@qduc/term2 0.22.0 → 0.23.0

package/dist/gateway/serve.d.ts

@@ -0,0 +1,79 @@
+import { LoggingService } from '../services/logging/logging-service.js';
+import type { WorkspaceGrant } from './contracts.js';
+import { SessionContextService } from '../services/session/session-context-service.js';
+import type { ISessionContextService } from '../services/service-interfaces.js';
+/**
+ * `term2 serve` entry point: compose the real settings authority, the
+ * production runtime factory, and the gateway control plane, then block until
+ * SIGINT/SIGTERM triggers the existing bounded shutdown.
+ *
+ * State layout under --state-dir (0700): manifest.json + manifest.sha256,
+ * replay.sqlite, trusted-clients.json (0600, written by TrustedClientsStore),
+ * dynamic-workspaces.json (0600, durable browser-selected grants),
+ * gateway-data/ (persistence coordinator), runtime-tmp/ + sandbox/
+ * (per-session scratch), gateway-audit.jsonl.
+ */
+/** A launcher precondition failed; runServe turns this into a stderr message and exit 1. */
+export declare class ServeStartupError extends Error {
+}
+/**
+ * Per-session logger for gateway sessions, pointed at term2's standard log
+ * destination — the same XDG log directory the CLI writes, so gateway session
+ * diagnostics (e.g. a failed compaction's typed reason or the codex native
+ * compaction error) are visible next to CLI session logs. Console output stays
+ * suppressed (the LoggingService default) so serve's stdio contract is intact,
+ * and record contents follow the app log's sanitization rules.
+ */
+export declare function createServeSessionLogger(context: ISessionContextService, logDir?: string): LoggingService;
+/**
+ * Session-logger wiring for the whole serve process: one LoggingService and one
+ * SessionContextService, handed to every session the runtime factory composes.
+ *
+ * One instance, not one per session: each per-session LoggingService would
+ * construct its own winston-daily-rotate-file transport against the same
+ * rotation audit file (term2-audit.json), and concurrent rotation bookkeeping
+ * on a shared audit file is not something the transport guarantees. The
+ * per-session traffic attribution is unaffected by sharing, because
+ * SessionContextService is an AsyncLocalStorage cell — sessions still run
+ * their provider traffic inside their own context, and the shared logger's
+ * provider-traffic store reads whichever context is current.
+ */
+export declare function createServeSessionLogWiring(logDir?: string): {
+    createSessionContext: () => SessionContextService;
+    createLogger: (sessionId: string, context: ISessionContextService) => LoggingService;
+};
+/**
+ * Derive the gateway manifest for a state dir. A state dir with no manifest
+ * (or an empty-grant manifest) gets the canonical empty manifest this launcher
+ * runs: workspace admission is extended at runtime by the browser-owned
+ * candidate registry, and that state is durable in dynamic-workspaces.json,
+ * not in the manifest. A manifest that already carries curated grants is
+ * preserved untouched; only its sha256 sidecar is refreshed.
+ */
+export declare function prepareGatewayManifest(stateDir: string): {
+    manifestPath: string;
+    manifestSha256: string;
+};
+/**
+ * Load durable browser-selected grants. A missing file means no prior grants;
+ * a damaged (unparseable) file is quarantined as <file>.corrupt.<timestamp>
+ * with a warning so the evidence survives (the unique suffix keeps a second
+ * incident from destroying the first) and the launcher starts empty; a file
+ * that parses but carries an invalid grant list fails closed.
+ */
+export declare function loadDynamicWorkspaceGrants(stateDir: string): readonly WorkspaceGrant[];
+/** Write the durable grant list atomically (temp file, then rename). */
+export declare function saveDynamicWorkspaceGrants(stateDir: string, grants: readonly WorkspaceGrant[]): void;
+/** Canonicalize one --workspace-root; the registry requires real directories. */
+export declare function canonicalizeWorkspaceRoot(root: string): string;
+/**
+ * Startup sandbox availability never gates readiness and no consumer may read
+ * workerSandboxAvailable as proof of a usable sandbox. This warning tells the
+ * operator up front when every shell tool call will be refused.
+ */
+export declare function sandboxStartupWarning(availability: {
+    type: string;
+    reason?: string;
+}): string | undefined;
+export declare function runServe(argv: readonly string[]): Promise<void>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/gateway/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../source/gateway/serve.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAIxE,OAAO,KAAK,EAA0B,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAa7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAEhF;;;;;;;;;;GAUG;AAEH,4FAA4F;AAC5F,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAEzG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG;IAC5D,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;IAClD,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,KAAK,cAAc,CAAC;CACtF,CAOA;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAsBzG;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE,CAiCtF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAKpG;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS9D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAIzG;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoNrE"}

package/dist/gateway/serve.js

@@ -0,0 +1,375 @@
+import { createHash } from 'node:crypto';
+import { appendFile } from 'node:fs/promises';
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { buildEnvOverrides, SettingsService } from '../services/settings/settings-service.js';
+import { LoggingService } from '../services/logging/logging-service.js';
+import { getDefaultShellSandboxRunner } from '../utils/shell/sandbox/shell-sandbox-runner.js';
+import { launchGateway } from './launcher.js';
+import { createProductionRuntimeFactory } from './runtime-factory.js';
+import { createGatewayStorageLayout } from './persistence/storage.js';
+import { GatewayPersistenceCoordinator } from './persistence/coordinator.js';
+import { loadGatewayManifest, validateDynamicGrant, validateGatewayManifest, WorkspaceAdmission, } from './workspace-admission.js';
+import { DynamicWorkspaceRegistry } from './dynamic-workspace-registry.js';
+import { createRealWorkspaceBoundaryProbe } from './workspace-boundary-probe.js';
+import { parseServeArgs } from './serve-args.js';
+import { SessionContextService } from '../services/session/session-context-service.js';
+/**
+ * `term2 serve` entry point: compose the real settings authority, the
+ * production runtime factory, and the gateway control plane, then block until
+ * SIGINT/SIGTERM triggers the existing bounded shutdown.
+ *
+ * State layout under --state-dir (0700): manifest.json + manifest.sha256,
+ * replay.sqlite, trusted-clients.json (0600, written by TrustedClientsStore),
+ * dynamic-workspaces.json (0600, durable browser-selected grants),
+ * gateway-data/ (persistence coordinator), runtime-tmp/ + sandbox/
+ * (per-session scratch), gateway-audit.jsonl.
+ */
+/** A launcher precondition failed; runServe turns this into a stderr message and exit 1. */
+export class ServeStartupError extends Error {
+}
+/**
+ * Per-session logger for gateway sessions, pointed at term2's standard log
+ * destination — the same XDG log directory the CLI writes, so gateway session
+ * diagnostics (e.g. a failed compaction's typed reason or the codex native
+ * compaction error) are visible next to CLI session logs. Console output stays
+ * suppressed (the LoggingService default) so serve's stdio contract is intact,
+ * and record contents follow the app log's sanitization rules.
+ */
+export function createServeSessionLogger(context, logDir) {
+    return new LoggingService({ sessionContextService: context, ...(logDir !== undefined ? { logDir } : {}) });
+}
+/**
+ * Session-logger wiring for the whole serve process: one LoggingService and one
+ * SessionContextService, handed to every session the runtime factory composes.
+ *
+ * One instance, not one per session: each per-session LoggingService would
+ * construct its own winston-daily-rotate-file transport against the same
+ * rotation audit file (term2-audit.json), and concurrent rotation bookkeeping
+ * on a shared audit file is not something the transport guarantees. The
+ * per-session traffic attribution is unaffected by sharing, because
+ * SessionContextService is an AsyncLocalStorage cell — sessions still run
+ * their provider traffic inside their own context, and the shared logger's
+ * provider-traffic store reads whichever context is current.
+ */
+export function createServeSessionLogWiring(logDir) {
+    const context = new SessionContextService();
+    const logger = createServeSessionLogger(context, logDir);
+    return {
+        createSessionContext: () => context,
+        createLogger: () => logger,
+    };
+}
+/**
+ * Derive the gateway manifest for a state dir. A state dir with no manifest
+ * (or an empty-grant manifest) gets the canonical empty manifest this launcher
+ * runs: workspace admission is extended at runtime by the browser-owned
+ * candidate registry, and that state is durable in dynamic-workspaces.json,
+ * not in the manifest. A manifest that already carries curated grants is
+ * preserved untouched; only its sha256 sidecar is refreshed.
+ */
+export function prepareGatewayManifest(stateDir) {
+    const manifestPath = path.join(stateDir, 'manifest.json');
+    const emptyManifest = `${JSON.stringify({ version: 1, grants: [], sshTargets: [] }, null, 2)}\n`;
+    let manifestJson = emptyManifest;
+    if (existsSync(manifestPath)) {
+        const existingRaw = readFileSync(manifestPath, 'utf8');
+        let existingGrants = 0;
+        try {
+            existingGrants = validateGatewayManifest(JSON.parse(existingRaw)).grants.length;
+        }
+        catch (error) {
+            throw new ServeStartupError(`refusing to overwrite an unreadable gateway manifest at ${manifestPath}: ${messageOf(error)}`);
+        }
+        if (existingGrants > 0)
+            manifestJson = existingRaw;
+    }
+    const manifestSha256 = createHash('sha256').update(manifestJson).digest('hex');
+    writeFileSync(manifestPath, manifestJson, { mode: 0o600 });
+    writeFileSync(path.join(stateDir, 'manifest.sha256'), `${manifestSha256}\n`, { mode: 0o600 });
+    // Prove the artifact the startup assertion will re-read actually parses.
+    loadGatewayManifest(manifestPath, manifestSha256);
+    return { manifestPath, manifestSha256 };
+}
+/**
+ * Load durable browser-selected grants. A missing file means no prior grants;
+ * a damaged (unparseable) file is quarantined as <file>.corrupt.<timestamp>
+ * with a warning so the evidence survives (the unique suffix keeps a second
+ * incident from destroying the first) and the launcher starts empty; a file
+ * that parses but carries an invalid grant list fails closed.
+ */
+export function loadDynamicWorkspaceGrants(stateDir) {
+    const grantsFile = path.join(stateDir, 'dynamic-workspaces.json');
+    let raw;
+    try {
+        raw = readFileSync(grantsFile, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // rename(2) replaces an existing destination, so the quarantine name
+        // carries a timestamp: a second incident must not destroy the first.
+        const quarantinePath = `${grantsFile}.corrupt.${Date.now()}`;
+        let moved = false;
+        try {
+            renameSync(grantsFile, quarantinePath);
+            moved = true;
+        }
+        catch {
+            // Keep the damaged file in place rather than lose the evidence.
+        }
+        console.error(moved
+            ? `term2 serve: ${grantsFile} is damaged; moved to ${quarantinePath}, starting with no dynamic grants`
+            : `term2 serve: ${grantsFile} is damaged and could not be moved aside; leaving it in place — repair or delete it before the next start`);
+        return [];
+    }
+    if (!Array.isArray(parsed) || !parsed.every((entry) => validateDynamicGrant(entry))) {
+        throw new ServeStartupError(`${grantsFile} contains an invalid dynamic grant; refusing to start`);
+    }
+    return parsed;
+}
+/** Write the durable grant list atomically (temp file, then rename). */
+export function saveDynamicWorkspaceGrants(stateDir, grants) {
+    const grantsFile = path.join(stateDir, 'dynamic-workspaces.json');
+    const tempPath = `${grantsFile}.tmp`;
+    writeFileSync(tempPath, `${JSON.stringify(grants, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tempPath, grantsFile);
+}
+/** Canonicalize one --workspace-root; the registry requires real directories. */
+export function canonicalizeWorkspaceRoot(root) {
+    let canonical;
+    try {
+        canonical = realpathSync(root);
+        if (!statSync(canonical).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch (error) {
+        throw new ServeStartupError(`--workspace-root ${root} is unusable: ${messageOf(error)}`);
+    }
+    return canonical;
+}
+/**
+ * Startup sandbox availability never gates readiness and no consumer may read
+ * workerSandboxAvailable as proof of a usable sandbox. This warning tells the
+ * operator up front when every shell tool call will be refused.
+ */
+export function sandboxStartupWarning(availability) {
+    if (availability.type === 'available')
+        return undefined;
+    const detail = availability.reason ? ` (${availability.reason})` : '';
+    return `term2 serve: warning: shell sandbox unavailable: ${availability.type}${detail}; shell tool calls will be refused`;
+}
+export async function runServe(argv) {
+    const parsed = parseServeArgs(argv);
+    if (!parsed.ok) {
+        console.error(`term2 serve: ${parsed.error}`);
+        process.exit(1);
+    }
+    const args = parsed.args;
+    let stateDir;
+    try {
+        mkdirSync(args.stateDir, { recursive: true, mode: 0o700 });
+        chmodSync(args.stateDir, 0o700);
+        stateDir = realpathSync(args.stateDir);
+    }
+    catch (error) {
+        console.error(`term2 serve: cannot create state directory ${args.stateDir}: ${messageOf(error)}`);
+        process.exit(1);
+    }
+    let manifest;
+    try {
+        manifest = prepareGatewayManifest(stateDir);
+    }
+    catch (error) {
+        console.error(`term2 serve: ${messageOf(error)}`);
+        process.exit(1);
+    }
+    const { manifestPath, manifestSha256 } = manifest;
+    const publicKeys = new Map();
+    for (const { kid, pemPath } of args.bffKeys) {
+        try {
+            publicKeys.set(kid, readFileSync(pemPath, 'utf8'));
+        }
+        catch (error) {
+            console.error(`term2 serve: cannot read BFF public key "${kid}" at ${pemPath}: ${messageOf(error)}`);
+            process.exit(1);
+        }
+    }
+    if (publicKeys.size === 0 && !args.pairing) {
+        console.error('term2 serve: provide at least one --bff-key <kid>=<pem path> or enable --pairing');
+        process.exit(1);
+    }
+    if (args.transport.kind === 'tls') {
+        for (const label of ['tls-cert', 'tls-key']) {
+            const filePath = label === 'tls-cert' ? args.transport.certPath : args.transport.keyPath;
+            try {
+                readFileSync(filePath);
+            }
+            catch (error) {
+                console.error(`term2 serve: cannot read --${label} at ${filePath}: ${messageOf(error)}`);
+                process.exit(1);
+            }
+        }
+    }
+    let workspaceRoots;
+    try {
+        workspaceRoots = args.workspaceRoots.map((root) => canonicalizeWorkspaceRoot(root));
+    }
+    catch (error) {
+        console.error(`term2 serve: ${messageOf(error)}`);
+        process.exit(1);
+    }
+    // Probe once for the operator-visible warning. This does not gate readiness:
+    // the shell tool refuses the unsandboxed fallback per command when the
+    // sandbox runtime is unusable, so sessions still start and every other tool
+    // keeps working. The probe is advisory only: a throw from the optional
+    // sandbox subsystem becomes a probe_failed warning, never a stack trace.
+    let sandboxWarning;
+    try {
+        sandboxWarning = sandboxStartupWarning(await getDefaultShellSandboxRunner().availability());
+    }
+    catch (error) {
+        sandboxWarning = sandboxStartupWarning({ type: 'probe_failed', reason: messageOf(error) });
+    }
+    // The launcher process is the credential owner: this is the operator's real
+    // settings service (loaded with the same env precedence as the CLI), not a
+    // per-session overlay. Sessions receive only the M1 allowlist.
+    const settingsAuthority = new SettingsService({
+        env: buildEnvOverrides(),
+        loggingService: new LoggingService({ disableLogging: true, suppressConsoleOutput: true }),
+    });
+    const runtimeFactory = createProductionRuntimeFactory({
+        settingsAuthority,
+        tmpDir: ensureDir(stateDir, 'runtime-tmp'),
+        sandboxAvailable: true,
+        allowWrite: args.allowWrite,
+        ...createServeSessionLogWiring(),
+    });
+    const persistence = new GatewayPersistenceCoordinator(createGatewayStorageLayout(ensureDir(stateDir, 'gateway-data')));
+    let initialDynamicGrants;
+    try {
+        initialDynamicGrants = loadDynamicWorkspaceGrants(stateDir);
+    }
+    catch (error) {
+        console.error(`term2 serve: ${messageOf(error)}`);
+        process.exit(1);
+    }
+    const boundaryProbe = createRealWorkspaceBoundaryProbe({ allowWrite: args.allowWrite });
+    const admission = new WorkspaceAdmission(loadGatewayManifest(manifestPath, manifestSha256), {
+        allowWrite: args.allowWrite,
+        boundaryProbe,
+        initialDynamicGrants,
+        onDynamicGrantChange: (grants) => {
+            mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+            saveDynamicWorkspaceGrants(stateDir, grants);
+        },
+    });
+    const workspaceRegistry = new DynamicWorkspaceRegistry({
+        admission,
+        allowedRoots: workspaceRoots,
+    });
+    const auditPath = path.join(stateDir, 'gateway-audit.jsonl');
+    const auditWriter = async (record) => {
+        await appendFile(auditPath, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+    };
+    const config = {
+        enabled: true,
+        ...(args.transport.kind === 'socket'
+            ? { socketPath: args.transport.socketPath }
+            : {
+                host: args.transport.host,
+                port: args.transport.port,
+                tls: { certPath: args.transport.certPath, keyPath: args.transport.keyPath, requireClientCert: false },
+            }),
+        manifestPath,
+        manifestSha256,
+        replayDbPath: path.join(stateDir, 'replay.sqlite'),
+        issuer: args.issuer,
+        audience: args.audience,
+        publicKeys,
+        localOwnerUserId: args.localOwnerUserId,
+        workspaceRegistry,
+        workspaceBoundaryProbe: boundaryProbe,
+        // Launch-config claim only: the startup assertion requires this literal,
+        // and no consumer may read it as proof of a usable sandbox. Real shell
+        // execution probes the runner per call and refuses the unsandboxed
+        // fallback; the startup warning tells the operator when that will happen.
+        workerSandboxAvailable: true,
+        tmpDir: ensureDir(stateDir, 'sandbox'),
+        sshEnabled: false,
+        allowWrite: args.allowWrite,
+        autoApprove: false,
+        allowUnsandboxed: false,
+        auditWriter,
+        // The launcher owns the diagnostics destination; the gateway only decides what is
+        // worth reporting. Without this the gateway would have nowhere to report a degraded
+        // shutdown audit.
+        logger: new LoggingService(),
+        runtimeFactory,
+        // Always wired: without it session_create answers with the legacy body
+        // shape, which the ChatForge BFF rejects as gateway_unavailable.
+        persistence,
+        ...(args.pairing
+            ? {
+                pairing: {
+                    enabled: true,
+                    trustFilePath: path.join(stateDir, 'trusted-clients.json'),
+                    // The OTP is the operator's out-of-band secret: stderr only, so it
+                    // can never interleave with a machine-readable stdout stream.
+                    printOtp: (otp) => console.error(`PAIRING OTP: ${otp}`),
+                },
+            }
+            : {}),
+    };
+    // The CLI module registers global SIGINT/SIGTERM handlers that force-exit
+    // for interactive sessions. A gateway shutdown is bounded and must be given
+    // the chance to finish, so those listeners are replaced here.
+    process.removeAllListeners('SIGINT');
+    process.removeAllListeners('SIGTERM');
+    let gateway;
+    try {
+        gateway = await launchGateway(config);
+    }
+    catch (error) {
+        console.error(`term2 serve: gateway failed to start: ${messageOf(error)}`);
+        process.exit(1);
+    }
+    if (sandboxWarning)
+        console.error(sandboxWarning);
+    const endpoint = args.transport.kind === 'socket'
+        ? `transport=socket path=${args.transport.socketPath}`
+        : `transport=tls host=${args.transport.host} port=${args.transport.port}`;
+    console.error(`GATEWAY_READY pid=${process.pid} ${endpoint} pairing=${args.pairing ? 'on' : 'off'} workspaceRoots=${workspaceRoots.join(',')}`);
+    // launchGateway's own handlers start the bounded shutdown; this once-handler
+    // awaits the same idempotent shutdown and then exits deterministically even
+    // if a library keeps the event loop alive. runServe stays pending until that
+    // shutdown finishes, so a caller cannot fall through and exit the process
+    // while the gateway is still serving.
+    let settleShutdown = () => undefined;
+    const shutdownComplete = new Promise((resolve) => {
+        settleShutdown = resolve;
+    });
+    const shutdownAndExit = () => {
+        void gateway.shutdown().finally(() => {
+            settleShutdown();
+            process.exit(0);
+        });
+    };
+    process.once('SIGINT', shutdownAndExit);
+    process.once('SIGTERM', shutdownAndExit);
+    await shutdownComplete;
+}
+function ensureDir(stateDir, leaf) {
+    const dir = path.join(stateDir, leaf);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=serve.js.map

package/dist/gateway/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../source/gateway/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAGvF;;;;;;;;;;GAUG;AAEH,4FAA4F;AAC5F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA+B,EAAE,MAAe;IACvF,OAAO,IAAI,cAAc,CAAC,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAe;IAIzD,MAAM,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO;QACL,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO;QACnC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACjG,IAAI,YAAY,GAAG,aAAa,CAAC;IACjC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,2DAA2D,YAAY,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,GAAG,CAAC;YAAE,YAAY,GAAG,WAAW,CAAC;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,GAAG,cAAc,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,yEAAyE;IACzE,mBAAmB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAClD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,cAAc,GAAG,GAAG,UAAU,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACvC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,OAAO,CAAC,KAAK,CACX,KAAK;YACH,CAAC,CAAC,gBAAgB,UAAU,yBAAyB,cAAc,mCAAmC;YACtG,CAAC,CAAC,gBAAgB,UAAU,2GAA2G,CAC1I,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,iBAAiB,CAAC,GAAG,UAAU,uDAAuD,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,MAAiC;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,UAAU,MAAM,CAAC;IACrC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,IAAI,iBAAiB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAA+C;IACnF,IAAI,YAAY,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,oDAAoD,YAAY,CAAC,IAAI,GAAG,MAAM,oCAAoC,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAuB;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,GAAG,QAAQ,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,CAAU,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACzF,IAAI,CAAC;gBACH,YAAY,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACH,cAAc,GAAG,qBAAqB,CAAC,MAAM,4BAA4B,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,iBAAiB,GAAG,IAAI,eAAe,CAAC;QAC5C,GAAG,EAAE,iBAAiB,EAAE;QACxB,cAAc,EAAE,IAAI,cAAc,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;KAC1F,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,8BAA8B,CAAC;QACpD,iBAAiB;QACjB,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC1C,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,2BAA2B,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,6BAA6B,CACnD,0BAA0B,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAChE,CAAC;IAEF,IAAI,oBAA+C,CAAC;IACpD,IAAI,CAAC;QACH,oBAAoB,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,aAAa,GAAG,gCAAgC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE;QAC1F,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa;QACb,oBAAoB;QACpB,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;QACrD,SAAS;QACT,YAAY,EAAE,cAAc;KAC7B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,KAAK,EAAE,MAA8B,EAAE,EAAE;QAC3D,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAwB;QAClC,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;YAC3C,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBACzB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBACzB,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE;aACtG,CAAC;QACN,YAAY;QACZ,cAAc;QACd,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAClD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU;QACV,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,iBAAiB;QACjB,sBAAsB,EAAE,aAAa;QACrC,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,0EAA0E;QAC1E,sBAAsB,EAAE,IAAI;QAC5B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;QACtC,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,KAAK;QACvB,WAAW;QACX,kFAAkF;QAClF,oFAAoF;QACpF,kBAAkB;QAClB,MAAM,EAAE,IAAI,cAAc,EAAE;QAC5B,cAAc;QACd,uEAAuE;QACvE,iEAAiE;QACjE,WAAW;QACX,GAAG,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC;oBAC1D,mEAAmE;oBACnE,8DAA8D;oBAC9D,QAAQ,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC;iBAChE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAEtC,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,cAAc;QAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;QACtD,CAAC,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,CAAC,KAAK,CACX,qBAAqB,OAAO,CAAC,GAAG,IAAI,QAAQ,YAC1C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KACxB,mBAAmB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9C,CAAC;IAEF,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,cAAc,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACrD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,GAAG,EAAE;QAC3B,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,cAAc,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,MAAM,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/gateway/server-session.d.ts

@@ -5,6 +5,7 @@ import type { UserTurn } from '../types/user-turn.js';
 import type { GatewaySessionComposition, SecretFreeWorkerSettings, SessionBinding } from './contracts.js';
 import type { RuntimeResourcePolicy } from './runtime-factory.js';
 import type { PreparedMessageResult, PreparedMessageIds } from '../services/conversation/conversation-adapter.js';
+import type { GatewayMessageAdmissionRuntime } from './persistence/admission-persistence.js';
 export type ServerSessionStatus = 'idle' | 'running' | 'awaiting_interaction' | 'interrupted' | 'closed';
 export type AbortOutcome = {
     readonly kind: 'aborted';
@@ -45,6 +46,13 @@ export declare class ServerSession {
     readonly binding: Readonly<SessionBinding>;
     readonly service: ConversationService;
     constructor(options: ServerSessionOptions);
+    /**
+     * Attribute the events raised by `run` to `turnId`. Compact is the only
+     * command that publishes conversation events, and it runs outside a turn, so
+     * without this the gateway sees no turn and drops `context_compaction_*`
+     * before it reaches the journal.
+     */
+    withCommandTurn<T>(turnId: string, run: () => Promise<T>): Promise<T>;
     get sessionId(): string;
     get status(): ServerSessionStatus;
     get activeTurnId(): string | null;
@@ -57,6 +65,7 @@ export declare class ServerSession {
     prepareMessage(input: UserTurn | string, ids: PreparedMessageIds): Promise<PreparedMessageResult>;
     commitMessage(leaseId: string): Promise<void>;
     cancelPreparedMessage(leaseId: string): Promise<void>;
+    createRetryRuntime(command: 'retry-tool' | 'retry-turn'): GatewayMessageAdmissionRuntime;
     resolvePendingInteraction(request: ResolvePendingInteractionRequest): PendingInteractionResolution;
     abort(turnId: string): Promise<AbortOutcome>;
     dispose(reason?: 'closed' | 'shutdown' | 'interrupted'): Promise<void>;

package/dist/gateway/server-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-session.d.ts","sourceRoot":"","sources":["../../source/gateway/server-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,KAAK,EACV,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AAElH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,sBAAsB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEvG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAC7E,YAAY,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAI3C;CACF;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,yBAAyB,CAAC;IACvC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,KAAK,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACvG,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,CAAC;AAkBF,qBAAa,aAAa;;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAgBtC,YAAY,OAAO,EAAE,oBAAoB,EAqCxC;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IA4BD,IAAI,MAAM,IAAI,mBAAmB,CAGhC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,IAAI,CAEhC;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAEjD;IAED,IAAI,SAAS,IAAI,yBAAyB,CAEzC;IAED,+EAA+E;IAC/E,cAAc,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAMrD;IAED,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQhG;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlD;IAEK,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1D;IAED,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,4BAA4B,CAKjG;IAEK,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCjD;IAEK,OAAO,CAAC,MAAM,GAAE,QAAQ,GAAG,UAAU,GAAG,aAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrF;IAED,OAAO,CAAC,UAAU;CAyBnB"}
+{"version":3,"file":"server-session.d.ts","sourceRoot":"","sources":["../../source/gateway/server-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,KAAK,EACV,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AAClH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAE7F,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,sBAAsB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEvG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAC7E,YAAY,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAI3C;CACF;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,WAAW,EAAE,yBAAyB,CAAC;IACvC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,KAAK,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACvG,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACxB,CAAC;AAkBF,qBAAa,aAAa;;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAiBtC,YAAY,OAAO,EAAE,oBAAoB,EAiBxC;IA4BD;;;;;OAKG;IACG,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAQ1E;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IA4BD,IAAI,MAAM,IAAI,mBAAmB,CAGhC;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,IAAI,CAEhC;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,wBAAwB,CAAC,CAEjD;IAED,IAAI,SAAS,IAAI,yBAAyB,CAEzC;IAED,+EAA+E;IAC/E,cAAc,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAMrD;IAED,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQhG;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBlD;IAEK,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1D;IAED,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,GAAG,8BAA8B,CAkGvF;IAED,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,4BAA4B,CAKjG;IAEK,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCjD;IAEK,OAAO,CAAC,MAAM,GAAE,QAAQ,GAAG,UAAU,GAAG,aAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrF;IAED,OAAO,CAAC,UAAU;CAyBnB"}