@calliopelabs/cli 2.5.0 → 3.1.0

package/dist/runlog.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Calliope CLI - Run Logs (audit trail)
+ *
+ * Append-only JSONL trace of an agent session, written to
+ * `~/.calliope-cli/runs/<sessionId>.jsonl` (override with `audit.dir`).
+ *
+ * Every line is a self-describing event carrying a schema `v`ersion, a monotonic
+ * `seq`uence number, an ISO `ts`, the event `type`, a type-specific payload, and
+ * a tamper-evidence hash chain: `prev_hash` (the previous line's hash) and `hash`
+ * (sha256 of `prev_hash` + the canonical JSON of the line body). No signing keys
+ * are needed — any edit, reorder, insertion, or deletion breaks the chain at that
+ * line, which `verifyChain` reports. See docs/governance.md.
+ *
+ * Writes are buffered and appended asynchronously (ordered via an internal
+ * promise chain); fsync is not forced per line, so logging never blocks the agent
+ * loop. The hash chain is advanced synchronously so ordering is always correct.
+ *
+ * On by default: the audit trail is the point, and it is local disk. Disable with
+ * `audit.enabled = false`.
+ */
+/** Run-log schema version. Bump only for breaking payload changes. */
+export declare const RUNLOG_SCHEMA_VERSION = 1;
+export type RunLogEventType = 'run_start' | 'user_prompt' | 'assistant_message' | 'tool_call' | 'tool_result' | 'budget_event' | 'policy_event' | 'run_end';
+/** The stable, on-disk shape of a run-log line. */
+export interface RunLogLine {
+    v: number;
+    seq: number;
+    ts: string;
+    type: RunLogEventType;
+    prev_hash: string;
+    hash: string;
+    [key: string]: unknown;
+}
+export interface RunStartPayload {
+    session: string;
+    cwd: string;
+    provider: string;
+    model: string;
+    /** Config snapshot with credentials stripped (never contains apiKey/token values). */
+    config: Record<string, unknown>;
+    /** How the session was driven: e.g. 'headless', 'acp'. Omitted for the default TUI. */
+    mode?: string;
+}
+export interface AssistantMessagePayload {
+    content: string;
+    tokens: {
+        input: number;
+        output: number;
+    };
+    cost: number;
+}
+export interface ToolCallPayload {
+    id: string;
+    name: string;
+    /** Arguments after a redaction pass for obvious secrets. */
+    args: Record<string, unknown>;
+}
+export interface ToolResultPayload {
+    id: string;
+    result: string;
+    isError: boolean;
+    durationMs: number;
+}
+export interface BudgetEventPayload {
+    scope: 'run' | 'project';
+    kind: 'cost' | 'tokens';
+    spent: number;
+    cap: number;
+    message: string;
+}
+export interface PolicyEventPayload {
+    tool: string;
+    decision: 'allow' | 'deny';
+    source: string;
+    reason?: string;
+    durationMs: number;
+}
+export interface RunEndPayload {
+    totals: {
+        inputTokens: number;
+        outputTokens: number;
+        cost: number;
+        toolCalls: number;
+        durationMs: number;
+    };
+    exitReason: string;
+}
+/**
+ * Deep-copy `value`, replacing anything that looks like a secret with
+ * `[REDACTED]`. Keys matching {@link SECRET_KEY_RE} are stripped by key name
+ * (so an empty or oddly-formatted API key is still removed); string values
+ * matching a known secret format are masked in place. Structure is preserved so
+ * the trace stays readable and diffable.
+ */
+export declare function redactSecrets(value: unknown): unknown;
+/**
+ * Deterministic JSON with object keys sorted recursively, so a line's canonical
+ * form is independent of key insertion order. Arrays keep their order.
+ */
+export declare function canonicalize(value: unknown): string;
+export interface ChainVerification {
+    ok: boolean;
+    /** 1-based line number where the chain first breaks, if any. */
+    brokenAtLine?: number;
+    /** Human-readable reason for the break. */
+    reason?: string;
+}
+/**
+ * Recompute the hash chain over parsed lines and report the first break.
+ * A line breaks the chain if its `prev_hash` does not match the previous line's
+ * `hash`, or if its recomputed `hash` does not match its stored `hash`.
+ */
+export declare function verifyChain(lines: RunLogLine[]): ChainVerification;
+export interface AuditSettings {
+    enabled: boolean;
+    dir: string;
+    retention: number;
+}
+/** Resolve audit settings from config, with optional explicit overrides. */
+export declare function resolveAuditSettings(overrides?: Partial<AuditSettings>): AuditSettings;
+/** Return the run-log file path for a session id under the given (or default) dir. */
+export declare function runLogPath(sessionId: string, dir?: string): string;
+/**
+ * Keep only the most recent `retention` run-log files in `dir` (by mtime),
+ * deleting the rest. Best-effort: a delete failure is ignored.
+ */
+export declare function rotateRuns(dir: string, retention: number): void;
+/**
+ * Parse a run-log file into lines. Blank lines are skipped; an unparseable line
+ * throws (a corrupt trace should be visible, not silently truncated). Callers
+ * that want tolerance can catch.
+ */
+export declare function readRunLog(filePath: string): RunLogLine[];
+export declare class RunLog {
+    readonly sessionId: string;
+    readonly filePath: string;
+    readonly enabled: boolean;
+    private seq;
+    private prevHash;
+    private writeTail;
+    private constructor();
+    /**
+     * Open (or reuse) the run log for a session. If a trace already exists on disk
+     * the hash chain is resumed from its last valid line. Multiple opens for the
+     * same file return the same instance so a session's turns share one chain.
+     */
+    static open(sessionId: string, overrides?: Partial<AuditSettings>): RunLog;
+    /** Resume seq/prev_hash from the last valid line of an existing trace. */
+    private resumeChain;
+    /** Build the next line, advance the chain synchronously, enqueue the write. */
+    private append;
+    runStart(payload: RunStartPayload): void;
+    userPrompt(text: string): void;
+    assistantMessage(payload: AssistantMessagePayload): void;
+    toolCall(payload: ToolCallPayload): void;
+    toolResult(payload: ToolResultPayload, maxResultChars?: number): void;
+    budgetEvent(payload: BudgetEventPayload): void;
+    policyEvent(payload: PolicyEventPayload): void;
+    runEnd(payload: RunEndPayload): void;
+    /** Await all buffered writes. */
+    flush(): Promise<void>;
+    /** Flush and drop this instance from the shared cache. */
+    close(): Promise<void>;
+}
+/**
+ * Record a supply-chain integrity violation (#137) as a `policy_event` in a
+ * dedicated `security` audit trace. Called when an installed skill or plugin
+ * fails hash re-verification at load time: the artifact is refused AND the
+ * tamper is surfaced in the audit trail, so it is not lost to a transient
+ * console warning that scrolls away.
+ *
+ * `subject` identifies the artifact (e.g. `skill:foo`, `plugin:bar`). Self-gates
+ * on the audit setting: when audit is disabled the underlying RunLog no-ops, so
+ * "log a policy_event if audit is on" needs no extra branch at the call site.
+ * Never throws — auditing must never break the load path it observes.
+ *
+ * Returns the RunLog so callers/tests can await `.flush()`, or null if the
+ * trace could not be opened.
+ */
+export declare function auditIntegrityViolation(subject: string, reason: string, overrides?: Partial<AuditSettings>): RunLog | null;
+/**
+ * Clear the in-memory instance cache (tests only). Does not touch disk.
+ */
+export declare function resetRunLogs(): void;
+//# sourceMappingURL=runlog.d.ts.map

package/dist/runlog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runlog.d.ts","sourceRoot":"","sources":["../src/runlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAYH,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,cAAc,GACd,cAAc,GACd,SAAS,CAAC;AAEd,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;CACpB;AAgCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcrD;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAMD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAgBlE;AAMD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,aAAa,CAe1F;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAmB,GAAG,MAAM,CAK5E;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CA4B/D;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAczD;AASD,qBAAa,MAAM;IACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,SAAS,CAAoC;IAErD,OAAO,eAIN;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,MAAM,CAuB7E;IAED,0EAA0E;IAC1E,OAAO,CAAC,WAAW;IA6BnB,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAsBd,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAKvC;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7B;IAED,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAEvD;IAED,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAMvC;IAED,UAAU,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,SAAO,GAAG,IAAI,CAUlE;IAED,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE7C;IAED,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAE7C;IAED,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAEnC;IAED,iCAAiC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAErB;IAED,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GACrC,MAAM,GAAG,IAAI,CAcf;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}

package/dist/runlog.js

@@ -0,0 +1,398 @@
+/**
+ * Calliope CLI - Run Logs (audit trail)
+ *
+ * Append-only JSONL trace of an agent session, written to
+ * `~/.calliope-cli/runs/<sessionId>.jsonl` (override with `audit.dir`).
+ *
+ * Every line is a self-describing event carrying a schema `v`ersion, a monotonic
+ * `seq`uence number, an ISO `ts`, the event `type`, a type-specific payload, and
+ * a tamper-evidence hash chain: `prev_hash` (the previous line's hash) and `hash`
+ * (sha256 of `prev_hash` + the canonical JSON of the line body). No signing keys
+ * are needed — any edit, reorder, insertion, or deletion breaks the chain at that
+ * line, which `verifyChain` reports. See docs/governance.md.
+ *
+ * Writes are buffered and appended asynchronously (ordered via an internal
+ * promise chain); fsync is not forced per line, so logging never blocks the agent
+ * loop. The hash chain is advanced synchronously so ordering is always correct.
+ *
+ * On by default: the audit trail is the point, and it is local disk. Disable with
+ * `audit.enabled = false`.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { createHash } from 'crypto';
+import * as config from './config.js';
+// ============================================================================
+// Schema
+// ============================================================================
+/** Run-log schema version. Bump only for breaking payload changes. */
+export const RUNLOG_SCHEMA_VERSION = 1;
+// ============================================================================
+// Redaction
+// ============================================================================
+/** Object keys whose values are always credentials — stripped wholesale. */
+const SECRET_KEY_RE = /(api[-_]?key|token|secret|password|passwd|authorization|credential|access[-_]?key|private[-_]?key|client[-_]?secret|session[-_]?token|bearer)/i;
+/** String values that look like well-known secret formats. */
+const SECRET_VALUE_PATTERNS = [
+    /sk-ant-[A-Za-z0-9_-]{16,}/,
+    /sk-[A-Za-z0-9_-]{16,}/,
+    /AKIA[0-9A-Z]{16}/,
+    /gh[pousr]_[A-Za-z0-9]{16,}/,
+    /github_pat_[A-Za-z0-9_]{22,}/,
+    /xox[baprs]-[A-Za-z0-9-]{10,}/,
+    /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+];
+const REDACTED = '[REDACTED]';
+function redactString(value) {
+    let out = value;
+    for (const pattern of SECRET_VALUE_PATTERNS) {
+        out = out.replace(new RegExp(pattern, 'g'), REDACTED);
+    }
+    return out;
+}
+/**
+ * Deep-copy `value`, replacing anything that looks like a secret with
+ * `[REDACTED]`. Keys matching {@link SECRET_KEY_RE} are stripped by key name
+ * (so an empty or oddly-formatted API key is still removed); string values
+ * matching a known secret format are masked in place. Structure is preserved so
+ * the trace stays readable and diffable.
+ */
+export function redactSecrets(value) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map(redactSecrets);
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+        if (SECRET_KEY_RE.test(key)) {
+            out[key] = REDACTED;
+        }
+        else {
+            out[key] = redactSecrets(val);
+        }
+    }
+    return out;
+}
+// ============================================================================
+// Hash chain
+// ============================================================================
+/**
+ * Deterministic JSON with object keys sorted recursively, so a line's canonical
+ * form is independent of key insertion order. Arrays keep their order.
+ */
+export function canonicalize(value) {
+    if (value === null || typeof value !== 'object') {
+        return JSON.stringify(value ?? null);
+    }
+    if (Array.isArray(value)) {
+        return '[' + value.map(canonicalize).join(',') + ']';
+    }
+    const keys = Object.keys(value).sort();
+    const parts = keys.map((k) => JSON.stringify(k) + ':' + canonicalize(value[k]));
+    return '{' + parts.join(',') + '}';
+}
+function hashBody(prevHash, body) {
+    return createHash('sha256').update(prevHash + canonicalize(body)).digest('hex');
+}
+/**
+ * Recompute the hash chain over parsed lines and report the first break.
+ * A line breaks the chain if its `prev_hash` does not match the previous line's
+ * `hash`, or if its recomputed `hash` does not match its stored `hash`.
+ */
+export function verifyChain(lines) {
+    let prev = '';
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Reconstruct the body (everything except the chain fields).
+        const { prev_hash, hash, ...body } = line;
+        if (prev_hash !== prev) {
+            return { ok: false, brokenAtLine: i + 1, reason: 'prev_hash mismatch' };
+        }
+        const expected = hashBody(prev_hash, body);
+        if (expected !== hash) {
+            return { ok: false, brokenAtLine: i + 1, reason: 'hash mismatch' };
+        }
+        prev = hash;
+    }
+    return { ok: true };
+}
+const DEFAULT_RUNS_DIR = path.join(os.homedir(), '.calliope-cli', 'runs');
+const DEFAULT_RETENTION = 100;
+/** Resolve audit settings from config, with optional explicit overrides. */
+export function resolveAuditSettings(overrides = {}) {
+    let stored;
+    try {
+        stored = config.get('audit');
+    }
+    catch {
+        stored = undefined;
+    }
+    const enabled = overrides.enabled ?? stored?.enabled ?? true; // ON by default
+    const dir = overrides.dir ?? stored?.dir ?? DEFAULT_RUNS_DIR;
+    const retentionRaw = overrides.retention ?? stored?.retention ?? DEFAULT_RETENTION;
+    const retention = Number.isFinite(retentionRaw) && retentionRaw > 0
+        ? Math.floor(retentionRaw)
+        : DEFAULT_RETENTION;
+    return { enabled, dir, retention };
+}
+/** Return the run-log file path for a session id under the given (or default) dir. */
+export function runLogPath(sessionId, dir = DEFAULT_RUNS_DIR) {
+    // Session ids are internally generated (`session_<ts>_<rand>`), but guard
+    // against path traversal from any externally-supplied id all the same.
+    const safe = sessionId.replace(/[^A-Za-z0-9_.-]/g, '_');
+    return path.join(dir, `${safe}.jsonl`);
+}
+/**
+ * Keep only the most recent `retention` run-log files in `dir` (by mtime),
+ * deleting the rest. Best-effort: a delete failure is ignored.
+ */
+export function rotateRuns(dir, retention) {
+    if (retention <= 0)
+        return;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir).filter((f) => f.endsWith('.jsonl'));
+    }
+    catch {
+        return;
+    }
+    if (entries.length <= retention)
+        return;
+    const withMtime = entries
+        .map((f) => {
+        const full = path.join(dir, f);
+        try {
+            return { full, mtime: fs.statSync(full).mtimeMs };
+        }
+        catch {
+            return { full, mtime: 0 };
+        }
+    })
+        .sort((a, b) => b.mtime - a.mtime); // newest first
+    for (const { full } of withMtime.slice(retention)) {
+        try {
+            fs.unlinkSync(full);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+// ============================================================================
+// Reading
+// ============================================================================
+/**
+ * Parse a run-log file into lines. Blank lines are skipped; an unparseable line
+ * throws (a corrupt trace should be visible, not silently truncated). Callers
+ * that want tolerance can catch.
+ */
+export function readRunLog(filePath) {
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const lines = [];
+    const rawLines = content.split('\n');
+    for (let i = 0; i < rawLines.length; i++) {
+        const raw = rawLines[i].trim();
+        if (!raw)
+            continue;
+        try {
+            lines.push(JSON.parse(raw));
+        }
+        catch {
+            throw new Error(`runlog: unparseable JSON on line ${i + 1} of ${filePath}`);
+        }
+    }
+    return lines;
+}
+// ============================================================================
+// RunLog (writer)
+// ============================================================================
+/** Per-file instance cache so multiple turns share one hash chain. */
+const cache = new Map();
+export class RunLog {
+    sessionId;
+    filePath;
+    enabled;
+    seq = 0;
+    prevHash = '';
+    writeTail = Promise.resolve();
+    constructor(sessionId, filePath, enabled) {
+        this.sessionId = sessionId;
+        this.filePath = filePath;
+        this.enabled = enabled;
+    }
+    /**
+     * Open (or reuse) the run log for a session. If a trace already exists on disk
+     * the hash chain is resumed from its last valid line. Multiple opens for the
+     * same file return the same instance so a session's turns share one chain.
+     */
+    static open(sessionId, overrides = {}) {
+        const settings = resolveAuditSettings(overrides);
+        const filePath = runLogPath(sessionId, settings.dir);
+        const existing = cache.get(filePath);
+        if (existing)
+            return existing;
+        const log = new RunLog(sessionId, filePath, settings.enabled);
+        if (settings.enabled) {
+            try {
+                fs.mkdirSync(settings.dir, { recursive: true });
+            }
+            catch {
+                /* if the dir can't be made, writes below will no-op via the catch */
+            }
+            // Rotate old sessions before this new one lands (cheap: once per open).
+            if (!fs.existsSync(filePath)) {
+                rotateRuns(settings.dir, settings.retention);
+            }
+            else {
+                log.resumeChain();
+            }
+        }
+        cache.set(filePath, log);
+        return log;
+    }
+    /** Resume seq/prev_hash from the last valid line of an existing trace. */
+    resumeChain() {
+        let lines;
+        try {
+            lines = readRunLog(this.filePath);
+        }
+        catch {
+            // Corrupt tail: fall back to a best-effort scan for the last valid line.
+            lines = [];
+            try {
+                const raw = fs.readFileSync(this.filePath, 'utf-8').split('\n');
+                for (const line of raw) {
+                    const t = line.trim();
+                    if (!t)
+                        continue;
+                    try {
+                        lines.push(JSON.parse(t));
+                    }
+                    catch {
+                        /* skip torn line */
+                    }
+                }
+            }
+            catch {
+                return;
+            }
+        }
+        const last = lines[lines.length - 1];
+        if (last && typeof last.hash === 'string' && typeof last.seq === 'number') {
+            this.prevHash = last.hash;
+            this.seq = last.seq + 1;
+        }
+    }
+    /** Build the next line, advance the chain synchronously, enqueue the write. */
+    append(type, payload) {
+        if (!this.enabled)
+            return;
+        const body = {
+            v: RUNLOG_SCHEMA_VERSION,
+            seq: this.seq,
+            ts: new Date().toISOString(),
+            type,
+            ...payload,
+        };
+        const hash = hashBody(this.prevHash, body);
+        const line = { ...body, prev_hash: this.prevHash, hash };
+        this.prevHash = hash;
+        this.seq += 1;
+        const text = JSON.stringify(line) + '\n';
+        this.writeTail = this.writeTail
+            .then(() => fs.promises.appendFile(this.filePath, text))
+            .catch(() => {
+            /* logging must never throw into the agent loop; drop on I/O error */
+        });
+    }
+    runStart(payload) {
+        this.append('run_start', {
+            ...payload,
+            config: redactSecrets(payload.config),
+        });
+    }
+    userPrompt(text) {
+        this.append('user_prompt', { text });
+    }
+    assistantMessage(payload) {
+        this.append('assistant_message', { ...payload });
+    }
+    toolCall(payload) {
+        this.append('tool_call', {
+            id: payload.id,
+            name: payload.name,
+            args: redactSecrets(payload.args),
+        });
+    }
+    toolResult(payload, maxResultChars = 2000) {
+        const result = payload.result.length > maxResultChars
+            ? payload.result.slice(0, maxResultChars) + `\n... [truncated ${payload.result.length - maxResultChars} chars]`
+            : payload.result;
+        this.append('tool_result', {
+            id: payload.id,
+            result,
+            isError: payload.isError,
+            durationMs: payload.durationMs,
+        });
+    }
+    budgetEvent(payload) {
+        this.append('budget_event', { ...payload });
+    }
+    policyEvent(payload) {
+        this.append('policy_event', { ...payload });
+    }
+    runEnd(payload) {
+        this.append('run_end', { ...payload });
+    }
+    /** Await all buffered writes. */
+    flush() {
+        return this.writeTail;
+    }
+    /** Flush and drop this instance from the shared cache. */
+    async close() {
+        await this.flush();
+        cache.delete(this.filePath);
+    }
+}
+/**
+ * Record a supply-chain integrity violation (#137) as a `policy_event` in a
+ * dedicated `security` audit trace. Called when an installed skill or plugin
+ * fails hash re-verification at load time: the artifact is refused AND the
+ * tamper is surfaced in the audit trail, so it is not lost to a transient
+ * console warning that scrolls away.
+ *
+ * `subject` identifies the artifact (e.g. `skill:foo`, `plugin:bar`). Self-gates
+ * on the audit setting: when audit is disabled the underlying RunLog no-ops, so
+ * "log a policy_event if audit is on" needs no extra branch at the call site.
+ * Never throws — auditing must never break the load path it observes.
+ *
+ * Returns the RunLog so callers/tests can await `.flush()`, or null if the
+ * trace could not be opened.
+ */
+export function auditIntegrityViolation(subject, reason, overrides = {}) {
+    try {
+        const log = RunLog.open('security', overrides);
+        log.policyEvent({
+            tool: subject,
+            decision: 'deny',
+            source: 'integrity',
+            reason,
+            durationMs: 0,
+        });
+        return log;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Clear the in-memory instance cache (tests only). Does not touch disk.
+ */
+export function resetRunLogs() {
+    cache.clear();
+}
+//# sourceMappingURL=runlog.js.map

package/dist/runlog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runlog.js","sourceRoot":"","sources":["../src/runlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAkFvC,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,aAAa,GACjB,gJAAgJ,CAAC;AAEnJ,8DAA8D;AAC9D,MAAM,qBAAqB,GAAa;IACtC,2BAA2B;IAC3B,uBAAuB;IACvB,kBAAkB;IAClB,4BAA4B;IAC5B,8BAA8B;IAC9B,8BAA8B;IAC9B,qCAAqC;IACrC,oCAAoC;CACrC,CAAC;AAEF,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1D,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC1E,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CACrF,CAAC;IACF,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAA6B;IAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,6DAA6D;QAC7D,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAYD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAA2B,EAAE;IACzE,IAAI,MAA2E,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GACX,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,gBAAgB;IAChE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,gBAAgB,CAAC;IAC7D,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,IAAI,MAAM,EAAE,SAAS,IAAI,iBAAiB,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1B,CAAC,CAAC,iBAAiB,CAAC;IACtB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,GAAG,GAAG,gBAAgB;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,SAAiB;IACvD,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO;IAC3B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO;IAExC,MAAM,SAAS,GAAG,OAAO;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IAErD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,sEAAsE;AACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,MAAM,OAAO,MAAM;IACR,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,OAAO,CAAU;IAClB,GAAG,GAAG,CAAC,CAAC;IACR,QAAQ,GAAG,EAAE,CAAC;IACd,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAErD,YAAoB,SAAiB,EAAE,QAAgB,EAAE,OAAgB;QACvE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,SAAiB,EAAE,SAAS,GAA2B,EAAE;QACnE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;YACD,wEAAwE;YACxE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAClE,WAAW;QACjB,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChE,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtB,IAAI,CAAC,CAAC;wBAAE,SAAS;oBACjB,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,oBAAoB;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,+EAA+E;IACvE,MAAM,CAAC,IAAqB,EAAE,OAAgC;QACpE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,GAA4B;YACpC,CAAC,EAAE,qBAAqB;YACxB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI;YACJ,GAAG,OAAO;SACX,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAe,EAAE,GAAI,IAAe,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAgB,CAAC;QAC/F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAEd,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;aAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;aACvD,KAAK,CAAC,GAAG,EAAE;YACV,qEAAqE;QACvE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,QAAQ,CAAC,OAAwB;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YACvB,GAAG,OAAO;YACV,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAA4B;SACjE,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,gBAAgB,CAAC,OAAgC;QAC/C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,OAAwB;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAA4B;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAA0B,EAAE,cAAc,GAAG,IAAI;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,cAAc;YACnD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG,oBAAoB,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,cAAc,SAAS;YAC/G,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YACzB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,OAA2B;QACrC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,WAAW,CAAC,OAA2B;QACrC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,OAAsB;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,iCAAiC;IACjC,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,MAAc,EACd,SAAS,GAA2B,EAAE;IAEtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,WAAW,CAAC;YACd,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,WAAW;YACnB,MAAM;YACN,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/{sandbox.d.ts → sandbox/docker.d.ts}

@@ -46,4 +46,4 @@ export declare function executeUnsafe(language: Language, code: string, timeout?
  * Execute code (with or without sandbox based on availability)
  */
 export declare function execute(language: Language, code: string, config?: Partial<SandboxConfig>, cwd?: string): Promise<ExecutionResult>;
-//# sourceMappingURL=sandbox.d.ts.map
+//# sourceMappingURL=docker.d.ts.map

package/dist/sandbox/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/sandbox/docker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;AAiC3E;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjE;AAcD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CAoI1B;AAqFD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAyG1B;AAMD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CAQ1B"}

package/dist/{sandbox.js → sandbox/docker.js}

@@ -390,4 +390,4 @@ export async function execute(language, code, config = {}, cwd) {
         return executeUnsafe(language, code, cfg.timeout);
     }
 }
-//# sourceMappingURL=sandbox.js.map
+//# sourceMappingURL=docker.js.map

package/dist/sandbox/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/sandbox/docker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAY,YAAY,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AA4BzB,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,cAAc,GAAkB;IACpC,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,kBAAkB,EAAG,wCAAwC;IACpE,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,KAAK;IACrB,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,IAAI;CACf,CAAC;AAEF,kCAAkC;AAClC,MAAM,eAAe,GAA6B;IAChD,MAAM,EAAE,kBAAkB;IAC1B,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,gBAAgB;CACvB,CAAC;AAEF,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,IAAI,eAAe,GAAmB,IAAI,CAAC;AAE3C;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAErD,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,uFAAuF;AACvF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,IAAY,EACZ,MAAM,GAA2B,EAAE,EACnC,GAAY;IAEZ,MAAM,GAAG,GAAkB,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,4BAA4B;IAC5B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,wEAAwE;YAChF,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;IAErD,sBAAsB;IACtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,gCAAgC,KAAK,EAAE;YAC/C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjC,uBAAuB;IACvB,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;YACvC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,UAAU;YACV,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YAED,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAClD,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAExC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,GAAG;oBACb,MAAM;oBACN,MAAM,EAAE,MAAM,GAAG,uBAAuB;oBACxC,QAAQ;oBACR,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC;oBACN,OAAO,EAAE,QAAQ,KAAK,CAAC;oBACvB,QAAQ,EAAE,QAAQ,IAAI,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,EAAE,OAAO,SAAS,CAAC;QAChC,KAAK,MAAM,EAAE,OAAO,SAAS,CAAC;QAC9B,KAAK,MAAM,EAAE,OAAO,SAAS,CAAC;QAC9B,KAAK,MAAM,EAAE,OAAO,SAAS,CAAC;QAC9B,KAAK,IAAI,EAAE,OAAO,SAAS,CAAC;QAC5B,KAAK,MAAM,EAAE,OAAO,SAAS,CAAC;QAC9B,SAAS,OAAO,UAAU,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,QAAkB,EAClB,MAAqB,EACrB,OAAe,EACf,QAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEvC,kBAAkB;IAClB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAErC,UAAU;IACV,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,WAAW;IACX,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAE/B,iCAAiC;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAE9B,2BAA2B;IAC3B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,aAAa,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ;IACR,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjB,4BAA4B;IAC5B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM;QACR,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAC;YAC5C,MAAM;QACR,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,QAAQ,EAAE,CAAC,CAAC;YAC5C,MAAM;QACR,KAAK,IAAI;YACP,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YAC7D,MAAM;QACR,KAAK,MAAM;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,0BAA0B,QAAQ,4BAA4B,CAAC,CAAC;YACtF,MAAM;IACV,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAkB,EAClB,IAAY,EACZ,OAAO,GAAW,KAAK;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,mBAAmB;IACnB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjC,cAAc;IACd,IAAI,GAAW,CAAC;IAChB,IAAI,IAAc,CAAC;IAEnB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,GAAG,GAAG,SAAS,CAAC;YAChB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM;QACR,KAAK,MAAM;YACT,GAAG,GAAG,MAAM,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM;QACR,KAAK,MAAM;YACT,GAAG,GAAG,MAAM,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM;QACR,KAAK,MAAM;YACT,GAAG,GAAG,MAAM,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM;QACR;YACE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,yBAAyB,QAAQ,EAAE;gBAC3C,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAEzD,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAClD,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAElD,OAAO,CAAC;gBACN,OAAO,EAAE,CAAC,QAAQ,IAAI,QAAQ,KAAK,CAAC;gBACpC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC1C,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,MAAM;gBAC5D,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAEzD,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAkB,EAClB,IAAY,EACZ,MAAM,GAA2B,EAAE,EACnC,GAAY;IAEZ,MAAM,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAE7C,IAAI,GAAG,CAAC,OAAO,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}