@descryy/runtime-orchestrator 0.4.9 → 0.4.11

package/dist/cgroup-partial-restriction.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Partial going-forward resource restriction for an already-running, attached-to
+ * process, via cgroups v2 — narrower alternative to `respawn-and-supervise.ts`.
+ *
+ * Moving a live pid into a delegated cgroup applies real kernel-enforced limits
+ * (`memory.max`, `cpu.max`, `pids.max`) without killing/restarting it. **It does
+ * NOT and cannot give filesystem or network isolation** — that needs `setns()`
+ * against a live pid, out of scope here. `CGROUP_PARTIAL_RESTRICTION_SCOPE` is the
+ * literal string every result carries so nothing downstream rounds this up to
+ * "sandboxed"/"isolated" (which would misrepresent it as `sandbox.ts`'s real
+ * spawn-time bwrap isolation).
+ *
+ * Finding the delegated ancestor: a non-root user can only write under
+ * `/sys/fs/cgroup` where a systemd user session delegates it (`Delegate=yes`).
+ * Delegation isn't uniform all the way down — a leaf cgroup already holding a
+ * process (e.g. this Node process's own scope) generally can't extend
+ * `subtree_control` further; writing fails `EBUSY` (measured on this repo's dev
+ * host). So `findDelegatedCgroupAncestor` doesn't trust subtree_control text or
+ * permission bits — it walks up from `/proc/self/cgroup` and, at each ancestor,
+ * creates a real temporary probe child and checks whether the kernel actually gave
+ * it a `memory.max` file.
+ */
+import type { CapabilityStatus } from "@descryy/runtime-contracts";
+/** Literal scope string every `CgroupMoveResult` carries under `scope` — never restated by hand, so quotes of it can't drift. */
+export declare const CGROUP_PARTIAL_RESTRICTION_SCOPE: "partial -- resource limits only, no filesystem or network isolation";
+/**
+ * Walks up from this process's cgroup toward `/sys/fs/cgroup`, returning the
+ * deepest ancestor whose children genuinely get a real `memory.max` — the actual
+ * delegation boundary. `null` if cgroups v2 isn't mounted, own path can't be
+ * determined, or no ancestor passes the probe.
+ */
+export declare function findDelegatedCgroupAncestor(): string | null;
+export declare function cgroupV2Capability(): CapabilityStatus;
+export interface CgroupResourceLimits {
+    /**
+     * Maps to cgroups v2 `memory.max`, in bytes. Also writes `memory.swap.max=0` for
+     * the same cgroup — measured: with swap available, `memory.max` alone doesn't
+     * kill anything, it just pushes pages to swap under pressure. Disabling swap is
+     * what makes it a hard, OOM-killer-enforced limit rather than a soft one. Not
+     * independently toggleable — "cap it but let it swap" would be a separate field.
+     */
+    readonly memoryMaxBytes?: number;
+    /** Maps to cgroups v2 `pids.max` -- caps tasks (processes/threads) this cgroup may hold. */
+    readonly maxProcesses?: number;
+    /**
+     * Raw cgroups v2 `cpu.max` value (`"$MAX $PERIOD"`, e.g. `"50000 100000"` for
+     * 50% of one CPU). Throws rather than silently dropping if the delegated
+     * ancestor has no writable `cpu.max` — measured on this repo's dev host: `cpu`
+     * was NOT delegated at the same level `memory`/`pids` were.
+     */
+    readonly cpuMax?: string;
+}
+export interface CgroupMoveResult {
+    readonly applied: true;
+    readonly cgroupPath: string;
+    /** Always the literal `CGROUP_PARTIAL_RESTRICTION_SCOPE` string. */
+    readonly scope: typeof CGROUP_PARTIAL_RESTRICTION_SCOPE;
+    readonly appliedLimits: CgroupResourceLimits;
+    /**
+     * Best-effort removal of the cgroup this call created. Succeeds only once
+     * `cgroup.procs` is empty (pid exited or moved elsewhere) -- cgroups v2 refuses
+     * to remove a non-empty cgroup. Returns whether removal happened; never throws.
+     */
+    readonly release: () => boolean;
+}
+/**
+ * Moves `options.pid` (a process this runtime did not spawn) into a newly created,
+ * resource-limited cgroup. Throws if the target isn't alive, `cgroupV2Capability()`
+ * is unavailable, or a declared limit's controller file doesn't exist.
+ *
+ * Limits are written before the pid is moved in, so a process is never observed
+ * with a half-applied limit set; on any write failure the still-empty cgroup is
+ * removed and the error rethrown, never left orphaned.
+ */
+export declare function moveProcessIntoRestrictedCgroup(options: {
+    readonly pid: number;
+    readonly limits: CgroupResourceLimits;
+    readonly nameHint?: string;
+}): CgroupMoveResult;
+//# sourceMappingURL=cgroup-partial-restriction.d.ts.map

package/dist/cgroup-partial-restriction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cgroup-partial-restriction.d.ts","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,iIAAiI;AACjI,eAAO,MAAM,gCAAgC,EAAG,qEAA8E,CAAC;AA2C/H;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAED,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkBrD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,gBAAgB,CAsEnB"}

package/dist/cgroup-partial-restriction.js

@@ -0,0 +1,189 @@
+/**
+ * Partial going-forward resource restriction for an already-running, attached-to
+ * process, via cgroups v2 — narrower alternative to `respawn-and-supervise.ts`.
+ *
+ * Moving a live pid into a delegated cgroup applies real kernel-enforced limits
+ * (`memory.max`, `cpu.max`, `pids.max`) without killing/restarting it. **It does
+ * NOT and cannot give filesystem or network isolation** — that needs `setns()`
+ * against a live pid, out of scope here. `CGROUP_PARTIAL_RESTRICTION_SCOPE` is the
+ * literal string every result carries so nothing downstream rounds this up to
+ * "sandboxed"/"isolated" (which would misrepresent it as `sandbox.ts`'s real
+ * spawn-time bwrap isolation).
+ *
+ * Finding the delegated ancestor: a non-root user can only write under
+ * `/sys/fs/cgroup` where a systemd user session delegates it (`Delegate=yes`).
+ * Delegation isn't uniform all the way down — a leaf cgroup already holding a
+ * process (e.g. this Node process's own scope) generally can't extend
+ * `subtree_control` further; writing fails `EBUSY` (measured on this repo's dev
+ * host). So `findDelegatedCgroupAncestor` doesn't trust subtree_control text or
+ * permission bits — it walks up from `/proc/self/cgroup` and, at each ancestor,
+ * creates a real temporary probe child and checks whether the kernel actually gave
+ * it a `memory.max` file.
+ */
+import { existsSync, mkdirSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isProcessAlive } from "./attach-to-running-process.js";
+const CGROUP_ROOT = "/sys/fs/cgroup";
+/** Literal scope string every `CgroupMoveResult` carries under `scope` — never restated by hand, so quotes of it can't drift. */
+export const CGROUP_PARTIAL_RESTRICTION_SCOPE = "partial -- resource limits only, no filesystem or network isolation";
+function ownUnifiedCgroupPath() {
+    let content;
+    try {
+        content = readFileSync("/proc/self/cgroup", "utf8");
+    }
+    catch {
+        return null;
+    }
+    for (const line of content.trim().split("\n")) {
+        // unified-hierarchy lines read "0::<path>"; only the "0::" line matters here
+        const firstColon = line.indexOf(":");
+        const secondColon = line.indexOf(":", firstColon + 1);
+        if (firstColon === -1 || secondColon === -1)
+            continue;
+        if (line.slice(0, firstColon) === "0" && firstColon + 1 === secondColon) {
+            return line.slice(secondColon + 1);
+        }
+    }
+    return null;
+}
+/**
+ * Real empirical probe, not a permission-bit read — a directory can be
+ * `mkdir`-able yet its child still lack `memory.max` if the controller was never
+ * enabled in `subtree_control` (this process's own leaf scope is exactly this
+ * shape, measured directly).
+ */
+function probeControllableChild(candidateDir) {
+    const probe = join(candidateDir, `.descry-cgroup-probe-${String(process.pid)}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`);
+    try {
+        mkdirSync(probe);
+    }
+    catch {
+        return false;
+    }
+    const controllable = existsSync(join(probe, "memory.max"));
+    try {
+        rmdirSync(probe);
+    }
+    catch {
+        // best-effort cleanup; not our problem if something raced to touch it first
+    }
+    return controllable;
+}
+/**
+ * Walks up from this process's cgroup toward `/sys/fs/cgroup`, returning the
+ * deepest ancestor whose children genuinely get a real `memory.max` — the actual
+ * delegation boundary. `null` if cgroups v2 isn't mounted, own path can't be
+ * determined, or no ancestor passes the probe.
+ */
+export function findDelegatedCgroupAncestor() {
+    if (process.platform !== "linux")
+        return null;
+    if (!existsSync(join(CGROUP_ROOT, "cgroup.controllers")))
+        return null;
+    const ownPath = ownUnifiedCgroupPath();
+    if (ownPath === null)
+        return null;
+    let dir = join(CGROUP_ROOT, ownPath.replace(/^\/+/, ""));
+    // never test CGROUP_ROOT itself: root-wide limits are root-only anyway
+    while (dir !== CGROUP_ROOT && dirname(dir) !== dir) {
+        if (existsSync(dir) && probeControllableChild(dir))
+            return dir;
+        dir = dirname(dir);
+    }
+    return null;
+}
+export function cgroupV2Capability() {
+    if (process.platform !== "linux") {
+        return { availability: "unavailable", reason: `cgroups v2 resource-limit move is Linux-only; not available on "${process.platform}"` };
+    }
+    if (!existsSync(join(CGROUP_ROOT, "cgroup.controllers"))) {
+        return { availability: "unavailable", reason: `${CGROUP_ROOT} has no cgroup.controllers file -- this host is not using the cgroups v2 unified hierarchy` };
+    }
+    const ancestor = findDelegatedCgroupAncestor();
+    if (ancestor === null) {
+        return {
+            availability: "unavailable",
+            reason: "cgroups v2 is mounted, but no writable, controller-delegated cgroup ancestor was found for this process -- commonly means this " +
+                "process is not running under a systemd user session with delegation (Delegate=yes on user@<uid>.service), or is running as a " +
+                "user with no cgroup delegation anywhere in its own ancestry. Refusing rather than silently doing nothing.",
+        };
+    }
+    return { availability: "available", reason: null };
+}
+/**
+ * Moves `options.pid` (a process this runtime did not spawn) into a newly created,
+ * resource-limited cgroup. Throws if the target isn't alive, `cgroupV2Capability()`
+ * is unavailable, or a declared limit's controller file doesn't exist.
+ *
+ * Limits are written before the pid is moved in, so a process is never observed
+ * with a half-applied limit set; on any write failure the still-empty cgroup is
+ * removed and the error rethrown, never left orphaned.
+ */
+export function moveProcessIntoRestrictedCgroup(options) {
+    if (!isProcessAlive(options.pid)) {
+        throw new Error(`moveProcessIntoRestrictedCgroup: pid ${String(options.pid)} is not running -- cannot move a target that does not exist.`);
+    }
+    const capability = cgroupV2Capability();
+    if (capability.availability !== "available") {
+        throw new Error(`moveProcessIntoRestrictedCgroup: cannot apply -- ${capability.reason}`);
+    }
+    const ancestor = findDelegatedCgroupAncestor();
+    if (ancestor === null) {
+        // unreachable given availability check above; narrows the type honestly
+        throw new Error("moveProcessIntoRestrictedCgroup: no delegated cgroup ancestor found despite capability reporting available -- internal inconsistency.");
+    }
+    const cgroupPath = join(ancestor, `descry-restrict-${options.nameHint ?? String(options.pid)}-${String(Date.now())}`);
+    mkdirSync(cgroupPath);
+    try {
+        if (options.limits.cpuMax !== undefined && !existsSync(join(cgroupPath, "cpu.max"))) {
+            throw new Error(`cpuMax was requested but the delegated cgroup ancestor (${ancestor}) does not expose a writable cpu.max to its children on this host -- ` +
+                "refusing rather than silently ignoring the limit.");
+        }
+        if (options.limits.memoryMaxBytes !== undefined) {
+            writeFileSync(join(cgroupPath, "memory.max"), String(options.limits.memoryMaxBytes));
+            // see memoryMaxBytes doc: without this, swap makes memory.max a soft limit.
+            // best-effort -- no memory.swap.max file (swap accounting disabled/not
+            // delegated) still gets a real memory.max, just without this hardening
+            try {
+                writeFileSync(join(cgroupPath, "memory.swap.max"), "0");
+            }
+            catch {
+                // disclosed above, not pretended to have succeeded
+            }
+        }
+        if (options.limits.maxProcesses !== undefined) {
+            writeFileSync(join(cgroupPath, "pids.max"), String(options.limits.maxProcesses));
+        }
+        if (options.limits.cpuMax !== undefined) {
+            writeFileSync(join(cgroupPath, "cpu.max"), options.limits.cpuMax);
+        }
+        // moved last, only once every requested limit is confirmed written
+        writeFileSync(join(cgroupPath, "cgroup.procs"), String(options.pid));
+    }
+    catch (error) {
+        try {
+            rmdirSync(cgroupPath);
+        }
+        catch {
+            // best-effort: if the pid was already moved in, the dir is non-empty
+            // and can't be removed
+        }
+        throw new Error(`moveProcessIntoRestrictedCgroup: failed to apply limits or move pid ${String(options.pid)} into ${cgroupPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        applied: true,
+        cgroupPath,
+        scope: CGROUP_PARTIAL_RESTRICTION_SCOPE,
+        appliedLimits: options.limits,
+        release: () => {
+            try {
+                rmdirSync(cgroupPath);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=cgroup-partial-restriction.js.map

package/dist/cgroup-partial-restriction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cgroup-partial-restriction.js","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,iIAAiI;AACjI,MAAM,CAAC,MAAM,gCAAgC,GAAG,qEAA8E,CAAC;AAE/H,SAAS,oBAAoB;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,UAAU,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/D,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,mEAAmE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,4FAA4F,EAAE,CAAC;IAC7J,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EACJ,iIAAiI;gBACjI,+HAA+H;gBAC/H,2GAA2G;SAC9G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAoCD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC7I,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtH,SAAS,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,uEAAuE;gBACxI,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,4EAA4E;YAC5E,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,mEAAmE;QACnE,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uBAAuB;QACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU;QACV,KAAK,EAAE,gCAAgC;QACvC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/collector-version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
+ * before any collector ran). Reads `package.json` directly so it can't drift from
+ * what shipped, same approach as `nodeVersion`'s use of `process.version`.
+ */
+export declare const COLLECTOR_VERSION: string;
+//# sourceMappingURL=collector-version.d.ts.map

package/dist/collector-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-version.d.ts","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,eAAO,MAAM,iBAAiB,EAAE,MAA6E,CAAC"}

package/dist/collector-version.js

@@ -0,0 +1,9 @@
+/**
+ * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
+ * before any collector ran). Reads `package.json` directly so it can't drift from
+ * what shipped, same approach as `nodeVersion`'s use of `process.version`.
+ */
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+export const COLLECTOR_VERSION = require("../package.json").version;
+//# sourceMappingURL=collector-version.js.map

package/dist/collector-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-version.js","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAkC,CAAC,OAAO,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export type { PollingProcessOutputSourceOptions } from "./polling-output-source.ts";
+export { createPollingProcessOutputSource } from "./polling-output-source.ts";
+export type { AttachToRunningProcessOptions, AttachedProcessOutputSource } from "./attach-to-running-process.ts";
+export { attachToRunningProcess, isProcessAlive } from "./attach-to-running-process.ts";
+export type { AttachToRunningNodeProcessOptions } from "./attach-to-running-node-process.ts";
+export { attachToRunningNodeProcess, discoverNodeInspectorUrl } from "./attach-to-running-node-process.ts";
+export type { CdpSession } from "./cdp-client.ts";
+export { connectCdp } from "./cdp-client.ts";
+export type { AttachToRunningJvmProcessOptions } from "./attach-to-running-jvm-process.ts";
+export { attachToRunningJvmProcess } from "./attach-to-running-jvm-process.ts";
+export type { RespawnCommand, RespawnCommandSource, RespawnAndSuperviseOptions, RespawnAndSuperviseResult, } from "./respawn-and-supervise.ts";
+export { respawnAndSupervise, inferRespawnCommandFromProc } from "./respawn-and-supervise.ts";
+export type { CgroupResourceLimits, CgroupMoveResult, } from "./cgroup-partial-restriction.ts";
+export { CGROUP_PARTIAL_RESTRICTION_SCOPE, cgroupV2Capability, findDelegatedCgroupAncestor, moveProcessIntoRestrictedCgroup, } from "./cgroup-partial-restriction.ts";
+export type { InstrumentedExecutionInput, InstrumentedExecutionResult, ExecutionBudgetOutcome } from "./instrumented-execution.ts";
+export { runInstrumentedExecution, createSourceRootResolver, applyOutboundLaunch } from "./instrumented-execution.ts";
+export type { BackendObservationMechanism, RunRemoteLogObservationInput, RunRemoteLogObservationResult, } from "./profile-backend-observation.ts";
+export { backendObservationMechanismFor, runRemoteLogObservation } from "./profile-backend-observation.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACjH,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC3G,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC9F,YAAY,EACV,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnI,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtH,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+export { createPollingProcessOutputSource } from "./polling-output-source.js";
+export { attachToRunningProcess, isProcessAlive } from "./attach-to-running-process.js";
+export { attachToRunningNodeProcess, discoverNodeInspectorUrl } from "./attach-to-running-node-process.js";
+export { connectCdp } from "./cdp-client.js";
+export { attachToRunningJvmProcess } from "./attach-to-running-jvm-process.js";
+export { respawnAndSupervise, inferRespawnCommandFromProc } from "./respawn-and-supervise.js";
+export { CGROUP_PARTIAL_RESTRICTION_SCOPE, cgroupV2Capability, findDelegatedCgroupAncestor, moveProcessIntoRestrictedCgroup, } from "./cgroup-partial-restriction.js";
+export { runInstrumentedExecution, createSourceRootResolver, applyOutboundLaunch } from "./instrumented-execution.js";
+export { backendObservationMechanismFor, runRemoteLogObservation } from "./profile-backend-observation.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAExF,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAO/E,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAK9F,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMtH,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/instrumented-execution.d.ts

@@ -0,0 +1,136 @@
+/**
+ * The assembly wiring the runtime's pieces together in production code (previously
+ * only connected ad hoc by tests). Runs an `ExecutionController` over a `services`
+ * configuration; wraps each spawned process in a live `ProcessOutputSource`
+ * (polls the buffer, yields each line once); builds a `CollectorContext` with a
+ * real `resolveSourceRoot` closed over the execution's own processes; starts,
+ * drains and stops the adapter's collectors; writes every emitted item through
+ * `EvidenceStore` so redaction runs (plan §28).
+ *
+ * Deliberately does not decide whether a finding exists, correlate to graph
+ * nodes, or drive a browser — separate stages, separate contracts.
+ */
+import type { Evidence, Execution, ExecutionConfiguration, ProcessHandle, ServiceRootLookup } from "@descryy/runtime-contracts";
+import type { RuntimeAdapter, OutboundHttpLaunch } from "@descryy/runtime-backend-observation";
+import { type CreateExecutionInput, type RunOptions, type PreflightCheckSpec } from "@descryy/runtime-controller";
+import { EvidenceStore } from "@descryy/runtime-evidence-store";
+export interface InstrumentedExecutionInput {
+    /** Carries the `ExecutionConfiguration` itself — the controller's own input shape, not a parallel copy that could drift from it. */
+    readonly execution: CreateExecutionInput;
+    readonly runOptions: RunOptions;
+    /** Supplies the collectors. One adapter per execution: a run observes one backend runtime. */
+    readonly adapter: RuntimeAdapter;
+    /** Where evidence is written. Provided rather than constructed so a caller owns the database's lifetime and its redaction policy. */
+    readonly store: EvidenceStore;
+    /**
+     * How long to keep draining collector output after the services are up.
+     * There is no "the application is done" signal at this layer — a server
+     * runs until stopped — so the caller states how long the observation
+     * window is rather than this module guessing.
+     */
+    readonly observeForMs: number;
+    /**
+     * Opt-in, per service name: front that service with `InboundProxy` (RT-192,
+     * DEC-271) once its own readiness has already succeeded — reads the answer
+     * `controller.run()` already produced (`serviceStartResults`), never re-asks.
+     * Absent or unnamed service: unchanged behaviour, no proxy.
+     *
+     * Does not close any per-language "HTTP observation" checklist row — those use
+     * self-initiated fixtures with no separate public port for a proxy to front.
+     * This only makes `InboundProxy` available for a future externally-driven
+     * scenario.
+     */
+    readonly frontWithInboundProxy?: Readonly<Record<string, boolean>>;
+    /**
+     * Fires once every collector (including any fronting proxy) has started, before
+     * the observation window's sleep. Lets a caller drive real traffic through a
+     * just-started proxy while it's still alive — `InstrumentedExecutionResult` is
+     * only returned after the run has stopped everything, too late for that. A
+     * throwing callback is not caught here.
+     */
+    readonly onReady?: (info: {
+        readonly execution: Execution;
+        /** Service name → the proxy's own bound port, for every service that was both flagged AND successfully fronted. */
+        readonly proxyPorts: Readonly<Record<string, number>>;
+    }) => void | Promise<void>;
+    readonly extraPreflightChecks?: readonly PreflightCheckSpec[];
+}
+export interface InstrumentedExecutionResult {
+    readonly execution: Execution;
+    readonly evidence: readonly Evidence[];
+    /** Every collector's own report of what it could do, after the run — not what it claimed at construction. */
+    readonly collectorCapabilities: readonly {
+        readonly collectorId: string;
+        readonly capabilities: ReturnType<import("@descryy/runtime-contracts").Collector["capabilities"]>;
+    }[];
+    /** Set when `run()` refused before spawning anything. Evidence is empty and that is a refusal, not an absence of failures. */
+    readonly validationError: string | null;
+    /**
+     * What the declared whole-execution budget actually did to this run.
+     *
+     * `timeoutMs` used to bound only the service, not the observation window: a
+     * 1500ms budget with a 12000ms window measurably returned after 12288ms with
+     * zero evidence, since services had been dead for the last 10.8s. Reported as a
+     * struct so a caller can tell a full window that found nothing from one cut
+     * short before it could.
+     */
+    readonly budget: ExecutionBudgetOutcome;
+    /**
+     * Service name → the combined stdout+stderr that service produced.
+     *
+     * The controller has always captured this and exposed it
+     * (`ExecutionController.readProcessOutput`); it was used only for readiness
+     * polling and never left this function, so a caller got
+     * `processes[].exitCode` and nothing about *why*. An exit code alone can
+     * actively mislead — `prlimit`, which wraps every sandboxed spawn, exits 126
+     * for "found but not executable" and writes the reason to stderr, and 126 has
+     * already been misread once as a nested-sandbox failure (bwrap exits 1 for
+     * every namespace failure, so it never means that).
+     *
+     * **A missing key and an empty string are different claims.** Present-and-
+     * empty is "this ran and said nothing"; absent is "no process was attributed
+     * to this service at all". Collapsing them loses the distinction for good.
+     *
+     * **RT-261 update — no longer whole.** Backed by `ManagedProcess.readOutput()`,
+     * which now holds head+tail per service (`OUTPUT_HEAD_BYTES`/`OUTPUT_TAIL_BYTES`
+     * in `@descryy/runtime-controller`'s `process-manager.ts`), not the full
+     * accumulated buffer -- a chatty service no longer grows Descry's own memory
+     * without bound. When a service's real output exceeded that bound, the
+     * string itself carries one inline marker naming how many bytes were
+     * dropped and the real total, so the cut is visible in the text a reader
+     * already has, not only in a structured field alongside it.
+     */
+    readonly serviceOutput: Readonly<Record<string, string>>;
+}
+/** See `InstrumentedExecutionResult.budget`. */
+export interface ExecutionBudgetOutcome {
+    /** `ExecutionConfiguration.timeoutMs`, verbatim. */
+    readonly declaredMs: number;
+    /** Wall-clock time this function actually took. */
+    readonly elapsedMs: number;
+    /** What `observeForMs` asked for. */
+    readonly requestedObservationMs: number;
+    /** What the budget left for it. Less than `requestedObservationMs` means the window was cut short. */
+    readonly observedForMs: number;
+    /** True when the run finished past its own deadline — teardown of real processes can overshoot even a bounded window. */
+    readonly exceeded: boolean;
+}
+/**
+ * Builds the origin → source-root lookup a collector reads through
+ * `CollectorContext.resolveSourceRoot`. Closes over the execution's own
+ * processes, which is what makes the port→service join possible at all — under
+ * ephemeral ports only the running process knows its own port.
+ */
+export declare function createSourceRootResolver(processes: readonly ProcessHandle[], configuration: ExecutionConfiguration): (origin: string) => ServiceRootLookup;
+/**
+ * Rewrites every spawnable service so it launches with outbound
+ * instrumentation in place.
+ *
+ * The declaration comes from the adapter and names no language; this function
+ * applies it and also names none. `attach`-mode services are skipped: their
+ * process is already running, so there is no launch left to influence, and
+ * pretending otherwise would claim instrumentation that is not there.
+ */
+export declare function applyOutboundLaunch(execution: CreateExecutionInput, launch: OutboundHttpLaunch): CreateExecutionInput;
+export declare function runInstrumentedExecution(input: InstrumentedExecutionInput): Promise<InstrumentedExecutionResult>;
+//# sourceMappingURL=instrumented-execution.d.ts.map

package/dist/instrumented-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumented-execution.d.ts","sourceRoot":"","sources":["../src/instrumented-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAEV,QAAQ,EACR,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAuB,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAGpH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAOf,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAKhE,MAAM,WAAW,0BAA0B;IACzC,oIAAoI;IACpI,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,mHAAmH;QACnH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACvD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/D;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,6GAA6G;IAC7G,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,4BAA4B,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/K,8HAA8H;IAC9H,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,aAAa,EAAE,sBAAsB,GACpC,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,EAC/B,MAAM,EAAE,kBAAkB,GACzB,oBAAoB,CAwBtB;AAgCD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA+nBtH"}