@descryy/runtime-controller 0.2.0 → 0.3.0

package/dist/readiness.js

@@ -1,65 +1,30 @@
 /**
- * Readiness (plan §6): "Readiness must not equal 'process exists.'" —
- * supported strategies are HTTP health check, TCP/port check, a known log
- * pattern, a real subprocess command, or a caller-supplied hook (which
- * covers the plan's "framework readiness hook" and "user-defined readiness"
- * — two names for the same shape, a caller-provided async predicate,
- * consolidated into one mechanism rather than two near-identical ones).
+ * Readiness (§6): "readiness must not equal 'process exists.'" Mechanisms: HTTP
+ * check, TCP/port check, log pattern, subprocess command, or a caller hook
+ * (consolidates the plan's "framework readiness hook" and "user-defined readiness"
+ * into one predicate shape).
  *
- * **`command` is not `custom-hook` (RT-193).** An earlier version of this
- * comment folded the plan's "command check" into `custom-hook` too, on the
- * reasoning that both are "a caller-provided check." That collapsed a real
- * distinction: `custom-hook` runs a caller's own in-process predicate,
- * while `command` runs an actual subprocess and reads its actual exit
- * code — the same "declared, not inferred" shape `ServiceConfiguration`'s
- * own `command` field already uses, one layer over. A caller with a real
- * CLI health check (`pg_isready`, a framework's own readiness script) had
- * no way to express that without either wrapping it in a hand-written
- * `custom-hook` predicate that shells out itself, or reimplementing the
- * subprocess plumbing per caller — `command` is that plumbing, built once.
+ * **`command` is not `custom-hook` (RT-193).** `custom-hook` runs a caller's
+ * in-process predicate; `command` runs a real subprocess and reads its exit code --
+ * built once so a caller with a real CLI health check (`pg_isready`) doesn't have to
+ * shell out from inside a hand-written hook.
  *
- * The plan requires recording which mechanism succeeded — `ReadinessResult`
- * makes that a field, not something inferred after the fact.
+ * **What `ready: true` does not claim (RT-024).** All mechanisms answer "is
+ * something listening/responding," none confirm it's the process *this* spawn
+ * produced -- a stale listener from an already-dead run satisfies `http`/`tcp-port`
+ * identically. `log-pattern` only carries the stronger this-run guarantee if `read`
+ * is wired to this execution's own `readOutput()` (caller discipline, not enforced
+ * by the type). An ephemeral port closes this gap by construction; a fixed,
+ * guessable port doesn't. Found via a real 30s collector timeout that looked like a
+ * Playwright bug and was actually a wait on an orphaned process from a dead session
+ * (RT-024).
  *
- * **What `ready: true` does and does not claim (RT-024).** All four
- * mechanisms answer one question — is something listening / responding
- * where expected — and none answer whether it is the process *this*
- * `spawnProcess` call produced. A stale listener from an unrelated, already-
- * dead run satisfies `http`/`tcp-port` identically to a correct one; nothing
- * here can tell them apart. `log-pattern` only carries the stronger,
- * this-run-specific guarantee when its `read` is wired to *this* execution's
- * own `ManagedProcess.readOutput()` — the type does not enforce that wiring,
- * it is a caller discipline. `custom-hook` inherits whatever the caller's
- * predicate actually checks.
- *
- * Callers that bind a fixed, guessable host:port are exposed to this gap;
- * an ephemeral port closes it by construction (nothing else can already be
- * bound there) rather than by detection, and is the default recommendation
- * over a startup-nonce scheme, which only earns its extra machinery when a
- * fixed port is genuinely unavoidable (a contract with an external tool).
- * See `descry-runtime`'s `DECISIONS.md` RT-024 for how this was found —
- * a real 30-second collector timeout that looked like a Playwright/DOM bug
- * and was actually a correct wait against an orphaned process from a
- * different, already-dead session.
- *
- * **A single probe attempt cannot outlive `timeoutMs` (RT-030).** `http`
- * and `tcp-port` each bind their I/O to the *remaining* time until
- * `deadline`, not a fresh per-attempt budget — a target that accepts a
- * connection and never responds no longer lets one probe attempt run past
- * the caller's own deadline. Measured, not theoretical: an unbound `fetch`
- * here let `awaitReadiness` run past its own `timeoutMs` (>8s observed
- * against a 3s budget). `command` honors the same discipline, the same
- * way: `execFile`'s own `timeout` option is set to the remaining time until
- * `deadline`, so a command that hangs instead of exiting is killed rather
- * than left to run past the caller's own budget — it owns a real OS
- * resource (a child process) exactly like the http/tcp-port sockets do, so
- * it gets the same treatment. `custom-hook` is not wrapped the same way — a
- * caller-supplied predicate owns its own timeout behavior, same as every
- * other `Collector`-shaped callback contract in this repo (`collector.ts`'s
- * own docs put "must resolve, not hang" on the implementer); imposing a
- * surprise external cancellation on arbitrary caller code would be a
- * different, larger decision than fixing the mechanisms that own a real OS
- * resource this module can actually clean up.
+ * **A single probe attempt cannot outlive `timeoutMs` (RT-030).** `http`/`tcp-port`
+ * bind I/O to the remaining time until `deadline`, not a fresh per-attempt budget --
+ * measured: an unbound `fetch` here let `awaitReadiness` run 8s+ past a 3s budget.
+ * `command` gets the same treatment via `execFile`'s `timeout`. `custom-hook` is not
+ * wrapped this way -- a caller predicate owns its own timeout, same as every other
+ * `Collector` callback contract here.
  */
 import { createConnection } from "node:net";
 import { execFile } from "node:child_process";
@@ -72,35 +37,34 @@ export async function awaitReadiness(checks, options) {
     if (checks.length === 0) {
         return { ready: false, mechanism: null, elapsedMs: 0, reason: "no readiness checks configured" };
     }
+    // C-F4: last real diagnostic any probe captured before giving up (chiefly
+    // `command`'s stderr/exit code -- http/tcp-port have nothing richer than
+    // "connection refused"). Kept as "last seen", most likely to explain the timeout.
+    let lastDetail = null;
     do {
         for (const check of checks) {
-            if (await probe(check, deadline)) {
+            const result = await probe(check, deadline);
+            if (result.ok) {
                 return { ready: true, mechanism: check.kind, elapsedMs: Date.now() - startedAt, reason: null };
             }
+            if (result.detail !== null)
+                lastDetail = `${check.kind}: ${result.detail}`;
         }
         await sleep(pollIntervalMs);
     } while (Date.now() < deadline);
-    // Names what was actually probed, not just that nothing answered.
-    //
-    // This is the only cheap thing available against the ephemeral-port race
-    // in `allocateEphemeralPort` (bind 0, read, close, spawn): if another
-    // process takes the port in the window between release and the child's
-    // own bind, the child never comes up and the *only* symptom is this
-    // result. "No readiness mechanism succeeded" sends the reader to look at
-    // the application; "nothing answered http://127.0.0.1:41237/health"
-    // sends them to look at the port, which is where the problem is. The race
-    // itself cannot be closed without binding the real service directly to
-    // the probe socket, which the child-process model does not support — so
-    // making its one symptom legible is the honest remainder.
+    // Names what was actually probed, not just that nothing answered -- the only
+    // cheap mitigation for the ephemeral-port race in `allocateEphemeralPort`
+    // (bind 0, read, close, spawn): if another process grabs the port first, the
+    // child never comes up and this message is the only symptom. Naming the exact
+    // address probed sends the reader to the port, not the application.
     return {
         ready: false,
         mechanism: null,
         elapsedMs: Date.now() - startedAt,
-        // "timeout" stays in the wording deliberately: the first draft of this
-        // message replaced it with "within 1500ms", which reads fine and drops
-        // the one word a caller can match on. §41's hung-process test does
-        // exactly that, and caught it.
-        reason: `no readiness mechanism succeeded within the ${options.timeoutMs}ms timeout — probed ${checks.map(describeCheck).join(", ")}`,
+        // "timeout" stays in the wording deliberately -- §41's hung-process test
+        // matches on that word.
+        reason: `no readiness mechanism succeeded within the ${options.timeoutMs}ms timeout — probed ${checks.map(describeCheck).join(", ")}` +
+            (lastDetail !== null ? `; last observed failure — ${lastDetail}` : ""),
     };
 }
 function describeCheck(check) {
@@ -117,6 +81,12 @@ function describeCheck(check) {
             return "custom hook";
     }
 }
+function ok() {
+    return { ok: true, detail: null };
+}
+function notReady(detail = null) {
+    return { ok: false, detail };
+}
 async function probe(check, deadline) {
     switch (check.kind) {
         case "http":
@@ -124,52 +94,60 @@ async function probe(check, deadline) {
         case "tcp-port":
             return probeTcpPort(check, deadline);
         case "log-pattern":
-            return check.pattern.test(check.read());
+            return check.pattern.test(check.read()) ? ok() : notReady();
         case "command":
             return probeCommand(check, deadline);
         case "custom-hook":
-            return check.check();
+            return (await check.check()) ? ok() : notReady();
     }
 }
 async function probeHttp(check, deadline) {
     try {
         const response = await fetch(check.url, { signal: AbortSignal.timeout(Math.max(0, deadline - Date.now())) });
-        return response.status === (check.expectedStatus ?? 200);
+        if (response.status === (check.expectedStatus ?? 200))
+            return ok();
+        return notReady(`responded with status ${String(response.status)}, expected ${String(check.expectedStatus ?? 200)}`);
     }
-    catch {
-        return false;
+    catch (error) {
+        return notReady(error instanceof Error ? error.message : String(error));
     }
 }
 function probeTcpPort(check, deadline) {
     return new Promise((resolve) => {
         const socket = createConnection({ host: check.host, port: check.port });
         socket.setTimeout(Math.max(0, deadline - Date.now()));
-        const finish = (ok) => {
+        const finish = (result) => {
             socket.destroy();
-            resolve(ok);
+            resolve(result);
         };
-        socket.once("connect", () => finish(true));
-        socket.once("error", () => finish(false));
-        socket.once("timeout", () => finish(false));
+        socket.once("connect", () => finish(ok()));
+        socket.once("error", (error) => finish(notReady(error.message)));
+        socket.once("timeout", () => finish(notReady("connection attempt timed out")));
     });
 }
 /**
- * Ready when `check.command` exits 0 within the remaining time until
- * `deadline` (RT-030 — see this module's own header). A non-zero exit, a
- * spawn failure (e.g. command not found), and a timeout kill are all "not
- * ready yet" here — `awaitReadiness`'s polling loop retries on the next
- * `pollIntervalMs` tick regardless of which one happened, the same as every
- * other mechanism's `false`.
+ * Ready when `check.command` exits 0 within the remaining time until `deadline`
+ * (RT-030). Non-zero exit, spawn failure, and timeout kill are all "not ready yet" --
+ * same as every other mechanism's `false`.
+ *
+ * C-F4: stdout/stderr are the actual health-check output, the richest diagnostic
+ * available here. Preferring stderr, then stdout, then the bare error message
+ * mirrors `runAttacher`'s ordering in `attach-to-running-jvm-process.ts`.
  */
 function probeCommand(check, deadline) {
     return new Promise((resolve) => {
         const remainingMs = Math.max(0, deadline - Date.now());
         if (remainingMs === 0) {
-            resolve(false);
+            resolve(notReady("no time remaining before the readiness deadline"));
             return;
         }
-        execFile(check.command, check.args ?? [], { cwd: check.cwd, timeout: remainingMs }, (error) => {
-            resolve(error === null);
+        execFile(check.command, check.args ?? [], { cwd: check.cwd, timeout: remainingMs }, (error, stdout, stderr) => {
+            if (error === null) {
+                resolve(ok());
+                return;
+            }
+            const detail = stderr.trim() || stdout.trim() || error.message;
+            resolve(notReady(detail));
         });
     });
 }

package/dist/readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAqE3G,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,OAA8B;IAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAE1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnG,CAAC;IAED,GAAG,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;IAEhC,kEAAkE;IAClE,EAAE;IACF,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,0DAA0D;IAC1D,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACjC,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,+BAA+B;QAC/B,MAAM,EAAE,+CAA+C,OAAO,CAAC,SAAS,uBAAuB,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACtI,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,OAAO,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,aAAa;YAChB,OAAO,eAAe,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,KAAqB,EAAE,QAAgB;IAC1D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAyB,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA4B,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,EAAW,EAAQ,EAAE;YACnC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAA4B,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5F,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../src/readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AA8D3G,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAiC,EACjC,OAA8B;IAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAE1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACnG,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,kFAAkF;IAClF,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,GAAG,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;gBAAE,UAAU,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;IAEhC,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,oEAAoE;IACpE,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACjC,yEAAyE;QACzE,wBAAwB;QACxB,MAAM,EACJ,+CAA+C,OAAO,CAAC,SAAS,uBAAuB,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC7H,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,OAAO,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,KAAK,aAAa;YAChB,OAAO,eAAe,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAQD,SAAS,EAAE;IACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AACD,SAAS,QAAQ,CAAC,SAAwB,IAAI;IAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,KAAqB,EAAE,QAAgB;IAC1D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,KAAK,aAAa;YAChB,OAAO,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAyB,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,CAAC;QACnE,OAAO,QAAQ,CAAC,yBAAyB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA4B,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAQ,EAAE;YAC3C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,KAA4B,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5G,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC;YAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/sandbox.d.ts

@@ -1,110 +1,70 @@
 /**
- * §21's execution boundary, real isolation half (the sandbox-isolation
- * lane, superseding the "sandbox platform is a separate architectural
- * decision, not built here" deferral). RT-070 and RT-193 gave this runtime
- * a *named* boundary (trusted-local, resource limits, privilege reporting)
- * but not an *isolating* one -- nothing stopped a spawned process from
- * reading any file the invoking user could read, or reaching any host the
- * invoking user's network could reach. This module closes that gap for
- * real, on Linux, for processes this runtime SPAWNS.
+ * §21's execution boundary, real isolation half. RT-070/RT-193 gave this runtime a
+ * *named* boundary (trusted-local, resource limits, privilege reporting) but not an
+ * *isolating* one -- nothing stopped a spawned process from reading any file, or
+ * reaching any host, the invoking user could. This module closes that gap for real,
+ * on Linux, for processes this runtime SPAWNS.
  *
- * **The architectural constraint this module does not try to solve
- * around:** isolation can only wrap a process Descry itself launches.
- * Attach-mode (`attach-to-running-process.ts`, `attach-to-running-node-
- * process.ts`, `attach-to-running-jvm-process.ts`) reaches a process that
- * was already running, unconfined, before Descry touched it -- there is no
- * honest way to retroactively contain it (ptrace-based interception was
- * investigated and rejected elsewhere in this repo as "not honestly
- * generalizable"). Spawn-mode gets real isolation via this module.
- * Attach-mode stays permanently and explicitly unsandboxed --
- * `SANDBOX_BOUNDARY_DISCLOSURE` in `execution-safety.ts` says so in-product,
- * and this module does not (and structurally cannot) change that.
+ * **Architectural constraint this module cannot solve around:** isolation can only
+ * wrap a process Descry itself launches. Attach-mode reaches a process already
+ * running, unconfined, before Descry touched it -- there is no honest way to
+ * retroactively contain it (ptrace-based interception was investigated and rejected
+ * elsewhere as not honestly generalizable). Attach-mode stays permanently and
+ * explicitly unsandboxed -- `SANDBOX_BOUNDARY_DISCLOSURE` in `execution-safety.ts`
+ * discloses this in-product; this module does not and structurally cannot change it.
  *
- * **Mechanism: bubblewrap (bwrap), not raw `unshare`/`clone`.** bwrap is
- * the unprivileged sandboxing helper behind Flatpak and used by many
- * developer tools directly -- a small (tens of KB), auditable, actively
- * maintained binary, not a bespoke native module this repo would need to
- * build and ship per-platform. It runs setuid-free on any kernel with
- * unprivileged user namespaces enabled (checked below, not assumed) and
- * gives one process a new mount namespace (real filesystem visibility
- * control) and network namespace (real network denial) in one exec,
- * composing cleanly with `applyResourceLimits`'s `prlimit` wrap and with
- * this package's existing process-group kill mechanism (`detached: true` +
- * `process.kill(-pid, …)`) -- verified directly: bwrap does not create a
- * new process group unless asked to, so the group-kill in
- * `process-manager.ts` reaches it and everything it started, unchanged.
- * The one dependency this buys: `bwrap` must be on `PATH`. Reported as a
- * capability, exactly like `prlimit` -- refused, never silently
- * unconstrained, when requested and absent.
+ * **Mechanism: bubblewrap (bwrap), not raw `unshare`/`clone`.** bwrap is the
+ * unprivileged sandboxing helper behind Flatpak -- small, auditable, actively
+ * maintained, not a bespoke native module this repo builds per-platform. Runs
+ * setuid-free on any kernel with unprivileged user namespaces enabled (checked
+ * below, never assumed) and gives one process a new mount namespace (real
+ * filesystem visibility control) and network namespace (real network denial) in one
+ * exec. Composes with `applyResourceLimits`'s `prlimit` wrap and with
+ * `process-manager.ts`'s process-group kill -- verified directly: bwrap does not
+ * create a new process group unless asked, so the existing group-kill reaches it
+ * unchanged. The one dependency this buys: `bwrap` must be on PATH, reported as a
+ * capability exactly like `prlimit` -- refused, never silently unconstrained, when
+ * requested and absent.
  *
- * **What this module does NOT attempt, and where that gap actually closes:**
- * a *native* macOS or Windows sandbox for this mechanism (`sandbox-exec`/
- * Seatbelt -- deprecated public API; the Endpoint Security Framework --
- * needs a special Apple entitlement this project does not have; Windows Job
- * Objects + restricted tokens/AppContainer + WFP network enforcement -- a
- * second and third bespoke native sandbox to build and maintain). That is
- * not "researched but not built here, someday" -- it is an explicit
- * architecture decision NOT to build native sandboxes for those two
- * platforms at all. `../container-sandbox.ts` closes the gap instead, by
- * routing macOS and Windows through a real Docker container that reuses
- * THIS module's own proven Linux mechanism underneath (Docker Desktop's
- * Linux VM on macOS, WSL2/Docker Desktop's Windows backend on Windows) --
- * see that module's own doc comment for exactly what is real-tested there
- * versus unverified on real macOS/Windows hardware. `filesystemIsolationCapability`/
- * `networkIsolationCapability` below still report `unavailable` with a
- * reason on non-Linux platforms -- this module never silently claims to
- * cover them; `container-sandbox.ts` is the module a non-Linux caller
- * actually wants.
+ * **NOT attempted, deliberately: a native macOS or Windows sandbox.** `sandbox-exec`/
+ * Seatbelt is deprecated with no public API replacement; the Endpoint Security
+ * Framework needs an Apple entitlement this project doesn't have; Windows Job
+ * Objects + AppContainer + WFP would be a second and third bespoke native sandbox.
+ * This is an explicit decision not to build native sandboxes for those platforms at
+ * all -- `../container-sandbox.ts` closes the gap instead, routing macOS/Windows
+ * through a real Docker container that reuses this module's proven Linux mechanism
+ * (see that module's doc for what's real-tested there vs unverified on real
+ * hardware). `filesystemIsolationCapability`/`networkIsolationCapability` below
+ * still report `unavailable` with a reason on non-Linux -- never silently claimed
+ * as covered.
  */
 import type { CapabilityStatus, FilesystemPolicy, NetworkPolicy } from "@descryy/runtime-contracts";
-/**
- * Real capability check, matching `resourceLimitCapability`'s own shape and
- * precedent exactly: existence on `PATH` first (fast, matches
- * `prlimit --version`'s pattern), then the one Linux-specific precondition
- * that existence alone doesn't prove -- unprivileged user namespaces
- * actually being usable, not just bwrap being installed.
- */
+/** Real capability check, same shape as `resourceLimitCapability`: PATH existence first, then the Linux-specific precondition existence alone doesn't prove -- unprivileged user namespaces actually usable, not just bwrap installed. */
 export declare function filesystemIsolationCapability(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): CapabilityStatus;
-/**
- * The same underlying mechanism as `filesystemIsolationCapability` --
- * bwrap building one namespace set covers both a restricted mount view and
- * a network namespace in the same exec -- so this delegates rather than
- * duplicating the check. Kept as its own named function because the two
- * policies are declared, refused, and reasoned about independently
- * (`NetworkPolicy` only supports one shape; see `unsupportedNetworkPolicyReason`),
- * even though today they share one mechanism underneath.
- */
+/** Same underlying mechanism as `filesystemIsolationCapability` (one bwrap namespace set covers both) -- delegates rather than duplicating. Kept as its own function because the two policies are declared and reasoned about independently. */
 export declare function networkIsolationCapability(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): CapabilityStatus;
 /**
- * `NetworkPolicy`'s general shape (arbitrary allow/deny host lists) is not
- * what this iteration's mechanism enforces -- only full denial. Returns the
- * reason a given policy cannot be applied, or `null` if it is the one
- * shape that can. Checked independently of `networkIsolationCapability`:
- * a policy can be shape-unsupported on a platform where the mechanism
- * itself is otherwise available, and the two refusals are different
- * claims ("nothing here can enforce any network policy" vs. "this specific
- * policy asks for something the real mechanism doesn't do yet").
+ * `NetworkPolicy`'s general shape (arbitrary allow/deny host lists) is not what
+ * this mechanism enforces -- only full denial. Returns the reason a policy can't be
+ * applied, or `null` if it's the one shape that can. Checked independently of
+ * `networkIsolationCapability`: "nothing here can enforce any policy" and "this
+ * specific policy asks for something not built yet" are different claims.
  */
 export declare function unsupportedNetworkPolicyReason(policy: NetworkPolicy): string | null;
 /**
  * Resolves the real, symlink-followed directory containing the executable
- * `command` would run as -- the one piece of host filesystem a sandboxed
- * process needs beyond the standard OS directories and whatever the caller
- * declared, and the one this function computes generically rather than by
- * naming a language: an interpreter installed outside `/usr` (nvm, rbenv,
- * pyenv, sdkman -- all common, all under a user's home directory) would
- * otherwise be invisible inside the sandbox no matter which language it
- * is, which is exactly the kind of per-language special case §IR-boundary
- * rules out. Returns `null` when `command` cannot be resolved (already
- * absolute-looking and missing, or not found on `PATH`) -- the caller
- * proceeds without an extra bind in that case; the exec itself will fail
- * inside the sandbox the same honest way it would outside one.
+ * `command` would run as -- the one extra host path a sandboxed process needs
+ * beyond standard OS dirs and whatever the caller declared. Computed generically,
+ * not per-language: an interpreter installed outside `/usr` (nvm, rbenv, pyenv,
+ * sdkman) would otherwise be invisible inside the sandbox regardless of language.
+ * Returns `null` when unresolvable -- the caller proceeds without an extra bind;
+ * the exec fails inside the sandbox the same honest way it would outside one.
  */
 export declare function resolveExecutableDirectory(command: string, cwd: string, env: NodeJS.ProcessEnv): string | null;
 export interface SandboxOptions {
-    /** The original, un-resource-limit-wrapped command (e.g. `"node"`) -- used only to resolve which extra directory the interpreter itself needs bound in. */
+    /** Original, un-resource-limit-wrapped command (e.g. "node") -- used only to resolve which extra directory the interpreter needs bound in. */
     readonly interpreterCommand: string;
-    /** The command to actually exec inside the sandbox -- already passed through `applyResourceLimits`, so this may be `"prlimit"` with the real command in `args`. */
+    /** Command to actually exec inside the sandbox -- already passed through `applyResourceLimits`, so may be "prlimit" with the real command in `args`. */
     readonly command: string;
     readonly args: readonly string[];
     readonly cwd: string;
@@ -114,23 +74,18 @@ export interface SandboxOptions {
     readonly platform?: NodeJS.Platform;
 }
 /**
- * Wraps `command`/`args` with `bwrap` so the OS enforces `filesystemPolicy`
- * and/or `networkPolicy`. Neither declared returns `command`/`args`
- * unchanged -- every execution before this lane keeps behaving exactly as
- * before unless it opts in, the same non-regression contract
- * `applyResourceLimits` already established for resource limits.
+ * Wraps `command`/`args` with `bwrap` so the OS enforces `filesystemPolicy`/
+ * `networkPolicy`. Neither declared returns them unchanged -- same non-regression
+ * contract as `applyResourceLimits`.
  *
- * **Throws rather than silently spawning unconstrained** -- same
- * `tokenizeCommand`/`applyResourceLimits` precedent -- when a policy is
- * requested and the real mechanism cannot back it, whether because the
- * platform has no mechanism at all or because the declared shape is one
- * this mechanism doesn't implement (`unsupportedNetworkPolicyReason`).
+ * **Throws rather than silently spawning unconstrained** when a policy is
+ * requested and the real mechanism can't back it -- no mechanism on this platform,
+ * or a declared shape this mechanism doesn't implement.
  *
- * Composes with `applyResourceLimits`: this function wraps *outside* it
- * (`bwrap … -- prlimit … -- realCommand`), because the mount namespace must
- * exist before `prlimit` or the real command run inside it, and `prlimit`
- * itself (in `/usr/bin`) is reachable through the same base OS binding
- * every sandboxed process gets.
+ * Composes with `applyResourceLimits` by wrapping *outside* it (`bwrap … --
+ * prlimit … -- realCommand`) -- the mount namespace must exist before `prlimit` or
+ * the real command run inside it; `prlimit` (in `/usr/bin`) is reachable through
+ * the same base OS binding every sandboxed process gets.
  */
 export declare function applySandbox(options: SandboxOptions): {
     readonly command: string;

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AA+BpG;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,gBAAgB,CAoBlJ;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,gBAAgB,CAE/I;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAOnF;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAwB9G;AAED,MAAM,WAAW,cAAc;IAC7B,2JAA2J;IAC3J,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,mKAAmK;IACnK,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAmFpH"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAkCpG,0OAA0O;AAC1O,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,gBAAgB,CAoBlJ;AAED,gPAAgP;AAChP,wBAAgB,0BAA0B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,gBAAgB,CAE/I;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAOnF;AAOD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAwB9G;AAED,MAAM,WAAW,cAAc;IAC7B,8IAA8I;IAC9I,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,wJAAwJ;IACxJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAkFpH"}