@dsh-enhanced/assistant-isolation 0.1.30

package/lib/service.js

@@ -0,0 +1,361 @@
+import { validateGoalArtifactAdmission, validateTaskAcceptanceContract } from '@dsh-enhanced/task-acceptance-contract';
+import { Service } from '@deepseek-ai/cordis';
+import { createHash, randomUUID } from 'node:crypto';
+import { chmodSync, lstatSync, mkdirSync, realpathSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { Config, validateConfig } from './config.js';
+import { IsolationLedger } from './ledger.js';
+import { removeIsolatedContainer, runIsolatedProcess } from './runner.js';
+import { reconcileUnknownJob } from './reconcile.js';
+import { normalizeRequest, stageWorkspace } from './workspace.js';
+import { registerIsolationTools } from './tools.js';
+import { plannedStorageBytes } from './storage-policy.js';
+import { maintainIsolationStorage, observeStorage } from './storage.js';
+import { inspectIsolationGrant } from './diagnostics.js';
+export { Config };
+export const isolationPrincipalDigest = (principal) => createHash('sha256').update(principal).digest('hex');
+const digest = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+// Keep prompt visibility and the Host execution guard on the exact same named surface.
+const isolatedScopeTools = new Set(['isolation_run', 'isolation_grants', 'goal_context', 'goal_checkpoint']);
+const preauthorizedScopedTools = new Set(['action_github_grants', 'action_github_deliver', 'action_github_delivery_status', 'action_github_commit', 'action_github_branch', 'action_github_pr', 'action_github_inspect', 'action_github_compensate', 'action_github_compensation_status', 'goal_create', 'goal_schedule', 'goal_strategy', 'goal_wait_event']);
+const isolatedPromptTools = new Set([...isolatedScopeTools, ...preauthorizedScopedTools]);
+const restrictedScopeSection = 'Environment capability constraint: this authenticated workspace uses isolated execution. Host filesystem and shell tools are unavailable. The user request and explicitly supplied inline files are the only starting material; do not look for a Host project, pre-existing task file, or Host path. isolation_run starts a fresh scratch workspace with no Host project mount and no network. isolation_grants can show an existing finite grant; it cannot create or extend one.';
+const controllerTtlMs = 30_000;
+/** Trusted Host broker. Only bounded input copies cross into the job-specific Docker volume. */
+export class AssistantIsolationService extends Service {
+    static Config = Config;
+    #config;
+    #ledger;
+    #authority;
+    #ready;
+    #jobs = new Map();
+    #recoveryAbort = new AbortController();
+    #sweep;
+    #cursor = '';
+    #storageCursor = '';
+    #lastMaintenance = 0;
+    #active = true;
+    #timer;
+    constructor(ctx, input = {}) {
+        super(ctx, 'assistantIsolation');
+        this.#config = validateConfig(input);
+        const root = this.#config.stateRoot;
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        if (realpathSync(root) !== root || !lstatSync(root).isDirectory() || lstatSync(root).uid !== process.getuid?.())
+            throw new Error('assistant-isolation: private owned state root required');
+        chmodSync(root, 0o700);
+        this.#ledger = new IsolationLedger(join(root, 'ledger.sqlite'));
+        try {
+            this.#authority = this.#ledger.claimController(randomUUID(), controllerTtlMs);
+            this.#ledger.syncGrants(this.#config.grants, this.#authority);
+        }
+        catch (error) {
+            this.#ledger.close();
+            throw error;
+        }
+        this.#timer = setInterval(() => {
+            try {
+                if (this.#ledger.renewController(this.#authority, controllerTtlMs)) {
+                    this.#scheduleSweep();
+                    return;
+                }
+            }
+            catch { /* Losing the fence stops execution. */ }
+            this.#active = false;
+            this.#recoveryAbort.abort();
+            for (const job of this.#jobs.values())
+                job.abort.abort();
+        }, 5000);
+        this.#timer.unref();
+        this.#ready = this.#recover();
+        // Store the failure for run() without an unhandled background rejection.
+        void this.#ready.catch(() => { this.#active = false; });
+        ctx.effect(() => async () => {
+            this.#active = false;
+            this.#recoveryAbort.abort();
+            for (const job of this.#jobs.values())
+                job.abort.abort();
+            await Promise.allSettled([this.#ready, this.#sweep, ...Array.from(this.#jobs.values(), job => job.done)]);
+            clearInterval(this.#timer);
+            try {
+                this.#ledger.releaseController(this.#authority);
+            }
+            finally {
+                this.#ledger.close();
+            }
+        }, 'assistant-isolation.controller');
+        // These scopes remain managed even when a grant expires or is revoked.
+        // Trusted Host plugins are outside the worker boundary; model tool calls
+        // cannot switch to an arbitrary Host shell or a nested code dispatcher.
+        ctx.inject(['tools'], runtime => runtime.on('tools/execute', async (execution, next) => {
+            const header = execution.agent?.session.header;
+            if (header !== undefined && this.#config.grants.some(grant => grant.workspace === header.cwd && grant.agentPreset === header.agentPreset)
+                && !isolatedScopeTools.has(execution.name)
+                && !(preauthorizedScopedTools.has(execution.name) && this.ctx.get('assistantPolicy')?.isPreauthorizedTool?.(execution)))
+                throw new Error('assistant-isolation: this scope requires isolated execution');
+            return await next();
+        }));
+        ctx.inject(['systemPrompt'], runtime => runtime.on('system-prompt/assemble', async (_assembly, { agent }, next) => {
+            const assembly = await next();
+            if (!this.#configuredOwnerScope(agent))
+                return assembly;
+            return { ...assembly,
+                tools: assembly.tools.filter(tool => isolatedPromptTools.has(tool.name)),
+                // Append a capability fact without replacing deployment persona or safety sections.
+                sections: [...assembly.sections.filter(section => !section.name.startsWith('tools:') || isolatedPromptTools.has(section.name.slice('tools:'.length))),
+                    { name: 'assistant-isolation:restricted-scope', text: restrictedScopeSection }],
+            };
+        }));
+        ctx.inject(['agents', 'assistantDelivery', 'assistantPolicy', 'tools'], runtime => registerIsolationTools(runtime, this));
+    }
+    #scheduleSweep() {
+        if (!this.#active || this.#sweep)
+            return;
+        this.#sweep = this.#ready.then(async () => {
+            const page = this.#ledger.recoverable(this.#cursor).slice(0, 16);
+            this.#cursor = page.at(-1)?.id ?? '';
+            for (const job of page) {
+                if (!this.#active)
+                    break;
+                if (this.#jobs.has(job.id))
+                    continue;
+                const signal = AbortSignal.any([this.#recoveryAbort.signal, AbortSignal.timeout(30_000)]);
+                if (await reconcileUnknownJob(this.#ledger, this.#authority, job, this.#config.dockerPath, signal)) {
+                    await rm(join(this.#config.stateRoot, 'workspaces', job.id), { recursive: true, force: true });
+                }
+            }
+            if (this.#active && Date.now() - this.#lastMaintenance >= 60_000) {
+                this.#lastMaintenance = Date.now();
+                const report = await maintainIsolationStorage(this.#ledger, this.#authority, this.#config.stateRoot, this.#config.storage, this.#storageCursor);
+                this.#storageCursor = report.cursor;
+            }
+        }).catch(() => { }).finally(() => { this.#sweep = undefined; });
+    }
+    #ownerIdentity(agent) {
+        if (!this.#active || !this.#ledger.hasController(this.#authority))
+            throw new Error('assistant-isolation: controller unavailable');
+        if (agent === undefined || this.ctx.get('agents')?.get(agent.id) !== agent)
+            throw new Error('assistant-isolation: exact live agent required');
+        const owner = this.ctx.get('assistantDelivery')?.preferencePrincipalForAgent(agent);
+        if (owner === undefined || owner.scope.workspace !== agent.session.header.cwd || owner.scope.preset !== agent.session.header.agentPreset)
+            throw new Error('assistant-isolation: authenticated owner required');
+        return { principalDigest: isolationPrincipalDigest(owner.principalId), ...owner.principalLineage,
+            workspace: owner.scope.workspace, agentPreset: owner.scope.preset };
+    }
+    /** Presentation is scoped only after live owner authentication, but remains restricted after grant revoke/expiry. */
+    #configuredOwnerScope(agent) {
+        try {
+            const identity = this.#ownerIdentity(agent);
+            return this.#config.grants.some(grant => grant.workspace === identity.workspace && grant.agentPreset === identity.agentPreset);
+        }
+        catch {
+            return false;
+        }
+    }
+    #identity(agent, grantId) {
+        const identity = this.#ownerIdentity(agent);
+        if (this.ctx.get('assistantPolicy')?.evaluateAgent(agent, 'execute', { kind: 'tool', id: `isolation:${grantId}` }).effect !== 'allow')
+            throw new Error('assistant-isolation: policy denied');
+        return identity;
+    }
+    /** Model-visible read-only discovery for grants already authorized to this exact live owner scope. */
+    discover = async (agent) => {
+        await this.#ready;
+        const identity = this.#ownerIdentity(agent);
+        if (this.ctx.get('assistantPolicy')?.evaluateAgent(agent, 'execute', { kind: 'tool', id: 'isolation_grants' }).effect !== 'allow')
+            throw new Error('assistant-isolation: policy denied');
+        const now = Date.now();
+        const grants = [];
+        for (const grant of this.#config.grants) {
+            if (!this.#ledger.permitsGrant(identity, grant.id)
+                || this.ctx.get('assistantPolicy')?.evaluateAgent(agent, 'execute', { kind: 'tool', id: `isolation:${grant.id}` }).effect !== 'allow')
+                continue;
+            const diagnostic = inspectIsolationGrant({ stateRoot: this.#config.stateRoot, grant, now });
+            if (diagnostic.status !== 'available' || diagnostic.remainingRuns === null || diagnostic.remainingDurationMs === null)
+                continue;
+            grants.push(Object.freeze({ id: grant.id, expiresAt: grant.expiresAt, remainingRuns: diagnostic.remainingRuns,
+                remainingDurationMs: diagnostic.remainingDurationMs, limits: Object.freeze({ maxDurationMs: this.#config.limits.maxDurationMs,
+                    maxInputBytes: this.#config.limits.maxInputBytes, maxOutputBytes: this.#config.limits.maxOutputBytes,
+                    maxArtifactBytes: this.#config.limits.maxArtifactBytes, maxFiles: this.#config.limits.maxFiles }) }));
+        }
+        return Object.freeze(grants);
+    };
+    async #recover() {
+        let cursor = '';
+        for (;;) {
+            const page = this.#ledger.recoverable(cursor);
+            if (page.length === 0)
+                break;
+            cursor = page.at(-1).id;
+            for (const job of page) {
+                if (!this.#active)
+                    return;
+                const removed = await removeIsolatedContainer(this.#config.dockerPath, job.containerName, { signal: this.#recoveryAbort.signal });
+                if (!this.#active)
+                    return;
+                // An absent object does not prove a timed-out daemon create request
+                // completed. Restart must not erase that uncertainty or free its pool.
+                const quiescent = removed && !job.dispatchAttempted && job.result?.reason !== 'docker-creation-unconfirmed';
+                const result = job.result ? { ...job.result, quiescent } : {
+                    jobId: job.id, status: 'unknown', quiescent, stdout: '', stderr: '', artifacts: [], reason: job.dispatchAttempted ? 'controller-recovery-dispatch-unconfirmed' : 'controller-recovery-no-replay',
+                };
+                this.#ledger.settle(job.id, job.version, result, this.#authority);
+                if (quiescent)
+                    await rm(join(this.#config.stateRoot, 'workspaces', job.id), { recursive: true, force: true });
+            }
+        }
+    }
+    /** Private Host readback; never exposed as a model tool or filesystem path. */
+    readAcceptedArtifact = (input, path) => {
+        if (!this.#active || !this.#ledger.hasController(this.#authority))
+            throw new Error('assistant-isolation: artifact source unavailable');
+        const contract = validateTaskAcceptanceContract(input);
+        if (contract.protocol !== 'task-acceptance/v4' || contract.task.kind !== 'goal-step')
+            throw new Error('assistant-isolation: artifact source must be a goal step');
+        const job = this.#ledger.acceptedArtifactJob(contract.id, contract.digest, path);
+        if (!job || job.artifactBinding?.admission.runId !== contract.task.ref || job.sessionId !== contract.task.goal.sessionId
+            || job.identity.principalRecordId !== contract.owner.principalRecordId || job.identity.principalVersion !== contract.owner.principalVersion
+            || job.identity.workspace !== contract.scope.workspace || job.identity.agentPreset !== contract.scope.preset
+            || !job.dispatchAttempted || job.createdAt < contract.issuedAt || job.updatedAt >= contract.expiresAt || job.status !== 'succeeded'
+            || job.result?.quiescent !== true || job.result.retention !== undefined)
+            throw new Error('assistant-isolation: accepted artifact unavailable');
+        const artifacts = job.result.artifacts.filter(artifact => artifact.path === path);
+        if (artifacts.length !== 1)
+            throw new Error('assistant-isolation: accepted artifact unavailable');
+        const artifact = artifacts[0];
+        return Object.freeze({ jobId: job.id, requestDigest: job.requestDigest, admission: job.artifactBinding.admission,
+            path, content: artifact.content, sha256: createHash('sha256').update(artifact.content).digest('hex') });
+    };
+    /** Only the trusted registered isolation tool may skip a redundant risk prompt. */
+    preauthorize = (execution) => {
+        try {
+            if (execution.signal.aborted || !execution.arguments || typeof execution.arguments !== 'object' || Array.isArray(execution.arguments))
+                return false;
+            const args = execution.arguments;
+            if (Object.keys(args).some(key => !['grant_id', 'idempotency_key', 'command', 'files', 'artifacts', 'timeout_ms'].includes(key)))
+                return false;
+            const request = normalizeRequest({ grantId: args.grant_id, idempotencyKey: args.idempotency_key, command: args.command,
+                ...(args.files === undefined ? {} : { files: args.files }), ...(args.artifacts === undefined ? {} : { artifacts: args.artifacts }),
+                ...(args.timeout_ms === undefined ? {} : { timeoutMs: args.timeout_ms }),
+            }, this.#config.limits);
+            return this.#ledger.permitsGrant(this.#identity(execution.agent, request.grantId), request.grantId);
+        }
+        catch {
+            return false;
+        }
+    };
+    run = async (agent, input, signal) => {
+        await this.#ready;
+        signal.throwIfAborted();
+        const request = normalizeRequest(input, this.#config.limits);
+        const observation = await observeStorage(this.#config.stateRoot);
+        signal.throwIfAborted();
+        const identity = this.#identity(agent, request.grantId);
+        const producer = this.ctx.get('assistantGoals', false);
+        const admission = producer?.currentArtifactAdmission?.(agent);
+        const prepared = this.#ledger.prepare({ ...(admission ? { artifactBinding: { admission: validateGoalArtifactAdmission(admission), paths: request.artifacts ?? [] } } : {}), identity, sessionId: String(agent.session.id), grantId: request.grantId,
+            idempotencyKey: request.idempotencyKey, requestDigest: digest({ request, image: this.#config.image, limits: this.#config.limits }),
+            resourceReservation: { memoryMiB: this.#config.limits.memoryMiB + this.#config.limits.workspaceMiB + 32,
+                workspaceInodes: this.#config.limits.workspaceInodes, maxMemoryMiB: this.#config.maxReservedMemoryMiB,
+                maxWorkspaceInodes: this.#config.maxReservedWorkspaceInodes },
+            storageBudget: { maxStateBytes: this.#config.storage.maxStateBytes, maxJobRecords: this.#config.storage.maxJobRecords,
+                reservedBytes: plannedStorageBytes(this.#config.limits), ...(observation ? { observation } : {}) },
+            durationMs: request.timeoutMs, maxActiveJobs: this.#config.maxConcurrentJobs, authority: this.#authority });
+        if (!prepared.created) {
+            const current = this.#jobs.get(prepared.job.id);
+            const result = current ? await current.done : prepared.job.result ?? {
+                jobId: prepared.job.id, status: 'unknown', quiescent: false, stdout: '', stderr: '', artifacts: [], reason: 'job-in-progress-no-replay',
+            };
+            if (digest(this.#identity(agent, request.grantId)) !== digest(identity))
+                throw new Error('assistant-isolation: owner changed');
+            return structuredClone(result);
+        }
+        const authorization = this.ctx.get('assistantPolicy')?.authorizeAgent(agent, 'execute', { kind: 'tool', id: `isolation:${request.grantId}` }, {
+            idempotencyKey: `isolation:${prepared.job.id}`,
+        });
+        if (authorization?.effect !== 'allow') {
+            const result = { jobId: prepared.job.id, status: 'failed', quiescent: true, stdout: '', stderr: '', artifacts: [], reason: 'policy-denied-before-dispatch' };
+            this.#ledger.settle(prepared.job.id, prepared.job.version, result, this.#authority);
+            throw new Error('assistant-isolation: policy denied');
+        }
+        const abort = new AbortController();
+        const combined = AbortSignal.any([signal, abort.signal]);
+        const done = this.#execute(agent, identity, prepared.job, request, combined);
+        this.#jobs.set(prepared.job.id, { abort, done });
+        try {
+            const result = await done;
+            if (digest(this.#identity(agent, request.grantId)) !== digest(identity))
+                throw new Error('assistant-isolation: owner changed');
+            return structuredClone(result);
+        }
+        finally {
+            this.#jobs.delete(prepared.job.id);
+        }
+    };
+    async #execute(agent, identity, initial, request, signal) {
+        let job = initial;
+        const abort = new AbortController();
+        const authorized = () => {
+            try {
+                if (job.artifactBinding) {
+                    const producer = this.ctx.get('assistantGoals', false);
+                    const admission = producer?.currentArtifactAdmission?.(agent);
+                    if (!admission || digest(admission) !== digest(job.artifactBinding.admission))
+                        return false;
+                }
+                return !signal.aborted && this.#ledger.usable(job.id)
+                    && digest(this.#identity(agent, job.grantId)) === digest(identity);
+            }
+            catch {
+                return false;
+            }
+        };
+        const timer = setInterval(() => { if (!authorized())
+            abort.abort(); }, 250);
+        timer.unref();
+        let mayHaveCreated = false;
+        let creationWitness;
+        let result = { jobId: job.id, status: 'failed', quiescent: true, stdout: '', stderr: '', artifacts: [], reason: 'preparation-failed' };
+        try {
+            const workspacePath = await stageWorkspace(this.#config.stateRoot, job.id, request);
+            if (!authorized())
+                throw new Error('authorization-denied-before-create');
+            job = this.#ledger.markDispatched(job.id, job.version, this.#authority);
+            mayHaveCreated = true;
+            const processResult = await runIsolatedProcess({ jobId: job.id, containerName: job.containerName, image: this.#config.image,
+                dockerPath: this.#config.dockerPath, workspacePath, artifacts: request.artifacts ?? [], command: request.command, deadline: job.deadline,
+                limits: this.#config.limits, signal: AbortSignal.any([signal, abort.signal]),
+                authorizeStart: () => {
+                    if (!authorized())
+                        return false;
+                    job = this.#ledger.start(job.id, job.version, this.#authority);
+                    return true;
+                },
+            });
+            const { creationWitness: witness, ...publicResult } = processResult;
+            creationWitness = witness;
+            result = { ...publicResult, jobId: job.id, artifacts: processResult.artifacts ?? [],
+                quiescent: publicResult.status === 'unknown' ? false : publicResult.quiescent };
+        }
+        catch {
+            if (mayHaveCreated) {
+                await removeIsolatedContainer(this.#config.dockerPath, job.containerName);
+                result = { ...result, status: 'unknown', quiescent: false, reason: 'runner-exception-no-replay' };
+            }
+        }
+        finally {
+            clearInterval(timer);
+        }
+        // A lost controller cannot write success into a successor's ledger.
+        try {
+            this.#ledger.settle(job.id, job.version, result, this.#authority, creationWitness);
+        }
+        finally {
+            if (result.quiescent)
+                await rm(join(this.#config.stateRoot, 'workspaces', job.id), { recursive: true, force: true });
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=service.js.map

package/lib/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAA2D,MAAM,wCAAwC,CAAA;AAC/K,OAAO,EAAE,OAAO,EAAgB,MAAM,qBAAqB,CAAA;AAM3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,eAAe,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAK3H,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3G,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAC5G,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mCAAmC,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAC9V,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,EAAE,GAAG,wBAAwB,CAAC,CAAC,CAAA;AACzF,MAAM,sBAAsB,GAAG,qdAAqd,CAAA;AACpf,MAAM,eAAe,GAAG,MAAM,CAAA;AAG9B,gGAAgG;AAChG,MAAM,OAAO,yBAA0B,SAAQ,OAAO;IACpD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IACb,OAAO,CAAmC;IAC1C,OAAO,CAAiB;IACxB,UAAU,CAA8B;IACxC,MAAM,CAAe;IACrB,KAAK,GAAG,IAAI,GAAG,EAAsE,CAAA;IACrF,cAAc,GAAG,IAAI,eAAe,EAAE,CAAA;IAC/C,MAAM,CAA2B;IACjC,OAAO,GAAG,EAAE,CAAA;IACZ,cAAc,GAAG,EAAE,CAAA;IACnB,gBAAgB,GAAG,CAAC,CAAA;IACpB,OAAO,GAAG,IAAI,CAAA;IACd,MAAM,CAAgB;IAEtB,YAAY,GAAY,EAAE,QAAgB,EAAE;QAC1C,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QACnC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC1L,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,eAAe,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAA;QAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC;gBAAC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBAAC,OAAM;gBAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;YAC/J,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAC1D,CAAC,EAAE,IAAI,CAAC,CAAA;QACR,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC7B,yEAAyE;QACzE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACxD,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACzG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QAC1F,CAAC,EAAE,gCAAgC,CAAC,CAAA;QACpC,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACrF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAA;YAC9C,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;mBACpI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;mBACvC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YACzM,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC,CAAC,CAAC,CAAA;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE;YAChH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;YAC7B,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAA;YACvD,OAAO,EAAE,GAAG,QAAQ;gBAClB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxE,oFAAoF;gBACpF,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACnJ,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;aAClF,CAAA;QACH,CAAC,CAAC,CAAC,CAAA;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;IAC3H,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;YACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,MAAK;gBACxB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAQ;gBACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACzF,IAAI,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;oBACnG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAChG,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,IAAI,MAAM,EAAE,CAAC;gBACjE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAClC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;gBAC/I,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAA;YACrC,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAkE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA,CAAC,CAAC,CAAC,CAAA;IAC/H,CAAC;IAED,cAAc,CAAC,KAAwB;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QACjI,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAC7I,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAA;QACnF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAC9M,OAAO,EAAE,eAAe,EAAE,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,gBAAgB;YAC9F,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IACvE,CAAC;IACD,qHAAqH;IACrH,qBAAqB,CAAC,KAAwB;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAA;QAChI,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,KAAwB,EAAE,OAAe;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC5L,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,sGAAsG;IACtG,QAAQ,GAAG,KAAK,EAAE,KAAwB,EAA+C,EAAE;QACzF,MAAM,IAAI,CAAC,MAAM,CAAA;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,KAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACzL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAA8B,EAAE,CAAA;QAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;mBAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,KAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO;gBAAE,SAAQ;YAClJ,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3F,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,mBAAmB,KAAK,IAAI;gBAAE,SAAQ;YAC/H,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa;gBAC3G,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;oBAC3H,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;oBACpG,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC,CAAA;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAM;gBACzB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAA;gBACjI,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAM;gBACzB,oEAAoE;gBACpE,uEAAuE;gBACvE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,6BAA6B,CAAA;gBAC3G,MAAM,MAAM,GAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC1E,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,+BAA+B;iBACjM,CAAA;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBACjE,IAAI,SAAS;oBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/G,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,oBAAoB,GAAG,CAAC,KAA6B,EAAE,IAAY,EAAE,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACtI,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,QAAQ,CAAC,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QACjK,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;eACnH,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,CAAC,iBAAiB,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK,CAAC,gBAAgB;eACxI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;eACzG,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;eAChI,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAChJ,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACjG,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAE,CAAA;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,SAAS;YAC9G,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC3G,CAAC,CAAA;IAED,mFAAmF;IACnF,YAAY,GAAG,CAAC,SAAwB,EAAW,EAAE;QACnD,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAA;YACnJ,MAAM,IAAI,GAAG,SAAS,CAAC,SAAoC,CAAA;YAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC9I,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACpH,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClI,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aACrD,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QACrG,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC1B,CAAC,CAAA;IAED,GAAG,GAAG,KAAK,EAAE,KAAwB,EAAE,KAAuB,EAAE,MAAmB,EAA4B,EAAE;QAC/G,MAAM,IAAI,CAAC,MAAM,CAAA;QACjB,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChE,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAyB,EAAE,KAAK,CAA+F,CAAA;QAC7J,MAAM,SAAS,GAAG,QAAQ,EAAE,wBAAwB,EAAE,CAAC,KAAM,CAAC,CAAA;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,6BAA6B,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YAClP,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAClI,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,GAAG,EAAE;gBACrG,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB;gBACrG,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE;YAC/D,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;gBACnH,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpG,UAAU,EAAE,OAAO,CAAC,SAAU,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI;gBACnE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,2BAA2B;aACjJ,CAAA;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAC9H,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE;YAC5I,cAAc,EAAE,aAAa,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE;SAC/C,CAAC,CAAA;QACF,IAAI,aAAa,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GAAoB,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;YAC7K,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAA;YACzB,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAC9H,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IAClD,CAAC,CAAA;IAED,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,QAA2B,EAAE,OAAqB,EAAE,OAAyB,EAAE,MAAmB;QAC7H,IAAI,GAAG,GAAG,OAAO,CAAA;QACjB,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,MAAM,UAAU,GAAG,GAAY,EAAE;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAyB,EAAE,KAAK,CAA+F,CAAA;oBAC7J,MAAM,SAAS,GAAG,QAAQ,EAAE,wBAAwB,EAAE,CAAC,KAAK,CAAC,CAAA;oBAC7D,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;wBAAE,OAAO,KAAK,CAAA;gBAC7F,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;uBAClD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAA;YAAC,CAAC;QAC/F,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC1E,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,IAAI,cAAc,GAAG,KAAK,CAAA;QAC1B,IAAI,eAA4C,CAAA;QAChD,IAAI,MAAM,GAAoB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;QACvJ,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,CAAC,UAAU,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACxE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACvE,cAAc,GAAG,IAAI,CAAA;YACrB,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzH,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACxI,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC5E,cAAc,EAAE,GAAG,EAAE;oBACnB,IAAI,CAAC,UAAU,EAAE;wBAAE,OAAO,KAAK,CAAA;oBAC/B,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC9D,OAAO,IAAI,CAAA;gBACb,CAAC;aACF,CAAC,CAAA;YACF,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,aAAa,CAAA;YACnE,eAAe,GAAG,OAAO,CAAA;YACzB,MAAM,GAAG,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,EAAE;gBACjF,SAAS,EAAE,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,CAAA;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;gBACzE,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;YACnG,CAAC;QACH,CAAC;gBACO,CAAC;YAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;QAChC,oEAAoE;QACpE,IAAI,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;QAAC,CAAC;gBAClF,CAAC;YAAC,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAChI,OAAO,MAAM,CAAA;IACf,CAAC"}

package/lib/storage-policy.d.ts

@@ -0,0 +1,7 @@
+import type { IsolationLimits, IsolationResult, IsolationRetention, IsolationStoragePolicy } from './types.js';
+export declare const defaultStoragePolicy: IsolationStoragePolicy;
+export declare function validateStoragePolicy(value: unknown): IsolationStoragePolicy;
+export declare function plannedStorageBytes(limits: IsolationLimits): number;
+export declare function validateRetention(value: unknown): IsolationRetention | undefined;
+export declare function pruneResult(result: IsolationResult, now: number): IsolationResult | undefined;
+//# sourceMappingURL=storage-policy.d.ts.map

package/lib/storage-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-policy.d.ts","sourceRoot":"","sources":["../src/storage-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAG9G,eAAO,MAAM,oBAAoB,EAAE,sBAIjC,CAAA;AAMF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAS5E;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAEnE;AAgBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAehF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAe7F"}

package/lib/storage-policy.js

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto';
+const DAY = 24 * 60 * 60 * 1000;
+export const defaultStoragePolicy = Object.freeze({
+    maxStateBytes: 256 * 1024 * 1024,
+    maxJobRecords: 10_000,
+    resultRetentionMs: 0,
+});
+function exact(value, keys) {
+    return typeof value === 'object' && value !== null && Object.keys(value).length === keys.length && keys.every(key => key in value);
+}
+export function validateStoragePolicy(value) {
+    if (value === undefined)
+        return { ...defaultStoragePolicy };
+    if (!exact(value, ['maxStateBytes', 'maxJobRecords', 'resultRetentionMs']))
+        throw new Error('assistant-isolation: invalid storage policy');
+    const { maxStateBytes, maxJobRecords, resultRetentionMs } = value;
+    if (typeof maxStateBytes !== 'number' || typeof maxJobRecords !== 'number' || typeof resultRetentionMs !== 'number'
+        || !Number.isSafeInteger(maxStateBytes) || maxStateBytes < 16 * 1024 * 1024 || maxStateBytes > 16 * 1024 * 1024 * 1024
+        || !Number.isSafeInteger(maxJobRecords) || maxJobRecords < 1 || maxJobRecords > 1_000_000
+        || !Number.isSafeInteger(resultRetentionMs) || resultRetentionMs < 0 || resultRetentionMs > 365 * DAY)
+        throw new Error('assistant-isolation: invalid storage policy');
+    return { maxStateBytes, maxJobRecords, resultRetentionMs };
+}
+export function plannedStorageBytes(limits) {
+    return 6 * (limits.maxOutputBytes + limits.maxArtifactBytes) + limits.maxInputBytes + 2 * 1024 * 1024;
+}
+function digest(content) {
+    const bytes = Buffer.byteLength(content, 'utf8');
+    return { sha256: createHash('sha256').update(content, 'utf8').digest('hex'), bytes };
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${canonical(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+export function validateRetention(value) {
+    if (!exact(value, ['kind', 'version', 'prunedAt', 'original', 'stdout', 'stderr', 'artifacts']))
+        return undefined;
+    const item = (entry, path = false) => {
+        if (!exact(entry, path ? ['sha256', 'bytes', 'path'] : ['sha256', 'bytes']))
+            return undefined;
+        const record = entry;
+        if (typeof record.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(record.sha256) || typeof record.bytes !== 'number' || !Number.isSafeInteger(record.bytes) || record.bytes < 0
+            || (path && (typeof record.path !== 'string' || record.path.length === 0 || record.path.length > 4096 || record.path.startsWith('/') || /[\p{Cc}\\]/u.test(record.path) || record.path.split('/').some(part => part === '' || part === '.' || part === '..'))))
+            return undefined;
+        return path ? { sha256: record.sha256, bytes: record.bytes, path: record.path } : { sha256: record.sha256, bytes: record.bytes };
+    };
+    const record = value;
+    if (record.kind !== 'pruned' || record.version !== 1 || typeof record.prunedAt !== 'number' || !Number.isSafeInteger(record.prunedAt) || record.prunedAt < 0 || !Array.isArray(record.artifacts) || record.artifacts.length > 128)
+        return undefined;
+    const original = item(record.original);
+    const stdout = item(record.stdout);
+    const stderr = item(record.stderr);
+    const artifacts = record.artifacts.map(entry => item(entry, true));
+    if (!original || !stdout || !stderr || artifacts.some(entry => entry === undefined) || new Set(artifacts.map(entry => entry?.path)).size !== artifacts.length)
+        return undefined;
+    return { kind: 'pruned', version: 1, prunedAt: record.prunedAt, original, stdout, stderr, artifacts: artifacts };
+}
+export function pruneResult(result, now) {
+    if (!Number.isSafeInteger(now) || now < 0 || !result.quiescent
+        || !['succeeded', 'failed', 'cancelled', 'timed-out'].includes(result.status) || result.retention !== undefined)
+        return undefined;
+    const bodyBytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr) + result.artifacts.reduce((sum, artifact) => sum + Buffer.byteLength(artifact.path) + Buffer.byteLength(artifact.content), 0);
+    if (bodyBytes === 0)
+        return undefined;
+    // Result creation time is not carried by the result itself; callers pass a
+    // result only once it is eligible under their job's retention deadline.
+    const original = digest(canonical(result));
+    const retention = { kind: 'pruned', version: 1, prunedAt: now, original,
+        stdout: digest(result.stdout), stderr: digest(result.stderr), artifacts: result.artifacts.map(artifact => ({ path: artifact.path, ...digest(artifact.content) })) };
+    // Older trusted Host writers accepted broader artifact paths. Preserve such
+    // bodies rather than persisting a marker the current reader cannot decode.
+    if (!validateRetention(retention))
+        return undefined;
+    const pruned = { jobId: result.jobId, status: result.status, quiescent: true, stdout: '', stderr: '', artifacts: [], ...(result.exitCode === undefined ? {} : { exitCode: result.exitCode }), ...(result.reason === undefined ? {} : { reason: result.reason }), retention };
+    return Buffer.byteLength(canonical(pruned)) < Buffer.byteLength(canonical(result)) ? pruned : undefined;
+}
+//# sourceMappingURL=storage-policy.js.map

package/lib/storage-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-policy.js","sourceRoot":"","sources":["../src/storage-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAA2B,MAAM,CAAC,MAAM,CAAC;IACxE,aAAa,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,CAAC;CACrB,CAAC,CAAA;AAEF,SAAS,KAAK,CAAC,KAAc,EAAE,IAAuB;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAAA;AACpI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAA;IAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAC1I,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAA;IACjE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,iBAAiB,KAAK,QAAQ;WAC9G,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;WACnH,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,SAAS;WACtF,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IACvK,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACvG,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;AACtF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACnH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACjH,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAI,GAAG,KAAK,EAAgE,EAAE;QAC1G,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAC7F,MAAM,MAAM,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;eACxK,CAAC,IAAI,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAClR,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAc,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAC5I,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAA;IACpB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAA;IACnP,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9G,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC/K,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAA4C,EAAE,CAAA;AACrJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAuB,EAAE,GAAW;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;WACzD,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACnI,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACnN,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACrC,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACzF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACrK,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,MAAM,GAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAA;IAC7R,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACzG,CAAC"}

package/lib/storage.d.ts

@@ -0,0 +1,18 @@
+import type { IsolationControllerAuthority, IsolationLedger } from './ledger.js';
+import type { IsolationStorageObservation, IsolationStoragePolicy } from './types.js';
+/** A bounded observation, not an atomic snapshot or a filesystem quota. */
+export declare function observeStorage(root: string): Promise<IsolationStorageObservation | undefined>;
+export interface IsolationStorageMaintenance {
+    checked: number;
+    pruned: number;
+    logicalBytesRemoved: number;
+    stagingCleaned: number;
+    retained: number;
+    cursor: string;
+    checkpoint: 'complete' | 'busy';
+    reclaimMode: 'incremental' | 'page-reuse';
+    observation?: IsolationStorageObservation;
+}
+/** One bounded controller page. Zero retention age never prunes result bodies. */
+export declare function maintainIsolationStorage(ledger: IsolationLedger, authority: IsolationControllerAuthority, root: string, input: IsolationStoragePolicy, afterId?: string): Promise<IsolationStorageMaintenance>;
+//# sourceMappingURL=storage.d.ts.map

package/lib/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEhF,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAErF,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAsBnG;AAkBD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,GAAG,MAAM,CAAA;IAC/B,WAAW,EAAE,aAAa,GAAG,YAAY,CAAA;IACzC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAC1C;AAED,kFAAkF;AAClF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,4BAA4B,EAC7G,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA2BjG"}