@cleocode/core 2026.6.11 → 2026.6.13

package/dist/llm/pi/pi-gondolin-env.js

@@ -0,0 +1,541 @@
+/**
+ * Gondolin micro-VM Pi `ExecutionEnv` — the SECOND backend of the
+ * {@link PiExecutionEnv} seam (T11909 · T11888-B · P5 Gondolin · epic T11599).
+ *
+ * Where the in-process {@link import('./pi-execution-env.js').GuardedExecutionEnv}
+ * (S1 · T11761 · T11897) confines Pi with a deny-first `ToolGuard` + workspace
+ * boundary INSIDE the host process, this backend's confinement is the
+ * **micro-VM boundary itself**. Guest code runs with:
+ *
+ * - **ZERO host authority** — no `cleo.db` handle, no writer-lease IPC socket, no
+ *   host `process.env` secrets, no host filesystem outside the single RW
+ *   `/workspace` mount. The guest is a different kernel; it cannot reach the
+ *   daemon, the lease arbiter, or BRAIN even if Pi-driven code tries.
+ * - **Egress only via the credential-injection proxy** — `createHttpHooks` is
+ *   constructed with `allowedHosts: []` (present-and-empty = DENY ALL per the
+ *   gondolin docs; OMITTING it = allow-all — the egress footgun this guards) and
+ *   host-side secret PLACEHOLDERS, so the guest only ever sees the `placeholder`
+ *   bytes, never the real token. The loop appends specific hosts per run.
+ * - **Live DBs NEVER mounted** — `.cleo/tasks.db` / `.cleo/brain.db` are NOT in
+ *   the VFS mount set. A replay operates on a DISPOSABLE seeded copy
+ *   (`VACUUM INTO` snapshot), so the T5158 data-loss vector (git overwrites the
+ *   live WAL-backed DB) is structurally impossible: there is no live handle
+ *   inside the VM to corrupt.
+ *
+ * This is strictly stronger than S1's env-scrub: S1 protects against an in-process
+ * Pi escape via the guard allowlist; Gondolin protects via kernel + VFS + network
+ * namespace separation. A thin in-guest deny layer (lexical `/workspace`
+ * confinement + a command denylist for real egress verbs) is kept as DEFENSE IN
+ * DEPTH — the boundary is the VM, but a Pi escape that runs a binary still cannot
+ * do damage that survives the run.
+ *
+ * Optional-dep discipline (D11142): `@earendil-works/gondolin` is loaded ONLY via
+ * the {@link import('./gondolin-loader.js').loadGondolin} dynamic import — it is
+ * in NEITHER `dependencies` NOR `optionalDependencies`, and this module declares
+ * NO `import type` from the package (the consumed structural shapes come from the
+ * loader's LOCAL types). `core` builds + all non-gondolin tests pass with gondolin
+ * ABSENT, and this module is import-time side-effect-free (no top-level VM boot).
+ *
+ * Never-throw discipline: every `vm.fs.*` / `vm.exec` call is wrapped exactly as
+ * S1's `#toFsErr` / `execErr` — a thrown gondolin/guest error becomes a
+ * {@link PiResult} `err` with `E_PI_FS_*` / `E_PI_EXEC_*` codes. The
+ * `PiResult<T, E>` contract is byte-for-byte identical to S1, so the Pi loop
+ * cannot tell the two backends apart.
+ *
+ * @epic T11599
+ * @task T11909
+ * @see ./pi-execution-env.js — the S1 `GuardedExecutionEnv` this mirrors over a VM
+ * @see ./gondolin-loader.js — the optional-dep loader supplying the structural types
+ */
+import { isAbsolute as posixIsAbsolute, join as posixJoin } from 'node:path/posix';
+import { getLogger } from '../../logger.js';
+import { loadGondolin, } from './gondolin-loader.js';
+const log = getLogger('pi-gondolin-env');
+/** The single RW mount point inside the guest — the ONLY writable location. */
+export const GONDOLIN_WORKSPACE_ROOT = '/workspace';
+/** Where in-guest temp dirs/files are created (under the workspace mount). */
+const GONDOLIN_TMP_DIR = `${GONDOLIN_WORKSPACE_ROOT}/.tmp`;
+/** Default guest memory bound — set explicitly so we never rely on gondolin's default. */
+const DEFAULT_GUEST_MEMORY = '1G';
+// ---------------------------------------------------------------------------
+// Result constructors (byte-for-byte identical to S1's, so the Pi loop cannot
+// tell the backends apart).
+// ---------------------------------------------------------------------------
+/** Build a successful {@link PiResult}. */
+function ok(value) {
+    return { ok: true, value };
+}
+/** Build a failed {@link PiResult} with a {@link PiFileError}. */
+function fsErr(code, message, path) {
+    return { ok: false, error: { code, message, ...(path !== undefined ? { path } : {}) } };
+}
+/** Build a failed {@link PiResult} with a {@link PiExecutionError}. */
+function execErr(code, message) {
+    return { ok: false, error: { code, message } };
+}
+/**
+ * The real egress verbs the guest is NEVER allowed to run. Sandbox output is a
+ * DRAFT PR opened HOST-side by the loop's egress step (never from inside the
+ * guest). The guest may run `git diff`/`git apply`/`git status` to PRODUCE a
+ * patch, but pushing/publishing is a host-only, budget-gated action. `cleo` is
+ * denied for completeness (no daemon is reachable from the guest anyway).
+ *
+ * Each entry is matched against the command's argv-0 basename, plus the
+ * two-token forms `git push` / `git remote` so a `git`-rooted egress is caught
+ * even though `git`'s OWN basename is allowed (for `git diff` etc.).
+ */
+const DENIED_EXEC_PREFIXES = [
+    'gh',
+    'npm publish',
+    'cleo',
+    'git push',
+    'git remote',
+];
+/**
+ * Whether `command` (string or argv) is a denied real-egress verb. Deny-first:
+ * checked BEFORE the command ever reaches `vm.exec`. Comparison is on the
+ * normalized leading tokens (argv-0 basename + a possible second subcommand
+ * token), so `git push origin main`, `/usr/bin/gh pr create`, and
+ * `npm publish --tag x` are all rejected, while `git diff` / `git status` pass.
+ *
+ * @param command - The string command or argv array the env received.
+ * @returns The matched denied prefix, or `null` when the command is allowed.
+ */
+function deniedEgressVerb(command) {
+    const tokens = Array.isArray(command)
+        ? [...command]
+        : String(command)
+            .trim()
+            .split(/\s+/)
+            .filter((t) => t.length > 0);
+    if (tokens.length === 0)
+        return null;
+    const base0 = basenameOf(tokens[0] ?? '');
+    const base1 = tokens.length > 1 ? basenameOf(tokens[1] ?? '') : '';
+    const one = base0;
+    const two = base1 ? `${base0} ${base1}` : '';
+    for (const denied of DENIED_EXEC_PREFIXES) {
+        if (denied === one)
+            return denied;
+        if (two !== '' && denied === two)
+            return denied;
+    }
+    return null;
+}
+/** POSIX basename of a token (strips any path prefix, e.g. `/usr/bin/gh` → `gh`). */
+function basenameOf(token) {
+    const slash = token.lastIndexOf('/');
+    return slash === -1 ? token : token.slice(slash + 1);
+}
+// ---------------------------------------------------------------------------
+// GondolinExecutionEnv
+// ---------------------------------------------------------------------------
+/**
+ * A {@link PiExecutionEnv} whose confinement is a gondolin micro-VM. Owns exactly
+ * ONE {@link VM} and releases it in {@link cleanup} via `vm.close()`.
+ *
+ * Every fs op maps to `vm.fs.*`; `exec` maps to `vm.exec`. Each call is wrapped
+ * try/catch → {@link PiResult} `err`, so no method ever throws. A thin in-guest
+ * deny layer (lexical `/workspace` confinement + the {@link DENIED_EXEC_PREFIXES}
+ * command denylist) is the defense-in-depth net BEHIND the VM boundary.
+ *
+ * Unlike the stateless {@link import('./pi-execution-env.js').GuardedExecutionEnv}
+ * (whose `cleanup()` is a no-op), this env OWNS the VM and MUST release it.
+ * `cleanup()` is idempotent (guarded by a `#closed` flag).
+ */
+export class GondolinExecutionEnv {
+    #vm;
+    #closed = false;
+    /**
+     * @param vm - The booted gondolin VM this env owns. Construct via
+     *   {@link createGondolinExecutionEnv}, not directly — the factory wires the
+     *   deny-by-default egress hooks + seeded-copy-only mount set.
+     */
+    constructor(vm) {
+        this.#vm = vm;
+    }
+    // --- pure path arithmetic (no VM round-trip) -----------------------------
+    /** The guest workspace root — the in-VM Pi run's working directory. */
+    cwd() {
+        return GONDOLIN_WORKSPACE_ROOT;
+    }
+    /** Resolve `path` to a guest-absolute path anchored at `/workspace`. */
+    absolutePath(path) {
+        return posixIsAbsolute(path) ? posixJoin(path) : posixJoin(GONDOLIN_WORKSPACE_ROOT, path);
+    }
+    /** Join path segments (pure POSIX) anchored at the guest workspace root. */
+    joinPath(...segments) {
+        return posixJoin(GONDOLIN_WORKSPACE_ROOT, ...segments);
+    }
+    /**
+     * Lexically confine a (possibly relative) guest path under `/workspace`. The
+     * guest cannot see host paths at all (separate VFS), so there is no
+     * symlink-to-host vector to resolve — a lexical check is sufficient here. A
+     * `../` climb or an absolute path outside `/workspace` returns `null`.
+     *
+     * @returns the normalized guest-absolute path, or `null` on an escape.
+     */
+    #confine(path) {
+        const abs = posixIsAbsolute(path) ? posixJoin(path) : posixJoin(GONDOLIN_WORKSPACE_ROOT, path);
+        if (abs === GONDOLIN_WORKSPACE_ROOT || abs.startsWith(`${GONDOLIN_WORKSPACE_ROOT}/`)) {
+            return abs;
+        }
+        return null;
+    }
+    // --- file reads ----------------------------------------------------------
+    /** Read a file's text from the guest workspace. */
+    async readTextFile(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const content = await this.#vm.fs.readFile(abs, { encoding: 'utf-8' });
+            return ok(content);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Read a file's text as an array of lines. */
+    async readTextLines(path) {
+        const res = await this.readTextFile(path);
+        return res.ok ? ok(res.value.split(/\r?\n/)) : res;
+    }
+    /**
+     * Binary read — FILLS S1's v0 denial. The guest VFS supports binary reads
+     * directly via `vm.fs.readFile(p)` (returns a `Uint8Array`).
+     */
+    async readBinaryFile(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const bytes = await this.#vm.fs.readFile(abs);
+            return ok(bytes);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    // --- file writes ---------------------------------------------------------
+    /** Write a file to the guest workspace. */
+    async writeFile(path, content) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            await this.#vm.fs.writeFile(abs, content);
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /**
+     * Append to a file. The guest fs surface offers only whole-file writes, so this
+     * reads-then-writes the concatenation (still confined). A missing file is
+     * treated as empty (append-creates).
+     */
+    async appendFile(path, content) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        let prefix = '';
+        try {
+            prefix = await this.#vm.fs.readFile(abs, { encoding: 'utf-8' });
+        }
+        catch (err) {
+            // A missing file is the only non-fatal case (append-creates). Any other
+            // failure (permission, …) propagates as the Pi error.
+            if (!isMissingFileError(err))
+                return this.#toFsErr(err, abs);
+        }
+        try {
+            await this.#vm.fs.writeFile(abs, prefix + content);
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    // --- metadata ------------------------------------------------------------
+    /** Report whether a guest path is a file or directory. */
+    async fileInfo(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const stat = await this.#vm.fs.stat(abs);
+            return ok({ isFile: stat.isFile(), isDirectory: stat.isDirectory() });
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Whether a guest path exists. */
+    async exists(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            await this.#vm.fs.access(abs);
+            return ok(true);
+        }
+        catch {
+            // `access` rejects for a missing path — that is a definitive "does not
+            // exist", NOT an error to surface. (A denied path was already rejected
+            // above by `#confine`.)
+            return ok(false);
+        }
+    }
+    /**
+     * Canonicalize a guest path via `realpath` inside the guest. Runs the binary in
+     * ARRAY form (no `$PATH` / shell expansion) so the path argument cannot be
+     * reinterpreted as shell.
+     */
+    async canonicalPath(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const res = await this.#vm.exec(['/bin/realpath', abs]);
+            const resolved = res.stdout.trim();
+            if (res.exitCode !== 0 || resolved === '') {
+                return fsErr('E_PI_FS_FAILED', res.stderr.trim() || 'realpath failed', abs);
+            }
+            return ok(resolved);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    // --- fs-mutating / listing ops (FILL S1's v0 denials) --------------------
+    /** List a guest directory — FILLS S1's v0 denial. */
+    async listDir(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const entries = await this.#vm.fs.listDir(abs);
+            return ok(entries);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Create a guest directory (recursive) — FILLS S1's v0 denial. */
+    async createDir(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            await this.#vm.fs.mkdir(abs, { recursive: true });
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Remove a guest path (recursive, force) — FILLS S1's v0 denial. */
+    async remove(path) {
+        const abs = this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            await this.#vm.fs.deleteFile(abs, { recursive: true, force: true });
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /**
+     * Create a temp directory under `/workspace/.tmp` — FILLS S1's v0 denial. Runs
+     * `mktemp -d` in ARRAY form (no `$PATH` / shell expansion).
+     */
+    async createTempDir(prefix) {
+        return this.#mktemp(['-d'], prefix);
+    }
+    /**
+     * Create a temp file under `/workspace/.tmp` — FILLS S1's v0 denial. Runs
+     * `mktemp` in ARRAY form (no `$PATH` / shell expansion).
+     */
+    async createTempFile(prefix) {
+        return this.#mktemp([], prefix);
+    }
+    /**
+     * Shared `mktemp` helper for {@link createTempDir} / {@link createTempFile}.
+     * The template lives UNDER the `/workspace` mount, so the created path is
+     * inside the only writable location and is confined by construction.
+     */
+    async #mktemp(flags, prefix) {
+        const safePrefix = (prefix ?? 'pi-').replace(/[^A-Za-z0-9._-]/g, '');
+        const template = `${GONDOLIN_TMP_DIR}/${safePrefix}XXXXXX`;
+        try {
+            // Ensure the parent .tmp dir exists (idempotent) before mktemp runs.
+            await this.#vm.fs.mkdir(GONDOLIN_TMP_DIR, { recursive: true });
+            const res = await this.#vm.exec(['/bin/mktemp', ...flags, template]);
+            const created = res.stdout.trim();
+            if (res.exitCode !== 0 || created === '') {
+                return fsErr('E_PI_FS_FAILED', res.stderr.trim() || 'mktemp failed', template);
+            }
+            return ok(created);
+        }
+        catch (err) {
+            return this.#toFsErr(err, template);
+        }
+    }
+    // --- shell ---------------------------------------------------------------
+    /**
+     * Execute a command in the guest via `vm.exec`. Deny-first: a real-egress verb
+     * ({@link DENIED_EXEC_PREFIXES} — `gh` / `git push` / `npm publish` / `cleo` /
+     * `git remote`) is rejected BEFORE reaching the VM, even though the VM itself
+     * has no egress (the network namespace is deny-by-default). `cwd` is confined
+     * to the workspace; the host `AbortSignal` is forwarded only when supplied.
+     *
+     * ## exitCode mapping
+     *
+     * gondolin's `ExecResult.exitCode` is `number` (NON-nullable) with a SEPARATE
+     * optional `signal` field; Pi's `PiExecResult.exitCode` is `number | null`
+     * ("null when killed by signal"). So a signal-kill is mapped to `null`, NOT
+     * the raw `exitCode`.
+     */
+    async exec(command, options) {
+        const denied = deniedEgressVerb(command);
+        if (denied !== null) {
+            return execErr('E_PI_EXEC_DENIED', `egress verb "${denied}" is denied inside the sandbox`);
+        }
+        const cwd = options?.cwd !== undefined ? this.#confine(options.cwd) : GONDOLIN_WORKSPACE_ROOT;
+        if (cwd === null) {
+            return execErr('E_PI_EXEC_DENIED', 'cwd escapes workspace boundary');
+        }
+        const execOptions = {
+            cwd,
+            ...(options?.env !== undefined ? { env: options.env } : {}),
+            ...(options?.timeout !== undefined ? { timeout: options.timeout } : {}),
+        };
+        try {
+            const res = await this.#vm.exec(command, execOptions);
+            const exitCode = res.signal !== undefined ? null : res.exitCode;
+            return ok({ stdout: res.stdout, stderr: res.stderr, exitCode });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return execErr('E_PI_EXEC_FAILED', message);
+        }
+    }
+    // --- cleanup (idempotent — owns the VM) ----------------------------------
+    /**
+     * Tear down the owned VM (`vm.close()`). Idempotent: a second call is a no-op.
+     * Best-effort and never throws (a close failure is logged, not propagated) so
+     * the Pi contract — `cleanup()` must not throw — holds.
+     */
+    async cleanup() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        try {
+            await this.#vm.close();
+        }
+        catch (err) {
+            log.debug({ err }, 'gondolin VM close failed during cleanup (ignored)');
+        }
+    }
+    // --- error mapping -------------------------------------------------------
+    /** Convert a thrown error from a `vm.fs.*` call into a Pi `Result.err`. */
+    #toFsErr(err, path) {
+        const code = typeof err === 'object' && err !== null && 'code' in err
+            ? String(err.code)
+            : 'E_PI_FS_FAILED';
+        const message = err instanceof Error ? err.message : String(err);
+        return fsErr(code, message, path);
+    }
+}
+/**
+ * Whether `err` is a "file does not exist" failure (`ENOENT`). Used by
+ * {@link GondolinExecutionEnv.appendFile} to treat append-to-missing as
+ * append-creates while still propagating every OTHER failure.
+ */
+function isMissingFileError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        'code' in err &&
+        err.code === 'ENOENT');
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Thrown by {@link createGondolinExecutionEnv} when the optional
+ * `@earendil-works/gondolin` package (or its QEMU/KVM host infra) is not
+ * available, so a VM cannot be booted. Callers that want graceful degradation
+ * should check `isGondolinAvailable()` first (the selector
+ * {@link import('./resolve-execution-env.js')} does this) and fall back to the
+ * in-process {@link import('./pi-execution-env.js').GuardedExecutionEnv}.
+ */
+export class GondolinUnavailableError extends Error {
+    /** Machine-readable code. */
+    code = 'E_GONDOLIN_UNAVAILABLE';
+    constructor(message) {
+        super(message);
+        this.name = 'GondolinUnavailableError';
+    }
+}
+/**
+ * Boot a gondolin micro-VM and wrap it in a {@link GondolinExecutionEnv}.
+ *
+ * The VM is configured for ZERO host authority:
+ * - **mount set** = ONLY `{ '/workspace': new RealFSProvider(seededCopyDir) }`.
+ *   The disposable seeded copy is the single RW mount; live `tasks.db`/`brain.db`
+ *   are structurally absent from the guest VFS (T5158 impossible in-VM).
+ * - **egress** = `createHttpHooks({ allowedHosts, secrets })` with `allowedHosts`
+ *   defaulting to `[]` (DENY ALL — the footgun guard) and host-side secret
+ *   PLACEHOLDERS (the guest never sees real token bytes).
+ * - **env** = ONLY `opts.env` (host `process.env` is NEVER inherited).
+ * - **memory** = `opts.memory` (default `"1G"`), set EXPLICITLY.
+ *
+ * Import-time side-effect-free: the gondolin module is loaded lazily HERE (not at
+ * module top-level) via the injectable {@link GondolinLoader} (tests pass a fake
+ * → a MOCK VM, so NO real QEMU boots).
+ *
+ * @param opts - The seeded-copy mount dir + egress allowlist/secrets + guest env.
+ * @returns A {@link PiExecutionEnv} backed by the booted VM.
+ * @throws {GondolinUnavailableError} When the optional package cannot be loaded.
+ *
+ * @example
+ * ```ts
+ * const env = await createGondolinExecutionEnv({ seededCopyDir: snapshotDir });
+ * // ... drive Pi's loop over `env` ...
+ * await env.cleanup(); // releases the VM
+ * ```
+ */
+export async function createGondolinExecutionEnv(opts) {
+    const load = opts.load ?? loadGondolin;
+    const mod = await load();
+    if (mod === null) {
+        throw new GondolinUnavailableError('gondolin is not available (package absent or host infra missing); ' +
+            'check isGondolinAvailable() and fall back to the in-process GuardedExecutionEnv');
+    }
+    // The ONLY RW mount is the disposable seeded copy at /workspace. Live DBs are
+    // structurally absent — there is no live handle inside the VM to corrupt.
+    const mounts = {
+        [GONDOLIN_WORKSPACE_ROOT]: new mod.RealFSProvider(opts.seededCopyDir),
+    };
+    // Egress deny-by-default: `allowedHosts` MUST be PRESENT-and-empty `[]` (the
+    // footgun — OMITTING it = allow-all per the gondolin docs). The loop appends
+    // specific hosts per run; secret bytes are injected host-side (guest sees only
+    // each `placeholder`).
+    const createHooks = mod.createHttpHooks;
+    const httpHooks = createHooks({
+        allowedHosts: opts.allowedHosts ?? [],
+        ...(opts.vaultSecrets !== undefined ? { secrets: opts.vaultSecrets } : {}),
+    });
+    const vm = await mod.VM.create({
+        memory: opts.memory ?? DEFAULT_GUEST_MEMORY,
+        env: opts.env ?? {},
+        vfs: { mounts },
+        httpHooks,
+    });
+    return new GondolinExecutionEnv(vm);
+}
+//# sourceMappingURL=pi-gondolin-env.js.map

package/dist/llm/pi/pi-gondolin-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-gondolin-env.js","sourceRoot":"","sources":["../../../src/llm/pi/pi-gondolin-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,UAAU,IAAI,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAKL,YAAY,GAIb,MAAM,sBAAsB,CAAC;AAW9B,MAAM,GAAG,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAqB,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,GAAG,uBAAuB,OAAO,CAAC;AAE3D,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,IAAa,CAAC;AAE3C,8EAA8E;AAC9E,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,2CAA2C;AAC3C,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,kEAAkE;AAClE,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe,EAAE,IAAa;IACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,uEAAuE;AACvE,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,IAAI;IACJ,aAAa;IACb,MAAM;IACN,UAAU;IACV,YAAY;CACb,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,OAAmC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aACZ,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC;QAClC,IAAI,GAAG,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAmDD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IACtB,GAAG,CAAK;IACjB,OAAO,GAAG,KAAK,CAAC;IAEhB;;;;OAIG;IACH,YAAY,EAAM;QAChB,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,4EAA4E;IAE5E,uEAAuE;IACvE,GAAG;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,wEAAwE;IACxE,YAAY,CAAC,IAAY;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC;IAED,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,QAAkB;QAC5B,OAAO,SAAS,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QAC/F,IAAI,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,uBAAuB,GAAG,CAAC,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAE5E,mDAAmD;IACnD,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,2CAA2C;IAC3C,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAe;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sDAAsD;YACtD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;YACnD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,uEAAuE;YACvE,wBAAwB;YACxB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,qDAAqD;IACrD,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAe;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAAe;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAwB,EAAE,MAAe;QACrD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,GAAG,gBAAgB,IAAI,UAAU,QAAQ,CAAC;QAC3D,IAAI,CAAC;YACH,qEAAqE;YACrE,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE,QAAQ,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAuB;QAEvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,kBAAkB,EAAE,gBAAgB,MAAM,gCAAgC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAC9F,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,WAAW,GAAwB;YACvC,GAAG;YACH,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAuB,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,2EAA2E;IAC3E,QAAQ,CAAC,GAAY,EAAE,IAAY;QACjC,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG;YACtD,CAAC,CAAC,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,gBAAgB,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,6BAA6B;IACpB,IAAI,GAAG,wBAAwB,CAAC;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuC;IAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAwB,CAChC,oEAAoE;YAClE,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,MAAM,GAA2C;QACrD,CAAC,uBAAuB,CAAC,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC;KACtE,CAAC;IAEF,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,uBAAuB;IACvB,MAAM,WAAW,GAAoB,GAAG,CAAC,eAAe,CAAC;IACzD,MAAM,SAAS,GAAG,WAAW,CAAC;QAC5B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,oBAAoB;QAC3C,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;QACnB,GAAG,EAAE,EAAE,MAAM,EAAE;QACf,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC"}