@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/Path.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Explicit kernel decision for the Effect path service.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Layer, Path as EffectPath } from "effect";
+import { Workspace } from "./Workspace.ts";
+/**
+ * Effect's lexical path-service shape.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Path = EffectPath.Path;
+/**
+ * The unchanged underlying path-service tag.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export declare const Path: import("effect/Context").Service<EffectPath.Path, EffectPath.Path>;
+/**
+ * Re-provides Effect's path service with relative paths resolved against
+ * `Workspace.root`, the same root the kernel spawner runs commands in. Path
+ * manipulation is pure and lexical, so it requires no capability check. This
+ * explicit layer proves that every member of the Host services closed list has
+ * a kernel decision.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: Layer.Layer<Path, never, Path | Workspace>;
+//# sourceMappingURL=Path.d.ts.map

package/dist/esm/Path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Path.d.ts","sourceRoot":"","sources":["../../src/Path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAU,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;AAElC;;;;;GAKG;AACH,eAAO,MAAM,IAAI,oEAAkB,CAAA;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,SAAS,CAM5D,CAAA"}

package/dist/esm/Path.js

@@ -0,0 +1,34 @@
+/**
+ * Explicit kernel decision for the Effect path service.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Effect, Layer, Path as EffectPath } from "effect";
+import * as Rooted from "./Rooted.js";
+import { Workspace } from "./Workspace.js";
+/**
+ * The unchanged underlying path-service tag.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export const Path = EffectPath.Path;
+/**
+ * Re-provides Effect's path service with relative paths resolved against
+ * `Workspace.root`, the same root the kernel spawner runs commands in. Path
+ * manipulation is pure and lexical, so it requires no capability check. This
+ * explicit layer proves that every member of the Host services closed list has
+ * a kernel decision.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layer = Layer.effect(Path, Effect.gen(function* () {
+    const path = yield* Path;
+    return Rooted.path(path, path.resolve((yield* Workspace).root));
+}));
+//# sourceMappingURL=Path.js.map

package/dist/esm/Path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Path.js","sourceRoot":"","sources":["../../src/Path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC1D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAU1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAA+C,KAAK,CAAC,MAAM,CAC3E,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC,CAAC,CACH,CAAA","sourcesContent":["/**\n * Explicit kernel decision for the Effect path service.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md` and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport { Effect, Layer, Path as EffectPath } from \"effect\"\nimport * as Rooted from \"./Rooted.ts\"\nimport { Workspace } from \"./Workspace.ts\"\n\n/**\n * Effect's lexical path-service shape.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Path = EffectPath.Path\n\n/**\n * The unchanged underlying path-service tag.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport const Path = EffectPath.Path\n\n/**\n * Re-provides Effect's path service with relative paths resolved against\n * `Workspace.root`, the same root the kernel spawner runs commands in. Path\n * manipulation is pure and lexical, so it requires no capability check. This\n * explicit layer proves that every member of the Host services closed list has\n * a kernel decision.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer: Layer.Layer<Path, never, Path | Workspace> = Layer.effect(\n  Path,\n  Effect.gen(function*() {\n    const path = yield* Path\n    return Rooted.path(path, path.resolve((yield* Workspace).root))\n  })\n)\n"]}

package/dist/esm/ProcessConfinement.d.ts

@@ -0,0 +1,55 @@
+/** Operating-system confinement derived conservatively from effective grants.
+ * @since 1.0.0-rc.1
+ */
+import type { GrantStoreError } from "@smthrs/capability/Permission";
+import { Context, Effect, Layer, type Path, type Scope } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import type * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { Service as GrantService } from "./GrantStore.ts";
+/** Workspace-relative trees; `.` names the workspace. No path opens its parent.
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Profile {
+    readonly workspaceRoot: string;
+    readonly reads: ReadonlyArray<string>;
+    readonly writes: ReadonlyArray<string>;
+    readonly readOnly: ReadonlyArray<string>;
+    readonly network: "none" | "open";
+}
+/** Host wrapper for one process stage. Failure must occur before spawning.
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Service {
+    readonly confine: (command: ChildProcess.StandardCommand, profile: Profile) => Effect.Effect<ChildProcess.StandardCommand, PlatformError, Scope.Scope>;
+}
+declare const ProcessConfinement_base: Context.ServiceClass<ProcessConfinement, "@smthrs/kernel/ProcessConfinement", Service>;
+/** Host confinement seam; missing service refuses spawning.
+ * @category services
+ * @since 1.0.0-rc.1
+ */
+export declare class ProcessConfinement extends ProcessConfinement_base {
+}
+/** Explicit unconfined composition.
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export declare const makeNoop: Service;
+/** Explicit unconfined layer.
+ * @category layers
+ * @since 1.0.0-rc.1
+ */
+export declare const layerNoop: Layer.Layer<ProcessConfinement>;
+/** Derives a subset of authority, never a widening. Literal filesystem grants,
+ * complex globs and unrepresentable restrictions conservatively open nothing.
+ * Writable trees also require read authority and write authority over their
+ * exact directory root: native mounts permit reads and directory metadata
+ * changes. Only whole-tree grants prove filesystem trees; unrestricted
+ * authority for each of get/post/private is required to open network access.
+ * @category resolution
+ * @since 1.0.0-rc.1
+ */
+export declare const profile: (grants: GrantService, workspaceRoot: string, path: Path.Path) => Effect.Effect<Profile, GrantStoreError>;
+export {};
+//# sourceMappingURL=ProcessConfinement.d.ts.map

package/dist/esm/ProcessConfinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessConfinement.d.ts","sourceRoot":"","sources":["../../src/ProcessConfinement.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,KAAK,YAAY,MAAM,sCAAsC,CAAA;AACzE,OAAO,KAAK,EAAsB,OAAO,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAElF;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;CAClC;AACD;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,CAChB,OAAO,EAAE,YAAY,CAAC,eAAe,EACrC,OAAO,EAAE,OAAO,KACb,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;CAC7E;;AACD;;;GAGG;AACH,qBAAa,kBACX,SAAQ,uBAAmF;CAC3F;AACF;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,OAAkF,CAAA;AACzG;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAA+C,CAAA;AAqCrG;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAClB,QAAQ,YAAY,EACpB,eAAe,MAAM,EACrB,MAAM,IAAI,CAAC,IAAI,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAiDrC,CAAA"}

package/dist/esm/ProcessConfinement.js

@@ -0,0 +1,106 @@
+/** Operating-system confinement derived conservatively from effective grants.
+ * @since 1.0.0-rc.1
+ */
+import { Capability, CapabilityPattern, matches, maxResourceLength, subsumes, withinMatchBudget } from "@smthrs/capability/Capability";
+import { Context, Effect, Layer } from "effect";
+/** Host confinement seam; missing service refuses spawning.
+ * @category services
+ * @since 1.0.0-rc.1
+ */
+export class ProcessConfinement extends Context.Service()("@smthrs/kernel/ProcessConfinement") {
+}
+/** Explicit unconfined composition.
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export const makeNoop = ProcessConfinement.of({ confine: (command) => Effect.succeed(command) });
+/** Explicit unconfined layer.
+ * @category layers
+ * @since 1.0.0-rc.1
+ */
+export const layerNoop = Layer.succeed(ProcessConfinement)(makeNoop);
+const decidable = (pattern, action) => withinMatchBudget(pattern, new Capability({ action, resource: "x".repeat(maxResourceLength) }));
+// The capability matcher permits a single star to cross separators. Only
+// this universal spelling is equivalent to **; arbitrary globs stay closed.
+const universal = (pattern) => pattern.resource === "*" ? new CapabilityPattern({ action: pattern.action, resource: "**" }) : pattern;
+const coversCeiling = (ceiling, target) => ceiling.groups.every((group) => group.some((pattern) => decidable(pattern, target.action) && subsumes(universal(pattern), target)));
+const actionRelevant = (pattern, action) => matches(new CapabilityPattern({ action: pattern.action, resource: "**" }), new Capability({ action, resource: "" }));
+// A covering rule resolves the complete region. A narrower/conditional refusal
+// makes it unknown until a later covering rule resolves it. Unknown configured
+// denial vetoes all later grant groups, just as evaluate's configured veto does.
+const prove = (policy, target) => {
+    if (!coversCeiling(policy.ceiling, target))
+        return false;
+    let decision = "ask";
+    let configured = "ask";
+    for (const [index, group] of policy.groups.entries()) {
+        for (const { rule, ceiling } of group) {
+            if (!decidable(rule.pattern, target.action))
+                return false;
+            if (!actionRelevant(rule.pattern, target.action))
+                continue;
+            if (target.action === "net:private" && rule.effect === "allow" && rule.pattern.action !== "net:private")
+                continue;
+            if (coversCeiling(ceiling, target) && subsumes(universal(rule.pattern), target))
+                decision = rule.effect;
+            else if (rule.effect !== "allow")
+                decision = "unknown";
+            if (index === 0)
+                configured = decision;
+        }
+    }
+    return configured !== "deny" && configured !== "unknown" && decision === "allow";
+};
+/** Derives a subset of authority, never a widening. Literal filesystem grants,
+ * complex globs and unrepresentable restrictions conservatively open nothing.
+ * Writable trees also require read authority and write authority over their
+ * exact directory root: native mounts permit reads and directory metadata
+ * changes. Only whole-tree grants prove filesystem trees; unrestricted
+ * authority for each of get/post/private is required to open network access.
+ * @category resolution
+ * @since 1.0.0-rc.1
+ */
+export const profile = (grants, workspaceRoot, path) => Effect.gen(function* () {
+    const policy = yield* grants.policy;
+    const root = path.resolve(workspaceRoot);
+    const resources = [
+        ...policy.groups.flatMap((group) => group.flatMap(({ rule, ceiling }) => [rule.pattern, ...ceiling.groups.flat()])),
+        ...policy.ceiling.groups.flat()
+    ];
+    const candidates = new Set();
+    for (const { resource } of resources) {
+        if (resource === "**" || resource === "*") {
+            candidates.add(".");
+            continue;
+        }
+        if (!resource.endsWith("/**") || /[*?]/.test(resource.slice(0, -3)))
+            continue;
+        const base = resource.slice(0, -3);
+        // Relative policy resources do not authorize absolute kernel resources.
+        if (!path.isAbsolute(base) || path.normalize(base) !== base)
+            continue;
+        const relative = path.relative(root, base);
+        if (path.isAbsolute(relative) || relative.split(path.sep)[0] === "..")
+            continue;
+        candidates.add(relative === "" ? "." : relative.split(path.sep).join("/"));
+    }
+    const opened = (action) => [...candidates].filter((relative) => {
+        const directory = relative === "." ? root : path.resolve(root, relative);
+        const resource = `${directory}/**`;
+        return prove(policy, new CapabilityPattern({ action, resource })) &&
+            (action !== "fs:write" || (prove(policy, new CapabilityPattern({ action: "fs:read", resource })) &&
+                prove(policy, new CapabilityPattern({ action: "fs:write", resource: directory }))));
+    })
+        .filter((relative, _, all) => !all.some((parent) => parent !== relative && (parent === "." || relative.startsWith(`${parent}/`))))
+        .sort();
+    return Object.freeze({
+        workspaceRoot: root,
+        reads: Object.freeze(opened("fs:read")),
+        writes: Object.freeze(opened("fs:write")),
+        readOnly: Object.freeze([]),
+        network: ["net:get", "net:post", "net:private"].every((action) => prove(policy, new CapabilityPattern({ action, resource: "**" }))) ?
+            "open" :
+            "none"
+    });
+});
+//# sourceMappingURL=ProcessConfinement.js.map

package/dist/esm/ProcessConfinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessConfinement.js","sourceRoot":"","sources":["../../src/ProcessConfinement.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,UAAU,EACV,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,iBAAiB,EAClB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAyB,MAAM,QAAQ,CAAA;AA0BtE;;;GAGG;AACH,MAAM,OAAO,kBACX,SAAQ,OAAO,CAAC,OAAO,EAA+B,CAAC,mCAAmC,CAAC;CAC3F;AACF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACzG;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAoC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAA;AAErG,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAE,MAAc,EAAE,EAAE,CAC/D,iBAAiB,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAA;AAEjG,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAClE,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAExG,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAE,MAAyB,EAAW,EAAE,CAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAgB,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAC7G,CAAA;AACH,MAAM,cAAc,GAAG,CAAC,OAA0B,EAAE,MAAc,EAAW,EAAE,CAC7E,OAAO,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAEtH,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,MAAyB,EAAW,EAAE;IACnE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACxD,IAAI,QAAQ,GAAyC,KAAK,CAAA;IAC1D,IAAI,UAAU,GAAyC,KAAK,CAAA;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAgB,CAAC;gBAAE,OAAO,KAAK,CAAA;YACnE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAgB,CAAC;gBAAE,SAAQ;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa;gBAAE,SAAQ;YACjH,IAAI,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;iBAClG,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,QAAQ,GAAG,SAAS,CAAA;YACtD,IAAI,KAAK,KAAK,CAAC;gBAAE,UAAU,GAAG,QAAQ,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,CAAA;AAClF,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAoB,EACpB,aAAqB,EACrB,IAAe,EAC0B,EAAE,CAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG;QAChB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACjC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAC/E;QACD,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;KAChC,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,SAAS,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClC,wEAAwE;QACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,SAAQ;QAC/E,UAAU,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;QAClC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/D,CAAC,MAAM,KAAK,UAAU,IAAI,CACxB,KAAK,CAAC,MAAM,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,MAAM,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAClF,CAAC,CAAA;IACN,CAAC,CAAC;SACC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAC3B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CACpG;SACA,IAAI,EAAE,CAAA;IACX,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAG,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAW,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,KAAK,CAAC,MAAM,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CACjE,CAAC,CAAC;YACH,MAAe,CAAC,CAAC;YACjB,MAAe;KAClB,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["/** Operating-system confinement derived conservatively from effective grants.\n * @since 1.0.0-rc.1\n */\n\nimport {\n  type Action,\n  Capability,\n  CapabilityPattern,\n  matches,\n  maxResourceLength,\n  subsumes,\n  withinMatchBudget\n} from \"@smthrs/capability/Capability\"\nimport type { GrantStoreError } from \"@smthrs/capability/Permission\"\nimport { Context, Effect, Layer, type Path, type Scope } from \"effect\"\nimport type { PlatformError } from \"effect/PlatformError\"\nimport type * as ChildProcess from \"effect/unstable/process/ChildProcess\"\nimport type { Policy, PolicyRule, Service as GrantService } from \"./GrantStore.ts\"\n\n/** Workspace-relative trees; `.` names the workspace. No path opens its parent.\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface Profile {\n  readonly workspaceRoot: string\n  readonly reads: ReadonlyArray<string>\n  readonly writes: ReadonlyArray<string>\n  readonly readOnly: ReadonlyArray<string>\n  readonly network: \"none\" | \"open\"\n}\n/** Host wrapper for one process stage. Failure must occur before spawning.\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface Service {\n  readonly confine: (\n    command: ChildProcess.StandardCommand,\n    profile: Profile\n  ) => Effect.Effect<ChildProcess.StandardCommand, PlatformError, Scope.Scope>\n}\n/** Host confinement seam; missing service refuses spawning.\n * @category services\n * @since 1.0.0-rc.1\n */\nexport class ProcessConfinement\n  extends Context.Service<ProcessConfinement, Service>()(\"@smthrs/kernel/ProcessConfinement\")\n{}\n/** Explicit unconfined composition.\n * @category constructors\n * @since 1.0.0-rc.1\n */\nexport const makeNoop: Service = ProcessConfinement.of({ confine: (command) => Effect.succeed(command) })\n/** Explicit unconfined layer.\n * @category layers\n * @since 1.0.0-rc.1\n */\nexport const layerNoop: Layer.Layer<ProcessConfinement> = Layer.succeed(ProcessConfinement)(makeNoop)\n\nconst decidable = (pattern: CapabilityPattern, action: Action) =>\n  withinMatchBudget(pattern, new Capability({ action, resource: \"x\".repeat(maxResourceLength) }))\n\n// The capability matcher permits a single star to cross separators. Only\n// this universal spelling is equivalent to **; arbitrary globs stay closed.\nconst universal = (pattern: CapabilityPattern): CapabilityPattern =>\n  pattern.resource === \"*\" ? new CapabilityPattern({ action: pattern.action, resource: \"**\" }) : pattern\n\nconst coversCeiling = (ceiling: PolicyRule[\"ceiling\"], target: CapabilityPattern): boolean =>\n  ceiling.groups.every((group) =>\n    group.some((pattern) => decidable(pattern, target.action as Action) && subsumes(universal(pattern), target))\n  )\nconst actionRelevant = (pattern: CapabilityPattern, action: Action): boolean =>\n  matches(new CapabilityPattern({ action: pattern.action, resource: \"**\" }), new Capability({ action, resource: \"\" }))\n\n// A covering rule resolves the complete region. A narrower/conditional refusal\n// makes it unknown until a later covering rule resolves it. Unknown configured\n// denial vetoes all later grant groups, just as evaluate's configured veto does.\nconst prove = (policy: Policy, target: CapabilityPattern): boolean => {\n  if (!coversCeiling(policy.ceiling, target)) return false\n  let decision: \"allow\" | \"deny\" | \"ask\" | \"unknown\" = \"ask\"\n  let configured: \"allow\" | \"deny\" | \"ask\" | \"unknown\" = \"ask\"\n  for (const [index, group] of policy.groups.entries()) {\n    for (const { rule, ceiling } of group) {\n      if (!decidable(rule.pattern, target.action as Action)) return false\n      if (!actionRelevant(rule.pattern, target.action as Action)) continue\n      if (target.action === \"net:private\" && rule.effect === \"allow\" && rule.pattern.action !== \"net:private\") continue\n      if (coversCeiling(ceiling, target) && subsumes(universal(rule.pattern), target)) decision = rule.effect\n      else if (rule.effect !== \"allow\") decision = \"unknown\"\n      if (index === 0) configured = decision\n    }\n  }\n  return configured !== \"deny\" && configured !== \"unknown\" && decision === \"allow\"\n}\n\n/** Derives a subset of authority, never a widening. Literal filesystem grants,\n * complex globs and unrepresentable restrictions conservatively open nothing.\n * Writable trees also require read authority and write authority over their\n * exact directory root: native mounts permit reads and directory metadata\n * changes. Only whole-tree grants prove filesystem trees; unrestricted\n * authority for each of get/post/private is required to open network access.\n * @category resolution\n * @since 1.0.0-rc.1\n */\nexport const profile = (\n  grants: GrantService,\n  workspaceRoot: string,\n  path: Path.Path\n): Effect.Effect<Profile, GrantStoreError> =>\n  Effect.gen(function*() {\n    const policy = yield* grants.policy\n    const root = path.resolve(workspaceRoot)\n    const resources = [\n      ...policy.groups.flatMap((group) =>\n        group.flatMap(({ rule, ceiling }) => [rule.pattern, ...ceiling.groups.flat()])\n      ),\n      ...policy.ceiling.groups.flat()\n    ]\n    const candidates = new Set<string>()\n    for (const { resource } of resources) {\n      if (resource === \"**\" || resource === \"*\") {\n        candidates.add(\".\")\n        continue\n      }\n      if (!resource.endsWith(\"/**\") || /[*?]/.test(resource.slice(0, -3))) continue\n      const base = resource.slice(0, -3)\n      // Relative policy resources do not authorize absolute kernel resources.\n      if (!path.isAbsolute(base) || path.normalize(base) !== base) continue\n      const relative = path.relative(root, base)\n      if (path.isAbsolute(relative) || relative.split(path.sep)[0] === \"..\") continue\n      candidates.add(relative === \"\" ? \".\" : relative.split(path.sep).join(\"/\"))\n    }\n    const opened = (action: Action) =>\n      [...candidates].filter((relative) => {\n        const directory = relative === \".\" ? root : path.resolve(root, relative)\n        const resource = `${directory}/**`\n        return prove(policy, new CapabilityPattern({ action, resource })) &&\n          (action !== \"fs:write\" || (\n            prove(policy, new CapabilityPattern({ action: \"fs:read\", resource })) &&\n            prove(policy, new CapabilityPattern({ action: \"fs:write\", resource: directory }))\n          ))\n      })\n        .filter((relative, _, all) =>\n          !all.some((parent) => parent !== relative && (parent === \".\" || relative.startsWith(`${parent}/`)))\n        )\n        .sort()\n    return Object.freeze({\n      workspaceRoot: root,\n      reads: Object.freeze(opened(\"fs:read\")),\n      writes: Object.freeze(opened(\"fs:write\")),\n      readOnly: Object.freeze([]),\n      network: ([\"net:get\", \"net:post\", \"net:private\"] as const).every((action) =>\n          prove(policy, new CapabilityPattern({ action, resource: \"**\" }))\n        ) ?\n        \"open\" as const :\n        \"none\" as const\n    })\n  })\n"]}

package/dist/esm/ProcessLedger.d.ts

@@ -0,0 +1,260 @@
+/**
+ * The host's ledger of the processes it spawned.
+ *
+ * A cancelled run must not leave a child agent running, and the engine cannot
+ * do anything about that on its own: cancellation interrupts fibers, and a
+ * fiber closing its scope only reaches the processes THIS incarnation of the
+ * host still holds a handle for. A host that crashed left its children with no
+ * one holding anything.
+ *
+ * The ledger is the missing half. Every spawn is recorded here in memory and
+ * written to the journal as an ownerless durable record. It is ownerless
+ * because it describes the host rather than a run, and first-writer-wins is
+ * exactly the semantics a spawn record wants. The next incarnation of the same
+ * `hostId` replays those records, subtracts the ones that reported an exit,
+ * and is left with {@link Service.orphans}: the process groups a dead owner
+ * abandoned, which a platform reaper can then signal.
+ *
+ * The kernel stays BELOW the engine: this module records pids and process
+ * groups and knows nothing about runs, attempts, or ownership fences. It also
+ * stays platform-neutral, because signalling a process group is a platform
+ * concern and lives in `@smthrs/platform-node`.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Host Adapters.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as JournalModule from "@smthrs/journal/Journal";
+import type { JournalError } from "@smthrs/journal/Journal";
+import * as JournalEvent from "@smthrs/journal/JournalEvent";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+/**
+ * The event type recording that a host started a process.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const SpawnedEventType = "flows.host.process-spawned.v1";
+/**
+ * The event type recording that a recorded process ended.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const ExitedEventType = "flows.host.process-exited.v1";
+/**
+ * The event type recording that a later incarnation killed an abandoned
+ * process group.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const ReapedEventType = "flows.host.process-reaped.v1";
+/**
+ * The event type recording that a later incarnation retired a record WITHOUT
+ * signalling anything.
+ *
+ * A stored pid outlives the process that wrote it, so a reaper that cannot
+ * prove the number still names the process the record describes must not
+ * signal it. Retiring the record is still correct: nothing will ever be able
+ * to prove it again, and leaving it would make every later incarnation
+ * re-examine a number the operating system has moved on from.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const SkippedEventType = "flows.host.process-reap-skipped.v1";
+/**
+ * The producer id every ledger record is written under.
+ *
+ * Replay checks it: a record forged by another producer cannot make a host
+ * signal a process group.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const sourceId = "@smthrs/kernel/ProcessLedger";
+/**
+ * The journal run a host's process records live on.
+ *
+ * Process records describe a host, not a run, so they get a run of their own,
+ * named after the host. Two incarnations of one `hostId` therefore share a
+ * history, which is what makes an abandoned process discoverable.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const hostRunId: (hostId: string) => JournalEvent.RunId;
+/**
+ * What the spawner knows about a process the moment it starts.
+ *
+ * `pgid` is `null` when the child shares the host's own process group. Such a
+ * process cannot be group-signalled — signalling that group would signal the
+ * host itself — so the ledger records the absence rather than a number a
+ * reaper could misread.
+ *
+ * `commandDigest` names the executable and nothing else, as
+ * `CommandLine.executable` renders it. Arguments carry credentials
+ * (`curl -u user:password`, `mysql -phunter2`) and these records are permanent
+ * journal entries, so the ledger never writes an argument down. A reader that
+ * has to act on a record matches it by pid and process group; the program name
+ * is there to make the row legible.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Spawned {
+    readonly pid: number;
+    readonly pgid: number | null;
+    readonly commandDigest: string;
+}
+/**
+ * Schema for a recorded process, as it round-trips through the journal.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export declare const ProcessRecord: Schema.Struct<{
+    readonly pid: Schema.Int;
+    readonly pgid: Schema.NullOr<Schema.Int>;
+    readonly hostId: Schema.String;
+    readonly ownerPid: Schema.Int;
+    readonly startedAtMs: Schema.Int;
+    readonly commandDigest: Schema.String;
+}>;
+/**
+ * One process a host started, with the identity of the incarnation that
+ * started it.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type ProcessRecord = typeof ProcessRecord.Type;
+/**
+ * Why a ledger history could not be replayed.
+ *
+ * - `journal_unreadable`: a page of the host's history could not be read.
+ * - `cursor_stalled`: the journal reported more history but did not advance.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export declare const ProcessLedgerReplayErrorCode: Schema.Literals<readonly ["journal_unreadable", "cursor_stalled"]>;
+declare const ProcessLedgerReplayError_base: Schema.Class<ProcessLedgerReplayError, Schema.TaggedStruct<"@smthrs/kernel/ProcessLedgerReplayError", {
+    readonly code: Schema.Literals<readonly ["journal_unreadable", "cursor_stalled"]>;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Defect>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The ledger could not read a previous incarnation's history to its end.
+ *
+ * An unread history is never reported as an empty one: a caller that treated
+ * it as empty would leave every abandoned child running with no owner.
+ *
+ * @category errors
+ * @since 1.0.0-rc.1
+ */
+export declare class ProcessLedgerReplayError extends ProcessLedgerReplayError_base {
+}
+/**
+ * Ledger operations.
+ *
+ * Every write that has a durable half REPORTS whether that half committed.
+ * The in-memory set is still updated first, so a caller that decides to carry
+ * on has an accurate view of this incarnation, but the failure is not
+ * swallowed: a spawn whose record did not commit is a child that no later
+ * incarnation can discover, which is the exact hole this ledger exists to
+ * close. {@link ContainedSpawner} therefore refuses such a spawn, and the
+ * reaper leaves a record it could not retire in place so a later incarnation
+ * tries again.
+ *
+ * A ledger built with no journal ({@link makeMemory}) never fails: it promises
+ * nothing durable in the first place.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export interface Service {
+    /** Records a started process and returns the durable record written for it. */
+    readonly record: (spawned: Spawned) => Effect.Effect<ProcessRecord, JournalError>;
+    /** Records that a process ended, and drops it from {@link Service.live}. */
+    readonly release: (record: ProcessRecord) => Effect.Effect<void, JournalError>;
+    /** Records that an abandoned process group was signalled by this host. */
+    readonly reaped: (record: ProcessRecord) => Effect.Effect<void, JournalError>;
+    /**
+     * Retires a record this host refused to signal, naming why. The record
+     * leaves {@link Service.orphans} without anything having been killed.
+     */
+    readonly skipped: (record: ProcessRecord, reason: string) => Effect.Effect<void, JournalError>;
+    /** The processes this incarnation started and has not yet released. */
+    readonly live: Effect.Effect<ReadonlyArray<ProcessRecord>>;
+    /**
+     * The processes a previous incarnation of this host left running.
+     *
+     * Fails when that history cannot be read to its end, so an unreadable
+     * history is never mistaken for one with nothing left running.
+     */
+    readonly orphans: Effect.Effect<ReadonlyArray<ProcessRecord>, ProcessLedgerReplayError>;
+}
+declare const ProcessLedger_base: Context.ServiceClass<ProcessLedger, "@smthrs/kernel/ProcessLedger", Service>;
+/**
+ * The process-ledger service tag.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export declare class ProcessLedger extends ProcessLedger_base {
+}
+/**
+ * Ledger configuration.
+ *
+ * `hostId` is the durable identity two incarnations share; `ownerPid` is the
+ * process id of THIS incarnation, which is how a replay tells its own live
+ * processes from an abandoned one's.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Options {
+    readonly hostId: string;
+    readonly ownerPid: number;
+}
+/**
+ * Builds a journal-backed ledger.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (options: Options) => Effect.Effect<Service, never, JournalModule.Journal>;
+/**
+ * Builds a ledger that records nothing durably.
+ *
+ * A host without a journal still contains the processes it holds handles for —
+ * scope closure does that — but it inherits nothing from a previous
+ * incarnation, so {@link Service.orphans} is always empty.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const makeMemory: (options: Options) => Effect.Effect<Service>;
+/**
+ * Provides a journal-backed ledger.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: (options: Options) => Layer.Layer<ProcessLedger, never, JournalModule.Journal>;
+/**
+ * Provides a ledger that records nothing durably.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerMemory: (options: Options) => Layer.Layer<ProcessLedger>;
+export {};
+//# sourceMappingURL=ProcessLedger.d.ts.map

package/dist/esm/ProcessLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessLedger.d.ts","sourceRoot":"","sources":["../../src/ProcessLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,kCAAkC,CAAA;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,uCAAuC,CAAA;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,iCAAiC,CAAA;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,KAAG,YAAY,CAAC,KAAqD,CAAA;AAE7G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;EAOxB,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,oEAA4D,CAAA;;;;;;AAErG;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,6BAO7C;CAAG;AAKJ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,OAAO;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IACjF,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAC9E,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAC7E;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAC9F,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAA;IAC1D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC,CAAA;CACxF;;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,kBAAyE;CAAG;AAE/G;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AA+ID;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CACO,CAAA;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAqD,CAAA;AAExH;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CACpD,CAAA;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CACtB,CAAA"}