@descryy/runtime-controller 0.3.8 → 0.3.9

package/dist/container-sandbox.js

@@ -0,0 +1,152 @@
+/**
+ * §21's execution boundary, container backend -- the macOS/Windows half of the
+ * sandbox-isolation lane (`sandbox.ts` covers Linux via bubblewrap).
+ *
+ * **Not a second native sandbox.** `sandbox-exec`/Seatbelt (macOS) and Job
+ * Objects/AppContainer/WFP (Windows) were researched and rejected: `sandbox-exec` is
+ * deprecated with no public API replacement, Endpoint Security needs an Apple
+ * entitlement this project doesn't have, and hand-building Windows equivalents is a
+ * second and third bespoke sandbox for a problem already solved once.
+ *
+ * **Mechanism: route the spawned process through a real container instead**, via
+ * `docker run` (Docker Desktop's Linux VM on macOS, WSL2/Docker Desktop on Windows).
+ * The container's own rootfs is the isolation boundary; no bwrap needed inside it.
+ *
+ * **Verified for real** (Linux dev machine, real Docker daemon 29.6.1, not mocked):
+ * a file outside bind-mounts is unreachable (`ENOENT`); a network call under
+ * `--network none` is refused against a real listener; both together, through the
+ * full `ExecutionController.run()` path. See `container-sandbox.test.ts`,
+ * `controller.test.ts`'s container-backend e2e test.
+ *
+ * **UNVERIFIED on real macOS/Windows hardware** (none available here): Docker
+ * Desktop running-detection before spawn, path translation across the Docker
+ * Desktop VM boundary (macOS) and WSL2 (Windows) -- this module's bind-mount assumes
+ * host path == in-container path (`-v hostPath:hostPath`), true on Linux and for
+ * Docker Desktop's Linux VM when already inside its shared-drive mapping, untested
+ * for an arbitrary Windows path. Mechanism exists and is tested where it can be;
+ * cross-platform verification needs hardware nobody here has -- not a bug, not
+ * claimed otherwise.
+ *
+ * **Scope boundary** (same treatment as attach-mode elsewhere): a target that can't
+ * run containerized at all (deep native OS integration, GUI, native deps absent
+ * from a Linux image) is out of scope on any platform, with no native-sandbox
+ * fallback -- disclosed, not silently unsupported.
+ *
+ * **Measured Docker/bwrap difference** (found via a mutation check removing
+ * `--network none` and rerunning): Docker gives every container its own network
+ * namespace regardless of `--network none` -- unlike bwrap, which shares the host's
+ * network unless `networkPolicy` is declared. So a container can never reach the
+ * HOST's loopback either way, but it CAN still reach the public internet via
+ * Docker's default bridge NAT unless `--network none` is set. The dedicated
+ * mutation-sensitive test in `container-sandbox.test.ts` checks reachability to an
+ * external host (not loopback) to isolate exactly this.
+ *
+ * **Not solved here, disclosed:** `ResourceLimits` composition -- `sandbox.ts` wraps
+ * bwrap with `applyResourceLimits`; this module does not wrap Docker's
+ * `--memory`/`--cpus`/`--pids-limit` equivalents, so a `resourceLimits`-declared
+ * execution on this backend runs unlimited inside the container. Selective network
+ * allow/deny-listing is unimplemented for the same reason as `sandbox.ts` (needs DNS
+ * interception + IP filtering) -- `unsupportedContainerNetworkPolicyReason` reports
+ * it the same way, matching posture rather than overclaiming.
+ */
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { basename } from "node:path";
+/** Real check: working Docker CLI + reachable daemon, not just a `docker` binary on PATH. `docker version` talks to the daemon, so a CLI with no daemon running fails the same way a missing binary does -- both mean "cannot enforce." */
+export function containerRuntimeCapability(env = process.env) {
+    try {
+        execFileSync("docker", ["version", "--format", "{{.Server.Version}}"], { env, stdio: "ignore" });
+    }
+    catch {
+        return {
+            availability: "unavailable",
+            reason: "docker is not on PATH, or no Docker daemon is reachable -- container-based isolation cannot be enforced without a real, running Docker",
+        };
+    }
+    return { availability: "available", reason: null };
+}
+// Mirrors sandbox.ts's filesystem/network capability split: one real mechanism
+// (container boundary), two named capabilities since the policies are declared
+// and reasoned about independently.
+export function containerFilesystemIsolationCapability(env = process.env) {
+    return containerRuntimeCapability(env);
+}
+export function containerNetworkIsolationCapability(env = process.env) {
+    return containerRuntimeCapability(env);
+}
+/** Same posture as `sandbox.ts`'s `unsupportedNetworkPolicyReason`: only full denial (`--network none`) is enforced. A shape bwrap discloses as unsupported isn't silently claimed here just because the mechanism changed. */
+export function unsupportedContainerNetworkPolicyReason(policy) {
+    if (policy.mode === "allow" && policy.hosts.length === 0)
+        return null;
+    return ('only full network denial ({ mode: "allow", hosts: [] }) is enforced -- selective allow- or deny-listing of specific ' +
+        "hosts would need a custom docker network with DNS interception and IP filtering inside it, not built in this " +
+        "iteration (the same posture the bwrap backend already declares for the same shapes)");
+}
+// Minimal official -slim/-jre images for this runtime's fixture targets, keyed by
+// interpreter basename so a full path still resolves. Not a general registry --
+// other runtimes pass `containerImage` explicitly instead of extending this table.
+const KNOWN_RUNTIME_IMAGES = {
+    node: "node:22-slim",
+    python: "python:3.12-slim",
+    python3: "python:3.12-slim",
+    java: "eclipse-temurin:21-jre",
+};
+export function resolveContainerImage(interpreterCommand) {
+    return KNOWN_RUNTIME_IMAGES[basename(interpreterCommand)] ?? null;
+}
+/**
+ * Wraps `command`/`args` with `docker run` so a container boundary enforces
+ * `filesystemPolicy`/`networkPolicy`. Neither declared returns them unchanged and
+ * never invokes docker -- same non-regression contract as `sandbox.ts`'s
+ * `applySandbox`.
+ *
+ * **Throws rather than silently spawning unconstrained** when a policy can't
+ * actually be backed (no working Docker, unimplemented `networkPolicy` shape).
+ *
+ * **Returns a real, unique `containerName` whenever it wraps.** Found via real
+ * escape testing: `process-manager.ts`'s group-kill targets the local `docker` CLI
+ * process's group, which is right for bwrap but not Docker -- the container runs
+ * under `dockerd`, not as the CLI's child, so killing the CLI's group left an
+ * orphaned `node:22-slim` container running in testing. `containerName` lets the
+ * caller issue an explicit `docker stop <name>` against the container itself.
+ */
+export function applyContainerSandbox(options) {
+    const { filesystemPolicy, networkPolicy } = options;
+    if (filesystemPolicy === undefined && networkPolicy === undefined) {
+        return { command: options.command, args: options.args };
+    }
+    const env = options.env ?? process.env;
+    if (networkPolicy !== undefined) {
+        const shapeReason = unsupportedContainerNetworkPolicyReason(networkPolicy);
+        if (shapeReason !== null) {
+            throw new Error(`networkPolicy was configured but cannot be enforced: ${shapeReason}`);
+        }
+    }
+    const capability = containerRuntimeCapability(env);
+    if (capability.availability !== "available") {
+        throw new Error(`container sandbox was requested but cannot be enforced: ${capability.reason}`);
+    }
+    const image = options.containerImage ?? resolveContainerImage(options.interpreterCommand);
+    if (image === null) {
+        throw new Error(`container sandbox was requested but no base image is known for interpreter "${options.interpreterCommand}" -- pass containerImage explicitly`);
+    }
+    const containerName = `descry-sandbox-${randomUUID()}`;
+    const dockerArgs = ["run", "--rm", "--name", containerName];
+    if (networkPolicy !== undefined) {
+        dockerArgs.push("--network", "none");
+    }
+    dockerArgs.push("-v", `${options.cwd}:${options.cwd}`, "-w", options.cwd);
+    if (filesystemPolicy !== undefined) {
+        for (const root of filesystemPolicy.allowedRoots) {
+            dockerArgs.push("-v", `${root}:${root}`);
+        }
+    }
+    for (const [key, value] of Object.entries(options.processEnv ?? {})) {
+        if (key === "PATH" || value === undefined)
+            continue;
+        dockerArgs.push("-e", `${key}=${value}`);
+    }
+    dockerArgs.push(image, options.command, ...options.args);
+    return { command: "docker", args: dockerArgs, containerName };
+}
+//# sourceMappingURL=container-sandbox.js.map

package/dist/container-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-sandbox.js","sourceRoot":"","sources":["../src/container-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,2OAA2O;AAC3O,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,wIAAwI;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,UAAU,sCAAsC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+NAA+N;AAC/N,MAAM,UAAU,uCAAuC,CAAC,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,sHAAsH;QACtH,+GAA+G;QAC/G,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,oBAAoB,GAAqC;IAC7D,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,kBAAkB;IAC3B,IAAI,EAAE,wBAAwB;CAC/B,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+EAA+E,OAAO,CAAC,kBAAkB,qCAAqC,CAC/I,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAChE,CAAC"}

package/dist/controller.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Runtime controller (§4/§5/§6/§45 "Core"). Owns Execution lifecycle, spawns every
+ * configured service, waits for each one's real readiness (never "process exists"),
+ * guarantees cleanup on partial/total failure and timeout. Knows nothing about any
+ * specific language or framework (principle 8).
+ */
+import { type Execution, type ProcessHandle } from "@descryy/runtime-contracts";
+import { type ProcessOutputReader, type ReadinessCheck, type ReadinessResult } from "./readiness.ts";
+import type { ExecutionConfiguration } from "@descryy/runtime-contracts";
+export interface CreateExecutionInput {
+    readonly application: string;
+    readonly repository: string;
+    readonly commit: string;
+    readonly configuration: ExecutionConfiguration;
+}
+export interface ServiceReadinessSpec {
+    /**
+     * `outputReader` is a real `ProcessOutputReader` bound to THIS spawned (or
+     * attached) process's own output — the only way to build a `log-pattern`
+     * check that type-checks (`readiness.ts`'s `ProcessOutputReader` brand).
+     * RT-024: this closes "log-pattern only carries the stronger this-run
+     * guarantee as caller discipline, not enforced by the type" by making the
+     * discipline the only path the type allows.
+     */
+    readonly checks: (info: {
+        readonly port: number;
+        readonly outputReader: ProcessOutputReader;
+    }) => readonly ReadinessCheck[];
+    readonly timeoutMs: number;
+}
+export interface RunOptions {
+    /** One entry required per key in `configuration.services` -- refuses rather than defaulting a missing one to "spawn success is enough" (RT-024/RT-032). */
+    readonly readiness: Readonly<Record<string, ServiceReadinessSpec>>;
+    /**
+     * Optional live observer for `ProcessLifecycleEvent`, called synchronously at each
+     * transition for the lifetime of this execution (including after `run()` returns).
+     * A throwing observer is not caught here -- same "must not hang, may not silently
+     * swallow its own failure" discipline `Collector` imposes on every callback here.
+     */
+    readonly onProcessLifecycleEvent?: (event: ProcessLifecycleEvent) => void;
+}
+export interface ServiceStartResult {
+    readonly serviceName: string;
+    readonly stage: "spawn" | "readiness" | "not-attempted";
+    readonly succeeded: boolean;
+    /** Set when `stage === "readiness"`. RT-024/RT-031 apply per entry -- N of these is N liveness claims, never a joint identity proof. */
+    readonly readiness: ReadinessResult | null;
+    /** Set when `stage === "spawn"` and spawning itself threw. */
+    readonly error: string | null;
+}
+/**
+ * Fires at the exact moments `run()` observes a service's lifecycle -- spawned,
+ * readiness settled either way, reaped. A pure notification channel; nothing here
+ * decides whether a transition becomes Evidence.
+ *
+ * Needed because `Execution.processes`/`ServiceStartResults` are only complete once
+ * `run()` returns, but a service still running when `run()` resolves hasn't exited
+ * yet -- its eventual `process-exited` lies in the future. Only this live channel
+ * can observe that exit; reading the final `Execution` later cannot.
+ */
+export type ProcessLifecycleEvent = {
+    readonly kind: "process-started";
+    readonly serviceName: string;
+    readonly handle: ProcessHandle;
+} | {
+    readonly kind: "process-ready";
+    readonly serviceName: string;
+    readonly handle: ProcessHandle;
+    readonly readiness: ReadinessResult;
+} | {
+    readonly kind: "process-ready-failed";
+    readonly serviceName: string;
+    readonly handle: ProcessHandle;
+    readonly readiness: ReadinessResult;
+}
+/**
+ * `phase` distinguishes "readiness hadn't yet succeeded when it exited"
+ * (`"starting"`) from "had already reached READY" (`"running"`) -- the
+ * process-level echo of `FAILED_START` vs `FAILED` (§30). Computed from this
+ * service's own readiness history, not `Execution.state` at exit time -- a crash
+ * mid-readiness-poll fires before the execution's own state has caught up.
+ */
+ | {
+    readonly kind: "process-exited";
+    readonly serviceName: string;
+    readonly handle: ProcessHandle;
+    readonly phase: "starting" | "running";
+};
+export declare class ExecutionController {
+    #private;
+    private constructor();
+    static create(input: CreateExecutionInput): ExecutionController;
+    get execution(): Execution;
+    /** One entry per configured service, in spawn order, including never-attempted ones (`stage: "not-attempted"`). Empty until `run()` returns its first result. */
+    get serviceStartResults(): readonly ServiceStartResult[];
+    /** Non-null only when `run()` refused before spawning anything. */
+    get validationError(): string | null;
+    /** Combined stdout+stderr of the named service's process so far, or "" if it was never spawned. */
+    readProcessOutput(serviceName: string): string;
+    /**
+     * Starts every service in dependency order, spawned (each on its own ephemeral
+     * port unless fixed) or attached (`service.attach`, for an already-running
+     * pid/log file). Reaches RUNNING only if every service starts and reaches
+     * readiness. On first failure, every started service is killed in reverse order
+     * (no-op for attached ones) and remaining services are recorded "not-attempted" --
+     * `serviceStartResults` always distinguishes "never tried" from "tried and failed".
+     *
+     * Configuration is validated atomically first -- a bad `dependsOn`, a cycle, an
+     * undeclared placeholder, ambiguous `command`/`attach`, or a missing readiness
+     * entry refuses before anything spawns.
+     *
+     * Every **spawned** service gets `PORT` (its resolved port) unconditionally --
+     * load-bearing (matches the fixture apps), not incidental: a command reading its
+     * port from anywhere else won't be reachable via readiness checks built from the
+     * same `port`. An **attached** service gets no env/port allocation -- it's already
+     * running on whatever it bound at launch.
+     */
+    run(options: RunOptions): Promise<Execution>;
+    stop(): Promise<Execution>;
+    /**
+     * Stop everything and record `TIMED_OUT` -- same transition `#onTimeout` makes,
+     * for a caller that knows the budget expired before the internal timer noticed.
+     *
+     * **Why not `stop()`:** the orchestrator clamps its observation window to
+     * whatever's left of `timeoutMs`, making `TIMED_OUT` a race between `#onTimeout`
+     * and `stop()` at the deadline -- measured: the same case reported `TIMED_OUT` at
+     * 1534ms and `COMPLETED` at 1515ms. `execution.state` is what `observe_runtime`
+     * reads to choose `ok` vs `timed_out`, so losing that race silently hides a real
+     * cutoff. A caller that already decided it truncated the run shouldn't have to
+     * win a race to report it.
+     *
+     * Idempotent and terminal-safe like `cancel()`: if the timer fired first, returns
+     * the execution it already finished.
+     */
+    timeout(): Promise<Execution>;
+    cancel(): Promise<Execution>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAA6C,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAWhJ,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;KAAE,KAAK,SAAS,cAAc,EAAE,CAAC;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA6BD,MAAM,WAAW,UAAU;IACzB,2JAA2J;IAC3J,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACrI;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC9I;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9I,qBAAa,mBAAmB;;IAO9B,OAAO;IAIP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,mBAAmB;IAsB/D,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,iKAAiK;IACjK,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,mEAAmE;IACnE,IAAI,eAAe,IAAI,MAAM,GAAG,IAAI,CAEnC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IA2B9C;;;;;;;;;;;;;;;;;OAiBG;IACG,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAgQ5C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAWhC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;IAS7B,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;CA6CnC"}