@dsh-enhanced/assistant-verifier 0.1.64 → 0.1.66

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,KAAK,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,oCAAoC,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpD,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,CAAA;AACtG,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC3K,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC3G,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAChI,OAAO,EAAE,kCAAkC,EAAE,sCAAsC,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAClJ,YAAY,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAC7G,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAChG,YAAY,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAChG,YAAY,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAC/H,YAAY,EAAE,8BAA8B,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAA;AAElI,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,KAAK,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,oCAAoC,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpD,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,CAAA;AACtG,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC3K,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC3G,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAChI,OAAO,EAAE,kCAAkC,EAAE,sCAAsC,EAAE,wCAAwC,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC5L,YAAY,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAA;AAC/I,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAChG,YAAY,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAChG,YAAY,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAC/H,YAAY,EAAE,8BAA8B,EAAE,2CAA2C,EAAE,MAAM,iCAAiC,CAAA;AAElI,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,wBAAwB,CAAA"}

package/lib/index.js

@@ -7,7 +7,7 @@ export * from './host.js';
 export * from './config.js';
 export { validateSourceReviewConfig } from './source-review.js';
 export { validateMemoryReviewConfig } from './memory-review.js';
-export { validatePluginBehaviorRunnerConfig, validatePluginBehaviorDeploymentConfig, NATIVE_BEHAVIOR_BOUNDARY } from './plugin-behavior-config.js';
+export { validatePluginBehaviorRunnerConfig, validatePluginBehaviorDeploymentConfig, validateCreationBehaviorDeploymentConfig, NATIVE_BEHAVIOR_BOUNDARY } from './plugin-behavior-config.js';
 export { compileCreationReviewConfig, validateCreationReviewConfig } from './creation-review.js';
 export { compileRevisionReviewConfig, validateRevisionReviewConfig } from './revision-review.js';
 export { compileRevisionRegressionReviewConfig, validateRevisionRegressionReviewConfig } from './revision-regression-review.js';

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,iCAAiC,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAEpD,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAG/D,OAAO,EAAE,kCAAkC,EAAE,sCAAsC,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAElJ,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEhG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEhG,OAAO,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAG/H,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,eAAe,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,iCAAiC,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAEpD,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAG/D,OAAO,EAAE,kCAAkC,EAAE,sCAAsC,EAAE,wCAAwC,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAE5L,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEhG,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEhG,OAAO,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAG/H,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,eAAe,wBAAwB,CAAA"}

package/lib/linux-behavior-assets.d.ts

@@ -0,0 +1,17 @@
+export declare const LINUX_BEHAVIOR_COMMAND = "exec /usr/bin/env LD_PRELOAD=/runtime/0/dsh-plugin-verifier/parent-protect.so /runtime/0/bin/node --disable-sigusr1 /runtime/0/dsh-plugin-verifier/worker.mjs";
+export declare const LINUX_BEHAVIOR_PREFIX = "/runtime/0/dsh-plugin-verifier";
+export declare const LINUX_BEHAVIOR_MAPPINGS: readonly [readonly ["/opt/dsh-plugin-verifier/plugins/assistant-verifier/node_modules", "/runtime/0/node_modules"], readonly ["/opt/dsh-plugin-verifier", "/runtime/0/dsh-plugin-verifier"]];
+export declare const LINUX_BEHAVIOR_COMPILE_FLAGS: readonly ["-std=c11", "-O2", "-Wall", "-Wextra", "-Werror", "-DDSH_NODE_PATH=\"/runtime/0/bin/node\""];
+export declare const behaviorSha256: (value: string | Buffer) => string;
+/** Bounded descriptor reads: source assets must be ordinary, stable, unlinked files. */
+export declare function readBehaviorFile(path: string, limit: number): Promise<Buffer>;
+/** Same unique markers and byte limit as the existing Docker asset extractor. */
+export declare function extractLinuxBehaviorAsset(raw: string, name: 'WORKER' | 'CANDIDATE'): string;
+export interface LinuxBehaviorAssets {
+    worker: string;
+    candidate: string;
+    launcher: string;
+    sourceSha256: string;
+}
+export declare function loadLinuxBehaviorAssets(): Promise<LinuxBehaviorAssets>;
+//# sourceMappingURL=linux-behavior-assets.d.ts.map

package/lib/linux-behavior-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-behavior-assets.d.ts","sourceRoot":"","sources":["../src/linux-behavior-assets.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,sBAAsB,kKAAkK,CAAA;AACrM,eAAO,MAAM,qBAAqB,mCAAmC,CAAA;AAIrE,eAAO,MAAM,uBAAuB,8LAG1B,CAAA;AACV,eAAO,MAAM,4BAA4B,wGAAuG,CAAA;AAChJ,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,GAAG,MAAM,KAAG,MAA0D,CAAA;AAElH,wFAAwF;AACxF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBnF;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,CAU3F;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAa5E"}

package/lib/linux-behavior-assets.js

@@ -0,0 +1,73 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+export const LINUX_BEHAVIOR_COMMAND = 'exec /usr/bin/env LD_PRELOAD=/runtime/0/dsh-plugin-verifier/parent-protect.so /runtime/0/bin/node --disable-sigusr1 /runtime/0/dsh-plugin-verifier/worker.mjs';
+export const LINUX_BEHAVIOR_PREFIX = '/runtime/0/dsh-plugin-verifier';
+// Node checks both the package alias and its resolved SDK path. The historical
+// second SDK alias is redundant here; use that grant for the exact real tree.
+// Keep the first alias for package.json reads, never grant the whole runtime.
+export const LINUX_BEHAVIOR_MAPPINGS = [
+    ['/opt/dsh-plugin-verifier/plugins/assistant-verifier/node_modules', '/runtime/0/node_modules'],
+    ['/opt/dsh-plugin-verifier', LINUX_BEHAVIOR_PREFIX],
+];
+export const LINUX_BEHAVIOR_COMPILE_FLAGS = ['-std=c11', '-O2', '-Wall', '-Wextra', '-Werror', '-DDSH_NODE_PATH="/runtime/0/bin/node"'];
+export const behaviorSha256 = (value) => createHash('sha256').update(value).digest('hex');
+/** Bounded descriptor reads: source assets must be ordinary, stable, unlinked files. */
+export async function readBehaviorFile(path, limit) {
+    const before = await lstat(path);
+    if (!before.isFile() || before.nlink !== 1 || before.size > limit || before.mode & 0o022
+        || await realpath(path) !== path)
+        throw new Error('unsafe Linux behavior asset');
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stamp = (info) => JSON.stringify([info.dev, info.ino, info.mode, info.uid, info.size, info.mtimeMs, info.ctimeMs]);
+    try {
+        if (stamp(await fd.stat()) !== stamp(before))
+            throw new Error('Linux behavior asset changed');
+        const buffer = Buffer.alloc(before.size + 1);
+        let count = 0;
+        while (count < buffer.length) {
+            const result = await fd.read(buffer, count, buffer.length - count);
+            if (!result.bytesRead)
+                break;
+            count += result.bytesRead;
+        }
+        if (count !== before.size || stamp(await fd.stat()) !== stamp(before)
+            || stamp(await lstat(path)) !== stamp(before))
+            throw new Error('Linux behavior asset changed');
+        return buffer.subarray(0, count);
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Same unique markers and byte limit as the existing Docker asset extractor. */
+export function extractLinuxBehaviorAsset(raw, name) {
+    if (Buffer.byteLength(raw) > 256 * 1024)
+        throw new Error('Linux behavior source too large');
+    const begin = `/* DSH_PLUGIN_VERIFIER_${name}_START\n`;
+    const end = `\nDSH_PLUGIN_VERIFIER_${name}_END */`;
+    const first = raw.indexOf(begin), last = raw.indexOf(end, first + begin.length);
+    if (first < 0 || last < 0 || raw.indexOf(begin, first + 1) >= 0 || raw.indexOf(end) !== last
+        || raw.indexOf(end, last + 1) >= 0)
+        throw new Error('Linux behavior fixed markers invalid');
+    const result = raw.slice(first + begin.length, last) + '\n';
+    if (Buffer.byteLength(result) > 32 * 1024)
+        throw new Error('Linux behavior fixed asset too large');
+    return result;
+}
+export async function loadLinuxBehaviorAssets() {
+    const raw = (await readBehaviorFile(fileURLToPath(new URL('../lib/plugin-behavior-runner.js', import.meta.url)), 256 * 1024)).toString('utf8');
+    const launcher = (await readBehaviorFile(fileURLToPath(new URL('../runtime/plugin-observer-launcher.c', import.meta.url)), 64 * 1024)).toString('utf8');
+    const worker = extractLinuxBehaviorAsset(raw, 'WORKER'), candidate = extractLinuxBehaviorAsset(raw, 'CANDIDATE');
+    const map = (source) => LINUX_BEHAVIOR_MAPPINGS.reduce((value, [from, to]) => value.replaceAll(from, to), source);
+    // Canonical fixed-source identity: only these ordered fields, original UTF-8
+    // bytes, exact prefix mapping, command and compiler flags enter this digest.
+    // Compiler/helper identity is independently bound by the private receipt.
+    const sourceSha256 = behaviorSha256(JSON.stringify({ schemaVersion: 1, workerSha256: behaviorSha256(worker),
+        candidateSha256: behaviorSha256(candidate), launcherSourceSha256: behaviorSha256(launcher),
+        mapping: LINUX_BEHAVIOR_MAPPINGS, command: LINUX_BEHAVIOR_COMMAND,
+        compileFlags: LINUX_BEHAVIOR_COMPILE_FLAGS }));
+    return { worker: map(worker), candidate: map(candidate), launcher: map(launcher), sourceSha256 };
+}
+//# sourceMappingURL=linux-behavior-assets.js.map

package/lib/linux-behavior-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-behavior-assets.js","sourceRoot":"","sources":["../src/linux-behavior-assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,+JAA+J,CAAA;AACrM,MAAM,CAAC,MAAM,qBAAqB,GAAG,gCAAgC,CAAA;AACrE,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,CAAC,kEAAkE,EAAE,yBAAyB,CAAC;IAC/F,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;CAC3C,CAAA;AACV,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,uCAAuC,CAAU,CAAA;AAChJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAElH,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAChE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;WACnF,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAClF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/I,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;QAC5C,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAA;YAClE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAK;YAC5B,KAAK,IAAI,MAAM,CAAC,SAAS,CAAA;QAC3B,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;eAChE,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAChG,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,IAA4B;IACjF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC3F,MAAM,KAAK,GAAG,0BAA0B,IAAI,UAAU,CAAA;IACtD,MAAM,GAAG,GAAG,yBAAyB,IAAI,SAAS,CAAA;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/E,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;WACvF,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAA;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IAClG,OAAO,MAAM,CAAA;AACf,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,GAAG,GAAG,CAAC,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9I,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,uCAAuC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAChH,MAAM,GAAG,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;IACjI,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC;QACzG,eAAe,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,QAAQ,CAAC;QAC1F,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,sBAAsB;QACjE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAA;IAChD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;AAClG,CAAC"}

package/lib/linux-behavior-runner.d.ts

@@ -0,0 +1,10 @@
+import { type IsolationResult } from '@dsh-enhanced/assistant-isolation';
+import type { LinuxPluginBehaviorRunnerConfig } from './plugin-behavior-config.js';
+/** Owns observer verification as well as the ordinary runner's durable execution. */
+export declare class LinuxBehaviorRunner {
+    #private;
+    constructor(config: LinuxPluginBehaviorRunnerConfig);
+    run: (key: string, artifact: string, stdin: string, signal: AbortSignal) => Promise<IsolationResult>;
+    close: () => Promise<void>;
+}
+//# sourceMappingURL=linux-behavior-runner.d.ts.map

package/lib/linux-behavior-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-behavior-runner.d.ts","sourceRoot":"","sources":["../src/linux-behavior-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,mCAAmC,CAAA;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAA;AASlF,qFAAqF;AACrF,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,+BAA+B;IAQnD,GAAG,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,QAAQ,WAAW,KAAG,OAAO,CAAC,eAAe,CAAC,CAKlG;IAyBD,KAAK,QAAa,OAAO,CAAC,IAAI,CAAC,CAW9B;CACF"}

package/lib/linux-behavior-runner.js

@@ -0,0 +1,69 @@
+import { LinuxVerifierRunner } from '@dsh-enhanced/assistant-isolation';
+import { LINUX_BEHAVIOR_COMMAND, verifyLinuxPluginBehaviorRuntime } from './linux-behavior-runtime.js';
+const MAX_VERIFICATION_MS = 300_000;
+// A check that precedes ledger lookup proves no new dispatch, not absence of
+// resources retained by a historical same-key unknown job.
+const unavailable = (reason) => ({ jobId: '', status: 'unknown', quiescent: false,
+    stdout: '', stderr: '', artifacts: [], reason });
+/** Owns observer verification as well as the ordinary runner's durable execution. */
+export class LinuxBehaviorRunner {
+    #config;
+    #runner;
+    #abort = new AbortController();
+    #calls = new Set();
+    #active = true;
+    #closePromise;
+    constructor(config) {
+        this.#config = config;
+        const { runtime, ...authority } = config;
+        // The ordinary profile is fixed inside LinuxVerifierRunner. No repository
+        // execution policy, caller command, source or mutable resource limits enter.
+        this.#runner = new LinuxVerifierRunner({ ...authority, runtime: runtime.runtime, command: LINUX_BEHAVIOR_COMMAND });
+    }
+    run = (key, artifact, stdin, signal) => {
+        const call = this.#run(key, artifact, stdin, signal);
+        this.#calls.add(call);
+        void call.then(() => this.#calls.delete(call), () => this.#calls.delete(call));
+        return call;
+    };
+    async #run(key, artifact, stdin, caller) {
+        if (!this.#active || caller.aborted || Date.now() >= this.#config.expiresAt)
+            return unavailable('plugin-behavior-unavailable');
+        const deadline = new AbortController();
+        const timer = setTimeout(() => deadline.abort(), Math.max(1, Math.min(MAX_VERIFICATION_MS, this.#config.expiresAt - Date.now())));
+        timer.unref();
+        const signal = AbortSignal.any([caller, this.#abort.signal, deadline.signal]);
+        try {
+            try {
+                await verifyLinuxPluginBehaviorRuntime(this.#config.runtime, signal);
+            }
+            catch {
+                return unavailable(signal.aborted ? 'plugin-behavior-unavailable' : 'plugin-behavior-runtime-invalid');
+            }
+            if (!this.#active || signal.aborted || Date.now() >= this.#config.expiresAt)
+                return unavailable('plugin-behavior-unavailable');
+            const result = await this.#runner.run(key, artifact, stdin, signal);
+            if (!this.#active || signal.aborted)
+                return { ...result, status: 'unknown', reason: 'plugin-behavior-unavailable' };
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    close = async () => {
+        if (this.#closePromise)
+            return await this.#closePromise;
+        this.#active = false;
+        this.#abort.abort();
+        this.#closePromise = (async () => {
+            // Closing the underlying runner cancels admitted work while verification
+            // responds to the same abort. Await both; never detach an in-flight check.
+            const settled = await Promise.allSettled([this.#runner.close(), ...this.#calls]);
+            if (settled[0]?.status === 'rejected')
+                throw settled[0].reason;
+        })();
+        return await this.#closePromise;
+    };
+}
+//# sourceMappingURL=linux-behavior-runner.js.map

package/lib/linux-behavior-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-behavior-runner.js","sourceRoot":"","sources":["../src/linux-behavior-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAwB,MAAM,mCAAmC,CAAA;AAE7F,OAAO,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAA;AAEtG,MAAM,mBAAmB,GAAG,OAAO,CAAA;AACnC,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,WAAW,GAAG,CAAC,MAAc,EAAmB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK;IACxG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAElD,qFAAqF;AACrF,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAiC;IACxC,OAAO,CAAqB;IAC5B,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAC9B,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IACrD,OAAO,GAAG,IAAI,CAAA;IACd,aAAa,CAA2B;IAExC,YAAY,MAAuC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAA;QACxC,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACrH,CAAC;IAED,GAAG,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAmB,EAA4B,EAAE;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAmB;QAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YACzE,OAAO,WAAW,CAAC,6BAA6B,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QACjI,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7E,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAA;YACxG,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;gBACzE,OAAO,WAAW,CAAC,6BAA6B,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACnE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;YACnH,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,KAAK,GAAG,KAAK,IAAmB,EAAE;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;QACvD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC/B,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;YAChF,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,UAAU;gBAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAChE,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,MAAM,IAAI,CAAC,aAAa,CAAA;IACjC,CAAC,CAAA;CACF"}

package/lib/linux-behavior-runtime.d.ts

@@ -0,0 +1,67 @@
+import { type LinuxRuntime } from '@dsh-enhanced/assistant-isolation';
+export { LINUX_BEHAVIOR_COMMAND } from './linux-behavior-assets.js';
+export interface LinuxPluginBehaviorRuntime {
+    schemaVersion: 1;
+    runtime: LinuxRuntime;
+    observer: {
+        schemaVersion: 1;
+        sourceSha256: string;
+        workerSha256: string;
+        candidateSha256: string;
+        launcherSha256: string;
+        parentProtectSha256: string;
+        childProtectSha256: string;
+    };
+}
+/** Shape-only validation. No file reads, subprocesses or authority are acquired. */
+export declare function validateLinuxPluginBehaviorRuntime(value: unknown): LinuxPluginBehaviorRuntime;
+export declare function linuxPluginBehaviorRuntimeDigest(value: LinuxPluginBehaviorRuntime): string;
+/** Full tree and fixed-source checks precede every candidate use. Tree hashing
+ * and fixed Node probes use the underlying runtime's bounded, cancellable checks. */
+export declare function verifyLinuxPluginBehaviorRuntime(value: LinuxPluginBehaviorRuntime, signal?: AbortSignal): Promise<LinuxPluginBehaviorRuntime>;
+/** Adoption rechecks the retained clone, not the expired build authority. The
+ * independently signed preparation digest binds the original compiler/base
+ * provenance; it does not assert that either is still installed. */
+export declare function verifyLinuxPluginBehaviorAdoptionRuntime(input: {
+    runtime: LinuxPluginBehaviorRuntime;
+    buildRuntimeDigest: string;
+    preparationDigest: string;
+    signal: AbortSignal;
+}): Promise<void>;
+/** Read-only reopen for retained deployment observers whose build-time base
+ * runtime is no longer installed. Receipt self-consistency, the live
+ * descriptor identity and the observer tree checks still bind preparation;
+ * the returned digests must be anchored to a freshly signed certificate. */
+export declare function readLinuxPluginBehaviorDeploymentPreparation(input: {
+    runtime: LinuxPluginBehaviorRuntime;
+    signal?: AbortSignal;
+}): Promise<{
+    descriptor: LinuxPluginBehaviorRuntime;
+    baseRuntimeDigest: string;
+    preparationDigest: string;
+}>;
+/** Read-only reopen; compiler, base and fixed-source drift invalidate reuse. */
+export declare function readLinuxPluginBehaviorPreparation(input: {
+    runtime: LinuxRuntime;
+    root: string;
+    signal?: AbortSignal;
+}): Promise<{
+    descriptor: LinuxPluginBehaviorRuntime;
+    baseRuntimeDigest: string;
+    preparationDigest: string;
+}>;
+/** Descriptor-only compatibility wrapper over the same validated preparation. */
+export declare function readLinuxPluginBehaviorRuntime(input: {
+    runtime: LinuxRuntime;
+    root: string;
+    signal?: AbortSignal;
+}): Promise<LinuxPluginBehaviorRuntime>;
+/** A private sibling lock excludes concurrent preparations through this API.
+ * A crash leaves the lock closed for owner inspection. Like the base bootstrap,
+ * this does not isolate a hostile Host running under the same OS user. */
+export declare function prepareLinuxPluginBehaviorRuntime(input: {
+    runtime: LinuxRuntime;
+    root: string;
+    signal?: AbortSignal;
+}): Promise<LinuxPluginBehaviorRuntime>;
+//# sourceMappingURL=linux-behavior-runtime.d.ts.map

package/lib/linux-behavior-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-behavior-runtime.d.ts","sourceRoot":"","sources":["../src/linux-behavior-runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsF,KAAK,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEzJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAEnE,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,QAAQ,EAAE;QAAE,aAAa,EAAE,CAAC,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAChG,cAAc,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAA;CACpF;AAmCD,oFAAoF;AACpF,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAO7F;AACD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAE1F;AA8ID;qFACqF;AACrF,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,0BAA0B,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA2BnJ;AAED;;oEAEoE;AACpE,wBAAsB,wCAAwC,CAAC,KAAK,EAAE;IACpE,OAAO,EAAE,0BAA0B,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAChH,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BhB;AAED;;;4EAG4E;AAC5E,wBAAsB,4CAA4C,CAAC,KAAK,EAAE;IACxE,OAAO,EAAE,0BAA0B,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC1D,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,0BAA0B,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B5G;AAED,gFAAgF;AAChF,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC;IACtI,UAAU,EAAE,0BAA0B,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAC7F,CAAC,CAsBD;AAED,iFAAiF;AACjF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAE9J;AA2ED;;0EAE0E;AAC1E,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAejK"}