@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/execution/cli-provider.js

@@ -1,341 +0,0 @@
-/** Reviewed local Linux Docker boundary; no normal fleet/CLI delivery driver is used. */
-import { randomUUID } from "node:crypto";
-import { promisify } from "node:util";
-import { lstatSync } from "node:fs";
-import { execFile, spawn } from "../../child-process.js";
-import { z } from "zod";
-import { HubProtocolError, parseStrictJson, plain, uuid, validated } from "../validation.js";
-import { HubProviderSetupError } from "./provider-setup.js";
-import { documentArguments, documentTool, HubForbiddenModelTool, MODEL_WIRE_LIMIT, restrictedModelRequest, validateModelReply } from "./model-broker.js";
-const run = promisify(execFile);
-const cliEnv = { PATH: "/usr/local/bin:/usr/bin:/bin", LANG: "C.UTF-8" };
-export const HUB_PROVIDER_CLI_VERSIONS = Object.freeze({ claude: "2.1.316", codex: "0.166.0" });
-const object = (v) => z.record(z.string(), z.unknown()).parse(v);
-const includesPrompt = (v, prompt) => typeof v === "string" ? v.includes(prompt)
-    : Array.isArray(v) ? v.some(x => includesPrompt(x, prompt))
-        : !!v && typeof v === "object" && Object.values(v).some(x => includesPrompt(x, prompt));
-export function hubContainerArguments(imageId, name, token, contextId) {
-    return ["create", "--pull=never", "--name", name, "--label", `org.agend.hub.question=${token}`,
-        "--label", `org.agend.hub.context=${contextId}`,
-        "--network=none", "--read-only", "--log-driver=none", "--user=65532:65532", "--cap-drop=ALL", "--security-opt=no-new-privileges:true",
-        "--memory=1073741824", "--memory-swap=1073741824", "--cpus=1", "--pids-limit=64", "--ulimit", "nofile=128:128",
-        "--tmpfs", "/scratch:rw,nosuid,nodev,noexec,size=67108864,mode=1777", "--workdir=/scratch", "--init", "--interactive",
-        "--entrypoint=/usr/local/bin/node", imageId, "/opt/agend/sandbox-runner.js"];
-}
-/** Check actual engine state, not just the command that requested isolation. */
-export function verifyHubContainer(value, imageId, token, contextId) {
-    const c = object(value), h = object(c.HostConfig), config = object(c.Config), tmpfs = object(h.Tmpfs);
-    const security = z.array(z.string()).parse(h.SecurityOpt), caps = z.array(z.string()).parse(h.CapDrop);
-    if (c.Image !== imageId || config.User !== "65532:65532" || object(config.Labels)["org.agend.hub.question"] !== token
-        || contextId !== undefined && object(config.Labels)["org.agend.hub.context"] !== contextId
-        || config.WorkingDir !== "/scratch" || JSON.stringify(config.Entrypoint) !== JSON.stringify(["/usr/local/bin/node"])
-        || JSON.stringify(config.Cmd) !== JSON.stringify(["/opt/agend/sandbox-runner.js"])
-        || h.NetworkMode !== "none" || h.ReadonlyRootfs !== true || h.Privileged !== false || h.Init !== true || object(h.LogConfig).Type !== "none"
-        || h.Memory !== 1073741824 || h.MemorySwap !== 1073741824 || h.NanoCpus !== 1_000_000_000 || h.PidsLimit !== 64
-        || !caps.includes("ALL") || !security.some(s => s === "no-new-privileges:true" || s === "no-new-privileges")
-        || (Array.isArray(h.CapAdd) && h.CapAdd.length) || h.PidMode || h.IpcMode === "host" || h.UTSMode === "host"
-        || (Array.isArray(c.Mounts) && c.Mounts.length) || (Array.isArray(h.Binds) && h.Binds.length)
-        || (Array.isArray(h.Devices) && h.Devices.length) || (Array.isArray(h.DeviceRequests) && h.DeviceRequests.length)
-        || Object.keys(object(h.PortBindings ?? {})).length || Object.keys(tmpfs).length !== 1
-        || typeof tmpfs["/scratch"] !== "string" || !tmpfs["/scratch"].includes("size=67108864")
-        || !["nosuid", "nodev", "noexec"].every(s => tmpfs["/scratch"].split(",").includes(s)))
-        throw new HubProtocolError("incompatible");
-}
-/** Explicit async availability check; merely importing this module cannot install or start anything. */
-export async function createHubCliProvider(options) {
-    const backend = z.enum(["claude", "codex"]).parse(options.backend);
-    const selectedImage = z.string().regex(/^sha256:[a-f0-9]{64}$/).safeParse(options.imageId);
-    if (!selectedImage.success)
-        throw new HubProviderSetupError("image-unconfigured");
-    const imageId = selectedImage.data;
-    const model = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/).parse(options.model);
-    const selectedSocket = z.string().regex(/^\/(?:var\/run|run)\/[a-zA-Z0-9/_.-]+\.sock$/).safeParse(options.dockerSocket ?? "/var/run/docker.sock");
-    if (!selectedSocket.success || selectedSocket.data.split("/").some(part => part === "." || part === ".."))
-        throw new HubProviderSetupError("engine-unavailable");
-    const socket = selectedSocket.data;
-    try {
-        if (!lstatSync(socket).isSocket())
-            throw new Error();
-    }
-    catch {
-        throw new HubProviderSetupError("engine-unavailable");
-    }
-    const modelBroker = options.modelBroker;
-    if (typeof modelBroker !== "function")
-        throw new HubProviderSetupError("credential-unconfigured");
-    const docker = ["--host", `unix://${socket}`];
-    const command = async (args) => {
-        try {
-            return (await run("docker", [...docker, ...args], { env: cliEnv, timeout: 10_000, maxBuffer: MODEL_WIRE_LIMIT })).stdout.trim();
-        }
-        catch {
-            throw new HubProtocolError("unavailable");
-        }
-    };
-    let engine;
-    try {
-        engine = await command(["info", "--format", "{{.OSType}}/{{.Architecture}}"]);
-    }
-    catch {
-        throw new HubProviderSetupError("engine-unavailable");
-    }
-    if (!/^linux\/(?:amd64|x86_64)$/.test(engine))
-        throw new HubProviderSetupError("engine-unsupported");
-    try {
-        const images = z.array(z.unknown()).length(1).parse(parseStrictJson(await command(["image", "inspect", imageId]), MODEL_WIRE_LIMIT));
-        const image = object(images[0]), config = object(image.Config), labels = object(config.Labels);
-        if (image.Id !== imageId || image.Architecture !== "amd64" || labels["org.agend.hub.protocol"] !== "1" || labels[`org.agend.hub.${backend}`] !== HUB_PROVIDER_CLI_VERSIONS[backend]
-            || (config.Volumes && Object.keys(object(config.Volumes)).length) || (config.OnBuild && config.OnBuild.length))
-            throw new Error();
-    }
-    catch {
-        throw new HubProviderSetupError("image-mismatch");
-    }
-    let poisoned = false, active = 0, stopped = false;
-    const sessions = new Set();
-    return {
-        get isolation() { if (poisoned || stopped)
-            throw new HubProtocolError("unavailable"); return "hub-restricted-v1"; },
-        async close() { stopped = true; const results = await Promise.allSettled([...sessions].map(close => close())); if (results.some(r => r.status === "rejected"))
-            throw new HubProtocolError("uncertain"); },
-        async open(input) {
-            if (poisoned || stopped || active >= 8 || input.signal.aborted)
-                throw new HubProtocolError("unavailable");
-            validated(uuid, input.contextId);
-            validated(plain(32 * 1024), input.question);
-            validated(plain(4096), input.label);
-            active++;
-            const token = randomUUID(), name = `agend-hub-question-${token}`, abort = new AbortController();
-            const prompt = `${input.label}\nContext: ${input.contextId}\n\n${input.question}`;
-            let container, child, closed;
-            let creation;
-            const work = new Set();
-            let accepted = false, answerReceived = false, busy = false, apiCalls = 0, toolCalls = 0, bytes = 0;
-            let exited;
-            const exit = new Promise(resolve => { exited = resolve; });
-            let gateway, releaseGateway;
-            const gatewayReady = new Promise(resolve => { releaseGateway = resolve; });
-            let accept, rejectAccept, answer, rejectAnswer;
-            const admission = new Promise((resolve, reject) => { accept = resolve; rejectAccept = reject; });
-            const result = new Promise((resolve, reject) => { answer = resolve; rejectAnswer = reject; });
-            void admission.catch(() => { });
-            void result.catch(() => { });
-            const fail = () => { const error = new HubProtocolError("uncertain"); rejectAccept(error); rejectAnswer(error); releaseGateway(); abort.abort(); };
-            const close = () => {
-                if (closed)
-                    return closed;
-                let resolve, reject;
-                const attempt = new Promise((yes, no) => { resolve = yes; reject = no; });
-                closed = attempt;
-                fail();
-                void (async () => {
-                    let failed = false;
-                    try {
-                        if (creation) {
-                            try {
-                                container ??= await creation;
-                            }
-                            catch { /* Inspect the owned name after an ambiguous create. */ }
-                            const knownId = container && /^[a-f0-9]{64}$/.test(container) ? container : undefined;
-                            // A lost rm response can mean removal succeeded. Confirm absence by exact immutable ID, never by label alone.
-                            const listed = knownId ? await command(["container", "ls", "--all", "--no-trunc", "--filter", `id=${knownId}`, "--format", "{{.ID}}"]) : undefined;
-                            if (listed && listed !== knownId)
-                                throw new HubProtocolError("uncertain");
-                            if (listed !== "") {
-                                // The random name is ours even when create returned an ambiguous outcome. Inspect ownership before removal.
-                                const rows = z.array(z.unknown()).length(1).parse(parseStrictJson(await command(["container", "inspect", knownId ?? name])));
-                                const c = object(rows[0]);
-                                if (object(object(c.Config).Labels)["org.agend.hub.question"] !== token || typeof c.Id !== "string" || !/^[a-f0-9]{64}$/.test(c.Id))
-                                    throw new HubProtocolError("uncertain");
-                                container = c.Id;
-                                await command(["rm", "--force", container]);
-                            }
-                        }
-                    }
-                    catch {
-                        failed = true;
-                        poisoned = true;
-                    }
-                    finally {
-                        // Failed removal still owns pending broker/tool work. Abort prevents dispatch; draining proves it exited.
-                        child?.kill();
-                        await Promise.allSettled([...work]);
-                        try {
-                            if (child) {
-                                let timer;
-                                try {
-                                    await Promise.race([exit, new Promise((_, reject) => { timer = setTimeout(() => reject(new HubProtocolError("uncertain")), 5_000); })]);
-                                }
-                                finally {
-                                    clearTimeout(timer);
-                                }
-                            }
-                        }
-                        catch {
-                            failed = true;
-                            poisoned = true;
-                        }
-                        finally {
-                            clearTimeout(deadline);
-                            input.signal.removeEventListener("abort", onAbort);
-                            if (!failed) {
-                                active--;
-                                sessions.delete(close);
-                            }
-                        }
-                    }
-                    if (failed)
-                        throw new HubProtocolError("uncertain");
-                })().then(resolve, error => { closed = undefined; reject(error); });
-                return attempt;
-            };
-            const onAbort = () => { void close().catch(() => { }); };
-            const deadline = setTimeout(onAbort, 120_000);
-            deadline.unref();
-            sessions.add(close);
-            input.signal.addEventListener("abort", onAbort, { once: true });
-            const send = (message) => {
-                if (abort.signal.aborted || !child?.stdin?.writable)
-                    throw new HubProtocolError("stale");
-                child.stdin.write(`${JSON.stringify(message)}\n`);
-            };
-            const message = async (raw) => {
-                if (abort.signal.aborted || busy)
-                    throw new HubProtocolError("uncertain");
-                busy = true;
-                try {
-                    const frame = object(parseStrictJson(raw, 2 * MODEL_WIRE_LIMIT));
-                    if (frame.type === "model") {
-                        const id = z.number().int().min(1).max(256).parse(frame.id);
-                        if (++apiCalls > 16)
-                            throw new HubProtocolError("backpressure");
-                        const request = restrictedModelRequest(backend, model, frame.body);
-                        if (!accepted) {
-                            if (!includesPrompt(backend === "claude" ? request.messages : request.input, prompt))
-                                throw new HubProtocolError("uncertain");
-                            accepted = true;
-                            accept();
-                        }
-                        await gatewayReady;
-                        if (abort.signal.aborted || !gateway)
-                            throw new HubProtocolError("stale");
-                        let reply;
-                        try {
-                            reply = validateModelReply(backend, await modelBroker(backend, request, abort.signal));
-                        }
-                        catch (error) {
-                            if (error instanceof HubForbiddenModelTool && !abort.signal.aborted)
-                                await gateway.propose(error.tool, error.args, "The restricted session refused this tool. Local review is required; no action was executed.");
-                            throw error;
-                        }
-                        if (abort.signal.aborted)
-                            throw new HubProtocolError("stale");
-                        send({ type: "model-result", id, ...reply });
-                    }
-                    else if (frame.type === "tool") {
-                        if (!accepted || !gateway || ++toolCalls > 64)
-                            throw new HubProtocolError("denied");
-                        const id = z.number().int().min(1).max(256).parse(frame.id), name = documentTool(z.string().parse(frame.name));
-                        const args = documentArguments(name, frame.arguments), value = await gateway.invoke(name, args);
-                        if (abort.signal.aborted)
-                            throw new HubProtocolError("stale");
-                        const text = JSON.stringify(value);
-                        if (Buffer.byteLength(text) > 128 * 1024)
-                            throw new HubProtocolError("backpressure");
-                        send({ type: "tool-result", id, text });
-                    }
-                    else if (frame.type === "answer") {
-                        if (!accepted || !gateway || answerReceived)
-                            throw new HubProtocolError("uncertain");
-                        answerReceived = true;
-                        const text = validated(plain(128 * 1024), frame.text);
-                        const response = validated(z.strictObject({ answer: plain(120 * 1024), proposal: z.strictObject({ action: plain(256).min(1), arguments: z.unknown(), consequences: plain(4096).min(1) }).nullable() }), parseStrictJson(text, 128 * 1024));
-                        if (response.proposal)
-                            await gateway.propose(response.proposal.action, response.proposal.arguments, response.proposal.consequences);
-                        if (abort.signal.aborted)
-                            throw new HubProtocolError("stale");
-                        answer(response.answer);
-                    }
-                    else
-                        throw new HubProtocolError("uncertain");
-                }
-                finally {
-                    busy = false;
-                }
-            };
-            try {
-                if (input.signal.aborted)
-                    throw new HubProtocolError("stale");
-                creation = command(hubContainerArguments(imageId, name, token, input.contextId));
-                container = await creation;
-                if (!/^[a-f0-9]{64}$/.test(container) || abort.signal.aborted)
-                    throw new HubProtocolError("uncertain");
-                const rows = z.array(z.unknown()).length(1).parse(parseStrictJson(await command(["container", "inspect", container])));
-                verifyHubContainer(rows[0], imageId, token, input.contextId);
-                if (abort.signal.aborted)
-                    throw new HubProtocolError("stale");
-                child = spawn("docker", [...docker, "start", "--attach", "--interactive", container], { env: cliEnv, stdio: ["pipe", "pipe", "pipe"] });
-                let buffer = "";
-                child.stdout.setEncoding("utf8");
-                child.stdout.on("data", (chunk) => {
-                    bytes += Buffer.byteLength(chunk);
-                    buffer += chunk;
-                    if (bytes > 8 * MODEL_WIRE_LIMIT || Buffer.byteLength(buffer) > 2 * MODEL_WIRE_LIMIT) {
-                        onAbort();
-                        return;
-                    }
-                    for (;;) {
-                        const at = buffer.indexOf("\n");
-                        if (at < 0)
-                            break;
-                        const line = buffer.slice(0, at);
-                        buffer = buffer.slice(at + 1);
-                        const pending = Promise.resolve().then(() => message(line));
-                        work.add(pending);
-                        void pending.finally(() => work.delete(pending)).catch(onAbort);
-                    }
-                });
-                let stderrBytes = 0;
-                child.stderr.on("data", (chunk) => { stderrBytes += chunk.length; if (stderrBytes > 64 * 1024)
-                    onAbort(); });
-                child.on("error", onAbort);
-                child.on("close", code => { exited(code); if (code !== 0 || !answerReceived)
-                    onAbort(); });
-                input.beforeInput();
-                if (abort.signal.aborted)
-                    throw new HubProtocolError("stale");
-                send({ type: "start", backend, model, prompt });
-                await admission;
-                if (abort.signal.aborted)
-                    throw new HubProtocolError("stale");
-                let answering = false;
-                return {
-                    async answer(scopedGateway) {
-                        if (answering || abort.signal.aborted)
-                            throw new HubProtocolError("stale");
-                        answering = true;
-                        gateway = scopedGateway;
-                        releaseGateway();
-                        let text;
-                        try {
-                            text = await result;
-                            if (await exit !== 0)
-                                throw new HubProtocolError("uncertain");
-                        }
-                        catch {
-                            await close();
-                            throw new HubProtocolError("uncertain");
-                        }
-                        await close();
-                        return text;
-                    }, close,
-                };
-            }
-            catch {
-                await close();
-                throw new HubProtocolError("uncertain");
-            }
-        },
-    };
-}
-//# sourceMappingURL=cli-provider.js.map

package/dist/hub/execution/cli-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-provider.js","sourceRoot":"","sources":["../../../src/hub/execution/cli-provider.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,EAClF,MAAM,mBAAmB,CAAC;AAErE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAWhG,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1E,MAAM,cAAc,GAAG,CAAC,CAAU,EAAE,MAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,KAAa,EAAE,SAAiB;IACnG,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B,KAAK,EAAE;QAC5F,SAAS,EAAE,yBAAyB,SAAS,EAAE;QAC/C,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,uCAAuC;QACrI,qBAAqB,EAAE,0BAA0B,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB;QAC9G,SAAS,EAAE,yDAAyD,EAAE,oBAAoB,EAAE,QAAQ,EAAE,eAAe;QACrH,kCAAkC,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;AACjF,CAAC;AACD,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAe,EAAE,KAAa,EAAE,SAAkB;IACnG,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvG,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,KAAK,KAAK;WAChH,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS;WACvF,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC;WACjH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,8BAA8B,CAAC,CAAC;WAC/E,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,MAAM;WACzI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE;WAC5G,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,wBAAwB,IAAI,CAAC,KAAK,mBAAmB,CAAC;WACzG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;WACzG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;WAC1F,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;WAC9G,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;WACnF,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;WACrF,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAE,KAAK,CAAC,UAAU,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;AACnJ,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA8B;IACvE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC;IAClJ,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IACjK,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC;QAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAAC,CAAC;IAC7D,MAAM,CAAC;QAAC,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAc,EAAmB,EAAE;QACxD,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACxI,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAAC,CAAC;IACtF,MAAM,CAAC;QAAC,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;IAChE,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACrI,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,KAAK,OAAO,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,EAAE,CAAC,KAAK,yBAAyB,CAAC,OAAO,CAAC;eAC9K,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,MAAM,CAAC,OAAqB,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACrJ,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC9D,IAAI,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,OAAO;QACL,IAAI,SAAS,KAAK,IAAI,QAAQ,IAAI,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,mBAA4B,CAAC,CAAC,CAAC;QAC5H,KAAK,CAAC,KAAK,KAAK,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACzM,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,IAAI,QAAQ,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC1G,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnH,MAAM,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,UAAU,EAAE,EAAE,IAAI,GAAG,sBAAsB,KAAK,EAAE,EAAE,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YAChG,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClF,IAAI,SAA6B,EAAE,KAA2C,EAAE,MAAiC,CAAC;YAClH,IAAI,QAAqC,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAC;YACtC,IAAI,QAAQ,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YACnG,IAAI,MAAsC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,OAAwC,EAAE,cAA2B,CAAC;YAC1E,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,MAAmB,EAAE,YAAmC,EAAE,MAA+B,EAAE,YAAmC,CAAC;YACnI,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACvG,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtG,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACnJ,MAAM,KAAK,GAAG,GAAkB,EAAE;gBAChC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAC1B,IAAI,OAAoB,EAAE,MAAiC,CAAC;gBAC5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChF,MAAM,GAAG,OAAO,CAAC;gBACjB,IAAI,EAAE,CAAC;gBACP,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,CAAC;wBACH,IAAI,QAAQ,EAAE,CAAC;4BACb,IAAI,CAAC;gCAAC,SAAS,KAAK,MAAM,QAAQ,CAAC;4BAAC,CAAC;4BAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC;4BACvG,MAAM,OAAO,GAAG,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;4BACtF,8GAA8G;4BAC9G,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;4BACnJ,IAAI,MAAM,IAAI,MAAM,KAAK,OAAO;gCAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;4BAC1E,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gCAClB,4GAA4G;gCAC5G,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gCAC7H,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gCAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oCAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gCAC7K,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;gCACjB,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;4BAC9C,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,GAAG,IAAI,CAAC;wBAAC,QAAQ,GAAG,IAAI,CAAC;oBAAC,CAAC;4BACnC,CAAC;wBACP,0GAA0G;wBAC1G,KAAK,EAAE,IAAI,EAAE,CAAC;wBACd,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;wBACpC,IAAI,CAAC;4BACH,IAAI,KAAK,EAAE,CAAC;gCACV,IAAI,KAAgD,CAAC;gCACrD,IAAI,CAAC;oCAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gCAAC,CAAC;wCAC/I,CAAC;oCAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gCAAC,CAAC;4BAClC,CAAC;wBACH,CAAC;wBAAC,MAAM,CAAC;4BAAC,MAAM,GAAG,IAAI,CAAC;4BAAC,QAAQ,GAAG,IAAI,CAAC;wBAAC,CAAC;gCACnC,CAAC;4BACP,YAAY,CAAC,QAAQ,CAAC,CAAC;4BAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;4BAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;gCAAC,MAAM,EAAE,CAAC;gCAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BAAC,CAAC;wBACpD,CAAC;oBACH,CAAC;oBACD,IAAI,MAAM;wBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtD,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAE,EAAE;gBAChC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACzF,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;gBACnD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI;oBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC1E,IAAI,GAAG,IAAI,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC;oBACjE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBAC5D,IAAI,EAAE,QAAQ,GAAG,EAAE;4BAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;wBAChE,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,IAAI,CAAC,cAAc,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gCAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;4BAC9H,QAAQ,GAAG,IAAI,CAAC;4BAAC,MAAM,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,YAAY,CAAC;wBACnB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO;4BAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC1E,IAAI,KAAK,CAAC;wBACV,IAAI,CAAC;4BAAC,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;wBAAC,CAAC;wBAC/F,OAAO,KAAK,EAAE,CAAC;4BACb,IAAI,KAAK,YAAY,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gCAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,6FAA6F,CAAC,CAAC;4BAClN,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC9D,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;oBAC/C,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,EAAE,SAAS,GAAG,EAAE;4BAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;wBACpF,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC/G,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;wBAChG,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;wBAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI;4BAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;wBACzH,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1C,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACnC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,cAAc;4BAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;wBACrF,cAAc,GAAG,IAAI,CAAC;wBACtB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,eAAe,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;wBAC3O,IAAI,QAAQ,CAAC,QAAQ;4BAAE,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;wBACpI,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC9D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC1B,CAAC;;wBAAM,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACjD,CAAC;wBAAS,CAAC;oBAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,CAAC;YAC7B,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9D,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBACjF,SAAS,GAAG,MAAM,QAAQ,CAAC;gBAC3B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACvG,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvH,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9D,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxI,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,KAAK,CAAC,MAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACzC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC;oBACnD,IAAI,KAAK,GAAG,CAAC,GAAG,gBAAgB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAgB,EAAE,CAAC;wBAAC,OAAO,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBAC5G,SAAS,CAAC;wBACR,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAAC,IAAI,EAAE,GAAG,CAAC;4BAAE,MAAM;wBACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;wBAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC/E,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,IAAI,WAAW,GAAG,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,GAAG,EAAE,GAAG,IAAI;oBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc;oBAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3F,KAAK,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChD,MAAM,SAAS,CAAC;gBAChB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,OAAO;oBACL,KAAK,CAAC,MAAM,CAAC,aAAa;wBACxB,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC3E,SAAS,GAAG,IAAI,CAAC;wBAAC,OAAO,GAAG,aAAa,CAAC;wBAAC,cAAc,EAAE,CAAC;wBAC5D,IAAI,IAAY,CAAC;wBACjB,IAAI,CAAC;4BAAC,IAAI,GAAG,MAAM,MAAM,CAAC;4BAAC,IAAI,MAAM,IAAI,KAAK,CAAC;gCAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;wBAAC,CAAC;wBAC3F,MAAM,CAAC;4BAAC,MAAM,KAAK,EAAE,CAAC;4BAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;wBAAC,CAAC;wBACjE,MAAM,KAAK,EAAE,CAAC;wBAAC,OAAO,IAAI,CAAC;oBAC7B,CAAC,EAAE,KAAK;iBACT,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/execution/index.d.ts

@@ -1,13 +0,0 @@
-/** Pure exports: importing S4 does not install providers, open storage or enable Hub work. */
-export { HubRestrictedExecutionService } from "./service.js";
-export type { HubExecutionOptions, HubExecutionReadiness, HubLocalExposure, HubExecutionBinding, HubIsolatedProvider, HubExecutionGateway } from "./service.js";
-export { HubExecutionStore, migrateHubExecution } from "./store.js";
-export type { ExecutionAuditEvent, ExecutionStoreOptions } from "./store.js";
-export { HubDocumentView, executionPolicyDigest, HUB_READ_TOOLS } from "./views.js";
-export type { HubViewDocument } from "./views.js";
-export { createHubCliProvider } from "./cli-provider.js";
-export type { HubCliProvider, HubCliProviderOptions } from "./cli-provider.js";
-export { createHubModelBroker } from "./model-broker.js";
-export type { HubModelBroker, HubCliBackend } from "./model-broker.js";
-export { HubProviderSetupError, HUB_PROVIDER_SETUP_REASONS, isHubProviderSetupReason, hubProviderSetupReason } from "./provider-setup.js";
-export type { HubProviderSetupReason } from "./provider-setup.js";

package/dist/hub/execution/index.js

@@ -1,8 +0,0 @@
-/** Pure exports: importing S4 does not install providers, open storage or enable Hub work. */
-export { HubRestrictedExecutionService } from "./service.js";
-export { HubExecutionStore, migrateHubExecution } from "./store.js";
-export { HubDocumentView, executionPolicyDigest, HUB_READ_TOOLS } from "./views.js";
-export { createHubCliProvider } from "./cli-provider.js";
-export { createHubModelBroker } from "./model-broker.js";
-export { HubProviderSetupError, HUB_PROVIDER_SETUP_REASONS, isHubProviderSetupReason, hubProviderSetupReason } from "./provider-setup.js";
-//# sourceMappingURL=index.js.map

package/dist/hub/execution/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hub/execution/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/hub/execution/model-broker.d.ts

@@ -1,24 +0,0 @@
-export type HubCliBackend = "claude" | "codex";
-export interface HubModelReply {
-    body: string;
-    contentType: "text/event-stream" | "application/json";
-}
-export type HubModelBroker = (backend: HubCliBackend, body: Record<string, unknown>, signal: AbortSignal) => Promise<HubModelReply>;
-export declare const HUB_CLI_TOOLS: readonly ["mcp__hub_documents__documents_list", "mcp__hub_documents__documents_read"];
-export declare const MODEL_WIRE_LIMIT: number;
-export declare function documentTool(name: string): string;
-export declare function documentArguments(name: string, args: unknown): unknown;
-/** Rebuild the request rather than forwarding ambient CLI settings, hosted tools, history IDs or headers. */
-export declare function restrictedModelRequest(backend: HubCliBackend, model: string, value: unknown): Record<string, unknown>;
-export declare class HubForbiddenModelTool extends Error {
-    readonly tool: string;
-    readonly args: unknown;
-    constructor(tool: string, args: unknown);
-}
-/** Buffer and validate the ENTIRE response before a byte reaches the CLI's native dispatcher. */
-export declare function validateModelReply(backend: HubCliBackend, reply: HubModelReply): HubModelReply;
-/** Explicit construction only; production endpoints are fixed, TLS checked, redirects forbidden. */
-export declare function createHubModelBroker(credentials: {
-    claude?: string;
-    codex?: string;
-}): HubModelBroker;