@descryy/runtime-controller 0.3.7 → 0.3.8

package/dist/controller.js

@@ -1,449 +0,0 @@
-/**
- * Runtime controller (§4/§5/§6/§45 "Core"). Owns Execution lifecycle, spawns every
- * configured service, waits for each one's real readiness (never "process exists"),
- * guarantees cleanup on partial/total failure and timeout. Knows nothing about any
- * specific language or framework (principle 8).
- */
-import { randomUUID } from "node:crypto";
-import { isTerminalExecutionState, isValidExecutionTransition, } from "@descryy/runtime-contracts";
-import { spawnProcess, attachManagedProcess, allocateEphemeralPort } from "./process-manager.js";
-import { awaitReadiness, createProcessOutputReader } from "./readiness.js";
-import { withDefaultProcessEnv } from "./env.js";
-import { validateServicesConfiguration, substitutePortPlaceholders, tokenizeCommand } from "./orchestration.js";
-import { resourceLimitCapability, networkPolicyCapability } from "./execution-safety.js";
-import { filesystemIsolationCapability, unsupportedNetworkPolicyReason } from "./sandbox.js";
-import { containerFilesystemIsolationCapability, containerNetworkIsolationCapability, unsupportedContainerNetworkPolicyReason, } from "./container-sandbox.js";
-import { captureEnvironmentMetadata } from "./environment-metadata.js";
-/**
- * RT-024: binds every `tcp-port`/`http` check this controller runs to the
- * pid of the process it just spawned or attached to, unless the caller
- * already declared one. Applied automatically so a caller does not have to
- * opt in per check to get the stronger guarantee — see `readiness.ts`'s
- * `identityCheckedConnection` for what happens with it.
- *
- * **Not applied for `sandboxBackend: "container"`.** A published Docker port
- * is commonly fronted by a host-side `docker-proxy` process, not the pid
- * this function would bind to — auto-injecting there would produce a false
- * `"mismatch"` refusal against a perfectly healthy container. Disclosed as
- * `identity: "unverified"` for that backend instead of a wrong verdict.
- */
-function bindChecksToProcessIdentity(checks, pid, sandboxBackend) {
-    if (pid === null || sandboxBackend === "container")
-        return checks;
-    return checks.map((check) => {
-        if ((check.kind === "tcp-port" || check.kind === "http") && check.expectedPid === undefined) {
-            return { ...check, expectedPid: pid };
-        }
-        return check;
-    });
-}
-// `run()`'s timeout timer and a caller's stop()/cancel() can race to move a
-// finishing execution to a terminal state. Every transition after an `await` uses
-// `#tryTransition` (returns false) rather than the throwing `#transition`, so the
-// losing path degrades to a no-op instead of an unhandled rejection.
-export class ExecutionController {
-    #execution;
-    #processes = new Map();
-    #timeoutHandle = null;
-    #serviceStartResults = [];
-    #validationError = null;
-    constructor(execution) {
-        this.#execution = execution;
-    }
-    static create(input) {
-        const execution = {
-            executionId: randomUUID(),
-            application: input.application,
-            repository: input.repository,
-            commit: input.commit,
-            environmentMetadata: null,
-            configuration: input.configuration,
-            state: "CREATED",
-            startedAt: null,
-            endedAt: null,
-            processes: [],
-            browserSessions: [],
-            eventIds: [],
-            traceIds: [],
-            failureIds: [],
-            correlationIds: [],
-            findingIds: [],
-        };
-        return new ExecutionController(execution);
-    }
-    get execution() {
-        return this.#execution;
-    }
-    /** One entry per configured service, in spawn order, including never-attempted ones (`stage: "not-attempted"`). Empty until `run()` returns its first result. */
-    get serviceStartResults() {
-        return this.#serviceStartResults;
-    }
-    /** Non-null only when `run()` refused before spawning anything. */
-    get validationError() {
-        return this.#validationError;
-    }
-    /** Combined stdout+stderr of the named service's process so far, or "" if it was never spawned. */
-    readProcessOutput(serviceName) {
-        return this.#processes.get(serviceName)?.readOutput() ?? "";
-    }
-    #transition(to) {
-        if (!isValidExecutionTransition(this.#execution.state, to)) {
-            throw new Error(`invalid execution transition: ${this.#execution.state} -> ${to}`);
-        }
-        this.#execution = { ...this.#execution, state: to };
-    }
-    #tryTransition(to) {
-        if (!isValidExecutionTransition(this.#execution.state, to)) {
-            return false;
-        }
-        this.#transition(to);
-        return true;
-    }
-    #recordProcesses() {
-        const handles = [];
-        for (const managed of this.#processes.values()) {
-            handles.push(managed.handle());
-        }
-        this.#execution = { ...this.#execution, processes: handles };
-    }
-    /**
-     * Starts every service in dependency order, spawned (each on its own ephemeral
-     * port unless fixed) or attached (`service.attach`, for an already-running
-     * pid/log file). Reaches RUNNING only if every service starts and reaches
-     * readiness. On first failure, every started service is killed in reverse order
-     * (no-op for attached ones) and remaining services are recorded "not-attempted" --
-     * `serviceStartResults` always distinguishes "never tried" from "tried and failed".
-     *
-     * Configuration is validated atomically first -- a bad `dependsOn`, a cycle, an
-     * undeclared placeholder, ambiguous `command`/`attach`, or a missing readiness
-     * entry refuses before anything spawns.
-     *
-     * Every **spawned** service gets `PORT` (its resolved port) unconditionally --
-     * load-bearing (matches the fixture apps), not incidental: a command reading its
-     * port from anywhere else won't be reachable via readiness checks built from the
-     * same `port`. An **attached** service gets no env/port allocation -- it's already
-     * running on whatever it bound at launch.
-     */
-    async run(options) {
-        this.#transition("STARTING");
-        this.#armTimeout();
-        const services = this.#execution.configuration.services;
-        const validation = validateServicesConfiguration(services);
-        if (!validation.valid) {
-            return this.#refuseToStart(validation.reason, Object.keys(services));
-        }
-        // §21/RT-070: refuse atomically before spawning, same discipline as
-        // tokenizeCommand -- finding out only when spawnProcess() throws would mean
-        // earlier services are already running by the time of refusal.
-        const resourceLimits = this.#execution.configuration.resourceLimits;
-        if (resourceLimits !== undefined) {
-            const capability = resourceLimitCapability();
-            if (capability.availability !== "available") {
-                return this.#refuseToStart(`resourceLimits was configured but cannot be enforced on this platform: ${capability.reason}`, Object.keys(services));
-            }
-        }
-        // Which real mechanism backs filesystemPolicy/networkPolicy -- absent means "bwrap".
-        const sandboxBackend = this.#execution.configuration.sandboxBackend ?? "bwrap";
-        // RT-193, same atomic-refusal placement. networkPolicyCapability() is real on
-        // Linux (bwrap network namespace), unavailable on macOS/Windows, and only
-        // implements full denial even where it exists -- both refused here before
-        // spawning. "container" checks the container mechanism's own functions instead.
-        const networkPolicy = this.#execution.configuration.networkPolicy;
-        if (networkPolicy !== undefined) {
-            const shapeReason = sandboxBackend === "container" ? unsupportedContainerNetworkPolicyReason(networkPolicy) : unsupportedNetworkPolicyReason(networkPolicy);
-            if (shapeReason !== null) {
-                return this.#refuseToStart(`networkPolicy was configured but cannot be enforced: ${shapeReason}`, Object.keys(services));
-            }
-            const capability = sandboxBackend === "container" ? containerNetworkIsolationCapability() : networkPolicyCapability();
-            if (capability.availability !== "available") {
-                return this.#refuseToStart(`networkPolicy was configured but cannot be enforced on this platform: ${capability.reason}`, Object.keys(services));
-            }
-        }
-        // Filesystem half, same atomic-refusal placement -- real on Linux via bwrap's
-        // mount namespace, refused where it doesn't exist. "container" checks Docker's
-        // own capability instead.
-        const filesystemPolicy = this.#execution.configuration.filesystemPolicy;
-        if (filesystemPolicy !== undefined) {
-            const capability = sandboxBackend === "container" ? containerFilesystemIsolationCapability() : filesystemIsolationCapability();
-            if (capability.availability !== "available") {
-                return this.#refuseToStart(`filesystemPolicy was configured but cannot be enforced on this platform: ${capability.reason}`, Object.keys(services));
-            }
-        }
-        for (const name of validation.order) {
-            if (options.readiness[name] === undefined) {
-                return this.#refuseToStart(`service "${name}" has no matching RunOptions.readiness entry`, validation.order);
-            }
-        }
-        // RT-193: captured once spawning is committed, from the real host.
-        const environmentMetadata = await captureEnvironmentMetadata(services);
-        this.#execution = { ...this.#execution, startedAt: new Date().toISOString(), environmentMetadata };
-        const resolvedPorts = new Map();
-        for (let i = 0; i < validation.order.length; i++) {
-            const name = validation.order[i];
-            if (name === undefined)
-                continue;
-            if (isTerminalExecutionState(this.#execution.state)) {
-                // A concurrent timeout/stop/cancel already finished this execution.
-                return this.#execution;
-            }
-            const service = services[name];
-            if (service === undefined)
-                continue;
-            const readinessSpec = options.readiness[name];
-            if (readinessSpec === undefined)
-                continue;
-            let managed;
-            let port;
-            if (service.attach !== undefined) {
-                // Attach mode: the target is already running and bound to whatever it
-                // bound at launch -- nothing here can allocate a port for it, only record
-                // the one the caller already knows. `0` when unsupplied, so a readiness
-                // check needing a port fails legibly ("nothing answered") rather than
-                // this function inventing an ephemeral port unrelated to the real target.
-                // resourceLimits/filesystemPolicy/networkPolicy/sandboxBackend never pass
-                // through -- they can't apply to a process this runtime didn't spawn.
-                port = service.port ?? 0;
-                try {
-                    managed = attachManagedProcess({
-                        processId: randomUUID(),
-                        attach: service.attach,
-                        serviceName: name,
-                        ...(service.port === undefined ? {} : { port: service.port }),
-                    });
-                }
-                catch (err) {
-                    this.#serviceStartResults.push({
-                        serviceName: name,
-                        stage: "spawn",
-                        succeeded: false,
-                        readiness: null,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                    this.#markRemainingNotAttempted(validation.order, i + 1);
-                    this.#tryTransition("FAILED_START");
-                    await this.#cleanup();
-                    this.#finish();
-                    throw err;
-                }
-            }
-            else {
-                port = service.port ?? (await allocateEphemeralPort());
-                const env = withDefaultProcessEnv({
-                    PORT: String(port),
-                    ...substitutePortPlaceholders(service.env, resolvedPorts),
-                });
-                // validateServicesConfiguration already proved this, so both branches
-                // below are unreachable in practice -- kept over a non-null assertion
-                // that would crash for real if the two ever drift apart.
-                if (service.command === undefined) {
-                    return this.#refuseToStart(`service "${name}": neither "command" nor "attach" is set`, validation.order);
-                }
-                const tokenized = tokenizeCommand(service.command);
-                if (!tokenized.ok) {
-                    return this.#refuseToStart(`service "${name}": ${tokenized.reason}`, validation.order);
-                }
-                const { command, args } = tokenized;
-                // Instrumentation flags (`--import <preload>`) go through NODE_OPTIONS, not
-                // spliced into the spawned command's own argv. `command` is a raw
-                // user-supplied token (`tokenizeCommand`'s output) with no proof it is
-                // literally `node` -- it may be a shebang-wrapped CLI ("next", "vite")
-                // that the kernel resolves to `node <script>` transparently, in which case
-                // anything appended to `args` lands in THAT CLI's own argv, not Node's.
-                // Frameworks fronted by a strict argv parser (cac, used by next/vite) then
-                // refuse to start. NODE_OPTIONS is consumed by Node itself before the
-                // target ever sees `process.argv`, so it works whether `command` is `node`,
-                // a shebang script, or anything else -- and appends to (never clobbers) any
-                // NODE_OPTIONS the caller already declared, in `env` or inherited from this
-                // process's own environment.
-                if (service.interpreterArgs !== undefined && service.interpreterArgs.length > 0) {
-                    const existing = env.NODE_OPTIONS ?? process.env.NODE_OPTIONS;
-                    const addition = service.interpreterArgs.join(" ");
-                    env.NODE_OPTIONS = existing === undefined || existing === "" ? addition : `${existing} ${addition}`;
-                }
-                try {
-                    managed = spawnProcess({
-                        processId: randomUUID(),
-                        command,
-                        args,
-                        cwd: service.cwd,
-                        env,
-                        serviceName: name,
-                        port,
-                        ...(resourceLimits === undefined ? {} : { resourceLimits }),
-                        ...(filesystemPolicy === undefined ? {} : { filesystemPolicy }),
-                        ...(networkPolicy === undefined ? {} : { networkPolicy }),
-                        ...(sandboxBackend === "bwrap" ? {} : { sandboxBackend }),
-                    });
-                }
-                catch (err) {
-                    this.#serviceStartResults.push({
-                        serviceName: name,
-                        stage: "spawn",
-                        succeeded: false,
-                        readiness: null,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                    this.#markRemainingNotAttempted(validation.order, i + 1);
-                    this.#tryTransition("FAILED_START");
-                    await this.#cleanup();
-                    this.#finish();
-                    throw err;
-                }
-            }
-            this.#processes.set(name, managed);
-            resolvedPorts.set(name, port);
-            this.#recordProcesses();
-            options.onProcessLifecycleEvent?.({ kind: "process-started", serviceName: name, handle: managed.handle() });
-            // Read by the exit watcher below -- true only once readiness succeeded, which
-            // lets `phase` distinguish "died before confirmed up" from "died after running".
-            let reachedReady = false;
-            // Fire-and-forget: exit can happen long after run() returns (a later crash, or
-            // #cleanup()'s reap) -- must not be awaited inline, which would block every
-            // later service in validation.order on this one's exit.
-            void managed.waitForExit().then(() => {
-                options.onProcessLifecycleEvent?.({
-                    kind: "process-exited",
-                    serviceName: name,
-                    handle: managed.handle(),
-                    phase: reachedReady ? "running" : "starting",
-                });
-            });
-            const outputReader = createProcessOutputReader(() => managed.readOutput());
-            const declaredChecks = readinessSpec.checks({ port, outputReader });
-            const identityBoundChecks = bindChecksToProcessIdentity(declaredChecks, managed.handle().pid, sandboxBackend);
-            const readinessResult = await awaitReadiness(identityBoundChecks, {
-                timeoutMs: readinessSpec.timeoutMs,
-            });
-            if (readinessResult.ready)
-                reachedReady = true;
-            this.#serviceStartResults.push({
-                serviceName: name,
-                stage: "readiness",
-                succeeded: readinessResult.ready,
-                readiness: readinessResult,
-                error: null,
-            });
-            options.onProcessLifecycleEvent?.({
-                kind: readinessResult.ready ? "process-ready" : "process-ready-failed",
-                serviceName: name,
-                handle: managed.handle(),
-                readiness: readinessResult,
-            });
-            if (isTerminalExecutionState(this.#execution.state)) {
-                return this.#execution;
-            }
-            if (!readinessResult.ready) {
-                this.#markRemainingNotAttempted(validation.order, i + 1);
-                if (this.#tryTransition("FAILED_START")) {
-                    await this.#cleanup();
-                }
-                return this.#finish();
-            }
-        }
-        if (this.#tryTransition("READY")) {
-            this.#tryTransition("RUNNING");
-        }
-        return this.#execution;
-    }
-    #refuseToStart(reason, allServiceNames) {
-        this.#validationError = reason;
-        this.#serviceStartResults = allServiceNames.map((serviceName) => ({
-            serviceName,
-            stage: "not-attempted",
-            succeeded: false,
-            readiness: null,
-            error: null,
-        }));
-        this.#tryTransition("FAILED_START");
-        return this.#finish();
-    }
-    #markRemainingNotAttempted(order, fromIndex) {
-        for (let i = fromIndex; i < order.length; i++) {
-            const serviceName = order[i];
-            if (serviceName === undefined)
-                continue;
-            this.#serviceStartResults.push({
-                serviceName,
-                stage: "not-attempted",
-                succeeded: false,
-                readiness: null,
-                error: null,
-            });
-        }
-    }
-    async stop() {
-        if (isTerminalExecutionState(this.#execution.state) || this.#execution.state === "STOPPING") {
-            return this.#execution;
-        }
-        if (this.#tryTransition("STOPPING")) {
-            await this.#cleanup();
-            this.#tryTransition("COMPLETED");
-        }
-        return this.#finish();
-    }
-    /**
-     * Stop everything and record `TIMED_OUT` -- same transition `#onTimeout` makes,
-     * for a caller that knows the budget expired before the internal timer noticed.
-     *
-     * **Why not `stop()`:** the orchestrator clamps its observation window to
-     * whatever's left of `timeoutMs`, making `TIMED_OUT` a race between `#onTimeout`
-     * and `stop()` at the deadline -- measured: the same case reported `TIMED_OUT` at
-     * 1534ms and `COMPLETED` at 1515ms. `execution.state` is what `observe_runtime`
-     * reads to choose `ok` vs `timed_out`, so losing that race silently hides a real
-     * cutoff. A caller that already decided it truncated the run shouldn't have to
-     * win a race to report it.
-     *
-     * Idempotent and terminal-safe like `cancel()`: if the timer fired first, returns
-     * the execution it already finished.
-     */
-    async timeout() {
-        if (isTerminalExecutionState(this.#execution.state) || this.#execution.state === "STOPPING") {
-            return this.#execution;
-        }
-        await this.#cleanup();
-        this.#tryTransition("TIMED_OUT");
-        return this.#finish();
-    }
-    async cancel() {
-        if (isTerminalExecutionState(this.#execution.state) || this.#execution.state === "STOPPING") {
-            return this.#execution;
-        }
-        await this.#cleanup();
-        this.#tryTransition("CANCELLED");
-        return this.#finish();
-    }
-    #armTimeout() {
-        this.#timeoutHandle = setTimeout(() => {
-            void this.#onTimeout();
-        }, this.#execution.configuration.timeoutMs);
-    }
-    async #onTimeout() {
-        if (isTerminalExecutionState(this.#execution.state)) {
-            return;
-        }
-        await this.#cleanup();
-        this.#tryTransition("TIMED_OUT");
-        this.#finish();
-    }
-    /** Kills every spawned service in reverse start order — last up, first down. */
-    async #cleanup() {
-        if (this.#timeoutHandle !== null) {
-            clearTimeout(this.#timeoutHandle);
-            this.#timeoutHandle = null;
-        }
-        const managed = [...this.#processes.values()].reverse();
-        for (const proc of managed) {
-            await proc.kill();
-        }
-        if (managed.length > 0) {
-            this.#recordProcesses();
-        }
-    }
-    #finish() {
-        if (this.#execution.endedAt === null) {
-            this.#execution = { ...this.#execution, endedAt: new Date().toISOString() };
-        }
-        return this.#execution;
-    }
-}
-//# sourceMappingURL=controller.js.map

package/dist/controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAuE,MAAM,gBAAgB,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACnC,uCAAuC,GACxC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAuBvE;;;;;;;;;;;;GAYG;AACH,SAAS,2BAA2B,CAClC,MAAiC,EACjC,GAAkB,EAClB,cAAqC;IAErC,IAAI,GAAG,KAAK,IAAI,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAClE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5F,OAAO,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AA+CD,4EAA4E;AAC5E,kFAAkF;AAClF,kFAAkF;AAClF,qEAAqE;AACrE,MAAM,OAAO,mBAAmB;IAC9B,UAAU,CAAY;IACtB,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,cAAc,GAA0B,IAAI,CAAC;IAC7C,oBAAoB,GAAyB,EAAE,CAAC;IAChD,gBAAgB,GAAkB,IAAI,CAAC;IAEvC,YAAoB,SAAoB;QACtC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAA2B;QACvC,MAAM,SAAS,GAAc;YAC3B,WAAW,EAAE,UAAU,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,EAAE;YACb,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE,EAAE;SACf,CAAC;QACF,OAAO,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iKAAiK;IACjK,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAmB;QACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,WAAW,CAAC,EAAkB;QAC5B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,cAAc,CAAC,EAAkB;QAC/B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,GAAG,CAAC,OAAmB;QAC3B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC;QACxD,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,oEAAoE;QACpE,4EAA4E;QAC5E,+DAA+D;QAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,cAAc,CAAC;QACpE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;YAC7C,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,0EAA0E,UAAU,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnJ,CAAC;QACH,CAAC;QACD,qFAAqF;QACrF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,cAAc,IAAI,OAAO,CAAC;QAE/E,8EAA8E;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,gFAAgF;QAChF,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC;QAClE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,uCAAuC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;YAC5J,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,cAAc,CAAC,wDAAwD,WAAW,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,UAAU,GAAG,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;YACtH,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,yEAAyE,UAAU,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC;QACD,8EAA8E;QAC9E,+EAA+E;QAC/E,0BAA0B;QAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACxE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC;YAC/H,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,4EAA4E,UAAU,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,8CAA8C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/G,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,mBAAmB,EAAE,CAAC;QACnG,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEhD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YAEjC,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,oEAAoE;gBACpE,OAAO,IAAI,CAAC,UAAU,CAAC;YACzB,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,aAAa,KAAK,SAAS;gBAAE,SAAS;YAE1C,IAAI,OAAuB,CAAC;YAC5B,IAAI,IAAY,CAAC;YAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,sEAAsE;gBACtE,0EAA0E;gBAC1E,wEAAwE;gBACxE,sEAAsE;gBACtE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,sEAAsE;gBACtE,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,GAAG,oBAAoB,CAAC;wBAC7B,SAAS,EAAE,UAAU,EAAE;wBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,WAAW,EAAE,IAAI;wBACjB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;wBAC7B,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,OAAO;wBACd,SAAS,EAAE,KAAK;wBAChB,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;oBACH,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzD,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;oBACpC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACf,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC;gBACvD,MAAM,GAAG,GAAG,qBAAqB,CAAC;oBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;oBAClB,GAAG,0BAA0B,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC;iBAC1D,CAAC,CAAC;gBACH,sEAAsE;gBACtE,sEAAsE;gBACtE,yDAAyD;gBACzD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAClC,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,0CAA0C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC3G,CAAC;gBACD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,IAAI,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;gBACpC,4EAA4E;gBAC5E,kEAAkE;gBAClE,uEAAuE;gBACvE,uEAAuE;gBACvE,2EAA2E;gBAC3E,wEAAwE;gBACxE,2EAA2E;gBAC3E,sEAAsE;gBACtE,4EAA4E;gBAC5E,4EAA4E;gBAC5E,4EAA4E;gBAC5E,6BAA6B;gBAC7B,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnD,GAAG,CAAC,YAAY,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACtG,CAAC;gBAED,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC;wBACrB,SAAS,EAAE,UAAU,EAAE;wBACvB,OAAO;wBACP,IAAI;wBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,GAAG;wBACH,WAAW,EAAE,IAAI;wBACjB,IAAI;wBACJ,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;wBAC3D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;wBAC/D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;wBACzD,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;qBAC1D,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;wBAC7B,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,OAAO;wBACd,SAAS,EAAE,KAAK;wBAChB,SAAS,EAAE,IAAI;wBACf,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;oBACH,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzD,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;oBACpC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACf,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,OAAO,CAAC,uBAAuB,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5G,8EAA8E;YAC9E,iFAAiF;YACjF,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,+EAA+E;YAC/E,4EAA4E;YAC5E,wDAAwD;YACxD,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnC,OAAO,CAAC,uBAAuB,EAAE,CAAC;oBAChC,IAAI,EAAE,gBAAgB;oBACtB,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;oBACxB,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;iBAC7C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9G,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,mBAAmB,EAAE;gBAChE,SAAS,EAAE,aAAa,CAAC,SAAS;aACnC,CAAC,CAAC;YACH,IAAI,eAAe,CAAC,KAAK;gBAAE,YAAY,GAAG,IAAI,CAAC;YAC/C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,eAAe,CAAC,KAAK;gBAChC,SAAS,EAAE,eAAe;gBAC1B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBAChC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,sBAAsB;gBACtE,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACxB,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YAEH,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC,UAAU,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,eAAkC;QAC/D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,IAAI,CAAC,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAChE,WAAW;YACX,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,0BAA0B,CAAC,KAAwB,EAAE,SAAiB;QACpE,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,WAAW;gBACX,KAAK,EAAE,eAAe;gBACtB,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,WAAW;QACT,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/dependency-version-check.d.ts

@@ -1,36 +0,0 @@
-/**
- * `DEC-NEXT-fault-layer-empirical-confirmation.md`'s `dependency` mechanism: declared
- * (lockfile) vs resolved (installed) version — a structural fact, recorded not inferred.
- *
- * - Node-only, checked not assumed: no existing lockfile reader for any language to
- *   match. A Python/Ruby target is a real, disclosed gap — an additive second reader,
- *   not a rewrite.
- * - Only `lockfileVersion` 2/3's flat `packages` map (keyed by `node_modules/<name>`,
- *   confirmed against `fixture-apps/broken-invoices-backend`). v1's `dependencies`
- *   shape is not read — `applicable: false`, disclosed gap.
- * - "Resolved" is a direct read from the lockfile key's path, not Node module
- *   resolution — the key already encodes install location, including nested
- *   transitives (`node_modules/a/node_modules/b`).
- * - Direct dependencies only (`dependencies`/`devDependencies`), not every transitive
- *   lockfile entry — matches the ruling's "cheap, always available" bar.
- */
-export interface DependencyVersionMismatch {
-    readonly name: string;
-    /** The version `package-lock.json` pins this package to. */
-    readonly declaredVersion: string;
-    /** The version actually found in `node_modules/<name>/package.json` on disk. */
-    readonly resolvedVersion: string;
-}
-export interface DependencyVersionCheckResult {
-    /** `false` when not identifiable as a checkable Node target (no package.json/lockfile, unsupported shape, malformed JSON) — "not applicable", not a guessed clean result. `mismatches` is `[]` when `false`. */
-    readonly applicable: boolean;
-    readonly mismatches: readonly DependencyVersionMismatch[];
-}
-/**
- * Compares lockfile-declared vs installed version for every direct dependency of the
- * Node project rooted at `cwd`. A dependency missing from the lockfile (workspace/
- * local-link) or from `node_modules` (never installed) is skipped, not reported —
- * different facts from a mismatch, not guessed as one.
- */
-export declare function checkDependencyVersions(cwd: string): DependencyVersionCheckResult;
-//# sourceMappingURL=dependency-version-check.d.ts.map

package/dist/dependency-version-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dependency-version-check.d.ts","sourceRoot":"","sources":["../src/dependency-version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,gNAAgN;IAChN,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D;AAuBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,4BAA4B,CA4CjF"}

package/dist/dependency-version-check.js

@@ -1,72 +0,0 @@
-/**
- * `DEC-NEXT-fault-layer-empirical-confirmation.md`'s `dependency` mechanism: declared
- * (lockfile) vs resolved (installed) version — a structural fact, recorded not inferred.
- *
- * - Node-only, checked not assumed: no existing lockfile reader for any language to
- *   match. A Python/Ruby target is a real, disclosed gap — an additive second reader,
- *   not a rewrite.
- * - Only `lockfileVersion` 2/3's flat `packages` map (keyed by `node_modules/<name>`,
- *   confirmed against `fixture-apps/broken-invoices-backend`). v1's `dependencies`
- *   shape is not read — `applicable: false`, disclosed gap.
- * - "Resolved" is a direct read from the lockfile key's path, not Node module
- *   resolution — the key already encodes install location, including nested
- *   transitives (`node_modules/a/node_modules/b`).
- * - Direct dependencies only (`dependencies`/`devDependencies`), not every transitive
- *   lockfile entry — matches the ruling's "cheap, always available" bar.
- */
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-function readJsonFile(path) {
-    try {
-        return JSON.parse(readFileSync(path, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Compares lockfile-declared vs installed version for every direct dependency of the
- * Node project rooted at `cwd`. A dependency missing from the lockfile (workspace/
- * local-link) or from `node_modules` (never installed) is skipped, not reported —
- * different facts from a mismatch, not guessed as one.
- */
-export function checkDependencyVersions(cwd) {
-    const packageJsonPath = join(cwd, "package.json");
-    const lockfilePath = join(cwd, "package-lock.json");
-    if (!existsSync(packageJsonPath) || !existsSync(lockfilePath)) {
-        return { applicable: false, mismatches: [] };
-    }
-    const packageJson = readJsonFile(packageJsonPath);
-    const lockfile = readJsonFile(lockfilePath);
-    if (packageJson === null || lockfile === null) {
-        return { applicable: false, mismatches: [] };
-    }
-    const packages = lockfile.packages;
-    if (packages === undefined || typeof packages !== "object") {
-        // lockfileVersion 1, or an unrecognized shape -- see header.
-        return { applicable: false, mismatches: [] };
-    }
-    const declaredNames = new Set([
-        ...Object.keys(packageJson.dependencies ?? {}),
-        ...Object.keys(packageJson.devDependencies ?? {}),
-    ]);
-    const mismatches = [];
-    for (const name of declaredNames) {
-        const lockEntry = packages[`node_modules/${name}`];
-        const declaredVersion = lockEntry?.version;
-        if (typeof declaredVersion !== "string")
-            continue;
-        const installedPackageJsonPath = join(cwd, "node_modules", name, "package.json");
-        if (!existsSync(installedPackageJsonPath))
-            continue;
-        const installedPackageJson = readJsonFile(installedPackageJsonPath);
-        const resolvedVersion = installedPackageJson?.version;
-        if (typeof resolvedVersion !== "string")
-            continue;
-        if (resolvedVersion !== declaredVersion) {
-            mismatches.push({ name, declaredVersion, resolvedVersion });
-        }
-    }
-    return { applicable: true, mismatches };
-}
-//# sourceMappingURL=dependency-version-check.js.map

package/dist/dependency-version-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dependency-version-check.js","sourceRoot":"","sources":["../src/dependency-version-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA6BjC,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAmB,eAAe,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,YAAY,CAAmB,YAAY,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3D,6DAA6D;QAC7D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;QACpC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC;QAC9C,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,SAAS,EAAE,OAAO,CAAC;QAC3C,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,SAAS;QAElD,MAAM,wBAAwB,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;YAAE,SAAS;QAEpD,MAAM,oBAAoB,GAAG,YAAY,CAAgC,wBAAwB,CAAC,CAAC;QACnG,MAAM,eAAe,GAAG,oBAAoB,EAAE,OAAO,CAAC;QACtD,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,SAAS;QAElD,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}

package/dist/env.d.ts

@@ -1,10 +0,0 @@
-/**
- * Default environment applied to every spawned process, on top of the caller's own.
- *
- * RUST_BACKTRACE=1 (§17): without it a Rust panic prints only a message, hiding the
- * trace — a collector-absence-masquerading-as-success case, not a caller-remembers-it case.
- *
- * Never overrides a key the caller already set.
- */
-export declare function withDefaultProcessEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
-//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAEpC"}

package/dist/env.js

@@ -1,12 +0,0 @@
-/**
- * Default environment applied to every spawned process, on top of the caller's own.
- *
- * RUST_BACKTRACE=1 (§17): without it a Rust panic prints only a message, hiding the
- * trace — a collector-absence-masquerading-as-success case, not a caller-remembers-it case.
- *
- * Never overrides a key the caller already set.
- */
-export function withDefaultProcessEnv(env) {
-    return { RUST_BACKTRACE: "1", ...env };
-}
-//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiD;IAEjD,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;AACzC,CAAC"}

package/dist/environment-metadata.d.ts

@@ -1,15 +0,0 @@
-/**
- * §2/RT-193: `Execution.commit` alone can't reproduce a run — same commit, different
- * Node/OS/toolchain can behave differently. Fills the gap from the real host: OS
- * platform, this process's own `process.version`, and the version of every distinct
- * executable `configuration.services` invokes.
- *
- * Toolchain probe mirrors `scripts/preflight.mjs`'s `interpreters()` (version flag,
- * read stdout+stderr combined since some tools like `java -version` write to stderr
- * only, keep first line) but isn't the same function: that one checks a fixed tool
- * list against expected versions (a gate); this reports whatever `services[*].command`
- * names, no expected version to compare against.
- */
-import type { EnvironmentMetadata, ServiceConfiguration } from "@descryy/runtime-contracts";
-export declare function captureEnvironmentMetadata(services: Readonly<Record<string, ServiceConfiguration>>): Promise<EnvironmentMetadata>;
-//# sourceMappingURL=environment-metadata.d.ts.map

package/dist/environment-metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment-metadata.d.ts","sourceRoot":"","sources":["../src/environment-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAM5F,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GACvD,OAAO,CAAC,mBAAmB,CAAC,CAmB9B"}