@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (116) hide show
  1. package/README.md +287 -9
  2. package/lib/audit-archive.d.ts +1 -1
  3. package/lib/audit-archive.d.ts.map +1 -1
  4. package/lib/audit-archive.js +31 -13
  5. package/lib/audit-archive.js.map +1 -1
  6. package/lib/cli.d.ts +7 -3
  7. package/lib/cli.d.ts.map +1 -1
  8. package/lib/cli.js +104 -23
  9. package/lib/cli.js.map +1 -1
  10. package/lib/config.d.ts +15 -2
  11. package/lib/config.d.ts.map +1 -1
  12. package/lib/config.js +49 -9
  13. package/lib/config.js.map +1 -1
  14. package/lib/diagnostics.js +2 -2
  15. package/lib/diagnostics.js.map +1 -1
  16. package/lib/index.d.ts +17 -1
  17. package/lib/index.d.ts.map +1 -1
  18. package/lib/index.js +17 -1
  19. package/lib/index.js.map +1 -1
  20. package/lib/ledger.d.ts +19 -2
  21. package/lib/ledger.d.ts.map +1 -1
  22. package/lib/ledger.js +371 -44
  23. package/lib/ledger.js.map +1 -1
  24. package/lib/linux-cgroups.d.ts +75 -0
  25. package/lib/linux-cgroups.d.ts.map +1 -0
  26. package/lib/linux-cgroups.js +517 -0
  27. package/lib/linux-cgroups.js.map +1 -0
  28. package/lib/linux-execution-contract.d.ts +123 -0
  29. package/lib/linux-execution-contract.d.ts.map +1 -0
  30. package/lib/linux-execution-contract.js +279 -0
  31. package/lib/linux-execution-contract.js.map +1 -0
  32. package/lib/linux-execution.d.ts +123 -0
  33. package/lib/linux-execution.d.ts.map +1 -0
  34. package/lib/linux-execution.js +1264 -0
  35. package/lib/linux-execution.js.map +1 -0
  36. package/lib/linux-job-recovery.d.ts +5 -0
  37. package/lib/linux-job-recovery.d.ts.map +1 -0
  38. package/lib/linux-job-recovery.js +63 -0
  39. package/lib/linux-job-recovery.js.map +1 -0
  40. package/lib/linux-namespace.d.ts +80 -0
  41. package/lib/linux-namespace.d.ts.map +1 -0
  42. package/lib/linux-namespace.js +471 -0
  43. package/lib/linux-namespace.js.map +1 -0
  44. package/lib/linux-repository-admission.d.ts +26 -0
  45. package/lib/linux-repository-admission.d.ts.map +1 -0
  46. package/lib/linux-repository-admission.js +64 -0
  47. package/lib/linux-repository-admission.js.map +1 -0
  48. package/lib/linux-repository-runner.d.ts +54 -0
  49. package/lib/linux-repository-runner.d.ts.map +1 -0
  50. package/lib/linux-repository-runner.js +614 -0
  51. package/lib/linux-repository-runner.js.map +1 -0
  52. package/lib/linux-runner-state-migration.d.ts +94 -0
  53. package/lib/linux-runner-state-migration.d.ts.map +1 -0
  54. package/lib/linux-runner-state-migration.js +463 -0
  55. package/lib/linux-runner-state-migration.js.map +1 -0
  56. package/lib/linux-runner-state.d.ts +53 -0
  57. package/lib/linux-runner-state.d.ts.map +1 -0
  58. package/lib/linux-runner-state.js +332 -0
  59. package/lib/linux-runner-state.js.map +1 -0
  60. package/lib/linux-runtime-source.d.ts +28 -0
  61. package/lib/linux-runtime-source.d.ts.map +1 -0
  62. package/lib/linux-runtime-source.js +237 -0
  63. package/lib/linux-runtime-source.js.map +1 -0
  64. package/lib/linux-runtime.d.ts +37 -0
  65. package/lib/linux-runtime.d.ts.map +1 -0
  66. package/lib/linux-runtime.js +192 -0
  67. package/lib/linux-runtime.js.map +1 -0
  68. package/lib/linux-system-snapshot.d.ts +47 -0
  69. package/lib/linux-system-snapshot.d.ts.map +1 -0
  70. package/lib/linux-system-snapshot.js +704 -0
  71. package/lib/linux-system-snapshot.js.map +1 -0
  72. package/lib/linux-user-namespace.d.ts +79 -0
  73. package/lib/linux-user-namespace.d.ts.map +1 -0
  74. package/lib/linux-user-namespace.js +234 -0
  75. package/lib/linux-user-namespace.js.map +1 -0
  76. package/lib/linux-verifier-runner.d.ts +27 -0
  77. package/lib/linux-verifier-runner.d.ts.map +1 -0
  78. package/lib/linux-verifier-runner.js +346 -0
  79. package/lib/linux-verifier-runner.js.map +1 -0
  80. package/lib/native-cgroup-roots.d.ts +20 -0
  81. package/lib/native-cgroup-roots.d.ts.map +1 -0
  82. package/lib/native-cgroup-roots.js +121 -0
  83. package/lib/native-cgroup-roots.js.map +1 -0
  84. package/lib/native-resources.d.ts +44 -0
  85. package/lib/native-resources.d.ts.map +1 -0
  86. package/lib/native-resources.js +354 -0
  87. package/lib/native-resources.js.map +1 -0
  88. package/lib/probe.d.ts +10 -0
  89. package/lib/probe.d.ts.map +1 -1
  90. package/lib/probe.js +52 -2
  91. package/lib/probe.js.map +1 -1
  92. package/lib/service.d.ts +1 -1
  93. package/lib/service.d.ts.map +1 -1
  94. package/lib/service.js +122 -9
  95. package/lib/service.js.map +1 -1
  96. package/lib/storage.d.ts.map +1 -1
  97. package/lib/storage.js +36 -6
  98. package/lib/storage.js.map +1 -1
  99. package/lib/tools.js +1 -1
  100. package/lib/tools.js.map +1 -1
  101. package/lib/types.d.ts +5 -1
  102. package/lib/types.d.ts.map +1 -1
  103. package/lib/verifier-runner.d.ts +4 -2
  104. package/lib/verifier-runner.d.ts.map +1 -1
  105. package/lib/verifier-runner.js +22 -1
  106. package/lib/verifier-runner.js.map +1 -1
  107. package/lib/version.d.ts +1 -1
  108. package/lib/version.js +1 -1
  109. package/package.json +15 -10
  110. package/runtime/linux-candidate-entry.py +82 -0
  111. package/runtime/linux-namespace-worker.mjs +561 -0
  112. package/runtime/linux-seccomp-policy.LICENSE +202 -0
  113. package/runtime/linux-seccomp-policy.json +886 -0
  114. package/runtime/linux-seccomp.py +106 -0
  115. package/runtime/linux-userns-launcher.py +149 -0
  116. package/runtime/linux-userns-proof.py +299 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"linux-system-snapshot.js","sourceRoot":"","sources":["../src/linux-system-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAmB,MAAM,kBAAkB,CAAA;AAC5I,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AAUtH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AACpG,MAAM,QAAQ,GAAG,2BAA2B,CAAA;AAC5C,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACrC,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAChC,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChG,MAAM,SAAS,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;OAC3E,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;AACjH,MAAM,KAAK,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC/G,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAQ,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAA,CAAC,CAAC,CAAA;AAC/E,MAAM,KAAK,GAAG,+bAA+b,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AAMxd,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAY;IAChE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACnE,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAA;IACtE,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACxF,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAG,CAAC,CAAA;QACzC,IAAI,OAAO,KAAK,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACjI,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACvH,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA;QAC3H,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,IAAI,EAAE,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;YACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3C,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,CAAA;YACvF,OAAO,GAAG,GAAG,CAAA;QACf,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;aAC/F,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3I,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAoB,EAAE,MAAoB;IACnF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC7E,IAAI,MAA8B,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAClK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QAC/D,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;YACnG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;YAClD,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAClB,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,OAAO,GAAG,CAAC,CAAA;gBACf,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;oBACzE,IAAI,CAAC,MAAM,CAAC,YAAY;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;oBACzE,OAAO,IAAI,MAAM,CAAC,YAAY,CAAA;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,MAAM,CAAC,SAAS,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAC1F,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACrJ,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,EAAE,KAAK,EAAE,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAAC,CAAC;AAC1E,CAAC;AAGD,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA2D,EAAE,IAAY,EAAE,IAAY;IAC/H,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,MAAc,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAmB,EAAE;QAC9F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC;eACzF,MAAM,GAAG,KAAK,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAA;QACvH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACvE,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAC/F,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;WACvD,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACxJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzE,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrC,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC,CAAA;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpF,MAAM,QAAQ,GAA2E,EAAE,CAAA;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IAClG,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAA;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAA;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC;YACvF,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC9I,MAAM,MAAM,GAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IACpD,IAAI,WAAW;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IACxG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAA;IAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,GAA4B,EAAE,CAAA;IACtG,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;QACnF,IAAI,CAAC,GAAG;YAAE,MAAK;QACf,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC1I,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpG,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAChF,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;IAClH,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;IAC/F,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC1G,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzD,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QACzF,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YAChF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;YAC7K,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;mBACjJ,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA;YACtF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC7I,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA;YACtH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IACrD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAoB,EAAE,WAAW,GAAG,MAAM,CAAC,IAAI;IACtF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC7E,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAC/J,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAChE,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,OAAO,IAAI,GAAG,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;gBACtE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;gBAC5D,IAAI,IAAI,IAAI,CAAC,SAAS,CAAA;YACxB,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACjC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACzJ,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY,EAAE,MAAoB,EAAE,OAAsB;IACzG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC5H,UAAU,CAAC,MAAM,CAAC,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;WAChF,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACrH,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,UAAU,CAAC,MAAM,CAAC,CAAA;IAClB,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,EAAE,OAAO,GAAG,IAAI,GAAG,EAAuD,CAAA;IACnH,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAA;IACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAA;IAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;IACtH,MAAM,WAAW,GAAG,CAAC,QAAQ,YAAY,EAAE,EAAE,YAAY,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACpH,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,EAAQ,EAAE;QAClC,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,KAAK,IAAI,IAAI,CAAA;QACb,IAAI,EAAE,OAAO,GAAG,yBAAyB,CAAC,OAAO,IAAI,KAAK,GAAG,yBAAyB,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtJ,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAW,EAAE,MAAe,EAAQ,EAAE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC1J,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACtD,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAM;QAC7C,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,IAAI,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACxG,QAAQ,EAAE,CAAA;QACV,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5G,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;QACxD,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAAC,MAAM,KAAK,CAAA;QAAC,CAAC;IAC5I,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,MAAgB,EAAmB,EAAE;QACxE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAA;QACxH,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;YACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;gBAC5B,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACjG,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;QACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC,CAAA;IACD,MAAM,GAAG,GAAG,KAAK,EAAE,SAAiB,EAAE,SAAS,GAAG,IAAI,EAAE,YAAsB,EAAE,EAAiB,EAAE;QACjG,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;eAChF,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;eAC9E,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;eAChD,CAAC,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;eACtE,CAAC,CAAC,sBAAsB,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACpC,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACvD,oFAAoF;YACpF,QAAQ,EAAE,CAAA;YACV,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAA;QAChN,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5B,IAAI,SAAS,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;gBAC7F,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACvD,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAAE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;gBAC1F,CAAC;gBACD,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACrC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACtC,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;YACrC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YACtG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;YACrD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;YAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACvK,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;YAChE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;mBAC5F,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACnC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAA;gBACnJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;gBACrF,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;QACxD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAM;QACjC,IAAI,QAAQ,CAAC,IAAI,IAAI,yBAAyB,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAC5G,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS;gBACrF,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC1D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAChD,MAAM,MAAM,GAAG,CAAC,MAAM,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;YACvE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YACjG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC5B,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,WAAW;YAAE,MAAM,GAAG,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,IAAc,EAAmB,EAAE;QACpE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,IAAI,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG;YAClG,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAC7G,QAAQ,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,CAAC,CAAA;IACD,IAAI,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC9E,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QACvD,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YAAE,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC3G,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC,CAAA;QACrH,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC,CAAA;QACnH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACvG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,sBAAsB;YAChG,YAAY,YAAY,eAAe,EAAE,YAAY,YAAY,YAAY;YAC7E,mBAAmB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACjI,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAA;QAC3C,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,sBAAsB,CAAC;YACjF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAE,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAU,EAAE,CAAC;YACtH,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAA;YAC3D,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAA;YAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YAC5F,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB;YAC7F,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,CAAC;YAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACvH,IAAI,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;gBAAE,IAAI,MAAM,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;oBAAE,MAAM,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;YACjM,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAA;YACpE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,YAAY,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACzI,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,MAAM,GAAG,CAAC,cAAc,CAAC,CAAA;YACzB,MAAM,OAAO,GAAG,YAAY,YAAY,YAAY,CAAA;YACpD,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;YAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5L,MAAM,IAAI,GAAG,YAAY,YAAY,IAAI,IAAI,EAAE,CAAA;gBAC/C,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;YACjG,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;mBAC/F,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YACtI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACpG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;YAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM;gBACvG,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;gBACvF,uBAAuB,EAAE,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;YACnE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAChD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YAChE,IAAI,QAAQ,CAAC,WAAW;gBAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpI,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,CAAC;YAC3F,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAU,EAAE,CAAC;YACtH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC3N,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ;YAC/F,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAA;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACzG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;QACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAwB,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE;YACpJ,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAChD,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,OAAO,MAAM,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAA8B,EAAE,EAAE;YACzE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YAC/C,MAAM,OAAO,CAAA;QACf,CAAC,CAAC,CAAA;QACF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5I,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA0B,EAAE,MAAoB;IAC9F,UAAU,CAAC,MAAM,CAAC,CAAA;IAClB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,iDAAiD;WAC/F,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qBAAqB;WAC3G,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WACzH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;WAC1H,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,yBAAyB,CAAC,KAAK;WACtG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,yBAAyB,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC/J,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACtD,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK;WACxH,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAChH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,GAAG,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC7J,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACpD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAa,CAAA;IAC3D,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;WAChH,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;eAC1E,MAAM,CAAC,IAAI,KAAK,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;eACvG,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;mBACnG,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;gBAC3E,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACvI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QAClD,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,EAAE,OAAO,GAAG,yBAAyB,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QAC1G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACrF,IAAI,IAAI,KAAK,GAAG,GAAG,QAAQ;YAAE,OAAM;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACzG,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;mBAChE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;mBACjL,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjH,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxG,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAClF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;mBACxJ,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAClN,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACxD,CAAC,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAChF,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjK,UAAU,CAAC,MAAM,CAAC,CAAA;IAClB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED;kFACkF;AAClF,SAAS,uBAAuB,CAAC,KAAmB;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QACpH,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QAClE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QACnH,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;YAC3G,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;AACvH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,QAA6B,EAAE,OAAqB,EACrH,MAAoB;IACpB,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5D,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3C,UAAU,CAAC,MAAM,CAAC,CAAA;IAClB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;IACtH,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAG,CAAC,QAAQ,YAAY,EAAE,EAAE,YAAY,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACjH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;QACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC7D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAC/H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC1C,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,MAAgB,EAAmB,EAAE;QACxE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/H,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;YACzC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;oBAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBAAC,CAAC;gBAC3F,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAA;gBAAC,CAAC;YACvF,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YAC5E,IAAI,OAAO,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;QACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,SAAmB,EAAiB,EAAE;QAC1F,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,IAAI,CAAC,IAAI,IAAI,yBAAyB,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACvH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YAC7E,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACvG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBACpF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC1E,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACjE,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;gBACvG,MAAM,KAAK,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;gBACtD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC9F,CAAC;oBAAS,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YAC9B,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS;gBACpF,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,WAAW;YAAE,MAAM,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAClG,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAA;YACxF,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACnJ,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACrH,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACpG,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACtI,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAa,CAAA;IACnG,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;IAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU;WACpF,KAAK,CAAC,uBAAuB,KAAK,uBAAuB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAClI,UAAU,CAAC,MAAM,CAAC,CAAA;AACpB,CAAC"}
@@ -0,0 +1,79 @@
1
+ /** Repository-only identity protocol. Ordinary/legacy jobs retain their
2
+ * single-UID contract and never inherit this termination authority. */
3
+ export interface LinuxUserNamespaceMapping {
4
+ schemaVersion: 1;
5
+ ownerUid: number;
6
+ ownerGid: number;
7
+ candidateUid: number;
8
+ candidateGid: number;
9
+ hostNamespace: {
10
+ dev: number;
11
+ ino: number;
12
+ };
13
+ helpers: {
14
+ uid: {
15
+ path: '/usr/bin/newuidmap';
16
+ sha256: string;
17
+ };
18
+ gid: {
19
+ path: '/usr/bin/newgidmap';
20
+ sha256: string;
21
+ };
22
+ };
23
+ }
24
+ /** Observed independently by the Host before any candidate receives START.
25
+ * UID/GID maps are exactly [0, owner, 1], [65534, candidate, 1]. */
26
+ export interface LinuxUserNamespaceWitness {
27
+ schemaVersion: 1;
28
+ bootId: string;
29
+ mapping: LinuxUserNamespaceMapping;
30
+ namespace: {
31
+ dev: number;
32
+ ino: number;
33
+ };
34
+ parent: {
35
+ dev: number;
36
+ ino: number;
37
+ };
38
+ ownerUid: number;
39
+ leader: {
40
+ pid: number;
41
+ startTicks: string;
42
+ };
43
+ }
44
+ export interface LinuxRepositoryCandidateWitness {
45
+ schemaVersion: 1;
46
+ pid: number;
47
+ startTicks: string;
48
+ bootId: string;
49
+ namespace: {
50
+ dev: number;
51
+ ino: number;
52
+ };
53
+ uid: number;
54
+ gid: number;
55
+ groups: [];
56
+ capabilities: '0';
57
+ noNewPrivileges: true;
58
+ seccomp: 2;
59
+ }
60
+ /** Freeze the packaged implementation in each repository execution contract.
61
+ * Updating these bytes cannot silently change an already prepared job. */
62
+ export declare function linuxRepositoryImplementationDigest(): string;
63
+ export declare function validateLinuxUserNamespaceMapping(value: unknown): LinuxUserNamespaceMapping;
64
+ export declare function validateLinuxUserNamespaceWitness(value: unknown): LinuxUserNamespaceWitness;
65
+ export declare function validateLinuxRepositoryCandidateWitness(value: unknown, witness: LinuxUserNamespaceWitness): LinuxRepositoryCandidateWitness;
66
+ /** Read installation-owned allocation; never create, widen or rewrite it. */
67
+ export declare function readLinuxUserNamespaceMapping(): Promise<LinuxUserNamespaceMapping>;
68
+ /** New dispatch requires the frozen allocation and helpers, not a fresh choice. */
69
+ export declare function verifyLinuxUserNamespaceMapping(value: LinuxUserNamespaceMapping): Promise<LinuxUserNamespaceMapping>;
70
+ export declare function linuxUserNamespaceProof(request: object): Promise<unknown>;
71
+ export declare function inspectLinuxUserNamespace(mapping: LinuxUserNamespaceMapping, identity: {
72
+ pid: number;
73
+ startTicks: number | string;
74
+ }): Promise<LinuxUserNamespaceWitness>;
75
+ export declare function inspectLinuxRepositoryCandidate(witness: LinuxUserNamespaceWitness, identity: {
76
+ pid: number;
77
+ startTicks: number | string;
78
+ }): Promise<LinuxRepositoryCandidateWitness>;
79
+ //# sourceMappingURL=linux-user-namespace.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"linux-user-namespace.d.ts","sourceRoot":"","sources":["../src/linux-user-namespace.ts"],"names":[],"mappings":"AAQA;uEACuE;AACvE,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C,OAAO,EAAE;QACP,GAAG,EAAE;YAAE,IAAI,EAAE,oBAAoB,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;QACnD,GAAG,EAAE;YAAE,IAAI,EAAE,oBAAoB,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KACpD,CAAA;CACF;AAED;oEACoE;AACpE,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,yBAAyB,CAAA;IAClC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,CAAC,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,EAAE,CAAA;IACV,YAAY,EAAE,GAAG,CAAA;IACjB,eAAe,EAAE,IAAI,CAAA;IACrB,OAAO,EAAE,CAAC,CAAA;CACX;AAQD;0EAC0E;AAC1E,wBAAgB,mCAAmC,IAAI,MAAM,CAwB5D;AAmBD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAc3F;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAU3F;AAED,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,GAAG,+BAA+B,CAU3I;AAsCD,6EAA6E;AAC7E,wBAAsB,6BAA6B,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAYxF;AAED,mFAAmF;AACnF,wBAAsB,+BAA+B,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAW1H;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB/E;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAG9K;AAED,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAG1L"}
@@ -0,0 +1,234 @@
1
+ import { createHash } from 'node:crypto';
2
+ import { spawn } from 'node:child_process';
3
+ import { closeSync, constants, fstatSync, openSync, readSync } from 'node:fs';
4
+ import { lstat, readFile, realpath, stat } from 'node:fs/promises';
5
+ import { userInfo } from 'node:os';
6
+ import { dirname } from 'node:path';
7
+ import { fileURLToPath } from 'node:url';
8
+ const PROOF = fileURLToPath(new URL('../runtime/linux-userns-proof.py', import.meta.url));
9
+ const HEX = /^[a-f0-9]{64}$/u;
10
+ const UUID = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u;
11
+ const TICKS = /^[1-9][0-9]{0,63}$/u;
12
+ function fail(message) { throw new Error(`Linux user namespace: ${message}`); }
13
+ /** Freeze the packaged implementation in each repository execution contract.
14
+ * Updating these bytes cannot silently change an already prepared job. */
15
+ export function linuxRepositoryImplementationDigest() {
16
+ const digest = createHash('sha256').update('linux-repository-implementation-v1\0');
17
+ for (const name of ['linux-userns-launcher.py', 'linux-candidate-entry.py', 'linux-namespace-worker.mjs',
18
+ 'linux-seccomp.py', 'linux-seccomp-policy.json', 'linux-userns-proof.py']) {
19
+ const path = fileURLToPath(new URL(`../runtime/${name}`, import.meta.url));
20
+ const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
21
+ try {
22
+ const before = fstatSync(fd);
23
+ if (!before.isFile() || before.size < 1 || before.size > 1_048_576 || before.mode & 0o022)
24
+ fail('unsafe packaged runtime file');
25
+ const bytes = Buffer.alloc(before.size);
26
+ let used = 0;
27
+ while (used < bytes.length) {
28
+ const count = readSync(fd, bytes, used, bytes.length - used, used);
29
+ if (!count)
30
+ fail('packaged runtime file truncated');
31
+ used += count;
32
+ }
33
+ if (readSync(fd, Buffer.alloc(1), 0, 1, used))
34
+ fail('packaged runtime file grew');
35
+ const after = fstatSync(fd);
36
+ if (before.dev !== after.dev || before.ino !== after.ino
37
+ || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
38
+ fail('packaged runtime file changed');
39
+ digest.update(name).update('\0').update(String(bytes.length)).update('\0').update(bytes).update('\0');
40
+ }
41
+ finally {
42
+ closeSync(fd);
43
+ }
44
+ }
45
+ return digest.digest('hex');
46
+ }
47
+ const natural = (value) => Number.isSafeInteger(value) && value >= 0;
48
+ const positive = (value) => natural(value) && value > 0;
49
+ function fields(value, expected) {
50
+ if (!value || typeof value !== 'object' || Object.getPrototypeOf(value) !== Object.prototype
51
+ || Object.keys(value).sort().join() !== [...expected].sort().join())
52
+ fail('record fields differ');
53
+ }
54
+ function namespace(value) {
55
+ fields(value, ['dev', 'ino']);
56
+ if (!natural(value.dev) || !positive(value.ino))
57
+ fail('invalid namespace identity');
58
+ }
59
+ const sameNamespace = (left, right) => left.dev === right.dev && left.ino === right.ino;
60
+ function frozen(value) {
61
+ const copy = structuredClone(value);
62
+ const freeze = (item) => { if (item && typeof item === 'object') {
63
+ Object.values(item).forEach(freeze);
64
+ Object.freeze(item);
65
+ } };
66
+ freeze(copy);
67
+ return copy;
68
+ }
69
+ export function validateLinuxUserNamespaceMapping(value) {
70
+ fields(value, ['schemaVersion', 'ownerUid', 'ownerGid', 'candidateUid', 'candidateGid', 'hostNamespace', 'helpers']);
71
+ if (value.schemaVersion !== 1 || !positive(value.ownerUid) || !natural(value.ownerGid)
72
+ || !positive(value.candidateUid) || value.candidateUid < 65_536 || value.candidateUid > 0xffff_fffe
73
+ || !positive(value.candidateGid) || value.candidateGid < 65_536 || value.candidateGid > 0xffff_fffe
74
+ || value.ownerUid === value.candidateUid || value.ownerGid === value.candidateGid)
75
+ fail('invalid mapping');
76
+ namespace(value.hostNamespace);
77
+ fields(value.helpers, ['uid', 'gid']);
78
+ for (const kind of ['uid', 'gid']) {
79
+ const helper = value.helpers[kind];
80
+ fields(helper, ['path', 'sha256']);
81
+ if (helper.path !== `/usr/bin/new${kind}map` || typeof helper.sha256 !== 'string' || !HEX.test(helper.sha256))
82
+ fail('invalid mapping helper');
83
+ }
84
+ return frozen(value);
85
+ }
86
+ export function validateLinuxUserNamespaceWitness(value) {
87
+ fields(value, ['schemaVersion', 'bootId', 'mapping', 'namespace', 'parent', 'ownerUid', 'leader']);
88
+ const mapping = validateLinuxUserNamespaceMapping(value.mapping);
89
+ namespace(value.namespace);
90
+ namespace(value.parent);
91
+ fields(value.leader, ['pid', 'startTicks']);
92
+ if (value.schemaVersion !== 1 || typeof value.bootId !== 'string' || !UUID.test(value.bootId)
93
+ || value.ownerUid !== mapping.ownerUid || sameNamespace(value.namespace, mapping.hostNamespace)
94
+ || !sameNamespace(value.parent, mapping.hostNamespace) || !positive(value.leader.pid)
95
+ || typeof value.leader.startTicks !== 'string' || !TICKS.test(value.leader.startTicks))
96
+ fail('invalid namespace witness');
97
+ return frozen(value);
98
+ }
99
+ export function validateLinuxRepositoryCandidateWitness(value, witness) {
100
+ fields(value, ['schemaVersion', 'pid', 'startTicks', 'bootId', 'namespace', 'uid', 'gid', 'groups', 'capabilities', 'noNewPrivileges', 'seccomp']);
101
+ const anchor = validateLinuxUserNamespaceWitness(witness);
102
+ namespace(value.namespace);
103
+ if (value.schemaVersion !== 1 || !positive(value.pid) || typeof value.startTicks !== 'string' || !TICKS.test(value.startTicks)
104
+ || value.bootId !== anchor.bootId || !sameNamespace(value.namespace, anchor.namespace)
105
+ || value.uid !== anchor.mapping.candidateUid || value.gid !== anchor.mapping.candidateGid
106
+ || !Array.isArray(value.groups) || value.groups.length !== 0 || value.capabilities !== '0'
107
+ || value.noNewPrivileges !== true || value.seccomp !== 2)
108
+ fail('invalid candidate witness');
109
+ return frozen(value);
110
+ }
111
+ async function trustedSystemFile(path, executable = false) {
112
+ if (await realpath(path) !== path)
113
+ fail(`noncanonical system file: ${path}`);
114
+ let parent = dirname(path);
115
+ for (;;) {
116
+ const item = await lstat(parent);
117
+ if (!item.isDirectory() || item.isSymbolicLink() || item.uid !== 0 || item.mode & 0o022)
118
+ fail('untrusted system parent');
119
+ if (parent === '/')
120
+ break;
121
+ parent = dirname(parent);
122
+ }
123
+ const before = await lstat(path);
124
+ if (!before.isFile() || before.isSymbolicLink() || before.uid !== 0 || before.mode & 0o022 || before.size > 1_048_576
125
+ || executable && (before.mode & 0o4111) !== 0o4111)
126
+ fail(`untrusted system file: ${path}`);
127
+ const bytes = await readFile(path), after = await lstat(path);
128
+ if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs
129
+ || bytes.length !== before.size)
130
+ fail('system file changed');
131
+ return bytes;
132
+ }
133
+ async function allocation(kind, owner, name, selected) {
134
+ const content = (await trustedSystemFile(`/etc/sub${kind}`)).toString('utf8');
135
+ const allocated = [];
136
+ for (const line of content.split('\n')) {
137
+ if (!line || line.startsWith('#'))
138
+ continue;
139
+ const parts = line.split(':');
140
+ if (parts[0] !== name && parts[0] !== String(owner))
141
+ continue;
142
+ if (parts.length !== 3 || !/^[0-9]+$/u.test(parts[1]) || !/^[0-9]+$/u.test(parts[2]))
143
+ fail('invalid subordinate allocation');
144
+ const start = Number(parts[1]), length = Number(parts[2]);
145
+ if (!natural(start) || !positive(length) || start + length > 0xffff_ffff)
146
+ fail('invalid subordinate range');
147
+ if (selected !== undefined && selected >= start && selected < start + length)
148
+ return selected;
149
+ const first = Math.max(start, 65_536);
150
+ if (first < start + length && first !== owner)
151
+ allocated.push(first);
152
+ }
153
+ if (selected !== undefined || allocated.length === 0)
154
+ fail(`subordinate ${kind} allocation is unavailable`);
155
+ return Math.min(...allocated);
156
+ }
157
+ /** Read installation-owned allocation; never create, widen or rewrite it. */
158
+ export async function readLinuxUserNamespaceMapping() {
159
+ if (process.platform !== 'linux' || !process.getuid?.() || !process.getgid)
160
+ fail('requires non-root Linux');
161
+ const ownerUid = process.getuid(), ownerGid = process.getgid(), name = userInfo().username;
162
+ const [candidateUid, candidateGid, uid, gid, host] = await Promise.all([
163
+ allocation('uid', ownerUid, name), allocation('gid', ownerUid, name),
164
+ trustedSystemFile('/usr/bin/newuidmap', true), trustedSystemFile('/usr/bin/newgidmap', true), stat('/proc/self/ns/user'),
165
+ ]);
166
+ return validateLinuxUserNamespaceMapping({ schemaVersion: 1, ownerUid, ownerGid, candidateUid, candidateGid,
167
+ hostNamespace: { dev: host.dev, ino: host.ino }, helpers: {
168
+ uid: { path: '/usr/bin/newuidmap', sha256: createHash('sha256').update(uid).digest('hex') },
169
+ gid: { path: '/usr/bin/newgidmap', sha256: createHash('sha256').update(gid).digest('hex') },
170
+ } });
171
+ }
172
+ /** New dispatch requires the frozen allocation and helpers, not a fresh choice. */
173
+ export async function verifyLinuxUserNamespaceMapping(value) {
174
+ const mapping = validateLinuxUserNamespaceMapping(value);
175
+ if (process.platform !== 'linux' || process.getuid?.() !== mapping.ownerUid || process.getgid?.() !== mapping.ownerGid)
176
+ fail('Host owner differs');
177
+ const host = await stat('/proc/self/ns/user');
178
+ if (!sameNamespace(host, mapping.hostNamespace))
179
+ fail('Host user namespace changed');
180
+ const name = userInfo().username;
181
+ await Promise.all([allocation('uid', mapping.ownerUid, name, mapping.candidateUid), allocation('gid', mapping.ownerUid, name, mapping.candidateGid)]);
182
+ for (const kind of ['uid', 'gid']) {
183
+ if (createHash('sha256').update(await trustedSystemFile(mapping.helpers[kind].path, true)).digest('hex') !== mapping.helpers[kind].sha256)
184
+ fail('mapping helper changed');
185
+ }
186
+ return mapping;
187
+ }
188
+ export async function linuxUserNamespaceProof(request) {
189
+ const bytes = JSON.stringify(request);
190
+ if (Buffer.byteLength(bytes) > 1_048_576)
191
+ fail('proof request exceeds bound');
192
+ return await new Promise((resolve, reject) => {
193
+ const child = spawn('/usr/bin/python3', ['-I', '-S', PROOF], { stdio: ['pipe', 'pipe', 'pipe'], shell: false,
194
+ env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' } });
195
+ let output = '', diagnostic = '', size = 0, exceeded = false;
196
+ const timer = setTimeout(() => child.kill('SIGKILL'), 5_000);
197
+ child.stdin.on('error', () => { child.kill('SIGKILL'); });
198
+ child.stdout.setEncoding('utf8');
199
+ child.stderr.setEncoding('utf8');
200
+ child.stdout.on('data', (chunk) => {
201
+ if ((size += Buffer.byteLength(chunk)) > 1_048_576) {
202
+ exceeded = true;
203
+ child.kill('SIGKILL');
204
+ }
205
+ else
206
+ output += chunk;
207
+ });
208
+ child.stderr.on('data', (chunk) => { diagnostic = (diagnostic + chunk).slice(-4096); });
209
+ child.once('error', error => { clearTimeout(timer); reject(error); });
210
+ child.once('close', code => {
211
+ clearTimeout(timer);
212
+ if (code !== 0 || exceeded) {
213
+ reject(new Error(`Linux user namespace proof failed: ${diagnostic.slice(-512)}`));
214
+ return;
215
+ }
216
+ try {
217
+ resolve(JSON.parse(output));
218
+ }
219
+ catch (error) {
220
+ reject(error);
221
+ }
222
+ });
223
+ child.stdin.end(bytes);
224
+ });
225
+ }
226
+ export async function inspectLinuxUserNamespace(mapping, identity) {
227
+ return validateLinuxUserNamespaceWitness(await linuxUserNamespaceProof({ operation: 'anchor', mapping: validateLinuxUserNamespaceMapping(mapping),
228
+ identity: { pid: identity.pid, startTicks: String(identity.startTicks) } }));
229
+ }
230
+ export async function inspectLinuxRepositoryCandidate(witness, identity) {
231
+ return validateLinuxRepositoryCandidateWitness(await linuxUserNamespaceProof({ operation: 'candidate', witness: validateLinuxUserNamespaceWitness(witness),
232
+ identity: { pid: identity.pid, startTicks: String(identity.startTicks) } }), witness);
233
+ }
234
+ //# sourceMappingURL=linux-user-namespace.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"linux-user-namespace.js","sourceRoot":"","sources":["../src/linux-user-namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA2CxC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACzF,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,IAAI,GAAG,gDAAgD,CAAA;AAC7D,MAAM,KAAK,GAAG,qBAAqB,CAAA;AACnC,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAE7F;0EAC0E;AAC1E,MAAM,UAAU,mCAAmC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAA;IAClF,KAAK,MAAM,IAAI,IAAI,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,4BAA4B;QACtG,kBAAkB,EAAE,2BAA2B,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAC3F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;gBAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC/H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAA;gBAClE,IAAI,CAAC,KAAK;oBAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;gBACnD,IAAI,IAAI,KAAK,CAAA;YACf,CAAC;YACD,IAAI,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;gBAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;YACjF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;YAC3B,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;mBACnD,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;YAC9I,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACvG,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AACD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAA;AAC1G,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AACjF,SAAS,MAAM,CAAC,KAAc,EAAE,QAA2B;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;WACvF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;AACrG,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;AACrF,CAAC;AACD,MAAM,aAAa,GAAG,CAAC,IAAkC,EAAE,KAAmC,EAAW,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAA;AAC5J,SAAS,MAAM,CAAI,KAAQ;IACzB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,CAAC,IAAa,EAAQ,EAAE,GAAG,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC,CAAC,CAAC,CAAA;IAC9I,MAAM,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAA;IACpH,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;WACjF,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,WAAW;WAChG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,WAAW;WAChG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC5G,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/I,CAAC;IACD,OAAO,MAAM,CAAC,KAA6C,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClG,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChE,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;IAC3C,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;WACxF,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC;WAC5F,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;WAClF,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IAC3H,OAAO,MAAM,CAAC,KAA6C,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,uCAAuC,CAAC,KAAc,EAAE,OAAkC;IACxG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAA;IAClJ,MAAM,MAAM,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAA;IACzD,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC1B,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;WACzH,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;WACnF,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,YAAY;WACtF,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,GAAG;WACvF,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAC,KAAmD,CAAC,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,UAAU,GAAG,KAAK;IAC/D,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAC5E,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;YAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;QACxH,IAAI,MAAM,KAAK,GAAG;YAAE,MAAK;QACzB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,SAAS;WAChH,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WACrH,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAmB,EAAE,KAAa,EAAE,IAAY,EAAE,QAAiB;IAC3F,MAAM,OAAO,GAAG,CAAC,MAAM,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;QAC9H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,MAAM,GAAG,WAAW;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC3G,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,GAAG,KAAK,GAAG,MAAM;YAAE,OAAO,QAAQ,CAAA;QAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACrC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAA;IAC3G,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,6BAA6B;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAC3G,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAA;IAC1F,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC;QACpE,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC;KACzH,CAAC,CAAA;IACF,OAAO,iCAAiC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY;QACzG,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE;YACxD,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC3F,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC5F,EAAE,CAAC,CAAA;AACR,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAgC;IACpF,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAClJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IACpF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAA;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACrJ,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC3K,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAC7E,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK;YAC1G,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3D,IAAI,MAAM,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5D,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACxD,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAClE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;;gBACzF,MAAM,IAAI,KAAK,CAAA;QACtB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,UAAU,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC9F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAM;YAAC,CAAC;YACzH,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAAC,CAAC;QACrE,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAkC,EAAE,QAAsD;IACxI,OAAO,iCAAiC,CAAC,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;QAC/I,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAkC,EAAE,QAAsD;IAC9I,OAAO,uCAAuC,CAAC,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;QACxJ,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;AACzF,CAAC"}
@@ -0,0 +1,27 @@
1
+ import type { LinuxCgroupRoots } from './linux-cgroups.js';
2
+ import { type LinuxRuntime } from './linux-runtime.js';
3
+ import type { IsolationLimits, IsolationResult } from './types.js';
4
+ import { type LinuxRunnerStateSeal } from './linux-runner-state.js';
5
+ export interface LinuxVerifierRunnerConfig {
6
+ backend: 'linux-native';
7
+ stateRoot: string;
8
+ stateSeal?: LinuxRunnerStateSeal;
9
+ authorityDigest: string;
10
+ command: string;
11
+ expiresAt: number;
12
+ maxRuns: number;
13
+ maxTotalDurationMs: number;
14
+ maxDurationMs: number;
15
+ maxOutputBytes: number;
16
+ runtime: LinuxRuntime;
17
+ cgroupRoots: LinuxCgroupRoots;
18
+ limits?: Partial<IsolationLimits>;
19
+ }
20
+ /** Private operator API. Uses the same ledger, grants and history as the Docker verifier. */
21
+ export declare class LinuxVerifierRunner {
22
+ #private;
23
+ constructor(input: LinuxVerifierRunnerConfig);
24
+ run: (key: string, artifact: string, stdin: string, signal: AbortSignal) => Promise<IsolationResult>;
25
+ close: () => Promise<void>;
26
+ }
27
+ //# sourceMappingURL=linux-verifier-runner.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"linux-verifier-runner.d.ts","sourceRoot":"","sources":["../src/linux-verifier-runner.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAI1D,OAAO,EAAgE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIpH,OAAO,KAAK,EAAmC,eAAe,EAAoB,eAAe,EAAE,MAAM,YAAY,CAAA;AACrH,OAAO,EAAyD,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAE1H,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,oBAAoB,CAAA;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,YAAY,CAAA;IACrB,WAAW,EAAE,gBAAgB,CAAA;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;CAClC;AAUD,6FAA6F;AAC7F,qBAAa,mBAAmB;;gBAiBlB,KAAK,EAAE,yBAAyB;IA0J5C,GAAG,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CAKlG;IAmFD,KAAK,QAAa,OAAO,CAAC,IAAI,CAAC,CAU9B;CACF"}