@descryy/runtime-controller 0.3.9 → 0.4.1

package/dist/container-sandbox.js

@@ -51,7 +51,10 @@
  */
 import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { basename } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { sandboxPathRefusalReason } from "./sandbox.js";
 /** Real check: working Docker CLI + reachable daemon, not just a `docker` binary on PATH. `docker version` talks to the daemon, so a CLI with no daemon running fails the same way a missing binary does -- both mean "cannot enforce." */
 export function containerRuntimeCapability(env = process.env) {
     try {
@@ -63,8 +66,32 @@ export function containerRuntimeCapability(env = process.env) {
             reason: "docker is not on PATH, or no Docker daemon is reachable -- container-based isolation cannot be enforced without a real, running Docker",
         };
     }
+    return hardenedLaunchStatus(env);
+}
+const HARDENED_PROBE_IMAGE = "alpine:latest";
+const HARDENED_PROBE_TIMEOUT_MS = 60_000;
+let defaultEnvHardenedStatus;
+function probeHardenedLaunch(env) {
+    try {
+        execFileSync("docker", ["run", "--rm", "--pull", "never", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", HARDENED_PROBE_IMAGE, "true"], { env, stdio: ["ignore", "ignore", "pipe"], timeout: HARDENED_PROBE_TIMEOUT_MS });
+    }
+    catch (error) {
+        const stderr = String(error.stderr ?? "");
+        if (/operation not permitted/i.test(stderr)) {
+            return {
+                availability: "unavailable",
+                reason: "docker is reachable but cannot start a container with --security-opt no-new-privileges here (exec: operation not permitted -- typically a snap-confined Docker); the container sandbox launches every process that way, so it cannot be enforced on this host",
+            };
+        }
+    }
     return { availability: "available", reason: null };
 }
+function hardenedLaunchStatus(env) {
+    if (env !== process.env)
+        return probeHardenedLaunch(env);
+    defaultEnvHardenedStatus ??= probeHardenedLaunch(env);
+    return defaultEnvHardenedStatus;
+}
 // Mirrors sandbox.ts's filesystem/network capability split: one real mechanism
 // (container boundary), two named capabilities since the policies are declared
 // and reasoned about independently.
@@ -110,6 +137,73 @@ export function resolveContainerImage(interpreterCommand) {
  * orphaned `node:22-slim` container running in testing. `containerName` lets the
  * caller issue an explicit `docker stop <name>` against the container itself.
  */
+const DEFAULT_CONTAINER_PIDS_LIMIT = 4096;
+function isWithin(root, target) {
+    const offset = relative(root, target);
+    return offset === "" || (!offset.startsWith("..") && !isAbsolute(offset));
+}
+function hostUserSpecifier() {
+    const uid = process.getuid?.();
+    const gid = process.getgid?.();
+    if (uid === undefined || gid === undefined || uid === 0)
+        return null;
+    return `${String(uid)}:${String(gid)}`;
+}
+const NODE_OPTIONS_MODULE_FLAGS = new Set(["--import", "--require", "-r", "--experimental-loader", "--loader"]);
+function nearestPackageRoot(file) {
+    let directory = dirname(file);
+    for (let hops = 0; hops < 4; hops += 1) {
+        if (existsSync(join(directory, "package.json")))
+            return directory;
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    return dirname(file);
+}
+function fileUrlToPathOrNull(value) {
+    try {
+        return fileURLToPath(value);
+    }
+    catch {
+        return null;
+    }
+}
+function instrumentationRoots(nodeOptions) {
+    if (nodeOptions === undefined)
+        return [];
+    const tokens = nodeOptions.match(/"(?:[^"\\]|\\.)*"|\S+/g) ?? [];
+    const roots = new Set();
+    for (let index = 0; index < tokens.length; index += 1) {
+        const flag = tokens[index];
+        const equals = flag.indexOf("=");
+        const [name, inlineValue] = equals > 0 ? [flag.slice(0, equals), flag.slice(equals + 1)] : [flag, undefined];
+        if (!NODE_OPTIONS_MODULE_FLAGS.has(name))
+            continue;
+        let value = inlineValue ?? tokens[index + 1];
+        if (inlineValue === undefined)
+            index += 1;
+        if (value === undefined)
+            continue;
+        if (value.startsWith('"'))
+            value = value.slice(1, -1).replace(/\\(.)/g, "$1");
+        const path = value.startsWith("file://") ? fileUrlToPathOrNull(value) : value;
+        if (path !== null && isAbsolute(path) && existsSync(path))
+            roots.add(nearestPackageRoot(path));
+    }
+    return [...roots];
+}
+const FORWARDABLE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const CONTAINER_HOST_ENV_PASSTHROUGH = ["LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ"];
+export function containerProcessEnv(declared, host = process.env) {
+    const env = {};
+    for (const name of CONTAINER_HOST_ENV_PASSTHROUGH) {
+        if (host[name] !== undefined)
+            env[name] = host[name];
+    }
+    return { ...env, ...declared };
+}
 export function applyContainerSandbox(options) {
     const { filesystemPolicy, networkPolicy } = options;
     if (filesystemPolicy === undefined && networkPolicy === undefined) {
@@ -131,22 +225,59 @@ export function applyContainerSandbox(options) {
         throw new Error(`container sandbox was requested but no base image is known for interpreter "${options.interpreterCommand}" -- pass containerImage explicitly`);
     }
     const containerName = `descry-sandbox-${randomUUID()}`;
-    const dockerArgs = ["run", "--rm", "--name", containerName];
+    const dockerArgs = ["run", "--rm", "--init", "--name", containerName, "--cap-drop", "ALL", "--security-opt", "no-new-privileges"];
+    dockerArgs.push("--pids-limit", String(options.resourceLimits?.maxProcesses ?? DEFAULT_CONTAINER_PIDS_LIMIT));
+    if (options.resourceLimits?.maxMemoryBytes !== undefined)
+        dockerArgs.push("--memory", String(options.resourceLimits.maxMemoryBytes));
+    if (options.resourceLimits?.maxCpuSeconds !== undefined)
+        dockerArgs.push("--ulimit", `cpu=${String(options.resourceLimits.maxCpuSeconds)}`);
+    const hostUser = hostUserSpecifier();
+    if (hostUser !== null)
+        dockerArgs.push("--user", hostUser);
     if (networkPolicy !== undefined) {
         dockerArgs.push("--network", "none");
     }
-    dockerArgs.push("-v", `${options.cwd}:${options.cwd}`, "-w", options.cwd);
-    if (filesystemPolicy !== undefined) {
-        for (const root of filesystemPolicy.allowedRoots) {
-            dockerArgs.push("-v", `${root}:${root}`);
+    const writableRoots = [options.cwd, ...(filesystemPolicy?.allowedRoots ?? [])];
+    const mounts = [
+        { role: "working directory", path: options.cwd, readOnly: false },
+    ];
+    for (const path of filesystemPolicy?.allowedRoots ?? []) {
+        if (mounts.some((mount) => mount.path === path))
+            continue;
+        mounts.push({ role: "allowed root", path, readOnly: false });
+    }
+    for (const root of filesystemPolicy?.readOnlyRoots ?? []) {
+        if (writableRoots.some((bound) => isWithin(bound, root)) || !existsSync(root))
+            continue;
+        mounts.push({ role: "read-only root", path: root, readOnly: true });
+    }
+    for (const preloadRoot of instrumentationRoots(options.processEnv?.NODE_OPTIONS)) {
+        if (mounts.some((mount) => isWithin(mount.path, preloadRoot)))
+            continue;
+        mounts.push({ role: "instrumentation directory", path: preloadRoot, readOnly: true });
+    }
+    for (const mount of mounts) {
+        const refusal = sandboxPathRefusalReason(mount.path, mount.role);
+        if (refusal !== null)
+            throw new Error(`sandbox refused: ${refusal}`);
+        if (/[,"\n\r\0]/.test(mount.path)) {
+            throw new Error(`sandbox refused: ${mount.role} ${JSON.stringify(mount.path)} contains a character (comma, quote or line break) that cannot be passed to docker --mount`);
         }
+        dockerArgs.push("--mount", `type=bind,source=${mount.path},target=${mount.path}${mount.readOnly ? ",readonly" : ""}`);
     }
+    dockerArgs.push("-w", options.cwd);
+    const forwarded = {};
     for (const [key, value] of Object.entries(options.processEnv ?? {})) {
         if (key === "PATH" || value === undefined)
             continue;
-        dockerArgs.push("-e", `${key}=${value}`);
+        if (!FORWARDABLE_ENV_NAME.test(key)) {
+            throw new Error(`environment variable ${JSON.stringify(key)} cannot be forwarded into the container: a name must be letters, digits ` +
+                "and underscores, not starting with a digit");
+        }
+        forwarded[key] = value;
+        dockerArgs.push("-e", key);
     }
     dockerArgs.push(image, options.command, ...options.args);
-    return { command: "docker", args: dockerArgs, containerName };
+    return { command: "docker", args: dockerArgs, containerName, env: forwarded };
 }
 //# sourceMappingURL=container-sandbox.js.map

package/dist/container-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-sandbox.js","sourceRoot":"","sources":["../src/container-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,2OAA2O;AAC3O,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,wIAAwI;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,UAAU,sCAAsC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+NAA+N;AAC/N,MAAM,UAAU,uCAAuC,CAAC,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,sHAAsH;QACtH,+GAA+G;QAC/G,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,oBAAoB,GAAqC;IAC7D,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,kBAAkB;IAC3B,IAAI,EAAE,wBAAwB;CAC/B,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+EAA+E,OAAO,CAAC,kBAAkB,qCAAqC,CAC/I,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,YAAY,EAAE,CAAC;YACjD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"container-sandbox.js","sourceRoot":"","sources":["../src/container-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,2OAA2O;AAC3O,MAAM,UAAU,0BAA0B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7E,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EAAE,wIAAwI;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAC7C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,IAAI,wBAAsD,CAAC;AAE3D,SAAS,mBAAmB,CAAC,GAAsB;IACjD,IAAI,CAAC;QACH,YAAY,CACV,QAAQ,EACR,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAC5H,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACjF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,YAAY,EAAE,aAAa;gBAC3B,MAAM,EACJ,+PAA+P;aAClQ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAsB;IAClD,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzD,wBAAwB,KAAK,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,UAAU,sCAAsC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+NAA+N;AAC/N,MAAM,UAAU,uCAAuC,CAAC,MAAqB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,CACL,sHAAsH;QACtH,+GAA+G;QAC/G,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,oBAAoB,GAAqC;IAC7D,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,kBAAkB;IAC3B,IAAI,EAAE,wBAAwB;CAC/B,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,kBAA0B;IAC9D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,CAAC,CAAC,CAAC;AAErI,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,WAA+B;IAC3D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7G,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACnD,IAAI,KAAK,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,WAAW,KAAK,SAAS;YAAE,KAAK,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,IAAI,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AAElH,MAAM,UAAU,mBAAmB,CACjC,QAAkE,EAClE,OAA0B,OAAO,CAAC,GAAG;IAErC,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,8BAA8B,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAOhC,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,gBAAgB,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+EAA+E,OAAO,CAAC,kBAAkB,qCAAqC,CAC/I,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,UAAU,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAE5I,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,IAAI,4BAA4B,CAAC,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,cAAc,EAAE,cAAc,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;IACrI,IAAI,OAAO,CAAC,cAAc,EAAE,aAAa,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAE5I,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE3D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAwF;QAClG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;KAClE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;QACzD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACxF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAAE,SAAS;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC5K,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,0EAA0E;gBACnH,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAChF,CAAC"}

package/dist/controller.d.ts

@@ -5,7 +5,10 @@
  * specific language or framework (principle 8).
  */
 import { type Execution, type ProcessHandle } from "@descryy/runtime-contracts";
+import { type ProcessOutputRead } from "./process-manager.ts";
+import type { AttachFence } from "./attach-fencing.ts";
 import { type ProcessOutputReader, type ReadinessCheck, type ReadinessResult } from "./readiness.ts";
+import { type OrphanProtectionStatus } from "./orphan-reaper.ts";
 import type { ExecutionConfiguration } from "@descryy/runtime-contracts";
 export interface CreateExecutionInput {
     readonly application: string;
@@ -38,6 +41,7 @@ export interface RunOptions {
      * swallow its own failure" discipline `Collector` imposes on every callback here.
      */
     readonly onProcessLifecycleEvent?: (event: ProcessLifecycleEvent) => void;
+    readonly signal?: AbortSignal;
 }
 export interface ServiceStartResult {
     readonly serviceName: string;
@@ -95,8 +99,26 @@ export declare class ExecutionController {
     get serviceStartResults(): readonly ServiceStartResult[];
     /** Non-null only when `run()` refused before spawning anything. */
     get validationError(): string | null;
+    get timeoutNote(): string | null;
+    get orphanProtection(): OrphanProtectionStatus;
+    get lifecycleObserverErrors(): readonly string[];
+    get teardownErrors(): readonly string[];
     /** Combined stdout+stderr of the named service's process so far, or "" if it was never spawned. */
     readProcessOutput(serviceName: string): string;
+    readProcessOutputFrom(serviceName: string, cursor: number): ProcessOutputRead;
+    /**
+     * RT-N3's fence for the named service's process, or `null` for a spawned
+     * service (nothing predates observation) or one this controller never
+     * started. A caller building a live `ProcessOutputSource` over
+     * `readProcessOutput` needs this to mark pre-existing content instead of
+     * reporting it as freshly observed — see `attach-fencing.ts`'s own header.
+     * Bug found here: `runInstrumentedExecution` (`@descryy/runtime-orchestrator`)
+     * built its polling source with no way to reach the fence at all, so an
+     * attached service's whole pre-existing backlog — including a crash
+     * already in the log before this run ever attached — read as this run's
+     * own evidence. This getter is the seam that fix threads through.
+     */
+    attachFenceFor(serviceName: string): AttachFence | null;
     /**
      * Starts every service in dependency order, spawned (each on its own ephemeral
      * port unless fixed) or attached (`service.attach`, for an already-running
@@ -118,11 +140,11 @@ export declare class ExecutionController {
     run(options: RunOptions): Promise<Execution>;
     stop(): Promise<Execution>;
     /**
-     * Stop everything and record `TIMED_OUT` -- same transition `#onTimeout` makes,
+     * Stop everything and record `TIMED_OUT` -- same transition the internal timer makes,
      * for a caller that knows the budget expired before the internal timer noticed.
      *
      * **Why not `stop()`:** the orchestrator clamps its observation window to
-     * whatever's left of `timeoutMs`, making `TIMED_OUT` a race between `#onTimeout`
+     * whatever's left of `timeoutMs`, making `TIMED_OUT` a race between the internal timer
      * and `stop()` at the deadline -- measured: the same case reported `TIMED_OUT` at
      * 1534ms and `COMPLETED` at 1515ms. `execution.state` is what `observe_runtime`
      * reads to choose `ok` vs `timed_out`, so losing that race silently hides a real

package/dist/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAA6C,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAWhJ,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;KAAE,KAAK,SAAS,cAAc,EAAE,CAAC;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA6BD,MAAM,WAAW,UAAU;IACzB,2JAA2J;IAC3J,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC3E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACrI;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC9I;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9I,qBAAa,mBAAmB;;IAO9B,OAAO;IAIP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,mBAAmB;IAsB/D,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,iKAAiK;IACjK,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,mEAAmE;IACnE,IAAI,eAAe,IAAI,MAAM,GAAG,IAAI,CAEnC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IA2B9C;;;;;;;;;;;;;;;;;OAiBG;IACG,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAgQ5C,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAWhC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;IAS7B,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;CA6CnC"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../src/controller.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAkF,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9I,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAA6C,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAahJ,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;KAAE,KAAK,SAAS,cAAc,EAAE,CAAC;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA6BD,MAAM,WAAW,UAAU;IACzB,2JAA2J;IAC3J,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wIAAwI;IACxI,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACrI;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CAAE;AAC9I;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAU9I,qBAAa,mBAAmB;;IAa9B,OAAO;IAIP,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,mBAAmB;IAsB/D,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,iKAAiK;IACjK,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,mEAAmE;IACnE,IAAI,eAAe,IAAI,MAAM,GAAG,IAAI,CAEnC;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,IAAI,gBAAgB,IAAI,sBAAsB,CAE7C;IAED,IAAI,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAE/C;IAED,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAEtC;IAED,mGAAmG;IACnG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAI9C,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAS7E;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IA2BvD;;;;;;;;;;;;;;;;;OAiBG;IACG,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAgTlD,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAI1B;;;;;;;;;;;;;;OAcG;IACH,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;IAI7B,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;CA4E7B"}