@agent-vm/gondolin-vm-adapter 0.0.124 → 0.0.126

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.js +1 -1
  2. package/dist/index.js.map +1 -1
  3. package/package.json +3 -3
package/dist/index.js CHANGED
@@ -589,7 +589,7 @@ function toRelativeProviderPath(providerPath) {
589
589
  return normalizedPath === "/" ? "" : normalizedPath.slice(1);
590
590
  }
591
591
  function isEqualOrDescendant(candidatePath, ancestorPath) {
592
- return candidatePath === ancestorPath || candidatePath.startsWith(`${ancestorPath}/`);
592
+ return ancestorPath.length === 0 || candidatePath === ancestorPath || candidatePath.startsWith(`${ancestorPath}/`);
593
593
  }
594
594
  function pathsOverlap(firstPath, secondPath) {
595
595
  return isEqualOrDescendant(firstPath, secondPath) || isEqualOrDescendant(secondPath, firstPath);
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","names":["isRecord","fs","net","createNativeManagedVm"],"sources":["../src/rootfs-init-extra.ts","../src/build-pipeline.ts","../src/exact-recorded-process-termination.ts","../src/gondolin-package.ts","../src/pinned-realfs.ts","../src/filtered-workspace-provider.ts","../src/host-network-defaults.ts","../src/vm-adapter.ts","../src/managed-vm-provider.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport const agentVmRootfsInitExtraScript = `# Generated by agent-vm.\n# Gondolin mounts devtmpfs over /dev at boot, so Docker-image /dev symlinks are hidden.\nmkdir -p /dev\nln -sfn /proc/self/fd /dev/fd 2>/dev/null || true\nln -sfn /proc/self/fd/0 /dev/stdin 2>/dev/null || true\nln -sfn /proc/self/fd/1 /dev/stdout 2>/dev/null || true\nln -sfn /proc/self/fd/2 /dev/stderr 2>/dev/null || true\nif [ ! -e /dev/ptmx ] && [ -e /dev/pts/ptmx ]; then\n ln -sfn pts/ptmx /dev/ptmx 2>/dev/null || true\nfi\n`;\n\ninterface PrepareRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly imagePath: string;\n\treadonly rootfsInitExtraContent: string;\n}\n\ninterface ResolveRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}\n\n/**\n * Backend projection of the domain-owned managed Gateway boot contract.\n *\n * The projection is deliberately closed: callers select the framework image\n * entry, while executable paths, arguments, environment-input paths, and log\n * identities remain adapter-owned image behavior.\n */\nexport interface GondolinManagedGatewayBootProjection {\n\treadonly frameworkBootEntry: 'hermes-framework-service' | 'openclaw-framework-service';\n\treadonly kind: 'managed-gateway-exact-two-role';\n}\n\nexport interface ResolvedRootfsInitExtra {\n\treadonly content: string;\n\treadonly fingerprintInput: {\n\t\treadonly agentVmRootfsInitExtra: string;\n\t\treadonly deploymentRootfsInitExtra?: string;\n\t\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\t};\n}\n\nconst managedGatewayEnvironmentInputRoot = '/run/agent-vm/managed-gateway-environment';\nconst managedGatewayStructuredInputRoot = '/run/agent-vm/managed-gateway';\nconst managedGatewayRuntimeRoot = '/run/agent-vm/gateway-runtime';\nconst managedGatewayLogRoot = '/var/log/agent-vm';\n\nfunction frameworkBootCommand(\n\tframeworkBootEntry: GondolinManagedGatewayBootProjection['frameworkBootEntry'],\n): string {\n\tswitch (frameworkBootEntry) {\n\t\tcase 'hermes-framework-service':\n\t\t\treturn '/usr/local/bin/agent-vm-hermes-gateway';\n\t\tcase 'openclaw-framework-service':\n\t\t\treturn '/usr/local/bin/openclaw gateway --port 18789';\n\t}\n}\n\nfunction frameworkLogFileName(\n\tframeworkBootEntry: GondolinManagedGatewayBootProjection['frameworkBootEntry'],\n): string {\n\treturn frameworkBootEntry === 'openclaw-framework-service'\n\t\t? 'openclaw-service.log'\n\t\t: 'hermes-service.log';\n}\n\nexport function renderManagedGatewayRootfsInitScript(\n\tprojection: GondolinManagedGatewayBootProjection,\n): string {\n\tconst selectedFrameworkBootCommand = frameworkBootCommand(projection.frameworkBootEntry);\n\tconst selectedFrameworkLogPath = `${managedGatewayLogRoot}/${frameworkLogFileName(projection.frameworkBootEntry)}`;\n\tconst frameworkBootInputFileNames = 'framework-service.json';\n\tconst serviceEnvironmentIsolationPrefix =\n\t\tprojection.frameworkBootEntry === 'hermes-framework-service' ? '/usr/bin/env -i ' : '';\n\treturn `# Fixed managed Gateway sibling boot entries.\nmanaged_gateway_environment_input_root=${managedGatewayEnvironmentInputRoot}\nmanaged_gateway_structured_input_root=${managedGatewayStructuredInputRoot}\nmkdir -p ${managedGatewayLogRoot}\ninstall -d -m 0700 ${managedGatewayRuntimeRoot}\ninstall -m 0600 /dev/null ${managedGatewayLogRoot}/tool-portal-service.log\ninstall -m 0600 /dev/null ${selectedFrameworkLogPath}\n(\n if [ ! -f \"$managed_gateway_environment_input_root/tool-portal.environment.sh\" ]; then exit 78; fi\n for managed_gateway_input_name in tool-portal-service.json mcp.config.json; do\n if [ ! -f \"$managed_gateway_structured_input_root/$managed_gateway_input_name\" ]; then exit 78; fi\n done\n exec ${serviceEnvironmentIsolationPrefix}/bin/sh -c 'set -a; . ${managedGatewayEnvironmentInputRoot}/tool-portal.environment.sh || exit 78; set +a; rm -- ${managedGatewayEnvironmentInputRoot}/tool-portal.environment.sh || exit 78; exec /usr/local/bin/agent-vm-gateway-runtime --config ${managedGatewayStructuredInputRoot}/tool-portal-service.json'\n) >> ${managedGatewayLogRoot}/tool-portal-service.log 2>&1 &\n(\n if [ ! -f \"$managed_gateway_environment_input_root/framework.environment.sh\" ]; then exit 78; fi\n for managed_gateway_input_name in ${frameworkBootInputFileNames}; do\n if [ ! -f \"$managed_gateway_structured_input_root/$managed_gateway_input_name\" ]; then exit 78; fi\n done\n exec ${serviceEnvironmentIsolationPrefix}/bin/sh -c 'set -a; . ${managedGatewayEnvironmentInputRoot}/framework.environment.sh || exit 78; set +a; rm -- ${managedGatewayEnvironmentInputRoot}/framework.environment.sh || exit 78; exec ${selectedFrameworkBootCommand}'\n) >> ${selectedFrameworkLogPath} 2>&1 &\n`;\n}\n\nfunction resolveBuildConfigPath(filePath: string, configDir: string | undefined): string {\n\treturn path.isAbsolute(filePath) ? filePath : path.resolve(configDir ?? process.cwd(), filePath);\n}\n\nasync function readExistingRootfsInitExtra(\n\tbuildConfig: BuildConfig,\n\tconfigDir: string | undefined,\n): Promise<string | undefined> {\n\tconst existingRootfsInitExtra = buildConfig.init?.rootfsInitExtra;\n\tif (!existingRootfsInitExtra) {\n\t\treturn undefined;\n\t}\n\n\tconst resolvedRootfsInitExtra = resolveBuildConfigPath(existingRootfsInitExtra, configDir);\n\ttry {\n\t\treturn await fs.readFile(resolvedRootfsInitExtra, 'utf8');\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin rootfs init extra '${resolvedRootfsInitExtra}': ${message}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction composeRootfsInitExtra(existingRootfsInitExtra: string | undefined): string {\n\treturn existingRootfsInitExtra\n\t\t? `${agentVmRootfsInitExtraScript.trimEnd()}\\n\\n${existingRootfsInitExtra}`\n\t\t: agentVmRootfsInitExtraScript;\n}\n\nexport async function resolveRootfsInitExtra(\n\toptions: ResolveRootfsInitExtraOptions,\n): Promise<ResolvedRootfsInitExtra> {\n\tif (options.managedGatewayBoot !== undefined && options.buildConfig.init?.rootfsInitExtra) {\n\t\tthrow new Error(\n\t\t\t'Managed Gateway images cannot compose deployment-authored rootfs init authority.',\n\t\t);\n\t}\n\tconst existingRootfsInitExtra = await readExistingRootfsInitExtra(\n\t\toptions.buildConfig,\n\t\toptions.configDir,\n\t);\n\tconst managedGatewayRootfsInitExtra =\n\t\toptions.managedGatewayBoot === undefined\n\t\t\t? undefined\n\t\t\t: renderManagedGatewayRootfsInitScript(options.managedGatewayBoot);\n\tconst composedRootfsInitExtra = composeRootfsInitExtra(existingRootfsInitExtra);\n\n\treturn {\n\t\tcontent:\n\t\t\tmanagedGatewayRootfsInitExtra === undefined\n\t\t\t\t? composedRootfsInitExtra\n\t\t\t\t: `${composedRootfsInitExtra.trimEnd()}\\n\\n${managedGatewayRootfsInitExtra}`,\n\t\tfingerprintInput: {\n\t\t\tagentVmRootfsInitExtra: agentVmRootfsInitExtraScript,\n\t\t\t...(existingRootfsInitExtra === undefined\n\t\t\t\t? {}\n\t\t\t\t: { deploymentRootfsInitExtra: existingRootfsInitExtra }),\n\t\t\t...(options.managedGatewayBoot === undefined\n\t\t\t\t? {}\n\t\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t\t},\n\t};\n}\n\nexport async function prepareBuildConfigWithAgentVmRootfsInitExtra(\n\toptions: PrepareRootfsInitExtraOptions,\n): Promise<BuildConfig> {\n\tconst rootfsInitExtraPath = path.join(options.imagePath, 'agent-vm-rootfs-init-extra.sh');\n\n\tawait fs.writeFile(rootfsInitExtraPath, options.rootfsInitExtraContent, {\n\t\tencoding: 'utf8',\n\t\tmode: 0o755,\n\t});\n\n\treturn {\n\t\t...options.buildConfig,\n\t\tinit: {\n\t\t\t...options.buildConfig.init,\n\t\t\trootfsInitExtra: rootfsInitExtraPath,\n\t\t},\n\t};\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig, BuildOptions } from '@earendil-works/gondolin';\nimport { validateBuildConfig } from '@earendil-works/gondolin';\n\nimport {\n\tprepareBuildConfigWithAgentVmRootfsInitExtra,\n\tresolveRootfsInitExtra,\n\ttype GondolinManagedGatewayBootProjection,\n} from './rootfs-init-extra.js';\n\nexport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport interface BuildImageOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly cacheDir: string;\n\t/** Directory to resolve relative paths in buildConfig (e.g. postBuild.copy.src).\n\t * Defaults to process.cwd() if not provided. */\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\treadonly output?: BuildOutput;\n}\n\nexport interface BuildOutput {\n\twrite(chunk: string | Uint8Array): boolean;\n}\n\nexport interface BuildImageResult {\n\treadonly built: boolean;\n\treadonly fingerprint: string;\n\treadonly imagePath: string;\n}\n\nexport interface GondolinImageBuildToolingOptions {\n\treadonly buildConfig: unknown;\n\treadonly cacheDir: string;\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\treadonly output?: BuildOutput;\n}\n\nexport interface GondolinImageFingerprintOptions {\n\treadonly buildConfig: unknown;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}\n\nexport interface GondolinImageBuildTooling {\n\tbuildImage(\n\t\toptions: GondolinImageBuildToolingOptions,\n\t\tdependencies?: { readonly gondolinVersion?: string },\n\t): Promise<BuildImageResult>;\n\tcomputeFingerprint(options: GondolinImageFingerprintOptions): Promise<string>;\n}\n\nexport const buildImageAssetFileNames = [\n\t'manifest.json',\n\t'rootfs.ext4',\n\t'initramfs.cpio.lz4',\n\t'vmlinuz-virt',\n] as const;\n\nfunction requireValidBuildConfig(buildConfig: unknown): BuildConfig {\n\tif (!validateBuildConfig(buildConfig)) {\n\t\tthrow new Error('Managed VM image recipe has an invalid build shape.');\n\t}\n\treturn buildConfig;\n}\n\nexport function createGondolinImageBuildTooling(): GondolinImageBuildTooling {\n\treturn {\n\t\tasync buildImage(options, dependencies) {\n\t\t\treturn await buildImage(\n\t\t\t\t{\n\t\t\t\t\t...options,\n\t\t\t\t\tbuildConfig: requireValidBuildConfig(options.buildConfig),\n\t\t\t\t},\n\t\t\t\tdependencies,\n\t\t\t);\n\t\t},\n\t\tasync computeFingerprint(options) {\n\t\t\tconst result = await computeEffectiveBuildFingerprint({\n\t\t\t\t...options,\n\t\t\t\tbuildConfig: requireValidBuildConfig(options.buildConfig),\n\t\t\t});\n\t\t\treturn result.fingerprint;\n\t\t},\n\t};\n}\n\ninterface BuildPipelineDependencies {\n\treadonly buildAssets?: (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t) => Promise<unknown>;\n\treadonly gondolinVersion?: string;\n}\n\nconst inFlightImageBuilds = new Map<string, Promise<BuildImageResult>>();\nconst gondolinWorkDirectoryName = '.agent-vm-gondolin-work';\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null;\n}\n\nfunction stableSerialize(value: unknown): string {\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((entry) => stableSerialize(entry)).join(',')}]`;\n\t}\n\n\tif (isRecord(value)) {\n\t\tconst objectEntries = Object.entries(value)\n\t\t\t.filter(([, entryValue]) => entryValue !== undefined)\n\t\t\t.toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n\t\treturn `{${objectEntries\n\t\t\t.map(([entryKey, entryValue]) => `${JSON.stringify(entryKey)}:${stableSerialize(entryValue)}`)\n\t\t\t.join(',')}}`;\n\t}\n\n\treturn JSON.stringify(value);\n}\n\nfunction isMissingPathError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait fs.access(filePath);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (!isMissingPathError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn false;\n\t}\n}\n\nexport async function hasBuiltImageAssets(outputDirectoryPath: string): Promise<boolean> {\n\tfor (const fileName of buildImageAssetFileNames) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- each missing file points at the same image generation\n\t\tif (!(await pathExists(path.join(outputDirectoryPath, fileName)))) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nasync function loadBuildAssets(): Promise<\n\t(\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t) => Promise<unknown>\n> {\n\tconst gondolinModule = await import('@earendil-works/gondolin');\n\treturn async (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t): Promise<unknown> =>\n\t\tawait gondolinModule.buildAssets(buildConfig, {\n\t\t\toutputDir: outputDirectory,\n\t\t\tverbose: verbose ?? false,\n\t\t\t...(configDir ? { configDir } : {}),\n\t\t\t...(workDir ? { workDir } : {}),\n\t\t} satisfies BuildOptions);\n}\n\nfunction createRedirectedWrite(output: BuildOutput): typeof process.stderr.write {\n\treturn ((\n\t\tchunk: string | Uint8Array,\n\t\tencodingOrCallback?: BufferEncoding | ((error?: Error | null) => void),\n\t\tcallback?: (error?: Error | null) => void,\n\t): boolean => {\n\t\tconst writeCallback = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;\n\t\tconst wrote = output.write(chunk);\n\t\twriteCallback?.();\n\t\treturn wrote;\n\t}) as typeof process.stderr.write;\n}\n\nasync function withCapturedBuildOutput<TResult>(\n\toutput: BuildOutput | undefined,\n\tfn: () => Promise<TResult>,\n): Promise<TResult> {\n\tif (!output) {\n\t\treturn await fn();\n\t}\n\n\tconst originalStderrWrite = process.stderr.write.bind(process.stderr);\n\tconst originalStdoutWrite = process.stdout.write.bind(process.stdout);\n\tconst originalCi = process.env.CI;\n\tconst redirectedWrite = createRedirectedWrite(output);\n\n\tprocess.stderr.write = redirectedWrite;\n\tprocess.stdout.write = redirectedWrite;\n\tprocess.env.CI = 'true';\n\n\ttry {\n\t\treturn await fn();\n\t} finally {\n\t\tprocess.stderr.write = originalStderrWrite;\n\t\tprocess.stdout.write = originalStdoutWrite;\n\t\tif (originalCi === undefined) {\n\t\t\tdelete process.env.CI;\n\t\t} else {\n\t\t\tprocess.env.CI = originalCi;\n\t\t}\n\t}\n}\n\nexport function computeBuildFingerprint(\n\tbuildConfig: BuildConfig,\n\tgondolinVersion: string = 'unknown',\n\tfingerprintInput?: unknown,\n): string {\n\tconst payload =\n\t\tfingerprintInput === undefined\n\t\t\t? `${stableSerialize(buildConfig)}|${gondolinVersion}`\n\t\t\t: `${stableSerialize(buildConfig)}|${gondolinVersion}|${stableSerialize(fingerprintInput)}`;\n\n\treturn crypto.createHash('sha256').update(payload).digest('hex').slice(0, 16);\n}\n\nexport async function computeEffectiveBuildFingerprint(options: {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}): Promise<{\n\treadonly fingerprint: string;\n\treadonly rootfsInitExtraContent: string;\n}> {\n\tconst resolvedRootfsInitExtra = await resolveRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.managedGatewayBoot === undefined\n\t\t\t? {}\n\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t});\n\tconst fingerprint = computeBuildFingerprint(options.buildConfig, options.gondolinVersion, {\n\t\tagentVmRootfsInitExtra: resolvedRootfsInitExtra.fingerprintInput,\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { callerFingerprintInput: options.fingerprintInput }),\n\t});\n\n\treturn {\n\t\tfingerprint,\n\t\trootfsInitExtraContent: resolvedRootfsInitExtra.content,\n\t};\n}\n\nexport async function buildImage(\n\toptions: BuildImageOptions,\n\tdependencies: BuildPipelineDependencies = {},\n): Promise<BuildImageResult> {\n\tconst effectiveBuildFingerprint = await computeEffectiveBuildFingerprint({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { fingerprintInput: options.fingerprintInput }),\n\t\t...(options.managedGatewayBoot === undefined\n\t\t\t? {}\n\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t\t...(dependencies.gondolinVersion ? { gondolinVersion: dependencies.gondolinVersion } : {}),\n\t});\n\tconst fingerprint = effectiveBuildFingerprint.fingerprint;\n\tconst imagePath = path.join(options.cacheDir, fingerprint);\n\tconst buildImageForFingerprint = async (): Promise<BuildImageResult> => {\n\t\tif (options.fullReset) {\n\t\t\tawait fs.rm(imagePath, { recursive: true, force: true });\n\t\t}\n\n\t\tif (await hasBuiltImageAssets(imagePath)) {\n\t\t\treturn {\n\t\t\t\tbuilt: false,\n\t\t\t\tfingerprint,\n\t\t\t\timagePath,\n\t\t\t};\n\t\t}\n\n\t\tawait fs.mkdir(imagePath, { recursive: true });\n\t\tconst buildAssetsImplementation = dependencies.buildAssets ?? (await loadBuildAssets());\n\t\tconst effectiveBuildConfig = await prepareBuildConfigWithAgentVmRootfsInitExtra({\n\t\t\tbuildConfig: options.buildConfig,\n\t\t\timagePath,\n\t\t\trootfsInitExtraContent: effectiveBuildFingerprint.rootfsInitExtraContent,\n\t\t});\n\t\tconst gondolinWorkDir = path.join(imagePath, gondolinWorkDirectoryName);\n\t\tawait fs.rm(gondolinWorkDir, { recursive: true, force: true });\n\t\ttry {\n\t\t\tawait withCapturedBuildOutput(options.output, async () => {\n\t\t\t\tawait buildAssetsImplementation(\n\t\t\t\t\teffectiveBuildConfig,\n\t\t\t\t\timagePath,\n\t\t\t\t\toptions.configDir,\n\t\t\t\t\tgondolinWorkDir,\n\t\t\t\t\toptions.output !== undefined,\n\t\t\t\t);\n\t\t\t});\n\t\t} finally {\n\t\t\tawait fs.rm(gondolinWorkDir, { recursive: true, force: true });\n\t\t}\n\n\t\tif (!(await hasBuiltImageAssets(imagePath))) {\n\t\t\tthrow new Error(`Expected Gondolin assets to be written to ${imagePath}.`);\n\t\t}\n\n\t\treturn {\n\t\t\tbuilt: true,\n\t\t\tfingerprint,\n\t\t\timagePath,\n\t\t};\n\t};\n\n\tif (options.output) {\n\t\treturn await buildImageForFingerprint();\n\t}\n\n\tconst inFlightKey = path.resolve(imagePath);\n\tconst existingBuild = inFlightImageBuilds.get(inFlightKey);\n\tif (existingBuild) {\n\t\treturn await existingBuild;\n\t}\n\tconst buildPromise = buildImageForFingerprint();\n\tinFlightImageBuilds.set(inFlightKey, buildPromise);\n\ttry {\n\t\treturn await buildPromise;\n\t} finally {\n\t\tif (inFlightImageBuilds.get(inFlightKey) === buildPromise) {\n\t\t\tinFlightImageBuilds.delete(inFlightKey);\n\t\t}\n\t}\n}\n","import { execFile } from 'node:child_process';\nimport { basename } from 'node:path';\nimport { promisify } from 'node:util';\n\nimport type {\n\tManagedVmExactProcessTerminationCapability,\n\tManagedVmExactProcessTerminationOutcome,\n\tManagedVmHostProcessIdentity,\n} from '@agent-vm/managed-vm';\n\nconst execFileAsync = promisify(execFile);\nconst terminationStageTimeoutMs = 2_000;\nconst processIdentityPollIntervalMs = 100;\nconst darwinProcessCommandNameLimit = 16;\nconst linuxTaskCommandNameLimit = 15;\n\nexport interface GondolinHostProcessIdentity {\n\treadonly command: string;\n\treadonly processState: string;\n\treadonly processStartIdentity: string;\n}\n\nexport interface GondolinProcessTerminationDependencies {\n\treadonly now: () => number;\n\treadonly readProcessIdentity: (\n\t\thostProcessId: number,\n\t) => Promise<GondolinHostProcessIdentity | null>;\n\treadonly sendSignal: (hostProcessId: number, signal: NodeJS.Signals) => void;\n\treadonly sleep: (delayMs: number) => Promise<void>;\n}\n\ntype RecordedProcessObservation = 'absent' | 'exact';\ntype RecordedProcessObservationMode = 'after-signal' | 'before-signal';\n\nfunction processErrorCode(error: unknown): unknown {\n\treturn typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;\n}\n\nfunction isManagedVmHostCommand(command: string): boolean {\n\treturn /\\b(qemu-system|krun)\\b/u.test(command);\n}\n\nfunction isMatchingDarwinFallbackCommand(options: {\n\treadonly currentCommand: string;\n\treadonly recordedCommand: string;\n}): boolean {\n\tconst fallbackCommandMatch = /^\\(([^()]+)\\)$/u.exec(options.currentCommand);\n\tif (fallbackCommandMatch === null) {\n\t\treturn false;\n\t}\n\tconst recordedExecutable = options.recordedCommand.split(/[ \\t]/u, 1)[0];\n\tif (recordedExecutable === undefined || recordedExecutable.length === 0) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfallbackCommandMatch[1] === basename(recordedExecutable).slice(0, darwinProcessCommandNameLimit)\n\t);\n}\n\nfunction isMatchingLinuxTaskFallbackCommand(options: {\n\treadonly currentCommand: string;\n\treadonly recordedCommand: string;\n}): boolean {\n\tconst fallbackCommandMatch = /^\\[([^\\r\\n]+)\\]$/u.exec(options.currentCommand);\n\tif (fallbackCommandMatch === null) {\n\t\treturn false;\n\t}\n\tconst recordedExecutable = options.recordedCommand.split(/[ \\t]/u, 1)[0];\n\tif (recordedExecutable === undefined || recordedExecutable.length === 0) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfallbackCommandMatch[1] === basename(recordedExecutable).slice(0, linuxTaskCommandNameLimit)\n\t);\n}\n\nfunction findProcessCommandBoundary(processDescription: string): number | null {\n\tlet tokenCount = 0;\n\tlet insideToken = false;\n\tfor (let index = 0; index < processDescription.length; index += 1) {\n\t\tconst character = processDescription[index];\n\t\tconst isWhitespace = character === ' ' || character === '\\t';\n\t\tif (!isWhitespace && !insideToken) {\n\t\t\tinsideToken = true;\n\t\t} else if (isWhitespace && insideToken) {\n\t\t\tinsideToken = false;\n\t\t\ttokenCount += 1;\n\t\t\tif (tokenCount === 5) {\n\t\t\t\treturn index;\n\t\t\t}\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction parseProcessIdentityOutput(\n\thostProcessId: number,\n\tprocessDescription: string,\n): GondolinHostProcessIdentity {\n\tconst trimmedDescription = processDescription.trim();\n\tconst processStateBoundary = trimmedDescription.search(/[ \\t]/u);\n\tif (processStateBoundary === -1) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`,\n\t\t);\n\t}\n\tconst processState = trimmedDescription.slice(0, processStateBoundary).trim();\n\tconst startAndCommandDescription = trimmedDescription.slice(processStateBoundary).trim();\n\tconst commandBoundary = findProcessCommandBoundary(startAndCommandDescription);\n\tif (commandBoundary === null) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`,\n\t\t);\n\t}\n\tconst processStartIdentity = startAndCommandDescription.slice(0, commandBoundary).trim();\n\tconst command = startAndCommandDescription.slice(commandBoundary).trim();\n\tif (processState.length === 0 || processStartIdentity.length === 0 || command.length === 0) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps omitted the process state, start, or command.`,\n\t\t);\n\t}\n\treturn { command, processStartIdentity, processState };\n}\n\nasync function readGondolinHostProcessIdentity(\n\thostProcessId: number,\n): Promise<GondolinHostProcessIdentity | null> {\n\ttry {\n\t\tconst { stdout } = await execFileAsync('ps', [\n\t\t\t'-p',\n\t\t\tString(hostProcessId),\n\t\t\t'-o',\n\t\t\t'state=',\n\t\t\t'-o',\n\t\t\t'lstart=',\n\t\t\t'-o',\n\t\t\t'command=',\n\t\t]);\n\t\tif (stdout.trim().length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned empty output.`,\n\t\t\t);\n\t\t}\n\t\treturn parseProcessIdentityOutput(hostProcessId, stdout);\n\t} catch (error) {\n\t\tif (processErrorCode(error) === 1) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nfunction sendHostProcessSignal(hostProcessId: number, signal: NodeJS.Signals): void {\n\tprocess.kill(hostProcessId, signal);\n}\n\nasync function sleep(delayMs: number): Promise<void> {\n\tawait new Promise((resolve) => setTimeout(resolve, delayMs));\n}\n\nconst defaultDependencies = {\n\tnow: Date.now,\n\treadProcessIdentity: readGondolinHostProcessIdentity,\n\tsendSignal: sendHostProcessSignal,\n\tsleep,\n} satisfies GondolinProcessTerminationDependencies;\n\nfunction assertTerminationRequest(request: {\n\treadonly contextLabel: string;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): void {\n\tif (request.contextLabel.trim().length === 0) {\n\t\tthrow new Error('Exact managed VM process termination requires a non-empty context label.');\n\t}\n\tif (\n\t\t!Number.isSafeInteger(request.identity.hostProcessId) ||\n\t\trequest.identity.hostProcessId <= 0\n\t) {\n\t\tthrow new Error('Exact managed VM process termination requires a positive safe host pid.');\n\t}\n\tif (\n\t\trequest.identity.vmId.length === 0 ||\n\t\trequest.identity.processStartIdentity.length === 0 ||\n\t\trequest.identity.command.length === 0\n\t) {\n\t\tthrow new Error('Exact managed VM process termination requires complete recorded identity.');\n\t}\n}\n\nasync function observeRecordedProcess(options: {\n\treadonly action: string;\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n\treadonly mode: RecordedProcessObservationMode;\n}): Promise<RecordedProcessObservation> {\n\tconst currentIdentity = await options.dependencies.readProcessIdentity(\n\t\toptions.identity.hostProcessId,\n\t);\n\tif (currentIdentity === null) {\n\t\treturn 'absent';\n\t}\n\tif (currentIdentity.processStartIdentity !== options.identity.processStartIdentity) {\n\t\treturn 'absent';\n\t}\n\tif (currentIdentity.processState.startsWith('Z')) {\n\t\treturn 'absent';\n\t}\n\tif (options.mode === 'after-signal' && currentIdentity.processState.includes('E')) {\n\t\treturn 'exact';\n\t}\n\tif (\n\t\toptions.mode === 'after-signal' &&\n\t\t(currentIdentity.processState.startsWith('U') ||\n\t\t\tcurrentIdentity.processState.startsWith('R')) &&\n\t\t(isMatchingDarwinFallbackCommand({\n\t\t\tcurrentCommand: currentIdentity.command,\n\t\t\trecordedCommand: options.identity.command,\n\t\t}) ||\n\t\t\tisMatchingLinuxTaskFallbackCommand({\n\t\t\t\tcurrentCommand: currentIdentity.command,\n\t\t\t\trecordedCommand: options.identity.command,\n\t\t\t}))\n\t) {\n\t\treturn 'exact';\n\t}\n\tif (currentIdentity.command !== options.identity.command) {\n\t\tthrow new Error(\n\t\t\t`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)}: same process start identity was observed with state ${JSON.stringify(currentIdentity.processState)} but command changed (recorded ${JSON.stringify(options.identity.command)}, current ${JSON.stringify(currentIdentity.command)}).`,\n\t\t);\n\t}\n\tif (!isManagedVmHostCommand(currentIdentity.command)) {\n\t\tthrow new Error(\n\t\t\t`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)} because the exact command is not a managed VM process.`,\n\t\t);\n\t}\n\treturn 'exact';\n}\n\nasync function waitForRecordedProcessAbsence(options: {\n\treadonly afterSignal: NodeJS.Signals;\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): Promise<boolean> {\n\tconst deadline = options.dependencies.now() + terminationStageTimeoutMs;\n\twhile (options.dependencies.now() < deadline) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- exact identity observations must remain ordered\n\t\tconst observation = await observeRecordedProcess({\n\t\t\taction: `continued containment after ${options.afterSignal} for`,\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t\tmode: 'after-signal',\n\t\t});\n\t\tif (observation === 'absent') {\n\t\t\treturn true;\n\t\t}\n\t\t// oxlint-disable-next-line no-await-in-loop -- bounded process identity polling is sequential\n\t\tawait options.dependencies.sleep(processIdentityPollIntervalMs);\n\t}\n\treturn (\n\t\t(await observeRecordedProcess({\n\t\t\taction: `continued containment after ${options.afterSignal} for`,\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t\tmode: 'after-signal',\n\t\t})) === 'absent'\n\t);\n}\n\nfunction signalRecordedProcess(options: {\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly hostProcessId: number;\n\treadonly signal: NodeJS.Signals;\n}): void {\n\ttry {\n\t\toptions.dependencies.sendSignal(options.hostProcessId, options.signal);\n\t} catch (error) {\n\t\tif (processErrorCode(error) !== 'ESRCH') {\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n\nexport async function terminateExactRecordedManagedVmHostProcess(options: {\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): Promise<ManagedVmExactProcessTerminationOutcome> {\n\tassertTerminationRequest(options);\n\tconst initialObservation = await observeRecordedProcess({\n\t\taction: 'SIGTERM to',\n\t\tcontextLabel: options.contextLabel,\n\t\tdependencies: options.dependencies,\n\t\tidentity: options.identity,\n\t\tmode: 'before-signal',\n\t});\n\tif (initialObservation === 'absent') {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'already-absent' };\n\t}\n\n\tsignalRecordedProcess({\n\t\tdependencies: options.dependencies,\n\t\thostProcessId: options.identity.hostProcessId,\n\t\tsignal: 'SIGTERM',\n\t});\n\tif (\n\t\tawait waitForRecordedProcessAbsence({\n\t\t\tafterSignal: 'SIGTERM',\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t})\n\t) {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\n\tconst beforeKillObservation = await observeRecordedProcess({\n\t\taction: 'SIGKILL to',\n\t\tcontextLabel: options.contextLabel,\n\t\tdependencies: options.dependencies,\n\t\tidentity: options.identity,\n\t\tmode: 'after-signal',\n\t});\n\tif (beforeKillObservation === 'absent') {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\tsignalRecordedProcess({\n\t\tdependencies: options.dependencies,\n\t\thostProcessId: options.identity.hostProcessId,\n\t\tsignal: 'SIGKILL',\n\t});\n\tif (\n\t\tawait waitForRecordedProcessAbsence({\n\t\t\tafterSignal: 'SIGKILL',\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t})\n\t) {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\n\tthrow new Error(\n\t\t`Failed to terminate exact recorded managed VM process ${String(options.identity.hostProcessId)} (${options.contextLabel}).`,\n\t);\n}\n\nexport function createGondolinExactProcessTerminationCapability(\n\tdependencies: GondolinProcessTerminationDependencies = defaultDependencies,\n): ManagedVmExactProcessTerminationCapability {\n\treturn {\n\t\tasync terminateRecordedHostProcess(request): Promise<ManagedVmExactProcessTerminationOutcome> {\n\t\t\treturn await terminateExactRecordedManagedVmHostProcess({\n\t\t\t\tcontextLabel: request.contextLabel,\n\t\t\t\tdependencies,\n\t\t\t\tidentity: request.identity,\n\t\t\t});\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\n\nimport { z } from 'zod';\n\nconst requireFromHere = createRequire(import.meta.url);\n\nconst gondolinPackageJsonSchema = z.object({\n\tversion: z.string().min(1),\n});\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nfunction getErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nexport function parseMinimumZigVersion(rawContents: string): string {\n\tconst match = rawContents.match(/\\.minimum_zig_version\\s*=\\s*\"([^\"]*)\"/u);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t'minimum_zig_version declaration not found. Expected a line like `.minimum_zig_version = \"0.15.2\"`.',\n\t\t);\n\t}\n\n\tconst version = match[1];\n\tif (!version) {\n\t\tthrow new Error('minimum_zig_version is empty.');\n\t}\n\treturn version;\n}\n\nexport function resolveGondolinPackageJsonPath(): string {\n\treturn requireFromHere.resolve('@earendil-works/gondolin/package.json');\n}\n\nexport async function resolveGondolinPackageSpec(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\tconst parsed: unknown = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));\n\tconst packageJson = gondolinPackageJsonSchema.parse(parsed);\n\treturn `@earendil-works/gondolin@${packageJson.version}`;\n}\n\nexport interface ResolveGondolinMinimumZigVersionOptions {\n\treadonly buildZigZonPath?: string;\n}\n\nasync function resolveDefaultBuildZigZonPath(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\treturn path.join(path.dirname(packageJsonPath), 'dist', 'guest', 'build.zig.zon');\n}\n\nexport async function resolveGondolinMinimumZigVersion(\n\toptions: ResolveGondolinMinimumZigVersionOptions = {},\n): Promise<string> {\n\tconst zonPath = options.buildZigZonPath ?? (await resolveDefaultBuildZigZonPath());\n\tlet rawContents: string;\n\ttry {\n\t\trawContents = await fs.readFile(zonPath, 'utf8');\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) {\n\t\t\tthrow new Error(`Missing Gondolin build.zig.zon at '${zonPath}'.`, { cause: error });\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\n\ttry {\n\t\treturn parseMinimumZigVersion(rawContents);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to parse Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { VirtualProvider } from '@earendil-works/gondolin';\n\nexport interface PinnedRealFsRoot {\n\treadonly hostPath: string;\n\treadonly realPath: string;\n\treadonly fd: number;\n\treadonly device: number;\n\treadonly inode: number;\n}\n\nexport interface CreatePinnedRealFsProviderOptions {\n\treadonly root: PinnedRealFsRoot;\n\treadonly createRealFsProvider: (hostPath: string) => VirtualProvider;\n}\n\nconst terminallyClosedPinnedRoots = new WeakSet<PinnedRealFsRoot>();\n\nfunction formatRootIdentity(root: PinnedRealFsRoot): string {\n\treturn `${root.device}:${root.inode}`;\n}\n\nfunction openDirectoryNoFollow(candidatePath: string): number {\n\treturn fs.openSync(\n\t\tcandidatePath,\n\t\tfs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,\n\t);\n}\n\nexport function pinRealFsRoot(hostPath: string): PinnedRealFsRoot {\n\tif (!hostPath || !path.isAbsolute(hostPath)) {\n\t\tthrow new Error(`Pinned RealFS root must be a non-empty absolute path: ${hostPath}`);\n\t}\n\n\tconst resolvedHostPath = path.resolve(hostPath);\n\tconst fd = openDirectoryNoFollow(resolvedHostPath);\n\ttry {\n\t\tconst stats = fs.fstatSync(fd);\n\t\tif (!stats.isDirectory()) {\n\t\t\tthrow new Error(`Pinned RealFS root is not a directory: ${resolvedHostPath}`);\n\t\t}\n\t\tconst realPath = fs.realpathSync(resolvedHostPath);\n\t\tconst realPathStats = fs.statSync(realPath);\n\t\tif (realPathStats.dev !== stats.dev || realPathStats.ino !== stats.ino) {\n\t\t\tthrow new Error(\n\t\t\t\t`Pinned RealFS root changed while opening: ${resolvedHostPath} opened ${stats.dev}:${stats.ino} but resolved to ${realPathStats.dev}:${realPathStats.ino}`,\n\t\t\t);\n\t\t}\n\t\treturn {\n\t\t\tdevice: stats.dev,\n\t\t\tfd,\n\t\t\thostPath: resolvedHostPath,\n\t\t\tinode: stats.ino,\n\t\t\trealPath,\n\t\t};\n\t} catch (error) {\n\t\tfs.closeSync(fd);\n\t\tthrow error;\n\t}\n}\n\nexport function closePinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tif (terminallyClosedPinnedRoots.has(root)) {\n\t\treturn;\n\t}\n\tfs.closeSync(root.fd);\n\tterminallyClosedPinnedRoots.add(root);\n}\n\nexport function assertPinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tconst pinnedStats = fs.fstatSync(root.fd);\n\tconst currentStats = fs.statSync(root.realPath);\n\tif (\n\t\tpinnedStats.dev !== root.device ||\n\t\tpinnedStats.ino !== root.inode ||\n\t\tcurrentStats.dev !== root.device ||\n\t\tcurrentStats.ino !== root.inode\n\t) {\n\t\tthrow new Error(\n\t\t\t`Pinned RealFS root changed before mount access: ${root.realPath} expected ${formatRootIdentity(root)} got ${currentStats.dev}:${currentStats.ino}`,\n\t\t);\n\t}\n}\n\ntype ProviderMethod = (...args: unknown[]) => unknown;\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- Reflect.get()\n loses the method signature from Gondolin's VirtualProvider union. The proxy\n keeps the same provider object and only wraps callable properties with the\n pinned-root assertion. */\nexport function createPinnedRealFsProvider(\n\toptions: CreatePinnedRealFsProviderOptions,\n): VirtualProvider {\n\tassertPinnedRealFsRoot(options.root);\n\tconst provider = options.createRealFsProvider(options.root.realPath);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tassertPinnedRealFsRoot(options.root);\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n/* oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n","import path from 'node:path';\n\nimport type { ManagedVmFilteredWorkspacePolicy } from '@agent-vm/managed-vm';\nimport {\n\tERRNO,\n\tVirtualDirent,\n\tcreateVirtualDirStats,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype VirtualProvider,\n} from '@earendil-works/gondolin';\n\nexport interface FilteredWorkspaceProviderDependencies {\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n}\n\nexport interface CreateFilteredWorkspaceProviderOptions {\n\treadonly baseProvider: VirtualProvider;\n\treadonly dependencies: FilteredWorkspaceProviderDependencies;\n\treadonly policy: ManagedVmFilteredWorkspacePolicy;\n}\n\ntype ProviderMethod = (...methodArguments: readonly unknown[]) => unknown;\n\nfunction toAbsoluteProviderPath(relativePath: string): string {\n\treturn `/${relativePath}`;\n}\n\nfunction normalizeProviderPath(providerPath: string): string {\n\tconst absolutePath = providerPath.startsWith('/') ? providerPath : `/${providerPath}`;\n\treturn path.posix.normalize(absolutePath);\n}\n\nfunction toRelativeProviderPath(providerPath: string): string {\n\tconst normalizedPath = normalizeProviderPath(providerPath);\n\treturn normalizedPath === '/' ? '' : normalizedPath.slice(1);\n}\n\nfunction isEqualOrDescendant(candidatePath: string, ancestorPath: string): boolean {\n\treturn candidatePath === ancestorPath || candidatePath.startsWith(`${ancestorPath}/`);\n}\n\nfunction pathsOverlap(firstPath: string, secondPath: string): boolean {\n\treturn isEqualOrDescendant(firstPath, secondPath) || isEqualOrDescendant(secondPath, firstPath);\n}\n\nfunction createFilesystemPolicyError(\n\tcode: 'EACCES' | 'ENOENT' | 'EROFS',\n\tsyscall: string,\n\tproviderPath: string,\n): Error & { readonly code: 'EACCES' | 'ENOENT' | 'EROFS'; readonly errno: number } {\n\treturn Object.assign(new Error(`${code}: ${syscall} '${providerPath}'`), {\n\t\tcode,\n\t\terrno: ERRNO[code],\n\t\tpath: providerPath,\n\t\tsyscall,\n\t});\n}\n\nfunction invokeProviderMethod(\n\tprovider: VirtualProvider,\n\tproperty: string | symbol,\n\tmethodArguments: readonly unknown[],\n): unknown {\n\tconst method = Reflect.get(provider, property, provider) as unknown;\n\tif (typeof method !== 'function') {\n\t\treturn method;\n\t}\n\treturn Reflect.apply(method as ProviderMethod, provider, methodArguments);\n}\n\nconst singlePathMutationMethods = new Set([\n\t'appendFile',\n\t'appendFileSync',\n\t'mkdir',\n\t'mkdirSync',\n\t'rmdir',\n\t'rmdirSync',\n\t'symlink',\n\t'symlinkSync',\n\t'truncate',\n\t'truncateSync',\n\t'unlink',\n\t'unlinkSync',\n\t'writeFile',\n\t'writeFileSync',\n]);\n\nfunction mutationPathArgumentIndex(property: string): number {\n\treturn property === 'symlink' || property === 'symlinkSync' ? 1 : 0;\n}\n\nfunction failProviderMutation(property: string, providerPath: string): unknown {\n\treturn failProviderOperation(property, providerPath, 'EROFS');\n}\n\nfunction failProviderOperation(\n\tproperty: string,\n\tproviderPath: string,\n\tcode: 'EACCES' | 'ENOENT' | 'EROFS',\n): unknown {\n\tconst operationError = createFilesystemPolicyError(code, property, providerPath);\n\tif (property.endsWith('Sync')) {\n\t\tthrow operationError;\n\t}\n\treturn Promise.reject(operationError);\n}\n\nfunction createRelativeRootProvider(\n\tprovider: VirtualProvider,\n\tsourceRelativePath: string,\n): VirtualProvider {\n\tconst sourceProviderPath = toAbsoluteProviderPath(sourceRelativePath);\n\tconst translatePath = (providerPath: string): string => {\n\t\tconst suffix = toRelativeProviderPath(providerPath);\n\t\treturn toAbsoluteProviderPath(\n\t\t\tsuffix.length === 0 ? sourceRelativePath : `${sourceRelativePath}/${suffix}`,\n\t\t);\n\t};\n\tconst translateArguments = (\n\t\tproperty: string,\n\t\tmethodArguments: readonly unknown[],\n\t): readonly unknown[] => {\n\t\tconst translatedArguments = [...methodArguments];\n\t\tif (\n\t\t\tproperty === 'rename' ||\n\t\t\tproperty === 'renameSync' ||\n\t\t\tproperty === 'link' ||\n\t\t\tproperty === 'linkSync' ||\n\t\t\tproperty === 'copyFile' ||\n\t\t\tproperty === 'copyFileSync'\n\t\t) {\n\t\t\ttranslatedArguments[0] = translatePath(String(methodArguments[0]));\n\t\t\ttranslatedArguments[1] = translatePath(String(methodArguments[1]));\n\t\t\treturn translatedArguments;\n\t\t}\n\t\ttranslatedArguments[mutationPathArgumentIndex(property)] = translatePath(\n\t\t\tString(methodArguments[mutationPathArgumentIndex(property)]),\n\t\t);\n\t\treturn translatedArguments;\n\t};\n\tconst assertResolvedPathWithinSource = (\n\t\tresolvedPath: string,\n\t\tcanonicalSourcePath: string,\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t): void => {\n\t\tconst resolvedRelativePath = toRelativeProviderPath(resolvedPath);\n\t\tconst canonicalSourceRelativePath = toRelativeProviderPath(canonicalSourcePath);\n\t\tif (!isEqualOrDescendant(resolvedRelativePath, canonicalSourceRelativePath)) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t};\n\tconst resolveConfinedPath = async (\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t\ttranslatedPath: string,\n\t): Promise<{ readonly canonicalSourcePath: string; readonly resolvedPath: string }> => {\n\t\tif (!provider.realpath) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t\tconst [canonicalSourcePath, resolvedPath] = await Promise.all([\n\t\t\tprovider.realpath(sourceProviderPath),\n\t\t\tprovider.realpath(translatedPath),\n\t\t]);\n\t\tassertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);\n\t\treturn { canonicalSourcePath, resolvedPath };\n\t};\n\tconst resolveConfinedPathSync = (\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t\ttranslatedPath: string,\n\t): { readonly canonicalSourcePath: string; readonly resolvedPath: string } => {\n\t\tif (!provider.realpathSync) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t\tconst canonicalSourcePath = provider.realpathSync(sourceProviderPath);\n\t\tconst resolvedPath = provider.realpathSync(translatedPath);\n\t\tassertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);\n\t\treturn { canonicalSourcePath, resolvedPath };\n\t};\n\tconst parentProviderPath = (providerPath: string): string => {\n\t\tconst normalizedPath = normalizeProviderPath(providerPath);\n\t\treturn normalizedPath === '/' ? '/' : path.posix.dirname(normalizedPath);\n\t};\n\tconst remapResolvedPath = (resolvedPath: string, canonicalSourcePath: string): string => {\n\t\tconst resolvedRelativePath = toRelativeProviderPath(resolvedPath);\n\t\tconst canonicalSourceRelativePath = toRelativeProviderPath(canonicalSourcePath);\n\t\tif (resolvedRelativePath === canonicalSourceRelativePath) {\n\t\t\treturn '/';\n\t\t}\n\t\treturn toAbsoluteProviderPath(\n\t\t\tcanonicalSourceRelativePath.length === 0\n\t\t\t\t? resolvedRelativePath\n\t\t\t\t: resolvedRelativePath.slice(`${canonicalSourceRelativePath}/`.length),\n\t\t);\n\t};\n\tconst asyncFollowMethods = new Set(['access', 'open', 'readdir', 'readFile', 'stat', 'statfs']);\n\tconst syncFollowMethods = new Set([\n\t\t'accessSync',\n\t\t'openSync',\n\t\t'readdirSync',\n\t\t'readFileSync',\n\t\t'statSync',\n\t\t'watch',\n\t\t'watchAsync',\n\t\t'watchFile',\n\t\t'unwatchFile',\n\t]);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst translatedArguments = translateArguments(property, methodArguments);\n\t\t\t\tif (property === 'realpath') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0])).then(\n\t\t\t\t\t\t({ canonicalSourcePath, resolvedPath }) =>\n\t\t\t\t\t\t\tremapResolvedPath(resolvedPath, canonicalSourcePath),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (property === 'realpathSync') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst { canonicalSourcePath, resolvedPath } = resolveConfinedPathSync(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\tString(translatedArguments[0]),\n\t\t\t\t\t);\n\t\t\t\t\treturn remapResolvedPath(resolvedPath, canonicalSourcePath);\n\t\t\t\t}\n\t\t\t\tif (property === 'lstat' || property === 'readlink') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\ttranslatePath(parentProviderPath(providerPath)),\n\t\t\t\t\t).then(() => Reflect.apply(value as ProviderMethod, target, translatedArguments));\n\t\t\t\t}\n\t\t\t\tif (property === 'lstatSync' || property === 'readlinkSync') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tresolveConfinedPathSync(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\ttranslatePath(parentProviderPath(providerPath)),\n\t\t\t\t\t);\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t\t}\n\t\t\t\tif (property === 'exists') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0]))\n\t\t\t\t\t\t.then(() => Reflect.apply(value as ProviderMethod, target, translatedArguments))\n\t\t\t\t\t\t.catch(() => false);\n\t\t\t\t}\n\t\t\t\tif (property === 'existsSync' || property === 'internalModuleStat') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\ttry {\n\t\t\t\t\t\tresolveConfinedPathSync(property, providerPath, String(translatedArguments[0]));\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn property === 'existsSync' ? false : -2;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (asyncFollowMethods.has(property)) {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0])).then(\n\t\t\t\t\t\t() => Reflect.apply(value as ProviderMethod, target, translatedArguments),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (syncFollowMethods.has(property)) {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tresolveConfinedPathSync(property, providerPath, String(translatedArguments[0]));\n\t\t\t\t}\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction createPositiveWorkspaceProjectionProvider(\n\tprovider: VirtualProvider,\n\tpolicy: Extract<\n\t\tManagedVmFilteredWorkspacePolicy['visibility'],\n\t\t{ readonly kind: 'positive-paths' }\n\t>,\n\tdependencies: FilteredWorkspaceProviderDependencies,\n): VirtualProvider {\n\tconst isVisible = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn (\n\t\t\trelativePath.length === 0 ||\n\t\t\tpolicy.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath))\n\t\t);\n\t};\n\tconst isWritable = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.writablePaths.some((writablePath) =>\n\t\t\tisEqualOrDescendant(relativePath, writablePath),\n\t\t);\n\t};\n\tconst projectedProvider = dependencies.createShadowProvider(provider, {\n\t\tshouldShadow: ({ path: providerPath }) => !isVisible(providerPath),\n\t\twriteMode: 'deny',\n\t});\n\tconst readonlyProvider = dependencies.createReadonlyProvider(projectedProvider);\n\n\treturn new Proxy(projectedProvider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'open' || property === 'openSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (singlePathMutationMethods.has(property)) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst pathIndex = mutationPathArgumentIndex(property);\n\t\t\t\t\tconst providerPath = String(methodArguments[pathIndex]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'rename' || property === 'renameSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst affectedPaths = [String(methodArguments[0]), String(methodArguments[1])];\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\taffectedPaths.every(isVisible) &&\n\t\t\t\t\t\taffectedPaths.some((affectedPath) => !isWritable(affectedPath))\n\t\t\t\t\t\t\t? readonlyProvider\n\t\t\t\t\t\t\t: target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'copyFile' || property === 'copyFileSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(sourcePath) && isVisible(destinationPath) && !isWritable(destinationPath)\n\t\t\t\t\t\t\t? readonlyProvider\n\t\t\t\t\t\t\t: target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t},\n\t});\n}\n\nfunction createWorkspaceHardlinkProvider(\n\tprovider: VirtualProvider,\n\tbaseProvider: VirtualProvider,\n\tpolicy: ManagedVmFilteredWorkspacePolicy,\n): VirtualProvider {\n\tconst hidden = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));\n\t};\n\tconst temporary = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.temporaryPaths.some((temporaryPath) =>\n\t\t\tisEqualOrDescendant(relativePath, temporaryPath),\n\t\t);\n\t};\n\tconst visible = (providerPath: string): boolean => {\n\t\tif (policy.visibility.kind === 'whole-root-writable') {\n\t\t\treturn true;\n\t\t}\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn (\n\t\t\trelativePath.length === 0 ||\n\t\t\tpolicy.visibility.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath))\n\t\t);\n\t};\n\tconst writable = (providerPath: string): boolean => {\n\t\tif (temporary(providerPath)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (policy.visibility.kind === 'whole-root-writable') {\n\t\t\treturn true;\n\t\t}\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.visibility.writablePaths.some((writablePath) =>\n\t\t\tisEqualOrDescendant(relativePath, writablePath),\n\t\t);\n\t};\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (property !== 'link' && property !== 'linkSync') {\n\t\t\t\treturn typeof value === 'function'\n\t\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments)\n\t\t\t\t\t: value;\n\t\t\t}\n\t\t\tconst underlyingLinkMethod = Reflect.get(baseProvider, property, baseProvider) as unknown;\n\t\t\tif (typeof underlyingLinkMethod !== 'function') {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\tif (hidden(sourcePath) || !visible(sourcePath)) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t}\n\t\t\t\tif (hidden(destinationPath) || !visible(destinationPath)) {\n\t\t\t\t\treturn failProviderOperation(property, destinationPath, 'EACCES');\n\t\t\t\t}\n\t\t\t\tif (!writable(sourcePath)) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'EROFS');\n\t\t\t\t}\n\t\t\t\tif (!writable(destinationPath)) {\n\t\t\t\t\treturn failProviderOperation(property, destinationPath, 'EROFS');\n\t\t\t\t}\n\t\t\t\tif (property === 'link') {\n\t\t\t\t\tif (!provider.realpath) {\n\t\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t\t}\n\t\t\t\t\treturn provider\n\t\t\t\t\t\t.realpath(sourcePath)\n\t\t\t\t\t\t.then(() =>\n\t\t\t\t\t\t\tReflect.apply(underlyingLinkMethod as ProviderMethod, baseProvider, methodArguments),\n\t\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (!provider.realpathSync) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t}\n\t\t\t\tprovider.realpathSync(sourcePath);\n\t\t\t\treturn Reflect.apply(underlyingLinkMethod as ProviderMethod, baseProvider, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n\ninterface ReadonlyInputProvider {\n\treadonly destinationRelativePath: string;\n\treadonly provider: VirtualProvider;\n}\n\nfunction directReadonlyDestinationChildren(\n\tproviderPath: string,\n\treadonlyInputs: readonly ReadonlyInputProvider[],\n): readonly string[] {\n\tconst relativePath = toRelativeProviderPath(providerPath);\n\tconst prefix = relativePath.length === 0 ? '' : `${relativePath}/`;\n\tconst children = new Set<string>();\n\tfor (const readonlyInput of readonlyInputs) {\n\t\tif (!readonlyInput.destinationRelativePath.startsWith(prefix)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst remainingPath = readonlyInput.destinationRelativePath.slice(prefix.length);\n\t\tconst childName = remainingPath.split('/')[0];\n\t\tif (childName) {\n\t\t\tchildren.add(childName);\n\t\t}\n\t}\n\treturn [...children].toSorted();\n}\n\nfunction entryName(entry: string | { readonly name: string }): string {\n\treturn typeof entry === 'string' ? entry : entry.name;\n}\n\nfunction mergeDirectoryEntries(\n\tentries: readonly (string | { readonly name: string })[],\n\tvirtualChildren: readonly string[],\n\twithFileTypes: boolean,\n): readonly (string | { readonly name: string })[] {\n\tconst presentNames = new Set(entries.map(entryName));\n\tconst missingChildren = virtualChildren.filter((childName) => !presentNames.has(childName));\n\treturn [\n\t\t...entries,\n\t\t...missingChildren.map((childName) =>\n\t\t\twithFileTypes ? new VirtualDirent(childName) : childName,\n\t\t),\n\t];\n}\n\nfunction isNoEntryError(error: unknown): boolean {\n\treturn (\n\t\ttypeof error === 'object' &&\n\t\terror !== null &&\n\t\t(('code' in error && (error.code === 'ENOENT' || error.code === 'ERRNO_2')) ||\n\t\t\t('errno' in error && (error.errno === ERRNO.ENOENT || error.errno === -ERRNO.ENOENT)))\n\t);\n}\n\nfunction createNestedReadonlyWorkspaceProvider(\n\tprovider: VirtualProvider,\n\tsourceProvider: VirtualProvider,\n\tpolicy: ManagedVmFilteredWorkspacePolicy,\n\tdependencies: FilteredWorkspaceProviderDependencies,\n): VirtualProvider {\n\tconst readonlyInputs: ReadonlyInputProvider[] = [];\n\tfor (const readonlyInput of policy.readonlyInputs) {\n\t\tif (\n\t\t\tpolicy.hiddenPaths.some((hiddenPath) =>\n\t\t\t\tisEqualOrDescendant(readonlyInput.destinationRelativePath, hiddenPath),\n\t\t\t)\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tlet inputProvider = createRelativeRootProvider(\n\t\t\tsourceProvider,\n\t\t\treadonlyInput.sourceRelativePath,\n\t\t);\n\t\tconst nestedHiddenPaths = policy.hiddenPaths.flatMap((hiddenPath) => {\n\t\t\tconst destinationPrefix = `${readonlyInput.destinationRelativePath}/`;\n\t\t\treturn hiddenPath.startsWith(destinationPrefix)\n\t\t\t\t? [toAbsoluteProviderPath(hiddenPath.slice(destinationPrefix.length))]\n\t\t\t\t: [];\n\t\t});\n\t\tif (nestedHiddenPaths.length > 0) {\n\t\t\tinputProvider = dependencies.createShadowProvider(inputProvider, {\n\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(nestedHiddenPaths),\n\t\t\t\twriteMode: 'deny',\n\t\t\t});\n\t\t}\n\t\treadonlyInputs.push({\n\t\t\tdestinationRelativePath: readonlyInput.destinationRelativePath,\n\t\t\tprovider: dependencies.createReadonlyProvider(inputProvider),\n\t\t});\n\t}\n\n\tif (readonlyInputs.length === 0) {\n\t\treturn provider;\n\t}\n\n\tconst findInput = (providerPath: string): ReadonlyInputProvider | undefined => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn readonlyInputs.find((readonlyInput) =>\n\t\t\tisEqualOrDescendant(relativePath, readonlyInput.destinationRelativePath),\n\t\t);\n\t};\n\tconst mapInputPath = (providerPath: string, readonlyInput: ReadonlyInputProvider): string => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\tconst suffix = relativePath.slice(readonlyInput.destinationRelativePath.length);\n\t\treturn suffix.length === 0 ? '/' : suffix;\n\t};\n\tconst conflictsWithReadonlyInput = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn readonlyInputs.some((readonlyInput) =>\n\t\t\tpathsOverlap(relativePath, readonlyInput.destinationRelativePath),\n\t\t);\n\t};\n\tconst isHidden = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));\n\t};\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'readdir' || property === 'readdirSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readdirOptions = methodArguments[1];\n\t\t\t\t\tconst withFileTypes =\n\t\t\t\t\t\ttypeof readdirOptions === 'object' &&\n\t\t\t\t\t\treaddirOptions !== null &&\n\t\t\t\t\t\t'withFileTypes' in readdirOptions &&\n\t\t\t\t\t\treaddirOptions.withFileTypes === true;\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\tif (readonlyInput && !isHidden(providerPath)) {\n\t\t\t\t\t\treturn invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t]);\n\t\t\t\t\t}\n\t\t\t\t\tconst virtualChildren = directReadonlyDestinationChildren(providerPath, readonlyInputs);\n\t\t\t\t\tif (virtualChildren.length === 0) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tif (property === 'readdir') {\n\t\t\t\t\t\treturn Promise.resolve(Reflect.apply(value as ProviderMethod, target, methodArguments))\n\t\t\t\t\t\t\t.catch((error: unknown) => {\n\t\t\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\t\t\treturn [];\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.then((entries) =>\n\t\t\t\t\t\t\t\tmergeDirectoryEntries(\n\t\t\t\t\t\t\t\t\tentries as readonly (string | { readonly name: string })[],\n\t\t\t\t\t\t\t\t\tvirtualChildren,\n\t\t\t\t\t\t\t\t\twithFileTypes,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn mergeDirectoryEntries(\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments) as readonly (\n\t\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t\t| { readonly name: string }\n\t\t\t\t\t\t\t)[],\n\t\t\t\t\t\t\tvirtualChildren,\n\t\t\t\t\t\t\twithFileTypes,\n\t\t\t\t\t\t);\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\treturn virtualChildren;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'stat' ||\n\t\t\t\tproperty === 'statSync' ||\n\t\t\t\tproperty === 'lstat' ||\n\t\t\t\tproperty === 'lstatSync'\n\t\t\t) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\tif (readonlyInput && !isHidden(providerPath)) {\n\t\t\t\t\t\treturn invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t]);\n\t\t\t\t\t}\n\t\t\t\t\tconst virtualChildren = directReadonlyDestinationChildren(providerPath, readonlyInputs);\n\t\t\t\t\tif (virtualChildren.length === 0) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tif (property === 'stat' || property === 'lstat') {\n\t\t\t\t\t\treturn Promise.resolve(\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments),\n\t\t\t\t\t\t).catch((error: unknown) => {\n\t\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\t\treturn createVirtualDirStats();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\treturn createVirtualDirStats();\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'open' || property === 'openSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\treturn readonlyInput && !isHidden(providerPath)\n\t\t\t\t\t\t? invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t\t])\n\t\t\t\t\t\t: Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (singlePathMutationMethods.has(property)) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[mutationPathArgumentIndex(property)]);\n\t\t\t\t\tif (!isHidden(providerPath) && conflictsWithReadonlyInput(providerPath)) {\n\t\t\t\t\t\treturn failProviderMutation(property, providerPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'rename' ||\n\t\t\t\tproperty === 'renameSync' ||\n\t\t\t\tproperty === 'link' ||\n\t\t\t\tproperty === 'linkSync'\n\t\t\t) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst affectedPaths = [String(methodArguments[0]), String(methodArguments[1])];\n\t\t\t\t\tconst conflictingPath = affectedPaths.find(\n\t\t\t\t\t\t(affectedPath) => !isHidden(affectedPath) && conflictsWithReadonlyInput(affectedPath),\n\t\t\t\t\t);\n\t\t\t\t\tif (conflictingPath) {\n\t\t\t\t\t\treturn failProviderMutation(property, conflictingPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'copyFile' || property === 'copyFileSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\t\tif (!isHidden(destinationPath) && conflictsWithReadonlyInput(destinationPath)) {\n\t\t\t\t\t\treturn failProviderMutation(property, destinationPath);\n\t\t\t\t\t}\n\t\t\t\t\tconst sourceInput = findInput(sourcePath);\n\t\t\t\t\tif (!sourceInput || isHidden(sourcePath)) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tconst mappedSourcePath = mapInputPath(sourcePath, sourceInput);\n\t\t\t\t\tif (property === 'copyFile') {\n\t\t\t\t\t\treturn Promise.resolve(\n\t\t\t\t\t\t\tinvokeProviderMethod(sourceInput.provider, 'readFile', [mappedSourcePath]),\n\t\t\t\t\t\t).then((contents) =>\n\t\t\t\t\t\t\tinvokeProviderMethod(target, 'writeFile', [destinationPath, contents]),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst contents = invokeProviderMethod(sourceInput.provider, 'readFileSync', [\n\t\t\t\t\t\tmappedSourcePath,\n\t\t\t\t\t]);\n\t\t\t\t\treturn invokeProviderMethod(target, 'writeFileSync', [destinationPath, contents]);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\tconst result =\n\t\t\t\t\treadonlyInput && !isHidden(providerPath)\n\t\t\t\t\t\t? invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t\t])\n\t\t\t\t\t\t: Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\tif (!readonlyInput || isHidden(providerPath)) {\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\t\t\t\tif (property === 'realpath') {\n\t\t\t\t\treturn Promise.resolve(result).then((resolvedPath) => {\n\t\t\t\t\t\tconst resolvedRelativePath = toRelativeProviderPath(String(resolvedPath));\n\t\t\t\t\t\treturn toAbsoluteProviderPath(\n\t\t\t\t\t\t\tresolvedRelativePath.length === 0\n\t\t\t\t\t\t\t\t? readonlyInput.destinationRelativePath\n\t\t\t\t\t\t\t\t: `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tif (property === 'realpathSync') {\n\t\t\t\t\tconst resolvedRelativePath = toRelativeProviderPath(String(result));\n\t\t\t\t\treturn toAbsoluteProviderPath(\n\t\t\t\t\t\tresolvedRelativePath.length === 0\n\t\t\t\t\t\t\t? readonlyInput.destinationRelativePath\n\t\t\t\t\t\t\t: `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result;\n\t\t\t};\n\t\t},\n\t});\n}\n\nexport function createFilteredWorkspaceProvider(\n\toptions: CreateFilteredWorkspaceProviderOptions,\n): VirtualProvider {\n\tlet workspaceProvider = options.baseProvider;\n\tif (options.policy.visibility.kind === 'positive-paths') {\n\t\tworkspaceProvider = createPositiveWorkspaceProjectionProvider(\n\t\t\tworkspaceProvider,\n\t\t\toptions.policy.visibility,\n\t\t\toptions.dependencies,\n\t\t);\n\t}\n\n\tif (options.policy.hiddenPaths.length > 0) {\n\t\tworkspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {\n\t\t\tshouldShadow: options.dependencies.createShadowPathPredicate(\n\t\t\t\toptions.policy.hiddenPaths.map(toAbsoluteProviderPath),\n\t\t\t),\n\t\t\twriteMode: 'deny',\n\t\t});\n\t}\n\n\tif (options.policy.temporaryPaths.length > 0) {\n\t\tconst hiddenPredicate = options.dependencies.createShadowPathPredicate(\n\t\t\toptions.policy.hiddenPaths.map(toAbsoluteProviderPath),\n\t\t);\n\t\tconst temporaryPredicate = options.dependencies.createShadowPathPredicate(\n\t\t\toptions.policy.temporaryPaths.map(toAbsoluteProviderPath),\n\t\t);\n\t\tworkspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {\n\t\t\tshouldShadow: (context) => !hiddenPredicate(context) && temporaryPredicate(context),\n\t\t\ttmpfs: options.dependencies.createMemoryProvider(),\n\t\t\twriteMode: 'tmpfs',\n\t\t});\n\t}\n\tworkspaceProvider = createWorkspaceHardlinkProvider(\n\t\tworkspaceProvider,\n\t\toptions.baseProvider,\n\t\toptions.policy,\n\t);\n\n\treturn createNestedReadonlyWorkspaceProvider(\n\t\tworkspaceProvider,\n\t\toptions.baseProvider,\n\t\toptions.policy,\n\t\toptions.dependencies,\n\t);\n}\n","import * as dns from 'node:dns';\nimport * as net from 'node:net';\n\nexport interface HostNetworkDefaultsResult {\n\treadonly autoSelectFamily: false | 'unavailable';\n\treadonly dnsResultOrder: 'ipv4first' | 'unavailable';\n}\n\nexport interface HostNetworkDefaultsDependencies {\n\treadonly setDefaultAutoSelectFamily?: ((value: boolean) => void) | undefined;\n\treadonly setDefaultResultOrder?: ((order: 'ipv4first') => void) | undefined;\n}\n\n/**\n * Gondolin raw tcpHosts passthrough sockets are opened by the host-side Node\n * process, not by guest Node processes. VM NODE_OPTIONS cannot affect those\n * sockets, so host processes that create Gondolin VMs also force deterministic\n * IPv4-first behavior before network state is constructed.\n */\nexport function configureHostNetworkDefaults(\n\tdependencies: HostNetworkDefaultsDependencies = {},\n): HostNetworkDefaultsResult {\n\tconst setDefaultResultOrder =\n\t\t'setDefaultResultOrder' in dependencies\n\t\t\t? dependencies.setDefaultResultOrder\n\t\t\t: dns.setDefaultResultOrder;\n\tconst setDefaultAutoSelectFamily =\n\t\t'setDefaultAutoSelectFamily' in dependencies\n\t\t\t? dependencies.setDefaultAutoSelectFamily\n\t\t\t: net.setDefaultAutoSelectFamily;\n\n\tlet dnsResultOrder: HostNetworkDefaultsResult['dnsResultOrder'] = 'unavailable';\n\tif (typeof setDefaultResultOrder === 'function') {\n\t\tsetDefaultResultOrder('ipv4first');\n\t\tdnsResultOrder = 'ipv4first';\n\t}\n\n\tlet autoSelectFamily: HostNetworkDefaultsResult['autoSelectFamily'] = 'unavailable';\n\tif (typeof setDefaultAutoSelectFamily === 'function') {\n\t\tsetDefaultAutoSelectFamily(false);\n\t\tautoSelectFamily = false;\n\t}\n\n\treturn {\n\t\tautoSelectFamily,\n\t\tdnsResultOrder,\n\t};\n}\n","import type { Stats } from 'node:fs';\nimport net from 'node:net';\n\nimport {\n\tvalidateManagedVmFinalizeMemoryMountRequest,\n\ttype ManagedVmFilteredWorkspacePolicy,\n\ttype ManagedVmFinalizeMemoryMountRequest,\n} from '@agent-vm/managed-vm';\nimport {\n\tMemoryProvider,\n\tReadonlyProvider,\n\tRealFSProvider,\n\tShadowProvider,\n\tVM,\n\tcreateHttpHooks,\n\tcreateShadowPathPredicate,\n\ttype CreateHttpHooksResult,\n\ttype EnableIngressOptions,\n\ttype EnableSshOptions,\n\ttype ExecOptions as GondolinExecOptions,\n\ttype ExecProcess as GondolinExecProcess,\n\ttype ExecResult as GondolinExecResult,\n\ttype HttpHooks,\n\ttype IngressRoute as GondolinIngressRoute,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype SshOptions,\n\ttype VMOptions,\n\ttype VmFs as GondolinVmFs,\n\ttype VirtualFileHandle,\n\ttype VirtualProvider,\n\tERRNO,\n\tgetInfoFromSshExecRequest,\n\tisWriteFlag,\n} from '@earendil-works/gondolin';\n\nimport { createFilteredWorkspaceProvider } from './filtered-workspace-provider.js';\nimport {\n\tconfigureHostNetworkDefaults,\n\ttype HostNetworkDefaultsResult,\n} from './host-network-defaults.js';\nimport {\n\tclosePinnedRealFsRoot,\n\tcreatePinnedRealFsProvider,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\n\nexport const SYNTHETIC_DNS_IPV4_BENCHMARK = '198.18.0.1';\nexport const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = '::ffff:198.18.0.1';\nexport const MANAGED_VM_DEFAULT_INGRESS_MAX_BUFFERED_RESPONSE_BODY_BYTES = 512 * 1024 * 1024;\nexport const MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_HEADER_TIMEOUT_MS = 120_000;\nexport const MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_RESPONSE_TIMEOUT_MS = 120_000;\n\nexport const MANAGED_VM_DEFAULT_INGRESS_OPTIONS = {\n\tallowWebSockets: true,\n\tbufferResponseBody: false,\n\tmaxBufferedResponseBodyBytes: MANAGED_VM_DEFAULT_INGRESS_MAX_BUFFERED_RESPONSE_BODY_BYTES,\n\tupstreamHeaderTimeoutMs: MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_HEADER_TIMEOUT_MS,\n\tupstreamResponseTimeoutMs: MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_RESPONSE_TIMEOUT_MS,\n} satisfies EnableIngressOptions;\n\nexport type ManagedExecInput = string | readonly string[];\nexport type ManagedExecOptions = GondolinExecOptions;\nexport type ManagedExecProcess = GondolinExecProcess;\nexport type ManagedExecResult = GondolinExecResult;\nexport type ManagedVmFs = GondolinVmFs;\nexport type ManagedSshEgressOptions = SshOptions;\n\nexport type IngressRoute = GondolinIngressRoute;\n\ntype VirtualProviderMethod = (...methodArguments: readonly unknown[]) => unknown;\n\nfunction createGuestRootOwnedStats(stats: Stats): Stats {\n\treturn new Proxy(stats, {\n\t\tget(target: Stats, property: string | symbol, receiver: unknown): unknown {\n\t\t\tif (property === 'gid' || property === 'uid') {\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\treturn Reflect.get(target, property, receiver);\n\t\t},\n\t});\n}\n\nfunction createGuestRootOwnedFileHandle(handle: VirtualFileHandle): VirtualFileHandle {\n\treturn new Proxy(handle, {\n\t\tget(target: VirtualFileHandle, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'stat') {\n\t\t\t\treturn async (options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.stat(options));\n\t\t\t}\n\t\t\tif (property === 'statSync') {\n\t\t\t\treturn (options?: object): Stats => createGuestRootOwnedStats(target.statSync(options));\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nfunction createGuestRootOwnedProvider(provider: VirtualProvider): VirtualProvider {\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'open') {\n\t\t\t\treturn async (\n\t\t\t\t\tentryPath: string,\n\t\t\t\t\tflags: string,\n\t\t\t\t\tmode?: number,\n\t\t\t\t): Promise<VirtualFileHandle> =>\n\t\t\t\t\tcreateGuestRootOwnedFileHandle(await target.open(entryPath, flags, mode));\n\t\t\t}\n\t\t\tif (property === 'openSync') {\n\t\t\t\treturn (entryPath: string, flags: string, mode?: number): VirtualFileHandle =>\n\t\t\t\t\tcreateGuestRootOwnedFileHandle(target.openSync(entryPath, flags, mode));\n\t\t\t}\n\t\t\tif (property === 'stat') {\n\t\t\t\treturn async (entryPath: string, options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.stat(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'statSync') {\n\t\t\t\treturn (entryPath: string, options?: object): Stats =>\n\t\t\t\t\tcreateGuestRootOwnedStats(target.statSync(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'lstat') {\n\t\t\t\treturn async (entryPath: string, options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.lstat(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'lstatSync') {\n\t\t\t\treturn (entryPath: string, options?: object): Stats =>\n\t\t\t\t\tcreateGuestRootOwnedStats(target.lstatSync(entryPath, options));\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nfunction createReadonlyMutationError(\n\tsyscall: string,\n\tfilePath: string | undefined,\n): Error & {\n\treadonly code: 'EROFS';\n\treadonly errno: number;\n\treadonly path?: string;\n\treadonly syscall: string;\n} {\n\tconst pathSuffix = filePath === undefined ? '' : ` '${filePath}'`;\n\treturn Object.assign(new Error(`EROFS: ${syscall}${pathSuffix}`), {\n\t\tcode: 'EROFS' as const,\n\t\terrno: ERRNO.EROFS,\n\t\t...(filePath === undefined ? {} : { path: filePath }),\n\t\tsyscall,\n\t});\n}\n\nfunction createHardenedReadonlyFileHandle(handle: VirtualFileHandle): VirtualFileHandle {\n\treturn new Proxy(handle, {\n\t\tget(target: VirtualFileHandle, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'write' || property === 'writeFile' || property === 'truncate') {\n\t\t\t\treturn async (): Promise<never> => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), target.path);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'writeSync' || property === 'writeFileSync' || property === 'truncateSync') {\n\t\t\t\treturn (): never => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), target.path);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nexport function createHardenedReadonlyProvider(provider: VirtualProvider): VirtualProvider {\n\tconst readonlyProvider = new ReadonlyProvider(provider);\n\treturn new Proxy(readonlyProvider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'open') {\n\t\t\t\treturn async (\n\t\t\t\t\tentryPath: string,\n\t\t\t\t\tflags: string,\n\t\t\t\t\tmode?: number,\n\t\t\t\t): Promise<VirtualFileHandle> => {\n\t\t\t\t\tif (isWriteFlag(flags)) {\n\t\t\t\t\t\tthrow createReadonlyMutationError('open', entryPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn createHardenedReadonlyFileHandle(await target.open(entryPath, flags, mode));\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'openSync') {\n\t\t\t\treturn (entryPath: string, flags: string, mode?: number): VirtualFileHandle => {\n\t\t\t\t\tif (isWriteFlag(flags)) {\n\t\t\t\t\t\tthrow createReadonlyMutationError('openSync', entryPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn createHardenedReadonlyFileHandle(target.openSync(entryPath, flags, mode));\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'mkdir' ||\n\t\t\t\tproperty === 'rmdir' ||\n\t\t\t\tproperty === 'unlink' ||\n\t\t\t\tproperty === 'rename' ||\n\t\t\t\tproperty === 'link' ||\n\t\t\t\tproperty === 'writeFile' ||\n\t\t\t\tproperty === 'appendFile' ||\n\t\t\t\tproperty === 'copyFile' ||\n\t\t\t\tproperty === 'symlink'\n\t\t\t) {\n\t\t\t\treturn async (entryPath: string): Promise<never> => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), entryPath);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'mkdirSync' ||\n\t\t\t\tproperty === 'rmdirSync' ||\n\t\t\t\tproperty === 'unlinkSync' ||\n\t\t\t\tproperty === 'renameSync' ||\n\t\t\t\tproperty === 'linkSync' ||\n\t\t\t\tproperty === 'writeFileSync' ||\n\t\t\t\tproperty === 'appendFileSync' ||\n\t\t\t\tproperty === 'copyFileSync' ||\n\t\t\t\tproperty === 'symlinkSync'\n\t\t\t) {\n\t\t\t\treturn (entryPath: string): never => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), entryPath);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nexport interface GitReadOnlySshEgressOptions {\n\treadonly allowedHosts: readonly string[];\n\treadonly allowedRepos?: readonly string[];\n\treadonly agent?: string;\n\treadonly knownHostsFile?: SshOptions['knownHostsFile'];\n}\n\nexport interface SshAccess {\n\tclose(): Promise<void>;\n\treadonly host: string;\n\treadonly command?: string;\n\treadonly identityFile?: string;\n\treadonly port: number;\n\treadonly serverHostKey: SshServerHostKey;\n\treadonly user?: string;\n}\n\nexport interface ManagedVmSshAccess {\n\tclose(): Promise<void>;\n\treadonly command: string;\n\treadonly host: string;\n\treadonly identityFile: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface SshServerHostKey {\n\treadonly algorithm: 'ssh-ed25519';\n\treadonly publicKeyBase64: string;\n}\n\nexport function isSshServerHostKey(value: unknown): value is SshServerHostKey {\n\tif (typeof value !== 'object' || value === null) {\n\t\treturn false;\n\t}\n\tif (!('algorithm' in value) || !('publicKeyBase64' in value)) {\n\t\treturn false;\n\t}\n\tconst algorithm = value.algorithm;\n\tconst publicKeyBase64 = value.publicKeyBase64;\n\tif (\n\t\talgorithm !== 'ssh-ed25519' ||\n\t\ttypeof publicKeyBase64 !== 'string' ||\n\t\t!/^[A-Za-z0-9+/]+={0,2}$/u.test(publicKeyBase64)\n\t) {\n\t\treturn false;\n\t}\n\n\ttry {\n\t\tconst decodedPublicKey = Buffer.from(publicKeyBase64, 'base64');\n\t\tif (decodedPublicKey.toString('base64') !== publicKeyBase64 || decodedPublicKey.length < 4) {\n\t\t\treturn false;\n\t\t}\n\t\tconst algorithmLength = decodedPublicKey.readUInt32BE(0);\n\t\tconst algorithmStart = 4;\n\t\tconst algorithmEnd = algorithmStart + algorithmLength;\n\t\tconst publicKeyLengthOffset = algorithmEnd;\n\t\tconst publicKeyStart = publicKeyLengthOffset + 4;\n\t\treturn (\n\t\t\talgorithmEnd + 4 <= decodedPublicKey.length &&\n\t\t\tdecodedPublicKey.subarray(algorithmStart, algorithmEnd).toString('utf8') === 'ssh-ed25519' &&\n\t\t\tdecodedPublicKey.readUInt32BE(publicKeyLengthOffset) === 32 &&\n\t\t\tdecodedPublicKey.length === publicKeyStart + 32\n\t\t);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport function parseSshServerHostKey(publicKeyText: string): SshServerHostKey {\n\tconst publicKeyLines = publicKeyText\n\t\t.split('\\n')\n\t\t.map((line) => line.trim())\n\t\t.filter((line) => line.length > 0);\n\tif (publicKeyLines.length !== 1) {\n\t\tthrow new Error('Tool VM did not expose exactly one ssh-ed25519 server host key.');\n\t}\n\tconst publicKeyFields = publicKeyLines[0]?.split(/\\s+/u);\n\tconst serverHostKey = {\n\t\talgorithm: publicKeyFields?.[0],\n\t\tpublicKeyBase64: publicKeyFields?.[1],\n\t};\n\tif (!isSshServerHostKey(serverHostKey)) {\n\t\tthrow new Error('Tool VM did not expose a valid ssh-ed25519 server host key.');\n\t}\n\treturn serverHostKey;\n}\n\nasync function readSshServerHostKey(vmInstance: ManagedVmInstance): Promise<SshServerHostKey> {\n\tconst publicKeyResult = await vmInstance.exec(['/bin/cat', '/etc/ssh/ssh_host_ed25519_key.pub']);\n\tif (publicKeyResult.exitCode !== 0) {\n\t\tthrow new Error(\n\t\t\t`Tool VM server host key read failed with exit ${String(publicKeyResult.exitCode)}.`,\n\t\t);\n\t}\n\treturn parseSshServerHostKey(publicKeyResult.stdout);\n}\n\nasync function closeSshAccessAfterIdentityFailure(\n\tsshAccess: Awaited<ReturnType<ManagedVmInstance['enableSsh']>>,\n\tidentityError: unknown,\n): Promise<never> {\n\ttry {\n\t\tawait sshAccess.close();\n\t} catch (closeError) {\n\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError.errors preserves closeError while cause retains the primary identity failure.\n\t\tthrow new AggregateError(\n\t\t\t[identityError, closeError],\n\t\t\t'Tool VM SSH server identity validation and SSH access cleanup both failed.',\n\t\t\t{ cause: identityError },\n\t\t);\n\t}\n\tthrow identityError;\n}\n\nexport interface IngressAccess {\n\tclose(): Promise<void>;\n\treadonly host: string;\n\treadonly port: number;\n}\n\nexport interface ManagedVmInstance {\n\treadonly fs: ManagedVmFs;\n\treadonly id: string;\n\texec(command: string | string[], options?: ManagedExecOptions): ManagedExecProcess;\n\tenableSsh(options?: EnableSshOptions): Promise<ManagedVmSshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tgetHostPid?(): number | null;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tstart(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\nexport interface ManagedVmDependencies {\n\tconfigureHostNetworkDefaults?: () => HostNetworkDefaultsResult;\n\tcreateVm(vmOptions: VMOptions): Promise<ManagedVmInstance>;\n\tcreateHttpHooks(options: {\n\t\treadonly allowedHosts: readonly string[];\n\t\treadonly allowedInternalHosts?: readonly string[];\n\t\treadonly isIpAllowed?: HttpHooks['isIpAllowed'];\n\t\treadonly secrets: Record<string, ManagedHttpMediatedSecretSpec>;\n\t\treadonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n\t\treadonly onResponse?: (response: Response) => Promise<Response | void>;\n\t}): Pick<CreateHttpHooksResult, 'env' | 'httpHooks'>;\n\tclosePinnedRealFsRoot(root: PinnedRealFsRoot): void;\n\tcreatePinnedRealFsProvider(root: PinnedRealFsRoot): VirtualProvider;\n\tcreateRealFsProvider(hostPath: string): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n}\n\ninterface ManagedHttpMediatedSecretSpec {\n\treadonly hosts: readonly string[];\n\treadonly placeholder?: string;\n\treadonly value: string;\n}\n\ntype RealFsVfsMountSpec = {\n\treadonly hostPath?: string;\n\treadonly kind: 'realfs' | 'realfs-readonly';\n\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n};\n\nexport type VfsMountSpec =\n\t| RealFsVfsMountSpec\n\t| {\n\t\t\treadonly access: 'read-only' | 'read-write';\n\t\t\treadonly kind: 'finalizable-memory';\n\t }\n\t| {\n\t\t\treadonly kind: 'filtered-workspace';\n\t\t\treadonly pinnedHostRoot: PinnedRealFsRoot;\n\t\t\treadonly policy: ManagedVmFilteredWorkspacePolicy;\n\t }\n\t| { readonly kind: 'memory' }\n\t| {\n\t\t\treadonly hostPath?: string;\n\t\t\treadonly kind: 'shadow';\n\t\t\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n\t\t\treadonly shadowConfig?: {\n\t\t\t\treadonly deny: readonly string[];\n\t\t\t\treadonly tmpfs: readonly string[];\n\t\t\t};\n\t };\n\nexport interface CreateVmOptions {\n\treadonly imagePath: string;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly rootfsMode: 'readonly' | 'memory' | 'cow';\n\treadonly runtimeRootfsSize?: string;\n\treadonly allowedHosts: readonly string[];\n\treadonly secrets: Record<string, ManagedHttpMediatedSecretSpec>;\n\treadonly vfsMounts: Record<string, VfsMountSpec>;\n\treadonly tcpHosts?: Record<string, string>;\n\treadonly sshEgress?: ManagedSshEgressOptions;\n\treadonly env?: Record<string, string>;\n\treadonly sessionLabel?: string;\n\treadonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n\treadonly onResponse?: (response: Response) => Promise<Response | void>;\n}\n\nexport interface ManagedVm {\n\treadonly fs: ManagedVmFs;\n\treadonly id: string;\n\texec(command: ManagedExecInput, options?: ManagedExecOptions): ManagedExecProcess;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tfinalizeMemoryMount(request: ManagedVmFinalizeMemoryMountRequest): Promise<void>;\n\tgetHostPid(): number | null;\n\tgetVmInstance(): ManagedVmInstance;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tstart(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- VM.create() returns\n Gondolin's concrete VM class; this adapter exposes only the narrower\n ManagedVmInstance interface used by agent-vm. */\nfunction createDefaultDependencies(): ManagedVmDependencies {\n\tconst createDefaultRealFsProvider = (hostPath: string): VirtualProvider =>\n\t\tnew RealFSProvider(hostPath);\n\treturn {\n\t\tconfigureHostNetworkDefaults,\n\t\tcreateVm: async (vmOptions: VMOptions): Promise<ManagedVmInstance> =>\n\t\t\t(await VM.create(vmOptions)) as unknown as ManagedVmInstance,\n\t\tcreateHttpHooks: (hookOptions) =>\n\t\t\tcreateHttpHooks({\n\t\t\t\tallowedHosts: [...hookOptions.allowedHosts],\n\t\t\t\t...(hookOptions.allowedInternalHosts === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: { allowedInternalHosts: [...hookOptions.allowedInternalHosts] }),\n\t\t\t\t...(hookOptions.isIpAllowed ? { isIpAllowed: hookOptions.isIpAllowed } : {}),\n\t\t\t\tsecrets: Object.fromEntries(\n\t\t\t\t\tObject.entries(hookOptions.secrets).map(([secretName, secretSpec]) => [\n\t\t\t\t\t\tsecretName,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secretSpec.hosts],\n\t\t\t\t\t\t\t...(secretSpec.placeholder === undefined\n\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t: { placeholder: secretSpec.placeholder }),\n\t\t\t\t\t\t\tvalue: secretSpec.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t),\n\t\t\t\t...(hookOptions.onRequest ? { onRequest: hookOptions.onRequest } : {}),\n\t\t\t\t...(hookOptions.onResponse ? { onResponse: hookOptions.onResponse } : {}),\n\t\t\t}),\n\t\tclosePinnedRealFsRoot,\n\t\tcreatePinnedRealFsProvider: (root: PinnedRealFsRoot): VirtualProvider =>\n\t\t\tcreatePinnedRealFsProvider({\n\t\t\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\t\t\troot,\n\t\t\t}),\n\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\tcreateReadonlyProvider: createHardenedReadonlyProvider,\n\t\tcreateMemoryProvider: (): VirtualProvider => new MemoryProvider(),\n\t\tcreateShadowProvider: (\n\t\t\tprovider: VirtualProvider,\n\t\t\tshadowOptions: ShadowProviderOptions,\n\t\t): VirtualProvider => new ShadowProvider(provider, shadowOptions),\n\t\tcreateShadowPathPredicate: (paths: readonly string[]): ShadowPredicate =>\n\t\t\tcreateShadowPathPredicate([...paths]),\n\t};\n}\n/* oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n\nfunction normalizeShadowPath(pathValue: string): string {\n\tconst trimmedPath = pathValue.trim();\n\tif (trimmedPath.startsWith('/')) {\n\t\treturn trimmedPath;\n\t}\n\n\tconst relativePath = trimmedPath.startsWith('./') ? trimmedPath.slice('./'.length) : trimmedPath;\n\treturn `/${relativePath}`;\n}\n\nfunction createRealFsProviderForSpec(\n\tmountSpec: RealFsVfsMountSpec | Extract<VfsMountSpec, { readonly kind: 'shadow' }>,\n\tdependencies: ManagedVmDependencies,\n\tmountKind: string,\n): VirtualProvider {\n\tif (mountSpec.pinnedHostRoot) {\n\t\treturn dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot);\n\t}\n\tif (mountSpec.hostPath) {\n\t\treturn dependencies.createRealFsProvider(mountSpec.hostPath);\n\t}\n\n\tthrow new Error(`${mountKind} mounts require hostPath or pinnedHostRoot`);\n}\n\nfunction createProviderFromSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n): VirtualProvider {\n\tswitch (mountSpec.kind) {\n\t\tcase 'finalizable-memory':\n\t\t\tthrow new Error('Finalizable memory mounts require retained provider construction.');\n\t\tcase 'memory':\n\t\t\treturn dependencies.createMemoryProvider();\n\t\tcase 'realfs': {\n\t\t\treturn createRealFsProviderForSpec(mountSpec, dependencies, 'realfs');\n\t\t}\n\t\tcase 'realfs-readonly': {\n\t\t\treturn dependencies.createReadonlyProvider(\n\t\t\t\tcreateRealFsProviderForSpec(mountSpec, dependencies, 'realfs-readonly'),\n\t\t\t);\n\t\t}\n\t\tcase 'filtered-workspace': {\n\t\t\treturn createFilteredWorkspaceProvider({\n\t\t\t\tbaseProvider: dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot),\n\t\t\t\tdependencies,\n\t\t\t\tpolicy: mountSpec.policy,\n\t\t\t});\n\t\t}\n\t\tcase 'shadow': {\n\t\t\tconst baseProvider =\n\t\t\t\tmountSpec.hostPath || mountSpec.pinnedHostRoot\n\t\t\t\t\t? createRealFsProviderForSpec(mountSpec, dependencies, 'shadow')\n\t\t\t\t\t: dependencies.createMemoryProvider();\n\n\t\t\tlet shadowProvider = baseProvider;\n\t\t\tconst shadowConfig = mountSpec.shadowConfig;\n\n\t\t\tif (shadowConfig?.deny.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.deny.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'deny',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (shadowConfig?.tmpfs.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.tmpfs.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'tmpfs',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn shadowProvider;\n\t\t}\n\t\tdefault: {\n\t\t\tthrow new Error('Unsupported VFS mount kind.');\n\t\t}\n\t}\n}\n\ninterface FinalizableMemoryMount {\n\treadonly provider: VirtualProvider;\n\tstate: 'failed' | 'finalized' | 'finalizing' | 'pending';\n}\n\ninterface CreatedVfsMounts {\n\treadonly finalizableMemoryMounts: Map<string, FinalizableMemoryMount>;\n\treadonly mounts: Record<string, VirtualProvider>;\n}\n\nfunction createVfsMounts(\n\tvfsMounts: Record<string, VfsMountSpec>,\n\tdependencies: ManagedVmDependencies,\n): CreatedVfsMounts {\n\tconst mountMap: Record<string, VirtualProvider> = {};\n\tconst finalizableMemoryMounts = new Map<string, FinalizableMemoryMount>();\n\n\tfor (const [guestPath, mountSpec] of Object.entries(vfsMounts)) {\n\t\tif (mountSpec.kind === 'finalizable-memory') {\n\t\t\tconst provider = dependencies.createMemoryProvider();\n\t\t\tfinalizableMemoryMounts.set(guestPath, { provider, state: 'pending' });\n\t\t\tconst guestProvider = createGuestRootOwnedProvider(provider);\n\t\t\tmountMap[guestPath] =\n\t\t\t\tmountSpec.access === 'read-only'\n\t\t\t\t\t? dependencies.createReadonlyProvider(guestProvider)\n\t\t\t\t\t: guestProvider;\n\t\t\tcontinue;\n\t\t}\n\t\tmountMap[guestPath] = createProviderFromSpec(mountSpec, dependencies);\n\t}\n\n\treturn { finalizableMemoryMounts, mounts: mountMap };\n}\n\nfunction collectPinnedRealFsRoots(\n\tvfsMounts: Record<string, VfsMountSpec>,\n): readonly PinnedRealFsRoot[] {\n\tconst roots = new Map<number, PinnedRealFsRoot>();\n\tfor (const mountSpec of Object.values(vfsMounts)) {\n\t\tif ('pinnedHostRoot' in mountSpec && mountSpec.pinnedHostRoot) {\n\t\t\troots.set(mountSpec.pinnedHostRoot.fd, mountSpec.pinnedHostRoot);\n\t\t}\n\t}\n\treturn [...roots.values()];\n}\n\nfunction closePinnedRealFsRoots(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\tconst closeErrors: unknown[] = [];\n\tfor (const root of roots) {\n\t\ttry {\n\t\t\tdependencies.closePinnedRealFsRoot(root);\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t}\n\tif (closeErrors.length === 1) {\n\t\tthrow closeErrors[0];\n\t}\n\tif (closeErrors.length > 1) {\n\t\tthrow new AggregateError(closeErrors, 'Multiple pinned RealFS roots failed to close.');\n\t}\n}\n\nfunction closePinnedRealFsRootsAfterFailure(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\ttry {\n\t\tclosePinnedRealFsRoots(roots, dependencies);\n\t} catch {\n\t\t// Preserve the VM creation failure; leaked-fd risk is lower than hiding\n\t\t// the root cause of a failed lease.\n\t}\n}\n\nfunction resolveManagedVmIngressOptions(\n\tingressOptions: EnableIngressOptions = {},\n): EnableIngressOptions {\n\tconst resolvedOptions: EnableIngressOptions = {\n\t\t...MANAGED_VM_DEFAULT_INGRESS_OPTIONS,\n\t};\n\n\tif (ingressOptions.listenHost !== undefined) {\n\t\tresolvedOptions.listenHost = ingressOptions.listenHost;\n\t}\n\tif (ingressOptions.listenPort !== undefined) {\n\t\tresolvedOptions.listenPort = ingressOptions.listenPort;\n\t}\n\tif (ingressOptions.allowWebSockets !== undefined) {\n\t\tresolvedOptions.allowWebSockets = ingressOptions.allowWebSockets;\n\t}\n\tif (ingressOptions.hooks !== undefined) {\n\t\tresolvedOptions.hooks = ingressOptions.hooks;\n\t}\n\tif (ingressOptions.bufferResponseBody !== undefined) {\n\t\tresolvedOptions.bufferResponseBody = ingressOptions.bufferResponseBody;\n\t}\n\tif (ingressOptions.maxBufferedResponseBodyBytes !== undefined) {\n\t\tresolvedOptions.maxBufferedResponseBodyBytes = ingressOptions.maxBufferedResponseBodyBytes;\n\t}\n\tif (ingressOptions.upstreamHeaderTimeoutMs !== undefined) {\n\t\tresolvedOptions.upstreamHeaderTimeoutMs = ingressOptions.upstreamHeaderTimeoutMs;\n\t}\n\tif (ingressOptions.upstreamResponseTimeoutMs !== undefined) {\n\t\tresolvedOptions.upstreamResponseTimeoutMs = ingressOptions.upstreamResponseTimeoutMs;\n\t}\n\n\treturn resolvedOptions;\n}\n\ninterface TcpHostEndpoint {\n\treadonly hostname: string;\n\treadonly port: number;\n}\n\ninterface InternalTcpHostRule extends TcpHostEndpoint {}\n\nfunction normalizePolicyHostname(hostname: string): string {\n\treturn hostname.toLowerCase();\n}\n\nfunction parseTcpHostEndpoint(endpoint: string): TcpHostEndpoint | undefined {\n\tif (endpoint.startsWith('[')) {\n\t\tconst closingBracketIndex = endpoint.indexOf(']');\n\t\tif (closingBracketIndex > 1) {\n\t\t\tconst portValue = Number.parseInt(endpoint.slice(closingBracketIndex + 2), 10);\n\t\t\tif (!Number.isFinite(portValue)) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\thostname: normalizePolicyHostname(endpoint.slice(1, closingBracketIndex)),\n\t\t\t\tport: portValue,\n\t\t\t};\n\t\t}\n\t}\n\n\tconst portSeparatorIndex = endpoint.lastIndexOf(':');\n\tif (portSeparatorIndex <= 0) {\n\t\treturn undefined;\n\t}\n\tconst portValue = Number.parseInt(endpoint.slice(portSeparatorIndex + 1), 10);\n\tif (!Number.isFinite(portValue)) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\thostname: normalizePolicyHostname(endpoint.slice(0, portSeparatorIndex)),\n\t\tport: portValue,\n\t};\n}\n\nfunction ipv4AddressIsInternal(ipAddress: string): boolean {\n\tconst octets = ipAddress.split('.').map((segment) => Number.parseInt(segment, 10));\n\tif (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) {\n\t\treturn false;\n\t}\n\tconst firstOctet = octets[0];\n\tconst secondOctet = octets[1];\n\tif (firstOctet === undefined || secondOctet === undefined) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfirstOctet === 10 ||\n\t\tfirstOctet === 127 ||\n\t\t(firstOctet === 169 && secondOctet === 254) ||\n\t\t(firstOctet === 172 && secondOctet >= 16 && secondOctet <= 31) ||\n\t\t(firstOctet === 192 && secondOctet === 168) ||\n\t\t(firstOctet === 100 && secondOctet >= 64 && secondOctet <= 127)\n\t);\n}\n\nfunction ipAddressIsInternal(ipAddress: string): boolean {\n\tif (net.isIP(ipAddress) === 4) {\n\t\treturn ipv4AddressIsInternal(ipAddress);\n\t}\n\tconst normalizedIpAddress = ipAddress.toLowerCase();\n\tif (normalizedIpAddress.startsWith('::ffff:')) {\n\t\treturn ipv4AddressIsInternal(normalizedIpAddress.slice('::ffff:'.length));\n\t}\n\treturn (\n\t\tnormalizedIpAddress === '::1' ||\n\t\tnormalizedIpAddress.startsWith('fc') ||\n\t\tnormalizedIpAddress.startsWith('fd') ||\n\t\tnormalizedIpAddress.startsWith('fe80:')\n\t);\n}\n\nfunction endpointHostnameIsInternal(hostname: string): boolean {\n\tconst normalizedHostname = normalizePolicyHostname(hostname);\n\treturn (\n\t\tnormalizedHostname === 'localhost' ||\n\t\tnormalizedHostname === 'host.docker.internal' ||\n\t\tipAddressIsInternal(normalizedHostname)\n\t);\n}\n\nfunction deriveInternalTcpHostRules(\n\ttcpHosts: Record<string, string> | undefined,\n): readonly InternalTcpHostRule[] {\n\tif (!tcpHosts) {\n\t\treturn [];\n\t}\n\n\tconst rules: InternalTcpHostRule[] = [];\n\tfor (const [tcpHostKey, tcpHostTarget] of Object.entries(tcpHosts)) {\n\t\tconst exposedEndpoint = parseTcpHostEndpoint(tcpHostKey);\n\t\tconst targetEndpoint = parseTcpHostEndpoint(tcpHostTarget);\n\t\tif (\n\t\t\t!exposedEndpoint ||\n\t\t\t!targetEndpoint ||\n\t\t\t!endpointHostnameIsInternal(targetEndpoint.hostname)\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (\n\t\t\t!rules.some(\n\t\t\t\t(rule) => rule.hostname === exposedEndpoint.hostname && rule.port === exposedEndpoint.port,\n\t\t\t)\n\t\t) {\n\t\t\trules.push(exposedEndpoint);\n\t\t}\n\t}\n\treturn rules;\n}\n\nfunction mergeUniqueHosts(\n\thosts: readonly string[],\n\tadditionalHosts: readonly string[],\n): readonly string[] {\n\tconst mergedHosts = [...hosts];\n\tfor (const host of additionalHosts) {\n\t\tif (!mergedHosts.includes(host)) {\n\t\t\tmergedHosts.push(host);\n\t\t}\n\t}\n\treturn mergedHosts;\n}\n\nfunction normalizeGitRepoPath(repoPath: string): string {\n\treturn repoPath.replace(/^\\/+/u, '').replace(/\\.git$/u, '');\n}\n\nexport function createGitReadOnlySshEgressOptions(\n\toptions: GitReadOnlySshEgressOptions,\n): ManagedSshEgressOptions {\n\tconst allowedRepos =\n\t\toptions.allowedRepos === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.allowedRepos.map((repoPath) => normalizeGitRepoPath(repoPath)));\n\n\treturn {\n\t\tallowedHosts: [...options.allowedHosts],\n\t\t...(options.agent ? { agent: options.agent } : {}),\n\t\t...(options.knownHostsFile ? { knownHostsFile: options.knownHostsFile } : {}),\n\t\texecPolicy: (request) => {\n\t\t\tconst gitExec = getInfoFromSshExecRequest(request);\n\t\t\tif (!gitExec) {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: non-git SSH exec is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (gitExec.service === 'git-receive-pack') {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: git push over guest SSH is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (gitExec.service !== 'git-upload-pack') {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: unsupported git SSH service is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (allowedRepos && !allowedRepos.has(normalizeGitRepoPath(gitExec.repo))) {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: git repository is not allowlisted for guest SSH reads',\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allow: true };\n\t\t},\n\t};\n}\n\nfunction createInternalTcpHostPolicy(\n\trules: readonly InternalTcpHostRule[],\n): HttpHooks['isIpAllowed'] | undefined {\n\tif (rules.length === 0) {\n\t\treturn undefined;\n\t}\n\tconst ruleHostnames = new Set(rules.map((rule) => rule.hostname));\n\treturn (info) => {\n\t\tconst hostname = normalizePolicyHostname(info.hostname);\n\t\tconst exactRuleMatched = rules.some(\n\t\t\t(rule) => rule.hostname === hostname && rule.port === info.port,\n\t\t);\n\t\tif (ruleHostnames.has(hostname)) {\n\t\t\treturn exactRuleMatched;\n\t\t}\n\t\tif (ipAddressIsInternal(info.ip)) {\n\t\t\treturn false;\n\t\t}\n\t\treturn true;\n\t};\n}\n\nexport async function createManagedVm(\n\toptions: CreateVmOptions,\n\tdependencies: ManagedVmDependencies = createDefaultDependencies(),\n): Promise<ManagedVm> {\n\tdependencies.configureHostNetworkDefaults?.();\n\tconst hasTcpHosts = options.tcpHosts && Object.keys(options.tcpHosts).length > 0;\n\tconst hasSshEgress = options.sshEgress !== undefined && options.sshEgress.allowedHosts.length > 0;\n\tconst internalTcpHostRules = deriveInternalTcpHostRules(options.tcpHosts);\n\tconst allowedInternalHosts = mergeUniqueHosts(\n\t\t[],\n\t\tinternalTcpHostRules.map((rule) => rule.hostname),\n\t);\n\tconst isIpAllowed = createInternalTcpHostPolicy(internalTcpHostRules);\n\tconst pinnedRealFsRoots = collectPinnedRealFsRoots(options.vfsMounts);\n\tlet createdVfsMounts: CreatedVfsMounts;\n\tlet vmInstance: ManagedVmInstance;\n\ttry {\n\t\tcreatedVfsMounts = createVfsMounts(options.vfsMounts, dependencies);\n\t\tconst hookBundle = dependencies.createHttpHooks({\n\t\t\tallowedHosts: options.allowedHosts,\n\t\t\t...(allowedInternalHosts.length > 0 ? { allowedInternalHosts } : {}),\n\t\t\t...(isIpAllowed ? { isIpAllowed } : {}),\n\t\t\tsecrets: options.secrets,\n\t\t\t...(options.onRequest ? { onRequest: options.onRequest } : {}),\n\t\t\t...(options.onResponse ? { onResponse: options.onResponse } : {}),\n\t\t});\n\t\tvmInstance = await dependencies.createVm({\n\t\t\t...(options.imagePath.length > 0 ? { sandbox: { imagePath: options.imagePath } } : {}),\n\t\t\t...(options.sessionLabel ? { sessionLabel: options.sessionLabel } : {}),\n\t\t\trootfs: {\n\t\t\t\tmode: options.rootfsMode,\n\t\t\t\t...(options.runtimeRootfsSize === undefined ? {} : { size: options.runtimeRootfsSize }),\n\t\t\t},\n\t\t\tmemory: options.memory,\n\t\t\tcpus: options.cpus,\n\t\t\tenv: {\n\t\t\t\t...hookBundle.env,\n\t\t\t\t...options.env,\n\t\t\t},\n\t\t\thttpHooks: hookBundle.httpHooks,\n\t\t\tvfs: {\n\t\t\t\tfuseMount: '/data',\n\t\t\t\tmounts: createdVfsMounts.mounts,\n\t\t\t},\n\t\t\t...(hasTcpHosts || hasSshEgress\n\t\t\t\t? {\n\t\t\t\t\t\tdns: {\n\t\t\t\t\t\t\tmode: 'synthetic',\n\t\t\t\t\t\t\tsyntheticIPv4: SYNTHETIC_DNS_IPV4_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticIPv6: SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticHostMapping: 'per-host',\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(hasSshEgress ? { ssh: options.sshEgress } : {}),\n\t\t\t\t\t\t...(hasTcpHosts\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\ttcp: {\n\t\t\t\t\t\t\t\t\t\thosts: options.tcpHosts,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t});\n\t} catch (error) {\n\t\tclosePinnedRealFsRootsAfterFailure(pinnedRealFsRoots, dependencies);\n\t\tthrow error;\n\t}\n\n\tlet finalizationPoison: unknown;\n\tlet lifecycleState: 'closed' | 'created' | 'started' = 'created';\n\tconst poisonFinalization = (error: unknown): void => {\n\t\tfinalizationPoison ??= error;\n\t};\n\treturn {\n\t\tfs: vmInstance.fs,\n\t\tid: vmInstance.id,\n\t\texec(command: ManagedExecInput, execOptions?: ManagedExecOptions): ManagedExecProcess {\n\t\t\tconst normalizedCommand = typeof command === 'string' ? command : [...command];\n\t\t\treturn vmInstance.exec(normalizedCommand, execOptions);\n\t\t},\n\t\tasync enableSsh(sshOptions?: EnableSshOptions): Promise<SshAccess> {\n\t\t\tconst sshAccess = await vmInstance.enableSsh(sshOptions);\n\t\t\tlet serverHostKey: SshServerHostKey;\n\t\t\ttry {\n\t\t\t\tserverHostKey = await readSshServerHostKey(vmInstance);\n\t\t\t} catch (identityError) {\n\t\t\t\treturn await closeSshAccessAfterIdentityFailure(sshAccess, identityError);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tclose: async (): Promise<void> => await sshAccess.close(),\n\t\t\t\tcommand: sshAccess.command,\n\t\t\t\thost: sshAccess.host,\n\t\t\t\tidentityFile: sshAccess.identityFile,\n\t\t\t\tport: sshAccess.port,\n\t\t\t\tserverHostKey,\n\t\t\t\tuser: sshAccess.user,\n\t\t\t};\n\t\t},\n\t\tasync enableIngress(ingressOptions?: EnableIngressOptions): Promise<IngressAccess> {\n\t\t\treturn await vmInstance.enableIngress(resolveManagedVmIngressOptions(ingressOptions));\n\t\t},\n\t\tasync finalizeMemoryMount(request: ManagedVmFinalizeMemoryMountRequest): Promise<void> {\n\t\t\tif (lifecycleState === 'closed') {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mounts cannot be finalized after close.');\n\t\t\t}\n\t\t\tif (lifecycleState === 'started') {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mounts cannot be finalized after start.');\n\t\t\t}\n\t\t\tif (finalizationPoison !== undefined) {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mount finalization is poisoned.', {\n\t\t\t\t\tcause: finalizationPoison,\n\t\t\t\t});\n\t\t\t}\n\t\t\tlet validatedRequest: ManagedVmFinalizeMemoryMountRequest;\n\t\t\ttry {\n\t\t\t\tvalidatedRequest = validateManagedVmFinalizeMemoryMountRequest(request);\n\t\t\t\tconst mount = createdVfsMounts.finalizableMemoryMounts.get(validatedRequest.guestPath);\n\t\t\t\tif (mount === undefined) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed Gondolin VM has no declared finalizable memory mount at '${validatedRequest.guestPath}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (mount.state !== 'pending') {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed Gondolin VM memory mount '${validatedRequest.guestPath}' must be finalized exactly once.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tmount.state = 'finalizing';\n\t\t\t\tif (mount.provider.writeFile === undefined) {\n\t\t\t\t\tthrow new Error('Gondolin memory provider does not support file writes.');\n\t\t\t\t}\n\t\t\t\tfor (const file of validatedRequest.files) {\n\t\t\t\t\t// oxlint-disable-next-line no-await-in-loop -- one-shot inventory publication is intentionally ordered.\n\t\t\t\t\tawait mount.provider.writeFile(`/${file.relativePath}`, Buffer.from(file.contents), {\n\t\t\t\t\t\tmode: file.mode,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tmount.state = 'finalized';\n\t\t\t} catch (error) {\n\t\t\t\tconst mount = createdVfsMounts.finalizableMemoryMounts.get(request.guestPath);\n\t\t\t\tif (mount !== undefined) mount.state = 'failed';\n\t\t\t\tpoisonFinalization(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t\tgetHostPid(): number | null {\n\t\t\treturn vmInstance.getHostPid?.() ?? null;\n\t\t},\n\t\tgetVmInstance(): ManagedVmInstance {\n\t\t\treturn vmInstance;\n\t\t},\n\t\tsetIngressRoutes(routes: readonly IngressRoute[]): void {\n\t\t\tvmInstance.setIngressRoutes(routes);\n\t\t},\n\t\tasync start(): Promise<void> {\n\t\t\tif (finalizationPoison !== undefined) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t'Managed Gondolin VM cannot start after memory finalization was poisoned.',\n\t\t\t\t\t{\n\t\t\t\t\t\tcause: finalizationPoison,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst incompleteMount = [...createdVfsMounts.finalizableMemoryMounts].find(\n\t\t\t\t([, mount]) => mount.state !== 'finalized',\n\t\t\t);\n\t\t\tif (incompleteMount !== undefined) {\n\t\t\t\tconst error = new Error(\n\t\t\t\t\t`Managed Gondolin VM memory mount '${incompleteMount[0]}' must be finalized before start.`,\n\t\t\t\t);\n\t\t\t\tpoisonFinalization(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tawait vmInstance.start();\n\t\t\tlifecycleState = 'started';\n\t\t},\n\t\tasync close(): Promise<void> {\n\t\t\tconst closeErrors: unknown[] = [];\n\t\t\ttry {\n\t\t\t\tawait vmInstance.close();\n\t\t\t} catch (error) {\n\t\t\t\tcloseErrors.push(error);\n\t\t\t}\n\t\t\tlifecycleState = 'closed';\n\t\t\tcreatedVfsMounts.finalizableMemoryMounts.clear();\n\t\t\ttry {\n\t\t\t\tclosePinnedRealFsRoots(pinnedRealFsRoots, dependencies);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof AggregateError) {\n\t\t\t\t\tcloseErrors.push(...error.errors);\n\t\t\t\t} else {\n\t\t\t\t\tcloseErrors.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (closeErrors.length === 1) {\n\t\t\t\tthrow closeErrors[0];\n\t\t\t}\n\t\t\tif (closeErrors.length > 1) {\n\t\t\t\tthrow new AggregateError(closeErrors, 'Managed Gondolin VM cleanup failed.');\n\t\t\t}\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport {\n\tcreateOwnedHostDirectoryController,\n\tassertPositiveHostProcessId,\n\tvalidateManagedVmFilteredWorkspacePolicy,\n\ttype ManagedVm,\n\ttype ManagedVmAccessHandle,\n\ttype ManagedVmCreateRequest,\n\ttype ManagedVmExecCommand,\n\ttype ManagedVmExecOptions,\n\ttype ManagedVmExecOutputChunk,\n\ttype ManagedVmExecProcess,\n\ttype ManagedVmExecResult,\n\ttype ManagedVmExecStreamMode,\n\ttype ManagedVmIngressOptions,\n\ttype ManagedVmIngressRoute,\n\ttype ManagedVmProvider,\n\ttype ManagedVmSshAccess,\n\ttype OwnedHostDirectory,\n\ttype OwnedHostDirectoryTransfer,\n} from '@agent-vm/managed-vm';\nimport { validateBuildConfig } from '@earendil-works/gondolin';\nimport { parse, printParseErrorCode, type ParseError } from 'jsonc-parser';\n\nimport { buildImage } from './build-pipeline.js';\nimport { createGondolinExactProcessTerminationCapability } from './exact-recorded-process-termination.js';\nimport {\n\tresolveGondolinMinimumZigVersion,\n\tresolveGondolinPackageSpec,\n} from './gondolin-package.js';\nimport {\n\tassertPinnedRealFsRoot,\n\tclosePinnedRealFsRoot,\n\tpinRealFsRoot,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\nimport {\n\tcreateGitReadOnlySshEgressOptions,\n\tcreateManagedVm as createNativeManagedVm,\n\ttype ManagedExecOptions as NativeManagedExecOptions,\n\ttype ManagedVm as NativeManagedVm,\n\ttype VfsMountSpec,\n} from './vm-adapter.js';\n\ntype OwnedDirectoryProvenance = WeakMap<OwnedHostDirectory, PinnedRealFsRoot>;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction formatUnknownValue(value: unknown): string {\n\treturn typeof value === 'string' ? value : JSON.stringify(value);\n}\n\nfunction assertCreateRequestSupported(request: ManagedVmCreateRequest): void {\n\tif (!['readonly', 'memory', 'cow'].includes(request.rootfsMode)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported managed VM rootfs mode: ${formatUnknownValue(request.rootfsMode)}`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(request.resources.cpuCount) || request.resources.cpuCount <= 0) {\n\t\tthrow new Error('Managed VM CPU count must be a positive safe integer.');\n\t}\n\tif (request.imageReference.length === 0 || request.resources.memory.length === 0) {\n\t\tthrow new Error('Managed VM image reference and memory must be non-empty.');\n\t}\n\tif (request.sshEgress !== undefined && request.sshEgress.kind !== 'git-read-only') {\n\t\tthrow new Error(\n\t\t\t`Unsupported managed VM SSH egress kind: ${formatUnknownValue(request.sshEgress.kind)}`,\n\t\t);\n\t}\n\tfor (const [guestPath, mount] of Object.entries(request.mounts)) {\n\t\tif (!guestPath.startsWith('/')) {\n\t\t\tthrow new Error(`Managed VM mount path must be absolute: ${guestPath}`);\n\t\t}\n\t\tif (\n\t\t\t![\n\t\t\t\t'host-directory',\n\t\t\t\t'finalizable-memory',\n\t\t\t\t'owned-host-directory',\n\t\t\t\t'owned-filtered-workspace',\n\t\t\t\t'memory',\n\t\t\t\t'shadow',\n\t\t\t].includes(mount.kind)\n\t\t) {\n\t\t\tthrow new Error(`Unsupported managed VM mount kind: ${formatUnknownValue(mount.kind)}`);\n\t\t}\n\t}\n\tconst mediatedSecretNames = new Set<string>();\n\tfor (const secret of request.mediatedSecrets) {\n\t\tif (mediatedSecretNames.has(secret.environmentVariable)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate managed VM mediated-secret environment variable: ${secret.environmentVariable}`,\n\t\t\t);\n\t\t}\n\t\tmediatedSecretNames.add(secret.environmentVariable);\n\t}\n\tconst tcpGuestHosts = new Set<string>();\n\tfor (const mapping of request.tcpHosts) {\n\t\tif (tcpGuestHosts.has(mapping.guestHost)) {\n\t\t\tthrow new Error(`Duplicate managed VM TCP guest host: ${mapping.guestHost}`);\n\t\t}\n\t\ttcpGuestHosts.add(mapping.guestHost);\n\t}\n}\n\ninterface TranslatedMounts {\n\treadonly mounts: Record<string, VfsMountSpec>;\n\treadonly transfers: readonly OwnedHostDirectoryTransfer[];\n}\n\nfunction closeOwnedDirectoryTransfers(\n\ttransfers: readonly OwnedHostDirectoryTransfer[],\n): readonly unknown[] {\n\tconst closeErrors: unknown[] = [];\n\tfor (const transfer of transfers) {\n\t\ttry {\n\t\t\ttransfer.close();\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t}\n\treturn closeErrors;\n}\n\nfunction isReadonlyStringArray(\n\tvalue: readonly string[] | Readonly<Record<string, string>>,\n): value is readonly string[] {\n\treturn Array.isArray(value);\n}\n\nfunction translateExecEnvironment(\n\tenvironment: readonly string[] | Readonly<Record<string, string>>,\n): string[] | Record<string, string> {\n\treturn isReadonlyStringArray(environment) ? [...environment] : { ...environment };\n}\n\nfunction translateExecStdin(\n\tstdin: string | Uint8Array | AsyncIterable<Uint8Array>,\n): string | Buffer | AsyncIterable<Buffer> {\n\tif (typeof stdin === 'string') {\n\t\treturn stdin;\n\t}\n\tif (stdin instanceof Uint8Array) {\n\t\treturn Buffer.from(stdin);\n\t}\n\treturn (async function* (): AsyncIterable<Buffer> {\n\t\tfor await (const chunk of stdin) {\n\t\t\tyield Buffer.from(chunk);\n\t\t}\n\t})();\n}\n\nconst MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES = 4 * 1024;\nconst MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES = 16 * 1024 * 1024;\n\nfunction translateExecStreamMode(mode: ManagedVmExecStreamMode): 'ignore' | 'pipe' {\n\tif (typeof mode !== 'object' || mode === null || !('kind' in mode)) {\n\t\tthrow new Error('Unsupported managed VM exec output mode.');\n\t}\n\tif (mode.kind === 'pipe') {\n\t\treturn 'pipe';\n\t}\n\tif (mode.kind === 'discard') {\n\t\treturn 'ignore';\n\t}\n\tthrow new Error('Unsupported managed VM exec output mode.');\n}\n\nfunction translateExecStreamingOptions(\n\toutput: NonNullable<ManagedVmExecOptions['output']>,\n): Pick<NativeManagedExecOptions, 'stderr' | 'stdout' | 'windowBytes'> {\n\tif (\n\t\t!Number.isInteger(output.windowBytes) ||\n\t\toutput.windowBytes < MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES ||\n\t\toutput.windowBytes > MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES\n\t) {\n\t\tthrow new Error(\n\t\t\t`Managed VM exec output window must be an integer between ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES)} and ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES)} bytes.`,\n\t\t);\n\t}\n\treturn {\n\t\tstderr: translateExecStreamMode(output.stderr),\n\t\tstdout: translateExecStreamMode(output.stdout),\n\t\twindowBytes: output.windowBytes,\n\t};\n}\n\nfunction translateExecOptions(options: ManagedVmExecOptions): NativeManagedExecOptions {\n\treturn {\n\t\t...(options.argv ? { argv: [...options.argv] } : {}),\n\t\t...(options.cwd ? { cwd: options.cwd } : {}),\n\t\t...(options.env ? { env: translateExecEnvironment(options.env) } : {}),\n\t\t...(options.output === undefined ? {} : translateExecStreamingOptions(options.output)),\n\t\t...(options.pty === undefined ? {} : { pty: options.pty }),\n\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t...(options.stdin === undefined ? {} : { stdin: translateExecStdin(options.stdin) }),\n\t};\n}\n\nfunction wrapExecProcess(nativeProcess: ReturnType<NativeManagedVm['exec']>): ManagedVmExecProcess {\n\tconst result: Promise<ManagedVmExecResult> = nativeProcess.result;\n\treturn Object.assign(result, {\n\t\t[Symbol.asyncIterator](): AsyncIterator<string> {\n\t\t\treturn nativeProcess[Symbol.asyncIterator]();\n\t\t},\n\t\tend(): void {\n\t\t\tnativeProcess.end();\n\t\t},\n\t\tlines(): AsyncIterable<string> {\n\t\t\treturn nativeProcess.lines();\n\t\t},\n\t\toutput(): AsyncIterable<ManagedVmExecOutputChunk> {\n\t\t\treturn nativeProcess.output();\n\t\t},\n\t\tresize(rows: number, columns: number): void {\n\t\t\tnativeProcess.resize(rows, columns);\n\t\t},\n\t\tresult,\n\t\twrite(data: string | Uint8Array): void {\n\t\t\tnativeProcess.write(typeof data === 'string' ? data : Buffer.from(data));\n\t\t},\n\t}) satisfies ManagedVmExecProcess;\n}\n\nasync function assertReadonlyInputSourcesStayWithinOwnedRoot(\n\tpinnedRoot: PinnedRealFsRoot,\n\tpolicy: ReturnType<typeof validateManagedVmFilteredWorkspacePolicy>,\n): Promise<void> {\n\tconst canonicalRootPrefix = pinnedRoot.realPath.endsWith(path.sep)\n\t\t? pinnedRoot.realPath\n\t\t: `${pinnedRoot.realPath}${path.sep}`;\n\tawait Promise.all(\n\t\tpolicy.readonlyInputs.map(async (readonlyInput) => {\n\t\t\tconst sourcePath = path.join(\n\t\t\t\tpinnedRoot.realPath,\n\t\t\t\t...readonlyInput.sourceRelativePath.split('/'),\n\t\t\t);\n\t\t\tconst canonicalSourcePath = await fs.realpath(sourcePath);\n\t\t\tif (\n\t\t\t\tcanonicalSourcePath !== pinnedRoot.realPath &&\n\t\t\t\t!canonicalSourcePath.startsWith(canonicalRootPrefix)\n\t\t\t) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Managed filtered workspace read-only source crosses the owned root boundary: ${readonlyInput.sourceRelativePath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}),\n\t);\n}\n\nasync function translateMounts(\n\tmounts: ManagedVmCreateRequest['mounts'],\n\townedDirectoryRoots: OwnedDirectoryProvenance,\n): Promise<TranslatedMounts> {\n\tconst translatedMounts: Record<string, VfsMountSpec> = {};\n\tconst transfers: OwnedHostDirectoryTransfer[] = [];\n\tconst sourceValidations: {\n\t\treadonly pinnedRoot: PinnedRealFsRoot;\n\t\treadonly policy: ReturnType<typeof validateManagedVmFilteredWorkspacePolicy>;\n\t}[] = [];\n\ttry {\n\t\tfor (const [guestPath, mount] of Object.entries(mounts)) {\n\t\t\tswitch (mount.kind) {\n\t\t\t\tcase 'finalizable-memory':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\taccess: mount.access,\n\t\t\t\t\t\tkind: 'finalizable-memory',\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'host-directory':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\thostPath: mount.hostPath,\n\t\t\t\t\t\tkind: mount.access === 'read-only' ? 'realfs-readonly' : 'realfs',\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'owned-host-directory': {\n\t\t\t\t\tconst pinnedRoot = ownedDirectoryRoots.get(mount.directory);\n\t\t\t\t\tif (!pinnedRoot) {\n\t\t\t\t\t\tthrow new Error('Owned host directory was not acquired by this Gondolin provider.');\n\t\t\t\t\t}\n\t\t\t\t\tassertPinnedRealFsRoot(pinnedRoot);\n\t\t\t\t\ttransfers.push(mount.directory.consume());\n\t\t\t\t\townedDirectoryRoots.delete(mount.directory);\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\tkind: mount.access === 'read-only' ? 'realfs-readonly' : 'realfs',\n\t\t\t\t\t\tpinnedHostRoot: pinnedRoot,\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase 'owned-filtered-workspace': {\n\t\t\t\t\tconst pinnedRoot = ownedDirectoryRoots.get(mount.directory);\n\t\t\t\t\tif (!pinnedRoot) {\n\t\t\t\t\t\tthrow new Error('Owned host directory was not acquired by this Gondolin provider.');\n\t\t\t\t\t}\n\t\t\t\t\tassertPinnedRealFsRoot(pinnedRoot);\n\t\t\t\t\ttransfers.push(mount.directory.consume());\n\t\t\t\t\townedDirectoryRoots.delete(mount.directory);\n\t\t\t\t\tconst policy = validateManagedVmFilteredWorkspacePolicy(mount.policy);\n\t\t\t\t\tsourceValidations.push({ pinnedRoot, policy });\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\tkind: 'filtered-workspace',\n\t\t\t\t\t\tpinnedHostRoot: pinnedRoot,\n\t\t\t\t\t\tpolicy,\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase 'memory':\n\t\t\t\t\ttranslatedMounts[guestPath] = { kind: 'memory' };\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'shadow':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\thostPath: mount.hostPath,\n\t\t\t\t\t\tkind: 'shadow',\n\t\t\t\t\t\tshadowConfig: {\n\t\t\t\t\t\t\tdeny: mount.deny,\n\t\t\t\t\t\t\ttmpfs: mount.temporaryFilesystems,\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tawait Promise.all(\n\t\t\tsourceValidations.map(({ pinnedRoot, policy }) =>\n\t\t\t\tassertReadonlyInputSourcesStayWithinOwnedRoot(pinnedRoot, policy),\n\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tconst closeErrors = closeOwnedDirectoryTransfers(transfers);\n\t\tif (closeErrors.length > 0) {\n\t\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError cause and errors both retain the primary translation failure.\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, ...closeErrors],\n\t\t\t\t'Managed VM mount translation and owned-directory cleanup both failed.',\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n\treturn { mounts: translatedMounts, transfers };\n}\n\nfunction wrapManagedVm(\n\tnativeVm: NativeManagedVm,\n\townedDirectoryTransfers: readonly OwnedHostDirectoryTransfer[],\n): ManagedVm {\n\ttype ManagedVmLifecycleState =\n\t\t| 'created'\n\t\t| 'starting'\n\t\t| 'started'\n\t\t| 'start-failed'\n\t\t| 'closing'\n\t\t| 'closed';\n\tlet closePromise: Promise<void> | undefined;\n\tlet hostProcessId: number | null = null;\n\tlet lifecycleState: ManagedVmLifecycleState = 'created';\n\tlet startPromise: Promise<void> | undefined;\n\tconst closeOnce = async (): Promise<void> => {\n\t\tif (startPromise) {\n\t\t\ttry {\n\t\t\t\tawait startPromise;\n\t\t\t} catch {\n\t\t\t\t// Mechanical close must continue after either start success or failure.\n\t\t\t}\n\t\t}\n\t\tconst closeErrors: unknown[] = [];\n\t\ttry {\n\t\t\tawait nativeVm.close();\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t\tcloseErrors.push(...closeOwnedDirectoryTransfers(ownedDirectoryTransfers));\n\t\ttry {\n\t\t\tif (closeErrors.length === 1) {\n\t\t\t\tthrow closeErrors[0];\n\t\t\t}\n\t\t\tif (closeErrors.length > 1) {\n\t\t\t\tthrow new AggregateError(closeErrors, 'Managed VM cleanup failed.');\n\t\t\t}\n\t\t} finally {\n\t\t\thostProcessId = null;\n\t\t\tlifecycleState = 'closed';\n\t\t}\n\t};\n\treturn {\n\t\tasync close(): Promise<void> {\n\t\t\tif (!closePromise) {\n\t\t\t\tlifecycleState = 'closing';\n\t\t\t\tclosePromise = closeOnce();\n\t\t\t}\n\t\t\tawait closePromise;\n\t\t},\n\t\tconfigureIngressRoutes(routes: readonly ManagedVmIngressRoute[]): void {\n\t\t\tnativeVm.setIngressRoutes(\n\t\t\t\troutes.map((route) => ({\n\t\t\t\t\tport: route.port,\n\t\t\t\t\tprefix: route.prefix,\n\t\t\t\t\tstripPrefix: route.stripPrefix,\n\t\t\t\t})),\n\t\t\t);\n\t\t},\n\t\tasync enableIngress(options?: ManagedVmIngressOptions): Promise<ManagedVmAccessHandle> {\n\t\t\treturn await nativeVm.enableIngress(options);\n\t\t},\n\t\tasync enableSsh(options): Promise<ManagedVmSshAccess> {\n\t\t\tconst access = await nativeVm.enableSsh(options);\n\t\t\tif (!access.command || !access.identityFile || !access.user) {\n\t\t\t\tawait access.close();\n\t\t\t\tthrow new Error('Gondolin SSH access omitted required neutral connection fields.');\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tclose: async (): Promise<void> => await access.close(),\n\t\t\t\tcommand: access.command,\n\t\t\t\thost: access.host,\n\t\t\t\tidentityFile: access.identityFile,\n\t\t\t\tport: access.port,\n\t\t\t\tserverHostKey: access.serverHostKey,\n\t\t\t\tuser: access.user,\n\t\t\t};\n\t\t},\n\t\tasync finalizeMemoryMount(request): Promise<void> {\n\t\t\tawait nativeVm.finalizeMemoryMount(request);\n\t\t},\n\t\texec(command: ManagedVmExecCommand, options?: ManagedVmExecOptions): ManagedVmExecProcess {\n\t\t\tconst normalizedCommand = typeof command === 'string' ? command : [...command];\n\t\t\tconst nativeProcess = nativeVm.exec(\n\t\t\t\tnormalizedCommand,\n\t\t\t\toptions ? translateExecOptions(options) : undefined,\n\t\t\t);\n\t\t\treturn wrapExecProcess(nativeProcess);\n\t\t},\n\t\tgetHostProcessId(): number | null {\n\t\t\tif (hostProcessId === null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst currentHostProcessId = nativeVm.getHostPid();\n\t\t\tif (currentHostProcessId === null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (currentHostProcessId !== hostProcessId) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Gondolin runner identity changed for managed VM '${nativeVm.id}': expected pid ${String(hostProcessId)}, observed ${String(currentHostProcessId)}.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn hostProcessId;\n\t\t},\n\t\tid: nativeVm.id,\n\t\tasync start(): Promise<void> {\n\t\t\tif (lifecycleState === 'closing' || lifecycleState === 'closed') {\n\t\t\t\tthrow new Error('Managed VM cannot start after close has been requested.');\n\t\t\t}\n\t\t\tif (lifecycleState === 'started') {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!startPromise) {\n\t\t\t\tlifecycleState = 'starting';\n\t\t\t\tstartPromise = (async (): Promise<void> => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait nativeVm.start();\n\t\t\t\t\t\tconst startedHostProcessId = assertPositiveHostProcessId(nativeVm.getHostPid());\n\t\t\t\t\t\tif (lifecycleState !== 'starting') {\n\t\t\t\t\t\t\tthrow new Error('Managed VM closed while startup was settling.');\n\t\t\t\t\t\t}\n\t\t\t\t\t\thostProcessId = startedHostProcessId;\n\t\t\t\t\t\tlifecycleState = 'started';\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (lifecycleState === 'starting') {\n\t\t\t\t\t\t\tlifecycleState = 'start-failed';\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t})();\n\t\t\t}\n\t\t\tawait startPromise;\n\t\t},\n\t};\n}\n\nfunction openOwnedHostDirectory(\n\thostPath: string,\n\townedDirectoryRoots: OwnedDirectoryProvenance,\n): OwnedHostDirectory {\n\tconst pinnedRoot = pinRealFsRoot(hostPath);\n\tconst directory = createOwnedHostDirectoryController({\n\t\tidentity: {\n\t\t\tcanonicalPath: pinnedRoot.realPath,\n\t\t\tdevice: pinnedRoot.device,\n\t\t\tinode: pinnedRoot.inode,\n\t\t},\n\t\tonClose: () => closePinnedRealFsRoot(pinnedRoot),\n\t\tonConsume: () => assertPinnedRealFsRoot(pinnedRoot),\n\t});\n\townedDirectoryRoots.set(directory, pinnedRoot);\n\treturn directory;\n}\n\nexport function createGondolinManagedVmProvider(): ManagedVmProvider {\n\tconst ownedDirectoryRoots: OwnedDirectoryProvenance = new WeakMap();\n\treturn {\n\t\tdiagnostics: {\n\t\t\tasync checkCompatibility() {\n\t\t\t\tconst diagnostics = [];\n\t\t\t\ttry {\n\t\t\t\t\tawait Promise.all([resolveGondolinPackageSpec(), resolveGondolinMinimumZigVersion()]);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tdiagnostics.push({\n\t\t\t\t\t\tcode: 'gondolin-toolchain-unavailable',\n\t\t\t\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t\t\t\t\tseverity: 'error' as const,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn diagnostics;\n\t\t\t},\n\t\t},\n\t\texactProcessTermination: createGondolinExactProcessTerminationCapability(),\n\t\tfactory: {\n\t\t\tasync createManagedVm(request: ManagedVmCreateRequest): Promise<ManagedVm> {\n\t\t\t\tassertCreateRequestSupported(request);\n\t\t\t\tconst secrets = Object.fromEntries(\n\t\t\t\t\trequest.mediatedSecrets.map((secret) => [\n\t\t\t\t\t\tsecret.environmentVariable,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secret.allowedHosts],\n\t\t\t\t\t\t\t...(secret.guestPlaceholder === undefined\n\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t: { placeholder: secret.guestPlaceholder }),\n\t\t\t\t\t\t\tvalue: secret.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t\tconst tcpHosts = Object.fromEntries(\n\t\t\t\t\trequest.tcpHosts.map((mapping) => [mapping.guestHost, mapping.target]),\n\t\t\t\t);\n\t\t\t\tconst translatedMounts = await translateMounts(request.mounts, ownedDirectoryRoots);\n\t\t\t\tlet nativeVm: NativeManagedVm;\n\t\t\t\ttry {\n\t\t\t\t\tnativeVm = await createNativeManagedVm({\n\t\t\t\t\t\tallowedHosts: [...request.allowedHosts],\n\t\t\t\t\t\tcpus: request.resources.cpuCount,\n\t\t\t\t\t\tenv: { ...request.environment },\n\t\t\t\t\t\timagePath: request.imageReference,\n\t\t\t\t\t\tmemory: request.resources.memory,\n\t\t\t\t\t\t...(request.mediation?.onRequest ? { onRequest: request.mediation.onRequest } : {}),\n\t\t\t\t\t\t...(request.mediation?.onResponse ? { onResponse: request.mediation.onResponse } : {}),\n\t\t\t\t\t\trootfsMode: request.rootfsMode,\n\t\t\t\t\t\t...(request.runtimeRootfsSize ? { runtimeRootfsSize: request.runtimeRootfsSize } : {}),\n\t\t\t\t\t\tsecrets,\n\t\t\t\t\t\tsessionLabel: request.sessionLabel,\n\t\t\t\t\t\t...(request.sshEgress\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tsshEgress: createGitReadOnlySshEgressOptions({\n\t\t\t\t\t\t\t\t\t\tallowedHosts: request.sshEgress.allowedHosts,\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.agentSocket\n\t\t\t\t\t\t\t\t\t\t\t? { agent: request.sshEgress.agentSocket }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.allowedRepositories\n\t\t\t\t\t\t\t\t\t\t\t? { allowedRepos: request.sshEgress.allowedRepositories }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.knownHostsFile\n\t\t\t\t\t\t\t\t\t\t\t? { knownHostsFile: request.sshEgress.knownHostsFile }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\ttcpHosts,\n\t\t\t\t\t\tvfsMounts: translatedMounts.mounts,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst closeErrors = closeOwnedDirectoryTransfers(translatedMounts.transfers);\n\t\t\t\t\tif (closeErrors.length > 0) {\n\t\t\t\t\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError cause and errors both retain the primary construction failure.\n\t\t\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t\t\t[error, ...closeErrors],\n\t\t\t\t\t\t\t'Managed VM construction and owned-directory cleanup both failed.',\n\t\t\t\t\t\t\t{ cause: error },\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\treturn wrapManagedVm(nativeVm, translatedMounts.transfers);\n\t\t\t},\n\t\t},\n\t\timages: {\n\t\t\tasync prepareImage(request) {\n\t\t\t\tconst parseErrors: ParseError[] = [];\n\t\t\t\tconst parsedRecipe: unknown = parse(\n\t\t\t\t\tawait fs.readFile(request.recipePath, 'utf8'),\n\t\t\t\t\tparseErrors,\n\t\t\t\t\t{ allowTrailingComma: true },\n\t\t\t\t);\n\t\t\t\tif (parseErrors.length > 0) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Invalid managed VM image recipe '${request.recipePath}': ${parseErrors\n\t\t\t\t\t\t\t.map((parseError) => printParseErrorCode(parseError.error))\n\t\t\t\t\t\t\t.join(', ')}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (!isRecord(parsedRecipe) || !validateBuildConfig(parsedRecipe)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed VM image recipe has an invalid build shape: ${request.recipePath}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst result = await buildImage({\n\t\t\t\t\tbuildConfig: parsedRecipe,\n\t\t\t\t\tcacheDir: request.cacheDirectory,\n\t\t\t\t\tconfigDir: path.dirname(request.recipePath),\n\t\t\t\t\t...(request.forceRebuild === undefined ? {} : { fullReset: request.forceRebuild }),\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\tbuilt: result.built,\n\t\t\t\t\tfingerprint: result.fingerprint,\n\t\t\t\t\timageReference: result.imagePath,\n\t\t\t\t};\n\t\t\t},\n\t\t},\n\t\townedDirectories: {\n\t\t\topenHostDirectory: (hostPath: string): OwnedHostDirectory =>\n\t\t\t\topenOwnedHostDirectory(hostPath, ownedDirectoryRoots),\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;AAKA,MAAa,+BAA+B;;;;;;;;;;;AA6C5C,MAAM,qCAAqC;AAC3C,MAAM,oCAAoC;AAC1C,MAAM,4BAA4B;AAClC,MAAM,wBAAwB;AAE9B,SAAS,qBACR,oBACS;CACT,QAAQ,oBAAR;EACC,KAAK,4BACJ,OAAO;EACR,KAAK,8BACJ,OAAO;;;AAIV,SAAS,qBACR,oBACS;CACT,OAAO,uBAAuB,+BAC3B,yBACA;;AAGJ,SAAgB,qCACf,YACS;CACT,MAAM,+BAA+B,qBAAqB,WAAW,mBAAmB;CACxF,MAAM,2BAA2B,GAAG,sBAAsB,GAAG,qBAAqB,WAAW,mBAAmB;CAChH,MAAM,8BAA8B;CACpC,MAAM,oCACL,WAAW,uBAAuB,6BAA6B,qBAAqB;CACrF,OAAO;yCACiC,mCAAmC;wCACpC,kCAAkC;WAC/D,sBAAsB;qBACZ,0BAA0B;4BACnB,sBAAsB;4BACtB,yBAAyB;;;;;;SAM5C,kCAAkC,wBAAwB,mCAAmC,wDAAwD,mCAAmC,gGAAgG,kCAAkC;OAC5T,sBAAsB;;;sCAGS,4BAA4B;;;SAGzD,kCAAkC,wBAAwB,mCAAmC,sDAAsD,mCAAmC,6CAA6C,6BAA6B;OAClQ,yBAAyB;;;AAIhC,SAAS,uBAAuB,UAAkB,WAAuC;CACxF,OAAO,KAAK,WAAW,SAAS,GAAG,WAAW,KAAK,QAAQ,aAAa,QAAQ,KAAK,EAAE,SAAS;;AAGjG,eAAe,4BACd,aACA,WAC8B;CAC9B,MAAM,0BAA0B,YAAY,MAAM;CAClD,IAAI,CAAC,yBACJ;CAGD,MAAM,0BAA0B,uBAAuB,yBAAyB,UAAU;CAC1F,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,yBAAyB,OAAO;UACjD,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;EACtE,MAAM,IAAI,MACT,8CAA8C,wBAAwB,KAAK,WAC3E,EAAE,OAAO,OAAO,CAChB;;;AAIH,SAAS,uBAAuB,yBAAqD;CACpF,OAAO,0BACJ,GAAG,6BAA6B,SAAS,CAAC,MAAM,4BAChD;;AAGJ,eAAsB,uBACrB,SACmC;CACnC,IAAI,QAAQ,uBAAuB,KAAA,KAAa,QAAQ,YAAY,MAAM,iBACzE,MAAM,IAAI,MACT,mFACA;CAEF,MAAM,0BAA0B,MAAM,4BACrC,QAAQ,aACR,QAAQ,UACR;CACD,MAAM,gCACL,QAAQ,uBAAuB,KAAA,IAC5B,KAAA,IACA,qCAAqC,QAAQ,mBAAmB;CACpE,MAAM,0BAA0B,uBAAuB,wBAAwB;CAE/E,OAAO;EACN,SACC,kCAAkC,KAAA,IAC/B,0BACA,GAAG,wBAAwB,SAAS,CAAC,MAAM;EAC/C,kBAAkB;GACjB,wBAAwB;GACxB,GAAI,4BAA4B,KAAA,IAC7B,EAAE,GACF,EAAE,2BAA2B,yBAAyB;GACzD,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;GACrD;EACD;;AAGF,eAAsB,6CACrB,SACuB;CACvB,MAAM,sBAAsB,KAAK,KAAK,QAAQ,WAAW,gCAAgC;CAEzF,MAAM,GAAG,UAAU,qBAAqB,QAAQ,wBAAwB;EACvE,UAAU;EACV,MAAM;EACN,CAAC;CAEF,OAAO;EACN,GAAG,QAAQ;EACX,MAAM;GACL,GAAG,QAAQ,YAAY;GACvB,iBAAiB;GACjB;EACD;;;;AC7HF,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;AAED,SAAS,wBAAwB,aAAmC;CACnE,IAAI,CAAC,oBAAoB,YAAY,EACpC,MAAM,IAAI,MAAM,sDAAsD;CAEvE,OAAO;;AAGR,SAAgB,kCAA6D;CAC5E,OAAO;EACN,MAAM,WAAW,SAAS,cAAc;GACvC,OAAO,MAAM,WACZ;IACC,GAAG;IACH,aAAa,wBAAwB,QAAQ,YAAY;IACzD,EACD,aACA;;EAEF,MAAM,mBAAmB,SAAS;GAKjC,QAAO,MAJc,iCAAiC;IACrD,GAAG;IACH,aAAa,wBAAwB,QAAQ,YAAY;IACzD,CAAC,EACY;;EAEf;;AAcF,MAAM,sCAAsB,IAAI,KAAwC;AACxE,MAAM,4BAA4B;AAElC,SAASA,WAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,gBAAgB,OAAwB;CAChD,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,IAAI,MAAM,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;CAGnE,IAAIA,WAAS,MAAM,EAIlB,OAAO,IAHe,OAAO,QAAQ,MAAM,CACzC,QAAQ,GAAG,gBAAgB,eAAe,KAAA,EAAU,CACpD,UAAU,CAAC,UAAU,CAAC,cAAc,QAAQ,cAAc,SAAS,CAC7C,CACtB,KAAK,CAAC,UAAU,gBAAgB,GAAG,KAAK,UAAU,SAAS,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC7F,KAAK,IAAI,CAAC;CAGb,OAAO,KAAK,UAAU,MAAM;;AAG7B,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,eAAe,WAAW,UAAoC;CAC7D,IAAI;EACH,MAAM,GAAG,OAAO,SAAS;EACzB,OAAO;UACC,OAAO;EACf,IAAI,CAAC,mBAAmB,MAAM,EAC7B,MAAM;EAEP,OAAO;;;AAIT,eAAsB,oBAAoB,qBAA+C;CACxF,KAAK,MAAM,YAAY,0BAEtB,IAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,SAAS,CAAC,EAC/D,OAAO;CAGT,OAAO;;AAGR,eAAe,kBAQb;CACD,MAAM,iBAAiB,MAAM,OAAO;CACpC,OAAO,OACN,aACA,iBACA,WACA,SACA,YAEA,MAAM,eAAe,YAAY,aAAa;EAC7C,WAAW;EACX,SAAS,WAAW;EACpB,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;EAClC,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;EAC9B,CAAwB;;AAG3B,SAAS,sBAAsB,QAAkD;CAChF,SACC,OACA,oBACA,aACa;EACb,MAAM,gBAAgB,OAAO,uBAAuB,aAAa,qBAAqB;EACtF,MAAM,QAAQ,OAAO,MAAM,MAAM;EACjC,iBAAiB;EACjB,OAAO;;;AAIT,eAAe,wBACd,QACA,IACmB;CACnB,IAAI,CAAC,QACJ,OAAO,MAAM,IAAI;CAGlB,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,aAAa,QAAQ,IAAI;CAC/B,MAAM,kBAAkB,sBAAsB,OAAO;CAErD,QAAQ,OAAO,QAAQ;CACvB,QAAQ,OAAO,QAAQ;CACvB,QAAQ,IAAI,KAAK;CAEjB,IAAI;EACH,OAAO,MAAM,IAAI;WACR;EACT,QAAQ,OAAO,QAAQ;EACvB,QAAQ,OAAO,QAAQ;EACvB,IAAI,eAAe,KAAA,GAClB,OAAO,QAAQ,IAAI;OAEnB,QAAQ,IAAI,KAAK;;;AAKpB,SAAgB,wBACf,aACA,kBAA0B,WAC1B,kBACS;CACT,MAAM,UACL,qBAAqB,KAAA,IAClB,GAAG,gBAAgB,YAAY,CAAC,GAAG,oBACnC,GAAG,gBAAgB,YAAY,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,iBAAiB;CAE3F,OAAO,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,eAAsB,iCAAiC,SASpD;CACF,MAAM,0BAA0B,MAAM,uBAAuB;EAC5D,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;EACrD,CAAC;CAQF,OAAO;EACN,aARmB,wBAAwB,QAAQ,aAAa,QAAQ,iBAAiB;GACzF,wBAAwB,wBAAwB;GAChD,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,wBAAwB,QAAQ,kBAAkB;GACvD,CAGW;EACX,wBAAwB,wBAAwB;EAChD;;AAGF,eAAsB,WACrB,SACA,eAA0C,EAAE,EAChB;CAC5B,MAAM,4BAA4B,MAAM,iCAAiC;EACxE,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,kBAAkB,QAAQ,kBAAkB;EACjD,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;EACrD,GAAI,aAAa,kBAAkB,EAAE,iBAAiB,aAAa,iBAAiB,GAAG,EAAE;EACzF,CAAC;CACF,MAAM,cAAc,0BAA0B;CAC9C,MAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,YAAY;CAC1D,MAAM,2BAA2B,YAAuC;EACvE,IAAI,QAAQ,WACX,MAAM,GAAG,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;EAGzD,IAAI,MAAM,oBAAoB,UAAU,EACvC,OAAO;GACN,OAAO;GACP;GACA;GACA;EAGF,MAAM,GAAG,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;EAC9C,MAAM,4BAA4B,aAAa,eAAgB,MAAM,iBAAiB;EACtF,MAAM,uBAAuB,MAAM,6CAA6C;GAC/E,aAAa,QAAQ;GACrB;GACA,wBAAwB,0BAA0B;GAClD,CAAC;EACF,MAAM,kBAAkB,KAAK,KAAK,WAAW,0BAA0B;EACvE,MAAM,GAAG,GAAG,iBAAiB;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;EAC9D,IAAI;GACH,MAAM,wBAAwB,QAAQ,QAAQ,YAAY;IACzD,MAAM,0BACL,sBACA,WACA,QAAQ,WACR,iBACA,QAAQ,WAAW,KAAA,EACnB;KACA;YACO;GACT,MAAM,GAAG,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;;EAG/D,IAAI,CAAE,MAAM,oBAAoB,UAAU,EACzC,MAAM,IAAI,MAAM,6CAA6C,UAAU,GAAG;EAG3E,OAAO;GACN,OAAO;GACP;GACA;GACA;;CAGF,IAAI,QAAQ,QACX,OAAO,MAAM,0BAA0B;CAGxC,MAAM,cAAc,KAAK,QAAQ,UAAU;CAC3C,MAAM,gBAAgB,oBAAoB,IAAI,YAAY;CAC1D,IAAI,eACH,OAAO,MAAM;CAEd,MAAM,eAAe,0BAA0B;CAC/C,oBAAoB,IAAI,aAAa,aAAa;CAClD,IAAI;EACH,OAAO,MAAM;WACJ;EACT,IAAI,oBAAoB,IAAI,YAAY,KAAK,cAC5C,oBAAoB,OAAO,YAAY;;;;;ACnV1C,MAAM,gBAAgB,UAAU,SAAS;AACzC,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;AACtC,MAAM,gCAAgC;AACtC,MAAM,4BAA4B;AAoBlC,SAAS,iBAAiB,OAAyB;CAClD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QAAQ,MAAM,OAAO,KAAA;;AAGtF,SAAS,uBAAuB,SAA0B;CACzD,OAAO,0BAA0B,KAAK,QAAQ;;AAG/C,SAAS,gCAAgC,SAG7B;CACX,MAAM,uBAAuB,kBAAkB,KAAK,QAAQ,eAAe;CAC3E,IAAI,yBAAyB,MAC5B,OAAO;CAER,MAAM,qBAAqB,QAAQ,gBAAgB,MAAM,UAAU,EAAE,CAAC;CACtE,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,WAAW,GACrE,OAAO;CAER,OACC,qBAAqB,OAAO,SAAS,mBAAmB,CAAC,MAAM,GAAG,8BAA8B;;AAIlG,SAAS,mCAAmC,SAGhC;CACX,MAAM,uBAAuB,oBAAoB,KAAK,QAAQ,eAAe;CAC7E,IAAI,yBAAyB,MAC5B,OAAO;CAER,MAAM,qBAAqB,QAAQ,gBAAgB,MAAM,UAAU,EAAE,CAAC;CACtE,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,WAAW,GACrE,OAAO;CAER,OACC,qBAAqB,OAAO,SAAS,mBAAmB,CAAC,MAAM,GAAG,0BAA0B;;AAI9F,SAAS,2BAA2B,oBAA2C;CAC9E,IAAI,aAAa;CACjB,IAAI,cAAc;CAClB,KAAK,IAAI,QAAQ,GAAG,QAAQ,mBAAmB,QAAQ,SAAS,GAAG;EAClE,MAAM,YAAY,mBAAmB;EACrC,MAAM,eAAe,cAAc,OAAO,cAAc;EACxD,IAAI,CAAC,gBAAgB,CAAC,aACrB,cAAc;OACR,IAAI,gBAAgB,aAAa;GACvC,cAAc;GACd,cAAc;GACd,IAAI,eAAe,GAClB,OAAO;;;CAIV,OAAO;;AAGR,SAAS,2BACR,eACA,oBAC8B;CAC9B,MAAM,qBAAqB,mBAAmB,MAAM;CACpD,MAAM,uBAAuB,mBAAmB,OAAO,SAAS;CAChE,IAAI,yBAAyB,IAC5B,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,iDACzE;CAEF,MAAM,eAAe,mBAAmB,MAAM,GAAG,qBAAqB,CAAC,MAAM;CAC7E,MAAM,6BAA6B,mBAAmB,MAAM,qBAAqB,CAAC,MAAM;CACxF,MAAM,kBAAkB,2BAA2B,2BAA2B;CAC9E,IAAI,oBAAoB,MACvB,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,iDACzE;CAEF,MAAM,uBAAuB,2BAA2B,MAAM,GAAG,gBAAgB,CAAC,MAAM;CACxF,MAAM,UAAU,2BAA2B,MAAM,gBAAgB,CAAC,MAAM;CACxE,IAAI,aAAa,WAAW,KAAK,qBAAqB,WAAW,KAAK,QAAQ,WAAW,GACxF,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,2DACzE;CAEF,OAAO;EAAE;EAAS;EAAsB;EAAc;;AAGvD,eAAe,gCACd,eAC8C;CAC9C,IAAI;EACH,MAAM,EAAE,WAAW,MAAM,cAAc,MAAM;GAC5C;GACA,OAAO,cAAc;GACrB;GACA;GACA;GACA;GACA;GACA;GACA,CAAC;EACF,IAAI,OAAO,MAAM,CAAC,WAAW,GAC5B,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,oCACzE;EAEF,OAAO,2BAA2B,eAAe,OAAO;UAChD,OAAO;EACf,IAAI,iBAAiB,MAAM,KAAK,GAC/B,OAAO;EAER,MAAM;;;AAIR,SAAS,sBAAsB,eAAuB,QAA8B;CACnF,QAAQ,KAAK,eAAe,OAAO;;AAGpC,eAAe,MAAM,SAAgC;CACpD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;;AAG7D,MAAM,sBAAsB;CAC3B,KAAK,KAAK;CACV,qBAAqB;CACrB,YAAY;CACZ;CACA;AAED,SAAS,yBAAyB,SAGzB;CACR,IAAI,QAAQ,aAAa,MAAM,CAAC,WAAW,GAC1C,MAAM,IAAI,MAAM,2EAA2E;CAE5F,IACC,CAAC,OAAO,cAAc,QAAQ,SAAS,cAAc,IACrD,QAAQ,SAAS,iBAAiB,GAElC,MAAM,IAAI,MAAM,0EAA0E;CAE3F,IACC,QAAQ,SAAS,KAAK,WAAW,KACjC,QAAQ,SAAS,qBAAqB,WAAW,KACjD,QAAQ,SAAS,QAAQ,WAAW,GAEpC,MAAM,IAAI,MAAM,4EAA4E;;AAI9F,eAAe,uBAAuB,SAME;CACvC,MAAM,kBAAkB,MAAM,QAAQ,aAAa,oBAClD,QAAQ,SAAS,cACjB;CACD,IAAI,oBAAoB,MACvB,OAAO;CAER,IAAI,gBAAgB,yBAAyB,QAAQ,SAAS,sBAC7D,OAAO;CAER,IAAI,gBAAgB,aAAa,WAAW,IAAI,EAC/C,OAAO;CAER,IAAI,QAAQ,SAAS,kBAAkB,gBAAgB,aAAa,SAAS,IAAI,EAChF,OAAO;CAER,IACC,QAAQ,SAAS,mBAChB,gBAAgB,aAAa,WAAW,IAAI,IAC5C,gBAAgB,aAAa,WAAW,IAAI,MAC5C,gCAAgC;EAChC,gBAAgB,gBAAgB;EAChC,iBAAiB,QAAQ,SAAS;EAClC,CAAC,IACD,mCAAmC;EAClC,gBAAgB,gBAAgB;EAChC,iBAAiB,QAAQ,SAAS;EAClC,CAAC,GAEH,OAAO;CAER,IAAI,gBAAgB,YAAY,QAAQ,SAAS,SAChD,MAAM,IAAI,MACT,GAAG,QAAQ,aAAa,YAAY,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,cAAc,CAAC,wDAAwD,KAAK,UAAU,gBAAgB,aAAa,CAAC,iCAAiC,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,YAAY,KAAK,UAAU,gBAAgB,QAAQ,CAAC,IACpU;CAEF,IAAI,CAAC,uBAAuB,gBAAgB,QAAQ,EACnD,MAAM,IAAI,MACT,GAAG,QAAQ,aAAa,YAAY,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,cAAc,CAAC,yDACjG;CAEF,OAAO;;AAGR,eAAe,8BAA8B,SAKxB;CACpB,MAAM,WAAW,QAAQ,aAAa,KAAK,GAAG;CAC9C,OAAO,QAAQ,aAAa,KAAK,GAAG,UAAU;EAS7C,IAAI,MAPsB,uBAAuB;GAChD,QAAQ,+BAA+B,QAAQ,YAAY;GAC3D,cAAc,QAAQ;GACtB,cAAc,QAAQ;GACtB,UAAU,QAAQ;GAClB,MAAM;GACN,CAAC,KACkB,UACnB,OAAO;EAGR,MAAM,QAAQ,aAAa,MAAM,8BAA8B;;CAEhE,OACE,MAAM,uBAAuB;EAC7B,QAAQ,+BAA+B,QAAQ,YAAY;EAC3D,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KAAM;;AAIV,SAAS,sBAAsB,SAItB;CACR,IAAI;EACH,QAAQ,aAAa,WAAW,QAAQ,eAAe,QAAQ,OAAO;UAC9D,OAAO;EACf,IAAI,iBAAiB,MAAM,KAAK,SAC/B,MAAM;;;AAKT,eAAsB,2CAA2C,SAIZ;CACpD,yBAAyB,QAAQ;CAQjC,IAAI,MAP6B,uBAAuB;EACvD,QAAQ;EACR,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KACyB,UAC1B,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAkB;CAGjF,sBAAsB;EACrB,cAAc,QAAQ;EACtB,eAAe,QAAQ,SAAS;EAChC,QAAQ;EACR,CAAC;CACF,IACC,MAAM,8BAA8B;EACnC,aAAa;EACb,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,CAAC,EAEF,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAU7E,IAAI,MAPgC,uBAAuB;EAC1D,QAAQ;EACR,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KAC4B,UAC7B,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAE7E,sBAAsB;EACrB,cAAc,QAAQ;EACtB,eAAe,QAAQ,SAAS;EAChC,QAAQ;EACR,CAAC;CACF,IACC,MAAM,8BAA8B;EACnC,aAAa;EACb,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,CAAC,EAEF,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAG7E,MAAM,IAAI,MACT,yDAAyD,OAAO,QAAQ,SAAS,cAAc,CAAC,IAAI,QAAQ,aAAa,IACzH;;AAGF,SAAgB,gDACf,eAAuD,qBACV;CAC7C,OAAO,EACN,MAAM,6BAA6B,SAA2D;EAC7F,OAAO,MAAM,2CAA2C;GACvD,cAAc,QAAQ;GACtB;GACA,UAAU,QAAQ;GAClB,CAAC;IAEH;;;;ACnWF,MAAM,kBAAkB,cAAc,OAAO,KAAK,IAAI;AAEtD,MAAM,4BAA4B,EAAE,OAAO,EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC;AAEF,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,SAAS,gBAAgB,OAAwB;CAChD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAgB,uBAAuB,aAA6B;CACnE,MAAM,QAAQ,YAAY,MAAM,yCAAyC;CACzE,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,uGACA;CAGF,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,gCAAgC;CAEjD,OAAO;;AAGR,SAAgB,iCAAyC;CACxD,OAAO,gBAAgB,QAAQ,wCAAwC;;AAGxE,eAAsB,6BAA8C;CACnE,MAAM,kBAAkB,gCAAgC;CACxD,MAAM,SAAkB,KAAK,MAAM,MAAM,GAAG,SAAS,iBAAiB,OAAO,CAAC;CAE9E,OAAO,4BADa,0BAA0B,MAAM,OACN,CAAC;;AAOhD,eAAe,gCAAiD;CAC/D,MAAM,kBAAkB,gCAAgC;CACxD,OAAO,KAAK,KAAK,KAAK,QAAQ,gBAAgB,EAAE,QAAQ,SAAS,gBAAgB;;AAGlF,eAAsB,iCACrB,UAAmD,EAAE,EACnC;CAClB,MAAM,UAAU,QAAQ,mBAAoB,MAAM,+BAA+B;CACjF,IAAI;CACJ,IAAI;EACH,cAAc,MAAM,GAAG,SAAS,SAAS,OAAO;UACxC,OAAO;EACf,IAAI,mBAAmB,MAAM,EAC5B,MAAM,IAAI,MAAM,sCAAsC,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC;EAErF,MAAM,IAAI,MACT,6CAA6C,QAAQ,KAAK,gBAAgB,MAAM,IAChF,EAAE,OAAO,OAAO,CAChB;;CAGF,IAAI;EACH,OAAO,uBAAuB,YAAY;UAClC,OAAO;EACf,MAAM,IAAI,MACT,8CAA8C,QAAQ,KAAK,gBAAgB,MAAM,IACjF,EAAE,OAAO,OAAO,CAChB;;;;;AC5DH,MAAM,8CAA8B,IAAI,SAA2B;AAEnE,SAAS,mBAAmB,MAAgC;CAC3D,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK;;AAG/B,SAAS,sBAAsB,eAA+B;CAC7D,OAAOC,KAAG,SACT,eACAA,KAAG,UAAU,WAAWA,KAAG,UAAU,cAAcA,KAAG,UAAU,WAChE;;AAGF,SAAgB,cAAc,UAAoC;CACjE,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,SAAS,EAC1C,MAAM,IAAI,MAAM,yDAAyD,WAAW;CAGrF,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAC/C,MAAM,KAAK,sBAAsB,iBAAiB;CAClD,IAAI;EACH,MAAM,QAAQA,KAAG,UAAU,GAAG;EAC9B,IAAI,CAAC,MAAM,aAAa,EACvB,MAAM,IAAI,MAAM,0CAA0C,mBAAmB;EAE9E,MAAM,WAAWA,KAAG,aAAa,iBAAiB;EAClD,MAAM,gBAAgBA,KAAG,SAAS,SAAS;EAC3C,IAAI,cAAc,QAAQ,MAAM,OAAO,cAAc,QAAQ,MAAM,KAClE,MAAM,IAAI,MACT,6CAA6C,iBAAiB,UAAU,MAAM,IAAI,GAAG,MAAM,IAAI,mBAAmB,cAAc,IAAI,GAAG,cAAc,MACrJ;EAEF,OAAO;GACN,QAAQ,MAAM;GACd;GACA,UAAU;GACV,OAAO,MAAM;GACb;GACA;UACO,OAAO;EACf,KAAG,UAAU,GAAG;EAChB,MAAM;;;AAIR,SAAgB,sBAAsB,MAA8B;CACnE,IAAI,4BAA4B,IAAI,KAAK,EACxC;CAED,KAAG,UAAU,KAAK,GAAG;CACrB,4BAA4B,IAAI,KAAK;;AAGtC,SAAgB,uBAAuB,MAA8B;CACpE,MAAM,cAAcA,KAAG,UAAU,KAAK,GAAG;CACzC,MAAM,eAAeA,KAAG,SAAS,KAAK,SAAS;CAC/C,IACC,YAAY,QAAQ,KAAK,UACzB,YAAY,QAAQ,KAAK,SACzB,aAAa,QAAQ,KAAK,UAC1B,aAAa,QAAQ,KAAK,OAE1B,MAAM,IAAI,MACT,mDAAmD,KAAK,SAAS,YAAY,mBAAmB,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,aAAa,MAC9I;;AAUH,SAAgB,2BACf,SACkB;CAClB,uBAAuB,QAAQ,KAAK;CACpC,MAAM,WAAW,QAAQ,qBAAqB,QAAQ,KAAK,SAAS;CAEpE,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,OAAO,UAAU,YACpB,OAAO;EAGR,QAAQ,GAAG,oBAAiD;GAC3D,uBAAuB,QAAQ,KAAK;GACpC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;IAGxE,CAAC;;;;ACnFH,SAAS,uBAAuB,cAA8B;CAC7D,OAAO,IAAI;;AAGZ,SAAS,sBAAsB,cAA8B;CAC5D,MAAM,eAAe,aAAa,WAAW,IAAI,GAAG,eAAe,IAAI;CACvE,OAAO,KAAK,MAAM,UAAU,aAAa;;AAG1C,SAAS,uBAAuB,cAA8B;CAC7D,MAAM,iBAAiB,sBAAsB,aAAa;CAC1D,OAAO,mBAAmB,MAAM,KAAK,eAAe,MAAM,EAAE;;AAG7D,SAAS,oBAAoB,eAAuB,cAA+B;CAClF,OAAO,kBAAkB,gBAAgB,cAAc,WAAW,GAAG,aAAa,GAAG;;AAGtF,SAAS,aAAa,WAAmB,YAA6B;CACrE,OAAO,oBAAoB,WAAW,WAAW,IAAI,oBAAoB,YAAY,UAAU;;AAGhG,SAAS,4BACR,MACA,SACA,cACmF;CACnF,OAAO,OAAO,uBAAO,IAAI,MAAM,GAAG,KAAK,IAAI,QAAQ,IAAI,aAAa,GAAG,EAAE;EACxE;EACA,OAAO,MAAM;EACb,MAAM;EACN;EACA,CAAC;;AAGH,SAAS,qBACR,UACA,UACA,iBACU;CACV,MAAM,SAAS,QAAQ,IAAI,UAAU,UAAU,SAAS;CACxD,IAAI,OAAO,WAAW,YACrB,OAAO;CAER,OAAO,QAAQ,MAAM,QAA0B,UAAU,gBAAgB;;AAG1E,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,0BAA0B,UAA0B;CAC5D,OAAO,aAAa,aAAa,aAAa,gBAAgB,IAAI;;AAGnE,SAAS,qBAAqB,UAAkB,cAA+B;CAC9E,OAAO,sBAAsB,UAAU,cAAc,QAAQ;;AAG9D,SAAS,sBACR,UACA,cACA,MACU;CACV,MAAM,iBAAiB,4BAA4B,MAAM,UAAU,aAAa;CAChF,IAAI,SAAS,SAAS,OAAO,EAC5B,MAAM;CAEP,OAAO,QAAQ,OAAO,eAAe;;AAGtC,SAAS,2BACR,UACA,oBACkB;CAClB,MAAM,qBAAqB,uBAAuB,mBAAmB;CACrE,MAAM,iBAAiB,iBAAiC;EACvD,MAAM,SAAS,uBAAuB,aAAa;EACnD,OAAO,uBACN,OAAO,WAAW,IAAI,qBAAqB,GAAG,mBAAmB,GAAG,SACpE;;CAEF,MAAM,sBACL,UACA,oBACwB;EACxB,MAAM,sBAAsB,CAAC,GAAG,gBAAgB;EAChD,IACC,aAAa,YACb,aAAa,gBACb,aAAa,UACb,aAAa,cACb,aAAa,cACb,aAAa,gBACZ;GACD,oBAAoB,KAAK,cAAc,OAAO,gBAAgB,GAAG,CAAC;GAClE,oBAAoB,KAAK,cAAc,OAAO,gBAAgB,GAAG,CAAC;GAClE,OAAO;;EAER,oBAAoB,0BAA0B,SAAS,IAAI,cAC1D,OAAO,gBAAgB,0BAA0B,SAAS,EAAE,CAC5D;EACD,OAAO;;CAER,MAAM,kCACL,cACA,qBACA,UACA,iBACU;EAGV,IAAI,CAAC,oBAFwB,uBAAuB,aAEP,EADT,uBAAuB,oBACe,CAAC,EAC1E,MAAM,4BAA4B,UAAU,UAAU,aAAa;;CAGrE,MAAM,sBAAsB,OAC3B,UACA,cACA,mBACsF;EACtF,IAAI,CAAC,SAAS,UACb,MAAM,4BAA4B,UAAU,UAAU,aAAa;EAEpE,MAAM,CAAC,qBAAqB,gBAAgB,MAAM,QAAQ,IAAI,CAC7D,SAAS,SAAS,mBAAmB,EACrC,SAAS,SAAS,eAAe,CACjC,CAAC;EACF,+BAA+B,cAAc,qBAAqB,UAAU,aAAa;EACzF,OAAO;GAAE;GAAqB;GAAc;;CAE7C,MAAM,2BACL,UACA,cACA,mBAC6E;EAC7E,IAAI,CAAC,SAAS,cACb,MAAM,4BAA4B,UAAU,UAAU,aAAa;EAEpE,MAAM,sBAAsB,SAAS,aAAa,mBAAmB;EACrE,MAAM,eAAe,SAAS,aAAa,eAAe;EAC1D,+BAA+B,cAAc,qBAAqB,UAAU,aAAa;EACzF,OAAO;GAAE;GAAqB;GAAc;;CAE7C,MAAM,sBAAsB,iBAAiC;EAC5D,MAAM,iBAAiB,sBAAsB,aAAa;EAC1D,OAAO,mBAAmB,MAAM,MAAM,KAAK,MAAM,QAAQ,eAAe;;CAEzE,MAAM,qBAAqB,cAAsB,wBAAwC;EACxF,MAAM,uBAAuB,uBAAuB,aAAa;EACjE,MAAM,8BAA8B,uBAAuB,oBAAoB;EAC/E,IAAI,yBAAyB,6BAC5B,OAAO;EAER,OAAO,uBACN,4BAA4B,WAAW,IACpC,uBACA,qBAAqB,MAAM,GAAG,4BAA4B,GAAG,OAAO,CACvE;;CAEF,MAAM,qBAAqB,IAAI,IAAI;EAAC;EAAU;EAAQ;EAAW;EAAY;EAAQ;EAAS,CAAC;CAC/F,MAAM,oBAAoB,IAAI,IAAI;EACjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CAEF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,sBAAsB,mBAAmB,UAAU,gBAAgB;GACzE,IAAI,aAAa,YAEhB,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAAC,MACjF,EAAE,qBAAqB,mBACvB,kBAAkB,cAAc,oBAAoB,CACrD;GAEF,IAAI,aAAa,gBAAgB;IAEhC,MAAM,EAAE,qBAAqB,iBAAiB,wBAC7C,UAFoB,OAAO,gBAAgB,GAG/B,EACZ,OAAO,oBAAoB,GAAG,CAC9B;IACD,OAAO,kBAAkB,cAAc,oBAAoB;;GAE5D,IAAI,aAAa,WAAW,aAAa,YAAY;IACpD,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,OAAO,oBACN,UACA,cACA,cAAc,mBAAmB,aAAa,CAAC,CAC/C,CAAC,WAAW,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CAAC;;GAElF,IAAI,aAAa,eAAe,aAAa,gBAAgB;IAC5D,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,wBACC,UACA,cACA,cAAc,mBAAmB,aAAa,CAAC,CAC/C;IACD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;;GAE3E,IAAI,aAAa,UAEhB,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAChF,WAAW,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CAAC,CAC/E,YAAY,MAAM;GAErB,IAAI,aAAa,gBAAgB,aAAa,sBAAsB;IACnE,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,IAAI;KACH,wBAAwB,UAAU,cAAc,OAAO,oBAAoB,GAAG,CAAC;KAC/E,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;YACnE;KACP,OAAO,aAAa,eAAe,QAAQ;;;GAG7C,IAAI,mBAAmB,IAAI,SAAS,EAEnC,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAAC,WAC5E,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CACzE;GAEF,IAAI,kBAAkB,IAAI,SAAS,EAElC,wBAAwB,UADH,OAAO,gBAAgB,GACE,EAAE,OAAO,oBAAoB,GAAG,CAAC;GAEhF,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;;IAG5E,CAAC;;AAGH,SAAS,0CACR,UACA,QAIA,cACkB;CAClB,MAAM,aAAa,iBAAkC;EACpD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OACC,aAAa,WAAW,KACxB,OAAO,aAAa,MAAM,gBAAgB,aAAa,cAAc,YAAY,CAAC;;CAGpF,MAAM,cAAc,iBAAkC;EACrD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,cAAc,MAAM,iBACjC,oBAAoB,cAAc,aAAa,CAC/C;;CAEF,MAAM,oBAAoB,aAAa,qBAAqB,UAAU;EACrE,eAAe,EAAE,MAAM,mBAAmB,CAAC,UAAU,aAAa;EAClE,WAAW;EACX,CAAC;CACF,MAAM,mBAAmB,aAAa,uBAAuB,kBAAkB;CAE/E,OAAO,IAAI,MAAM,mBAAmB,EACnC,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,IAAI,aAAa,UAAU,aAAa,YACvC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAG/C,OAAO,qBADN,UAAU,aAAa,IAAI,CAAC,WAAW,aAAa,GAAG,mBAAmB,QAC7B,UAAU,gBAAgB;;EAG1E,IAAI,0BAA0B,IAAI,SAAS,EAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,YAAY,0BAA0B,SAAS;GACrD,MAAM,eAAe,OAAO,gBAAgB,WAAW;GAGvD,OAAO,qBADN,UAAU,aAAa,IAAI,CAAC,WAAW,aAAa,GAAG,mBAAmB,QAC7B,UAAU,gBAAgB;;EAG1E,IAAI,aAAa,YAAY,aAAa,cACzC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,gBAAgB,CAAC,OAAO,gBAAgB,GAAG,EAAE,OAAO,gBAAgB,GAAG,CAAC;GAM9E,OAAO,qBAJN,cAAc,MAAM,UAAU,IAC9B,cAAc,MAAM,iBAAiB,CAAC,WAAW,aAAa,CAAC,GAC5D,mBACA,QAC0C,UAAU,gBAAgB;;EAG1E,IAAI,aAAa,cAAc,aAAa,gBAC3C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAKlD,OAAO,qBAHN,UAAU,WAAW,IAAI,UAAU,gBAAgB,IAAI,CAAC,WAAW,gBAAgB,GAChF,mBACA,QAC0C,UAAU,gBAAgB;;EAG1E,QAAQ,GAAG,oBACV,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;IAEjE,CAAC;;AAGH,SAAS,gCACR,UACA,cACA,QACkB;CAClB,MAAM,UAAU,iBAAkC;EACjD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,YAAY,MAAM,eAAe,oBAAoB,cAAc,WAAW,CAAC;;CAE9F,MAAM,aAAa,iBAAkC;EACpD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,eAAe,MAAM,kBAClC,oBAAoB,cAAc,cAAc,CAChD;;CAEF,MAAM,WAAW,iBAAkC;EAClD,IAAI,OAAO,WAAW,SAAS,uBAC9B,OAAO;EAER,MAAM,eAAe,uBAAuB,aAAa;EACzD,OACC,aAAa,WAAW,KACxB,OAAO,WAAW,aAAa,MAAM,gBAAgB,aAAa,cAAc,YAAY,CAAC;;CAG/F,MAAM,YAAY,iBAAkC;EACnD,IAAI,UAAU,aAAa,EAC1B,OAAO;EAER,IAAI,OAAO,WAAW,SAAS,uBAC9B,OAAO;EAER,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,WAAW,cAAc,MAAM,iBAC5C,oBAAoB,cAAc,aAAa,CAC/C;;CAGF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,aAAa,UAAU,aAAa,YACvC,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,GAC/D;EAEJ,MAAM,uBAAuB,QAAQ,IAAI,cAAc,UAAU,aAAa;EAC9E,IAAI,OAAO,yBAAyB,YACnC;EAED,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAClD,IAAI,OAAO,WAAW,IAAI,CAAC,QAAQ,WAAW,EAC7C,OAAO,sBAAsB,UAAU,YAAY,SAAS;GAE7D,IAAI,OAAO,gBAAgB,IAAI,CAAC,QAAQ,gBAAgB,EACvD,OAAO,sBAAsB,UAAU,iBAAiB,SAAS;GAElE,IAAI,CAAC,SAAS,WAAW,EACxB,OAAO,sBAAsB,UAAU,YAAY,QAAQ;GAE5D,IAAI,CAAC,SAAS,gBAAgB,EAC7B,OAAO,sBAAsB,UAAU,iBAAiB,QAAQ;GAEjE,IAAI,aAAa,QAAQ;IACxB,IAAI,CAAC,SAAS,UACb,OAAO,sBAAsB,UAAU,YAAY,SAAS;IAE7D,OAAO,SACL,SAAS,WAAW,CACpB,WACA,QAAQ,MAAM,sBAAwC,cAAc,gBAAgB,CACpF;;GAEH,IAAI,CAAC,SAAS,cACb,OAAO,sBAAsB,UAAU,YAAY,SAAS;GAE7D,SAAS,aAAa,WAAW;GACjC,OAAO,QAAQ,MAAM,sBAAwC,cAAc,gBAAgB;;IAG7F,CAAC;;AAQH,SAAS,kCACR,cACA,gBACoB;CACpB,MAAM,eAAe,uBAAuB,aAAa;CACzD,MAAM,SAAS,aAAa,WAAW,IAAI,KAAK,GAAG,aAAa;CAChE,MAAM,2BAAW,IAAI,KAAa;CAClC,KAAK,MAAM,iBAAiB,gBAAgB;EAC3C,IAAI,CAAC,cAAc,wBAAwB,WAAW,OAAO,EAC5D;EAGD,MAAM,YADgB,cAAc,wBAAwB,MAAM,OAAO,OAC1C,CAAC,MAAM,IAAI,CAAC;EAC3C,IAAI,WACH,SAAS,IAAI,UAAU;;CAGzB,OAAO,CAAC,GAAG,SAAS,CAAC,UAAU;;AAGhC,SAAS,UAAU,OAAmD;CACrE,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;;AAGlD,SAAS,sBACR,SACA,iBACA,eACkD;CAClD,MAAM,eAAe,IAAI,IAAI,QAAQ,IAAI,UAAU,CAAC;CACpD,MAAM,kBAAkB,gBAAgB,QAAQ,cAAc,CAAC,aAAa,IAAI,UAAU,CAAC;CAC3F,OAAO,CACN,GAAG,SACH,GAAG,gBAAgB,KAAK,cACvB,gBAAgB,IAAI,cAAc,UAAU,GAAG,UAC/C,CACD;;AAGF,SAAS,eAAe,OAAyB;CAChD,OACC,OAAO,UAAU,YACjB,UAAU,SACR,UAAU,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,cAC9D,WAAW,UAAU,MAAM,UAAU,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM;;AAIhF,SAAS,sCACR,UACA,gBACA,QACA,cACkB;CAClB,MAAM,iBAA0C,EAAE;CAClD,KAAK,MAAM,iBAAiB,OAAO,gBAAgB;EAClD,IACC,OAAO,YAAY,MAAM,eACxB,oBAAoB,cAAc,yBAAyB,WAAW,CACtE,EAED;EAED,IAAI,gBAAgB,2BACnB,gBACA,cAAc,mBACd;EACD,MAAM,oBAAoB,OAAO,YAAY,SAAS,eAAe;GACpE,MAAM,oBAAoB,GAAG,cAAc,wBAAwB;GACnE,OAAO,WAAW,WAAW,kBAAkB,GAC5C,CAAC,uBAAuB,WAAW,MAAM,kBAAkB,OAAO,CAAC,CAAC,GACpE,EAAE;IACJ;EACF,IAAI,kBAAkB,SAAS,GAC9B,gBAAgB,aAAa,qBAAqB,eAAe;GAChE,cAAc,aAAa,0BAA0B,kBAAkB;GACvE,WAAW;GACX,CAAC;EAEH,eAAe,KAAK;GACnB,yBAAyB,cAAc;GACvC,UAAU,aAAa,uBAAuB,cAAc;GAC5D,CAAC;;CAGH,IAAI,eAAe,WAAW,GAC7B,OAAO;CAGR,MAAM,aAAa,iBAA4D;EAC9E,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,eAAe,MAAM,kBAC3B,oBAAoB,cAAc,cAAc,wBAAwB,CACxE;;CAEF,MAAM,gBAAgB,cAAsB,kBAAiD;EAE5F,MAAM,SADe,uBAAuB,aACjB,CAAC,MAAM,cAAc,wBAAwB,OAAO;EAC/E,OAAO,OAAO,WAAW,IAAI,MAAM;;CAEpC,MAAM,8BAA8B,iBAAkC;EACrE,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,eAAe,MAAM,kBAC3B,aAAa,cAAc,cAAc,wBAAwB,CACjE;;CAEF,MAAM,YAAY,iBAAkC;EACnD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,YAAY,MAAM,eAAe,oBAAoB,cAAc,WAAW,CAAC;;CAG9F,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,IAAI,aAAa,aAAa,aAAa,eAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,iBAAiB,gBAAgB;GACvC,MAAM,gBACL,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,mBAAmB,kBACnB,eAAe,kBAAkB;GAClC,MAAM,gBAAgB,UAAU,aAAa;GAC7C,IAAI,iBAAiB,CAAC,SAAS,aAAa,EAC3C,OAAO,qBAAqB,cAAc,UAAU,UAAU,CAC7D,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC;GAEH,MAAM,kBAAkB,kCAAkC,cAAc,eAAe;GACvF,IAAI,gBAAgB,WAAW,GAC9B,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,IAAI,aAAa,WAChB,OAAO,QAAQ,QAAQ,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,CAAC,CACrF,OAAO,UAAmB;IAC1B,IAAI,eAAe,MAAM,EACxB,OAAO,EAAE;IAEV,MAAM;KACL,CACD,MAAM,YACN,sBACC,SACA,iBACA,cACA,CACD;GAEH,IAAI;IACH,OAAO,sBACN,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,EAI/D,iBACA,cACA;YACO,OAAO;IACf,IAAI,eAAe,MAAM,EACxB,OAAO;IAER,MAAM;;;EAIT,IACC,aAAa,UACb,aAAa,cACb,aAAa,WACb,aAAa,aAEb,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,IAAI,iBAAiB,CAAC,SAAS,aAAa,EAC3C,OAAO,qBAAqB,cAAc,UAAU,UAAU,CAC7D,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC;GAGH,IADwB,kCAAkC,cAAc,eACrD,CAAC,WAAW,GAC9B,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,IAAI,aAAa,UAAU,aAAa,SACvC,OAAO,QAAQ,QACd,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,CAC/D,CAAC,OAAO,UAAmB;IAC3B,IAAI,eAAe,MAAM,EACxB,OAAO,uBAAuB;IAE/B,MAAM;KACL;GAEH,IAAI;IACH,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;YAC9D,OAAO;IACf,IAAI,eAAe,MAAM,EACxB,OAAO,uBAAuB;IAE/B,MAAM;;;EAIT,IAAI,aAAa,UAAU,aAAa,YACvC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,OAAO,iBAAiB,CAAC,SAAS,aAAa,GAC5C,qBAAqB,cAAc,UAAU,UAAU,CACvD,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC,GACD,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGpE,IAAI,0BAA0B,IAAI,SAAS,EAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,0BAA0B,SAAS,EAAE;GACjF,IAAI,CAAC,SAAS,aAAa,IAAI,2BAA2B,aAAa,EACtE,OAAO,qBAAqB,UAAU,aAAa;GAEpD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGxE,IACC,aAAa,YACb,aAAa,gBACb,aAAa,UACb,aAAa,YAEb,QAAQ,GAAG,oBAAiD;GAE3D,MAAM,kBAAkB,CADD,OAAO,gBAAgB,GAAG,EAAE,OAAO,gBAAgB,GAAG,CACxC,CAAC,MACpC,iBAAiB,CAAC,SAAS,aAAa,IAAI,2BAA2B,aAAa,CACrF;GACD,IAAI,iBACH,OAAO,qBAAqB,UAAU,gBAAgB;GAEvD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGxE,IAAI,aAAa,cAAc,aAAa,gBAC3C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAClD,IAAI,CAAC,SAAS,gBAAgB,IAAI,2BAA2B,gBAAgB,EAC5E,OAAO,qBAAqB,UAAU,gBAAgB;GAEvD,MAAM,cAAc,UAAU,WAAW;GACzC,IAAI,CAAC,eAAe,SAAS,WAAW,EACvC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,MAAM,mBAAmB,aAAa,YAAY,YAAY;GAC9D,IAAI,aAAa,YAChB,OAAO,QAAQ,QACd,qBAAqB,YAAY,UAAU,YAAY,CAAC,iBAAiB,CAAC,CAC1E,CAAC,MAAM,aACP,qBAAqB,QAAQ,aAAa,CAAC,iBAAiB,SAAS,CAAC,CACtE;GAKF,OAAO,qBAAqB,QAAQ,iBAAiB,CAAC,iBAHrC,qBAAqB,YAAY,UAAU,gBAAgB,CAC3E,iBACA,CAC8E,CAAC,CAAC;;EAGnF,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,MAAM,SACL,iBAAiB,CAAC,SAAS,aAAa,GACrC,qBAAqB,cAAc,UAAU,UAAU,CACvD,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC,GACD,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GACnE,IAAI,CAAC,iBAAiB,SAAS,aAAa,EAC3C,OAAO;GAER,IAAI,aAAa,YAChB,OAAO,QAAQ,QAAQ,OAAO,CAAC,MAAM,iBAAiB;IACrD,MAAM,uBAAuB,uBAAuB,OAAO,aAAa,CAAC;IACzE,OAAO,uBACN,qBAAqB,WAAW,IAC7B,cAAc,0BACd,GAAG,cAAc,wBAAwB,GAAG,uBAC/C;KACA;GAEH,IAAI,aAAa,gBAAgB;IAChC,MAAM,uBAAuB,uBAAuB,OAAO,OAAO,CAAC;IACnE,OAAO,uBACN,qBAAqB,WAAW,IAC7B,cAAc,0BACd,GAAG,cAAc,wBAAwB,GAAG,uBAC/C;;GAEF,OAAO;;IAGT,CAAC;;AAGH,SAAgB,gCACf,SACkB;CAClB,IAAI,oBAAoB,QAAQ;CAChC,IAAI,QAAQ,OAAO,WAAW,SAAS,kBACtC,oBAAoB,0CACnB,mBACA,QAAQ,OAAO,YACf,QAAQ,aACR;CAGF,IAAI,QAAQ,OAAO,YAAY,SAAS,GACvC,oBAAoB,QAAQ,aAAa,qBAAqB,mBAAmB;EAChF,cAAc,QAAQ,aAAa,0BAClC,QAAQ,OAAO,YAAY,IAAI,uBAAuB,CACtD;EACD,WAAW;EACX,CAAC;CAGH,IAAI,QAAQ,OAAO,eAAe,SAAS,GAAG;EAC7C,MAAM,kBAAkB,QAAQ,aAAa,0BAC5C,QAAQ,OAAO,YAAY,IAAI,uBAAuB,CACtD;EACD,MAAM,qBAAqB,QAAQ,aAAa,0BAC/C,QAAQ,OAAO,eAAe,IAAI,uBAAuB,CACzD;EACD,oBAAoB,QAAQ,aAAa,qBAAqB,mBAAmB;GAChF,eAAe,YAAY,CAAC,gBAAgB,QAAQ,IAAI,mBAAmB,QAAQ;GACnF,OAAO,QAAQ,aAAa,sBAAsB;GAClD,WAAW;GACX,CAAC;;CAEH,oBAAoB,gCACnB,mBACA,QAAQ,cACR,QAAQ,OACR;CAED,OAAO,sCACN,mBACA,QAAQ,cACR,QAAQ,QACR,QAAQ,aACR;;;;;;;;;;ACrxBF,SAAgB,6BACf,eAAgD,EAAE,EACtB;CAC5B,MAAM,wBACL,2BAA2B,eACxB,aAAa,wBACb,IAAI;CACR,MAAM,6BACL,gCAAgC,eAC7B,aAAa,6BACbC,MAAI;CAER,IAAI,iBAA8D;CAClE,IAAI,OAAO,0BAA0B,YAAY;EAChD,sBAAsB,YAAY;EAClC,iBAAiB;;CAGlB,IAAI,mBAAkE;CACtE,IAAI,OAAO,+BAA+B,YAAY;EACrD,2BAA2B,MAAM;EACjC,mBAAmB;;CAGpB,OAAO;EACN;EACA;EACA;;;;ACCF,MAAa,+BAA+B;AAC5C,MAAa,2CAA2C;AAKxD,MAAa,qCAAqC;CACjD,iBAAiB;CACjB,oBAAoB;CACpB,8BAP0E,MAAM,OAAO;CAQvF,yBAAyB;CACzB,2BAA2B;CAC3B;AAaD,SAAS,0BAA0B,OAAqB;CACvD,OAAO,IAAI,MAAM,OAAO,EACvB,IAAI,QAAe,UAA2B,UAA4B;EACzE,IAAI,aAAa,SAAS,aAAa,OACtC,OAAO;EAER,OAAO,QAAQ,IAAI,QAAQ,UAAU,SAAS;IAE/C,CAAC;;AAGH,SAAS,+BAA+B,QAA8C;CACrF,OAAO,IAAI,MAAM,QAAQ,EACxB,IAAI,QAA2B,UAA2B,UAA4B;EACrF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OAAO,YACb,0BAA0B,MAAM,OAAO,KAAK,QAAQ,CAAC;EAEvD,IAAI,aAAa,YAChB,QAAQ,YAA4B,0BAA0B,OAAO,SAAS,QAAQ,CAAC;EAExF,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAS,6BAA6B,UAA4C;CACjF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OACN,WACA,OACA,SAEA,+BAA+B,MAAM,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3E,IAAI,aAAa,YAChB,QAAQ,WAAmB,OAAe,SACzC,+BAA+B,OAAO,SAAS,WAAW,OAAO,KAAK,CAAC;EAEzE,IAAI,aAAa,QAChB,OAAO,OAAO,WAAmB,YAChC,0BAA0B,MAAM,OAAO,KAAK,WAAW,QAAQ,CAAC;EAElE,IAAI,aAAa,YAChB,QAAQ,WAAmB,YAC1B,0BAA0B,OAAO,SAAS,WAAW,QAAQ,CAAC;EAEhE,IAAI,aAAa,SAChB,OAAO,OAAO,WAAmB,YAChC,0BAA0B,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;EAEnE,IAAI,aAAa,aAChB,QAAQ,WAAmB,YAC1B,0BAA0B,OAAO,UAAU,WAAW,QAAQ,CAAC;EAEjE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAS,4BACR,SACA,UAMC;CACD,MAAM,aAAa,aAAa,KAAA,IAAY,KAAK,KAAK,SAAS;CAC/D,OAAO,OAAO,uBAAO,IAAI,MAAM,UAAU,UAAU,aAAa,EAAE;EACjE,MAAM;EACN,OAAO,MAAM;EACb,GAAI,aAAa,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,UAAU;EACpD;EACA,CAAC;;AAGH,SAAS,iCAAiC,QAA8C;CACvF,OAAO,IAAI,MAAM,QAAQ,EACxB,IAAI,QAA2B,UAA2B,UAA4B;EACrF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,WAAW,aAAa,eAAe,aAAa,YACpE,OAAO,YAA4B;GAClC,MAAM,4BAA4B,OAAO,SAAS,EAAE,OAAO,KAAK;;EAGlE,IAAI,aAAa,eAAe,aAAa,mBAAmB,aAAa,gBAC5E,aAAoB;GACnB,MAAM,4BAA4B,OAAO,SAAS,EAAE,OAAO,KAAK;;EAGlE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAgB,+BAA+B,UAA4C;CAC1F,MAAM,mBAAmB,IAAI,iBAAiB,SAAS;CACvD,OAAO,IAAI,MAAM,kBAAkB,EAClC,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OACN,WACA,OACA,SACgC;GAChC,IAAI,YAAY,MAAM,EACrB,MAAM,4BAA4B,QAAQ,UAAU;GAErD,OAAO,iCAAiC,MAAM,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;;EAGpF,IAAI,aAAa,YAChB,QAAQ,WAAmB,OAAe,SAAqC;GAC9E,IAAI,YAAY,MAAM,EACrB,MAAM,4BAA4B,YAAY,UAAU;GAEzD,OAAO,iCAAiC,OAAO,SAAS,WAAW,OAAO,KAAK,CAAC;;EAGlF,IACC,aAAa,WACb,aAAa,WACb,aAAa,YACb,aAAa,YACb,aAAa,UACb,aAAa,eACb,aAAa,gBACb,aAAa,cACb,aAAa,WAEb,OAAO,OAAO,cAAsC;GACnD,MAAM,4BAA4B,OAAO,SAAS,EAAE,UAAU;;EAGhE,IACC,aAAa,eACb,aAAa,eACb,aAAa,gBACb,aAAa,gBACb,aAAa,cACb,aAAa,mBACb,aAAa,oBACb,aAAa,kBACb,aAAa,eAEb,QAAQ,cAA6B;GACpC,MAAM,4BAA4B,OAAO,SAAS,EAAE,UAAU;;EAGhE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAkCH,SAAgB,mBAAmB,OAA2C;CAC7E,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,OAAO;CAER,IAAI,EAAE,eAAe,UAAU,EAAE,qBAAqB,QACrD,OAAO;CAER,MAAM,YAAY,MAAM;CACxB,MAAM,kBAAkB,MAAM;CAC9B,IACC,cAAc,iBACd,OAAO,oBAAoB,YAC3B,CAAC,0BAA0B,KAAK,gBAAgB,EAEhD,OAAO;CAGR,IAAI;EACH,MAAM,mBAAmB,OAAO,KAAK,iBAAiB,SAAS;EAC/D,IAAI,iBAAiB,SAAS,SAAS,KAAK,mBAAmB,iBAAiB,SAAS,GACxF,OAAO;EAER,MAAM,kBAAkB,iBAAiB,aAAa,EAAE;EACxD,MAAM,iBAAiB;EACvB,MAAM,eAAe,iBAAiB;EACtC,MAAM,wBAAwB;EAC9B,MAAM,iBAAiB,wBAAwB;EAC/C,OACC,eAAe,KAAK,iBAAiB,UACrC,iBAAiB,SAAS,gBAAgB,aAAa,CAAC,SAAS,OAAO,KAAK,iBAC7E,iBAAiB,aAAa,sBAAsB,KAAK,MACzD,iBAAiB,WAAW,iBAAiB;SAEvC;EACP,OAAO;;;AAIT,SAAgB,sBAAsB,eAAyC;CAC9E,MAAM,iBAAiB,cACrB,MAAM,KAAK,CACX,KAAK,SAAS,KAAK,MAAM,CAAC,CAC1B,QAAQ,SAAS,KAAK,SAAS,EAAE;CACnC,IAAI,eAAe,WAAW,GAC7B,MAAM,IAAI,MAAM,kEAAkE;CAEnF,MAAM,kBAAkB,eAAe,IAAI,MAAM,OAAO;CACxD,MAAM,gBAAgB;EACrB,WAAW,kBAAkB;EAC7B,iBAAiB,kBAAkB;EACnC;CACD,IAAI,CAAC,mBAAmB,cAAc,EACrC,MAAM,IAAI,MAAM,8DAA8D;CAE/E,OAAO;;AAGR,eAAe,qBAAqB,YAA0D;CAC7F,MAAM,kBAAkB,MAAM,WAAW,KAAK,CAAC,YAAY,oCAAoC,CAAC;CAChG,IAAI,gBAAgB,aAAa,GAChC,MAAM,IAAI,MACT,iDAAiD,OAAO,gBAAgB,SAAS,CAAC,GAClF;CAEF,OAAO,sBAAsB,gBAAgB,OAAO;;AAGrD,eAAe,mCACd,WACA,eACiB;CACjB,IAAI;EACH,MAAM,UAAU,OAAO;UACf,YAAY;EAEpB,MAAM,IAAI,eACT,CAAC,eAAe,WAAW,EAC3B,8EACA,EAAE,OAAO,eAAe,CACxB;;CAEF,MAAM;;AA6GP,SAAS,4BAAmD;CAC3D,MAAM,+BAA+B,aACpC,IAAI,eAAe,SAAS;CAC7B,OAAO;EACN;EACA,UAAU,OAAO,cACf,MAAM,GAAG,OAAO,UAAU;EAC5B,kBAAkB,gBACjB,gBAAgB;GACf,cAAc,CAAC,GAAG,YAAY,aAAa;GAC3C,GAAI,YAAY,yBAAyB,KAAA,IACtC,EAAE,GACF,EAAE,sBAAsB,CAAC,GAAG,YAAY,qBAAqB,EAAE;GAClE,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,aAAa,GAAG,EAAE;GAC3E,SAAS,OAAO,YACf,OAAO,QAAQ,YAAY,QAAQ,CAAC,KAAK,CAAC,YAAY,gBAAgB,CACrE,YACA;IACC,OAAO,CAAC,GAAG,WAAW,MAAM;IAC5B,GAAI,WAAW,gBAAgB,KAAA,IAC5B,EAAE,GACF,EAAE,aAAa,WAAW,aAAa;IAC1C,OAAO,WAAW;IAClB,CACD,CAAC,CACF;GACD,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,WAAW,GAAG,EAAE;GACrE,GAAI,YAAY,aAAa,EAAE,YAAY,YAAY,YAAY,GAAG,EAAE;GACxE,CAAC;EACH;EACA,6BAA6B,SAC5B,2BAA2B;GAC1B,sBAAsB;GACtB;GACA,CAAC;EACH,sBAAsB;EACtB,wBAAwB;EACxB,4BAA6C,IAAI,gBAAgB;EACjE,uBACC,UACA,kBACqB,IAAI,eAAe,UAAU,cAAc;EACjE,4BAA4B,UAC3B,0BAA0B,CAAC,GAAG,MAAM,CAAC;EACtC;;AAIF,SAAS,oBAAoB,WAA2B;CACvD,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,YAAY,WAAW,IAAI,EAC9B,OAAO;CAIR,OAAO,IADc,YAAY,WAAW,KAAK,GAAG,YAAY,MAAM,EAAY,GAAG;;AAItF,SAAS,4BACR,WACA,cACA,WACkB;CAClB,IAAI,UAAU,gBACb,OAAO,aAAa,2BAA2B,UAAU,eAAe;CAEzE,IAAI,UAAU,UACb,OAAO,aAAa,qBAAqB,UAAU,SAAS;CAG7D,MAAM,IAAI,MAAM,GAAG,UAAU,4CAA4C;;AAG1E,SAAS,uBACR,WACA,cACkB;CAClB,QAAQ,UAAU,MAAlB;EACC,KAAK,sBACJ,MAAM,IAAI,MAAM,oEAAoE;EACrF,KAAK,UACJ,OAAO,aAAa,sBAAsB;EAC3C,KAAK,UACJ,OAAO,4BAA4B,WAAW,cAAc,SAAS;EAEtE,KAAK,mBACJ,OAAO,aAAa,uBACnB,4BAA4B,WAAW,cAAc,kBAAkB,CACvE;EAEF,KAAK,sBACJ,OAAO,gCAAgC;GACtC,cAAc,aAAa,2BAA2B,UAAU,eAAe;GAC/E;GACA,QAAQ,UAAU;GAClB,CAAC;EAEH,KAAK,UAAU;GAMd,IAAI,iBAJH,UAAU,YAAY,UAAU,iBAC7B,4BAA4B,WAAW,cAAc,SAAS,GAC9D,aAAa,sBAAsB;GAGvC,MAAM,eAAe,UAAU;GAE/B,IAAI,cAAc,KAAK,QACtB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,KAAK,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACtE;IACD,WAAW;IACX,CAAC;GAGH,IAAI,cAAc,MAAM,QACvB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,MAAM,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACvE;IACD,WAAW;IACX,CAAC;GAGH,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,8BAA8B;;;AAejD,SAAS,gBACR,WACA,cACmB;CACnB,MAAM,WAA4C,EAAE;CACpD,MAAM,0CAA0B,IAAI,KAAqC;CAEzE,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,UAAU,EAAE;EAC/D,IAAI,UAAU,SAAS,sBAAsB;GAC5C,MAAM,WAAW,aAAa,sBAAsB;GACpD,wBAAwB,IAAI,WAAW;IAAE;IAAU,OAAO;IAAW,CAAC;GACtE,MAAM,gBAAgB,6BAA6B,SAAS;GAC5D,SAAS,aACR,UAAU,WAAW,cAClB,aAAa,uBAAuB,cAAc,GAClD;GACJ;;EAED,SAAS,aAAa,uBAAuB,WAAW,aAAa;;CAGtE,OAAO;EAAE;EAAyB,QAAQ;EAAU;;AAGrD,SAAS,yBACR,WAC8B;CAC9B,MAAM,wBAAQ,IAAI,KAA+B;CACjD,KAAK,MAAM,aAAa,OAAO,OAAO,UAAU,EAC/C,IAAI,oBAAoB,aAAa,UAAU,gBAC9C,MAAM,IAAI,UAAU,eAAe,IAAI,UAAU,eAAe;CAGlE,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC;;AAG3B,SAAS,uBACR,OACA,cACO;CACP,MAAM,cAAyB,EAAE;CACjC,KAAK,MAAM,QAAQ,OAClB,IAAI;EACH,aAAa,sBAAsB,KAAK;UAChC,OAAO;EACf,YAAY,KAAK,MAAM;;CAGzB,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;CAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,gDAAgD;;AAIxF,SAAS,mCACR,OACA,cACO;CACP,IAAI;EACH,uBAAuB,OAAO,aAAa;SACpC;;AAMT,SAAS,+BACR,iBAAuC,EAAE,EAClB;CACvB,MAAM,kBAAwC,EAC7C,GAAG,oCACH;CAED,IAAI,eAAe,eAAe,KAAA,GACjC,gBAAgB,aAAa,eAAe;CAE7C,IAAI,eAAe,eAAe,KAAA,GACjC,gBAAgB,aAAa,eAAe;CAE7C,IAAI,eAAe,oBAAoB,KAAA,GACtC,gBAAgB,kBAAkB,eAAe;CAElD,IAAI,eAAe,UAAU,KAAA,GAC5B,gBAAgB,QAAQ,eAAe;CAExC,IAAI,eAAe,uBAAuB,KAAA,GACzC,gBAAgB,qBAAqB,eAAe;CAErD,IAAI,eAAe,iCAAiC,KAAA,GACnD,gBAAgB,+BAA+B,eAAe;CAE/D,IAAI,eAAe,4BAA4B,KAAA,GAC9C,gBAAgB,0BAA0B,eAAe;CAE1D,IAAI,eAAe,8BAA8B,KAAA,GAChD,gBAAgB,4BAA4B,eAAe;CAG5D,OAAO;;AAUR,SAAS,wBAAwB,UAA0B;CAC1D,OAAO,SAAS,aAAa;;AAG9B,SAAS,qBAAqB,UAA+C;CAC5E,IAAI,SAAS,WAAW,IAAI,EAAE;EAC7B,MAAM,sBAAsB,SAAS,QAAQ,IAAI;EACjD,IAAI,sBAAsB,GAAG;GAC5B,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,sBAAsB,EAAE,EAAE,GAAG;GAC9E,IAAI,CAAC,OAAO,SAAS,UAAU,EAC9B;GAED,OAAO;IACN,UAAU,wBAAwB,SAAS,MAAM,GAAG,oBAAoB,CAAC;IACzE,MAAM;IACN;;;CAIH,MAAM,qBAAqB,SAAS,YAAY,IAAI;CACpD,IAAI,sBAAsB,GACzB;CAED,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,qBAAqB,EAAE,EAAE,GAAG;CAC7E,IAAI,CAAC,OAAO,SAAS,UAAU,EAC9B;CAED,OAAO;EACN,UAAU,wBAAwB,SAAS,MAAM,GAAG,mBAAmB,CAAC;EACxE,MAAM;EACN;;AAGF,SAAS,sBAAsB,WAA4B;CAC1D,MAAM,SAAS,UAAU,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,SAAS,SAAS,GAAG,CAAC;CAClF,IAAI,OAAO,WAAW,KAAK,OAAO,MAAM,UAAU,CAAC,OAAO,UAAU,MAAM,CAAC,EAC1E,OAAO;CAER,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,IAAI,eAAe,KAAA,KAAa,gBAAgB,KAAA,GAC/C,OAAO;CAER,OACC,eAAe,MACf,eAAe,OACd,eAAe,OAAO,gBAAgB,OACtC,eAAe,OAAO,eAAe,MAAM,eAAe,MAC1D,eAAe,OAAO,gBAAgB,OACtC,eAAe,OAAO,eAAe,MAAM,eAAe;;AAI7D,SAAS,oBAAoB,WAA4B;CACxD,IAAI,IAAI,KAAK,UAAU,KAAK,GAC3B,OAAO,sBAAsB,UAAU;CAExC,MAAM,sBAAsB,UAAU,aAAa;CACnD,IAAI,oBAAoB,WAAW,UAAU,EAC5C,OAAO,sBAAsB,oBAAoB,MAAM,EAAiB,CAAC;CAE1E,OACC,wBAAwB,SACxB,oBAAoB,WAAW,KAAK,IACpC,oBAAoB,WAAW,KAAK,IACpC,oBAAoB,WAAW,QAAQ;;AAIzC,SAAS,2BAA2B,UAA2B;CAC9D,MAAM,qBAAqB,wBAAwB,SAAS;CAC5D,OACC,uBAAuB,eACvB,uBAAuB,0BACvB,oBAAoB,mBAAmB;;AAIzC,SAAS,2BACR,UACiC;CACjC,IAAI,CAAC,UACJ,OAAO,EAAE;CAGV,MAAM,QAA+B,EAAE;CACvC,KAAK,MAAM,CAAC,YAAY,kBAAkB,OAAO,QAAQ,SAAS,EAAE;EACnE,MAAM,kBAAkB,qBAAqB,WAAW;EACxD,MAAM,iBAAiB,qBAAqB,cAAc;EAC1D,IACC,CAAC,mBACD,CAAC,kBACD,CAAC,2BAA2B,eAAe,SAAS,EAEpD;EAED,IACC,CAAC,MAAM,MACL,SAAS,KAAK,aAAa,gBAAgB,YAAY,KAAK,SAAS,gBAAgB,KACtF,EAED,MAAM,KAAK,gBAAgB;;CAG7B,OAAO;;AAGR,SAAS,iBACR,OACA,iBACoB;CACpB,MAAM,cAAc,CAAC,GAAG,MAAM;CAC9B,KAAK,MAAM,QAAQ,iBAClB,IAAI,CAAC,YAAY,SAAS,KAAK,EAC9B,YAAY,KAAK,KAAK;CAGxB,OAAO;;AAGR,SAAS,qBAAqB,UAA0B;CACvD,OAAO,SAAS,QAAQ,SAAS,GAAG,CAAC,QAAQ,WAAW,GAAG;;AAG5D,SAAgB,kCACf,SAC0B;CAC1B,MAAM,eACL,QAAQ,iBAAiB,KAAA,IACtB,KAAA,IACA,IAAI,IAAI,QAAQ,aAAa,KAAK,aAAa,qBAAqB,SAAS,CAAC,CAAC;CAEnF,OAAO;EACN,cAAc,CAAC,GAAG,QAAQ,aAAa;EACvC,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,OAAO,GAAG,EAAE;EACjD,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,gBAAgB,GAAG,EAAE;EAC5E,aAAa,YAAY;GACxB,MAAM,UAAU,0BAA0B,QAAQ;GAClD,IAAI,CAAC,SACJ,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,QAAQ,YAAY,oBACvB,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,QAAQ,YAAY,mBACvB,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,gBAAgB,CAAC,aAAa,IAAI,qBAAqB,QAAQ,KAAK,CAAC,EACxE,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,OAAO,EAAE,OAAO,MAAM;;EAEvB;;AAGF,SAAS,4BACR,OACuC;CACvC,IAAI,MAAM,WAAW,GACpB;CAED,MAAM,gBAAgB,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC;CACjE,QAAQ,SAAS;EAChB,MAAM,WAAW,wBAAwB,KAAK,SAAS;EACvD,MAAM,mBAAmB,MAAM,MAC7B,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,KAC3D;EACD,IAAI,cAAc,IAAI,SAAS,EAC9B,OAAO;EAER,IAAI,oBAAoB,KAAK,GAAG,EAC/B,OAAO;EAER,OAAO;;;AAIT,eAAsB,gBACrB,SACA,eAAsC,2BAA2B,EAC5C;CACrB,aAAa,gCAAgC;CAC7C,MAAM,cAAc,QAAQ,YAAY,OAAO,KAAK,QAAQ,SAAS,CAAC,SAAS;CAC/E,MAAM,eAAe,QAAQ,cAAc,KAAA,KAAa,QAAQ,UAAU,aAAa,SAAS;CAChG,MAAM,uBAAuB,2BAA2B,QAAQ,SAAS;CACzE,MAAM,uBAAuB,iBAC5B,EAAE,EACF,qBAAqB,KAAK,SAAS,KAAK,SAAS,CACjD;CACD,MAAM,cAAc,4BAA4B,qBAAqB;CACrE,MAAM,oBAAoB,yBAAyB,QAAQ,UAAU;CACrE,IAAI;CACJ,IAAI;CACJ,IAAI;EACH,mBAAmB,gBAAgB,QAAQ,WAAW,aAAa;EACnE,MAAM,aAAa,aAAa,gBAAgB;GAC/C,cAAc,QAAQ;GACtB,GAAI,qBAAqB,SAAS,IAAI,EAAE,sBAAsB,GAAG,EAAE;GACnE,GAAI,cAAc,EAAE,aAAa,GAAG,EAAE;GACtC,SAAS,QAAQ;GACjB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GAC7D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;GAChE,CAAC;EACF,aAAa,MAAM,aAAa,SAAS;GACxC,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,GAAG,EAAE;GACrF,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,cAAc,GAAG,EAAE;GACtE,QAAQ;IACP,MAAM,QAAQ;IACd,GAAI,QAAQ,sBAAsB,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,QAAQ,mBAAmB;IACtF;GACD,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,KAAK;IACJ,GAAG,WAAW;IACd,GAAG,QAAQ;IACX;GACD,WAAW,WAAW;GACtB,KAAK;IACJ,WAAW;IACX,QAAQ,iBAAiB;IACzB;GACD,GAAI,eAAe,eAChB;IACA,KAAK;KACJ,MAAM;KACN,eAAe;KACf,eAAe;KACf,sBAAsB;KACtB;IACD,GAAI,eAAe,EAAE,KAAK,QAAQ,WAAW,GAAG,EAAE;IAClD,GAAI,cACD,EACA,KAAK,EACJ,OAAO,QAAQ,UACf,EACD,GACA,EAAE;IACL,GACA,EAAE;GACL,CAAC;UACM,OAAO;EACf,mCAAmC,mBAAmB,aAAa;EACnE,MAAM;;CAGP,IAAI;CACJ,IAAI,iBAAmD;CACvD,MAAM,sBAAsB,UAAyB;EACpD,uBAAuB;;CAExB,OAAO;EACN,IAAI,WAAW;EACf,IAAI,WAAW;EACf,KAAK,SAA2B,aAAsD;GACrF,MAAM,oBAAoB,OAAO,YAAY,WAAW,UAAU,CAAC,GAAG,QAAQ;GAC9E,OAAO,WAAW,KAAK,mBAAmB,YAAY;;EAEvD,MAAM,UAAU,YAAmD;GAClE,MAAM,YAAY,MAAM,WAAW,UAAU,WAAW;GACxD,IAAI;GACJ,IAAI;IACH,gBAAgB,MAAM,qBAAqB,WAAW;YAC9C,eAAe;IACvB,OAAO,MAAM,mCAAmC,WAAW,cAAc;;GAE1E,OAAO;IACN,OAAO,YAA2B,MAAM,UAAU,OAAO;IACzD,SAAS,UAAU;IACnB,MAAM,UAAU;IAChB,cAAc,UAAU;IACxB,MAAM,UAAU;IAChB;IACA,MAAM,UAAU;IAChB;;EAEF,MAAM,cAAc,gBAA+D;GAClF,OAAO,MAAM,WAAW,cAAc,+BAA+B,eAAe,CAAC;;EAEtF,MAAM,oBAAoB,SAA6D;GACtF,IAAI,mBAAmB,UACtB,MAAM,IAAI,MAAM,qEAAqE;GAEtF,IAAI,mBAAmB,WACtB,MAAM,IAAI,MAAM,qEAAqE;GAEtF,IAAI,uBAAuB,KAAA,GAC1B,MAAM,IAAI,MAAM,8DAA8D,EAC7E,OAAO,oBACP,CAAC;GAEH,IAAI;GACJ,IAAI;IACH,mBAAmB,4CAA4C,QAAQ;IACvE,MAAM,QAAQ,iBAAiB,wBAAwB,IAAI,iBAAiB,UAAU;IACtF,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,MACT,oEAAoE,iBAAiB,UAAU,IAC/F;IAEF,IAAI,MAAM,UAAU,WACnB,MAAM,IAAI,MACT,qCAAqC,iBAAiB,UAAU,mCAChE;IAEF,MAAM,QAAQ;IACd,IAAI,MAAM,SAAS,cAAc,KAAA,GAChC,MAAM,IAAI,MAAM,yDAAyD;IAE1E,KAAK,MAAM,QAAQ,iBAAiB,OAEnC,MAAM,MAAM,SAAS,UAAU,IAAI,KAAK,gBAAgB,OAAO,KAAK,KAAK,SAAS,EAAE,EACnF,MAAM,KAAK,MACX,CAAC;IAEH,MAAM,QAAQ;YACN,OAAO;IACf,MAAM,QAAQ,iBAAiB,wBAAwB,IAAI,QAAQ,UAAU;IAC7E,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ;IACvC,mBAAmB,MAAM;IACzB,MAAM;;;EAGR,aAA4B;GAC3B,OAAO,WAAW,cAAc,IAAI;;EAErC,gBAAmC;GAClC,OAAO;;EAER,iBAAiB,QAAuC;GACvD,WAAW,iBAAiB,OAAO;;EAEpC,MAAM,QAAuB;GAC5B,IAAI,uBAAuB,KAAA,GAC1B,MAAM,IAAI,MACT,4EACA,EACC,OAAO,oBACP,CACD;GAEF,MAAM,kBAAkB,CAAC,GAAG,iBAAiB,wBAAwB,CAAC,MACpE,GAAG,WAAW,MAAM,UAAU,YAC/B;GACD,IAAI,oBAAoB,KAAA,GAAW;IAClC,MAAM,wBAAQ,IAAI,MACjB,qCAAqC,gBAAgB,GAAG,mCACxD;IACD,mBAAmB,MAAM;IACzB,MAAM;;GAEP,MAAM,WAAW,OAAO;GACxB,iBAAiB;;EAElB,MAAM,QAAuB;GAC5B,MAAM,cAAyB,EAAE;GACjC,IAAI;IACH,MAAM,WAAW,OAAO;YAChB,OAAO;IACf,YAAY,KAAK,MAAM;;GAExB,iBAAiB;GACjB,iBAAiB,wBAAwB,OAAO;GAChD,IAAI;IACH,uBAAuB,mBAAmB,aAAa;YAC/C,OAAO;IACf,IAAI,iBAAiB,gBACpB,YAAY,KAAK,GAAG,MAAM,OAAO;SAEjC,YAAY,KAAK,MAAM;;GAGzB,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;GAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,sCAAsC;;EAG9E;;;;ACpiCF,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,mBAAmB,OAAwB;CACnD,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM;;AAGjE,SAAS,6BAA6B,SAAuC;CAC5E,IAAI,CAAC;EAAC;EAAY;EAAU;EAAM,CAAC,SAAS,QAAQ,WAAW,EAC9D,MAAM,IAAI,MACT,uCAAuC,mBAAmB,QAAQ,WAAW,GAC7E;CAEF,IAAI,CAAC,OAAO,cAAc,QAAQ,UAAU,SAAS,IAAI,QAAQ,UAAU,YAAY,GACtF,MAAM,IAAI,MAAM,wDAAwD;CAEzE,IAAI,QAAQ,eAAe,WAAW,KAAK,QAAQ,UAAU,OAAO,WAAW,GAC9E,MAAM,IAAI,MAAM,2DAA2D;CAE5E,IAAI,QAAQ,cAAc,KAAA,KAAa,QAAQ,UAAU,SAAS,iBACjE,MAAM,IAAI,MACT,2CAA2C,mBAAmB,QAAQ,UAAU,KAAK,GACrF;CAEF,KAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,QAAQ,OAAO,EAAE;EAChE,IAAI,CAAC,UAAU,WAAW,IAAI,EAC7B,MAAM,IAAI,MAAM,2CAA2C,YAAY;EAExE,IACC,CAAC;GACA;GACA;GACA;GACA;GACA;GACA;GACA,CAAC,SAAS,MAAM,KAAK,EAEtB,MAAM,IAAI,MAAM,sCAAsC,mBAAmB,MAAM,KAAK,GAAG;;CAGzF,MAAM,sCAAsB,IAAI,KAAa;CAC7C,KAAK,MAAM,UAAU,QAAQ,iBAAiB;EAC7C,IAAI,oBAAoB,IAAI,OAAO,oBAAoB,EACtD,MAAM,IAAI,MACT,8DAA8D,OAAO,sBACrE;EAEF,oBAAoB,IAAI,OAAO,oBAAoB;;CAEpD,MAAM,gCAAgB,IAAI,KAAa;CACvC,KAAK,MAAM,WAAW,QAAQ,UAAU;EACvC,IAAI,cAAc,IAAI,QAAQ,UAAU,EACvC,MAAM,IAAI,MAAM,wCAAwC,QAAQ,YAAY;EAE7E,cAAc,IAAI,QAAQ,UAAU;;;AAStC,SAAS,6BACR,WACqB;CACrB,MAAM,cAAyB,EAAE;CACjC,KAAK,MAAM,YAAY,WACtB,IAAI;EACH,SAAS,OAAO;UACR,OAAO;EACf,YAAY,KAAK,MAAM;;CAGzB,OAAO;;AAGR,SAAS,sBACR,OAC6B;CAC7B,OAAO,MAAM,QAAQ,MAAM;;AAG5B,SAAS,yBACR,aACoC;CACpC,OAAO,sBAAsB,YAAY,GAAG,CAAC,GAAG,YAAY,GAAG,EAAE,GAAG,aAAa;;AAGlF,SAAS,mBACR,OAC0C;CAC1C,IAAI,OAAO,UAAU,UACpB,OAAO;CAER,IAAI,iBAAiB,YACpB,OAAO,OAAO,KAAK,MAAM;CAE1B,QAAQ,mBAA0C;EACjD,WAAW,MAAM,SAAS,OACzB,MAAM,OAAO,KAAK,MAAM;KAEtB;;AAGL,MAAM,0CAA0C,IAAI;AACpD,MAAM,0CAA0C,KAAK,OAAO;AAE5D,SAAS,wBAAwB,MAAkD;CAClF,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,EAAE,UAAU,OAC5D,MAAM,IAAI,MAAM,2CAA2C;CAE5D,IAAI,KAAK,SAAS,QACjB,OAAO;CAER,IAAI,KAAK,SAAS,WACjB,OAAO;CAER,MAAM,IAAI,MAAM,2CAA2C;;AAG5D,SAAS,8BACR,QACsE;CACtE,IACC,CAAC,OAAO,UAAU,OAAO,YAAY,IACrC,OAAO,cAAc,2CACrB,OAAO,cAAc,yCAErB,MAAM,IAAI,MACT,4DAA4D,OAAO,wCAAwC,CAAC,OAAO,OAAO,wCAAwC,CAAC,SACnK;CAEF,OAAO;EACN,QAAQ,wBAAwB,OAAO,OAAO;EAC9C,QAAQ,wBAAwB,OAAO,OAAO;EAC9C,aAAa,OAAO;EACpB;;AAGF,SAAS,qBAAqB,SAAyD;CACtF,OAAO;EACN,GAAI,QAAQ,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,KAAK,EAAE,GAAG,EAAE;EACnD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,KAAK,GAAG,EAAE;EAC3C,GAAI,QAAQ,MAAM,EAAE,KAAK,yBAAyB,QAAQ,IAAI,EAAE,GAAG,EAAE;EACrE,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,GAAG,8BAA8B,QAAQ,OAAO;EACrF,GAAI,QAAQ,QAAQ,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,QAAQ,KAAK;EACzD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;EACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,GAAG,EAAE,OAAO,mBAAmB,QAAQ,MAAM,EAAE;EACnF;;AAGF,SAAS,gBAAgB,eAA0E;CAClG,MAAM,SAAuC,cAAc;CAC3D,OAAO,OAAO,OAAO,QAAQ;EAC5B,CAAC,OAAO,iBAAwC;GAC/C,OAAO,cAAc,OAAO,gBAAgB;;EAE7C,MAAY;GACX,cAAc,KAAK;;EAEpB,QAA+B;GAC9B,OAAO,cAAc,OAAO;;EAE7B,SAAkD;GACjD,OAAO,cAAc,QAAQ;;EAE9B,OAAO,MAAc,SAAuB;GAC3C,cAAc,OAAO,MAAM,QAAQ;;EAEpC;EACA,MAAM,MAAiC;GACtC,cAAc,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,KAAK,KAAK,CAAC;;EAEzE,CAAC;;AAGH,eAAe,8CACd,YACA,QACgB;CAChB,MAAM,sBAAsB,WAAW,SAAS,SAAS,KAAK,IAAI,GAC/D,WAAW,WACX,GAAG,WAAW,WAAW,KAAK;CACjC,MAAM,QAAQ,IACb,OAAO,eAAe,IAAI,OAAO,kBAAkB;EAClD,MAAM,aAAa,KAAK,KACvB,WAAW,UACX,GAAG,cAAc,mBAAmB,MAAM,IAAI,CAC9C;EACD,MAAM,sBAAsB,MAAM,GAAG,SAAS,WAAW;EACzD,IACC,wBAAwB,WAAW,YACnC,CAAC,oBAAoB,WAAW,oBAAoB,EAEpD,MAAM,IAAI,MACT,gFAAgF,cAAc,qBAC9F;GAED,CACF;;AAGF,eAAe,gBACd,QACA,qBAC4B;CAC5B,MAAM,mBAAiD,EAAE;CACzD,MAAM,YAA0C,EAAE;CAClD,MAAM,oBAGA,EAAE;CACR,IAAI;EACH,KAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,OAAO,EACtD,QAAQ,MAAM,MAAd;GACC,KAAK;IACJ,iBAAiB,aAAa;KAC7B,QAAQ,MAAM;KACd,MAAM;KACN;IACD;GACD,KAAK;IACJ,iBAAiB,aAAa;KAC7B,UAAU,MAAM;KAChB,MAAM,MAAM,WAAW,cAAc,oBAAoB;KACzD;IACD;GACD,KAAK,wBAAwB;IAC5B,MAAM,aAAa,oBAAoB,IAAI,MAAM,UAAU;IAC3D,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,mEAAmE;IAEpF,uBAAuB,WAAW;IAClC,UAAU,KAAK,MAAM,UAAU,SAAS,CAAC;IACzC,oBAAoB,OAAO,MAAM,UAAU;IAC3C,iBAAiB,aAAa;KAC7B,MAAM,MAAM,WAAW,cAAc,oBAAoB;KACzD,gBAAgB;KAChB;IACD;;GAED,KAAK,4BAA4B;IAChC,MAAM,aAAa,oBAAoB,IAAI,MAAM,UAAU;IAC3D,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,mEAAmE;IAEpF,uBAAuB,WAAW;IAClC,UAAU,KAAK,MAAM,UAAU,SAAS,CAAC;IACzC,oBAAoB,OAAO,MAAM,UAAU;IAC3C,MAAM,SAAS,yCAAyC,MAAM,OAAO;IACrE,kBAAkB,KAAK;KAAE;KAAY;KAAQ,CAAC;IAC9C,iBAAiB,aAAa;KAC7B,MAAM;KACN,gBAAgB;KAChB;KACA;IACD;;GAED,KAAK;IACJ,iBAAiB,aAAa,EAAE,MAAM,UAAU;IAChD;GACD,KAAK;IACJ,iBAAiB,aAAa;KAC7B,UAAU,MAAM;KAChB,MAAM;KACN,cAAc;MACb,MAAM,MAAM;MACZ,OAAO,MAAM;MACb;KACD;IACD;;EAGH,MAAM,QAAQ,IACb,kBAAkB,KAAK,EAAE,YAAY,aACpC,8CAA8C,YAAY,OAAO,CACjE,CACD;UACO,OAAO;EACf,MAAM,cAAc,6BAA6B,UAAU;EAC3D,IAAI,YAAY,SAAS,GAExB,MAAM,IAAI,eACT,CAAC,OAAO,GAAG,YAAY,EACvB,yEACA,EAAE,OAAO,OAAO,CAChB;EAEF,MAAM;;CAEP,OAAO;EAAE,QAAQ;EAAkB;EAAW;;AAG/C,SAAS,cACR,UACA,yBACY;CAQZ,IAAI;CACJ,IAAI,gBAA+B;CACnC,IAAI,iBAA0C;CAC9C,IAAI;CACJ,MAAM,YAAY,YAA2B;EAC5C,IAAI,cACH,IAAI;GACH,MAAM;UACC;EAIT,MAAM,cAAyB,EAAE;EACjC,IAAI;GACH,MAAM,SAAS,OAAO;WACd,OAAO;GACf,YAAY,KAAK,MAAM;;EAExB,YAAY,KAAK,GAAG,6BAA6B,wBAAwB,CAAC;EAC1E,IAAI;GACH,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;GAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,6BAA6B;YAE3D;GACT,gBAAgB;GAChB,iBAAiB;;;CAGnB,OAAO;EACN,MAAM,QAAuB;GAC5B,IAAI,CAAC,cAAc;IAClB,iBAAiB;IACjB,eAAe,WAAW;;GAE3B,MAAM;;EAEP,uBAAuB,QAAgD;GACtE,SAAS,iBACR,OAAO,KAAK,WAAW;IACtB,MAAM,MAAM;IACZ,QAAQ,MAAM;IACd,aAAa,MAAM;IACnB,EAAE,CACH;;EAEF,MAAM,cAAc,SAAmE;GACtF,OAAO,MAAM,SAAS,cAAc,QAAQ;;EAE7C,MAAM,UAAU,SAAsC;GACrD,MAAM,SAAS,MAAM,SAAS,UAAU,QAAQ;GAChD,IAAI,CAAC,OAAO,WAAW,CAAC,OAAO,gBAAgB,CAAC,OAAO,MAAM;IAC5D,MAAM,OAAO,OAAO;IACpB,MAAM,IAAI,MAAM,kEAAkE;;GAEnF,OAAO;IACN,OAAO,YAA2B,MAAM,OAAO,OAAO;IACtD,SAAS,OAAO;IAChB,MAAM,OAAO;IACb,cAAc,OAAO;IACrB,MAAM,OAAO;IACb,eAAe,OAAO;IACtB,MAAM,OAAO;IACb;;EAEF,MAAM,oBAAoB,SAAwB;GACjD,MAAM,SAAS,oBAAoB,QAAQ;;EAE5C,KAAK,SAA+B,SAAsD;GACzF,MAAM,oBAAoB,OAAO,YAAY,WAAW,UAAU,CAAC,GAAG,QAAQ;GAK9E,OAAO,gBAJe,SAAS,KAC9B,mBACA,UAAU,qBAAqB,QAAQ,GAAG,KAAA,EAEP,CAAC;;EAEtC,mBAAkC;GACjC,IAAI,kBAAkB,MACrB,OAAO;GAER,MAAM,uBAAuB,SAAS,YAAY;GAClD,IAAI,yBAAyB,MAC5B,OAAO;GAER,IAAI,yBAAyB,eAC5B,MAAM,IAAI,MACT,oDAAoD,SAAS,GAAG,kBAAkB,OAAO,cAAc,CAAC,aAAa,OAAO,qBAAqB,CAAC,GAClJ;GAEF,OAAO;;EAER,IAAI,SAAS;EACb,MAAM,QAAuB;GAC5B,IAAI,mBAAmB,aAAa,mBAAmB,UACtD,MAAM,IAAI,MAAM,0DAA0D;GAE3E,IAAI,mBAAmB,WACtB;GAED,IAAI,CAAC,cAAc;IAClB,iBAAiB;IACjB,gBAAgB,YAA2B;KAC1C,IAAI;MACH,MAAM,SAAS,OAAO;MACtB,MAAM,uBAAuB,4BAA4B,SAAS,YAAY,CAAC;MAC/E,IAAI,mBAAmB,YACtB,MAAM,IAAI,MAAM,gDAAgD;MAEjE,gBAAgB;MAChB,iBAAiB;cACT,OAAO;MACf,IAAI,mBAAmB,YACtB,iBAAiB;MAElB,MAAM;;QAEJ;;GAEL,MAAM;;EAEP;;AAGF,SAAS,uBACR,UACA,qBACqB;CACrB,MAAM,aAAa,cAAc,SAAS;CAC1C,MAAM,YAAY,mCAAmC;EACpD,UAAU;GACT,eAAe,WAAW;GAC1B,QAAQ,WAAW;GACnB,OAAO,WAAW;GAClB;EACD,eAAe,sBAAsB,WAAW;EAChD,iBAAiB,uBAAuB,WAAW;EACnD,CAAC;CACF,oBAAoB,IAAI,WAAW,WAAW;CAC9C,OAAO;;AAGR,SAAgB,kCAAqD;CACpE,MAAM,sCAAgD,IAAI,SAAS;CACnE,OAAO;EACN,aAAa,EACZ,MAAM,qBAAqB;GAC1B,MAAM,cAAc,EAAE;GACtB,IAAI;IACH,MAAM,QAAQ,IAAI,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;YAC7E,OAAO;IACf,YAAY,KAAK;KAChB,MAAM;KACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KAC/D,UAAU;KACV,CAAC;;GAEH,OAAO;KAER;EACD,yBAAyB,iDAAiD;EAC1E,SAAS,EACR,MAAM,gBAAgB,SAAqD;GAC1E,6BAA6B,QAAQ;GACrC,MAAM,UAAU,OAAO,YACtB,QAAQ,gBAAgB,KAAK,WAAW,CACvC,OAAO,qBACP;IACC,OAAO,CAAC,GAAG,OAAO,aAAa;IAC/B,GAAI,OAAO,qBAAqB,KAAA,IAC7B,EAAE,GACF,EAAE,aAAa,OAAO,kBAAkB;IAC3C,OAAO,OAAO;IACd,CACD,CAAC,CACF;GACD,MAAM,WAAW,OAAO,YACvB,QAAQ,SAAS,KAAK,YAAY,CAAC,QAAQ,WAAW,QAAQ,OAAO,CAAC,CACtE;GACD,MAAM,mBAAmB,MAAM,gBAAgB,QAAQ,QAAQ,oBAAoB;GACnF,IAAI;GACJ,IAAI;IACH,WAAW,MAAMC,gBAAsB;KACtC,cAAc,CAAC,GAAG,QAAQ,aAAa;KACvC,MAAM,QAAQ,UAAU;KACxB,KAAK,EAAE,GAAG,QAAQ,aAAa;KAC/B,WAAW,QAAQ;KACnB,QAAQ,QAAQ,UAAU;KAC1B,GAAI,QAAQ,WAAW,YAAY,EAAE,WAAW,QAAQ,UAAU,WAAW,GAAG,EAAE;KAClF,GAAI,QAAQ,WAAW,aAAa,EAAE,YAAY,QAAQ,UAAU,YAAY,GAAG,EAAE;KACrF,YAAY,QAAQ;KACpB,GAAI,QAAQ,oBAAoB,EAAE,mBAAmB,QAAQ,mBAAmB,GAAG,EAAE;KACrF;KACA,cAAc,QAAQ;KACtB,GAAI,QAAQ,YACT,EACA,WAAW,kCAAkC;MAC5C,cAAc,QAAQ,UAAU;MAChC,GAAI,QAAQ,UAAU,cACnB,EAAE,OAAO,QAAQ,UAAU,aAAa,GACxC,EAAE;MACL,GAAI,QAAQ,UAAU,sBACnB,EAAE,cAAc,QAAQ,UAAU,qBAAqB,GACvD,EAAE;MACL,GAAI,QAAQ,UAAU,iBACnB,EAAE,gBAAgB,QAAQ,UAAU,gBAAgB,GACpD,EAAE;MACL,CAAC,EACF,GACA,EAAE;KACL;KACA,WAAW,iBAAiB;KAC5B,CAAC;YACM,OAAO;IACf,MAAM,cAAc,6BAA6B,iBAAiB,UAAU;IAC5E,IAAI,YAAY,SAAS,GAExB,MAAM,IAAI,eACT,CAAC,OAAO,GAAG,YAAY,EACvB,oEACA,EAAE,OAAO,OAAO,CAChB;IAEF,MAAM;;GAEP,OAAO,cAAc,UAAU,iBAAiB,UAAU;KAE3D;EACD,QAAQ,EACP,MAAM,aAAa,SAAS;GAC3B,MAAM,cAA4B,EAAE;GACpC,MAAM,eAAwB,MAC7B,MAAM,GAAG,SAAS,QAAQ,YAAY,OAAO,EAC7C,aACA,EAAE,oBAAoB,MAAM,CAC5B;GACD,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,MACT,oCAAoC,QAAQ,WAAW,KAAK,YAC1D,KAAK,eAAe,oBAAoB,WAAW,MAAM,CAAC,CAC1D,KAAK,KAAK,GACZ;GAEF,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,oBAAoB,aAAa,EAChE,MAAM,IAAI,MACT,uDAAuD,QAAQ,aAC/D;GAEF,MAAM,SAAS,MAAM,WAAW;IAC/B,aAAa;IACb,UAAU,QAAQ;IAClB,WAAW,KAAK,QAAQ,QAAQ,WAAW;IAC3C,GAAI,QAAQ,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW,QAAQ,cAAc;IACjF,CAAC;GACF,OAAO;IACN,OAAO,OAAO;IACd,aAAa,OAAO;IACpB,gBAAgB,OAAO;IACvB;KAEF;EACD,kBAAkB,EACjB,oBAAoB,aACnB,uBAAuB,UAAU,oBAAoB,EACtD;EACD"}
1
+ {"version":3,"file":"index.js","names":["isRecord","fs","net","createNativeManagedVm"],"sources":["../src/rootfs-init-extra.ts","../src/build-pipeline.ts","../src/exact-recorded-process-termination.ts","../src/gondolin-package.ts","../src/pinned-realfs.ts","../src/filtered-workspace-provider.ts","../src/host-network-defaults.ts","../src/vm-adapter.ts","../src/managed-vm-provider.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport const agentVmRootfsInitExtraScript = `# Generated by agent-vm.\n# Gondolin mounts devtmpfs over /dev at boot, so Docker-image /dev symlinks are hidden.\nmkdir -p /dev\nln -sfn /proc/self/fd /dev/fd 2>/dev/null || true\nln -sfn /proc/self/fd/0 /dev/stdin 2>/dev/null || true\nln -sfn /proc/self/fd/1 /dev/stdout 2>/dev/null || true\nln -sfn /proc/self/fd/2 /dev/stderr 2>/dev/null || true\nif [ ! -e /dev/ptmx ] && [ -e /dev/pts/ptmx ]; then\n ln -sfn pts/ptmx /dev/ptmx 2>/dev/null || true\nfi\n`;\n\ninterface PrepareRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly imagePath: string;\n\treadonly rootfsInitExtraContent: string;\n}\n\ninterface ResolveRootfsInitExtraOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}\n\n/**\n * Backend projection of the domain-owned managed Gateway boot contract.\n *\n * The projection is deliberately closed: callers select the framework image\n * entry, while executable paths, arguments, environment-input paths, and log\n * identities remain adapter-owned image behavior.\n */\nexport interface GondolinManagedGatewayBootProjection {\n\treadonly frameworkBootEntry: 'hermes-framework-service' | 'openclaw-framework-service';\n\treadonly kind: 'managed-gateway-exact-two-role';\n}\n\nexport interface ResolvedRootfsInitExtra {\n\treadonly content: string;\n\treadonly fingerprintInput: {\n\t\treadonly agentVmRootfsInitExtra: string;\n\t\treadonly deploymentRootfsInitExtra?: string;\n\t\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\t};\n}\n\nconst managedGatewayEnvironmentInputRoot = '/run/agent-vm/managed-gateway-environment';\nconst managedGatewayStructuredInputRoot = '/run/agent-vm/managed-gateway';\nconst managedGatewayRuntimeRoot = '/run/agent-vm/gateway-runtime';\nconst managedGatewayLogRoot = '/var/log/agent-vm';\n\nfunction frameworkBootCommand(\n\tframeworkBootEntry: GondolinManagedGatewayBootProjection['frameworkBootEntry'],\n): string {\n\tswitch (frameworkBootEntry) {\n\t\tcase 'hermes-framework-service':\n\t\t\treturn '/usr/local/bin/agent-vm-hermes-gateway';\n\t\tcase 'openclaw-framework-service':\n\t\t\treturn '/usr/local/bin/openclaw gateway --port 18789';\n\t}\n}\n\nfunction frameworkLogFileName(\n\tframeworkBootEntry: GondolinManagedGatewayBootProjection['frameworkBootEntry'],\n): string {\n\treturn frameworkBootEntry === 'openclaw-framework-service'\n\t\t? 'openclaw-service.log'\n\t\t: 'hermes-service.log';\n}\n\nexport function renderManagedGatewayRootfsInitScript(\n\tprojection: GondolinManagedGatewayBootProjection,\n): string {\n\tconst selectedFrameworkBootCommand = frameworkBootCommand(projection.frameworkBootEntry);\n\tconst selectedFrameworkLogPath = `${managedGatewayLogRoot}/${frameworkLogFileName(projection.frameworkBootEntry)}`;\n\tconst frameworkBootInputFileNames = 'framework-service.json';\n\tconst serviceEnvironmentIsolationPrefix =\n\t\tprojection.frameworkBootEntry === 'hermes-framework-service' ? '/usr/bin/env -i ' : '';\n\treturn `# Fixed managed Gateway sibling boot entries.\nmanaged_gateway_environment_input_root=${managedGatewayEnvironmentInputRoot}\nmanaged_gateway_structured_input_root=${managedGatewayStructuredInputRoot}\nmkdir -p ${managedGatewayLogRoot}\ninstall -d -m 0700 ${managedGatewayRuntimeRoot}\ninstall -m 0600 /dev/null ${managedGatewayLogRoot}/tool-portal-service.log\ninstall -m 0600 /dev/null ${selectedFrameworkLogPath}\n(\n if [ ! -f \"$managed_gateway_environment_input_root/tool-portal.environment.sh\" ]; then exit 78; fi\n for managed_gateway_input_name in tool-portal-service.json mcp.config.json; do\n if [ ! -f \"$managed_gateway_structured_input_root/$managed_gateway_input_name\" ]; then exit 78; fi\n done\n exec ${serviceEnvironmentIsolationPrefix}/bin/sh -c 'set -a; . ${managedGatewayEnvironmentInputRoot}/tool-portal.environment.sh || exit 78; set +a; rm -- ${managedGatewayEnvironmentInputRoot}/tool-portal.environment.sh || exit 78; exec /usr/local/bin/agent-vm-gateway-runtime --config ${managedGatewayStructuredInputRoot}/tool-portal-service.json'\n) >> ${managedGatewayLogRoot}/tool-portal-service.log 2>&1 &\n(\n if [ ! -f \"$managed_gateway_environment_input_root/framework.environment.sh\" ]; then exit 78; fi\n for managed_gateway_input_name in ${frameworkBootInputFileNames}; do\n if [ ! -f \"$managed_gateway_structured_input_root/$managed_gateway_input_name\" ]; then exit 78; fi\n done\n exec ${serviceEnvironmentIsolationPrefix}/bin/sh -c 'set -a; . ${managedGatewayEnvironmentInputRoot}/framework.environment.sh || exit 78; set +a; rm -- ${managedGatewayEnvironmentInputRoot}/framework.environment.sh || exit 78; exec ${selectedFrameworkBootCommand}'\n) >> ${selectedFrameworkLogPath} 2>&1 &\n`;\n}\n\nfunction resolveBuildConfigPath(filePath: string, configDir: string | undefined): string {\n\treturn path.isAbsolute(filePath) ? filePath : path.resolve(configDir ?? process.cwd(), filePath);\n}\n\nasync function readExistingRootfsInitExtra(\n\tbuildConfig: BuildConfig,\n\tconfigDir: string | undefined,\n): Promise<string | undefined> {\n\tconst existingRootfsInitExtra = buildConfig.init?.rootfsInitExtra;\n\tif (!existingRootfsInitExtra) {\n\t\treturn undefined;\n\t}\n\n\tconst resolvedRootfsInitExtra = resolveBuildConfigPath(existingRootfsInitExtra, configDir);\n\ttry {\n\t\treturn await fs.readFile(resolvedRootfsInitExtra, 'utf8');\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin rootfs init extra '${resolvedRootfsInitExtra}': ${message}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n\nfunction composeRootfsInitExtra(existingRootfsInitExtra: string | undefined): string {\n\treturn existingRootfsInitExtra\n\t\t? `${agentVmRootfsInitExtraScript.trimEnd()}\\n\\n${existingRootfsInitExtra}`\n\t\t: agentVmRootfsInitExtraScript;\n}\n\nexport async function resolveRootfsInitExtra(\n\toptions: ResolveRootfsInitExtraOptions,\n): Promise<ResolvedRootfsInitExtra> {\n\tif (options.managedGatewayBoot !== undefined && options.buildConfig.init?.rootfsInitExtra) {\n\t\tthrow new Error(\n\t\t\t'Managed Gateway images cannot compose deployment-authored rootfs init authority.',\n\t\t);\n\t}\n\tconst existingRootfsInitExtra = await readExistingRootfsInitExtra(\n\t\toptions.buildConfig,\n\t\toptions.configDir,\n\t);\n\tconst managedGatewayRootfsInitExtra =\n\t\toptions.managedGatewayBoot === undefined\n\t\t\t? undefined\n\t\t\t: renderManagedGatewayRootfsInitScript(options.managedGatewayBoot);\n\tconst composedRootfsInitExtra = composeRootfsInitExtra(existingRootfsInitExtra);\n\n\treturn {\n\t\tcontent:\n\t\t\tmanagedGatewayRootfsInitExtra === undefined\n\t\t\t\t? composedRootfsInitExtra\n\t\t\t\t: `${composedRootfsInitExtra.trimEnd()}\\n\\n${managedGatewayRootfsInitExtra}`,\n\t\tfingerprintInput: {\n\t\t\tagentVmRootfsInitExtra: agentVmRootfsInitExtraScript,\n\t\t\t...(existingRootfsInitExtra === undefined\n\t\t\t\t? {}\n\t\t\t\t: { deploymentRootfsInitExtra: existingRootfsInitExtra }),\n\t\t\t...(options.managedGatewayBoot === undefined\n\t\t\t\t? {}\n\t\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t\t},\n\t};\n}\n\nexport async function prepareBuildConfigWithAgentVmRootfsInitExtra(\n\toptions: PrepareRootfsInitExtraOptions,\n): Promise<BuildConfig> {\n\tconst rootfsInitExtraPath = path.join(options.imagePath, 'agent-vm-rootfs-init-extra.sh');\n\n\tawait fs.writeFile(rootfsInitExtraPath, options.rootfsInitExtraContent, {\n\t\tencoding: 'utf8',\n\t\tmode: 0o755,\n\t});\n\n\treturn {\n\t\t...options.buildConfig,\n\t\tinit: {\n\t\t\t...options.buildConfig.init,\n\t\t\trootfsInitExtra: rootfsInitExtraPath,\n\t\t},\n\t};\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport type { BuildConfig, BuildOptions } from '@earendil-works/gondolin';\nimport { validateBuildConfig } from '@earendil-works/gondolin';\n\nimport {\n\tprepareBuildConfigWithAgentVmRootfsInitExtra,\n\tresolveRootfsInitExtra,\n\ttype GondolinManagedGatewayBootProjection,\n} from './rootfs-init-extra.js';\n\nexport type { BuildConfig } from '@earendil-works/gondolin';\n\nexport interface BuildImageOptions {\n\treadonly buildConfig: BuildConfig;\n\treadonly cacheDir: string;\n\t/** Directory to resolve relative paths in buildConfig (e.g. postBuild.copy.src).\n\t * Defaults to process.cwd() if not provided. */\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\treadonly output?: BuildOutput;\n}\n\nexport interface BuildOutput {\n\twrite(chunk: string | Uint8Array): boolean;\n}\n\nexport interface BuildImageResult {\n\treadonly built: boolean;\n\treadonly fingerprint: string;\n\treadonly imagePath: string;\n}\n\nexport interface GondolinImageBuildToolingOptions {\n\treadonly buildConfig: unknown;\n\treadonly cacheDir: string;\n\treadonly configDir?: string;\n\treadonly fullReset?: boolean;\n\treadonly fingerprintInput?: unknown;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n\treadonly output?: BuildOutput;\n}\n\nexport interface GondolinImageFingerprintOptions {\n\treadonly buildConfig: unknown;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}\n\nexport interface GondolinImageBuildTooling {\n\tbuildImage(\n\t\toptions: GondolinImageBuildToolingOptions,\n\t\tdependencies?: { readonly gondolinVersion?: string },\n\t): Promise<BuildImageResult>;\n\tcomputeFingerprint(options: GondolinImageFingerprintOptions): Promise<string>;\n}\n\nexport const buildImageAssetFileNames = [\n\t'manifest.json',\n\t'rootfs.ext4',\n\t'initramfs.cpio.lz4',\n\t'vmlinuz-virt',\n] as const;\n\nfunction requireValidBuildConfig(buildConfig: unknown): BuildConfig {\n\tif (!validateBuildConfig(buildConfig)) {\n\t\tthrow new Error('Managed VM image recipe has an invalid build shape.');\n\t}\n\treturn buildConfig;\n}\n\nexport function createGondolinImageBuildTooling(): GondolinImageBuildTooling {\n\treturn {\n\t\tasync buildImage(options, dependencies) {\n\t\t\treturn await buildImage(\n\t\t\t\t{\n\t\t\t\t\t...options,\n\t\t\t\t\tbuildConfig: requireValidBuildConfig(options.buildConfig),\n\t\t\t\t},\n\t\t\t\tdependencies,\n\t\t\t);\n\t\t},\n\t\tasync computeFingerprint(options) {\n\t\t\tconst result = await computeEffectiveBuildFingerprint({\n\t\t\t\t...options,\n\t\t\t\tbuildConfig: requireValidBuildConfig(options.buildConfig),\n\t\t\t});\n\t\t\treturn result.fingerprint;\n\t\t},\n\t};\n}\n\ninterface BuildPipelineDependencies {\n\treadonly buildAssets?: (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t) => Promise<unknown>;\n\treadonly gondolinVersion?: string;\n}\n\nconst inFlightImageBuilds = new Map<string, Promise<BuildImageResult>>();\nconst gondolinWorkDirectoryName = '.agent-vm-gondolin-work';\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null;\n}\n\nfunction stableSerialize(value: unknown): string {\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((entry) => stableSerialize(entry)).join(',')}]`;\n\t}\n\n\tif (isRecord(value)) {\n\t\tconst objectEntries = Object.entries(value)\n\t\t\t.filter(([, entryValue]) => entryValue !== undefined)\n\t\t\t.toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey));\n\t\treturn `{${objectEntries\n\t\t\t.map(([entryKey, entryValue]) => `${JSON.stringify(entryKey)}:${stableSerialize(entryValue)}`)\n\t\t\t.join(',')}}`;\n\t}\n\n\treturn JSON.stringify(value);\n}\n\nfunction isMissingPathError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nasync function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait fs.access(filePath);\n\t\treturn true;\n\t} catch (error) {\n\t\tif (!isMissingPathError(error)) {\n\t\t\tthrow error;\n\t\t}\n\t\treturn false;\n\t}\n}\n\nexport async function hasBuiltImageAssets(outputDirectoryPath: string): Promise<boolean> {\n\tfor (const fileName of buildImageAssetFileNames) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- each missing file points at the same image generation\n\t\tif (!(await pathExists(path.join(outputDirectoryPath, fileName)))) {\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n\nasync function loadBuildAssets(): Promise<\n\t(\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t) => Promise<unknown>\n> {\n\tconst gondolinModule = await import('@earendil-works/gondolin');\n\treturn async (\n\t\tbuildConfig: BuildConfig,\n\t\toutputDirectory: string,\n\t\tconfigDir?: string,\n\t\tworkDir?: string,\n\t\tverbose?: boolean,\n\t): Promise<unknown> =>\n\t\tawait gondolinModule.buildAssets(buildConfig, {\n\t\t\toutputDir: outputDirectory,\n\t\t\tverbose: verbose ?? false,\n\t\t\t...(configDir ? { configDir } : {}),\n\t\t\t...(workDir ? { workDir } : {}),\n\t\t} satisfies BuildOptions);\n}\n\nfunction createRedirectedWrite(output: BuildOutput): typeof process.stderr.write {\n\treturn ((\n\t\tchunk: string | Uint8Array,\n\t\tencodingOrCallback?: BufferEncoding | ((error?: Error | null) => void),\n\t\tcallback?: (error?: Error | null) => void,\n\t): boolean => {\n\t\tconst writeCallback = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;\n\t\tconst wrote = output.write(chunk);\n\t\twriteCallback?.();\n\t\treturn wrote;\n\t}) as typeof process.stderr.write;\n}\n\nasync function withCapturedBuildOutput<TResult>(\n\toutput: BuildOutput | undefined,\n\tfn: () => Promise<TResult>,\n): Promise<TResult> {\n\tif (!output) {\n\t\treturn await fn();\n\t}\n\n\tconst originalStderrWrite = process.stderr.write.bind(process.stderr);\n\tconst originalStdoutWrite = process.stdout.write.bind(process.stdout);\n\tconst originalCi = process.env.CI;\n\tconst redirectedWrite = createRedirectedWrite(output);\n\n\tprocess.stderr.write = redirectedWrite;\n\tprocess.stdout.write = redirectedWrite;\n\tprocess.env.CI = 'true';\n\n\ttry {\n\t\treturn await fn();\n\t} finally {\n\t\tprocess.stderr.write = originalStderrWrite;\n\t\tprocess.stdout.write = originalStdoutWrite;\n\t\tif (originalCi === undefined) {\n\t\t\tdelete process.env.CI;\n\t\t} else {\n\t\t\tprocess.env.CI = originalCi;\n\t\t}\n\t}\n}\n\nexport function computeBuildFingerprint(\n\tbuildConfig: BuildConfig,\n\tgondolinVersion: string = 'unknown',\n\tfingerprintInput?: unknown,\n): string {\n\tconst payload =\n\t\tfingerprintInput === undefined\n\t\t\t? `${stableSerialize(buildConfig)}|${gondolinVersion}`\n\t\t\t: `${stableSerialize(buildConfig)}|${gondolinVersion}|${stableSerialize(fingerprintInput)}`;\n\n\treturn crypto.createHash('sha256').update(payload).digest('hex').slice(0, 16);\n}\n\nexport async function computeEffectiveBuildFingerprint(options: {\n\treadonly buildConfig: BuildConfig;\n\treadonly configDir?: string;\n\treadonly fingerprintInput?: unknown;\n\treadonly gondolinVersion?: string;\n\treadonly managedGatewayBoot?: GondolinManagedGatewayBootProjection;\n}): Promise<{\n\treadonly fingerprint: string;\n\treadonly rootfsInitExtraContent: string;\n}> {\n\tconst resolvedRootfsInitExtra = await resolveRootfsInitExtra({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.managedGatewayBoot === undefined\n\t\t\t? {}\n\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t});\n\tconst fingerprint = computeBuildFingerprint(options.buildConfig, options.gondolinVersion, {\n\t\tagentVmRootfsInitExtra: resolvedRootfsInitExtra.fingerprintInput,\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { callerFingerprintInput: options.fingerprintInput }),\n\t});\n\n\treturn {\n\t\tfingerprint,\n\t\trootfsInitExtraContent: resolvedRootfsInitExtra.content,\n\t};\n}\n\nexport async function buildImage(\n\toptions: BuildImageOptions,\n\tdependencies: BuildPipelineDependencies = {},\n): Promise<BuildImageResult> {\n\tconst effectiveBuildFingerprint = await computeEffectiveBuildFingerprint({\n\t\tbuildConfig: options.buildConfig,\n\t\t...(options.configDir ? { configDir: options.configDir } : {}),\n\t\t...(options.fingerprintInput === undefined\n\t\t\t? {}\n\t\t\t: { fingerprintInput: options.fingerprintInput }),\n\t\t...(options.managedGatewayBoot === undefined\n\t\t\t? {}\n\t\t\t: { managedGatewayBoot: options.managedGatewayBoot }),\n\t\t...(dependencies.gondolinVersion ? { gondolinVersion: dependencies.gondolinVersion } : {}),\n\t});\n\tconst fingerprint = effectiveBuildFingerprint.fingerprint;\n\tconst imagePath = path.join(options.cacheDir, fingerprint);\n\tconst buildImageForFingerprint = async (): Promise<BuildImageResult> => {\n\t\tif (options.fullReset) {\n\t\t\tawait fs.rm(imagePath, { recursive: true, force: true });\n\t\t}\n\n\t\tif (await hasBuiltImageAssets(imagePath)) {\n\t\t\treturn {\n\t\t\t\tbuilt: false,\n\t\t\t\tfingerprint,\n\t\t\t\timagePath,\n\t\t\t};\n\t\t}\n\n\t\tawait fs.mkdir(imagePath, { recursive: true });\n\t\tconst buildAssetsImplementation = dependencies.buildAssets ?? (await loadBuildAssets());\n\t\tconst effectiveBuildConfig = await prepareBuildConfigWithAgentVmRootfsInitExtra({\n\t\t\tbuildConfig: options.buildConfig,\n\t\t\timagePath,\n\t\t\trootfsInitExtraContent: effectiveBuildFingerprint.rootfsInitExtraContent,\n\t\t});\n\t\tconst gondolinWorkDir = path.join(imagePath, gondolinWorkDirectoryName);\n\t\tawait fs.rm(gondolinWorkDir, { recursive: true, force: true });\n\t\ttry {\n\t\t\tawait withCapturedBuildOutput(options.output, async () => {\n\t\t\t\tawait buildAssetsImplementation(\n\t\t\t\t\teffectiveBuildConfig,\n\t\t\t\t\timagePath,\n\t\t\t\t\toptions.configDir,\n\t\t\t\t\tgondolinWorkDir,\n\t\t\t\t\toptions.output !== undefined,\n\t\t\t\t);\n\t\t\t});\n\t\t} finally {\n\t\t\tawait fs.rm(gondolinWorkDir, { recursive: true, force: true });\n\t\t}\n\n\t\tif (!(await hasBuiltImageAssets(imagePath))) {\n\t\t\tthrow new Error(`Expected Gondolin assets to be written to ${imagePath}.`);\n\t\t}\n\n\t\treturn {\n\t\t\tbuilt: true,\n\t\t\tfingerprint,\n\t\t\timagePath,\n\t\t};\n\t};\n\n\tif (options.output) {\n\t\treturn await buildImageForFingerprint();\n\t}\n\n\tconst inFlightKey = path.resolve(imagePath);\n\tconst existingBuild = inFlightImageBuilds.get(inFlightKey);\n\tif (existingBuild) {\n\t\treturn await existingBuild;\n\t}\n\tconst buildPromise = buildImageForFingerprint();\n\tinFlightImageBuilds.set(inFlightKey, buildPromise);\n\ttry {\n\t\treturn await buildPromise;\n\t} finally {\n\t\tif (inFlightImageBuilds.get(inFlightKey) === buildPromise) {\n\t\t\tinFlightImageBuilds.delete(inFlightKey);\n\t\t}\n\t}\n}\n","import { execFile } from 'node:child_process';\nimport { basename } from 'node:path';\nimport { promisify } from 'node:util';\n\nimport type {\n\tManagedVmExactProcessTerminationCapability,\n\tManagedVmExactProcessTerminationOutcome,\n\tManagedVmHostProcessIdentity,\n} from '@agent-vm/managed-vm';\n\nconst execFileAsync = promisify(execFile);\nconst terminationStageTimeoutMs = 2_000;\nconst processIdentityPollIntervalMs = 100;\nconst darwinProcessCommandNameLimit = 16;\nconst linuxTaskCommandNameLimit = 15;\n\nexport interface GondolinHostProcessIdentity {\n\treadonly command: string;\n\treadonly processState: string;\n\treadonly processStartIdentity: string;\n}\n\nexport interface GondolinProcessTerminationDependencies {\n\treadonly now: () => number;\n\treadonly readProcessIdentity: (\n\t\thostProcessId: number,\n\t) => Promise<GondolinHostProcessIdentity | null>;\n\treadonly sendSignal: (hostProcessId: number, signal: NodeJS.Signals) => void;\n\treadonly sleep: (delayMs: number) => Promise<void>;\n}\n\ntype RecordedProcessObservation = 'absent' | 'exact';\ntype RecordedProcessObservationMode = 'after-signal' | 'before-signal';\n\nfunction processErrorCode(error: unknown): unknown {\n\treturn typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;\n}\n\nfunction isManagedVmHostCommand(command: string): boolean {\n\treturn /\\b(qemu-system|krun)\\b/u.test(command);\n}\n\nfunction isMatchingDarwinFallbackCommand(options: {\n\treadonly currentCommand: string;\n\treadonly recordedCommand: string;\n}): boolean {\n\tconst fallbackCommandMatch = /^\\(([^()]+)\\)$/u.exec(options.currentCommand);\n\tif (fallbackCommandMatch === null) {\n\t\treturn false;\n\t}\n\tconst recordedExecutable = options.recordedCommand.split(/[ \\t]/u, 1)[0];\n\tif (recordedExecutable === undefined || recordedExecutable.length === 0) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfallbackCommandMatch[1] === basename(recordedExecutable).slice(0, darwinProcessCommandNameLimit)\n\t);\n}\n\nfunction isMatchingLinuxTaskFallbackCommand(options: {\n\treadonly currentCommand: string;\n\treadonly recordedCommand: string;\n}): boolean {\n\tconst fallbackCommandMatch = /^\\[([^\\r\\n]+)\\]$/u.exec(options.currentCommand);\n\tif (fallbackCommandMatch === null) {\n\t\treturn false;\n\t}\n\tconst recordedExecutable = options.recordedCommand.split(/[ \\t]/u, 1)[0];\n\tif (recordedExecutable === undefined || recordedExecutable.length === 0) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfallbackCommandMatch[1] === basename(recordedExecutable).slice(0, linuxTaskCommandNameLimit)\n\t);\n}\n\nfunction findProcessCommandBoundary(processDescription: string): number | null {\n\tlet tokenCount = 0;\n\tlet insideToken = false;\n\tfor (let index = 0; index < processDescription.length; index += 1) {\n\t\tconst character = processDescription[index];\n\t\tconst isWhitespace = character === ' ' || character === '\\t';\n\t\tif (!isWhitespace && !insideToken) {\n\t\t\tinsideToken = true;\n\t\t} else if (isWhitespace && insideToken) {\n\t\t\tinsideToken = false;\n\t\t\ttokenCount += 1;\n\t\t\tif (tokenCount === 5) {\n\t\t\t\treturn index;\n\t\t\t}\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction parseProcessIdentityOutput(\n\thostProcessId: number,\n\tprocessDescription: string,\n): GondolinHostProcessIdentity {\n\tconst trimmedDescription = processDescription.trim();\n\tconst processStateBoundary = trimmedDescription.search(/[ \\t]/u);\n\tif (processStateBoundary === -1) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`,\n\t\t);\n\t}\n\tconst processState = trimmedDescription.slice(0, processStateBoundary).trim();\n\tconst startAndCommandDescription = trimmedDescription.slice(processStateBoundary).trim();\n\tconst commandBoundary = findProcessCommandBoundary(startAndCommandDescription);\n\tif (commandBoundary === null) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned malformed identity output.`,\n\t\t);\n\t}\n\tconst processStartIdentity = startAndCommandDescription.slice(0, commandBoundary).trim();\n\tconst command = startAndCommandDescription.slice(commandBoundary).trim();\n\tif (processState.length === 0 || processStartIdentity.length === 0 || command.length === 0) {\n\t\tthrow new Error(\n\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps omitted the process state, start, or command.`,\n\t\t);\n\t}\n\treturn { command, processStartIdentity, processState };\n}\n\nasync function readGondolinHostProcessIdentity(\n\thostProcessId: number,\n): Promise<GondolinHostProcessIdentity | null> {\n\ttry {\n\t\tconst { stdout } = await execFileAsync('ps', [\n\t\t\t'-p',\n\t\t\tString(hostProcessId),\n\t\t\t'-o',\n\t\t\t'state=',\n\t\t\t'-o',\n\t\t\t'lstart=',\n\t\t\t'-o',\n\t\t\t'command=',\n\t\t]);\n\t\tif (stdout.trim().length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Unable to confirm host process identity for pid ${String(hostProcessId)} because ps returned empty output.`,\n\t\t\t);\n\t\t}\n\t\treturn parseProcessIdentityOutput(hostProcessId, stdout);\n\t} catch (error) {\n\t\tif (processErrorCode(error) === 1) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nfunction sendHostProcessSignal(hostProcessId: number, signal: NodeJS.Signals): void {\n\tprocess.kill(hostProcessId, signal);\n}\n\nasync function sleep(delayMs: number): Promise<void> {\n\tawait new Promise((resolve) => setTimeout(resolve, delayMs));\n}\n\nconst defaultDependencies = {\n\tnow: Date.now,\n\treadProcessIdentity: readGondolinHostProcessIdentity,\n\tsendSignal: sendHostProcessSignal,\n\tsleep,\n} satisfies GondolinProcessTerminationDependencies;\n\nfunction assertTerminationRequest(request: {\n\treadonly contextLabel: string;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): void {\n\tif (request.contextLabel.trim().length === 0) {\n\t\tthrow new Error('Exact managed VM process termination requires a non-empty context label.');\n\t}\n\tif (\n\t\t!Number.isSafeInteger(request.identity.hostProcessId) ||\n\t\trequest.identity.hostProcessId <= 0\n\t) {\n\t\tthrow new Error('Exact managed VM process termination requires a positive safe host pid.');\n\t}\n\tif (\n\t\trequest.identity.vmId.length === 0 ||\n\t\trequest.identity.processStartIdentity.length === 0 ||\n\t\trequest.identity.command.length === 0\n\t) {\n\t\tthrow new Error('Exact managed VM process termination requires complete recorded identity.');\n\t}\n}\n\nasync function observeRecordedProcess(options: {\n\treadonly action: string;\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n\treadonly mode: RecordedProcessObservationMode;\n}): Promise<RecordedProcessObservation> {\n\tconst currentIdentity = await options.dependencies.readProcessIdentity(\n\t\toptions.identity.hostProcessId,\n\t);\n\tif (currentIdentity === null) {\n\t\treturn 'absent';\n\t}\n\tif (currentIdentity.processStartIdentity !== options.identity.processStartIdentity) {\n\t\treturn 'absent';\n\t}\n\tif (currentIdentity.processState.startsWith('Z')) {\n\t\treturn 'absent';\n\t}\n\tif (options.mode === 'after-signal' && currentIdentity.processState.includes('E')) {\n\t\treturn 'exact';\n\t}\n\tif (\n\t\toptions.mode === 'after-signal' &&\n\t\t(currentIdentity.processState.startsWith('U') ||\n\t\t\tcurrentIdentity.processState.startsWith('R')) &&\n\t\t(isMatchingDarwinFallbackCommand({\n\t\t\tcurrentCommand: currentIdentity.command,\n\t\t\trecordedCommand: options.identity.command,\n\t\t}) ||\n\t\t\tisMatchingLinuxTaskFallbackCommand({\n\t\t\t\tcurrentCommand: currentIdentity.command,\n\t\t\t\trecordedCommand: options.identity.command,\n\t\t\t}))\n\t) {\n\t\treturn 'exact';\n\t}\n\tif (currentIdentity.command !== options.identity.command) {\n\t\tthrow new Error(\n\t\t\t`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)}: same process start identity was observed with state ${JSON.stringify(currentIdentity.processState)} but command changed (recorded ${JSON.stringify(options.identity.command)}, current ${JSON.stringify(currentIdentity.command)}).`,\n\t\t);\n\t}\n\tif (!isManagedVmHostCommand(currentIdentity.command)) {\n\t\tthrow new Error(\n\t\t\t`${options.contextLabel} refusing ${options.action} pid ${String(options.identity.hostProcessId)} because the exact command is not a managed VM process.`,\n\t\t);\n\t}\n\treturn 'exact';\n}\n\nasync function waitForRecordedProcessAbsence(options: {\n\treadonly afterSignal: NodeJS.Signals;\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): Promise<boolean> {\n\tconst deadline = options.dependencies.now() + terminationStageTimeoutMs;\n\twhile (options.dependencies.now() < deadline) {\n\t\t// oxlint-disable-next-line no-await-in-loop -- exact identity observations must remain ordered\n\t\tconst observation = await observeRecordedProcess({\n\t\t\taction: `continued containment after ${options.afterSignal} for`,\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t\tmode: 'after-signal',\n\t\t});\n\t\tif (observation === 'absent') {\n\t\t\treturn true;\n\t\t}\n\t\t// oxlint-disable-next-line no-await-in-loop -- bounded process identity polling is sequential\n\t\tawait options.dependencies.sleep(processIdentityPollIntervalMs);\n\t}\n\treturn (\n\t\t(await observeRecordedProcess({\n\t\t\taction: `continued containment after ${options.afterSignal} for`,\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t\tmode: 'after-signal',\n\t\t})) === 'absent'\n\t);\n}\n\nfunction signalRecordedProcess(options: {\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly hostProcessId: number;\n\treadonly signal: NodeJS.Signals;\n}): void {\n\ttry {\n\t\toptions.dependencies.sendSignal(options.hostProcessId, options.signal);\n\t} catch (error) {\n\t\tif (processErrorCode(error) !== 'ESRCH') {\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n\nexport async function terminateExactRecordedManagedVmHostProcess(options: {\n\treadonly contextLabel: string;\n\treadonly dependencies: GondolinProcessTerminationDependencies;\n\treadonly identity: ManagedVmHostProcessIdentity;\n}): Promise<ManagedVmExactProcessTerminationOutcome> {\n\tassertTerminationRequest(options);\n\tconst initialObservation = await observeRecordedProcess({\n\t\taction: 'SIGTERM to',\n\t\tcontextLabel: options.contextLabel,\n\t\tdependencies: options.dependencies,\n\t\tidentity: options.identity,\n\t\tmode: 'before-signal',\n\t});\n\tif (initialObservation === 'absent') {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'already-absent' };\n\t}\n\n\tsignalRecordedProcess({\n\t\tdependencies: options.dependencies,\n\t\thostProcessId: options.identity.hostProcessId,\n\t\tsignal: 'SIGTERM',\n\t});\n\tif (\n\t\tawait waitForRecordedProcessAbsence({\n\t\t\tafterSignal: 'SIGTERM',\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t})\n\t) {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\n\tconst beforeKillObservation = await observeRecordedProcess({\n\t\taction: 'SIGKILL to',\n\t\tcontextLabel: options.contextLabel,\n\t\tdependencies: options.dependencies,\n\t\tidentity: options.identity,\n\t\tmode: 'after-signal',\n\t});\n\tif (beforeKillObservation === 'absent') {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\tsignalRecordedProcess({\n\t\tdependencies: options.dependencies,\n\t\thostProcessId: options.identity.hostProcessId,\n\t\tsignal: 'SIGKILL',\n\t});\n\tif (\n\t\tawait waitForRecordedProcessAbsence({\n\t\t\tafterSignal: 'SIGKILL',\n\t\t\tcontextLabel: options.contextLabel,\n\t\t\tdependencies: options.dependencies,\n\t\t\tidentity: options.identity,\n\t\t})\n\t) {\n\t\treturn { hostProcessId: options.identity.hostProcessId, kind: 'terminated' };\n\t}\n\n\tthrow new Error(\n\t\t`Failed to terminate exact recorded managed VM process ${String(options.identity.hostProcessId)} (${options.contextLabel}).`,\n\t);\n}\n\nexport function createGondolinExactProcessTerminationCapability(\n\tdependencies: GondolinProcessTerminationDependencies = defaultDependencies,\n): ManagedVmExactProcessTerminationCapability {\n\treturn {\n\t\tasync terminateRecordedHostProcess(request): Promise<ManagedVmExactProcessTerminationOutcome> {\n\t\t\treturn await terminateExactRecordedManagedVmHostProcess({\n\t\t\t\tcontextLabel: request.contextLabel,\n\t\t\t\tdependencies,\n\t\t\t\tidentity: request.identity,\n\t\t\t});\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\n\nimport { z } from 'zod';\n\nconst requireFromHere = createRequire(import.meta.url);\n\nconst gondolinPackageJsonSchema = z.object({\n\tversion: z.string().min(1),\n});\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';\n}\n\nfunction getErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nexport function parseMinimumZigVersion(rawContents: string): string {\n\tconst match = rawContents.match(/\\.minimum_zig_version\\s*=\\s*\"([^\"]*)\"/u);\n\tif (!match) {\n\t\tthrow new Error(\n\t\t\t'minimum_zig_version declaration not found. Expected a line like `.minimum_zig_version = \"0.15.2\"`.',\n\t\t);\n\t}\n\n\tconst version = match[1];\n\tif (!version) {\n\t\tthrow new Error('minimum_zig_version is empty.');\n\t}\n\treturn version;\n}\n\nexport function resolveGondolinPackageJsonPath(): string {\n\treturn requireFromHere.resolve('@earendil-works/gondolin/package.json');\n}\n\nexport async function resolveGondolinPackageSpec(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\tconst parsed: unknown = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));\n\tconst packageJson = gondolinPackageJsonSchema.parse(parsed);\n\treturn `@earendil-works/gondolin@${packageJson.version}`;\n}\n\nexport interface ResolveGondolinMinimumZigVersionOptions {\n\treadonly buildZigZonPath?: string;\n}\n\nasync function resolveDefaultBuildZigZonPath(): Promise<string> {\n\tconst packageJsonPath = resolveGondolinPackageJsonPath();\n\treturn path.join(path.dirname(packageJsonPath), 'dist', 'guest', 'build.zig.zon');\n}\n\nexport async function resolveGondolinMinimumZigVersion(\n\toptions: ResolveGondolinMinimumZigVersionOptions = {},\n): Promise<string> {\n\tconst zonPath = options.buildZigZonPath ?? (await resolveDefaultBuildZigZonPath());\n\tlet rawContents: string;\n\ttry {\n\t\trawContents = await fs.readFile(zonPath, 'utf8');\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) {\n\t\t\tthrow new Error(`Missing Gondolin build.zig.zon at '${zonPath}'.`, { cause: error });\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Failed to read Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\n\ttry {\n\t\treturn parseMinimumZigVersion(rawContents);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to parse Gondolin build.zig.zon at '${zonPath}': ${getErrorMessage(error)}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { VirtualProvider } from '@earendil-works/gondolin';\n\nexport interface PinnedRealFsRoot {\n\treadonly hostPath: string;\n\treadonly realPath: string;\n\treadonly fd: number;\n\treadonly device: number;\n\treadonly inode: number;\n}\n\nexport interface CreatePinnedRealFsProviderOptions {\n\treadonly root: PinnedRealFsRoot;\n\treadonly createRealFsProvider: (hostPath: string) => VirtualProvider;\n}\n\nconst terminallyClosedPinnedRoots = new WeakSet<PinnedRealFsRoot>();\n\nfunction formatRootIdentity(root: PinnedRealFsRoot): string {\n\treturn `${root.device}:${root.inode}`;\n}\n\nfunction openDirectoryNoFollow(candidatePath: string): number {\n\treturn fs.openSync(\n\t\tcandidatePath,\n\t\tfs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,\n\t);\n}\n\nexport function pinRealFsRoot(hostPath: string): PinnedRealFsRoot {\n\tif (!hostPath || !path.isAbsolute(hostPath)) {\n\t\tthrow new Error(`Pinned RealFS root must be a non-empty absolute path: ${hostPath}`);\n\t}\n\n\tconst resolvedHostPath = path.resolve(hostPath);\n\tconst fd = openDirectoryNoFollow(resolvedHostPath);\n\ttry {\n\t\tconst stats = fs.fstatSync(fd);\n\t\tif (!stats.isDirectory()) {\n\t\t\tthrow new Error(`Pinned RealFS root is not a directory: ${resolvedHostPath}`);\n\t\t}\n\t\tconst realPath = fs.realpathSync(resolvedHostPath);\n\t\tconst realPathStats = fs.statSync(realPath);\n\t\tif (realPathStats.dev !== stats.dev || realPathStats.ino !== stats.ino) {\n\t\t\tthrow new Error(\n\t\t\t\t`Pinned RealFS root changed while opening: ${resolvedHostPath} opened ${stats.dev}:${stats.ino} but resolved to ${realPathStats.dev}:${realPathStats.ino}`,\n\t\t\t);\n\t\t}\n\t\treturn {\n\t\t\tdevice: stats.dev,\n\t\t\tfd,\n\t\t\thostPath: resolvedHostPath,\n\t\t\tinode: stats.ino,\n\t\t\trealPath,\n\t\t};\n\t} catch (error) {\n\t\tfs.closeSync(fd);\n\t\tthrow error;\n\t}\n}\n\nexport function closePinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tif (terminallyClosedPinnedRoots.has(root)) {\n\t\treturn;\n\t}\n\tfs.closeSync(root.fd);\n\tterminallyClosedPinnedRoots.add(root);\n}\n\nexport function assertPinnedRealFsRoot(root: PinnedRealFsRoot): void {\n\tconst pinnedStats = fs.fstatSync(root.fd);\n\tconst currentStats = fs.statSync(root.realPath);\n\tif (\n\t\tpinnedStats.dev !== root.device ||\n\t\tpinnedStats.ino !== root.inode ||\n\t\tcurrentStats.dev !== root.device ||\n\t\tcurrentStats.ino !== root.inode\n\t) {\n\t\tthrow new Error(\n\t\t\t`Pinned RealFS root changed before mount access: ${root.realPath} expected ${formatRootIdentity(root)} got ${currentStats.dev}:${currentStats.ino}`,\n\t\t);\n\t}\n}\n\ntype ProviderMethod = (...args: unknown[]) => unknown;\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- Reflect.get()\n loses the method signature from Gondolin's VirtualProvider union. The proxy\n keeps the same provider object and only wraps callable properties with the\n pinned-root assertion. */\nexport function createPinnedRealFsProvider(\n\toptions: CreatePinnedRealFsProviderOptions,\n): VirtualProvider {\n\tassertPinnedRealFsRoot(options.root);\n\tconst provider = options.createRealFsProvider(options.root.realPath);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tassertPinnedRealFsRoot(options.root);\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n/* oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n","import path from 'node:path';\n\nimport type { ManagedVmFilteredWorkspacePolicy } from '@agent-vm/managed-vm';\nimport {\n\tERRNO,\n\tVirtualDirent,\n\tcreateVirtualDirStats,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype VirtualProvider,\n} from '@earendil-works/gondolin';\n\nexport interface FilteredWorkspaceProviderDependencies {\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n}\n\nexport interface CreateFilteredWorkspaceProviderOptions {\n\treadonly baseProvider: VirtualProvider;\n\treadonly dependencies: FilteredWorkspaceProviderDependencies;\n\treadonly policy: ManagedVmFilteredWorkspacePolicy;\n}\n\ntype ProviderMethod = (...methodArguments: readonly unknown[]) => unknown;\n\nfunction toAbsoluteProviderPath(relativePath: string): string {\n\treturn `/${relativePath}`;\n}\n\nfunction normalizeProviderPath(providerPath: string): string {\n\tconst absolutePath = providerPath.startsWith('/') ? providerPath : `/${providerPath}`;\n\treturn path.posix.normalize(absolutePath);\n}\n\nfunction toRelativeProviderPath(providerPath: string): string {\n\tconst normalizedPath = normalizeProviderPath(providerPath);\n\treturn normalizedPath === '/' ? '' : normalizedPath.slice(1);\n}\n\nfunction isEqualOrDescendant(candidatePath: string, ancestorPath: string): boolean {\n\treturn (\n\t\tancestorPath.length === 0 ||\n\t\tcandidatePath === ancestorPath ||\n\t\tcandidatePath.startsWith(`${ancestorPath}/`)\n\t);\n}\n\nfunction pathsOverlap(firstPath: string, secondPath: string): boolean {\n\treturn isEqualOrDescendant(firstPath, secondPath) || isEqualOrDescendant(secondPath, firstPath);\n}\n\nfunction createFilesystemPolicyError(\n\tcode: 'EACCES' | 'ENOENT' | 'EROFS',\n\tsyscall: string,\n\tproviderPath: string,\n): Error & { readonly code: 'EACCES' | 'ENOENT' | 'EROFS'; readonly errno: number } {\n\treturn Object.assign(new Error(`${code}: ${syscall} '${providerPath}'`), {\n\t\tcode,\n\t\terrno: ERRNO[code],\n\t\tpath: providerPath,\n\t\tsyscall,\n\t});\n}\n\nfunction invokeProviderMethod(\n\tprovider: VirtualProvider,\n\tproperty: string | symbol,\n\tmethodArguments: readonly unknown[],\n): unknown {\n\tconst method = Reflect.get(provider, property, provider) as unknown;\n\tif (typeof method !== 'function') {\n\t\treturn method;\n\t}\n\treturn Reflect.apply(method as ProviderMethod, provider, methodArguments);\n}\n\nconst singlePathMutationMethods = new Set([\n\t'appendFile',\n\t'appendFileSync',\n\t'mkdir',\n\t'mkdirSync',\n\t'rmdir',\n\t'rmdirSync',\n\t'symlink',\n\t'symlinkSync',\n\t'truncate',\n\t'truncateSync',\n\t'unlink',\n\t'unlinkSync',\n\t'writeFile',\n\t'writeFileSync',\n]);\n\nfunction mutationPathArgumentIndex(property: string): number {\n\treturn property === 'symlink' || property === 'symlinkSync' ? 1 : 0;\n}\n\nfunction failProviderMutation(property: string, providerPath: string): unknown {\n\treturn failProviderOperation(property, providerPath, 'EROFS');\n}\n\nfunction failProviderOperation(\n\tproperty: string,\n\tproviderPath: string,\n\tcode: 'EACCES' | 'ENOENT' | 'EROFS',\n): unknown {\n\tconst operationError = createFilesystemPolicyError(code, property, providerPath);\n\tif (property.endsWith('Sync')) {\n\t\tthrow operationError;\n\t}\n\treturn Promise.reject(operationError);\n}\n\nfunction createRelativeRootProvider(\n\tprovider: VirtualProvider,\n\tsourceRelativePath: string,\n): VirtualProvider {\n\tconst sourceProviderPath = toAbsoluteProviderPath(sourceRelativePath);\n\tconst translatePath = (providerPath: string): string => {\n\t\tconst suffix = toRelativeProviderPath(providerPath);\n\t\treturn toAbsoluteProviderPath(\n\t\t\tsuffix.length === 0 ? sourceRelativePath : `${sourceRelativePath}/${suffix}`,\n\t\t);\n\t};\n\tconst translateArguments = (\n\t\tproperty: string,\n\t\tmethodArguments: readonly unknown[],\n\t): readonly unknown[] => {\n\t\tconst translatedArguments = [...methodArguments];\n\t\tif (\n\t\t\tproperty === 'rename' ||\n\t\t\tproperty === 'renameSync' ||\n\t\t\tproperty === 'link' ||\n\t\t\tproperty === 'linkSync' ||\n\t\t\tproperty === 'copyFile' ||\n\t\t\tproperty === 'copyFileSync'\n\t\t) {\n\t\t\ttranslatedArguments[0] = translatePath(String(methodArguments[0]));\n\t\t\ttranslatedArguments[1] = translatePath(String(methodArguments[1]));\n\t\t\treturn translatedArguments;\n\t\t}\n\t\ttranslatedArguments[mutationPathArgumentIndex(property)] = translatePath(\n\t\t\tString(methodArguments[mutationPathArgumentIndex(property)]),\n\t\t);\n\t\treturn translatedArguments;\n\t};\n\tconst assertResolvedPathWithinSource = (\n\t\tresolvedPath: string,\n\t\tcanonicalSourcePath: string,\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t): void => {\n\t\tconst resolvedRelativePath = toRelativeProviderPath(resolvedPath);\n\t\tconst canonicalSourceRelativePath = toRelativeProviderPath(canonicalSourcePath);\n\t\tif (!isEqualOrDescendant(resolvedRelativePath, canonicalSourceRelativePath)) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t};\n\tconst resolveConfinedPath = async (\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t\ttranslatedPath: string,\n\t): Promise<{ readonly canonicalSourcePath: string; readonly resolvedPath: string }> => {\n\t\tif (!provider.realpath) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t\tconst [canonicalSourcePath, resolvedPath] = await Promise.all([\n\t\t\tprovider.realpath(sourceProviderPath),\n\t\t\tprovider.realpath(translatedPath),\n\t\t]);\n\t\tassertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);\n\t\treturn { canonicalSourcePath, resolvedPath };\n\t};\n\tconst resolveConfinedPathSync = (\n\t\tproperty: string,\n\t\tproviderPath: string,\n\t\ttranslatedPath: string,\n\t): { readonly canonicalSourcePath: string; readonly resolvedPath: string } => {\n\t\tif (!provider.realpathSync) {\n\t\t\tthrow createFilesystemPolicyError('ENOENT', property, providerPath);\n\t\t}\n\t\tconst canonicalSourcePath = provider.realpathSync(sourceProviderPath);\n\t\tconst resolvedPath = provider.realpathSync(translatedPath);\n\t\tassertResolvedPathWithinSource(resolvedPath, canonicalSourcePath, property, providerPath);\n\t\treturn { canonicalSourcePath, resolvedPath };\n\t};\n\tconst parentProviderPath = (providerPath: string): string => {\n\t\tconst normalizedPath = normalizeProviderPath(providerPath);\n\t\treturn normalizedPath === '/' ? '/' : path.posix.dirname(normalizedPath);\n\t};\n\tconst remapResolvedPath = (resolvedPath: string, canonicalSourcePath: string): string => {\n\t\tconst resolvedRelativePath = toRelativeProviderPath(resolvedPath);\n\t\tconst canonicalSourceRelativePath = toRelativeProviderPath(canonicalSourcePath);\n\t\tif (resolvedRelativePath === canonicalSourceRelativePath) {\n\t\t\treturn '/';\n\t\t}\n\t\treturn toAbsoluteProviderPath(\n\t\t\tcanonicalSourceRelativePath.length === 0\n\t\t\t\t? resolvedRelativePath\n\t\t\t\t: resolvedRelativePath.slice(`${canonicalSourceRelativePath}/`.length),\n\t\t);\n\t};\n\tconst asyncFollowMethods = new Set(['access', 'open', 'readdir', 'readFile', 'stat', 'statfs']);\n\tconst syncFollowMethods = new Set([\n\t\t'accessSync',\n\t\t'openSync',\n\t\t'readdirSync',\n\t\t'readFileSync',\n\t\t'statSync',\n\t\t'watch',\n\t\t'watchAsync',\n\t\t'watchFile',\n\t\t'unwatchFile',\n\t]);\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst translatedArguments = translateArguments(property, methodArguments);\n\t\t\t\tif (property === 'realpath') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0])).then(\n\t\t\t\t\t\t({ canonicalSourcePath, resolvedPath }) =>\n\t\t\t\t\t\t\tremapResolvedPath(resolvedPath, canonicalSourcePath),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (property === 'realpathSync') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst { canonicalSourcePath, resolvedPath } = resolveConfinedPathSync(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\tString(translatedArguments[0]),\n\t\t\t\t\t);\n\t\t\t\t\treturn remapResolvedPath(resolvedPath, canonicalSourcePath);\n\t\t\t\t}\n\t\t\t\tif (property === 'lstat' || property === 'readlink') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\ttranslatePath(parentProviderPath(providerPath)),\n\t\t\t\t\t).then(() => Reflect.apply(value as ProviderMethod, target, translatedArguments));\n\t\t\t\t}\n\t\t\t\tif (property === 'lstatSync' || property === 'readlinkSync') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tresolveConfinedPathSync(\n\t\t\t\t\t\tproperty,\n\t\t\t\t\t\tproviderPath,\n\t\t\t\t\t\ttranslatePath(parentProviderPath(providerPath)),\n\t\t\t\t\t);\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t\t}\n\t\t\t\tif (property === 'exists') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0]))\n\t\t\t\t\t\t.then(() => Reflect.apply(value as ProviderMethod, target, translatedArguments))\n\t\t\t\t\t\t.catch(() => false);\n\t\t\t\t}\n\t\t\t\tif (property === 'existsSync' || property === 'internalModuleStat') {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\ttry {\n\t\t\t\t\t\tresolveConfinedPathSync(property, providerPath, String(translatedArguments[0]));\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn property === 'existsSync' ? false : -2;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (asyncFollowMethods.has(property)) {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\treturn resolveConfinedPath(property, providerPath, String(translatedArguments[0])).then(\n\t\t\t\t\t\t() => Reflect.apply(value as ProviderMethod, target, translatedArguments),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (syncFollowMethods.has(property)) {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tresolveConfinedPathSync(property, providerPath, String(translatedArguments[0]));\n\t\t\t\t}\n\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, translatedArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction createPositiveWorkspaceProjectionProvider(\n\tprovider: VirtualProvider,\n\tpolicy: Extract<\n\t\tManagedVmFilteredWorkspacePolicy['visibility'],\n\t\t{ readonly kind: 'positive-paths' }\n\t>,\n\tdependencies: FilteredWorkspaceProviderDependencies,\n): VirtualProvider {\n\tconst isVisible = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn (\n\t\t\trelativePath.length === 0 ||\n\t\t\tpolicy.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath))\n\t\t);\n\t};\n\tconst isWritable = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.writablePaths.some((writablePath) =>\n\t\t\tisEqualOrDescendant(relativePath, writablePath),\n\t\t);\n\t};\n\tconst projectedProvider = dependencies.createShadowProvider(provider, {\n\t\tshouldShadow: ({ path: providerPath }) => !isVisible(providerPath),\n\t\twriteMode: 'deny',\n\t});\n\tconst readonlyProvider = dependencies.createReadonlyProvider(projectedProvider);\n\n\treturn new Proxy(projectedProvider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'open' || property === 'openSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (singlePathMutationMethods.has(property)) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst pathIndex = mutationPathArgumentIndex(property);\n\t\t\t\t\tconst providerPath = String(methodArguments[pathIndex]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(providerPath) && !isWritable(providerPath) ? readonlyProvider : target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'rename' || property === 'renameSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst affectedPaths = [String(methodArguments[0]), String(methodArguments[1])];\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\taffectedPaths.every(isVisible) &&\n\t\t\t\t\t\taffectedPaths.some((affectedPath) => !isWritable(affectedPath))\n\t\t\t\t\t\t\t? readonlyProvider\n\t\t\t\t\t\t\t: target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'copyFile' || property === 'copyFileSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\t\tconst selectedProvider =\n\t\t\t\t\t\tisVisible(sourcePath) && isVisible(destinationPath) && !isWritable(destinationPath)\n\t\t\t\t\t\t\t? readonlyProvider\n\t\t\t\t\t\t\t: target;\n\t\t\t\t\treturn invokeProviderMethod(selectedProvider, property, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t},\n\t});\n}\n\nfunction createWorkspaceHardlinkProvider(\n\tprovider: VirtualProvider,\n\tbaseProvider: VirtualProvider,\n\tpolicy: ManagedVmFilteredWorkspacePolicy,\n): VirtualProvider {\n\tconst hidden = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));\n\t};\n\tconst temporary = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.temporaryPaths.some((temporaryPath) =>\n\t\t\tisEqualOrDescendant(relativePath, temporaryPath),\n\t\t);\n\t};\n\tconst visible = (providerPath: string): boolean => {\n\t\tif (policy.visibility.kind === 'whole-root-writable') {\n\t\t\treturn true;\n\t\t}\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn (\n\t\t\trelativePath.length === 0 ||\n\t\t\tpolicy.visibility.visiblePaths.some((visiblePath) => pathsOverlap(relativePath, visiblePath))\n\t\t);\n\t};\n\tconst writable = (providerPath: string): boolean => {\n\t\tif (temporary(providerPath)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (policy.visibility.kind === 'whole-root-writable') {\n\t\t\treturn true;\n\t\t}\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.visibility.writablePaths.some((writablePath) =>\n\t\t\tisEqualOrDescendant(relativePath, writablePath),\n\t\t);\n\t};\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (property !== 'link' && property !== 'linkSync') {\n\t\t\t\treturn typeof value === 'function'\n\t\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments)\n\t\t\t\t\t: value;\n\t\t\t}\n\t\t\tconst underlyingLinkMethod = Reflect.get(baseProvider, property, baseProvider) as unknown;\n\t\t\tif (typeof underlyingLinkMethod !== 'function') {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\tif (hidden(sourcePath) || !visible(sourcePath)) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t}\n\t\t\t\tif (hidden(destinationPath) || !visible(destinationPath)) {\n\t\t\t\t\treturn failProviderOperation(property, destinationPath, 'EACCES');\n\t\t\t\t}\n\t\t\t\tif (!writable(sourcePath)) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'EROFS');\n\t\t\t\t}\n\t\t\t\tif (!writable(destinationPath)) {\n\t\t\t\t\treturn failProviderOperation(property, destinationPath, 'EROFS');\n\t\t\t\t}\n\t\t\t\tif (property === 'link') {\n\t\t\t\t\tif (!provider.realpath) {\n\t\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t\t}\n\t\t\t\t\treturn provider\n\t\t\t\t\t\t.realpath(sourcePath)\n\t\t\t\t\t\t.then(() =>\n\t\t\t\t\t\t\tReflect.apply(underlyingLinkMethod as ProviderMethod, baseProvider, methodArguments),\n\t\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (!provider.realpathSync) {\n\t\t\t\t\treturn failProviderOperation(property, sourcePath, 'ENOENT');\n\t\t\t\t}\n\t\t\t\tprovider.realpathSync(sourcePath);\n\t\t\t\treturn Reflect.apply(underlyingLinkMethod as ProviderMethod, baseProvider, methodArguments);\n\t\t\t};\n\t\t},\n\t});\n}\n\ninterface ReadonlyInputProvider {\n\treadonly destinationRelativePath: string;\n\treadonly provider: VirtualProvider;\n}\n\nfunction directReadonlyDestinationChildren(\n\tproviderPath: string,\n\treadonlyInputs: readonly ReadonlyInputProvider[],\n): readonly string[] {\n\tconst relativePath = toRelativeProviderPath(providerPath);\n\tconst prefix = relativePath.length === 0 ? '' : `${relativePath}/`;\n\tconst children = new Set<string>();\n\tfor (const readonlyInput of readonlyInputs) {\n\t\tif (!readonlyInput.destinationRelativePath.startsWith(prefix)) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst remainingPath = readonlyInput.destinationRelativePath.slice(prefix.length);\n\t\tconst childName = remainingPath.split('/')[0];\n\t\tif (childName) {\n\t\t\tchildren.add(childName);\n\t\t}\n\t}\n\treturn [...children].toSorted();\n}\n\nfunction entryName(entry: string | { readonly name: string }): string {\n\treturn typeof entry === 'string' ? entry : entry.name;\n}\n\nfunction mergeDirectoryEntries(\n\tentries: readonly (string | { readonly name: string })[],\n\tvirtualChildren: readonly string[],\n\twithFileTypes: boolean,\n): readonly (string | { readonly name: string })[] {\n\tconst presentNames = new Set(entries.map(entryName));\n\tconst missingChildren = virtualChildren.filter((childName) => !presentNames.has(childName));\n\treturn [\n\t\t...entries,\n\t\t...missingChildren.map((childName) =>\n\t\t\twithFileTypes ? new VirtualDirent(childName) : childName,\n\t\t),\n\t];\n}\n\nfunction isNoEntryError(error: unknown): boolean {\n\treturn (\n\t\ttypeof error === 'object' &&\n\t\terror !== null &&\n\t\t(('code' in error && (error.code === 'ENOENT' || error.code === 'ERRNO_2')) ||\n\t\t\t('errno' in error && (error.errno === ERRNO.ENOENT || error.errno === -ERRNO.ENOENT)))\n\t);\n}\n\nfunction createNestedReadonlyWorkspaceProvider(\n\tprovider: VirtualProvider,\n\tsourceProvider: VirtualProvider,\n\tpolicy: ManagedVmFilteredWorkspacePolicy,\n\tdependencies: FilteredWorkspaceProviderDependencies,\n): VirtualProvider {\n\tconst readonlyInputs: ReadonlyInputProvider[] = [];\n\tfor (const readonlyInput of policy.readonlyInputs) {\n\t\tif (\n\t\t\tpolicy.hiddenPaths.some((hiddenPath) =>\n\t\t\t\tisEqualOrDescendant(readonlyInput.destinationRelativePath, hiddenPath),\n\t\t\t)\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tlet inputProvider = createRelativeRootProvider(\n\t\t\tsourceProvider,\n\t\t\treadonlyInput.sourceRelativePath,\n\t\t);\n\t\tconst nestedHiddenPaths = policy.hiddenPaths.flatMap((hiddenPath) => {\n\t\t\tconst destinationPrefix = `${readonlyInput.destinationRelativePath}/`;\n\t\t\treturn hiddenPath.startsWith(destinationPrefix)\n\t\t\t\t? [toAbsoluteProviderPath(hiddenPath.slice(destinationPrefix.length))]\n\t\t\t\t: [];\n\t\t});\n\t\tif (nestedHiddenPaths.length > 0) {\n\t\t\tinputProvider = dependencies.createShadowProvider(inputProvider, {\n\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(nestedHiddenPaths),\n\t\t\t\twriteMode: 'deny',\n\t\t\t});\n\t\t}\n\t\treadonlyInputs.push({\n\t\t\tdestinationRelativePath: readonlyInput.destinationRelativePath,\n\t\t\tprovider: dependencies.createReadonlyProvider(inputProvider),\n\t\t});\n\t}\n\n\tif (readonlyInputs.length === 0) {\n\t\treturn provider;\n\t}\n\n\tconst findInput = (providerPath: string): ReadonlyInputProvider | undefined => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn readonlyInputs.find((readonlyInput) =>\n\t\t\tisEqualOrDescendant(relativePath, readonlyInput.destinationRelativePath),\n\t\t);\n\t};\n\tconst mapInputPath = (providerPath: string, readonlyInput: ReadonlyInputProvider): string => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\tconst suffix = relativePath.slice(readonlyInput.destinationRelativePath.length);\n\t\treturn suffix.length === 0 ? '/' : suffix;\n\t};\n\tconst conflictsWithReadonlyInput = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn readonlyInputs.some((readonlyInput) =>\n\t\t\tpathsOverlap(relativePath, readonlyInput.destinationRelativePath),\n\t\t);\n\t};\n\tconst isHidden = (providerPath: string): boolean => {\n\t\tconst relativePath = toRelativeProviderPath(providerPath);\n\t\treturn policy.hiddenPaths.some((hiddenPath) => isEqualOrDescendant(relativePath, hiddenPath));\n\t};\n\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol): unknown {\n\t\t\tconst value = Reflect.get(target, property, target) as unknown;\n\t\t\tif (typeof property !== 'string' || typeof value !== 'function') {\n\t\t\t\treturn value;\n\t\t\t}\n\t\t\tif (property === 'readdir' || property === 'readdirSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readdirOptions = methodArguments[1];\n\t\t\t\t\tconst withFileTypes =\n\t\t\t\t\t\ttypeof readdirOptions === 'object' &&\n\t\t\t\t\t\treaddirOptions !== null &&\n\t\t\t\t\t\t'withFileTypes' in readdirOptions &&\n\t\t\t\t\t\treaddirOptions.withFileTypes === true;\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\tif (readonlyInput && !isHidden(providerPath)) {\n\t\t\t\t\t\treturn invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t]);\n\t\t\t\t\t}\n\t\t\t\t\tconst virtualChildren = directReadonlyDestinationChildren(providerPath, readonlyInputs);\n\t\t\t\t\tif (virtualChildren.length === 0) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tif (property === 'readdir') {\n\t\t\t\t\t\treturn Promise.resolve(Reflect.apply(value as ProviderMethod, target, methodArguments))\n\t\t\t\t\t\t\t.catch((error: unknown) => {\n\t\t\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\t\t\treturn [];\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.then((entries) =>\n\t\t\t\t\t\t\t\tmergeDirectoryEntries(\n\t\t\t\t\t\t\t\t\tentries as readonly (string | { readonly name: string })[],\n\t\t\t\t\t\t\t\t\tvirtualChildren,\n\t\t\t\t\t\t\t\t\twithFileTypes,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn mergeDirectoryEntries(\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments) as readonly (\n\t\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t\t| { readonly name: string }\n\t\t\t\t\t\t\t)[],\n\t\t\t\t\t\t\tvirtualChildren,\n\t\t\t\t\t\t\twithFileTypes,\n\t\t\t\t\t\t);\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\treturn virtualChildren;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'stat' ||\n\t\t\t\tproperty === 'statSync' ||\n\t\t\t\tproperty === 'lstat' ||\n\t\t\t\tproperty === 'lstatSync'\n\t\t\t) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\tif (readonlyInput && !isHidden(providerPath)) {\n\t\t\t\t\t\treturn invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t]);\n\t\t\t\t\t}\n\t\t\t\t\tconst virtualChildren = directReadonlyDestinationChildren(providerPath, readonlyInputs);\n\t\t\t\t\tif (virtualChildren.length === 0) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tif (property === 'stat' || property === 'lstat') {\n\t\t\t\t\t\treturn Promise.resolve(\n\t\t\t\t\t\t\tReflect.apply(value as ProviderMethod, target, methodArguments),\n\t\t\t\t\t\t).catch((error: unknown) => {\n\t\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\t\treturn createVirtualDirStats();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (isNoEntryError(error)) {\n\t\t\t\t\t\t\treturn createVirtualDirStats();\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'open' || property === 'openSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\t\treturn readonlyInput && !isHidden(providerPath)\n\t\t\t\t\t\t? invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t\t])\n\t\t\t\t\t\t: Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (singlePathMutationMethods.has(property)) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst providerPath = String(methodArguments[mutationPathArgumentIndex(property)]);\n\t\t\t\t\tif (!isHidden(providerPath) && conflictsWithReadonlyInput(providerPath)) {\n\t\t\t\t\t\treturn failProviderMutation(property, providerPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'rename' ||\n\t\t\t\tproperty === 'renameSync' ||\n\t\t\t\tproperty === 'link' ||\n\t\t\t\tproperty === 'linkSync'\n\t\t\t) {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst affectedPaths = [String(methodArguments[0]), String(methodArguments[1])];\n\t\t\t\t\tconst conflictingPath = affectedPaths.find(\n\t\t\t\t\t\t(affectedPath) => !isHidden(affectedPath) && conflictsWithReadonlyInput(affectedPath),\n\t\t\t\t\t);\n\t\t\t\t\tif (conflictingPath) {\n\t\t\t\t\t\treturn failProviderMutation(property, conflictingPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'copyFile' || property === 'copyFileSync') {\n\t\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\t\tconst sourcePath = String(methodArguments[0]);\n\t\t\t\t\tconst destinationPath = String(methodArguments[1]);\n\t\t\t\t\tif (!isHidden(destinationPath) && conflictsWithReadonlyInput(destinationPath)) {\n\t\t\t\t\t\treturn failProviderMutation(property, destinationPath);\n\t\t\t\t\t}\n\t\t\t\t\tconst sourceInput = findInput(sourcePath);\n\t\t\t\t\tif (!sourceInput || isHidden(sourcePath)) {\n\t\t\t\t\t\treturn Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\t\t}\n\t\t\t\t\tconst mappedSourcePath = mapInputPath(sourcePath, sourceInput);\n\t\t\t\t\tif (property === 'copyFile') {\n\t\t\t\t\t\treturn Promise.resolve(\n\t\t\t\t\t\t\tinvokeProviderMethod(sourceInput.provider, 'readFile', [mappedSourcePath]),\n\t\t\t\t\t\t).then((contents) =>\n\t\t\t\t\t\t\tinvokeProviderMethod(target, 'writeFile', [destinationPath, contents]),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst contents = invokeProviderMethod(sourceInput.provider, 'readFileSync', [\n\t\t\t\t\t\tmappedSourcePath,\n\t\t\t\t\t]);\n\t\t\t\t\treturn invokeProviderMethod(target, 'writeFileSync', [destinationPath, contents]);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn (...methodArguments: readonly unknown[]): unknown => {\n\t\t\t\tconst providerPath = String(methodArguments[0]);\n\t\t\t\tconst readonlyInput = findInput(providerPath);\n\t\t\t\tconst result =\n\t\t\t\t\treadonlyInput && !isHidden(providerPath)\n\t\t\t\t\t\t? invokeProviderMethod(readonlyInput.provider, property, [\n\t\t\t\t\t\t\t\tmapInputPath(providerPath, readonlyInput),\n\t\t\t\t\t\t\t\t...methodArguments.slice(1),\n\t\t\t\t\t\t\t])\n\t\t\t\t\t\t: Reflect.apply(value as ProviderMethod, target, methodArguments);\n\t\t\t\tif (!readonlyInput || isHidden(providerPath)) {\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\t\t\t\tif (property === 'realpath') {\n\t\t\t\t\treturn Promise.resolve(result).then((resolvedPath) => {\n\t\t\t\t\t\tconst resolvedRelativePath = toRelativeProviderPath(String(resolvedPath));\n\t\t\t\t\t\treturn toAbsoluteProviderPath(\n\t\t\t\t\t\t\tresolvedRelativePath.length === 0\n\t\t\t\t\t\t\t\t? readonlyInput.destinationRelativePath\n\t\t\t\t\t\t\t\t: `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tif (property === 'realpathSync') {\n\t\t\t\t\tconst resolvedRelativePath = toRelativeProviderPath(String(result));\n\t\t\t\t\treturn toAbsoluteProviderPath(\n\t\t\t\t\t\tresolvedRelativePath.length === 0\n\t\t\t\t\t\t\t? readonlyInput.destinationRelativePath\n\t\t\t\t\t\t\t: `${readonlyInput.destinationRelativePath}/${resolvedRelativePath}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn result;\n\t\t\t};\n\t\t},\n\t});\n}\n\nexport function createFilteredWorkspaceProvider(\n\toptions: CreateFilteredWorkspaceProviderOptions,\n): VirtualProvider {\n\tlet workspaceProvider = options.baseProvider;\n\tif (options.policy.visibility.kind === 'positive-paths') {\n\t\tworkspaceProvider = createPositiveWorkspaceProjectionProvider(\n\t\t\tworkspaceProvider,\n\t\t\toptions.policy.visibility,\n\t\t\toptions.dependencies,\n\t\t);\n\t}\n\n\tif (options.policy.hiddenPaths.length > 0) {\n\t\tworkspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {\n\t\t\tshouldShadow: options.dependencies.createShadowPathPredicate(\n\t\t\t\toptions.policy.hiddenPaths.map(toAbsoluteProviderPath),\n\t\t\t),\n\t\t\twriteMode: 'deny',\n\t\t});\n\t}\n\n\tif (options.policy.temporaryPaths.length > 0) {\n\t\tconst hiddenPredicate = options.dependencies.createShadowPathPredicate(\n\t\t\toptions.policy.hiddenPaths.map(toAbsoluteProviderPath),\n\t\t);\n\t\tconst temporaryPredicate = options.dependencies.createShadowPathPredicate(\n\t\t\toptions.policy.temporaryPaths.map(toAbsoluteProviderPath),\n\t\t);\n\t\tworkspaceProvider = options.dependencies.createShadowProvider(workspaceProvider, {\n\t\t\tshouldShadow: (context) => !hiddenPredicate(context) && temporaryPredicate(context),\n\t\t\ttmpfs: options.dependencies.createMemoryProvider(),\n\t\t\twriteMode: 'tmpfs',\n\t\t});\n\t}\n\tworkspaceProvider = createWorkspaceHardlinkProvider(\n\t\tworkspaceProvider,\n\t\toptions.baseProvider,\n\t\toptions.policy,\n\t);\n\n\treturn createNestedReadonlyWorkspaceProvider(\n\t\tworkspaceProvider,\n\t\toptions.baseProvider,\n\t\toptions.policy,\n\t\toptions.dependencies,\n\t);\n}\n","import * as dns from 'node:dns';\nimport * as net from 'node:net';\n\nexport interface HostNetworkDefaultsResult {\n\treadonly autoSelectFamily: false | 'unavailable';\n\treadonly dnsResultOrder: 'ipv4first' | 'unavailable';\n}\n\nexport interface HostNetworkDefaultsDependencies {\n\treadonly setDefaultAutoSelectFamily?: ((value: boolean) => void) | undefined;\n\treadonly setDefaultResultOrder?: ((order: 'ipv4first') => void) | undefined;\n}\n\n/**\n * Gondolin raw tcpHosts passthrough sockets are opened by the host-side Node\n * process, not by guest Node processes. VM NODE_OPTIONS cannot affect those\n * sockets, so host processes that create Gondolin VMs also force deterministic\n * IPv4-first behavior before network state is constructed.\n */\nexport function configureHostNetworkDefaults(\n\tdependencies: HostNetworkDefaultsDependencies = {},\n): HostNetworkDefaultsResult {\n\tconst setDefaultResultOrder =\n\t\t'setDefaultResultOrder' in dependencies\n\t\t\t? dependencies.setDefaultResultOrder\n\t\t\t: dns.setDefaultResultOrder;\n\tconst setDefaultAutoSelectFamily =\n\t\t'setDefaultAutoSelectFamily' in dependencies\n\t\t\t? dependencies.setDefaultAutoSelectFamily\n\t\t\t: net.setDefaultAutoSelectFamily;\n\n\tlet dnsResultOrder: HostNetworkDefaultsResult['dnsResultOrder'] = 'unavailable';\n\tif (typeof setDefaultResultOrder === 'function') {\n\t\tsetDefaultResultOrder('ipv4first');\n\t\tdnsResultOrder = 'ipv4first';\n\t}\n\n\tlet autoSelectFamily: HostNetworkDefaultsResult['autoSelectFamily'] = 'unavailable';\n\tif (typeof setDefaultAutoSelectFamily === 'function') {\n\t\tsetDefaultAutoSelectFamily(false);\n\t\tautoSelectFamily = false;\n\t}\n\n\treturn {\n\t\tautoSelectFamily,\n\t\tdnsResultOrder,\n\t};\n}\n","import type { Stats } from 'node:fs';\nimport net from 'node:net';\n\nimport {\n\tvalidateManagedVmFinalizeMemoryMountRequest,\n\ttype ManagedVmFilteredWorkspacePolicy,\n\ttype ManagedVmFinalizeMemoryMountRequest,\n} from '@agent-vm/managed-vm';\nimport {\n\tMemoryProvider,\n\tReadonlyProvider,\n\tRealFSProvider,\n\tShadowProvider,\n\tVM,\n\tcreateHttpHooks,\n\tcreateShadowPathPredicate,\n\ttype CreateHttpHooksResult,\n\ttype EnableIngressOptions,\n\ttype EnableSshOptions,\n\ttype ExecOptions as GondolinExecOptions,\n\ttype ExecProcess as GondolinExecProcess,\n\ttype ExecResult as GondolinExecResult,\n\ttype HttpHooks,\n\ttype IngressRoute as GondolinIngressRoute,\n\ttype ShadowPredicate,\n\ttype ShadowProviderOptions,\n\ttype SshOptions,\n\ttype VMOptions,\n\ttype VmFs as GondolinVmFs,\n\ttype VirtualFileHandle,\n\ttype VirtualProvider,\n\tERRNO,\n\tgetInfoFromSshExecRequest,\n\tisWriteFlag,\n} from '@earendil-works/gondolin';\n\nimport { createFilteredWorkspaceProvider } from './filtered-workspace-provider.js';\nimport {\n\tconfigureHostNetworkDefaults,\n\ttype HostNetworkDefaultsResult,\n} from './host-network-defaults.js';\nimport {\n\tclosePinnedRealFsRoot,\n\tcreatePinnedRealFsProvider,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\n\nexport const SYNTHETIC_DNS_IPV4_BENCHMARK = '198.18.0.1';\nexport const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = '::ffff:198.18.0.1';\nexport const MANAGED_VM_DEFAULT_INGRESS_MAX_BUFFERED_RESPONSE_BODY_BYTES = 512 * 1024 * 1024;\nexport const MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_HEADER_TIMEOUT_MS = 120_000;\nexport const MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_RESPONSE_TIMEOUT_MS = 120_000;\n\nexport const MANAGED_VM_DEFAULT_INGRESS_OPTIONS = {\n\tallowWebSockets: true,\n\tbufferResponseBody: false,\n\tmaxBufferedResponseBodyBytes: MANAGED_VM_DEFAULT_INGRESS_MAX_BUFFERED_RESPONSE_BODY_BYTES,\n\tupstreamHeaderTimeoutMs: MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_HEADER_TIMEOUT_MS,\n\tupstreamResponseTimeoutMs: MANAGED_VM_DEFAULT_INGRESS_UPSTREAM_RESPONSE_TIMEOUT_MS,\n} satisfies EnableIngressOptions;\n\nexport type ManagedExecInput = string | readonly string[];\nexport type ManagedExecOptions = GondolinExecOptions;\nexport type ManagedExecProcess = GondolinExecProcess;\nexport type ManagedExecResult = GondolinExecResult;\nexport type ManagedVmFs = GondolinVmFs;\nexport type ManagedSshEgressOptions = SshOptions;\n\nexport type IngressRoute = GondolinIngressRoute;\n\ntype VirtualProviderMethod = (...methodArguments: readonly unknown[]) => unknown;\n\nfunction createGuestRootOwnedStats(stats: Stats): Stats {\n\treturn new Proxy(stats, {\n\t\tget(target: Stats, property: string | symbol, receiver: unknown): unknown {\n\t\t\tif (property === 'gid' || property === 'uid') {\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\treturn Reflect.get(target, property, receiver);\n\t\t},\n\t});\n}\n\nfunction createGuestRootOwnedFileHandle(handle: VirtualFileHandle): VirtualFileHandle {\n\treturn new Proxy(handle, {\n\t\tget(target: VirtualFileHandle, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'stat') {\n\t\t\t\treturn async (options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.stat(options));\n\t\t\t}\n\t\t\tif (property === 'statSync') {\n\t\t\t\treturn (options?: object): Stats => createGuestRootOwnedStats(target.statSync(options));\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nfunction createGuestRootOwnedProvider(provider: VirtualProvider): VirtualProvider {\n\treturn new Proxy(provider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'open') {\n\t\t\t\treturn async (\n\t\t\t\t\tentryPath: string,\n\t\t\t\t\tflags: string,\n\t\t\t\t\tmode?: number,\n\t\t\t\t): Promise<VirtualFileHandle> =>\n\t\t\t\t\tcreateGuestRootOwnedFileHandle(await target.open(entryPath, flags, mode));\n\t\t\t}\n\t\t\tif (property === 'openSync') {\n\t\t\t\treturn (entryPath: string, flags: string, mode?: number): VirtualFileHandle =>\n\t\t\t\t\tcreateGuestRootOwnedFileHandle(target.openSync(entryPath, flags, mode));\n\t\t\t}\n\t\t\tif (property === 'stat') {\n\t\t\t\treturn async (entryPath: string, options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.stat(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'statSync') {\n\t\t\t\treturn (entryPath: string, options?: object): Stats =>\n\t\t\t\t\tcreateGuestRootOwnedStats(target.statSync(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'lstat') {\n\t\t\t\treturn async (entryPath: string, options?: object): Promise<Stats> =>\n\t\t\t\t\tcreateGuestRootOwnedStats(await target.lstat(entryPath, options));\n\t\t\t}\n\t\t\tif (property === 'lstatSync') {\n\t\t\t\treturn (entryPath: string, options?: object): Stats =>\n\t\t\t\t\tcreateGuestRootOwnedStats(target.lstatSync(entryPath, options));\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nfunction createReadonlyMutationError(\n\tsyscall: string,\n\tfilePath: string | undefined,\n): Error & {\n\treadonly code: 'EROFS';\n\treadonly errno: number;\n\treadonly path?: string;\n\treadonly syscall: string;\n} {\n\tconst pathSuffix = filePath === undefined ? '' : ` '${filePath}'`;\n\treturn Object.assign(new Error(`EROFS: ${syscall}${pathSuffix}`), {\n\t\tcode: 'EROFS' as const,\n\t\terrno: ERRNO.EROFS,\n\t\t...(filePath === undefined ? {} : { path: filePath }),\n\t\tsyscall,\n\t});\n}\n\nfunction createHardenedReadonlyFileHandle(handle: VirtualFileHandle): VirtualFileHandle {\n\treturn new Proxy(handle, {\n\t\tget(target: VirtualFileHandle, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'write' || property === 'writeFile' || property === 'truncate') {\n\t\t\t\treturn async (): Promise<never> => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), target.path);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'writeSync' || property === 'writeFileSync' || property === 'truncateSync') {\n\t\t\t\treturn (): never => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), target.path);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nexport function createHardenedReadonlyProvider(provider: VirtualProvider): VirtualProvider {\n\tconst readonlyProvider = new ReadonlyProvider(provider);\n\treturn new Proxy(readonlyProvider, {\n\t\tget(target: VirtualProvider, property: string | symbol, receiver: unknown): unknown {\n\t\t\tconst value = Reflect.get(target, property, receiver) as unknown;\n\t\t\tif (property === 'open') {\n\t\t\t\treturn async (\n\t\t\t\t\tentryPath: string,\n\t\t\t\t\tflags: string,\n\t\t\t\t\tmode?: number,\n\t\t\t\t): Promise<VirtualFileHandle> => {\n\t\t\t\t\tif (isWriteFlag(flags)) {\n\t\t\t\t\t\tthrow createReadonlyMutationError('open', entryPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn createHardenedReadonlyFileHandle(await target.open(entryPath, flags, mode));\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (property === 'openSync') {\n\t\t\t\treturn (entryPath: string, flags: string, mode?: number): VirtualFileHandle => {\n\t\t\t\t\tif (isWriteFlag(flags)) {\n\t\t\t\t\t\tthrow createReadonlyMutationError('openSync', entryPath);\n\t\t\t\t\t}\n\t\t\t\t\treturn createHardenedReadonlyFileHandle(target.openSync(entryPath, flags, mode));\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'mkdir' ||\n\t\t\t\tproperty === 'rmdir' ||\n\t\t\t\tproperty === 'unlink' ||\n\t\t\t\tproperty === 'rename' ||\n\t\t\t\tproperty === 'link' ||\n\t\t\t\tproperty === 'writeFile' ||\n\t\t\t\tproperty === 'appendFile' ||\n\t\t\t\tproperty === 'copyFile' ||\n\t\t\t\tproperty === 'symlink'\n\t\t\t) {\n\t\t\t\treturn async (entryPath: string): Promise<never> => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), entryPath);\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (\n\t\t\t\tproperty === 'mkdirSync' ||\n\t\t\t\tproperty === 'rmdirSync' ||\n\t\t\t\tproperty === 'unlinkSync' ||\n\t\t\t\tproperty === 'renameSync' ||\n\t\t\t\tproperty === 'linkSync' ||\n\t\t\t\tproperty === 'writeFileSync' ||\n\t\t\t\tproperty === 'appendFileSync' ||\n\t\t\t\tproperty === 'copyFileSync' ||\n\t\t\t\tproperty === 'symlinkSync'\n\t\t\t) {\n\t\t\t\treturn (entryPath: string): never => {\n\t\t\t\t\tthrow createReadonlyMutationError(String(property), entryPath);\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn typeof value === 'function'\n\t\t\t\t? (...methodArguments: readonly unknown[]): unknown =>\n\t\t\t\t\t\tReflect.apply(value as VirtualProviderMethod, target, methodArguments)\n\t\t\t\t: value;\n\t\t},\n\t});\n}\n\nexport interface GitReadOnlySshEgressOptions {\n\treadonly allowedHosts: readonly string[];\n\treadonly allowedRepos?: readonly string[];\n\treadonly agent?: string;\n\treadonly knownHostsFile?: SshOptions['knownHostsFile'];\n}\n\nexport interface SshAccess {\n\tclose(): Promise<void>;\n\treadonly host: string;\n\treadonly command?: string;\n\treadonly identityFile?: string;\n\treadonly port: number;\n\treadonly serverHostKey: SshServerHostKey;\n\treadonly user?: string;\n}\n\nexport interface ManagedVmSshAccess {\n\tclose(): Promise<void>;\n\treadonly command: string;\n\treadonly host: string;\n\treadonly identityFile: string;\n\treadonly port: number;\n\treadonly user: string;\n}\n\nexport interface SshServerHostKey {\n\treadonly algorithm: 'ssh-ed25519';\n\treadonly publicKeyBase64: string;\n}\n\nexport function isSshServerHostKey(value: unknown): value is SshServerHostKey {\n\tif (typeof value !== 'object' || value === null) {\n\t\treturn false;\n\t}\n\tif (!('algorithm' in value) || !('publicKeyBase64' in value)) {\n\t\treturn false;\n\t}\n\tconst algorithm = value.algorithm;\n\tconst publicKeyBase64 = value.publicKeyBase64;\n\tif (\n\t\talgorithm !== 'ssh-ed25519' ||\n\t\ttypeof publicKeyBase64 !== 'string' ||\n\t\t!/^[A-Za-z0-9+/]+={0,2}$/u.test(publicKeyBase64)\n\t) {\n\t\treturn false;\n\t}\n\n\ttry {\n\t\tconst decodedPublicKey = Buffer.from(publicKeyBase64, 'base64');\n\t\tif (decodedPublicKey.toString('base64') !== publicKeyBase64 || decodedPublicKey.length < 4) {\n\t\t\treturn false;\n\t\t}\n\t\tconst algorithmLength = decodedPublicKey.readUInt32BE(0);\n\t\tconst algorithmStart = 4;\n\t\tconst algorithmEnd = algorithmStart + algorithmLength;\n\t\tconst publicKeyLengthOffset = algorithmEnd;\n\t\tconst publicKeyStart = publicKeyLengthOffset + 4;\n\t\treturn (\n\t\t\talgorithmEnd + 4 <= decodedPublicKey.length &&\n\t\t\tdecodedPublicKey.subarray(algorithmStart, algorithmEnd).toString('utf8') === 'ssh-ed25519' &&\n\t\t\tdecodedPublicKey.readUInt32BE(publicKeyLengthOffset) === 32 &&\n\t\t\tdecodedPublicKey.length === publicKeyStart + 32\n\t\t);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport function parseSshServerHostKey(publicKeyText: string): SshServerHostKey {\n\tconst publicKeyLines = publicKeyText\n\t\t.split('\\n')\n\t\t.map((line) => line.trim())\n\t\t.filter((line) => line.length > 0);\n\tif (publicKeyLines.length !== 1) {\n\t\tthrow new Error('Tool VM did not expose exactly one ssh-ed25519 server host key.');\n\t}\n\tconst publicKeyFields = publicKeyLines[0]?.split(/\\s+/u);\n\tconst serverHostKey = {\n\t\talgorithm: publicKeyFields?.[0],\n\t\tpublicKeyBase64: publicKeyFields?.[1],\n\t};\n\tif (!isSshServerHostKey(serverHostKey)) {\n\t\tthrow new Error('Tool VM did not expose a valid ssh-ed25519 server host key.');\n\t}\n\treturn serverHostKey;\n}\n\nasync function readSshServerHostKey(vmInstance: ManagedVmInstance): Promise<SshServerHostKey> {\n\tconst publicKeyResult = await vmInstance.exec(['/bin/cat', '/etc/ssh/ssh_host_ed25519_key.pub']);\n\tif (publicKeyResult.exitCode !== 0) {\n\t\tthrow new Error(\n\t\t\t`Tool VM server host key read failed with exit ${String(publicKeyResult.exitCode)}.`,\n\t\t);\n\t}\n\treturn parseSshServerHostKey(publicKeyResult.stdout);\n}\n\nasync function closeSshAccessAfterIdentityFailure(\n\tsshAccess: Awaited<ReturnType<ManagedVmInstance['enableSsh']>>,\n\tidentityError: unknown,\n): Promise<never> {\n\ttry {\n\t\tawait sshAccess.close();\n\t} catch (closeError) {\n\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError.errors preserves closeError while cause retains the primary identity failure.\n\t\tthrow new AggregateError(\n\t\t\t[identityError, closeError],\n\t\t\t'Tool VM SSH server identity validation and SSH access cleanup both failed.',\n\t\t\t{ cause: identityError },\n\t\t);\n\t}\n\tthrow identityError;\n}\n\nexport interface IngressAccess {\n\tclose(): Promise<void>;\n\treadonly host: string;\n\treadonly port: number;\n}\n\nexport interface ManagedVmInstance {\n\treadonly fs: ManagedVmFs;\n\treadonly id: string;\n\texec(command: string | string[], options?: ManagedExecOptions): ManagedExecProcess;\n\tenableSsh(options?: EnableSshOptions): Promise<ManagedVmSshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tgetHostPid?(): number | null;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tstart(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\nexport interface ManagedVmDependencies {\n\tconfigureHostNetworkDefaults?: () => HostNetworkDefaultsResult;\n\tcreateVm(vmOptions: VMOptions): Promise<ManagedVmInstance>;\n\tcreateHttpHooks(options: {\n\t\treadonly allowedHosts: readonly string[];\n\t\treadonly allowedInternalHosts?: readonly string[];\n\t\treadonly isIpAllowed?: HttpHooks['isIpAllowed'];\n\t\treadonly secrets: Record<string, ManagedHttpMediatedSecretSpec>;\n\t\treadonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n\t\treadonly onResponse?: (response: Response) => Promise<Response | void>;\n\t}): Pick<CreateHttpHooksResult, 'env' | 'httpHooks'>;\n\tclosePinnedRealFsRoot(root: PinnedRealFsRoot): void;\n\tcreatePinnedRealFsProvider(root: PinnedRealFsRoot): VirtualProvider;\n\tcreateRealFsProvider(hostPath: string): VirtualProvider;\n\tcreateReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n\tcreateMemoryProvider(): VirtualProvider;\n\tcreateShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n\tcreateShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n}\n\ninterface ManagedHttpMediatedSecretSpec {\n\treadonly hosts: readonly string[];\n\treadonly placeholder?: string;\n\treadonly value: string;\n}\n\ntype RealFsVfsMountSpec = {\n\treadonly hostPath?: string;\n\treadonly kind: 'realfs' | 'realfs-readonly';\n\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n};\n\nexport type VfsMountSpec =\n\t| RealFsVfsMountSpec\n\t| {\n\t\t\treadonly access: 'read-only' | 'read-write';\n\t\t\treadonly kind: 'finalizable-memory';\n\t }\n\t| {\n\t\t\treadonly kind: 'filtered-workspace';\n\t\t\treadonly pinnedHostRoot: PinnedRealFsRoot;\n\t\t\treadonly policy: ManagedVmFilteredWorkspacePolicy;\n\t }\n\t| { readonly kind: 'memory' }\n\t| {\n\t\t\treadonly hostPath?: string;\n\t\t\treadonly kind: 'shadow';\n\t\t\treadonly pinnedHostRoot?: PinnedRealFsRoot;\n\t\t\treadonly shadowConfig?: {\n\t\t\t\treadonly deny: readonly string[];\n\t\t\t\treadonly tmpfs: readonly string[];\n\t\t\t};\n\t };\n\nexport interface CreateVmOptions {\n\treadonly imagePath: string;\n\treadonly memory: string;\n\treadonly cpus: number;\n\treadonly rootfsMode: 'readonly' | 'memory' | 'cow';\n\treadonly runtimeRootfsSize?: string;\n\treadonly allowedHosts: readonly string[];\n\treadonly secrets: Record<string, ManagedHttpMediatedSecretSpec>;\n\treadonly vfsMounts: Record<string, VfsMountSpec>;\n\treadonly tcpHosts?: Record<string, string>;\n\treadonly sshEgress?: ManagedSshEgressOptions;\n\treadonly env?: Record<string, string>;\n\treadonly sessionLabel?: string;\n\treadonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n\treadonly onResponse?: (response: Response) => Promise<Response | void>;\n}\n\nexport interface ManagedVm {\n\treadonly fs: ManagedVmFs;\n\treadonly id: string;\n\texec(command: ManagedExecInput, options?: ManagedExecOptions): ManagedExecProcess;\n\tenableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n\tenableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n\tfinalizeMemoryMount(request: ManagedVmFinalizeMemoryMountRequest): Promise<void>;\n\tgetHostPid(): number | null;\n\tgetVmInstance(): ManagedVmInstance;\n\tsetIngressRoutes(routes: readonly IngressRoute[]): void;\n\tstart(): Promise<void>;\n\tclose(): Promise<void>;\n}\n\n/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- VM.create() returns\n Gondolin's concrete VM class; this adapter exposes only the narrower\n ManagedVmInstance interface used by agent-vm. */\nfunction createDefaultDependencies(): ManagedVmDependencies {\n\tconst createDefaultRealFsProvider = (hostPath: string): VirtualProvider =>\n\t\tnew RealFSProvider(hostPath);\n\treturn {\n\t\tconfigureHostNetworkDefaults,\n\t\tcreateVm: async (vmOptions: VMOptions): Promise<ManagedVmInstance> =>\n\t\t\t(await VM.create(vmOptions)) as unknown as ManagedVmInstance,\n\t\tcreateHttpHooks: (hookOptions) =>\n\t\t\tcreateHttpHooks({\n\t\t\t\tallowedHosts: [...hookOptions.allowedHosts],\n\t\t\t\t...(hookOptions.allowedInternalHosts === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: { allowedInternalHosts: [...hookOptions.allowedInternalHosts] }),\n\t\t\t\t...(hookOptions.isIpAllowed ? { isIpAllowed: hookOptions.isIpAllowed } : {}),\n\t\t\t\tsecrets: Object.fromEntries(\n\t\t\t\t\tObject.entries(hookOptions.secrets).map(([secretName, secretSpec]) => [\n\t\t\t\t\t\tsecretName,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secretSpec.hosts],\n\t\t\t\t\t\t\t...(secretSpec.placeholder === undefined\n\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t: { placeholder: secretSpec.placeholder }),\n\t\t\t\t\t\t\tvalue: secretSpec.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t),\n\t\t\t\t...(hookOptions.onRequest ? { onRequest: hookOptions.onRequest } : {}),\n\t\t\t\t...(hookOptions.onResponse ? { onResponse: hookOptions.onResponse } : {}),\n\t\t\t}),\n\t\tclosePinnedRealFsRoot,\n\t\tcreatePinnedRealFsProvider: (root: PinnedRealFsRoot): VirtualProvider =>\n\t\t\tcreatePinnedRealFsProvider({\n\t\t\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\t\t\troot,\n\t\t\t}),\n\t\tcreateRealFsProvider: createDefaultRealFsProvider,\n\t\tcreateReadonlyProvider: createHardenedReadonlyProvider,\n\t\tcreateMemoryProvider: (): VirtualProvider => new MemoryProvider(),\n\t\tcreateShadowProvider: (\n\t\t\tprovider: VirtualProvider,\n\t\t\tshadowOptions: ShadowProviderOptions,\n\t\t): VirtualProvider => new ShadowProvider(provider, shadowOptions),\n\t\tcreateShadowPathPredicate: (paths: readonly string[]): ShadowPredicate =>\n\t\t\tcreateShadowPathPredicate([...paths]),\n\t};\n}\n/* oxlint-enable typescript-eslint/no-unsafe-type-assertion */\n\nfunction normalizeShadowPath(pathValue: string): string {\n\tconst trimmedPath = pathValue.trim();\n\tif (trimmedPath.startsWith('/')) {\n\t\treturn trimmedPath;\n\t}\n\n\tconst relativePath = trimmedPath.startsWith('./') ? trimmedPath.slice('./'.length) : trimmedPath;\n\treturn `/${relativePath}`;\n}\n\nfunction createRealFsProviderForSpec(\n\tmountSpec: RealFsVfsMountSpec | Extract<VfsMountSpec, { readonly kind: 'shadow' }>,\n\tdependencies: ManagedVmDependencies,\n\tmountKind: string,\n): VirtualProvider {\n\tif (mountSpec.pinnedHostRoot) {\n\t\treturn dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot);\n\t}\n\tif (mountSpec.hostPath) {\n\t\treturn dependencies.createRealFsProvider(mountSpec.hostPath);\n\t}\n\n\tthrow new Error(`${mountKind} mounts require hostPath or pinnedHostRoot`);\n}\n\nfunction createProviderFromSpec(\n\tmountSpec: VfsMountSpec,\n\tdependencies: ManagedVmDependencies,\n): VirtualProvider {\n\tswitch (mountSpec.kind) {\n\t\tcase 'finalizable-memory':\n\t\t\tthrow new Error('Finalizable memory mounts require retained provider construction.');\n\t\tcase 'memory':\n\t\t\treturn dependencies.createMemoryProvider();\n\t\tcase 'realfs': {\n\t\t\treturn createRealFsProviderForSpec(mountSpec, dependencies, 'realfs');\n\t\t}\n\t\tcase 'realfs-readonly': {\n\t\t\treturn dependencies.createReadonlyProvider(\n\t\t\t\tcreateRealFsProviderForSpec(mountSpec, dependencies, 'realfs-readonly'),\n\t\t\t);\n\t\t}\n\t\tcase 'filtered-workspace': {\n\t\t\treturn createFilteredWorkspaceProvider({\n\t\t\t\tbaseProvider: dependencies.createPinnedRealFsProvider(mountSpec.pinnedHostRoot),\n\t\t\t\tdependencies,\n\t\t\t\tpolicy: mountSpec.policy,\n\t\t\t});\n\t\t}\n\t\tcase 'shadow': {\n\t\t\tconst baseProvider =\n\t\t\t\tmountSpec.hostPath || mountSpec.pinnedHostRoot\n\t\t\t\t\t? createRealFsProviderForSpec(mountSpec, dependencies, 'shadow')\n\t\t\t\t\t: dependencies.createMemoryProvider();\n\n\t\t\tlet shadowProvider = baseProvider;\n\t\t\tconst shadowConfig = mountSpec.shadowConfig;\n\n\t\t\tif (shadowConfig?.deny.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.deny.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'deny',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (shadowConfig?.tmpfs.length) {\n\t\t\t\tshadowProvider = dependencies.createShadowProvider(shadowProvider, {\n\t\t\t\t\tshouldShadow: dependencies.createShadowPathPredicate(\n\t\t\t\t\t\tshadowConfig.tmpfs.map((shadowPath) => normalizeShadowPath(shadowPath)),\n\t\t\t\t\t),\n\t\t\t\t\twriteMode: 'tmpfs',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn shadowProvider;\n\t\t}\n\t\tdefault: {\n\t\t\tthrow new Error('Unsupported VFS mount kind.');\n\t\t}\n\t}\n}\n\ninterface FinalizableMemoryMount {\n\treadonly provider: VirtualProvider;\n\tstate: 'failed' | 'finalized' | 'finalizing' | 'pending';\n}\n\ninterface CreatedVfsMounts {\n\treadonly finalizableMemoryMounts: Map<string, FinalizableMemoryMount>;\n\treadonly mounts: Record<string, VirtualProvider>;\n}\n\nfunction createVfsMounts(\n\tvfsMounts: Record<string, VfsMountSpec>,\n\tdependencies: ManagedVmDependencies,\n): CreatedVfsMounts {\n\tconst mountMap: Record<string, VirtualProvider> = {};\n\tconst finalizableMemoryMounts = new Map<string, FinalizableMemoryMount>();\n\n\tfor (const [guestPath, mountSpec] of Object.entries(vfsMounts)) {\n\t\tif (mountSpec.kind === 'finalizable-memory') {\n\t\t\tconst provider = dependencies.createMemoryProvider();\n\t\t\tfinalizableMemoryMounts.set(guestPath, { provider, state: 'pending' });\n\t\t\tconst guestProvider = createGuestRootOwnedProvider(provider);\n\t\t\tmountMap[guestPath] =\n\t\t\t\tmountSpec.access === 'read-only'\n\t\t\t\t\t? dependencies.createReadonlyProvider(guestProvider)\n\t\t\t\t\t: guestProvider;\n\t\t\tcontinue;\n\t\t}\n\t\tmountMap[guestPath] = createProviderFromSpec(mountSpec, dependencies);\n\t}\n\n\treturn { finalizableMemoryMounts, mounts: mountMap };\n}\n\nfunction collectPinnedRealFsRoots(\n\tvfsMounts: Record<string, VfsMountSpec>,\n): readonly PinnedRealFsRoot[] {\n\tconst roots = new Map<number, PinnedRealFsRoot>();\n\tfor (const mountSpec of Object.values(vfsMounts)) {\n\t\tif ('pinnedHostRoot' in mountSpec && mountSpec.pinnedHostRoot) {\n\t\t\troots.set(mountSpec.pinnedHostRoot.fd, mountSpec.pinnedHostRoot);\n\t\t}\n\t}\n\treturn [...roots.values()];\n}\n\nfunction closePinnedRealFsRoots(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\tconst closeErrors: unknown[] = [];\n\tfor (const root of roots) {\n\t\ttry {\n\t\t\tdependencies.closePinnedRealFsRoot(root);\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t}\n\tif (closeErrors.length === 1) {\n\t\tthrow closeErrors[0];\n\t}\n\tif (closeErrors.length > 1) {\n\t\tthrow new AggregateError(closeErrors, 'Multiple pinned RealFS roots failed to close.');\n\t}\n}\n\nfunction closePinnedRealFsRootsAfterFailure(\n\troots: readonly PinnedRealFsRoot[],\n\tdependencies: ManagedVmDependencies,\n): void {\n\ttry {\n\t\tclosePinnedRealFsRoots(roots, dependencies);\n\t} catch {\n\t\t// Preserve the VM creation failure; leaked-fd risk is lower than hiding\n\t\t// the root cause of a failed lease.\n\t}\n}\n\nfunction resolveManagedVmIngressOptions(\n\tingressOptions: EnableIngressOptions = {},\n): EnableIngressOptions {\n\tconst resolvedOptions: EnableIngressOptions = {\n\t\t...MANAGED_VM_DEFAULT_INGRESS_OPTIONS,\n\t};\n\n\tif (ingressOptions.listenHost !== undefined) {\n\t\tresolvedOptions.listenHost = ingressOptions.listenHost;\n\t}\n\tif (ingressOptions.listenPort !== undefined) {\n\t\tresolvedOptions.listenPort = ingressOptions.listenPort;\n\t}\n\tif (ingressOptions.allowWebSockets !== undefined) {\n\t\tresolvedOptions.allowWebSockets = ingressOptions.allowWebSockets;\n\t}\n\tif (ingressOptions.hooks !== undefined) {\n\t\tresolvedOptions.hooks = ingressOptions.hooks;\n\t}\n\tif (ingressOptions.bufferResponseBody !== undefined) {\n\t\tresolvedOptions.bufferResponseBody = ingressOptions.bufferResponseBody;\n\t}\n\tif (ingressOptions.maxBufferedResponseBodyBytes !== undefined) {\n\t\tresolvedOptions.maxBufferedResponseBodyBytes = ingressOptions.maxBufferedResponseBodyBytes;\n\t}\n\tif (ingressOptions.upstreamHeaderTimeoutMs !== undefined) {\n\t\tresolvedOptions.upstreamHeaderTimeoutMs = ingressOptions.upstreamHeaderTimeoutMs;\n\t}\n\tif (ingressOptions.upstreamResponseTimeoutMs !== undefined) {\n\t\tresolvedOptions.upstreamResponseTimeoutMs = ingressOptions.upstreamResponseTimeoutMs;\n\t}\n\n\treturn resolvedOptions;\n}\n\ninterface TcpHostEndpoint {\n\treadonly hostname: string;\n\treadonly port: number;\n}\n\ninterface InternalTcpHostRule extends TcpHostEndpoint {}\n\nfunction normalizePolicyHostname(hostname: string): string {\n\treturn hostname.toLowerCase();\n}\n\nfunction parseTcpHostEndpoint(endpoint: string): TcpHostEndpoint | undefined {\n\tif (endpoint.startsWith('[')) {\n\t\tconst closingBracketIndex = endpoint.indexOf(']');\n\t\tif (closingBracketIndex > 1) {\n\t\t\tconst portValue = Number.parseInt(endpoint.slice(closingBracketIndex + 2), 10);\n\t\t\tif (!Number.isFinite(portValue)) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\thostname: normalizePolicyHostname(endpoint.slice(1, closingBracketIndex)),\n\t\t\t\tport: portValue,\n\t\t\t};\n\t\t}\n\t}\n\n\tconst portSeparatorIndex = endpoint.lastIndexOf(':');\n\tif (portSeparatorIndex <= 0) {\n\t\treturn undefined;\n\t}\n\tconst portValue = Number.parseInt(endpoint.slice(portSeparatorIndex + 1), 10);\n\tif (!Number.isFinite(portValue)) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\thostname: normalizePolicyHostname(endpoint.slice(0, portSeparatorIndex)),\n\t\tport: portValue,\n\t};\n}\n\nfunction ipv4AddressIsInternal(ipAddress: string): boolean {\n\tconst octets = ipAddress.split('.').map((segment) => Number.parseInt(segment, 10));\n\tif (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet))) {\n\t\treturn false;\n\t}\n\tconst firstOctet = octets[0];\n\tconst secondOctet = octets[1];\n\tif (firstOctet === undefined || secondOctet === undefined) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tfirstOctet === 10 ||\n\t\tfirstOctet === 127 ||\n\t\t(firstOctet === 169 && secondOctet === 254) ||\n\t\t(firstOctet === 172 && secondOctet >= 16 && secondOctet <= 31) ||\n\t\t(firstOctet === 192 && secondOctet === 168) ||\n\t\t(firstOctet === 100 && secondOctet >= 64 && secondOctet <= 127)\n\t);\n}\n\nfunction ipAddressIsInternal(ipAddress: string): boolean {\n\tif (net.isIP(ipAddress) === 4) {\n\t\treturn ipv4AddressIsInternal(ipAddress);\n\t}\n\tconst normalizedIpAddress = ipAddress.toLowerCase();\n\tif (normalizedIpAddress.startsWith('::ffff:')) {\n\t\treturn ipv4AddressIsInternal(normalizedIpAddress.slice('::ffff:'.length));\n\t}\n\treturn (\n\t\tnormalizedIpAddress === '::1' ||\n\t\tnormalizedIpAddress.startsWith('fc') ||\n\t\tnormalizedIpAddress.startsWith('fd') ||\n\t\tnormalizedIpAddress.startsWith('fe80:')\n\t);\n}\n\nfunction endpointHostnameIsInternal(hostname: string): boolean {\n\tconst normalizedHostname = normalizePolicyHostname(hostname);\n\treturn (\n\t\tnormalizedHostname === 'localhost' ||\n\t\tnormalizedHostname === 'host.docker.internal' ||\n\t\tipAddressIsInternal(normalizedHostname)\n\t);\n}\n\nfunction deriveInternalTcpHostRules(\n\ttcpHosts: Record<string, string> | undefined,\n): readonly InternalTcpHostRule[] {\n\tif (!tcpHosts) {\n\t\treturn [];\n\t}\n\n\tconst rules: InternalTcpHostRule[] = [];\n\tfor (const [tcpHostKey, tcpHostTarget] of Object.entries(tcpHosts)) {\n\t\tconst exposedEndpoint = parseTcpHostEndpoint(tcpHostKey);\n\t\tconst targetEndpoint = parseTcpHostEndpoint(tcpHostTarget);\n\t\tif (\n\t\t\t!exposedEndpoint ||\n\t\t\t!targetEndpoint ||\n\t\t\t!endpointHostnameIsInternal(targetEndpoint.hostname)\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (\n\t\t\t!rules.some(\n\t\t\t\t(rule) => rule.hostname === exposedEndpoint.hostname && rule.port === exposedEndpoint.port,\n\t\t\t)\n\t\t) {\n\t\t\trules.push(exposedEndpoint);\n\t\t}\n\t}\n\treturn rules;\n}\n\nfunction mergeUniqueHosts(\n\thosts: readonly string[],\n\tadditionalHosts: readonly string[],\n): readonly string[] {\n\tconst mergedHosts = [...hosts];\n\tfor (const host of additionalHosts) {\n\t\tif (!mergedHosts.includes(host)) {\n\t\t\tmergedHosts.push(host);\n\t\t}\n\t}\n\treturn mergedHosts;\n}\n\nfunction normalizeGitRepoPath(repoPath: string): string {\n\treturn repoPath.replace(/^\\/+/u, '').replace(/\\.git$/u, '');\n}\n\nexport function createGitReadOnlySshEgressOptions(\n\toptions: GitReadOnlySshEgressOptions,\n): ManagedSshEgressOptions {\n\tconst allowedRepos =\n\t\toptions.allowedRepos === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.allowedRepos.map((repoPath) => normalizeGitRepoPath(repoPath)));\n\n\treturn {\n\t\tallowedHosts: [...options.allowedHosts],\n\t\t...(options.agent ? { agent: options.agent } : {}),\n\t\t...(options.knownHostsFile ? { knownHostsFile: options.knownHostsFile } : {}),\n\t\texecPolicy: (request) => {\n\t\t\tconst gitExec = getInfoFromSshExecRequest(request);\n\t\t\tif (!gitExec) {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: non-git SSH exec is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (gitExec.service === 'git-receive-pack') {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: git push over guest SSH is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (gitExec.service !== 'git-upload-pack') {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: unsupported git SSH service is denied',\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (allowedRepos && !allowedRepos.has(normalizeGitRepoPath(gitExec.repo))) {\n\t\t\t\treturn {\n\t\t\t\t\tallow: false,\n\t\t\t\t\tmessage: 'agent-vm: git repository is not allowlisted for guest SSH reads',\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allow: true };\n\t\t},\n\t};\n}\n\nfunction createInternalTcpHostPolicy(\n\trules: readonly InternalTcpHostRule[],\n): HttpHooks['isIpAllowed'] | undefined {\n\tif (rules.length === 0) {\n\t\treturn undefined;\n\t}\n\tconst ruleHostnames = new Set(rules.map((rule) => rule.hostname));\n\treturn (info) => {\n\t\tconst hostname = normalizePolicyHostname(info.hostname);\n\t\tconst exactRuleMatched = rules.some(\n\t\t\t(rule) => rule.hostname === hostname && rule.port === info.port,\n\t\t);\n\t\tif (ruleHostnames.has(hostname)) {\n\t\t\treturn exactRuleMatched;\n\t\t}\n\t\tif (ipAddressIsInternal(info.ip)) {\n\t\t\treturn false;\n\t\t}\n\t\treturn true;\n\t};\n}\n\nexport async function createManagedVm(\n\toptions: CreateVmOptions,\n\tdependencies: ManagedVmDependencies = createDefaultDependencies(),\n): Promise<ManagedVm> {\n\tdependencies.configureHostNetworkDefaults?.();\n\tconst hasTcpHosts = options.tcpHosts && Object.keys(options.tcpHosts).length > 0;\n\tconst hasSshEgress = options.sshEgress !== undefined && options.sshEgress.allowedHosts.length > 0;\n\tconst internalTcpHostRules = deriveInternalTcpHostRules(options.tcpHosts);\n\tconst allowedInternalHosts = mergeUniqueHosts(\n\t\t[],\n\t\tinternalTcpHostRules.map((rule) => rule.hostname),\n\t);\n\tconst isIpAllowed = createInternalTcpHostPolicy(internalTcpHostRules);\n\tconst pinnedRealFsRoots = collectPinnedRealFsRoots(options.vfsMounts);\n\tlet createdVfsMounts: CreatedVfsMounts;\n\tlet vmInstance: ManagedVmInstance;\n\ttry {\n\t\tcreatedVfsMounts = createVfsMounts(options.vfsMounts, dependencies);\n\t\tconst hookBundle = dependencies.createHttpHooks({\n\t\t\tallowedHosts: options.allowedHosts,\n\t\t\t...(allowedInternalHosts.length > 0 ? { allowedInternalHosts } : {}),\n\t\t\t...(isIpAllowed ? { isIpAllowed } : {}),\n\t\t\tsecrets: options.secrets,\n\t\t\t...(options.onRequest ? { onRequest: options.onRequest } : {}),\n\t\t\t...(options.onResponse ? { onResponse: options.onResponse } : {}),\n\t\t});\n\t\tvmInstance = await dependencies.createVm({\n\t\t\t...(options.imagePath.length > 0 ? { sandbox: { imagePath: options.imagePath } } : {}),\n\t\t\t...(options.sessionLabel ? { sessionLabel: options.sessionLabel } : {}),\n\t\t\trootfs: {\n\t\t\t\tmode: options.rootfsMode,\n\t\t\t\t...(options.runtimeRootfsSize === undefined ? {} : { size: options.runtimeRootfsSize }),\n\t\t\t},\n\t\t\tmemory: options.memory,\n\t\t\tcpus: options.cpus,\n\t\t\tenv: {\n\t\t\t\t...hookBundle.env,\n\t\t\t\t...options.env,\n\t\t\t},\n\t\t\thttpHooks: hookBundle.httpHooks,\n\t\t\tvfs: {\n\t\t\t\tfuseMount: '/data',\n\t\t\t\tmounts: createdVfsMounts.mounts,\n\t\t\t},\n\t\t\t...(hasTcpHosts || hasSshEgress\n\t\t\t\t? {\n\t\t\t\t\t\tdns: {\n\t\t\t\t\t\t\tmode: 'synthetic',\n\t\t\t\t\t\t\tsyntheticIPv4: SYNTHETIC_DNS_IPV4_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticIPv6: SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK,\n\t\t\t\t\t\t\tsyntheticHostMapping: 'per-host',\n\t\t\t\t\t\t},\n\t\t\t\t\t\t...(hasSshEgress ? { ssh: options.sshEgress } : {}),\n\t\t\t\t\t\t...(hasTcpHosts\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\ttcp: {\n\t\t\t\t\t\t\t\t\t\thosts: options.tcpHosts,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t});\n\t} catch (error) {\n\t\tclosePinnedRealFsRootsAfterFailure(pinnedRealFsRoots, dependencies);\n\t\tthrow error;\n\t}\n\n\tlet finalizationPoison: unknown;\n\tlet lifecycleState: 'closed' | 'created' | 'started' = 'created';\n\tconst poisonFinalization = (error: unknown): void => {\n\t\tfinalizationPoison ??= error;\n\t};\n\treturn {\n\t\tfs: vmInstance.fs,\n\t\tid: vmInstance.id,\n\t\texec(command: ManagedExecInput, execOptions?: ManagedExecOptions): ManagedExecProcess {\n\t\t\tconst normalizedCommand = typeof command === 'string' ? command : [...command];\n\t\t\treturn vmInstance.exec(normalizedCommand, execOptions);\n\t\t},\n\t\tasync enableSsh(sshOptions?: EnableSshOptions): Promise<SshAccess> {\n\t\t\tconst sshAccess = await vmInstance.enableSsh(sshOptions);\n\t\t\tlet serverHostKey: SshServerHostKey;\n\t\t\ttry {\n\t\t\t\tserverHostKey = await readSshServerHostKey(vmInstance);\n\t\t\t} catch (identityError) {\n\t\t\t\treturn await closeSshAccessAfterIdentityFailure(sshAccess, identityError);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tclose: async (): Promise<void> => await sshAccess.close(),\n\t\t\t\tcommand: sshAccess.command,\n\t\t\t\thost: sshAccess.host,\n\t\t\t\tidentityFile: sshAccess.identityFile,\n\t\t\t\tport: sshAccess.port,\n\t\t\t\tserverHostKey,\n\t\t\t\tuser: sshAccess.user,\n\t\t\t};\n\t\t},\n\t\tasync enableIngress(ingressOptions?: EnableIngressOptions): Promise<IngressAccess> {\n\t\t\treturn await vmInstance.enableIngress(resolveManagedVmIngressOptions(ingressOptions));\n\t\t},\n\t\tasync finalizeMemoryMount(request: ManagedVmFinalizeMemoryMountRequest): Promise<void> {\n\t\t\tif (lifecycleState === 'closed') {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mounts cannot be finalized after close.');\n\t\t\t}\n\t\t\tif (lifecycleState === 'started') {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mounts cannot be finalized after start.');\n\t\t\t}\n\t\t\tif (finalizationPoison !== undefined) {\n\t\t\t\tthrow new Error('Managed Gondolin VM memory mount finalization is poisoned.', {\n\t\t\t\t\tcause: finalizationPoison,\n\t\t\t\t});\n\t\t\t}\n\t\t\tlet validatedRequest: ManagedVmFinalizeMemoryMountRequest;\n\t\t\ttry {\n\t\t\t\tvalidatedRequest = validateManagedVmFinalizeMemoryMountRequest(request);\n\t\t\t\tconst mount = createdVfsMounts.finalizableMemoryMounts.get(validatedRequest.guestPath);\n\t\t\t\tif (mount === undefined) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed Gondolin VM has no declared finalizable memory mount at '${validatedRequest.guestPath}'.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (mount.state !== 'pending') {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed Gondolin VM memory mount '${validatedRequest.guestPath}' must be finalized exactly once.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tmount.state = 'finalizing';\n\t\t\t\tif (mount.provider.writeFile === undefined) {\n\t\t\t\t\tthrow new Error('Gondolin memory provider does not support file writes.');\n\t\t\t\t}\n\t\t\t\tfor (const file of validatedRequest.files) {\n\t\t\t\t\t// oxlint-disable-next-line no-await-in-loop -- one-shot inventory publication is intentionally ordered.\n\t\t\t\t\tawait mount.provider.writeFile(`/${file.relativePath}`, Buffer.from(file.contents), {\n\t\t\t\t\t\tmode: file.mode,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tmount.state = 'finalized';\n\t\t\t} catch (error) {\n\t\t\t\tconst mount = createdVfsMounts.finalizableMemoryMounts.get(request.guestPath);\n\t\t\t\tif (mount !== undefined) mount.state = 'failed';\n\t\t\t\tpoisonFinalization(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t\tgetHostPid(): number | null {\n\t\t\treturn vmInstance.getHostPid?.() ?? null;\n\t\t},\n\t\tgetVmInstance(): ManagedVmInstance {\n\t\t\treturn vmInstance;\n\t\t},\n\t\tsetIngressRoutes(routes: readonly IngressRoute[]): void {\n\t\t\tvmInstance.setIngressRoutes(routes);\n\t\t},\n\t\tasync start(): Promise<void> {\n\t\t\tif (finalizationPoison !== undefined) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t'Managed Gondolin VM cannot start after memory finalization was poisoned.',\n\t\t\t\t\t{\n\t\t\t\t\t\tcause: finalizationPoison,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst incompleteMount = [...createdVfsMounts.finalizableMemoryMounts].find(\n\t\t\t\t([, mount]) => mount.state !== 'finalized',\n\t\t\t);\n\t\t\tif (incompleteMount !== undefined) {\n\t\t\t\tconst error = new Error(\n\t\t\t\t\t`Managed Gondolin VM memory mount '${incompleteMount[0]}' must be finalized before start.`,\n\t\t\t\t);\n\t\t\t\tpoisonFinalization(error);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tawait vmInstance.start();\n\t\t\tlifecycleState = 'started';\n\t\t},\n\t\tasync close(): Promise<void> {\n\t\t\tconst closeErrors: unknown[] = [];\n\t\t\ttry {\n\t\t\t\tawait vmInstance.close();\n\t\t\t} catch (error) {\n\t\t\t\tcloseErrors.push(error);\n\t\t\t}\n\t\t\tlifecycleState = 'closed';\n\t\t\tcreatedVfsMounts.finalizableMemoryMounts.clear();\n\t\t\ttry {\n\t\t\t\tclosePinnedRealFsRoots(pinnedRealFsRoots, dependencies);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof AggregateError) {\n\t\t\t\t\tcloseErrors.push(...error.errors);\n\t\t\t\t} else {\n\t\t\t\t\tcloseErrors.push(error);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (closeErrors.length === 1) {\n\t\t\t\tthrow closeErrors[0];\n\t\t\t}\n\t\t\tif (closeErrors.length > 1) {\n\t\t\t\tthrow new AggregateError(closeErrors, 'Managed Gondolin VM cleanup failed.');\n\t\t\t}\n\t\t},\n\t};\n}\n","import fs from 'node:fs/promises';\nimport path from 'node:path';\n\nimport {\n\tcreateOwnedHostDirectoryController,\n\tassertPositiveHostProcessId,\n\tvalidateManagedVmFilteredWorkspacePolicy,\n\ttype ManagedVm,\n\ttype ManagedVmAccessHandle,\n\ttype ManagedVmCreateRequest,\n\ttype ManagedVmExecCommand,\n\ttype ManagedVmExecOptions,\n\ttype ManagedVmExecOutputChunk,\n\ttype ManagedVmExecProcess,\n\ttype ManagedVmExecResult,\n\ttype ManagedVmExecStreamMode,\n\ttype ManagedVmIngressOptions,\n\ttype ManagedVmIngressRoute,\n\ttype ManagedVmProvider,\n\ttype ManagedVmSshAccess,\n\ttype OwnedHostDirectory,\n\ttype OwnedHostDirectoryTransfer,\n} from '@agent-vm/managed-vm';\nimport { validateBuildConfig } from '@earendil-works/gondolin';\nimport { parse, printParseErrorCode, type ParseError } from 'jsonc-parser';\n\nimport { buildImage } from './build-pipeline.js';\nimport { createGondolinExactProcessTerminationCapability } from './exact-recorded-process-termination.js';\nimport {\n\tresolveGondolinMinimumZigVersion,\n\tresolveGondolinPackageSpec,\n} from './gondolin-package.js';\nimport {\n\tassertPinnedRealFsRoot,\n\tclosePinnedRealFsRoot,\n\tpinRealFsRoot,\n\ttype PinnedRealFsRoot,\n} from './pinned-realfs.js';\nimport {\n\tcreateGitReadOnlySshEgressOptions,\n\tcreateManagedVm as createNativeManagedVm,\n\ttype ManagedExecOptions as NativeManagedExecOptions,\n\ttype ManagedVm as NativeManagedVm,\n\ttype VfsMountSpec,\n} from './vm-adapter.js';\n\ntype OwnedDirectoryProvenance = WeakMap<OwnedHostDirectory, PinnedRealFsRoot>;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction formatUnknownValue(value: unknown): string {\n\treturn typeof value === 'string' ? value : JSON.stringify(value);\n}\n\nfunction assertCreateRequestSupported(request: ManagedVmCreateRequest): void {\n\tif (!['readonly', 'memory', 'cow'].includes(request.rootfsMode)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported managed VM rootfs mode: ${formatUnknownValue(request.rootfsMode)}`,\n\t\t);\n\t}\n\tif (!Number.isSafeInteger(request.resources.cpuCount) || request.resources.cpuCount <= 0) {\n\t\tthrow new Error('Managed VM CPU count must be a positive safe integer.');\n\t}\n\tif (request.imageReference.length === 0 || request.resources.memory.length === 0) {\n\t\tthrow new Error('Managed VM image reference and memory must be non-empty.');\n\t}\n\tif (request.sshEgress !== undefined && request.sshEgress.kind !== 'git-read-only') {\n\t\tthrow new Error(\n\t\t\t`Unsupported managed VM SSH egress kind: ${formatUnknownValue(request.sshEgress.kind)}`,\n\t\t);\n\t}\n\tfor (const [guestPath, mount] of Object.entries(request.mounts)) {\n\t\tif (!guestPath.startsWith('/')) {\n\t\t\tthrow new Error(`Managed VM mount path must be absolute: ${guestPath}`);\n\t\t}\n\t\tif (\n\t\t\t![\n\t\t\t\t'host-directory',\n\t\t\t\t'finalizable-memory',\n\t\t\t\t'owned-host-directory',\n\t\t\t\t'owned-filtered-workspace',\n\t\t\t\t'memory',\n\t\t\t\t'shadow',\n\t\t\t].includes(mount.kind)\n\t\t) {\n\t\t\tthrow new Error(`Unsupported managed VM mount kind: ${formatUnknownValue(mount.kind)}`);\n\t\t}\n\t}\n\tconst mediatedSecretNames = new Set<string>();\n\tfor (const secret of request.mediatedSecrets) {\n\t\tif (mediatedSecretNames.has(secret.environmentVariable)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate managed VM mediated-secret environment variable: ${secret.environmentVariable}`,\n\t\t\t);\n\t\t}\n\t\tmediatedSecretNames.add(secret.environmentVariable);\n\t}\n\tconst tcpGuestHosts = new Set<string>();\n\tfor (const mapping of request.tcpHosts) {\n\t\tif (tcpGuestHosts.has(mapping.guestHost)) {\n\t\t\tthrow new Error(`Duplicate managed VM TCP guest host: ${mapping.guestHost}`);\n\t\t}\n\t\ttcpGuestHosts.add(mapping.guestHost);\n\t}\n}\n\ninterface TranslatedMounts {\n\treadonly mounts: Record<string, VfsMountSpec>;\n\treadonly transfers: readonly OwnedHostDirectoryTransfer[];\n}\n\nfunction closeOwnedDirectoryTransfers(\n\ttransfers: readonly OwnedHostDirectoryTransfer[],\n): readonly unknown[] {\n\tconst closeErrors: unknown[] = [];\n\tfor (const transfer of transfers) {\n\t\ttry {\n\t\t\ttransfer.close();\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t}\n\treturn closeErrors;\n}\n\nfunction isReadonlyStringArray(\n\tvalue: readonly string[] | Readonly<Record<string, string>>,\n): value is readonly string[] {\n\treturn Array.isArray(value);\n}\n\nfunction translateExecEnvironment(\n\tenvironment: readonly string[] | Readonly<Record<string, string>>,\n): string[] | Record<string, string> {\n\treturn isReadonlyStringArray(environment) ? [...environment] : { ...environment };\n}\n\nfunction translateExecStdin(\n\tstdin: string | Uint8Array | AsyncIterable<Uint8Array>,\n): string | Buffer | AsyncIterable<Buffer> {\n\tif (typeof stdin === 'string') {\n\t\treturn stdin;\n\t}\n\tif (stdin instanceof Uint8Array) {\n\t\treturn Buffer.from(stdin);\n\t}\n\treturn (async function* (): AsyncIterable<Buffer> {\n\t\tfor await (const chunk of stdin) {\n\t\t\tyield Buffer.from(chunk);\n\t\t}\n\t})();\n}\n\nconst MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES = 4 * 1024;\nconst MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES = 16 * 1024 * 1024;\n\nfunction translateExecStreamMode(mode: ManagedVmExecStreamMode): 'ignore' | 'pipe' {\n\tif (typeof mode !== 'object' || mode === null || !('kind' in mode)) {\n\t\tthrow new Error('Unsupported managed VM exec output mode.');\n\t}\n\tif (mode.kind === 'pipe') {\n\t\treturn 'pipe';\n\t}\n\tif (mode.kind === 'discard') {\n\t\treturn 'ignore';\n\t}\n\tthrow new Error('Unsupported managed VM exec output mode.');\n}\n\nfunction translateExecStreamingOptions(\n\toutput: NonNullable<ManagedVmExecOptions['output']>,\n): Pick<NativeManagedExecOptions, 'stderr' | 'stdout' | 'windowBytes'> {\n\tif (\n\t\t!Number.isInteger(output.windowBytes) ||\n\t\toutput.windowBytes < MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES ||\n\t\toutput.windowBytes > MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES\n\t) {\n\t\tthrow new Error(\n\t\t\t`Managed VM exec output window must be an integer between ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MIN_BYTES)} and ${String(MANAGED_VM_EXEC_OUTPUT_WINDOW_MAX_BYTES)} bytes.`,\n\t\t);\n\t}\n\treturn {\n\t\tstderr: translateExecStreamMode(output.stderr),\n\t\tstdout: translateExecStreamMode(output.stdout),\n\t\twindowBytes: output.windowBytes,\n\t};\n}\n\nfunction translateExecOptions(options: ManagedVmExecOptions): NativeManagedExecOptions {\n\treturn {\n\t\t...(options.argv ? { argv: [...options.argv] } : {}),\n\t\t...(options.cwd ? { cwd: options.cwd } : {}),\n\t\t...(options.env ? { env: translateExecEnvironment(options.env) } : {}),\n\t\t...(options.output === undefined ? {} : translateExecStreamingOptions(options.output)),\n\t\t...(options.pty === undefined ? {} : { pty: options.pty }),\n\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t...(options.stdin === undefined ? {} : { stdin: translateExecStdin(options.stdin) }),\n\t};\n}\n\nfunction wrapExecProcess(nativeProcess: ReturnType<NativeManagedVm['exec']>): ManagedVmExecProcess {\n\tconst result: Promise<ManagedVmExecResult> = nativeProcess.result;\n\treturn Object.assign(result, {\n\t\t[Symbol.asyncIterator](): AsyncIterator<string> {\n\t\t\treturn nativeProcess[Symbol.asyncIterator]();\n\t\t},\n\t\tend(): void {\n\t\t\tnativeProcess.end();\n\t\t},\n\t\tlines(): AsyncIterable<string> {\n\t\t\treturn nativeProcess.lines();\n\t\t},\n\t\toutput(): AsyncIterable<ManagedVmExecOutputChunk> {\n\t\t\treturn nativeProcess.output();\n\t\t},\n\t\tresize(rows: number, columns: number): void {\n\t\t\tnativeProcess.resize(rows, columns);\n\t\t},\n\t\tresult,\n\t\twrite(data: string | Uint8Array): void {\n\t\t\tnativeProcess.write(typeof data === 'string' ? data : Buffer.from(data));\n\t\t},\n\t}) satisfies ManagedVmExecProcess;\n}\n\nasync function assertReadonlyInputSourcesStayWithinOwnedRoot(\n\tpinnedRoot: PinnedRealFsRoot,\n\tpolicy: ReturnType<typeof validateManagedVmFilteredWorkspacePolicy>,\n): Promise<void> {\n\tconst canonicalRootPrefix = pinnedRoot.realPath.endsWith(path.sep)\n\t\t? pinnedRoot.realPath\n\t\t: `${pinnedRoot.realPath}${path.sep}`;\n\tawait Promise.all(\n\t\tpolicy.readonlyInputs.map(async (readonlyInput) => {\n\t\t\tconst sourcePath = path.join(\n\t\t\t\tpinnedRoot.realPath,\n\t\t\t\t...readonlyInput.sourceRelativePath.split('/'),\n\t\t\t);\n\t\t\tconst canonicalSourcePath = await fs.realpath(sourcePath);\n\t\t\tif (\n\t\t\t\tcanonicalSourcePath !== pinnedRoot.realPath &&\n\t\t\t\t!canonicalSourcePath.startsWith(canonicalRootPrefix)\n\t\t\t) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Managed filtered workspace read-only source crosses the owned root boundary: ${readonlyInput.sourceRelativePath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}),\n\t);\n}\n\nasync function translateMounts(\n\tmounts: ManagedVmCreateRequest['mounts'],\n\townedDirectoryRoots: OwnedDirectoryProvenance,\n): Promise<TranslatedMounts> {\n\tconst translatedMounts: Record<string, VfsMountSpec> = {};\n\tconst transfers: OwnedHostDirectoryTransfer[] = [];\n\tconst sourceValidations: {\n\t\treadonly pinnedRoot: PinnedRealFsRoot;\n\t\treadonly policy: ReturnType<typeof validateManagedVmFilteredWorkspacePolicy>;\n\t}[] = [];\n\ttry {\n\t\tfor (const [guestPath, mount] of Object.entries(mounts)) {\n\t\t\tswitch (mount.kind) {\n\t\t\t\tcase 'finalizable-memory':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\taccess: mount.access,\n\t\t\t\t\t\tkind: 'finalizable-memory',\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'host-directory':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\thostPath: mount.hostPath,\n\t\t\t\t\t\tkind: mount.access === 'read-only' ? 'realfs-readonly' : 'realfs',\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'owned-host-directory': {\n\t\t\t\t\tconst pinnedRoot = ownedDirectoryRoots.get(mount.directory);\n\t\t\t\t\tif (!pinnedRoot) {\n\t\t\t\t\t\tthrow new Error('Owned host directory was not acquired by this Gondolin provider.');\n\t\t\t\t\t}\n\t\t\t\t\tassertPinnedRealFsRoot(pinnedRoot);\n\t\t\t\t\ttransfers.push(mount.directory.consume());\n\t\t\t\t\townedDirectoryRoots.delete(mount.directory);\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\tkind: mount.access === 'read-only' ? 'realfs-readonly' : 'realfs',\n\t\t\t\t\t\tpinnedHostRoot: pinnedRoot,\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase 'owned-filtered-workspace': {\n\t\t\t\t\tconst pinnedRoot = ownedDirectoryRoots.get(mount.directory);\n\t\t\t\t\tif (!pinnedRoot) {\n\t\t\t\t\t\tthrow new Error('Owned host directory was not acquired by this Gondolin provider.');\n\t\t\t\t\t}\n\t\t\t\t\tassertPinnedRealFsRoot(pinnedRoot);\n\t\t\t\t\ttransfers.push(mount.directory.consume());\n\t\t\t\t\townedDirectoryRoots.delete(mount.directory);\n\t\t\t\t\tconst policy = validateManagedVmFilteredWorkspacePolicy(mount.policy);\n\t\t\t\t\tsourceValidations.push({ pinnedRoot, policy });\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\tkind: 'filtered-workspace',\n\t\t\t\t\t\tpinnedHostRoot: pinnedRoot,\n\t\t\t\t\t\tpolicy,\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase 'memory':\n\t\t\t\t\ttranslatedMounts[guestPath] = { kind: 'memory' };\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'shadow':\n\t\t\t\t\ttranslatedMounts[guestPath] = {\n\t\t\t\t\t\thostPath: mount.hostPath,\n\t\t\t\t\t\tkind: 'shadow',\n\t\t\t\t\t\tshadowConfig: {\n\t\t\t\t\t\t\tdeny: mount.deny,\n\t\t\t\t\t\t\ttmpfs: mount.temporaryFilesystems,\n\t\t\t\t\t\t},\n\t\t\t\t\t};\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tawait Promise.all(\n\t\t\tsourceValidations.map(({ pinnedRoot, policy }) =>\n\t\t\t\tassertReadonlyInputSourcesStayWithinOwnedRoot(pinnedRoot, policy),\n\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tconst closeErrors = closeOwnedDirectoryTransfers(transfers);\n\t\tif (closeErrors.length > 0) {\n\t\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError cause and errors both retain the primary translation failure.\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, ...closeErrors],\n\t\t\t\t'Managed VM mount translation and owned-directory cleanup both failed.',\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n\treturn { mounts: translatedMounts, transfers };\n}\n\nfunction wrapManagedVm(\n\tnativeVm: NativeManagedVm,\n\townedDirectoryTransfers: readonly OwnedHostDirectoryTransfer[],\n): ManagedVm {\n\ttype ManagedVmLifecycleState =\n\t\t| 'created'\n\t\t| 'starting'\n\t\t| 'started'\n\t\t| 'start-failed'\n\t\t| 'closing'\n\t\t| 'closed';\n\tlet closePromise: Promise<void> | undefined;\n\tlet hostProcessId: number | null = null;\n\tlet lifecycleState: ManagedVmLifecycleState = 'created';\n\tlet startPromise: Promise<void> | undefined;\n\tconst closeOnce = async (): Promise<void> => {\n\t\tif (startPromise) {\n\t\t\ttry {\n\t\t\t\tawait startPromise;\n\t\t\t} catch {\n\t\t\t\t// Mechanical close must continue after either start success or failure.\n\t\t\t}\n\t\t}\n\t\tconst closeErrors: unknown[] = [];\n\t\ttry {\n\t\t\tawait nativeVm.close();\n\t\t} catch (error) {\n\t\t\tcloseErrors.push(error);\n\t\t}\n\t\tcloseErrors.push(...closeOwnedDirectoryTransfers(ownedDirectoryTransfers));\n\t\ttry {\n\t\t\tif (closeErrors.length === 1) {\n\t\t\t\tthrow closeErrors[0];\n\t\t\t}\n\t\t\tif (closeErrors.length > 1) {\n\t\t\t\tthrow new AggregateError(closeErrors, 'Managed VM cleanup failed.');\n\t\t\t}\n\t\t} finally {\n\t\t\thostProcessId = null;\n\t\t\tlifecycleState = 'closed';\n\t\t}\n\t};\n\treturn {\n\t\tasync close(): Promise<void> {\n\t\t\tif (!closePromise) {\n\t\t\t\tlifecycleState = 'closing';\n\t\t\t\tclosePromise = closeOnce();\n\t\t\t}\n\t\t\tawait closePromise;\n\t\t},\n\t\tconfigureIngressRoutes(routes: readonly ManagedVmIngressRoute[]): void {\n\t\t\tnativeVm.setIngressRoutes(\n\t\t\t\troutes.map((route) => ({\n\t\t\t\t\tport: route.port,\n\t\t\t\t\tprefix: route.prefix,\n\t\t\t\t\tstripPrefix: route.stripPrefix,\n\t\t\t\t})),\n\t\t\t);\n\t\t},\n\t\tasync enableIngress(options?: ManagedVmIngressOptions): Promise<ManagedVmAccessHandle> {\n\t\t\treturn await nativeVm.enableIngress(options);\n\t\t},\n\t\tasync enableSsh(options): Promise<ManagedVmSshAccess> {\n\t\t\tconst access = await nativeVm.enableSsh(options);\n\t\t\tif (!access.command || !access.identityFile || !access.user) {\n\t\t\t\tawait access.close();\n\t\t\t\tthrow new Error('Gondolin SSH access omitted required neutral connection fields.');\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tclose: async (): Promise<void> => await access.close(),\n\t\t\t\tcommand: access.command,\n\t\t\t\thost: access.host,\n\t\t\t\tidentityFile: access.identityFile,\n\t\t\t\tport: access.port,\n\t\t\t\tserverHostKey: access.serverHostKey,\n\t\t\t\tuser: access.user,\n\t\t\t};\n\t\t},\n\t\tasync finalizeMemoryMount(request): Promise<void> {\n\t\t\tawait nativeVm.finalizeMemoryMount(request);\n\t\t},\n\t\texec(command: ManagedVmExecCommand, options?: ManagedVmExecOptions): ManagedVmExecProcess {\n\t\t\tconst normalizedCommand = typeof command === 'string' ? command : [...command];\n\t\t\tconst nativeProcess = nativeVm.exec(\n\t\t\t\tnormalizedCommand,\n\t\t\t\toptions ? translateExecOptions(options) : undefined,\n\t\t\t);\n\t\t\treturn wrapExecProcess(nativeProcess);\n\t\t},\n\t\tgetHostProcessId(): number | null {\n\t\t\tif (hostProcessId === null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst currentHostProcessId = nativeVm.getHostPid();\n\t\t\tif (currentHostProcessId === null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (currentHostProcessId !== hostProcessId) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Gondolin runner identity changed for managed VM '${nativeVm.id}': expected pid ${String(hostProcessId)}, observed ${String(currentHostProcessId)}.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn hostProcessId;\n\t\t},\n\t\tid: nativeVm.id,\n\t\tasync start(): Promise<void> {\n\t\t\tif (lifecycleState === 'closing' || lifecycleState === 'closed') {\n\t\t\t\tthrow new Error('Managed VM cannot start after close has been requested.');\n\t\t\t}\n\t\t\tif (lifecycleState === 'started') {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!startPromise) {\n\t\t\t\tlifecycleState = 'starting';\n\t\t\t\tstartPromise = (async (): Promise<void> => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait nativeVm.start();\n\t\t\t\t\t\tconst startedHostProcessId = assertPositiveHostProcessId(nativeVm.getHostPid());\n\t\t\t\t\t\tif (lifecycleState !== 'starting') {\n\t\t\t\t\t\t\tthrow new Error('Managed VM closed while startup was settling.');\n\t\t\t\t\t\t}\n\t\t\t\t\t\thostProcessId = startedHostProcessId;\n\t\t\t\t\t\tlifecycleState = 'started';\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (lifecycleState === 'starting') {\n\t\t\t\t\t\t\tlifecycleState = 'start-failed';\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t})();\n\t\t\t}\n\t\t\tawait startPromise;\n\t\t},\n\t};\n}\n\nfunction openOwnedHostDirectory(\n\thostPath: string,\n\townedDirectoryRoots: OwnedDirectoryProvenance,\n): OwnedHostDirectory {\n\tconst pinnedRoot = pinRealFsRoot(hostPath);\n\tconst directory = createOwnedHostDirectoryController({\n\t\tidentity: {\n\t\t\tcanonicalPath: pinnedRoot.realPath,\n\t\t\tdevice: pinnedRoot.device,\n\t\t\tinode: pinnedRoot.inode,\n\t\t},\n\t\tonClose: () => closePinnedRealFsRoot(pinnedRoot),\n\t\tonConsume: () => assertPinnedRealFsRoot(pinnedRoot),\n\t});\n\townedDirectoryRoots.set(directory, pinnedRoot);\n\treturn directory;\n}\n\nexport function createGondolinManagedVmProvider(): ManagedVmProvider {\n\tconst ownedDirectoryRoots: OwnedDirectoryProvenance = new WeakMap();\n\treturn {\n\t\tdiagnostics: {\n\t\t\tasync checkCompatibility() {\n\t\t\t\tconst diagnostics = [];\n\t\t\t\ttry {\n\t\t\t\t\tawait Promise.all([resolveGondolinPackageSpec(), resolveGondolinMinimumZigVersion()]);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tdiagnostics.push({\n\t\t\t\t\t\tcode: 'gondolin-toolchain-unavailable',\n\t\t\t\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t\t\t\t\tseverity: 'error' as const,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn diagnostics;\n\t\t\t},\n\t\t},\n\t\texactProcessTermination: createGondolinExactProcessTerminationCapability(),\n\t\tfactory: {\n\t\t\tasync createManagedVm(request: ManagedVmCreateRequest): Promise<ManagedVm> {\n\t\t\t\tassertCreateRequestSupported(request);\n\t\t\t\tconst secrets = Object.fromEntries(\n\t\t\t\t\trequest.mediatedSecrets.map((secret) => [\n\t\t\t\t\t\tsecret.environmentVariable,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\thosts: [...secret.allowedHosts],\n\t\t\t\t\t\t\t...(secret.guestPlaceholder === undefined\n\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t: { placeholder: secret.guestPlaceholder }),\n\t\t\t\t\t\t\tvalue: secret.value,\n\t\t\t\t\t\t},\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t\tconst tcpHosts = Object.fromEntries(\n\t\t\t\t\trequest.tcpHosts.map((mapping) => [mapping.guestHost, mapping.target]),\n\t\t\t\t);\n\t\t\t\tconst translatedMounts = await translateMounts(request.mounts, ownedDirectoryRoots);\n\t\t\t\tlet nativeVm: NativeManagedVm;\n\t\t\t\ttry {\n\t\t\t\t\tnativeVm = await createNativeManagedVm({\n\t\t\t\t\t\tallowedHosts: [...request.allowedHosts],\n\t\t\t\t\t\tcpus: request.resources.cpuCount,\n\t\t\t\t\t\tenv: { ...request.environment },\n\t\t\t\t\t\timagePath: request.imageReference,\n\t\t\t\t\t\tmemory: request.resources.memory,\n\t\t\t\t\t\t...(request.mediation?.onRequest ? { onRequest: request.mediation.onRequest } : {}),\n\t\t\t\t\t\t...(request.mediation?.onResponse ? { onResponse: request.mediation.onResponse } : {}),\n\t\t\t\t\t\trootfsMode: request.rootfsMode,\n\t\t\t\t\t\t...(request.runtimeRootfsSize ? { runtimeRootfsSize: request.runtimeRootfsSize } : {}),\n\t\t\t\t\t\tsecrets,\n\t\t\t\t\t\tsessionLabel: request.sessionLabel,\n\t\t\t\t\t\t...(request.sshEgress\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tsshEgress: createGitReadOnlySshEgressOptions({\n\t\t\t\t\t\t\t\t\t\tallowedHosts: request.sshEgress.allowedHosts,\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.agentSocket\n\t\t\t\t\t\t\t\t\t\t\t? { agent: request.sshEgress.agentSocket }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.allowedRepositories\n\t\t\t\t\t\t\t\t\t\t\t? { allowedRepos: request.sshEgress.allowedRepositories }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t\t...(request.sshEgress.knownHostsFile\n\t\t\t\t\t\t\t\t\t\t\t? { knownHostsFile: request.sshEgress.knownHostsFile }\n\t\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\ttcpHosts,\n\t\t\t\t\t\tvfsMounts: translatedMounts.mounts,\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst closeErrors = closeOwnedDirectoryTransfers(translatedMounts.transfers);\n\t\t\t\t\tif (closeErrors.length > 0) {\n\t\t\t\t\t\t// oxlint-disable-next-line preserve-caught-error -- AggregateError cause and errors both retain the primary construction failure.\n\t\t\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t\t\t[error, ...closeErrors],\n\t\t\t\t\t\t\t'Managed VM construction and owned-directory cleanup both failed.',\n\t\t\t\t\t\t\t{ cause: error },\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\treturn wrapManagedVm(nativeVm, translatedMounts.transfers);\n\t\t\t},\n\t\t},\n\t\timages: {\n\t\t\tasync prepareImage(request) {\n\t\t\t\tconst parseErrors: ParseError[] = [];\n\t\t\t\tconst parsedRecipe: unknown = parse(\n\t\t\t\t\tawait fs.readFile(request.recipePath, 'utf8'),\n\t\t\t\t\tparseErrors,\n\t\t\t\t\t{ allowTrailingComma: true },\n\t\t\t\t);\n\t\t\t\tif (parseErrors.length > 0) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Invalid managed VM image recipe '${request.recipePath}': ${parseErrors\n\t\t\t\t\t\t\t.map((parseError) => printParseErrorCode(parseError.error))\n\t\t\t\t\t\t\t.join(', ')}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (!isRecord(parsedRecipe) || !validateBuildConfig(parsedRecipe)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Managed VM image recipe has an invalid build shape: ${request.recipePath}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst result = await buildImage({\n\t\t\t\t\tbuildConfig: parsedRecipe,\n\t\t\t\t\tcacheDir: request.cacheDirectory,\n\t\t\t\t\tconfigDir: path.dirname(request.recipePath),\n\t\t\t\t\t...(request.forceRebuild === undefined ? {} : { fullReset: request.forceRebuild }),\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\tbuilt: result.built,\n\t\t\t\t\tfingerprint: result.fingerprint,\n\t\t\t\t\timageReference: result.imagePath,\n\t\t\t\t};\n\t\t\t},\n\t\t},\n\t\townedDirectories: {\n\t\t\topenHostDirectory: (hostPath: string): OwnedHostDirectory =>\n\t\t\t\topenOwnedHostDirectory(hostPath, ownedDirectoryRoots),\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;AAKA,MAAa,+BAA+B;;;;;;;;;;;AA6C5C,MAAM,qCAAqC;AAC3C,MAAM,oCAAoC;AAC1C,MAAM,4BAA4B;AAClC,MAAM,wBAAwB;AAE9B,SAAS,qBACR,oBACS;CACT,QAAQ,oBAAR;EACC,KAAK,4BACJ,OAAO;EACR,KAAK,8BACJ,OAAO;;;AAIV,SAAS,qBACR,oBACS;CACT,OAAO,uBAAuB,+BAC3B,yBACA;;AAGJ,SAAgB,qCACf,YACS;CACT,MAAM,+BAA+B,qBAAqB,WAAW,mBAAmB;CACxF,MAAM,2BAA2B,GAAG,sBAAsB,GAAG,qBAAqB,WAAW,mBAAmB;CAChH,MAAM,8BAA8B;CACpC,MAAM,oCACL,WAAW,uBAAuB,6BAA6B,qBAAqB;CACrF,OAAO;yCACiC,mCAAmC;wCACpC,kCAAkC;WAC/D,sBAAsB;qBACZ,0BAA0B;4BACnB,sBAAsB;4BACtB,yBAAyB;;;;;;SAM5C,kCAAkC,wBAAwB,mCAAmC,wDAAwD,mCAAmC,gGAAgG,kCAAkC;OAC5T,sBAAsB;;;sCAGS,4BAA4B;;;SAGzD,kCAAkC,wBAAwB,mCAAmC,sDAAsD,mCAAmC,6CAA6C,6BAA6B;OAClQ,yBAAyB;;;AAIhC,SAAS,uBAAuB,UAAkB,WAAuC;CACxF,OAAO,KAAK,WAAW,SAAS,GAAG,WAAW,KAAK,QAAQ,aAAa,QAAQ,KAAK,EAAE,SAAS;;AAGjG,eAAe,4BACd,aACA,WAC8B;CAC9B,MAAM,0BAA0B,YAAY,MAAM;CAClD,IAAI,CAAC,yBACJ;CAGD,MAAM,0BAA0B,uBAAuB,yBAAyB,UAAU;CAC1F,IAAI;EACH,OAAO,MAAM,GAAG,SAAS,yBAAyB,OAAO;UACjD,OAAO;EACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;EACtE,MAAM,IAAI,MACT,8CAA8C,wBAAwB,KAAK,WAC3E,EAAE,OAAO,OAAO,CAChB;;;AAIH,SAAS,uBAAuB,yBAAqD;CACpF,OAAO,0BACJ,GAAG,6BAA6B,SAAS,CAAC,MAAM,4BAChD;;AAGJ,eAAsB,uBACrB,SACmC;CACnC,IAAI,QAAQ,uBAAuB,KAAA,KAAa,QAAQ,YAAY,MAAM,iBACzE,MAAM,IAAI,MACT,mFACA;CAEF,MAAM,0BAA0B,MAAM,4BACrC,QAAQ,aACR,QAAQ,UACR;CACD,MAAM,gCACL,QAAQ,uBAAuB,KAAA,IAC5B,KAAA,IACA,qCAAqC,QAAQ,mBAAmB;CACpE,MAAM,0BAA0B,uBAAuB,wBAAwB;CAE/E,OAAO;EACN,SACC,kCAAkC,KAAA,IAC/B,0BACA,GAAG,wBAAwB,SAAS,CAAC,MAAM;EAC/C,kBAAkB;GACjB,wBAAwB;GACxB,GAAI,4BAA4B,KAAA,IAC7B,EAAE,GACF,EAAE,2BAA2B,yBAAyB;GACzD,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;GACrD;EACD;;AAGF,eAAsB,6CACrB,SACuB;CACvB,MAAM,sBAAsB,KAAK,KAAK,QAAQ,WAAW,gCAAgC;CAEzF,MAAM,GAAG,UAAU,qBAAqB,QAAQ,wBAAwB;EACvE,UAAU;EACV,MAAM;EACN,CAAC;CAEF,OAAO;EACN,GAAG,QAAQ;EACX,MAAM;GACL,GAAG,QAAQ,YAAY;GACvB,iBAAiB;GACjB;EACD;;;;AC7HF,MAAa,2BAA2B;CACvC;CACA;CACA;CACA;CACA;AAED,SAAS,wBAAwB,aAAmC;CACnE,IAAI,CAAC,oBAAoB,YAAY,EACpC,MAAM,IAAI,MAAM,sDAAsD;CAEvE,OAAO;;AAGR,SAAgB,kCAA6D;CAC5E,OAAO;EACN,MAAM,WAAW,SAAS,cAAc;GACvC,OAAO,MAAM,WACZ;IACC,GAAG;IACH,aAAa,wBAAwB,QAAQ,YAAY;IACzD,EACD,aACA;;EAEF,MAAM,mBAAmB,SAAS;GAKjC,QAAO,MAJc,iCAAiC;IACrD,GAAG;IACH,aAAa,wBAAwB,QAAQ,YAAY;IACzD,CAAC,EACY;;EAEf;;AAcF,MAAM,sCAAsB,IAAI,KAAwC;AACxE,MAAM,4BAA4B;AAElC,SAASA,WAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,gBAAgB,OAAwB;CAChD,IAAI,MAAM,QAAQ,MAAM,EACvB,OAAO,IAAI,MAAM,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;CAGnE,IAAIA,WAAS,MAAM,EAIlB,OAAO,IAHe,OAAO,QAAQ,MAAM,CACzC,QAAQ,GAAG,gBAAgB,eAAe,KAAA,EAAU,CACpD,UAAU,CAAC,UAAU,CAAC,cAAc,QAAQ,cAAc,SAAS,CAC7C,CACtB,KAAK,CAAC,UAAU,gBAAgB,GAAG,KAAK,UAAU,SAAS,CAAC,GAAG,gBAAgB,WAAW,GAAG,CAC7F,KAAK,IAAI,CAAC;CAGb,OAAO,KAAK,UAAU,MAAM;;AAG7B,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,eAAe,WAAW,UAAoC;CAC7D,IAAI;EACH,MAAM,GAAG,OAAO,SAAS;EACzB,OAAO;UACC,OAAO;EACf,IAAI,CAAC,mBAAmB,MAAM,EAC7B,MAAM;EAEP,OAAO;;;AAIT,eAAsB,oBAAoB,qBAA+C;CACxF,KAAK,MAAM,YAAY,0BAEtB,IAAI,CAAE,MAAM,WAAW,KAAK,KAAK,qBAAqB,SAAS,CAAC,EAC/D,OAAO;CAGT,OAAO;;AAGR,eAAe,kBAQb;CACD,MAAM,iBAAiB,MAAM,OAAO;CACpC,OAAO,OACN,aACA,iBACA,WACA,SACA,YAEA,MAAM,eAAe,YAAY,aAAa;EAC7C,WAAW;EACX,SAAS,WAAW;EACpB,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;EAClC,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;EAC9B,CAAwB;;AAG3B,SAAS,sBAAsB,QAAkD;CAChF,SACC,OACA,oBACA,aACa;EACb,MAAM,gBAAgB,OAAO,uBAAuB,aAAa,qBAAqB;EACtF,MAAM,QAAQ,OAAO,MAAM,MAAM;EACjC,iBAAiB;EACjB,OAAO;;;AAIT,eAAe,wBACd,QACA,IACmB;CACnB,IAAI,CAAC,QACJ,OAAO,MAAM,IAAI;CAGlB,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,sBAAsB,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO;CACrE,MAAM,aAAa,QAAQ,IAAI;CAC/B,MAAM,kBAAkB,sBAAsB,OAAO;CAErD,QAAQ,OAAO,QAAQ;CACvB,QAAQ,OAAO,QAAQ;CACvB,QAAQ,IAAI,KAAK;CAEjB,IAAI;EACH,OAAO,MAAM,IAAI;WACR;EACT,QAAQ,OAAO,QAAQ;EACvB,QAAQ,OAAO,QAAQ;EACvB,IAAI,eAAe,KAAA,GAClB,OAAO,QAAQ,IAAI;OAEnB,QAAQ,IAAI,KAAK;;;AAKpB,SAAgB,wBACf,aACA,kBAA0B,WAC1B,kBACS;CACT,MAAM,UACL,qBAAqB,KAAA,IAClB,GAAG,gBAAgB,YAAY,CAAC,GAAG,oBACnC,GAAG,gBAAgB,YAAY,CAAC,GAAG,gBAAgB,GAAG,gBAAgB,iBAAiB;CAE3F,OAAO,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAG9E,eAAsB,iCAAiC,SASpD;CACF,MAAM,0BAA0B,MAAM,uBAAuB;EAC5D,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;EACrD,CAAC;CAQF,OAAO;EACN,aARmB,wBAAwB,QAAQ,aAAa,QAAQ,iBAAiB;GACzF,wBAAwB,wBAAwB;GAChD,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,wBAAwB,QAAQ,kBAAkB;GACvD,CAGW;EACX,wBAAwB,wBAAwB;EAChD;;AAGF,eAAsB,WACrB,SACA,eAA0C,EAAE,EAChB;CAC5B,MAAM,4BAA4B,MAAM,iCAAiC;EACxE,aAAa,QAAQ;EACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC7D,GAAI,QAAQ,qBAAqB,KAAA,IAC9B,EAAE,GACF,EAAE,kBAAkB,QAAQ,kBAAkB;EACjD,GAAI,QAAQ,uBAAuB,KAAA,IAChC,EAAE,GACF,EAAE,oBAAoB,QAAQ,oBAAoB;EACrD,GAAI,aAAa,kBAAkB,EAAE,iBAAiB,aAAa,iBAAiB,GAAG,EAAE;EACzF,CAAC;CACF,MAAM,cAAc,0BAA0B;CAC9C,MAAM,YAAY,KAAK,KAAK,QAAQ,UAAU,YAAY;CAC1D,MAAM,2BAA2B,YAAuC;EACvE,IAAI,QAAQ,WACX,MAAM,GAAG,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;EAGzD,IAAI,MAAM,oBAAoB,UAAU,EACvC,OAAO;GACN,OAAO;GACP;GACA;GACA;EAGF,MAAM,GAAG,MAAM,WAAW,EAAE,WAAW,MAAM,CAAC;EAC9C,MAAM,4BAA4B,aAAa,eAAgB,MAAM,iBAAiB;EACtF,MAAM,uBAAuB,MAAM,6CAA6C;GAC/E,aAAa,QAAQ;GACrB;GACA,wBAAwB,0BAA0B;GAClD,CAAC;EACF,MAAM,kBAAkB,KAAK,KAAK,WAAW,0BAA0B;EACvE,MAAM,GAAG,GAAG,iBAAiB;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;EAC9D,IAAI;GACH,MAAM,wBAAwB,QAAQ,QAAQ,YAAY;IACzD,MAAM,0BACL,sBACA,WACA,QAAQ,WACR,iBACA,QAAQ,WAAW,KAAA,EACnB;KACA;YACO;GACT,MAAM,GAAG,GAAG,iBAAiB;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;;EAG/D,IAAI,CAAE,MAAM,oBAAoB,UAAU,EACzC,MAAM,IAAI,MAAM,6CAA6C,UAAU,GAAG;EAG3E,OAAO;GACN,OAAO;GACP;GACA;GACA;;CAGF,IAAI,QAAQ,QACX,OAAO,MAAM,0BAA0B;CAGxC,MAAM,cAAc,KAAK,QAAQ,UAAU;CAC3C,MAAM,gBAAgB,oBAAoB,IAAI,YAAY;CAC1D,IAAI,eACH,OAAO,MAAM;CAEd,MAAM,eAAe,0BAA0B;CAC/C,oBAAoB,IAAI,aAAa,aAAa;CAClD,IAAI;EACH,OAAO,MAAM;WACJ;EACT,IAAI,oBAAoB,IAAI,YAAY,KAAK,cAC5C,oBAAoB,OAAO,YAAY;;;;;ACnV1C,MAAM,gBAAgB,UAAU,SAAS;AACzC,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;AACtC,MAAM,gCAAgC;AACtC,MAAM,4BAA4B;AAoBlC,SAAS,iBAAiB,OAAyB;CAClD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QAAQ,MAAM,OAAO,KAAA;;AAGtF,SAAS,uBAAuB,SAA0B;CACzD,OAAO,0BAA0B,KAAK,QAAQ;;AAG/C,SAAS,gCAAgC,SAG7B;CACX,MAAM,uBAAuB,kBAAkB,KAAK,QAAQ,eAAe;CAC3E,IAAI,yBAAyB,MAC5B,OAAO;CAER,MAAM,qBAAqB,QAAQ,gBAAgB,MAAM,UAAU,EAAE,CAAC;CACtE,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,WAAW,GACrE,OAAO;CAER,OACC,qBAAqB,OAAO,SAAS,mBAAmB,CAAC,MAAM,GAAG,8BAA8B;;AAIlG,SAAS,mCAAmC,SAGhC;CACX,MAAM,uBAAuB,oBAAoB,KAAK,QAAQ,eAAe;CAC7E,IAAI,yBAAyB,MAC5B,OAAO;CAER,MAAM,qBAAqB,QAAQ,gBAAgB,MAAM,UAAU,EAAE,CAAC;CACtE,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,WAAW,GACrE,OAAO;CAER,OACC,qBAAqB,OAAO,SAAS,mBAAmB,CAAC,MAAM,GAAG,0BAA0B;;AAI9F,SAAS,2BAA2B,oBAA2C;CAC9E,IAAI,aAAa;CACjB,IAAI,cAAc;CAClB,KAAK,IAAI,QAAQ,GAAG,QAAQ,mBAAmB,QAAQ,SAAS,GAAG;EAClE,MAAM,YAAY,mBAAmB;EACrC,MAAM,eAAe,cAAc,OAAO,cAAc;EACxD,IAAI,CAAC,gBAAgB,CAAC,aACrB,cAAc;OACR,IAAI,gBAAgB,aAAa;GACvC,cAAc;GACd,cAAc;GACd,IAAI,eAAe,GAClB,OAAO;;;CAIV,OAAO;;AAGR,SAAS,2BACR,eACA,oBAC8B;CAC9B,MAAM,qBAAqB,mBAAmB,MAAM;CACpD,MAAM,uBAAuB,mBAAmB,OAAO,SAAS;CAChE,IAAI,yBAAyB,IAC5B,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,iDACzE;CAEF,MAAM,eAAe,mBAAmB,MAAM,GAAG,qBAAqB,CAAC,MAAM;CAC7E,MAAM,6BAA6B,mBAAmB,MAAM,qBAAqB,CAAC,MAAM;CACxF,MAAM,kBAAkB,2BAA2B,2BAA2B;CAC9E,IAAI,oBAAoB,MACvB,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,iDACzE;CAEF,MAAM,uBAAuB,2BAA2B,MAAM,GAAG,gBAAgB,CAAC,MAAM;CACxF,MAAM,UAAU,2BAA2B,MAAM,gBAAgB,CAAC,MAAM;CACxE,IAAI,aAAa,WAAW,KAAK,qBAAqB,WAAW,KAAK,QAAQ,WAAW,GACxF,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,2DACzE;CAEF,OAAO;EAAE;EAAS;EAAsB;EAAc;;AAGvD,eAAe,gCACd,eAC8C;CAC9C,IAAI;EACH,MAAM,EAAE,WAAW,MAAM,cAAc,MAAM;GAC5C;GACA,OAAO,cAAc;GACrB;GACA;GACA;GACA;GACA;GACA;GACA,CAAC;EACF,IAAI,OAAO,MAAM,CAAC,WAAW,GAC5B,MAAM,IAAI,MACT,mDAAmD,OAAO,cAAc,CAAC,oCACzE;EAEF,OAAO,2BAA2B,eAAe,OAAO;UAChD,OAAO;EACf,IAAI,iBAAiB,MAAM,KAAK,GAC/B,OAAO;EAER,MAAM;;;AAIR,SAAS,sBAAsB,eAAuB,QAA8B;CACnF,QAAQ,KAAK,eAAe,OAAO;;AAGpC,eAAe,MAAM,SAAgC;CACpD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;;AAG7D,MAAM,sBAAsB;CAC3B,KAAK,KAAK;CACV,qBAAqB;CACrB,YAAY;CACZ;CACA;AAED,SAAS,yBAAyB,SAGzB;CACR,IAAI,QAAQ,aAAa,MAAM,CAAC,WAAW,GAC1C,MAAM,IAAI,MAAM,2EAA2E;CAE5F,IACC,CAAC,OAAO,cAAc,QAAQ,SAAS,cAAc,IACrD,QAAQ,SAAS,iBAAiB,GAElC,MAAM,IAAI,MAAM,0EAA0E;CAE3F,IACC,QAAQ,SAAS,KAAK,WAAW,KACjC,QAAQ,SAAS,qBAAqB,WAAW,KACjD,QAAQ,SAAS,QAAQ,WAAW,GAEpC,MAAM,IAAI,MAAM,4EAA4E;;AAI9F,eAAe,uBAAuB,SAME;CACvC,MAAM,kBAAkB,MAAM,QAAQ,aAAa,oBAClD,QAAQ,SAAS,cACjB;CACD,IAAI,oBAAoB,MACvB,OAAO;CAER,IAAI,gBAAgB,yBAAyB,QAAQ,SAAS,sBAC7D,OAAO;CAER,IAAI,gBAAgB,aAAa,WAAW,IAAI,EAC/C,OAAO;CAER,IAAI,QAAQ,SAAS,kBAAkB,gBAAgB,aAAa,SAAS,IAAI,EAChF,OAAO;CAER,IACC,QAAQ,SAAS,mBAChB,gBAAgB,aAAa,WAAW,IAAI,IAC5C,gBAAgB,aAAa,WAAW,IAAI,MAC5C,gCAAgC;EAChC,gBAAgB,gBAAgB;EAChC,iBAAiB,QAAQ,SAAS;EAClC,CAAC,IACD,mCAAmC;EAClC,gBAAgB,gBAAgB;EAChC,iBAAiB,QAAQ,SAAS;EAClC,CAAC,GAEH,OAAO;CAER,IAAI,gBAAgB,YAAY,QAAQ,SAAS,SAChD,MAAM,IAAI,MACT,GAAG,QAAQ,aAAa,YAAY,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,cAAc,CAAC,wDAAwD,KAAK,UAAU,gBAAgB,aAAa,CAAC,iCAAiC,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,YAAY,KAAK,UAAU,gBAAgB,QAAQ,CAAC,IACpU;CAEF,IAAI,CAAC,uBAAuB,gBAAgB,QAAQ,EACnD,MAAM,IAAI,MACT,GAAG,QAAQ,aAAa,YAAY,QAAQ,OAAO,OAAO,OAAO,QAAQ,SAAS,cAAc,CAAC,yDACjG;CAEF,OAAO;;AAGR,eAAe,8BAA8B,SAKxB;CACpB,MAAM,WAAW,QAAQ,aAAa,KAAK,GAAG;CAC9C,OAAO,QAAQ,aAAa,KAAK,GAAG,UAAU;EAS7C,IAAI,MAPsB,uBAAuB;GAChD,QAAQ,+BAA+B,QAAQ,YAAY;GAC3D,cAAc,QAAQ;GACtB,cAAc,QAAQ;GACtB,UAAU,QAAQ;GAClB,MAAM;GACN,CAAC,KACkB,UACnB,OAAO;EAGR,MAAM,QAAQ,aAAa,MAAM,8BAA8B;;CAEhE,OACE,MAAM,uBAAuB;EAC7B,QAAQ,+BAA+B,QAAQ,YAAY;EAC3D,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KAAM;;AAIV,SAAS,sBAAsB,SAItB;CACR,IAAI;EACH,QAAQ,aAAa,WAAW,QAAQ,eAAe,QAAQ,OAAO;UAC9D,OAAO;EACf,IAAI,iBAAiB,MAAM,KAAK,SAC/B,MAAM;;;AAKT,eAAsB,2CAA2C,SAIZ;CACpD,yBAAyB,QAAQ;CAQjC,IAAI,MAP6B,uBAAuB;EACvD,QAAQ;EACR,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KACyB,UAC1B,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAkB;CAGjF,sBAAsB;EACrB,cAAc,QAAQ;EACtB,eAAe,QAAQ,SAAS;EAChC,QAAQ;EACR,CAAC;CACF,IACC,MAAM,8BAA8B;EACnC,aAAa;EACb,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,CAAC,EAEF,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAU7E,IAAI,MAPgC,uBAAuB;EAC1D,QAAQ;EACR,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,MAAM;EACN,CAAC,KAC4B,UAC7B,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAE7E,sBAAsB;EACrB,cAAc,QAAQ;EACtB,eAAe,QAAQ,SAAS;EAChC,QAAQ;EACR,CAAC;CACF,IACC,MAAM,8BAA8B;EACnC,aAAa;EACb,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,CAAC,EAEF,OAAO;EAAE,eAAe,QAAQ,SAAS;EAAe,MAAM;EAAc;CAG7E,MAAM,IAAI,MACT,yDAAyD,OAAO,QAAQ,SAAS,cAAc,CAAC,IAAI,QAAQ,aAAa,IACzH;;AAGF,SAAgB,gDACf,eAAuD,qBACV;CAC7C,OAAO,EACN,MAAM,6BAA6B,SAA2D;EAC7F,OAAO,MAAM,2CAA2C;GACvD,cAAc,QAAQ;GACtB;GACA,UAAU,QAAQ;GAClB,CAAC;IAEH;;;;ACnWF,MAAM,kBAAkB,cAAc,OAAO,KAAK,IAAI;AAEtD,MAAM,4BAA4B,EAAE,OAAO,EAC1C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC;AAEF,SAAS,mBAAmB,OAAyB;CACpD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,SAAS,MAAM,SAAS;;AAGzF,SAAS,gBAAgB,OAAwB;CAChD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG9D,SAAgB,uBAAuB,aAA6B;CACnE,MAAM,QAAQ,YAAY,MAAM,yCAAyC;CACzE,IAAI,CAAC,OACJ,MAAM,IAAI,MACT,uGACA;CAGF,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,gCAAgC;CAEjD,OAAO;;AAGR,SAAgB,iCAAyC;CACxD,OAAO,gBAAgB,QAAQ,wCAAwC;;AAGxE,eAAsB,6BAA8C;CACnE,MAAM,kBAAkB,gCAAgC;CACxD,MAAM,SAAkB,KAAK,MAAM,MAAM,GAAG,SAAS,iBAAiB,OAAO,CAAC;CAE9E,OAAO,4BADa,0BAA0B,MAAM,OACN,CAAC;;AAOhD,eAAe,gCAAiD;CAC/D,MAAM,kBAAkB,gCAAgC;CACxD,OAAO,KAAK,KAAK,KAAK,QAAQ,gBAAgB,EAAE,QAAQ,SAAS,gBAAgB;;AAGlF,eAAsB,iCACrB,UAAmD,EAAE,EACnC;CAClB,MAAM,UAAU,QAAQ,mBAAoB,MAAM,+BAA+B;CACjF,IAAI;CACJ,IAAI;EACH,cAAc,MAAM,GAAG,SAAS,SAAS,OAAO;UACxC,OAAO;EACf,IAAI,mBAAmB,MAAM,EAC5B,MAAM,IAAI,MAAM,sCAAsC,QAAQ,KAAK,EAAE,OAAO,OAAO,CAAC;EAErF,MAAM,IAAI,MACT,6CAA6C,QAAQ,KAAK,gBAAgB,MAAM,IAChF,EAAE,OAAO,OAAO,CAChB;;CAGF,IAAI;EACH,OAAO,uBAAuB,YAAY;UAClC,OAAO;EACf,MAAM,IAAI,MACT,8CAA8C,QAAQ,KAAK,gBAAgB,MAAM,IACjF,EAAE,OAAO,OAAO,CAChB;;;;;AC5DH,MAAM,8CAA8B,IAAI,SAA2B;AAEnE,SAAS,mBAAmB,MAAgC;CAC3D,OAAO,GAAG,KAAK,OAAO,GAAG,KAAK;;AAG/B,SAAS,sBAAsB,eAA+B;CAC7D,OAAOC,KAAG,SACT,eACAA,KAAG,UAAU,WAAWA,KAAG,UAAU,cAAcA,KAAG,UAAU,WAChE;;AAGF,SAAgB,cAAc,UAAoC;CACjE,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,SAAS,EAC1C,MAAM,IAAI,MAAM,yDAAyD,WAAW;CAGrF,MAAM,mBAAmB,KAAK,QAAQ,SAAS;CAC/C,MAAM,KAAK,sBAAsB,iBAAiB;CAClD,IAAI;EACH,MAAM,QAAQA,KAAG,UAAU,GAAG;EAC9B,IAAI,CAAC,MAAM,aAAa,EACvB,MAAM,IAAI,MAAM,0CAA0C,mBAAmB;EAE9E,MAAM,WAAWA,KAAG,aAAa,iBAAiB;EAClD,MAAM,gBAAgBA,KAAG,SAAS,SAAS;EAC3C,IAAI,cAAc,QAAQ,MAAM,OAAO,cAAc,QAAQ,MAAM,KAClE,MAAM,IAAI,MACT,6CAA6C,iBAAiB,UAAU,MAAM,IAAI,GAAG,MAAM,IAAI,mBAAmB,cAAc,IAAI,GAAG,cAAc,MACrJ;EAEF,OAAO;GACN,QAAQ,MAAM;GACd;GACA,UAAU;GACV,OAAO,MAAM;GACb;GACA;UACO,OAAO;EACf,KAAG,UAAU,GAAG;EAChB,MAAM;;;AAIR,SAAgB,sBAAsB,MAA8B;CACnE,IAAI,4BAA4B,IAAI,KAAK,EACxC;CAED,KAAG,UAAU,KAAK,GAAG;CACrB,4BAA4B,IAAI,KAAK;;AAGtC,SAAgB,uBAAuB,MAA8B;CACpE,MAAM,cAAcA,KAAG,UAAU,KAAK,GAAG;CACzC,MAAM,eAAeA,KAAG,SAAS,KAAK,SAAS;CAC/C,IACC,YAAY,QAAQ,KAAK,UACzB,YAAY,QAAQ,KAAK,SACzB,aAAa,QAAQ,KAAK,UAC1B,aAAa,QAAQ,KAAK,OAE1B,MAAM,IAAI,MACT,mDAAmD,KAAK,SAAS,YAAY,mBAAmB,KAAK,CAAC,OAAO,aAAa,IAAI,GAAG,aAAa,MAC9I;;AAUH,SAAgB,2BACf,SACkB;CAClB,uBAAuB,QAAQ,KAAK;CACpC,MAAM,WAAW,QAAQ,qBAAqB,QAAQ,KAAK,SAAS;CAEpE,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,OAAO,UAAU,YACpB,OAAO;EAGR,QAAQ,GAAG,oBAAiD;GAC3D,uBAAuB,QAAQ,KAAK;GACpC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;IAGxE,CAAC;;;;ACnFH,SAAS,uBAAuB,cAA8B;CAC7D,OAAO,IAAI;;AAGZ,SAAS,sBAAsB,cAA8B;CAC5D,MAAM,eAAe,aAAa,WAAW,IAAI,GAAG,eAAe,IAAI;CACvE,OAAO,KAAK,MAAM,UAAU,aAAa;;AAG1C,SAAS,uBAAuB,cAA8B;CAC7D,MAAM,iBAAiB,sBAAsB,aAAa;CAC1D,OAAO,mBAAmB,MAAM,KAAK,eAAe,MAAM,EAAE;;AAG7D,SAAS,oBAAoB,eAAuB,cAA+B;CAClF,OACC,aAAa,WAAW,KACxB,kBAAkB,gBAClB,cAAc,WAAW,GAAG,aAAa,GAAG;;AAI9C,SAAS,aAAa,WAAmB,YAA6B;CACrE,OAAO,oBAAoB,WAAW,WAAW,IAAI,oBAAoB,YAAY,UAAU;;AAGhG,SAAS,4BACR,MACA,SACA,cACmF;CACnF,OAAO,OAAO,uBAAO,IAAI,MAAM,GAAG,KAAK,IAAI,QAAQ,IAAI,aAAa,GAAG,EAAE;EACxE;EACA,OAAO,MAAM;EACb,MAAM;EACN;EACA,CAAC;;AAGH,SAAS,qBACR,UACA,UACA,iBACU;CACV,MAAM,SAAS,QAAQ,IAAI,UAAU,UAAU,SAAS;CACxD,IAAI,OAAO,WAAW,YACrB,OAAO;CAER,OAAO,QAAQ,MAAM,QAA0B,UAAU,gBAAgB;;AAG1E,MAAM,4BAA4B,IAAI,IAAI;CACzC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,0BAA0B,UAA0B;CAC5D,OAAO,aAAa,aAAa,aAAa,gBAAgB,IAAI;;AAGnE,SAAS,qBAAqB,UAAkB,cAA+B;CAC9E,OAAO,sBAAsB,UAAU,cAAc,QAAQ;;AAG9D,SAAS,sBACR,UACA,cACA,MACU;CACV,MAAM,iBAAiB,4BAA4B,MAAM,UAAU,aAAa;CAChF,IAAI,SAAS,SAAS,OAAO,EAC5B,MAAM;CAEP,OAAO,QAAQ,OAAO,eAAe;;AAGtC,SAAS,2BACR,UACA,oBACkB;CAClB,MAAM,qBAAqB,uBAAuB,mBAAmB;CACrE,MAAM,iBAAiB,iBAAiC;EACvD,MAAM,SAAS,uBAAuB,aAAa;EACnD,OAAO,uBACN,OAAO,WAAW,IAAI,qBAAqB,GAAG,mBAAmB,GAAG,SACpE;;CAEF,MAAM,sBACL,UACA,oBACwB;EACxB,MAAM,sBAAsB,CAAC,GAAG,gBAAgB;EAChD,IACC,aAAa,YACb,aAAa,gBACb,aAAa,UACb,aAAa,cACb,aAAa,cACb,aAAa,gBACZ;GACD,oBAAoB,KAAK,cAAc,OAAO,gBAAgB,GAAG,CAAC;GAClE,oBAAoB,KAAK,cAAc,OAAO,gBAAgB,GAAG,CAAC;GAClE,OAAO;;EAER,oBAAoB,0BAA0B,SAAS,IAAI,cAC1D,OAAO,gBAAgB,0BAA0B,SAAS,EAAE,CAC5D;EACD,OAAO;;CAER,MAAM,kCACL,cACA,qBACA,UACA,iBACU;EAGV,IAAI,CAAC,oBAFwB,uBAAuB,aAEP,EADT,uBAAuB,oBACe,CAAC,EAC1E,MAAM,4BAA4B,UAAU,UAAU,aAAa;;CAGrE,MAAM,sBAAsB,OAC3B,UACA,cACA,mBACsF;EACtF,IAAI,CAAC,SAAS,UACb,MAAM,4BAA4B,UAAU,UAAU,aAAa;EAEpE,MAAM,CAAC,qBAAqB,gBAAgB,MAAM,QAAQ,IAAI,CAC7D,SAAS,SAAS,mBAAmB,EACrC,SAAS,SAAS,eAAe,CACjC,CAAC;EACF,+BAA+B,cAAc,qBAAqB,UAAU,aAAa;EACzF,OAAO;GAAE;GAAqB;GAAc;;CAE7C,MAAM,2BACL,UACA,cACA,mBAC6E;EAC7E,IAAI,CAAC,SAAS,cACb,MAAM,4BAA4B,UAAU,UAAU,aAAa;EAEpE,MAAM,sBAAsB,SAAS,aAAa,mBAAmB;EACrE,MAAM,eAAe,SAAS,aAAa,eAAe;EAC1D,+BAA+B,cAAc,qBAAqB,UAAU,aAAa;EACzF,OAAO;GAAE;GAAqB;GAAc;;CAE7C,MAAM,sBAAsB,iBAAiC;EAC5D,MAAM,iBAAiB,sBAAsB,aAAa;EAC1D,OAAO,mBAAmB,MAAM,MAAM,KAAK,MAAM,QAAQ,eAAe;;CAEzE,MAAM,qBAAqB,cAAsB,wBAAwC;EACxF,MAAM,uBAAuB,uBAAuB,aAAa;EACjE,MAAM,8BAA8B,uBAAuB,oBAAoB;EAC/E,IAAI,yBAAyB,6BAC5B,OAAO;EAER,OAAO,uBACN,4BAA4B,WAAW,IACpC,uBACA,qBAAqB,MAAM,GAAG,4BAA4B,GAAG,OAAO,CACvE;;CAEF,MAAM,qBAAqB,IAAI,IAAI;EAAC;EAAU;EAAQ;EAAW;EAAY;EAAQ;EAAS,CAAC;CAC/F,MAAM,oBAAoB,IAAI,IAAI;EACjC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CAEF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,sBAAsB,mBAAmB,UAAU,gBAAgB;GACzE,IAAI,aAAa,YAEhB,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAAC,MACjF,EAAE,qBAAqB,mBACvB,kBAAkB,cAAc,oBAAoB,CACrD;GAEF,IAAI,aAAa,gBAAgB;IAEhC,MAAM,EAAE,qBAAqB,iBAAiB,wBAC7C,UAFoB,OAAO,gBAAgB,GAG/B,EACZ,OAAO,oBAAoB,GAAG,CAC9B;IACD,OAAO,kBAAkB,cAAc,oBAAoB;;GAE5D,IAAI,aAAa,WAAW,aAAa,YAAY;IACpD,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,OAAO,oBACN,UACA,cACA,cAAc,mBAAmB,aAAa,CAAC,CAC/C,CAAC,WAAW,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CAAC;;GAElF,IAAI,aAAa,eAAe,aAAa,gBAAgB;IAC5D,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,wBACC,UACA,cACA,cAAc,mBAAmB,aAAa,CAAC,CAC/C;IACD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;;GAE3E,IAAI,aAAa,UAEhB,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAChF,WAAW,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CAAC,CAC/E,YAAY,MAAM;GAErB,IAAI,aAAa,gBAAgB,aAAa,sBAAsB;IACnE,MAAM,eAAe,OAAO,gBAAgB,GAAG;IAC/C,IAAI;KACH,wBAAwB,UAAU,cAAc,OAAO,oBAAoB,GAAG,CAAC;KAC/E,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;YACnE;KACP,OAAO,aAAa,eAAe,QAAQ;;;GAG7C,IAAI,mBAAmB,IAAI,SAAS,EAEnC,OAAO,oBAAoB,UADN,OAAO,gBAAgB,GACK,EAAE,OAAO,oBAAoB,GAAG,CAAC,CAAC,WAC5E,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB,CACzE;GAEF,IAAI,kBAAkB,IAAI,SAAS,EAElC,wBAAwB,UADH,OAAO,gBAAgB,GACE,EAAE,OAAO,oBAAoB,GAAG,CAAC;GAEhF,OAAO,QAAQ,MAAM,OAAyB,QAAQ,oBAAoB;;IAG5E,CAAC;;AAGH,SAAS,0CACR,UACA,QAIA,cACkB;CAClB,MAAM,aAAa,iBAAkC;EACpD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OACC,aAAa,WAAW,KACxB,OAAO,aAAa,MAAM,gBAAgB,aAAa,cAAc,YAAY,CAAC;;CAGpF,MAAM,cAAc,iBAAkC;EACrD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,cAAc,MAAM,iBACjC,oBAAoB,cAAc,aAAa,CAC/C;;CAEF,MAAM,oBAAoB,aAAa,qBAAqB,UAAU;EACrE,eAAe,EAAE,MAAM,mBAAmB,CAAC,UAAU,aAAa;EAClE,WAAW;EACX,CAAC;CACF,MAAM,mBAAmB,aAAa,uBAAuB,kBAAkB;CAE/E,OAAO,IAAI,MAAM,mBAAmB,EACnC,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,IAAI,aAAa,UAAU,aAAa,YACvC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAG/C,OAAO,qBADN,UAAU,aAAa,IAAI,CAAC,WAAW,aAAa,GAAG,mBAAmB,QAC7B,UAAU,gBAAgB;;EAG1E,IAAI,0BAA0B,IAAI,SAAS,EAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,YAAY,0BAA0B,SAAS;GACrD,MAAM,eAAe,OAAO,gBAAgB,WAAW;GAGvD,OAAO,qBADN,UAAU,aAAa,IAAI,CAAC,WAAW,aAAa,GAAG,mBAAmB,QAC7B,UAAU,gBAAgB;;EAG1E,IAAI,aAAa,YAAY,aAAa,cACzC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,gBAAgB,CAAC,OAAO,gBAAgB,GAAG,EAAE,OAAO,gBAAgB,GAAG,CAAC;GAM9E,OAAO,qBAJN,cAAc,MAAM,UAAU,IAC9B,cAAc,MAAM,iBAAiB,CAAC,WAAW,aAAa,CAAC,GAC5D,mBACA,QAC0C,UAAU,gBAAgB;;EAG1E,IAAI,aAAa,cAAc,aAAa,gBAC3C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAKlD,OAAO,qBAHN,UAAU,WAAW,IAAI,UAAU,gBAAgB,IAAI,CAAC,WAAW,gBAAgB,GAChF,mBACA,QAC0C,UAAU,gBAAgB;;EAG1E,QAAQ,GAAG,oBACV,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;IAEjE,CAAC;;AAGH,SAAS,gCACR,UACA,cACA,QACkB;CAClB,MAAM,UAAU,iBAAkC;EACjD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,YAAY,MAAM,eAAe,oBAAoB,cAAc,WAAW,CAAC;;CAE9F,MAAM,aAAa,iBAAkC;EACpD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,eAAe,MAAM,kBAClC,oBAAoB,cAAc,cAAc,CAChD;;CAEF,MAAM,WAAW,iBAAkC;EAClD,IAAI,OAAO,WAAW,SAAS,uBAC9B,OAAO;EAER,MAAM,eAAe,uBAAuB,aAAa;EACzD,OACC,aAAa,WAAW,KACxB,OAAO,WAAW,aAAa,MAAM,gBAAgB,aAAa,cAAc,YAAY,CAAC;;CAG/F,MAAM,YAAY,iBAAkC;EACnD,IAAI,UAAU,aAAa,EAC1B,OAAO;EAER,IAAI,OAAO,WAAW,SAAS,uBAC9B,OAAO;EAER,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,WAAW,cAAc,MAAM,iBAC5C,oBAAoB,cAAc,aAAa,CAC/C;;CAGF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,aAAa,UAAU,aAAa,YACvC,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,GAC/D;EAEJ,MAAM,uBAAuB,QAAQ,IAAI,cAAc,UAAU,aAAa;EAC9E,IAAI,OAAO,yBAAyB,YACnC;EAED,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAClD,IAAI,OAAO,WAAW,IAAI,CAAC,QAAQ,WAAW,EAC7C,OAAO,sBAAsB,UAAU,YAAY,SAAS;GAE7D,IAAI,OAAO,gBAAgB,IAAI,CAAC,QAAQ,gBAAgB,EACvD,OAAO,sBAAsB,UAAU,iBAAiB,SAAS;GAElE,IAAI,CAAC,SAAS,WAAW,EACxB,OAAO,sBAAsB,UAAU,YAAY,QAAQ;GAE5D,IAAI,CAAC,SAAS,gBAAgB,EAC7B,OAAO,sBAAsB,UAAU,iBAAiB,QAAQ;GAEjE,IAAI,aAAa,QAAQ;IACxB,IAAI,CAAC,SAAS,UACb,OAAO,sBAAsB,UAAU,YAAY,SAAS;IAE7D,OAAO,SACL,SAAS,WAAW,CACpB,WACA,QAAQ,MAAM,sBAAwC,cAAc,gBAAgB,CACpF;;GAEH,IAAI,CAAC,SAAS,cACb,OAAO,sBAAsB,UAAU,YAAY,SAAS;GAE7D,SAAS,aAAa,WAAW;GACjC,OAAO,QAAQ,MAAM,sBAAwC,cAAc,gBAAgB;;IAG7F,CAAC;;AAQH,SAAS,kCACR,cACA,gBACoB;CACpB,MAAM,eAAe,uBAAuB,aAAa;CACzD,MAAM,SAAS,aAAa,WAAW,IAAI,KAAK,GAAG,aAAa;CAChE,MAAM,2BAAW,IAAI,KAAa;CAClC,KAAK,MAAM,iBAAiB,gBAAgB;EAC3C,IAAI,CAAC,cAAc,wBAAwB,WAAW,OAAO,EAC5D;EAGD,MAAM,YADgB,cAAc,wBAAwB,MAAM,OAAO,OAC1C,CAAC,MAAM,IAAI,CAAC;EAC3C,IAAI,WACH,SAAS,IAAI,UAAU;;CAGzB,OAAO,CAAC,GAAG,SAAS,CAAC,UAAU;;AAGhC,SAAS,UAAU,OAAmD;CACrE,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;;AAGlD,SAAS,sBACR,SACA,iBACA,eACkD;CAClD,MAAM,eAAe,IAAI,IAAI,QAAQ,IAAI,UAAU,CAAC;CACpD,MAAM,kBAAkB,gBAAgB,QAAQ,cAAc,CAAC,aAAa,IAAI,UAAU,CAAC;CAC3F,OAAO,CACN,GAAG,SACH,GAAG,gBAAgB,KAAK,cACvB,gBAAgB,IAAI,cAAc,UAAU,GAAG,UAC/C,CACD;;AAGF,SAAS,eAAe,OAAyB;CAChD,OACC,OAAO,UAAU,YACjB,UAAU,SACR,UAAU,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,cAC9D,WAAW,UAAU,MAAM,UAAU,MAAM,UAAU,MAAM,UAAU,CAAC,MAAM;;AAIhF,SAAS,sCACR,UACA,gBACA,QACA,cACkB;CAClB,MAAM,iBAA0C,EAAE;CAClD,KAAK,MAAM,iBAAiB,OAAO,gBAAgB;EAClD,IACC,OAAO,YAAY,MAAM,eACxB,oBAAoB,cAAc,yBAAyB,WAAW,CACtE,EAED;EAED,IAAI,gBAAgB,2BACnB,gBACA,cAAc,mBACd;EACD,MAAM,oBAAoB,OAAO,YAAY,SAAS,eAAe;GACpE,MAAM,oBAAoB,GAAG,cAAc,wBAAwB;GACnE,OAAO,WAAW,WAAW,kBAAkB,GAC5C,CAAC,uBAAuB,WAAW,MAAM,kBAAkB,OAAO,CAAC,CAAC,GACpE,EAAE;IACJ;EACF,IAAI,kBAAkB,SAAS,GAC9B,gBAAgB,aAAa,qBAAqB,eAAe;GAChE,cAAc,aAAa,0BAA0B,kBAAkB;GACvE,WAAW;GACX,CAAC;EAEH,eAAe,KAAK;GACnB,yBAAyB,cAAc;GACvC,UAAU,aAAa,uBAAuB,cAAc;GAC5D,CAAC;;CAGH,IAAI,eAAe,WAAW,GAC7B,OAAO;CAGR,MAAM,aAAa,iBAA4D;EAC9E,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,eAAe,MAAM,kBAC3B,oBAAoB,cAAc,cAAc,wBAAwB,CACxE;;CAEF,MAAM,gBAAgB,cAAsB,kBAAiD;EAE5F,MAAM,SADe,uBAAuB,aACjB,CAAC,MAAM,cAAc,wBAAwB,OAAO;EAC/E,OAAO,OAAO,WAAW,IAAI,MAAM;;CAEpC,MAAM,8BAA8B,iBAAkC;EACrE,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,eAAe,MAAM,kBAC3B,aAAa,cAAc,cAAc,wBAAwB,CACjE;;CAEF,MAAM,YAAY,iBAAkC;EACnD,MAAM,eAAe,uBAAuB,aAAa;EACzD,OAAO,OAAO,YAAY,MAAM,eAAe,oBAAoB,cAAc,WAAW,CAAC;;CAG9F,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAAoC;EAChE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO;EACnD,IAAI,OAAO,aAAa,YAAY,OAAO,UAAU,YACpD,OAAO;EAER,IAAI,aAAa,aAAa,aAAa,eAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,iBAAiB,gBAAgB;GACvC,MAAM,gBACL,OAAO,mBAAmB,YAC1B,mBAAmB,QACnB,mBAAmB,kBACnB,eAAe,kBAAkB;GAClC,MAAM,gBAAgB,UAAU,aAAa;GAC7C,IAAI,iBAAiB,CAAC,SAAS,aAAa,EAC3C,OAAO,qBAAqB,cAAc,UAAU,UAAU,CAC7D,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC;GAEH,MAAM,kBAAkB,kCAAkC,cAAc,eAAe;GACvF,IAAI,gBAAgB,WAAW,GAC9B,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,IAAI,aAAa,WAChB,OAAO,QAAQ,QAAQ,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,CAAC,CACrF,OAAO,UAAmB;IAC1B,IAAI,eAAe,MAAM,EACxB,OAAO,EAAE;IAEV,MAAM;KACL,CACD,MAAM,YACN,sBACC,SACA,iBACA,cACA,CACD;GAEH,IAAI;IACH,OAAO,sBACN,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,EAI/D,iBACA,cACA;YACO,OAAO;IACf,IAAI,eAAe,MAAM,EACxB,OAAO;IAER,MAAM;;;EAIT,IACC,aAAa,UACb,aAAa,cACb,aAAa,WACb,aAAa,aAEb,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,IAAI,iBAAiB,CAAC,SAAS,aAAa,EAC3C,OAAO,qBAAqB,cAAc,UAAU,UAAU,CAC7D,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC;GAGH,IADwB,kCAAkC,cAAc,eACrD,CAAC,WAAW,GAC9B,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,IAAI,aAAa,UAAU,aAAa,SACvC,OAAO,QAAQ,QACd,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB,CAC/D,CAAC,OAAO,UAAmB;IAC3B,IAAI,eAAe,MAAM,EACxB,OAAO,uBAAuB;IAE/B,MAAM;KACL;GAEH,IAAI;IACH,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;YAC9D,OAAO;IACf,IAAI,eAAe,MAAM,EACxB,OAAO,uBAAuB;IAE/B,MAAM;;;EAIT,IAAI,aAAa,UAAU,aAAa,YACvC,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,OAAO,iBAAiB,CAAC,SAAS,aAAa,GAC5C,qBAAqB,cAAc,UAAU,UAAU,CACvD,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC,GACD,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGpE,IAAI,0BAA0B,IAAI,SAAS,EAC1C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,0BAA0B,SAAS,EAAE;GACjF,IAAI,CAAC,SAAS,aAAa,IAAI,2BAA2B,aAAa,EACtE,OAAO,qBAAqB,UAAU,aAAa;GAEpD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGxE,IACC,aAAa,YACb,aAAa,gBACb,aAAa,UACb,aAAa,YAEb,QAAQ,GAAG,oBAAiD;GAE3D,MAAM,kBAAkB,CADD,OAAO,gBAAgB,GAAG,EAAE,OAAO,gBAAgB,GAAG,CACxC,CAAC,MACpC,iBAAiB,CAAC,SAAS,aAAa,IAAI,2BAA2B,aAAa,CACrF;GACD,IAAI,iBACH,OAAO,qBAAqB,UAAU,gBAAgB;GAEvD,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;;EAGxE,IAAI,aAAa,cAAc,aAAa,gBAC3C,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,aAAa,OAAO,gBAAgB,GAAG;GAC7C,MAAM,kBAAkB,OAAO,gBAAgB,GAAG;GAClD,IAAI,CAAC,SAAS,gBAAgB,IAAI,2BAA2B,gBAAgB,EAC5E,OAAO,qBAAqB,UAAU,gBAAgB;GAEvD,MAAM,cAAc,UAAU,WAAW;GACzC,IAAI,CAAC,eAAe,SAAS,WAAW,EACvC,OAAO,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GAEvE,MAAM,mBAAmB,aAAa,YAAY,YAAY;GAC9D,IAAI,aAAa,YAChB,OAAO,QAAQ,QACd,qBAAqB,YAAY,UAAU,YAAY,CAAC,iBAAiB,CAAC,CAC1E,CAAC,MAAM,aACP,qBAAqB,QAAQ,aAAa,CAAC,iBAAiB,SAAS,CAAC,CACtE;GAKF,OAAO,qBAAqB,QAAQ,iBAAiB,CAAC,iBAHrC,qBAAqB,YAAY,UAAU,gBAAgB,CAC3E,iBACA,CAC8E,CAAC,CAAC;;EAGnF,QAAQ,GAAG,oBAAiD;GAC3D,MAAM,eAAe,OAAO,gBAAgB,GAAG;GAC/C,MAAM,gBAAgB,UAAU,aAAa;GAC7C,MAAM,SACL,iBAAiB,CAAC,SAAS,aAAa,GACrC,qBAAqB,cAAc,UAAU,UAAU,CACvD,aAAa,cAAc,cAAc,EACzC,GAAG,gBAAgB,MAAM,EAAE,CAC3B,CAAC,GACD,QAAQ,MAAM,OAAyB,QAAQ,gBAAgB;GACnE,IAAI,CAAC,iBAAiB,SAAS,aAAa,EAC3C,OAAO;GAER,IAAI,aAAa,YAChB,OAAO,QAAQ,QAAQ,OAAO,CAAC,MAAM,iBAAiB;IACrD,MAAM,uBAAuB,uBAAuB,OAAO,aAAa,CAAC;IACzE,OAAO,uBACN,qBAAqB,WAAW,IAC7B,cAAc,0BACd,GAAG,cAAc,wBAAwB,GAAG,uBAC/C;KACA;GAEH,IAAI,aAAa,gBAAgB;IAChC,MAAM,uBAAuB,uBAAuB,OAAO,OAAO,CAAC;IACnE,OAAO,uBACN,qBAAqB,WAAW,IAC7B,cAAc,0BACd,GAAG,cAAc,wBAAwB,GAAG,uBAC/C;;GAEF,OAAO;;IAGT,CAAC;;AAGH,SAAgB,gCACf,SACkB;CAClB,IAAI,oBAAoB,QAAQ;CAChC,IAAI,QAAQ,OAAO,WAAW,SAAS,kBACtC,oBAAoB,0CACnB,mBACA,QAAQ,OAAO,YACf,QAAQ,aACR;CAGF,IAAI,QAAQ,OAAO,YAAY,SAAS,GACvC,oBAAoB,QAAQ,aAAa,qBAAqB,mBAAmB;EAChF,cAAc,QAAQ,aAAa,0BAClC,QAAQ,OAAO,YAAY,IAAI,uBAAuB,CACtD;EACD,WAAW;EACX,CAAC;CAGH,IAAI,QAAQ,OAAO,eAAe,SAAS,GAAG;EAC7C,MAAM,kBAAkB,QAAQ,aAAa,0BAC5C,QAAQ,OAAO,YAAY,IAAI,uBAAuB,CACtD;EACD,MAAM,qBAAqB,QAAQ,aAAa,0BAC/C,QAAQ,OAAO,eAAe,IAAI,uBAAuB,CACzD;EACD,oBAAoB,QAAQ,aAAa,qBAAqB,mBAAmB;GAChF,eAAe,YAAY,CAAC,gBAAgB,QAAQ,IAAI,mBAAmB,QAAQ;GACnF,OAAO,QAAQ,aAAa,sBAAsB;GAClD,WAAW;GACX,CAAC;;CAEH,oBAAoB,gCACnB,mBACA,QAAQ,cACR,QAAQ,OACR;CAED,OAAO,sCACN,mBACA,QAAQ,cACR,QAAQ,QACR,QAAQ,aACR;;;;;;;;;;ACzxBF,SAAgB,6BACf,eAAgD,EAAE,EACtB;CAC5B,MAAM,wBACL,2BAA2B,eACxB,aAAa,wBACb,IAAI;CACR,MAAM,6BACL,gCAAgC,eAC7B,aAAa,6BACbC,MAAI;CAER,IAAI,iBAA8D;CAClE,IAAI,OAAO,0BAA0B,YAAY;EAChD,sBAAsB,YAAY;EAClC,iBAAiB;;CAGlB,IAAI,mBAAkE;CACtE,IAAI,OAAO,+BAA+B,YAAY;EACrD,2BAA2B,MAAM;EACjC,mBAAmB;;CAGpB,OAAO;EACN;EACA;EACA;;;;ACCF,MAAa,+BAA+B;AAC5C,MAAa,2CAA2C;AAKxD,MAAa,qCAAqC;CACjD,iBAAiB;CACjB,oBAAoB;CACpB,8BAP0E,MAAM,OAAO;CAQvF,yBAAyB;CACzB,2BAA2B;CAC3B;AAaD,SAAS,0BAA0B,OAAqB;CACvD,OAAO,IAAI,MAAM,OAAO,EACvB,IAAI,QAAe,UAA2B,UAA4B;EACzE,IAAI,aAAa,SAAS,aAAa,OACtC,OAAO;EAER,OAAO,QAAQ,IAAI,QAAQ,UAAU,SAAS;IAE/C,CAAC;;AAGH,SAAS,+BAA+B,QAA8C;CACrF,OAAO,IAAI,MAAM,QAAQ,EACxB,IAAI,QAA2B,UAA2B,UAA4B;EACrF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OAAO,YACb,0BAA0B,MAAM,OAAO,KAAK,QAAQ,CAAC;EAEvD,IAAI,aAAa,YAChB,QAAQ,YAA4B,0BAA0B,OAAO,SAAS,QAAQ,CAAC;EAExF,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAS,6BAA6B,UAA4C;CACjF,OAAO,IAAI,MAAM,UAAU,EAC1B,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OACN,WACA,OACA,SAEA,+BAA+B,MAAM,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAE3E,IAAI,aAAa,YAChB,QAAQ,WAAmB,OAAe,SACzC,+BAA+B,OAAO,SAAS,WAAW,OAAO,KAAK,CAAC;EAEzE,IAAI,aAAa,QAChB,OAAO,OAAO,WAAmB,YAChC,0BAA0B,MAAM,OAAO,KAAK,WAAW,QAAQ,CAAC;EAElE,IAAI,aAAa,YAChB,QAAQ,WAAmB,YAC1B,0BAA0B,OAAO,SAAS,WAAW,QAAQ,CAAC;EAEhE,IAAI,aAAa,SAChB,OAAO,OAAO,WAAmB,YAChC,0BAA0B,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;EAEnE,IAAI,aAAa,aAChB,QAAQ,WAAmB,YAC1B,0BAA0B,OAAO,UAAU,WAAW,QAAQ,CAAC;EAEjE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAS,4BACR,SACA,UAMC;CACD,MAAM,aAAa,aAAa,KAAA,IAAY,KAAK,KAAK,SAAS;CAC/D,OAAO,OAAO,uBAAO,IAAI,MAAM,UAAU,UAAU,aAAa,EAAE;EACjE,MAAM;EACN,OAAO,MAAM;EACb,GAAI,aAAa,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,UAAU;EACpD;EACA,CAAC;;AAGH,SAAS,iCAAiC,QAA8C;CACvF,OAAO,IAAI,MAAM,QAAQ,EACxB,IAAI,QAA2B,UAA2B,UAA4B;EACrF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,WAAW,aAAa,eAAe,aAAa,YACpE,OAAO,YAA4B;GAClC,MAAM,4BAA4B,OAAO,SAAS,EAAE,OAAO,KAAK;;EAGlE,IAAI,aAAa,eAAe,aAAa,mBAAmB,aAAa,gBAC5E,aAAoB;GACnB,MAAM,4BAA4B,OAAO,SAAS,EAAE,OAAO,KAAK;;EAGlE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAGH,SAAgB,+BAA+B,UAA4C;CAC1F,MAAM,mBAAmB,IAAI,iBAAiB,SAAS;CACvD,OAAO,IAAI,MAAM,kBAAkB,EAClC,IAAI,QAAyB,UAA2B,UAA4B;EACnF,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;EACrD,IAAI,aAAa,QAChB,OAAO,OACN,WACA,OACA,SACgC;GAChC,IAAI,YAAY,MAAM,EACrB,MAAM,4BAA4B,QAAQ,UAAU;GAErD,OAAO,iCAAiC,MAAM,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;;EAGpF,IAAI,aAAa,YAChB,QAAQ,WAAmB,OAAe,SAAqC;GAC9E,IAAI,YAAY,MAAM,EACrB,MAAM,4BAA4B,YAAY,UAAU;GAEzD,OAAO,iCAAiC,OAAO,SAAS,WAAW,OAAO,KAAK,CAAC;;EAGlF,IACC,aAAa,WACb,aAAa,WACb,aAAa,YACb,aAAa,YACb,aAAa,UACb,aAAa,eACb,aAAa,gBACb,aAAa,cACb,aAAa,WAEb,OAAO,OAAO,cAAsC;GACnD,MAAM,4BAA4B,OAAO,SAAS,EAAE,UAAU;;EAGhE,IACC,aAAa,eACb,aAAa,eACb,aAAa,gBACb,aAAa,gBACb,aAAa,cACb,aAAa,mBACb,aAAa,oBACb,aAAa,kBACb,aAAa,eAEb,QAAQ,cAA6B;GACpC,MAAM,4BAA4B,OAAO,SAAS,EAAE,UAAU;;EAGhE,OAAO,OAAO,UAAU,cACpB,GAAG,oBACJ,QAAQ,MAAM,OAAgC,QAAQ,gBAAgB,GACtE;IAEJ,CAAC;;AAkCH,SAAgB,mBAAmB,OAA2C;CAC7E,IAAI,OAAO,UAAU,YAAY,UAAU,MAC1C,OAAO;CAER,IAAI,EAAE,eAAe,UAAU,EAAE,qBAAqB,QACrD,OAAO;CAER,MAAM,YAAY,MAAM;CACxB,MAAM,kBAAkB,MAAM;CAC9B,IACC,cAAc,iBACd,OAAO,oBAAoB,YAC3B,CAAC,0BAA0B,KAAK,gBAAgB,EAEhD,OAAO;CAGR,IAAI;EACH,MAAM,mBAAmB,OAAO,KAAK,iBAAiB,SAAS;EAC/D,IAAI,iBAAiB,SAAS,SAAS,KAAK,mBAAmB,iBAAiB,SAAS,GACxF,OAAO;EAER,MAAM,kBAAkB,iBAAiB,aAAa,EAAE;EACxD,MAAM,iBAAiB;EACvB,MAAM,eAAe,iBAAiB;EACtC,MAAM,wBAAwB;EAC9B,MAAM,iBAAiB,wBAAwB;EAC/C,OACC,eAAe,KAAK,iBAAiB,UACrC,iBAAiB,SAAS,gBAAgB,aAAa,CAAC,SAAS,OAAO,KAAK,iBAC7E,iBAAiB,aAAa,sBAAsB,KAAK,MACzD,iBAAiB,WAAW,iBAAiB;SAEvC;EACP,OAAO;;;AAIT,SAAgB,sBAAsB,eAAyC;CAC9E,MAAM,iBAAiB,cACrB,MAAM,KAAK,CACX,KAAK,SAAS,KAAK,MAAM,CAAC,CAC1B,QAAQ,SAAS,KAAK,SAAS,EAAE;CACnC,IAAI,eAAe,WAAW,GAC7B,MAAM,IAAI,MAAM,kEAAkE;CAEnF,MAAM,kBAAkB,eAAe,IAAI,MAAM,OAAO;CACxD,MAAM,gBAAgB;EACrB,WAAW,kBAAkB;EAC7B,iBAAiB,kBAAkB;EACnC;CACD,IAAI,CAAC,mBAAmB,cAAc,EACrC,MAAM,IAAI,MAAM,8DAA8D;CAE/E,OAAO;;AAGR,eAAe,qBAAqB,YAA0D;CAC7F,MAAM,kBAAkB,MAAM,WAAW,KAAK,CAAC,YAAY,oCAAoC,CAAC;CAChG,IAAI,gBAAgB,aAAa,GAChC,MAAM,IAAI,MACT,iDAAiD,OAAO,gBAAgB,SAAS,CAAC,GAClF;CAEF,OAAO,sBAAsB,gBAAgB,OAAO;;AAGrD,eAAe,mCACd,WACA,eACiB;CACjB,IAAI;EACH,MAAM,UAAU,OAAO;UACf,YAAY;EAEpB,MAAM,IAAI,eACT,CAAC,eAAe,WAAW,EAC3B,8EACA,EAAE,OAAO,eAAe,CACxB;;CAEF,MAAM;;AA6GP,SAAS,4BAAmD;CAC3D,MAAM,+BAA+B,aACpC,IAAI,eAAe,SAAS;CAC7B,OAAO;EACN;EACA,UAAU,OAAO,cACf,MAAM,GAAG,OAAO,UAAU;EAC5B,kBAAkB,gBACjB,gBAAgB;GACf,cAAc,CAAC,GAAG,YAAY,aAAa;GAC3C,GAAI,YAAY,yBAAyB,KAAA,IACtC,EAAE,GACF,EAAE,sBAAsB,CAAC,GAAG,YAAY,qBAAqB,EAAE;GAClE,GAAI,YAAY,cAAc,EAAE,aAAa,YAAY,aAAa,GAAG,EAAE;GAC3E,SAAS,OAAO,YACf,OAAO,QAAQ,YAAY,QAAQ,CAAC,KAAK,CAAC,YAAY,gBAAgB,CACrE,YACA;IACC,OAAO,CAAC,GAAG,WAAW,MAAM;IAC5B,GAAI,WAAW,gBAAgB,KAAA,IAC5B,EAAE,GACF,EAAE,aAAa,WAAW,aAAa;IAC1C,OAAO,WAAW;IAClB,CACD,CAAC,CACF;GACD,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,WAAW,GAAG,EAAE;GACrE,GAAI,YAAY,aAAa,EAAE,YAAY,YAAY,YAAY,GAAG,EAAE;GACxE,CAAC;EACH;EACA,6BAA6B,SAC5B,2BAA2B;GAC1B,sBAAsB;GACtB;GACA,CAAC;EACH,sBAAsB;EACtB,wBAAwB;EACxB,4BAA6C,IAAI,gBAAgB;EACjE,uBACC,UACA,kBACqB,IAAI,eAAe,UAAU,cAAc;EACjE,4BAA4B,UAC3B,0BAA0B,CAAC,GAAG,MAAM,CAAC;EACtC;;AAIF,SAAS,oBAAoB,WAA2B;CACvD,MAAM,cAAc,UAAU,MAAM;CACpC,IAAI,YAAY,WAAW,IAAI,EAC9B,OAAO;CAIR,OAAO,IADc,YAAY,WAAW,KAAK,GAAG,YAAY,MAAM,EAAY,GAAG;;AAItF,SAAS,4BACR,WACA,cACA,WACkB;CAClB,IAAI,UAAU,gBACb,OAAO,aAAa,2BAA2B,UAAU,eAAe;CAEzE,IAAI,UAAU,UACb,OAAO,aAAa,qBAAqB,UAAU,SAAS;CAG7D,MAAM,IAAI,MAAM,GAAG,UAAU,4CAA4C;;AAG1E,SAAS,uBACR,WACA,cACkB;CAClB,QAAQ,UAAU,MAAlB;EACC,KAAK,sBACJ,MAAM,IAAI,MAAM,oEAAoE;EACrF,KAAK,UACJ,OAAO,aAAa,sBAAsB;EAC3C,KAAK,UACJ,OAAO,4BAA4B,WAAW,cAAc,SAAS;EAEtE,KAAK,mBACJ,OAAO,aAAa,uBACnB,4BAA4B,WAAW,cAAc,kBAAkB,CACvE;EAEF,KAAK,sBACJ,OAAO,gCAAgC;GACtC,cAAc,aAAa,2BAA2B,UAAU,eAAe;GAC/E;GACA,QAAQ,UAAU;GAClB,CAAC;EAEH,KAAK,UAAU;GAMd,IAAI,iBAJH,UAAU,YAAY,UAAU,iBAC7B,4BAA4B,WAAW,cAAc,SAAS,GAC9D,aAAa,sBAAsB;GAGvC,MAAM,eAAe,UAAU;GAE/B,IAAI,cAAc,KAAK,QACtB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,KAAK,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACtE;IACD,WAAW;IACX,CAAC;GAGH,IAAI,cAAc,MAAM,QACvB,iBAAiB,aAAa,qBAAqB,gBAAgB;IAClE,cAAc,aAAa,0BAC1B,aAAa,MAAM,KAAK,eAAe,oBAAoB,WAAW,CAAC,CACvE;IACD,WAAW;IACX,CAAC;GAGH,OAAO;;EAER,SACC,MAAM,IAAI,MAAM,8BAA8B;;;AAejD,SAAS,gBACR,WACA,cACmB;CACnB,MAAM,WAA4C,EAAE;CACpD,MAAM,0CAA0B,IAAI,KAAqC;CAEzE,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,UAAU,EAAE;EAC/D,IAAI,UAAU,SAAS,sBAAsB;GAC5C,MAAM,WAAW,aAAa,sBAAsB;GACpD,wBAAwB,IAAI,WAAW;IAAE;IAAU,OAAO;IAAW,CAAC;GACtE,MAAM,gBAAgB,6BAA6B,SAAS;GAC5D,SAAS,aACR,UAAU,WAAW,cAClB,aAAa,uBAAuB,cAAc,GAClD;GACJ;;EAED,SAAS,aAAa,uBAAuB,WAAW,aAAa;;CAGtE,OAAO;EAAE;EAAyB,QAAQ;EAAU;;AAGrD,SAAS,yBACR,WAC8B;CAC9B,MAAM,wBAAQ,IAAI,KAA+B;CACjD,KAAK,MAAM,aAAa,OAAO,OAAO,UAAU,EAC/C,IAAI,oBAAoB,aAAa,UAAU,gBAC9C,MAAM,IAAI,UAAU,eAAe,IAAI,UAAU,eAAe;CAGlE,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC;;AAG3B,SAAS,uBACR,OACA,cACO;CACP,MAAM,cAAyB,EAAE;CACjC,KAAK,MAAM,QAAQ,OAClB,IAAI;EACH,aAAa,sBAAsB,KAAK;UAChC,OAAO;EACf,YAAY,KAAK,MAAM;;CAGzB,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;CAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,gDAAgD;;AAIxF,SAAS,mCACR,OACA,cACO;CACP,IAAI;EACH,uBAAuB,OAAO,aAAa;SACpC;;AAMT,SAAS,+BACR,iBAAuC,EAAE,EAClB;CACvB,MAAM,kBAAwC,EAC7C,GAAG,oCACH;CAED,IAAI,eAAe,eAAe,KAAA,GACjC,gBAAgB,aAAa,eAAe;CAE7C,IAAI,eAAe,eAAe,KAAA,GACjC,gBAAgB,aAAa,eAAe;CAE7C,IAAI,eAAe,oBAAoB,KAAA,GACtC,gBAAgB,kBAAkB,eAAe;CAElD,IAAI,eAAe,UAAU,KAAA,GAC5B,gBAAgB,QAAQ,eAAe;CAExC,IAAI,eAAe,uBAAuB,KAAA,GACzC,gBAAgB,qBAAqB,eAAe;CAErD,IAAI,eAAe,iCAAiC,KAAA,GACnD,gBAAgB,+BAA+B,eAAe;CAE/D,IAAI,eAAe,4BAA4B,KAAA,GAC9C,gBAAgB,0BAA0B,eAAe;CAE1D,IAAI,eAAe,8BAA8B,KAAA,GAChD,gBAAgB,4BAA4B,eAAe;CAG5D,OAAO;;AAUR,SAAS,wBAAwB,UAA0B;CAC1D,OAAO,SAAS,aAAa;;AAG9B,SAAS,qBAAqB,UAA+C;CAC5E,IAAI,SAAS,WAAW,IAAI,EAAE;EAC7B,MAAM,sBAAsB,SAAS,QAAQ,IAAI;EACjD,IAAI,sBAAsB,GAAG;GAC5B,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,sBAAsB,EAAE,EAAE,GAAG;GAC9E,IAAI,CAAC,OAAO,SAAS,UAAU,EAC9B;GAED,OAAO;IACN,UAAU,wBAAwB,SAAS,MAAM,GAAG,oBAAoB,CAAC;IACzE,MAAM;IACN;;;CAIH,MAAM,qBAAqB,SAAS,YAAY,IAAI;CACpD,IAAI,sBAAsB,GACzB;CAED,MAAM,YAAY,OAAO,SAAS,SAAS,MAAM,qBAAqB,EAAE,EAAE,GAAG;CAC7E,IAAI,CAAC,OAAO,SAAS,UAAU,EAC9B;CAED,OAAO;EACN,UAAU,wBAAwB,SAAS,MAAM,GAAG,mBAAmB,CAAC;EACxE,MAAM;EACN;;AAGF,SAAS,sBAAsB,WAA4B;CAC1D,MAAM,SAAS,UAAU,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,SAAS,SAAS,GAAG,CAAC;CAClF,IAAI,OAAO,WAAW,KAAK,OAAO,MAAM,UAAU,CAAC,OAAO,UAAU,MAAM,CAAC,EAC1E,OAAO;CAER,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO;CAC3B,IAAI,eAAe,KAAA,KAAa,gBAAgB,KAAA,GAC/C,OAAO;CAER,OACC,eAAe,MACf,eAAe,OACd,eAAe,OAAO,gBAAgB,OACtC,eAAe,OAAO,eAAe,MAAM,eAAe,MAC1D,eAAe,OAAO,gBAAgB,OACtC,eAAe,OAAO,eAAe,MAAM,eAAe;;AAI7D,SAAS,oBAAoB,WAA4B;CACxD,IAAI,IAAI,KAAK,UAAU,KAAK,GAC3B,OAAO,sBAAsB,UAAU;CAExC,MAAM,sBAAsB,UAAU,aAAa;CACnD,IAAI,oBAAoB,WAAW,UAAU,EAC5C,OAAO,sBAAsB,oBAAoB,MAAM,EAAiB,CAAC;CAE1E,OACC,wBAAwB,SACxB,oBAAoB,WAAW,KAAK,IACpC,oBAAoB,WAAW,KAAK,IACpC,oBAAoB,WAAW,QAAQ;;AAIzC,SAAS,2BAA2B,UAA2B;CAC9D,MAAM,qBAAqB,wBAAwB,SAAS;CAC5D,OACC,uBAAuB,eACvB,uBAAuB,0BACvB,oBAAoB,mBAAmB;;AAIzC,SAAS,2BACR,UACiC;CACjC,IAAI,CAAC,UACJ,OAAO,EAAE;CAGV,MAAM,QAA+B,EAAE;CACvC,KAAK,MAAM,CAAC,YAAY,kBAAkB,OAAO,QAAQ,SAAS,EAAE;EACnE,MAAM,kBAAkB,qBAAqB,WAAW;EACxD,MAAM,iBAAiB,qBAAqB,cAAc;EAC1D,IACC,CAAC,mBACD,CAAC,kBACD,CAAC,2BAA2B,eAAe,SAAS,EAEpD;EAED,IACC,CAAC,MAAM,MACL,SAAS,KAAK,aAAa,gBAAgB,YAAY,KAAK,SAAS,gBAAgB,KACtF,EAED,MAAM,KAAK,gBAAgB;;CAG7B,OAAO;;AAGR,SAAS,iBACR,OACA,iBACoB;CACpB,MAAM,cAAc,CAAC,GAAG,MAAM;CAC9B,KAAK,MAAM,QAAQ,iBAClB,IAAI,CAAC,YAAY,SAAS,KAAK,EAC9B,YAAY,KAAK,KAAK;CAGxB,OAAO;;AAGR,SAAS,qBAAqB,UAA0B;CACvD,OAAO,SAAS,QAAQ,SAAS,GAAG,CAAC,QAAQ,WAAW,GAAG;;AAG5D,SAAgB,kCACf,SAC0B;CAC1B,MAAM,eACL,QAAQ,iBAAiB,KAAA,IACtB,KAAA,IACA,IAAI,IAAI,QAAQ,aAAa,KAAK,aAAa,qBAAqB,SAAS,CAAC,CAAC;CAEnF,OAAO;EACN,cAAc,CAAC,GAAG,QAAQ,aAAa;EACvC,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,OAAO,GAAG,EAAE;EACjD,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,gBAAgB,GAAG,EAAE;EAC5E,aAAa,YAAY;GACxB,MAAM,UAAU,0BAA0B,QAAQ;GAClD,IAAI,CAAC,SACJ,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,QAAQ,YAAY,oBACvB,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,QAAQ,YAAY,mBACvB,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,IAAI,gBAAgB,CAAC,aAAa,IAAI,qBAAqB,QAAQ,KAAK,CAAC,EACxE,OAAO;IACN,OAAO;IACP,SAAS;IACT;GAEF,OAAO,EAAE,OAAO,MAAM;;EAEvB;;AAGF,SAAS,4BACR,OACuC;CACvC,IAAI,MAAM,WAAW,GACpB;CAED,MAAM,gBAAgB,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC;CACjE,QAAQ,SAAS;EAChB,MAAM,WAAW,wBAAwB,KAAK,SAAS;EACvD,MAAM,mBAAmB,MAAM,MAC7B,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,KAC3D;EACD,IAAI,cAAc,IAAI,SAAS,EAC9B,OAAO;EAER,IAAI,oBAAoB,KAAK,GAAG,EAC/B,OAAO;EAER,OAAO;;;AAIT,eAAsB,gBACrB,SACA,eAAsC,2BAA2B,EAC5C;CACrB,aAAa,gCAAgC;CAC7C,MAAM,cAAc,QAAQ,YAAY,OAAO,KAAK,QAAQ,SAAS,CAAC,SAAS;CAC/E,MAAM,eAAe,QAAQ,cAAc,KAAA,KAAa,QAAQ,UAAU,aAAa,SAAS;CAChG,MAAM,uBAAuB,2BAA2B,QAAQ,SAAS;CACzE,MAAM,uBAAuB,iBAC5B,EAAE,EACF,qBAAqB,KAAK,SAAS,KAAK,SAAS,CACjD;CACD,MAAM,cAAc,4BAA4B,qBAAqB;CACrE,MAAM,oBAAoB,yBAAyB,QAAQ,UAAU;CACrE,IAAI;CACJ,IAAI;CACJ,IAAI;EACH,mBAAmB,gBAAgB,QAAQ,WAAW,aAAa;EACnE,MAAM,aAAa,aAAa,gBAAgB;GAC/C,cAAc,QAAQ;GACtB,GAAI,qBAAqB,SAAS,IAAI,EAAE,sBAAsB,GAAG,EAAE;GACnE,GAAI,cAAc,EAAE,aAAa,GAAG,EAAE;GACtC,SAAS,QAAQ;GACjB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GAC7D,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;GAChE,CAAC;EACF,aAAa,MAAM,aAAa,SAAS;GACxC,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,GAAG,EAAE;GACrF,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,cAAc,GAAG,EAAE;GACtE,QAAQ;IACP,MAAM,QAAQ;IACd,GAAI,QAAQ,sBAAsB,KAAA,IAAY,EAAE,GAAG,EAAE,MAAM,QAAQ,mBAAmB;IACtF;GACD,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,KAAK;IACJ,GAAG,WAAW;IACd,GAAG,QAAQ;IACX;GACD,WAAW,WAAW;GACtB,KAAK;IACJ,WAAW;IACX,QAAQ,iBAAiB;IACzB;GACD,GAAI,eAAe,eAChB;IACA,KAAK;KACJ,MAAM;KACN,eAAe;KACf,eAAe;KACf,sBAAsB;KACtB;IACD,GAAI,eAAe,EAAE,KAAK,QAAQ,WAAW,GAAG,EAAE;IAClD,GAAI,cACD,EACA,KAAK,EACJ,OAAO,QAAQ,UACf,EACD,GACA,EAAE;IACL,GACA,EAAE;GACL,CAAC;UACM,OAAO;EACf,mCAAmC,mBAAmB,aAAa;EACnE,MAAM;;CAGP,IAAI;CACJ,IAAI,iBAAmD;CACvD,MAAM,sBAAsB,UAAyB;EACpD,uBAAuB;;CAExB,OAAO;EACN,IAAI,WAAW;EACf,IAAI,WAAW;EACf,KAAK,SAA2B,aAAsD;GACrF,MAAM,oBAAoB,OAAO,YAAY,WAAW,UAAU,CAAC,GAAG,QAAQ;GAC9E,OAAO,WAAW,KAAK,mBAAmB,YAAY;;EAEvD,MAAM,UAAU,YAAmD;GAClE,MAAM,YAAY,MAAM,WAAW,UAAU,WAAW;GACxD,IAAI;GACJ,IAAI;IACH,gBAAgB,MAAM,qBAAqB,WAAW;YAC9C,eAAe;IACvB,OAAO,MAAM,mCAAmC,WAAW,cAAc;;GAE1E,OAAO;IACN,OAAO,YAA2B,MAAM,UAAU,OAAO;IACzD,SAAS,UAAU;IACnB,MAAM,UAAU;IAChB,cAAc,UAAU;IACxB,MAAM,UAAU;IAChB;IACA,MAAM,UAAU;IAChB;;EAEF,MAAM,cAAc,gBAA+D;GAClF,OAAO,MAAM,WAAW,cAAc,+BAA+B,eAAe,CAAC;;EAEtF,MAAM,oBAAoB,SAA6D;GACtF,IAAI,mBAAmB,UACtB,MAAM,IAAI,MAAM,qEAAqE;GAEtF,IAAI,mBAAmB,WACtB,MAAM,IAAI,MAAM,qEAAqE;GAEtF,IAAI,uBAAuB,KAAA,GAC1B,MAAM,IAAI,MAAM,8DAA8D,EAC7E,OAAO,oBACP,CAAC;GAEH,IAAI;GACJ,IAAI;IACH,mBAAmB,4CAA4C,QAAQ;IACvE,MAAM,QAAQ,iBAAiB,wBAAwB,IAAI,iBAAiB,UAAU;IACtF,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,MACT,oEAAoE,iBAAiB,UAAU,IAC/F;IAEF,IAAI,MAAM,UAAU,WACnB,MAAM,IAAI,MACT,qCAAqC,iBAAiB,UAAU,mCAChE;IAEF,MAAM,QAAQ;IACd,IAAI,MAAM,SAAS,cAAc,KAAA,GAChC,MAAM,IAAI,MAAM,yDAAyD;IAE1E,KAAK,MAAM,QAAQ,iBAAiB,OAEnC,MAAM,MAAM,SAAS,UAAU,IAAI,KAAK,gBAAgB,OAAO,KAAK,KAAK,SAAS,EAAE,EACnF,MAAM,KAAK,MACX,CAAC;IAEH,MAAM,QAAQ;YACN,OAAO;IACf,MAAM,QAAQ,iBAAiB,wBAAwB,IAAI,QAAQ,UAAU;IAC7E,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ;IACvC,mBAAmB,MAAM;IACzB,MAAM;;;EAGR,aAA4B;GAC3B,OAAO,WAAW,cAAc,IAAI;;EAErC,gBAAmC;GAClC,OAAO;;EAER,iBAAiB,QAAuC;GACvD,WAAW,iBAAiB,OAAO;;EAEpC,MAAM,QAAuB;GAC5B,IAAI,uBAAuB,KAAA,GAC1B,MAAM,IAAI,MACT,4EACA,EACC,OAAO,oBACP,CACD;GAEF,MAAM,kBAAkB,CAAC,GAAG,iBAAiB,wBAAwB,CAAC,MACpE,GAAG,WAAW,MAAM,UAAU,YAC/B;GACD,IAAI,oBAAoB,KAAA,GAAW;IAClC,MAAM,wBAAQ,IAAI,MACjB,qCAAqC,gBAAgB,GAAG,mCACxD;IACD,mBAAmB,MAAM;IACzB,MAAM;;GAEP,MAAM,WAAW,OAAO;GACxB,iBAAiB;;EAElB,MAAM,QAAuB;GAC5B,MAAM,cAAyB,EAAE;GACjC,IAAI;IACH,MAAM,WAAW,OAAO;YAChB,OAAO;IACf,YAAY,KAAK,MAAM;;GAExB,iBAAiB;GACjB,iBAAiB,wBAAwB,OAAO;GAChD,IAAI;IACH,uBAAuB,mBAAmB,aAAa;YAC/C,OAAO;IACf,IAAI,iBAAiB,gBACpB,YAAY,KAAK,GAAG,MAAM,OAAO;SAEjC,YAAY,KAAK,MAAM;;GAGzB,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;GAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,sCAAsC;;EAG9E;;;;ACpiCF,SAAS,SAAS,OAAkD;CACnE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,mBAAmB,OAAwB;CACnD,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM;;AAGjE,SAAS,6BAA6B,SAAuC;CAC5E,IAAI,CAAC;EAAC;EAAY;EAAU;EAAM,CAAC,SAAS,QAAQ,WAAW,EAC9D,MAAM,IAAI,MACT,uCAAuC,mBAAmB,QAAQ,WAAW,GAC7E;CAEF,IAAI,CAAC,OAAO,cAAc,QAAQ,UAAU,SAAS,IAAI,QAAQ,UAAU,YAAY,GACtF,MAAM,IAAI,MAAM,wDAAwD;CAEzE,IAAI,QAAQ,eAAe,WAAW,KAAK,QAAQ,UAAU,OAAO,WAAW,GAC9E,MAAM,IAAI,MAAM,2DAA2D;CAE5E,IAAI,QAAQ,cAAc,KAAA,KAAa,QAAQ,UAAU,SAAS,iBACjE,MAAM,IAAI,MACT,2CAA2C,mBAAmB,QAAQ,UAAU,KAAK,GACrF;CAEF,KAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,QAAQ,OAAO,EAAE;EAChE,IAAI,CAAC,UAAU,WAAW,IAAI,EAC7B,MAAM,IAAI,MAAM,2CAA2C,YAAY;EAExE,IACC,CAAC;GACA;GACA;GACA;GACA;GACA;GACA;GACA,CAAC,SAAS,MAAM,KAAK,EAEtB,MAAM,IAAI,MAAM,sCAAsC,mBAAmB,MAAM,KAAK,GAAG;;CAGzF,MAAM,sCAAsB,IAAI,KAAa;CAC7C,KAAK,MAAM,UAAU,QAAQ,iBAAiB;EAC7C,IAAI,oBAAoB,IAAI,OAAO,oBAAoB,EACtD,MAAM,IAAI,MACT,8DAA8D,OAAO,sBACrE;EAEF,oBAAoB,IAAI,OAAO,oBAAoB;;CAEpD,MAAM,gCAAgB,IAAI,KAAa;CACvC,KAAK,MAAM,WAAW,QAAQ,UAAU;EACvC,IAAI,cAAc,IAAI,QAAQ,UAAU,EACvC,MAAM,IAAI,MAAM,wCAAwC,QAAQ,YAAY;EAE7E,cAAc,IAAI,QAAQ,UAAU;;;AAStC,SAAS,6BACR,WACqB;CACrB,MAAM,cAAyB,EAAE;CACjC,KAAK,MAAM,YAAY,WACtB,IAAI;EACH,SAAS,OAAO;UACR,OAAO;EACf,YAAY,KAAK,MAAM;;CAGzB,OAAO;;AAGR,SAAS,sBACR,OAC6B;CAC7B,OAAO,MAAM,QAAQ,MAAM;;AAG5B,SAAS,yBACR,aACoC;CACpC,OAAO,sBAAsB,YAAY,GAAG,CAAC,GAAG,YAAY,GAAG,EAAE,GAAG,aAAa;;AAGlF,SAAS,mBACR,OAC0C;CAC1C,IAAI,OAAO,UAAU,UACpB,OAAO;CAER,IAAI,iBAAiB,YACpB,OAAO,OAAO,KAAK,MAAM;CAE1B,QAAQ,mBAA0C;EACjD,WAAW,MAAM,SAAS,OACzB,MAAM,OAAO,KAAK,MAAM;KAEtB;;AAGL,MAAM,0CAA0C,IAAI;AACpD,MAAM,0CAA0C,KAAK,OAAO;AAE5D,SAAS,wBAAwB,MAAkD;CAClF,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,EAAE,UAAU,OAC5D,MAAM,IAAI,MAAM,2CAA2C;CAE5D,IAAI,KAAK,SAAS,QACjB,OAAO;CAER,IAAI,KAAK,SAAS,WACjB,OAAO;CAER,MAAM,IAAI,MAAM,2CAA2C;;AAG5D,SAAS,8BACR,QACsE;CACtE,IACC,CAAC,OAAO,UAAU,OAAO,YAAY,IACrC,OAAO,cAAc,2CACrB,OAAO,cAAc,yCAErB,MAAM,IAAI,MACT,4DAA4D,OAAO,wCAAwC,CAAC,OAAO,OAAO,wCAAwC,CAAC,SACnK;CAEF,OAAO;EACN,QAAQ,wBAAwB,OAAO,OAAO;EAC9C,QAAQ,wBAAwB,OAAO,OAAO;EAC9C,aAAa,OAAO;EACpB;;AAGF,SAAS,qBAAqB,SAAyD;CACtF,OAAO;EACN,GAAI,QAAQ,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,KAAK,EAAE,GAAG,EAAE;EACnD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,KAAK,GAAG,EAAE;EAC3C,GAAI,QAAQ,MAAM,EAAE,KAAK,yBAAyB,QAAQ,IAAI,EAAE,GAAG,EAAE;EACrE,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,GAAG,8BAA8B,QAAQ,OAAO;EACrF,GAAI,QAAQ,QAAQ,KAAA,IAAY,EAAE,GAAG,EAAE,KAAK,QAAQ,KAAK;EACzD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;EACpD,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,GAAG,EAAE,OAAO,mBAAmB,QAAQ,MAAM,EAAE;EACnF;;AAGF,SAAS,gBAAgB,eAA0E;CAClG,MAAM,SAAuC,cAAc;CAC3D,OAAO,OAAO,OAAO,QAAQ;EAC5B,CAAC,OAAO,iBAAwC;GAC/C,OAAO,cAAc,OAAO,gBAAgB;;EAE7C,MAAY;GACX,cAAc,KAAK;;EAEpB,QAA+B;GAC9B,OAAO,cAAc,OAAO;;EAE7B,SAAkD;GACjD,OAAO,cAAc,QAAQ;;EAE9B,OAAO,MAAc,SAAuB;GAC3C,cAAc,OAAO,MAAM,QAAQ;;EAEpC;EACA,MAAM,MAAiC;GACtC,cAAc,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,KAAK,KAAK,CAAC;;EAEzE,CAAC;;AAGH,eAAe,8CACd,YACA,QACgB;CAChB,MAAM,sBAAsB,WAAW,SAAS,SAAS,KAAK,IAAI,GAC/D,WAAW,WACX,GAAG,WAAW,WAAW,KAAK;CACjC,MAAM,QAAQ,IACb,OAAO,eAAe,IAAI,OAAO,kBAAkB;EAClD,MAAM,aAAa,KAAK,KACvB,WAAW,UACX,GAAG,cAAc,mBAAmB,MAAM,IAAI,CAC9C;EACD,MAAM,sBAAsB,MAAM,GAAG,SAAS,WAAW;EACzD,IACC,wBAAwB,WAAW,YACnC,CAAC,oBAAoB,WAAW,oBAAoB,EAEpD,MAAM,IAAI,MACT,gFAAgF,cAAc,qBAC9F;GAED,CACF;;AAGF,eAAe,gBACd,QACA,qBAC4B;CAC5B,MAAM,mBAAiD,EAAE;CACzD,MAAM,YAA0C,EAAE;CAClD,MAAM,oBAGA,EAAE;CACR,IAAI;EACH,KAAK,MAAM,CAAC,WAAW,UAAU,OAAO,QAAQ,OAAO,EACtD,QAAQ,MAAM,MAAd;GACC,KAAK;IACJ,iBAAiB,aAAa;KAC7B,QAAQ,MAAM;KACd,MAAM;KACN;IACD;GACD,KAAK;IACJ,iBAAiB,aAAa;KAC7B,UAAU,MAAM;KAChB,MAAM,MAAM,WAAW,cAAc,oBAAoB;KACzD;IACD;GACD,KAAK,wBAAwB;IAC5B,MAAM,aAAa,oBAAoB,IAAI,MAAM,UAAU;IAC3D,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,mEAAmE;IAEpF,uBAAuB,WAAW;IAClC,UAAU,KAAK,MAAM,UAAU,SAAS,CAAC;IACzC,oBAAoB,OAAO,MAAM,UAAU;IAC3C,iBAAiB,aAAa;KAC7B,MAAM,MAAM,WAAW,cAAc,oBAAoB;KACzD,gBAAgB;KAChB;IACD;;GAED,KAAK,4BAA4B;IAChC,MAAM,aAAa,oBAAoB,IAAI,MAAM,UAAU;IAC3D,IAAI,CAAC,YACJ,MAAM,IAAI,MAAM,mEAAmE;IAEpF,uBAAuB,WAAW;IAClC,UAAU,KAAK,MAAM,UAAU,SAAS,CAAC;IACzC,oBAAoB,OAAO,MAAM,UAAU;IAC3C,MAAM,SAAS,yCAAyC,MAAM,OAAO;IACrE,kBAAkB,KAAK;KAAE;KAAY;KAAQ,CAAC;IAC9C,iBAAiB,aAAa;KAC7B,MAAM;KACN,gBAAgB;KAChB;KACA;IACD;;GAED,KAAK;IACJ,iBAAiB,aAAa,EAAE,MAAM,UAAU;IAChD;GACD,KAAK;IACJ,iBAAiB,aAAa;KAC7B,UAAU,MAAM;KAChB,MAAM;KACN,cAAc;MACb,MAAM,MAAM;MACZ,OAAO,MAAM;MACb;KACD;IACD;;EAGH,MAAM,QAAQ,IACb,kBAAkB,KAAK,EAAE,YAAY,aACpC,8CAA8C,YAAY,OAAO,CACjE,CACD;UACO,OAAO;EACf,MAAM,cAAc,6BAA6B,UAAU;EAC3D,IAAI,YAAY,SAAS,GAExB,MAAM,IAAI,eACT,CAAC,OAAO,GAAG,YAAY,EACvB,yEACA,EAAE,OAAO,OAAO,CAChB;EAEF,MAAM;;CAEP,OAAO;EAAE,QAAQ;EAAkB;EAAW;;AAG/C,SAAS,cACR,UACA,yBACY;CAQZ,IAAI;CACJ,IAAI,gBAA+B;CACnC,IAAI,iBAA0C;CAC9C,IAAI;CACJ,MAAM,YAAY,YAA2B;EAC5C,IAAI,cACH,IAAI;GACH,MAAM;UACC;EAIT,MAAM,cAAyB,EAAE;EACjC,IAAI;GACH,MAAM,SAAS,OAAO;WACd,OAAO;GACf,YAAY,KAAK,MAAM;;EAExB,YAAY,KAAK,GAAG,6BAA6B,wBAAwB,CAAC;EAC1E,IAAI;GACH,IAAI,YAAY,WAAW,GAC1B,MAAM,YAAY;GAEnB,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,eAAe,aAAa,6BAA6B;YAE3D;GACT,gBAAgB;GAChB,iBAAiB;;;CAGnB,OAAO;EACN,MAAM,QAAuB;GAC5B,IAAI,CAAC,cAAc;IAClB,iBAAiB;IACjB,eAAe,WAAW;;GAE3B,MAAM;;EAEP,uBAAuB,QAAgD;GACtE,SAAS,iBACR,OAAO,KAAK,WAAW;IACtB,MAAM,MAAM;IACZ,QAAQ,MAAM;IACd,aAAa,MAAM;IACnB,EAAE,CACH;;EAEF,MAAM,cAAc,SAAmE;GACtF,OAAO,MAAM,SAAS,cAAc,QAAQ;;EAE7C,MAAM,UAAU,SAAsC;GACrD,MAAM,SAAS,MAAM,SAAS,UAAU,QAAQ;GAChD,IAAI,CAAC,OAAO,WAAW,CAAC,OAAO,gBAAgB,CAAC,OAAO,MAAM;IAC5D,MAAM,OAAO,OAAO;IACpB,MAAM,IAAI,MAAM,kEAAkE;;GAEnF,OAAO;IACN,OAAO,YAA2B,MAAM,OAAO,OAAO;IACtD,SAAS,OAAO;IAChB,MAAM,OAAO;IACb,cAAc,OAAO;IACrB,MAAM,OAAO;IACb,eAAe,OAAO;IACtB,MAAM,OAAO;IACb;;EAEF,MAAM,oBAAoB,SAAwB;GACjD,MAAM,SAAS,oBAAoB,QAAQ;;EAE5C,KAAK,SAA+B,SAAsD;GACzF,MAAM,oBAAoB,OAAO,YAAY,WAAW,UAAU,CAAC,GAAG,QAAQ;GAK9E,OAAO,gBAJe,SAAS,KAC9B,mBACA,UAAU,qBAAqB,QAAQ,GAAG,KAAA,EAEP,CAAC;;EAEtC,mBAAkC;GACjC,IAAI,kBAAkB,MACrB,OAAO;GAER,MAAM,uBAAuB,SAAS,YAAY;GAClD,IAAI,yBAAyB,MAC5B,OAAO;GAER,IAAI,yBAAyB,eAC5B,MAAM,IAAI,MACT,oDAAoD,SAAS,GAAG,kBAAkB,OAAO,cAAc,CAAC,aAAa,OAAO,qBAAqB,CAAC,GAClJ;GAEF,OAAO;;EAER,IAAI,SAAS;EACb,MAAM,QAAuB;GAC5B,IAAI,mBAAmB,aAAa,mBAAmB,UACtD,MAAM,IAAI,MAAM,0DAA0D;GAE3E,IAAI,mBAAmB,WACtB;GAED,IAAI,CAAC,cAAc;IAClB,iBAAiB;IACjB,gBAAgB,YAA2B;KAC1C,IAAI;MACH,MAAM,SAAS,OAAO;MACtB,MAAM,uBAAuB,4BAA4B,SAAS,YAAY,CAAC;MAC/E,IAAI,mBAAmB,YACtB,MAAM,IAAI,MAAM,gDAAgD;MAEjE,gBAAgB;MAChB,iBAAiB;cACT,OAAO;MACf,IAAI,mBAAmB,YACtB,iBAAiB;MAElB,MAAM;;QAEJ;;GAEL,MAAM;;EAEP;;AAGF,SAAS,uBACR,UACA,qBACqB;CACrB,MAAM,aAAa,cAAc,SAAS;CAC1C,MAAM,YAAY,mCAAmC;EACpD,UAAU;GACT,eAAe,WAAW;GAC1B,QAAQ,WAAW;GACnB,OAAO,WAAW;GAClB;EACD,eAAe,sBAAsB,WAAW;EAChD,iBAAiB,uBAAuB,WAAW;EACnD,CAAC;CACF,oBAAoB,IAAI,WAAW,WAAW;CAC9C,OAAO;;AAGR,SAAgB,kCAAqD;CACpE,MAAM,sCAAgD,IAAI,SAAS;CACnE,OAAO;EACN,aAAa,EACZ,MAAM,qBAAqB;GAC1B,MAAM,cAAc,EAAE;GACtB,IAAI;IACH,MAAM,QAAQ,IAAI,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;YAC7E,OAAO;IACf,YAAY,KAAK;KAChB,MAAM;KACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KAC/D,UAAU;KACV,CAAC;;GAEH,OAAO;KAER;EACD,yBAAyB,iDAAiD;EAC1E,SAAS,EACR,MAAM,gBAAgB,SAAqD;GAC1E,6BAA6B,QAAQ;GACrC,MAAM,UAAU,OAAO,YACtB,QAAQ,gBAAgB,KAAK,WAAW,CACvC,OAAO,qBACP;IACC,OAAO,CAAC,GAAG,OAAO,aAAa;IAC/B,GAAI,OAAO,qBAAqB,KAAA,IAC7B,EAAE,GACF,EAAE,aAAa,OAAO,kBAAkB;IAC3C,OAAO,OAAO;IACd,CACD,CAAC,CACF;GACD,MAAM,WAAW,OAAO,YACvB,QAAQ,SAAS,KAAK,YAAY,CAAC,QAAQ,WAAW,QAAQ,OAAO,CAAC,CACtE;GACD,MAAM,mBAAmB,MAAM,gBAAgB,QAAQ,QAAQ,oBAAoB;GACnF,IAAI;GACJ,IAAI;IACH,WAAW,MAAMC,gBAAsB;KACtC,cAAc,CAAC,GAAG,QAAQ,aAAa;KACvC,MAAM,QAAQ,UAAU;KACxB,KAAK,EAAE,GAAG,QAAQ,aAAa;KAC/B,WAAW,QAAQ;KACnB,QAAQ,QAAQ,UAAU;KAC1B,GAAI,QAAQ,WAAW,YAAY,EAAE,WAAW,QAAQ,UAAU,WAAW,GAAG,EAAE;KAClF,GAAI,QAAQ,WAAW,aAAa,EAAE,YAAY,QAAQ,UAAU,YAAY,GAAG,EAAE;KACrF,YAAY,QAAQ;KACpB,GAAI,QAAQ,oBAAoB,EAAE,mBAAmB,QAAQ,mBAAmB,GAAG,EAAE;KACrF;KACA,cAAc,QAAQ;KACtB,GAAI,QAAQ,YACT,EACA,WAAW,kCAAkC;MAC5C,cAAc,QAAQ,UAAU;MAChC,GAAI,QAAQ,UAAU,cACnB,EAAE,OAAO,QAAQ,UAAU,aAAa,GACxC,EAAE;MACL,GAAI,QAAQ,UAAU,sBACnB,EAAE,cAAc,QAAQ,UAAU,qBAAqB,GACvD,EAAE;MACL,GAAI,QAAQ,UAAU,iBACnB,EAAE,gBAAgB,QAAQ,UAAU,gBAAgB,GACpD,EAAE;MACL,CAAC,EACF,GACA,EAAE;KACL;KACA,WAAW,iBAAiB;KAC5B,CAAC;YACM,OAAO;IACf,MAAM,cAAc,6BAA6B,iBAAiB,UAAU;IAC5E,IAAI,YAAY,SAAS,GAExB,MAAM,IAAI,eACT,CAAC,OAAO,GAAG,YAAY,EACvB,oEACA,EAAE,OAAO,OAAO,CAChB;IAEF,MAAM;;GAEP,OAAO,cAAc,UAAU,iBAAiB,UAAU;KAE3D;EACD,QAAQ,EACP,MAAM,aAAa,SAAS;GAC3B,MAAM,cAA4B,EAAE;GACpC,MAAM,eAAwB,MAC7B,MAAM,GAAG,SAAS,QAAQ,YAAY,OAAO,EAC7C,aACA,EAAE,oBAAoB,MAAM,CAC5B;GACD,IAAI,YAAY,SAAS,GACxB,MAAM,IAAI,MACT,oCAAoC,QAAQ,WAAW,KAAK,YAC1D,KAAK,eAAe,oBAAoB,WAAW,MAAM,CAAC,CAC1D,KAAK,KAAK,GACZ;GAEF,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,oBAAoB,aAAa,EAChE,MAAM,IAAI,MACT,uDAAuD,QAAQ,aAC/D;GAEF,MAAM,SAAS,MAAM,WAAW;IAC/B,aAAa;IACb,UAAU,QAAQ;IAClB,WAAW,KAAK,QAAQ,QAAQ,WAAW;IAC3C,GAAI,QAAQ,iBAAiB,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW,QAAQ,cAAc;IACjF,CAAC;GACF,OAAO;IACN,OAAO,OAAO;IACd,aAAa,OAAO;IACpB,gBAAgB,OAAO;IACvB;KAEF;EACD,kBAAkB,EACjB,oBAAoB,aACnB,uBAAuB,UAAU,oBAAoB,EACtD;EACD"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@agent-vm/gondolin-vm-adapter",
3
- "version": "0.0.124",
3
+ "version": "0.0.126",
4
4
  "description": "Gondolin implementation of the backend-neutral @agent-vm/managed-vm contracts.",
5
5
  "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
6
6
  "bugs": {
@@ -32,8 +32,8 @@
32
32
  "@earendil-works/gondolin": "0.12.0",
33
33
  "jsonc-parser": "^3.3.1",
34
34
  "zod": "^4.4.3",
35
- "@agent-vm/managed-vm": "0.0.124",
36
- "@agent-vm/secret-management": "0.0.124"
35
+ "@agent-vm/managed-vm": "0.0.126",
36
+ "@agent-vm/secret-management": "0.0.126"
37
37
  },
38
38
  "scripts": {
39
39
  "build": "tsdown",