@dsh-enhanced/assistant-isolation 0.1.30

package/lib/runtime-witness.js

@@ -0,0 +1,225 @@
+import { spawn } from 'node:child_process';
+import { constants, readFileSync } from 'node:fs';
+import { chmod, lstat, mkdtemp, open, readFile, realpath, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+const bootIdPattern = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
+const ticksPattern = /^[1-9][0-9]{0,63}$/;
+const engineIdPattern = /^[A-Za-z0-9:-]{1,256}$/;
+const pathMaximum = 4096;
+const defaultSocketPath = '/var/run/docker.sock';
+const defaultPidFile = '/run/docker.pid';
+const validPath = (value) => typeof value === 'string' && value.length > 0 && value.length <= pathMaximum && isAbsolute(value) && !/[\p{Cc}]/u.test(value);
+const validProcess = (value) => !!value && typeof value === 'object'
+    && Object.keys(value).length === 3 && typeof value.bootId === 'string' && bootIdPattern.test(value.bootId)
+    && Number.isSafeInteger(value.pid) && value.pid > 0
+    && typeof value.startTicks === 'string' && ticksPattern.test(value.startTicks);
+export function validateCreationWitness(value) {
+    if (!value || typeof value !== 'object' || ![2, 3, 4].includes(Object.keys(value).length) || Object.keys(value).some(key => !['daemon', 'supervisor', 'requestsSettled', 'binding'].includes(key)) || !validProcess(value.supervisor))
+        throw new TypeError('invalid creation witness');
+    const daemon = value.daemon;
+    if (!daemon || typeof daemon !== 'object' || Object.keys(daemon).length !== 5 || !validProcess(daemon.process)
+        || typeof daemon.engineId !== 'string' || !engineIdPattern.test(daemon.engineId)
+        || !validPath(daemon.dockerPath) || !validPath(daemon.socketPath) || !validPath(daemon.pidFile))
+        throw new TypeError('invalid creation witness');
+    if (daemon.process.bootId !== value.supervisor.bootId)
+        throw new TypeError('creation witness crosses boot generations');
+    const witness = value;
+    if (witness.requestsSettled !== undefined && typeof witness.requestsSettled !== 'boolean')
+        throw new TypeError('invalid settlement proof');
+    if (witness.binding !== undefined && (!witness.binding || Object.keys(witness.binding).length !== 3 || witness.binding.kind !== 'systemd'
+        || !/^[0-9a-f]{32}$/.test(witness.binding.serviceInvocationId) || !/^[0-9a-f]{32}$/.test(witness.binding.socketInvocationId)))
+        throw new TypeError('invalid daemon binding');
+    return { ...(witness.requestsSettled === undefined ? {} : { requestsSettled: witness.requestsSettled }),
+        ...(witness.binding === undefined ? {} : { binding: { ...witness.binding } }), daemon: { process: { ...daemon.process }, engineId: daemon.engineId, dockerPath: daemon.dockerPath, socketPath: daemon.socketPath, pidFile: daemon.pidFile }, supervisor: { ...value.supervisor } };
+}
+async function bootId() {
+    try {
+        const value = (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim().toLowerCase();
+        return bootIdPattern.test(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function proc(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return undefined;
+    try {
+        const [currentBootId, raw, metadata] = await Promise.all([bootId(), readFile(`/proc/${pid}/stat`, 'utf8'), stat(`/proc/${pid}`)]);
+        const close = raw.lastIndexOf(') ');
+        const opening = raw.indexOf('(');
+        if (!currentBootId || opening < 0 || close <= opening || !Number.isSafeInteger(metadata.uid))
+            return undefined;
+        const fields = raw.slice(close + 2).trim().split(/\s+/);
+        const startTicks = fields[19];
+        if (!startTicks || !ticksPattern.test(startTicks) || !fields[0])
+            return undefined;
+        return { bootId: currentBootId, pid, startTicks, comm: raw.slice(opening + 1, close), state: fields[0], uid: metadata.uid };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function processWitness(pid = process.pid) {
+    const value = await proc(pid);
+    return value ? { bootId: value.bootId, pid: value.pid, startTicks: value.startTicks } : undefined;
+}
+export function processExited(witness) {
+    if (!validProcess(witness))
+        return false;
+    let currentBootId;
+    try {
+        currentBootId = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim().toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    if (!bootIdPattern.test(currentBootId))
+        return false;
+    if (currentBootId !== witness.bootId)
+        return true;
+    try {
+        const raw = readFileSync(`/proc/${witness.pid}/stat`, 'utf8');
+        const close = raw.lastIndexOf(') ');
+        if (close < 0)
+            return false;
+        const fields = raw.slice(close + 2).trim().split(/\s+/);
+        // A zombie retains its proc entry; it is not proof that all waiters reaped it.
+        if (fields[0] === 'Z' || !fields[19] || !ticksPattern.test(fields[19]))
+            return false;
+        return fields[19] !== witness.startTicks;
+    }
+    catch (error) {
+        return !!error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
+    }
+}
+async function stablePidFile(path) {
+    if (!validPath(path))
+        return undefined;
+    try {
+        const canonical = await realpath(path);
+        if (!isAbsolute(canonical))
+            return undefined;
+        const handle = await open(canonical, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const before = await handle.stat();
+            if (!before.isFile() || before.nlink !== 1 || (before.mode & 0o022) !== 0 || (before.uid !== 0 && before.uid !== process.getuid?.()) || before.size < 1 || before.size >= 64)
+                return undefined;
+            const bytes = Buffer.alloc(64);
+            const read = await handle.read(bytes, 0, bytes.length, 0);
+            const after = await handle.stat();
+            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+                return undefined;
+            const text = bytes.subarray(0, read.bytesRead).toString('ascii').trim();
+            if (!/^[1-9][0-9]{0,15}$/.test(text))
+                return undefined;
+            const pid = Number(text);
+            return Number.isSafeInteger(pid) && pid > 0 ? { path: canonical, pid, uid: before.uid, dev: before.dev, ino: before.ino } : undefined;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+async function canonicalSocket(path) {
+    if (!validPath(path))
+        return undefined;
+    try {
+        const canonical = await realpath(path);
+        const info = await lstat(canonical);
+        return isAbsolute(canonical) && info.isSocket() ? { path: canonical, dev: info.dev, ino: info.ino } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function canonicalExecutable(path) {
+    if (!validPath(path))
+        return undefined;
+    try {
+        const canonical = await realpath(path);
+        const info = await stat(canonical);
+        return isAbsolute(canonical) && info.isFile() && (info.mode & 0o111) !== 0 ? canonical : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function engineId(dockerPath, socketPath) {
+    let directory;
+    try {
+        directory = await mkdtemp(join(tmpdir(), 'dsh-isolation-docker-'));
+        await chmod(directory, 0o700);
+        return await new Promise(resolve => {
+            let output = Buffer.alloc(0);
+            let done = false;
+            const finish = (value) => { if (done)
+                return; done = true; clearTimeout(timer); resolve(value); };
+            const child = spawn(dockerPath, ['--config', directory, '-H', `unix://${socketPath}`, 'info', '--format', '{{.ID}}'], { shell: false, env: { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }, stdio: ['ignore', 'pipe', 'ignore'] });
+            const timer = setTimeout(() => { child.kill('SIGKILL'); finish(undefined); }, 5_000);
+            timer.unref();
+            child.stdout.on('data', (chunk) => { if (output.length + chunk.length > 4096) {
+                child.kill('SIGKILL');
+                finish(undefined);
+            }
+            else
+                output = Buffer.concat([output, chunk]); });
+            child.once('error', () => finish(undefined));
+            child.once('close', code => { const value = output.toString('utf8').trim(); finish(code === 0 && engineIdPattern.test(value) ? value : undefined); });
+        });
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (directory !== undefined)
+            await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+export async function captureDaemonWitness({ dockerPath, socketPath = defaultSocketPath, pidFile = defaultPidFile }) {
+    const [executable, socket, pid] = await Promise.all([canonicalExecutable(dockerPath), canonicalSocket(socketPath), stablePidFile(pidFile)]);
+    if (!executable || !socket || !pid)
+        return undefined;
+    const first = await proc(pid.pid);
+    if (!first || first.comm !== 'dockerd' || first.uid !== pid.uid || first.state === 'Z')
+        return undefined;
+    const id = await engineId(executable, socket.path);
+    const [recheckedPid, recheckedSocket] = await Promise.all([stablePidFile(pidFile), canonicalSocket(socketPath)]);
+    const second = await proc(pid.pid);
+    if (!id || !recheckedPid || !recheckedSocket || recheckedPid.path !== pid.path || recheckedPid.dev !== pid.dev || recheckedPid.ino !== pid.ino || recheckedPid.pid !== pid.pid || recheckedPid.uid !== pid.uid
+        || recheckedSocket.path !== socket.path || recheckedSocket.dev !== socket.dev || recheckedSocket.ino !== socket.ino
+        || !second || second.comm !== 'dockerd' || second.uid !== pid.uid || second.state === 'Z' || first.bootId !== second.bootId || first.startTicks !== second.startTicks)
+        return undefined;
+    return { process: { bootId: second.bootId, pid: second.pid, startTicks: second.startTicks }, engineId: id, dockerPath: executable, socketPath: socket.path, pidFile: pid.path };
+}
+function validDaemon(value) {
+    return !!value && typeof value === 'object' && Object.keys(value).length === 5 && validProcess(value.process)
+        && typeof value.engineId === 'string' && engineIdPattern.test(value.engineId)
+        && validPath(value.dockerPath) && validPath(value.socketPath) && validPath(value.pidFile);
+}
+export function sameDaemonWitness(a, b) {
+    if (!validDaemon(a) || !validDaemon(b))
+        return false;
+    return a.process.bootId === b.process.bootId && a.process.pid === b.process.pid && a.process.startTicks === b.process.startTicks && a.engineId === b.engineId && a.dockerPath === b.dockerPath && a.socketPath === b.socketPath && a.pidFile === b.pidFile;
+}
+/** Diagnostic candidate only: does not prove socket ownership or authorize quota release. */
+export async function eligibleRestartWitness(original) {
+    let value;
+    try {
+        value = validateCreationWitness(original);
+    }
+    catch {
+        return undefined;
+    }
+    if (!processExited(value.supervisor) || !processExited(value.daemon.process))
+        return undefined;
+    const current = await captureDaemonWitness({ dockerPath: value.daemon.dockerPath, socketPath: value.daemon.socketPath, pidFile: value.daemon.pidFile });
+    if (!current || current.engineId !== value.daemon.engineId || current.dockerPath !== value.daemon.dockerPath || current.socketPath !== value.daemon.socketPath || current.pidFile !== value.daemon.pidFile)
+        return undefined;
+    return current.process.bootId === value.daemon.process.bootId && current.process.pid === value.daemon.process.pid && current.process.startTicks === value.daemon.process.startTicks ? undefined : current;
+}
+//# sourceMappingURL=runtime-witness.js.map

package/lib/runtime-witness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-witness.js","sourceRoot":"","sources":["../src/runtime-witness.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAY5C,MAAM,aAAa,GAAG,+CAA+C,CAAA;AACrE,MAAM,YAAY,GAAG,oBAAoB,CAAA;AACzC,MAAM,eAAe,GAAG,wBAAwB,CAAA;AAChD,MAAM,WAAW,GAAG,IAAI,CAAA;AACxB,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAChD,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAExC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpL,MAAM,YAAY,GAAG,CAAC,KAAc,EAA2B,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;OACjG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAQ,KAAwB,CAAC,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAE,KAAwB,CAAC,MAAM,CAAC;OAC/I,MAAM,CAAC,aAAa,CAAE,KAAwB,CAAC,GAAG,CAAC,IAAK,KAAwB,CAAC,GAAG,GAAG,CAAC;OACxF,OAAQ,KAAwB,CAAC,UAAU,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAE,KAAwB,CAAC,UAAU,CAAC,CAAA;AAExH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAE,KAAyB,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAC3S,MAAM,MAAM,GAAI,KAAyB,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;WACzG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC7E,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAClJ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAM,KAAyB,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAC5I,MAAM,OAAO,GAAG,KAAwB,CAAA;IACxC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAA;IAC1I,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;WACpI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAA;IAC9K,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrG,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAI,KAAyB,CAAC,UAAU,EAAE,EAAE,CAAA;AAC3S,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QAAC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAAC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACzL,CAAC;AAGD,KAAK,UAAU,IAAI,CAAC,GAAW;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,IAAI,CAAC;QACH,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QACjI,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9G,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACjF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC7H,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9F,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,aAAa,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvD,+EAA+E;QAC/E,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpF,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,CAAA;IAClH,CAAC;AACH,CAAC;AAGD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QACtG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAA;YAC9L,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACjC,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAChL,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;YACvE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAA;YACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YACxB,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACvI,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AAC9B,CAAC;AAGD,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QAAC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACjO,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,CAAC;QAAC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AACnN,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAAkB;IAC5D,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACjG,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YACjC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,KAAK,CAAA;YAC9C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAQ,EAAE,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAA;YAC1H,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,SAAU,EAAE,IAAI,EAAE,UAAU,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;YACzP,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAClG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;;gBAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAClL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;YAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACtJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;AACpJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,iBAAiB,EAAE,OAAO,GAAG,cAAc,EAAiE;IAChL,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3I,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACxG,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAChH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe,IAAI,YAAY,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;WACzM,eAAe,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;WAChH,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACzL,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;AACjL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAE,KAAuB,CAAC,OAAO,CAAC;WAC3H,OAAQ,KAAuB,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAE,KAAuB,CAAC,QAAQ,CAAC;WAChH,SAAS,CAAE,KAAuB,CAAC,UAAU,CAAC,IAAI,SAAS,CAAE,KAAuB,CAAC,UAAU,CAAC,IAAI,SAAS,CAAE,KAAuB,CAAC,OAAO,CAAC,CAAA;AACtJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAgB,EAAE,CAAgB;IAClE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAA;AAC5P,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAyB;IACpE,IAAI,KAAsB,CAAA;IAC1B,IAAI,CAAC;QAAC,KAAK,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;IAC5E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACvJ,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC5N,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;AAC3M,CAAC"}

package/lib/service.d.ts

@@ -0,0 +1,47 @@
+import { type GoalArtifactAdmission, type TaskAcceptanceContract } from '@dsh-enhanced/task-acceptance-contract';
+import { Service, type Context } from '@deepseek-ai/cordis';
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { Config } from './config.js';
+import type { IsolationRequest, IsolationResult } from './types.js';
+export { Config };
+export declare const isolationPrincipalDigest: (principal: string) => string;
+export interface IsolationGrantDiscovery {
+    readonly id: string;
+    readonly expiresAt: number;
+    readonly remainingRuns: number;
+    readonly remainingDurationMs: number;
+    readonly limits: Readonly<{
+        maxDurationMs: number;
+        maxInputBytes: number;
+        maxOutputBytes: number;
+        maxArtifactBytes: number;
+        maxFiles: number;
+    }>;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        assistantIsolation: AssistantIsolationService;
+    }
+}
+/** Trusted Host broker. Only bounded input copies cross into the job-specific Docker volume. */
+export declare class AssistantIsolationService extends Service {
+    #private;
+    static Config: import("@deepseek-ai/schemastery").default<Config>;
+    constructor(ctx: Context, input?: Config);
+    /** Model-visible read-only discovery for grants already authorized to this exact live owner scope. */
+    discover: (agent: Agent | undefined) => Promise<readonly IsolationGrantDiscovery[]>;
+    /** Private Host readback; never exposed as a model tool or filesystem path. */
+    readAcceptedArtifact: (input: TaskAcceptanceContract, path: string) => Readonly<{
+        jobId: string;
+        requestDigest: string;
+        admission: GoalArtifactAdmission;
+        path: string;
+        content: string;
+        sha256: string;
+    }>;
+    /** Only the trusted registered isolation tool may skip a redundant risk prompt. */
+    preauthorize: (execution: ToolExecution) => boolean;
+    run: (agent: Agent | undefined, input: IsolationRequest, signal: AbortSignal) => Promise<IsolationResult>;
+}
+//# sourceMappingURL=service.d.ts.map

package/lib/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AAC/K,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AASnD,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAA;AAQpD,OAAO,KAAK,EAAmC,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAGpG,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,eAAO,MAAM,wBAAwB,GAAI,WAAW,MAAM,KAAG,MAA8D,CAAA;AAC3H,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACrH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChJ;AAQD,OAAO,QAAQ,qBAAqB,CAAC;IAAE,UAAU,OAAO;QAAG,kBAAkB,EAAE,yBAAyB,CAAA;KAAE;CAAE;AAE5G,gGAAgG;AAChG,qBAAa,yBAA0B,SAAQ,OAAO;;IACpD,MAAM,CAAC,MAAM,qDAAS;gBAcV,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW;IAgG5C,sGAAsG;IACtG,QAAQ,GAAU,OAAO,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAiBvF;IAwBD,+EAA+E;IAC/E,oBAAoB,GAAI,OAAO,sBAAsB,EAAE,MAAM,MAAM;;;;;;;OAelE;IAED,mFAAmF;IACnF,YAAY,GAAI,WAAW,aAAa,KAAG,OAAO,CAWjD;IAED,GAAG,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,gBAAgB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CA0C7G;CAkDF"}