@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/execution-resolver.js

@@ -1,170 +0,0 @@
-import { existsSync } from "fs";
-import { join } from "path";
-import { conversationSettingsPath, loadGlobalSettings, resolveConversationSettings, } from "./config.js";
-import { ensureDirExists, isRecord, readJsonFileIfExists } from "./utils/file-guards.js";
-import { DockerContainerManager } from "./provisioner.js";
-import { createExecutor } from "./sandbox/index.js";
-import { reportUserFacingError } from "./observability/sentry.js";
-import { normalizeSharedVaultName } from "./vault/index.js";
-import { resolveActorVaultKey } from "./vault/routing.js";
-import * as log from "./log.js";
-export function readConversationWorkspaceMountMode(workspaceDir, conversationId) {
-    const globalDefault = readGlobalWorkspaceMountMode();
-    if (!workspaceDir) {
-        return globalDefault;
-    }
-    const conversationDir = join(workspaceDir, conversationId);
-    try {
-        return resolveConversationSettings(conversationDir).sandboxImageWorkspaceMount ?? globalDefault;
-    }
-    catch (err) {
-        log.logWarning("Falling back while resolving conversation workspace mount", err instanceof Error ? err.message : String(err));
-        const raw = readConversationSettingsFallback(conversationSettingsPath(conversationDir));
-        return raw?.sandbox?.image?.workspaceMount ?? globalDefault;
-    }
-}
-function readGlobalWorkspaceMountMode() {
-    try {
-        return loadGlobalSettings().sandboxImageWorkspaceMount ?? "private";
-    }
-    catch (err) {
-        log.logWarning("Using default workspace mount because global settings could not be read", err instanceof Error ? err.message : String(err));
-        return "private";
-    }
-}
-function readConversationSettingsFallback(settingsPath) {
-    try {
-        return readJsonFileIfExists(settingsPath, (value) => isRecord(value), () => "Ignoring malformed conversation settings file while resolving workspace mount");
-    }
-    catch (err) {
-        log.logWarning("Ignoring malformed conversation settings fallback while resolving workspace mount", err instanceof Error ? err.message : String(err));
-        return undefined;
-    }
-}
-export class ActorExecutionResolver {
-    constructor(baseConfig, vaultManager, provisioner, workspaceDir) {
-        this.baseConfig = baseConfig;
-        this.vaultManager = vaultManager;
-        this.provisioner = provisioner;
-        this.workspaceDir = workspaceDir;
-        this.ensuredConversationDirs = new Set();
-    }
-    async resolve(context) {
-        const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);
-        this.ensureDefaultSharedVault(vaultKey);
-        const vault = this.vaultManager.resolve(vaultKey);
-        const config = this.resolveSandboxConfig(vaultKey);
-        const env = config.type !== "host" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
-        return createExecutor(config, env, this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault));
-    }
-    ensureDefaultSharedVault(vaultKey) {
-        if (this.baseConfig.type !== "image" && this.baseConfig.type !== "cloudflare")
-            return;
-        if (this.vaultManager.hasEntry(vaultKey))
-            return;
-        let profile;
-        try {
-            profile = loadGlobalSettings().defaultSharedVault;
-        }
-        catch {
-            return;
-        }
-        if (!profile || normalizeSharedVaultName(profile) !== profile)
-            return;
-        this.vaultManager.copySharedVaultTo(profile, vaultKey);
-    }
-    resolveSandboxConfig(vaultKey) {
-        const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);
-        if (this.baseConfig.type !== "image") {
-            return config;
-        }
-        if (config.type === "container") {
-            return config;
-        }
-        return {
-            type: "container",
-            container: DockerContainerManager.containerName(vaultKey),
-        };
-    }
-    buildEnsureReadyCallback(vaultKey, conversationId, config, vault) {
-        if (this.baseConfig.type !== "image" || config.type !== "container") {
-            return undefined;
-        }
-        return async () => {
-            const expected = config.container || DockerContainerManager.containerName(vaultKey);
-            let actual;
-            try {
-                actual = await this.provisioner?.provision(vaultKey, {
-                    containerName: expected,
-                    mounts: this.resolveMounts(conversationId, vault),
-                    conversationId,
-                });
-            }
-            catch (err) {
-                reportUserFacingError(err, {
-                    domain: "sandbox",
-                    surface: "sandbox_provision",
-                    operation: "ensure_image_container_ready",
-                    severity: "error",
-                    context: {
-                        sandboxType: "image",
-                        resolvedSandboxType: config.type,
-                        conversationId,
-                        vaultKey,
-                        expectedContainer: expected,
-                        hasVault: Boolean(vault),
-                    },
-                });
-                throw err;
-            }
-            if (actual && actual !== expected) {
-                throw new Error(`Provisioner returned container "${actual}" for container key "${vaultKey}", expected "${expected}"`);
-            }
-        };
-    }
-    resolveMounts(conversationId, vault) {
-        const mountsByTarget = new Map();
-        for (const mount of this.buildImageSandboxMounts(conversationId)) {
-            mountsByTarget.set(mount.target, mount);
-        }
-        for (const mount of vault?.mounts ?? []) {
-            if (!existsSync(mount.source)) {
-                reportUserFacingError(new Error("Vault mount source is missing"), {
-                    domain: "sandbox",
-                    surface: "vault_injection",
-                    operation: "resolve_mounts",
-                    severity: "warning",
-                    context: {
-                        sandboxType: "image",
-                        conversationId,
-                        target: mount.target,
-                        hasVault: Boolean(vault),
-                    },
-                });
-                continue;
-            }
-            mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });
-        }
-        return [...mountsByTarget.values()];
-    }
-    buildImageSandboxMounts(conversationId) {
-        if (!this.workspaceDir) {
-            return [];
-        }
-        if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === "full") {
-            return [{ source: this.workspaceDir, target: "/workspace" }];
-        }
-        const conversationDir = join(this.workspaceDir, conversationId);
-        if (!this.ensuredConversationDirs.has(conversationId)) {
-            ensureDirExists(conversationDir);
-            this.ensuredConversationDirs.add(conversationId);
-        }
-        return [
-            { source: join(this.workspaceDir, "MEMORY.md"), target: "/workspace/MEMORY.md" },
-            { source: join(this.workspaceDir, "skills"), target: "/workspace/skills" },
-            { source: join(this.workspaceDir, "events"), target: "/workspace/events" },
-            { source: conversationDir, target: `/workspace/${conversationId}` },
-        ];
-    }
-}
-//# sourceMappingURL=execution-resolver.js.map

package/dist/execution-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAyC,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,MAAM,UAAU,kCAAkC,CAChD,YAAgC,EAChC,cAAsB;IAEtB,MAAM,aAAa,GAAG,4BAA4B,EAAE,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,eAAe,CAAC,CAAC,0BAA0B,IAAI,aAAa,CAAC;IAClG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,2DAA2D,EAC3D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,gCAAgC,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC,0BAA0B,IAAI,SAAS,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,yEAAyE,EACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,oBAAoB,CACzB,YAAY,EACZ,CAAC,KAAK,EAAmF,EAAE,CACzF,QAAQ,CAAC,KAAK,CAAC,EACjB,GAAG,EAAE,CAAC,+EAA+E,CACtF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,mFAAmF,EACnF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IAGjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAAoC,EACpC,YAAqB;QAHrB,eAAU,GAAV,UAAU,CAAe;QACzB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAyB;QACpC,iBAAY,GAAZ,YAAY,CAAS;QANd,4BAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAO1D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,cAAc,CACnB,MAAM,EACN,GAAG,EACH,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAC/E,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,QAAgB;QAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACtF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEjD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QAEtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;SAC1D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,QAAgB,EAChB,cAAsB,EACtB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;oBACnD,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC;oBACjD,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,mBAAmB,EAAE,MAAM,CAAC,IAAI;wBAChC,cAAc;wBACd,QAAQ;wBACR,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,wBAAwB,QAAQ,gBAAgB,QAAQ,GAAG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,cAAsB,EAAE,KAAqB;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;oBAChE,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,gBAAgB;oBAC3B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,uBAAuB,CAAC,cAAsB;QACpD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAChF,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,cAAc,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport { join } from \"path\";\nimport {\n  conversationSettingsPath,\n  loadGlobalSettings,\n  resolveConversationSettings,\n} from \"./config.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./utils/file-guards.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\nimport { normalizeSharedVaultName, type ResolvedVault, type VaultManager } from \"./vault/index.js\";\nimport { resolveActorVaultKey } from \"./vault/routing.js\";\nimport * as log from \"./log.js\";\n\nexport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\nimport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\n\nexport function readConversationWorkspaceMountMode(\n  workspaceDir: string | undefined,\n  conversationId: string,\n): ImageWorkspaceMountMode {\n  const globalDefault = readGlobalWorkspaceMountMode();\n  if (!workspaceDir) {\n    return globalDefault;\n  }\n\n  const conversationDir = join(workspaceDir, conversationId);\n  try {\n    return resolveConversationSettings(conversationDir).sandboxImageWorkspaceMount ?? globalDefault;\n  } catch (err) {\n    log.logWarning(\n      \"Falling back while resolving conversation workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    const raw = readConversationSettingsFallback(conversationSettingsPath(conversationDir));\n    return raw?.sandbox?.image?.workspaceMount ?? globalDefault;\n  }\n}\n\nfunction readGlobalWorkspaceMountMode(): ImageWorkspaceMountMode {\n  try {\n    return loadGlobalSettings().sandboxImageWorkspaceMount ?? \"private\";\n  } catch (err) {\n    log.logWarning(\n      \"Using default workspace mount because global settings could not be read\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return \"private\";\n  }\n}\n\nfunction readConversationSettingsFallback(\n  settingsPath: string,\n): { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } | undefined {\n  try {\n    return readJsonFileIfExists(\n      settingsPath,\n      (value): value is { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } =>\n        isRecord(value),\n      () => \"Ignoring malformed conversation settings file while resolving workspace mount\",\n    );\n  } catch (err) {\n    log.logWarning(\n      \"Ignoring malformed conversation settings fallback while resolving workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return undefined;\n  }\n}\n\nexport class ActorExecutionResolver {\n  private readonly ensuredConversationDirs = new Set<string>();\n\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner?: DockerContainerManager,\n    private workspaceDir?: string,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);\n    this.ensureDefaultSharedVault(vaultKey);\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.resolveSandboxConfig(vaultKey);\n    const env =\n      config.type !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(\n      config,\n      env,\n      this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault),\n    );\n  }\n\n  private ensureDefaultSharedVault(vaultKey: string): void {\n    if (this.baseConfig.type !== \"image\" && this.baseConfig.type !== \"cloudflare\") return;\n    if (this.vaultManager.hasEntry(vaultKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n\n    this.vaultManager.copySharedVaultTo(profile, vaultKey);\n  }\n\n  private resolveSandboxConfig(vaultKey: string): SandboxConfig {\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    if (this.baseConfig.type !== \"image\") {\n      return config;\n    }\n\n    if (config.type === \"container\") {\n      return config;\n    }\n\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(vaultKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    vaultKey: string,\n    conversationId: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(vaultKey, {\n          containerName: expected,\n          mounts: this.resolveMounts(conversationId, vault),\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            resolvedSandboxType: config.type,\n            conversationId,\n            vaultKey,\n            expectedContainer: expected,\n            hasVault: Boolean(vault),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for container key \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(conversationId: string, vault?: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of this.buildImageSandboxMounts(conversationId)) {\n      mountsByTarget.set(mount.target, mount);\n    }\n    for (const mount of vault?.mounts ?? []) {\n      if (!existsSync(mount.source)) {\n        reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"resolve_mounts\",\n          severity: \"warning\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            target: mount.target,\n            hasVault: Boolean(vault),\n          },\n        });\n        continue;\n      }\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n\n  private buildImageSandboxMounts(conversationId: string): ContainerMount[] {\n    if (!this.workspaceDir) {\n      return [];\n    }\n\n    if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === \"full\") {\n      return [{ source: this.workspaceDir, target: \"/workspace\" }];\n    }\n\n    const conversationDir = join(this.workspaceDir, conversationId);\n    if (!this.ensuredConversationDirs.has(conversationId)) {\n      ensureDirExists(conversationDir);\n      this.ensuredConversationDirs.add(conversationId);\n    }\n\n    return [\n      { source: join(this.workspaceDir, \"MEMORY.md\"), target: \"/workspace/MEMORY.md\" },\n      { source: join(this.workspaceDir, \"skills\"), target: \"/workspace/skills\" },\n      { source: join(this.workspaceDir, \"events\"), target: \"/workspace/events\" },\n      { source: conversationDir, target: `/workspace/${conversationId}` },\n    ];\n  }\n}\n"]}

package/dist/harness/auth.d.ts

@@ -1,16 +0,0 @@
-import type { Credential, CredentialStore } from "@earendil-works/pi-ai";
-/** Default location of mikan's credential file. */
-export declare function defaultAuthPath(): string;
-export declare class FileCredentialStore implements CredentialStore {
-    private readonly authPath;
-    private chain;
-    constructor(authPath?: string);
-    private load;
-    private save;
-    /** Serialize read-modify-write cycles so concurrent refreshes cannot clobber each other. */
-    private enqueue;
-    read(providerId: string): Promise<Credential | undefined>;
-    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
-    delete(providerId: string): Promise<void>;
-}
-//# sourceMappingURL=auth.d.ts.map

package/dist/harness/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/harness/auth.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIzE,mDAAmD;AACnD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAQD,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,KAAK,CAAqB;IAElC,YAAY,QAAQ,GAAE,MAA0B,EAE/C;IAED,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,IAAI;IAKZ,4FAA4F;IAC5F,OAAO,CAAC,OAAO;IASf,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAExD;IAED,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACvE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CASjC;IAED,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxC;CACF"}

package/dist/harness/auth.js

@@ -1,86 +0,0 @@
-/**
- * File-backed credential store for the mikan harness.
- *
- * Implements pi-ai's `CredentialStore` over mikan's `auth.json`
- * (`~/.mikan/auth.json` by default). The file maps provider ids to
- * type-tagged credentials — the same shape pi-ai documents for auth.json.
- *
- * Writes are atomic (temp file + rename, mode 0600) and serialized per
- * provider within the process. mikan runs as a single process, so no
- * cross-process file lock is taken.
- */
-import { existsSync, readFileSync } from "fs";
-import { mkdirSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-import { atomicWritePrivateFile } from "../utils/fs-atomic.js";
-import * as log from "../log.js";
-/** Default location of mikan's credential file. */
-export function defaultAuthPath() {
-    return join(homedir(), ".mikan", "auth.json");
-}
-function isCredential(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const type = value.type;
-    return type === "api_key" || type === "oauth";
-}
-export class FileCredentialStore {
-    constructor(authPath = defaultAuthPath()) {
-        this.chain = Promise.resolve();
-        this.authPath = authPath;
-    }
-    load() {
-        if (!existsSync(this.authPath))
-            return {};
-        try {
-            const parsed = JSON.parse(readFileSync(this.authPath, "utf-8"));
-            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-                return {};
-            const data = {};
-            for (const [provider, credential] of Object.entries(parsed)) {
-                if (isCredential(credential))
-                    data[provider] = credential;
-            }
-            return data;
-        }
-        catch (err) {
-            log.logWarning(`Failed to read credentials from ${this.authPath}`, err instanceof Error ? err.message : String(err));
-            return {};
-        }
-    }
-    save(data) {
-        mkdirSync(dirname(this.authPath), { recursive: true });
-        atomicWritePrivateFile(this.authPath, `${JSON.stringify(data, null, 2)}\n`);
-    }
-    /** Serialize read-modify-write cycles so concurrent refreshes cannot clobber each other. */
-    enqueue(task) {
-        const result = this.chain.then(task);
-        this.chain = result.then(() => undefined, () => undefined);
-        return result;
-    }
-    read(providerId) {
-        return this.enqueue(async () => this.load()[providerId]);
-    }
-    modify(providerId, fn) {
-        return this.enqueue(async () => {
-            const data = this.load();
-            const next = await fn(data[providerId]);
-            if (next === undefined)
-                return data[providerId];
-            data[providerId] = next;
-            this.save(data);
-            return next;
-        });
-    }
-    delete(providerId) {
-        return this.enqueue(async () => {
-            const data = this.load();
-            if (!(providerId in data))
-                return;
-            delete data[providerId];
-            this.save(data);
-        });
-    }
-}
-//# sourceMappingURL=auth.js.map

package/dist/harness/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/harness/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAErC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,mDAAmD;AACnD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,mBAAmB;IAI9B,YAAY,QAAQ,GAAW,eAAe,EAAE;QAFxC,UAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAGhC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC9E,MAAM,IAAI,GAA+B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,IAAI,YAAY,CAAC,UAAU,CAAC;oBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,mCAAmC,IAAI,CAAC,QAAQ,EAAE,EAClD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAgC;QAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,4FAA4F;IACpF,OAAO,CAAI,IAAsB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CACJ,UAAkB,EAClB,EAAwE;QAExE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;gBAAE,OAAO;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["/**\n * File-backed credential store for the mikan harness.\n *\n * Implements pi-ai's `CredentialStore` over mikan's `auth.json`\n * (`~/.mikan/auth.json` by default). The file maps provider ids to\n * type-tagged credentials — the same shape pi-ai documents for auth.json.\n *\n * Writes are atomic (temp file + rename, mode 0600) and serialized per\n * provider within the process. mikan runs as a single process, so no\n * cross-process file lock is taken.\n */\nimport { existsSync, readFileSync } from \"fs\";\nimport { mkdirSync } from \"fs\";\nimport { homedir } from \"os\";\nimport { dirname, join } from \"path\";\nimport type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { atomicWritePrivateFile } from \"../utils/fs-atomic.js\";\nimport * as log from \"../log.js\";\n\n/** Default location of mikan's credential file. */\nexport function defaultAuthPath(): string {\n  return join(homedir(), \".mikan\", \"auth.json\");\n}\n\nfunction isCredential(value: unknown): value is Credential {\n  if (!value || typeof value !== \"object\") return false;\n  const type = (value as { type?: unknown }).type;\n  return type === \"api_key\" || type === \"oauth\";\n}\n\nexport class FileCredentialStore implements CredentialStore {\n  private readonly authPath: string;\n  private chain = Promise.resolve();\n\n  constructor(authPath: string = defaultAuthPath()) {\n    this.authPath = authPath;\n  }\n\n  private load(): Record<string, Credential> {\n    if (!existsSync(this.authPath)) return {};\n    try {\n      const parsed: unknown = JSON.parse(readFileSync(this.authPath, \"utf-8\"));\n      if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return {};\n      const data: Record<string, Credential> = {};\n      for (const [provider, credential] of Object.entries(parsed)) {\n        if (isCredential(credential)) data[provider] = credential;\n      }\n      return data;\n    } catch (err) {\n      log.logWarning(\n        `Failed to read credentials from ${this.authPath}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      return {};\n    }\n  }\n\n  private save(data: Record<string, Credential>): void {\n    mkdirSync(dirname(this.authPath), { recursive: true });\n    atomicWritePrivateFile(this.authPath, `${JSON.stringify(data, null, 2)}\\n`);\n  }\n\n  /** Serialize read-modify-write cycles so concurrent refreshes cannot clobber each other. */\n  private enqueue<T>(task: () => Promise<T>): Promise<T> {\n    const result = this.chain.then(task);\n    this.chain = result.then(\n      () => undefined,\n      () => undefined,\n    );\n    return result;\n  }\n\n  read(providerId: string): Promise<Credential | undefined> {\n    return this.enqueue(async () => this.load()[providerId]);\n  }\n\n  modify(\n    providerId: string,\n    fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n  ): Promise<Credential | undefined> {\n    return this.enqueue(async () => {\n      const data = this.load();\n      const next = await fn(data[providerId]);\n      if (next === undefined) return data[providerId];\n      data[providerId] = next;\n      this.save(data);\n      return next;\n    });\n  }\n\n  delete(providerId: string): Promise<void> {\n    return this.enqueue(async () => {\n      const data = this.load();\n      if (!(providerId in data)) return;\n      delete data[providerId];\n      this.save(data);\n    });\n  }\n}\n"]}

package/dist/harness/extensions/loader.d.ts

@@ -1,86 +0,0 @@
-import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
-import type { Api, Model } from "@earendil-works/pi-ai";
-import { type MikanSkill } from "../skills.js";
-import { ExtensionRegistry } from "./registry.js";
-import type { ExtensionHostServices, ExtensionLoadError, LoadedExtension } from "./types.js";
-/**
- * Canonical host-only extension code directories for a conversation, in load
- * order: `<stateDir>/global/extensions` (all conversations) then
- * `<stateDir>/conversations/<conversationId>/extensions` (that conversation
- * only). `global` and `conversations` are the two sibling scopes; see
- * `LAYOUT.md`. Conversation ids are used verbatim (see LAYOUT.md § Casing).
- */
-export declare function defaultExtensionDirs(conversationId: string, stateDir?: string): string[];
-/** Discovery-only view of an installed extension (module is not imported). */
-export interface InstalledExtensionInfo {
-    /** Display name: manifest name, falling back to the slug. */
-    name: string;
-    slug: string;
-    path: string;
-    /** Scan directory the extension was found in. */
-    dir: string;
-    version?: string;
-    description?: string;
-    /** Names of skills shipped in the extension's skills/ directory. */
-    skillNames: string[];
-}
-/**
- * List installed extensions without importing or activating them — safe for
- * inventory surfaces (commands, portal). Activation side effects (schedule
- * upserts, tool registration) only happen in {@link loadExtensions}.
- */
-export declare function listInstalledExtensions(dirs: string[]): InstalledExtensionInfo[];
-export interface LoadExtensionsOptions {
-    /** Directories to scan for extensions. Missing directories are skipped. */
-    dirs: string[];
-    context: {
-        conversationId: string;
-        workspaceDir: string;
-        model: Model<Api>;
-        thinkingLevel: ThinkingLevel;
-    };
-    /** Embedder-provided services backing the v2 api surface. */
-    services?: ExtensionHostServices;
-}
-export interface LoadExtensionsResult {
-    registry: ExtensionRegistry;
-    extensions: LoadedExtension[];
-    errors: ExtensionLoadError[];
-    /** Skills contributed by extensions (inline: bodies ride in the prompt). */
-    skills: MikanSkill[];
-}
-/**
- * Filesystem-safe identifier for an extension, derived from its install
- * location: the directory name for a directory-form extension, or the file
- * basename for a bare file. The slug keys the extension's data dir, secrets
- * vault, and schedule ownership — installing the same extension globally and
- * per-conversation shares one slug and therefore one shared data dir.
- */
-export declare function extensionSlug(entrypoint: string): string;
-/** Load and activate all extensions found in the given directories. */
-export declare function loadExtensions(options: LoadExtensionsOptions): Promise<LoadExtensionsResult>;
-export interface ExtensionValidation {
-    ok: boolean;
-    /** Slug the extension would install as (from the source dir/file name). */
-    slug: string;
-    /** Display name (manifest name, else slug). */
-    name: string;
-    version?: string;
-    description?: string;
-    /** Resolved entrypoint that would be imported. */
-    entrypoint?: string;
-    /** Skill names shipped alongside the extension. */
-    skillNames: string[];
-    errors: string[];
-    warnings: string[];
-}
-/**
- * Validate an extension source path (a directory or a single file) WITHOUT
- * activating it: resolves the entrypoint (package.json `mikan.extensions`,
- * index file, or the file itself), imports it, and checks it exports an
- * `activate` function. Used by `mikan ext install` as a preflight and by
- * `mikan ext validate`. Importing runs top-level module code but not
- * `activate`, so there are no schedule/tool side effects.
- */
-export declare function validateExtension(sourcePath: string): Promise<ExtensionValidation>;
-//# sourceMappingURL=loader.d.ts.map

package/dist/harness/extensions/loader.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/harness/extensions/loader.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAKlB,eAAe,EAIhB,MAAM,YAAY,CAAC;AAiBpB;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,QAAQ,GAAE,MAAkC,GAC3C,MAAM,EAAE,CAKV;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAkBhF;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,aAAa,EAAE,aAAa,CAAC;KAC9B,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAuHD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQxD;AA0OD,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAkD/B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsDxF"}