@plurnk/plurnk-execs 0.4.30 → 0.4.31
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/SPEC.md +20 -0
- package/dist/discover.d.ts.map +1 -1
- package/dist/discover.js +14 -1
- package/dist/discover.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -0
- package/dist/index.js.map +1 -1
- package/dist/policy.d.ts +5 -0
- package/dist/policy.d.ts.map +1 -0
- package/dist/policy.js +42 -0
- package/dist/policy.js.map +1 -0
- package/dist/types.d.ts +1 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -57,16 +57,18 @@ Declare the two and a third-party tag gets the same self-documenting surface the
|
|
|
57
57
|
|
|
58
58
|
## Discovery & trust
|
|
59
59
|
|
|
60
|
-
`discover(options?)` scans **every installed package** under `<cwd>/node_modules` — scope-agnostic — for `plurnk.kind === "exec"`, returning `{ registry, skipped }`.
|
|
60
|
+
`discover(options?)` scans **every installed package** under `<cwd>/node_modules` — scope-agnostic — for `plurnk.kind === "exec"`, returning `{ registry, skipped, disabled }`.
|
|
61
61
|
|
|
62
62
|
- **Tag collisions are fail-hard.** Two packages claiming the same tag throws at discovery, naming both — deliberately stricter than plurnk-mimetypes' last-wins. A runtime tag is an executable dispatch key, so a third party silently shadowing `python` is exactly the failure we refuse to let ship quietly; the operator resolves it.
|
|
63
63
|
- **Trust gate.** `discover()` honors **`PLURNK_PLUGINS_TRUSTED_ONLY`** (host posture, plurnk-service#229): unset/`""`/`0` → every package registers (default, no regression); any value → `@plurnk/*` always trusted plus a comma-separated allowlist (`1` = first-party only). An untrusted package is discovered but **not** registered and returned in `Discovery.skipped` for the consumer to note — never a crash.
|
|
64
|
+
- **Runtime policy (enable/disable cascade).** `discover()` applies the operator kill-switch uniformly to every tag (SPEC §3.3): `PLURNK_EXECS_<TAG>=0` kills one tag, `PLURNK_EXECS_ONLY=a,b,c` is an allowlist (all else off). Disabled tags are **not** registered — returned in `Discovery.disabled`. It's purely subtractive, so it **cascades**: the consumer feeds a client-declared policy (same `PLURNK_EXECS_*` format) through `Policy.enabledAcross(tag, [serviceEnv, clientLayer])` and the client can only narrow — never re-enable what the service disabled. `disable all but search` → `PLURNK_EXECS_ONLY=search`.
|
|
64
65
|
|
|
65
66
|
## Exports
|
|
66
67
|
|
|
67
68
|
- `BaseExecutor` — abstract base: `channels`, `run(args)`, optional `probe()` / `effect(target)`.
|
|
68
69
|
- `SubprocessExecutor` — concrete base for subprocess runtimes; override `spawnArgs()` (and `binary`). Streaming + process-group abort + env scoping + exit code, inherited.
|
|
69
|
-
- `discover(options?)` — the scope-agnostic registry scan (trust-gated, fail-hard on collision).
|
|
70
|
+
- `discover(options?)` — the scope-agnostic registry scan (trust-gated + runtime-policy-gated, fail-hard on collision).
|
|
71
|
+
- `Policy` — the runtime enable/disable resolver (SPEC §3.3): `Policy.isEnabled(tag, env?)`, `Policy.enabledAcross(tag, layers)`. Same parser the daemon and the consumer's per-session client layer share.
|
|
70
72
|
- Contract types: `ExecArgs`, `ExecResult`, `ChannelDecl`, `ChannelState`, `ExecutorMetadata`, `RuntimeAvailability`, `Effect`, `ExecInfo`, `ExecRegistry`, `Discovery`, `DiscoverOptions`.
|
|
71
73
|
- `TelemetryEvent`, `ContentOffset`, `LogCoordinate` — the `emit` sink's payload (mirror of grammar's telemetry envelope).
|
|
72
74
|
- `resolveRuntime`, `isKnownRuntime`, `KNOWN_RUNTIMES`, `SpawnArgs`, `RuntimeResolver` — subprocess-family helper for the consumer's legacy spawn path (SPEC §4).
|
package/SPEC.md
CHANGED
|
@@ -192,6 +192,26 @@ The principle: *Active = the operator unambiguously committed this capability ON
|
|
|
192
192
|
|
|
193
193
|
Execs owns none of the overlay machinery — the live Active/Available state, the `/enable` `/disable` `/mcp` commands, and the gate enforcement are the consumer's (plurnk-service#240). Execs' contribution is the static signals above and (for the hotload route) an MCP executor that accepts a runtime-injected server config and re-checks `PLURNK_MCP_INSTALL` at its connect path (defense in depth).
|
|
194
194
|
|
|
195
|
+
### §3.3 Runtime policy (the enable/disable cascade)
|
|
196
|
+
|
|
197
|
+
A **registration** bound — a sibling of the §3 trust gate, **not** the §3.2 activation overlay. The trust gate bounds registration by *package*; the runtime policy bounds it by *tag*; `discover()` enforces both (the two operator gates on "what is registered for this daemon"). A policy-disabled tag is **absent** — not Active, not Available — so §3.2's "a client may freely activate any registered capability" still holds: the registered set is simply bounded per layer.
|
|
198
|
+
|
|
199
|
+
**Grammar** (the `PLURNK_EXECS_*` namespace, identical at every tier):
|
|
200
|
+
|
|
201
|
+
| Var | Effect |
|
|
202
|
+
|---|---|
|
|
203
|
+
| `PLURNK_EXECS_<TAG>=0` (or `false`) | surgical kill-switch for one tag |
|
|
204
|
+
| `PLURNK_EXECS_ONLY=a,b,c` | allowlist — a tag not listed is disabled |
|
|
205
|
+
|
|
206
|
+
The two compose within a layer (an allowlisted tag can still be individually killed). `ONLY` is reserved: a runtime tag may not be named `only`. Purely **subtractive** — there is no force-enable verb, by design.
|
|
207
|
+
|
|
208
|
+
**The cascade is an intersection.** A tag is live iff enabled in *every* layer: `enabled(tag) = service ∧ client ∧ …`. Because each layer only subtracts, order is irrelevant and no downstream layer can undo an upstream disable — **the client can never re-enable what the service disabled**, structurally, not by a policed rule.
|
|
209
|
+
|
|
210
|
+
- `discover()` applies the **daemon boot layer** (`process.env`) at registration, uniformly across every daughter (framework-guaranteed — a daughter cannot escape it, the way `-common`'s old local kill-switch let `sqlite`/`jq`/`git` slip through). Disabled tags are returned in `Discovery.disabled`.
|
|
211
|
+
- The consumer applies the **per-session client layer** with the *same parser* — `Policy.enabledAcross(tag, [serviceEnv, clientLayer])`, or `Policy.isEnabled(tag, clientLayer)` over the already-registered set. The client declares its policy in the identical `PLURNK_EXECS_*` format; the daemon intersects. The client has no enforcement surface of its own — executors run in the daemon — so this is a structural ceiling, not a trust boundary.
|
|
212
|
+
|
|
213
|
+
Framework surface: **`Policy.isEnabled(tag, env?)`** (one layer, defaults to `process.env`) and **`Policy.enabledAcross(tag, layers)`** (the intersection). To disable all standard execs except search: `PLURNK_EXECS_ONLY=search`.
|
|
214
|
+
|
|
195
215
|
## §4 Subprocess helper (legacy path)
|
|
196
216
|
|
|
197
217
|
`resolveRuntime(runtime, command) → SpawnArgs` and `isKnownRuntime(runtime)` / `KNOWN_RUNTIMES` translate a subprocess runtime tag into `node:child_process.spawn` arguments:
|
package/dist/discover.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC;AAkDpF,MAAM,CAAC,OAAO,OAAO,QAAQ;;WACZ,IAAI,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,SAAS,CAAC;CAsMvE"}
|
package/dist/discover.js
CHANGED
|
@@ -9,6 +9,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
|
|
|
9
9
|
import fs from "node:fs/promises";
|
|
10
10
|
import path from "node:path";
|
|
11
11
|
import { pathToFileURL } from "node:url";
|
|
12
|
+
import Policy from "./policy.js";
|
|
12
13
|
// Scan installed executor packages and build the runtime-tag registry the
|
|
13
14
|
// consuming scheme dispatches on. Parallel to plurnk-mimetypes' discover().
|
|
14
15
|
// The public `discover()` entry (SPEC §3) is re-exported from index.ts over
|
|
@@ -55,6 +56,7 @@ export default class Discover {
|
|
|
55
56
|
const dirs = options.packageDirs ?? await Discover.#defaultPackageDirs(options.cwd ?? process.cwd());
|
|
56
57
|
const registry = new Map();
|
|
57
58
|
const skipped = new Set();
|
|
59
|
+
const disabled = new Set();
|
|
58
60
|
for (const dir of dirs) {
|
|
59
61
|
const manifest = await Discover.#readExecManifest(dir);
|
|
60
62
|
if (manifest === null)
|
|
@@ -69,6 +71,17 @@ export default class Discover {
|
|
|
69
71
|
continue;
|
|
70
72
|
}
|
|
71
73
|
for (const info of await Discover.#readExecInfos(dir, manifest)) {
|
|
74
|
+
// Runtime policy — the operator kill-switch / allowlist
|
|
75
|
+
// (PLURNK_EXECS_<tag>=0, PLURNK_EXECS_ONLY), the daemon's boot
|
|
76
|
+
// layer, applied uniformly to EVERY tag regardless of daughter
|
|
77
|
+
// (SPEC §3.3). A disabled tag is not registered — absent, not
|
|
78
|
+
// "Available-off" — and recorded for the consumer. The
|
|
79
|
+
// per-session client layer is the consumer's to intersect via
|
|
80
|
+
// the exported Policy, same parser.
|
|
81
|
+
if (!Policy.isEnabled(info.runtime)) {
|
|
82
|
+
disabled.add(info.runtime);
|
|
83
|
+
continue;
|
|
84
|
+
}
|
|
72
85
|
const existing = registry.get(info.runtime);
|
|
73
86
|
if (existing !== undefined) {
|
|
74
87
|
throw new Error(`exec runtime collision: '${info.runtime}' claimed by both `
|
|
@@ -77,7 +90,7 @@ export default class Discover {
|
|
|
77
90
|
registry.set(info.runtime, info);
|
|
78
91
|
}
|
|
79
92
|
}
|
|
80
|
-
return { registry, skipped: [...skipped].sort() };
|
|
93
|
+
return { registry, skipped: [...skipped].sort(), disabled: [...disabled].sort() };
|
|
81
94
|
}
|
|
82
95
|
// Host plugin-trust gate, read from PLURNK_PLUGINS_TRUSTED_ONLY — the SAME
|
|
83
96
|
// env var plurnk-service decides once and every scope-agnostic discovery
|
package/dist/discover.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":";;;;;;;;AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AAUjC,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,+BAA+B;AAC/B,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAC1E,+EAA+E;AAC/E,uEAAuE;AACvE,gFAAgF;AAChF,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAChF,2EAA2E;AAC3E,wBAAwB;AACxB,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,iCAAiC;AACjC,MAAM,CAAC,OAAO,OAAO,QAAQ;IACzB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAA2B,EAAE;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAErG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,QAAQ,KAAK,IAAI;gBAAE,SAAS,CAAC,sBAAsB;YACvD,mEAAmE;YACnE,6DAA6D;YAC7D,mEAAmE;YACnE,+DAA+D;YAC/D,+CAA+C;YAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAClC,SAAS;YACb,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9D,wDAAwD;gBACxD,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,uDAAuD;gBACvD,8DAA8D;gBAC9D,oCAAoC;gBACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC3B,SAAS;gBACb,CAAC;gBACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACX,4BAA4B,IAAI,CAAC,OAAO,oBAAoB;0BAC1D,GAAG,QAAQ,CAAC,WAAW,QAAQ,IAAI,CAAC,WAAW,EAAE,CACtD,CAAC;gBACN,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,6EAA6E;IAC7E,6CAA6C;IAC7C,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,CAAC,UAAU,CAAC,WAAmB;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACrD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAW;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1C,IAAI,OAAmD,CAAC;QACxD,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvF,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,KAAK,MAAM,CAAC,IAAI,MAAM;wBAAE,IAAI,CAAC,CAAC,WAAW,EAAE;4BAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxF,CAAC;gBAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACtC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,MAAM,GAAG,GAA8B,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAiC,CAAC;QACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAE3C,OAAO,EAAE,WAAW,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClG,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,YAAY;IACZ,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,EAAE,WAAW,EAAE,MAAM,EAAgB;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;QACnC,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;QAErH,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YACxE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YACxD,MAAM,CAAC,GAAG,IAA+B,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1D,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBACjD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACvD,aAAa;gBACb,WAAW;gBACX,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,yEAAyE;IACzE,sBAAsB;IACtB,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,WAAmB,EAAE,MAA+B;QACxF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACvG,OAAO,EAAE,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,WAAmB,EAAE,GAAW;QAC3E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,MAAM,kCAAC,IAAI,EAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,WAAW,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;QACzC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,OAAO,GAAG,oDAAoD,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACD,KAAK,GAAG,MAAO,IAAsB,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,WAAW,OAAO,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,KAAsB,CAAC;IAClC,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,GAAW;QAC9C,IAAI,CAAC;YACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ"}
|
package/dist/index.d.ts
CHANGED
|
@@ -3,6 +3,7 @@ import Runtime from "./runtime.ts";
|
|
|
3
3
|
export { default as BaseExecutor } from "./BaseExecutor.ts";
|
|
4
4
|
export { default as SubprocessExecutor } from "./SubprocessExecutor.ts";
|
|
5
5
|
export declare const discover: typeof Discover.scan;
|
|
6
|
+
export { default as Policy } from "./policy.ts";
|
|
6
7
|
export declare const KNOWN_RUNTIMES: ReadonlySet<string>;
|
|
7
8
|
export declare const isKnownRuntime: typeof Runtime.isKnown;
|
|
8
9
|
export declare const resolveRuntime: typeof Runtime.resolve;
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,cAAc,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKxE,eAAO,MAAM,QAAQ,sBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,cAAc,CAAC;AAGnC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKxE,eAAO,MAAM,QAAQ,sBAAgB,CAAC;AAMtC,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAKhD,eAAO,MAAM,cAAc,qBAAgB,CAAC;AAC5C,eAAO,MAAM,cAAc,wBAAkB,CAAC;AAC9C,eAAO,MAAM,cAAc,wBAAkB,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,MAAM,EACN,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,eAAe,GAClB,MAAM,YAAY,CAAC;AAGpB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -7,6 +7,11 @@ export { default as SubprocessExecutor } from "./SubprocessExecutor.js";
|
|
|
7
7
|
// documented `discover()` entry is its `scan` static, re-exported here so the
|
|
8
8
|
// public contract and the consumer's import stay unchanged.
|
|
9
9
|
export const discover = Discover.scan;
|
|
10
|
+
// Runtime enable/disable policy (SPEC §3.3). `discover()` applies it as the
|
|
11
|
+
// daemon boot layer; the consumer reuses the same parser for the per-session
|
|
12
|
+
// client layer — Policy.enabledAcross(tag, [serviceEnv, clientLayer]) — so the
|
|
13
|
+
// cascade is byte-identical at both tiers.
|
|
14
|
+
export { default as Policy } from "./policy.js";
|
|
10
15
|
// Runtime-tag → spawn-args helper (subprocess family; legacy scheme path,
|
|
11
16
|
// SPEC §4). Same shape: behavior on the `Runtime` class, the documented
|
|
12
17
|
// function/constant names re-exported over its statics.
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,oBAAoB;AACpB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAExE,uEAAuE;AACvE,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;AAEtC,0EAA0E;AAC1E,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,oBAAoB;AACpB,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAExE,uEAAuE;AACvE,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;AAEtC,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,2CAA2C;AAC3C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAEhD,0EAA0E;AAC1E,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC"}
|
package/dist/policy.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,OAAO,OAAO,MAAM;IACvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO;IAc7F,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO;CAGhG"}
|
package/dist/policy.js
ADDED
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
// Runtime enable/disable policy — a REGISTRATION bound, sibling to the trust
|
|
2
|
+
// gate (discover.ts `#isTrusted`), NOT the §3.2 activation overlay. A disabled
|
|
3
|
+
// tag is not registered at all: neither Active nor Available, simply absent. So
|
|
4
|
+
// the consumer can honor "a client may freely activate any registered
|
|
5
|
+
// capability" (§3.2) while the registered set itself is bounded per layer.
|
|
6
|
+
//
|
|
7
|
+
// Grammar (the `PLURNK_EXECS_*` namespace — same at every tier):
|
|
8
|
+
// PLURNK_EXECS_<TAG>=0 | false surgical kill-switch for one tag
|
|
9
|
+
// PLURNK_EXECS_ONLY=a,b,c allowlist — a tag not listed is disabled
|
|
10
|
+
// The two compose within a layer (a listed tag can still be individually
|
|
11
|
+
// killed). `ONLY` is a reserved key: a runtime tag may not be named "only".
|
|
12
|
+
//
|
|
13
|
+
// PURELY SUBTRACTIVE — there is no force-enable verb, and that is the whole
|
|
14
|
+
// point: intersect layers (service ∩ client ∩ …) and a downstream layer can
|
|
15
|
+
// only ever narrow. The client can never re-enable a tag the service disabled,
|
|
16
|
+
// structurally, not by a policed rule.
|
|
17
|
+
//
|
|
18
|
+
// `env` is the policy LAYER: `process.env` for the daemon's boot layer
|
|
19
|
+
// (discover's default), or a client-declared map in the exact same
|
|
20
|
+
// `PLURNK_EXECS_*` format for the per-session client layer. One parser, both
|
|
21
|
+
// tiers — the consumer feeds the client's map straight to these methods.
|
|
22
|
+
export default class Policy {
|
|
23
|
+
static isEnabled(tag, env = process.env) {
|
|
24
|
+
const off = env[`PLURNK_EXECS_${tag.toUpperCase()}`];
|
|
25
|
+
if (off === "0" || off?.toLowerCase() === "false")
|
|
26
|
+
return false;
|
|
27
|
+
const only = env.PLURNK_EXECS_ONLY;
|
|
28
|
+
if (only) {
|
|
29
|
+
const allow = new Set(only.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean));
|
|
30
|
+
if (!allow.has(tag.toLowerCase()))
|
|
31
|
+
return false;
|
|
32
|
+
}
|
|
33
|
+
return true;
|
|
34
|
+
}
|
|
35
|
+
// The cascade: enabled iff enabled in EVERY layer. Intersection is
|
|
36
|
+
// order-independent and monotonic — pass `[serviceEnv, clientLayer]` (or
|
|
37
|
+
// more) and no layer can undo another's disable.
|
|
38
|
+
static enabledAcross(tag, layers) {
|
|
39
|
+
return layers.every((layer) => Policy.isEnabled(tag, layer));
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
//# sourceMappingURL=policy.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,2EAA2E;AAC3E,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,OAAO,OAAO,MAAM;IACvB,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,MAA0C,OAAO,CAAC,GAAG;QAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,CAAC,aAAa,CAAC,GAAW,EAAE,MAAiD;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;CACJ"}
|
package/dist/types.d.ts
CHANGED
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAM3D,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAKD,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACjB;AAOD,MAAM,WAAW,QAAQ;IAGrB,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,MAAM,CAAC;IAKhB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAWnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAExB,MAAM,EAAE,WAAW,CAAC;IASpB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAEnE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAGzD,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACzC;AAKD,MAAM,WAAW,UAAU;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAO9C,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,QAAQ;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IAOd,OAAO,EAAE,MAAM,CAAC;IAMhB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IAOpB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACnC;AAOD,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAaD,MAAM,MAAM,YAAY,GAAG,MAAM,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAIxE,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzD,MAAM,WAAW,SAAS;IACtB,QAAQ,EAAE,YAAY,CAAC;IAKvB,OAAO,EAAE,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAM3D,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;CAC/B;AAKD,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACjB;AAOD,MAAM,WAAW,QAAQ;IAGrB,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,MAAM,CAAC;IAKhB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAWnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAMtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAExB,MAAM,EAAE,WAAW,CAAC;IASpB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAEnE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAGzD,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACzC;AAKD,MAAM,WAAW,UAAU;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAO9C,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,QAAQ;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IAOd,OAAO,EAAE,MAAM,CAAC;IAMhB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IAOpB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACnC;AAOD,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAaD,MAAM,MAAM,YAAY,GAAG,MAAM,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAIxE,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzD,MAAM,WAAW,SAAS;IACtB,QAAQ,EAAE,YAAY,CAAC;IAKvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAKlB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAG5B,GAAG,CAAC,EAAE,MAAM,CAAC;IAGb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAID,MAAM,WAAW,SAAS;IACtB,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC"}
|