@descryy/runtime-controller 0.2.1 → 0.3.0

package/dist/container-sandbox.js

@@ -1,111 +1,58 @@
 /**
- * §21's execution boundary, container backend -- the macOS/Windows half of
- * the sandbox-isolation lane. `sandbox.ts` closed this gap for Linux via
- * bubblewrap; this module closes it for macOS and Windows, but NOT by
- * building a second and third native OS sandbox. That path was researched
- * (`sandbox.ts`'s own original module doc named `sandbox-exec`/Seatbelt on
- * macOS and Job Objects/AppContainer on Windows as candidates) and
- * explicitly rejected as an architecture decision: `sandbox-exec` is
- * deprecated (no public API replacement), the Endpoint Security Framework
- * needs a special Apple entitlement this project does not have, and
- * hand-building Job Objects + AppContainer + WFP network enforcement on
- * Windows is a second and third bespoke native sandbox to build and
- * maintain for the same problem already solved once.
+ * §21's execution boundary, container backend -- the macOS/Windows half of the
+ * sandbox-isolation lane (`sandbox.ts` covers Linux via bubblewrap).
  *
- * **Mechanism: route the spawned process through a real container instead.**
- * This runtime's actual targets -- JVM/Spring, Node, Python backends -- are
- * already containerizable, so this reuses the *Linux* sandbox mechanism
- * bwrap already proved, by running the target process inside a `docker run`
- * invocation. The container's own rootfs IS the "outside allowedRoots is
- * unreachable" boundary; nothing inside the container needs bwrap. On
- * macOS, `docker run` targets Docker Desktop's Linux VM; on Windows, WSL2 /
- * Docker Desktop's Windows backend. Both ultimately run the same Linux
- * container runtime this module already drives directly.
+ * **Not a second native sandbox.** `sandbox-exec`/Seatbelt (macOS) and Job
+ * Objects/AppContainer/WFP (Windows) were researched and rejected: `sandbox-exec` is
+ * deprecated with no public API replacement, Endpoint Security needs an Apple
+ * entitlement this project doesn't have, and hand-building Windows equivalents is a
+ * second and third bespoke sandbox for a problem already solved once.
  *
- * **What was actually verified, and what was not -- stated precisely,
- * matching `sandbox.ts`'s own "researched and disclosed rather than
- * guessed" discipline:**
+ * **Mechanism: route the spawned process through a real container instead**, via
+ * `docker run` (Docker Desktop's Linux VM on macOS, WSL2/Docker Desktop on Windows).
+ * The container's own rootfs is the isolation boundary; no bwrap needed inside it.
  *
- * REAL-TESTED, on this Linux development machine, via a real installed
- * Docker daemon (server 29.6.1) and real `docker run` invocations -- not
- * mocked, not asserted from documentation: a file outside a container's
- * bind-mounts is genuinely unreachable (`ENOENT` from inside the running
- * container); a network call under `--network none` is genuinely refused
- * against a real host listener; both together on one spawn; the same
- * boundary through the full `ExecutionController.run()` path, not just this
- * module's own function called directly. See `container-sandbox.test.ts`
- * and `controller.test.ts`'s container-backend end-to-end test.
+ * **Verified for real** (Linux dev machine, real Docker daemon 29.6.1, not mocked):
+ * a file outside bind-mounts is unreachable (`ENOENT`); a network call under
+ * `--network none` is refused against a real listener; both together, through the
+ * full `ExecutionController.run()` path. See `container-sandbox.test.ts`,
+ * `controller.test.ts`'s container-backend e2e test.
  *
- * **IMPLEMENTATION-NOT-DONE, not a "gap" and not a coverage caveat: the
- * macOS-Docker-Desktop-VM-specific and Windows-WSL2-specific integration
- * paths are UNVERIFIED on real macOS/Windows hardware.** No such hardware
- * is available in this environment. Concretely unverified: detecting
- * whether Docker Desktop is actually running before attempting a spawn;
- * path translation across the Docker Desktop VM boundary on macOS; WSL2
- * path translation on Windows (a Windows host path and the path Linux
- * containers see are not the same string). This module's bind-mount
- * strategy assumes the host path and the in-container path are identical
- * (`-v hostPath:hostPath`, mirroring `sandbox.ts`'s own `--bind root root`
- * convention) -- true on Linux, true for Docker Desktop's Linux VM when the
- * path is already inside the VM's shared-drive mapping, but the exact
- * translation rules for an arbitrary Windows path are not exercised here at
- * all. This is "the container mechanism exists and is tested where it can
- * be, but full cross-platform verification needs hardware nobody here has"
- * -- a distinct category from a real bug or an intentionally out-of-scope
- * capability, and this module does not claim otherwise.
+ * **UNVERIFIED on real macOS/Windows hardware** (none available here): Docker
+ * Desktop running-detection before spawn, path translation across the Docker
+ * Desktop VM boundary (macOS) and WSL2 (Windows) -- this module's bind-mount assumes
+ * host path == in-container path (`-v hostPath:hostPath`), true on Linux and for
+ * Docker Desktop's Linux VM when already inside its shared-drive mapping, untested
+ * for an arbitrary Windows path. Mechanism exists and is tested where it can be;
+ * cross-platform verification needs hardware nobody here has -- not a bug, not
+ * claimed otherwise.
  *
- * **Explicit scope boundary, same treatment attach-mode already gets in
- * this codebase:** a target that cannot run containerized at all --deep
- * native OS integration, GUI-dependent processes, OS-specific native
- * dependencies that don't exist inside a Linux container image-- is out of
- * scope for this approach, on any platform. There is no fallback to a
- * native sandbox for such a target; it is simply not isolatable by this
- * mechanism, and that is disclosed rather than silently unsupported.
+ * **Scope boundary** (same treatment as attach-mode elsewhere): a target that can't
+ * run containerized at all (deep native OS integration, GUI, native deps absent
+ * from a Linux image) is out of scope on any platform, with no native-sandbox
+ * fallback -- disclosed, not silently unsupported.
  *
- * **Real escape testing on the container boundary is still required and
- * was done** -- "the container starts successfully" is not treated as
- * sufficient evidence here, the same bar `sandbox.ts`'s bwrap path was held
- * to. A mutation check on the first version of that testing (temporarily
- * removing `--network none`, rerunning) surfaced a genuine behavioral
- * difference from bwrap worth stating precisely rather than glossing over:
- * **Docker gives every container its own network namespace by default,
- * with or without `--network none`** -- unlike bwrap, which shares the
- * host's network unless `networkPolicy` is declared. A containerized
- * process can therefore never reach the HOST's own loopback either way
- * (that alone is not evidence `--network none` specifically did anything),
- * but it CAN still reach the public internet via Docker's default bridge
- * NAT when no `networkPolicy` is declared -- only `--network none`
- * additionally blocks that. `container-sandbox.test.ts`'s dedicated
- * mutation-sensitive test isolates exactly this variable (an external
- * host, not the host's own loopback) to prove the flag itself is what is
- * being tested, not mere containerization.
+ * **Measured Docker/bwrap difference** (found via a mutation check removing
+ * `--network none` and rerunning): Docker gives every container its own network
+ * namespace regardless of `--network none` -- unlike bwrap, which shares the host's
+ * network unless `networkPolicy` is declared. So a container can never reach the
+ * HOST's loopback either way, but it CAN still reach the public internet via
+ * Docker's default bridge NAT unless `--network none` is set. The dedicated
+ * mutation-sensitive test in `container-sandbox.test.ts` checks reachability to an
+ * external host (not loopback) to isolate exactly this.
  *
- * **What this module does NOT attempt to solve, disclosed rather than
- * silently dropped:** composition with `ResourceLimits` (`prlimit`) --
- * `sandbox.ts` composes bwrap with `applyResourceLimits` by wrapping
- * outside it; this module does not attempt the equivalent composition with
- * Docker's own `--memory`/`--cpus`/`--pids-limit` flags in this pass. A
- * `resourceLimits`-declared execution routed through the container backend
- * runs without OS-enforced resource limits inside the container. Selective
- * network allow-/deny-listing (`NetworkPolicy` shapes other than full
- * denial) is unimplemented here for the same reason `sandbox.ts` doesn't
- * implement it: it needs DNS interception and IP filtering this iteration
- * does not build -- `unsupportedContainerNetworkPolicyReason` reports this
- * the same way `sandbox.ts`'s own `unsupportedNetworkPolicyReason` does,
- * deliberately matching posture rather than silently claiming broader
- * support than the underlying mechanism has.
+ * **Not solved here, disclosed:** `ResourceLimits` composition -- `sandbox.ts` wraps
+ * bwrap with `applyResourceLimits`; this module does not wrap Docker's
+ * `--memory`/`--cpus`/`--pids-limit` equivalents, so a `resourceLimits`-declared
+ * execution on this backend runs unlimited inside the container. Selective network
+ * allow/deny-listing is unimplemented for the same reason as `sandbox.ts` (needs DNS
+ * interception + IP filtering) -- `unsupportedContainerNetworkPolicyReason` reports
+ * it the same way, matching posture rather than overclaiming.
  */
 import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { basename } from "node:path";
-/**
- * Real capability check: is a working Docker CLI + reachable daemon
- * actually present, not merely "does a `docker` binary exist on PATH."
- * `docker version` talks to the daemon; a CLI with no running daemon behind
- * it (Docker Desktop not started, dockerd not running) fails this the same
- * way a missing binary does -- both are "cannot enforce," and the caller
- * does not need to tell them apart to make the right decision (refuse).
- */
+/** Real check: working Docker CLI + reachable daemon, not just a `docker` binary on PATH. `docker version` talks to the daemon, so a CLI with no daemon running fails the same way a missing binary does -- both mean "cannot enforce." */
 export function containerRuntimeCapability(env = process.env) {
     try {
         execFileSync("docker", ["version", "--format", "{{.Server.Version}}"], { env, stdio: "ignore" });
@@ -118,26 +65,16 @@ export function containerRuntimeCapability(env = process.env) {
     }
     return { availability: "available", reason: null };
 }
-/**
- * Mirrors `sandbox.ts`'s `filesystemIsolationCapability`/
- * `networkIsolationCapability` split: one real mechanism underneath
- * (a container boundary), two named capabilities because the two policies
- * are declared, refused, and reasoned about independently at the call
- * site.
- */
+// Mirrors sandbox.ts's filesystem/network capability split: one real mechanism
+// (container boundary), two named capabilities since the policies are declared
+// and reasoned about independently.
 export function containerFilesystemIsolationCapability(env = process.env) {
     return containerRuntimeCapability(env);
 }
 export function containerNetworkIsolationCapability(env = process.env) {
     return containerRuntimeCapability(env);
 }
-/**
- * Same posture as `sandbox.ts`'s `unsupportedNetworkPolicyReason`, matched
- * deliberately rather than reinvented: only full denial
- * (`{ mode: "allow", hosts: [] }`, `docker run --network none`) is
- * enforced. A shape bwrap already discloses as unsupported is not silently
- * claimed as supported here just because the underlying mechanism changed.
- */
+/** Same posture as `sandbox.ts`'s `unsupportedNetworkPolicyReason`: only full denial (`--network none`) is enforced. A shape bwrap discloses as unsupported isn't silently claimed here just because the mechanism changed. */
 export function unsupportedContainerNetworkPolicyReason(policy) {
     if (policy.mode === "allow" && policy.hosts.length === 0)
         return null;
@@ -145,15 +82,9 @@ export function unsupportedContainerNetworkPolicyReason(policy) {
         "hosts would need a custom docker network with DNS interception and IP filtering inside it, not built in this " +
         "iteration (the same posture the bwrap backend already declares for the same shapes)");
 }
-/**
- * Minimal, official, `-slim`/`-jre` base images for this runtime's actual
- * fixture targets (JVM/Spring, Node, Python backends -- see
- * `packages/orchestrator/test/fixtures`), keyed by the interpreter's
- * basename so a full interpreter path (`/home/x/.nvm/versions/node/vX/bin/node`)
- * still resolves. Not a general-purpose image registry -- a caller with a
- * different runtime need passes `containerImage` explicitly instead of
- * extending this table with more special cases.
- */
+// Minimal official -slim/-jre images for this runtime's fixture targets, keyed by
+// interpreter basename so a full path still resolves. Not a general registry --
+// other runtimes pass `containerImage` explicitly instead of extending this table.
 const KNOWN_RUNTIME_IMAGES = {
     node: "node:22-slim",
     python: "python:3.12-slim",
@@ -164,32 +95,20 @@ export function resolveContainerImage(interpreterCommand) {
     return KNOWN_RUNTIME_IMAGES[basename(interpreterCommand)] ?? null;
 }
 /**
- * Wraps `command`/`args` with `docker run` so a real container boundary
- * enforces `filesystemPolicy`/`networkPolicy`. Neither declared returns
- * `command`/`args` unchanged and never invokes docker at all -- the same
- * non-regression contract `sandbox.ts`'s `applySandbox` established for
- * bwrap, applied here too: a caller who never opts into a policy is
- * completely unaffected by this module's existence.
+ * Wraps `command`/`args` with `docker run` so a container boundary enforces
+ * `filesystemPolicy`/`networkPolicy`. Neither declared returns them unchanged and
+ * never invokes docker -- same non-regression contract as `sandbox.ts`'s
+ * `applySandbox`.
  *
- * **Throws rather than silently spawning unconstrained** when a policy is
- * requested and cannot actually be backed -- no working Docker, or a
- * `networkPolicy` shape this mechanism doesn't implement -- matching
- * `applySandbox`'s own refuse-rather-than-guess precedent exactly.
+ * **Throws rather than silently spawning unconstrained** when a policy can't
+ * actually be backed (no working Docker, unimplemented `networkPolicy` shape).
  *
- * **Returns a real, unique `containerName` whenever it wraps.** This was
- * added after a genuine finding from this module's own real escape tests,
- * not assumed up front: `process-manager.ts`'s existing group-kill
- * (`process.kill(-pid, signal)`) targets the *local* `docker` CLI process's
- * group -- exactly right for bwrap, which execs the sandboxed process
- * directly and never creates a second process group. Docker is different:
- * the container runs under `dockerd`, not as a child of the local `docker`
- * CLI, so killing the CLI's process group does not reliably stop the
- * container -- observed directly (a `kill()` call left a real orphaned
- * `node:22-slim` container running after both the CLI process and its
- * grace period were gone). `containerName` lets the caller
- * (`process-manager.ts`) issue a real, explicit `docker stop <name>`
- * against the container itself as the actual mechanism, not the CLI
- * process, for the container backend.
+ * **Returns a real, unique `containerName` whenever it wraps.** Found via real
+ * escape testing: `process-manager.ts`'s group-kill targets the local `docker` CLI
+ * process's group, which is right for bwrap but not Docker -- the container runs
+ * under `dockerd`, not as the CLI's child, so killing the CLI's group left an
+ * orphaned `node:22-slim` container running in testing. `containerName` lets the
+ * caller issue an explicit `docker stop <name>` against the container itself.
  */
 export function applyContainerSandbox(options) {
     const { filesystemPolicy, networkPolicy } = options;

package/dist/container-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-sandbox.js","sourceRoot":"","sources":["../src/container-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,wIAAwI;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,sHAAsH;QACtH,+GAA+G;QAC/G,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,kBAAkB;IAC3B,IAAI,EAAE,wBAAwB;CAC/B,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+EAA+E,OAAO,CAAC,kBAAkB,qCAAqC,CAC/I,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"container-sandbox.js","sourceRoot":"","sources":["../src/container-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,2OAA2O;AAC3O,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,wIAAwI;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,UAAU,sCAAsC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+NAA+N;AAC/N,MAAM,UAAU,uCAAuC,CAAC,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,sHAAsH;QACtH,+GAA+G;QAC/G,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,oBAAoB,GAAqC;IAC7D,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,kBAAkB;IAC3B,IAAI,EAAE,wBAAwB;CAC/B,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+EAA+E,OAAO,CAAC,kBAAkB,qCAAqC,CAC/I,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAChE,CAAC"}

package/dist/controller.d.ts

@@ -1,11 +1,8 @@
 /**
- * Runtime controller (plan §4, §5, §6; plan §45's "Core" bucket: runtime
- * controller, execution IDs, process lifecycle, readiness, timeout
- * handling, cleanup, configuration). Owns Execution lifecycle, spawns every
- * service declared in configuration, waits for each one's real readiness
- * (never "process exists"), and guarantees cleanup — including on partial
- * or total failure and on timeout. Builds no collectors and knows nothing
- * about any specific language or framework (plan principle 8).
+ * Runtime controller (§4/§5/§6/§45 "Core"). Owns Execution lifecycle, spawns every
+ * configured service, waits for each one's real readiness (never "process exists"),
+ * guarantees cleanup on partial/total failure and timeout. Knows nothing about any
+ * specific language or framework (principle 8).
  */
 import { type Execution, type ProcessHandle } from "@descryy/runtime-contracts";
 import { type ReadinessCheck, type ReadinessResult } from "./readiness.ts";
@@ -23,17 +20,13 @@ export interface ServiceReadinessSpec {
     readonly timeoutMs: number;
 }
 export interface RunOptions {
-    /** One entry required per key in `configuration.services` — RT-032 refuses rather than default a missing one to "spawn success is enough" (RT-024's own rule, applied per service). */
+    /** One entry required per key in `configuration.services` -- refuses rather than defaulting a missing one to "spawn success is enough" (RT-024/RT-032). */
     readonly readiness: Readonly<Record<string, ServiceReadinessSpec>>;
     /**
-     * Optional live observer for `ProcessLifecycleEvent`. Called synchronously
-     * at each transition, in order, for the lifetime of this execution
-     * (including after `run()` itself has returned, for a service that exits
-     * later). A throwing observer is not caught here — the same "must not
-     * hang, may not silently swallow its own failure" discipline `Collector`
-     * already imposes on every callback shape in this repo; a caller wiring a
-     * `ProcessCollector`'s emit path in here that itself throws deserves to
-     * see that, not have it disappear into a promise this module owns.
+     * Optional live observer for `ProcessLifecycleEvent`, called synchronously at each
+     * transition for the lifetime of this execution (including after `run()` returns).
+     * A throwing observer is not caught here -- same "must not hang, may not silently
+     * swallow its own failure" discipline `Collector` imposes on every callback here.
      */
     readonly onProcessLifecycleEvent?: (event: ProcessLifecycleEvent) => void;
 }
@@ -41,31 +34,20 @@ export interface ServiceStartResult {
     readonly serviceName: string;
     readonly stage: "spawn" | "readiness" | "not-attempted";
     readonly succeeded: boolean;
-    /** Set when `stage === "readiness"`. RT-024/RT-031 apply to each entry independently — N of these is N liveness claims about N addresses, never a joint identity proof. */
+    /** Set when `stage === "readiness"`. RT-024/RT-031 apply per entry -- N of these is N liveness claims, never a joint identity proof. */
     readonly readiness: ReadinessResult | null;
     /** Set when `stage === "spawn"` and spawning itself threw. */
     readonly error: string | null;
 }
 /**
- * Fires at the exact moments `run()` itself observes a service's process
- * lifecycle — spawned, readiness settled (either way), reaped. This is a
- * pure notification channel: `ExecutionController` stays exactly as
- * ignorant of Evidence/Collector as its own module doc already claims
- * ("knows nothing about any specific language or framework") — nothing
- * here decides whether a lifecycle transition becomes Evidence, only that
- * a caller who wants to know *when* one happened, live, has a way to ask
- * that isn't "reconstruct it later from `Execution.processes`."
+ * Fires at the exact moments `run()` observes a service's lifecycle -- spawned,
+ * readiness settled either way, reaped. A pure notification channel; nothing here
+ * decides whether a transition becomes Evidence.
  *
- * That reconstruction is precisely what doesn't work for the case this
- * exists to make observable: `Execution.processes` and
- * `ServiceStartResults` are only complete once `run()` has already
- * returned, but a service that is spawned, then *running* (READY reached),
- * has not exited yet at that point — its own eventual `process-exited`
- * event lies in the future relative to `run()` resolving. A consumer that
- * only reads the final `Execution` after `run()` settles can see "started"
- * and "ready" (or "ready-failed") for every service, but can never see
- * "exited" for one still healthy when `run()` returned — only this live
- * channel can.
+ * Needed because `Execution.processes`/`ServiceStartResults` are only complete once
+ * `run()` returns, but a service still running when `run()` resolves hasn't exited
+ * yet -- its eventual `process-exited` lies in the future. Only this live channel
+ * can observe that exit; reading the final `Execution` later cannot.
  */
 export type ProcessLifecycleEvent = {
     readonly kind: "process-started";
@@ -83,19 +65,11 @@ export type ProcessLifecycleEvent = {
     readonly readiness: ReadinessResult;
 }
 /**
- * `phase` distinguishes "this service's own readiness had not yet
- * succeeded when it exited" (`"starting"`) from "it had already reached
- * READY at least once" (`"running"`) — the process-level echo of
- * `FAILED_START` vs `FAILED` on `ExecutionState` itself (§30). Without
- * it, `PROCESS_EXITED` alone cannot tell "crashed on boot" from
- * "finished/was stopped after running successfully," which collapses
- * exactly the distinction the execution lifecycle already exists to
- * carry. Computed from THIS service's own readiness history, not from
- * `Execution.state` at the moment of exit — a crash mid-readiness-poll
- * fires before `run()` has itself observed the failure and moved the
- * execution to `FAILED_START`, so reading execution state at exit time
- * would misreport `"starting"` as whatever the execution's not-yet-
- * updated state still says.
+ * `phase` distinguishes "readiness hadn't yet succeeded when it exited"
+ * (`"starting"`) from "had already reached READY" (`"running"`) -- the
+ * process-level echo of `FAILED_START` vs `FAILED` (§30). Computed from this
+ * service's own readiness history, not `Execution.state` at exit time -- a crash
+ * mid-readiness-poll fires before the execution's own state has caught up.
  */
  | {
     readonly kind: "process-exited";
@@ -103,82 +77,51 @@ export type ProcessLifecycleEvent = {
     readonly handle: ProcessHandle;
     readonly phase: "starting" | "running";
 };
-/**
- * `run()`'s timeout timer and a caller's `stop()`/`cancel()` can both
- * attempt to move a finishing execution to a terminal state at nearly the
- * same instant. Every transition attempted after an `await` goes through
- * `#tryTransition` (returns false instead of throwing) rather than the
- * throwing `#transition`, so whichever path loses the race degrades to a
- * no-op instead of an unhandled rejection from a fire-and-forget timer
- * callback.
- */
 export declare class ExecutionController {
     #private;
     private constructor();
     static create(input: CreateExecutionInput): ExecutionController;
     get execution(): Execution;
-    /** One entry per service configured, in spawn order — including services never attempted because an earlier one failed (`stage: "not-attempted"`). Empty before `run()` returns its first result. */
+    /** One entry per configured service, in spawn order, including never-attempted ones (`stage: "not-attempted"`). Empty until `run()` returns its first result. */
     get serviceStartResults(): readonly ServiceStartResult[];
-    /** Non-null only when `run()` refused before spawning anything — a bad `dependsOn` reference, a cycle, an undeclared placeholder dependency, or a service with no matching `RunOptions.readiness` entry. */
+    /** Non-null only when `run()` refused before spawning anything. */
     get validationError(): string | null;
     /** Combined stdout+stderr of the named service's process so far, or "" if it was never spawned. */
     readProcessOutput(serviceName: string): string;
     /**
-     * Starts every service in `configuration.services`, in the dependency
-     * order `validateServicesConfiguration` computes — spawned, each on its
-     * own ephemeral port unless it opts into a fixed one, or attached to
-     * (`service.attach`, `attachManagedProcess`) when it names an already-
-     * running pid/log file instead of a `command`. Reaches RUNNING only if
-     * every service starts and reaches its own readiness. On the first
-     * failure (spawn/attach throw, or readiness never succeeding), every
-     * already-started service is killed in reverse order (a no-op for an
-     * attached one — see `attachManagedProcess`'s own doc) and every
-     * not-yet-attempted service is recorded as such — a caller can always
-     * tell "never tried" from "tried and failed" via `serviceStartResults`.
+     * Starts every service in dependency order, spawned (each on its own ephemeral
+     * port unless fixed) or attached (`service.attach`, for an already-running
+     * pid/log file). Reaches RUNNING only if every service starts and reaches
+     * readiness. On first failure, every started service is killed in reverse order
+     * (no-op for attached ones) and remaining services are recorded "not-attempted" --
+     * `serviceStartResults` always distinguishes "never tried" from "tried and failed".
      *
-     * Configuration itself is validated first, atomically: a bad `dependsOn`
-     * reference, a cycle, an undeclared placeholder dependency, a service
-     * declaring neither or both of `command`/`attach`, or a missing
-     * `RunOptions.readiness` entry refuses before anything is spawned, never
-     * discovered mid-sequence with other services already running.
+     * Configuration is validated atomically first -- a bad `dependsOn`, a cycle, an
+     * undeclared placeholder, ambiguous `command`/`attach`, or a missing readiness
+     * entry refuses before anything spawns.
      *
-     * Every **spawned** service receives `PORT` (its own resolved port,
-     * ephemeral or fixed) in its environment unconditionally, on top of
-     * `service.env` — a service has no other way to learn the port RT-024
-     * chose for it. This is a real, load-bearing convention (matches
-     * `broken-invoices`'s fixture apps), not an implementation detail: a
-     * `ServiceConfiguration` whose command reads its listen port from
-     * anywhere other than `PORT` will not be reachable through readiness
-     * checks built from the same `port` this function resolves. An
-     * **attached** service receives no env and no port allocation — it is
-     * already running on whatever port it bound at its own launch, and
-     * `service.port` (when the caller supplies it) is a declaration of that
-     * fact, not a request this function can act on.
+     * Every **spawned** service gets `PORT` (its resolved port) unconditionally --
+     * load-bearing (matches the fixture apps), not incidental: a command reading its
+     * port from anywhere else won't be reachable via readiness checks built from the
+     * same `port`. An **attached** service gets no env/port allocation -- it's already
+     * running on whatever it bound at launch.
      */
     run(options: RunOptions): Promise<Execution>;
     stop(): Promise<Execution>;
     /**
-     * Stop everything and record the run as `TIMED_OUT` — the same transition
-     * `#onTimeout` makes, available to a caller that knows the budget expired
-     * before this controller's own timer got round to saying so.
-     *
-     * **Why a caller needs this, and why `stop()` is wrong for the case.**
-     * `ExecutionConfiguration.timeoutMs` is a whole-execution budget, and the
-     * orchestrator clamps its observation window to whatever the budget has left.
-     * That clamp made `TIMED_OUT` a race: the window ends at the deadline, the
-     * timer fires a hair later, and whichever of `#onTimeout` and `stop()` gets
-     * there first decides what the run *says* happened. Measured: the same case
-     * reported `TIMED_OUT` at 1534ms and `COMPLETED` at 1515ms.
+     * Stop everything and record `TIMED_OUT` -- same transition `#onTimeout` makes,
+     * for a caller that knows the budget expired before the internal timer noticed.
      *
-     * `execution.state` is what `descry-core`'s `observe_runtime` reads to choose
-     * between `ok` and `timed_out`, so losing that race turns a disclosed
-     * degradation into a silent one — a run that returns on time and says nothing
-     * was cut short, which is worse than the overrun it replaced. A caller that
-     * has already decided it truncated the run should not have to win a race to
-     * report it.
+     * **Why not `stop()`:** the orchestrator clamps its observation window to
+     * whatever's left of `timeoutMs`, making `TIMED_OUT` a race between `#onTimeout`
+     * and `stop()` at the deadline -- measured: the same case reported `TIMED_OUT` at
+     * 1534ms and `COMPLETED` at 1515ms. `execution.state` is what `observe_runtime`
+     * reads to choose `ok` vs `timed_out`, so losing that race silently hides a real
+     * cutoff. A caller that already decided it truncated the run shouldn't have to
+     * win a race to report it.
      *
-     * Idempotent and terminal-safe, exactly like `cancel()`: if the timer did fire
-     * first, this returns the execution the timer already finished.
+     * Idempotent and terminal-safe like `cancel()`: if the timer fired first, returns
+     * the execution it already finished.
      */
     timeout(): Promise<Execution>;
     cancel(): Promise<Execution>;

package/dist/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAW3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,cAAc,EAAE,CAAC;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,uLAAuL;IACvL,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,2KAA2K;IAC3K,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACrI;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC9I;;;;;;;;;;;;;;GAcG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAE9I;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;;IAO9B,OAAO;IAIP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,mBAAmB;IAsB/D,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,qMAAqM;IACrM,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,4MAA4M;IAC5M,IAAI,eAAe,IAAI,MAAM,GAAG,IAAI,CAEnC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IA2B9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IA2Q5C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAWhC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;IAS7B,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;CA6CnC"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAW3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,cAAc,EAAE,CAAC;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,2JAA2J;IAC3J,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACrI;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC9I;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9I,qBAAa,mBAAmB;;IAO9B,OAAO;IAIP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,mBAAmB;IAsB/D,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,iKAAiK;IACjK,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,mEAAmE;IACnE,IAAI,eAAe,IAAI,MAAM,GAAG,IAAI,CAEnC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IA2B9C;;;;;;;;;;;;;;;;;OAiBG;IACG,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IA+O5C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAWhC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;IAS7B,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;CA6CnC"}