@galaxy-stack/ai-coder-core 0.3.0-alpha.1 → 0.3.0-alpha.10

package/dist/adapters/node/host/command-containment.js

@@ -0,0 +1,580 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { constants, existsSync } from "node:fs";
+import { access, link, lstat, mkdtemp, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { delimiter, join, relative, sep } from "node:path";
+const MACOS_SANDBOX_EXECUTABLE = "/usr/bin/sandbox-exec";
+/*
+ * Prototype profile used only by the conformance probe. It is intentionally
+ * not selected for real NodeCommandPort runs: the probe currently demonstrates
+ * that pathname-based Seatbelt write rules do not protect outside inodes
+ * reachable through workspace hard links, and do not supervise descendants
+ * that create a new process group.
+ *
+ * The profile is a write/network experiment, not a confidentiality boundary.
+ * Broad reads keep the installed Node/toolchain visible. There are no TTY,
+ * pseudo-terminal, or network allowances.
+ */
+const MACOS_CONFORMANCE_PROFILE = `(version 1)
+(deny default)
+(allow file-read*)
+(allow process-exec)
+(allow process-fork)
+(allow signal (target self))
+(allow sysctl-read)
+(allow file-write*
+  (subpath (param "WORKSPACE"))
+  (subpath (param "PRIVATE_TMP"))
+  (literal "/dev/stdout")
+  (literal "/dev/stderr")
+  (literal "/dev/null"))
+(allow mach-lookup
+  (global-name "com.apple.system.opendirectoryd.libinfo")
+  (global-name "com.apple.system.opendirectoryd.membership")
+  (global-name "com.apple.bsd.dirhelper")
+  (global-name "com.apple.SecurityServer")
+  (global-name "com.apple.trustd")
+  (global-name "com.apple.trustd.agent"))`;
+const PROBE_TIMEOUT_MS = 5_000;
+const DESCENDANT_OBSERVATION_MS = 700;
+const MACOS_PROBE_SCRIPT = String.raw `
+const fs = require("node:fs");
+const net = require("node:net");
+const { spawn } = require("node:child_process");
+const result = {
+  descendantChildSpawned: false,
+  hardLinkWriteDenied: false,
+  networkDenied: false,
+  outsideWriteDenied: false,
+  privateTempWrite: false,
+  systemRead: false,
+  workspaceWrite: false,
+};
+try {
+  fs.readFileSync("/etc/hosts");
+  result.systemRead = true;
+  fs.writeFileSync(process.env.GALAXY_PROBE_WORKSPACE_FILE, "workspace-ok", "utf8");
+  result.workspaceWrite = true;
+  fs.writeFileSync(process.env.GALAXY_PROBE_TEMP_FILE, "temp-ok", "utf8");
+  result.privateTempWrite = true;
+  try {
+    fs.writeFileSync(process.env.GALAXY_PROBE_OUTSIDE_FILE, "changed", "utf8");
+  } catch (error) {
+    result.outsideWriteDenied = Boolean(error);
+  }
+  try {
+    fs.writeFileSync(process.env.GALAXY_PROBE_HARD_LINK_FILE, "changed-through-link", "utf8");
+  } catch (error) {
+    result.hardLinkWriteDenied = error && (error.code === "EACCES" || error.code === "EPERM");
+  }
+  const lateScript = 'setTimeout(() => require("node:fs").writeFileSync(process.env.GALAXY_PROBE_LATE_FILE, "late", "utf8"), 250)';
+  const child = spawn(process.execPath, ["-e", lateScript], {
+    detached: true,
+    env: process.env,
+    stdio: "ignore",
+  });
+  result.descendantChildSpawned = child.pid !== undefined;
+  child.unref();
+} catch {}
+let finished = false;
+const finish = () => {
+  if (finished) return;
+  finished = true;
+  process.stdout.write(JSON.stringify(result));
+};
+const socket = net.createConnection({
+  host: "127.0.0.1",
+  port: Number(process.env.GALAXY_PROBE_PORT),
+});
+socket.once("connect", () => {
+  socket.destroy();
+  finish();
+});
+socket.once("error", (error) => {
+  result.networkDenied = Boolean(error);
+  finish();
+});
+socket.setTimeout(2_000, () => {
+  result.networkDenied = true;
+  socket.destroy();
+  finish();
+});
+`;
+let cachedProbe;
+function freezeProbe(result) {
+    return Object.freeze({ ...result });
+}
+function unavailableProbe(backend, executable, available, reason) {
+    return freezeProbe({
+        available,
+        backend,
+        descendantChildSpawned: false,
+        descendantQuiescent: false,
+        executable,
+        hardLinkWriteDenied: false,
+        networkDenied: false,
+        outsideWriteDenied: false,
+        privateTempWrite: false,
+        reason,
+        systemRead: false,
+        toolchainExecution: false,
+        verified: false,
+        workspaceWrite: false,
+    });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function delay(milliseconds) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
+}
+async function isExecutable(path) {
+    try {
+        await access(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function executableOnPath(name) {
+    for (const entry of (process.env.PATH ?? "").split(delimiter)) {
+        if (entry.length === 0)
+            continue;
+        const candidate = join(entry, name);
+        if (await isExecutable(candidate))
+            return candidate;
+    }
+    return null;
+}
+function killProbeProcessGroup(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        process.kill(-pid, "SIGKILL");
+    }
+    catch {
+        try {
+            process.kill(pid, "SIGKILL");
+        }
+        catch {
+            // Nothing remains to terminate.
+        }
+    }
+}
+async function runProbeProcess(executable, args, env) {
+    return await new Promise((resolveResult) => {
+        const child = spawn(executable, args, {
+            detached: true,
+            env,
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let didTimeOut = false;
+        let forceFinish;
+        let settled = false;
+        let stderr = "";
+        let stdout = "";
+        const finish = (exitCode) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            if (forceFinish !== undefined)
+                clearTimeout(forceFinish);
+            resolveResult(Object.freeze({ exitCode, stderr, stdout, timedOut: didTimeOut }));
+        };
+        const timeout = setTimeout(() => {
+            didTimeOut = true;
+            killProbeProcessGroup(child.pid);
+            forceFinish = setTimeout(() => finish(null), 1_000);
+            forceFinish.unref();
+        }, PROBE_TIMEOUT_MS);
+        timeout.unref();
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            if (stdout.length < 64_000)
+                stdout += chunk;
+        });
+        child.stderr?.on("data", (chunk) => {
+            if (stderr.length < 64_000)
+                stderr += chunk;
+        });
+        child.once("error", (error) => {
+            stderr += errorMessage(error);
+            finish(null);
+        });
+        child.once("close", (exitCode) => finish(exitCode));
+    });
+}
+async function listenOnLoopback(server) {
+    return await new Promise((resolvePort, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", onError);
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                reject(new Error("The containment probe did not receive a TCP port."));
+                return;
+            }
+            resolvePort(address.port);
+        });
+    });
+}
+async function closeServer(server) {
+    if (!server.listening)
+        return;
+    await new Promise((resolveClose) => server.close(() => resolveClose()));
+}
+async function probeMacOsSeatbelt() {
+    if (!(await isExecutable(MACOS_SANDBOX_EXECUTABLE))) {
+        return unavailableProbe("macos_sandbox_exec", MACOS_SANDBOX_EXECUTABLE, false, `${MACOS_SANDBOX_EXECUTABLE} is not executable.`);
+    }
+    const temporaryRoots = [];
+    const server = createServer((socket) => socket.destroy());
+    let networkConnections = 0;
+    server.on("connection", () => {
+        networkConnections += 1;
+    });
+    try {
+        const makeTemporaryRoot = async (prefix) => {
+            const root = await mkdtemp(join(tmpdir(), prefix));
+            temporaryRoots.push(root);
+            return await realpath(root);
+        };
+        // Allocate sequentially so a rejection cannot race successful siblings
+        // that have not yet registered themselves for the finally cleanup.
+        const workspace = await makeTemporaryRoot("galaxy-containment-workspace-");
+        const privateTemp = await makeTemporaryRoot("galaxy-containment-temp-");
+        const outside = await makeTemporaryRoot("galaxy-containment-outside-");
+        const workspaceFile = join(workspace, `workspace-${randomUUID()}`);
+        const privateTempFile = join(privateTemp, `temp-${randomUUID()}`);
+        const outsideFile = join(outside, `sentinel-${randomUUID()}`);
+        const outsideHardLinkTarget = join(outside, `hard-link-target-${randomUUID()}`);
+        const workspaceHardLink = join(workspace, `hard-link-${randomUUID()}`);
+        const lateFile = join(workspace, `late-${randomUUID()}`);
+        const sentinel = `outside-${randomUUID()}`;
+        const hardLinkSentinel = `hard-link-outside-${randomUUID()}`;
+        await Promise.all([
+            writeFile(outsideFile, sentinel, "utf8"),
+            writeFile(outsideHardLinkTarget, hardLinkSentinel, "utf8"),
+        ]);
+        await link(outsideHardLinkTarget, workspaceHardLink);
+        const port = await listenOnLoopback(server);
+        const environment = {
+            CI: "1",
+            FORCE_COLOR: "0",
+            GALAXY_PROBE_HARD_LINK_FILE: workspaceHardLink,
+            GALAXY_PROBE_LATE_FILE: lateFile,
+            GALAXY_PROBE_OUTSIDE_FILE: outsideFile,
+            GALAXY_PROBE_PORT: String(port),
+            GALAXY_PROBE_TEMP_FILE: privateTempFile,
+            GALAXY_PROBE_WORKSPACE_FILE: workspaceFile,
+            PATH: process.env.PATH,
+            TEMP: privateTemp,
+            TMP: privateTemp,
+            TMPDIR: privateTemp,
+        };
+        const processResult = await runProbeProcess(MACOS_SANDBOX_EXECUTABLE, [
+            "-D",
+            `WORKSPACE=${workspace}`,
+            "-D",
+            `PRIVATE_TMP=${privateTemp}`,
+            "-p",
+            MACOS_CONFORMANCE_PROFILE,
+            process.execPath,
+            "-e",
+            MACOS_PROBE_SCRIPT,
+        ], environment);
+        await delay(DESCENDANT_OBSERVATION_MS);
+        let payload;
+        try {
+            payload = JSON.parse(processResult.stdout);
+        }
+        catch {
+            payload = undefined;
+        }
+        const [workspaceContent, privateTempContent, outsideContent, hardLinkContent, lateContent] = await Promise.all([
+            readFile(workspaceFile, "utf8").catch(() => ""),
+            readFile(privateTempFile, "utf8").catch(() => ""),
+            readFile(outsideFile, "utf8").catch(() => ""),
+            readFile(outsideHardLinkTarget, "utf8").catch(() => ""),
+            readFile(lateFile, "utf8").catch(() => ""),
+        ]);
+        const systemRead = payload?.systemRead === true;
+        const workspaceWrite = payload?.workspaceWrite === true && workspaceContent === "workspace-ok";
+        const privateTempWrite = payload?.privateTempWrite === true && privateTempContent === "temp-ok";
+        const outsideWriteDenied = payload?.outsideWriteDenied === true && outsideContent === sentinel;
+        const hardLinkWriteDenied = payload?.hardLinkWriteDenied === true && hardLinkContent === hardLinkSentinel;
+        const networkDenied = payload?.networkDenied === true && networkConnections === 0;
+        const descendantChildSpawned = payload?.descendantChildSpawned === true;
+        const descendantQuiescent = descendantChildSpawned && lateContent.length === 0;
+        const toolchainExecution = processResult.exitCode === 0 && !processResult.timedOut;
+        const assertions = {
+            descendantChildSpawned,
+            descendantQuiescent,
+            hardLinkWriteDenied,
+            networkDenied,
+            outsideWriteDenied,
+            privateTempWrite,
+            systemRead,
+            toolchainExecution,
+            workspaceWrite,
+        };
+        const failedAssertions = Object.entries(assertions)
+            .filter(([, passed]) => !passed)
+            .map(([name]) => name);
+        const verified = failedAssertions.length === 0;
+        const detail = processResult.timedOut
+            ? "The Seatbelt conformance probe timed out."
+            : processResult.exitCode !== 0
+                ? `The Seatbelt conformance probe exited with ${String(processResult.exitCode)}: ${processResult.stderr.trim()}`
+                : !verified
+                    ? `The Seatbelt conformance probe failed: ${failedAssertions.join(", ")}.`
+                    : null;
+        return freezeProbe({
+            available: true,
+            backend: "macos_sandbox_exec",
+            descendantChildSpawned,
+            descendantQuiescent,
+            executable: MACOS_SANDBOX_EXECUTABLE,
+            hardLinkWriteDenied,
+            networkDenied,
+            outsideWriteDenied,
+            privateTempWrite,
+            reason: detail,
+            systemRead,
+            toolchainExecution,
+            verified,
+            workspaceWrite,
+        });
+    }
+    catch (error) {
+        return unavailableProbe("macos_sandbox_exec", MACOS_SANDBOX_EXECUTABLE, true, `The Seatbelt conformance probe failed: ${errorMessage(error)}`);
+    }
+    finally {
+        await closeServer(server).catch(() => undefined);
+        await Promise.all(temporaryRoots.map(async (root) => {
+            await rm(root, { force: true, recursive: true });
+        })).catch(() => undefined);
+    }
+}
+async function probeLinuxBubblewrap() {
+    const executable = await executableOnPath("bwrap");
+    if (executable === null) {
+        return unavailableProbe("linux_bubblewrap", null, false, "bubblewrap (bwrap) is not available on PATH.");
+    }
+    const temporaryRoots = [];
+    const server = createServer((socket) => socket.destroy());
+    let networkConnections = 0;
+    server.on("connection", () => {
+        networkConnections += 1;
+    });
+    try {
+        const makeTemporaryRoot = async (prefix) => {
+            const root = await mkdtemp(join(tmpdir(), prefix));
+            temporaryRoots.push(root);
+            return await realpath(root);
+        };
+        const workspace = await makeTemporaryRoot("galaxy-bwrap-workspace-");
+        const outside = await makeTemporaryRoot("galaxy-bwrap-outside-");
+        const workspaceFile = join(workspace, `workspace-${randomUUID()}`);
+        const outsideFile = join(outside, `sentinel-${randomUUID()}`);
+        const lateFile = join(workspace, `late-${randomUUID()}`);
+        const hardLinkTarget = join(outside, `hard-link-target-${randomUUID()}`);
+        const hardLinkPath = join(workspace, `hard-link-${randomUUID()}`);
+        const sentinel = `outside-${randomUUID()}`;
+        await Promise.all([
+            writeFile(outsideFile, sentinel, "utf8"),
+            writeFile(hardLinkTarget, sentinel, "utf8"),
+        ]);
+        await link(hardLinkTarget, hardLinkPath);
+        let hardLinkWriteDenied = false;
+        try {
+            await assertWorkspaceHasNoHardLinks(workspace);
+        }
+        catch {
+            hardLinkWriteDenied = true;
+        }
+        await rm(hardLinkPath);
+        const port = await listenOnLoopback(server);
+        const environment = {
+            CI: "1",
+            FORCE_COLOR: "0",
+            GALAXY_PROBE_HARD_LINK_FILE: "/workspace/nonexistent-hard-link",
+            GALAXY_PROBE_LATE_FILE: `/workspace/${lateFile.split(sep).at(-1) ?? "late"}`,
+            GALAXY_PROBE_OUTSIDE_FILE: outsideFile,
+            GALAXY_PROBE_PORT: String(port),
+            GALAXY_PROBE_TEMP_FILE: "/tmp/probe-temp",
+            GALAXY_PROBE_WORKSPACE_FILE: `/workspace/${workspaceFile.split(sep).at(-1) ?? "workspace"}`,
+            PATH: "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+            TEMP: "/tmp",
+            TMP: "/tmp",
+            TMPDIR: "/tmp",
+        };
+        const processResult = await runProbeProcess(executable, buildBubblewrapArguments({
+            command: process.execPath,
+            commandArguments: Object.freeze(["-e", MACOS_PROBE_SCRIPT]),
+            cwd: workspace,
+            environment,
+            workspace,
+        }), environment);
+        await delay(DESCENDANT_OBSERVATION_MS);
+        let payload;
+        try {
+            payload = JSON.parse(processResult.stdout);
+        }
+        catch {
+            payload = undefined;
+        }
+        const [workspaceContent, outsideContent, lateContent] = await Promise.all([
+            readFile(workspaceFile, "utf8").catch(() => ""),
+            readFile(outsideFile, "utf8").catch(() => ""),
+            readFile(lateFile, "utf8").catch(() => ""),
+        ]);
+        const assertions = {
+            descendantChildSpawned: payload?.descendantChildSpawned === true,
+            descendantQuiescent: payload?.descendantChildSpawned === true && lateContent.length === 0,
+            hardLinkWriteDenied,
+            networkDenied: payload?.networkDenied === true && networkConnections === 0,
+            outsideWriteDenied: payload?.outsideWriteDenied === true && outsideContent === sentinel,
+            privateTempWrite: payload?.privateTempWrite === true,
+            systemRead: payload?.systemRead === true,
+            toolchainExecution: processResult.exitCode === 0 && !processResult.timedOut,
+            workspaceWrite: payload?.workspaceWrite === true && workspaceContent === "workspace-ok",
+        };
+        const failed = Object.entries(assertions).filter(([, passed]) => !passed).map(([name]) => name);
+        return freezeProbe({
+            available: true,
+            backend: "linux_bubblewrap",
+            ...assertions,
+            executable,
+            reason: failed.length === 0 ? null : `The bubblewrap conformance probe failed: ${failed.join(", ")}.`,
+            verified: failed.length === 0,
+        });
+    }
+    catch (error) {
+        return unavailableProbe("linux_bubblewrap", executable, true, `The bubblewrap conformance probe failed: ${errorMessage(error)}`);
+    }
+    finally {
+        await closeServer(server).catch(() => undefined);
+        await Promise.all(temporaryRoots.map(async (root) => rm(root, { force: true, recursive: true }))).catch(() => undefined);
+    }
+}
+async function detectCommandContainment() {
+    try {
+        return process.platform === "darwin"
+            ? await probeMacOsSeatbelt()
+            : process.platform === "linux"
+                ? await probeLinuxBubblewrap()
+                : unavailableProbe("none", null, false, `No command-containment backend is implemented for '${process.platform}'.`);
+    }
+    catch (error) {
+        return unavailableProbe("none", null, false, `Command-containment detection failed closed: ${errorMessage(error)}`);
+    }
+}
+/**
+ * Run the host conformance check once per process. A binary merely existing is
+ * not enough. Only a backend that passes every probe assertion can activate.
+ */
+export async function probeCommandContainment() {
+    cachedProbe ??= detectCommandContainment();
+    return await cachedProbe;
+}
+export function containmentStatus(mode, probe) {
+    const assertionsVerified = probe.descendantChildSpawned
+        && probe.descendantQuiescent
+        && probe.hardLinkWriteDenied
+        && probe.networkDenied
+        && probe.outsideWriteDenied
+        && probe.privateTempWrite
+        && probe.systemRead
+        && probe.toolchainExecution
+        && probe.workspaceWrite;
+    const active = probe.backend === "linux_bubblewrap" && probe.verified && assertionsVerified;
+    const state = !probe.available
+        ? "unavailable"
+        : active
+            ? "active"
+            : probe.verified
+                ? "unverified"
+                : "probe_failed";
+    const reason = active ? null : probe.verified && !assertionsVerified
+        ? "The backend claimed verification without passing every containment assertion."
+        : probe.verified
+            ? "The backend passed its probe but this platform implementation is not activated."
+            : probe.reason;
+    return Object.freeze({
+        active,
+        backend: probe.backend,
+        executable: probe.executable,
+        filesystemReads: active ? "system_and_workspace" : "host_visible",
+        filesystemWrites: active ? "workspace_and_private_temp" : "uncontained",
+        mode,
+        network: active ? "denied" : "uncontained",
+        reason,
+        state,
+        verified: active,
+    });
+}
+const BUBBLEWRAP_READ_ONLY_ROOTS = Object.freeze([
+    "/bin", "/etc", "/lib", "/lib64", "/nix/store", "/opt", "/sbin", "/usr",
+]);
+export function buildBubblewrapArguments(input) {
+    const relativeCwd = relative(input.workspace, input.cwd);
+    if (relativeCwd === ".." || relativeCwd.startsWith(`..${sep}`)) {
+        throw new Error("Contained command cwd must remain inside the workspace.");
+    }
+    const args = [
+        "--die-with-parent", "--new-session", "--unshare-all", "--disable-userns", "--cap-drop", "ALL",
+        "--clearenv", "--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp",
+    ];
+    for (const root of BUBBLEWRAP_READ_ONLY_ROOTS) {
+        try {
+            if (existsSync(root))
+                args.push("--ro-bind", root, root);
+        }
+        catch {
+            // Missing optional system roots are intentionally invisible.
+        }
+    }
+    args.push("--bind", input.workspace, "/workspace");
+    for (const [name, value] of Object.entries(input.environment).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
+        if (value !== undefined)
+            args.push("--setenv", name, value);
+    }
+    const sandboxCwd = relativeCwd.length === 0 ? "/workspace" : `/workspace/${relativeCwd.split(sep).join("/")}`;
+    args.push("--chdir", sandboxCwd, "--", input.command, ...input.commandArguments);
+    return Object.freeze(args);
+}
+export async function assertWorkspaceHasNoHardLinks(workspace) {
+    let entries = 0;
+    const visit = async (directory) => {
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            entries += 1;
+            if (entries > 100_000) {
+                throw Object.assign(new Error("Contained command hard-link scan exceeded 100000 workspace entries."), {
+                    code: "LIMIT_EXCEEDED",
+                });
+            }
+            const path = join(directory, entry.name);
+            const info = await lstat(path);
+            if (info.isSymbolicLink())
+                continue;
+            if (info.isDirectory()) {
+                await visit(path);
+            }
+            else if (info.isFile() && info.nlink > 1) {
+                throw Object.assign(new Error(`Contained command refused hard-linked workspace file '${relative(workspace, path)}'.`), {
+                    code: "PERMISSION_DENIED",
+                });
+            }
+        }
+    };
+    await visit(workspace);
+}
+//# sourceMappingURL=command-containment.js.map

package/dist/adapters/node/host/command-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-containment.js","sourceRoot":"","sources":["../../../../src/adapters/node/host/command-containment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAuC3D,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;0CAmBQ,CAAC;AAE3C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DpC,CAAC;AAmBF,IAAI,WAA+D,CAAC;AAEpE,SAAS,WAAW,CAAC,MAAqC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAkC,EAClC,UAAyB,EACzB,SAAkB,EAClB,MAAc;IAEd,OAAO,WAAW,CAAC;QACjB,SAAS;QACT,OAAO;QACP,sBAAsB,EAAE,KAAK;QAC7B,mBAAmB,EAAE,KAAK;QAC1B,UAAU;QACV,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,KAAK;QACzB,gBAAgB,EAAE,KAAK;QACvB,MAAM;QACN,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,KAAK;QACzB,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,KAAK;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,IAAuB,EACvB,GAAsB;IAEtB,OAAO,MAAM,IAAI,OAAO,CAAqB,CAAC,aAAa,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,GAAG;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,WAAuC,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAQ,EAAE;YAC/C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,WAAW,KAAK,SAAS;gBAAE,YAAY,CAAC,WAAW,CAAC,CAAC;YACzD,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,UAAU,GAAG,IAAI,CAAC;YAClB,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YACpD,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,gBAAgB,CACrB,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,EACL,GAAG,wBAAwB,qBAAqB,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;YAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,qBAAqB,UAAU,EAAE,EAAE,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,SAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC;YACxC,SAAS,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAsB;YACrC,EAAE,EAAE,GAAG;YACP,WAAW,EAAE,GAAG;YAChB,2BAA2B,EAAE,iBAAiB;YAC9C,sBAAsB,EAAE,QAAQ;YAChC,yBAAyB,EAAE,WAAW;YACtC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC;YAC/B,sBAAsB,EAAE,eAAe;YACvC,2BAA2B,EAAE,aAAa;YAC1C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,WAAW;SACpB,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE;YACpE,IAAI;YACJ,aAAa,SAAS,EAAE;YACxB,IAAI;YACJ,eAAe,WAAW,EAAE;YAC5B,IAAI;YACJ,yBAAyB;YACzB,OAAO,CAAC,QAAQ;YAChB,IAAI;YACJ,kBAAkB;SACnB,EAAE,WAAW,CAAC,CAAC;QAChB,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,OAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAsB,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7G,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;QAChD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,KAAK,IAAI,IAAI,gBAAgB,KAAK,cAAc,CAAC;QAC/F,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,KAAK,IAAI,IAAI,kBAAkB,KAAK,SAAS,CAAC;QAChG,MAAM,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,KAAK,IAAI,IAAI,cAAc,KAAK,QAAQ,CAAC;QAC/F,MAAM,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,KAAK,IAAI,IAAI,eAAe,KAAK,gBAAgB,CAAC;QAC1G,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,KAAK,IAAI,IAAI,kBAAkB,KAAK,CAAC,CAAC;QAClF,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,KAAK,IAAI,CAAC;QACxE,MAAM,mBAAmB,GAAG,sBAAsB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/E,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QACnF,MAAM,UAAU,GAAG;YACjB,sBAAsB;YACtB,mBAAmB;YACnB,mBAAmB;YACnB,aAAa;YACb,kBAAkB;YAClB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;YAClB,cAAc;SACN,CAAC;QACX,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ;YACnC,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC;gBAC5B,CAAC,CAAC,8CAA8C,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBAChH,CAAC,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,0CAA0C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC1E,CAAC,CAAC,IAAI,CAAC;QACb,OAAO,WAAW,CAAC;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,oBAAoB;YAC7B,sBAAsB;YACtB,mBAAmB;YACnB,UAAU,EAAE,wBAAwB;YACpC,mBAAmB;YACnB,aAAa;YACb,kBAAkB;YAClB,gBAAgB;YAChB,MAAM,EAAE,MAAM;YACd,UAAU;YACV,kBAAkB;YAClB,QAAQ;YACR,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CACrB,oBAAoB,EACpB,wBAAwB,EACxB,IAAI,EACJ,0CAA0C,YAAY,CAAC,KAAK,CAAC,EAAE,CAChE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,gBAAgB,CACrB,kBAAkB,EAClB,IAAI,EACJ,KAAK,EACL,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;QAC3B,kBAAkB,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;YAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,SAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC;YACxC,SAAS,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAsB;YACrC,EAAE,EAAE,GAAG;YACP,WAAW,EAAE,GAAG;YAChB,2BAA2B,EAAE,kCAAkC;YAC/D,sBAAsB,EAAE,cAAc,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE;YAC5E,yBAAyB,EAAE,WAAW;YACtC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC;YAC/B,sBAAsB,EAAE,iBAAiB;YACzC,2BAA2B,EAAE,cAAc,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE;YAC3F,IAAI,EAAE,8CAA8C;YACpD,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,MAAM;SACf,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,wBAAwB,CAAC;YAC/E,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC3D,GAAG,EAAE,SAAS;YACd,WAAW;YACX,SAAS;SACV,CAAC,EAAE,WAAW,CAAC,CAAC;QACjB,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvC,IAAI,OAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAsB,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,gBAAgB,EAAE,cAAc,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG;YACjB,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,KAAK,IAAI;YAChE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YACzF,mBAAmB;YACnB,aAAa,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,IAAI,kBAAkB,KAAK,CAAC;YAC1E,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,IAAI,cAAc,KAAK,QAAQ;YACvF,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI;YACpD,UAAU,EAAE,OAAO,EAAE,UAAU,KAAK,IAAI;YACxC,kBAAkB,EAAE,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ;YAC3E,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,IAAI,gBAAgB,KAAK,cAAc;SAC/E,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,WAAW,CAAC;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,kBAAkB;YAC3B,GAAG,UAAU;YACb,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrG,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CACrB,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,4CAA4C,YAAY,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB;IACrC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAClC,CAAC,CAAC,MAAM,kBAAkB,EAAE;YAC5B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,CAAC,MAAM,oBAAoB,EAAE;gBAC9B,CAAC,CAAC,gBAAgB,CAChB,MAAM,EACN,IAAI,EACJ,KAAK,EACL,sDAAsD,OAAO,CAAC,QAAQ,IAAI,CAC3E,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CACrB,MAAM,EACN,IAAI,EACJ,KAAK,EACL,gDAAgD,YAAY,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,WAAW,KAAK,wBAAwB,EAAE,CAAC;IAC3C,OAAO,MAAM,WAAW,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAA4B,EAC5B,KAAoC;IAEpC,MAAM,kBAAkB,GAAG,KAAK,CAAC,sBAAsB;WAClD,KAAK,CAAC,mBAAmB;WACzB,KAAK,CAAC,mBAAmB;WACzB,KAAK,CAAC,aAAa;WACnB,KAAK,CAAC,kBAAkB;WACxB,KAAK,CAAC,gBAAgB;WACtB,KAAK,CAAC,UAAU;WAChB,KAAK,CAAC,kBAAkB;WACxB,KAAK,CAAC,cAAc,CAAC;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,KAAK,kBAAkB,IAAI,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS;QAC5B,CAAC,CAAC,aAAsB;QACxB,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,QAAiB;YACnB,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAChB,CAAC,CAAC,YAAqB;gBACvB,CAAC,CAAC,cAAuB,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,kBAAkB;QAClE,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,iFAAiF;YACrF,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACjB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc;QACjE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,aAAa;QACvE,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;QAC1C,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACxE,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CAAC,KAMvC;IACA,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAa;QACrB,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK;QAC9F,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;KACpE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9G,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,SAAiB;IACnE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;gBACtB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qEAAqE,CAAC,EAAE;oBACpG,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,SAAS;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBACrH,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC"}

package/dist/adapters/node/host/content-hash.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256Text(content: string): string;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/adapters/node/host/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../../../src/adapters/node/host/content-hash.ts"],"names":[],"mappings":"AAEA,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/adapters/node/host/content-hash.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+export function sha256Text(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+//# sourceMappingURL=content-hash.js.map

package/dist/adapters/node/host/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../../../src/adapters/node/host/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/dist/adapters/node/host/file-run-store.d.ts

@@ -0,0 +1,29 @@
+import { type AiCoderRunCheckpoint } from "../../../index.js";
+import type { AiCoderFinalReport, AiCoderRunStore } from "../../../runtime/index.js";
+/**
+ * Minimal durable host store for the CLI laboratory. The configured directory
+ * must be outside model-writable workspace roots in production hosts.
+ */
+export declare class FileRunStore implements AiCoderRunStore {
+    private readonly root;
+    readonly checkpointTrust: "trusted_host";
+    private constructor();
+    static create(root: string): Promise<FileRunStore>;
+    private runDirectory;
+    loadLatestCheckpoint(runId: string, context: Readonly<{
+        deadline: number;
+        signal: AbortSignal;
+    }>): Promise<AiCoderRunCheckpoint | null>;
+    saveCheckpoint(checkpoint: AiCoderRunCheckpoint, context: Readonly<{
+        deadline: number;
+        signal: AbortSignal;
+    }>): Promise<Readonly<{
+        artifactRef?: string;
+    }>>;
+    saveFinalReport(report: AiCoderFinalReport, context: Readonly<{
+        deadline: number;
+        signal: AbortSignal;
+    }>): Promise<void>;
+    loadFinalReport(runId: string): Promise<AiCoderFinalReport | null>;
+}
+//# sourceMappingURL=file-run-store.d.ts.map

package/dist/adapters/node/host/file-run-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-run-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/node/host/file-run-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EAChB,MAAM,2BAA2B,CAAC;AA2BnC;;;GAGG;AACH,qBAAa,YAAa,YAAW,eAAe;IAG9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFzC,QAAQ,CAAC,eAAe,EAAG,cAAc,CAAU;IAEnD,OAAO;WAEM,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAU1C,YAAY;IAUpB,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC,GAC3D,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAcjC,cAAc,CAClB,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC,GAC3D,OAAO,CAAC,QAAQ,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASxC,eAAe,CACnB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,QAAQ,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC,GAC3D,OAAO,CAAC,IAAI,CAAC;IAOV,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CASzE"}