@dsh-enhanced/assistant-isolation 0.1.66 → 0.1.68

package/README.md

@@ -12,16 +12,14 @@ lease interval plus ordinary boot time before treating readiness as a failure.
 
 `@dsh-enhanced/assistant-isolation` adds `isolation_run` to the native DSH ToolRuntime. An operator grants a finite number of offline shell jobs to one authenticated owner, workspace and agent preset. Each job receives only explicitly supplied text files in a fresh scratch directory. Results and artifacts are untrusted process output; exit code zero does not establish that a user goal was achieved.
 
-This is the first actual isolation component of autonomy work packages 08–10. External action/credential brokerage, rollback/compensation and installer bootstrap remain separate delivery requirements. It does not isolate arbitrary Host plugins or replace the native AgentLoop. The Host, local operator, configured runtime and kernel remain trusted; the Docker backend also trusts its daemon and image. Each workspace uses a private tmpfs volume with byte and inode hard limits. A persistent pool bounds admitted worker/workspace/keeper reservations across this ledger; it is not a machine-wide guarantee against runtime/kernel overhead or unrelated workloads. Do not treat this initial component as a complete hostile-code production platform.
+This is an actual isolation component of the autonomy work. External action/credential brokerage, rollback/compensation and installer bootstrap remain separate delivery requirements. It does not isolate arbitrary Host plugins or replace the native AgentLoop. The Host, local operator, configured runtime and kernel remain trusted. The package contains no Docker dependency: Linux isolation is the native user-namespace/cgroup/seccomp backend, and macOS verification uses the seatbelt primitive. Each workspace uses a private tmpfs volume with byte and inode hard limits. A persistent pool bounds admitted worker/workspace/keeper reservations across this ledger; it is not a machine-wide guarantee against runtime/kernel overhead or unrelated workloads. Do not treat this component as a complete hostile-code production platform.
 
 ## Native Linux building blocks
 
 The Host-only `runLinuxNamespace`, `LinuxCgroupLease`, and `LinuxRuntime`
-exports provide Docker-free execution on non-root Linux. The public tool accepts
-explicit `backend: 'linux-native'` configuration; the private verifier also
-accepts `LinuxVerifierRunnerConfig` below. Omitting `backend` retains Docker
-configuration semantics. Production setup still selects its existing backend
-until installation and owner migration are integrated.
+exports provide execution on non-root Linux. Both the public tool and the private
+verifier require explicit `backend: 'linux-native'` configuration; there is
+only the native backend and no implicit default.
 
 `runLinuxNamespace` uses fixed `unshare`, mount, bubblewrap and Python/libseccomp
 programs, with a shipped digest-checked syscall policy. It exposes system runtime
@@ -55,8 +53,8 @@ runtime broker or a sudo rule for a writable checkout.
 `LinuxRuntime` verification binds Node, native pnpm, frozen dependencies and
 retained store/cache to device/inode and deterministic tree hashes. It rejects
 outside links, writable contents and drift. None of these exports activates a
-service, reads provider credentials, accesses a browser, downloads images or
-runs an install lifecycle script. See the [delivery boundary](../../docs/dockerless-runtime.md)
+service, reads provider credentials, accesses a browser or runs an install
+lifecycle script. See the [delivery boundary](../../docs/dockerless-runtime.md)
 for remaining integration and acceptance.
 
 ### Public native execution
@@ -67,7 +65,7 @@ is the digest-pinned `LinuxRuntime` prepared by the native toolchain bootstrap;
 `cgroupRoots` identifies the current user's verified v1 controller delegation.
 The synchronous Cordis Config rejects invalid bindings and insufficient pools;
 service readiness and every newly admitted request recheck the runtime tree.
-This branch does not require an image or resolve a Docker socket.
+This branch does not require an image, a Docker socket or a container daemon.
 
 `isolation_run` keeps its existing request, owner/Policy checks, goal artifact
 binding and cancellation contract. Inline files enter a fresh bounded workspace;
@@ -78,15 +76,15 @@ under an existing idempotency key is a conflict and never creates a new job.
 
 Startup and background recovery use each job's persisted backend. Native cleanup
 uses the original contract and private receipts; a native-configured service
-leaves historical Docker unknown resources occupied for their original cleanup
-path. Switching configuration does not extend grants or reset budgets.
+keeps historical unknown resources occupied for their original cleanup
+path. Configuration changes do not extend grants or reset budgets.
 
 `dsh-isolation probe-native /absolute/runtime-config.json` accepts an owned JSON
 file containing exactly `{ runtime, cgroupRoots }`. It tests pinned Node,
-non-root execution, a canary artifact and actual cleanup without Docker or a
-production grant. Unproven cleanup retains its private evidence directory.
-`reconcile /absolute/private/state-root` dispatches cleanup by persisted backend;
-Docker arguments are unused for a native-only ledger. `revoke` first persists
+non-root execution, a canary artifact and actual cleanup without a production
+grant. Unproven cleanup retains its private evidence directory.
+`reconcile /absolute/private/state-root` reconciles native cleanup.
+`revoke` first persists
 revocation and lets a live controller stop its work. For pending native jobs it
 also reports `nativeResourcesQuiescent` and `nativeRetained`; exit 2 indicates
 that cleanup is not yet confirmed. It never takes over a live controller.
@@ -117,7 +115,7 @@ incomplete initialization needs explicit reconciliation. The helper never
 renews grants, clears history or replays unknown jobs. Configurations without a
 seal retain their original behavior and have not acquired this protection.
 
-An authorized Docker-to-linux-native backend handover runs offline on a staged
+An authorized legacy-to-linux-native backend handover runs offline on a staged
 copy of the home. `prepareLinuxVerifierHandoverState({ name, stageStateRoot,
 stageSealPath, liveStateRoot, liveSealPath })` upgrades the staging ledger to
 schema 9 and publishes the seal before the new authority digest is compiled;
@@ -125,9 +123,8 @@ schema 9 and publishes the seal before the new authority digest is compiled;
 seal still binds the copy and performs the audited grant/job rewrite without
 resealing, so a digest compiled in between stays valid across the cutover.
 
-`IsolatedVerifierRunner` accepts either the existing Docker configuration or an
-explicit `backend: 'linux-native'` configuration with a verified `LinuxRuntime`
-and delegated `cgroupRoots`. `LinuxVerifierRunner` is also exported directly.
+`IsolatedVerifierRunner` requires a `backend: 'linux-native'` configuration with
+a verified `LinuxRuntime` and delegated `cgroupRoots`; any other backend is rejected. `LinuxVerifierRunner` is also exported directly.
 The API remains `run(key, artifact, stdin, signal)` and `close()`; the fixed
 operator command receives `artifact` and `input` files in the private workspace.
 Its PATH uses the pinned runtime's Node/pnpm. Ordinary agent tools do not receive
@@ -147,8 +144,7 @@ original identities and proves actual group/workspace absence. A missing or
 partial creation record never grants permission to run the command again or to
 signal an unidentified process. Proven cleanup releases active capacity while
 preserving an existing unknown result and its consumed run/duration budget.
-Historical Docker/macOS rows retain their own backend identity; switching this
-API does not reconcile those external resources or reset their grants.
+Historical rows opened from a pre-native ledger retain their original backend identity; the API cannot create them and does not reset their grants.
 
 These APIs still require non-root Linux with verified v1 delegation and the
 fixed namespace dependencies. Installer migration, behavior certificates and
@@ -247,7 +243,7 @@ native integration; repository execution alone does not authorize adoption.
 ## Native macOS execution primitive
 
 The Host-only `runNativeMacProcess` export runs one digest-pinned Node process
-under `/usr/bin/sandbox-exec`, without Docker. Its deny-default policy permits
+under `/usr/bin/sandbox-exec`, without a container daemon. Its deny-default policy permits
 only system runtime reads, explicitly approved canonical runtime roots and a
 private workspace. The workspace is read-only unless the trusted caller explicitly
 sets `workspaceWritable: true`. Network and child processes are denied; file
@@ -271,10 +267,10 @@ do not authenticate its contents. The caller must provision trusted runtime
 contents and exclude aliases to unrelated Host files. Workspace staging rejects
 symbolic links, hard links and special files before dispatch.
 Writable workspaces have no hard disk quota; this primitive also has no hard
-memory or CPU quota. Do not infer Docker resource limits or a complete native
+memory or CPU quota. Do not infer native resource limits or a complete native
 RSI installation from a successful invocation. Native tests run on macOS and
 use only temporary canaries, an ephemeral loopback listener and disposable
-processes; they require no Docker installation.
+processes; they require no container runtime installation.
 
 The Host-only `NativeMacVerifierRunner` adds a durable finite grant to this
 single-process primitive. Its `backend: 'macos-seatbelt'` configuration pins an
@@ -287,7 +283,7 @@ and nonce. The detached supervisor kills its candidate when the Host IPC
 disconnects; an absent or invalid receipt leaves the job `unknown`, occupies
 active capacity and cannot be replayed. A new Host must wait for the old
 controller lease to expire before recovering it. The private native state
-root is bound separately from Docker state and is never a runtime read root.
+root is its own private state and is never a runtime read root.
 Runtime tree hashing rejects special files, hard links, external symbolic
 links and group/world-writable contents; internal pnpm links are allowed only
 when their resolved targets remain inside the same root. Admission bounds runs,
@@ -301,17 +297,18 @@ trusted verifier API, not the public `isolation_run` tool.
 dsh plugin --profile <profile> add @dsh-enhanced/assistant-isolation
 ```
 
-Required Host services: `agents`, `tools`, `assistantDelivery`, and `assistantPolicy`. The bundle is independently publishable; installing it does not install or activate peers. Without the services it does not register an execution tool. With no grants it does not execute jobs. No Docker image is downloaded by the plugin.
+Required Host services: `agents`, `tools`, `assistantDelivery`, and `assistantPolicy`. The bundle is independently publishable; installing it does not install or activate peers. Without the services it does not register an execution tool. With no grants it does not execute jobs. The plugin downloads no image and contacts no container daemon.
 
-The Docker backend supports a non-root Linux or macOS Host process with access to a local Docker daemon. Linux defaults to `/var/run/docker.sock`; macOS defaults to the current user's Docker Desktop socket at `~/.docker/run/docker.sock`. The socket must exist at runtime and remain the same local Unix socket through creation, execution and cleanup. macOS requires an owner-owned socket and private Docker run directory; a remote `DOCKER_HOST`, Docker context or socket path outside that user directory is never used. Configure an already-present, operator-reviewed image **ID** (`sha256:` plus 64 hexadecimal digits), containing `/bin/sh`, a trusted `/bin/busybox` with `sleep`, `stat` and `cat`, and the commands needed for the task. Image-declared `VOLUME` entries are rejected to prevent extra writable Docker volumes. A tag or remote repository digest is not accepted as a substitute for the local immutable image ID. Failed Docker operations do not fall back to a Host shell.
+Linux isolation requires a non-root Linux Host with verified v1 cgroup delegation and the fixed namespace dependencies (unshare, bubblewrap, Python/libseccomp). macOS exposes only the `macos-seatbelt` verifier primitive; `isolation_run` is Linux-only.
 
 ## Configuration
 
 ```yaml
+backend: linux-native
 stateRoot: /absolute/private/assistant-isolation
-image: sha256:<64-hex-local-image-id>
-dockerPath: /usr/bin/docker
-# Optional: socketPath: /Users/<owner>/.docker/run/docker.sock on macOS.
+linux:
+  runtime: <digest-pinned LinuxRuntime from the native toolchain bootstrap>
+  cgroupRoots: <current-user v1 controller delegation>
 maxConcurrentJobs: 2
 maxReservedMemoryMiB: 2048
 maxReservedWorkspaceInodes: 32768
@@ -341,39 +338,15 @@ limits:
 
 Replace the placeholders with the operator's current owner record and runtime configuration. `isolationPrincipalDigest()` is exported for trusted Host configuration tooling. Model arguments cannot supply an owner or create/extend a grant. Policy must allow `execute` on both `tool:isolation_run` and `tool:isolation:<grant-id>` for the exact scope. Matching finite-grant preauthorization can skip the redundant risk prompt; native Policy denials, call budgets and other guards remain in force (details below).
 
-The workspace value identifies the authorized task; **the project directory is not mounted**. The tool accepts `grant_id`, `idempotency_key`, `command`, optional `files: [{ path, content }]`, `artifacts: [relativePath]` and `timeout_ms`. Paths must be canonical relative paths. Inputs and requested artifacts have finite count/byte limits, including path text and staged parent inode counts. Inputs are copied into a fresh quota volume; no Host directory is mounted in either container. After the execution container is removed, a separate keeper container retains the volume while the trusted supervisor checks each artifact with absolute-path BusyBox commands. Only regular UTF-8 files without symlink parents or hard links can be exported within one total byte budget. The keeper and volume must then be removed before the result reports quiescence. Binary/invalid UTF-8 console data is omitted; decoded output never expands past the configured byte limit.
+The workspace value identifies the authorized task; **the project directory is not mounted**. The tool accepts `grant_id`, `idempotency_key`, `command`, optional `files: [{ path, content }]`, `artifacts: [relativePath]` and `timeout_ms`. Paths must be canonical relative paths. Inputs and requested artifacts have finite count/byte limits, including path text and staged parent inode counts. Inputs are copied into a fresh tmpfs workspace inside the candidate's user/mount namespaces; no Host directory is mounted into the sandbox. After the candidate process is terminated, the trusted keeper process (outside the candidate's PID/cgroup namespace) retains the workspace while the supervisor checks each artifact with absolute-path commands. Only regular UTF-8 files without symlink parents or hard links can be exported within one total byte/inode budget. The keeper, cgroup and workspace must then be released and proven quiescent before the result reports quiescence. Binary/invalid UTF-8 console data is omitted; decoded output never expands past the configured byte limit.
 
 Within a configured workspace/preset, the model sees only the same named surface that the Host routing guard accepts: `isolation_run`, `isolation_grants`, `goal_context`, `goal_checkpoint`, and the fixed preauthorized goal or GitHub broker tools when installed. It does not see Host filesystem, shell, `run_code`, or subagent tools. This presentation applies only after the live Agent resolves to the current Delivery owner lineage and exact workspace/preset; ordinary or unbound Agents keep their normal tool surface. A scoped model-facing system section states that each `isolation_run` gets a fresh scratch workspace, accepts starting material only as inline files, and has no Host project mount or network. It contains no Host path, credential, task answer, or tool-call sequence. Revocation or expiry does not release the configured scope restriction while the bundle remains loaded. This is trusted Host routing around the OS-isolated worker; a trusted operator can change or remove the plugin configuration.
 
 ## Authorization, stop and recovery
 
-The private SQLite WAL ledger binds each job to exact owner lineage, grant revision, request/image/limits digest, owning Session, idempotency key and absolute deadline. A private state-root marker binds recovery to the configured Docker socket path; changing that path requires a separate state root. Legacy Linux ledgers without the marker can only continue on their original `/var/run/docker.sock`. Run count and reserved duration are consumed before creation and are not refunded on failures. Grant IDs retain cumulative usage across revisions. Same-key exact requests return the original outcome; changed requests are rejected. An unknown outcome is never automatically re-executed or promoted to success. Reusing a revoked grant revision cannot reactivate it.
+The private SQLite WAL ledger binds each job to exact owner lineage, grant revision, request/limits digest, owning Session, idempotency key and absolute deadline. Run count and reserved duration are consumed before creation and are not refunded on failures. Grant IDs retain cumulative usage across revisions. Same-key exact requests return the original outcome; changed requests are rejected. An unknown outcome is never automatically re-executed or promoted to success. Reusing a revoked grant revision cannot reactivate it. Legacy pre-native ledgers keep their historical rows readable for accounting and migration only; this package cannot create them.
 
-Schema v6 migrates existing v1/v2/v3/v4/v5 job records without erasing them. It retains the v5 rule that, before any supervisor can receive create authority, the Host durably commits a fenced `supervisor-spawn-intent`; a crash between fork and the later running-state CAS therefore cannot look like an unstarted job. Legacy records lack this proof and are conservatively treated as already dispatched. Each new job reserves `memoryMiB + workspaceMiB + 32` MiB (worker limit, workspace capacity, and keeper limit) and `workspaceInodes` in the same transaction as grant usage. Prepared/running jobs and all unconfirmed cleanup retain their reservations; an active legacy job with unknown resource use prevents new reservations. Unknown dispatched jobs retain occupancy after ordinary exact-name removal. A separate reconciliation path can release resource reservations only with the complete request receipt and stop evidence described below. Jobs durably known never to have been dispatched can still use ordinary recovery. Changing pool settings cannot retroactively release reservations. The pool applies to this state root, so separate state roots need an operator-managed aggregate budget.
-
-The native tool cancellation signal (including Agent cancellation), current owner/Policy changes, grant revocation and service disposal stop running jobs. The controller polls authorization every 250 ms while active. A detached supervisor watches the job deadline and Host IPC independently; losing the Host IPC initiates container termination, state inspection and removal, including `setsid` descendants. Stop is asynchronous, with bounded Docker control calls. The plugin reports `quiescent: false` and `unknown` when it cannot confirm cleanup. It cannot undo instructions already executed before a stop was observed. A timed-out creation acknowledgment remains `docker-creation-unconfirmed` and holds its reservation even across Host restart: current object absence alone does not prove a pending daemon request completed. The same protection covers other unknown outcomes after dispatch, including supervisor exit, IPC loss and runner exceptions. Private diagnostic witnesses capture the Linux boot ID, process PID/start ticks and Docker Engine ID around a final supervisor receipt when available. They are stored separately from model-visible results. A restart candidate is not a release authorization: trusted socket-to-daemon binding and an independently proven stop barrier remain operational requirements; do not delete the ledger to force capacity release.
-
-A final supervisor receipt now records whether every create/start/copy/exec command returned normally and every CLI closed. On Linux, when that private `requestsSettled` flag is true, the original supervisor has exited, and the exact Docker daemon generation is unchanged, the Host can remove and independently inspect all three UUID-named resources. A fresh opaque cleanup receipt, the original witness, current controller fence and job version are required in the same ledger transaction to release reservations. macOS does not fabricate Linux process witnesses; an unknown dispatched job retains its reservation pending a separately proven stop barrier. The original `unknown` outcome, output, run count and consumed duration remain unchanged; commands are never replayed. The audit stores the exact resources and their removal/absence observations.
-
-The live Host checks a bounded page of pending records every five seconds without overlapping sweeps. With the Host stopped, an operator can invoke the same path:
-
-```sh
-dsh-isolation reconcile /absolute/private/assistant-isolation
-# Optional Docker executable:
-dsh-isolation reconcile /absolute/private/assistant-isolation /absolute/docker
-```
-
-The command reports checked, released and retained counts and refuses to take over a live controller. Legacy receipts, interrupted mutating calls (including timeout or output overflow of `start --attach` or artifact `exec`), missing final IPC, and changed daemon generations retain occupancy. Systemd socket/service invocation metadata is diagnostic only: daemon restart does not prove containerd/shim execution stopped. Automatic release of these ambiguous cases is still unsupported.
-
-An operator can revoke from a separate terminal, without calling the model:
-
-```sh
-dsh-isolation revoke /absolute/private/assistant-isolation offline-maintenance 1
-# Optional absolute Docker executable for deployments using another path:
-dsh-isolation revoke /absolute/private/assistant-isolation offline-maintenance 1 /absolute/docker
-```
-
-This persists revocation first and attempts to remove this grant's exact UUID-named execution containers, keeper containers and workspace volumes. `containersRemoved` reports those removal attempts, not an atomic barrier against an already in-flight Docker request. A running controller also rejects any subsequent start and polls revocation. Return code 2 means cleanup was not confirmed; retain the ledger and investigate Docker availability. Credentials and external action leases are outside this offline entry point.
+Schema migration retains every historical job record. Before any supervisor can receive create authority, the Host durably commits a fenced `supervisor-spawn-intent`; a crash between fork and the running-state CAS therefore cannot look like an unstarted job. Legacy records without that proof are conservatively treated as already dispatched. Each new job reserves `memoryMiB + workspaceMiB + 32` MiB (worker limit, workspace capacity, and keeper limit) and `workspaceInodes` in the same transaction as grant usage. Prepared/running jobs and all unconfirmed cleanup retain their reservations; capacity releases only with the complete request receipt and stop evidence below. Changing pool settings never retroactively releases reservations. The pool applies to this state root, so separate state roots need an operator-managed aggregate budget.
 
 A durable 30-second controller lease with fencing prevents two live controllers from recovering or spending the same ledger. Heartbeats run every 5 seconds; losing the fence stops jobs and forbids stale outcome writes. A replacement can claim an expired controller lease, walk all recovery pages and remove old execution/keeper containers and workspace volumes without replaying their commands. Recovery retains unknown execution outcomes even when later removal succeeds. The controller ledger must not be deleted to clear an unknown job or exhausted budget.
 
@@ -423,28 +396,26 @@ The local hash chain proves integrity and linkage relative to a trusted digest;
 
 | Surface | Authority |
 | --- | --- |
-| Filesystem | Host owns a `0700` state directory, `0600` ledger and per-job staging. A separate operator-owned `0700` audit archive may contain canonical hash-linked NDJSON batches; neither state nor archive root is mounted or bind-mounted into a worker. The worker sees its byte/inode-limited tmpfs workspace plus its configured image or approved native runtime roots. Console/artifact results and diagnostic witnesses persist in the private ledger. The Host reads Linux `/proc`, the protected `/run/docker.pid`, and socket metadata for best-effort diagnostics; missing metadata never grants release. No writable Host bind is exposed. Observed storage admission and opt-in result retention are described below; they are not a hard filesystem quota. |
-| Network | Docker uses its fixed local Unix socket; native Linux does not contact Docker. Workers have no network, Host socket/config mount or external action endpoint. |
-| Subprocess | Native Linux uses the fixed packaged keeper, unshare, mount, bubblewrap and Python/libseccomp programs described above. Docker starts the fixed configured Docker executable and packaged detached Node supervisor, and may read fixed docker.service/docker.socket properties through /usr/bin/systemctl for diagnostics. Workers run `/bin/sh` with non-root UID/GID, read-only image filesystem, dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, bounded `/tmp` and `/dev/shm`, and disabled Docker log storage. A fixed BusyBox keeper retains the job volume across execution-container removal and does not execute job code. |
-| Credentials | Worker receives no Host environment or credential files. The Docker daemon access itself is a privileged trusted Host capability. Images and approved runtime roots must contain no embedded secrets. |
+| Filesystem | Host owns a `0700` state directory, `0600` ledger and per-job staging. A separate operator-owned `0700` audit archive may contain canonical hash-linked NDJSON batches; neither state nor archive root is mounted or bind-mounted into a worker. The worker sees its byte/inode-limited tmpfs workspace plus approved native runtime roots. Result and receipt data persist in the private ledger. The Host reads Linux `/proc` for best-effort diagnostics; missing metadata never grants release. No writable Host bind is exposed. Observed storage admission and opt-in result retention are described below; they are not a hard filesystem quota. |
+| Network | None. Workers have no network namespace connectivity, no Host socket/config mount and no external action endpoint. |
+| Subprocess | Native Linux uses the fixed packaged keeper, `unshare`, mount, bubblewrap and Python/libseccomp programs described above, with a shipped digest-checked seccomp policy. Workers run `/bin/sh` as non-root UID/GID with dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, bounded `/tmp` and `/dev/shm`. The keeper only coordinates cleanup; it never executes job code. |
+| Credentials | The worker receives no Host environment or credential files. Approved runtime roots must contain no embedded secrets. |
 | Browser | None. |
 | Install scripts | No runtime provisioning, image pull or privileged install hook. Standard package build/prepack only. |
 
-Whole-machine failure, Docker daemon failure, disk exhaustion and untrusted Host plugins are not solved by IPC cleanup. Unknown jobs remain visible in the ledger and consume active capacity when quiescence is unconfirmed. The same Host user can inspect or modify this database; it is protected from the container worker, not from the trusted operator. Partial scratch cleanup failures are not proof of execution failure and may require operator cleanup once the container is confirmed stopped.
+Whole-machine failure, disk exhaustion and untrusted Host plugins are not solved by IPC cleanup. Unknown jobs remain visible in the ledger and consume active capacity when quiescence is unconfirmed. The same Host user can inspect or modify this database; it is protected from the worker, not from the trusted operator. Partial scratch cleanup failures are not proof of execution failure and may require operator cleanup once resource absence is confirmed.
 
 ## Verification
 
 ```sh
-CI=true DSH_ISOLATION_TEST_IMAGE=sha256:<local-image-id> pnpm check
+DSH_NATIVE_CGROUP_REAL=1 pnpm check
 ```
 
-Without the environment variable, Docker tests are explicitly skipped. With it, tests use actual containers and the native AgentLoop/ToolRuntime; the model and Delivery identity are controlled seams; the finite-grant fixture uses the actual default-deny Policy, ApprovalService and native ToolRuntime. Separate tests exercise Host file/socket/environment separation, a Host HTTP canary, configured cgroup restrictions, workspace exhaustion, output/IPC separation, cancellation, and Host process-group death. Filesystem quota and storage lifecycle probes use actual Docker resources; no image is pulled. These are not evidence of a real cloud model, external account, full user profile or all autonomy work packages being complete.
-
-The optional identity probe `python3 scripts/isolation/daemon-witness-probe.py` runs from the repository root after a build. It requires Python 3, rootlesskit/dockerd and unprivileged Linux namespaces, starts only private rootless daemons, and leaves inspectable logs under `/tmp`. It verifies a real restart, stable Engine ID, changed PID/start ticks, live-process rejection and a surviving volume. Its limited UID/GID map and absent cgroup delegation do not establish worker isolation or production release authority.
+Without `DSH_NATIVE_CGROUP_REAL=1`, real-cgroup integration tests are explicitly skipped; schema, contract, migration and simulated-runtime tests always run. Real tests use actual user namespaces, cgroup leases, seccomp and the native AgentLoop/ToolRuntime; the model and Delivery identity are controlled seams and the finite-grant fixture uses the actual default-deny Policy, ApprovalService and native ToolRuntime. Separate tests exercise cgroup restrictions, workspace exhaustion, output bounds, cancellation, receipts and process-group death. These are not evidence of a real cloud model, external account, full user profile or a complete autonomy acceptance.
 
 ## Operator readiness and native preauthorization
 
-`dsh-isolation probe sha256:<local-image-id> [/absolute/docker [/absolute/docker.sock]]` exercises the production supervisor, non-root/read-only-root execution, work volume, artifact export and cleanup with a fixed nonce task. On macOS the default Docker executable is `/usr/local/bin/docker`; pass its absolute path if installed elsewhere. It creates private temporary staging and never pulls an image. Successful or confirmed-quiescent probes remove staging; unknown cleanup retains `probe.json` with exact job/container/image/socket metadata for operator investigation. This diagnostic does not create a production grant or reset a ledger, and does not replace task-specific resource validation.
+`dsh-isolation probe-native /absolute/runtime-config.json` exercises the pinned native runtime, non-root execution, a canary artifact and actual cleanup with a fixed nonce task, using exactly `{ runtime, cgroupRoots }` from an owned bounded JSON file. It creates private temporary staging and never touches production grants. Successful or confirmed-quiescent probes remove staging; unknown cleanup retains its private evidence for operator investigation. This diagnostic does not create a production grant or reset a ledger, and does not replace task-specific resource validation.
 
 With matching Policy and Isolation builds, the exact registered `isolation_run` definition can skip a redundant risk prompt only while its owner/scope grant and live Policy evaluation permit the normalized request. Same-name scoped tools cannot borrow this registration. Native tool authorization remains independent: configure `execute` on `tool:isolation_run` as well as `tool:isolation:<grant-id>`; explicit denials still win. A default-deny Policy is supported without allowing unrelated tools.
 
@@ -456,7 +427,7 @@ The default export is the Cordis plugin object with stable name, Config and appl
 
 schema v6 新增可空的 artifact admission 绑定，v1–v5 行迁移后保留且不会被追认为目标产物。Host 在真实 Goals native round 内，于隔离任务派发前固定 step acceptance ID/digest、run、turn 与声明输出路径；相同幂等键不会重新绑定。运行中若原 admission 改变则取消。私有 `readAcceptedArtifact` 只读取同一 v4 step scope/owner/Session 的成功、已静止、有效期内且正文未清理的产物；较新的同路径失败尝试禁止回退旧结果。
 
-Host Verifier 可使用导出的 `IsolatedVerifierRunner` 在独立私有 stateRoot 中验收复制产物。该类没有模型工具入口，固定 authority/镜像/命令、次数、累计预留时长及期限，可选 `socketPath` 与普通隔离任务遵循相同的本地 Docker socket 约束，并复用相同 Docker supervisor 和资源边界。验收任务与原产物 job 是不同 ID；验收不在宿主执行模型代码。未知派发仍保留资源占用且不自动重放，重复 setup 或重启也不会重置预算。
+Host Verifier 可使用导出的 `IsolatedVerifierRunner` 在独立私有 stateRoot 中验收复制产物。该类没有模型工具入口，要求显式 `backend: 'linux-native'` 配置（已验证 `LinuxRuntime` 与受委派 v1 cgroupRoots），固定 authority/命令、次数、累计预留时长及期限，复用原生执行资源边界。验收任务与原产物 job 是不同 ID；验收不在宿主执行模型代码。未知派发仍保留资源占用且不自动重放，重复 setup 或重启也不会重置预算。
 
 The read-only `isolation_grants` tool exposes usable grant IDs and remaining limits only for the current authenticated owner and workspace/preset. It applies live Policy, principal lineage, expiry and revocation checks; it cannot create or extend grants and returns no credentials or Host paths. When Policy allows discovery and at least one grant remains usable for that exact owner, the Host registers its exact tool definition for finite preauthorization so this read-only query skips the redundant native risk prompt. Revocation, expiry, owner/scope mismatch, Policy denial, tool replacement, or bundle unload removes that preauthorization. Use a returned ID with `isolation_run`.
 

package/lib/cli.d.ts

@@ -2,15 +2,13 @@
 import { type IsolationStorageMaintenance } from './storage.js';
 export interface IsolationRevocationResult {
     revoked: true;
-    /** Legacy Docker removal acknowledgements, not a general proof of quiescence. */
-    containersRemoved: boolean;
     nativeResourcesQuiescent?: boolean;
     nativeRetained?: number;
 }
 /** Operator entry point, separate from the model's tool registry. */
-export declare function revokeIsolationGrant(stateRoot: string, grantId: string, revision: number, dockerPath?: string, socketPath?: string): Promise<IsolationRevocationResult>;
+export declare function revokeIsolationGrant(stateRoot: string, grantId: string, revision: number): Promise<IsolationRevocationResult>;
 /** Reconcile only settled requests; a live Host owns its own background sweep. */
-export declare function reconcileIsolation(stateRoot: string, dockerPath?: string, signal?: AbortSignal, socketPath?: string): Promise<{
+export declare function reconcileIsolation(stateRoot: string, signal?: AbortSignal): Promise<{
     checked: number;
     released: number;
     retained: number;

package/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAA4B,KAAK,2BAA2B,EAAE,MAAM,cAAc,CAAA;AAezF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,IAAI,CAAA;IACb,iFAAiF;IACjF,iBAAiB,EAAE,OAAO,CAAA;IAC1B,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAC7F,UAAU,SAA8E,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAsDnJ;AAED,kFAAkF;AAClF,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,SAA8E,EAClJ,MAAM,GAAE,WAA0C,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC3I;AAED,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAepI"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAUA,OAAO,EAA4B,KAAK,2BAA2B,EAAE,MAAM,cAAc,CAAA;AAazF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,IAAI,CAAA;IACb,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6CnI;AAED,kFAAkF;AAClF,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EACxD,MAAM,GAAE,WAA0C,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BtH;AAED,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAepI"}

package/lib/cli.js

@@ -1,19 +1,15 @@
 #!/usr/bin/env node
-import { probeIsolationRuntime, probeLinuxIsolationRuntime } from './probe.js';
+import { probeLinuxIsolationRuntime } from './probe.js';
 import { randomUUID } from 'node:crypto';
-import { reconcileUnknownJob } from './reconcile.js';
 import { constants, lstatSync, realpathSync } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { isAbsolute, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { IsolationLedger, IsolationLedgerError } from './ledger.js';
 import { reconcileLinuxJob } from './linux-job-recovery.js';
-import { removeIsolatedContainer } from './runner.js';
 import { defaultStoragePolicy, validateStoragePolicy } from './storage-policy.js';
 import { maintainIsolationStorage } from './storage.js';
 import { archiveIsolationAudit, verifyIsolationAuditArchive } from './audit-archive.js';
-import { configuredDockerSocketPath } from './docker-socket.js';
-import { stateSocketBindingMatches } from './state-socket-binding.js';
 function privateLedger(stateRoot) {
     if (!isAbsolute(stateRoot) || realpathSync(stateRoot) !== stateRoot)
         throw new Error('canonical state root required');
@@ -26,7 +22,7 @@ function privateLedger(stateRoot) {
     return file;
 }
 /** Operator entry point, separate from the model's tool registry. */
-export async function revokeIsolationGrant(stateRoot, grantId, revision, dockerPath = process.platform === 'darwin' ? '/usr/local/bin/docker' : '/usr/bin/docker', socketPath) {
+export async function revokeIsolationGrant(stateRoot, grantId, revision) {
     const file = privateLedger(stateRoot);
     const ledger = new IsolationLedger(file);
     let authority;
@@ -34,7 +30,7 @@ export async function revokeIsolationGrant(stateRoot, grantId, revision, dockerP
     const abort = new AbortController();
     try {
         ledger.revoke(grantId, revision, 'external-operator-revoke');
-        let containersRemoved = true, nativeSeen = false;
+        let nativeSeen = false;
         let cursor = '';
         for (;;) {
             const page = ledger.recoverable(cursor);
@@ -42,49 +38,37 @@ export async function revokeIsolationGrant(stateRoot, grantId, revision, dockerP
                 break;
             cursor = page.at(-1).id;
             for (const job of page) {
-                if (job.grantId !== grantId)
+                if (job.grantId !== grantId || job.backend !== 'linux-native')
                     continue;
-                if (job.backend === 'linux-native') {
-                    nativeSeen = true;
-                    // A live service owns cancellation and cleanup. Claiming never steals
-                    // its lease or rewrites expiry; only an idle ledger permits CLI cleanup.
-                    if (!authority) {
-                        try {
-                            authority = ledger.claimController(randomUUID(), 30_000);
-                        }
-                        catch (error) {
-                            if (!(error instanceof IsolationLedgerError) || error.code !== 'unauthorized')
-                                throw error;
-                        }
-                        if (authority) {
-                            const controller = authority;
-                            timer = setInterval(() => { try {
-                                if (!ledger.renewController(controller, 30_000))
-                                    abort.abort();
-                            }
-                            catch {
+                nativeSeen = true;
+                // A live service owns cancellation and cleanup. Claiming never steals
+                // its lease or rewrites expiry; only an idle ledger permits CLI cleanup.
+                if (!authority) {
+                    try {
+                        authority = ledger.claimController(randomUUID(), 30_000);
+                    }
+                    catch (error) {
+                        if (!(error instanceof IsolationLedgerError) || error.code !== 'unauthorized')
+                            throw error;
+                    }
+                    if (authority) {
+                        const controller = authority;
+                        timer = setInterval(() => { try {
+                            if (!ledger.renewController(controller, 30_000))
                                 abort.abort();
-                            } }, 5_000);
-                            timer.unref();
                         }
+                        catch {
+                            abort.abort();
+                        } }, 5_000);
+                        timer.unref();
                     }
-                    if (authority)
-                        await reconcileLinuxJob(ledger, authority, job, join(stateRoot, 'linux-executions'), abort.signal);
-                }
-                else if (job.backend === 'docker' && job.containerName) {
-                    if (!isAbsolute(dockerPath))
-                        throw new Error('absolute Docker path required');
-                    const boundSocket = configuredDockerSocketPath(socketPath);
-                    if (!stateSocketBindingMatches(stateRoot, boundSocket)
-                        || !await removeIsolatedContainer(dockerPath, job.containerName, { socketPath: boundSocket }))
-                        containersRemoved = false;
                 }
+                if (authority)
+                    await reconcileLinuxJob(ledger, authority, job, join(stateRoot, 'linux-executions'), abort.signal);
             }
         }
-        // Revocation is durable. A running controller also polls it and prevents any
-        // pending create from starting; late daemon responses may remain unknown.
         if (!nativeSeen)
-            return { revoked: true, containersRemoved };
+            return { revoked: true };
         let nativeRetained = 0;
         cursor = '';
         for (;;) {
@@ -94,7 +78,7 @@ export async function revokeIsolationGrant(stateRoot, grantId, revision, dockerP
             cursor = page.at(-1).id;
             nativeRetained += page.filter(job => job.backend === 'linux-native' && job.grantId === grantId).length;
         }
-        return { revoked: true, containersRemoved, nativeResourcesQuiescent: nativeRetained === 0, nativeRetained };
+        return { revoked: true, nativeResourcesQuiescent: nativeRetained === 0, nativeRetained };
     }
     finally {
         if (timer)
@@ -109,7 +93,7 @@ export async function revokeIsolationGrant(stateRoot, grantId, revision, dockerP
     }
 }
 /** Reconcile only settled requests; a live Host owns its own background sweep. */
-export async function reconcileIsolation(stateRoot, dockerPath = process.platform === 'darwin' ? '/usr/local/bin/docker' : '/usr/bin/docker', signal = new AbortController().signal, socketPath) {
+export async function reconcileIsolation(stateRoot, signal = new AbortController().signal) {
     const ledger = new IsolationLedger(privateLedger(stateRoot));
     const abort = new AbortController();
     let timer;
@@ -123,7 +107,7 @@ export async function reconcileIsolation(stateRoot, dockerPath = process.platfor
         }
         catch {
             abort.abort();
-        } }, 5000);
+        } }, 5_000);
         timer.unref();
         const counts = { checked: 0, released: 0, retained: 0 };
         let cursor = '';
@@ -137,16 +121,8 @@ export async function reconcileIsolation(stateRoot, dockerPath = process.platfor
                 abort.signal.throwIfAborted();
                 counts.checked++;
                 const combined = AbortSignal.any([signal, abort.signal, AbortSignal.timeout(30_000)]);
-                let released = false;
-                if (job.backend === 'linux-native')
-                    released = await reconcileLinuxJob(ledger, controller, job, join(stateRoot, 'linux-executions'), combined);
-                else if (job.backend === 'docker' && job.containerName) {
-                    if (!isAbsolute(dockerPath))
-                        throw new Error('absolute Docker path required');
-                    const boundSocket = configuredDockerSocketPath(socketPath);
-                    released = stateSocketBindingMatches(stateRoot, boundSocket)
-                        && await reconcileUnknownJob(ledger, controller, job, dockerPath, combined, boundSocket);
-                }
+                const released = job.backend === 'linux-native'
+                    && await reconcileLinuxJob(ledger, controller, job, join(stateRoot, 'linux-executions'), combined);
                 if (released)
                     counts.released++;
                 else
@@ -179,7 +155,7 @@ export async function maintainIsolation(stateRoot, resultRetentionMs = 0, afterI
         timer = setInterval(() => { try {
             ledger.renewController(controller, 30_000);
         }
-        catch { /* The maintenance fence fails closed. */ } }, 5000);
+        catch { /* The maintenance fence fails closed. */ } }, 5_000);
         timer.unref();
         return await maintainIsolationStorage(ledger, controller, stateRoot, policy, afterId);
     }
@@ -196,10 +172,10 @@ export async function maintainIsolation(stateRoot, resultRetentionMs = 0, afterI
     }
 }
 if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
-    const [command, stateRoot, grantId, revision, dockerPath, ...extra] = process.argv.slice(2);
+    const [command, stateRoot, grantId, revision, ...extra] = process.argv.slice(2);
     try {
         if (command === 'probe-native') {
-            if (!stateRoot || !isAbsolute(stateRoot) || grantId !== undefined || revision !== undefined || dockerPath !== undefined || extra.length > 0)
+            if (!stateRoot || grantId !== undefined || revision !== undefined || extra.length > 0)
                 throw new Error('usage: dsh-isolation probe-native /absolute/runtime-config.json');
             const file = await open(stateRoot, constants.O_RDONLY | constants.O_NOFOLLOW);
             try {
@@ -208,7 +184,7 @@ if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.a
                     throw new Error('native probe config must be a bounded owned regular file');
                 const text = await file.readFile('utf8');
                 const after = await file.stat();
-                if (Buffer.byteLength(text) !== stat.size || after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs)
+                if (Buffer.byteLength(text) !== stat.size || after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.mtimeMs)
                     throw new Error('native probe config changed while reading');
                 process.stdout.write(`${JSON.stringify(await probeLinuxIsolationRuntime(JSON.parse(text)))}\n`);
             }
@@ -216,25 +192,20 @@ if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.a
                 await file.close();
             }
         }
-        else if (command === 'probe') {
-            if (!stateRoot || dockerPath !== undefined || extra.length > 0)
-                throw new Error('usage: dsh-isolation probe sha256:image-id [/absolute/docker [/absolute/docker.sock]]');
-            process.stdout.write(`${JSON.stringify(await probeIsolationRuntime(stateRoot, grantId, revision))}\n`);
-        }
         else if (command === 'maintain') {
-            if (stateRoot === undefined || dockerPath !== undefined || (grantId !== undefined && !/^(0|[1-9][0-9]*)$/.test(grantId)))
+            if (stateRoot === undefined || (grantId !== undefined && !/^(0|[1-9][0-9]*)$/.test(grantId)))
                 throw new Error('usage: dsh-isolation maintain /absolute/private/state-root [result-retention-ms [after-job-id]]');
             process.stdout.write(`${JSON.stringify(await maintainIsolation(stateRoot, grantId === undefined ? 0 : Number(grantId), revision))}\n`);
         }
         else if (command === 'reconcile') {
-            if (stateRoot === undefined || dockerPath !== undefined || extra.length > 0)
-                throw new Error('usage: dsh-isolation reconcile /absolute/private/state-root [/absolute/docker [/absolute/docker.sock]]');
+            if (stateRoot === undefined || extra.length > 0)
+                throw new Error('usage: dsh-isolation reconcile /absolute/private/state-root');
             const abort = new AbortController();
             const cancel = () => abort.abort();
             process.once('SIGINT', cancel);
             process.once('SIGTERM', cancel);
             try {
-                process.stdout.write(`${JSON.stringify(await reconcileIsolation(stateRoot, grantId, abort.signal, revision))}\n`);
+                process.stdout.write(`${JSON.stringify(await reconcileIsolation(stateRoot, abort.signal))}\n`);
             }
             finally {
                 process.removeListener('SIGINT', cancel);
@@ -242,29 +213,32 @@ if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.a
             }
         }
         else if (command === 'archive-audit') {
-            if (stateRoot === undefined || grantId === undefined || dockerPath !== undefined || extra.length > 0
+            if (stateRoot === undefined || grantId === undefined || extra.length > 0
                 || (revision !== undefined && (!/^[1-9][0-9]*$/.test(revision) || !Number.isSafeInteger(Number(revision)) || Number(revision) > 1_000))) {
                 throw new Error('usage: dsh-isolation archive-audit /absolute/private/state-root /absolute/private/archive-directory [batch-size]');
             }
-            process.stdout.write(`${JSON.stringify(archiveIsolationAudit({ stateRoot, archiveDirectory: grantId, ...(revision === undefined ? {} : { batchSize: Number(revision) }) }))}\n`);
+            process.stdout.write(`${JSON.stringify(await archiveIsolationAudit({ stateRoot, archiveDirectory: grantId, ...(revision === undefined ? {} : { batchSize: Number(revision) }) }))}\n`);
         }
         else if (command === 'verify-audit') {
-            if (stateRoot === undefined || grantId !== undefined || revision !== undefined || dockerPath !== undefined || extra.length > 0) {
+            if (stateRoot === undefined || grantId !== undefined || revision !== undefined || extra.length > 0) {
                 throw new Error('usage: dsh-isolation verify-audit /absolute/private/archive-directory');
             }
             process.stdout.write(`${JSON.stringify(verifyIsolationAuditArchive(stateRoot))}\n`);
         }
-        else {
-            if (command !== 'revoke' || stateRoot === undefined || grantId === undefined || revision === undefined || extra.length > 1 || !/^[1-9][0-9]*$/.test(revision))
-                throw new Error('usage: dsh-isolation revoke /absolute/private/state-root grant-id revision [/absolute/docker [/absolute/docker.sock]]');
-            const result = await revokeIsolationGrant(stateRoot, grantId, Number(revision), dockerPath, extra[0]);
+        else if (command === 'revoke') {
+            if (command !== 'revoke' || stateRoot === undefined || grantId === undefined || revision === undefined || extra.length > 0 || !/^[1-9][0-9]*$/.test(revision))
+                throw new Error('usage: dsh-isolation revoke /absolute/private/state-root grant-id revision');
+            const result = await revokeIsolationGrant(stateRoot, grantId, Number(revision));
             process.stdout.write(`${JSON.stringify(result)}\n`);
-            if (!result.containersRemoved || result.nativeResourcesQuiescent === false)
+            if (result.nativeResourcesQuiescent === false)
                 process.exitCode = 2;
         }
+        else {
+            throw new Error('unknown command');
+        }
     }
     catch (error) {
-        process.stderr.write(`${error instanceof Error ? error.message : 'isolation revoke failed'}\n`);
+        process.stderr.write(`${error instanceof Error ? error.message : 'isolation operation failed'}\n`);
         process.exitCode = 1;
     }
 }

package/lib/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAoC,MAAM,cAAc,CAAA;AACzF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAErE,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACrH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAClF,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC5L,OAAO,IAAI,CAAA;AACb,CAAC;AAUD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe,EAAE,QAAgB,EAC7F,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,iBAAiB,EAAE,UAAmB;IAC7G,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,SAAqE,CAAA;IACzE,IAAI,KAAiC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAA;QAC5D,IAAI,iBAAiB,GAAG,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;QAChD,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;oBAAE,SAAQ;gBACrC,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;oBACnC,UAAU,GAAG,IAAI,CAAA;oBACjB,sEAAsE;oBACtE,yEAAyE;oBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,IAAI,CAAC;4BAAC,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;wBAAC,CAAC;wBAChE,OAAO,KAAK,EAAE,CAAC;4BAAC,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gCAAE,MAAM,KAAK,CAAA;wBAAC,CAAC;wBAC5G,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,UAAU,GAAG,SAAS,CAAA;4BAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gCAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC;oCAAE,KAAK,CAAC,KAAK,EAAE,CAAA;4BAAC,CAAC;4BAAC,MAAM,CAAC;gCAAC,KAAK,CAAC,KAAK,EAAE,CAAA;4BAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;4BACpI,KAAK,CAAC,KAAK,EAAE,CAAA;wBACf,CAAC;oBACH,CAAC;oBACD,IAAI,SAAS;wBAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBACnH,CAAC;qBAAM,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;oBACzD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;oBAC7E,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAA;oBAC1D,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC;2BACjD,CAAC,MAAM,uBAAuB,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;wBAAE,iBAAiB,GAAG,KAAK,CAAA;gBAC5H,CAAC;YACH,CAAC;QACH,CAAC;QACD,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAA;QAC5D,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,MAAM,GAAG,EAAE,CAAA;QACX,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;QACxG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,cAAc,KAAK,CAAC,EAAE,cAAc,EAAE,CAAA;IAC7G,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,iBAAiB,EAClJ,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,UAAmB;IACvE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,IAAI,KAAiC,CAAA;IACrC,IAAI,SAAqE,CAAA;IACzE,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,SAAS,CAAA;QAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACnI,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACvD,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;gBACtD,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACrF,IAAI,QAAQ,GAAG,KAAK,CAAA;gBACpB,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;oBAAE,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;qBACzI,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;oBAC7E,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAA;oBAC1D,QAAQ,GAAG,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC;2BACvD,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;gBAC5F,CAAC;gBACD,IAAI,QAAQ;oBAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;;oBAC1B,MAAM,CAAC,QAAQ,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,iBAAiB,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;IAC5F,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,GAAG,oBAAoB,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAqE,CAAA;IACzE,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,SAAS,CAAA;QAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC3I,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,OAAO,MAAM,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACvF,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3F,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;YAC/N,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;gBACjM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;gBACvM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACjG,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QAClC,CAAC;aAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAA;YACxK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;QACxG,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAA;YAC5O,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;QACxI,CAAC;aAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAA;YACtM,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;YACnC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAC/D,IAAI,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;oBACjH,CAAC;gBAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAAC,CAAC;QACjG,CAAC;aAAM,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;mBAC/F,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1I,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAA;YACrI,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAClL,CAAC;aAAM,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/H,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;YAC1F,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAA;QACrF,CAAC;aAAM,CAAC;YACR,IAAI,OAAO,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uHAAuH,CAAC,CAAA;YACvS,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,wBAAwB,KAAK,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IAAC,CAAC;AAC3I,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAoC,MAAM,cAAc,CAAA;AACzF,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAEvF,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IACrH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAClF,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC5L,OAAO,IAAI,CAAA;AACb,CAAC;AAQD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe,EAAE,QAAgB;IAC7F,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,SAAqE,CAAA;IACzE,IAAI,KAAiC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;oBAAE,SAAQ;gBACvE,UAAU,GAAG,IAAI,CAAA;gBACjB,sEAAsE;gBACtE,yEAAyE;gBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC;wBAAC,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;oBAAC,CAAC;oBAChE,OAAO,KAAK,EAAE,CAAC;wBAAC,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;4BAAE,MAAM,KAAK,CAAA;oBAAC,CAAC;oBAC5G,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,UAAU,GAAG,SAAS,CAAA;wBAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;4BAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC;gCAAE,KAAK,CAAC,KAAK,EAAE,CAAA;wBAAC,CAAC;wBAAC,MAAM,CAAC;4BAAC,KAAK,CAAC,KAAK,EAAE,CAAA;wBAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;wBACpI,KAAK,CAAC,KAAK,EAAE,CAAA;oBACf,CAAC;gBACH,CAAC;gBACD,IAAI,SAAS;oBAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACnH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACzC,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,MAAM,GAAG,EAAE,CAAA;QACX,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;QACxG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,cAAc,KAAK,CAAC,EAAE,cAAc,EAAE,CAAA;IAC1F,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EACxD,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM;IAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IACnC,IAAI,KAAiC,CAAA;IACrC,IAAI,SAAqE,CAAA;IACzE,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,SAAS,CAAA;QAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpI,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACvD,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;YAC5B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;YACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;gBACtD,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,KAAK,cAAc;uBAC1C,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACpG,IAAI,QAAQ;oBAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;;oBAC1B,MAAM,CAAC,QAAQ,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,iBAAiB,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE;IAC5F,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,GAAG,oBAAoB,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACpF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAqE,CAAA;IACzE,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,SAAS,CAAA;QAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5I,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,OAAO,MAAM,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACvF,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC;YAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;YACzK,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;gBACjM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;gBACvM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACjG,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QAClC,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAA;YAChN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;QACxI,CAAC;aAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC/H,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;YACnC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAC/D,IAAI,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;oBAC9F,CAAC;gBAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAAC,CAAC;QACjG,CAAC;aAAM,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;mBACnE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1I,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAA;YACrI,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACxL,CAAC;aAAM,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;YAC1F,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAA;QACrF,CAAC;aAAM,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAO,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAC5P,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,MAAM,CAAC,wBAAwB,KAAK,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IAAC,CAAC;AAC9I,CAAC"}