@fentaris/edge 0.2.0

package/dist/setup.js

@@ -0,0 +1,427 @@
+import { randomUUID } from "node:crypto";
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { emitKeypressEvents } from "node:readline";
+import { createInterface } from "node:readline/promises";
+import { LAUNCH_RECIPE_VERSION, edgeError, isRuntimeValueToken, } from "@fentaris/core";
+/** Interactive terminal prompter that suppresses local secret echo on a TTY. */
+export class NodeTerminalSetupPrompter {
+    async confirm(message) {
+        const value = (await this.input(`${message} [y/N]:`)).trim().toLowerCase();
+        return value === "y" || value === "yes";
+    }
+    async input(message, options) {
+        if (options?.secret && process.stdin.isTTY) {
+            return hiddenInput(message);
+        }
+        const prompt = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            return await prompt.question(`${message} `);
+        }
+        finally {
+            prompt.close();
+        }
+    }
+}
+/** Initial terminal setup provider with explicit workload and resource consent. */
+export class TerminalSetupProvider {
+    prompt;
+    constructor(prompt) {
+        this.prompt = prompt;
+    }
+    approveWorkload(requirement) {
+        return this.prompt.confirm(`Allow deployment "${requirement.deploymentId}" to run recipe ${requirement.recipe.digest}?`);
+    }
+    async collectField(field) {
+        const label = field.label ?? field.name;
+        if (field.kind === "folder" || field.kind === "file") {
+            const approved = await this.prompt.confirm(`Grant ${field.access} access for ${field.kind} "${label}"?`);
+            if (!approved)
+                return { approved: false };
+        }
+        const raw = await this.prompt.input(`${label}:`, { secret: field.kind === "secret" });
+        return { approved: true, value: parseTerminalValue(field, raw) };
+    }
+}
+/** Local setup/grant reconciliation and launch-plan compilation. */
+export class LocalSetupManager {
+    options;
+    now;
+    grantId;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.grantId = options.grantId ?? randomUUID;
+    }
+    async ingest(requirement) {
+        assertDeclarative(requirement.recipe);
+        if (requirement.recipe.version !== LAUNCH_RECIPE_VERSION) {
+            throw edgeError("EDGE_PROTOCOL", "Unsupported launch recipe version.");
+        }
+        const database = await this.database();
+        const previous = database.states[requirement.deploymentId];
+        const grants = { ...database.grants };
+        const grantRefs = {};
+        const fieldDigests = {};
+        const missingFields = [];
+        const approved = new Set(database.approvedRecipeDigests);
+        const created = [];
+        const retired = [];
+        if (!approved.has(requirement.recipe.digest)) {
+            if (!await this.options.provider.approveWorkload(requirement)) {
+                const denied = stateFor(requirement, "denied", {}, {}, Object.keys(requirement.schema.fields));
+                await this.save({ ...database, grants, states: { ...database.states, [requirement.deploymentId]: denied } });
+                await this.emitTransition(denied);
+                return denied;
+            }
+            approved.add(requirement.recipe.digest);
+        }
+        try {
+            for (const [name, field] of Object.entries(requirement.schema.fields)) {
+                const digest = fieldDigest(field);
+                fieldDigests[name] = digest;
+                const oldGrantId = previous?.grantRefs[name];
+                const oldGrant = oldGrantId ? grants[oldGrantId] : undefined;
+                if (oldGrant && oldGrant.fieldDigest === digest) {
+                    grantRefs[name] = oldGrant.id;
+                    continue;
+                }
+                if (oldGrant) {
+                    retired.push(oldGrant);
+                    delete grants[oldGrant.id];
+                }
+                const response = await this.options.provider.collectField(field, requirement);
+                if (!response.approved) {
+                    if (field.required)
+                        missingFields.push(name);
+                    continue;
+                }
+                const value = response.value ?? defaultValue(field);
+                if (value === undefined && !field.required)
+                    continue;
+                if (value === undefined) {
+                    missingFields.push(name);
+                    continue;
+                }
+                const grant = await this.createGrant(requirement.deploymentId, field, digest, value);
+                created.push(grant);
+                grants[grant.id] = grant;
+                grantRefs[name] = grant.id;
+            }
+            for (const [name, oldGrantId] of Object.entries(previous?.grantRefs ?? {})) {
+                if (name in requirement.schema.fields)
+                    continue;
+                const oldGrant = grants[oldGrantId];
+                if (oldGrant) {
+                    retired.push(oldGrant);
+                    delete grants[oldGrantId];
+                }
+            }
+            const status = missingFields.length === 0 ? "ready" : "pending";
+            const state = stateFor(requirement, status, grantRefs, fieldDigests, missingFields);
+            await this.save({
+                grants,
+                states: { ...database.states, [requirement.deploymentId]: state },
+                approvedRecipeDigests: [...approved],
+            });
+            await Promise.all(retired.map((grant) => this.deleteGrant(grant)));
+            await this.emitTransition(state);
+            return state;
+        }
+        catch (error) {
+            await Promise.all(created.map((grant) => this.deleteGrant(grant)));
+            throw error;
+        }
+    }
+    async status(deploymentId) {
+        return (await this.database()).states[deploymentId];
+    }
+    /** Delete every local grant, setup state, and protected setup secret. */
+    async clear() {
+        const database = await this.database();
+        await Promise.all(Object.values(database.grants).map((grant) => this.deleteGrant(grant)));
+        await this.options.store.delete();
+    }
+    async compileLaunchPlan(requirement) {
+        assertDeclarative(requirement.recipe);
+        const database = await this.database();
+        const state = database.states[requirement.deploymentId];
+        if (!state
+            || state.status !== "ready"
+            || state.desiredStateVersion !== requirement.desiredStateVersion
+            || state.recipeDigest !== requirement.recipe.digest
+            || state.setupSchemaVersion !== requirement.schema.version) {
+            throw edgeError("EDGE_SETUP_REQUIRED", "Current desired deployment is not locally ready.", {
+                details: { deploymentId: requirement.deploymentId },
+            });
+        }
+        if (!database.approvedRecipeDigests.includes(requirement.recipe.digest)) {
+            throw edgeError("EDGE_SETUP_REQUIRED", "Launch recipe has not received local consent.");
+        }
+        const resolve = async (value) => {
+            if (typeof value === "string")
+                return value;
+            if (!isRuntimeValueToken(value)) {
+                throw edgeError("EDGE_PROTOCOL", "Launch recipe contains unsupported executable data.");
+            }
+            const grantId = state.grantRefs[value.ref];
+            const grant = grantId ? database.grants[grantId] : undefined;
+            if (!grant) {
+                throw edgeError("EDGE_SETUP_REQUIRED", "A required local setup grant is missing.", {
+                    details: { deploymentId: requirement.deploymentId, field: value.ref },
+                });
+            }
+            if (value.kind === "secret") {
+                if (grant.kind !== "secret")
+                    throw edgeError("EDGE_GRANT", "Runtime secret references a non-secret grant.");
+                const secret = await this.options.credentials.get(secretKey(grant.id));
+                if (secret === undefined)
+                    throw edgeError("EDGE_GRANT", "Local secret grant was revoked.");
+                return secret;
+            }
+            return this.resolveGrantValue(grant);
+        };
+        const args = await Promise.all(requirement.recipe.args.map(resolve));
+        const env = {};
+        for (const [name, value] of Object.entries(requirement.recipe.env))
+            env[name] = await resolve(value);
+        return {
+            deploymentId: requirement.deploymentId,
+            recipeDigest: requirement.recipe.digest,
+            command: requirement.recipe.command,
+            args,
+            env,
+        };
+    }
+    /** Resolve a child path while rechecking canonical containment and access. */
+    async resolveGrantedPath(grantId, childPath = ".", requestedAccess = "read") {
+        const grant = (await this.database()).grants[grantId];
+        if (!grant || (grant.kind !== "folder" && grant.kind !== "file")) {
+            throw edgeError("EDGE_GRANT", "Filesystem grant is missing or revoked.");
+        }
+        if (requestedAccess === "read-write" && grant.access !== "read-write") {
+            throw edgeError("EDGE_GRANT", "Write access exceeds the approved local grant.");
+        }
+        const root = await realpath(grant.canonicalPath);
+        if (root !== grant.canonicalPath) {
+            throw edgeError("EDGE_GRANT", "Filesystem grant canonical path changed.");
+        }
+        if (grant.kind === "file") {
+            if (childPath !== "." && childPath !== "")
+                throw edgeError("EDGE_GRANT", "File grants do not allow child paths.");
+            return root;
+        }
+        const candidate = await realpath(path.resolve(root, childPath));
+        const relative = path.relative(root, candidate);
+        if (relative.startsWith("..") || path.isAbsolute(relative)) {
+            throw edgeError("EDGE_GRANT", "Resolved path escapes the approved local grant.");
+        }
+        return candidate;
+    }
+    async revokeGrant(grantId) {
+        const database = await this.database();
+        const grant = database.grants[grantId];
+        if (!grant)
+            return;
+        await this.deleteGrant(grant);
+        const grants = { ...database.grants };
+        delete grants[grantId];
+        const affected = [];
+        const states = {};
+        for (const [deploymentId, state] of Object.entries(database.states)) {
+            if (!Object.values(state.grantRefs).includes(grantId)) {
+                states[deploymentId] = state;
+                continue;
+            }
+            affected.push(deploymentId);
+            states[deploymentId] = {
+                ...state,
+                status: "revoked",
+                missingFields: [...new Set([...state.missingFields, grant.fieldName])],
+            };
+        }
+        await this.save({ ...database, grants, states });
+        await this.options.onGrantRevoked?.(grantId, affected);
+        for (const deploymentId of affected) {
+            const state = states[deploymentId];
+            if (state)
+                await this.emitTransition(state);
+        }
+    }
+    async createGrant(deploymentId, field, digest, value) {
+        const id = this.grantId();
+        const base = {
+            id,
+            deploymentId,
+            fieldName: field.name,
+            fieldDigest: digest,
+            createdAt: this.now(),
+        };
+        if (field.kind === "folder" || field.kind === "file") {
+            if (typeof value !== "string")
+                throw edgeError("EDGE_GRANT", `${field.kind} setup requires a local path.`);
+            const canonicalPath = await realpath(value);
+            const info = await lstat(canonicalPath);
+            if (field.kind === "folder" ? !info.isDirectory() : !info.isFile()) {
+                throw edgeError("EDGE_GRANT", `Selected path is not a ${field.kind}.`);
+            }
+            return { ...base, kind: field.kind, canonicalPath, access: field.access };
+        }
+        if (field.kind === "secret") {
+            if (typeof value !== "string" || value.length === 0)
+                throw edgeError("EDGE_GRANT", "Secret setup requires a value.");
+            await this.options.credentials.set(secretKey(id), value);
+            return { ...base, kind: "secret" };
+        }
+        const scalar = validateScalar(field, value);
+        return { ...base, kind: field.kind, value: scalar };
+    }
+    async resolveGrantValue(grant) {
+        if (grant.kind === "folder" || grant.kind === "file") {
+            return this.resolveGrantedPath(grant.id);
+        }
+        if (grant.kind === "secret") {
+            throw edgeError("EDGE_GRANT", "Secret grant requires a runtime.secret reference.");
+        }
+        if ("value" in grant)
+            return String(grant.value);
+        throw edgeError("EDGE_GRANT", "Unsupported local grant value.");
+    }
+    async deleteGrant(grant) {
+        if (grant.kind === "secret")
+            await this.options.credentials.delete(secretKey(grant.id));
+    }
+    async database() {
+        return await this.options.store.load() ?? { grants: {}, states: {}, approvedRecipeDigests: [] };
+    }
+    save(database) {
+        return this.options.store.save(database);
+    }
+    async emitTransition(state) {
+        await this.options.telemetry?.emit({
+            name: "edge.setup.transition",
+            deploymentId: state.deploymentId,
+            outcome: state.status,
+            metadata: {
+                desiredStateVersion: state.desiredStateVersion,
+                recipeDigest: state.recipeDigest,
+                setupSchemaVersion: state.setupSchemaVersion,
+                missingFields: state.missingFields,
+            },
+        }).catch(() => undefined);
+    }
+}
+function stateFor(requirement, status, grantRefs, fieldDigests, missingFields) {
+    return {
+        deploymentId: requirement.deploymentId,
+        desiredStateVersion: requirement.desiredStateVersion,
+        recipeDigest: requirement.recipe.digest,
+        setupSchemaVersion: requirement.schema.version,
+        status,
+        grantRefs,
+        fieldDigests,
+        missingFields,
+    };
+}
+function fieldDigest(field) {
+    return JSON.stringify(canonicalize(field));
+}
+function secretKey(grantId) {
+    return `setup-secret:${grantId}`;
+}
+function defaultValue(field) {
+    return "default" in field ? field.default : undefined;
+}
+function validateScalar(field, value) {
+    switch (field.kind) {
+        case "string":
+            if (typeof value !== "string")
+                break;
+            return value;
+        case "boolean":
+            if (typeof value !== "boolean")
+                break;
+            return value;
+        case "number":
+            if (typeof value !== "number" || !Number.isFinite(value))
+                break;
+            if (field.min !== undefined && value < field.min)
+                break;
+            if (field.max !== undefined && value > field.max)
+                break;
+            return value;
+        case "select":
+            if (typeof value !== "string" || !field.options.some((option) => option.value === value))
+                break;
+            return value;
+        default:
+            throw edgeError("EDGE_GRANT", `Field "${field.name}" is not scalar.`);
+    }
+    throw edgeError("EDGE_GRANT", `Invalid local value for ${field.kind} field "${field.name}".`);
+}
+function parseTerminalValue(field, raw) {
+    if (field.kind === "boolean") {
+        if (raw === "true" || raw === "yes")
+            return true;
+        if (raw === "false" || raw === "no")
+            return false;
+        return raw;
+    }
+    if (field.kind === "number")
+        return Number(raw);
+    return raw;
+}
+function assertDeclarative(value, seen = new Set()) {
+    if (typeof value === "function" || typeof value === "symbol") {
+        throw edgeError("EDGE_PROTOCOL", "Launch recipe contains executable code.");
+    }
+    if (!value || typeof value !== "object" || seen.has(value))
+        return;
+    seen.add(value);
+    for (const child of Object.values(value))
+        assertDeclarative(child, seen);
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, child]) => [key, canonicalize(child)]));
+}
+function hiddenInput(message) {
+    process.stdout.write(`${message} `);
+    emitKeypressEvents(process.stdin);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const onKeypress = (character, key) => {
+            if (key.ctrl && key.name === "c") {
+                finish();
+                reject(new Error("Terminal input cancelled"));
+                return;
+            }
+            if (key.name === "return" || key.name === "enter") {
+                finish();
+                resolve(value);
+                return;
+            }
+            if (key.name === "backspace") {
+                value = value.slice(0, -1);
+                return;
+            }
+            if (character && !key.ctrl)
+                value += character;
+        };
+        const finish = () => {
+            process.stdin.off("keypress", onKeypress);
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdout.write("\n");
+        };
+        process.stdin.on("keypress", onKeypress);
+    });
+}
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,mBAAmB,GAMpB,MAAM,gBAAgB,CAAC;AAsCxB,gFAAgF;AAChF,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAA8B;QACzD,IAAI,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAE9D,eAAe,CAAC,WAAoC;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,qBAAqB,WAAW,CAAC,YAAY,mBAAmB,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAiB;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACxC,SAAS,KAAK,CAAC,MAAM,eAAe,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAC7D,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IACnE,CAAC;CACF;AAuDD,oEAAoE;AACpE,MAAM,OAAO,iBAAiB;IAIC;IAHZ,GAAG,CAAe;IAClB,OAAO,CAAe;IAEvC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAoC;QAC/C,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YACzD,MAAM,SAAS,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAuB,EAAE,CAAC;QAEvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/F,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7G,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBAClC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;gBAC5B,MAAM,UAAU,GAAG,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;oBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACvB,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC7B,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC9E,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACvB,IAAI,KAAK,CAAC,QAAQ;wBAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7C,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ;oBAAE,SAAS;gBACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACzB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;gBACzB,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3E,IAAI,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM;oBAAE,SAAS;gBAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;gBACpC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACvB,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAqB,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,IAAI,CAAC;gBACd,MAAM;gBACN,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE;gBACjE,qBAAqB,EAAE,CAAC,GAAG,QAAQ,CAAC;aACrC,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAoC;QAC1D,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACxD,IACE,CAAC,KAAK;eACH,KAAK,CAAC,MAAM,KAAK,OAAO;eACxB,KAAK,CAAC,mBAAmB,KAAK,WAAW,CAAC,mBAAmB;eAC7D,KAAK,CAAC,YAAY,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM;eAChD,KAAK,CAAC,kBAAkB,KAAK,WAAW,CAAC,MAAM,CAAC,OAAO,EAC1D,CAAC;YACD,MAAM,SAAS,CAAC,qBAAqB,EAAE,kDAAkD,EAAE;gBACzF,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,SAAS,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAsB,EAAmB,EAAE;YAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,SAAS,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CAAC,qBAAqB,EAAE,0CAA0C,EAAE;oBACjF,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;gBAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvE,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,SAAS,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;gBAC3F,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACrG,OAAO;YACL,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;YACvC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;YACnC,IAAI;YACJ,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,kBAAkB,CACtB,OAAe,EACf,SAAS,GAAG,GAAG,EACf,kBAAoC,MAAM;QAE1C,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,SAAS,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,eAAe,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACtE,MAAM,SAAS,CAAC,YAAY,EAAE,gDAAgD,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,SAAS,CAAC,YAAY,EAAE,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;gBAAE,MAAM,SAAS,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;YAClH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,SAAS,CAAC,YAAY,EAAE,iDAAiD,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAoC,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG;gBACrB,GAAG,KAAK;gBACR,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;aACvE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,KAAK,MAAM,YAAY,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,YAAoB,EACpB,KAAiB,EACjB,MAAc,EACd,KAAc;QAEd,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,EAAE;YACF,YAAY;YACZ,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,IAAI,+BAA+B,CAAC,CAAC;YAC3G,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnE,MAAM,SAAS,CAAC,YAAY,EAAE,0BAA0B,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAuB;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,YAAY,EAAE,mDAAmD,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,IAAI,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAuB;QAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IAEO,IAAI,CAAC,QAA4B;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAsB;QACjD,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;YACjC,IAAI,EAAE,uBAAuB;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,QAAQ,EAAE;gBACR,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,SAAS,QAAQ,CACf,WAAoC,EACpC,MAAwB,EACxB,SAA2C,EAC3C,YAA8C,EAC9C,aAAgC;IAEhC,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;QACvC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;QAC9C,MAAM;QACN,SAAS;QACT,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,gBAAgB,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,KAAc;IACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM;YACrC,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,MAAM;YACtC,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM;YAChE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG;gBAAE,MAAM;YACxD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG;gBAAE,MAAM;YACxD,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;gBAAE,MAAM;YAChG,OAAO,KAAK,CAAC;QACf;YACE,MAAM,SAAS,CAAC,YAAY,EAAE,UAAU,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,CAAC,YAAY,EAAE,2BAA2B,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,GAAW;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,OAAO,IAAI,GAAG,EAAU;IACjE,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACnE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IACpC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,GAAsC,EAAE,EAAE;YAC/E,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,KAAK,IAAI,SAAS,CAAC;QACjD,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/stdioWorkload.d.ts

@@ -0,0 +1,7 @@
+import type { CompiledLocalLaunchPlan } from "./setup.js";
+import type { EdgeWorkload, EdgeWorkloadFactory } from "./supervisor.js";
+/** Production workload factory backed by one stdio MCP client per workload. */
+export declare class StdioEdgeWorkloadFactory implements EdgeWorkloadFactory {
+    start(plan: CompiledLocalLaunchPlan, signal: AbortSignal): Promise<EdgeWorkload>;
+}
+//# sourceMappingURL=stdioWorkload.d.ts.map

package/dist/stdioWorkload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdioWorkload.d.ts","sourceRoot":"","sources":["../src/stdioWorkload.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EAGpB,MAAM,iBAAiB,CAAC;AAqDzB,+EAA+E;AAC/E,qBAAa,wBAAyB,YAAW,mBAAmB;IAC5D,KAAK,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAmBvF"}

package/dist/stdioWorkload.js

@@ -0,0 +1,94 @@
+import { StdioTransport, edgeError, } from "@fentaris/core";
+class StdioLocalMcpClient {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    async request(operation, params, signal) {
+        const pending = this.dispatch(operation, params);
+        return abortable(pending, signal, () => this.transport.close());
+    }
+    async capabilityManifest() {
+        const capabilities = await this.transport.serverCapabilities();
+        const [tools, resources, resourceTemplates, prompts] = await Promise.all([
+            this.transport.listTools().then((result) => result.tools),
+            this.transport.listResources().then((result) => result.resources),
+            this.transport.listResourceTemplates().then((result) => result.resourceTemplates),
+            this.transport.listPrompts().then((result) => result.prompts),
+        ]);
+        return {
+            tools,
+            resources,
+            resourceTemplates,
+            prompts,
+            supportsCompletion: Boolean(capabilities?.completions),
+        };
+    }
+    dispatch(operation, params) {
+        switch (operation) {
+            case "tools/list":
+                return this.transport.listTools(params);
+            case "tools/call":
+                return this.transport.callTool(params);
+            case "resources/list":
+                return this.transport.listResources(params);
+            case "resources/read":
+                return this.transport.readResource(params);
+            case "resources/templates/list":
+                return this.transport.listResourceTemplates(params);
+            case "prompts/list":
+                return this.transport.listPrompts(params);
+            case "prompts/get":
+                return this.transport.getPrompt(params);
+            case "completion/complete":
+                return this.transport.complete(params);
+            case "ping":
+                return Promise.resolve({});
+        }
+    }
+}
+/** Production workload factory backed by one stdio MCP client per workload. */
+export class StdioEdgeWorkloadFactory {
+    async start(plan, signal) {
+        const transport = new StdioTransport({
+            command: plan.command,
+            args: [...plan.args],
+            env: { ...plan.env },
+            clientName: "fentaris-edge",
+        });
+        try {
+            await abortable(transport.serverCapabilities(), signal, () => transport.close());
+        }
+        catch (error) {
+            await transport.close().catch(() => undefined);
+            throw error;
+        }
+        return {
+            client: new StdioLocalMcpClient(transport),
+            stopGracefully: () => transport.close(),
+            forceKill: () => transport.close(),
+        };
+    }
+}
+function abortable(pending, signal, onAbort) {
+    if (signal.aborted) {
+        void onAbort();
+        return Promise.reject(edgeError("EDGE_WORKLOAD", "Edge MCP operation was cancelled."));
+    }
+    return new Promise((resolve, reject) => {
+        const aborted = () => {
+            signal.removeEventListener("abort", aborted);
+            reject(edgeError("EDGE_WORKLOAD", "Edge MCP operation was cancelled."));
+            void onAbort();
+        };
+        signal.addEventListener("abort", aborted, { once: true });
+        pending.then((value) => {
+            signal.removeEventListener("abort", aborted);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", aborted);
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=stdioWorkload.js.map

package/dist/stdioWorkload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdioWorkload.js","sourceRoot":"","sources":["../src/stdioWorkload.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,GAEV,MAAM,gBAAgB,CAAC;AASxB,MAAM,mBAAmB;IACM;IAA7B,YAA6B,SAAyB;QAAzB,cAAS,GAAT,SAAS,CAAgB;IAAG,CAAC;IAE1D,KAAK,CAAC,OAAO,CAAC,SAA2B,EAAE,MAAe,EAAE,MAAmB;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACzD,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;YACjE,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACjF,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO;YACL,KAAK;YACL,SAAS;YACT,iBAAiB;YACjB,OAAO;YACP,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC;SACvD,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,SAA2B,EAAE,MAAe;QAC3D,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAoD,CAAC,CAAC;YACxF,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAmD,CAAC,CAAC;YACtF,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAqE,CAAC,CAAC;YAC7G,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAoE,CAAC,CAAC;YAC3G,KAAK,0BAA0B;gBAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAqB,CACzC,MAA6E,CAC9E,CAAC;YACJ,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAmE,CAAC,CAAC;YACzG,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAiE,CAAC,CAAC;YACrG,KAAK,qBAAqB;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAgE,CAAC,CAAC;YACnG,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,wBAAwB;IACnC,KAAK,CAAC,KAAK,CAAC,IAA6B,EAAE,MAAmB;QAC5D,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YACpB,UAAU,EAAE,eAAe;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC;YAC1C,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE;YACvC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE;SACnC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAChB,OAAmB,EACnB,MAAmB,EACnB,OAAmC;IAEnC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,OAAO,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,SAAS,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC,CAAC;YACxE,KAAK,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/supervisor.d.ts

@@ -0,0 +1,92 @@
+import { type EdgeMcpCancelEnvelope, type EdgeMcpErrorEnvelope, type EdgeMcpOperation, type EdgeMcpRequestEnvelope, type EdgeMcpResultEnvelope, type EdgeTelemetry } from "@fentaris/core";
+import { type CompiledLocalLaunchPlan, type DesiredSetupRequirement, type LocalSetupManager } from "./setup.js";
+export interface LocalMcpClient {
+    request(operation: EdgeMcpOperation, params: unknown, signal: AbortSignal): Promise<unknown>;
+    capabilityManifest?(): Promise<LocalMcpCapabilityManifest>;
+}
+export interface LocalMcpCapabilityManifest {
+    readonly tools: readonly unknown[];
+    readonly resources: readonly unknown[];
+    readonly resourceTemplates: readonly unknown[];
+    readonly prompts: readonly unknown[];
+    readonly supportsCompletion: boolean;
+}
+export interface EdgeWorkload {
+    readonly client: LocalMcpClient;
+    stopGracefully(): Promise<void>;
+    forceKill(): Promise<void>;
+}
+export interface EdgeWorkloadFactory {
+    start(plan: CompiledLocalLaunchPlan, signal: AbortSignal): Promise<EdgeWorkload>;
+}
+export interface SupervisedDesiredDeployment {
+    readonly requirement: DesiredSetupRequirement;
+}
+export interface EdgeWorkloadPolicy {
+    allow(plan: CompiledLocalLaunchPlan): boolean | Promise<boolean>;
+}
+export interface EdgeWorkloadSupervisorOptions {
+    readonly setup: LocalSetupManager;
+    readonly factory: EdgeWorkloadFactory;
+    readonly executablePolicy?: EdgeWorkloadPolicy;
+    readonly maxConcurrentWorkloads?: number;
+    readonly startupTimeoutMs?: number;
+    readonly operationTimeoutMs?: number;
+    readonly shutdownTimeoutMs?: number;
+    readonly idleLeaseMs?: number;
+    readonly maxOutputBytes?: number;
+    readonly reportCapabilityManifest?: (deploymentId: string, recipeDigest: string, manifest: LocalMcpCapabilityManifest) => void | Promise<void>;
+    readonly telemetry?: EdgeTelemetry;
+    readonly now?: () => number;
+}
+export interface DeploymentReconcileResult {
+    readonly deploymentId: string;
+    readonly status: "ready" | "blocked" | "removed";
+    readonly reason?: string;
+}
+/** Governed per-session MCP workload supervisor for cloud-defined deployments. */
+export declare class EdgeWorkloadSupervisor {
+    private readonly options;
+    private readonly desired;
+    private readonly workloads;
+    private readonly starting;
+    private readonly requests;
+    private readonly locallyDenied;
+    private readonly blocked;
+    private readonly now;
+    private readonly limits;
+    constructor(options: EdgeWorkloadSupervisorOptions);
+    /** Reconcile only the cloud-defined desired deployment set. */
+    reconcile(deployments: readonly SupervisedDesiredDeployment[]): Promise<DeploymentReconcileResult[]>;
+    /** Handle one correlated edge protocol MCP request. */
+    handleRequest(request: EdgeMcpRequestEnvelope): Promise<EdgeMcpResultEnvelope | EdgeMcpErrorEnvelope>;
+    /** Propagate a correlated cancellation to the local MCP client signal. */
+    handleCancel(cancel: EdgeMcpCancelEnvelope): boolean;
+    /** Sticky local denial overrides all replayed desired state. */
+    denyDeployment(deploymentId: string): Promise<void>;
+    /** Explicit local action required before a denied deployment may run again. */
+    renewConsent(deploymentId: string): void;
+    /** Mark a deployment blocked after grant/workload revocation. */
+    blockDeployment(deploymentId: string): Promise<void>;
+    endSession(sessionId: string): Promise<void>;
+    sweepIdle(): Promise<readonly string[]>;
+    shutdown(): Promise<void>;
+    activeWorkloadCount(): number;
+    private workloadFor;
+    private startWorkload;
+    private stopDeployment;
+    private stopRecord;
+    private emitLifecycle;
+}
+export interface ExecutableAllowlistPolicyOptions {
+    readonly executables?: readonly string[];
+    readonly packages?: readonly string[];
+}
+/** Exact executable/package allowlist suitable for local edge launch policy. */
+export declare class ExecutableAllowlistPolicy implements EdgeWorkloadPolicy {
+    private readonly executables;
+    private readonly packages;
+    constructor(options: ExecutableAllowlistPolicyOptions);
+    allow(plan: CompiledLocalLaunchPlan): boolean;
+}
+//# sourceMappingURL=supervisor.d.ts.map