@paperclipai/server 2026.817.0 → 2026.818.0-beta.1

package/dist/services/workspace-runtime-exposure.test.js

@@ -0,0 +1,517 @@
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { diagnoseRuntimeListenerBinds } from "./runtime-exposure/loopback-listener.js";
+import { resetRuntimeServicesForTests, setWorkspaceRuntimeExposureDepsForTests, startRuntimeServicesForWorkspaceControl, stopRuntimeServicesForExecutionWorkspace, } from "./workspace-runtime.js";
+const EXECUTION_WORKSPACE_ID = "11111111-2222-4333-8444-555566667777";
+const HANDLE = "handle-abcdef1234567890";
+// The shared test setup pins the automatic default off so unrelated suites do
+// not probe for a real host broker. This suite is about the default, so it opts
+// back in and restores the harness value afterwards.
+let previousHttpsMode;
+beforeEach(() => {
+    previousHttpsMode = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+    process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "auto";
+});
+afterEach(async () => {
+    if (previousHttpsMode === undefined)
+        delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+    else
+        process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = previousHttpsMode;
+    // These tests spawn real loopback backends on dedicated-range ports; reap them
+    // rather than leaving one squatting 42xxx/52xxx for every test in the file.
+    await resetRuntimeServicesForTests({ terminateProcesses: true });
+});
+function serviceCommand() {
+    return `node -e 'const http=require("http");const p=Number(process.env.PORT);for(const q of [p,p+10000])http.createServer((_,r)=>{r.statusCode=200;r.end("ok")}).listen(q,"127.0.0.1");setInterval(()=>{},1000)'`;
+}
+/**
+ * Fake guest dev runners written to disk (PAP-17256).
+ *
+ * They must be real files named `dev-runner*.mjs` for two reasons: the command
+ * has to look like a dev-runner invocation for the rewrite to apply at all, and
+ * `node <file> --bind lan` hands the flags to the script, which is exactly how a
+ * real `pnpm dev --bind lan` reaches `scripts/dev-runner.ts`.
+ */
+let guestDir;
+/**
+ * A guest checkout from *before* managed HTTPS exposure existed.
+ *
+ * Reproduces the behaviour that actually broke the lanes: `scripts/dev-runner.ts`
+ * on plain master derives its bind mode from its own `--bind` / `--bind-host`
+ * argv and **ignores `PAPERCLIP_BIND` / `PAPERCLIP_MANAGED_RUNTIME_EXPOSURE`
+ * entirely** — so env-only hardening cannot reach it. `--bind lan` therefore
+ * means `0.0.0.0`, which the broker must refuse.
+ */
+const PRE_MANAGED_EXPOSURE_GUEST = `
+import http from "node:http";
+const argv = process.argv.slice(2);
+const valueOf = (flag) => {
+  const at = argv.indexOf(flag);
+  const value = at >= 0 ? argv[at + 1] : undefined;
+  return value && !value.startsWith("--") ? value : undefined;
+};
+const mode = valueOf("--bind") ?? "loopback";
+const host = mode === "custom" ? (valueOf("--bind-host") ?? "127.0.0.1")
+  : mode === "lan" ? "0.0.0.0"
+  : "127.0.0.1";
+const p = Number(process.env.PORT);
+for (const q of [p, p + 10000]) {
+  http.createServer((_, r) => { r.statusCode = 200; r.end("ok"); }).listen(q, host);
+}
+setInterval(() => {}, 1000);
+`;
+/**
+ * The true shape of the deployed failure: a guest that honours the bind argv for
+ * its own HTTP listener but whose Vite gets `hmr.port` with no `hmr.server` and
+ * no `server.host`, so Vite opens its *own* HMR websocket on the IPv6 wildcard
+ * regardless of the bind mode. Plain master's `server/src/app.ts` does exactly
+ * this, which is why forcing the bind is necessary but not sufficient there.
+ */
+const WILDCARD_HMR_GUEST = `
+import http from "node:http";
+const argv = process.argv.slice(2);
+const at = argv.indexOf("--bind-host");
+const host = at >= 0 ? argv[at + 1] : "127.0.0.1";
+const p = Number(process.env.PORT);
+http.createServer((_, r) => { r.statusCode = 200; r.end("ok"); }).listen(p, host);
+// No host argument: Vite's own HMR listener lands on the wildcard.
+http.createServer((_, r) => { r.statusCode = 426; r.end(); }).listen(p + 10000);
+setInterval(() => {}, 1000);
+`;
+/** A guest so old it has no bind flags at all and always binds the wildcard. */
+const ALWAYS_WILDCARD_GUEST = `
+import http from "node:http";
+const p = Number(process.env.PORT);
+for (const q of [p, p + 10000]) {
+  http.createServer((_, r) => { r.statusCode = 200; r.end("ok"); }).listen(q, "0.0.0.0");
+}
+setInterval(() => {}, 1000);
+`;
+beforeAll(async () => {
+    guestDir = await fs.mkdtemp(path.join(os.tmpdir(), "pap-17256-guest-"));
+    await fs.writeFile(path.join(guestDir, "dev-runner.mjs"), PRE_MANAGED_EXPOSURE_GUEST);
+    await fs.writeFile(path.join(guestDir, "dev-runner-legacy.mjs"), ALWAYS_WILDCARD_GUEST);
+    await fs.writeFile(path.join(guestDir, "dev-runner-wildcard-hmr.mjs"), WILDCARD_HMR_GUEST);
+});
+afterAll(async () => {
+    await fs.rm(guestDir, { recursive: true, force: true });
+});
+const guestCommand = (file) => `node ${path.join(guestDir, file)}`;
+function createBroker() {
+    const calls = [];
+    let listeners = [];
+    const broker = {
+        async reserve(_runtimeId, requested) {
+            calls.push("reserve");
+            listeners = requested;
+            return { handle: HANDLE, reservedPorts: requested.map((listener) => listener.port) };
+        },
+        async expose() {
+            calls.push("expose");
+            return { handle: HANDLE, publicPorts: listeners.map((listener) => listener.port) };
+        },
+        async remove() {
+            calls.push("remove");
+            return { removedPorts: listeners.map((listener) => listener.port) };
+        },
+        async list() {
+            return [];
+        },
+    };
+    return { broker, calls };
+}
+/**
+ * A real loopback bind probe, matching production's `isLoopbackPortAvailable`.
+ *
+ * The default used to be `async () => true`, which claimed every port in the
+ * dedicated range was free. On a developer or canary host that already runs a
+ * managed lane on `42000`, that lie made the suite allocate a port something
+ * else was listening on — so the spawned guest could not bind, and every
+ * assertion downstream failed for a reason that had nothing to do with the
+ * behaviour under test. It also meant the suite exercised allocation against a
+ * range it never actually checked (PAP-17419; PAP-17255 started this with
+ * "make exposure fixture honor occupied ports").
+ */
+async function isLoopbackPortFree(port) {
+    return await new Promise((resolve) => {
+        const probe = net.createServer();
+        probe.unref();
+        probe.once("error", () => resolve(false));
+        probe.listen(port, "127.0.0.1", () => {
+            probe.close(() => resolve(true));
+        });
+    });
+}
+function installDeps(overrides) {
+    setWorkspaceRuntimeExposureDepsForTests({
+        broker: overrides.broker,
+        isPortAvailable: overrides.isPortAvailable ?? isLoopbackPortFree,
+        isBrokerAvailable: overrides.isBrokerAvailable ?? (async () => true),
+        resolveHostname: overrides.resolveHostname ?? (async () => "runner.tail123.ts.net"),
+        probeHealth: overrides.probeHealth ?? (async () => true),
+        now: () => "2026-08-11T00:00:00.000Z",
+        // The real /proc-backed diagnosis, not a fake: the fake broker below always
+        // says yes, so this is what has to catch an off-loopback bind here.
+        diagnoseListenerBinds: overrides.diagnoseListenerBinds ?? diagnoseRuntimeListenerBinds,
+    });
+}
+const DECLARED_EXPOSE = {
+    type: "tailscale_https",
+    hostname: "auto",
+    publicPort: "same",
+    includePaperclipViteHmr: true,
+    failurePolicy: "fail_closed",
+};
+/**
+ * The pre-feature Paperclip App project template, verbatim: a hard-coded HTTP
+ * `urlTemplate`, a pinned port outside the broker's dedicated range, and no
+ * exposure declaration at all.
+ */
+const LEGACY_HTTP_EXPOSE = {
+    type: "url",
+    urlTemplate: "http://paperclip-dev:{{port}}",
+};
+function startInput(options) {
+    const expose = options?.expose === undefined ? DECLARED_EXPOSE : options.expose;
+    return {
+        invocationId: "runtime-exposure-test",
+        actor: { id: null, name: "Paperclip", companyId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee" },
+        issue: null,
+        workspace: {
+            baseCwd: process.cwd(),
+            source: "project_primary",
+            projectId: null,
+            workspaceId: null,
+            repoUrl: null,
+            repoRef: null,
+            strategy: "project_primary",
+            cwd: process.cwd(),
+            branchName: "test",
+            worktreePath: null,
+            warnings: [],
+            created: false,
+        },
+        executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+        config: {
+            workspaceRuntime: {
+                services: [{
+                        name: options?.serviceName ?? "preview",
+                        command: options?.command ?? serviceCommand(),
+                        port: options?.port ?? { type: "auto", envKey: "PORT" },
+                        readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 5 },
+                        ...(expose ? { expose } : {}),
+                    }],
+            },
+        },
+        adapterEnv: {},
+    };
+}
+describe("workspace runtime tailscale_https lifecycle", () => {
+    it("reserves before spawn, exposes after backend readiness, and removes on stop", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput());
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        expect(runtime.port).toBeGreaterThanOrEqual(42000);
+        expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+        expect(runtime.exposure?.state).toBe("ready");
+        await stopRuntimeServicesForExecutionWorkspace({
+            executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+            runtimeServiceId: runtime.id,
+        });
+        expect(calls).toEqual(["reserve", "expose", "remove"]);
+    }, 15_000);
+    it("fails closed and removes the mapping when external HTTPS validation fails", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker, probeHealth: async () => false });
+        await expect(startRuntimeServicesForWorkspaceControl(startInput())).rejects.toThrow(/HTTPS exposure failed/);
+        expect(calls).toEqual(["reserve", "expose", "remove"]);
+    }, 15_000);
+});
+describe("automatic tailscale_https default for managed worktree runtimes", () => {
+    it("defaults a legacy paperclip-dev service with no exposure block, relocating its pinned port", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        // Exactly the persisted pre-feature shape: pinned 45439 + HTTP urlTemplate.
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: 45_439,
+        }));
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        // 45439 is outside the broker allowlist, so the pinned port cannot be kept.
+        expect(runtime.port).not.toBe(45_439);
+        expect(runtime.port).toBeGreaterThanOrEqual(42_000);
+        expect(runtime.port).toBeLessThanOrEqual(42_999);
+        // The canonical URL is the verified HTTPS origin; HTTP is never retained.
+        expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+        expect(runtime.url).not.toContain("http://");
+        expect(runtime.exposure?.state).toBe("ready");
+    }, 15_000);
+    it("keeps an existing runtime port that is already inside the dedicated range", async () => {
+        const { broker } = createBroker();
+        installDeps({ broker });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: 42_500,
+        }));
+        expect(runtime.port).toBe(42_500);
+        expect(runtime.url).toBe("https://runner.tail123.ts.net:42500");
+    }, 15_000);
+    it("preserves a deliberate opt-out and leaves the service on plain HTTP", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: { ...LEGACY_HTTP_EXPOSE, tailscaleHttps: false },
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        expect(calls).toEqual([]);
+        expect(runtime.exposure ?? null).toBeNull();
+        expect(runtime.url).toBe(`http://paperclip-dev:${runtime.port}`);
+    }, 15_000);
+    it("leaves an unmanaged/custom service untouched", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "preview",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        expect(calls).toEqual([]);
+        expect(runtime.exposure ?? null).toBeNull();
+        expect(runtime.url).toBe(`http://paperclip-dev:${runtime.port}`);
+    }, 15_000);
+    it("does not default when the host broker is unavailable", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker, isBrokerAvailable: async () => false });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        expect(calls).toEqual([]);
+        expect(runtime.exposure ?? null).toBeNull();
+    }, 15_000);
+    it("still honors an explicit opt-in when the broker socket is missing, failing loudly", async () => {
+        // A missing broker must never silently downgrade a requested HTTPS preview.
+        const { broker, calls } = createBroker();
+        const failing = {
+            ...broker,
+            async reserve() {
+                calls.push("reserve");
+                throw new Error("ENOENT: broker socket missing");
+            },
+        };
+        installDeps({ broker: failing, isBrokerAvailable: async () => false });
+        await expect(startRuntimeServicesForWorkspaceControl(startInput({ serviceName: "paperclip-dev" }))).rejects.toThrow();
+        expect(calls).toEqual(["reserve"]);
+    }, 15_000);
+    it("is idempotent across repeated starts: the same port pair is reserved again", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const [first] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: 45_439,
+        }));
+        const firstPort = first.port;
+        await stopRuntimeServicesForExecutionWorkspace({
+            executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+            runtimeServiceId: first.id,
+        });
+        calls.length = 0;
+        const [second] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            expose: LEGACY_HTTP_EXPOSE,
+            port: 45_439,
+        }));
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        expect(second.port).toBe(firstPort);
+        expect(second.url).toBe(`https://runner.tail123.ts.net:${firstPort}`);
+    }, 25_000);
+    it("releases the in-flight pair claim when hostname resolution fails, so a retry storm cannot exhaust the range", async () => {
+        // The reservation keeps the winning pair's in-process claim on purpose, for
+        // the caller to release on stop/teardown. A hostname failure throws before any
+        // runtime record exists, so that teardown can never run for this pair — and
+        // removing only the broker reservation would leave the claim held. Each retry
+        // would then burn another pair and the lane would report the range exhausted
+        // rather than the real cause, a Tailscale outage.
+        const reservedAppPorts = [];
+        const broker = {
+            async reserve(_runtimeId, requested) {
+                reservedAppPorts.push(requested[0].port);
+                return { handle: HANDLE, reservedPorts: requested.map((listener) => listener.port) };
+            },
+            async expose() {
+                return { handle: HANDLE, publicPorts: [] };
+            },
+            async remove() {
+                return { removedPorts: [] };
+            },
+            async list() {
+                return [];
+            },
+        };
+        installDeps({
+            broker,
+            resolveHostname: async () => {
+                throw new Error("MagicDNS unavailable");
+            },
+        });
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            await expect(startRuntimeServicesForWorkspaceControl(startInput({ serviceName: "paperclip-dev" }))).rejects.toThrow(/MagicDNS hostname unavailable/);
+        }
+        // Every attempt reserved the same pair. A leaked claim would push each retry
+        // onto a fresh pair instead.
+        expect(reservedAppPorts).toHaveLength(3);
+        expect(new Set(reservedAppPorts).size).toBe(1);
+    }, 25_000);
+});
+/**
+ * PAP-17256: the deployed regression. A fresh managed lane on service index 0
+ * failed every start with `listener_ownership_mismatch` because the branch
+ * checkout it launched bound `0.0.0.0`, and the server only asked for loopback
+ * via env vars that checkout never read.
+ */
+describe("loopback bind is forced on the guest, not merely requested (PAP-17256)", () => {
+    it("starts a fresh service-index-0 lane whose guest only honours argv", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            // Verbatim the command every failing lane recorded, modulo the fake guest.
+            command: `${guestCommand("dev-runner.mjs")} --bind lan`,
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        // The launched command carries the loopback bind, replacing `--bind lan`.
+        expect(runtime.command).toContain("--bind custom --bind-host 127.0.0.1");
+        expect(runtime.command).not.toContain("--bind lan");
+        // And because the guest honoured it, both listeners are loopback-only, so
+        // the exposure completes instead of being denied.
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        expect(runtime.exposure?.state).toBe("ready");
+        expect(runtime.exposure?.lastError ?? null).toBeNull();
+        expect(runtime.port).toBeGreaterThanOrEqual(42_000);
+        expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+        // Independent confirmation on the live listeners, using the same /proc read
+        // the broker's gate performs.
+        const hmrPort = runtime.port + 10_000;
+        expect(await diagnoseRuntimeListenerBinds([runtime.port, hmrPort])).toBeNull();
+        await stopRuntimeServicesForExecutionWorkspace({
+            executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+            runtimeServiceId: runtime.id,
+        });
+        expect(calls).toEqual(["reserve", "expose", "remove"]);
+    }, 20_000);
+    it("reaches a terminal failure naming the port and address when a guest still binds the wildcard", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        // A guest with no bind flags at all: the argv rewrite cannot reach it, so
+        // this is the residual case that must fail loudly rather than expose.
+        await expect(startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            command: guestCommand("dev-runner-legacy.mjs"),
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        }))).rejects.toThrow(/listener_ownership_mismatch.*(?:0\.0\.0\.0|::)/s);
+        // Terminal recovery: the reservation is released and nothing was exposed.
+        // The diagnosis runs before the broker, so `expose` is never attempted.
+        expect(calls).toEqual(["reserve", "remove"]);
+    }, 20_000);
+    it("explains rather than only coding the failure, so the next operator can act", async () => {
+        const { broker } = createBroker();
+        installDeps({ broker });
+        const error = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            command: guestCommand("dev-runner-legacy.mjs"),
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        })).then(() => null, (err) => err);
+        expect(error).not.toBeNull();
+        // The bare code alone is what cost PAP-17254 three diagnostic cycles.
+        expect(error.message).toContain("listener_ownership_mismatch");
+        expect(error.message).toContain("loopback");
+        expect(error.message).toContain("--bind custom --bind-host 127.0.0.1");
+    }, 20_000);
+    it("leaves a non-Paperclip service's --bind argument alone", async () => {
+        // `--bind` means something entirely different to the HTTPS probe canaries
+        // (`python3 -m http.server --bind 127.0.0.1`); rewriting it would break them.
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const declared = `${serviceCommand()} -- --bind 127.0.0.1`;
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "https-probe-canary",
+            command: declared,
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        expect(runtime.command).toBe(declared);
+        expect(runtime.command).not.toContain("--bind custom");
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        expect(runtime.exposure?.state).toBe("ready");
+    }, 20_000);
+    it("does not rewrite a Paperclip dev command when the service is not exposed", async () => {
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const declared = `${guestCommand("dev-runner.mjs")} --bind lan`;
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            command: declared,
+            expose: { ...LEGACY_HTTP_EXPOSE, tailscaleHttps: false },
+            port: { type: "auto", envKey: "PORT" },
+        }));
+        expect(calls).toEqual([]);
+        expect(runtime.command).toBe(declared);
+    }, 20_000);
+});
+describe("readiness probes loopback for an exposed runtime (PAP-17256)", () => {
+    it("starts even when the only readiness target is the MagicDNS display URL", async () => {
+        // The live project config declares a loopback readiness URL, but when it does
+        // not, readiness falls back to `expose.urlTemplate` — a MagicDNS name that
+        // resolves off-loopback. That only ever answered because the guest was bound
+        // to the wildcard, so it must be normalised alongside the bind fix.
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const input = startInput({
+            serviceName: "paperclip-dev",
+            command: `${guestCommand("dev-runner.mjs")} --bind lan`,
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        });
+        // Drop the explicit loopback readiness URL so the fallback path is exercised.
+        const service = input.config.workspaceRuntime.services[0];
+        service.readiness = { type: "http", timeoutSec: 10, intervalMs: 100 };
+        const [runtime] = await startRuntimeServicesForWorkspaceControl(input);
+        expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+        expect(runtime.exposure?.state).toBe("ready");
+        expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+    }, 20_000);
+});
+describe("the deployed failure shape: loopback app port, wildcard HMR (PAP-17256)", () => {
+    it("fails terminally naming the HMR port, because forcing the bind cannot reach Vite's own listener", async () => {
+        // Plain master's app.ts passes Vite `hmr.port` without `hmr.server` or
+        // `server.host`, so the HMR websocket binds `::` no matter what the bind mode
+        // is. The argv rewrite fixes the app port; only the preflight catches this.
+        const { broker, calls } = createBroker();
+        installDeps({ broker });
+        const error = await startRuntimeServicesForWorkspaceControl(startInput({
+            serviceName: "paperclip-dev",
+            command: `${guestCommand("dev-runner-wildcard-hmr.mjs")} --bind lan`,
+            expose: LEGACY_HTTP_EXPOSE,
+            port: { type: "auto", envKey: "PORT" },
+        })).then(() => null, (err) => err);
+        expect(error).not.toBeNull();
+        expect(error.message).toContain("listener_ownership_mismatch");
+        // The app port obeyed the forced bind; the HMR companion is the offender, and
+        // the diagnosis has to say so rather than blaming the lane as a whole.
+        expect(error.message).toMatch(/port 5\d{4} is bound to/);
+        expect(error.message).not.toMatch(/port 4\d{4} is bound to/);
+        expect(calls).toEqual(["reserve", "remove"]);
+    }, 20_000);
+});
+//# sourceMappingURL=workspace-runtime-exposure.test.js.map

package/dist/services/workspace-runtime-exposure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-runtime-exposure.test.js","sourceRoot":"","sources":["../../src/services/workspace-runtime-exposure.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG1F,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC,8EAA8E;AAC9E,gFAAgF;AAChF,qDAAqD;AACrD,IAAI,iBAAqC,CAAC;AAC1C,UAAU,CAAC,GAAG,EAAE;IACd,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,MAAM,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;;QACnF,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,iBAAiB,CAAC;IACrE,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,4BAA4B,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,SAAS,cAAc;IACrB,OAAO,0MAA0M,CAAC;AACpN,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,QAAgB,CAAC;AAErB;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;CAiBlC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;;;;;;;;;;CAU1B,CAAC;AAEF,gFAAgF;AAChF,MAAM,qBAAqB,GAAG;;;;;;;CAO7B,CAAC;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACtF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACxF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;AAE3E,SAAS,YAAY;IACnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAA4B,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAiB;QAC3B,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS;YACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,SAAS,GAAG,SAAS,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,MAAM;YACV,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,MAAM;YACV,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACnC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,SAOpB;IACC,uCAAuC,CAAC;QACtC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,kBAAkB;QAChE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QACpE,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,uBAAuB,CAAC;QACnF,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QACxD,GAAG,EAAE,GAAG,EAAE,CAAC,0BAA0B;QACrC,4EAA4E;QAC5E,oEAAoE;QACpE,qBAAqB,EAAE,SAAS,CAAC,qBAAqB,IAAI,4BAA4B;KACvF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,uBAAuB,EAAE,IAAI;IAC7B,aAAa,EAAE,aAAa;CACpB,CAAC;AAEX;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,+BAA+B;CACpC,CAAC;AAEX,SAAS,UAAU,CAAC,OAKnB;IACC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChF,OAAO;QACL,YAAY,EAAE,uBAAuB;QACrC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,sCAAsC,EAAE;QACzF,KAAK,EAAE,IAAI;QACX,SAAS,EAAE;YACT,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,iBAA0B;YAClC,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,iBAA0B;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;SACf;QACD,oBAAoB,EAAE,sBAAsB;QAC5C,MAAM,EAAE;YACN,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,CAAC;wBACT,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,SAAS;wBACvC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE;wBAC7C,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;wBACvD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,2BAA2B,EAAE,UAAU,EAAE,CAAC,EAAE;wBACpF,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9B,CAAC;aACH;SACF;QACD,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,wCAAwC,CAAC;YAC7C,oBAAoB,EAAE,sBAAsB;YAC5C,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAExD,MAAM,MAAM,CAAC,uCAAuC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC/E,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,4EAA4E;QAC5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,4EAA4E;QAC5E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjD,0EAA0E;QAC1E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAClC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAE9D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,4EAA4E;QAC5E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,GAAiB;YAC5B,GAAG,MAAM;YACT,KAAK,CAAC,OAAO;gBACX,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;QACF,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAEvE,MAAM,MAAM,CACV,uCAAuC,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CACtF,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACvE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC,CAAC;QACJ,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,MAAM,wCAAwC,CAAC;YAC7C,oBAAoB,EAAE,sBAAsB;YAC5C,gBAAgB,EAAE,KAAK,CAAC,EAAE;SAC3B,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAEjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACxE,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,8EAA8E;QAC9E,6EAA6E;QAC7E,kDAAkD;QAClD,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,MAAM,MAAM,GAAiB;YAC3B,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS;gBACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvF,CAAC;YACD,KAAK,CAAC,MAAM;gBACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAC7C,CAAC;YACD,KAAK,CAAC,MAAM;gBACV,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,IAAI;gBACR,OAAO,EAAE,CAAC;YACZ,CAAC;SACF,CAAC;QACF,WAAW,CAAC;YACV,MAAM;YACN,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;SACF,CAAC,CAAC;QAEH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,CACV,uCAAuC,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CACtF,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,6EAA6E;QAC7E,6BAA6B;QAC7B,MAAM,CAAC,gBAAgB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,2EAA2E;YAC3E,OAAO,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC,aAAa;YACvD,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,0EAA0E;QAC1E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAEpD,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,4EAA4E;QAC5E,8BAA8B;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAK,GAAG,MAAM,CAAC;QACvC,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAC,OAAO,CAAC,IAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEhF,MAAM,wCAAwC,CAAC;YAC7C,oBAAoB,EAAE,sBAAsB;YAC5C,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,MAAM,CAAC,uCAAuC,CAAC,UAAU,CAAC;YAC9D,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,YAAY,CAAC,uBAAuB,CAAC;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAExE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAClC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACrE,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,YAAY,CAAC,uBAAuB,CAAC;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAY,CAAC,CAAC;QAErD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,sEAAsE;QACtE,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC1E,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,GAAG,cAAc,EAAE,sBAAsB,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACzE,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,EAAE,GAAG,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC,aAAa;YACvD,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC;QACH,8EAA8E;QAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAA4B,CAAC;QACrF,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAEtE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,uCAAuC,CAAC,KAAK,CAAC,CAAC;QAEvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,uEAAuE;QACvE,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;QACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExB,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,UAAU,CAAC;YACrE,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,GAAG,YAAY,CAAC,6BAA6B,CAAC,aAAa;YACpE,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAY,CAAC,CAAC;QAErD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAChE,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/services/workspace-runtime-leases.d.ts

@@ -0,0 +1,90 @@
+import type { Db } from "@paperclipai/db";
+import { executionWorkspaceRuntimeLeases } from "@paperclipai/db";
+type ExecutionWorkspaceRuntimeLeaseRow = typeof executionWorkspaceRuntimeLeases.$inferSelect;
+/**
+ * Issue statuses that keep an issue eligible to drive workspace runtime controls.
+ * Shared with the runtime authorization path so "still authorized" and "still owns
+ * the lease" cannot drift apart.
+ */
+export declare const WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES: readonly string[];
+/** Runtime control actions that mutate the workspace and therefore need the lease. */
+export declare const LEASED_WORKSPACE_RUNTIME_ACTIONS: readonly string[];
+/**
+ * Upper bound on how long a lease survives without the owner touching it. Recovery
+ * from a stale owner is otherwise driven by owner eligibility, which is cheaper and
+ * more precise; the TTL only bounds the cases eligibility cannot see (for example an
+ * agent-scoped owner with no run or issue identity).
+ */
+export declare const WORKSPACE_RUNTIME_LEASE_TTL_MS: number;
+export type WorkspaceRuntimeLeaseOwner = {
+    actorType: string;
+    agentId?: string | null;
+    runId?: string | null;
+    issueId?: string | null;
+};
+export type WorkspaceRuntimeLeaseStaleReason = "lease_expired" | "owner_issue_missing" | "owner_issue_hidden" | "owner_issue_terminal" | "owner_run_missing" | "owner_run_terminal";
+export type WorkspaceRuntimeLeaseClaim = {
+    outcome: "created" | "renewed" | "reclaimed" | "bypassed";
+    ownerKey: string | null;
+    lease: ExecutionWorkspaceRuntimeLeaseRow | null;
+    reclaimedFrom: {
+        ownerKey: string;
+        reason: WorkspaceRuntimeLeaseStaleReason;
+    } | null;
+};
+/**
+ * Durable owner identity for a lease. The controlling issue is preferred because a
+ * canary lane outlives any single heartbeat run; runs and bare agent keys are only
+ * used when no issue is in scope.
+ */
+export declare function buildWorkspaceRuntimeLeaseOwnerKey(owner: WorkspaceRuntimeLeaseOwner): string | null;
+export declare function workspaceRuntimeLeaseService(db: Db): {
+    get(executionWorkspaceId: string): Promise<{
+        id: string;
+        companyId: string;
+        executionWorkspaceId: string;
+        ownerKey: string;
+        ownerIssueId: string | null;
+        ownerRunId: string | null;
+        ownerAgentId: string | null;
+        lastAction: string;
+        claimedAt: Date;
+        renewedAt: Date;
+        expiresAt: Date;
+        metadata: Record<string, unknown> | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    /**
+     * Atomically claim (or renew, or reclaim from a stale owner) the exclusive runtime
+     * lease for an execution workspace. Cross-process exclusivity comes from the unique
+     * constraint on execution_workspace_id plus a `SELECT ... FOR UPDATE` on the existing
+     * row, so competing claims serialize in the database rather than in one process.
+     *
+     * Board/operator actors bypass the lease entirely: they keep unconditional control
+     * and never take the lane away from an agent run.
+     */
+    claim(input: {
+        companyId: string;
+        executionWorkspaceId: string;
+        action: string;
+        owner: WorkspaceRuntimeLeaseOwner;
+        now?: Date;
+        ttlMs?: number;
+    }): Promise<WorkspaceRuntimeLeaseClaim>;
+    /**
+     * Give up the lane. `force` is for operator/lifecycle paths (workspace archive);
+     * owner-scoped releases only remove a lease the caller actually holds.
+     */
+    release(input: {
+        executionWorkspaceId: string;
+        owner?: WorkspaceRuntimeLeaseOwner;
+        force?: boolean;
+    }): Promise<{
+        released: boolean;
+        ownerKey: string | null;
+    }>;
+};
+export type WorkspaceRuntimeLeaseService = ReturnType<typeof workspaceRuntimeLeaseService>;
+export {};
+//# sourceMappingURL=workspace-runtime-leases.d.ts.map

package/dist/services/workspace-runtime-leases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-runtime-leases.d.ts","sourceRoot":"","sources":["../../src/services/workspace-runtime-leases.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,+BAA+B,EAAyB,MAAM,iBAAiB,CAAC;AAGzF,KAAK,iCAAiC,GAAG,OAAO,+BAA+B,CAAC,YAAY,CAAC;AAG7F;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,MAAM,EAMtE,CAAC;AAUF,sFAAsF;AACtF,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAAiC,CAAC;AAEhG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAiB,CAAC;AAE7D,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACxC,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,iCAAiC,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gCAAgC,CAAA;KAAE,GAAG,IAAI,CAAC;CACtF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAAG,IAAI,CAKnG;AA2ED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,EAAE;8BAEf,MAAM;;;;;;;;;;;;;;;;IAQtC;;;;;;;;OAQG;iBACgB;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,0BAA0B,CAAC;QAClC,GAAG,CAAC,EAAE,IAAI,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAiHvC;;;OAGG;mBACkB;QACnB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,CAAC,EAAE,0BAA0B,CAAC;QACnC,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;EAoB9D;AAED,MAAM,MAAM,4BAA4B,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC"}