@herdctl/core 1.3.0 → 2.0.0

package/dist/runner/runtime/__tests__/docker-security.test.js

@@ -0,0 +1,384 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { execSync } from "node:child_process";
+import { mkdir, rm, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { promisify } from "node:util";
+import { exec } from "node:child_process";
+import { buildContainerMounts, buildContainerEnv, } from "../container-manager.js";
+import { resolveDockerConfig } from "../docker-config.js";
+const execAsync = promisify(exec);
+// =============================================================================
+// Environment Detection
+// =============================================================================
+function isDockerAvailable() {
+    try {
+        execSync("docker info", { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const DOCKER_AVAILABLE = isDockerAvailable();
+// Skip entire file if Docker not available
+const describeDocker = DOCKER_AVAILABLE ? describe : describe.skip;
+// =============================================================================
+// Test Helpers
+// =============================================================================
+async function createTempDir() {
+    const baseDir = join(tmpdir(), `herdctl-docker-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    await mkdir(baseDir, { recursive: true });
+    return await realpath(baseDir);
+}
+function createTestAgent(overrides = {}) {
+    return {
+        name: "test-agent",
+        configPath: "/path/to/agent.yaml",
+        working_directory: "/workspace/project",
+        ...overrides,
+    };
+}
+async function inspectContainer(containerId) {
+    const { stdout } = await execAsync(`docker inspect ${containerId}`);
+    return JSON.parse(stdout)[0];
+}
+async function removeContainer(containerId) {
+    try {
+        await execAsync(`docker rm -f ${containerId}`);
+    }
+    catch {
+        // Ignore if already removed
+    }
+}
+// =============================================================================
+// Docker Security Tests
+// =============================================================================
+describeDocker("Docker Security Hardening", () => {
+    let tempDir;
+    const containers = [];
+    beforeEach(async () => {
+        tempDir = await createTempDir();
+    });
+    afterEach(async () => {
+        // Clean up containers
+        for (const id of containers) {
+            await removeContainer(id);
+        }
+        containers.length = 0;
+        // Clean up temp dir
+        await rm(tempDir, { recursive: true, force: true });
+    });
+    describe("buildContainerMounts", () => {
+        it("includes workspace mount", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({
+                enabled: true,
+                workspace_mode: "rw",
+            });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            const workspaceMount = mounts.find((m) => m.containerPath === "/workspace");
+            expect(workspaceMount).toBeDefined();
+            expect(workspaceMount?.mode).toBe("rw");
+        });
+        it("mounts workspace read-only when workspace_mode is ro", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({
+                enabled: true,
+                workspace_mode: "ro",
+            });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            const workspaceMount = mounts.find((m) => m.containerPath === "/workspace");
+            expect(workspaceMount?.mode).toBe("ro");
+        });
+        it("does not mount auth files (uses ANTHROPIC_API_KEY instead)", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({ enabled: true });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            // Auth should NOT be mounted - we use ANTHROPIC_API_KEY env var instead
+            const authMount = mounts.find((m) => m.containerPath?.includes(".claude") && m.hostPath?.includes(".claude"));
+            expect(authMount).toBeUndefined();
+        });
+        it("includes docker-sessions directory mount at Claude session path", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({ enabled: true });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            // Session mount at Claude CLI session location (encoded path: /workspace → -workspace)
+            const sessionMount = mounts.find((m) => m.containerPath === "/home/claude/.claude/projects/-workspace");
+            expect(sessionMount).toBeDefined();
+            expect(sessionMount?.mode).toBe("rw");
+        });
+        it("includes additional volumes from config", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({
+                enabled: true,
+                volumes: ["/data:/data:ro"],
+            });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            const dataMount = mounts.find((m) => m.containerPath === "/data");
+            expect(dataMount).toBeDefined();
+            expect(dataMount?.mode).toBe("ro");
+        });
+        it("handles agent workspace as string", () => {
+            const agent = createTestAgent({
+                working_directory: "/path/to/workspace",
+            });
+            const dockerConfig = resolveDockerConfig({ enabled: true });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            const workspaceMount = mounts.find((m) => m.containerPath === "/workspace");
+            expect(workspaceMount).toBeDefined();
+            expect(workspaceMount?.hostPath).toBe("/path/to/workspace");
+        });
+        it("handles agent workspace as object with root", () => {
+            const agent = createTestAgent({
+                working_directory: {
+                    root: "/path/to/workspace",
+                    auto_clone: true,
+                    clone_depth: 1,
+                    default_branch: "main",
+                },
+            });
+            const dockerConfig = resolveDockerConfig({ enabled: true });
+            const mounts = buildContainerMounts(agent, dockerConfig, tempDir);
+            const workspaceMount = mounts.find((m) => m.containerPath === "/workspace");
+            expect(workspaceMount).toBeDefined();
+            expect(workspaceMount?.hostPath).toBe("/path/to/workspace");
+        });
+    });
+    describe("buildContainerEnv", () => {
+        it("includes HOME environment variable", () => {
+            const agent = createTestAgent();
+            const env = buildContainerEnv(agent);
+            expect(env).toContain("HOME=/home/claude");
+        });
+        it("includes TERM environment variable", () => {
+            const agent = createTestAgent();
+            const env = buildContainerEnv(agent);
+            const termEnv = env.find((e) => e.startsWith("TERM="));
+            expect(termEnv).toBeDefined();
+        });
+        it("includes ANTHROPIC_API_KEY if set in process.env", () => {
+            const originalKey = process.env.ANTHROPIC_API_KEY;
+            process.env.ANTHROPIC_API_KEY = "test-key-123";
+            const agent = createTestAgent();
+            const env = buildContainerEnv(agent);
+            expect(env).toContain("ANTHROPIC_API_KEY=test-key-123");
+            // Restore
+            if (originalKey) {
+                process.env.ANTHROPIC_API_KEY = originalKey;
+            }
+            else {
+                delete process.env.ANTHROPIC_API_KEY;
+            }
+        });
+        it("does not include ANTHROPIC_API_KEY if not set", () => {
+            const originalKey = process.env.ANTHROPIC_API_KEY;
+            delete process.env.ANTHROPIC_API_KEY;
+            const agent = createTestAgent();
+            const env = buildContainerEnv(agent);
+            const apiKeyEnv = env.find((e) => e.startsWith("ANTHROPIC_API_KEY="));
+            expect(apiKeyEnv).toBeUndefined();
+            // Restore
+            if (originalKey) {
+                process.env.ANTHROPIC_API_KEY = originalKey;
+            }
+        });
+        it("includes custom env vars from docker config", () => {
+            const agent = createTestAgent();
+            const dockerConfig = resolveDockerConfig({
+                enabled: true,
+                env: {
+                    GITHUB_TOKEN: "ghp_test123",
+                    CUSTOM_VAR: "custom_value",
+                },
+            });
+            const env = buildContainerEnv(agent, dockerConfig);
+            expect(env).toContain("GITHUB_TOKEN=ghp_test123");
+            expect(env).toContain("CUSTOM_VAR=custom_value");
+        });
+        it("works without docker config (backwards compatible)", () => {
+            const agent = createTestAgent();
+            const env = buildContainerEnv(agent);
+            // Should still include basic env vars
+            expect(env).toContain("HOME=/home/claude");
+            expect(env.find((e) => e.startsWith("TERM="))).toBeDefined();
+        });
+    });
+    describe("Container Configuration", () => {
+        it("applies no-new-privileges security option", async () => {
+            // Create a container to inspect (don't start it)
+            const { stdout } = await execAsync(`docker create --security-opt=no-new-privileges alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            // Verify security options are applied
+            expect(inspection.HostConfig.SecurityOpt).toContain("no-new-privileges");
+        });
+        it("drops all capabilities", async () => {
+            const { stdout } = await execAsync(`docker create --cap-drop=ALL alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.CapDrop).toContain("ALL");
+        });
+        it("sets memory limits", async () => {
+            const memoryLimit = 512 * 1024 * 1024; // 512MB
+            const { stdout } = await execAsync(`docker create --memory=${memoryLimit} alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.Memory).toBe(memoryLimit);
+        });
+        it("sets user to non-root", async () => {
+            const { stdout } = await execAsync(`docker create --user=1000:1000 alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.Config.User).toBe("1000:1000");
+        });
+        it("applies network mode", async () => {
+            const { stdout } = await execAsync(`docker create --network=bridge alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.NetworkMode).toBe("bridge");
+        });
+        it("mounts with read-only flag when specified", async () => {
+            await mkdir(join(tempDir, "data"), { recursive: true });
+            const { stdout } = await execAsync(`docker create -v ${tempDir}/data:/data:ro alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            const dataMount = inspection.Mounts.find((m) => m.Destination === "/data");
+            expect(dataMount?.RW).toBe(false);
+        });
+        it("sets AutoRemove when ephemeral is true", async () => {
+            const { stdout } = await execAsync(`docker create --rm alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.AutoRemove).toBe(true);
+        });
+        it("does not set AutoRemove when ephemeral is false", async () => {
+            const { stdout } = await execAsync(`docker create alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.AutoRemove).toBe(false);
+        });
+        it("sets memory and swap limit to same value (no swap)", async () => {
+            const memoryLimit = 1024 * 1024 * 1024; // 1GB
+            const { stdout } = await execAsync(`docker create --memory=${memoryLimit} --memory-swap=${memoryLimit} alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.Memory).toBe(memoryLimit);
+            expect(inspection.HostConfig.MemorySwap).toBe(memoryLimit);
+        });
+        it("sets CPU shares for resource limits", async () => {
+            const cpuShares = 512;
+            const { stdout } = await execAsync(`docker create --cpu-shares=${cpuShares} alpine:latest sleep 1`);
+            const containerId = stdout.trim();
+            containers.push(containerId);
+            const inspection = await inspectContainer(containerId);
+            expect(inspection.HostConfig.CpuShares).toBe(cpuShares);
+        });
+    });
+});
+// =============================================================================
+// Docker Config Resolution Tests (don't need Docker running)
+// =============================================================================
+describe("Docker Config Security Defaults", () => {
+    it("defaults to bridge network (not none)", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.network).toBe("bridge");
+    });
+    it("defaults to 2GB memory", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.memoryBytes).toBe(2 * 1024 * 1024 * 1024);
+    });
+    it("defaults to host user UID:GID", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.user).toMatch(/^\d+:\d+$/);
+    });
+    it("defaults workspace to read-write", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.workspaceMode).toBe("rw");
+    });
+    it("defaults ephemeral to true", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.ephemeral).toBe(true);
+    });
+    it("defaults max_containers to 5", () => {
+        const config = resolveDockerConfig({ enabled: true });
+        expect(config.maxContainers).toBe(5);
+    });
+    it("allows custom network mode", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            network: "host",
+        });
+        expect(config.network).toBe("host");
+    });
+    it("allows custom memory limit", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            memory: "512m",
+        });
+        expect(config.memoryBytes).toBe(512 * 1024 * 1024);
+    });
+    it("allows custom user", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            user: "1001:1001",
+        });
+        expect(config.user).toBe("1001:1001");
+    });
+    it("allows custom workspace mode", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            workspace_mode: "ro",
+        });
+        expect(config.workspaceMode).toBe("ro");
+    });
+    it("allows ephemeral mode", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            ephemeral: true,
+        });
+        expect(config.ephemeral).toBe(true);
+    });
+    it("allows custom max_containers", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            max_containers: 10,
+        });
+        expect(config.maxContainers).toBe(10);
+    });
+    it("parses additional volumes correctly", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            volumes: ["/host/path:/container/path:ro"],
+        });
+        expect(config.volumes).toHaveLength(1);
+        expect(config.volumes[0].hostPath).toBe("/host/path");
+        expect(config.volumes[0].containerPath).toBe("/container/path");
+        expect(config.volumes[0].mode).toBe("ro");
+    });
+    it("uses base_image if image not specified", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            base_image: "custom:latest",
+        });
+        expect(config.image).toBe("custom:latest");
+    });
+    it("prefers image over base_image", () => {
+        const config = resolveDockerConfig({
+            enabled: true,
+            image: "specific:latest",
+            base_image: "fallback:latest",
+        });
+        expect(config.image).toBe("specific:latest");
+    });
+});
+//# sourceMappingURL=docker-security.test.js.map

package/dist/runner/runtime/__tests__/docker-security.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-security.test.js","sourceRoot":"","sources":["../../../../src/runner/runtime/__tests__/docker-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,cAAc,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAEnE,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,KAAK,UAAU,aAAa;IAC1B,MAAM,OAAO,GAAG,IAAI,CAClB,MAAM,EAAE,EACR,uBAAuB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC3E,CAAC;IACF,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,YAAoC,EAAE;IAC7D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,qBAAqB;QACjC,iBAAiB,EAAE,oBAAoB;QACvC,GAAG,SAAS;KACI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAAmB;IAChD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,cAAc,CAAC,2BAA2B,EAAE,GAAG,EAAE;IAC/C,IAAI,OAAe,CAAC;IACpB,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,sBAAsB;QACtB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtB,oBAAoB;QACpB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,aAAa,KAAK,YAAY,CACjC,CAAC;YACF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,aAAa,KAAK,YAAY,CACjC,CAAC;YACF,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CACxE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,uFAAuF;YACvF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,aAAa,KAAK,0CAA0C,CAC/D,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,gBAAgB,CAAC;aAC5B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,iBAAiB,EAAE,oBAAoB;aACxC,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,aAAa,KAAK,YAAY,CACjC,CAAC;YACF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,iBAAiB,EAAE;oBACjB,IAAI,EAAE,oBAAoB;oBAC1B,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,CAAC;oBACd,cAAc,EAAE,MAAM;iBACvB;aACF,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAElE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,aAAa,KAAK,YAAY,CACjC,CAAC;YACF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,cAAc,CAAC;YAE/C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;YAExD,UAAU;YACV,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,WAAW,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAErC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YAElC,UAAU;YACV,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,WAAW,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,YAAY,EAAE,aAAa;oBAC3B,UAAU,EAAE,cAAc;iBAC3B;aACF,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAEnD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAErC,sCAAsC;YACtC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,iDAAiD;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,sEAAsE,CACvE,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,sCAAsC;YACtC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,oDAAoD,CACrD,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;YAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,0BAA0B,WAAW,wBAAwB,CAC9D,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,sDAAsD,CACvD,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,sDAAsD,CACvD,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAExD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,oBAAoB,OAAO,sCAAsC,CAClE,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CACtC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CACtC,CAAC;YACF,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,0CAA0C,CAC3C,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,qCAAqC,CACtC,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,WAAW,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;YAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,0BAA0B,WAAW,kBAAkB,WAAW,wBAAwB,CAC3F,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,SAAS,GAAG,GAAG,CAAC;YACtB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,8BAA8B,SAAS,wBAAwB,CAChE,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,6DAA6D;AAC7D,gFAAgF;AAEhF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,+BAA+B,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,eAAe;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,iBAAiB;YACxB,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runner/runtime/__tests__/factory.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=factory.test.d.ts.map

package/dist/runner/runtime/__tests__/factory.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.test.d.ts","sourceRoot":"","sources":["../../../../src/runner/runtime/__tests__/factory.test.ts"],"names":[],"mappings":""}

package/dist/runner/runtime/__tests__/factory.test.js

@@ -0,0 +1,149 @@
+import { describe, it, expect } from "vitest";
+import { RuntimeFactory } from "../factory.js";
+// =============================================================================
+// Test Helpers
+// =============================================================================
+function createTestAgent(overrides = {}) {
+    return {
+        name: "test-agent",
+        configPath: "/path/to/agent.yaml",
+        ...overrides,
+    };
+}
+// =============================================================================
+// RuntimeFactory Tests
+// =============================================================================
+describe("RuntimeFactory", () => {
+    describe("runtime type selection", () => {
+        it("defaults to SDK runtime when runtime not specified", () => {
+            const agent = createTestAgent();
+            const runtime = RuntimeFactory.create(agent);
+            // Verify it's SDKRuntime by checking constructor name
+            expect(runtime.constructor.name).toBe("SDKRuntime");
+        });
+        it("creates SDK runtime for runtime: sdk", () => {
+            const agent = createTestAgent({ runtime: "sdk" });
+            const runtime = RuntimeFactory.create(agent);
+            expect(runtime.constructor.name).toBe("SDKRuntime");
+        });
+        it("creates CLI runtime for runtime: cli", () => {
+            const agent = createTestAgent({ runtime: "cli" });
+            const runtime = RuntimeFactory.create(agent);
+            expect(runtime.constructor.name).toBe("CLIRuntime");
+        });
+        it("throws for unknown runtime type", () => {
+            const agent = createTestAgent({ runtime: "unknown" });
+            expect(() => RuntimeFactory.create(agent)).toThrow("Unknown runtime type: unknown");
+            expect(() => RuntimeFactory.create(agent)).toThrow("Supported types: 'sdk' (default), 'cli'");
+        });
+    });
+    describe("Docker wrapping", () => {
+        it("returns base runtime when docker not enabled", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: { enabled: false },
+            });
+            const runtime = RuntimeFactory.create(agent);
+            // Should be SDKRuntime, not ContainerRunner
+            expect(runtime.constructor.name).toBe("SDKRuntime");
+        });
+        it("returns base runtime when docker undefined", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                // No docker config at all
+            });
+            const runtime = RuntimeFactory.create(agent);
+            expect(runtime.constructor.name).toBe("SDKRuntime");
+        });
+        it("wraps with ContainerRunner when docker.enabled is true", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: { enabled: true },
+            });
+            const runtime = RuntimeFactory.create(agent, {
+                stateDir: "/test/.herdctl",
+            });
+            // Should be wrapped with ContainerRunner
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+        });
+        it("passes stateDir to ContainerRunner", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: { enabled: true },
+            });
+            const customStateDir = "/custom/state/dir";
+            const runtime = RuntimeFactory.create(agent, {
+                stateDir: customStateDir,
+            });
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+            // ContainerRunner has a stateDir property we can check
+            expect(runtime.stateDir).toBe(customStateDir);
+        });
+        it("uses default stateDir when not provided", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: { enabled: true },
+            });
+            const runtime = RuntimeFactory.create(agent);
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+            // Default should be {cwd}/.herdctl
+            const expectedDefault = process.cwd() + "/.herdctl";
+            expect(runtime.stateDir).toBe(expectedDefault);
+        });
+    });
+    describe("combined scenarios", () => {
+        it("wraps SDK with Docker", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: { enabled: true },
+            });
+            const runtime = RuntimeFactory.create(agent, {
+                stateDir: "/test/.herdctl",
+            });
+            // Should be wrapped with ContainerRunner
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+            // Has execute method from RuntimeInterface
+            expect(typeof runtime.execute).toBe("function");
+        });
+        it("wraps CLI with Docker", () => {
+            const agent = createTestAgent({
+                runtime: "cli",
+                docker: { enabled: true },
+            });
+            const runtime = RuntimeFactory.create(agent, {
+                stateDir: "/test/.herdctl",
+            });
+            // Should be wrapped with ContainerRunner
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+            // Has execute method from RuntimeInterface
+            expect(typeof runtime.execute).toBe("function");
+        });
+        it("CLI without Docker is unwrapped", () => {
+            const agent = createTestAgent({
+                runtime: "cli",
+                docker: { enabled: false },
+            });
+            const runtime = RuntimeFactory.create(agent);
+            expect(runtime.constructor.name).toBe("CLIRuntime");
+        });
+        it("handles complex Docker config", () => {
+            const agent = createTestAgent({
+                runtime: "sdk",
+                docker: {
+                    enabled: true,
+                    image: "custom:latest",
+                    network: "none",
+                    memory: "4g",
+                    ephemeral: true,
+                },
+            });
+            const runtime = RuntimeFactory.create(agent, {
+                stateDir: "/test/.herdctl",
+            });
+            // Verify it creates ContainerRunner (config is private, we can't test it directly)
+            expect(runtime.constructor.name).toBe("ContainerRunner");
+            expect(typeof runtime.execute).toBe("function");
+        });
+    });
+});
+//# sourceMappingURL=factory.test.js.map

package/dist/runner/runtime/__tests__/factory.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.test.js","sourceRoot":"","sources":["../../../../src/runner/runtime/__tests__/factory.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/C,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,SAAS,eAAe,CAAC,YAAoC,EAAE;IAC7D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,qBAAqB;QACjC,GAAG,SAAS;KACI,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,sDAAsD;YACtD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,SAAgB,EAAE,CAAC,CAAC;YAE7D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAChD,+BAA+B,CAChC,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAChD,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAS;aAClC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,0BAA0B;aAC3B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAS;aACjC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3C,QAAQ,EAAE,gBAAgB;aAC3B,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAS;aACjC,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,mBAAmB,CAAC;YAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3C,QAAQ,EAAE,cAAc;aACzB,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzD,uDAAuD;YACvD,MAAM,CAAE,OAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAS;aACjC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzD,mCAAmC;YACnC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACpD,MAAM,CAAE,OAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAS;aACjC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3C,QAAQ,EAAE,gBAAgB;aAC3B,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzD,2CAA2C;YAC3C,MAAM,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAS;aACjC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3C,QAAQ,EAAE,gBAAgB;aAC3B,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzD,2CAA2C;YAC3C,MAAM,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAS;aAClC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE;oBACN,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,MAAM;oBACf,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,IAAI;iBACT;aACT,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC3C,QAAQ,EAAE,gBAAgB;aAC3B,CAAC,CAAC;YAEH,mFAAmF;YACnF,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runner/runtime/__tests__/integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=integration.test.d.ts.map

package/dist/runner/runtime/__tests__/integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.d.ts","sourceRoot":"","sources":["../../../../src/runner/runtime/__tests__/integration.test.ts"],"names":[],"mappings":""}