@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/dist/runner-manager.js

@@ -0,0 +1,590 @@
+/**
+ * Dynamic per-session runner manager.
+ *
+ * Unlike {@link createStigmerRunner} which creates a single Worker polling
+ * one task queue, the RunnerManager maintains a pool of Workers — one per
+ * session — all sharing a single Temporal connection and a shared set of
+ * activities.
+ *
+ * Used by the desktop app and any multi-session host that needs to
+ * dynamically add/remove sessions without restarting the process.
+ */
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { createRequire } from "node:module";
+import { NativeConnection, Worker, bundleWorkflowCode, } from "@temporalio/worker";
+import { releasingOnFailure } from "./agent-host/failed-boot.js";
+import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
+// Boot marks mirror the static runner's segment names where the work is the
+// same. Inert unless a mode emits the boot timeline (pool mode does; the
+// desktop manager never calls emitRunnerBootTiming, so marks cost nothing).
+import { markBoot } from "./shared/cold-start-timing.js";
+import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE, } from "./workflow-source.js";
+import { runCredentialActivityInterceptor } from "./interceptors/run-credential-activity.js";
+import { collectorSpanExporter, contentGuardedExporter, telemetrySettings } from "./otel-export.js";
+import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
+import { assertLlmBackendsPreflight } from "./preflight.js";
+import { captureRunnerSecrets, getRunnerSecret, setRunnerSecret, } from "./shared/runner-credential-store.js";
+import { loadTemporalConnectionConfig } from "@stigmer/temporal-codecs";
+import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
+// Per-task-queue in-flight activity tracking lives in ./in-flight.ts so the
+// activity interceptor (no manager-closure handle) and unit tests can reach it.
+// This is what keeps a session worker alive while ExecuteCursor is running, so a
+// view close can no longer reap the worker mid-run.
+import { activityStartedOnQueue, activityFinishedOnQueue, inFlightCountForQueue, setQueueDrainCallback, forgetQueue, } from "./in-flight.js";
+import { registerWorkerShutdownSignal, unregisterWorkerShutdownSignal, } from "./shared/worker-shutdown.js";
+const SESSION_QUEUE_PREFIX = "session:";
+// Warm-pool control queue — polled by exactly one pool member, carrying only
+// the ProbePoolMember/AttachSession claim activities (never session work).
+// Mirrors SessionDispatchService's convention: lowercase kind, colon, id.
+const POOL_CONTROL_QUEUE_PREFIX = "sandbox:";
+// Re-export for existing importers; the registry itself lives in
+// shared/worker-shutdown.ts so the static runner (runner.ts) and the
+// activities can share it without importing this manager module.
+export { getShutdownSignalForQueue } from "./shared/worker-shutdown.js";
+/**
+ * Create a runner manager that dynamically manages per-session Workers.
+ *
+ * One shared NativeConnection to Temporal, one shared set of activities.
+ * Each call to `addSession(id)` creates a new Worker polling `session:{id}`.
+ *
+ * @example
+ * ```ts
+ * import { createStigmerRunnerManager } from '@stigmer/runner';
+ *
+ * const manager = await createStigmerRunnerManager({
+ *   temporalAddress: 'localhost:7233',
+ *   stigmerEndpoint: 'http://localhost:7234',
+ * });
+ *
+ * await manager.addSession('ses_abc123');
+ * await manager.addSession('ses_def456');
+ *
+ * // Later:
+ * await manager.removeSession('ses_abc123');
+ * await manager.shutdown();
+ * ```
+ */
+export async function createStigmerRunnerManager(options) {
+    return releasingOnFailure((boot) => buildStigmerRunnerManager(options, boot));
+}
+/** The factory's body; `boot.release` is set once the agent host is up (`agent-host/failed-boot.ts`). */
+async function buildStigmerRunnerManager(options, boot) {
+    validateManagerOptions(options);
+    // Take custody of runner secrets BEFORE anything else can read them from
+    // env — and before any agent code could spawn with them (#508). Runs here
+    // (not only in main.ts) because this factory is a public library boot door:
+    // in-process embedders like the desktop never execute main.ts.
+    captureRunnerSecrets();
+    // `tokenRef` holds the control-plane token (the host's durable credential,
+    // e.g. the desktop's Auth0 token) and is shared with activity clients via
+    // config.stigmerTokenRef. The proxy credential (x-stigmer-auth) is managed
+    // separately by a RunnerTokenCoordinator (created after the harnesses boot)
+    // — see that module for the two-writer rationale and the staleness history
+    // it guards.
+    const tokenRef = { current: options.stigmerToken ?? null };
+    // `runnerTokenRef` mirrors the coordinator's proxy credential for gRPC use:
+    // the minted runner token (token_type=embedded_runner) once adopted, tracking
+    // the control-plane token in lockstep before that. StigmerClient authenticates
+    // value fetches with it so cloud's runner-class gate recognizes the desktop
+    // runner — its control-plane token is the user's own Auth0 token, which the
+    // server treats as a browsing user and refuses. Pre-mint the ref equals the control-plane
+    // token, which is exactly what the client would fall back to anyway.
+    const runnerTokenRef = { current: options.stigmerToken ?? null };
+    const baseConfig = mapManagerOptionsToConfig(options, tokenRef, runnerTokenRef);
+    assertLlmBackendsPreflight(baseConfig.proxyEndpoint);
+    // Boot the harnesses BEFORE resolving Temporal coordinates. Coordinate
+    // discovery dials the control plane through connect-node, which snapshots
+    // the node:http2 ESM facade on first import; the Cursor adapter's boot
+    // installs the proxy interceptors (the HTTP/2 one patches http2.connect,
+    // which only reaches that facade if it runs first), proves the patch landed,
+    // and only then loads its SDK. The interceptors read the proxy credential
+    // per request from `runnerTokenRef` (Config.proxyTokenRef, bound by
+    // mapManagerOptionsToConfig): the control-plane token until a runner token
+    // is minted, the minted token after, exactly the lockstep the coordinator
+    // below maintains in that ref. Nothing a boot reads depends on the
+    // coordinates, so `baseConfig` carries none yet. The modules imported
+    // here are connect-free by construction (`harness-adapters.ts`,
+    // `harness/registry.ts`, `agent-host/hosting.ts`;
+    // `__tests__/harness-boot-order.test.ts`). The hosted harnesses' engines
+    // run in the agent host, one for every session worker of this manager,
+    // behind their remote adapters (`agent-host/`).
+    const [{ HARNESS_ADAPTERS }, { adaptersOf, bootHarnesses, releaseHarnessSession, shutdownHarnesses }, { hostHarnesses, logCursorWarmup }] = await Promise.all([import("./harness-adapters.js"), import("./harness/registry.js"), import("./agent-host/hosting.js")]);
+    const hosted = await hostHarnesses(HARNESS_ADAPTERS, baseConfig);
+    boot.release = async () => {
+        try {
+            await shutdownHarnesses(adaptersOf(hosted.rows));
+        }
+        finally {
+            await hosted.close();
+        }
+    };
+    await bootHarnesses(adaptersOf(hosted.rows), baseConfig);
+    markBoot("harnesses_booted");
+    // The token coordinator owns the proxy credential (x-stigmer-auth) and its
+    // refresh lifecycle. It writes ONE sink, `runnerTokenRef`, which is read per
+    // request by both the interceptors (as Config.proxyTokenRef) and the gRPC
+    // client (as Config.stigmerRunnerTokenRef), so mint and refresh reach every
+    // reader in one write. It re-mints using the always-fresh control-plane
+    // token in `tokenRef` — never the (possibly expired) minted token itself, so
+    // a slept-past-TTL runner recovers without a restart.
+    const tokenCoordinator = createRunnerTokenCoordinator({
+        applyProxyToken: (token) => {
+            runnerTokenRef.current = token;
+        },
+        reMint: () => refreshRunnerAccessToken({
+            token: tokenRef.current,
+            stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
+        }),
+    });
+    // Resolve the runner bootstrap after the harnesses have booted (discovery
+    // dials the control plane through connect-node). An explicit address wins;
+    // otherwise a token triggers control-plane discovery; otherwise localhost.
+    // Must happen before createAllActivities so the activities' Config carries
+    // the resolved coordinates. Only the worker connection dials Temporal — no
+    // activity does (emit-event, the last one, now routes signals through the
+    // server's SendSignal lane; see oss#517).
+    const bootstrap = await resolveRunnerBootstrap({
+        explicitAddress: options.temporalAddress,
+        explicitNamespace: options.temporalNamespace,
+        token: options.stigmerToken,
+        stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
+    });
+    const config = {
+        ...baseConfig,
+        temporalAddress: bootstrap.temporalAddress,
+        temporalNamespace: bootstrap.temporalNamespace,
+    };
+    markBoot("bootstrap_resolved");
+    // Adopt the minted proxy token (cloud): it diverges from the control-plane
+    // token from here on, and the coordinator refreshes it before expiry.
+    if (bootstrap.runnerAccessToken) {
+        tokenCoordinator.adoptMintedToken(bootstrap.runnerAccessToken, bootstrap.runnerAccessTokenExpiresInSeconds);
+        console.log("[runner-manager] Adopted minted proxy token from bootstrap");
+    }
+    else if (baseConfig.proxyEndpoint && tokenRef.current) {
+        // Proxy is configured but no token was minted (OSS, signing key unset, or an
+        // explicit Temporal address pinned so bootstrap discovery was skipped). The
+        // runner keeps using the control-plane token for proxy traffic; warn so a
+        // resulting 401 is diagnosable rather than silent.
+        console.warn("[runner-manager] Proxy endpoint configured but no runner token was minted; " +
+            "falling back to the control-plane token for x-stigmer-auth");
+    }
+    const activities = await createAllActivities(config, hosted.rows);
+    markBoot("activities_imported");
+    // Surface the resolved artifact store at boot (see runner.ts for rationale):
+    // a path/type misconfiguration is the #285 failure class, and it should be
+    // visible here rather than only when a read fails mid-execution.
+    try {
+        const { loadArtifactStorageConfig } = await import("./shared/artifact-storage.js");
+        const artifactCfg = loadArtifactStorageConfig(config);
+        console.log(`[runner-manager] Artifact store: type=${artifactCfg.type}` +
+            (artifactCfg.type === "local"
+                ? ` | root=${artifactCfg.localPath}`
+                : ` | proxy=${artifactCfg.proxyEndpoint ?? "(unset)"}`));
+    }
+    catch (err) {
+        console.warn(`[runner-manager] Artifact store: could not resolve config for boot log: ${err}`);
+    }
+    const { createPayloadCodecs } = await import("./payload-codecs.js");
+    // Server-managed payload-encryption keys (cloud desktop runners) ride the
+    // bootstrap response; an env-configured key still wins inside the loader.
+    // A cloud server that mints runner tokens but returns no key predates key
+    // management — payloads then rest plaintext in cloud Temporal history, which
+    // deserves a diagnosable warning rather than silence.
+    const payloadCodecs = await createPayloadCodecs(config, bootstrap.payloadEncryption);
+    if (!bootstrap.payloadEncryption &&
+        bootstrap.runnerAccessToken &&
+        !getRunnerSecret("STIGMER_PAYLOAD_ENCRYPTION_KEY")) {
+        console.warn("[runner-manager] Server minted a runner token but returned no payload " +
+            "encryption key; Temporal payloads will be plaintext (server predates " +
+            "runner key management?)");
+    }
+    const connection = await NativeConnection.connect({
+        address: config.temporalAddress,
+        ...config.temporalConnection,
+    });
+    markBoot("connection_opened");
+    const interceptorConfig = await buildInterceptorConfig();
+    // Prefer the build-time workflow bundle (slim/packaged artifacts ship it and
+    // cannot bundle at runtime); fall back to bundle-on-boot for dev and tests.
+    const workflowSource = resolveWorkflowSource();
+    let workflowBundle;
+    if (workflowSource.kind === "prebuilt") {
+        console.log(`[runner-manager] Using pre-built workflow bundle: ${workflowSource.codePath}`);
+        workflowBundle = { codePath: workflowSource.codePath };
+    }
+    else {
+        console.log("[runner-manager] Pre-bundling workflow code...");
+        workflowBundle = await bundleWorkflowCode({
+            workflowsPath: workflowSource.workflowsPath,
+            workflowInterceptorModules: interceptorConfig.workflowInterceptorModules,
+        });
+        console.log("[runner-manager] Workflow code bundled successfully");
+    }
+    markBoot("workflow_bundle_ready");
+    const sessions = new Map();
+    // At most one per process: a pool member IS its control worker's identity.
+    let poolControl = null;
+    let shuttingDown = false;
+    async function createWorkerOnQueue(taskQueue) {
+        const shutdownController = registerWorkerShutdownSignal(taskQueue);
+        const worker = await Worker.create({
+            connection,
+            namespace: config.temporalNamespace,
+            taskQueue,
+            activities,
+            workflowBundle,
+            maxConcurrentActivityTaskExecutions: config.maxConcurrentActivities,
+            dataConverter: payloadCodecs?.length ? { payloadCodecs } : undefined,
+            sinks: interceptorConfig.sinks,
+            interceptors: interceptorConfig.interceptors,
+        });
+        const runPromise = worker.run().catch((err) => {
+            console.error(`[runner-manager] Worker for queue ${taskQueue} exited with error:`, err);
+        });
+        return { worker, runPromise, shutdownController, pendingClose: false };
+    }
+    /**
+     * Re-opening a session whose teardown was deferred: cancel the
+     * pending close so the worker keeps serving the reused queue. Returns true
+     * when an existing managed worker was found (caller should not recreate one).
+     */
+    function reuseExistingWorker(registry, id, taskQueue, kind) {
+        const existing = registry.get(id);
+        if (!existing)
+            return false;
+        if (existing.pendingClose) {
+            existing.pendingClose = false;
+            setQueueDrainCallback(taskQueue, undefined);
+            console.log(`[runner-manager] Re-opened ${kind} ${id}; cancelled deferred teardown`);
+        }
+        return true;
+    }
+    /**
+     * Graceful teardown of a managed worker. Never aborts: callers only reach the
+     * actual teardown once no activity is in flight, so a plain worker.shutdown()
+     * drains the (idle) queue cleanly. The abort-before-shutdown that used to live
+     * here is what killed running activities on a view close.
+     */
+    async function teardownManaged(registry, id, taskQueue, kind) {
+        const managed = registry.get(id);
+        if (!managed)
+            return;
+        managed.worker.shutdown();
+        await managed.runPromise;
+        registry.delete(id);
+        unregisterWorkerShutdownSignal(taskQueue);
+        forgetQueue(taskQueue);
+        console.log(`[runner-manager] Removed ${kind} ${id} (active=${registry.size})`);
+    }
+    /**
+     * Remove a managed worker, deferring teardown while activities are in flight.
+     * This is the server-side safety invariant that lets a run continue in the
+     * background after its session view closes: the worker is reaped only when the
+     * last activity finishes (or immediately if the queue is already idle).
+     */
+    async function removeManaged(registry, id, taskQueue, kind) {
+        const managed = registry.get(id);
+        if (!managed)
+            return;
+        if (inFlightCountForQueue(taskQueue) > 0) {
+            managed.pendingClose = true;
+            setQueueDrainCallback(taskQueue, () => {
+                // Skip if a full shutdown() is already reaping every worker, so we
+                // never call worker.shutdown() twice on the same worker.
+                if (shuttingDown)
+                    return;
+                void teardownManaged(registry, id, taskQueue, kind);
+            });
+            console.log(`[runner-manager] Deferring teardown of ${kind} ${id} — ` +
+                `${inFlightCountForQueue(taskQueue)} activity(ies) still in flight (runs in background)`);
+            return;
+        }
+        await teardownManaged(registry, id, taskQueue, kind);
+    }
+    return {
+        async addSession(sessionId) {
+            if (shuttingDown) {
+                throw new Error("RunnerManager is shutting down");
+            }
+            const taskQueue = SESSION_QUEUE_PREFIX + sessionId;
+            if (reuseExistingWorker(sessions, sessionId, taskQueue, "session")) {
+                return;
+            }
+            const managed = await createWorkerOnQueue(taskQueue);
+            sessions.set(sessionId, managed);
+            console.log(`[runner-manager] Added session ${sessionId} (queue=${taskQueue}, active=${sessions.size})`);
+        },
+        async removeSession(sessionId) {
+            await removeManaged(sessions, sessionId, SESSION_QUEUE_PREFIX + sessionId, "session");
+            // The session is done on this host — every harness releases what it
+            // parked for it (the Cursor harness: the agent, and the executor + MCP
+            // subprocesses its lease pins) now rather than after the idle TTL
+            // (#215). Logged, never thrown: the session's worker is already gone,
+            // and failing this IPC command would tell the desktop a removal that
+            // did happen did not.
+            try {
+                await releaseHarnessSession(adaptersOf(hosted.rows), sessionId);
+            }
+            catch (err) {
+                console.error(`[runner-manager] Harness release for session ${sessionId} failed (continuing): ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+        activeSessions() {
+            return Array.from(sessions.keys());
+        },
+        async addPoolControl(memberId) {
+            if (shuttingDown) {
+                throw new Error("RunnerManager is shutting down");
+            }
+            if (poolControl) {
+                throw new Error(`Pool control worker already polling ${poolControl.taskQueue} — ` +
+                    "a process is exactly one pool member");
+            }
+            const taskQueue = POOL_CONTROL_QUEUE_PREFIX + memberId;
+            poolControl = { taskQueue, managed: await createWorkerOnQueue(taskQueue) };
+            console.log(`[runner-manager] Added pool control worker (queue=${taskQueue})`);
+            // Idle-time warm-up (issue #209): pay the Cursor SDK's per-process
+            // store cost now, in the agent host where the SDK runs, while the
+            // member waits for a claim, instead of inside the claimed session's
+            // first resolve_agent. Fire-and-forget: a pool-control member only,
+            // never a claimed session's restart, which serves at once.
+            void hosted.warmCursorSdk().then(logCursorWarmup);
+        },
+        updateToken(token) {
+            // Writes the control-plane credential. Every reader follows this one
+            // write: the activity clients, the artifact store and the checkpoint
+            // saver read `tokenRef` per request, the per-turn model clients read it
+            // at build, and nothing holds the value (Config carries the ref alone;
+            // config.ts header). The coordinator decides whether the proxy
+            // credential follows it: only when no token has been minted (so the
+            // pre-mint lockstep is preserved — the in-cluster sandbox case, where
+            // nothing is ever minted), never once the runner owns a minted token.
+            // See runner-token-coordinator.ts and the staleness changelogs. The
+            // credential store is the second leg of the pair (it replaced the
+            // process.env.STIGMER_TOKEN write, #508): per-call readers like the
+            // registry headers resolve the current token there.
+            tokenRef.current = token;
+            setRunnerSecret("STIGMER_TOKEN", token);
+            tokenCoordinator.onControlPlaneTokenChanged(token);
+            console.log("[runner-manager] Auth token updated");
+        },
+        async shutdown() {
+            shuttingDown = true;
+            tokenCoordinator.stop();
+            console.log(`[runner-manager] Shutting down ${sessions.size} session workers...`);
+            // Mark every queue's shutdown signal BEFORE draining, so an in-flight
+            // activity cancelled by the drain classifies it as a worker shutdown
+            // rather than a user pause (issue #776 — a SIGTERM'd pool member used
+            // to persist RUN_PAUSED and let raw Temporal drain text reach
+            // status.error). Aborting is classification-only: it stops nothing;
+            // worker.shutdown() below still owns the drain. This is deliberately
+            // NOT done in teardownManaged — single-worker teardowns only run once
+            // the queue is idle, and aborting there is the old view-close bug.
+            for (const session of sessions.values()) {
+                session.shutdownController.abort();
+            }
+            poolControl?.managed.shutdownController.abort();
+            const shutdownPromises = [
+                ...Array.from(sessions.entries()).map(async ([id, session]) => {
+                    session.worker.shutdown();
+                    await session.runPromise;
+                    console.log(`[runner-manager] Session worker ${id} stopped`);
+                }),
+            ];
+            if (poolControl) {
+                const control = poolControl;
+                shutdownPromises.push((async () => {
+                    control.managed.worker.shutdown();
+                    await control.managed.runPromise;
+                    console.log(`[runner-manager] Pool control worker (${control.taskQueue}) stopped`);
+                })());
+            }
+            await Promise.all(shutdownPromises);
+            // Workers are drained — every harness releases what it still holds
+            // (the Cursor harness: its parked session agents, whose executor leases
+            // dispose and whose stdio MCP subprocesses die with them, #215). Logged,
+            // never thrown: the drain has already happened, and a teardown failure
+            // must not mask a clean stop.
+            try {
+                await shutdownHarnesses(adaptersOf(hosted.rows));
+            }
+            catch (err) {
+                console.error(`[runner-manager] Harness shutdown failed after the workers drained (continuing): ${err instanceof Error ? err.message : String(err)}`);
+            }
+            await hosted.close();
+            sessions.clear();
+            poolControl = null;
+            connection.close();
+            console.log("[runner-manager] All workers stopped, connection closed");
+        },
+    };
+}
+function validateManagerOptions(options) {
+    if (!options.stigmerEndpoint) {
+        throw new Error("RunnerManagerOptions.stigmerEndpoint is required — specify the Stigmer server endpoint");
+    }
+    // temporalAddress is intentionally NOT required: when omitted, the runner
+    // discovers it from the control plane (token-only embedding). If neither an
+    // explicit address nor a token is present, discovery falls back to localhost.
+}
+/**
+ * The runtime `Config` for the manager root. The refs are the root's: it
+ * creates them before mapping and writes them on every rotation
+ * (`updateToken`, the token coordinator), so a `Config` never carries a
+ * credential by value (config.ts header).
+ */
+export function mapManagerOptionsToConfig(options, tokenRef, runnerTokenRef) {
+    const proxyActive = !!options.proxyEndpoint;
+    // Execution location is independent of proxy transport. Do NOT derive `mode`
+    // from `proxyActive`: the desktop runner executes LOCALLY (local-path
+    // workspaces must work) while still routing Cursor traffic through the proxy.
+    // Coupling the two here is exactly what previously broke local-path sessions.
+    const mode = options.executionMode ?? "local";
+    return {
+        taskQueue: "manager", // not used for Workers — each Worker gets its own
+        // May be empty here; createStigmerRunnerManager resolves it via
+        // resolveTemporalCoordinates before any Temporal connection is opened.
+        temporalAddress: options.temporalAddress ?? "",
+        temporalNamespace: options.temporalNamespace ?? "default",
+        temporalConnection: options.temporalConnection ?? loadTemporalConnectionConfig(getRunnerSecret),
+        stigmerBackendEndpoint: normalizeEndpoint(options.stigmerEndpoint),
+        // Env-only like the env-loaded path (loadConfig): the bridge and public
+        // endpoints are deployment topology, not per-session state.
+        mcpBridgeEndpoint: process.env.STIGMER_MCP_BRIDGE_ENDPOINT ?? null,
+        mcpPublicEndpoint: process.env.STIGMER_MCP_PUBLIC_ENDPOINT || null,
+        stigmerTokenRef: tokenRef,
+        stigmerRunnerTokenRef: runnerTokenRef,
+        // The manager's proxy credential is the minted runner token once adopted
+        // (the control-plane token in lockstep before that), so it is this ref and
+        // not `tokenRef`: binding `tokenRef` would keep sending the desktop's own
+        // Auth0 token as x-stigmer-auth after the mint.
+        proxyTokenRef: runnerTokenRef,
+        cursorApiKey: proxyActive
+            ? (options.cursorApiKey ?? "proxy-managed")
+            : (options.cursorApiKey ?? ""),
+        workspaceRootDir: options.workspaceRootDir ?? resolveDefaultWorkspaceDir(),
+        mode,
+        proxyEndpoint: options.proxyEndpoint ?? null,
+        maxConcurrentActivities: options.maxConcurrentActivitiesPerSession ?? 5,
+        idleTimeoutSeconds: null,
+        cloudModeEnabled: options.cloudModeEnabled ?? false,
+        checkpointerType: options.checkpointerType ?? (proxyActive ? "http" : "sqlite"),
+        checkpointerProxyEndpoint: options.checkpointerProxyEndpoint ?? options.proxyEndpoint ?? null,
+        artifactProxyEndpoint: options.artifactProxyEndpoint ?? options.proxyEndpoint ?? null,
+        primaryModel: options.primaryModel ?? "gpt-4.1",
+        cursorStreamStallTimeoutMs: options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,
+        agentResolveTimeoutMs: options.agentResolveTimeoutMs ?? DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS,
+        workspaceLockTimeoutMs: options.workspaceLockTimeoutMs ?? DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS,
+    };
+}
+/**
+ * Dynamically import all activity factories and merge into a single map,
+ * after the harnesses have booted: several of these modules transitively load
+ * `@connectrpc/connect-node` and LangChain, and the Cursor adapter's boot must
+ * have patched `node:http2` before connect-node is first imported (see
+ * createStigmerRunnerManager). The harness rows and the registry were imported
+ * by the factory for the boot; the imports here hit the module cache.
+ */
+async function createAllActivities(config, harnessRows) {
+    const [{ createHarnessActivities }, { createEnsureThreadActivities }, { createGenerateSessionSubjectActivities }, { createListPluginToolsActivities }, { createAttachSessionActivities },] = await Promise.all([
+        import("./harness/registry.js"),
+        import("./activities/ensure-thread.js"),
+        import("./activities/generate-session-subject.js"),
+        import("./activities/list-plugin-tools.js"),
+        import("./activities/attach-session.js"),
+    ]);
+    return {
+        ...(await createHarnessActivities(harnessRows, config)),
+        ...createEnsureThreadActivities(),
+        ...createGenerateSessionSubjectActivities(config),
+        ...createListPluginToolsActivities(config),
+        ...createAttachSessionActivities(config),
+    };
+}
+/**
+ * The manager's interceptors. `workflowSourceKind` decides whether the OTel
+ * workflow module must be registered for bundling: a pre-built bundle has it
+ * baked in (scripts/bundle-slim.mjs), and the slim artifact cannot resolve
+ * the module at all, since it is compiled into the bundle rather than staged
+ * beside it; only the runtime (bundle-on-boot) path resolves it, as worker.ts
+ * does. The kind defaults to the source the manager will use
+ * (resolveWorkflowSource, read again where the bundle is chosen). Exported
+ * for its test.
+ */
+export async function buildInterceptorConfig(workflowSourceKind = resolveWorkflowSource().kind) {
+    // The run credential (shared/run-credential.ts), always on and inert
+    // without a credential — the same interceptor the static root registers
+    // (worker.ts).
+    const activityInterceptors = [runCredentialActivityInterceptor];
+    let sinks = {};
+    const workflowInterceptorModules = [];
+    // In-flight activity counter: keeps a session worker alive while one of
+    // its activities (notably the long ExecuteCursor) is running, so a view close
+    // can no longer reap the worker mid-run. Always installed; cheap and global.
+    activityInterceptors.push((ctx) => ({
+        inbound: {
+            async execute(input, next) {
+                const taskQueue = ctx.info.taskQueue;
+                activityStartedOnQueue(taskQueue);
+                try {
+                    return await next(input);
+                }
+                finally {
+                    activityFinishedOnQueue(taskQueue);
+                }
+            },
+        },
+    }));
+    const telemetry = telemetrySettings();
+    if (telemetry.traces.enabled) {
+        const { OpenTelemetryActivityInboundInterceptor, makeWorkflowExporter } = await import("@temporalio/interceptors-opentelemetry");
+        const { resourceFromAttributes } = await import("@opentelemetry/resources");
+        activityInterceptors.push((ctx) => ({
+            inbound: new OpenTelemetryActivityInboundInterceptor(ctx),
+        }));
+        const resource = resourceFromAttributes({
+            "service.name": "stigmer-runner-manager",
+        });
+        const exporter = contentGuardedExporter(await collectorSpanExporter(telemetry), telemetry.content);
+        const otelSinks = makeWorkflowExporter(exporter, resource);
+        sinks = { ...sinks, ...otelSinks };
+        if (workflowSourceKind === "runtime") {
+            const esmRequire = createRequire(import.meta.url);
+            workflowInterceptorModules.push(esmRequire.resolve(OTEL_WORKFLOW_INTERCEPTOR_MODULE));
+        }
+    }
+    return {
+        sinks,
+        interceptors: {
+            ...(activityInterceptors.length > 0
+                ? { activity: activityInterceptors }
+                : {}),
+        },
+        workflowInterceptorModules,
+    };
+}
+function resolveDefaultWorkspaceDir() {
+    try {
+        const dir = join(homedir(), ".stigmer", "workspaces", "runner");
+        mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+    catch {
+        const dir = join(tmpdir(), "stigmer-runner-workspace");
+        mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+}
+function normalizeEndpoint(endpoint) {
+    if (endpoint.startsWith("http://") || endpoint.startsWith("https://")) {
+        return endpoint;
+    }
+    if (endpoint.endsWith(":443")) {
+        return `https://${endpoint}`;
+    }
+    return `http://${endpoint}`;
+}
+//# sourceMappingURL=runner-manager.js.map

package/dist/runner-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-manager.js","sourceRoot":"","sources":["../src/runner-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAmB,MAAM,6BAA6B,CAAC;AAGlF,OAAO,EAAE,uCAAuC,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACjJ,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,gCAAgC,GAEjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,iFAAiF;AACjF,oDAAoD;AACpD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAErC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AACxC,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAE7C,iEAAiE;AACjE,qEAAqE;AACrE,iEAAiE;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAgIxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA6B;IAE7B,OAAO,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,yBAAyB,CACtC,OAA6B,EAC7B,IAAgB;IAEhB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,+DAA+D;IAC/D,oBAAoB,EAAE,CAAC;IAEvB,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,aAAa;IACb,MAAM,QAAQ,GAAa,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;IACrE,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,0FAA0F;IAC1F,qEAAqE;IACrE,MAAM,cAAc,GAAa,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAEhF,0BAA0B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAErD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,mEAAmE;IACnE,sEAAsE;IACtE,gEAAgE;IAChE,kDAAkD;IAClD,yEAAyE;IACzE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,GACvI,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAE7B,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;QACpD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;QACjC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CACX,wBAAwB,CAAC;YACvB,KAAK,EAAE,QAAQ,CAAC,OAAO;YACvB,eAAe,EAAE,UAAU,CAAC,sBAAsB;SACnD,CAAC;KACL,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;QAC7C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,KAAK,EAAE,OAAO,CAAC,YAAY;QAC3B,eAAe,EAAE,UAAU,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,MAAM,MAAM,GAAW;QACrB,GAAG,UAAU;QACb,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC;IACF,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAE/B,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,gBAAgB,CAAC,gBAAgB,CAC/B,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,iCAAiC,CAC5C,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,UAAU,CAAC,aAAa,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,mDAAmD;QACnD,OAAO,CAAC,IAAI,CACV,6EAA6E;YAC3E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChC,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAChD,8BAA8B,CAC/B,CAAC;QACF,MAAM,WAAW,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CACT,yCAAyC,WAAW,CAAC,IAAI,EAAE;YACzD,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;gBAC3B,CAAC,CAAC,WAAW,WAAW,CAAC,SAAS,EAAE;gBACpC,CAAC,CAAC,YAAY,WAAW,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,2EAA2E,GAAG,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,IACE,CAAC,SAAS,CAAC,iBAAiB;QAC5B,SAAS,CAAC,iBAAiB;QAC3B,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAClD,CAAC;QACD,OAAO,CAAC,IAAI,CACV,wEAAwE;YACtE,uEAAuE;YACvE,yBAAyB,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,GAAG,MAAM,CAAC,kBAAkB;KAC7B,CAAC,CAAC;IACH,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE9B,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAEzD,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,IAAI,cAAoC,CAAC;IACzC,IAAI,cAAc,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,qDAAqD,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5F,cAAc,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,cAAc,GAAG,MAAM,kBAAkB,CAAC;YACxC,aAAa,EAAE,cAAc,CAAC,aAAa;YAC3C,0BAA0B,EAAE,iBAAiB,CAAC,0BAA0B;SACzE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,2EAA2E;IAC3E,IAAI,WAAW,GAA0D,IAAI,CAAC;IAC9E,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,UAAU,mBAAmB,CAAC,SAAiB;QAClD,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YACjC,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,SAAS;YACT,UAAU;YACV,cAAc;YACd,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;YACnE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;YACpE,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,OAAO,CAAC,KAAK,CACX,qCAAqC,SAAS,qBAAqB,EACnE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,SAAS,mBAAmB,CAC1B,QAAqC,EACrC,EAAU,EACV,SAAiB,EACjB,IAAY;QAEZ,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC;YAC9B,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,EAAE,+BAA+B,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,eAAe,CAC5B,QAAqC,EACrC,EAAU,EACV,SAAiB,EACjB,IAAY;QAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,CAAC,UAAU,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,8BAA8B,CAAC,SAAS,CAAC,CAAC;QAC1C,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,IAAI,EAAE,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC1B,QAAqC,EACrC,EAAU,EACV,SAAiB,EACjB,IAAY;QAEZ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;YAC5B,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE;gBACpC,mEAAmE;gBACnE,yDAAyD;gBACzD,IAAI,YAAY;oBAAE,OAAO;gBACzB,KAAK,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,0CAA0C,IAAI,IAAI,EAAE,KAAK;gBACzD,GAAG,qBAAqB,CAAC,SAAS,CAAC,qDAAqD,CACzF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,SAAiB;YAChC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAAC;YACnD,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CACT,kCAAkC,SAAS,WAAW,SAAS,YAAY,QAAQ,CAAC,IAAI,GAAG,CAC5F,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,SAAiB;YACnC,MAAM,aAAa,CACjB,QAAQ,EAAE,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAAE,SAAS,CACjE,CAAC;YACF,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,sBAAsB;YACtB,IAAI,CAAC;gBACH,MAAM,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,gDAAgD,SAAS,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,cAAc;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAgB;YACnC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,uCAAuC,WAAW,CAAC,SAAS,KAAK;oBACjE,sCAAsC,CACvC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,yBAAyB,GAAG,QAAQ,CAAC;YACvD,WAAW,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,qDAAqD,SAAS,GAAG,CAClE,CAAC;YACF,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,2DAA2D;YAC3D,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpD,CAAC;QAED,WAAW,CAAC,KAAoB;YAC9B,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,oDAAoD;YACpD,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;YACzB,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACxC,gBAAgB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,YAAY,GAAG,IAAI,CAAC;YACpB,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CACT,kCAAkC,QAAQ,CAAC,IAAI,qBAAqB,CACrE,CAAC;YAEF,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAEhD,MAAM,gBAAgB,GAAG;gBACvB,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACnC,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;oBACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC1B,MAAM,OAAO,CAAC,UAAU,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;gBAC/D,CAAC,CACF;aACF,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,WAAW,CAAC;gBAC5B,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;oBAChC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAClC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,SAAS,WAAW,CAAC,CAAC;gBACrF,CAAC,CAAC,EAAE,CAAC,CAAC;YACR,CAAC;YAED,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpC,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,8BAA8B;YAC9B,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,oFAAoF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvI,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA6B;IAC3D,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA6B,EAC7B,QAAkB,EAClB,cAAwB;IAExB,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAE5C,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAK,OAAiB,CAAC;IAEzD,OAAO;QACL,SAAS,EAAE,SAAS,EAAE,kDAAkD;QACxE,gEAAgE;QAChE,uEAAuE;QACvE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,kBAAkB,EAChB,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,CAAC,eAAe,CAAC;QAC7E,sBAAsB,EAAE,iBAAiB,CAAC,OAAO,CAAC,eAAe,CAAC;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI;QAClE,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI;QAClE,eAAe,EAAE,QAAQ;QACzB,qBAAqB,EAAE,cAAc;QACrC,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,aAAa,EAAE,cAAc;QAC7B,YAAY,EAAE,WAAW;YACvB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,eAAe,CAAC;YAC3C,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,EAAE;QAC1E,IAAI;QACJ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;QAC5C,uBAAuB,EAAE,OAAO,CAAC,iCAAiC,IAAI,CAAC;QACvE,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,gBAAgB,EACd,OAAO,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,yBAAyB,EACvB,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QACpE,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS;QAC/C,0BAA0B,EACxB,OAAO,CAAC,0BAA0B,IAAI,sCAAsC;QAC9E,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,uCAAuC;QAC1E,sBAAsB,EACpB,OAAO,CAAC,sBAAsB,IAAI,iCAAiC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,WAAkC;IACnF,MAAM,CACJ,EAAE,uBAAuB,EAAE,EAC3B,EAAE,4BAA4B,EAAE,EAChC,EAAE,sCAAsC,EAAE,EAC1C,EAAE,+BAA+B,EAAE,EACnC,EAAE,6BAA6B,EAAE,EAClC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,uBAAuB,CAAC;QAC/B,MAAM,CAAC,+BAA+B,CAAC;QACvC,MAAM,CAAC,0CAA0C,CAAC;QAClD,MAAM,CAAC,mCAAmC,CAAC;QAC3C,MAAM,CAAC,gCAAgC,CAAC;KACzC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,CAAC,MAAM,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,4BAA4B,EAAE;QACjC,GAAG,sCAAsC,CAAC,MAAM,CAAC;QACjD,GAAG,+BAA+B,CAAC,MAAM,CAAC;QAC1C,GAAG,6BAA6B,CAAC,MAAM,CAAC;KACzC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,qBAA6C,qBAAqB,EAAE,CAAC,IAAI;IAEzE,qEAAqE;IACrE,wEAAwE;IACxE,eAAe;IACf,MAAM,oBAAoB,GAAkC,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE;YACP,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;gBACvB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrC,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;wBAAS,CAAC;oBACT,uBAAuB,CAAC,SAAS,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,uCAAuC,EAAE,oBAAoB,EAAE,GACrE,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACzD,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAC7C,0BAA0B,CAC3B,CAAC;QAEF,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,cAAc,EAAE,wBAAwB;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,qBAAqB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACnG,MAAM,SAAS,GAAG,oBAAoB,CACpC,QAAe,EACf,QAAe,CACiB,CAAC;QACnC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,0BAA0B;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAChE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,QAAQ,EAAE,CAAC;AAC9B,CAAC"}