@harrylabsj/kiwi 0.6.0

package/dist/supervisor/manage.js

@@ -0,0 +1,419 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `kiwi up` / `kiwi status` / `kiwi down` — managed-local lifecycle.
+ *
+ * up starts the shopping-cli gateway, waits for /health, then starts the
+ * enabled buyer/merchant foreground agents — each through the child-runner
+ * with a random nonce. All spawns use argv arrays (never shell strings).
+ * up validates config/profiles/env BEFORE leaving any background process
+ * behind and rolls back only processes it created on partial failure. It is
+ * idempotent when its own instance is already healthy.
+ *
+ * down signals only verified wrapper PIDs (instance id + uid + live argv
+ * nonce + fingerprint), waits a bounded time, escalates to SIGKILL only for
+ * its own surviving verified wrapper, and reports — never kills — anything
+ * unverifiable. Both are idempotent; cleanup touches only this instance's
+ * run/ files.
+ */
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadProfile, ProfileError } from "../config/profile.js";
+import { exitPathFor, fingerprint, logPathFor, manifestPathFor, newNonce, pidAlive, readExitRecord, readManifest, verifyProcess, wrapperArgv, writeManifestAtomic, } from "./manifest.js";
+import { instancePaths, MANAGED_ROLES, parseStackConfig, resolveProfilePath, StackConfigError, } from "./stack-config.js";
+const HEALTH_TIMEOUT_MS = 30_000;
+const HEALTH_POLL_MS = 250;
+const AGENT_GRACE_MS = 750;
+const SIGTERM_WAIT_MS = 5_000;
+const SIGKILL_WAIT_MS = 2_000;
+const WAIT_POLL_MS = 100;
+export class SupervisorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SupervisorError";
+    }
+}
+function cliPath() {
+    const sibling = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "cli.js");
+    if (existsSync(sibling))
+        return sibling;
+    // Dev/test (running from src/): use the built CLI from dist/.
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "dist", "cli.js");
+}
+/** Resolve an agent profile with proven containment inside the instance. */
+function safeProfilePath(ctx, role) {
+    try {
+        return resolveProfilePath(ctx.paths.root, ctx.config.agents[role].profile, "stack config");
+    }
+    catch (err) {
+        if (err instanceof StackConfigError)
+            throw new SupervisorError(err.message);
+        throw err;
+    }
+}
+export function loadInstance(dir) {
+    const paths = instancePaths(dir);
+    let raw;
+    try {
+        raw = readFileSync(paths.config, "utf-8");
+    }
+    catch {
+        throw new SupervisorError(`no Kiwi instance at ${paths.root} (missing ${path.basename(paths.config)}); run kiwi init first`);
+    }
+    try {
+        return { paths, config: parseStackConfig(raw, paths.config) };
+    }
+    catch (err) {
+        if (err instanceof StackConfigError)
+            throw new SupervisorError(err.message);
+        throw err;
+    }
+}
+async function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** Bounded wait for a file to appear. */
+async function waitForFile(file, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (existsSync(file))
+            return true;
+        await sleep(25);
+    }
+    return existsSync(file);
+}
+const READY_WAIT_MS = 3_000;
+/** Spawn one managed process through the child-runner and write its manifest. */
+export async function spawnManaged(ctx, role, command, env) {
+    const nonce = newNonce();
+    const manifestPath = manifestPathFor(ctx.paths.run, role);
+    const logPath = logPathFor(ctx.paths.logs, role);
+    const exitPath = exitPathFor(ctx.paths.run, role);
+    rmSync(exitPath, { force: true });
+    rmSync(`${manifestPath}.ready`, { force: true });
+    const argv = wrapperArgv(nonce, manifestPath, logPath, exitPath, command);
+    const child = spawn(process.execPath, argv, {
+        detached: true,
+        stdio: "ignore",
+        env: { ...process.env, ...env },
+    });
+    child.unref();
+    if (child.pid === undefined) {
+        throw new SupervisorError(`failed to spawn ${role}`);
+    }
+    const manifest = {
+        manifest_version: 1,
+        instance_id: ctx.config.instance_id,
+        uid: typeof process.getuid === "function" ? process.getuid() : 0,
+        nonce,
+        role,
+        pid: child.pid,
+        command,
+        wrapper_argv: argv,
+        command_fingerprint: fingerprint(argv),
+        started_at: new Date().toISOString(),
+        log_path: logPath,
+        exit_path: exitPath,
+    };
+    writeManifestAtomic(manifestPath, manifest);
+    // The child-runner marks readiness only after its signal handlers are
+    // registered; no signal sent after this point can be lost.
+    const ready = await waitForFile(`${manifestPath}.ready`, READY_WAIT_MS);
+    if (!ready) {
+        const exit = readExitRecord(exitPath);
+        throw new SupervisorError(`${role} child-runner did not become ready` +
+            (exit ? ` (exit_code=${String(exit.exit_code)})` : ""));
+    }
+    return manifest;
+}
+async function waitHealth(baseUrl, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 2_000);
+            const res = await fetch(`${baseUrl}/health`, { signal: controller.signal });
+            clearTimeout(timer);
+            if (res.ok)
+                return true;
+        }
+        catch {
+            // not up yet
+        }
+        if (Date.now() > deadline)
+            return false;
+        await sleep(HEALTH_POLL_MS);
+    }
+}
+async function waitExit(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!pidAlive(pid))
+            return true;
+        await sleep(WAIT_POLL_MS);
+    }
+    return !pidAlive(pid);
+}
+function roleEnabled(config, role) {
+    if (role === "gateway")
+        return true;
+    return config.agents[role].enabled;
+}
+function roleState(ctx, role) {
+    const enabled = roleEnabled(ctx.config, role);
+    const manifestPath = manifestPathFor(ctx.paths.run, role);
+    const manifest = readManifest(manifestPath);
+    if (!manifest) {
+        return { role, enabled, verified: false, running: false, detail: "not started" };
+    }
+    // The manifest's role must match the file it lives in; a mismatch means
+    // the file cannot be trusted and the process is never signaled.
+    if (manifest.role !== role) {
+        return {
+            role,
+            enabled,
+            verified: false,
+            running: pidAlive(manifest.pid),
+            detail: `manifest role mismatch: ${role}.json describes role "${manifest.role}"`,
+        };
+    }
+    const verification = verifyProcess(manifest, ctx.config.instance_id);
+    const exited = verification.running ? undefined : readExitRecord(manifest.exit_path);
+    return {
+        role,
+        enabled,
+        verified: verification.verified,
+        running: verification.running,
+        exited,
+        detail: verification.detail,
+    };
+}
+/** Remove this instance's stale (not-running) run/ state for a role. */
+function cleanStaleRunState(ctx, role) {
+    rmSync(manifestPathFor(ctx.paths.run, role), { force: true });
+    rmSync(`${manifestPathFor(ctx.paths.run, role)}.ready`, { force: true });
+    rmSync(exitPathFor(ctx.paths.run, role), { force: true });
+}
+export async function runUp(dir, options) {
+    const healthTimeoutMs = options?.healthTimeoutMs ?? HEALTH_TIMEOUT_MS;
+    const agentGraceMs = options?.agentGraceMs ?? AGENT_GRACE_MS;
+    const ctx = loadInstance(dir);
+    if (ctx.config.mode !== "managed-local") {
+        throw new SupervisorError(`mode ${ctx.config.mode} is not managed by kiwi 0.5.0: start the gateway yourself and use kiwi agent run / doctor`);
+    }
+    // 1. Ownership/running state FIRST (safe, needs no secrets): an already
+    // verified+running stack must be idempotent even from a fresh shell
+    // without the agent tokens in its environment.
+    const started = [];
+    const alreadyRunning = [];
+    const disabled = [];
+    const toStart = [];
+    for (const role of MANAGED_ROLES) {
+        if (!roleEnabled(ctx.config, role)) {
+            disabled.push(role);
+            continue;
+        }
+        const state = roleState(ctx, role);
+        if (state.running && state.verified) {
+            alreadyRunning.push(role);
+            continue;
+        }
+        if (state.running && !state.verified) {
+            throw new SupervisorError(`${role}: pid in manifest is alive but failed ownership verification (${state.detail}); refusing to disturb it — inspect ${ctx.paths.run} manually`);
+        }
+        cleanStaleRunState(ctx, role); // only this instance's run/ files
+        toStart.push(role);
+    }
+    // 2. Validate profiles and required env vars — only for agent roles that
+    // actually need to start, and still before any process is spawned.
+    const agentsToStart = toStart.filter((role) => role !== "gateway");
+    if (agentsToStart.length > 0) {
+        const missing = [];
+        for (const role of agentsToStart) {
+            // Containment is proven against the instance root, not by substring.
+            const profilePath = safeProfilePath(ctx, role);
+            try {
+                const profile = loadProfile(profilePath);
+                if (process.env[profile.commerce.token_env] === undefined) {
+                    missing.push(`${profile.commerce.token_env} (${role} commerce token)`);
+                }
+                if (profile.model.provider !== "fake" && profile.model.api_key_env !== undefined) {
+                    if (process.env[profile.model.api_key_env] === undefined) {
+                        missing.push(`${profile.model.api_key_env} (${role} model API key)`);
+                    }
+                }
+            }
+            catch (err) {
+                if (err instanceof ProfileError) {
+                    throw new SupervisorError(`${role} profile invalid: ${err.message}`);
+                }
+                throw err;
+            }
+        }
+        if (missing.length > 0) {
+            throw new SupervisorError(`missing required environment variables: ${missing.join(", ")} (names only; values are never printed)`);
+        }
+    }
+    // 3. Gateway health is a precondition for starting agents — even when the
+    // gateway wrapper is already verified+running. If it stays unhealthy,
+    // fail clearly: no agents are started and the pre-existing gateway is
+    // left untouched.
+    const gatewayInToStart = toStart.includes("gateway");
+    if (agentsToStart.length > 0 && !gatewayInToStart) {
+        if (!(await waitHealth(ctx.config.gateway.base_url, healthTimeoutMs))) {
+            throw new SupervisorError(`gateway is already running but not healthy at ${ctx.config.gateway.base_url}; refusing to start agents (the running gateway was left untouched)`);
+        }
+    }
+    // 4. Start gateway, wait for health, then agents. Roll back only what we
+    // started on any partial failure.
+    const gatewayEnv = {
+        ...ctx.config.gateway.env,
+        SHOPPING_DEPLOYMENT_PROFILE: process.env.SHOPPING_DEPLOYMENT_PROFILE ?? "local",
+        SHOPPING_ADMIN_TOKEN: process.env.SHOPPING_ADMIN_TOKEN ?? randomBytes(24).toString("base64url"),
+        SHOPPING_BUYER_BOOTSTRAP_TOKEN: process.env.SHOPPING_BUYER_BOOTSTRAP_TOKEN ?? randomBytes(24).toString("base64url"),
+    };
+    const rollback = async () => {
+        for (const role of [...started].reverse()) {
+            const manifest = readManifest(manifestPathFor(ctx.paths.run, role));
+            if (manifest)
+                await stopVerified(ctx, manifest);
+            cleanStaleRunState(ctx, role);
+        }
+    };
+    try {
+        for (const role of toStart) {
+            if (role === "gateway") {
+                await spawnManaged(ctx, role, ctx.config.gateway.command, gatewayEnv);
+                started.push(role);
+                if (!(await waitHealth(ctx.config.gateway.base_url, healthTimeoutMs))) {
+                    throw new SupervisorError(`gateway did not become healthy within ${healthTimeoutMs / 1000}s at ${ctx.config.gateway.base_url}`);
+                }
+            }
+            else {
+                const profilePath = safeProfilePath(ctx, role);
+                await spawnManaged(ctx, role, [process.execPath, cliPath(), "agent", "run", "--profile", profilePath], {});
+                started.push(role);
+                await sleep(agentGraceMs);
+                const state = roleState(ctx, role);
+                if (!state.running || state.exited !== undefined) {
+                    throw new SupervisorError(`${role} agent exited during startup (see ${logPathFor(ctx.paths.logs, role)})`);
+                }
+            }
+        }
+    }
+    catch (err) {
+        await rollback();
+        throw err;
+    }
+    return {
+        instance_id: ctx.config.instance_id,
+        started,
+        already_running: alreadyRunning,
+        disabled,
+        base_url: ctx.config.gateway.base_url,
+    };
+}
+/** Stop one manifest-owned process after verification. Never touches anything unverifiable. */
+export async function stopVerified(ctx, manifest) {
+    const verification = verifyProcess(manifest, ctx.config.instance_id);
+    if (!verification.running)
+        return "not_running";
+    if (!verification.verified)
+        return "unverified";
+    // Never signal a child-runner whose readiness cannot be proven (the ready
+    // marker is written only after its signal handlers are installed). If the
+    // marker never appears, do NOT signal: report instead of risking a kill
+    // before the handlers exist.
+    const readyPath = `${manifestPathFor(ctx.paths.run, manifest.role)}.ready`;
+    if (!existsSync(readyPath) && !(await waitForFile(readyPath, READY_WAIT_MS))) {
+        return "unverified";
+    }
+    process.kill(manifest.pid, "SIGTERM");
+    if (await waitExit(manifest.pid, SIGTERM_WAIT_MS))
+        return "stopped";
+    // Escalate only against our own still-verified wrapper.
+    const again = verifyProcess(manifest, ctx.config.instance_id);
+    if (!again.running)
+        return "stopped";
+    if (!again.verified)
+        return "unverified";
+    process.kill(manifest.pid, "SIGKILL");
+    return (await waitExit(manifest.pid, SIGKILL_WAIT_MS)) ? "killed" : "unverified";
+}
+export async function runDown(dir) {
+    const ctx = loadInstance(dir);
+    const results = [];
+    // Agents first, gateway last.
+    for (const role of [...MANAGED_ROLES].reverse()) {
+        const manifest = readManifest(manifestPathFor(ctx.paths.run, role));
+        if (!manifest) {
+            results.push({ role, outcome: "not_started", detail: "no manifest" });
+            continue;
+        }
+        if (manifest.role !== role) {
+            // Report, never signal: the file cannot be trusted for this role.
+            results.push({
+                role,
+                outcome: "unverified",
+                detail: `manifest role mismatch: ${role}.json describes role "${manifest.role}"`,
+            });
+            continue;
+        }
+        const verification = verifyProcess(manifest, ctx.config.instance_id);
+        if (verification.running && !verification.verified) {
+            // Report, never kill: this process cannot be proven to be ours.
+            results.push({ role, outcome: "unverified", detail: verification.detail });
+            continue;
+        }
+        const outcome = await stopVerified(ctx, manifest);
+        if (outcome !== "unverified") {
+            cleanStaleRunState(ctx, role);
+        }
+        results.push({ role, outcome, detail: verification.detail });
+    }
+    return { instance_id: ctx.config.instance_id, results };
+}
+export async function runStatus(dir) {
+    const ctx = loadInstance(dir);
+    let health;
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 2_000);
+        const res = await fetch(`${ctx.config.gateway.base_url}/health`, {
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        const body = (await res.json());
+        health = { ok: res.ok && body.ok === true, ...(body.version ? { version: body.version } : {}) };
+    }
+    catch {
+        health = undefined;
+    }
+    const processes = MANAGED_ROLES.map((role) => roleState(ctx, role));
+    const ok = (health?.ok ?? false) && processes.every((p) => !p.enabled || (p.running && p.verified));
+    return {
+        ok,
+        instance_id: ctx.config.instance_id,
+        mode: ctx.config.mode,
+        base_url: ctx.config.gateway.base_url,
+        gateway_health: health,
+        processes,
+    };
+}
+//# sourceMappingURL=manage.js.map

package/dist/supervisor/manage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage.js","sourceRoot":"","sources":["../../src/supervisor/manage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,aAAa,EACb,WAAW,EACX,mBAAmB,GAIpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,8DAA8D;IAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClG,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CAAC,GAAoB,EAAE,IAA0B;IACvE,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,uBAAuB,KAAK,CAAC,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAClG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,IAAiB,EACjB,OAAiB,EACjB,GAA2B;IAE3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,YAAY,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC1C,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;KAChC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,gBAAgB,EAAE,CAAC;QACnB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;QACnC,GAAG,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO;QACP,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,WAAW,CAAC,IAAI,CAAC;QACtC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;KACpB,CAAC;IACF,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5C,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,YAAY,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,eAAe,CACvB,GAAG,IAAI,oCAAoC;YACzC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,SAAiB;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,SAAiB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAWD,SAAS,WAAW,CAAC,MAAmB,EAAE,IAAiB;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB,EAAE,IAAiB;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnF,CAAC;IACD,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,2BAA2B,IAAI,yBAAyB,QAAQ,CAAC,IAAI,GAAG;SACjF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAiB,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,MAAM;QACN,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,GAAoB,EAAE,IAAiB;IACjE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,OAAmB;IAC1D,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,iBAAiB,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,cAAc,CAAC;IAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,2FAA2F,CACnH,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,+CAA+C;IAC/C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,cAAc,GAAkB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CACvB,GAAG,IAAI,iEAAiE,KAAK,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,CACpJ,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,kCAAkC;QACjE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,qEAAqE;YACrE,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,kBAAkB,CAAC,CAAC;gBACzE,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBACjF,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;wBACzD,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,iBAAiB,CAAC,CAAC;oBACvE,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;oBAChC,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CACvB,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CACvB,iDAAiD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,qEAAqE,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,UAAU,GAA2B;QACzC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;QACzB,2BAA2B,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,OAAO;QAC/E,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/F,8BAA8B,EAC5B,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACpE,IAAI,QAAQ;gBAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChD,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,IAAI,eAAe,CACvB,yCAAyC,eAAe,GAAG,IAAI,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CACrG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM,YAAY,CAChB,GAAG,EACH,IAAI,EACJ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,EACvE,EAAE,CACH,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACjD,MAAM,IAAI,eAAe,CACvB,GAAG,IAAI,qCAAqC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAChF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;QACnC,OAAO;QACP,eAAe,EAAE,cAAc;QAC/B,QAAQ;QACR,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;KACtC,CAAC;AACJ,CAAC;AAID,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,QAAyB;IAEzB,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IAChD,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IAChD,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,6BAA6B;IAC7B,MAAM,SAAS,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,wDAAwD;IACxD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;AACnF,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,8BAA8B;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,kEAAkE;YAClE,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,2BAA2B,IAAI,yBAAyB,QAAQ,CAAC,IAAI,GAAG;aACjF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACnD,gEAAgE;YAChE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,SAAS,EAAE;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAC;QACtE,MAAM,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,EAAE,GACN,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,OAAO;QACL,EAAE;QACF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;QACnC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;QACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;QACrC,cAAc,EAAE,MAAM;QACtB,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/supervisor/manifest.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ManagedRole } from "./stack-config.js";
+export interface ProcessManifest {
+    manifest_version: 1;
+    instance_id: string;
+    uid: number;
+    nonce: string;
+    role: ManagedRole;
+    /** PID of the wrapper (the only PID ever signaled). */
+    pid: number;
+    /** Exact child command argv (never a shell string). */
+    command: string[];
+    /** Full wrapper argv as spawned (includes the nonce). */
+    wrapper_argv: string[];
+    /** sha256 of JSON.stringify(wrapper_argv). */
+    command_fingerprint: string;
+    started_at: string;
+    log_path: string;
+    exit_path: string;
+}
+export interface Verification {
+    verified: boolean;
+    running: boolean;
+    detail: string;
+}
+export declare function newNonce(): string;
+export declare function wrapperPath(): string;
+/** Full wrapper argv: the nonce is always visible to ps for verification. */
+export declare function wrapperArgv(nonce: string, manifestPath: string, logPath: string, exitPath: string, command: string[]): string[];
+export declare function fingerprint(argv: string[]): string;
+export declare function manifestPathFor(runDir: string, role: ManagedRole): string;
+export declare function exitPathFor(runDir: string, role: ManagedRole): string;
+export declare function logPathFor(logsDir: string, role: ManagedRole): string;
+/** Atomic mode-0600 write: temp file in the same dir, fsync, rename. */
+export declare function writeManifestAtomic(manifestPath: string, manifest: ProcessManifest): void;
+/**
+ * Parse a manifest file, fail closed: any malformed or tampered field makes
+ * the whole manifest unreadable, and an unreadable manifest is never
+ * signaled.
+ */
+export declare function readManifest(manifestPath: string): ProcessManifest | undefined;
+export declare function pidAlive(pid: number): boolean;
+export interface ExitRecord {
+    exit_code: number | null;
+    signal: string | null;
+    at: string;
+}
+export declare function readExitRecord(exitPath: string): ExitRecord | undefined;
+/**
+ * Verify that the live process at manifest.pid is exactly the wrapper this
+ * instance started: same instance, same uid, alive, argv carries the exact
+ * nonce and wrapper path, and the stored fingerprint matches the recomputed
+ * wrapper argv.
+ */
+export declare function verifyProcess(manifest: ProcessManifest, expectedInstanceId: string): Verification;