@sentropic/h2a-runtime 0.98.6 → 0.98.7-rc.10

package/dist/claude-code-cli-lifecycle.js

@@ -0,0 +1,402 @@
+/**
+ * Claude Code CLI lifecycle: process-tree supervision, TTL admission,
+ * and startup orphan sweeps. Account locking lives in the mesh account
+ * directory (common seat model) — never here.
+ */
+import { closeSync, constants, existsSync, openSync, readdirSync, readFileSync, readlinkSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { resolvePrivateRuntimeRoot } from "./claude-code-cli-isolation.js";
+import { readBootId, readMachineId, readPidNamespaceId, readProcessStartTime } from "./proc-identity.js";
+export const DEFAULT_ORPHAN_STALE_AFTER_MS = 5 * 60 * 1000; // 5 minutes
+export const DEFAULT_MIN_REMAINING_TTL_MS = 60_000; // 1 minute
+export const DEFAULT_MAX_REMAINING_TTL_MS = 86_400_000; // 24 hours
+/**
+ * Prove a recorded holder dead. PID presence alone proves nothing across
+ * PID reuse: a live pid with a mismatched start-time is a different process
+ * (reclaim), a mismatched boot id means a reboot happened (reclaim), and an
+ * ESRCH signal check means the process is gone (reclaim). Anything
+ * unprovable — EPERM liveness, unreadable identity, foreign namespace or
+ * machine sharing this directory — fails closed as alive (wait, never
+ * reclaim), so a live holder can never lose its lock to a waiter.
+ */
+function isRecordedHolderProvenDead(holder) {
+    if (!holder || typeof holder !== "object")
+        return false;
+    if (typeof holder.pid !== "number" || !Number.isInteger(holder.pid) || holder.pid <= 0) {
+        return false;
+    }
+    const liveNamespace = readPidNamespaceId();
+    if (typeof holder.pidNamespace === "string" &&
+        liveNamespace !== undefined &&
+        holder.pidNamespace !== liveNamespace) {
+        return false;
+    }
+    const liveMachine = readMachineId();
+    if (typeof holder.machineId === "string" &&
+        liveMachine !== undefined &&
+        holder.machineId !== liveMachine) {
+        return false;
+    }
+    try {
+        process.kill(holder.pid, 0);
+    }
+    catch (err) {
+        if (err.code === "ESRCH")
+            return true;
+        return false;
+    }
+    const liveStartTime = readProcessStartTime(holder.pid);
+    if (typeof holder.startTime === "number" &&
+        liveStartTime !== undefined &&
+        liveStartTime !== holder.startTime) {
+        return true;
+    }
+    const liveBootId = readBootId();
+    if (typeof holder.bootId === "string" &&
+        liveBootId !== undefined &&
+        liveBootId !== holder.bootId) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Positively prove that a live child process is the exact process spawned by this sandbox.
+ * Fails closed: never signals on PID presence alone, across reboot, across PID namespace
+ * boundary, across PID reuse, or when start-time was unrecorded or mismatched.
+ */
+export function isRecordedChildProvenTarget(childPid, rawMeta, parentMeta, runDir) {
+    if (typeof childPid !== "number" || !Number.isInteger(childPid) || childPid <= 0) {
+        return { proven: false, reason: "invalid_pid" };
+    }
+    // Must be alive to prove
+    try {
+        process.kill(childPid, 0);
+    }
+    catch {
+        return { proven: false, reason: "process_dead" };
+    }
+    // Linux-specific identity proofs: start-time, boot-id, pid-namespace
+    if (process.platform === "linux") {
+        const liveBootId = readBootId();
+        const recordedChildBoot = (typeof rawMeta.childBootId === "string" && rawMeta.childBootId) ||
+            parentMeta.bootId;
+        if (typeof recordedChildBoot !== "string" ||
+            !recordedChildBoot ||
+            liveBootId === undefined ||
+            liveBootId !== recordedChildBoot) {
+            return { proven: false, reason: "boot_id_mismatch_or_unrecorded" };
+        }
+        const liveNamespace = readPidNamespaceId();
+        const recordedChildNs = (typeof rawMeta.childPidNamespace === "string" && rawMeta.childPidNamespace) ||
+            parentMeta.pidNamespace;
+        if (typeof recordedChildNs !== "string" ||
+            !recordedChildNs ||
+            liveNamespace === undefined ||
+            liveNamespace !== recordedChildNs) {
+            return { proven: false, reason: "pid_namespace_mismatch_or_unrecorded" };
+        }
+        const liveMachine = readMachineId();
+        if (typeof parentMeta.machineId === "string" &&
+            (liveMachine === undefined || liveMachine !== parentMeta.machineId)) {
+            return { proven: false, reason: "machine_id_mismatch" };
+        }
+        if (typeof rawMeta.childStartTime !== "number" ||
+            !Number.isFinite(rawMeta.childStartTime) ||
+            rawMeta.childStartTime <= 0) {
+            return { proven: false, reason: "child_start_time_unrecorded" };
+        }
+        const liveStartTime = readProcessStartTime(childPid);
+        if (liveStartTime === undefined || liveStartTime !== rawMeta.childStartTime) {
+            return { proven: false, reason: "child_start_time_mismatched" };
+        }
+        // Optional cwd/marker ownership check if recorded
+        if (typeof rawMeta.childCwd === "string") {
+            try {
+                const liveCwd = readlinkSync(`/proc/${childPid}/cwd`);
+                const normalizedRunDir = runDir.endsWith("/") ? runDir : `${runDir}/`;
+                if (liveCwd !== rawMeta.childCwd && liveCwd !== runDir && !liveCwd.startsWith(normalizedRunDir)) {
+                    return { proven: false, reason: "child_cwd_mismatched" };
+                }
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "ENOENT" || code === "ESRCH") {
+                    return { proven: false, reason: "process_dead" };
+                }
+                return { proven: false, reason: "child_cwd_unreadable" };
+            }
+        }
+    }
+    else {
+        // Non-Linux platforms: without /proc start-time and boot-id, cannot positively
+        // prove process identity to avoid PID reuse hazard. Fail closed: never signal.
+        return { proven: false, reason: "non_linux_process_identity_unprovable" };
+    }
+    return { proven: true };
+}
+/**
+ * Account locking lives in the mesh account directory for every seat
+ * (owner decision 2026-10-13, realign on the common seat model): h2a holds
+ * no per-account lease. `acquireClaudeAccountLease` and
+ * `reclaimDeadAccountLock` were removed without replacement — the mesh route
+ * planner serializes acquisition and refresh. What follows is TTL admission,
+ * process reaping, and the orphan sweep (proven-dead sandboxes only).
+ */
+/**
+ * Validate token remaining TTL against admission boundaries.
+ * Preserves real provider expiry without rewriting or fabricating timestamps.
+ */
+export function checkTokenTtlAdmission(expiresAt, now = Date.now(), minTtlMs = DEFAULT_MIN_REMAINING_TTL_MS, maxTtlMs = DEFAULT_MAX_REMAINING_TTL_MS) {
+    if (!Number.isFinite(expiresAt) || expiresAt <= 0) {
+        return { admitted: false, reason: "invalid_token_expiry" };
+    }
+    const remaining = expiresAt - now;
+    if (remaining < minTtlMs) {
+        return { admitted: false, reason: "insufficient_remaining_ttl" };
+    }
+    if (remaining > maxTtlMs) {
+        return { admitted: false, reason: "excessive_remaining_ttl" };
+    }
+    return { admitted: true };
+}
+/**
+ * Supervise process tree and guarantee reaping of child and all descendants.
+ */
+export async function reapProcessTree(pid, signal = "SIGTERM", gracePeriodMs = 500) {
+    if (pid <= 0)
+        return;
+    const sendSignal = (sig) => {
+        try {
+            // Kill process group (negative PID)
+            process.kill(-pid, sig);
+        }
+        catch {
+            try {
+                process.kill(pid, sig);
+            }
+            catch {
+                // Process might already be dead
+            }
+        }
+    };
+    sendSignal(signal);
+    // Await grace period
+    await new Promise((r) => setTimeout(r, gracePeriodMs));
+    // Escalate to SIGKILL if still running
+    try {
+        process.kill(pid, 0);
+        sendSignal("SIGKILL");
+        await new Promise((r) => setTimeout(r, 100));
+    }
+    catch {
+        // Process exited successfully
+    }
+}
+/** Sweep mutual-exclusion file inside the runtime root. */
+export const CLAUDE_SWEEP_LOCK_FILENAME = ".sweep.lock";
+/**
+ * Content-blind orphan sweep at host boot and runner start.
+ * A run is swept only when its run-meta.json carries a valid pid plus
+ * createdAt AND the holder is proven dead by pid/start-time/boot identity
+ * AND its age exceeds the stale threshold. Runs without valid metadata are
+ * always retained (never deleted blindly); live holders are skipped; a
+ * concurrent active sweeper makes this call a no-op.
+ */
+export async function sweepOrphanSandboxes(rootDir, options = {}) {
+    const root = resolvePrivateRuntimeRoot(rootDir);
+    const maxAgeMs = options.maxAgeMs ?? DEFAULT_ORPHAN_STALE_AFTER_MS;
+    const now = (options.now ?? Date.now)();
+    let swept = 0;
+    let retained = 0;
+    let skippedAlive = 0;
+    let skippedUnprovenChild = 0;
+    if (!existsSync(root)) {
+        return { swept, retained, skippedAlive };
+    }
+    // Sweep mutual exclusion: one active sweeper per root.
+    const sweepLockFile = join(root, CLAUDE_SWEEP_LOCK_FILENAME);
+    const sweepToken = randomUUID();
+    const readSweepHolder = () => {
+        try {
+            const parsed = JSON.parse(readFileSync(sweepLockFile, "utf8"));
+            if (!parsed || typeof parsed !== "object")
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    };
+    let sweepFd = null;
+    try {
+        sweepFd = openSync(sweepLockFile, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR, 0o600);
+        writeFileSync(sweepFd, JSON.stringify({
+            pid: process.pid,
+            startTime: readProcessStartTime(process.pid) ?? null,
+            bootId: readBootId() ?? null,
+            pidNamespace: readPidNamespaceId() ?? null,
+            machineId: readMachineId() ?? null,
+            acquiredAt: now,
+            token: sweepToken,
+        }));
+    }
+    catch {
+        const holder = readSweepHolder();
+        const holderAge = holder && typeof holder.acquiredAt === "number"
+            ? now - (holder.acquiredAt)
+            : 0;
+        if (holder && (isRecordedHolderProvenDead(holder) || holderAge > 2 * maxAgeMs)) {
+            try {
+                unlinkSync(sweepLockFile);
+            }
+            catch {
+                // Lost the race; skip this round.
+                return { swept, retained, skippedAlive };
+            }
+            try {
+                sweepFd = openSync(sweepLockFile, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR, 0o600);
+                writeFileSync(sweepFd, JSON.stringify({ pid: process.pid, acquiredAt: now, token: sweepToken }));
+            }
+            catch {
+                return { swept, retained, skippedAlive };
+            }
+        }
+        else {
+            return { swept, retained, skippedAlive };
+        }
+    }
+    try {
+        const entries = readdirSync(root, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.name.startsWith("."))
+                continue;
+            const runDir = join(root, entry.name);
+            const metaPath = join(runDir, "run-meta.json");
+            let meta = null;
+            try {
+                const parsed = JSON.parse(readFileSync(metaPath, "utf8"));
+                if (parsed && typeof parsed === "object") {
+                    meta = parsed;
+                }
+            }
+            catch {
+                meta = null;
+            }
+            // No valid identity metadata: retain, never delete blindly.
+            if (!meta || typeof meta.pid !== "number" || typeof meta.createdAt !== "number") {
+                retained++;
+                continue;
+            }
+            if (!isRecordedHolderProvenDead(meta)) {
+                skippedAlive++;
+                continue;
+            }
+            // Young orphan retry: do NOT delete if younger than stale threshold
+            if (now - meta.createdAt < maxAgeMs) {
+                retained++;
+                continue;
+            }
+            // Holder proven dead and age > maxAgeMs: reap detached child ONLY if positive identity is proven, then delete
+            const rawMeta = meta;
+            if (typeof rawMeta.childPid === "number" && rawMeta.childPid > 0) {
+                let childAlive = false;
+                try {
+                    process.kill(rawMeta.childPid, 0);
+                    childAlive = true;
+                }
+                catch {
+                    childAlive = false;
+                }
+                if (childAlive) {
+                    const proof = isRecordedChildProvenTarget(rawMeta.childPid, rawMeta, meta, runDir);
+                    if (proof.proven) {
+                        // Re-verify start-time immediately prior to signal to minimize
+                        // the proof-to-signal window (c-m3). The window cannot be closed
+                        // from Node: pidfd_open/pidfd_send_signal have no stdlib binding
+                        // and a native addon is out of scope, so the re-read plus
+                        // fail-closed retain on any divergence is the mitigation.
+                        let raceDiverged = false;
+                        if (process.platform === "linux") {
+                            const liveNow = readProcessStartTime(rawMeta.childPid);
+                            if (liveNow === undefined || liveNow !== rawMeta.childStartTime) {
+                                raceDiverged = true;
+                            }
+                        }
+                        if (raceDiverged) {
+                            skippedUnprovenChild++;
+                            if (options.onUnprovenChild) {
+                                options.onUnprovenChild({
+                                    runDir,
+                                    childPid: rawMeta.childPid,
+                                    reason: "child_start_time_mismatched",
+                                });
+                            }
+                        }
+                        else {
+                            try {
+                                const reaper = options.reapProcessTreeFn ?? reapProcessTree;
+                                await reaper(rawMeta.childPid, "SIGKILL", 50);
+                            }
+                            catch {
+                                // Best effort
+                            }
+                        }
+                    }
+                    else {
+                        // Identity not positively proven: NEVER signal! Skip child reap and report.
+                        skippedUnprovenChild++;
+                        if (options.onUnprovenChild) {
+                            options.onUnprovenChild({
+                                runDir,
+                                childPid: rawMeta.childPid,
+                                reason: proof.reason ?? "unproven_identity",
+                            });
+                        }
+                        // Retain sandbox when the child might still be the legitimate seat process running
+                        // (e.g. unrecorded start-time, non-Linux unprovable, pid namespace unprovable, cwd unreadable).
+                        // Only sweep when identity proves it is definitely a different process (mismatched start-time, mismatched boot-id).
+                        if (proof.reason === "child_start_time_unrecorded" ||
+                            proof.reason === "non_linux_process_identity_unprovable" ||
+                            proof.reason === "pid_namespace_mismatch_or_unrecorded" ||
+                            proof.reason === "child_cwd_unreadable") {
+                            retained++;
+                            continue;
+                        }
+                    }
+                }
+            }
+            try {
+                rmSync(runDir, { recursive: true, force: true });
+                swept++;
+            }
+            catch {
+                retained++;
+            }
+        }
+    }
+    finally {
+        try {
+            if (sweepFd !== null) {
+                closeSync(sweepFd);
+                sweepFd = null;
+            }
+        }
+        catch {
+            // Best effort
+        }
+        try {
+            const current = readSweepHolder();
+            if (current && current.token === sweepToken) {
+                unlinkSync(sweepLockFile);
+            }
+        }
+        catch {
+            // Best effort
+        }
+    }
+    return skippedUnprovenChild > 0
+        ? { swept, retained, skippedAlive, skippedUnprovenChild }
+        : { swept, retained, skippedAlive };
+}
+//# sourceMappingURL=claude-code-cli-lifecycle.js.map

package/dist/claude-code-cli-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-cli-lifecycle.js","sourceRoot":"","sources":["../src/claude-code-cli-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAEzG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,CAAC,WAAW;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC,CAAC,WAAW;AAiBnE;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CAAC,MAA+B;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;IAC3C,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,aAAa,KAAK,SAAS;QAC3B,MAAM,CAAC,YAAY,KAAK,aAAa,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;IACpC,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,WAAW,KAAK,SAAS;QACzB,MAAM,CAAC,SAAS,KAAK,WAAW,EAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,aAAa,KAAK,SAAS;QAC3B,aAAa,KAAK,MAAM,CAAC,SAAS,EAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,UAAU,KAAK,SAAS;QACxB,UAAU,KAAK,MAAM,CAAC,MAAM,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,OAMC,EACD,UAAmC,EACnC,MAAc;IAEd,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClD,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACnD,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,iBAAiB,GACrB,CAAC,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;YAChE,UAAU,CAAC,MAAM,CAAC;QACpB,IACE,OAAO,iBAAiB,KAAK,QAAQ;YACrC,CAAC,iBAAiB;YAClB,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,iBAAiB,EAChC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;QAC3C,MAAM,eAAe,GACnB,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC;YAC5E,UAAU,CAAC,YAAY,CAAC;QAC1B,IACE,OAAO,eAAe,KAAK,QAAQ;YACnC,CAAC,eAAe;YAChB,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,eAAe,EACjC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;QACpC,IACE,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ;YACxC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,UAAU,CAAC,SAAS,CAAC,EACnE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QAED,IACE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;YAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;YACxC,OAAO,CAAC,cAAc,IAAI,CAAC,EAC3B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,QAAQ,MAAM,CAAC,CAAC;gBACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC;gBACtE,IAAI,OAAO,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAChG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBAC3D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC1C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBACnD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+EAA+E;QAC/E,+EAA+E;QAC/E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,QAAQ,GAAG,4BAA4B,EACvC,QAAQ,GAAG,4BAA4B;IAEvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,GAAG,GAAG,CAAC;IAClC,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,SAAyB,SAAS,EAClC,aAAa,GAAG,GAAG;IAEnB,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO;IAErB,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,oCAAoC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,qBAAqB;IACrB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAEvD,uCAAuC;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAgBD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,UAAuC,EAAE;IAEzC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,6BAA6B,CAAC;IACnE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAExC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC3C,CAAC;IAED,uDAAuD;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,eAAe,GAAG,GAAmC,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,OAAO,MAAiC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClG,aAAa,CACX,OAAO,EACP,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI;YACpD,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI;YAC5B,YAAY,EAAE,kBAAkB,EAAE,IAAI,IAAI;YAC1C,SAAS,EAAE,aAAa,EAAE,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GACb,MAAM,IAAI,OAAQ,MAAmC,CAAC,UAAU,KAAK,QAAQ;YAC3E,CAAC,CAAC,GAAG,GAAG,CAAE,MAAiC,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,CAAC,CAAC;QACR,IAAI,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC;gBACH,UAAU,CAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;gBAClC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAClG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YACnG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAE/C,IAAI,IAAI,GAA+D,IAAI,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,IAAI,GAAG,MAA2D,CAAC;gBACrE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YAED,4DAA4D;YAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChF,QAAQ,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,oEAAoE;YACpE,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;gBACpC,QAAQ,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,8GAA8G;YAC9G,MAAM,OAAO,GAAG,IAKf,CAAC;YACF,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjE,IAAI,UAAU,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBAClC,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,GAAG,KAAK,CAAC;gBACrB,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBACnF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACjB,+DAA+D;wBAC/D,iEAAiE;wBACjE,iEAAiE;wBACjE,0DAA0D;wBAC1D,0DAA0D;wBAC1D,IAAI,YAAY,GAAG,KAAK,CAAC;wBACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;4BACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;4BACvD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;gCAChE,YAAY,GAAG,IAAI,CAAC;4BACtB,CAAC;wBACH,CAAC;wBACD,IAAI,YAAY,EAAE,CAAC;4BACjB,oBAAoB,EAAE,CAAC;4BACvB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gCAC5B,OAAO,CAAC,eAAe,CAAC;oCACtB,MAAM;oCACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;oCAC1B,MAAM,EAAE,6BAA6B;iCACtC,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC;gCACH,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,IAAI,eAAe,CAAC;gCAC5D,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;4BAChD,CAAC;4BAAC,MAAM,CAAC;gCACP,cAAc;4BAChB,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,4EAA4E;wBAC5E,oBAAoB,EAAE,CAAC;wBACvB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;4BAC5B,OAAO,CAAC,eAAe,CAAC;gCACtB,MAAM;gCACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gCAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,mBAAmB;6BAC5C,CAAC,CAAC;wBACL,CAAC;wBACD,mFAAmF;wBACnF,gGAAgG;wBAChG,oHAAoH;wBACpH,IACE,KAAK,CAAC,MAAM,KAAK,6BAA6B;4BAC9C,KAAK,CAAC,MAAM,KAAK,uCAAuC;4BACxD,KAAK,CAAC,MAAM,KAAK,sCAAsC;4BACvD,KAAK,CAAC,MAAM,KAAK,sBAAsB,EACvC,CAAC;4BACD,QAAQ,EAAE,CAAC;4BACX,SAAS;wBACX,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,KAAK,EAAE,CAAC;YACV,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,eAAe,EAAgC,CAAC;YAChE,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC5C,UAAU,CAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,OAAO,oBAAoB,GAAG,CAAC;QAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE;QACzD,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC"}

package/dist/claude-code-cli-runner.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Claude Code CLI Runner: executes the official `claude` CLI (resolved
+ * from `PATH` at each attempt) with NDJSON streaming, strict isolation,
+ * process reaping, credential read-back, and static error handling.
+ * No version pin, no digest fingerprint, no attestation: no other seat
+ * carries such machinery, and none is claimed here.
+ */
+import { spawn } from "node:child_process";
+import type { ClaudeCodeAccessProjection, ClaudeCodeCliCapabilities, ClaudeCodeCliEvent, ClaudeCodeCliRequest, ClaudeCodeCliRunner } from "./claude-seat-mesh-contract.js";
+/**
+ * Resolve the official `claude` CLI from `PATH` (Linux-first; Windows
+ * resolves `claude` and `claude.exe` only — `.cmd`/`.bat` shims are
+ * excluded because spawn launches without a shell). Returns the first
+ * absolute regular executable candidate, or undefined when none is found.
+ * Never throws, never executes anything.
+ */
+export declare function resolveClaudeBinaryFromPath(env?: NodeJS.ProcessEnv): string | undefined;
+export declare const DEFAULT_MAX_FRAME_BYTES = 65536;
+export declare const DEFAULT_MAX_TOTAL_BYTES: number;
+export declare const DEFAULT_RUN_DEADLINE_MS = 120000;
+/**
+ * Strict allowlist of typed tool identifiers permitted for the CLI --tools flag.
+ * Caller-provided tool names are never passed to --tools.
+ */
+export declare const ALLOWED_TYPED_TOOL_IDENTIFIERS: readonly string[];
+/**
+ * Known built-in tools of the Claude CLI. Callers cannot request these names.
+ */
+export declare const BUILTIN_CLI_TOOLS: Set<string>;
+/**
+ * Top-level NDJSON frame types emitted by the official CLI stream-json
+ * output that are known transport or lifecycle events and should not be failed as unknown.
+ */
+export declare const KNOWN_IGNORED_TOP_LEVEL_TYPES: Set<string>;
+export interface OfficialClaudeCodeCliRunnerOptions {
+    /**
+     * Explicit binary path override (test seam). When absent, the runner
+     * resolves `claude` from `PATH` at each attempt.
+     */
+    readonly binaryPath?: string;
+    readonly capabilities?: ClaudeCodeCliCapabilities;
+    readonly maxFrameBytes?: number;
+    readonly maxTotalBytes?: number;
+    readonly timeoutMs?: number;
+    readonly spawnFn?: typeof spawn;
+    readonly now?: () => number;
+    /** Test seam directing sandbox roots away from the per-user runtime base. */
+    readonly sandboxRootDir?: string;
+    /** Allowlist of typed tool identifiers authorized for the CLI --tools flag. */
+    readonly allowedCliTools?: readonly string[];
+    /** Test seam injecting process group killer instead of process.kill(-childPid). */
+    readonly killProcessTreeFn?: (pid: number, signal?: NodeJS.Signals) => void;
+    /** Test seam injecting process tree reaper instead of reapProcessTree(childPid). */
+    readonly reapProcessTreeFn?: (pid: number, signal?: NodeJS.Signals, gracePeriodMs?: number) => Promise<void>;
+}
+export declare class OfficialClaudeCodeCliRunner implements ClaudeCodeCliRunner {
+    private readonly binaryPath;
+    private readonly capabilities;
+    private readonly maxFrameBytes;
+    private readonly maxTotalBytes;
+    private readonly timeoutMs;
+    private readonly spawnFn;
+    private readonly now;
+    private readonly sandboxRootDir;
+    private readonly allowedCliTools;
+    private readonly killProcessTreeFn;
+    private readonly reapProcessTreeFn;
+    constructor(options?: OfficialClaudeCodeCliRunnerOptions);
+    /**
+     * Resolve the spawn candidate: the explicit override when set,
+     * otherwise the official `claude` CLI from `PATH` (re-resolved at each
+     * attempt, so a later CLI install is picked up without a restart).
+     * Generic spawn safety only — absolute resolved path, regular executable
+     * file, supported protocol. No version pin, no fingerprint, no attestation.
+     */
+    private resolveBinary;
+    /**
+     * Refuse to spawn unless the candidate resolves and the mesh protocol
+     * matches. Anything less is refused before spawn.
+     */
+    private qualifyBinary;
+    run(input: {
+        access: ClaudeCodeAccessProjection;
+        request: ClaudeCodeCliRequest;
+        signal: AbortSignal;
+    }): AsyncIterable<ClaudeCodeCliEvent>;
+    private runInternal;
+}
+//# sourceMappingURL=claude-code-cli-runner.d.ts.map

package/dist/claude-code-cli-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-cli-runner.d.ts","sourceRoot":"","sources":["../src/claude-code-cli-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,KAAK,EACV,0BAA0B,EAC1B,yBAAyB,EAEzB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,gCAAgC,CAAC;AA4BxC;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAgBpB;AAED,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AACxD,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAgB,CAAC;AAE7E;;GAEG;AACH,eAAO,MAAM,iBAAiB,aAiB5B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,6BAA6B,aAQxC,CAAC;AAEH,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC5E,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9G;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgC;IAChE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+D;IACjG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAEpB;gBAEF,OAAO,GAAE,kCAAuC;IAc5D;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAcrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAOrB,GAAG,CAAC,KAAK,EAAE;QACT,MAAM,EAAE,0BAA0B,CAAC;QACnC,OAAO,EAAE,oBAAoB,CAAC;QAC9B,MAAM,EAAE,WAAW,CAAC;KACrB,GAAG,aAAa,CAAC,kBAAkB,CAAC;YA4BtB,WAAW;CA6e3B"}