAAA,GACb,OAAO;CAER,IAAI,CAAC,SAAS,MAAM,EACnB,OAAO;CAER,KAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,MAAM,EAAE;EACvD,IAAI,CAAC,QAAQ,sCAAsC,IAAI,EACtD,OAAO;EAER,IAAI,CAAC,mCAAmC,KAAK,YAAY,EACxD,OAAO;;CAGT,OAAO;;AAGR,SAAS,mCACR,KACA,OACU;CACV,QAAQ,KAAR;EACC,KAAK;EACL,KAAK;EACL,KAAK,cACJ,OAAO,qBAAqB,MAAM;EACnC,KAAK,gBACJ,OAAO,OAAO,UAAU,YAAY,6BAA6B,KAAK,MAAM;EAC7E,KAAK;EACL,KAAK,wBACJ,OAAO,OAAO,UAAU;;CAE1B,OAAO,+CAA+C,IAAI;;AAG3D,SAAS,+CAA+C,KAAmB;CAC1E,MAAM,IAAI,MAAM,uDAAuD,OAAO,IAAI,GAAG;;AAGtF,SAAS,kCACR,OAC2C;CAC3C,OAAO,UAAU,oCAAoC,UAAU;;AAGhE,SAAS,6CACR,QACA,QACU;CACV,QAAQ,QAAR;EACC,KAAK;EACL,KAAK,iBACJ,OAAO,WAAW;EACnB,KAAK;EACL,KAAK,2BACJ,OAAO,WAAW;;CAEpB,OAAO,sCAAsC,OAAO;;AAGrD,SAAS,mCAAmC,OAAyC;CAUpF,IAAI,EARH,MAAM,gBAAgB,KAAA,KACtB,MAAM,uBAAuB,KAAA,KAC7B,MAAM,yBAAyB,KAAA,KAC/B,MAAM,uBAAuB,KAAA,KAC7B,MAAM,wBAAwB,KAAA,KAC9B,MAAM,eAAe,KAAA,KACrB,MAAM,uBAAuB,KAAA,KAC7B,MAAM,iBAAiB,KAAA,IAEvB,OAAO;CAER,IACC,EACC,uBAAuB,MAAM,YAAY,IACzC,cAAc,gCAAgC,MAAM,mBAAmB,IACvE,cAAc,6BAA6B,MAAM,qBAAqB,IACtE,QAAQ,gCAAgC,MAAM,mBAAmB,IACjE,QAAQ,iCAAiC,MAAM,oBAAoB,IACnE,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,SAAS,KAC1B,OAAO,MAAM,iBAAiB,YAC9B,MAAM,aAAa,SAAS,IAG7B,OAAO;CAER,IAAI,kCAAkC,MAAM,oBAAoB,EAC/D,OAAO,OAAO,MAAM,uBAAuB,YAAY,MAAM,mBAAmB,SAAS;CAE1F,OACC,MAAM,uBAAuB,KAAA,KAC7B,cAAc,gCAAgC,MAAM,mBAAmB,IACvE,cAAc,iCAAiC,MAAM,oBAAoB;;AAI3E,SAAgB,qBAAqB,OAA6C;CACjF,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,mBAAmB,MAAM,EACjD,OAAO;CAER,QAAQ,MAAM,MAAd;EACC,KAAK,4BACJ,OACC,QACC;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,EACD,MAAM,UACN,IACD,QACC;GACC;GACA;GACA;GACA,EACD,MAAM,OACN,IACD,MAAM,WAAW;EAEnB,KAAK,0BACJ,OACC,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,SAAS,KACpB,OAAO,UAAU,MAAM,KAAK,IAC5B,mBAAmB,MAAM,WAAW;EAEtC,KAAK,2BACJ,OACC,eAAe,MAAM,OAAO,IAC5B,eAAe,MAAM,aAAa,IAClC,MAAM,WAAW,qBACjB,0BAA0B,MAAM,UAAU,IAC1C,QAAQ,uCAAuC,MAAM,UAAU,IAC/D,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,SAAS,KACtB,eAAe,MAAM,UAAU;EAEjC,KAAK,sBACJ,OACC,OAAO,UAAU,MAAM,QAAQ,IAC/B,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,UAAU,MAAM,YAAY,IACnC,QAAQ,yCAAyC,MAAM,UAAU,IACjE,mBAAmB,MAAM,WAAW;EAEtC,KAAK,eACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY;EAE3B,KAAK,mBACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,UAAU;EAEzB,KAAK,eACJ,OACC,OAAO,MAAM,YAAY,YACzB,0BAA0B,MAAM,UAAU,IAC1C,eAAe,MAAM,UAAU,IAC/B,OAAO,MAAM,YAAY,YACzB,QAAQ;GAAC;GAAW;GAAe;GAAY;GAAQ,EAAW,MAAM,UAAU,IAClF,mCAAmC,MAAM;EAE3C,KAAK,yBACJ,OACC,QAAQ,mBAAmB,MAAM,eAAe,IAChD,QAAQ;GAAC;GAAY;GAAS;GAAY;GAAS,EAAW,MAAM,MAAM;EAE5E,KAAK,iCACJ,OACC,OAAO,MAAM,sBAAsB,YACnC,MAAM,kBAAkB,SAAS,KACjC,QAAQ,iCAAiC,MAAM,OAAO,IACtD,QAAQ,0BAA0B,MAAM,OAAO,IAC/C,6CAA6C,MAAM,QAAQ,MAAM,OAAO,IACxE,2BAA2B,MAAM,sBAAsB,IACvD,2BAA2B,MAAM,iBAAiB,IAClD,wBAAwB,MAAM,QAAQ;EAExC,KAAK;GACJ,IACC,CAAC,QACA;IACC;IACA;IACA;IACA;IACA,EACD,MAAM,OACN,IACD,CAAC,qBAAqB,MAAM,oBAAoB,IAChD,CAAC,kBAAkB,MAAM,WAAW,IACpC,CAAC,0BAA0B,MAAM,UAAU,IAC3C,CAAC,QAAQ,8BAA8B,MAAM,OAAO,IACpD,CAAC,eAAe,MAAM,YAAY,EAElC,OAAO;GAER,IAAI,MAAM,WAAW,MAAM;IAC1B,IAAI,MAAM,WAAW,2BAA2B,MAAM,WAAW,sBAChE,OAAO;IAQR,IAAI,EALH,qBAAqB,MAAM,yBAAyB,IACpD,OAAO,MAAM,gBAAgB,YAC7B,qBAAqB,MAAM,WAAW,IACtC,OAAO,MAAM,YAAY,YACzB,MAAM,cAAc,KAAA,IAEpB,OAAO;IAER,IAAI,MAAM,WAAW,yBACpB,OACC,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA;IAGpB,OACC,OAAO,MAAM,gBAAgB,YAC7B,qBAAqB,MAAM,WAAW,IACtC,OAAO,MAAM,YAAY;;GAG3B,IAAI,MAAM,WAAW,UAAU;IAC9B,IACC,OAAO,MAAM,cAAc,YAC3B,MAAM,UAAU,WAAW,KAC3B,CAAC,2BAA2B,MAAM,yBAAyB,IAC3D,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA,KAClB,CAAC,eAAe,MAAM,YAAY,EAElC,OAAO;IAER,IAAI,MAAM,WAAW,sBAAsB;KAC1C,IAAI,kCAAkC,MAAM,UAAU,EACrD,OACC,eAAe,MAAM,YAAY,IACjC,2BAA2B,MAAM,WAAW,IAC5C,eAAe,MAAM,QAAQ;KAG/B,OACC,eAAe,MAAM,YAAY,IACjC,2BAA2B,MAAM,WAAW,IAC5C,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,SAAS;;IAGzB,QACE,MAAM,WAAW,2BACjB,MAAM,WAAW,kBACjB,MAAM,WAAW,wBAClB,MAAM,gBAAgB,KAAA,KACtB,MAAM,eAAe,KAAA,KACrB,MAAM,YAAY,KAAA;;GAGpB,OAAO;EACR,KAAK,8BACJ,OACC,QACC;GACC;GACA;GACA;GACA;GACA,EACD,MAAM,OACN,IACD,qBAAqB,MAAM,4BAA4B,IACvD,qBAAqB,MAAM,oBAAoB,IAC/C,kBAAkB,MAAM,WAAW,IACnC,MAAM,cAAc,2BACpB,kBAAkB,MAAM,sBAAsB,IAC9C,eAAe,MAAM,YAAY,IACjC,QAAQ,8BAA8B,MAAM,OAAO,IACnD,MAAM,WAAW;EAEnB,SACC,OAAO;;;AAIV,SAAgB,qBAAqB,OAAmC;CACvE,QAAQ,MAAM,MAAd;EACC,KAAK,4BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,UAAU,GAAG,MAAM;EAClE,KAAK,2BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM;EACjC,KAAK,0BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM;EACjC,KAAK,sBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,mBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,GAAG,MAAM;EAChE,KAAK,eACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK;GACJ,IAAI,MAAM,iBAAiB,KAAA,GAC1B,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,aAAa,MAAM;GAEzD,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,GAAG,MAAM;EAChE,KAAK,yBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,iCACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,oBACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;EAC/C,KAAK,8BACJ,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,MAAM;;CAEhD,OAAO,uBAAuB,MAAM;;AAQrC,SAAS,0BAA0B,OAA6D;CAC/F,OAAO,MAAM,SAAS;;AAGvB,SAAS,wBAAwB,OAAqD;CACrF,QAAQ,MAAM,MAAd;EACC,KAAK,0BACJ,OAAO;EACR,KAAK,2BACJ,OAAO;EACR,KAAK,sBACJ,OAAO;EACR,KAAK,mBACJ,OAAO;EACR,KAAK,eACJ,OAAO;EACR,KAAK,eACJ,OAAO;EACR,KAAK,yBACJ,OAAO;EACR,KAAK,iCACJ,OAAO;EACR,KAAK,oBACJ,OAAO;EACR,KAAK,8BACJ,OAAO;;CAET,OAAO,uBAAuB,MAAM;;AAGrC,SAAS,uBAAuB,OAAqB;CACpD,MAAM,IAAI,MAAM,gCAAgC,KAAK,UAAU,MAAM,GAAG;;AAGzE,SAAS,sCAAsC,QAAsB;CACpE,MAAM,IAAI,MAAM,4CAA4C,OAAO,OAAO,GAAG;;AAG9E,SAAS,cACR,OACA,SAC8B;CAC9B,IAAI,CAAC,0BAA0B,MAAM,EACpC;CAED,IACC,QAAQ,QAAQ,MAAM,eAAe,QAAQ,gBAC7C,CAAC,4BAA4B,MAAM,EAEnC,OAAO;EACN,MAAM;EACN,aAAa;EACb,SAAS,GAAG,MAAM,KAAK;EACvB,SAAS,MAAM;EACf;CAEF,IAAI,MAAM,WAAW,YAAY,MAAM,WAAW,aAAa,MAAM,WAAW,SAC/E,OAAO;EACN,MAAM,wBAAwB,MAAM;EACpC,aAAa;EACb,SAAS,GAAG,MAAM,KAAK,yBAAyB,MAAM;EACtD,SAAS,MAAM;EACf;;AAKH,SAAS,4BAA4B,OAAoC;CACxE,OAAO,MAAM,SAAS,sBAAsB,MAAM,WAAW;;AAc9D,SAAS,iCACR,OACmD;CACnD,OACC,MAAM,SAAS,iBACf,MAAM,uBAAuB,sBAC7B,kCAAkC,MAAM,oBAAoB,IAC5D,MAAM,WAAW;;AAInB,SAAS,iCACR,QAC8B;CAC9B,MAAM,qCAAqB,IAAI,KAAqB;CACpD,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,CAAC,iCAAiC,MAAM,EAC3C;EAED,MAAM,uBAAuB,mBAAmB,IAAI,MAAM,WAAW;EACrE,IAAI,yBAAyB,KAAA,KAAa,uBAAuB,MAAM,cACtE,mBAAmB,IAAI,MAAM,YAAY,MAAM,aAAa;;CAG9D,OAAO;;AAGR,SAAS,sBACR,OACyE;CACzE,OAAO,MAAM,SAAS,iBAAiB,MAAM,iBAAiB,KAAA;;AAG/D,SAAS,gCACR,QACgC;CAChC,MAAM,iCAAiC,iCAAiC,OAAO;CAC/E,OAAO,OAAO,QAAQ,UAAU;EAC/B,IAAI,CAAC,sBAAsB,MAAM,EAChC,OAAO;EAER,MAAM,iBAAiB,+BAA+B,IAAI,MAAM,QAAQ;EACxE,OAAO,mBAAmB,KAAA,KAAa,iBAAiB,MAAM;GAC7D;;AAGH,SAAgB,yBACf,QACA,SACqB;CACrB,MAAM,8BAAc,IAAI,KAAiC;CACzD,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,MAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,4BACrD;EAED,MAAM,MAAM,qBAAqB,MAAM;EACvC,MAAM,WAAW,YAAY,IAAI,IAAI;EACrC,IAAI,CAAC,YAAY,SAAS,gBAAgB,MAAM,cAC/C,YAAY,IAAI,KAAK,MAAM;;CAG7B,MAAM,eAAe,gCAAgC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,UAC9E,OAAO,WAAW,OAAO,eAAe,MAAM,aAC/C;CACD,IAAI,aAAa,WAAW,GAC3B,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAa,QAAQ,QAAQ;EAAQ;CAExE,MAAM,SAAS,aACb,KAAK,UAAU,cAAc,OAAO,QAAQ,CAAC,CAC7C,QAAQ,UAAoC,UAAU,KAAA,EAAU;CAClE,IAAI,OAAO,WAAW,GACrB,OAAO;EAAE,MAAM;EAAM;EAAc,QAAQ,QAAQ;EAAQ;CAE5D,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,qBAAqB,EAC9D,OAAO;EAAE;EAAQ,MAAM;EAAS;EAAc,QAAQ,QAAQ;EAAQ;CAEvE,OAAO;EAAE;EAAQ,MAAM;EAAU;EAAc,QAAQ,QAAQ;EAAQ;;;;AC/7BxE,SAAS,cAAc,UAA0B;CAChD,OAAO,SAAS,QAAQ,WAAW,GAAG;;AAGvC,SAAS,kBAAkB,UAAsC;CAChE,MAAM,kBAAkB,cAAc,SAAS,MAAM,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC3E,MAAM,WAAW,gBAAgB,MAAM,IAAI;CAC3C,IAAI,SAAS,SAAS,KAAK,SAAS,MAAM,YAAY,CAAC,qBAAqB,KAAK,QAAQ,CAAC,EACzF;CAED,OAAO;;AAGR,SAAS,cAAc,MAAkC;CACxD,MAAM,iBAAiB,KAAK,MAAM,CAAC,aAAa;CAChD,IAAI,CAAC,iBAAiB,KAAK,eAAe,IAAI,eAAe,WAAW,IAAI,EAC3E;CAED,OAAO;;AAaR,SAAgB,oCACf,SACiD;CACjD,MAAM,iBAAiB,QAAQ,MAAM;CACrC,IAAI,eAAe,WAAW,GAC7B;CAGD,IAAI;CACJ,IAAI;EACH,YAAY,IAAI,IAAI,eAAe;SAC5B;EACP,YAAY,KAAA;;CAEb,IAAI,cAAc,KAAA,GAAW;EAC5B,MAAM,OAAO,cAAc,UAAU,SAAS;EAC9C,MAAM,WAAW,kBAAkB,UAAU,SAAS;EACtD,OAAO,SAAS,KAAA,KAAa,aAAa,KAAA,IAAY,KAAA,IAAY;GAAE;GAAM;GAAU;;CAGrF,MAAM,WAAW,2DAA2D,KAAK,eAAe;CAChG,IAAI,UAAU,QAAQ,SAAS,KAAA,KAAa,SAAS,OAAO,aAAa,KAAA,GAAW;EACnF,MAAM,OAAO,cAAc,SAAS,OAAO,KAAK;EAChD,MAAM,WAAW,kBAAkB,SAAS,OAAO,SAAS;EAC5D,OAAO,SAAS,KAAA,KAAa,aAAa,KAAA,IAAY,KAAA,IAAY;GAAE;GAAM;GAAU;;CAGrF,MAAM,gBAAgB,8CAA8C,KAAK,eAAe;CACxF,IAAI,eAAe,QAAQ,SAAS,KAAA,KAAa,cAAc,OAAO,aAAa,KAAA,GAAW;EAC7F,MAAM,sBAAsB,kBAAkB,cAAc,OAAO,SAAS;EAC5E,MAAM,OAAO,cAAc,cAAc,OAAO,KAAK;EACrD,IAAI,SAAS,KAAA,KAAa,wBAAwB,KAAA,KAAa,KAAK,SAAS,IAAI,EAChF,OAAO;GAAE;GAAM,UAAU;GAAqB;;CAIhD,MAAM,eAAe,kBAAkB,eAAe;CACtD,IAAI,iBAAiB,KAAA,GACpB,OAAO;EAAE,MAAM;EAAc,UAAU;EAAc;;AAMvD,SAAgB,qCACf,UACgC;CAChC,IAAI,aAAa,KAAA,GAChB,OAAO;EAAE,cAAc,EAAE;EAAE,cAAc,EAAE;EAAE;CAE9C,MAAM,+BAAe,IAAI,KAAa;CACtC,MAAM,+BAAe,IAAI,KAAa;CACtC,KAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,iBAAiB,oCAAoC,QAAQ;EACnE,IAAI,mBAAmB,KAAA,GAAW;GACjC,aAAa,IAAI,eAAe,KAAK;GACrC,aAAa,IAAI,eAAe,SAAS;;;CAG3C,OAAO;EACN,cAAc,CAAC,GAAG,aAAa,CAAC,UAAU;EAC1C,cAAc,CAAC,GAAG,aAAa,CAAC,UAAU;EAC1C;;AAGF,SAAgB,uCAAuC,SAAqC;CAC3F,MAAM,iBAAiB,QAAQ,MAAM;CACrC,IAAI,eAAe,WAAW,GAC7B;CAGD,MAAM,WAAW,gDAAgD,KAAK,eAAe;CACrF,IAAI,UAAU,QAAQ,aAAa,KAAA,GAClC,OAAO,kBAAkB,SAAS,OAAO,SAAS;CAGnD,MAAM,gBAAgB,iDAAiD,KAAK,eAAe;CAC3F,IAAI,eAAe,QAAQ,aAAa,KAAA,GACvC,OAAO,kBAAkB,cAAc,OAAO,SAAS;CAGxD,MAAM,eAAe,kBAAkB,eAAe;CACtD,IAAI,iBAAiB,KAAA,GACpB,OAAO;CAGR,IAAI;CACJ,IAAI;EACH,YAAY,IAAI,IAAI,eAAe;SAC5B;EACP;;CAED,IAAI,UAAU,SAAS,aAAa,KAAK,cACxC;CAED,OAAO,kBAAkB,UAAU,SAAS;;AAG7C,SAAgB,wCACf,UACoB;CACpB,OAAO,qCAAqC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjGvD,MAAa,iCACZ;AAED,MAAM,sCAAsC,+BAA+B,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BxF,SAAgB,mBAAmB,WAAuC;CACzE,MAAM,UAAU,WAAW,MAAM,IAAI;CACrC,IAAI,YAAY,IACf,OAAO;CAER,MAAM,YAAY,QAChB,MAAM,OAAO,CACb,QAAQ,SAAS,CAAC,oCAAoC,SAAS,KAAK,CAAC;CACvE,IAAI,UAAU,WAAW,GACxB,OAAO;CAER,OAAO,GAAG,+BAA+B,GAAG,UAAU,KAAK,IAAI;;;;ACNhE,SAAS,kBAAkB,OAAgB,OAA+C;CACzF,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,EACtE,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;CAEpD,MAAM,YAAY,QAAQ,eAAe,MAAM;CAC/C,IAAI,cAAc,OAAO,aAAa,cAAc,MACnD,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;;AAIrD,SAAS,kBACR,QACA,OACA,gBACO;CACP,MAAM,mBAAmB,IAAI,IAAI,eAAe;CAChD,KAAK,MAAM,YAAY,QAAQ,QAAQ,OAAO,EAAE;EAC/C,IAAI,OAAO,aAAa,UACvB,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B;EAEzD,MAAM,YAAY;EAClB,IAAI,CAAC,iBAAiB,IAAI,UAAU,EACnC,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,UAAU,IAAI;EAE9D,MAAM,aAAa,QAAQ,yBAAyB,QAAQ,UAAU;EACtE,IAAI,eAAe,KAAA,KAAa,CAAC,OAAO,OAAO,YAAY,QAAQ,EAClE,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,UAAU,wBAAwB;;CAGhE,KAAK,MAAM,aAAa,gBACvB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,EACpC,MAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B,UAAU,IAAI;;AAKxE,SAAS,aACR,OACA,UACA,OACW;CACX,IAAI,UAAU,UACb,MAAM,IAAI,MAAM,GAAG,MAAM,WAAW,KAAK,UAAU,SAAS,CAAC,GAAG;CAEjE,OAAO;;AAGR,SAAS,oBAAoB,OAAgB,OAAuB;CACnE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,MAAM,IAAI,MAAM,GAAG,MAAM,8BAA8B;CAExD,OAAO;;AAGR,SAAS,uBAAuB,OAAgB,OAAuB;CACtE,MAAM,YAAY,oBAAoB,OAAO,MAAM;CACnD,IACC,CAAC,UAAU,WAAW,IAAI,IAC1B,UAAU,SAAS,KAAK,IACxB,UAAU,SAAS,KAAK,IACvB,UAAU,SAAS,KAAK,UAAU,SAAS,IAAI,IAChD,UAAU,MAAM,IAAI,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,KAAK,EAE3E,MAAM,IAAI,MAAM,GAAG,MAAM,4CAA4C;CAEtE,OAAO;;AAGR,SAAS,cAAc,OAAgB,OAAuB;CAC7D,MAAM,WAAW,oBAAoB,OAAO,MAAM;CAClD,IAAI,CAAC,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,KAAK,EACvD,MAAM,IAAI,MAAM,GAAG,MAAM,iCAAiC;CAE3D,OAAO;;AAGR,SAAS,eAAe,OAAgB,OAAuB;CAC9D,IAAI,CAAC,OAAO,UAAU,MAAM,IAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,QAAQ,OACjF,MAAM,IAAI,MAAM,GAAG,MAAM,oDAAoD;CAE9E,OAAO;;AAGR,SAAS,iBAAiB,OAAgB,OAA0C;CACnF,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO,CAAC,aAAa,cAAc,CAAC;CAC7D,OAAO,OAAO,OAAO;EACpB,WAAW,uBAAuB,MAAM,WAAW,GAAG,MAAM,YAAY;EACxE,aAAa,oBAAoB,MAAM,aAAa,GAAG,MAAM,cAAc;EAC3E,CAAC;;AAGH,SAAS,yBACR,OACA,OACqC;CACrC,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAAC;EAAgB;EAAQ;EAAa,CAAC;CACvE,OAAO,OAAO,OAAO;EACpB,cAAc,uBAAuB,MAAM,cAAc,GAAG,MAAM,eAAe;EACjF,MAAM,aAAa,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO;EACvE,YAAY,uBAAuB,MAAM,YAAY,GAAG,MAAM,aAAa;EAC3E,CAAC;;AAGH,SAAS,wBAAwB,OAAgB,OAAkD;CAClG,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAAC;EAAa;EAAQ;EAAO,CAAC;CAC9D,OAAO,OAAO,OAAO;EACpB,WAAW,eAAe,MAAM,WAAW,GAAG,MAAM,YAAY;EAChE,MAAM,aAAa,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO;EACjE,MAAM,cAAc,MAAM,MAAM,GAAG,MAAM,OAAO;EAChD,CAAC;;AAGH,SAAS,sBAAsB,OAAgB,OAAgD;CAC9F,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO,CAAC,aAAa,OAAO,CAAC;CACtD,OAAO,OAAO,OAAO;EACpB,WAAW,eAAe,MAAM,WAAW,GAAG,MAAM,YAAY;EAChE,MAAM,aAAa,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO;EACjE,CAAC;;AAGH,SAAS,uBAAuB,OAAsD;CACrF,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,OAAO,OAAO,OAAO;EACpB,WAAW,aAAa,MAAM,WAAW,4BAA4B,GAAG,MAAM,YAAY;EAC1F,wBAAwB,uBACvB,MAAM,wBACN,GAAG,MAAM,yBACT;EACD,sBAAsB,uBACrB,MAAM,sBACN,GAAG,MAAM,uBACT;EACD,aAAa,iBAAiB,MAAM,aAAa,GAAG,MAAM,cAAc;EACxE,WAAW,yBAAyB,MAAM,WAAW,GAAG,MAAM,YAAY;EAC1E,MAAM,aAAa,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO;EACtE,CAAC;;AAGH,SAAS,sBAAsB,OAAqD;CACnF,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,MAAM,YAAY,MAAM;CACxB,IAAI,cAAc,cAAc,cAAc,UAC7C,MAAM,IAAI,MAAM,GAAG,MAAM,4CAA4C;CAEtE,MAAM,UAAU,sBAAsB,MAAM,SAAS,GAAG,MAAM,UAAU;CACxE,MAAM,YAAY,wBAAwB,MAAM,WAAW,GAAG,MAAM,YAAY;CAChF,IAAI,QAAQ,cAAc,UAAU,WACnC,MAAM,IAAI,MAAM,GAAG,MAAM,2DAA2D;CAErF,MAAM,eAAe;EACpB,wBAAwB,uBACvB,MAAM,wBACN,GAAG,MAAM,yBACT;EACD,sBAAsB,uBACrB,MAAM,sBACN,GAAG,MAAM,uBACT;EACD;EACA,aAAa,iBAAiB,MAAM,aAAa,GAAG,MAAM,cAAc;EACxE;EACA,MAAM,aAAa,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO;EACpE;CACD,IAAI,cAAc,YACjB,OAAO,OAAO,OAAO;EACpB,GAAG;EACH,WAAW,aAAa,MAAM,WAAW,oBAAoB,GAAG,MAAM,YAAY;EAClF;EACA,CAAC;CAEH,OAAO,OAAO,OAAO;EACpB,GAAG;EACH,WAAW,aAAa,MAAM,WAAW,kBAAkB,GAAG,MAAM,YAAY;EAChF;EACA,CAAC;;;;;;;AAQH,SAAgB,gCAAgC,OAA4C;CAC3F,MAAM,QAAQ;CACd,kBAAkB,OAAO,MAAM;CAC/B,kBAAkB,OAAO,OAAO;EAC/B;EACA;EACA;EACA;EACA,CAAC;CACF,OAAO,OAAO,OAAO;EACpB,iBAAiB,aAAa,MAAM,iBAAiB,GAAG,GAAG,MAAM,kBAAkB;EACnF,kBAAkB,sBAAsB,MAAM,iBAAiB;EAC/D,MAAM,aAAa,MAAM,MAAM,kCAAkC,GAAG,MAAM,OAAO;EACjF,mBAAmB,uBAAuB,MAAM,kBAAkB;EAClE,CAAC;;;;AC/QH,SAAgB,gCACf,eACA,iBACA,SAC6B;CAC7B,MAAM,qBAA6C,EAAE;CACrD,MAAM,kBAAsD,EAAE;CAC9D,MAAM,YAAY,QAAQ,aAAa;CAEvC,KAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,EAAE;EACxE,MAAM,eAAe,cAAc;EACnC,IAAI,CAAC,cACJ,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,mDACrC;EAEF,IAAI,CAAC,gBAAgB,aAAa,UAAU,QAAQ,SAAS,EAC5D;EAGD,IAAI,aAAa,cAAc,kBAAkB;GAChD,IAAI,aAAa,MAAM,WAAW,GACjC,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,8CACrC;GAEF,gBAAgB,cAAc;IAC7B,OAAO,CAAC,GAAG,aAAa,MAAM;IAC9B,OAAO;IACP;GACD;;EAGD,MAAM,oBAAqB,aAA+C;EAC1E,IAAI,sBAAsB,WACzB,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,kDAAkD,kBAAkB,IACzG;EAEF,IAAI,QAAQ,aAAa,WACxB,mBAAmB,cAAc;;CAInC,OAAO;EAAE;EAAoB;EAAiB;;AAK/C,SAAgB,4BACf,MACA,iBACoC;CACpC,OAAO,gCAAgC,KAAK,SAAS,iBAAiB;EACrE,UAAU;EACV,WAAW;EACX,CAAC;;AAGH,SAAS,+BACR,YACA,QACA,aACA,aACA,WACO;CACP,IAAI,YAAY,IAAI,WAAW,EAC9B,MAAM,IAAI,MACT,IAAI,UAAU,4BAA4B,WAAW,kEACrD;CAEF,IAAI,cAAc,YAAY,oBAC7B,MAAM,IAAI,MACT,IAAI,UAAU,oBAAoB,OAAO,WAAW,WAAW,mDAC/D;CAEF,IAAI,cAAc,YAAY,iBAC7B,MAAM,IAAI,MACT,IAAI,UAAU,oBAAoB,OAAO,WAAW,WAAW,sDAC/D;CAEF,YAAY,IAAI,WAAW;;AAG5B,SAAgB,2BACf,aACA,UAA6C,EAAE,EAClB;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,8BAAc,IAAI,KAAa;CACrC,KAAK,MAAM,cAAc,OAAO,KAAK,QAAQ,sBAAsB,EAAE,CAAC,EACrE,+BAA+B,YAAY,eAAe,aAAa,aAAa,UAAU;CAE/F,KAAK,MAAM,cAAc,OAAO,KAAK,QAAQ,0BAA0B,EAAE,CAAC,EACzE,+BACC,YACA,kBACA,aACA,aACA,UACA;CAGF,OAAO;EACN,oBAAoB;GACnB,GAAG,YAAY;GACf,GAAG,QAAQ;GACX;EACD,iBAAiB;GAChB,GAAG,YAAY;GACf,GAAG,QAAQ;GACX;EACD;;;;AC7BF,MAAM,gCAAgC,MAAU,KAAK;AAErD,SAAS,cAAc,QAIZ;CACV,IAAI,OAAO,eAAe,GACzB,OAAO,OAAO;CAEf,MAAM,WAAW,OAAO,UAAU,OAAO;CAEzC,MAAM,aADQ,OAAO,UAAU,WACJ,OAAO,QAAQ,GAAG,WAAW;CACxD,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;;AAG3C,SAAgB,0BAAkC;CACjD,OAAOA,IAAQ;;AAGhB,SAAgB,oBAAoB,OAAwB;CAC3D,OAAOC,SAAa,MAAM,IAAIC,QAAY,MAAM,KAAK;;AAGtD,SAAgB,oCACf,aACyC;CACzC,IAAI,CAAC,mCAAmC,YAAY,EACnD;CAED,MAAM,aAAa,QAA8D;EAChF,MAAM,QAAQ,YAAY;EAC1B,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;;CAEhE,MAAM,wBAAwB;EAC7B,GAAI,UAAU,YAAY,KAAK,KAAA,IAAY,EAAE,WAAW,UAAU,YAAY,EAAE,GAAG,EAAE;EACrF,GAAI,UAAU,YAAY,KAAK,KAAA,IAAY,EAAE,WAAW,UAAU,YAAY,EAAE,GAAG,EAAE;EACrF,GAAI,UAAU,QAAQ,KAAK,KAAA,IAAY,EAAE,OAAO,UAAU,QAAQ,EAAE,GAAG,EAAE;EACzE,GAAI,UAAU,mBAAmB,KAAK,KAAA,IACnC,EAAE,kBAAkB,UAAU,mBAAmB,EAAE,GACnD,EAAE;EACL,GAAI,UAAU,aAAa,KAAK,KAAA,IAAY,EAAE,YAAY,UAAU,aAAa,EAAE,GAAG,EAAE;EACxF,GAAI,UAAU,UAAU,KAAK,KAAA,IAAY,EAAE,SAAS,UAAU,UAAU,EAAE,GAAG,EAAE;EAC/E;CACD,OAAO,OAAO,KAAK,sBAAsB,CAAC,SAAS,IAAI,wBAAwB,KAAA;;AAGhF,SAAS,mCACR,OACuE;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,eAAsB,4BACrB,SACiC;CACjC,MAAM,QAAQ,yBAAyB;CACvC,MAAM,aAAa,MAAM,QAAQ,eAAe;EAC/C,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,EAAE;EACnE;EACA,CAAC;CACF,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,MAAM,QAAQ,WAAW,KAAK;CACpC,MAAM,YAAY,KAAK;CACvB,MAAM,yBAAyB,QAAQ,0BAA0B;CACjE,MAAM,uBAAuB,QAAQ,wBAAwB;CAC7D,MAAM,SAAS,QAAQ,cAAc,KAAK;CAC1C,MAAM,2BAA2B,IAAI,iBAAiB;CACtD,IAAI,QAAQ;CACZ,IAAI;CACJ,IAAI;CAEJ,MAAM,4BAAkC;EACvC,IAAI,gBAAgB;GACnB,iBAAiB,eAAe;GAChC,iBAAiB,KAAA;;;CAInB,MAAM,qBAAqB,YAA0B;EACpD,IAAI,KAAK,GAAG,aAAa,wBACxB;EAED,qBAAqB;EACrB,iBAAiB,qBACV;GACL,IAAI,KAAK,GAAG,aAAa,wBACxB;GAED,MAAM,mBACL,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,cAAc;GAC3D,QACE,mBAAmB,WAAW,OAAO,iBAAiB,CACtD,MAAM,cAAc;IACpB,IAAI,CAAC,OACJ,kBAAkB,UAAU,iBAAiB;KAE7C,CACD,OAAO,UAAmB;IAC1B,QAAQ,sBAAsB,MAAM;IACpC,IACC,QAAQ,8BAA8B,MAAM,KAAK,QACjD,QAAQ,+BACP;KACD,yBAAyB,MAAM,MAAM;KACrC,QAAQ;KACR,qBAAqB;KACrB,QAAa,8BAA8B,MAAM,CAAC,OAAO,eAAwB;MAChF,QAAQ,sBAAsB,WAAW;OACxC;KACF;;IAED,IAAI,CAAC,OACJ,kBAAkB,WAAW,iBAAiB;KAE9C;KAEJ,cAAc;GAAE;GAAS,aAAa;GAAsB;GAAQ,CAAC,CACrE;;CAGF,kBAAkB,WAAW,iBAAiB;CAE9C,MAAM,MAAM,OAAO,UAAkC,gBAA+B;EACnF,IAAI,OACH;EAED,QAAQ;EACR,qBAAqB;EACrB,IAAI;GACH,MAAM,QAAQ,aAAa,WAAW,OAAO;IAC5C;IACA,GAAI,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,cAAc;IAC9D,CAAC;WACM,OAAO;GACf,IAAI,QAAQ,sBAAsB,MAAM,KAAK,MAAM;IAClD,QAAQ,gBAAgB,MAAM;IAC9B;;GAED,MAAM;;;CAIR,OAAO;EACN,QAAQ,yBAAyB;EACjC,OAAO,WAAW;EAClB,SAAS;EACT;EACA,SAAS,WAAiB;GACzB,IAAI,OACH;GAED,eAAe;;EAEhB;;;;ACpQF,MAAa,6BAA6B;AAC1C,MAAa,yBAAyB;AACtC,MAAa,mCAAmC,GAAG,uBAAuB;AA2H1E,MAAM,yBAAyB;CAC9B;CACA;CACA;CACA;AAED,SAAS,4BAA4B,WAA4B;CAChE,OAAO,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK;;AAG9C,SAAS,sBAAsB,WAA2B;CAEzD,OAAO,IADa,UAAU,MAAM,IAAI,CAAC,QAAQ,YAAY,YAAY,MAAM,YAAY,IACrE,CAAC,KAAK,IAAI;;AAGjC,SAAS,cAAc,UAA0B;CAChD,MAAM,iBAAiB,sBAAsB,SAAS;CACtD,OAAO,mBAAmB,MAAM,iBAAiB,eAAe,QAAQ,SAAS,GAAG;;AAGrF,SAAS,gBAAgB,eAAuB,UAA2B;CAC1E,OAAO,kBAAkB,YAAY,cAAc,WAAW,GAAG,SAAS,GAAG;;AAG9E,SAAS,oBAAoB,eAAuB,UAA0B;CAC7E,OAAO,kBAAkB,WAAW,KAAK,cAAc,MAAM,SAAS,SAAS,EAAE;;AAGlF,SAAS,oBAAoB,UAAkB,cAA8B;CAC5E,OAAO,iBAAiB,KAAK,WAAW,GAAG,SAAS,GAAG;;AAGxD,SAAS,qBAAqB,UAA2B;CACxD,OACC,SAAS,MAAM,KAAK,MAAM,CAAC,SAAS,WAAW,IAAI,IAAI,4BAA4B,SAAS;;AAI9F,SAAS,8BACR,MACA,WACU;CACV,IAAI,KAAK,iBAAiB,eAAe,KAAA,GACxC,OAAO,KAAK,eAAe;CAE5B,OAAO,cAAc;;AAGtB,SAAS,2BACR,SACA,SACoB;CACpB,OAAO,QAAQ,MAAM,SAAS,SAAS;EACtC,IAAI,CAAC,KAAK,aAAa,UACtB,OAAO,EAAE;EAEV,MAAM,SAAS,KAAK,kBAAkB,eAAe;EACrD,OAAO,uBAAuB,SAAS,cAAwB;GAC9D,MAAM,WAAW,KAAK,UAAU;GAChC,IAAI,aAAa,KAAA,KAAa,CAAC,8BAA8B,MAAM,UAAU,EAC5E,OAAO,EAAE;GAEV,OAAO,CAAC,GAAG,cAAc,SAAS,GAAG,SAAS;IAC7C;GACD;;AAGH,SAAS,wBAAwB,SAA6B,SAAqC;CAClG,OAAO,yCAAyC,QAAQ,GAAG,GAAG,QAAQ,IAAI,2BAA2B,SAAS,QAAQ,CAAC,KAAK,KAAK,CAAC;;AAGnI,SAAS,YAAY,QAMU;CAC9B,OAAO;EACN,OAAO;GACN,kBAAkB,2BAA2B,OAAO,SAAS,OAAO,QAAQ;GAC5E,MAAM,OAAO;GACb,WAAW,OAAO;GAClB,WAAW,OAAO,QAAQ;GAC1B,SAAS,OAAO;GAChB,SAAS,OAAO;GAChB,eAAe,wBAAwB,OAAO,SAAS,OAAO,QAAQ;GACtE;EACD,IAAI;EACJ;;AAGF,SAAS,kBAAkB,QAIU;CAgBpC,OAfgB,OAAO,QAAQ,MAAM,SAAS,SAC7C,uBAAuB,SAAS,mBAAmB;EAClD,MAAM,WAAW,KAAK,UAAU;EAChC,IAAI,aAAa,KAAA,GAChB,OAAO,EAAE;EAEV,IAAI,OAAO,oBAAoB,KAAA,KAAa,mBAAmB,OAAO,iBACrE,OAAO,EAAE;EAEV,MAAM,iBAAiB,cAAc,SAAS;EAC9C,OAAO,gBAAgB,OAAO,WAAW,eAAe,GACrD,CAAC;GAAE;GAAgB,aAAa;GAAgB;GAAM,CAAC,GACvD,EAAE;GACJ,CAEW,CAAC,UAAU,MAAM,UAAU,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,CAAC;;AAG9F,SAAS,gBACR,SACqE;CACrE,KAAK,MAAM,QAAQ,QAAQ,OAC1B,KAAK,MAAM,aAAa,wBAAwB;EAC/C,MAAM,WAAW,KAAK,UAAU;EAChC,IAAI,aAAa,KAAA,KAAa,qBAAqB,SAAS,EAC3D,OAAO;GAAE,QAAQ,KAAK;GAAI;GAAU;;;AAOxC,SAAgB,qBAAqB,OAA8D;CAClG,IAAI,CAAC,MAAM,UAAU,WAAW,IAAI,EACnC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,SAAS,MAAM,UAAU;EAClC,SAAS,MAAM;EACf,CAAC;CAIH,IAAI,4BAA4B,MAAM,UAAU,EAC/C,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,SAAS,MAAM,UAAU;EAClC,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,cAAc,gBAAgB,MAAM,QAAQ;CAClD,IAAI,gBAAgB,KAAA,GACnB,OAAO,YAAY;EAClB,MAAM;EACN,WAAW,MAAM;EACjB,SAAS,MAAM;EACf,SAAS,sBAAsB,YAAY,OAAO,sBAAsB,YAAY,SAAS;EAC7F,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,sBAAsB,sBAAsB,MAAM,UAAU;CAClE,MAAM,QAAQ,kBAAkB;EAC/B,WAAW;EACX,SAAS,MAAM;EACf,GAAI,MAAM,oBAAoB,KAAA,IAAY,EAAE,GAAG,EAAE,iBAAiB,MAAM,iBAAiB;EACzF,CAAC;CACF,IAAI,UAAU,KAAA,GACb,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,yCAAyC,MAAM,QAAQ,GAAG;EAChG,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,eAAe,oBAAoB,qBAAqB,MAAM,YAAY;CAChF,IAAI,iBAAiB,MAAM,CAAC,MAAM,KAAK,iBACtC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,2CAA2C,MAAM,QAAQ;EACpI,SAAS,MAAM;EACf,CAAC;CAEH,IAAI,CAAC,MAAM,KAAK,aAAa,MAAM,UAClC,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,0BAA0B,MAAM,QAAQ;EACnH,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,aAAa,MAAM,KAAK,UAAU,MAAM;CAC9C,IAAI,eAAe,KAAA,GAClB,OAAO,YAAY;EAClB,MAAM;EACN,WAAW;EACX,SAAS,MAAM;EACf,SAAS,SAAS,oBAAoB,YAAY,MAAM,KAAK,cAAc,SAAS,MAAM,gBAAgB;EAC1G,SAAS,MAAM;EACf,CAAC;CAEH,MAAM,uBAAuB,cAAc,WAAW;CACtD,OAAO;EACN,IAAI;EACJ,OAAO;GACN,SAAS,MAAM,KAAK;GACpB,cAAc,MAAM,KAAK;GACzB,gBAAgB,MAAM;GACtB,WAAW;GACX,WAAW,MAAM,QAAQ;GACzB,iBAAiB,MAAM;GACvB,YAAY,oBAAoB,sBAAsB,aAAa;GACnE;GACA,QAAQ,MAAM,KAAK;GACnB;EACD;;;;AChVF,SAAgB,sBAAqC;CACpD,OAAO,mBAAmBC,IAAQ,CAAC;;AAGpC,SAAgB,gBAAgB,OAAwC;CACvE,OAAO,OAAO,UAAU,YAAYC,SAAa,MAAM,IAAIC,QAAY,MAAM,KAAK;;AAGnF,SAAgB,mBAAmB,OAA+B;CACjE,IAAI,gBAAgB,MAAM,EACzB,OAAO;CAER,MAAM,IAAI,UAAU,oDAAoD;;;;ACpBzE,MAAM,8BAA8B,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAO,CAAC;AA8BrE,SAASC,cAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,SAAS,iBAAiB,OAAiC;CAC1D,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,CAAC,SAAS;;AAG3D,SAAgB,oBACf,OACA,WACyC;CACzC,MAAM,SAASA,cAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,QAAQ,IAAI,QAAQ,YAAY,KAAK;;AAIvC,SAAgB,gBAAgB,OAAwC;CACvE,MAAM,SAASA,cAAY,MAAM;CACjC,OACC,WAAW,KAAA,KACX,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,iBAAiB,QAAQ,IAAI,QAAQ,cAAc,CAAC,IACpD,iBAAiB,QAAQ,IAAI,QAAQ,iBAAiB,CAAC,IACvD,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK;;AAIzC,SAAgB,sBAAsB,OAA8C;CACnF,MAAM,SAASA,cAAY,MAAM;CACjC,IAAI,WAAW,KAAA,GACd,OAAO;CAER,KAAK,MAAM,OAAO,OAAO,KAAK,OAAO,EACpC,IAAI,CAAC,4BAA4B,IAAI,IAAI,EACxC,OAAO;CAGT,OACC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK,YACvC,OAAO,QAAQ,IAAI,QAAQ,OAAO,KAAK;;;;ACjEzC,MAAa,4CAA4C,MAAU;AACnE,MAAa,0BAA0B;AAuBvC,SAAS,YAAY,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA;;AAG9D,MAAM,iCAAiC,CAAC,SAAS,MAAM,CAAC,KAAK,GAAG;AAEhE,SAAgB,iBAAiB,OAAyC;CACzE,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,oBAAoB,QAAQ,cAAc,IAC1C,gBAAgB,QAAQ,IAAI,QAAQ,UAAU,CAAC,IAC/C,gBAAgB,QAAQ,IAAI,QAAQ,MAAM,CAAC,IAC3C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,CAAC,QAAQ,IAAI,QAAQ,+BAA+B;;AAItD,SAAgB,kBAAkB,OAA0C;CAC3E,MAAM,SAAS,YAAY,MAAM;CACjC,OACC,oBAAoB,QAAQ,cAAc,IAC1C,gBAAgB,QAAQ,IAAI,QAAQ,UAAU,CAAC,IAC/C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,OAAO,QAAQ,IAAI,QAAQ,aAAa,KAAK,YAC7C,OAAO,QAAQ,IAAI,QAAQ,YAAY,KAAK,YAC5C,sBAAsB,QAAQ,IAAI,QAAQ,MAAM,CAAC,IACjD,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,UAAU,KAAK,YAC1C,OAAO,QAAQ,IAAI,QAAQ,SAAS,KAAK,YACzC,CAAC,QAAQ,IAAI,QAAQ,+BAA+B"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/gateway-lifecycle",
-  "version": "0.0.122",
+  "version": "0.0.124",
   "description": "Shared gateway lifecycle contracts, workload intent, and cross-gateway policies.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "uuid": "^11.1.1",
-    "@agent-vm/managed-vm": "0.0.122",
-    "@agent-vm/secret-management": "0.0.122"
+    "@agent-vm/managed-vm": "0.0.124",
+    "@agent-vm/secret-management": "0.0.124"
   },
   "devDependencies": {
     "typescript": "^6.0.3",