npm - @agent-vm/gondolin-adapter - Versions diffs - 0.0.63 → 0.0.65 - Mend

@agent-vm/gondolin-adapter 0.0.63 → 0.0.65

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { ResolveAllResponse } from "@1password/sdk";
 import { BuildConfig, BuildConfig as BuildConfig$1, CreateHttpHooksResult, EnableIngressOptions, EnableSshOptions, IngressRoute as IngressRoute$1, ShadowPredicate, ShadowProviderOptions, VMOptions, VirtualProvider, getDefaultBuildConfig } from "@earendil-works/gondolin";
 //#region src/build-pipeline.d.ts
@@ -108,7 +109,7 @@ type SecretRef = {
 interface SecretResolverClient {
   readonly secrets: {
     resolve(secretReference: string): Promise<string>;
-    resolveAll(secretReferences: readonly string[]): Promise<unknown>;
+    resolveAll(secretReferences: readonly string[]): Promise<ResolveAllResponse>;
   };
 }
 interface SecretResolver {

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","names":[],"sources":["../src/build-pipeline.ts","../src/gondolin-package.ts","../src/mount-policy.ts","../src/pinned-realfs.ts","../src/policy-compiler.ts","../src/types.ts","../src/secret-resolver.ts","../src/vm-adapter.ts","../src/volume-manager.ts","../src/write-file-atomically.ts"],"mappings":"~~;;;~~UAaiB,iBAAA;EAAA,SACP,WAAA,EAAa,aAAA;EAAA,SACb,QAAA~~;;;WAGA~~,SAAA;EAAA,SACA,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,MAAA,GAAS,WAAA;AAAA;AAAA,UAGF,WAAA;EAChB,KAAA,CAAM,KAAA,WAAgB,UAAA;AAAA;AAAA,UAGN,gBAAA;EAAA,SACP,KAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA;AAAA;AAAA,cAGG,wBAAA;AAAA,UAOH,yBAAA;EAAA,SACA,WAAA,IACR,WAAA,EAAa,aAAA,EACb,eAAA,UACA,SAAA,cACI,OAAA;EAAA,SACI,eAAA;AAAA;AAAA,iBAwCY,mBAAA,CAAoB,mBAAA,WAA8B,OAAA;AAAA,iBAqExD,uBAAA,CACf,WAAA,EAAa,aAAA,EACb,eAAA,WACA,gBAAA;AAAA,iBAUqB,gCAAA,CAAiC,OAAA;EAAA,SAC7C,WAAA,EAAa,aAAA;EAAA,SACb,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,eAAA;AAAA,IACN,OAAA;EAAA,SACM,WAAA;EAAA,SACA,sBAAA;AAAA;AAAA,iBAmBY,UAAA,CACrB,OAAA,EAAS,iBAAA,EACT,YAAA,GAAc,yBAAA,GACZ,OAAA,CAAQ,gBAAA;;;iBClLK,sBAAA,CAAuB,WAAA;AAAA,iBAevB,8BAAA,CAAA;AAAA,iBAIM,0BAAA,CAAA,GAA8B,OAAA;AAAA,UAOnC,uCAAA;EAAA,SACP,eAAA;AAAA;AAAA,iBAQY,gCAAA,CACrB,OAAA,GAAS,uCAAA,GACP,OAAA;;;UC1Cc,mBAAA;EAAA,SACP,cAAA;EAAA,SACA,4BAAA;AAAA;AAAA,UAGO,wBAAA;EAAA,SACP,WAAA,EAAa,QAAA,CAAS,MAAA;EAAA,SACtB,aAAA,EAAe,mBAAA;AAAA;AAAA,iBAYT,qBAAA,CAAsB,SAAA,UAAmB,OAAA;AAAA,iBA8BzC,qBAAA,CACf,SAAA,UACA,MAAA,EAAQ,mBAAA,EACR,OAAA;EAAA,SAAoB,OAAA;AAAA;AAAA,iBA4BC,0BAAA,CACrB,MAAA,EAAQ,wBAAA,EACR,OAAA;EAAA,SAAoB,QAAA;EAAA,SAA2B,OAAA;AAAA,IAC7C,OAAA;;;UC7Fc,gBAAA;EAAA,SACP,QAAA;EAAA,SACA,QAAA;EAAA,SACA,EAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,IAAA,EAAM,gBAAA;EAAA,SACN,oBAAA,GAAuB,QAAA,aAAqB,eAAA;AAAA;AAAA,iBActC,aAAA,CAAc,QAAA,WAAmB,gBAAA;AAAA,iBAgCjC,qBAAA,CAAsB,IAAA,EAAM,gBAAA;AAAA,iBAI5B,sBAAA,CAAuB,IAAA,EAAM,gBAAA;AAAA,iBAqB7B,0BAAA,CACf,OAAA,EAAS,iCAAA,GACP,eAAA;;;UCxFc,aAAA;EAAA,SACP,IAAA;EAAA,SACA,OAAA;EAAA,SACA,KAAA;AAAA;AAAA,iBAGM,iBAAA,CAAkB,WAAA;AAAA,iBAIlB,YAAA,CAAa,MAAA;AAAA,iBAmBb,aAAA,CAAc,OAAA,EAAS,aAAA;;;UC7BtB,UAAA;EAAA,SACP,KAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,SAAA;EAAA,SAEA,MAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,MAAA;EAAA,SACA,GAAA;AAAA;;;UCNK,oBAAA;EAAA,SACP,OAAA;IACR,OAAA,CAAQ,eAAA,WAA0B,OAAA;IAClC,UAAA,CAAW,gBAAA,sBAAsC,OAAA;EAAA;AAAA;AAAA,~~UAIlC~~,cAAA;EAChB,OAAA,CAAQ,GAAA,EAAK,SAAA,GAAY,OAAA;EACzB,UAAA,CAAW,IAAA,EAAM,MAAA,SAAe,SAAA,IAAa,OAAA,CAAQ,MAAA;AAAA;AAAA,KAK1C,WAAA;EAAA,SACE,IAAA;EAAA,SAAyB,GAAA;AAAA;EAAA,SACzB,IAAA;EAAA,SAAsB,MAAA;AAAA;EAAA,SACtB,IAAA;EAAA,SAA2B,OAAA;EAAA,SAA0B,OAAA;AAAA;AAAA,UAElD,eAAA;EAAA,SACP,GAAA,GAAM,QAAA,CAAS,MAAA;AAAA;AAAA,UAGR,cAAA;EAAA,SACP,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,~~iBAwCY~~,0BAAA,CACrB,MAAA,EAAQ,WAAA,EACR,YAAA;EAAA,SACU,aAAA,IACR,OAAA,UACA,IAAA,qBACA,OAAA,GAAU,eAAA,KACN,OAAA,CAAQ,cAAA;AAAA,IAEZ,OAAA;AAAA,UA4Dc,gCAAA;EAAA,SACP,YAAA,IAAgB,MAAA;IACxB,IAAA;IACA,eAAA;IACA,kBAAA;EAAA,MACK,OAAA,CAAQ,oBAAA;EAAA,SACL,aAAA,IACR,OAAA,UACA,IAAA,qBACA,OAAA,GAAU,eAAA,KACN,OAAA,CAAQ,cAAA;EAAA,SACJ,eAAA;EAAA,SACA,kBAAA;AAAA;AAAA,~~iBA6CY~~,oBAAA,CACrB,OAAA;EAAA,SACU,mBAAA;AAAA,GAEV,YAAA,GAAc,gCAAA,GACZ,OAAA,CAAQ,cAAA;AAAA,~~iBA4DW~~,yBAAA,CACrB,OAAA;EAAA,SACU,mBAAA;AAAA,GAEV,YAAA,GAAc,IAAA,CAAK,gCAAA,qBACjB,OAAA,CAAQ,cAAA;;;~~cClPE~~,4BAAA;AAAA,cACA,wCAAA;AAAA,UAEI,UAAA;EAAA,SACP,QAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,YAAA,GAAe,cAAA;AAAA,UAEV,SAAA;EAAA,SACP,IAAA;EAAA,SACA,OAAA;EAAA,SACA,YAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,aAAA;EAAA,SACP,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,iBAAA;EAAA,SACP,EAAA;EACT,IAAA,CAAK,OAAA,WAAkB,OAAA;IAAA,SACb,QAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA;EAAA;EAEV,SAAA,CAAU,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,SAAA;EAC/C,aAAA,CAAc,OAAA,GAAU,oBAAA,GAAuB,OAAA,CAAQ,aAAA;EACvD,gBAAA,CAAiB,MAAA,WAAiB,YAAA;EAClC,KAAA,IAAS,OAAA;AAAA;AAAA,UAGO,qBAAA;EAChB,QAAA,CAAS,SAAA,EAAW,SAAA,GAAY,OAAA,CAAQ,iBAAA;EACxC,eAAA,CAAgB,OAAA;IAAA,SACN,YAAA;IAAA,SACA,OAAA,EAAS,MAAA,SAAe,UAAA;IAAA,SACxB,SAAA,IAAa,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,OAAA,GAAU,QAAA;IAAA,SACpD,UAAA,IAAc,QAAA,EAAU,QAAA,KAAa,OAAA,CAAQ,QAAA;EAAA,IACnD,IAAA,CAAK,qBAAA;EACT,qBAAA,CAAsB,IAAA,EAAM,gBAAA;EAC5B,0BAAA,CAA2B,IAAA,EAAM,gBAAA,GAAmB,eAAA;EACpD,oBAAA,CAAqB,QAAA,WAAmB,eAAA;EACxC,sBAAA,CAAuB,QAAA,EAAU,eAAA,GAAkB,eAAA;EACnD,oBAAA,IAAwB,eAAA;EACxB,oBAAA,CAAqB,QAAA,EAAU,eAAA,EAAiB,OAAA,EAAS,qBAAA,GAAwB,eAAA;EACjF,yBAAA,CAA0B,KAAA,sBAA2B,eAAA;AAAA;AAAA,UAGrC,YAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA;EAAA,SACA,cAAA,GAAiB,gBAAA;EAAA,SACjB,YAAA;IAAA,SACC,IAAA;IAAA,SACA,KAAA;EAAA;AAAA;AAAA,UAIM,eAAA;EAAA,SACP,SAAA;EAAA,SACA,MAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;EAAA,SACA,OAAA,EAAS,MAAA,SAAe,UAAA;EAAA,SACxB,SAAA,EAAW,MAAA,SAAe,YAAA;EAAA,SAC1B,QAAA,GAAW,MAAA;EAAA,SACX,GAAA,GAAM,MAAA;EAAA,SACN,YAAA;EAAA,SACA,SAAA,IAAa,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,OAAA,GAAU,QAAA;EAAA,SACpD,UAAA,IAAc,QAAA,EAAU,QAAA,KAAa,OAAA,CAAQ,QAAA;AAAA;AAAA,UAGtC,SAAA;EAAA,SACP,EAAA;EACT,IAAA,CAAK,OAAA,WAAkB,OAAA,CAAQ,UAAA;EAC/B,SAAA,CAAU,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,SAAA;EAC/C,aAAA,CAAc,OAAA,GAAU,oBAAA,GAAuB,OAAA,CAAQ,aAAA;EACvD,aAAA,IAAiB,iBAAA;EACjB,gBAAA,CAAiB,MAAA,WAAiB,YAAA;EAClC,KAAA,IAAS,OAAA;AAAA;AAAA,iBAwKY,eAAA,CACrB,OAAA,EAAS,eAAA,EACT,YAAA,GAAc,qBAAA,GACZ,OAAA,CAAQ,SAAA;;;UCvRM,iBAAA;EAAA,SACP,SAAA;AAAA;AAAA,UAGO,cAAA;EAAA,SACP,OAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGY,eAAA,CACrB,SAAA,UACA,aAAA,UACA,UAAA,WACE,OAAA;AAAA,iBAMmB,iBAAA,CACrB,SAAA,UACA,aAAA,UACA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,iBAAA,KAC/B,OAAA,CAAQ,MAAA,SAAe,cAAA;;;iBCxBJ,mBAAA,CACrB,QAAA,UACA,OAAA,UACA,OAAA;EAAA,SACU,IAAA;AAAA,IAER,OAAA"}
1	+ {"version":3,"file":"index.d.ts","names":[],"sources":["../src/build-pipeline.ts","../src/gondolin-package.ts","../src/mount-policy.ts","../src/pinned-realfs.ts","../src/policy-compiler.ts","../src/types.ts","../src/secret-resolver.ts","../src/vm-adapter.ts","../src/volume-manager.ts","../src/write-file-atomically.ts"],"mappings":";;;;UAaiB,iBAAA;EAAA,SACP,WAAA,EAAa,aAAA;EAAA,SACb,QAAA;EAFwB;;EAAA,SAKxB,SAAA;EAAA,SACA,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,MAAA,GAAS,WAAA;AAAA;AAAA,UAGF,WAAA;EAChB,KAAA,CAAM,KAAA,WAAgB,UAAA;AAAA;AAAA,UAGN,gBAAA;EAAA,SACP,KAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA;AAAA;AAAA,cAGG,wBAAA;AAAA,UAOH,yBAAA;EAAA,SACA,WAAA,IACR,WAAA,EAAa,aAAA,EACb,eAAA,UACA,SAAA,cACI,OAAA;EAAA,SACI,eAAA;AAAA;AAAA,iBAwCY,mBAAA,CAAoB,mBAAA,WAA8B,OAAA;AAAA,iBAqExD,uBAAA,CACf,WAAA,EAAa,aAAA,EACb,eAAA,WACA,gBAAA;AAAA,iBAUqB,gCAAA,CAAiC,OAAA;EAAA,SAC7C,WAAA,EAAa,aAAA;EAAA,SACb,SAAA;EAAA,SACA,gBAAA;EAAA,SACA,eAAA;AAAA,IACN,OAAA;EAAA,SACM,WAAA;EAAA,SACA,sBAAA;AAAA;AAAA,iBAmBY,UAAA,CACrB,OAAA,EAAS,iBAAA,EACT,YAAA,GAAc,yBAAA,GACZ,OAAA,CAAQ,gBAAA;;;iBClLK,sBAAA,CAAuB,WAAA;AAAA,iBAevB,8BAAA,CAAA;AAAA,iBAIM,0BAAA,CAAA,GAA8B,OAAA;AAAA,UAOnC,uCAAA;EAAA,SACP,eAAA;AAAA;AAAA,iBAQY,gCAAA,CACrB,OAAA,GAAS,uCAAA,GACP,OAAA;;;UC1Cc,mBAAA;EAAA,SACP,cAAA;EAAA,SACA,4BAAA;AAAA;AAAA,UAGO,wBAAA;EAAA,SACP,WAAA,EAAa,QAAA,CAAS,MAAA;EAAA,SACtB,aAAA,EAAe,mBAAA;AAAA;AAAA,iBAYT,qBAAA,CAAsB,SAAA,UAAmB,OAAA;AAAA,iBA8BzC,qBAAA,CACf,SAAA,UACA,MAAA,EAAQ,mBAAA,EACR,OAAA;EAAA,SAAoB,OAAA;AAAA;AAAA,iBA4BC,0BAAA,CACrB,MAAA,EAAQ,wBAAA,EACR,OAAA;EAAA,SAAoB,QAAA;EAAA,SAA2B,OAAA;AAAA,IAC7C,OAAA;;;UC7Fc,gBAAA;EAAA,SACP,QAAA;EAAA,SACA,QAAA;EAAA,SACA,EAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA;AAAA,UAGO,iCAAA;EAAA,SACP,IAAA,EAAM,gBAAA;EAAA,SACN,oBAAA,GAAuB,QAAA,aAAqB,eAAA;AAAA;AAAA,iBActC,aAAA,CAAc,QAAA,WAAmB,gBAAA;AAAA,iBAgCjC,qBAAA,CAAsB,IAAA,EAAM,gBAAA;AAAA,iBAI5B,sBAAA,CAAuB,IAAA,EAAM,gBAAA;AAAA,iBAqB7B,0BAAA,CACf,OAAA,EAAS,iCAAA,GACP,eAAA;;;UCxFc,aAAA;EAAA,SACP,IAAA;EAAA,SACA,OAAA;EAAA,SACA,KAAA;AAAA;AAAA,iBAGM,iBAAA,CAAkB,WAAA;AAAA,iBAIlB,YAAA,CAAa,MAAA;AAAA,iBAmBb,aAAA,CAAc,OAAA,EAAS,aAAA;;;UC7BtB,UAAA;EAAA,SACP,KAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,SAAA;EAAA,SAEA,MAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,MAAA;EAAA,SACA,GAAA;AAAA;;;UCNK,oBAAA;EAAA,SACP,OAAA;IACR,OAAA,CAAQ,eAAA,WAA0B,OAAA;IAClC,UAAA,CAAW,gBAAA,sBAAsC,OAAA,CAAQ,kBAAA;EAAA;AAAA;AAAA,UAI1C,cAAA;EAChB,OAAA,CAAQ,GAAA,EAAK,SAAA,GAAY,OAAA;EACzB,UAAA,CAAW,IAAA,EAAM,MAAA,SAAe,SAAA,IAAa,OAAA,CAAQ,MAAA;AAAA;AAAA,KAK1C,WAAA;EAAA,SACE,IAAA;EAAA,SAAyB,GAAA;AAAA;EAAA,SACzB,IAAA;EAAA,SAAsB,MAAA;AAAA;EAAA,SACtB,IAAA;EAAA,SAA2B,OAAA;EAAA,SAA0B,OAAA;AAAA;AAAA,UAElD,eAAA;EAAA,SACP,GAAA,GAAM,QAAA,CAAS,MAAA;AAAA;AAAA,UAGR,cAAA;EAAA,SACP,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,iBA4CY,0BAAA,CACrB,MAAA,EAAQ,WAAA,EACR,YAAA;EAAA,SACU,aAAA,IACR,OAAA,UACA,IAAA,qBACA,OAAA,GAAU,eAAA,KACN,OAAA,CAAQ,cAAA;AAAA,IAEZ,OAAA;AAAA,UA4Dc,gCAAA;EAAA,SACP,YAAA,IAAgB,MAAA;IACxB,IAAA;IACA,eAAA;IACA,kBAAA;EAAA,MACK,OAAA,CAAQ,oBAAA;EAAA,SACL,aAAA,IACR,OAAA,UACA,IAAA,qBACA,OAAA,GAAU,eAAA,KACN,OAAA,CAAQ,cAAA;EAAA,SACJ,eAAA;EAAA,SACA,kBAAA;AAAA;AAAA,iBA4GY,oBAAA,CACrB,OAAA;EAAA,SACU,mBAAA;AAAA,GAEV,YAAA,GAAc,gCAAA,GACZ,OAAA,CAAQ,cAAA;AAAA,iBAkDW,yBAAA,CACrB,OAAA;EAAA,SACU,mBAAA;AAAA,GAEV,YAAA,GAAc,IAAA,CAAK,gCAAA,qBACjB,OAAA,CAAQ,cAAA;;;cC3SE,4BAAA;AAAA,cACA,wCAAA;AAAA,UAEI,UAAA;EAAA,SACP,QAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,YAAA,GAAe,cAAA;AAAA,UAEV,SAAA;EAAA,SACP,IAAA;EAAA,SACA,OAAA;EAAA,SACA,YAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,aAAA;EAAA,SACP,IAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,iBAAA;EAAA,SACP,EAAA;EACT,IAAA,CAAK,OAAA,WAAkB,OAAA;IAAA,SACb,QAAA;IAAA,SACA,MAAA;IAAA,SACA,MAAA;EAAA;EAEV,SAAA,CAAU,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,SAAA;EAC/C,aAAA,CAAc,OAAA,GAAU,oBAAA,GAAuB,OAAA,CAAQ,aAAA;EACvD,gBAAA,CAAiB,MAAA,WAAiB,YAAA;EAClC,KAAA,IAAS,OAAA;AAAA;AAAA,UAGO,qBAAA;EAChB,QAAA,CAAS,SAAA,EAAW,SAAA,GAAY,OAAA,CAAQ,iBAAA;EACxC,eAAA,CAAgB,OAAA;IAAA,SACN,YAAA;IAAA,SACA,OAAA,EAAS,MAAA,SAAe,UAAA;IAAA,SACxB,SAAA,IAAa,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,OAAA,GAAU,QAAA;IAAA,SACpD,UAAA,IAAc,QAAA,EAAU,QAAA,KAAa,OAAA,CAAQ,QAAA;EAAA,IACnD,IAAA,CAAK,qBAAA;EACT,qBAAA,CAAsB,IAAA,EAAM,gBAAA;EAC5B,0BAAA,CAA2B,IAAA,EAAM,gBAAA,GAAmB,eAAA;EACpD,oBAAA,CAAqB,QAAA,WAAmB,eAAA;EACxC,sBAAA,CAAuB,QAAA,EAAU,eAAA,GAAkB,eAAA;EACnD,oBAAA,IAAwB,eAAA;EACxB,oBAAA,CAAqB,QAAA,EAAU,eAAA,EAAiB,OAAA,EAAS,qBAAA,GAAwB,eAAA;EACjF,yBAAA,CAA0B,KAAA,sBAA2B,eAAA;AAAA;AAAA,UAGrC,YAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA;EAAA,SACA,cAAA,GAAiB,gBAAA;EAAA,SACjB,YAAA;IAAA,SACC,IAAA;IAAA,SACA,KAAA;EAAA;AAAA;AAAA,UAIM,eAAA;EAAA,SACP,SAAA;EAAA,SACA,MAAA;EAAA,SACA,IAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;EAAA,SACA,OAAA,EAAS,MAAA,SAAe,UAAA;EAAA,SACxB,SAAA,EAAW,MAAA,SAAe,YAAA;EAAA,SAC1B,QAAA,GAAW,MAAA;EAAA,SACX,GAAA,GAAM,MAAA;EAAA,SACN,YAAA;EAAA,SACA,SAAA,IAAa,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,OAAA,GAAU,QAAA;EAAA,SACpD,UAAA,IAAc,QAAA,EAAU,QAAA,KAAa,OAAA,CAAQ,QAAA;AAAA;AAAA,UAGtC,SAAA;EAAA,SACP,EAAA;EACT,IAAA,CAAK,OAAA,WAAkB,OAAA,CAAQ,UAAA;EAC/B,SAAA,CAAU,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,SAAA;EAC/C,aAAA,CAAc,OAAA,GAAU,oBAAA,GAAuB,OAAA,CAAQ,aAAA;EACvD,aAAA,IAAiB,iBAAA;EACjB,gBAAA,CAAiB,MAAA,WAAiB,YAAA;EAClC,KAAA,IAAS,OAAA;AAAA;AAAA,iBAwKY,eAAA,CACrB,OAAA,EAAS,eAAA,EACT,YAAA,GAAc,qBAAA,GACZ,OAAA,CAAQ,SAAA;;;UCvRM,iBAAA;EAAA,SACP,SAAA;AAAA;AAAA,UAGO,cAAA;EAAA,SACP,OAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGY,eAAA,CACrB,SAAA,UACA,aAAA,UACA,UAAA,WACE,OAAA;AAAA,iBAMmB,iBAAA,CACrB,SAAA,UACA,aAAA,UACA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,iBAAA,KAC/B,OAAA,CAAQ,MAAA,SAAe,cAAA;;;iBCxBJ,mBAAA,CACrB,QAAA,UACA,OAAA,UACA,OAAA;EAAA,SACU,IAAA;AAAA,IAER,OAAA"}

package/dist/index.js CHANGED Viewed

@@ -358,6 +358,9 @@ function compilePolicy(sources) {
 function writeStderr(message) {
 	process.stderr.write(`${message}\n`);
 }
+function formatUnknownError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 function ensureMacOsForKeychain() {
 	if (process.platform !== "darwin") throw new Error("Keychain token source is only supported on macOS. Use an env or op-cli token source on this platform so cmd-ts can surface a clear startup error.");
 }
@@ -420,9 +423,32 @@ async function resolveSecretWithOpCli(serviceAccountToken, secretReference, exec
 }
 async function resolveAllSecretsWithOpCli(serviceAccountToken, refs, exec) {
 	const resolvedSecrets = {};
-	for (const [secretName, secretRef] of Object.entries(refs)) resolvedSecrets[secretName] = await resolveSecretWithOpCli(serviceAccountToken, secretRef.ref, exec);
+	const failures = [];
+	for (const [secretName, secretRef] of Object.entries(refs)) try {
+		resolvedSecrets[secretName] = await resolveSecretWithOpCli(serviceAccountToken, secretRef.ref, exec);
+	} catch (error) {
+		failures.push(new Error(`Failed to resolve secret '${secretName}' from '${secretRef.ref}' via op read: ${formatUnknownError(error)}`, { cause: error }));
+	}
+	if (failures.length > 0) throw new AggregateError(failures, `Failed to resolve ${String(failures.length)} secret(s) via op read.`);
 	return resolvedSecrets;
 }
+function formatResolveReferenceError(error) {
+	return "message" in error && typeof error.message === "string" ? `${error.type}: ${error.message}` : error.type;
+}
+function readSdkBatchSecret(options) {
+	const individualResponse = options.response.individualResponses[options.secretReference];
+	if (!individualResponse) throw new Error(`1Password SDK resolveAll response omitted '${options.secretName}' (${options.secretReference}).`);
+	if (individualResponse.content !== void 0) return individualResponse.content.secret;
+	if (individualResponse.error !== void 0) throw new Error(`1Password SDK resolveAll failed for '${options.secretName}' (${options.secretReference}): ${formatResolveReferenceError(individualResponse.error)}`);
+	throw new Error(`1Password SDK resolveAll returned neither content nor error for '${options.secretName}' (${options.secretReference}).`);
+}
+function mapSdkResolveAllResponse(refs, response) {
+	return Object.fromEntries(Object.entries(refs).map(([secretName, secretRef]) => [secretName, readSdkBatchSecret({
+		response,
+		secretName,
+		secretReference: secretRef.ref
+	})]));
+}
 async function createSecretResolver(options, dependencies = {}) {
 	const exec = dependencies.execFileAsync ?? execFileAsync;
 	try {
@@ -442,15 +468,12 @@ async function createSecretResolver(options, dependencies = {}) {
 				}
 			},
 			resolveAll: async (refs) => {
-				const resolvedSecrets = {};
-				for (const [secretName, secretRef] of Object.entries(refs)) try {
-					resolvedSecrets[secretName] = await client.secrets.resolve(secretRef.ref);
+				try {
+					return mapSdkResolveAllResponse(refs, await client.secrets.resolveAll(Object.values(refs).map((secretRef) => secretRef.ref)));
 				} catch (error) {
-					const message = error instanceof Error ? error.message : String(error);
-					writeStderr(`[secret-resolver] 1Password SDK resolve failed for ${secretRef.ref}; falling back to op CLI: ${message}`);
-					resolvedSecrets[secretName] = await resolveSecretWithOpCli(options.serviceAccountToken, secretRef.ref, exec);
+					writeStderr(`[secret-resolver] 1Password SDK resolveAll failed; falling back to serial op CLI reads: ${error instanceof Error ? error.message : String(error)}`);
+					return await resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec);
 				}
-				return resolvedSecrets;
 			}
 		};
 	} catch (error) {

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":["fs"],"sources":["../src/rootfs-init-extra.ts","../src/build-pipeline.ts","../src/gondolin-package.ts","../src/mount-policy.ts","../src/pinned-realfs.ts","../src/policy-compiler.ts","../src/secret-resolver.ts","../src/vm-adapter.ts","../src/volume-manager.ts","../src/write-file-atomically.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport const agentVmRootfsInitExtraScript = `# Generated by agent-vm.\n# Gondolin mounts devtmpfs over /dev at boot, so Docker-image /dev symlinks are hidden.\nmkdir -p /dev\nln -sfn /proc/self/fd /dev/fd 2>/dev/null \|\| true\nln -sfn /proc/self/fd/0 /dev/stdin 2>/dev/null \|\| true\nln -sfn /proc/self/fd/1 /dev/stdout 2>/dev/null \|\| true\nln -sfn /proc/self/fd/2 /dev/stderr 2>/dev/null \|\| true\nif [ ! -e /dev/ptmx ] && [ -e /dev/pts/ptmx ]; then\n ln -sfn pts/ptmx /dev/ptmx 2>/dev/null \|\| true\nfi\n`;\n\ninterface PrepareRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly imagePath: string;\n\treadonly rootfsInitExtraContent: string;\n}\n\ninterface ResolveRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n}\n\nexport interface ResolvedRootfsInitExtra {\n\treadonly content: string;\n\treadonly fingerprintInput: {\n\t\treadonly agentVmRootfsInitExtra: string;\n\t\treadonly deploymentRootfsInitExtra?: string;\n\t};\n}\n\nfunction resolveBuildConfigPath(filePath: string, configDir: string \| undefined): string {\n\treturn path.isAbsolute(filePath) ? filePath : path.resolve(configDir ?? process.cwd(), filePath);\n}\n\nasync function readExistingRootfsInitExtra(\n\tbuildConfig: BuildConfig,\n\tconfigDir: string \| undefined,\n): Promise<string \| undefined> {\n\tconst existingRootfsInitExtra = buildConfig.init?.rootfsInitExtra;\n\tif (!existingRootfsInitExtra) {\n\t\treturn undefined;\n\t}\n\n\tconst resolvedRootfsInitExtra = resolveBuildConfigPath(existingRootfsInitExtra, configDir);\n\ttry {\n\t\treturn await fs.readFile(resolvedRootfsInitExtra, 'utf8');\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin rootfs init extra '${resolvedRootfsInitExtra}': ${message}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction composeRootfsInitExtra(existingRootfsInitExtra: string \| undefined): string {\n\treturn existingRootfsInitExtra\n\t\t? `${agentVmRootfsInitExtraScript.trimEnd()}\\n\\n${existingRootfsInitExtra}`\n\t\t: agentVmRootfsInitExtraScript;\n}\n\nexport async function resolveRootfsInitExtra(\n\toptions: ResolveRootfsInitExtraOptions,\n): Promise<ResolvedRootfsInitExtra> {\n\tconst existingRootfsInitExtra = await readExistingRootfsInitExtra(\n\t\toptions.buildConfig,\n\t\toptions.configDir,\n\t);\n\n\treturn {\n\t\tcontent: composeRootfsInitExtra(existingRootfsInitExtra),\n\t\tfingerprintInput: {\n\t\t\tagentVmRootfsInitExtra: agentVmRootfsInitExtraScript,\n\t\t\t...(existingRootfsInitExtra === undefined\n\t\t\t\t? {}\n\t\t\t\t: { deploymentRootfsInitExtra: existingRootfsInitExtra }),\n\t\t},\n\t};\n}\n\nexport async function prepareBuildConfigWithAgentVmRootfsInitExtra(\n\toptions: PrepareRootfsInitExtraOptions,\n): Promise<BuildConfig> {\n\tconst rootfsInitExtraPath = path.join(options.imagePath, 'agent-vm-rootfs-init-extra.sh');\n\n\tawait fs.writeFile(rootfsInitExtraPath, options.rootfsInitExtraContent, {\n\t\tencoding: 'utf8',\n\t\tmode: 0o755,\n\t});\n\n\treturn {\n\t\t...options.buildConfig,\n\t\tinit: {\n\t\t\t...options.buildConfig.init,\n\t\t\trootfsInitExtra: rootfsInitExtraPath,\n\t\t},\n\t};\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig, BuildOptions } from '@earendil-works/gondolin';\n\nimport {\n\tprepareBuildConfigWithAgentVmRootfsInitExtra,\n\tresolveRootfsInitExtra,\n} from './rootfs-init-extra.js';\n\nexport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport interface BuildImageOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly cacheDir: string;\n\t/** Directory to resolve relative paths in buildConfig (e.g. postBuild.copy.src).\n\t * Defaults to process.cwd() if not provided. /\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly output?: BuildOutput;\n}\n\nexport interface BuildOutput {\n\twrite(chunk: string \| Uint8Array): boolean;\n}\n\nexport interface BuildImageResult {\n\treadonly built: boolean;\n\treadonly fingerprint: string;\n\treadonly imagePath: string;\n}\n\nexport const buildImageAssetFileNames = [\n\t'manifest.json',\n\t'rootfs.ext4',\n\t'initramfs.cpio.lz4',\n\t'vmlinuz-virt',\n] as const;\n\ninterface BuildPipelineDependencies {\n\treadonly buildAssets?: (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t) => Promise<unknown>;\n\treadonly gondolinVersion?: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null;\n}\n\nfunction stableSerialize(value: unknown): string {\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((entry) => stableSerialize(entry)).join(',')}]`;\n\t}\n\n\tif (isRecord(value)) {\n\t\tconst objectEntries = Object.entries(value)\n\t\t\t.filter(([, entryValue]) => entryValue !== undefined)\n\t\t\t.toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n\t\treturn `{${objectEntries\n\t\t\t.map(([entryKey, entryValue]) => `${JSON.stringify(entryKey)}:${stableSerialize(entryValue)}`)\n\t\t\t.join(',')}}`;\n\t}\n\n\treturn JSON.stringify(value);\n}\n\nfunction isMissingPathError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait fs.access(filePath);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (!isMissingPathError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn false;\n\t}\n}\n\nexport async function hasBuiltImageAssets(outputDirectoryPath: string): Promise<boolean> {\n\tfor (const fileName of buildImageAssetFileNames) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- each missing file points at the same image generation\n\t\tif (!(await pathExists(path.join(outputDirectoryPath, fileName)))) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nasync function loadBuildAssets(): Promise<\n\t(buildConfig: BuildConfig, outputDirectory: string, configDir?: string) => Promise<unknown>\n> {\n\tconst gondolinModule = await import('@earendil-works/gondolin');\n\treturn async (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t): Promise<unknown> =>\n\t\tawait gondolinModule.buildAssets(buildConfig, {\n\t\t\toutputDir: outputDirectory,\n\t\t\tverbose: false,\n\t\t\t...(configDir ? { configDir } : {}),\n\t\t} satisfies BuildOptions);\n}\n\nfunction createRedirectedWrite(output: BuildOutput): typeof process.stderr.write {\n\treturn ((\n\t\tchunk: string \| Uint8Array,\n\t\tencodingOrCallback?: BufferEncoding \| ((error?: Error \| null) => void),\n\t\tcallback?: (error?: Error \| null) => void,\n\t): boolean => {\n\t\tconst writeCallback = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;\n\t\tconst wrote = output.write(chunk);\n\t\twriteCallback?.();\n\t\treturn wrote;\n\t}) as typeof process.stderr.write;\n}\n\nasync function withCapturedBuildOutput<TResult>(\n\toutput: BuildOutput \| undefined,\n\tfn: () => Promise<TResult>,\n): Promise<TResult> {\n\tif (!output) {\n\t\treturn await fn();\n\t}\n\n\tconst originalStderrWrite = process.stderr.write.bind(process.stderr);\n\tconst originalStdoutWrite = process.stdout.write.bind(process.stdout);\n\tconst originalCi = process.env.CI;\n\tconst redirectedWrite = createRedirectedWrite(output);\n\n\tprocess.stderr.write = redirectedWrite;\n\tprocess.stdout.write = redirectedWrite;\n\tprocess.env.CI = 'true';\n\n\ttry {\n\t\treturn await fn();\n\t} finally {\n\t\tprocess.stderr.write = originalStderrWrite;\n\t\tprocess.stdout.write = originalStdoutWrite;\n\t\tif (originalCi === undefined) {\n\t\t\tdelete process.env.CI;\n\t\t} else {\n\t\t\tprocess.env.CI = originalCi;\n\t\t}\n\t}\n}\n\nexport function computeBuildFingerprint(\n\tbuildConfig: BuildConfig,\n\tgondolinVersion: string = 'unknown',\n\tfingerprintInput?: unknown,\n): string {\n\tconst payload =\n\t\tfingerprintInput === undefined\n\t\t\t? `${stableSerialize(buildConfig)}\|${gondolinVersion}`\n\t\t\t: `${stableSerialize(buildConfig)}\|${gondolinVersion}\|${stableSerialize(fingerprintInput)}`;\n\n\treturn crypto.createHash('sha256').update(payload).digest('hex').slice(0, 16);\n}\n\nexport async function computeEffectiveBuildFingerprint(options: {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n}): Promise<{\n\treadonly fingerprint: string;\n\treadonly rootfsInitExtraContent: string;\n}> {\n\tconst resolvedRootfsInitExtra = await resolveRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t});\n\tconst fingerprint = computeBuildFingerprint(options.buildConfig, options.gondolinVersion, {\n\t\tagentVmRootfsInitExtra: resolvedRootfsInitExtra.fingerprintInput,\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { callerFingerprintInput: options.fingerprintInput }),\n\t});\n\n\treturn {\n\t\tfingerprint,\n\t\trootfsInitExtraContent: resolvedRootfsInitExtra.content,\n\t};\n}\n\nexport async function buildImage(\n\toptions: BuildImageOptions,\n\tdependencies: BuildPipelineDependencies = {},\n): Promise<BuildImageResult> {\n\tconst effectiveBuildFingerprint = await computeEffectiveBuildFingerprint({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { fingerprintInput: options.fingerprintInput }),\n\t\t...(dependencies.gondolinVersion ? { gondolinVersion: dependencies.gondolinVersion } : {}),\n\t});\n\tconst fingerprint = effectiveBuildFingerprint.fingerprint;\n\tconst imagePath = path.join(options.cacheDir, fingerprint);\n\n\tif (options.fullReset) {\n\t\tawait fs.rm(imagePath, { recursive: true, force: true });\n\t}\n\n\tif (await hasBuiltImageAssets(imagePath)) {\n\t\treturn {\n\t\t\tbuilt: false,\n\t\t\tfingerprint,\n\t\t\timagePath,\n\t\t};\n\t}\n\n\tawait fs.mkdir(imagePath, { recursive: true });\n\tconst buildAssetsImplementation = dependencies.buildAssets ?? (await loadBuildAssets());\n\tconst effectiveBuildConfig = await prepareBuildConfigWithAgentVmRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\timagePath,\n\t\trootfsInitExtraContent: effectiveBuildFingerprint.rootfsInitExtraContent,\n\t});\n\tawait withCapturedBuildOutput(options.output, async () => {\n\t\tawait buildAssetsImplementation(effectiveBuildConfig, imagePath, options.configDir);\n\t});\n\n\tif (!(await hasBuiltImageAssets(imagePath))) {\n\t\tthrow new Error(`Expected Gondolin assets to be written to ${imagePath}.`);\n\t}\n\n\treturn {\n\t\tbuilt: true,\n\t\tfingerprint,\n\t\timagePath,\n\t};\n}\n","import fs from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\n\nimport { z } from 'zod';\n\nconst requireFromHere = createRequire(import.meta.url);\n\nconst gondolinPackageJsonSchema = z.object({\n\tversion: z.string().min(1),\n});\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nfunction getErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nexport function parseMinimumZigVersion(rawContents: string): string {\n\tconst match = rawContents.match(/\\.minimum_zig_version\\s=\\s\"([^\"])\"/u);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t'minimum_zig_version declaration not found. Expected a line like `.minimum_zig_version = \"0.15.2\"`.',\n\t\t);\n\t}\n\n\tconst version = match[1];\n\tif (!version) {\n\t\tthrow new Error('minimum_zig_version is empty.');\n\t}\n\treturn version;\n}\n\nexport function resolveGondolinPackageJsonPath(): string {\n\treturn requireFromHere.resolve('@earendil-works/gondolin/package.json');\n}\n\nexport async function resolveGondolinPackageSpec(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\tconst parsed: unknown = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));\n\tconst packageJson = gondolinPackageJsonSchema.parse(parsed);\n\treturn `@earendil-works/gondolin@${packageJson.version}`;\n}\n\nexport interface ResolveGondolinMinimumZigVersionOptions {\n\treadonly buildZigZonPath?: string;\n}\n\nasync function resolveDefaultBuildZigZonPath(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\treturn path.join(path.dirname(packageJsonPath), 'dist', 'guest', 'build.zig.zon');\n}\n\nexport async function resolveGondolinMinimumZigVersion(\n\toptions: ResolveGondolinMinimumZigVersionOptions = {},\n): Promise<string> {\n\tconst zonPath = options.buildZigZonPath ?? (await resolveDefaultBuildZigZonPath());\n\tlet rawContents: string;\n\ttry {\n\t\trawContents = await fs.readFile(zonPath, 'utf8');\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) {\n\t\t\tthrow new Error(`Missing Gondolin build.zig.zon at '${zonPath}'.`, { cause: error });\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\n\ttry {\n\t\treturn parseMinimumZigVersion(rawContents);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to parse Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nconst AUTH_GUEST_PATH_PREFIXES = [\n\t'/home/agent/.aws',\n\t'/home/agent/.claude',\n\t'/home/agent/.codex',\n\t'/home/agent/.gemini',\n\t'/home/openclaw/.aws',\n\t'/home/openclaw/.claude',\n\t'/home/openclaw/.codex',\n\t'/home/openclaw/.gemini',\n\t'/home/openclaw/.openclaw',\n] as const;\n\nexport interface WritableMountPolicy {\n\treadonly allowAuthWrite: boolean;\n\treadonly writableAllowedGuestPrefixes: readonly string[];\n}\n\nexport interface RuntimeMountPolicyConfig {\n\treadonly extraMounts: Readonly<Record<string, string>>;\n\treadonly mountControls: WritableMountPolicy;\n}\n\nfunction resolveAuthHostPrefixes(hostHome: string): readonly string[] {\n\treturn [\n\t\tpath.join(hostHome, '.aws'),\n\t\tpath.join(hostHome, '.claude'),\n\t\tpath.join(hostHome, '.codex'),\n\t\tpath.join(hostHome, '.gemini'),\n\t];\n}\n\nexport function resolveGuestMountPath(guestPath: string, workDir: string): string {\n\tif (path.isAbsolute(guestPath)) {\n\t\treturn path.resolve(guestPath);\n\t}\n\n\treturn path.resolve(workDir, guestPath);\n}\n\nfunction isPathWithinPrefix(candidatePath: string, prefixPath: string): boolean {\n\tconst relativePath = path.relative(prefixPath, candidatePath);\n\treturn relativePath === '' \|\| (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));\n}\n\nasync function normalizeHostPath(hostPath: string): Promise<string> {\n\tconst resolvedHostPath = path.resolve(hostPath);\n\n\ttry {\n\t\treturn await fs.realpath(resolvedHostPath);\n\t} catch {\n\t\treturn resolvedHostPath;\n\t}\n}\n\nfunction pathsOverlap(candidatePath: string, protectedPath: string): boolean {\n\treturn (\n\t\tisPathWithinPrefix(candidatePath, protectedPath) \|\|\n\t\tisPathWithinPrefix(protectedPath, candidatePath)\n\t);\n}\n\nexport function validateWritableMount(\n\tguestPath: string,\n\tpolicy: WritableMountPolicy,\n\toptions: { readonly workDir: string },\n): void {\n\tconst resolvedGuestPath = resolveGuestMountPath(guestPath, options.workDir);\n\tconst resolvedAllowedPrefixes = policy.writableAllowedGuestPrefixes.map((allowedPrefix) =>\n\t\tresolveGuestMountPath(allowedPrefix, options.workDir),\n\t);\n\n\tconst isAllowedGuestPath = resolvedAllowedPrefixes.some((allowedPrefix) =>\n\t\tisPathWithinPrefix(resolvedGuestPath, allowedPrefix),\n\t);\n\tif (!isAllowedGuestPath) {\n\t\tthrow new Error(\n\t\t\t`Writable mount guest path '${resolvedGuestPath}' is outside writable allowlist [${resolvedAllowedPrefixes.join(', ')}].`,\n\t\t);\n\t}\n\n\tif (!policy.allowAuthWrite) {\n\t\tconst targetsProtectedGuestPath = AUTH_GUEST_PATH_PREFIXES.some((authPrefix) =>\n\t\t\tisPathWithinPrefix(resolvedGuestPath, authPrefix),\n\t\t);\n\t\tif (targetsProtectedGuestPath) {\n\t\t\tthrow new Error(\n\t\t\t\t`Writable mount guest path '${resolvedGuestPath}' targets an auth mount path. Set mountControls.allowAuthWrite=true to permit auth writes.`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nexport async function validateRuntimeMountPolicy(\n\tconfig: RuntimeMountPolicyConfig,\n\toptions: { readonly hostHome: string; readonly workDir: string },\n): Promise<void> {\n\tconst mountEntries = Object.entries(config.extraMounts);\n\tfor (const [guestPath] of mountEntries) {\n\t\tvalidateWritableMount(guestPath, config.mountControls, options);\n\t}\n\n\tif (config.mountControls.allowAuthWrite) {\n\t\treturn;\n\t}\n\n\tconst absoluteHostMountEntries = mountEntries.filter(([, hostPath]) => path.isAbsolute(hostPath));\n\tconst [protectedHostPaths, writableHostPaths] = await Promise.all([\n\t\tPromise.all(\n\t\t\tresolveAuthHostPrefixes(options.hostHome).map(\n\t\t\t\tasync (authHostPrefix) => await normalizeHostPath(authHostPrefix),\n\t\t\t),\n\t\t),\n\t\tPromise.all(\n\t\t\tabsoluteHostMountEntries.map(async ([, hostPath]) => await normalizeHostPath(hostPath)),\n\t\t),\n\t]);\n\n\tfor (const resolvedWritableHostPath of writableHostPaths) {\n\t\tconst overlapsProtectedHostPath = protectedHostPaths.some((authHostPrefix) =>\n\t\t\tpathsOverlap(resolvedWritableHostPath, authHostPrefix),\n\t\t);\n\n\t\tif (overlapsProtectedHostPath) {\n\t\t\tthrow new Error(\n\t\t\t\t`Writable host path '${resolvedWritableHostPath}' targets an auth host directory. Set mountControls.allowAuthWrite=true to permit auth writes.`,\n\t\t\t);\n\t\t}\n\t}\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { VirtualProvider } from '@earendil-works/gondolin';\n\nexport interface PinnedRealFsRoot {\n\treadonly hostPath: string;\n\treadonly realPath: string;\n\treadonly fd: number;\n\treadonly device: number;\n\treadonly inode: number;\n}\n\nexport interface CreatePinnedRealFsProviderOptions {\n\treadonly root: PinnedRealFsRoot;\n\treadonly createRealFsProvider: (hostPath: string) => VirtualProvider;\n}\n\nfunction formatRootIdentity(root: PinnedRealFsRoot): string {\n\treturn `${root.device}:${root.inode}`;\n}\n\nfunction openDirectoryNoFollow(candidatePath: string): number {\n\treturn fs.openSync(\n\t\tcandidatePath,\n\t\tfs.constants.O_RDONLY \| fs.constants.O_DIRECTORY \| fs.constants.O_NOFOLLOW,\n\t);\n}\n\nexport function pinRealFsRoot(hostPath: string): PinnedRealFsRoot {\n\tif (!hostPath \|\| !path.isAbsolute(hostPath)) {\n\t\tthrow new Error(`Pinned RealFS root must be a non-empty absolute path: ${hostPath}`);\n\t}\n\n\tconst resolvedHostPath = path.resolve(hostPath);\n\tconst fd = openDirectoryNoFollow(resolvedHostPath);\n\ttry {\n\t\tconst stats = fs.fstatSync(fd);\n\t\tif (!stats.isDirectory()) {\n\t\t\tthrow new Error(`Pinned RealFS root is not a directory: ${resolvedHostPath}`);\n\t\t}\n\t\tconst realPath = fs.realpathSync(resolvedHostPath);\n\t\tconst realPathStats = fs.statSync(realPath);\n\t\tif (realPathStats.dev !== stats.dev \|\| realPathStats.ino !== stats.ino) {\n\t\t\tthrow new Error(\n\t\t\t\t`Pinned RealFS root changed while opening: ${resolvedHostPath} opened ${stats.dev}:${stats.ino} but resolved to ${realPathStats.dev}:${realPathStats.ino}`,\n\t\t\t);\n\t\t}\n\t\treturn {\n\t\t\tdevice: stats.dev,\n\t\t\tfd,\n\t\t\thostPath: resolvedHostPath,\n\t\t\tinode: stats.ino,\n\t\t\trealPath,\n\t\t};\n\t} catch (error) {\n\t\tfs.closeSync(fd);\n\t\tthrow error;\n\t}\n}\n\nexport function closePinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tfs.closeSync(root.fd);\n}\n\nexport function assertPinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tconst pinnedStats = fs.fstatSync(root.fd);\n\tconst currentStats = fs.statSync(root.realPath);\n\tif (\n\t\tpinnedStats.dev !== root.device \|\|\n\t\tpinnedStats.ino !== root.inode \|\|\n\t\tcurrentStats.dev !== root.device \|\|\n\t\tcurrentStats.ino !== root.inode\n\t) {\n\t\tthrow new Error(\n\t\t\t`Pinned RealFS root changed before mount access: ${root.realPath} expected ${formatRootIdentity(root)} got ${currentStats.dev}:${currentStats.ino}`,\n\t\t);\n\t}\n}\n\ntype ProviderMethod = (...args: unknown[]) => unknown;\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- Reflect.get()\n loses the method signature from Gondolin's VirtualProvider union. The proxy\n keeps the same provider object and only wraps callable properties with the\n pinned-root assertion. /\nexport function createPinnedRealFsProvider(\n\toptions: CreatePinnedRealFsProviderOptions,\n): VirtualProvider {\n\tassertPinnedRealFsRoot(options.root);\n\tconst provider = options.createRealFsProvider(options.root.realPath);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string \| symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tassertPinnedRealFsRoot(options.root);\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n/ oxlint-enable typescript-eslint/no-unsafe-type-assertion /\n","export interface PolicySources {\n\treadonly base: readonly string[];\n\treadonly profile: readonly string[];\n\treadonly extra: readonly string[];\n}\n\nexport function normalizeHostname(rawHostname: string): string {\n\treturn rawHostname.trim().toLowerCase().replace(/\\.+$/u, '');\n}\n\nexport function dedupeStable(values: readonly string[]): string[] {\n\tconst seenHostnames = new Set<string>();\n\tconst normalizedValues: string[] = [];\n\n\tfor (const value of values) {\n\t\tconst normalizedValue = normalizeHostname(value);\n\t\tif (normalizedValue.length === 0 \|\| normalizedValue.startsWith('#')) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!seenHostnames.has(normalizedValue)) {\n\t\t\tseenHostnames.add(normalizedValue);\n\t\t\tnormalizedValues.push(normalizedValue);\n\t\t}\n\t}\n\n\treturn normalizedValues;\n}\n\nexport function compilePolicy(sources: PolicySources): string[] {\n\treturn dedupeStable([...sources.base, ...sources.profile, ...sources.extra]);\n}\n","import { execFile } from 'node:child_process';\n\nimport { createClient } from '@1password/sdk';\n\nimport type { SecretRef } from './types.js';\n\nexport interface SecretResolverClient {\n\treadonly secrets: {\n\t\tresolve(secretReference: string): Promise<string>;\n\t\tresolveAll(secretReferences: readonly string[]): Promise<unknown>;\n\t};\n}\n\nexport interface SecretResolver {\n\tresolve(ref: SecretRef): Promise<string>;\n\tresolveAll(refs: Record<string, SecretRef>): Promise<Record<string, string>>;\n}\n\n// --- Token source: how to obtain the 1Password service account token ---\n\nexport type TokenSource =\n\t\| { readonly type: 'op-cli'; readonly ref: string }\n\t\| { readonly type: 'env'; readonly envVar?: string \| undefined }\n\t\| { readonly type: 'keychain'; readonly service: string; readonly account: string };\n\nexport interface ExecFileOptions {\n\treadonly env?: Readonly<Record<string, string \| undefined>>;\n}\n\nexport interface ExecFileResult {\n\treadonly stdout: string;\n\treadonly stderr: string;\n}\n\nfunction writeStderr(message: string): void {\n\tprocess.stderr.write(`${message}\\n`);\n}\n\nfunction ensureMacOsForKeychain(): void {\n\tif (process.platform !== 'darwin') {\n\t\tthrow new Error(\n\t\t\t'Keychain token source is only supported on macOS. Use an env or op-cli token source on this platform so cmd-ts can surface a clear startup error.',\n\t\t);\n\t}\n}\n\nfunction execFileAsync(\n\tcommand: string,\n\targs: readonly string[],\n\toptions?: ExecFileOptions,\n): Promise<ExecFileResult> {\n\treturn new Promise((resolve, reject) => {\n\t\texecFile(\n\t\t\tcommand,\n\t\t\t[...args],\n\t\t\t{ env: options?.env, timeout: 30_000 },\n\t\t\t(error, stdout, stderr) => {\n\t\t\t\tif (error) {\n\t\t\t\t\tconst errorMessage = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\t\t\treject(new Error(`${command} failed: ${stderr.trim() \|\| errorMessage}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tresolve({ stdout, stderr });\n\t\t\t},\n\t\t);\n\t});\n}\n\nconst SAFE_IDENTIFIER_PATTERN = /^[\\w.@-]+$/u;\n\nexport async function resolveServiceAccountToken(\n\tsource: TokenSource,\n\tdependencies?: {\n\t\treadonly execFileAsync?: (\n\t\t\tcommand: string,\n\t\t\targs: readonly string[],\n\t\t\toptions?: ExecFileOptions,\n\t\t) => Promise<ExecFileResult>;\n\t},\n): Promise<string> {\n\tconst exec = dependencies?.execFileAsync ?? execFileAsync;\n\n\tswitch (source.type) {\n\t\tcase 'op-cli': {\n\t\t\t// Uses `op read` which triggers biometric auth (Touch ID) on macOS\n\t\t\tconst result = await exec('op', ['read', source.ref]);\n\t\t\tconst token = result.stdout.trim();\n\t\t\tif (token.length === 0) {\n\t\t\t\tthrow new Error('op-cli token resolution returned empty value');\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\n\t\tcase 'env': {\n\t\t\tconst envVar = source.envVar ?? 'OP_SERVICE_ACCOUNT_TOKEN';\n\t\t\tconst token = process.env[envVar]?.trim();\n\t\t\tif (!token) {\n\t\t\t\tthrow new Error(`Environment variable ${envVar} is not set`);\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\n\t\tcase 'keychain': {\n\t\t\tensureMacOsForKeychain();\n\n\t\t\t// Validate keychain identifiers to prevent argument injection\n\t\t\tif (!SAFE_IDENTIFIER_PATTERN.test(source.service)) {\n\t\t\t\tthrow new Error('Keychain service name contains invalid characters');\n\t\t\t}\n\n\t\t\tif (!SAFE_IDENTIFIER_PATTERN.test(source.account)) {\n\t\t\t\tthrow new Error('Keychain account name contains invalid characters');\n\t\t\t}\n\n\t\t\t// macOS Keychain via `security find-generic-password`\n\t\t\tconst result = await exec('security', [\n\t\t\t\t'find-generic-password',\n\t\t\t\t'-s',\n\t\t\t\tsource.service,\n\t\t\t\t'-a',\n\t\t\t\tsource.account,\n\t\t\t\t'-w',\n\t\t\t]);\n\t\t\tconst token = result.stdout.trim();\n\t\t\tif (token.length === 0) {\n\t\t\t\tthrow new Error('Keychain token resolution returned empty value');\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\t\tdefault:\n\t\t\tthrow new Error(`Unsupported token source: ${JSON.stringify(source)}`);\n\t}\n}\n\n// --- Secret resolver: uses the token to resolve secrets via 1Password SDK ---\n\nexport interface CreateSecretResolverDependencies {\n\treadonly createClient?: (config: {\n\t\tauth: string;\n\t\tintegrationName: string;\n\t\tintegrationVersion: string;\n\t}) => Promise<SecretResolverClient>;\n\treadonly execFileAsync?: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>;\n\treadonly integrationName?: string;\n\treadonly integrationVersion?: string;\n}\n\nasync function resolveSecretWithOpCli(\n\tserviceAccountToken: string,\n\tsecretReference: string,\n\texec: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>,\n): Promise<string> {\n\tconst result = await exec('op', ['read', secretReference], {\n\t\tenv: {\n\t\t\t...process.env,\n\t\t\tOP_SERVICE_ACCOUNT_TOKEN: serviceAccountToken,\n\t\t},\n\t});\n\treturn result.stdout.trim();\n}\n\nasync function resolveAllSecretsWithOpCli(\n\tserviceAccountToken: string,\n\trefs: Record<string, SecretRef>,\n\texec: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>,\n): Promise<Record<string, string>> {\n\tconst resolvedSecrets: Record<string, string> = {};\n\n\tfor (const [secretName, secretRef] of Object.entries(refs)) {\n\t\t// Sequential resolution avoids concurrent `op read` failures with the same service account token.\n\t\t// oxlint-disable-next-line eslint/no-await-in-loop\n\t\tresolvedSecrets[secretName] = await resolveSecretWithOpCli(\n\t\t\tserviceAccountToken,\n\t\t\tsecretRef.ref,\n\t\t\texec,\n\t\t);\n\t}\n\n\treturn resolvedSecrets;\n}\n\nexport async function createSecretResolver(\n\toptions: {\n\t\treadonly serviceAccountToken: string;\n\t},\n\tdependencies: CreateSecretResolverDependencies = {},\n): Promise<SecretResolver> {\n\tconst exec = dependencies.execFileAsync ?? execFileAsync;\n\ttry {\n\t\tconst client = await (dependencies.createClient ?? createClient)({\n\t\t\tauth: options.serviceAccountToken,\n\t\t\tintegrationName: dependencies.integrationName ?? 'agent-vm',\n\t\t\tintegrationVersion: dependencies.integrationVersion ?? '0.0.1',\n\t\t});\n\n\t\treturn {\n\t\t\tresolve: async (ref: SecretRef): Promise<string> => {\n\t\t\t\ttry {\n\t\t\t\t\treturn await client.secrets.resolve(ref.ref);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\t\twriteStderr(\n\t\t\t\t\t\t`[secret-resolver] 1Password SDK resolve failed for ${ref.ref}; falling back to op CLI: ${message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn await resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec);\n\t\t\t\t}\n\t\t\t},\n\t\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> => {\n\t\t\t\tconst resolvedSecrets: Record<string, string> = {};\n\n\t\t\t\tfor (const [secretName, secretRef] of Object.entries(refs)) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop\n\t\t\t\t\t\tresolvedSecrets[secretName] = await client.secrets.resolve(secretRef.ref);\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\t\t\twriteStderr(\n\t\t\t\t\t\t\t`[secret-resolver] 1Password SDK resolve failed for ${secretRef.ref}; falling back to op CLI: ${message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\t// Sequential fallback avoids concurrent `op read` failures when the SDK path is unhealthy.\n\t\t\t\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop\n\t\t\t\t\t\tresolvedSecrets[secretName] = await resolveSecretWithOpCli(\n\t\t\t\t\t\t\toptions.serviceAccountToken,\n\t\t\t\t\t\t\tsecretRef.ref,\n\t\t\t\t\t\t\texec,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn resolvedSecrets;\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\twriteStderr(\n\t\t\t`[secret-resolver] 1Password SDK client creation failed; falling back to op CLI: ${message}`,\n\t\t);\n\t\treturn {\n\t\t\tresolve: async (ref: SecretRef): Promise<string> =>\n\t\t\t\tawait resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec),\n\t\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> =>\n\t\t\t\tawait resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec),\n\t\t};\n\t}\n}\n\nexport async function createOpCliSecretResolver(\n\toptions: {\n\t\treadonly serviceAccountToken: string;\n\t},\n\tdependencies: Pick<CreateSecretResolverDependencies, 'execFileAsync'> = {},\n): Promise<SecretResolver> {\n\tconst exec = dependencies.execFileAsync ?? execFileAsync;\n\n\treturn {\n\t\tresolve: async (ref: SecretRef): Promise<string> =>\n\t\t\tawait resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec),\n\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> =>\n\t\t\tawait resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec),\n\t};\n}\n","import {\n\tMemoryProvider,\n\tReadonlyProvider,\n\tRealFSProvider,\n\tShadowProvider,\n\tVM,\n\tcreateHttpHooks,\n\tcreateShadowPathPredicate,\n\ttype CreateHttpHooksResult,\n\ttype EnableIngressOptions,\n\ttype EnableSshOptions,\n\ttype IngressRoute as GondolinIngressRoute,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype VMOptions,\n\ttype VirtualProvider,\n} from '@earendil-works/gondolin';\n\nimport {\n\tclosePinnedRealFsRoot,\n\tcreatePinnedRealFsProvider,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\nimport type { SecretSpec } from './types.js';\n\nexport const SYNTHETIC_DNS_IPV4_BENCHMARK = '198.18.0.1';\nexport const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = '::ffff:198.18.0.1';\n\nexport interface ExecResult {\n\treadonly exitCode: number;\n\treadonly stdout: string;\n\treadonly stderr: string;\n}\n\nexport type IngressRoute = GondolinIngressRoute;\n\nexport interface SshAccess {\n\treadonly host: string;\n\treadonly command?: string;\n\treadonly identityFile?: string;\n\treadonly port: number;\n\treadonly user?: string;\n}\n\nexport interface IngressAccess {\n\treadonly host: string;\n\treadonly port: number;\n}\n\nexport interface ManagedVmInstance {\n\treadonly id: string;\n\texec(command: string): Promise<{\n\t\treadonly exitCode: number;\n\t\treadonly stdout?: string;\n\t\treadonly stderr?: string;\n\t}>;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tclose(): Promise<void>;\n}\n\nexport interface ManagedVmDependencies {\n\tcreateVm(vmOptions: VMOptions): Promise<ManagedVmInstance>;\n\tcreateHttpHooks(options: {\n\t\treadonly allowedHosts: readonly string[];\n\t\treadonly secrets: Record<string, SecretSpec>;\n\t\treadonly onRequest?: (request: Request) => Promise<Request \| Response \| void>;\n\t\treadonly onResponse?: (response: Response) => Promise<Response \| void>;\n\t}): Pick<CreateHttpHooksResult, 'env' \| 'httpHooks'>;\n\tclosePinnedRealFsRoot(root: PinnedRealFsRoot): void;\n\tcreatePinnedRealFsProvider(root: PinnedRealFsRoot): VirtualProvider;\n\tcreateRealFsProvider(hostPath: string): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n}\n\nexport interface VfsMountSpec {\n\treadonly kind: 'realfs' \| 'realfs-readonly' \| 'memory' \| 'shadow';\n\treadonly hostPath?: string;\n\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n\treadonly shadowConfig?: {\n\t\treadonly deny: readonly string[];\n\t\treadonly tmpfs: readonly string[];\n\t};\n}\n\nexport interface CreateVmOptions {\n\treadonly imagePath: string;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly rootfsMode: 'readonly' \| 'memory' \| 'cow';\n\treadonly allowedHosts: readonly string[];\n\treadonly secrets: Record<string, SecretSpec>;\n\treadonly vfsMounts: Record<string, VfsMountSpec>;\n\treadonly tcpHosts?: Record<string, string>;\n\treadonly env?: Record<string, string>;\n\treadonly sessionLabel?: string;\n\treadonly onRequest?: (request: Request) => Promise<Request \| Response \| void>;\n\treadonly onResponse?: (response: Response) => Promise<Response \| void>;\n}\n\nexport interface ManagedVm {\n\treadonly id: string;\n\texec(command: string): Promise<ExecResult>;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tgetVmInstance(): ManagedVmInstance;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tclose(): Promise<void>;\n}\n\n/ oxlint-disable typescript-eslint/no-unsafe-type-assertion -- VM.create() returns\n Gondolin's concrete VM class; this adapter exposes only the narrower\n ManagedVmInstance interface used by agent-vm. /\nfunction createDefaultDependencies(): ManagedVmDependencies {\n\tconst createDefaultRealFsProvider = (hostPath: string): VirtualProvider =>\n\t\tnew RealFSProvider(hostPath);\n\treturn {\n\t\tcreateVm: async (vmOptions: VMOptions): Promise<ManagedVmInstance> =>\n\t\t\t(await VM.create(vmOptions)) as unknown as ManagedVmInstance,\n\t\tcreateHttpHooks: (hookOptions) =>\n\t\t\tcreateHttpHooks({\n\t\t\t\tallowedHosts: [...hookOptions.allowedHosts],\n\t\t\t\tsecrets: Object.fromEntries(\n\t\t\t\t\tObject.entries(hookOptions.secrets).map(([secretName, secretSpec]) => [\n\t\t\t\t\t\tsecretName,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secretSpec.hosts],\n\t\t\t\t\t\t\tvalue: secretSpec.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t),\n\t\t\t\t...(hookOptions.onRequest ? { onRequest: hookOptions.onRequest } : {}),\n\t\t\t\t...(hookOptions.onResponse ? { onResponse: hookOptions.onResponse } : {}),\n\t\t\t}),\n\t\tclosePinnedRealFsRoot,\n\t\tcreatePinnedRealFsProvider: (root: PinnedRealFsRoot): VirtualProvider =>\n\t\t\tcreatePinnedRealFsProvider({\n\t\t\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\t\t\troot,\n\t\t\t}),\n\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\tcreateReadonlyProvider: (provider: VirtualProvider): VirtualProvider =>\n\t\t\tnew ReadonlyProvider(provider),\n\t\tcreateMemoryProvider: (): VirtualProvider => new MemoryProvider(),\n\t\tcreateShadowProvider: (\n\t\t\tprovider: VirtualProvider,\n\t\t\tshadowOptions: ShadowProviderOptions,\n\t\t): VirtualProvider => new ShadowProvider(provider, shadowOptions),\n\t\tcreateShadowPathPredicate: (paths: readonly string[]): ShadowPredicate =>\n\t\t\tcreateShadowPathPredicate([...paths]),\n\t};\n}\n/ oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n\nfunction normalizeShadowPath(pathValue: string): string {\n\tconst trimmedPath = pathValue.trim();\n\tif (trimmedPath.startsWith('/')) {\n\t\treturn trimmedPath;\n\t}\n\n\tconst relativePath = trimmedPath.startsWith('./') ? trimmedPath.slice('./'.length) : trimmedPath;\n\treturn `/${relativePath}`;\n}\n\nfunction createRealFsProviderForSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n\tmountKind: string,\n): VirtualProvider {\n\tif (mountSpec.pinnedHostRoot) {\n\t\treturn dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot);\n\t}\n\tif (mountSpec.hostPath) {\n\t\treturn dependencies.createRealFsProvider(mountSpec.hostPath);\n\t}\n\n\tthrow new Error(`${mountKind} mounts require hostPath or pinnedHostRoot`);\n}\n\nfunction createProviderFromSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n): VirtualProvider {\n\tswitch (mountSpec.kind) {\n\t\tcase 'memory':\n\t\t\treturn dependencies.createMemoryProvider();\n\t\tcase 'realfs': {\n\t\t\treturn createRealFsProviderForSpec(mountSpec, dependencies, 'realfs');\n\t\t}\n\t\tcase 'realfs-readonly': {\n\t\t\treturn dependencies.createReadonlyProvider(\n\t\t\t\tcreateRealFsProviderForSpec(mountSpec, dependencies, 'realfs-readonly'),\n\t\t\t);\n\t\t}\n\t\tcase 'shadow': {\n\t\t\tconst baseProvider =\n\t\t\t\tmountSpec.hostPath \|\| mountSpec.pinnedHostRoot\n\t\t\t\t\t? createRealFsProviderForSpec(mountSpec, dependencies, 'shadow')\n\t\t\t\t\t: dependencies.createMemoryProvider();\n\n\t\t\tlet shadowProvider = baseProvider;\n\t\t\tconst shadowConfig = mountSpec.shadowConfig;\n\n\t\t\tif (shadowConfig?.deny.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.deny.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'deny',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (shadowConfig?.tmpfs.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.tmpfs.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'tmpfs',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn shadowProvider;\n\t\t}\n\t\tdefault: {\n\t\t\tthrow new Error(`Unsupported VFS mount kind: ${String(mountSpec.kind)}`);\n\t\t}\n\t}\n}\n\nfunction createVfsMounts(\n\tvfsMounts: Record<string, VfsMountSpec>,\n\tdependencies: ManagedVmDependencies,\n): Record<string, VirtualProvider> {\n\tconst mountMap: Record<string, VirtualProvider> = {};\n\n\tfor (const [guestPath, mountSpec] of Object.entries(vfsMounts)) {\n\t\tmountMap[guestPath] = createProviderFromSpec(mountSpec, dependencies);\n\t}\n\n\treturn mountMap;\n}\n\nfunction collectPinnedRealFsRoots(\n\tvfsMounts: Record<string, VfsMountSpec>,\n): readonly PinnedRealFsRoot[] {\n\tconst roots = new Map<number, PinnedRealFsRoot>();\n\tfor (const mountSpec of Object.values(vfsMounts)) {\n\t\tif (mountSpec.pinnedHostRoot) {\n\t\t\troots.set(mountSpec.pinnedHostRoot.fd, mountSpec.pinnedHostRoot);\n\t\t}\n\t}\n\treturn [...roots.values()];\n}\n\nfunction closePinnedRealFsRoots(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\tfor (const root of roots) {\n\t\tdependencies.closePinnedRealFsRoot(root);\n\t}\n}\n\nfunction closePinnedRealFsRootsAfterFailure(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\ttry {\n\t\tclosePinnedRealFsRoots(roots, dependencies);\n\t} catch {\n\t\t// Preserve the VM creation failure; leaked-fd risk is lower than hiding\n\t\t// the root cause of a failed lease.\n\t}\n}\n\nexport async function createManagedVm(\n\toptions: CreateVmOptions,\n\tdependencies: ManagedVmDependencies = createDefaultDependencies(),\n): Promise<ManagedVm> {\n\tconst hasTcpHosts = options.tcpHosts && Object.keys(options.tcpHosts).length > 0;\n\tconst pinnedRealFsRoots = collectPinnedRealFsRoots(options.vfsMounts);\n\tlet vmInstance: ManagedVmInstance;\n\ttry {\n\t\tconst hookBundle = dependencies.createHttpHooks({\n\t\t\tallowedHosts: options.allowedHosts,\n\t\t\tsecrets: options.secrets,\n\t\t\t...(options.onRequest ? { onRequest: options.onRequest } : {}),\n\t\t\t...(options.onResponse ? { onResponse: options.onResponse } : {}),\n\t\t});\n\t\tvmInstance = await dependencies.createVm({\n\t\t\t...(options.imagePath.length > 0 ? { sandbox: { imagePath: options.imagePath } } : {}),\n\t\t\t...(options.sessionLabel ? { sessionLabel: options.sessionLabel } : {}),\n\t\t\trootfs: {\n\t\t\t\tmode: options.rootfsMode,\n\t\t\t},\n\t\t\tmemory: options.memory,\n\t\t\tcpus: options.cpus,\n\t\t\tenv: {\n\t\t\t\t...hookBundle.env,\n\t\t\t\t...options.env,\n\t\t\t},\n\t\t\thttpHooks: hookBundle.httpHooks,\n\t\t\tvfs: {\n\t\t\t\tfuseMount: '/data',\n\t\t\t\tmounts: createVfsMounts(options.vfsMounts, dependencies),\n\t\t\t},\n\t\t\t...(hasTcpHosts\n\t\t\t\t? {\n\t\t\t\t\t\tdns: {\n\t\t\t\t\t\t\tmode: 'synthetic',\n\t\t\t\t\t\t\tsyntheticIPv4: SYNTHETIC_DNS_IPV4_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticIPv6: SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticHostMapping: 'per-host',\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttcp: {\n\t\t\t\t\t\t\thosts: options.tcpHosts,\n\t\t\t\t\t\t},\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t});\n\t} catch (error) {\n\t\tclosePinnedRealFsRootsAfterFailure(pinnedRealFsRoots, dependencies);\n\t\tthrow error;\n\t}\n\n\treturn {\n\t\tid: vmInstance.id,\n\t\tasync exec(command: string): Promise<ExecResult> {\n\t\t\tconst executionResult = await vmInstance.exec(command);\n\t\t\treturn {\n\t\t\t\texitCode: executionResult.exitCode,\n\t\t\t\tstdout: executionResult.stdout ?? '',\n\t\t\t\tstderr: executionResult.stderr ?? '',\n\t\t\t};\n\t\t},\n\t\tasync enableSsh(sshOptions?: EnableSshOptions): Promise<SshAccess> {\n\t\t\treturn await vmInstance.enableSsh(sshOptions);\n\t\t},\n\t\tasync enableIngress(ingressOptions?: EnableIngressOptions): Promise<IngressAccess> {\n\t\t\treturn await vmInstance.enableIngress(ingressOptions);\n\t\t},\n\t\tgetVmInstance(): ManagedVmInstance {\n\t\t\treturn vmInstance;\n\t\t},\n\t\tsetIngressRoutes(routes: readonly IngressRoute[]): void {\n\t\t\tvmInstance.setIngressRoutes(routes);\n\t\t},\n\t\tasync close(): Promise<void> {\n\t\t\tlet closeError: unknown;\n\t\t\ttry {\n\t\t\t\tawait vmInstance.close();\n\t\t\t} catch (error) {\n\t\t\t\tcloseError = error;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tclosePinnedRealFsRoots(pinnedRealFsRoots, dependencies);\n\t\t\t} catch (error) {\n\t\t\t\tcloseError ??= error;\n\t\t\t}\n\t\t\tif (closeError !== undefined) {\n\t\t\t\tthrow closeError;\n\t\t\t}\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nexport interface VolumeConfigEntry {\n\treadonly guestPath: string;\n}\n\nexport interface ResolvedVolume {\n\treadonly hostDir: string;\n\treadonly guestPath: string;\n}\n\nexport async function ensureVolumeDir(\n\tcacheBase: string,\n\tworkspaceHash: string,\n\tvolumeName: string,\n): Promise<string> {\n\tconst volumeDirectory = path.join(cacheBase, workspaceHash, volumeName);\n\tawait fs.mkdir(volumeDirectory, { recursive: true });\n\treturn volumeDirectory;\n}\n\nexport async function resolveVolumeDirs(\n\tcacheBase: string,\n\tworkspaceHash: string,\n\tvolumes: Readonly<Record<string, VolumeConfigEntry>>,\n): Promise<Record<string, ResolvedVolume>> {\n\tconst resolvedVolumeEntries = await Promise.all(\n\t\tObject.entries(volumes).map(\n\t\t\tasync ([volumeName, volumeConfig]) =>\n\t\t\t\t[\n\t\t\t\t\tvolumeName,\n\t\t\t\t\t{\n\t\t\t\t\t\tguestPath: volumeConfig.guestPath,\n\t\t\t\t\t\thostDir: await ensureVolumeDir(cacheBase, workspaceHash, volumeName),\n\t\t\t\t\t},\n\t\t\t\t] satisfies readonly [string, ResolvedVolume],\n\t\t),\n\t);\n\n\treturn Object.fromEntries(resolvedVolumeEntries);\n}\n","import fs from 'node:fs/promises';\n\nexport async function writeFileAtomically(\n\tfilePath: string,\n\tcontent: string,\n\toptions: {\n\t\treadonly mode?: number;\n\t} = {},\n): Promise<void> {\n\tconst temporaryFilePath = `${filePath}.${process.pid}.${Date.now()}.tmp`;\n\tawait fs.writeFile(temporaryFilePath, content, {\n\t\tencoding: 'utf8',\n\t\t...(options.mode ? { mode: options.mode } : {}),\n\t});\n\ttry {\n\t\tawait fs.rename(temporaryFilePath, filePath);\n\t} catch (renameError) {\n\t\ttry {\n\t\t\tawait fs.rm(temporaryFilePath, { force: true });\n\t\t} catch (cleanupError) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to replace '${filePath}' (${renameError instanceof Error ? renameError.message : JSON.stringify(renameError)}) and failed to remove temporary file '${temporaryFilePath}': ${cleanupError instanceof Error ? cleanupError.message : JSON.stringify(cleanupError)}`,\n\t\t\t\t{ cause: cleanupError },\n\t\t\t);\n\t\t}\n\t\tthrow renameError;\n\t}\n}\n"],"mappings":";;;;;;;;;;AAKA,MAAa,+BAA+B;;;;;;;;;;;AA+B5C,SAAS,uBAAuB,UAAkB,WAAuC;CACxF,OAAO,KAAK,WAAW,SAAS,GAAG,WAAW,KAAK,QAAQ,aAAa,QAAQ,KAAK,EAAE,SAAS;;AAGjG,eAAe,4BACd,aACA,WAC8B;CAC9B,MAAM,0BAA0B,YAAY,MAAM;CAClD,IAAI,CAAC,yBACJ;CAGD,MAAM,0BAA0B,uBAAuB,yBAAyB,UAAU;CAC1F,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,yBAAyB,OAAO;UACjD,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;EACtE,MAAM,IAAI,MACT,8CAA8C,wBAAwB,KAAK,WAC3E,EAAE,OAAO,OAAO,CAChB;;;AAIH,SAAS,uBAAuB,yBAAqD;CACpF,OAAO,0BACJ,GAAG,6BAA6B,SAAS,CAAC,MAAM,4BAChD;;AAGJ,eAAsB,uBACrB,SACmC;CACnC,MAAM,0BAA0B,MAAM,4BACrC,QAAQ,aACR,QAAQ,UACR;CAED,OAAO;EACN,SAAS,uBAAuB,wBAAwB;EACxD,kBAAkB;GACjB,wBAAwB;GACxB,GAAI,4BAA4B,KAAA,IAC7B,EAAE,GACF,EAAE,2BAA2B,yBAAyB;GACzD;EACD;;AAGF,eAAsB,6CACrB,SACuB;CACvB,MAAM,sBAAsB,KAAK,KAAK,QAAQ,WAAW,gCAAgC;CAEzF,MAAM,GAAG,UAAU,qBAAqB,QAAQ,wBAAwB;EACvE,UAAU;EACV,MAAM;EACN,CAAC;CAEF,OAAO;EACN,GAAG,QAAQ;EACX,MAAM;GACL,GAAG,QAAQ,YAAY;GACvB,iBAAiB;GACjB;EACD;;;;ACpEF,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;AAWD,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,gBAAgB,OAAwB;CAChD,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,IAAI,MAAM,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;CAGnE,IAAI,SAAS,MAAM,EAIlB,OAAO,IAHe,OAAO,QAAQ,MAAM,CACzC,QAAQ,GAAG,gBAAgB,eAAe,KAAA,EAAU,CACpD,UAAU,CAAC,UAAU,CAAC,cAAc,QAAQ,cAAc,SAAS,CAC7C,CACtB,KAAK,CAAC,UAAU,gBAAgB,GAAG,KAAK,UAAU,SAAS,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC7F,KAAK,IAAI,CAAC;CAGb,OAAO,KAAK,UAAU,MAAM;;AAG7B,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,eAAe,WAAW,UAAoC;CAC7D,IAAI;EACH,MAAM,GAAG,OAAO,SAAS;EACzB,OAAO;UACC,OAAO;EACf,IAAI,CAAC,mBAAmB,MAAM,EAC7B,MAAM;EAEP,OAAO;;;AAIT,eAAsB,oBAAoB,qBAA+C;CACxF,KAAK,MAAM,YAAY,0BAEtB,IAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,SAAS,CAAC,EAC/D,OAAO;CAGT,OAAO;;AAGR,eAAe,kBAEb;CACD,MAAM,iBAAiB,MAAM,OAAO;CACpC,OAAO,OACN,aACA,iBACA,cAEA,MAAM,eAAe,YAAY,aAAa;EAC7C,WAAW;EACX,SAAS;EACT,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;EAClC,CAAwB;;AAG3B,SAAS,sBAAsB,QAAkD;CAChF,SACC,OACA,oBACA,aACa;EACb,MAAM,gBAAgB,OAAO,uBAAuB,aAAa,qBAAqB;EACtF,MAAM,QAAQ,OAAO,MAAM,MAAM;EACjC,iBAAiB;EACjB,OAAO;;;AAIT,eAAe,wBACd,QACA,IACmB;CACnB,IAAI,CAAC,QACJ,OAAO,MAAM,IAAI;CAGlB,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,aAAa,QAAQ,IAAI;CAC/B,MAAM,kBAAkB,sBAAsB,OAAO;CAErD,QAAQ,OAAO,QAAQ;CACvB,QAAQ,OAAO,QAAQ;CACvB,QAAQ,IAAI,KAAK;CAEjB,IAAI;EACH,OAAO,MAAM,IAAI;WACR;EACT,QAAQ,OAAO,QAAQ;EACvB,QAAQ,OAAO,QAAQ;EACvB,IAAI,eAAe,KAAA,GAClB,OAAO,QAAQ,IAAI;OAEnB,QAAQ,IAAI,KAAK;;;AAKpB,SAAgB,wBACf,aACA,kBAA0B,WAC1B,kBACS;CACT,MAAM,UACL,qBAAqB,KAAA,IAClB,GAAG,gBAAgB,YAAY,CAAC,GAAG,oBACnC,GAAG,gBAAgB,YAAY,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,iBAAiB;CAE3F,OAAO,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,eAAsB,iCAAiC,SAQpD;CACF,MAAM,0BAA0B,MAAM,uBAAuB;EAC5D,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,CAAC;CAQF,OAAO;EACN,aARmB,wBAAwB,QAAQ,aAAa,QAAQ,iBAAiB;GACzF,wBAAwB,wBAAwB;GAChD,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,wBAAwB,QAAQ,kBAAkB;GACvD,CAGW;EACX,wBAAwB,wBAAwB;EAChD;;AAGF,eAAsB,WACrB,SACA,eAA0C,EAAE,EAChB;CAC5B,MAAM,4BAA4B,MAAM,iCAAiC;EACxE,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,kBAAkB,QAAQ,kBAAkB;EACjD,GAAI,aAAa,kBAAkB,EAAE,iBAAiB,aAAa,iBAAiB,GAAG,EAAE;EACzF,CAAC;CACF,MAAM,cAAc,0BAA0B;CAC9C,MAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,YAAY;CAE1D,IAAI,QAAQ,WACX,MAAM,GAAG,GAAG,WAAW;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC;CAGzD,IAAI,MAAM,oBAAoB,UAAU,EACvC,OAAO;EACN,OAAO;EACP;EACA;EACA;CAGF,MAAM,GAAG,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;CAC9C,MAAM,4BAA4B,aAAa,eAAgB,MAAM,iBAAiB;CACtF,MAAM,uBAAuB,MAAM,6CAA6C;EAC/E,aAAa,QAAQ;EACrB;EACA,wBAAwB,0BAA0B;EAClD,CAAC;CACF,MAAM,wBAAwB,QAAQ,QAAQ,YAAY;EACzD,MAAM,0BAA0B,sBAAsB,WAAW,QAAQ,UAAU;GAClF;CAEF,IAAI,CAAE,MAAM,oBAAoB,UAAU,EACzC,MAAM,IAAI,MAAM,6CAA6C,UAAU,GAAG;CAG3E,OAAO;EACN,OAAO;EACP;EACA;EACA;;;;AC3OF,MAAM,kBAAkB,cAAc,OAAO,KAAK,IAAI;AAEtD,MAAM,4BAA4B,EAAE,OAAO,EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC;AAEF,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,SAAS,gBAAgB,OAAwB;CAChD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAgB,uBAAuB,aAA6B;CACnE,MAAM,QAAQ,YAAY,MAAM,yCAAyC;CACzE,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,uGACA;CAGF,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,gCAAgC;CAEjD,OAAO;;AAGR,SAAgB,iCAAyC;CACxD,OAAO,gBAAgB,QAAQ,wCAAwC;;AAGxE,eAAsB,6BAA8C;CACnE,MAAM,kBAAkB,gCAAgC;CACxD,MAAM,SAAkB,KAAK,MAAM,MAAM,GAAG,SAAS,iBAAiB,OAAO,CAAC;CAE9E,OAAO,4BADa,0BAA0B,MAAM,OACN,CAAC;;AAOhD,eAAe,gCAAiD;CAC/D,MAAM,kBAAkB,gCAAgC;CACxD,OAAO,KAAK,KAAK,KAAK,QAAQ,gBAAgB,EAAE,QAAQ,SAAS,gBAAgB;;AAGlF,eAAsB,iCACrB,UAAmD,EAAE,EACnC;CAClB,MAAM,UAAU,QAAQ,mBAAoB,MAAM,+BAA+B;CACjF,IAAI;CACJ,IAAI;EACH,cAAc,MAAM,GAAG,SAAS,SAAS,OAAO;UACxC,OAAO;EACf,IAAI,mBAAmB,MAAM,EAC5B,MAAM,IAAI,MAAM,sCAAsC,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC;EAErF,MAAM,IAAI,MACT,6CAA6C,QAAQ,KAAK,gBAAgB,MAAM,IAChF,EAAE,OAAO,OAAO,CAChB;;CAGF,IAAI;EACH,OAAO,uBAAuB,YAAY;UAClC,OAAO;EACf,MAAM,IAAI,MACT,8CAA8C,QAAQ,KAAK,gBAAgB,MAAM,IACjF,EAAE,OAAO,OAAO,CAChB;;;;;AC3EH,MAAM,2BAA2B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAYD,SAAS,wBAAwB,UAAqC;CACrE,OAAO;EACN,KAAK,KAAK,UAAU,OAAO;EAC3B,KAAK,KAAK,UAAU,UAAU;EAC9B,KAAK,KAAK,UAAU,SAAS;EAC7B,KAAK,KAAK,UAAU,UAAU;EAC9B;;AAGF,SAAgB,sBAAsB,WAAmB,SAAyB;CACjF,IAAI,KAAK,WAAW,UAAU,EAC7B,OAAO,KAAK,QAAQ,UAAU;CAG/B,OAAO,KAAK,QAAQ,SAAS,UAAU;;AAGxC,SAAS,mBAAmB,eAAuB,YAA6B;CAC/E,MAAM,eAAe,KAAK,SAAS,YAAY,cAAc;CAC7D,OAAO,iBAAiB,MAAO,CAAC,aAAa,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW,aAAa;;AAGhG,eAAe,kBAAkB,UAAmC;CACnE,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAE/C,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,iBAAiB;SACnC;EACP,OAAO;;;AAIT,SAAS,aAAa,eAAuB,eAAgC;CAC5E,OACC,mBAAmB,eAAe,cAAc,IAChD,mBAAmB,eAAe,cAAc;;AAIlD,SAAgB,sBACf,WACA,QACA,SACO;CACP,MAAM,oBAAoB,sBAAsB,WAAW,QAAQ,QAAQ;CAC3E,MAAM,0BAA0B,OAAO,6BAA6B,KAAK,kBACxE,sBAAsB,eAAe,QAAQ,QAAQ,CACrD;CAKD,IAAI,CAHuB,wBAAwB,MAAM,kBACxD,mBAAmB,mBAAmB,cAAc,CAE9B,EACtB,MAAM,IAAI,MACT,8BAA8B,kBAAkB,mCAAmC,wBAAwB,KAAK,KAAK,CAAC,IACtH;CAGF,IAAI,CAAC,OAAO;MACuB,yBAAyB,MAAM,eAChE,mBAAmB,mBAAmB,WAAW,CAErB,EAC5B,MAAM,IAAI,MACT,8BAA8B,kBAAkB,4FAChD;;;AAKJ,eAAsB,2BACrB,QACA,SACgB;CAChB,MAAM,eAAe,OAAO,QAAQ,OAAO,YAAY;CACvD,KAAK,MAAM,CAAC,cAAc,cACzB,sBAAsB,WAAW,OAAO,eAAe,QAAQ;CAGhE,IAAI,OAAO,cAAc,gBACxB;CAGD,MAAM,2BAA2B,aAAa,QAAQ,GAAG,cAAc,KAAK,WAAW,SAAS,CAAC;CACjG,MAAM,CAAC,oBAAoB,qBAAqB,MAAM,QAAQ,IAAI,CACjE,QAAQ,IACP,wBAAwB,QAAQ,SAAS,CAAC,IACzC,OAAO,mBAAmB,MAAM,kBAAkB,eAAe,CACjE,CACD,EACD,QAAQ,IACP,yBAAyB,IAAI,OAAO,GAAG,cAAc,MAAM,kBAAkB,SAAS,CAAC,CACvF,CACD,CAAC;CAEF,KAAK,MAAM,4BAA4B,mBAKtC,IAJkC,mBAAmB,MAAM,mBAC1D,aAAa,0BAA0B,eAAe,CAG1B,EAC5B,MAAM,IAAI,MACT,uBAAuB,yBAAyB,gGAChD;;;;AC9GJ,SAAS,mBAAmB,MAAgC;CAC3D,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK;;AAG/B,SAAS,sBAAsB,eAA+B;CAC7D,OAAOA,KAAG,SACT,eACAA,KAAG,UAAU,WAAWA,KAAG,UAAU,cAAcA,KAAG,UAAU,WAChE;;AAGF,SAAgB,cAAc,UAAoC;CACjE,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,SAAS,EAC1C,MAAM,IAAI,MAAM,yDAAyD,WAAW;CAGrF,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAC/C,MAAM,KAAK,sBAAsB,iBAAiB;CAClD,IAAI;EACH,MAAM,QAAQA,KAAG,UAAU,GAAG;EAC9B,IAAI,CAAC,MAAM,aAAa,EACvB,MAAM,IAAI,MAAM,0CAA0C,mBAAmB;EAE9E,MAAM,WAAWA,KAAG,aAAa,iBAAiB;EAClD,MAAM,gBAAgBA,KAAG,SAAS,SAAS;EAC3C,IAAI,cAAc,QAAQ,MAAM,OAAO,cAAc,QAAQ,MAAM,KAClE,MAAM,IAAI,MACT,6CAA6C,iBAAiB,UAAU,MAAM,IAAI,GAAG,MAAM,IAAI,mBAAmB,cAAc,IAAI,GAAG,cAAc,MACrJ;EAEF,OAAO;GACN,QAAQ,MAAM;GACd;GACA,UAAU;GACV,OAAO,MAAM;GACb;GACA;UACO,OAAO;EACf,KAAG,UAAU,GAAG;EAChB,MAAM;;;AAIR,SAAgB,sBAAsB,MAA8B;CACnE,KAAG,UAAU,KAAK,GAAG;;AAGtB,SAAgB,uBAAuB,MAA8B;CACpE,MAAM,cAAcA,KAAG,UAAU,KAAK,GAAG;CACzC,MAAM,eAAeA,KAAG,SAAS,KAAK,SAAS;CAC/C,IACC,YAAY,QAAQ,KAAK,UACzB,YAAY,QAAQ,KAAK,SACzB,aAAa,QAAQ,KAAK,UAC1B,aAAa,QAAQ,KAAK,OAE1B,MAAM,IAAI,MACT,mDAAmD,KAAK,SAAS,YAAY,mBAAmB,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,aAAa,MAC9I;;AAUH,SAAgB,2BACf,SACkB;CAClB,uBAAuB,QAAQ,KAAK;CACpC,MAAM,WAAW,QAAQ,qBAAqB,QAAQ,KAAK,SAAS;CAEpE,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,OAAO,UAAU,YACpB,OAAO;EAGR,QAAQ,GAAG,oBAAiD;GAC3D,uBAAuB,QAAQ,KAAK;GACpC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;IAGxE,CAAC;;;;AClGH,SAAgB,kBAAkB,aAA6B;CAC9D,OAAO,YAAY,MAAM,CAAC,aAAa,CAAC,QAAQ,SAAS,GAAG;;AAG7D,SAAgB,aAAa,QAAqC;CACjE,MAAM,gCAAgB,IAAI,KAAa;CACvC,MAAM,mBAA6B,EAAE;CAErC,KAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,kBAAkB,kBAAkB,MAAM;EAChD,IAAI,gBAAgB,WAAW,KAAK,gBAAgB,WAAW,IAAI,EAClE;EAGD,IAAI,CAAC,cAAc,IAAI,gBAAgB,EAAE;GACxC,cAAc,IAAI,gBAAgB;GAClC,iBAAiB,KAAK,gBAAgB;;;CAIxC,OAAO;;AAGR,SAAgB,cAAc,SAAkC;CAC/D,OAAO,aAAa;EAAC,GAAG,QAAQ;EAAM,GAAG,QAAQ;EAAS,GAAG,QAAQ;EAAM,CAAC;;;;ACI7E,SAAS,YAAY,SAAuB;CAC3C,QAAQ,OAAO,MAAM,GAAG,QAAQ,IAAI;;AAGrC,SAAS,yBAA+B;CACvC,IAAI,QAAQ,aAAa,UACxB,MAAM,IAAI,MACT,oJACA;;AAIH,SAAS,cACR,SACA,MACA,SAC0B;CAC1B,OAAO,IAAI,SAAS,SAAS,WAAW;EACvC,SACC,SACA,CAAC,GAAG,KAAK,EACT;GAAE,KAAK,SAAS;GAAK,SAAS;GAAQ,GACrC,OAAO,QAAQ,WAAW;GAC1B,IAAI,OAAO;IACV,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;IACnF,uBAAO,IAAI,MAAM,GAAG,QAAQ,WAAW,OAAO,MAAM,IAAI,eAAe,CAAC;IACxE;;GAGD,QAAQ;IAAE;IAAQ;IAAQ,CAAC;IAE5B;GACA;;AAGH,MAAM,0BAA0B;AAEhC,eAAsB,2BACrB,QACA,cAOkB;CAClB,MAAM,OAAO,cAAc,iBAAiB;CAE5C,QAAQ,OAAO,MAAf;EACC,KAAK,UAAU;GAGd,MAAM,SAAQ,MADO,KAAK,MAAM,CAAC,QAAQ,OAAO,IAAI,CAAC,EAChC,OAAO,MAAM;GAClC,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,MAAM,+CAA+C;GAGhE,OAAO;;EAGR,KAAK,OAAO;GACX,MAAM,SAAS,OAAO,UAAU;GAChC,MAAM,QAAQ,QAAQ,IAAI,SAAS,MAAM;GACzC,IAAI,CAAC,OACJ,MAAM,IAAI,MAAM,wBAAwB,OAAO,aAAa;GAG7D,OAAO;;EAGR,KAAK,YAAY;GAChB,wBAAwB;GAGxB,IAAI,CAAC,wBAAwB,KAAK,OAAO,QAAQ,EAChD,MAAM,IAAI,MAAM,oDAAoD;GAGrE,IAAI,CAAC,wBAAwB,KAAK,OAAO,QAAQ,EAChD,MAAM,IAAI,MAAM,oDAAoD;GAYrE,MAAM,SAAQ,MARO,KAAK,YAAY;IACrC;IACA;IACA,OAAO;IACP;IACA,OAAO;IACP;IACA,CAAC,EACmB,OAAO,MAAM;GAClC,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,MAAM,iDAAiD;GAGlE,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,6BAA6B,KAAK,UAAU,OAAO,GAAG;;;AAqBzE,eAAe,uBACd,qBACA,iBACA,MAKkB;CAOlB,QAAO,MANc,KAAK,MAAM,CAAC,QAAQ,gBAAgB,EAAE,EAC1D,KAAK;EACJ,GAAG,QAAQ;EACX,0BAA0B;EAC1B,EACD,CAAC,EACY,OAAO,MAAM;;AAG5B,eAAe,2BACd,qBACA,MACA,MAKkC;CAClC,MAAM,kBAA0C,EAAE;CAElD,KAAK,MAAM,CAAC,YAAY,cAAc,OAAO,QAAQ,KAAK,EAGzD,gBAAgB,cAAc,MAAM,uBACnC,qBACA,UAAU,KACV,KACA;CAGF,OAAO;;AAGR,eAAsB,qBACrB,SAGA,eAAiD,EAAE,EACzB;CAC1B,MAAM,OAAO,aAAa,iBAAiB;CAC3C,IAAI;EACH,MAAM,SAAS,OAAO,aAAa,gBAAgB,cAAc;GAChE,MAAM,QAAQ;GACd,iBAAiB,aAAa,mBAAmB;GACjD,oBAAoB,aAAa,sBAAsB;GACvD,CAAC;EAEF,OAAO;GACN,SAAS,OAAO,QAAoC;IACnD,IAAI;KACH,OAAO,MAAM,OAAO,QAAQ,QAAQ,IAAI,IAAI;aACpC,OAAO;KACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KACtE,YACC,sDAAsD,IAAI,IAAI,4BAA4B,UAC1F;KACD,OAAO,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;;;GAGjF,YAAY,OAAO,SAAqE;IACvF,MAAM,kBAA0C,EAAE;IAElD,KAAK,MAAM,CAAC,YAAY,cAAc,OAAO,QAAQ,KAAK,EACzD,IAAI;KAEH,gBAAgB,cAAc,MAAM,OAAO,QAAQ,QAAQ,UAAU,IAAI;aACjE,OAAO;KACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KACtE,YACC,sDAAsD,UAAU,IAAI,4BAA4B,UAChG;KAGD,gBAAgB,cAAc,MAAM,uBACnC,QAAQ,qBACR,UAAU,KACV,KACA;;IAIH,OAAO;;GAER;UACO,OAAO;EAEf,YACC,mFAFe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAGrE;EACD,OAAO;GACN,SAAS,OAAO,QACf,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;GACzE,YAAY,OAAO,SAClB,MAAM,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK;GAC1E;;;AAIH,eAAsB,0BACrB,SAGA,eAAwE,EAAE,EAChD;CAC1B,MAAM,OAAO,aAAa,iBAAiB;CAE3C,OAAO;EACN,SAAS,OAAO,QACf,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;EACzE,YAAY,OAAO,SAClB,MAAM,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK;EAC1E;;;;AC1PF,MAAa,+BAA+B;AAC5C,MAAa,2CAA2C;AA2FxD,SAAS,4BAAmD;CAC3D,MAAM,+BAA+B,aACpC,IAAI,eAAe,SAAS;CAC7B,OAAO;EACN,UAAU,OAAO,cACf,MAAM,GAAG,OAAO,UAAU;EAC5B,kBAAkB,gBACjB,gBAAgB;GACf,cAAc,CAAC,GAAG,YAAY,aAAa;GAC3C,SAAS,OAAO,YACf,OAAO,QAAQ,YAAY,QAAQ,CAAC,KAAK,CAAC,YAAY,gBAAgB,CACrE,YACA;IACC,OAAO,CAAC,GAAG,WAAW,MAAM;IAC5B,OAAO,WAAW;IAClB,CACD,CAAC,CACF;GACD,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,WAAW,GAAG,EAAE;GACrE,GAAI,YAAY,aAAa,EAAE,YAAY,YAAY,YAAY,GAAG,EAAE;GACxE,CAAC;EACH;EACA,6BAA6B,SAC5B,2BAA2B;GAC1B,sBAAsB;GACtB;GACA,CAAC;EACH,sBAAsB;EACtB,yBAAyB,aACxB,IAAI,iBAAiB,SAAS;EAC/B,4BAA6C,IAAI,gBAAgB;EACjE,uBACC,UACA,kBACqB,IAAI,eAAe,UAAU,cAAc;EACjE,4BAA4B,UAC3B,0BAA0B,CAAC,GAAG,MAAM,CAAC;EACtC;;AAIF,SAAS,oBAAoB,WAA2B;CACvD,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,YAAY,WAAW,IAAI,EAC9B,OAAO;CAIR,OAAO,IADc,YAAY,WAAW,KAAK,GAAG,YAAY,MAAM,EAAY,GAAG;;AAItF,SAAS,4BACR,WACA,cACA,WACkB;CAClB,IAAI,UAAU,gBACb,OAAO,aAAa,2BAA2B,UAAU,eAAe;CAEzE,IAAI,UAAU,UACb,OAAO,aAAa,qBAAqB,UAAU,SAAS;CAG7D,MAAM,IAAI,MAAM,GAAG,UAAU,4CAA4C;;AAG1E,SAAS,uBACR,WACA,cACkB;CAClB,QAAQ,UAAU,MAAlB;EACC,KAAK,UACJ,OAAO,aAAa,sBAAsB;EAC3C,KAAK,UACJ,OAAO,4BAA4B,WAAW,cAAc,SAAS;EAEtE,KAAK,mBACJ,OAAO,aAAa,uBACnB,4BAA4B,WAAW,cAAc,kBAAkB,CACvE;EAEF,KAAK,UAAU;GAMd,IAAI,iBAJH,UAAU,YAAY,UAAU,iBAC7B,4BAA4B,WAAW,cAAc,SAAS,GAC9D,aAAa,sBAAsB;GAGvC,MAAM,eAAe,UAAU;GAE/B,IAAI,cAAc,KAAK,QACtB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,KAAK,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACtE;IACD,WAAW;IACX,CAAC;GAGH,IAAI,cAAc,MAAM,QACvB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,MAAM,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACvE;IACD,WAAW;IACX,CAAC;GAGH,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,+BAA+B,OAAO,UAAU,KAAK,GAAG;;;AAK3E,SAAS,gBACR,WACA,cACkC;CAClC,MAAM,WAA4C,EAAE;CAEpD,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,UAAU,EAC7D,SAAS,aAAa,uBAAuB,WAAW,aAAa;CAGtE,OAAO;;AAGR,SAAS,yBACR,WAC8B;CAC9B,MAAM,wBAAQ,IAAI,KAA+B;CACjD,KAAK,MAAM,aAAa,OAAO,OAAO,UAAU,EAC/C,IAAI,UAAU,gBACb,MAAM,IAAI,UAAU,eAAe,IAAI,UAAU,eAAe;CAGlE,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC;;AAG3B,SAAS,uBACR,OACA,cACO;CACP,KAAK,MAAM,QAAQ,OAClB,aAAa,sBAAsB,KAAK;;AAI1C,SAAS,mCACR,OACA,cACO;CACP,IAAI;EACH,uBAAuB,OAAO,aAAa;SACpC;;AAMT,eAAsB,gBACrB,SACA,eAAsC,2BAA2B,EAC5C;CACrB,MAAM,cAAc,QAAQ,YAAY,OAAO,KAAK,QAAQ,SAAS,CAAC,SAAS;CAC/E,MAAM,oBAAoB,yBAAyB,QAAQ,UAAU;CACrE,IAAI;CACJ,IAAI;EACH,MAAM,aAAa,aAAa,gBAAgB;GAC/C,cAAc,QAAQ;GACtB,SAAS,QAAQ;GACjB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GAC7D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;GAChE,CAAC;EACF,aAAa,MAAM,aAAa,SAAS;GACxC,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,GAAG,EAAE;GACrF,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,cAAc,GAAG,EAAE;GACtE,QAAQ,EACP,MAAM,QAAQ,YACd;GACD,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,KAAK;IACJ,GAAG,WAAW;IACd,GAAG,QAAQ;IACX;GACD,WAAW,WAAW;GACtB,KAAK;IACJ,WAAW;IACX,QAAQ,gBAAgB,QAAQ,WAAW,aAAa;IACxD;GACD,GAAI,cACD;IACA,KAAK;KACJ,MAAM;KACN,eAAe;KACf,eAAe;KACf,sBAAsB;KACtB;IACD,KAAK,EACJ,OAAO,QAAQ,UACf;IACD,GACA,EAAE;GACL,CAAC;UACM,OAAO;EACf,mCAAmC,mBAAmB,aAAa;EACnE,MAAM;;CAGP,OAAO;EACN,IAAI,WAAW;EACf,MAAM,KAAK,SAAsC;GAChD,MAAM,kBAAkB,MAAM,WAAW,KAAK,QAAQ;GACtD,OAAO;IACN,UAAU,gBAAgB;IAC1B,QAAQ,gBAAgB,UAAU;IAClC,QAAQ,gBAAgB,UAAU;IAClC;;EAEF,MAAM,UAAU,YAAmD;GAClE,OAAO,MAAM,WAAW,UAAU,WAAW;;EAE9C,MAAM,cAAc,gBAA+D;GAClF,OAAO,MAAM,WAAW,cAAc,eAAe;;EAEtD,gBAAmC;GAClC,OAAO;;EAER,iBAAiB,QAAuC;GACvD,WAAW,iBAAiB,OAAO;;EAEpC,MAAM,QAAuB;GAC5B,IAAI;GACJ,IAAI;IACH,MAAM,WAAW,OAAO;YAChB,OAAO;IACf,aAAa;;GAEd,IAAI;IACH,uBAAuB,mBAAmB,aAAa;YAC/C,OAAO;IACf,eAAe;;GAEhB,IAAI,eAAe,KAAA,GAClB,MAAM;;EAGR;;;;ACnWF,eAAsB,gBACrB,WACA,eACA,YACkB;CAClB,MAAM,kBAAkB,KAAK,KAAK,WAAW,eAAe,WAAW;CACvE,MAAM,GAAG,MAAM,iBAAiB,EAAE,WAAW,MAAM,CAAC;CACpD,OAAO;;AAGR,eAAsB,kBACrB,WACA,eACA,SAC0C;CAC1C,MAAM,wBAAwB,MAAM,QAAQ,IAC3C,OAAO,QAAQ,QAAQ,CAAC,IACvB,OAAO,CAAC,YAAY,kBACnB,CACC,YACA;EACC,WAAW,aAAa;EACxB,SAAS,MAAM,gBAAgB,WAAW,eAAe,WAAW;EACpE,CACD,CACF,CACD;CAED,OAAO,OAAO,YAAY,sBAAsB;;;;ACtCjD,eAAsB,oBACrB,UACA,SACA,UAEI,EAAE,EACU;CAChB,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC;CACnE,MAAM,GAAG,UAAU,mBAAmB,SAAS;EAC9C,UAAU;EACV,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,EAAE;EAC9C,CAAC;CACF,IAAI;EACH,MAAM,GAAG,OAAO,mBAAmB,SAAS;UACpC,aAAa;EACrB,IAAI;GACH,MAAM,GAAG,GAAG,mBAAmB,EAAE,OAAO,MAAM,CAAC;WACvC,cAAc;GACtB,MAAM,IAAI,MACT,sBAAsB,SAAS,KAAK,uBAAuB,QAAQ,YAAY,UAAU,KAAK,UAAU,YAAY,CAAC,yCAAyC,kBAAkB,KAAK,wBAAwB,QAAQ,aAAa,UAAU,KAAK,UAAU,aAAa,IACxQ,EAAE,OAAO,cAAc,CACvB;;EAEF,MAAM"}
1	+ {"version":3,"file":"index.js","names":["fs"],"sources":["../src/rootfs-init-extra.ts","../src/build-pipeline.ts","../src/gondolin-package.ts","../src/mount-policy.ts","../src/pinned-realfs.ts","../src/policy-compiler.ts","../src/secret-resolver.ts","../src/vm-adapter.ts","../src/volume-manager.ts","../src/write-file-atomically.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport const agentVmRootfsInitExtraScript = `# Generated by agent-vm.\n# Gondolin mounts devtmpfs over /dev at boot, so Docker-image /dev symlinks are hidden.\nmkdir -p /dev\nln -sfn /proc/self/fd /dev/fd 2>/dev/null \|\| true\nln -sfn /proc/self/fd/0 /dev/stdin 2>/dev/null \|\| true\nln -sfn /proc/self/fd/1 /dev/stdout 2>/dev/null \|\| true\nln -sfn /proc/self/fd/2 /dev/stderr 2>/dev/null \|\| true\nif [ ! -e /dev/ptmx ] && [ -e /dev/pts/ptmx ]; then\n ln -sfn pts/ptmx /dev/ptmx 2>/dev/null \|\| true\nfi\n`;\n\ninterface PrepareRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly imagePath: string;\n\treadonly rootfsInitExtraContent: string;\n}\n\ninterface ResolveRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n}\n\nexport interface ResolvedRootfsInitExtra {\n\treadonly content: string;\n\treadonly fingerprintInput: {\n\t\treadonly agentVmRootfsInitExtra: string;\n\t\treadonly deploymentRootfsInitExtra?: string;\n\t};\n}\n\nfunction resolveBuildConfigPath(filePath: string, configDir: string \| undefined): string {\n\treturn path.isAbsolute(filePath) ? filePath : path.resolve(configDir ?? process.cwd(), filePath);\n}\n\nasync function readExistingRootfsInitExtra(\n\tbuildConfig: BuildConfig,\n\tconfigDir: string \| undefined,\n): Promise<string \| undefined> {\n\tconst existingRootfsInitExtra = buildConfig.init?.rootfsInitExtra;\n\tif (!existingRootfsInitExtra) {\n\t\treturn undefined;\n\t}\n\n\tconst resolvedRootfsInitExtra = resolveBuildConfigPath(existingRootfsInitExtra, configDir);\n\ttry {\n\t\treturn await fs.readFile(resolvedRootfsInitExtra, 'utf8');\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin rootfs init extra '${resolvedRootfsInitExtra}': ${message}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction composeRootfsInitExtra(existingRootfsInitExtra: string \| undefined): string {\n\treturn existingRootfsInitExtra\n\t\t? `${agentVmRootfsInitExtraScript.trimEnd()}\\n\\n${existingRootfsInitExtra}`\n\t\t: agentVmRootfsInitExtraScript;\n}\n\nexport async function resolveRootfsInitExtra(\n\toptions: ResolveRootfsInitExtraOptions,\n): Promise<ResolvedRootfsInitExtra> {\n\tconst existingRootfsInitExtra = await readExistingRootfsInitExtra(\n\t\toptions.buildConfig,\n\t\toptions.configDir,\n\t);\n\n\treturn {\n\t\tcontent: composeRootfsInitExtra(existingRootfsInitExtra),\n\t\tfingerprintInput: {\n\t\t\tagentVmRootfsInitExtra: agentVmRootfsInitExtraScript,\n\t\t\t...(existingRootfsInitExtra === undefined\n\t\t\t\t? {}\n\t\t\t\t: { deploymentRootfsInitExtra: existingRootfsInitExtra }),\n\t\t},\n\t};\n}\n\nexport async function prepareBuildConfigWithAgentVmRootfsInitExtra(\n\toptions: PrepareRootfsInitExtraOptions,\n): Promise<BuildConfig> {\n\tconst rootfsInitExtraPath = path.join(options.imagePath, 'agent-vm-rootfs-init-extra.sh');\n\n\tawait fs.writeFile(rootfsInitExtraPath, options.rootfsInitExtraContent, {\n\t\tencoding: 'utf8',\n\t\tmode: 0o755,\n\t});\n\n\treturn {\n\t\t...options.buildConfig,\n\t\tinit: {\n\t\t\t...options.buildConfig.init,\n\t\t\trootfsInitExtra: rootfsInitExtraPath,\n\t\t},\n\t};\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig, BuildOptions } from '@earendil-works/gondolin';\n\nimport {\n\tprepareBuildConfigWithAgentVmRootfsInitExtra,\n\tresolveRootfsInitExtra,\n} from './rootfs-init-extra.js';\n\nexport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport interface BuildImageOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly cacheDir: string;\n\t/** Directory to resolve relative paths in buildConfig (e.g. postBuild.copy.src).\n\t * Defaults to process.cwd() if not provided. /\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly output?: BuildOutput;\n}\n\nexport interface BuildOutput {\n\twrite(chunk: string \| Uint8Array): boolean;\n}\n\nexport interface BuildImageResult {\n\treadonly built: boolean;\n\treadonly fingerprint: string;\n\treadonly imagePath: string;\n}\n\nexport const buildImageAssetFileNames = [\n\t'manifest.json',\n\t'rootfs.ext4',\n\t'initramfs.cpio.lz4',\n\t'vmlinuz-virt',\n] as const;\n\ninterface BuildPipelineDependencies {\n\treadonly buildAssets?: (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t) => Promise<unknown>;\n\treadonly gondolinVersion?: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null;\n}\n\nfunction stableSerialize(value: unknown): string {\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((entry) => stableSerialize(entry)).join(',')}]`;\n\t}\n\n\tif (isRecord(value)) {\n\t\tconst objectEntries = Object.entries(value)\n\t\t\t.filter(([, entryValue]) => entryValue !== undefined)\n\t\t\t.toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n\t\treturn `{${objectEntries\n\t\t\t.map(([entryKey, entryValue]) => `${JSON.stringify(entryKey)}:${stableSerialize(entryValue)}`)\n\t\t\t.join(',')}}`;\n\t}\n\n\treturn JSON.stringify(value);\n}\n\nfunction isMissingPathError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait fs.access(filePath);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (!isMissingPathError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn false;\n\t}\n}\n\nexport async function hasBuiltImageAssets(outputDirectoryPath: string): Promise<boolean> {\n\tfor (const fileName of buildImageAssetFileNames) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- each missing file points at the same image generation\n\t\tif (!(await pathExists(path.join(outputDirectoryPath, fileName)))) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nasync function loadBuildAssets(): Promise<\n\t(buildConfig: BuildConfig, outputDirectory: string, configDir?: string) => Promise<unknown>\n> {\n\tconst gondolinModule = await import('@earendil-works/gondolin');\n\treturn async (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t): Promise<unknown> =>\n\t\tawait gondolinModule.buildAssets(buildConfig, {\n\t\t\toutputDir: outputDirectory,\n\t\t\tverbose: false,\n\t\t\t...(configDir ? { configDir } : {}),\n\t\t} satisfies BuildOptions);\n}\n\nfunction createRedirectedWrite(output: BuildOutput): typeof process.stderr.write {\n\treturn ((\n\t\tchunk: string \| Uint8Array,\n\t\tencodingOrCallback?: BufferEncoding \| ((error?: Error \| null) => void),\n\t\tcallback?: (error?: Error \| null) => void,\n\t): boolean => {\n\t\tconst writeCallback = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;\n\t\tconst wrote = output.write(chunk);\n\t\twriteCallback?.();\n\t\treturn wrote;\n\t}) as typeof process.stderr.write;\n}\n\nasync function withCapturedBuildOutput<TResult>(\n\toutput: BuildOutput \| undefined,\n\tfn: () => Promise<TResult>,\n): Promise<TResult> {\n\tif (!output) {\n\t\treturn await fn();\n\t}\n\n\tconst originalStderrWrite = process.stderr.write.bind(process.stderr);\n\tconst originalStdoutWrite = process.stdout.write.bind(process.stdout);\n\tconst originalCi = process.env.CI;\n\tconst redirectedWrite = createRedirectedWrite(output);\n\n\tprocess.stderr.write = redirectedWrite;\n\tprocess.stdout.write = redirectedWrite;\n\tprocess.env.CI = 'true';\n\n\ttry {\n\t\treturn await fn();\n\t} finally {\n\t\tprocess.stderr.write = originalStderrWrite;\n\t\tprocess.stdout.write = originalStdoutWrite;\n\t\tif (originalCi === undefined) {\n\t\t\tdelete process.env.CI;\n\t\t} else {\n\t\t\tprocess.env.CI = originalCi;\n\t\t}\n\t}\n}\n\nexport function computeBuildFingerprint(\n\tbuildConfig: BuildConfig,\n\tgondolinVersion: string = 'unknown',\n\tfingerprintInput?: unknown,\n): string {\n\tconst payload =\n\t\tfingerprintInput === undefined\n\t\t\t? `${stableSerialize(buildConfig)}\|${gondolinVersion}`\n\t\t\t: `${stableSerialize(buildConfig)}\|${gondolinVersion}\|${stableSerialize(fingerprintInput)}`;\n\n\treturn crypto.createHash('sha256').update(payload).digest('hex').slice(0, 16);\n}\n\nexport async function computeEffectiveBuildFingerprint(options: {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n}): Promise<{\n\treadonly fingerprint: string;\n\treadonly rootfsInitExtraContent: string;\n}> {\n\tconst resolvedRootfsInitExtra = await resolveRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t});\n\tconst fingerprint = computeBuildFingerprint(options.buildConfig, options.gondolinVersion, {\n\t\tagentVmRootfsInitExtra: resolvedRootfsInitExtra.fingerprintInput,\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { callerFingerprintInput: options.fingerprintInput }),\n\t});\n\n\treturn {\n\t\tfingerprint,\n\t\trootfsInitExtraContent: resolvedRootfsInitExtra.content,\n\t};\n}\n\nexport async function buildImage(\n\toptions: BuildImageOptions,\n\tdependencies: BuildPipelineDependencies = {},\n): Promise<BuildImageResult> {\n\tconst effectiveBuildFingerprint = await computeEffectiveBuildFingerprint({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { fingerprintInput: options.fingerprintInput }),\n\t\t...(dependencies.gondolinVersion ? { gondolinVersion: dependencies.gondolinVersion } : {}),\n\t});\n\tconst fingerprint = effectiveBuildFingerprint.fingerprint;\n\tconst imagePath = path.join(options.cacheDir, fingerprint);\n\n\tif (options.fullReset) {\n\t\tawait fs.rm(imagePath, { recursive: true, force: true });\n\t}\n\n\tif (await hasBuiltImageAssets(imagePath)) {\n\t\treturn {\n\t\t\tbuilt: false,\n\t\t\tfingerprint,\n\t\t\timagePath,\n\t\t};\n\t}\n\n\tawait fs.mkdir(imagePath, { recursive: true });\n\tconst buildAssetsImplementation = dependencies.buildAssets ?? (await loadBuildAssets());\n\tconst effectiveBuildConfig = await prepareBuildConfigWithAgentVmRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\timagePath,\n\t\trootfsInitExtraContent: effectiveBuildFingerprint.rootfsInitExtraContent,\n\t});\n\tawait withCapturedBuildOutput(options.output, async () => {\n\t\tawait buildAssetsImplementation(effectiveBuildConfig, imagePath, options.configDir);\n\t});\n\n\tif (!(await hasBuiltImageAssets(imagePath))) {\n\t\tthrow new Error(`Expected Gondolin assets to be written to ${imagePath}.`);\n\t}\n\n\treturn {\n\t\tbuilt: true,\n\t\tfingerprint,\n\t\timagePath,\n\t};\n}\n","import fs from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\n\nimport { z } from 'zod';\n\nconst requireFromHere = createRequire(import.meta.url);\n\nconst gondolinPackageJsonSchema = z.object({\n\tversion: z.string().min(1),\n});\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nfunction getErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nexport function parseMinimumZigVersion(rawContents: string): string {\n\tconst match = rawContents.match(/\\.minimum_zig_version\\s=\\s\"([^\"])\"/u);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t'minimum_zig_version declaration not found. Expected a line like `.minimum_zig_version = \"0.15.2\"`.',\n\t\t);\n\t}\n\n\tconst version = match[1];\n\tif (!version) {\n\t\tthrow new Error('minimum_zig_version is empty.');\n\t}\n\treturn version;\n}\n\nexport function resolveGondolinPackageJsonPath(): string {\n\treturn requireFromHere.resolve('@earendil-works/gondolin/package.json');\n}\n\nexport async function resolveGondolinPackageSpec(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\tconst parsed: unknown = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));\n\tconst packageJson = gondolinPackageJsonSchema.parse(parsed);\n\treturn `@earendil-works/gondolin@${packageJson.version}`;\n}\n\nexport interface ResolveGondolinMinimumZigVersionOptions {\n\treadonly buildZigZonPath?: string;\n}\n\nasync function resolveDefaultBuildZigZonPath(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\treturn path.join(path.dirname(packageJsonPath), 'dist', 'guest', 'build.zig.zon');\n}\n\nexport async function resolveGondolinMinimumZigVersion(\n\toptions: ResolveGondolinMinimumZigVersionOptions = {},\n): Promise<string> {\n\tconst zonPath = options.buildZigZonPath ?? (await resolveDefaultBuildZigZonPath());\n\tlet rawContents: string;\n\ttry {\n\t\trawContents = await fs.readFile(zonPath, 'utf8');\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) {\n\t\t\tthrow new Error(`Missing Gondolin build.zig.zon at '${zonPath}'.`, { cause: error });\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\n\ttry {\n\t\treturn parseMinimumZigVersion(rawContents);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to parse Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nconst AUTH_GUEST_PATH_PREFIXES = [\n\t'/home/agent/.aws',\n\t'/home/agent/.claude',\n\t'/home/agent/.codex',\n\t'/home/agent/.gemini',\n\t'/home/openclaw/.aws',\n\t'/home/openclaw/.claude',\n\t'/home/openclaw/.codex',\n\t'/home/openclaw/.gemini',\n\t'/home/openclaw/.openclaw',\n] as const;\n\nexport interface WritableMountPolicy {\n\treadonly allowAuthWrite: boolean;\n\treadonly writableAllowedGuestPrefixes: readonly string[];\n}\n\nexport interface RuntimeMountPolicyConfig {\n\treadonly extraMounts: Readonly<Record<string, string>>;\n\treadonly mountControls: WritableMountPolicy;\n}\n\nfunction resolveAuthHostPrefixes(hostHome: string): readonly string[] {\n\treturn [\n\t\tpath.join(hostHome, '.aws'),\n\t\tpath.join(hostHome, '.claude'),\n\t\tpath.join(hostHome, '.codex'),\n\t\tpath.join(hostHome, '.gemini'),\n\t];\n}\n\nexport function resolveGuestMountPath(guestPath: string, workDir: string): string {\n\tif (path.isAbsolute(guestPath)) {\n\t\treturn path.resolve(guestPath);\n\t}\n\n\treturn path.resolve(workDir, guestPath);\n}\n\nfunction isPathWithinPrefix(candidatePath: string, prefixPath: string): boolean {\n\tconst relativePath = path.relative(prefixPath, candidatePath);\n\treturn relativePath === '' \|\| (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));\n}\n\nasync function normalizeHostPath(hostPath: string): Promise<string> {\n\tconst resolvedHostPath = path.resolve(hostPath);\n\n\ttry {\n\t\treturn await fs.realpath(resolvedHostPath);\n\t} catch {\n\t\treturn resolvedHostPath;\n\t}\n}\n\nfunction pathsOverlap(candidatePath: string, protectedPath: string): boolean {\n\treturn (\n\t\tisPathWithinPrefix(candidatePath, protectedPath) \|\|\n\t\tisPathWithinPrefix(protectedPath, candidatePath)\n\t);\n}\n\nexport function validateWritableMount(\n\tguestPath: string,\n\tpolicy: WritableMountPolicy,\n\toptions: { readonly workDir: string },\n): void {\n\tconst resolvedGuestPath = resolveGuestMountPath(guestPath, options.workDir);\n\tconst resolvedAllowedPrefixes = policy.writableAllowedGuestPrefixes.map((allowedPrefix) =>\n\t\tresolveGuestMountPath(allowedPrefix, options.workDir),\n\t);\n\n\tconst isAllowedGuestPath = resolvedAllowedPrefixes.some((allowedPrefix) =>\n\t\tisPathWithinPrefix(resolvedGuestPath, allowedPrefix),\n\t);\n\tif (!isAllowedGuestPath) {\n\t\tthrow new Error(\n\t\t\t`Writable mount guest path '${resolvedGuestPath}' is outside writable allowlist [${resolvedAllowedPrefixes.join(', ')}].`,\n\t\t);\n\t}\n\n\tif (!policy.allowAuthWrite) {\n\t\tconst targetsProtectedGuestPath = AUTH_GUEST_PATH_PREFIXES.some((authPrefix) =>\n\t\t\tisPathWithinPrefix(resolvedGuestPath, authPrefix),\n\t\t);\n\t\tif (targetsProtectedGuestPath) {\n\t\t\tthrow new Error(\n\t\t\t\t`Writable mount guest path '${resolvedGuestPath}' targets an auth mount path. Set mountControls.allowAuthWrite=true to permit auth writes.`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nexport async function validateRuntimeMountPolicy(\n\tconfig: RuntimeMountPolicyConfig,\n\toptions: { readonly hostHome: string; readonly workDir: string },\n): Promise<void> {\n\tconst mountEntries = Object.entries(config.extraMounts);\n\tfor (const [guestPath] of mountEntries) {\n\t\tvalidateWritableMount(guestPath, config.mountControls, options);\n\t}\n\n\tif (config.mountControls.allowAuthWrite) {\n\t\treturn;\n\t}\n\n\tconst absoluteHostMountEntries = mountEntries.filter(([, hostPath]) => path.isAbsolute(hostPath));\n\tconst [protectedHostPaths, writableHostPaths] = await Promise.all([\n\t\tPromise.all(\n\t\t\tresolveAuthHostPrefixes(options.hostHome).map(\n\t\t\t\tasync (authHostPrefix) => await normalizeHostPath(authHostPrefix),\n\t\t\t),\n\t\t),\n\t\tPromise.all(\n\t\t\tabsoluteHostMountEntries.map(async ([, hostPath]) => await normalizeHostPath(hostPath)),\n\t\t),\n\t]);\n\n\tfor (const resolvedWritableHostPath of writableHostPaths) {\n\t\tconst overlapsProtectedHostPath = protectedHostPaths.some((authHostPrefix) =>\n\t\t\tpathsOverlap(resolvedWritableHostPath, authHostPrefix),\n\t\t);\n\n\t\tif (overlapsProtectedHostPath) {\n\t\t\tthrow new Error(\n\t\t\t\t`Writable host path '${resolvedWritableHostPath}' targets an auth host directory. Set mountControls.allowAuthWrite=true to permit auth writes.`,\n\t\t\t);\n\t\t}\n\t}\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { VirtualProvider } from '@earendil-works/gondolin';\n\nexport interface PinnedRealFsRoot {\n\treadonly hostPath: string;\n\treadonly realPath: string;\n\treadonly fd: number;\n\treadonly device: number;\n\treadonly inode: number;\n}\n\nexport interface CreatePinnedRealFsProviderOptions {\n\treadonly root: PinnedRealFsRoot;\n\treadonly createRealFsProvider: (hostPath: string) => VirtualProvider;\n}\n\nfunction formatRootIdentity(root: PinnedRealFsRoot): string {\n\treturn `${root.device}:${root.inode}`;\n}\n\nfunction openDirectoryNoFollow(candidatePath: string): number {\n\treturn fs.openSync(\n\t\tcandidatePath,\n\t\tfs.constants.O_RDONLY \| fs.constants.O_DIRECTORY \| fs.constants.O_NOFOLLOW,\n\t);\n}\n\nexport function pinRealFsRoot(hostPath: string): PinnedRealFsRoot {\n\tif (!hostPath \|\| !path.isAbsolute(hostPath)) {\n\t\tthrow new Error(`Pinned RealFS root must be a non-empty absolute path: ${hostPath}`);\n\t}\n\n\tconst resolvedHostPath = path.resolve(hostPath);\n\tconst fd = openDirectoryNoFollow(resolvedHostPath);\n\ttry {\n\t\tconst stats = fs.fstatSync(fd);\n\t\tif (!stats.isDirectory()) {\n\t\t\tthrow new Error(`Pinned RealFS root is not a directory: ${resolvedHostPath}`);\n\t\t}\n\t\tconst realPath = fs.realpathSync(resolvedHostPath);\n\t\tconst realPathStats = fs.statSync(realPath);\n\t\tif (realPathStats.dev !== stats.dev \|\| realPathStats.ino !== stats.ino) {\n\t\t\tthrow new Error(\n\t\t\t\t`Pinned RealFS root changed while opening: ${resolvedHostPath} opened ${stats.dev}:${stats.ino} but resolved to ${realPathStats.dev}:${realPathStats.ino}`,\n\t\t\t);\n\t\t}\n\t\treturn {\n\t\t\tdevice: stats.dev,\n\t\t\tfd,\n\t\t\thostPath: resolvedHostPath,\n\t\t\tinode: stats.ino,\n\t\t\trealPath,\n\t\t};\n\t} catch (error) {\n\t\tfs.closeSync(fd);\n\t\tthrow error;\n\t}\n}\n\nexport function closePinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tfs.closeSync(root.fd);\n}\n\nexport function assertPinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tconst pinnedStats = fs.fstatSync(root.fd);\n\tconst currentStats = fs.statSync(root.realPath);\n\tif (\n\t\tpinnedStats.dev !== root.device \|\|\n\t\tpinnedStats.ino !== root.inode \|\|\n\t\tcurrentStats.dev !== root.device \|\|\n\t\tcurrentStats.ino !== root.inode\n\t) {\n\t\tthrow new Error(\n\t\t\t`Pinned RealFS root changed before mount access: ${root.realPath} expected ${formatRootIdentity(root)} got ${currentStats.dev}:${currentStats.ino}`,\n\t\t);\n\t}\n}\n\ntype ProviderMethod = (...args: unknown[]) => unknown;\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- Reflect.get()\n loses the method signature from Gondolin's VirtualProvider union. The proxy\n keeps the same provider object and only wraps callable properties with the\n pinned-root assertion. /\nexport function createPinnedRealFsProvider(\n\toptions: CreatePinnedRealFsProviderOptions,\n): VirtualProvider {\n\tassertPinnedRealFsRoot(options.root);\n\tconst provider = options.createRealFsProvider(options.root.realPath);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string \| symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tassertPinnedRealFsRoot(options.root);\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n/ oxlint-enable typescript-eslint/no-unsafe-type-assertion /\n","export interface PolicySources {\n\treadonly base: readonly string[];\n\treadonly profile: readonly string[];\n\treadonly extra: readonly string[];\n}\n\nexport function normalizeHostname(rawHostname: string): string {\n\treturn rawHostname.trim().toLowerCase().replace(/\\.+$/u, '');\n}\n\nexport function dedupeStable(values: readonly string[]): string[] {\n\tconst seenHostnames = new Set<string>();\n\tconst normalizedValues: string[] = [];\n\n\tfor (const value of values) {\n\t\tconst normalizedValue = normalizeHostname(value);\n\t\tif (normalizedValue.length === 0 \|\| normalizedValue.startsWith('#')) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!seenHostnames.has(normalizedValue)) {\n\t\t\tseenHostnames.add(normalizedValue);\n\t\t\tnormalizedValues.push(normalizedValue);\n\t\t}\n\t}\n\n\treturn normalizedValues;\n}\n\nexport function compilePolicy(sources: PolicySources): string[] {\n\treturn dedupeStable([...sources.base, ...sources.profile, ...sources.extra]);\n}\n","import { execFile } from 'node:child_process';\n\nimport { createClient, type ResolveAllResponse, type ResolveReferenceError } from '@1password/sdk';\n\nimport type { SecretRef } from './types.js';\n\nexport interface SecretResolverClient {\n\treadonly secrets: {\n\t\tresolve(secretReference: string): Promise<string>;\n\t\tresolveAll(secretReferences: readonly string[]): Promise<ResolveAllResponse>;\n\t};\n}\n\nexport interface SecretResolver {\n\tresolve(ref: SecretRef): Promise<string>;\n\tresolveAll(refs: Record<string, SecretRef>): Promise<Record<string, string>>;\n}\n\n// --- Token source: how to obtain the 1Password service account token ---\n\nexport type TokenSource =\n\t\| { readonly type: 'op-cli'; readonly ref: string }\n\t\| { readonly type: 'env'; readonly envVar?: string \| undefined }\n\t\| { readonly type: 'keychain'; readonly service: string; readonly account: string };\n\nexport interface ExecFileOptions {\n\treadonly env?: Readonly<Record<string, string \| undefined>>;\n}\n\nexport interface ExecFileResult {\n\treadonly stdout: string;\n\treadonly stderr: string;\n}\n\nfunction writeStderr(message: string): void {\n\tprocess.stderr.write(`${message}\\n`);\n}\n\nfunction formatUnknownError(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction ensureMacOsForKeychain(): void {\n\tif (process.platform !== 'darwin') {\n\t\tthrow new Error(\n\t\t\t'Keychain token source is only supported on macOS. Use an env or op-cli token source on this platform so cmd-ts can surface a clear startup error.',\n\t\t);\n\t}\n}\n\nfunction execFileAsync(\n\tcommand: string,\n\targs: readonly string[],\n\toptions?: ExecFileOptions,\n): Promise<ExecFileResult> {\n\treturn new Promise((resolve, reject) => {\n\t\texecFile(\n\t\t\tcommand,\n\t\t\t[...args],\n\t\t\t{ env: options?.env, timeout: 30_000 },\n\t\t\t(error, stdout, stderr) => {\n\t\t\t\tif (error) {\n\t\t\t\t\tconst errorMessage = error instanceof Error ? error.message : JSON.stringify(error);\n\t\t\t\t\treject(new Error(`${command} failed: ${stderr.trim() \|\| errorMessage}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tresolve({ stdout, stderr });\n\t\t\t},\n\t\t);\n\t});\n}\n\nconst SAFE_IDENTIFIER_PATTERN = /^[\\w.@-]+$/u;\n\nexport async function resolveServiceAccountToken(\n\tsource: TokenSource,\n\tdependencies?: {\n\t\treadonly execFileAsync?: (\n\t\t\tcommand: string,\n\t\t\targs: readonly string[],\n\t\t\toptions?: ExecFileOptions,\n\t\t) => Promise<ExecFileResult>;\n\t},\n): Promise<string> {\n\tconst exec = dependencies?.execFileAsync ?? execFileAsync;\n\n\tswitch (source.type) {\n\t\tcase 'op-cli': {\n\t\t\t// Uses `op read` which triggers biometric auth (Touch ID) on macOS\n\t\t\tconst result = await exec('op', ['read', source.ref]);\n\t\t\tconst token = result.stdout.trim();\n\t\t\tif (token.length === 0) {\n\t\t\t\tthrow new Error('op-cli token resolution returned empty value');\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\n\t\tcase 'env': {\n\t\t\tconst envVar = source.envVar ?? 'OP_SERVICE_ACCOUNT_TOKEN';\n\t\t\tconst token = process.env[envVar]?.trim();\n\t\t\tif (!token) {\n\t\t\t\tthrow new Error(`Environment variable ${envVar} is not set`);\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\n\t\tcase 'keychain': {\n\t\t\tensureMacOsForKeychain();\n\n\t\t\t// Validate keychain identifiers to prevent argument injection\n\t\t\tif (!SAFE_IDENTIFIER_PATTERN.test(source.service)) {\n\t\t\t\tthrow new Error('Keychain service name contains invalid characters');\n\t\t\t}\n\n\t\t\tif (!SAFE_IDENTIFIER_PATTERN.test(source.account)) {\n\t\t\t\tthrow new Error('Keychain account name contains invalid characters');\n\t\t\t}\n\n\t\t\t// macOS Keychain via `security find-generic-password`\n\t\t\tconst result = await exec('security', [\n\t\t\t\t'find-generic-password',\n\t\t\t\t'-s',\n\t\t\t\tsource.service,\n\t\t\t\t'-a',\n\t\t\t\tsource.account,\n\t\t\t\t'-w',\n\t\t\t]);\n\t\t\tconst token = result.stdout.trim();\n\t\t\tif (token.length === 0) {\n\t\t\t\tthrow new Error('Keychain token resolution returned empty value');\n\t\t\t}\n\n\t\t\treturn token;\n\t\t}\n\t\tdefault:\n\t\t\tthrow new Error(`Unsupported token source: ${JSON.stringify(source)}`);\n\t}\n}\n\n// --- Secret resolver: uses the token to resolve secrets via 1Password SDK ---\n\nexport interface CreateSecretResolverDependencies {\n\treadonly createClient?: (config: {\n\t\tauth: string;\n\t\tintegrationName: string;\n\t\tintegrationVersion: string;\n\t}) => Promise<SecretResolverClient>;\n\treadonly execFileAsync?: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>;\n\treadonly integrationName?: string;\n\treadonly integrationVersion?: string;\n}\n\nasync function resolveSecretWithOpCli(\n\tserviceAccountToken: string,\n\tsecretReference: string,\n\texec: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>,\n): Promise<string> {\n\tconst result = await exec('op', ['read', secretReference], {\n\t\tenv: {\n\t\t\t...process.env,\n\t\t\tOP_SERVICE_ACCOUNT_TOKEN: serviceAccountToken,\n\t\t},\n\t});\n\treturn result.stdout.trim();\n}\n\nasync function resolveAllSecretsWithOpCli(\n\tserviceAccountToken: string,\n\trefs: Record<string, SecretRef>,\n\texec: (\n\t\tcommand: string,\n\t\targs: readonly string[],\n\t\toptions?: ExecFileOptions,\n\t) => Promise<ExecFileResult>,\n): Promise<Record<string, string>> {\n\tconst resolvedSecrets: Record<string, string> = {};\n\tconst failures: Error[] = [];\n\n\tfor (const [secretName, secretRef] of Object.entries(refs)) {\n\t\ttry {\n\t\t\t// Sequential resolution avoids concurrent `op read` failures with the same service account token.\n\t\t\t// oxlint-disable-next-line eslint/no-await-in-loop\n\t\t\tresolvedSecrets[secretName] = await resolveSecretWithOpCli(\n\t\t\t\tserviceAccountToken,\n\t\t\t\tsecretRef.ref,\n\t\t\t\texec,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tfailures.push(\n\t\t\t\tnew Error(\n\t\t\t\t\t`Failed to resolve secret '${secretName}' from '${secretRef.ref}' via op read: ${formatUnknownError(error)}`,\n\t\t\t\t\t{ cause: error },\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tif (failures.length > 0) {\n\t\tthrow new AggregateError(\n\t\t\tfailures,\n\t\t\t`Failed to resolve ${String(failures.length)} secret(s) via op read.`,\n\t\t);\n\t}\n\n\treturn resolvedSecrets;\n}\n\nfunction formatResolveReferenceError(error: ResolveReferenceError): string {\n\treturn 'message' in error && typeof error.message === 'string'\n\t\t? `${error.type}: ${error.message}`\n\t\t: error.type;\n}\n\nfunction readSdkBatchSecret(options: {\n\treadonly response: ResolveAllResponse;\n\treadonly secretName: string;\n\treadonly secretReference: string;\n}): string {\n\tconst individualResponse = options.response.individualResponses[options.secretReference];\n\tif (!individualResponse) {\n\t\tthrow new Error(\n\t\t\t`1Password SDK resolveAll response omitted '${options.secretName}' (${options.secretReference}).`,\n\t\t);\n\t}\n\tif (individualResponse.content !== undefined) {\n\t\treturn individualResponse.content.secret;\n\t}\n\tif (individualResponse.error !== undefined) {\n\t\tthrow new Error(\n\t\t\t`1Password SDK resolveAll failed for '${options.secretName}' (${options.secretReference}): ${formatResolveReferenceError(individualResponse.error)}`,\n\t\t);\n\t}\n\tthrow new Error(\n\t\t`1Password SDK resolveAll returned neither content nor error for '${options.secretName}' (${options.secretReference}).`,\n\t);\n}\n\nfunction mapSdkResolveAllResponse(\n\trefs: Record<string, SecretRef>,\n\tresponse: ResolveAllResponse,\n): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(refs).map(([secretName, secretRef]) => [\n\t\t\tsecretName,\n\t\t\treadSdkBatchSecret({\n\t\t\t\tresponse,\n\t\t\t\tsecretName,\n\t\t\t\tsecretReference: secretRef.ref,\n\t\t\t}),\n\t\t]),\n\t);\n}\n\nexport async function createSecretResolver(\n\toptions: {\n\t\treadonly serviceAccountToken: string;\n\t},\n\tdependencies: CreateSecretResolverDependencies = {},\n): Promise<SecretResolver> {\n\tconst exec = dependencies.execFileAsync ?? execFileAsync;\n\ttry {\n\t\tconst client = await (dependencies.createClient ?? createClient)({\n\t\t\tauth: options.serviceAccountToken,\n\t\t\tintegrationName: dependencies.integrationName ?? 'agent-vm',\n\t\t\tintegrationVersion: dependencies.integrationVersion ?? '0.0.1',\n\t\t});\n\n\t\treturn {\n\t\t\tresolve: async (ref: SecretRef): Promise<string> => {\n\t\t\t\ttry {\n\t\t\t\t\treturn await client.secrets.resolve(ref.ref);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\t\twriteStderr(\n\t\t\t\t\t\t`[secret-resolver] 1Password SDK resolve failed for ${ref.ref}; falling back to op CLI: ${message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn await resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec);\n\t\t\t\t}\n\t\t\t},\n\t\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> => {\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await client.secrets.resolveAll(\n\t\t\t\t\t\tObject.values(refs).map((secretRef) => secretRef.ref),\n\t\t\t\t\t);\n\t\t\t\t\treturn mapSdkResolveAllResponse(refs, response);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\t\twriteStderr(\n\t\t\t\t\t\t`[secret-resolver] 1Password SDK resolveAll failed; falling back to serial op CLI reads: ${message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn await resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec);\n\t\t\t\t}\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\twriteStderr(\n\t\t\t`[secret-resolver] 1Password SDK client creation failed; falling back to op CLI: ${message}`,\n\t\t);\n\t\treturn {\n\t\t\tresolve: async (ref: SecretRef): Promise<string> =>\n\t\t\t\tawait resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec),\n\t\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> =>\n\t\t\t\tawait resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec),\n\t\t};\n\t}\n}\n\nexport async function createOpCliSecretResolver(\n\toptions: {\n\t\treadonly serviceAccountToken: string;\n\t},\n\tdependencies: Pick<CreateSecretResolverDependencies, 'execFileAsync'> = {},\n): Promise<SecretResolver> {\n\tconst exec = dependencies.execFileAsync ?? execFileAsync;\n\n\treturn {\n\t\tresolve: async (ref: SecretRef): Promise<string> =>\n\t\t\tawait resolveSecretWithOpCli(options.serviceAccountToken, ref.ref, exec),\n\t\tresolveAll: async (refs: Record<string, SecretRef>): Promise<Record<string, string>> =>\n\t\t\tawait resolveAllSecretsWithOpCli(options.serviceAccountToken, refs, exec),\n\t};\n}\n","import {\n\tMemoryProvider,\n\tReadonlyProvider,\n\tRealFSProvider,\n\tShadowProvider,\n\tVM,\n\tcreateHttpHooks,\n\tcreateShadowPathPredicate,\n\ttype CreateHttpHooksResult,\n\ttype EnableIngressOptions,\n\ttype EnableSshOptions,\n\ttype IngressRoute as GondolinIngressRoute,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype VMOptions,\n\ttype VirtualProvider,\n} from '@earendil-works/gondolin';\n\nimport {\n\tclosePinnedRealFsRoot,\n\tcreatePinnedRealFsProvider,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\nimport type { SecretSpec } from './types.js';\n\nexport const SYNTHETIC_DNS_IPV4_BENCHMARK = '198.18.0.1';\nexport const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = '::ffff:198.18.0.1';\n\nexport interface ExecResult {\n\treadonly exitCode: number;\n\treadonly stdout: string;\n\treadonly stderr: string;\n}\n\nexport type IngressRoute = GondolinIngressRoute;\n\nexport interface SshAccess {\n\treadonly host: string;\n\treadonly command?: string;\n\treadonly identityFile?: string;\n\treadonly port: number;\n\treadonly user?: string;\n}\n\nexport interface IngressAccess {\n\treadonly host: string;\n\treadonly port: number;\n}\n\nexport interface ManagedVmInstance {\n\treadonly id: string;\n\texec(command: string): Promise<{\n\t\treadonly exitCode: number;\n\t\treadonly stdout?: string;\n\t\treadonly stderr?: string;\n\t}>;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tclose(): Promise<void>;\n}\n\nexport interface ManagedVmDependencies {\n\tcreateVm(vmOptions: VMOptions): Promise<ManagedVmInstance>;\n\tcreateHttpHooks(options: {\n\t\treadonly allowedHosts: readonly string[];\n\t\treadonly secrets: Record<string, SecretSpec>;\n\t\treadonly onRequest?: (request: Request) => Promise<Request \| Response \| void>;\n\t\treadonly onResponse?: (response: Response) => Promise<Response \| void>;\n\t}): Pick<CreateHttpHooksResult, 'env' \| 'httpHooks'>;\n\tclosePinnedRealFsRoot(root: PinnedRealFsRoot): void;\n\tcreatePinnedRealFsProvider(root: PinnedRealFsRoot): VirtualProvider;\n\tcreateRealFsProvider(hostPath: string): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n}\n\nexport interface VfsMountSpec {\n\treadonly kind: 'realfs' \| 'realfs-readonly' \| 'memory' \| 'shadow';\n\treadonly hostPath?: string;\n\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n\treadonly shadowConfig?: {\n\t\treadonly deny: readonly string[];\n\t\treadonly tmpfs: readonly string[];\n\t};\n}\n\nexport interface CreateVmOptions {\n\treadonly imagePath: string;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly rootfsMode: 'readonly' \| 'memory' \| 'cow';\n\treadonly allowedHosts: readonly string[];\n\treadonly secrets: Record<string, SecretSpec>;\n\treadonly vfsMounts: Record<string, VfsMountSpec>;\n\treadonly tcpHosts?: Record<string, string>;\n\treadonly env?: Record<string, string>;\n\treadonly sessionLabel?: string;\n\treadonly onRequest?: (request: Request) => Promise<Request \| Response \| void>;\n\treadonly onResponse?: (response: Response) => Promise<Response \| void>;\n}\n\nexport interface ManagedVm {\n\treadonly id: string;\n\texec(command: string): Promise<ExecResult>;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tgetVmInstance(): ManagedVmInstance;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tclose(): Promise<void>;\n}\n\n/ oxlint-disable typescript-eslint/no-unsafe-type-assertion -- VM.create() returns\n Gondolin's concrete VM class; this adapter exposes only the narrower\n ManagedVmInstance interface used by agent-vm. /\nfunction createDefaultDependencies(): ManagedVmDependencies {\n\tconst createDefaultRealFsProvider = (hostPath: string): VirtualProvider =>\n\t\tnew RealFSProvider(hostPath);\n\treturn {\n\t\tcreateVm: async (vmOptions: VMOptions): Promise<ManagedVmInstance> =>\n\t\t\t(await VM.create(vmOptions)) as unknown as ManagedVmInstance,\n\t\tcreateHttpHooks: (hookOptions) =>\n\t\t\tcreateHttpHooks({\n\t\t\t\tallowedHosts: [...hookOptions.allowedHosts],\n\t\t\t\tsecrets: Object.fromEntries(\n\t\t\t\t\tObject.entries(hookOptions.secrets).map(([secretName, secretSpec]) => [\n\t\t\t\t\t\tsecretName,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secretSpec.hosts],\n\t\t\t\t\t\t\tvalue: secretSpec.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t),\n\t\t\t\t...(hookOptions.onRequest ? { onRequest: hookOptions.onRequest } : {}),\n\t\t\t\t...(hookOptions.onResponse ? { onResponse: hookOptions.onResponse } : {}),\n\t\t\t}),\n\t\tclosePinnedRealFsRoot,\n\t\tcreatePinnedRealFsProvider: (root: PinnedRealFsRoot): VirtualProvider =>\n\t\t\tcreatePinnedRealFsProvider({\n\t\t\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\t\t\troot,\n\t\t\t}),\n\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\tcreateReadonlyProvider: (provider: VirtualProvider): VirtualProvider =>\n\t\t\tnew ReadonlyProvider(provider),\n\t\tcreateMemoryProvider: (): VirtualProvider => new MemoryProvider(),\n\t\tcreateShadowProvider: (\n\t\t\tprovider: VirtualProvider,\n\t\t\tshadowOptions: ShadowProviderOptions,\n\t\t): VirtualProvider => new ShadowProvider(provider, shadowOptions),\n\t\tcreateShadowPathPredicate: (paths: readonly string[]): ShadowPredicate =>\n\t\t\tcreateShadowPathPredicate([...paths]),\n\t};\n}\n/ oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n\nfunction normalizeShadowPath(pathValue: string): string {\n\tconst trimmedPath = pathValue.trim();\n\tif (trimmedPath.startsWith('/')) {\n\t\treturn trimmedPath;\n\t}\n\n\tconst relativePath = trimmedPath.startsWith('./') ? trimmedPath.slice('./'.length) : trimmedPath;\n\treturn `/${relativePath}`;\n}\n\nfunction createRealFsProviderForSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n\tmountKind: string,\n): VirtualProvider {\n\tif (mountSpec.pinnedHostRoot) {\n\t\treturn dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot);\n\t}\n\tif (mountSpec.hostPath) {\n\t\treturn dependencies.createRealFsProvider(mountSpec.hostPath);\n\t}\n\n\tthrow new Error(`${mountKind} mounts require hostPath or pinnedHostRoot`);\n}\n\nfunction createProviderFromSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n): VirtualProvider {\n\tswitch (mountSpec.kind) {\n\t\tcase 'memory':\n\t\t\treturn dependencies.createMemoryProvider();\n\t\tcase 'realfs': {\n\t\t\treturn createRealFsProviderForSpec(mountSpec, dependencies, 'realfs');\n\t\t}\n\t\tcase 'realfs-readonly': {\n\t\t\treturn dependencies.createReadonlyProvider(\n\t\t\t\tcreateRealFsProviderForSpec(mountSpec, dependencies, 'realfs-readonly'),\n\t\t\t);\n\t\t}\n\t\tcase 'shadow': {\n\t\t\tconst baseProvider =\n\t\t\t\tmountSpec.hostPath \|\| mountSpec.pinnedHostRoot\n\t\t\t\t\t? createRealFsProviderForSpec(mountSpec, dependencies, 'shadow')\n\t\t\t\t\t: dependencies.createMemoryProvider();\n\n\t\t\tlet shadowProvider = baseProvider;\n\t\t\tconst shadowConfig = mountSpec.shadowConfig;\n\n\t\t\tif (shadowConfig?.deny.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.deny.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'deny',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (shadowConfig?.tmpfs.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.tmpfs.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'tmpfs',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn shadowProvider;\n\t\t}\n\t\tdefault: {\n\t\t\tthrow new Error(`Unsupported VFS mount kind: ${String(mountSpec.kind)}`);\n\t\t}\n\t}\n}\n\nfunction createVfsMounts(\n\tvfsMounts: Record<string, VfsMountSpec>,\n\tdependencies: ManagedVmDependencies,\n): Record<string, VirtualProvider> {\n\tconst mountMap: Record<string, VirtualProvider> = {};\n\n\tfor (const [guestPath, mountSpec] of Object.entries(vfsMounts)) {\n\t\tmountMap[guestPath] = createProviderFromSpec(mountSpec, dependencies);\n\t}\n\n\treturn mountMap;\n}\n\nfunction collectPinnedRealFsRoots(\n\tvfsMounts: Record<string, VfsMountSpec>,\n): readonly PinnedRealFsRoot[] {\n\tconst roots = new Map<number, PinnedRealFsRoot>();\n\tfor (const mountSpec of Object.values(vfsMounts)) {\n\t\tif (mountSpec.pinnedHostRoot) {\n\t\t\troots.set(mountSpec.pinnedHostRoot.fd, mountSpec.pinnedHostRoot);\n\t\t}\n\t}\n\treturn [...roots.values()];\n}\n\nfunction closePinnedRealFsRoots(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\tfor (const root of roots) {\n\t\tdependencies.closePinnedRealFsRoot(root);\n\t}\n}\n\nfunction closePinnedRealFsRootsAfterFailure(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\ttry {\n\t\tclosePinnedRealFsRoots(roots, dependencies);\n\t} catch {\n\t\t// Preserve the VM creation failure; leaked-fd risk is lower than hiding\n\t\t// the root cause of a failed lease.\n\t}\n}\n\nexport async function createManagedVm(\n\toptions: CreateVmOptions,\n\tdependencies: ManagedVmDependencies = createDefaultDependencies(),\n): Promise<ManagedVm> {\n\tconst hasTcpHosts = options.tcpHosts && Object.keys(options.tcpHosts).length > 0;\n\tconst pinnedRealFsRoots = collectPinnedRealFsRoots(options.vfsMounts);\n\tlet vmInstance: ManagedVmInstance;\n\ttry {\n\t\tconst hookBundle = dependencies.createHttpHooks({\n\t\t\tallowedHosts: options.allowedHosts,\n\t\t\tsecrets: options.secrets,\n\t\t\t...(options.onRequest ? { onRequest: options.onRequest } : {}),\n\t\t\t...(options.onResponse ? { onResponse: options.onResponse } : {}),\n\t\t});\n\t\tvmInstance = await dependencies.createVm({\n\t\t\t...(options.imagePath.length > 0 ? { sandbox: { imagePath: options.imagePath } } : {}),\n\t\t\t...(options.sessionLabel ? { sessionLabel: options.sessionLabel } : {}),\n\t\t\trootfs: {\n\t\t\t\tmode: options.rootfsMode,\n\t\t\t},\n\t\t\tmemory: options.memory,\n\t\t\tcpus: options.cpus,\n\t\t\tenv: {\n\t\t\t\t...hookBundle.env,\n\t\t\t\t...options.env,\n\t\t\t},\n\t\t\thttpHooks: hookBundle.httpHooks,\n\t\t\tvfs: {\n\t\t\t\tfuseMount: '/data',\n\t\t\t\tmounts: createVfsMounts(options.vfsMounts, dependencies),\n\t\t\t},\n\t\t\t...(hasTcpHosts\n\t\t\t\t? {\n\t\t\t\t\t\tdns: {\n\t\t\t\t\t\t\tmode: 'synthetic',\n\t\t\t\t\t\t\tsyntheticIPv4: SYNTHETIC_DNS_IPV4_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticIPv6: SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticHostMapping: 'per-host',\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttcp: {\n\t\t\t\t\t\t\thosts: options.tcpHosts,\n\t\t\t\t\t\t},\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t});\n\t} catch (error) {\n\t\tclosePinnedRealFsRootsAfterFailure(pinnedRealFsRoots, dependencies);\n\t\tthrow error;\n\t}\n\n\treturn {\n\t\tid: vmInstance.id,\n\t\tasync exec(command: string): Promise<ExecResult> {\n\t\t\tconst executionResult = await vmInstance.exec(command);\n\t\t\treturn {\n\t\t\t\texitCode: executionResult.exitCode,\n\t\t\t\tstdout: executionResult.stdout ?? '',\n\t\t\t\tstderr: executionResult.stderr ?? '',\n\t\t\t};\n\t\t},\n\t\tasync enableSsh(sshOptions?: EnableSshOptions): Promise<SshAccess> {\n\t\t\treturn await vmInstance.enableSsh(sshOptions);\n\t\t},\n\t\tasync enableIngress(ingressOptions?: EnableIngressOptions): Promise<IngressAccess> {\n\t\t\treturn await vmInstance.enableIngress(ingressOptions);\n\t\t},\n\t\tgetVmInstance(): ManagedVmInstance {\n\t\t\treturn vmInstance;\n\t\t},\n\t\tsetIngressRoutes(routes: readonly IngressRoute[]): void {\n\t\t\tvmInstance.setIngressRoutes(routes);\n\t\t},\n\t\tasync close(): Promise<void> {\n\t\t\tlet closeError: unknown;\n\t\t\ttry {\n\t\t\t\tawait vmInstance.close();\n\t\t\t} catch (error) {\n\t\t\t\tcloseError = error;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tclosePinnedRealFsRoots(pinnedRealFsRoots, dependencies);\n\t\t\t} catch (error) {\n\t\t\t\tcloseError ??= error;\n\t\t\t}\n\t\t\tif (closeError !== undefined) {\n\t\t\t\tthrow closeError;\n\t\t\t}\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nexport interface VolumeConfigEntry {\n\treadonly guestPath: string;\n}\n\nexport interface ResolvedVolume {\n\treadonly hostDir: string;\n\treadonly guestPath: string;\n}\n\nexport async function ensureVolumeDir(\n\tcacheBase: string,\n\tworkspaceHash: string,\n\tvolumeName: string,\n): Promise<string> {\n\tconst volumeDirectory = path.join(cacheBase, workspaceHash, volumeName);\n\tawait fs.mkdir(volumeDirectory, { recursive: true });\n\treturn volumeDirectory;\n}\n\nexport async function resolveVolumeDirs(\n\tcacheBase: string,\n\tworkspaceHash: string,\n\tvolumes: Readonly<Record<string, VolumeConfigEntry>>,\n): Promise<Record<string, ResolvedVolume>> {\n\tconst resolvedVolumeEntries = await Promise.all(\n\t\tObject.entries(volumes).map(\n\t\t\tasync ([volumeName, volumeConfig]) =>\n\t\t\t\t[\n\t\t\t\t\tvolumeName,\n\t\t\t\t\t{\n\t\t\t\t\t\tguestPath: volumeConfig.guestPath,\n\t\t\t\t\t\thostDir: await ensureVolumeDir(cacheBase, workspaceHash, volumeName),\n\t\t\t\t\t},\n\t\t\t\t] satisfies readonly [string, ResolvedVolume],\n\t\t),\n\t);\n\n\treturn Object.fromEntries(resolvedVolumeEntries);\n}\n","import fs from 'node:fs/promises';\n\nexport async function writeFileAtomically(\n\tfilePath: string,\n\tcontent: string,\n\toptions: {\n\t\treadonly mode?: number;\n\t} = {},\n): Promise<void> {\n\tconst temporaryFilePath = `${filePath}.${process.pid}.${Date.now()}.tmp`;\n\tawait fs.writeFile(temporaryFilePath, content, {\n\t\tencoding: 'utf8',\n\t\t...(options.mode ? { mode: options.mode } : {}),\n\t});\n\ttry {\n\t\tawait fs.rename(temporaryFilePath, filePath);\n\t} catch (renameError) {\n\t\ttry {\n\t\t\tawait fs.rm(temporaryFilePath, { force: true });\n\t\t} catch (cleanupError) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to replace '${filePath}' (${renameError instanceof Error ? renameError.message : JSON.stringify(renameError)}) and failed to remove temporary file '${temporaryFilePath}': ${cleanupError instanceof Error ? cleanupError.message : JSON.stringify(cleanupError)}`,\n\t\t\t\t{ cause: cleanupError },\n\t\t\t);\n\t\t}\n\t\tthrow renameError;\n\t}\n}\n"],"mappings":";;;;;;;;;;AAKA,MAAa,+BAA+B;;;;;;;;;;;AA+B5C,SAAS,uBAAuB,UAAkB,WAAuC;CACxF,OAAO,KAAK,WAAW,SAAS,GAAG,WAAW,KAAK,QAAQ,aAAa,QAAQ,KAAK,EAAE,SAAS;;AAGjG,eAAe,4BACd,aACA,WAC8B;CAC9B,MAAM,0BAA0B,YAAY,MAAM;CAClD,IAAI,CAAC,yBACJ;CAGD,MAAM,0BAA0B,uBAAuB,yBAAyB,UAAU;CAC1F,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,yBAAyB,OAAO;UACjD,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;EACtE,MAAM,IAAI,MACT,8CAA8C,wBAAwB,KAAK,WAC3E,EAAE,OAAO,OAAO,CAChB;;;AAIH,SAAS,uBAAuB,yBAAqD;CACpF,OAAO,0BACJ,GAAG,6BAA6B,SAAS,CAAC,MAAM,4BAChD;;AAGJ,eAAsB,uBACrB,SACmC;CACnC,MAAM,0BAA0B,MAAM,4BACrC,QAAQ,aACR,QAAQ,UACR;CAED,OAAO;EACN,SAAS,uBAAuB,wBAAwB;EACxD,kBAAkB;GACjB,wBAAwB;GACxB,GAAI,4BAA4B,KAAA,IAC7B,EAAE,GACF,EAAE,2BAA2B,yBAAyB;GACzD;EACD;;AAGF,eAAsB,6CACrB,SACuB;CACvB,MAAM,sBAAsB,KAAK,KAAK,QAAQ,WAAW,gCAAgC;CAEzF,MAAM,GAAG,UAAU,qBAAqB,QAAQ,wBAAwB;EACvE,UAAU;EACV,MAAM;EACN,CAAC;CAEF,OAAO;EACN,GAAG,QAAQ;EACX,MAAM;GACL,GAAG,QAAQ,YAAY;GACvB,iBAAiB;GACjB;EACD;;;;ACpEF,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;AAWD,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,gBAAgB,OAAwB;CAChD,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,IAAI,MAAM,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;CAGnE,IAAI,SAAS,MAAM,EAIlB,OAAO,IAHe,OAAO,QAAQ,MAAM,CACzC,QAAQ,GAAG,gBAAgB,eAAe,KAAA,EAAU,CACpD,UAAU,CAAC,UAAU,CAAC,cAAc,QAAQ,cAAc,SAAS,CAC7C,CACtB,KAAK,CAAC,UAAU,gBAAgB,GAAG,KAAK,UAAU,SAAS,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC7F,KAAK,IAAI,CAAC;CAGb,OAAO,KAAK,UAAU,MAAM;;AAG7B,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,eAAe,WAAW,UAAoC;CAC7D,IAAI;EACH,MAAM,GAAG,OAAO,SAAS;EACzB,OAAO;UACC,OAAO;EACf,IAAI,CAAC,mBAAmB,MAAM,EAC7B,MAAM;EAEP,OAAO;;;AAIT,eAAsB,oBAAoB,qBAA+C;CACxF,KAAK,MAAM,YAAY,0BAEtB,IAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,SAAS,CAAC,EAC/D,OAAO;CAGT,OAAO;;AAGR,eAAe,kBAEb;CACD,MAAM,iBAAiB,MAAM,OAAO;CACpC,OAAO,OACN,aACA,iBACA,cAEA,MAAM,eAAe,YAAY,aAAa;EAC7C,WAAW;EACX,SAAS;EACT,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;EAClC,CAAwB;;AAG3B,SAAS,sBAAsB,QAAkD;CAChF,SACC,OACA,oBACA,aACa;EACb,MAAM,gBAAgB,OAAO,uBAAuB,aAAa,qBAAqB;EACtF,MAAM,QAAQ,OAAO,MAAM,MAAM;EACjC,iBAAiB;EACjB,OAAO;;;AAIT,eAAe,wBACd,QACA,IACmB;CACnB,IAAI,CAAC,QACJ,OAAO,MAAM,IAAI;CAGlB,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,aAAa,QAAQ,IAAI;CAC/B,MAAM,kBAAkB,sBAAsB,OAAO;CAErD,QAAQ,OAAO,QAAQ;CACvB,QAAQ,OAAO,QAAQ;CACvB,QAAQ,IAAI,KAAK;CAEjB,IAAI;EACH,OAAO,MAAM,IAAI;WACR;EACT,QAAQ,OAAO,QAAQ;EACvB,QAAQ,OAAO,QAAQ;EACvB,IAAI,eAAe,KAAA,GAClB,OAAO,QAAQ,IAAI;OAEnB,QAAQ,IAAI,KAAK;;;AAKpB,SAAgB,wBACf,aACA,kBAA0B,WAC1B,kBACS;CACT,MAAM,UACL,qBAAqB,KAAA,IAClB,GAAG,gBAAgB,YAAY,CAAC,GAAG,oBACnC,GAAG,gBAAgB,YAAY,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,iBAAiB;CAE3F,OAAO,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,eAAsB,iCAAiC,SAQpD;CACF,MAAM,0BAA0B,MAAM,uBAAuB;EAC5D,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,CAAC;CAQF,OAAO;EACN,aARmB,wBAAwB,QAAQ,aAAa,QAAQ,iBAAiB;GACzF,wBAAwB,wBAAwB;GAChD,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,wBAAwB,QAAQ,kBAAkB;GACvD,CAGW;EACX,wBAAwB,wBAAwB;EAChD;;AAGF,eAAsB,WACrB,SACA,eAA0C,EAAE,EAChB;CAC5B,MAAM,4BAA4B,MAAM,iCAAiC;EACxE,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,kBAAkB,QAAQ,kBAAkB;EACjD,GAAI,aAAa,kBAAkB,EAAE,iBAAiB,aAAa,iBAAiB,GAAG,EAAE;EACzF,CAAC;CACF,MAAM,cAAc,0BAA0B;CAC9C,MAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,YAAY;CAE1D,IAAI,QAAQ,WACX,MAAM,GAAG,GAAG,WAAW;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC;CAGzD,IAAI,MAAM,oBAAoB,UAAU,EACvC,OAAO;EACN,OAAO;EACP;EACA;EACA;CAGF,MAAM,GAAG,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;CAC9C,MAAM,4BAA4B,aAAa,eAAgB,MAAM,iBAAiB;CACtF,MAAM,uBAAuB,MAAM,6CAA6C;EAC/E,aAAa,QAAQ;EACrB;EACA,wBAAwB,0BAA0B;EAClD,CAAC;CACF,MAAM,wBAAwB,QAAQ,QAAQ,YAAY;EACzD,MAAM,0BAA0B,sBAAsB,WAAW,QAAQ,UAAU;GAClF;CAEF,IAAI,CAAE,MAAM,oBAAoB,UAAU,EACzC,MAAM,IAAI,MAAM,6CAA6C,UAAU,GAAG;CAG3E,OAAO;EACN,OAAO;EACP;EACA;EACA;;;;AC3OF,MAAM,kBAAkB,cAAc,OAAO,KAAK,IAAI;AAEtD,MAAM,4BAA4B,EAAE,OAAO,EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC;AAEF,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,SAAS,gBAAgB,OAAwB;CAChD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAgB,uBAAuB,aAA6B;CACnE,MAAM,QAAQ,YAAY,MAAM,yCAAyC;CACzE,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,uGACA;CAGF,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,gCAAgC;CAEjD,OAAO;;AAGR,SAAgB,iCAAyC;CACxD,OAAO,gBAAgB,QAAQ,wCAAwC;;AAGxE,eAAsB,6BAA8C;CACnE,MAAM,kBAAkB,gCAAgC;CACxD,MAAM,SAAkB,KAAK,MAAM,MAAM,GAAG,SAAS,iBAAiB,OAAO,CAAC;CAE9E,OAAO,4BADa,0BAA0B,MAAM,OACN,CAAC;;AAOhD,eAAe,gCAAiD;CAC/D,MAAM,kBAAkB,gCAAgC;CACxD,OAAO,KAAK,KAAK,KAAK,QAAQ,gBAAgB,EAAE,QAAQ,SAAS,gBAAgB;;AAGlF,eAAsB,iCACrB,UAAmD,EAAE,EACnC;CAClB,MAAM,UAAU,QAAQ,mBAAoB,MAAM,+BAA+B;CACjF,IAAI;CACJ,IAAI;EACH,cAAc,MAAM,GAAG,SAAS,SAAS,OAAO;UACxC,OAAO;EACf,IAAI,mBAAmB,MAAM,EAC5B,MAAM,IAAI,MAAM,sCAAsC,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC;EAErF,MAAM,IAAI,MACT,6CAA6C,QAAQ,KAAK,gBAAgB,MAAM,IAChF,EAAE,OAAO,OAAO,CAChB;;CAGF,IAAI;EACH,OAAO,uBAAuB,YAAY;UAClC,OAAO;EACf,MAAM,IAAI,MACT,8CAA8C,QAAQ,KAAK,gBAAgB,MAAM,IACjF,EAAE,OAAO,OAAO,CAChB;;;;;AC3EH,MAAM,2BAA2B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAYD,SAAS,wBAAwB,UAAqC;CACrE,OAAO;EACN,KAAK,KAAK,UAAU,OAAO;EAC3B,KAAK,KAAK,UAAU,UAAU;EAC9B,KAAK,KAAK,UAAU,SAAS;EAC7B,KAAK,KAAK,UAAU,UAAU;EAC9B;;AAGF,SAAgB,sBAAsB,WAAmB,SAAyB;CACjF,IAAI,KAAK,WAAW,UAAU,EAC7B,OAAO,KAAK,QAAQ,UAAU;CAG/B,OAAO,KAAK,QAAQ,SAAS,UAAU;;AAGxC,SAAS,mBAAmB,eAAuB,YAA6B;CAC/E,MAAM,eAAe,KAAK,SAAS,YAAY,cAAc;CAC7D,OAAO,iBAAiB,MAAO,CAAC,aAAa,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW,aAAa;;AAGhG,eAAe,kBAAkB,UAAmC;CACnE,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAE/C,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,iBAAiB;SACnC;EACP,OAAO;;;AAIT,SAAS,aAAa,eAAuB,eAAgC;CAC5E,OACC,mBAAmB,eAAe,cAAc,IAChD,mBAAmB,eAAe,cAAc;;AAIlD,SAAgB,sBACf,WACA,QACA,SACO;CACP,MAAM,oBAAoB,sBAAsB,WAAW,QAAQ,QAAQ;CAC3E,MAAM,0BAA0B,OAAO,6BAA6B,KAAK,kBACxE,sBAAsB,eAAe,QAAQ,QAAQ,CACrD;CAKD,IAAI,CAHuB,wBAAwB,MAAM,kBACxD,mBAAmB,mBAAmB,cAAc,CAE9B,EACtB,MAAM,IAAI,MACT,8BAA8B,kBAAkB,mCAAmC,wBAAwB,KAAK,KAAK,CAAC,IACtH;CAGF,IAAI,CAAC,OAAO;MACuB,yBAAyB,MAAM,eAChE,mBAAmB,mBAAmB,WAAW,CAErB,EAC5B,MAAM,IAAI,MACT,8BAA8B,kBAAkB,4FAChD;;;AAKJ,eAAsB,2BACrB,QACA,SACgB;CAChB,MAAM,eAAe,OAAO,QAAQ,OAAO,YAAY;CACvD,KAAK,MAAM,CAAC,cAAc,cACzB,sBAAsB,WAAW,OAAO,eAAe,QAAQ;CAGhE,IAAI,OAAO,cAAc,gBACxB;CAGD,MAAM,2BAA2B,aAAa,QAAQ,GAAG,cAAc,KAAK,WAAW,SAAS,CAAC;CACjG,MAAM,CAAC,oBAAoB,qBAAqB,MAAM,QAAQ,IAAI,CACjE,QAAQ,IACP,wBAAwB,QAAQ,SAAS,CAAC,IACzC,OAAO,mBAAmB,MAAM,kBAAkB,eAAe,CACjE,CACD,EACD,QAAQ,IACP,yBAAyB,IAAI,OAAO,GAAG,cAAc,MAAM,kBAAkB,SAAS,CAAC,CACvF,CACD,CAAC;CAEF,KAAK,MAAM,4BAA4B,mBAKtC,IAJkC,mBAAmB,MAAM,mBAC1D,aAAa,0BAA0B,eAAe,CAG1B,EAC5B,MAAM,IAAI,MACT,uBAAuB,yBAAyB,gGAChD;;;;AC9GJ,SAAS,mBAAmB,MAAgC;CAC3D,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK;;AAG/B,SAAS,sBAAsB,eAA+B;CAC7D,OAAOA,KAAG,SACT,eACAA,KAAG,UAAU,WAAWA,KAAG,UAAU,cAAcA,KAAG,UAAU,WAChE;;AAGF,SAAgB,cAAc,UAAoC;CACjE,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,SAAS,EAC1C,MAAM,IAAI,MAAM,yDAAyD,WAAW;CAGrF,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAC/C,MAAM,KAAK,sBAAsB,iBAAiB;CAClD,IAAI;EACH,MAAM,QAAQA,KAAG,UAAU,GAAG;EAC9B,IAAI,CAAC,MAAM,aAAa,EACvB,MAAM,IAAI,MAAM,0CAA0C,mBAAmB;EAE9E,MAAM,WAAWA,KAAG,aAAa,iBAAiB;EAClD,MAAM,gBAAgBA,KAAG,SAAS,SAAS;EAC3C,IAAI,cAAc,QAAQ,MAAM,OAAO,cAAc,QAAQ,MAAM,KAClE,MAAM,IAAI,MACT,6CAA6C,iBAAiB,UAAU,MAAM,IAAI,GAAG,MAAM,IAAI,mBAAmB,cAAc,IAAI,GAAG,cAAc,MACrJ;EAEF,OAAO;GACN,QAAQ,MAAM;GACd;GACA,UAAU;GACV,OAAO,MAAM;GACb;GACA;UACO,OAAO;EACf,KAAG,UAAU,GAAG;EAChB,MAAM;;;AAIR,SAAgB,sBAAsB,MAA8B;CACnE,KAAG,UAAU,KAAK,GAAG;;AAGtB,SAAgB,uBAAuB,MAA8B;CACpE,MAAM,cAAcA,KAAG,UAAU,KAAK,GAAG;CACzC,MAAM,eAAeA,KAAG,SAAS,KAAK,SAAS;CAC/C,IACC,YAAY,QAAQ,KAAK,UACzB,YAAY,QAAQ,KAAK,SACzB,aAAa,QAAQ,KAAK,UAC1B,aAAa,QAAQ,KAAK,OAE1B,MAAM,IAAI,MACT,mDAAmD,KAAK,SAAS,YAAY,mBAAmB,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,aAAa,MAC9I;;AAUH,SAAgB,2BACf,SACkB;CAClB,uBAAuB,QAAQ,KAAK;CACpC,MAAM,WAAW,QAAQ,qBAAqB,QAAQ,KAAK,SAAS;CAEpE,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,OAAO,UAAU,YACpB,OAAO;EAGR,QAAQ,GAAG,oBAAiD;GAC3D,uBAAuB,QAAQ,KAAK;GACpC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;IAGxE,CAAC;;;;AClGH,SAAgB,kBAAkB,aAA6B;CAC9D,OAAO,YAAY,MAAM,CAAC,aAAa,CAAC,QAAQ,SAAS,GAAG;;AAG7D,SAAgB,aAAa,QAAqC;CACjE,MAAM,gCAAgB,IAAI,KAAa;CACvC,MAAM,mBAA6B,EAAE;CAErC,KAAK,MAAM,SAAS,QAAQ;EAC3B,MAAM,kBAAkB,kBAAkB,MAAM;EAChD,IAAI,gBAAgB,WAAW,KAAK,gBAAgB,WAAW,IAAI,EAClE;EAGD,IAAI,CAAC,cAAc,IAAI,gBAAgB,EAAE;GACxC,cAAc,IAAI,gBAAgB;GAClC,iBAAiB,KAAK,gBAAgB;;;CAIxC,OAAO;;AAGR,SAAgB,cAAc,SAAkC;CAC/D,OAAO,aAAa;EAAC,GAAG,QAAQ;EAAM,GAAG,QAAQ;EAAS,GAAG,QAAQ;EAAM,CAAC;;;;ACI7E,SAAS,YAAY,SAAuB;CAC3C,QAAQ,OAAO,MAAM,GAAG,QAAQ,IAAI;;AAGrC,SAAS,mBAAmB,OAAwB;CACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAS,yBAA+B;CACvC,IAAI,QAAQ,aAAa,UACxB,MAAM,IAAI,MACT,oJACA;;AAIH,SAAS,cACR,SACA,MACA,SAC0B;CAC1B,OAAO,IAAI,SAAS,SAAS,WAAW;EACvC,SACC,SACA,CAAC,GAAG,KAAK,EACT;GAAE,KAAK,SAAS;GAAK,SAAS;GAAQ,GACrC,OAAO,QAAQ,WAAW;GAC1B,IAAI,OAAO;IACV,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM;IACnF,uBAAO,IAAI,MAAM,GAAG,QAAQ,WAAW,OAAO,MAAM,IAAI,eAAe,CAAC;IACxE;;GAGD,QAAQ;IAAE;IAAQ;IAAQ,CAAC;IAE5B;GACA;;AAGH,MAAM,0BAA0B;AAEhC,eAAsB,2BACrB,QACA,cAOkB;CAClB,MAAM,OAAO,cAAc,iBAAiB;CAE5C,QAAQ,OAAO,MAAf;EACC,KAAK,UAAU;GAGd,MAAM,SAAQ,MADO,KAAK,MAAM,CAAC,QAAQ,OAAO,IAAI,CAAC,EAChC,OAAO,MAAM;GAClC,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,MAAM,+CAA+C;GAGhE,OAAO;;EAGR,KAAK,OAAO;GACX,MAAM,SAAS,OAAO,UAAU;GAChC,MAAM,QAAQ,QAAQ,IAAI,SAAS,MAAM;GACzC,IAAI,CAAC,OACJ,MAAM,IAAI,MAAM,wBAAwB,OAAO,aAAa;GAG7D,OAAO;;EAGR,KAAK,YAAY;GAChB,wBAAwB;GAGxB,IAAI,CAAC,wBAAwB,KAAK,OAAO,QAAQ,EAChD,MAAM,IAAI,MAAM,oDAAoD;GAGrE,IAAI,CAAC,wBAAwB,KAAK,OAAO,QAAQ,EAChD,MAAM,IAAI,MAAM,oDAAoD;GAYrE,MAAM,SAAQ,MARO,KAAK,YAAY;IACrC;IACA;IACA,OAAO;IACP;IACA,OAAO;IACP;IACA,CAAC,EACmB,OAAO,MAAM;GAClC,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,MAAM,iDAAiD;GAGlE,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,6BAA6B,KAAK,UAAU,OAAO,GAAG;;;AAqBzE,eAAe,uBACd,qBACA,iBACA,MAKkB;CAOlB,QAAO,MANc,KAAK,MAAM,CAAC,QAAQ,gBAAgB,EAAE,EAC1D,KAAK;EACJ,GAAG,QAAQ;EACX,0BAA0B;EAC1B,EACD,CAAC,EACY,OAAO,MAAM;;AAG5B,eAAe,2BACd,qBACA,MACA,MAKkC;CAClC,MAAM,kBAA0C,EAAE;CAClD,MAAM,WAAoB,EAAE;CAE5B,KAAK,MAAM,CAAC,YAAY,cAAc,OAAO,QAAQ,KAAK,EACzD,IAAI;EAGH,gBAAgB,cAAc,MAAM,uBACnC,qBACA,UAAU,KACV,KACA;UACO,OAAO;EACf,SAAS,KACR,IAAI,MACH,6BAA6B,WAAW,UAAU,UAAU,IAAI,iBAAiB,mBAAmB,MAAM,IAC1G,EAAE,OAAO,OAAO,CAChB,CACD;;CAIH,IAAI,SAAS,SAAS,GACrB,MAAM,IAAI,eACT,UACA,qBAAqB,OAAO,SAAS,OAAO,CAAC,yBAC7C;CAGF,OAAO;;AAGR,SAAS,4BAA4B,OAAsC;CAC1E,OAAO,aAAa,SAAS,OAAO,MAAM,YAAY,WACnD,GAAG,MAAM,KAAK,IAAI,MAAM,YACxB,MAAM;;AAGV,SAAS,mBAAmB,SAIjB;CACV,MAAM,qBAAqB,QAAQ,SAAS,oBAAoB,QAAQ;CACxE,IAAI,CAAC,oBACJ,MAAM,IAAI,MACT,8CAA8C,QAAQ,WAAW,KAAK,QAAQ,gBAAgB,IAC9F;CAEF,IAAI,mBAAmB,YAAY,KAAA,GAClC,OAAO,mBAAmB,QAAQ;CAEnC,IAAI,mBAAmB,UAAU,KAAA,GAChC,MAAM,IAAI,MACT,wCAAwC,QAAQ,WAAW,KAAK,QAAQ,gBAAgB,KAAK,4BAA4B,mBAAmB,MAAM,GAClJ;CAEF,MAAM,IAAI,MACT,oEAAoE,QAAQ,WAAW,KAAK,QAAQ,gBAAgB,IACpH;;AAGF,SAAS,yBACR,MACA,UACyB;CACzB,OAAO,OAAO,YACb,OAAO,QAAQ,KAAK,CAAC,KAAK,CAAC,YAAY,eAAe,CACrD,YACA,mBAAmB;EAClB;EACA;EACA,iBAAiB,UAAU;EAC3B,CAAC,CACF,CAAC,CACF;;AAGF,eAAsB,qBACrB,SAGA,eAAiD,EAAE,EACzB;CAC1B,MAAM,OAAO,aAAa,iBAAiB;CAC3C,IAAI;EACH,MAAM,SAAS,OAAO,aAAa,gBAAgB,cAAc;GAChE,MAAM,QAAQ;GACd,iBAAiB,aAAa,mBAAmB;GACjD,oBAAoB,aAAa,sBAAsB;GACvD,CAAC;EAEF,OAAO;GACN,SAAS,OAAO,QAAoC;IACnD,IAAI;KACH,OAAO,MAAM,OAAO,QAAQ,QAAQ,IAAI,IAAI;aACpC,OAAO;KACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KACtE,YACC,sDAAsD,IAAI,IAAI,4BAA4B,UAC1F;KACD,OAAO,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;;;GAGjF,YAAY,OAAO,SAAqE;IACvF,IAAI;KAIH,OAAO,yBAAyB,MAAM,MAHf,OAAO,QAAQ,WACrC,OAAO,OAAO,KAAK,CAAC,KAAK,cAAc,UAAU,IAAI,CACrD,CAC8C;aACvC,OAAO;KAEf,YACC,2FAFe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAGrE;KACD,OAAO,MAAM,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK;;;GAGlF;UACO,OAAO;EAEf,YACC,mFAFe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAGrE;EACD,OAAO;GACN,SAAS,OAAO,QACf,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;GACzE,YAAY,OAAO,SAClB,MAAM,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK;GAC1E;;;AAIH,eAAsB,0BACrB,SAGA,eAAwE,EAAE,EAChD;CAC1B,MAAM,OAAO,aAAa,iBAAiB;CAE3C,OAAO;EACN,SAAS,OAAO,QACf,MAAM,uBAAuB,QAAQ,qBAAqB,IAAI,KAAK,KAAK;EACzE,YAAY,OAAO,SAClB,MAAM,2BAA2B,QAAQ,qBAAqB,MAAM,KAAK;EAC1E;;;;ACnTF,MAAa,+BAA+B;AAC5C,MAAa,2CAA2C;AA2FxD,SAAS,4BAAmD;CAC3D,MAAM,+BAA+B,aACpC,IAAI,eAAe,SAAS;CAC7B,OAAO;EACN,UAAU,OAAO,cACf,MAAM,GAAG,OAAO,UAAU;EAC5B,kBAAkB,gBACjB,gBAAgB;GACf,cAAc,CAAC,GAAG,YAAY,aAAa;GAC3C,SAAS,OAAO,YACf,OAAO,QAAQ,YAAY,QAAQ,CAAC,KAAK,CAAC,YAAY,gBAAgB,CACrE,YACA;IACC,OAAO,CAAC,GAAG,WAAW,MAAM;IAC5B,OAAO,WAAW;IAClB,CACD,CAAC,CACF;GACD,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,WAAW,GAAG,EAAE;GACrE,GAAI,YAAY,aAAa,EAAE,YAAY,YAAY,YAAY,GAAG,EAAE;GACxE,CAAC;EACH;EACA,6BAA6B,SAC5B,2BAA2B;GAC1B,sBAAsB;GACtB;GACA,CAAC;EACH,sBAAsB;EACtB,yBAAyB,aACxB,IAAI,iBAAiB,SAAS;EAC/B,4BAA6C,IAAI,gBAAgB;EACjE,uBACC,UACA,kBACqB,IAAI,eAAe,UAAU,cAAc;EACjE,4BAA4B,UAC3B,0BAA0B,CAAC,GAAG,MAAM,CAAC;EACtC;;AAIF,SAAS,oBAAoB,WAA2B;CACvD,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,YAAY,WAAW,IAAI,EAC9B,OAAO;CAIR,OAAO,IADc,YAAY,WAAW,KAAK,GAAG,YAAY,MAAM,EAAY,GAAG;;AAItF,SAAS,4BACR,WACA,cACA,WACkB;CAClB,IAAI,UAAU,gBACb,OAAO,aAAa,2BAA2B,UAAU,eAAe;CAEzE,IAAI,UAAU,UACb,OAAO,aAAa,qBAAqB,UAAU,SAAS;CAG7D,MAAM,IAAI,MAAM,GAAG,UAAU,4CAA4C;;AAG1E,SAAS,uBACR,WACA,cACkB;CAClB,QAAQ,UAAU,MAAlB;EACC,KAAK,UACJ,OAAO,aAAa,sBAAsB;EAC3C,KAAK,UACJ,OAAO,4BAA4B,WAAW,cAAc,SAAS;EAEtE,KAAK,mBACJ,OAAO,aAAa,uBACnB,4BAA4B,WAAW,cAAc,kBAAkB,CACvE;EAEF,KAAK,UAAU;GAMd,IAAI,iBAJH,UAAU,YAAY,UAAU,iBAC7B,4BAA4B,WAAW,cAAc,SAAS,GAC9D,aAAa,sBAAsB;GAGvC,MAAM,eAAe,UAAU;GAE/B,IAAI,cAAc,KAAK,QACtB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,KAAK,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACtE;IACD,WAAW;IACX,CAAC;GAGH,IAAI,cAAc,MAAM,QACvB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,MAAM,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACvE;IACD,WAAW;IACX,CAAC;GAGH,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,+BAA+B,OAAO,UAAU,KAAK,GAAG;;;AAK3E,SAAS,gBACR,WACA,cACkC;CAClC,MAAM,WAA4C,EAAE;CAEpD,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,UAAU,EAC7D,SAAS,aAAa,uBAAuB,WAAW,aAAa;CAGtE,OAAO;;AAGR,SAAS,yBACR,WAC8B;CAC9B,MAAM,wBAAQ,IAAI,KAA+B;CACjD,KAAK,MAAM,aAAa,OAAO,OAAO,UAAU,EAC/C,IAAI,UAAU,gBACb,MAAM,IAAI,UAAU,eAAe,IAAI,UAAU,eAAe;CAGlE,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC;;AAG3B,SAAS,uBACR,OACA,cACO;CACP,KAAK,MAAM,QAAQ,OAClB,aAAa,sBAAsB,KAAK;;AAI1C,SAAS,mCACR,OACA,cACO;CACP,IAAI;EACH,uBAAuB,OAAO,aAAa;SACpC;;AAMT,eAAsB,gBACrB,SACA,eAAsC,2BAA2B,EAC5C;CACrB,MAAM,cAAc,QAAQ,YAAY,OAAO,KAAK,QAAQ,SAAS,CAAC,SAAS;CAC/E,MAAM,oBAAoB,yBAAyB,QAAQ,UAAU;CACrE,IAAI;CACJ,IAAI;EACH,MAAM,aAAa,aAAa,gBAAgB;GAC/C,cAAc,QAAQ;GACtB,SAAS,QAAQ;GACjB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GAC7D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;GAChE,CAAC;EACF,aAAa,MAAM,aAAa,SAAS;GACxC,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,GAAG,EAAE;GACrF,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,cAAc,GAAG,EAAE;GACtE,QAAQ,EACP,MAAM,QAAQ,YACd;GACD,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,KAAK;IACJ,GAAG,WAAW;IACd,GAAG,QAAQ;IACX;GACD,WAAW,WAAW;GACtB,KAAK;IACJ,WAAW;IACX,QAAQ,gBAAgB,QAAQ,WAAW,aAAa;IACxD;GACD,GAAI,cACD;IACA,KAAK;KACJ,MAAM;KACN,eAAe;KACf,eAAe;KACf,sBAAsB;KACtB;IACD,KAAK,EACJ,OAAO,QAAQ,UACf;IACD,GACA,EAAE;GACL,CAAC;UACM,OAAO;EACf,mCAAmC,mBAAmB,aAAa;EACnE,MAAM;;CAGP,OAAO;EACN,IAAI,WAAW;EACf,MAAM,KAAK,SAAsC;GAChD,MAAM,kBAAkB,MAAM,WAAW,KAAK,QAAQ;GACtD,OAAO;IACN,UAAU,gBAAgB;IAC1B,QAAQ,gBAAgB,UAAU;IAClC,QAAQ,gBAAgB,UAAU;IAClC;;EAEF,MAAM,UAAU,YAAmD;GAClE,OAAO,MAAM,WAAW,UAAU,WAAW;;EAE9C,MAAM,cAAc,gBAA+D;GAClF,OAAO,MAAM,WAAW,cAAc,eAAe;;EAEtD,gBAAmC;GAClC,OAAO;;EAER,iBAAiB,QAAuC;GACvD,WAAW,iBAAiB,OAAO;;EAEpC,MAAM,QAAuB;GAC5B,IAAI;GACJ,IAAI;IACH,MAAM,WAAW,OAAO;YAChB,OAAO;IACf,aAAa;;GAEd,IAAI;IACH,uBAAuB,mBAAmB,aAAa;YAC/C,OAAO;IACf,eAAe;;GAEhB,IAAI,eAAe,KAAA,GAClB,MAAM;;EAGR;;;;ACnWF,eAAsB,gBACrB,WACA,eACA,YACkB;CAClB,MAAM,kBAAkB,KAAK,KAAK,WAAW,eAAe,WAAW;CACvE,MAAM,GAAG,MAAM,iBAAiB,EAAE,WAAW,MAAM,CAAC;CACpD,OAAO;;AAGR,eAAsB,kBACrB,WACA,eACA,SAC0C;CAC1C,MAAM,wBAAwB,MAAM,QAAQ,IAC3C,OAAO,QAAQ,QAAQ,CAAC,IACvB,OAAO,CAAC,YAAY,kBACnB,CACC,YACA;EACC,WAAW,aAAa;EACxB,SAAS,MAAM,gBAAgB,WAAW,eAAe,WAAW;EACpE,CACD,CACF,CACD;CAED,OAAO,OAAO,YAAY,sBAAsB;;;;ACtCjD,eAAsB,oBACrB,UACA,SACA,UAEI,EAAE,EACU;CAChB,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,IAAI,GAAG,KAAK,KAAK,CAAC;CACnE,MAAM,GAAG,UAAU,mBAAmB,SAAS;EAC9C,UAAU;EACV,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,MAAM,GAAG,EAAE;EAC9C,CAAC;CACF,IAAI;EACH,MAAM,GAAG,OAAO,mBAAmB,SAAS;UACpC,aAAa;EACrB,IAAI;GACH,MAAM,GAAG,GAAG,mBAAmB,EAAE,OAAO,MAAM,CAAC;WACvC,cAAc;GACtB,MAAM,IAAI,MACT,sBAAsB,SAAS,KAAK,uBAAuB,QAAQ,YAAY,UAAU,KAAK,UAAU,YAAY,CAAC,yCAAyC,kBAAkB,KAAK,wBAAwB,QAAQ,aAAa,UAAU,KAAK,UAAU,aAAa,IACxQ,EAAE,OAAO,cAAc,CACvB;;EAEF,MAAM"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/gondolin-adapter",
-  "version": "0.0.63",
+  "version": "0.0.65",
   "description": "Adapter over @earendil-works/gondolin: VM build pipeline, image cache, and secret resolver.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {