@atomic-chat/core 0.5.1 → 0.13.2

package/dist/runtime/container/wsl-exec.js

@@ -0,0 +1,18 @@
+/** The docker CLI the guest recipe installs. */
+export const GUEST_DOCKER_BINARY = '/usr/bin/docker';
+const GUEST_ROOT = 'root';
+export function guestDockerExec(transport) {
+    return (args, call) => transport.exec([GUEST_DOCKER_BINARY, ...args], {
+        user: GUEST_ROOT,
+        ...(call?.timeoutMs === undefined ? {} : { timeoutMs: call.timeoutMs }),
+    });
+}
+export function guestRealpath(transport) {
+    return async (path) => {
+        const resolved = await transport.exec(['realpath', '-e', '--', path], { user: GUEST_ROOT });
+        if (resolved.code !== 0)
+            throw new Error(resolved.stderr.trim() || `realpath -e ${path} failed`);
+        return resolved.stdout.trim();
+    };
+}
+//# sourceMappingURL=wsl-exec.js.map

package/dist/runtime/container/wsl-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wsl-exec.js","sourceRoot":"","sources":["../../../src/runtime/container/wsl-exec.ts"],"names":[],"mappings":"AAUA,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAA;AACpD,MAAM,UAAU,GAAG,MAAM,CAAA;AAEzB,MAAM,UAAU,eAAe,CAAC,SAAmC;IACjE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACpB,SAAS,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,EAAE;QAC7C,IAAI,EAAE,UAAU;QAChB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;KACxE,CAAC,CAAA;AACN,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAmC;IAC/D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,IAAI,SAAS,CAAC,CAAA;QAChG,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC/B,CAAC,CAAA;AACH,CAAC"}

package/dist/runtime/environment/cached-document.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Getting one kind of conf document onto disk and keeping the right one in play — the mechanism
+ * the runtime descriptor (`descriptor-provider.ts`) and the environment manifest
+ * (`environment-manifest-provider.ts`) share (openspec change `extract-environment-manifest`, design
+ * D3). Each provider only says which document it is: where it comes from, which variable overrides
+ * that, how it parses, which field is its immutable id, and where its cache lives. Everything below
+ * is the same for both, so a fix to one is a fix to the other.
+ *
+ * Two rules shape the whole thing:
+ *
+ *   - A document is accepted only when it parses AND its `minimum_core_version` is no higher than
+ *     this build's own `CORE_VERSION`. An accepted document is cached forever, keyed by its own id —
+ *     conf's own rule is that an id's content never changes, so the cached copy is exactly as good as
+ *     a fresh fetch would be, on every later read.
+ *   - Only `latest()` talks to the network. `cached(id)` and `latestCached()` read the cache alone,
+ *     so whatever pinned an id (an installation, a consented operation) is never moved by a newer
+ *     document published in conf, and never waits on a fetch.
+ *
+ * Fetch transport follows the house pattern in `src/backend/catalog/manifest.ts`: an injected
+ * `fetch`, a hard timeout, `raw.githubusercontent.com` of `AtomicBot-ai/atomic-chat-conf` `main`. The
+ * override variable accepts only `file://…` (read from disk through an injected `readFile`) and
+ * `https://…` (fetched); anything else, including a plain `http://`, is refused as a source and
+ * treated the same as "could not fetch" — the document is production-only network input, and a
+ * scheme this mechanism does not recognise is not worth guessing about.
+ *
+ * The cache never deletes anything: this file only ever writes `<dir>/<id>.json` and repoints
+ * `<dir>/latest.json`. The cache directory is shared by an app core and a CLI core with no lock over
+ * it (unlike `store.ts`'s operation records): every write goes through a per-call random temp name
+ * (the same convention as `execution-journal.ts`/`optimal-store.ts`) so two concurrent accepts never
+ * contend for the same temp file, and a cache write that fails for any other reason (disk full,
+ * permissions) is swallowed rather than failing the whole resolution — the freshly fetched,
+ * already-validated document is still good to hand back even if this core could not persist it.
+ */
+/** Matches `MANIFEST_FETCH_TIMEOUT_MS` (`src/backend/catalog/manifest.ts`): the house budget. */
+export declare const DOCUMENT_FETCH_TIMEOUT_MS = 8000;
+/** One way of fetching a conf document; `timeoutMs` is the hard budget to honour. */
+export type DocumentFetch = (url: string, timeoutMs: number) => Promise<Response>;
+/**
+ * A transport over a `fetch`-compatible function with an abort-on-timeout, matching the catalog
+ * manifest's. `label` names the document in the timeout message ("Runtime descriptor fetch timed out…").
+ */
+export declare function documentFetchFromFetch(fetchImpl: typeof fetch, label: string): DocumentFetch;
+/** The slice of `node:fs/promises` the cache needs; tests pass an in-memory fake. */
+export interface DocumentCacheFs {
+    readFile(path: string, encoding: 'utf8'): Promise<string>;
+    writeFile(path: string, data: string, options?: {
+        encoding?: 'utf8';
+        mode?: number;
+    }): Promise<void>;
+    rename(from: string, to: string): Promise<void>;
+    mkdir(path: string, options?: {
+        recursive?: boolean;
+    }): Promise<string | undefined>;
+    /** Cleans up an orphaned temp file after a failed rename; never the source of truth for anything. */
+    rm(path: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+}
+/** Which document this is: everything that differs between a descriptor and a manifest. */
+export interface CachedDocumentKind<T> {
+    /** Names the document in warnings: "Runtime descriptor", "Environment manifest". */
+    label: string;
+    /**
+     * The variable that overrides the source, e.g. `ATOMIC_RUNTIME_DESCRIPTOR_URL`; or several, the
+     * first one set winning (a descriptor's per-engine variable, then the legacy one).
+     */
+    urlEnv: string | readonly string[];
+    /** Throws on anything that is not a valid document of this kind. */
+    parse(input: unknown): T;
+    /** The document's immutable id field, e.g. `descriptor_id`; also the key `latest.json` holds. */
+    idField: string;
+    id(document: T): string;
+    minimumCoreVersion(document: T): string;
+    /** The cache directory, one document's file in it, and `latest.json`. */
+    cacheDir: string;
+    cacheFile(id: string): string;
+    latestFile: string;
+    /**
+     * Pointers an older core wrote, read in order only while `latestFile` does not exist yet; a
+     * pointer whose document `parse` rejects (another engine's descriptor) counts as absent.
+     */
+    legacyLatestFiles?: readonly string[];
+}
+export interface CachedDocumentOptions {
+    /** Where the override variable is read from; the real process env in production. */
+    env: Record<string, string | undefined>;
+    fetch: DocumentFetch;
+    /** Reads a `file://…` override; rejects when the file does not exist or cannot be read. */
+    readFile: (path: string) => Promise<string>;
+    fs?: DocumentCacheFs;
+    /** This build's own version; defaults to `CORE_VERSION`. A test pins it to check the gate. */
+    coreVersion?: string;
+    /** The source when no override is set: conf main's published document. */
+    url: string;
+    timeoutMs?: number;
+    /** A rejected source scheme or a failed cache write is never fatal; this is where it is reported. */
+    onWarn?: (message: string) => void;
+}
+/**
+ * What `latest()` found. `fresh` — fetched and accepted now; `cached` — the fetch gave nothing
+ * acceptable, the latest previously accepted document stands in (never an error); `too-new` — the
+ * fetched document parsed but needs a newer core, and nothing was ever accepted before; `none` —
+ * nothing to fetch and nothing cached.
+ */
+export type LatestDocument<T> = {
+    kind: 'fresh';
+    document: T;
+} | {
+    kind: 'cached';
+    document: T;
+} | {
+    kind: 'too-new';
+    id: string;
+} | {
+    kind: 'none';
+};
+export interface CachedDocuments<T> {
+    /** Fetch from the configured source; on any failure to obtain a newly accepted one, the cache. */
+    latest(): Promise<LatestDocument<T>>;
+    /** One accepted document by id, from the cache alone: no fetch, no `readFile`. */
+    cached(id: string): Promise<T | null>;
+    /** What `latest()` would fall back to: the newest accepted document, from the cache alone. */
+    latestCached(): Promise<T | null>;
+}
+/** `minimum_core_version` no higher than this build's own version (numeric semver compare). */
+export declare function meetsCoreVersion(minimumCoreVersion: string, coreVersion: string): boolean;
+/** Build the mechanism for one kind. Construction does no I/O; every access happens per call. */
+export declare function createCachedDocuments<T>(kind: CachedDocumentKind<T>, options: CachedDocumentOptions): CachedDocuments<T>;

package/dist/runtime/environment/cached-document.js

@@ -0,0 +1,218 @@
+/**
+ * Getting one kind of conf document onto disk and keeping the right one in play — the mechanism
+ * the runtime descriptor (`descriptor-provider.ts`) and the environment manifest
+ * (`environment-manifest-provider.ts`) share (openspec change `extract-environment-manifest`, design
+ * D3). Each provider only says which document it is: where it comes from, which variable overrides
+ * that, how it parses, which field is its immutable id, and where its cache lives. Everything below
+ * is the same for both, so a fix to one is a fix to the other.
+ *
+ * Two rules shape the whole thing:
+ *
+ *   - A document is accepted only when it parses AND its `minimum_core_version` is no higher than
+ *     this build's own `CORE_VERSION`. An accepted document is cached forever, keyed by its own id —
+ *     conf's own rule is that an id's content never changes, so the cached copy is exactly as good as
+ *     a fresh fetch would be, on every later read.
+ *   - Only `latest()` talks to the network. `cached(id)` and `latestCached()` read the cache alone,
+ *     so whatever pinned an id (an installation, a consented operation) is never moved by a newer
+ *     document published in conf, and never waits on a fetch.
+ *
+ * Fetch transport follows the house pattern in `src/backend/catalog/manifest.ts`: an injected
+ * `fetch`, a hard timeout, `raw.githubusercontent.com` of `AtomicBot-ai/atomic-chat-conf` `main`. The
+ * override variable accepts only `file://…` (read from disk through an injected `readFile`) and
+ * `https://…` (fetched); anything else, including a plain `http://`, is refused as a source and
+ * treated the same as "could not fetch" — the document is production-only network input, and a
+ * scheme this mechanism does not recognise is not worth guessing about.
+ *
+ * The cache never deletes anything: this file only ever writes `<dir>/<id>.json` and repoints
+ * `<dir>/latest.json`. The cache directory is shared by an app core and a CLI core with no lock over
+ * it (unlike `store.ts`'s operation records): every write goes through a per-call random temp name
+ * (the same convention as `execution-journal.ts`/`optimal-store.ts`) so two concurrent accepts never
+ * contend for the same temp file, and a cache write that fails for any other reason (disk full,
+ * permissions) is swallowed rather than failing the whole resolution — the freshly fetched,
+ * already-validated document is still good to hand back even if this core could not persist it.
+ */
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { readFile as nodeReadFile, mkdir as nodeMkdir, rename as nodeRename, rm as nodeRm, writeFile as nodeWriteFile, } from 'node:fs/promises';
+import { compareVersions, withHardTimeout } from '../../backend/index.js';
+import { CORE_VERSION } from '../../version.js';
+/** Matches `MANIFEST_FETCH_TIMEOUT_MS` (`src/backend/catalog/manifest.ts`): the house budget. */
+export const DOCUMENT_FETCH_TIMEOUT_MS = 8_000;
+/**
+ * A transport over a `fetch`-compatible function with an abort-on-timeout, matching the catalog
+ * manifest's. `label` names the document in the timeout message ("Runtime descriptor fetch timed out…").
+ */
+export function documentFetchFromFetch(fetchImpl, label) {
+    return (url, timeoutMs) => {
+        const controller = new AbortController();
+        const request = fetchImpl(url, { headers: { Accept: 'application/json' }, signal: controller.signal });
+        return withHardTimeout(request, timeoutMs, `${label} fetch timed out after ${timeoutMs}ms`).catch((err) => {
+            controller.abort();
+            throw err;
+        });
+    };
+}
+const NODE_FS = {
+    readFile: (path) => nodeReadFile(path, 'utf8'),
+    writeFile: nodeWriteFile,
+    rename: nodeRename,
+    mkdir: nodeMkdir,
+    rm: (path, options) => nodeRm(path, { force: options?.force ?? false }),
+};
+/** `minimum_core_version` no higher than this build's own version (numeric semver compare). */
+export function meetsCoreVersion(minimumCoreVersion, coreVersion) {
+    return compareVersions(coreVersion, minimumCoreVersion) >= 0;
+}
+/**
+ * Write-then-rename with a per-call random temp name, never a fixed `<path>.tmp`: this cache has no
+ * lock over it, so two concurrent writers sharing one temp name would clobber each other's bytes or
+ * hit `ENOENT` on whichever renames second. `path` itself may still collide between two concurrent
+ * writers (`latest.json`, or the same id accepted twice at once) — that rename is a single
+ * filesystem syscall, so the loser's write is simply superseded, never torn.
+ */
+async function atomicWrite(fs, dir, path, contents) {
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${path}.${randomUUID()}.tmp`;
+    await fs.writeFile(tmp, contents, { encoding: 'utf8', mode: 0o600 });
+    await fs.rename(tmp, path).catch(async (error) => {
+        await fs.rm(tmp, { force: true }).catch(() => undefined);
+        throw error;
+    });
+}
+/** Build the mechanism for one kind. Construction does no I/O; every access happens per call. */
+export function createCachedDocuments(kind, options) {
+    const fs = options.fs ?? NODE_FS;
+    const coreVersion = options.coreVersion ?? CORE_VERSION;
+    const timeoutMs = options.timeoutMs ?? DOCUMENT_FETCH_TIMEOUT_MS;
+    const onWarn = options.onWarn ?? (() => undefined);
+    // `latest()` runs on every probe: the same warning is written once per process, not per call.
+    const warned = new Set();
+    const warnOnce = (message) => {
+        if (warned.has(message))
+            return;
+        warned.add(message);
+        onWarn(message);
+    };
+    const urlEnvs = typeof kind.urlEnv === 'string' ? [kind.urlEnv] : kind.urlEnv;
+    const sourceUrl = () => {
+        for (const variable of urlEnvs) {
+            const override = options.env[variable];
+            if (override === undefined || override.trim() === '')
+                continue;
+            // A pinned source silently hides every newer document conf publishes (a test machine kept a
+            // commit-pinned descriptor URL and never saw the next one, 2026-10-06): say so in the log.
+            warnOnce(`${kind.label} source is overridden by ${variable}=${override.trim()}; ${options.url} is not read.`);
+            return override.trim();
+        }
+        return options.url;
+    };
+    /** `JSON.parse` + shape validation; `null` for anything that fails either. */
+    const parse = (raw) => parseWithProblem(raw).document;
+    const parseWithProblem = (raw) => {
+        try {
+            return { document: kind.parse(JSON.parse(raw)), problem: null };
+        }
+        catch (error) {
+            return { document: null, problem: error instanceof Error ? error.message : String(error) };
+        }
+    };
+    /**
+     * `file://…` via `readFile`, `https://…` via `fetch`; on any failure or another scheme no text,
+     * and why, for the warning `latest()` writes when it falls back.
+     */
+    const readSource = async (url) => {
+        try {
+            if (url.startsWith('file://'))
+                return { raw: await options.readFile(fileURLToPath(url)) };
+            if (url.startsWith('https://')) {
+                const response = await options.fetch(url, timeoutMs);
+                if (!response.ok)
+                    return { problem: `HTTP ${response.status}` };
+                return { raw: await response.text() };
+            }
+            return { problem: 'the source is neither file:// nor https://' };
+        }
+        catch (error) {
+            return { problem: error instanceof Error ? error.message : String(error) };
+        }
+    };
+    const cached = async (id) => {
+        try {
+            return parse(await fs.readFile(kind.cacheFile(id), 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    };
+    /** The id a pointer file names: `undefined` when the file is absent, `null` when it is unreadable. */
+    const pointedId = async (file) => {
+        let text;
+        try {
+            text = await fs.readFile(file, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+        try {
+            const id = JSON.parse(text)[kind.idField];
+            return typeof id === 'string' ? id : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const latestCached = async () => {
+        const current = await pointedId(kind.latestFile);
+        if (current !== undefined)
+            return current === null ? null : await cached(current);
+        for (const legacy of kind.legacyLatestFiles ?? []) {
+            const id = await pointedId(legacy);
+            const document = typeof id === 'string' ? await cached(id) : null;
+            if (document !== null)
+                return document;
+        }
+        return null;
+    };
+    /** Cache the accepted document's exact bytes by its own id, and repoint `latestFile` at it. */
+    const accept = async (raw, document) => {
+        const id = kind.id(document);
+        await atomicWrite(fs, kind.cacheDir, kind.cacheFile(id), raw);
+        await atomicWrite(fs, kind.cacheDir, kind.latestFile, `${JSON.stringify({ [kind.idField]: id }, null, 2)}\n`);
+    };
+    return {
+        async latest() {
+            const url = sourceUrl();
+            const source = await readSource(url);
+            const raw = 'raw' in source ? source.raw : null;
+            const parsed = raw === null ? null : parseWithProblem(raw);
+            const fetched = parsed?.document ?? null;
+            // `raw !== null` always holds when `fetched` does; spelling it out is what lets `accept` cache
+            // the exact bytes received — the literal published document, not a re-serialization.
+            if (raw !== null &&
+                fetched !== null &&
+                meetsCoreVersion(kind.minimumCoreVersion(fetched), coreVersion)) {
+                await accept(raw, fetched).catch((error) => {
+                    onWarn(`Could not cache ${kind.label.toLowerCase()} ${kind.id(fetched)}: ${error instanceof Error ? error.message : String(error)}`);
+                });
+                return { kind: 'fresh', document: fetched };
+            }
+            const previous = await latestCached();
+            // Falling back is never an error to the caller, but it must not be invisible either.
+            const why = 'problem' in source
+                ? `could not be read (${source.problem})`
+                : fetched === null
+                    ? `is not a valid ${kind.label.toLowerCase()} (${parsed?.problem ?? 'unreadable'})`
+                    : `is ${kind.id(fetched)}, which needs core ${kind.minimumCoreVersion(fetched)} (this is ${coreVersion})`;
+            warnOnce(`${kind.label} from ${url} ${why}; ${previous === null ? 'none is cached' : `using the cached ${kind.id(previous)}`}.`);
+            if (previous !== null)
+                return { kind: 'cached', document: previous };
+            // Parsed fine, but this build is too old for it, and nothing was ever accepted before.
+            if (fetched !== null)
+                return { kind: 'too-new', id: kind.id(fetched) };
+            return { kind: 'none' };
+        },
+        cached,
+        latestCached,
+    };
+}
+//# sourceMappingURL=cached-document.js.map

package/dist/runtime/environment/cached-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-document.js","sourceRoot":"","sources":["../../../src/runtime/environment/cached-document.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EACL,QAAQ,IAAI,YAAY,EACxB,KAAK,IAAI,SAAS,EAClB,MAAM,IAAI,UAAU,EACpB,EAAE,IAAI,MAAM,EACZ,SAAS,IAAI,aAAa,GAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAK9C;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAuB,EAAE,KAAa;IAC3E,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACtG,OAAO,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,0BAA0B,SAAS,IAAI,CAAC,CAAC,KAAK,CAC/F,CAAC,GAAY,EAAE,EAAE;YACf,UAAU,CAAC,KAAK,EAAE,CAAA;YAClB,MAAM,GAAG,CAAA;QACX,CAAC,CACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAYD,MAAM,OAAO,GAAoB;IAC/B,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,SAAS;IAChB,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;CACxE,CAAA;AAiED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,kBAA0B,EAAE,WAAmB;IAC9E,OAAO,eAAe,CAAC,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,EAAmB,EAAE,GAAW,EAAE,IAAY,EAAE,QAAgB;IACzF,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACxD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxD,MAAM,KAAK,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,OAA8B;IAE9B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAA;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAA;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAS,EAAE,CAAC,SAAS,CAAC,CAAA;IACxD,8FAA8F;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAQ,EAAE;QACzC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAM;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,CAAC,OAAO,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,MAAM,OAAO,GAAsB,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IAChG,MAAM,SAAS,GAAG,GAAW,EAAE;QAC7B,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAQ;YAC9D,4FAA4F;YAC5F,2FAA2F;YAC3F,QAAQ,CACN,GAAG,IAAI,CAAC,KAAK,4BAA4B,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,GAAG,eAAe,CACpG,CAAA;YACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAA;IACpB,CAAC,CAAA;IAED,8EAA8E;IAC9E,MAAM,KAAK,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;IAEvE,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAkD,EAAE;QACvF,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;QAC5F,CAAC;IACH,CAAC,CAAA;IAED;;;OAGG;IACH,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAkD,EAAE;QACvF,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAA;YACzF,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;gBACpD,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;gBAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAA;YACvC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAA;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;QAC5E,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAqB,EAAE;QACrD,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,sGAAsG;IACtG,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAsC,EAAE;QAC3E,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtE,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,IAAuB,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAChD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QACjF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;YAClC,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,QAAQ,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,+FAA+F;IAC/F,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,QAAW,EAAiB,EAAE;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;QAC5B,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7D,MAAM,WAAW,CACf,EAAE,EACF,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,EACf,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvD,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;YACvB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;YAC/C,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAA;YAExC,+FAA+F;YAC/F,qFAAqF;YACrF,IACE,GAAG,KAAK,IAAI;gBACZ,OAAO,KAAK,IAAI;gBAChB,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,EAC/D,CAAC;gBACD,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAClD,MAAM,CACJ,mBAAmB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,KAC7D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAA;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;YAC7C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;YACrC,qFAAqF;YACrF,MAAM,GAAG,GACP,SAAS,IAAI,MAAM;gBACjB,CAAC,CAAC,sBAAsB,MAAM,CAAC,OAAO,GAAG;gBACzC,CAAC,CAAC,OAAO,KAAK,IAAI;oBAChB,CAAC,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,OAAO,IAAI,YAAY,GAAG;oBACnF,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,aAAa,WAAW,GAAG,CAAA;YAC/G,QAAQ,CACN,GAAG,IAAI,CAAC,KAAK,SAAS,GAAG,IAAI,GAAG,KAC9B,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC9E,GAAG,CACJ,CAAA;YACD,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;YACpE,uFAAuF;YACvF,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;YACtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,CAAC;QACD,MAAM;QACN,YAAY;KACb,CAAA;AACH,CAAC"}

package/dist/runtime/environment/canonical-json.d.ts

@@ -0,0 +1,78 @@
+/**
+ * One byte sequence per value, so two sides can agree on a hash — and the hashes the managed
+ * runtime makes decisions with: the fingerprint that decides whether a retried `begin` is the same
+ * request, and the plan digest the user's consent is bound to.
+ *
+ * This is deliberately not `settings`' `stableStringify`. That one fingerprints a settings object
+ * to answer "have I already imported this?", and it tolerates whatever `JSON.stringify` tolerates:
+ * `undefined` disappears, `NaN` becomes `null`, a `Date` becomes a string. Those are silent
+ * coercions, and a value that can be spelled two ways is a value two parties can disagree about
+ * while agreeing on the hash. Here a hash stands behind a privileged install the user approved, so
+ * anything that cannot be represented exactly is refused instead of coerced. Changing that older
+ * function was not an option either: its hashes are already on users' disks.
+ */
+import type { BeginOperation, ManagedOperationTarget, ManagedSystemChange, Sha256Digest } from '../../contracts/index.js';
+/**
+ * The canonical UTF-8 JSON of a value: object keys sorted recursively, array order kept, absent
+ * properties and explicit `undefined` treated alike, and anything JSON cannot hold refused.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** `sha256:` + the hex digest of the canonical JSON. */
+export declare function canonicalDigest(value: unknown): Sha256Digest;
+/**
+ * What makes two `begin` requests the same request. The request id is the caller's idempotency key,
+ * not part of the meaning, and the approved plan is consent that a resume may legitimately change,
+ * so neither is hashed. Everything that decides what would be installed is.
+ */
+export declare function beginFingerprint(input: BeginOperation): Sha256Digest;
+/**
+ * What the host looked like when the plan was computed, as far as consent is concerned (spec
+ * "Хост изменился до согласия": free space, the set of cards, or what is installed changed between
+ * the probe and the consent). `gpu_ids` is the sorted set of GPU UUIDs. `disk_sufficient` is whether
+ * the free space in `DockerRootDir` covers what the image still needs, not the number: free space
+ * moves by kilobytes on its own every second, and a digest over any rounding of it would still flip
+ * at a boundary and refuse a consent given a moment earlier (review r1, item 3). Null when unknown.
+ * "What is installed" is already in `system_changes`.
+ */
+export interface PlanHostFingerprint {
+    gpu_ids: string[];
+    disk_sufficient: boolean | null;
+    docker_root_dir: string | null;
+}
+/**
+ * The part of a requirement plan the user is consenting to. Whatever changes here invalidates an
+ * approval and sends the operation back to `awaiting-consent`: the target, the recipe, every system
+ * change (code, parameters and the text the user read), and the host facts in `host` — the GPU set
+ * and whether the free space where the image would land suffices (task 2.6, carry item 1). The registry's reported
+ * download size is left out: it is the descriptor's own estimate, pinned by `descriptor_id`.
+ */
+export interface PlanFingerprint {
+    target: ManagedOperationTarget;
+    recipe_id: string;
+    recipe_digest: Sha256Digest;
+    /** A plan that adopts the host's existing engine changes nothing, and says so in the hash. */
+    adopts_existing_engine: boolean;
+    system_changes: ManagedSystemChange[];
+    requires_elevation: boolean;
+    may_require_relogin: boolean;
+    may_require_reboot: boolean;
+    /**
+     * The runtime this plan would install, identified by the platform image it pins. Descriptors no
+     * longer carry a separate entrypoint digest (design D1/D12 reshape to
+     * `atomic-chat-conf/runtimes/schema.json`: `image` is a per-platform map, and there is nothing
+     * else in a descriptor that names what actually runs) — the image digest for the host's own
+     * platform is the whole identity.
+     */
+    descriptor: {
+        descriptor_id: string;
+        image_digest: Sha256Digest;
+    } | null;
+    /**
+     * The environment manifest the host was judged against (change `extract-environment-manifest`,
+     * D4): which distributions the install recipe was qualified for. A newly published manifest is a
+     * new plan, approved again; null when no manifest was available.
+     */
+    environment_manifest_id: string | null;
+    host: PlanHostFingerprint | null;
+}
+export declare function planDigest(plan: PlanFingerprint): Sha256Digest;

package/dist/runtime/environment/canonical-json.js

@@ -0,0 +1,86 @@
+/**
+ * One byte sequence per value, so two sides can agree on a hash — and the hashes the managed
+ * runtime makes decisions with: the fingerprint that decides whether a retried `begin` is the same
+ * request, and the plan digest the user's consent is bound to.
+ *
+ * This is deliberately not `settings`' `stableStringify`. That one fingerprints a settings object
+ * to answer "have I already imported this?", and it tolerates whatever `JSON.stringify` tolerates:
+ * `undefined` disappears, `NaN` becomes `null`, a `Date` becomes a string. Those are silent
+ * coercions, and a value that can be spelled two ways is a value two parties can disagree about
+ * while agreeing on the hash. Here a hash stands behind a privileged install the user approved, so
+ * anything that cannot be represented exactly is refused instead of coerced. Changing that older
+ * function was not an option either: its hashes are already on users' disks.
+ */
+import { createHash } from 'node:crypto';
+import { AtomicCoreError } from '../../contracts/index.js';
+const invalid = (why) => {
+    throw new AtomicCoreError('MANAGED_METADATA_INVALID', `Cannot canonicalise this value: ${why}`);
+};
+const isPlain = (value) => {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+const write = (value, path) => {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'boolean':
+            return value ? 'true' : 'false';
+        case 'string':
+            return JSON.stringify(value);
+        case 'number':
+            // `NaN` and the infinities have no JSON spelling; `JSON.stringify` writes `null` for them,
+            // which would make two different plans hash the same.
+            return Number.isFinite(value) ? JSON.stringify(value) : invalid(`${path} is ${String(value)}`);
+        case 'undefined':
+            return invalid(`${path} is undefined`);
+        case 'bigint':
+            return invalid(`${path} is a bigint`);
+        case 'function':
+        case 'symbol':
+            return invalid(`${path} is a ${typeof value}`);
+    }
+    const object = value;
+    if (Array.isArray(object)) {
+        // Order is meaning here: a list of system changes in another order is another plan.
+        return `[${object.map((item, index) => write(item, `${path}[${index}]`)).join(',')}]`;
+    }
+    // A `Date`, `Map` or class instance would walk as `{}` or as its private fields. Neither is what
+    // the caller meant, and both are silent.
+    if (!isPlain(object))
+        return invalid(`${path} is not a plain object`);
+    const entries = Object.entries(object)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([key, v]) => `${JSON.stringify(key)}:${write(v, `${path}.${key}`)}`);
+    return `{${entries.join(',')}}`;
+};
+/**
+ * The canonical UTF-8 JSON of a value: object keys sorted recursively, array order kept, absent
+ * properties and explicit `undefined` treated alike, and anything JSON cannot hold refused.
+ */
+export function canonicalJson(value) {
+    return write(value, '$');
+}
+/** `sha256:` + the hex digest of the canonical JSON. */
+export function canonicalDigest(value) {
+    const hex = createHash('sha256').update(canonicalJson(value), 'utf8').digest('hex');
+    return `sha256:${hex}`;
+}
+/**
+ * What makes two `begin` requests the same request. The request id is the caller's idempotency key,
+ * not part of the meaning, and the approved plan is consent that a resume may legitimately change,
+ * so neither is hashed. Everything that decides what would be installed is.
+ */
+export function beginFingerprint(input) {
+    return canonicalDigest({
+        target: input.target,
+        kind: input.kind,
+        descriptor_id: input.descriptor_id ?? null,
+        retain_models: input.retain_models ?? false,
+    });
+}
+export function planDigest(plan) {
+    return canonicalDigest(plan);
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/runtime/environment/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/runtime/environment/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAQ1D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAS,EAAE;IACrC,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,mCAAmC,GAAG,EAAE,CAAC,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAAa,EAAW,EAAE;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAkB,CAAA;IAC3D,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAA;AACrD,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,IAAY,EAAU,EAAE;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QACjC,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9B,KAAK,QAAQ;YACX,2FAA2F;YAC3F,sDAAsD;YACtD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChG,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,CAAA;QACxC,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC,CAAA;QACvC,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,GAAG,IAAI,SAAS,OAAO,KAAK,EAAE,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,KAAe,CAAA;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,oFAAoF;QACpF,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACvF,CAAC;IACD,iGAAiG;IACjG,yCAAyC;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACjC,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAC1B,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACnF,OAAO,UAAU,GAAG,EAAE,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK;KAC5C,CAAC,CAAA;AACJ,CAAC;AAsDD,MAAM,UAAU,UAAU,CAAC,IAAqB;IAC9C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC9B,CAAC"}