@aws/agentcore 1.0.0-preview.3 → 1.0.0-preview.30

package/dist/schema/schemas/agent-env.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentEnvSpecSchema = exports.RuntimeEndpointSchema = exports.RuntimeEndpointNameSchema = exports.LifecycleConfigurationSchema = exports.LIFECYCLE_TIMEOUT_MAX = exports.LIFECYCLE_TIMEOUT_MIN = exports.FilesystemConfigurationSchema = exports.SessionStorageSchema = exports.RequestHeaderAllowlistSchema = exports.MAX_HEADER_ALLOWLIST_SIZE = exports.HEADER_ALLOWLIST_PREFIX = exports.NetworkConfigSchema = exports.InstrumentationSchema = exports.EnvVarSchema = exports.EntrypointSchema = exports.BuildTypeSchema = exports.AgentTypeSchema = exports.AccessSchema = exports.GatewayNameSchema = exports.EnvVarNameSchema = exports.AgentNameSchema = void 0;
+exports.AgentEnvSpecSchema = exports.RuntimeEndpointSchema = exports.RuntimeEndpointNameSchema = exports.LifecycleConfigurationSchema = exports.LIFECYCLE_TIMEOUT_MAX = exports.LIFECYCLE_TIMEOUT_MIN = exports.FilesystemConfigurationSchema = exports.MAX_S3_MOUNTS = exports.MAX_EFS_MOUNTS = exports.CapacityProviderVolumeConfigSchema = exports.S3FilesAccessPointConfigSchema = exports.EfsAccessPointConfigSchema = exports.S3_FILES_ACCESS_POINT_ARN_PATTERN = exports.EFS_ACCESS_POINT_ARN_PATTERN = exports.SessionStorageSchema = exports.RequestHeaderAllowlistSchema = exports.MAX_HEADER_ALLOWLIST_SIZE = exports.HEADER_NAME_PATTERN = exports.HEADER_ALLOWLIST_PREFIX = exports.NetworkConfigSchema = exports.InstrumentationSchema = exports.EnvVarSchema = exports.RESERVED_BUILD_ARG_KEYS = exports.EntrypointSchema = exports.BuildTypeSchema = exports.AgentTypeSchema = exports.AccessSchema = exports.GatewayNameSchema = exports.EnvVarNameSchema = exports.AgentNameSchema = void 0;
+exports.isValidDockerfilePath = isValidDockerfilePath;
+exports.isReservedBuildArgKey = isReservedBuildArgKey;
+exports.checkAllowlistHeader = checkAllowlistHeader;
 /**
  * Agent Schema v2 - Clean, simplified model
  *
@@ -8,6 +11,8 @@ exports.AgentEnvSpecSchema = exports.RuntimeEndpointSchema = exports.RuntimeEndp
  */
 const constants_1 = require("../constants");
 const auth_1 = require("./auth");
+const connections_1 = require("./connections");
+const capacity_provider_1 = require("./primitives/capacity-provider");
 const tags_1 = require("./primitives/tags");
 const zod_1 = require("zod");
 // ============================================================================
@@ -56,6 +61,78 @@ exports.EntrypointSchema = zod_1.z
 // eslint-disable-next-line security/detect-unsafe-regex -- character class quantifiers don't cause backtracking
 /^[a-zA-Z0-9_][a-zA-Z0-9_/.-]*\.(py|ts|js)(:[a-zA-Z_][a-zA-Z0-9_]*)?$/, 'Must be a Python (.py) or TypeScript (.ts/.js) file path with optional handler (e.g., "main.py:handler" or "index.ts")');
 const DirectoryPathSchema = zod_1.z.string().min(1);
+// Char-safe set only (no backslash, spaces, or shell metacharacters): on deploy the buildspec
+// interpolates this unquoted as `docker build -f $DOCKERFILE_PATH`. A leading '.' is allowed so
+// conventional paths like '.docker/Dockerfile' pass.
+const DOCKERFILE_PATH_ALLOWED_CHARS = /^[A-Za-z0-9._/-]+$/;
+/**
+ * True when `p` is a safe relative Dockerfile path within the build context: allowed chars only, no
+ * leading slash (absolute), and no empty ('' from a leading/trailing/double slash) or '..' segments.
+ *
+ * The single source of truth shared by `DockerfilePathSchema` (config-validation time) and the runtime
+ * `getDockerfilePath` guard, so the two can never diverge — e.g. one accepting '.docker/Dockerfile'
+ * while the other rejects it, or one accepting a trailing-slash directory value like 'docker/'.
+ */
+function isValidDockerfilePath(p) {
+    if (!DOCKERFILE_PATH_ALLOWED_CHARS.test(p))
+        return false;
+    if (p.startsWith('/'))
+        return false;
+    return !p.split('/').some(segment => segment === '' || segment === '..');
+}
+/**
+ * Dockerfile location for Container builds, resolved relative to the Docker build context
+ * (`buildContextPath` when set, otherwise `codeLocation`). Accepts a filename ('Dockerfile',
+ * 'Dockerfile.gpu') or a forward-slash relative subpath ('docker/Dockerfile'). Absolute paths,
+ * trailing/double slashes, and '..' traversal are rejected so the Dockerfile can never escape or
+ * name the build context directory itself.
+ */
+const DockerfilePathSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(255)
+    .refine(isValidDockerfilePath, 'Must be a relative path within the build context: a filename or forward-slash subpath using only letters, digits, dot, dash, underscore, and slash; no leading slash, no ".." traversal, and no empty segments (no trailing or double slash)');
+/**
+ * Build-arg names reserved by the CodeBuild build environment. On deploy each build arg becomes a
+ * CodeBuild environment-variable override alongside the buildspec's own control vars, so a colliding
+ * name would break the deploy build — a wrong image tag / ECR region, a rejected StartBuild, or a
+ * clobbered build-container shell. We reject the buildspec control vars, the process-critical shell
+ * vars, and CodeBuild's own `AWS_*` / `CODEBUILD_*` namespaces. This is a best-effort denylist (the
+ * shell has other sensitive vars), but it covers the realistic footguns and keeps a config that
+ * builds locally from failing only on deploy.
+ */
+exports.RESERVED_BUILD_ARG_KEYS = [
+    // Buildspec control vars (mirrored in @aws/agentcore-cdk's ContainerBuildProject / build handler).
+    'ECR_REGISTRY',
+    'IMAGE_URI',
+    'DOCKERFILE_PATH',
+    'BUILD_ARG_FLAGS',
+    // Overriding these in the build shell would break the buildspec's own commands (command lookup,
+    // word-splitting, dynamic linking) or redirect the docker client off the build daemon. Kept
+    // deliberately narrow to the genuinely-dangerous names so common ARGs (e.g. USER, LANG) stay usable.
+    'PATH',
+    'HOME',
+    'IFS',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'DOCKER_HOST',
+    'DOCKER_CONFIG',
+    'DOCKER_TLS_VERIFY',
+    'DOCKER_CERT_PATH',
+];
+function isReservedBuildArgKey(key) {
+    return exports.RESERVED_BUILD_ARG_KEYS.includes(key) || key.startsWith('CODEBUILD_') || key.startsWith('AWS_');
+}
+/**
+ * Build-arg value. Bounded and control-char-free because on deploy each value becomes a CodeBuild
+ * `environmentVariablesOverride` PLAINTEXT entry; newlines/control chars or an over-long value can be
+ * rejected by StartBuild, so we reject them at schema time rather than let a local-only-valid config
+ * fail on deploy.
+ */
+const BuildArgValueSchema = zod_1.z
+    .string()
+    .max(4096, 'Build arg values must be at most 4096 characters')
+    .refine(v => ![...v].some(ch => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f), 'Build arg values must not contain control characters (including newlines)');
 exports.EnvVarSchema = zod_1.z.object({
     name: exports.EnvVarNameSchema,
     value: zod_1.z.string(),
@@ -76,26 +153,54 @@ exports.InstrumentationSchema = zod_1.z.object({
  * Required when networkMode is 'VPC'.
  */
 exports.NetworkConfigSchema = zod_1.z.object({
-    subnets: zod_1.z
-        .array(zod_1.z.string().regex(/^subnet-[0-9a-zA-Z]{8,17}$/))
-        .min(1)
-        .max(16),
+    subnets: zod_1.z.array(zod_1.z.string().regex(constants_1.SUBNET_ID_PATTERN, 'Must be a subnet id (subnet-...)')).min(1).max(16),
     securityGroups: zod_1.z
-        .array(zod_1.z.string().regex(/^sg-[0-9a-zA-Z]{8,17}$/))
+        .array(zod_1.z.string().regex(constants_1.SECURITY_GROUP_ID_PATTERN, 'Must be a security group id (sg-...)'))
         .min(1)
         .max(16),
+    /**
+     * VPC ID. Required for Container builds in VPC mode because CodeBuild needs an explicit VPC ID;
+     * it cannot infer the VPC from subnets alone. Runtime/Lambda builds can omit this.
+     */
+    vpcId: zod_1.z.string().regex(constants_1.VPC_ID_PATTERN, 'Must be a VPC id (vpc-...)').optional(),
 });
 /**
  * Allowed request headers for the runtime.
- * Each header must be 'Authorization' or start with 'X-Amzn-Bedrock-AgentCore-Runtime-Custom-'.
+ * Per https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-header-allowlist.html
+ * any valid HTTP header name (alphanumeric, hyphens, underscores) may be allow-listed,
+ * provided it is not structurally reserved (x-amz-*, x-amzn-* except Runtime-Custom-*).
  * Maximum 20 headers.
  */
 exports.HEADER_ALLOWLIST_PREFIX = 'X-Amzn-Bedrock-AgentCore-Runtime-Custom-';
+exports.HEADER_NAME_PATTERN = /^[A-Za-z0-9\-_]+$/;
 exports.MAX_HEADER_ALLOWLIST_SIZE = 20;
+/**
+ * Validate a single allowlist header name. Returns null if valid, or a specific
+ * error message describing which rule the input violated.
+ *
+ * Note: 'x-amz-' and 'x-amzn-' are disjoint prefixes (position 5 differs: '-' vs 'n'),
+ * so the two checks below are independent.
+ */
+function checkAllowlistHeader(val) {
+    if (!exports.HEADER_NAME_PATTERN.test(val)) {
+        return `Header name "${val}" must contain only alphanumeric characters, hyphens, and underscores.`;
+    }
+    const lower = val.toLowerCase();
+    if (lower.startsWith('x-amz-')) {
+        return `Header "${val}" is not allowed. Headers starting with "x-amz-" are reserved for AWS request signing.`;
+    }
+    if (lower.startsWith('x-amzn-') && !lower.startsWith('x-amzn-bedrock-agentcore-runtime-custom-')) {
+        return `Header "${val}" is not allowed. Headers starting with "x-amzn-" are reserved, except for "X-Amzn-Bedrock-AgentCore-Runtime-Custom-*".`;
+    }
+    return null;
+}
 exports.RequestHeaderAllowlistSchema = zod_1.z
-    .array(zod_1.z
-    .string()
-    .refine(val => val === 'Authorization' || val.startsWith(exports.HEADER_ALLOWLIST_PREFIX), `Must be "Authorization" or start with "${exports.HEADER_ALLOWLIST_PREFIX}"`))
+    .array(zod_1.z.string().superRefine((val, ctx) => {
+    const error = checkAllowlistHeader(val);
+    if (error) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: error });
+    }
+}))
     .max(exports.MAX_HEADER_ALLOWLIST_SIZE, `Maximum ${exports.MAX_HEADER_ALLOWLIST_SIZE} headers allowed`);
 /**
  * Session storage configuration for filesystem persistence.
@@ -105,11 +210,68 @@ exports.SessionStorageSchema = zod_1.z.object({
     /** Absolute mount path under /mnt with exactly one subdirectory level (e.g. /mnt/data). */
     mountPath: zod_1.z
         .string()
-        .regex(/^\/mnt\/[^/]+$/, 'Must be a path under /mnt with exactly one subdirectory (e.g. /mnt/data)'),
+        .min(6)
+        .max(200)
+        .regex(/^\/mnt\/[a-zA-Z0-9._-]+\/?$/, 'Must be a path under /mnt with exactly one subdirectory (e.g. /mnt/data)'),
 });
-exports.FilesystemConfigurationSchema = zod_1.z.object({
-    sessionStorage: exports.SessionStorageSchema,
+exports.EFS_ACCESS_POINT_ARN_PATTERN = /^arn:aws[-a-z]*:elasticfilesystem:[a-z][a-z0-9-]*:[0-9]{12}:access-point\/fsap-[0-9a-f]{8,40}$/;
+exports.S3_FILES_ACCESS_POINT_ARN_PATTERN = /^arn:aws[-a-z]*:s3files:[a-z][a-z0-9-]*:[0-9]{12}:file-system\/fs-[0-9a-f]{17,40}\/access-point\/fsap-[0-9a-f]{17,40}$/;
+/** EFS access point mount configuration. Requires VPC network mode. */
+exports.EfsAccessPointConfigSchema = zod_1.z.object({
+    /** ARN of an EFS access point. */
+    accessPointArn: zod_1.z
+        .string()
+        .regex(exports.EFS_ACCESS_POINT_ARN_PATTERN, 'Must be an EFS access point ARN (arn:aws[-a-z]*:elasticfilesystem:{region}:{account}:access-point/fsap-{id})'),
+    /** Absolute mount path under /mnt (e.g. /mnt/tools). */
+    mountPath: zod_1.z
+        .string()
+        .min(6)
+        .max(200)
+        .regex(/^\/mnt\/[a-zA-Z0-9._-]+\/?$/, 'Must be a path under /mnt with exactly one subdirectory (e.g. /mnt/tools)'),
+});
+/** S3 Files access point mount configuration. Requires VPC network mode. */
+exports.S3FilesAccessPointConfigSchema = zod_1.z.object({
+    /** ARN of an S3 Files access point. */
+    accessPointArn: zod_1.z
+        .string()
+        .regex(exports.S3_FILES_ACCESS_POINT_ARN_PATTERN, 'Must be an S3 Files access point ARN (arn:aws[-a-z]*:s3files:{region}:{account}:file-system/fs-{id}/access-point/fsap-{id})'),
+    /** Absolute mount path under /mnt (e.g. /mnt/datasets). */
+    mountPath: zod_1.z
+        .string()
+        .min(6)
+        .max(200)
+        .regex(/^\/mnt\/[a-zA-Z0-9._-]+\/?$/, 'Must be a path under /mnt with exactly one subdirectory (e.g. /mnt/datasets)'),
+});
+/** Capacity provider volume mount — references a named volume on the attached CP. */
+exports.CapacityProviderVolumeConfigSchema = zod_1.z.object({
+    /** Logical name of a volume defined on the attached capacity provider (CP's volumes[]). */
+    volumeName: capacity_provider_1.CapacityProviderVolumeNameSchema,
+    /** Absolute mount path under /mnt (e.g. /mnt/models). */
+    mountPath: zod_1.z
+        .string()
+        .min(6)
+        .max(200)
+        .regex(/^\/mnt\/[a-zA-Z0-9._-]+\/?$/, 'Must be a path under /mnt with exactly one subdirectory (e.g. /mnt/models)'),
 });
+/** Maximum number of EFS access point mounts per runtime. */
+exports.MAX_EFS_MOUNTS = 2;
+/** Maximum number of S3 Files access point mounts per runtime. */
+exports.MAX_S3_MOUNTS = 2;
+/**
+ * Filesystem configuration — union of four mount types.
+ * Exactly one key must be present per entry.
+ *
+ * Service limits per runtime: max 5 total, max 1 sessionStorage,
+ * max MAX_EFS_MOUNTS efsAccessPoint, max MAX_S3_MOUNTS s3FilesAccessPoint.
+ * efsAccessPoint and s3FilesAccessPoint require networkMode: VPC.
+ * capacityProviderVolume requires the runtime to be attached to a capacity provider.
+ */
+exports.FilesystemConfigurationSchema = zod_1.z.union([
+    zod_1.z.strictObject({ sessionStorage: exports.SessionStorageSchema }),
+    zod_1.z.strictObject({ efsAccessPoint: exports.EfsAccessPointConfigSchema }),
+    zod_1.z.strictObject({ s3FilesAccessPoint: exports.S3FilesAccessPointConfigSchema }),
+    zod_1.z.strictObject({ capacityProviderVolume: exports.CapacityProviderVolumeConfigSchema }),
+]);
 /** Minimum allowed value for lifecycle timeout fields (seconds). */
 exports.LIFECYCLE_TIMEOUT_MIN = 60;
 /** Maximum allowed value for lifecycle timeout fields (seconds). */
@@ -165,13 +327,29 @@ exports.AgentEnvSpecSchema = zod_1.z
     build: exports.BuildTypeSchema,
     entrypoint: exports.EntrypointSchema,
     codeLocation: DirectoryPathSchema,
-    /** Custom Dockerfile name for Container builds. Must be a filename, not a path. Default: 'Dockerfile' */
-    dockerfile: zod_1.z
-        .string()
-        .min(1)
-        .max(255)
-        .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/, 'Must be a filename (no path separators or traversal)')
-        .optional(),
+    /**
+     * Dockerfile for Container builds, resolved relative to the build context (`buildContextPath`
+     * when set, otherwise `codeLocation`). A filename or a relative subpath; no traversal. Default: 'Dockerfile'.
+     */
+    dockerfile: DockerfilePathSchema.optional(),
+    /**
+     * Docker build context directory for Container builds. When set, this directory (instead of
+     * `codeLocation`) is used as the `docker build` context and as the root the Dockerfile path is
+     * resolved against, so a single Dockerfile can be shared across multiple agents in a monorepo
+     * (e.g. so it can COPY files that live outside `codeLocation`). Container builds only.
+     *
+     * Like `codeLocation`, this is intentionally not containment-checked: the config author may point
+     * it at any directory (including a parent via `..` for a monorepo root). The unconditional
+     * secret-exclusion baseline on the deploy upload still applies to whatever directory is chosen.
+     */
+    buildContextPath: DirectoryPathSchema.optional(),
+    /**
+     * Custom build arguments passed to `docker build` as `--build-arg` flags. Keys must be valid
+     * environment-variable names (each arg is forwarded to the build as an env var), reusing
+     * `EnvVarNameSchema`. Useful for parameterising a shared Dockerfile per agent
+     * (e.g. `{ "AGENT_NAME": "myagent" }`). Container builds only.
+     */
+    customDockerBuildArgs: zod_1.z.record(exports.EnvVarNameSchema, BuildArgValueSchema).optional(),
     runtimeVersion: constants_1.RuntimeVersionSchema.optional(),
     /** Environment variables to set on the runtime */
     envVars: zod_1.z.array(exports.EnvVarSchema).optional(),
@@ -187,6 +365,13 @@ exports.AgentEnvSpecSchema = zod_1.z
     requestHeaderAllowlist: exports.RequestHeaderAllowlistSchema.optional(),
     /** ARN of an existing IAM execution role to use instead of creating a new one. */
     executionRoleArn: zod_1.z.string().optional(),
+    /**
+     * Additional IAM policies attached to the runtime execution role. Each entry is either a
+     * managed-policy ARN (attached directly) or a `.json` policy-document file path relative to
+     * `codeLocation` (attached as an inline policy). For opaque AWS access (e.g. S3) the CLI does
+     * not model as a typed connection.
+     */
+    additionalPolicies: zod_1.z.array(zod_1.z.string().min(1)).optional(),
     /** Authorizer type for inbound requests. Defaults to AWS_IAM. */
     authorizerType: auth_1.RuntimeAuthorizerTypeSchema.optional(),
     /** Authorizer configuration. Required when authorizerType is CUSTOM_JWT. */
@@ -198,6 +383,13 @@ exports.AgentEnvSpecSchema = zod_1.z
     filesystemConfigurations: zod_1.z.array(exports.FilesystemConfigurationSchema).optional(),
     /** Named endpoints (version aliases) for this runtime. Keys are endpoint names. */
     endpoints: zod_1.z.record(exports.RuntimeEndpointNameSchema, exports.RuntimeEndpointSchema).optional(),
+    /** Connections to external AgentCore resources (memory/gateway/runtime). The construct
+     *  generates IAM + discovery env vars onto this runtime's execution role. */
+    connections: zod_1.z.array(connections_1.ConnectionSchema).optional(),
+    /** Attach the runtime to a capacity provider (customer-managed EC2 compute) — either an
+     *  in-project sibling by name or an external CP by ARN. Mutually exclusive with VPC networking:
+     *  in CP mode the network topology comes from the capacity provider. */
+    capacityProviderConfiguration: capacity_provider_1.CapacityProviderConfigurationSchema.optional(),
 })
     .superRefine((data, ctx) => {
     if (data.networkMode === 'VPC' && !data.networkConfig) {
@@ -214,6 +406,32 @@ exports.AgentEnvSpecSchema = zod_1.z
             path: ['networkConfig'],
         });
     }
+    // Capacity-provider mode supplies its own network topology, so networkMode is not a settable
+    // property on a CP-attached runtime — neither VPC nor PUBLIC. The service derives networking
+    // from the capacity provider, so any explicit networkMode (or networkConfig) is rejected.
+    if (data.capacityProviderConfiguration && (data.networkMode !== undefined || data.networkConfig)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'capacityProviderConfiguration cannot be combined with a networkMode or VPC networking — a capacity provider supplies its own network topology, so leave networkMode/networkConfig unset',
+            path: ['capacityProviderConfiguration'],
+        });
+    }
+    // NOTE: vpcId is NOT required here at the schema (read/write) level. A Container+VPC agent needs
+    // a vpcId to build (CodeBuild can't infer it), but enforcing that on read would hard-fail
+    // pre-existing agentcore.json files written before vpcId existed. Instead: the CLI input
+    // validators require --vpc-id for fresh Container+VPC creates, deploy backfills a missing vpcId
+    // from the subnets (ec2:DescribeSubnets) and persists it, and the CDK construct fails fast if it
+    // is still missing at synth. This keeps `status`/`remove`/`validate` working on old configs.
+    if (data.networkMode === 'VPC' &&
+        (0, constants_1.isContainerBuild)(data) &&
+        data.networkConfig &&
+        data.networkConfig.securityGroups.length > constants_1.MAX_CONTAINER_BUILD_SECURITY_GROUPS) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: `Container builds in VPC mode allow at most ${constants_1.MAX_CONTAINER_BUILD_SECURITY_GROUPS} security groups (CodeBuild limit)`,
+            path: ['networkConfig', 'securityGroups'],
+        });
+    }
     if (data.authorizerType === 'CUSTOM_JWT' && !data.authorizerConfiguration?.customJwtAuthorizer) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -228,13 +446,91 @@ exports.AgentEnvSpecSchema = zod_1.z
             path: ['authorizerConfiguration'],
         });
     }
-    // If adding more Container-specific fields, consider consolidating into a containerConfig object (see networkConfig pattern)
-    if (data.build !== 'Container' && data.dockerfile) {
-        ctx.addIssue({
-            code: zod_1.z.ZodIssueCode.custom,
-            message: 'dockerfile is only allowed for Container builds',
-            path: ['dockerfile'],
-        });
+    // Container-only fields. If adding more, extend this list (and consider consolidating into a
+    // containerConfig object — see the networkConfig pattern).
+    for (const field of ['dockerfile', 'buildContextPath', 'customDockerBuildArgs']) {
+        if (data.build !== 'Container' && data[field]) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `${field} is only allowed for Container builds`,
+                path: [field],
+            });
+        }
+    }
+    for (const key of Object.keys(data.customDockerBuildArgs ?? {})) {
+        if (isReservedBuildArgKey(key)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `customDockerBuildArgs key "${key}" is reserved by the build environment (must not be ${exports.RESERVED_BUILD_ARG_KEYS.join(', ')}, or start with CODEBUILD_ or AWS_)`,
+                path: ['customDockerBuildArgs', key],
+            });
+        }
+    }
+    const fcs = data.filesystemConfigurations ?? [];
+    if (fcs.length > 0) {
+        const efsCount = fcs.filter(fc => 'efsAccessPoint' in fc).length;
+        const s3Count = fcs.filter(fc => 's3FilesAccessPoint' in fc).length;
+        const ssCount = fcs.filter(fc => 'sessionStorage' in fc).length;
+        const cpVolCount = fcs.filter(fc => 'capacityProviderVolume' in fc).length;
+        // A capacity-provider volume can only be mounted when the runtime is attached to a
+        // capacity provider — the volume is defined on that CP's volumes[].
+        if (cpVolCount > 0 && !data.capacityProviderConfiguration) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'capacityProviderVolume filesystem mounts require the runtime to be attached to a capacity provider (set capacityProviderConfiguration)',
+                path: ['filesystemConfigurations'],
+            });
+        }
+        if (fcs.length > 5) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'Maximum 5 filesystem configurations allowed',
+                path: ['filesystemConfigurations'],
+            });
+        }
+        if (efsCount > exports.MAX_EFS_MOUNTS) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `Maximum ${exports.MAX_EFS_MOUNTS} efsAccessPoint configurations allowed`,
+                path: ['filesystemConfigurations'],
+            });
+        }
+        if (s3Count > exports.MAX_S3_MOUNTS) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `Maximum ${exports.MAX_S3_MOUNTS} s3FilesAccessPoint configurations allowed`,
+                path: ['filesystemConfigurations'],
+            });
+        }
+        if (ssCount > 1) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'Maximum 1 sessionStorage configuration allowed',
+                path: ['filesystemConfigurations'],
+            });
+        }
+        const hasByo = efsCount > 0 || s3Count > 0;
+        if (hasByo && data.networkMode !== 'VPC') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'efsAccessPoint and s3FilesAccessPoint filesystem mounts require networkMode: VPC',
+                path: ['filesystemConfigurations'],
+            });
+        }
+        const mountPaths = fcs.map(fc => ('sessionStorage' in fc
+            ? fc.sessionStorage.mountPath
+            : 'efsAccessPoint' in fc
+                ? fc.efsAccessPoint.mountPath
+                : 's3FilesAccessPoint' in fc
+                    ? fc.s3FilesAccessPoint.mountPath
+                    : fc.capacityProviderVolume.mountPath).replace(/\/$/, ''));
+        if (new Set(mountPaths).size !== mountPaths.length) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: 'Filesystem mount paths must be unique',
+                path: ['filesystemConfigurations'],
+            });
+        }
     }
 });
 //# sourceMappingURL=agent-env.js.map

package/dist/schema/schemas/agent-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-env.js","sourceRoot":"","sources":["../../../src/schema/schemas/agent-env.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,4CAIsB;AAEtB,iCAA6E;AAC7E,4CAA+C;AAC/C,6BAAwB;AAMxB,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,wGAAwG;AAC3F,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;KAC1B,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,8BAA8B,EAC9B,kGAAkG,CACnG,CAAC;AAES,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,0BAA0B,EAC1B,uFAAuF,CACxF,CAAC;AAEJ,mGAAmG;AACtF,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK;AACJ,yGAAyG;AACzG,4CAA4C,EAC5C,yEAAyE,CAC1E,CAAC;AAEJ,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,wCAAwC;AAC3B,QAAA,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAG1D,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAElE,QAAA,eAAe,GAAG,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAGhD,QAAA,eAAe,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAGhE,qFAAqF;AACrF,2DAA2D;AAE3D;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,KAAK;AACJ,gHAAgH;AAChH,sEAAsE,EACtE,wHAAwH,CACvF,CAAC;AAEtC,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAwC,CAAC;AAExE,QAAA,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,wBAAgB;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAGH;;GAEG;AACU,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C;;;;OAIG;IACH,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC;AAGH;;;GAGG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,OAAC;SACP,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;IACV,cAAc,EAAE,OAAC;SACd,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAGH;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,0CAA0C,CAAC;AACrE,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAE/B,QAAA,4BAA4B,GAAG,OAAC;KAC1C,KAAK,CACJ,OAAC;KACE,MAAM,EAAE;KACR,MAAM,CACL,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,+BAAuB,CAAC,EACzE,0CAA0C,+BAAuB,GAAG,CACrE,CACJ;KACA,GAAG,CAAC,iCAAyB,EAAE,WAAW,iCAAyB,kBAAkB,CAAC,CAAC;AAE1F;;;GAGG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,2FAA2F;IAC3F,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,0EAA0E,CAAC;CACvG,CAAC,CAAC;AAGU,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,cAAc,EAAE,4BAAoB;CACrC,CAAC,CAAC;AAGH,oEAAoE;AACvD,QAAA,qBAAqB,GAAG,EAAE,CAAC;AACxC,oEAAoE;AACvD,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;GAGG;AACU,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,0DAA0D;IAC1D,yBAAyB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,QAAQ,EAAE;IAC5G,6DAA6D;IAC7D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,QAAQ,EAAE;CAC/F,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kDAAkD;gBAC3D,IAAI,EAAE,CAAC,2BAA2B,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACU,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC;KACnC,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,8BAA8B,EAC9B,kGAAkG,CACnG,CAAC;AAES,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,4DAA4D;IAC5D,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,4DAA4D;IAC5D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAIH;;;GAGG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,4CAA4C;IAC5C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,uBAAe;IACtB,UAAU,EAAE,wBAAgB;IAC5B,YAAY,EAAE,mBAAmB;IACjC,yGAAyG;IACzG,UAAU,EAAE,OAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,8BAA8B,EAAE,sDAAsD,CAAC;SAC7F,QAAQ,EAAE;IACb,cAAc,EAAE,gCAAiC,CAAC,QAAQ,EAAE;IAC5D,kDAAkD;IAClD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,oBAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,wDAAwD;IACxD,WAAW,EAAE,6BAAiB,CAAC,QAAQ,EAAE;IACzC,8EAA8E;IAC9E,aAAa,EAAE,2BAAmB,CAAC,QAAQ,EAAE;IAC7C,4EAA4E;IAC5E,eAAe,EAAE,6BAAqB,CAAC,QAAQ,EAAE;IACjD,uDAAuD;IACvD,QAAQ,EAAE,8BAAkB,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,sBAAsB,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IAC/D,kFAAkF;IAClF,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iEAAiE;IACjE,cAAc,EAAE,kCAA2B,CAAC,QAAQ,EAAE;IACtD,4EAA4E;IAC5E,uBAAuB,EAAE,6BAAsB,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAE,iBAAU,CAAC,QAAQ,EAAE;IAC3B,oDAAoD;IACpD,sBAAsB,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IAC/D,uEAAuE;IACvE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,QAAQ,EAAE;IAC3E,mFAAmF;IACnF,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,iCAAyB,EAAE,6BAAqB,CAAC,CAAC,QAAQ,EAAE;CACjF,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC/F,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,gGAAgG;YACzG,IAAI,EAAE,CAAC,yBAAyB,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,2EAA2E;YACpF,IAAI,EAAE,CAAC,yBAAyB,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,6HAA6H;IAC7H,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"agent-env.js","sourceRoot":"","sources":["../../../src/schema/schemas/agent-env.ts"],"names":[],"mappings":";;;AA8GA,sDAIC;AA+CD,sDAEC;AAuED,oDAYC;AAtPD;;;;GAIG;AACH,4CASsB;AAEtB,iCAA6E;AAC7E,+CAAiD;AACjD,sEAAuH;AACvH,4CAA+C;AAC/C,6BAAwB;AAMxB,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,wGAAwG;AAC3F,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;KAC1B,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,8BAA8B,EAC9B,kGAAkG,CACnG,CAAC;AAES,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,0BAA0B,EAC1B,uFAAuF,CACxF,CAAC;AAEJ,mGAAmG;AACtF,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK;AACJ,yGAAyG;AACzG,4CAA4C,EAC5C,yEAAyE,CAC1E,CAAC;AAEJ,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,wCAAwC;AAC3B,QAAA,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAG1D,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAElE,QAAA,eAAe,GAAG,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAGhD,QAAA,eAAe,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAGhE,qFAAqF;AACrF,2DAA2D;AAE3D;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,KAAK;AACJ,gHAAgH;AAChH,sEAAsE,EACtE,wHAAwH,CACvF,CAAC;AAEtC,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAwC,CAAC;AAErF,8FAA8F;AAC9F,gGAAgG;AAChG,qDAAqD;AACrD,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAE3D;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,CAAS;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,OAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CACL,qBAAqB,EACrB,8OAA8O,CAC/O,CAAC;AAEJ;;;;;;;;GAQG;AACU,QAAA,uBAAuB,GAAG;IACrC,mGAAmG;IACnG,cAAc;IACd,WAAW;IACX,iBAAiB;IACjB,iBAAiB;IACjB,gGAAgG;IAChG,4FAA4F;IAC5F,qGAAqG;IACrG,MAAM;IACN,MAAM;IACN,KAAK;IACL,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,kBAAkB;CACnB,CAAC;AAEF,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,OAAO,+BAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,IAAI,EAAE,kDAAkD,CAAC;KAC7D,MAAM,CACL,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAC7E,2EAA2E,CAC5E,CAAC;AAES,QAAA,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,wBAAgB;IACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAGH;;GAEG;AACU,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C;;;;OAIG;IACH,UAAU,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC;AAGH;;;GAGG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAAiB,EAAE,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACxG,cAAc,EAAE,OAAC;SACd,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAyB,EAAE,sCAAsC,CAAC,CAAC;SAC1F,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;IACV;;;OAGG;IACH,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAAc,EAAE,4BAA4B,CAAC,CAAC,QAAQ,EAAE;CACjF,CAAC,CAAC;AAGH;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAG,0CAA0C,CAAC;AACrE,QAAA,mBAAmB,GAAG,mBAAmB,CAAC;AAC1C,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC,2BAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,gBAAgB,GAAG,wEAAwE,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,WAAW,GAAG,wFAAwF,CAAC;IAChH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0CAA0C,CAAC,EAAE,CAAC;QACjG,OAAO,WAAW,GAAG,yHAAyH,CAAC;IACjJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEY,QAAA,4BAA4B,GAAG,OAAC;KAC1C,KAAK,CACJ,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAClC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CACH;KACA,GAAG,CAAC,iCAAyB,EAAE,WAAW,iCAAyB,kBAAkB,CAAC,CAAC;AAE1F;;;GAGG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,2FAA2F;IAC3F,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,6BAA6B,EAAE,0EAA0E,CAAC;CACpH,CAAC,CAAC;AAGU,QAAA,4BAA4B,GACvC,gGAAgG,CAAC;AAEtF,QAAA,iCAAiC,GAC5C,wHAAwH,CAAC;AAE3H,uEAAuE;AAC1D,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,kCAAkC;IAClC,cAAc,EAAE,OAAC;SACd,MAAM,EAAE;SACR,KAAK,CACJ,oCAA4B,EAC5B,8GAA8G,CAC/G;IACH,wDAAwD;IACxD,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,6BAA6B,EAAE,2EAA2E,CAAC;CACrH,CAAC,CAAC;AAGH,4EAA4E;AAC/D,QAAA,8BAA8B,GAAG,OAAC,CAAC,MAAM,CAAC;IACrD,uCAAuC;IACvC,cAAc,EAAE,OAAC;SACd,MAAM,EAAE;SACR,KAAK,CACJ,yCAAiC,EACjC,6HAA6H,CAC9H;IACH,2DAA2D;IAC3D,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,6BAA6B,EAC7B,8EAA8E,CAC/E;CACJ,CAAC,CAAC;AAGH,qFAAqF;AACxE,QAAA,kCAAkC,GAAG,OAAC,CAAC,MAAM,CAAC;IACzD,2FAA2F;IAC3F,UAAU,EAAE,oDAAgC;IAC5C,yDAAyD;IACzD,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,6BAA6B,EAAE,4EAA4E,CAAC;CACtH,CAAC,CAAC;AAGH,6DAA6D;AAChD,QAAA,cAAc,GAAG,CAAC,CAAC;AAChC,kEAAkE;AACrD,QAAA,aAAa,GAAG,CAAC,CAAC;AAE/B;;;;;;;;GAQG;AACU,QAAA,6BAA6B,GAAG,OAAC,CAAC,KAAK,CAAC;IACnD,OAAC,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,4BAAoB,EAAE,CAAC;IACxD,OAAC,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,kCAA0B,EAAE,CAAC;IAC9D,OAAC,CAAC,YAAY,CAAC,EAAE,kBAAkB,EAAE,sCAA8B,EAAE,CAAC;IACtE,OAAC,CAAC,YAAY,CAAC,EAAE,sBAAsB,EAAE,0CAAkC,EAAE,CAAC;CAC/E,CAAC,CAAC;AAGH,oEAAoE;AACvD,QAAA,qBAAqB,GAAG,EAAE,CAAC;AACxC,oEAAoE;AACvD,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;GAGG;AACU,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,0DAA0D;IAC1D,yBAAyB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,QAAQ,EAAE;IAC5G,6DAA6D;IAC7D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC,QAAQ,EAAE;CAC/F,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,yBAAyB,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kDAAkD;gBAC3D,IAAI,EAAE,CAAC,2BAA2B,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACU,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC;KACnC,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,8BAA8B,EAC9B,kGAAkG,CACnG,CAAC;AAES,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,4DAA4D;IAC5D,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,4DAA4D;IAC5D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAIH;;;GAGG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,uBAAe;IACrB,4CAA4C;IAC5C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,uBAAe;IACtB,UAAU,EAAE,wBAAgB;IAC5B,YAAY,EAAE,mBAAmB;IACjC;;;OAGG;IACH,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C;;;;;;;;;OASG;IACH,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,qBAAqB,EAAE,OAAC,CAAC,MAAM,CAAC,wBAAgB,EAAE,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACjF,cAAc,EAAE,gCAAiC,CAAC,QAAQ,EAAE;IAC5D,kDAAkD;IAClD,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,oBAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,wDAAwD;IACxD,WAAW,EAAE,6BAAiB,CAAC,QAAQ,EAAE;IACzC,8EAA8E;IAC9E,aAAa,EAAE,2BAAmB,CAAC,QAAQ,EAAE;IAC7C,4EAA4E;IAC5E,eAAe,EAAE,6BAAqB,CAAC,QAAQ,EAAE;IACjD,uDAAuD;IACvD,QAAQ,EAAE,8BAAkB,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,sBAAsB,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IAC/D,kFAAkF;IAClF,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;OAKG;IACH,kBAAkB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,iEAAiE;IACjE,cAAc,EAAE,kCAA2B,CAAC,QAAQ,EAAE;IACtD,4EAA4E;IAC5E,uBAAuB,EAAE,6BAAsB,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAE,iBAAU,CAAC,QAAQ,EAAE;IAC3B,oDAAoD;IACpD,sBAAsB,EAAE,oCAA4B,CAAC,QAAQ,EAAE;IAC/D,uEAAuE;IACvE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,qCAA6B,CAAC,CAAC,QAAQ,EAAE;IAC3E,mFAAmF;IACnF,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,iCAAyB,EAAE,6BAAqB,CAAC,CAAC,QAAQ,EAAE;IAChF;iFAC6E;IAC7E,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,8BAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD;;4EAEwE;IACxE,6BAA6B,EAAE,uDAAmC,CAAC,QAAQ,EAAE;CAC9E,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,0FAA0F;IAC1F,IAAI,IAAI,CAAC,6BAA6B,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,yLAAyL;YAC3L,IAAI,EAAE,CAAC,+BAA+B,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,iGAAiG;IACjG,0FAA0F;IAC1F,yFAAyF;IACzF,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,IACE,IAAI,CAAC,WAAW,KAAK,KAAK;QAC1B,IAAA,4BAAgB,EAAC,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,GAAG,+CAAmC,EAC9E,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,8CAA8C,+CAAmC,oCAAoC;YAC9H,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC/F,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,gGAAgG;YACzG,IAAI,EAAE,CAAC,yBAAyB,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,KAAK,YAAY,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,2EAA2E;YACpF,IAAI,EAAE,CAAC,yBAAyB,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,6FAA6F;IAC7F,2DAA2D;IAC3D,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,KAAK,uCAAuC;gBACxD,IAAI,EAAE,CAAC,KAAK,CAAC;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,8BAA8B,GAAG,uDAAuD,+BAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACxK,IAAI,EAAE,CAAC,uBAAuB,EAAE,GAAG,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACpE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAE3E,mFAAmF;QACnF,oEAAoE;QACpE,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EACL,wIAAwI;gBAC1I,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,6CAA6C;gBACtD,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,GAAG,sBAAc,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,WAAW,sBAAc,wCAAwC;gBAC1E,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,GAAG,qBAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,WAAW,qBAAa,4CAA4C;gBAC7E,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,gDAAgD;gBACzD,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kFAAkF;gBAC3F,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAC9B,CAAC,gBAAgB,IAAI,EAAE;YACrB,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS;YAC7B,CAAC,CAAC,gBAAgB,IAAI,EAAE;gBACtB,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS;gBAC7B,CAAC,CAAC,oBAAoB,IAAI,EAAE;oBAC1B,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS;oBACjC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,CAC1C,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,uCAAuC;gBAChD,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}