@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/native-resources.js

@@ -0,0 +1,354 @@
+import { createHash } from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, symlink, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { tmpdir } from 'node:os';
+import { isDeepStrictEqual } from 'node:util';
+import { hashLinuxRuntimeTree, verifyLinuxRuntime } from './linux-runtime.js';
+import { copyLinuxRuntimeManifests } from './linux-runtime-source.js';
+export { freezeLinuxRuntimeSource } from './linux-runtime-source.js';
+export { probeLinuxIsolationRuntime } from './probe.js';
+export { validateLinuxRuntime } from './linux-runtime.js';
+export { validateLinuxCgroupRoots } from './linux-execution-contract.js';
+export { discoverLinuxCgroupRoots, parseLinuxV1ControllerMounts, RsiLinuxCgroupUnavailableError } from './native-cgroup-roots.js';
+export const NODE_VERSION = 'v22.23.2';
+const PNPM_VERSION = '11.7.0';
+// nodejs.org/dist/v22.23.2/SHASUMS256.txt and the exact npm package tarballs.
+export const NODE_ARCHIVES = {
+    x64: 'b294a556e639d64338823920e5866c21c02741742d2e1529ee1a225c1ec9252a',
+    arm64: '013b59cfd2819703a6f4a14ab891fc46fc2a4e3f5bcd92de3fb4929b43e35b30',
+};
+const PNPM_ARCHIVE_SHA = 'deafa7ec98a1218b6a047289b92fbe2395c1e22d3495bb711653013218ee15ee';
+const PNPM_EXE_ARCHIVE_SHA = '0424127c10888e17ebbb3cfc0be685b2a87079ca7bc372bec0036313e3f1b4d5';
+const PNPM_NATIVE_ARCHIVES = {
+    x64: '90a6f44ad45f9ceb815ce63c55568bd14b370247c394b97f6767ef59036aca0e',
+    arm64: 'b196d44af42ae26308b5ca145091ed2febd569e6590e906fe54a223222e1c348',
+};
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const canonical = (path) => typeof path === 'string' && isAbsolute(path) && resolve(path) === path
+    && !path.includes('\r') && !path.includes('\n') && !path.includes('\0');
+const within = (path, root) => path === root || path.startsWith(root + sep);
+function fail(message) { throw new Error(`rsi Linux runtime: ${message}`); }
+/** Environmental prerequisites are missing (platform, binaries, namespace or
+ * tmpfs support). Integrity/identity failures stay hard errors via fail(). */
+export class LinuxRsiRuntimeUnavailableError extends Error {
+    constructor(message) { super(`rsi Linux runtime unavailable: ${message}`); }
+}
+async function privateDirectory(path) {
+    if (!canonical(path) || await realpath(path) !== path)
+        fail('noncanonical private directory');
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()
+        || info.mode & 0o077)
+        fail('unsafe private directory');
+}
+async function syncDirectory(path) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function sourceIdentity(input) {
+    input.signal?.throwIfAborted();
+    await input.revalidateSource?.();
+    input.signal?.throwIfAborted();
+}
+async function run(file, args, cwd, environment, signal, timeoutMs, maximumOutput = 4_194_304) {
+    signal.throwIfAborted();
+    return new Promise((resolveOutput, reject) => {
+        const child = spawn(file, args, { cwd, env: environment, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+        const chunks = [];
+        let size = 0, stderr = '', finished = false;
+        const stop = () => { if (child.pid)
+            try {
+                process.kill(-child.pid, 'SIGKILL');
+            }
+            catch {
+                child.kill('SIGKILL');
+            } };
+        const timer = setTimeout(stop, timeoutMs);
+        const abort = () => stop();
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+        child.stdout.on('data', (chunk) => { size += chunk.length; if (size > maximumOutput)
+            stop();
+        else
+            chunks.push(chunk); });
+        child.stderr.on('data', (chunk) => { stderr = (stderr + chunk.toString('utf8')).slice(-2048); });
+        child.once('error', error => { finished = true; clearTimeout(timer); signal.removeEventListener('abort', abort); reject(error); });
+        child.once('close', code => {
+            if (finished)
+                return;
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            if (signal.aborted || code !== 0 || size > maximumOutput)
+                reject(new Error(`Linux runtime command failed: ${stderr.slice(-200)}`));
+            else
+                resolveOutput(Buffer.concat(chunks));
+        });
+    });
+}
+export async function officialArchive(path, url, expected, maximum, stage, signal) {
+    const destination = join(stage, `archive-${expected.slice(0, 16)}.tgz`);
+    if (path === undefined) {
+        const networkEnv = { PATH: '/usr/bin:/bin', HOME: stage, LANG: 'C', LC_ALL: 'C' };
+        for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy',
+            'SSL_CERT_FILE', 'SSL_CERT_DIR'])
+            if (process.env[key] !== undefined)
+                networkEnv[key] = process.env[key];
+        const bytes = await run('/usr/bin/curl', ['--disable', '--fail', '--silent', '--show-error', '--proto', '=https',
+            '--max-redirs', '0', '--connect-timeout', '15', '--max-time', '180', '--url', url], stage, networkEnv, signal, 190_000, maximum);
+        await writeFile(destination, bytes, { flag: 'wx', mode: 0o600 });
+    }
+    else {
+        if (!canonical(path) || await realpath(path) !== path)
+            fail('cached archive path is noncanonical');
+        const info = await lstat(path);
+        if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > maximum)
+            fail('cached archive unsafe');
+        const data = await readFile(path);
+        if (data.length !== info.size)
+            fail('cached archive changed');
+        await writeFile(destination, data, { flag: 'wx', mode: 0o600 });
+    }
+    const archive = await readFile(destination);
+    if (archive.length < 1 || archive.length > maximum || sha(archive) !== expected)
+        fail('official archive digest differs');
+    return destination;
+}
+export async function extractExact(archive, member, cwd, signal, maximum) {
+    return run('/usr/bin/tar', ['-xOzf', archive, member], cwd, { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C', COPYFILE_DISABLE: '1' }, signal, 120_000, maximum);
+}
+function requireLinuxPlatform() {
+    if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)) {
+        throw new LinuxRsiRuntimeUnavailableError('Linux x64/arm64 required');
+    }
+}
+async function doctor() {
+    const unavailable = (message) => { throw new LinuxRsiRuntimeUnavailableError(message); };
+    requireLinuxPlatform();
+    const env = { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C' };
+    for (const command of ['/usr/bin/git', '/usr/bin/curl', '/usr/bin/tar', '/usr/bin/bwrap',
+        '/usr/bin/unshare', '/usr/bin/mount', '/usr/bin/bash', '/usr/bin/python3']) {
+        const result = spawnSync(command, ['--version'], { env, timeout: 5_000, maxBuffer: 4096 });
+        if (result.error || result.status !== 0)
+            unavailable(`required Linux prerequisite unavailable: ${command}`);
+    }
+    const bwrap = spawnSync('/usr/bin/bwrap', ['--unshare-all', '--ro-bind', '/usr', '/usr',
+        '--ro-bind', '/lib', '/lib', ...(process.arch === 'x64' ? ['--ro-bind', '/lib64', '/lib64'] : []),
+        '--proc', '/proc', '--dev', '/dev', '--dir', '/tmp', '/usr/bin/true'], { env, timeout: 5_000, maxBuffer: 4096 });
+    if (bwrap.error || bwrap.status !== 0)
+        unavailable('Linux namespace sandbox unavailable');
+    const probe = await mkdtemp(join(tmpdir(), 'dsh-linux-runtime-doctor-'));
+    try {
+        const mounted = spawnSync('/usr/bin/unshare', ['--user', '--map-root-user', '--mount', '--pid', '--fork',
+            '--kill-child=SIGKILL', '/usr/bin/bash', '-c',
+            'set -eu; mount -t tmpfs -o size=1048576,nr_inodes=16 tmpfs "$1"; test "$(stat -f -c %T "$1")" = tmpfs',
+            'dsh-linux-doctor', probe], { env, timeout: 5_000, maxBuffer: 4096 });
+        if (mounted.error || mounted.status !== 0)
+            unavailable('bounded Linux tmpfs unavailable');
+    }
+    finally {
+        await rm(probe, { recursive: true, force: true });
+    }
+}
+async function readExisting(final, input, manifests) {
+    await privateDirectory(final);
+    if (JSON.stringify((await readdir(final)).sort()) !== JSON.stringify(['bootstrap.json', 'runtime'])) {
+        fail('Linux runtime incomplete');
+    }
+    const receiptPath = join(final, 'bootstrap.json');
+    const info = await lstat(receiptPath);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > 4_194_304
+        || info.mode & 0o077 || info.uid !== process.getuid?.())
+        fail('Linux runtime receipt unsafe');
+    const fd = await open(receiptPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let receipt;
+    try {
+        const opened = await fd.stat();
+        if (opened.dev !== info.dev || opened.ino !== info.ino || opened.size !== info.size)
+            fail('Linux receipt changed');
+        receipt = JSON.parse(await fd.readFile({ encoding: 'utf8' }));
+    }
+    finally {
+        await fd.close();
+    }
+    const { receiptDigest, ...content } = receipt;
+    const hashes = Object.fromEntries([...manifests].map(([name, bytes]) => [name, sha(bytes)]));
+    const archives = { node: NODE_ARCHIVES[process.arch], pnpm: PNPM_ARCHIVE_SHA,
+        pnpmExe: PNPM_EXE_ARCHIVE_SHA, pnpmNative: PNPM_NATIVE_ARCHIVES[process.arch] };
+    if (receiptDigest !== sha(JSON.stringify(content)) || receipt.schemaVersion !== 3
+        || receipt.backend !== 'linux-native' || receipt.dshHome !== input.dshHome || receipt.profile !== input.profile
+        || receipt.sourceCommit !== input.source.sourceCommit || receipt.lockSha256 !== hashes['pnpm-lock.yaml']
+        || !isDeepStrictEqual(receipt.manifestHashes, hashes) || !isDeepStrictEqual(receipt.archives, archives)
+        || receipt.runtime.root.path !== join(final, 'runtime')
+        || receipt.runtime.sourceCommit !== receipt.sourceCommit || receipt.runtime.lockSha256 !== receipt.lockSha256) {
+        fail('Linux runtime receipt differs');
+    }
+    await verifyLinuxRuntime(receipt.runtime, input.signal);
+    await sourceIdentity(input);
+    return { schemaVersion: 3, backend: 'linux-native', sourceCommit: receipt.sourceCommit,
+        lockSha256: receipt.lockSha256, runtime: receipt.runtime };
+}
+/** Build only the approved manifest and lock dependency closure; candidate code is never present. */
+export async function prepareLinuxRuntime(input) {
+    const manifests = copyLinuxRuntimeManifests(input.source);
+    input = { ...input, source: { version: input.source.version, sourceCommit: input.source.sourceCommit,
+            manifests: [...manifests].map(([path, bytes]) => ({ path, bytes })) } };
+    input.signal?.throwIfAborted();
+    await doctor();
+    if (!canonical(input.dshHome) || !PROFILE.test(input.profile))
+        fail('invalid bootstrap identity');
+    await privateDirectory(input.dshHome);
+    await sourceIdentity(input);
+    const parent = join(input.dshHome, 'rsi-linux-runtimes');
+    await mkdir(parent, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+        throw error; });
+    await privateDirectory(parent);
+    const final = join(parent, input.profile);
+    if (await lstat(final).then(() => true, error => { if (error.code === 'ENOENT')
+        return false; throw error; })) {
+        return readExisting(final, input, manifests);
+    }
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(1_200_000)]);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    await chmod(stage, 0o700);
+    try {
+        const root = join(stage, 'runtime'), cache = join(root, 'cache'), store = join(root, 'store');
+        for (const directory of [root, cache, store])
+            await mkdir(directory, { mode: 0o700 });
+        const arch = process.arch;
+        const archives = { node: NODE_ARCHIVES[arch], pnpm: PNPM_ARCHIVE_SHA,
+            pnpmExe: PNPM_EXE_ARCHIVE_SHA, pnpmNative: PNPM_NATIVE_ARCHIVES[arch] };
+        const nodeArchive = await officialArchive(input.nodeArchivePath, `https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${arch}.tar.gz`, archives.node, 100_000_000, stage, signal);
+        const pnpmArchive = await officialArchive(input.pnpmArchivePath, `https://registry.npmjs.org/pnpm/-/pnpm-${PNPM_VERSION}.tgz`, archives.pnpm, 20_000_000, stage, signal);
+        const exeArchive = await officialArchive(input.pnpmExeArchivePath, `https://registry.npmjs.org/@pnpm/exe/-/exe-${PNPM_VERSION}.tgz`, archives.pnpmExe, 60_000_000, stage, signal);
+        const nativeArchive = await officialArchive(input.pnpmNativeArchivePath, `https://registry.npmjs.org/@pnpm/linux-${arch}/-/linux-${arch}-${PNPM_VERSION}.tgz`, archives.pnpmNative, 100_000_000, stage, signal);
+        const bin = join(root, 'bin'), pnpmRoot = join(root, 'pnpm'), nativeRoot = join(root, 'pnpm-native');
+        for (const directory of [bin, pnpmRoot, nativeRoot])
+            await mkdir(directory, { mode: 0o700 });
+        const node = await extractExact(nodeArchive, `node-${NODE_VERSION}-linux-${arch}/bin/node`, stage, signal, 150_000_000);
+        const nodePath = join(bin, 'node');
+        await writeFile(nodePath, node, { mode: 0o500 });
+        await chmod(nodePath, 0o500);
+        await run('/usr/bin/tar', ['-xzf', pnpmArchive, '--strip-components=1', '-C', pnpmRoot], stage, { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C' }, signal, 120_000);
+        await run('/usr/bin/tar', ['-xzf', exeArchive, '--strip-components=1', '-C', nativeRoot], stage, { PATH: '/usr/bin:/bin', HOME: '/nonexistent', LANG: 'C', LC_ALL: 'C' }, signal, 120_000);
+        const native = await extractExact(nativeArchive, 'package/pnpm', stage, signal, 150_000_000);
+        const nativePnpmPath = join(nativeRoot, 'pnpm');
+        await writeFile(nativePnpmPath, native, { mode: 0o500 });
+        await chmod(nativePnpmPath, 0o500);
+        // The existing release adapter binds the whole native pnpm package root
+        // and requires its exact Node and pnpm entrypoints in that same directory.
+        // Keep a separate regular copy so both the package root and the standalone
+        // Node entrypoint remain pinned without external links or shared inodes.
+        await writeFile(join(nativeRoot, 'node'), node, { flag: 'wx', mode: 0o500 });
+        for (const [name, bytes] of manifests) {
+            const path = join(root, name);
+            await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+            await writeFile(path, bytes, { mode: 0o600 });
+        }
+        const pnpmPath = join(pnpmRoot, 'bin', 'pnpm.mjs');
+        const env = { PATH: `${bin}:/usr/bin:/bin`, HOME: stage, LANG: 'C', LC_ALL: 'C', CI: 'true',
+            npm_config_userconfig: '/dev/null', npm_config_globalconfig: '/dev/null',
+            npm_config_registry: 'https://registry.npmjs.org/', npm_config_store_dir: store,
+            npm_config_cache_dir: cache, pnpm_config_cache_dir: cache, COREPACK_ENABLE_PROJECT_SPEC: '0' };
+        for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy',
+            'SSL_CERT_FILE', 'SSL_CERT_DIR'])
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        await run(nodePath, [pnpmPath, 'fetch', '--workspace-root', '--frozen-lockfile', '--ignore-scripts', '--ignore-pnpmfile',
+            '--store-dir', store, '--cache-dir', cache,
+            '--config.package-import-method=copy', '--reporter=append-only'], root, env, signal, 600_000);
+        await run(nodePath, [pnpmPath, 'install', '--offline', '--frozen-lockfile', '--ignore-scripts', '--ignore-pnpmfile',
+            '--store-dir', store, '--cache-dir', cache,
+            '--config.package-import-method=copy', '--reporter=append-only'], root, env, signal, 600_000);
+        await sourceIdentity(input);
+        const modulesPath = join(root, 'node_modules');
+        for (const name of ['@deepseek-ai/dsh-tools', '@deepseek-ai/dsh-system-prompt']) {
+            const link = join(modulesPath, name);
+            if (await lstat(link).then(() => true, error => { if (error.code === 'ENOENT')
+                return false; throw error; }))
+                continue;
+            const candidates = ['plugins/assistant-verifier', 'plugins/assistant-isolation',
+                'plugins/plugin-control-plane', 'plugins/lark-channel'].map(workspace => join(root, workspace, 'node_modules', name));
+            let target;
+            for (const candidate of candidates) {
+                const actual = await realpath(candidate).catch(error => { if (error.code === 'ENOENT')
+                    return undefined; throw error; });
+                if (actual && within(actual, root)) {
+                    target = actual;
+                    break;
+                }
+            }
+            if (!target)
+                fail(`Linux runtime package missing: ${name}`);
+            await mkdir(dirname(link), { recursive: true, mode: 0o700 });
+            await symlink(relative(dirname(link), target), link);
+        }
+        const versions = { node: NODE_VERSION, pnpm: PNPM_VERSION, typescript: '', cordis: '',
+            tools: '', systemPrompt: '' };
+        for (const [key, name] of [['typescript', 'typescript'], ['cordis', '@deepseek-ai/cordis'],
+            ['tools', '@deepseek-ai/dsh-tools'], ['systemPrompt', '@deepseek-ai/dsh-system-prompt']]) {
+            const actual = await realpath(join(modulesPath, name, 'package.json'));
+            if (!within(actual, root))
+                fail(`Linux runtime package escaped root: ${name}`);
+            const manifest = JSON.parse(await readFile(actual, 'utf8'));
+            if (!manifest.version)
+                fail(`Linux runtime package missing: ${name}`);
+            versions[key] = manifest.version;
+        }
+        const treeSha = await hashLinuxRuntimeTree(root);
+        const info = await stat(root);
+        const runtime = { schemaVersion: 1, backend: 'linux-native',
+            platform: `linux-${arch}`, sourceCommit: input.source.sourceCommit,
+            lockSha256: sha(manifests.get('pnpm-lock.yaml')),
+            root: { path: join(final, 'runtime'), dev: info.dev, ino: info.ino, sha256: treeSha },
+            nodePath: join(final, 'runtime', 'bin', 'node'), nodeSha256: sha(node),
+            pnpmPath: join(final, 'runtime', 'pnpm', 'bin', 'pnpm.mjs'),
+            nativePnpmRoot: join(final, 'runtime', 'pnpm-native'),
+            nativePnpmPath: join(final, 'runtime', 'pnpm-native', 'pnpm'),
+            modulesPath: join(final, 'runtime', 'node_modules'),
+            storePath: join(final, 'runtime', 'store'), cachePath: join(final, 'runtime', 'cache'),
+            versions: { ...versions, node: NODE_VERSION, pnpm: PNPM_VERSION } };
+        const hashes = Object.fromEntries([...manifests].map(([name, bytes]) => [name, sha(bytes)]));
+        const content = { schemaVersion: 3, backend: 'linux-native',
+            sourceCommit: input.source.sourceCommit, lockSha256: runtime.lockSha256,
+            runtime, dshHome: input.dshHome, profile: input.profile, manifestHashes: hashes, archives };
+        await writeFile(join(stage, 'bootstrap.json'), JSON.stringify({ ...content,
+            receiptDigest: sha(JSON.stringify(content)) }), { mode: 0o600 });
+        // pnpm may put diagnostics or transient state under its private HOME.
+        // Only the pinned runtime and receipt become durable authority inputs.
+        for (const name of await readdir(stage)) {
+            if (name !== 'runtime' && name !== 'bootstrap.json')
+                await rm(join(stage, name), { recursive: true, force: true });
+        }
+        await syncDirectory(root);
+        await syncDirectory(stage);
+        await rename(stage, final);
+        await syncDirectory(parent);
+        return readExisting(final, input, manifests);
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+    }
+}
+export async function readLinuxRuntime(input) {
+    const manifests = copyLinuxRuntimeManifests(input.source);
+    input = { ...input, source: { version: input.source.version, sourceCommit: input.source.sourceCommit,
+            manifests: [...manifests].map(([path, bytes]) => ({ path, bytes })) } };
+    input.signal?.throwIfAborted();
+    requireLinuxPlatform();
+    if (!canonical(input.dshHome) || !PROFILE.test(input.profile))
+        fail('invalid bootstrap identity');
+    await privateDirectory(input.dshHome);
+    await sourceIdentity(input);
+    await privateDirectory(join(input.dshHome, 'rsi-linux-runtimes'));
+    return readExisting(join(input.dshHome, 'rsi-linux-runtimes', input.profile), input, manifests);
+}
+//# sourceMappingURL=native-resources.js.map

package/lib/native-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-resources.js","sourceRoot":"","sources":["../src/native-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxI,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAiC,MAAM,2BAA2B,CAAA;AACpG,OAAO,EAAE,wBAAwB,EAA+D,MAAM,2BAA2B,CAAA;AACjI,OAAO,EAAE,0BAA0B,EAAkC,MAAM,YAAY,CAAA;AACvF,OAAO,EAAE,oBAAoB,EAAqB,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAExE,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,8BAA8B,EAA2B,MAAM,0BAA0B,CAAA;AAE1J,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAA;AACtC,MAAM,YAAY,GAAG,QAAQ,CAAA;AAC7B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,GAAG,EAAE,kEAAkE;IACvE,KAAK,EAAE,kEAAkE;CACjE,CAAA;AACV,MAAM,gBAAgB,GAAG,kEAAkE,CAAA;AAC3F,MAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAC/F,MAAM,oBAAoB,GAAG;IAC3B,GAAG,EAAE,kEAAkE;IACvE,KAAK,EAAE,kEAAkE;CACjE,CAAA;AACV,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;OACrG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACzE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AACpG,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAE1F;8EAC8E;AAC9E,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,OAAe,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;CACpF;AA8BD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC7F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;WAC9E,IAAI,CAAC,IAAI,GAAG,KAAK;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;AAC1D,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC9F,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACtD,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,KAAwB;IACpD,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAA;IAChC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;AAChC,CAAC;AACD,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,GAAW,EAAE,WAA8B,EAC1F,MAAmB,EAAE,SAAiB,EAAE,aAAa,GAAG,SAAS;IACjE,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7G,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,KAAK,CAAA;QACxE,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG;YAAE,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC,CAAC,CAAC,CAAA;QACvH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAA;QAChC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAA;QAC3B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,aAAa;YAAE,IAAI,EAAE,CAAC;;YAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC/H,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACvG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACjI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,IAAI,QAAQ;gBAAE,OAAM;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,aAAa;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;;gBAC7H,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAwB,EAAE,GAAW,EAAE,QAAgB,EAAE,OAAe,EAC5G,KAAa,EAAE,MAAmB;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,GAAsB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QACpG,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;YACjG,eAAe,EAAE,cAAc,CAAC;YAAE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC1G,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ;YAC9G,cAAc,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAC3F,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACrC,MAAM,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QAClG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO;YAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACrH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC7D,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACxH,OAAO,WAAW,CAAA;AACpB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,GAAW,EAAE,MAAmB,EAClG,OAAe;IACf,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,EACxD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAC7H,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,+BAA+B,CAAC,0BAA0B,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,MAAM,WAAW,GAAG,CAAC,OAAe,EAAS,EAAE,GAAG,MAAM,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,CAAA;IACtG,oBAAoB,EAAE,CAAA;IACtB,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnF,KAAK,MAAM,OAAO,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB;QACtF,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1F,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,WAAW,CAAC,4CAA4C,OAAO,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;QACrF,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EACvE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,WAAW,CAAC,qCAAqC,CAAC,CAAA;IACzF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ;YACtG,sBAAsB,EAAE,eAAe,EAAE,IAAI;YAC7C,uGAAuG;YACvG,kBAAkB,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,WAAW,CAAC,iCAAiC,CAAC,CAAA;IAC3F,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,KAAwB,EACjE,SAA8B;IAC9B,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QACpG,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;WACnF,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC/F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC7E,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAClH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAY,CAAA;IAC1E,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;IAC9B,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5F,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAuB,CAAC,EAAE,IAAI,EAAE,gBAAgB;QAC7F,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAuB,CAAC,EAAE,CAAA;IACpG,IAAI,aAAa,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;WAC5E,OAAO,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WAC5G,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,gBAAgB,CAAC;WACrG,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;WACpG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC;WACpD,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAChH,IAAI,CAAC,+BAA+B,CAAC,CAAA;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;QACpF,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAA;AAC9D,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAwB;IAChE,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACzD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YAClG,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;IACzE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,MAAM,EAAE,CAAA;IACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACjG,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IACxD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;IACjG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9G,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,CAAA;IACrE,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7F,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAuB,CAAA;QAC5C,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB;YAClE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAA;QACzE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,eAAe,EAC7D,2BAA2B,YAAY,SAAS,YAAY,UAAU,IAAI,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACjI,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,eAAe,EAC7D,0CAA0C,YAAY,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACzG,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAC/D,8CAA8C,YAAY,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChH,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,qBAAqB,EACrE,0CAA0C,IAAI,YAAY,IAAI,IAAI,YAAY,MAAM,EACpF,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QACpG,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC;YAAE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,YAAY,UAAU,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QACvH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAClC,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAChD,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAC5F,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3F,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,EAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QAC5F,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAC/C,MAAM,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QAClC,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC7B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM;YAC5G,qBAAqB,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW;YACxE,mBAAmB,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,KAAK;YAC/E,oBAAoB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,4BAA4B,EAAE,GAAG,EAAE,CAAA;QAChG,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;YACjG,eAAe,EAAE,cAAc,CAAC;YAAE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB;YACtH,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK;YAC1C,qCAAqC,EAAE,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/F,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,mBAAmB;YACjH,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK;YAC1C,qCAAqC,EAAE,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/F,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,gCAAgC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC;gBAAE,SAAQ;YACrH,MAAM,UAAU,GAAG,CAAC,4BAA4B,EAAE,6BAA6B;gBAC7E,8BAA8B,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAA;YACvH,IAAI,MAA0B,CAAA;YAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,SAAS,CAAC,CAAC,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;gBACvH,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;oBAAC,MAAM,GAAG,MAAM,CAAC;oBAAC,MAAK;gBAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;YACnF,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC;YACxF,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAU,EAAE,CAAC;YACpG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAyB,CAAA;YACnF,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,IAAI,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAA;YACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAA;QAClC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,OAAO,GAAiB,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc;YACvE,QAAQ,EAAE,SAAS,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YAClE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC;YACjD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;YACrF,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;YACtE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC;YAC3D,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC;YACrD,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC;YAC7D,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC;YACnD,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC;YACtF,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAA;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5F,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,cAAuB;YAC3E,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;YACvE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QAC7F,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO;YACxE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,gBAAgB;gBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;QACrD,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QACvD,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAC9C,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAwB;IAC7D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACzD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YAClG,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;IACzE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,oBAAoB,EAAE,CAAA;IACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACjG,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAA;IACjE,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;AACjG,CAAC"}

package/lib/probe.d.ts

@@ -1,3 +1,13 @@
+import type { LinuxCgroupRoots } from './linux-cgroups.js';
+import { type LinuxRuntime } from './linux-runtime.js';
+export interface LinuxIsolationProbeConfig {
+    runtime: LinuxRuntime;
+    cgroupRoots: LinuxCgroupRoots;
+}
+/** One finite operator probe. It neither creates owner grants nor contacts Docker. */
+export declare function probeLinuxIsolationRuntime(input: LinuxIsolationProbeConfig): Promise<{
+    ready: true;
+}>;
 /** Operator-only readiness probe using the same supervisor and work-volume path as jobs. */
 export declare function probeIsolationRuntime(image: string, dockerPath?: string, socketPath?: string): Promise<{
     ready: true;

package/lib/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AASA,4FAA4F;AAC5F,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAA8E,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,CA2BlM"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAI9F,MAAM,WAAW,yBAAyB;IAAG,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,gBAAgB,CAAA;CAAE;AAEnG,sFAAsF;AACtF,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,CAqC3G;AAED,4FAA4F;AAC5F,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAA8E,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC,CA2BlM"}

package/lib/probe.js

@@ -1,11 +1,61 @@
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { defaultLimits } from './config.js';
+import { defaultLimits, validateConfig } from './config.js';
 import { configuredDockerSocketPath } from './docker-socket.js';
 import { runIsolatedProcess } from './runner.js';
 import { stageWorkspace } from './workspace.js';
+import { linuxRuntimeDigest, verifyLinuxRuntime } from './linux-runtime.js';
+import { validateLinuxExecutionContract } from './linux-execution-contract.js';
+import { prepareLinuxExecutionIntent, runLinuxExecution, readLinuxExecutionReceipt, readLinuxExecutionPartialCleanupProof } from './linux-execution.js';
+/** One finite operator probe. It neither creates owner grants nor contacts Docker. */
+export async function probeLinuxIsolationRuntime(input) {
+    if (!input || typeof input !== 'object' || Object.keys(input).sort().join() !== 'cgroupRoots,runtime')
+        throw new Error('native probe requires runtime and cgroupRoots');
+    const config = validateConfig({ backend: 'linux-native', linux: input,
+        limits: { maxDurationMs: 20_000, memoryMiB: 128, workspaceMiB: 4, workspaceInodes: 64 } });
+    if (!config.linux)
+        throw new Error('native probe configuration unavailable');
+    const runtime = config.linux.runtime;
+    await verifyLinuxRuntime(runtime);
+    const contract = validateLinuxExecutionContract({ schemaVersion: 1, backend: 'linux-native',
+        runtimeDigest: linuxRuntimeDigest(runtime), profile: 'ordinary', limits: config.limits,
+        keeperLimits: { memoryMiB: 128, pidsLimit: 64, cpus: 0.5 }, cgroupRoots: config.linux.cgroupRoots });
+    const stateRoot = await mkdtemp(join(tmpdir(), 'dsh-native-isolation-probe-'));
+    const jobId = randomUUID(), marker = randomUUID();
+    let safeToRemove = true;
+    try {
+        const intent = await prepareLinuxExecutionIntent({ stateRoot, contract, job: { id: jobId,
+                requestDigest: linuxRuntimeDigest(runtime), nativeResourceId: `linux-${jobId}`, nativeNonce: randomBytes(16).toString('hex'),
+                deadline: Date.now() + 20_000 } });
+        const context = { stateRoot, contract, intent };
+        safeToRemove = false;
+        await writeFile(join(stateRoot, 'probe.json'), JSON.stringify({ backend: 'linux-native', contract, intent }), { mode: 0o600, flag: 'wx' });
+        const command = `test "$(id -u)" = 65534 && test ! -w /etc && printf '%s' '${marker}' > readiness.txt && printf '%s:' '${marker}' && node -e 'process.stdout.write(process.version)'`;
+        await runLinuxExecution({ ...context,
+            argv: ['/bin/sh', '-c', 'PATH=/runtime/0/bin:/runtime/0/pnpm-native:/usr/bin:/bin; export PATH; exec /bin/sh -c "$1"', 'dsh-native-probe', command],
+            files: [], artifacts: ['readiness.txt'], readOnlyRoots: [runtime.root.path], signal: AbortSignal.timeout(20_000),
+            recordResources: async () => { }, authorizeStart: () => true });
+        const receipt = await readLinuxExecutionReceipt(context);
+        safeToRemove = receipt?.result.quiescent === true || !!await readLinuxExecutionPartialCleanupProof(context);
+        const result = receipt?.result;
+        if (result?.status !== 'succeeded' || !safeToRemove || result.stdout !== `${marker}:${runtime.versions.node}`
+            || result.artifacts.length !== 1 || result.artifacts[0]?.path !== 'readiness.txt' || result.artifacts[0]?.content !== marker) {
+            throw new Error(`native isolation readiness failed (${result?.reason ?? result?.status ?? 'receipt-unavailable'})`);
+        }
+        return { ready: true };
+    }
+    catch (error) {
+        if (!safeToRemove)
+            throw new Error(`native isolation readiness did not establish quiescence; unresolved probe evidence retained at ${stateRoot}`, { cause: error });
+        throw error;
+    }
+    finally {
+        if (safeToRemove)
+            await rm(stateRoot, { recursive: true, force: true });
+    }
+}
 /** Operator-only readiness probe using the same supervisor and work-volume path as jobs. */
 export async function probeIsolationRuntime(image, dockerPath = process.platform === 'darwin' ? '/usr/local/bin/docker' : '/usr/bin/docker', socketPath) {
     if (!/^sha256:[0-9a-f]{64}$/.test(image) || !dockerPath.startsWith('/'))

package/lib/probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"probe.js","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAmB;IACtK,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IAC1K,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACzM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAAC,MAAM,aAAa,GAAG,iBAAiB,KAAK,EAAE,CAAA;IAC1E,IAAI,YAAY,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,0DAA0D,MAAM,qCAAqC,MAAM,GAAG,CAAA;QAC9H,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QACtH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACpJ,YAAY,GAAG,KAAK,CAAA;QACpB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa;YAC1G,OAAO,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YACpE,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE;YACxG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,YAAY,GAAG,MAAM,CAAC,SAAS,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;eAC7E,MAAM,CAAC,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,+DAA+D,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2CAA2C,SAAS,EAAE,EAAE,CAAC,CAAA;QAC3N,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5J,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,IAAI,YAAY;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../src/probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAA;AAIvJ,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAgC;IAC/E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IACvK,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK;QACnE,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAA;IACpC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc;QACzF,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACtF,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IACtG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAA;IAC9E,MAAM,KAAK,GAAG,UAAU,EAAE,EAAE,MAAM,GAAG,UAAU,EAAE,CAAA;IACjD,IAAI,YAAY,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK;gBACtF,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,SAAS,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5H,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QAC/C,YAAY,GAAG,KAAK,CAAA;QACpB,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1I,MAAM,OAAO,GAAG,6DAA6D,MAAM,sCAAsC,MAAM,sDAAsD,CAAA;QACrL,MAAM,iBAAiB,CAAC,EAAE,GAAG,OAAO;YAClC,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,6FAA6F,EAAE,kBAAkB,EAAE,OAAO,CAAC;YACnJ,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YAChH,eAAe,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACxD,YAAY,GAAG,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,qCAAqC,CAAC,OAAO,CAAC,CAAA;QAC3G,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;QAC9B,IAAI,MAAM,EAAE,MAAM,KAAK,WAAW,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;eACxG,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/H,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,IAAI,qBAAqB,GAAG,CAAC,CAAA;QACrH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,kGAAkG,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACnK,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,IAAI,YAAY;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACvF,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAmB;IACtK,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IAC1K,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACzM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAAC,MAAM,aAAa,GAAG,iBAAiB,KAAK,EAAE,CAAA;IAC1E,IAAI,YAAY,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,0DAA0D,MAAM,qCAAqC,MAAM,GAAG,CAAA;QAC9H,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QACtH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACpJ,YAAY,GAAG,KAAK,CAAA;QACpB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa;YAC1G,OAAO,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YACpE,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE;YACxG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,YAAY,GAAG,MAAM,CAAC,SAAS,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;eAC7E,MAAM,CAAC,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,+DAA+D,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2CAA2C,SAAS,EAAE,EAAE,CAAC,CAAA;QAC3N,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5J,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,IAAI,YAAY;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;AACvF,CAAC"}

package/lib/service.d.ts

@@ -24,7 +24,7 @@ declare module '@deepseek-ai/cordis' {
         assistantIsolation: AssistantIsolationService;
     }
 }
-/** Trusted Host broker. Only bounded input copies cross into the job-specific Docker volume. */
+/** Trusted Host broker. Only bounded inline inputs cross into the isolated workspace. */
 export declare class AssistantIsolationService extends Service {
     #private;
     static Config: import("@deepseek-ai/schemastery").default<Config>;

package/lib/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AAC/K,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AASnD,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAA;AAQpD,OAAO,KAAK,EAAmC,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAIpG,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,eAAO,MAAM,wBAAwB,GAAI,WAAW,MAAM,KAAG,MAA8D,CAAA;AAC3H,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACrH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChJ;AAmBD,OAAO,QAAQ,qBAAqB,CAAC;IAAE,UAAU,OAAO;QAAG,kBAAkB,EAAE,yBAAyB,CAAA;KAAE;CAAE;AAE5G,gGAAgG;AAChG,qBAAa,yBAA0B,SAAQ,OAAO;;IAEpD,MAAM,CAAC,MAAM,qDAAS;gBAcV,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW;IA4B5C,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAuB;IAE3C,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IA+FrC,sGAAsG;IACtG,QAAQ,GAAU,OAAO,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAiBvF;IAwBD,+EAA+E;IAC/E,oBAAoB,GAAI,OAAO,sBAAsB,EAAE,MAAM,MAAM;;;;;;;OAelE;IAED,mFAAmF;IACnF,YAAY,GAAI,WAAW,aAAa,KAAG,OAAO,CAWjD;IAED;;;;OAIG;IACH,qBAAqB,GAAI,WAAW,aAAa,KAAG,OAAO,CAU1D;IAED,GAAG,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,gBAAgB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CA0C7G;CAkDF"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AAC/K,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AASnD,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAA;AAQpD,OAAO,KAAK,EAAmC,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAQpG,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,eAAO,MAAM,wBAAwB,GAAI,WAAW,MAAM,KAAG,MAA8D,CAAA;AAC3H,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACrH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChJ;AAmBD,OAAO,QAAQ,qBAAqB,CAAC;IAAE,UAAU,OAAO;QAAG,kBAAkB,EAAE,yBAAyB,CAAA;KAAE;CAAE;AAE5G,yFAAyF;AACzF,qBAAa,yBAA0B,SAAQ,OAAO;;IAEpD,MAAM,CAAC,MAAM,qDAAS;gBAgBV,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW;IAsC5C,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAuB;IAE3C,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAqGrC,sGAAsG;IACtG,QAAQ,GAAU,OAAO,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAiBvF;IAmCD,+EAA+E;IAC/E,oBAAoB,GAAI,OAAO,sBAAsB,EAAE,MAAM,MAAM;;;;;;;OAelE;IAED,mFAAmF;IACnF,YAAY,GAAI,WAAW,aAAa,KAAG,OAAO,CAWjD;IAED;;;;OAIG;IACH,qBAAqB,GAAI,WAAW,aAAa,KAAG,OAAO,CAU1D;IAED,GAAG,GAAU,OAAO,KAAK,GAAG,SAAS,EAAE,OAAO,gBAAgB,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CA6D7G;CA4FF"}