@stigmer/server 3.14.0-dev.20260910084630

package/dist/sandbox/naming.d.ts

@@ -0,0 +1,11 @@
+import type { SandboxScope } from "./provisioner.js";
+/** Label carrying the owning driver ("stigmer-server") — the reap/list filter. */
+export declare const SANDBOX_MANAGED_BY_LABEL = "stigmer.ai/managed-by";
+/** Label carrying the scope ("session" | "workflow" | "connect"). */
+export declare const SANDBOX_SCOPE_LABEL = "stigmer.ai/scope";
+/** Label carrying the full owning resource id (the Q4 runtime-derived link). */
+export declare const SANDBOX_ID_LABEL = "stigmer.ai/sandbox-id";
+export declare const SANDBOX_MANAGED_BY_VALUE = "stigmer-server";
+/** sbx-<code>-<12-hex> (SandboxObjectNaming.java's derivation, kept exactly). */
+export declare function sandboxBaseName(scope: SandboxScope, id: string): string;
+//# sourceMappingURL=naming.d.ts.map

package/dist/sandbox/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/sandbox/naming.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AASrD,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AACtD,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAGvE"}

package/dist/sandbox/naming.js

@@ -0,0 +1,33 @@
+/**
+ * Deterministic sandbox object naming — generalized from the cloud
+ * edition's SandboxObjectNaming.java so both container drivers (and the
+ * cloud's own provisioner) name sandboxes identically: an operator
+ * moving between tiers sees one vocabulary.
+ *
+ * Base name: sbx-<scope-code>-<first 12 hex chars of SHA-256(id)> —
+ * DNS-1123-safe regardless of the id's alphabet or length (resource ids
+ * carry prefixes like ses_ that DNS labels reject; hashing sidesteps
+ * every alphabet/length edge). The full id travels in a label so the
+ * mapping is recoverable from the runtime object alone (gate ruling Q4:
+ * runtime-derived state, no store tables).
+ */
+import { createHash } from "node:crypto";
+/** The Java SandboxScope codes, byte-identical. */
+const SCOPE_CODES = {
+    session: "ses",
+    workflow: "wfx",
+    connect: "mcp",
+};
+/** Label carrying the owning driver ("stigmer-server") — the reap/list filter. */
+export const SANDBOX_MANAGED_BY_LABEL = "stigmer.ai/managed-by";
+/** Label carrying the scope ("session" | "workflow" | "connect"). */
+export const SANDBOX_SCOPE_LABEL = "stigmer.ai/scope";
+/** Label carrying the full owning resource id (the Q4 runtime-derived link). */
+export const SANDBOX_ID_LABEL = "stigmer.ai/sandbox-id";
+export const SANDBOX_MANAGED_BY_VALUE = "stigmer-server";
+/** sbx-<code>-<12-hex> (SandboxObjectNaming.java's derivation, kept exactly). */
+export function sandboxBaseName(scope, id) {
+    const digest = createHash("sha256").update(id).digest("hex").slice(0, 12);
+    return `sbx-${SCOPE_CODES[scope]}-${digest}`;
+}
+//# sourceMappingURL=naming.js.map

package/dist/sandbox/naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../src/sandbox/naming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,mDAAmD;AACnD,MAAM,WAAW,GAAiC;IAChD,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;CACf,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAEzD,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,EAAU;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/sandbox/provisioner.d.ts

@@ -0,0 +1,138 @@
+/**
+ * The sandbox-provisioner driver seam — convergence program 20260826.02,
+ * blueprint/03 §6d and DD-002, built by sub-project 20260827.05 (O6). The
+ * contract generalizes the cloud edition's production-proven Java
+ * strategy interface (stigmer-cloud
+ * domain/agentic/sandbox/SandboxProvisioner.java) so execution isolation
+ * is an OSS capability: a provisioner creates, repairs, and tears down
+ * the isolated runner that polls one execution-scoped Temporal task
+ * queue.
+ *
+ * Scope vocabulary (the Java interface's three variants, kept exactly):
+ *
+ *   - SESSION: long-lived, one sandbox per session, ensure is IDEMPOTENT
+ *     ensure-as-state-machine (absent → provision; stopped → start;
+ *     running → fast path). Invoked non-critically after the execution's
+ *     workflow starts (see steps.ts).
+ *   - WORKFLOW: ephemeral, one sandbox per workflow execution (shared by
+ *     the workflow AND its nested child agent executions via the wfexec:
+ *     queue-override lane — dispatch.ts). Ensured critically BEFORE the
+ *     execution persists; deprovisioned on the terminal phase transition.
+ *   - CONNECT: request-scoped, NOT idempotent; the caller must
+ *     deprovision in a finally block. Carried in the contract for the
+ *     cloud implementation (its MCP connect lane) — OSS does not invoke
+ *     it today because OSS connect runs on the shared runner queue (a
+ *     named non-goal, T01 gate ruling Q7).
+ *
+ * The probe is ensure-time LIVE-STATE inspection, never a boot-readiness
+ * wait (gate ruling Q5): the verified cloud design has NO readiness
+ * probes — a sandbox that never polls its queue surfaces as the
+ * activity's ScheduleToStartTimeout, with the ensure step's error
+ * pre-stamp naming the root cause.
+ *
+ * Selection follows the artifact-storage precedent (§6b): built-in
+ * drivers by name behind the SANDBOX_PROVISIONER_TYPE config knob,
+ * extension-registered names beyond them (extensions/drivers.ts), an
+ * unknown name a loud boot throw. The DEFAULT ("") is the external-runner
+ * posture — no provisioner constructed, ensure never invoked — which IS
+ * today's OSS behavior, named (gate ruling Q1): an operator-managed
+ * runner process polls the queues.
+ */
+import type { Logger } from "../boot/logger.js";
+/**
+ * The runtime handed to a provisioner for one sandbox: which queue the
+ * sandboxed runner must poll and the credential it authenticates with.
+ * Deliberately minimal (the Java SandboxEnvironment carries the same two
+ * load-bearing fields plus cloud-only accounting) — endpoints, images,
+ * and resource shapes are DRIVER configuration, not per-sandbox state.
+ */
+export interface SandboxEnvironment {
+    /** The Temporal task queue the sandboxed runner polls (session:{id} / wfexec:{id}). */
+    readonly taskQueue: string;
+    /**
+     * The runner credential injected as STIGMER_TOKEN. "" means none was
+     * minted (the provider's lane is disabled) — the sandbox still launches
+     * and EC decrypt falls back to redaction, the oss#535 posture.
+     */
+    readonly stigmerToken: string;
+}
+/** One sandbox's observed live state (the Q5 probe result). */
+export type SandboxProbeState = "absent" | "stopped" | "running";
+/** The scope discriminant, shared by probe and the drivers' naming. */
+export type SandboxScope = "session" | "workflow" | "connect";
+/**
+ * The driver contract. Implementations must be safe for concurrent use —
+ * ensure calls for the same id may race (the cloud accepts check-then-act
+ * overshoot, DD-002) and every arm must be idempotent except connect
+ * creation, which is documented one-shot.
+ */
+export interface SandboxProvisioner {
+    /**
+     * Ensure-as-state-machine for a session sandbox: absent → provision;
+     * stopped → start; running → fast path. Idempotent; safe to invoke on
+     * every execution create/recover for the session.
+     */
+    ensureSessionSandbox(sessionId: string, env: SandboxEnvironment): Promise<void>;
+    /** Tears down the session sandbox; missing is success (idempotent). */
+    deprovisionSessionSandbox(sessionId: string): Promise<void>;
+    /**
+     * Ensures the per-execution workflow sandbox. Same state-machine
+     * semantics; the sandbox lives exactly as long as the execution runs.
+     */
+    ensureWorkflowSandbox(executionId: string, env: SandboxEnvironment): Promise<void>;
+    /** Tears down the workflow sandbox; missing is success (idempotent). */
+    deprovisionWorkflowSandbox(executionId: string): Promise<void>;
+    /**
+     * Creates a request-scoped connect sandbox and returns the provider's
+     * sandbox id. NOT idempotent — the caller owns deprovision in a
+     * finally block. Unused by OSS wiring today (module header).
+     */
+    createConnectSandbox(connectRequestId: string, env: SandboxEnvironment): Promise<string>;
+    /** Tears down a connect sandbox by provider id; missing is success. */
+    deprovisionConnectSandbox(sandboxId: string): Promise<void>;
+    /** Live-state inspection (Q5) — consumed by ensure arms and diagnostics. */
+    probe(scope: SandboxScope, id: string): Promise<SandboxProbeState>;
+}
+/**
+ * Driver configuration resolved from ServerConfig — what every built-in
+ * needs to launch a runner that can reach this server. Extension drivers
+ * receive the same bag and may read their own env beyond it.
+ */
+export interface SandboxDriverConfig {
+    /**
+     * The server endpoint AS REACHABLE FROM INSIDE a sandbox (a container
+     * cannot use this process's localhost). Injected as
+     * STIGMER_BACKEND_ENDPOINT.
+     */
+    readonly backendEndpoint: string;
+    /** Temporal address as reachable from inside a sandbox (TEMPORAL_SERVICE_ADDRESS). */
+    readonly temporalAddress: string;
+    /** The runner image for container-based drivers (docker/kubernetes). */
+    readonly runnerImage: string;
+    /** The runner executable for the local-process driver. */
+    readonly runnerCommand: string;
+    /** The namespace the kubernetes driver provisions into. */
+    readonly kubernetesNamespace: string;
+}
+/** Constructs a driver. Factories, not instances — an unselected driver constructs nothing (§6b). */
+export type SandboxProvisionerFactory = (options: {
+    readonly config: SandboxDriverConfig;
+    readonly logger: Logger;
+}) => SandboxProvisioner;
+/**
+ * The built-in driver names — reserved: an extension registering one of
+ * these is a boot throw (the registry's shadow rule, extensions/
+ * registry.ts). DD-002's isolation ladder: process → Docker → Kubernetes.
+ */
+export declare const BUILT_IN_SANDBOX_PROVISIONER_TYPES: readonly ["local-process", "docker", "kubernetes"];
+/**
+ * Selects and constructs the configured provisioner, or undefined for
+ * the default external-runner posture (type ""). Unknown names are a
+ * loud boot throw — a typo'd knob must never silently run unisolated
+ * (the validateR2Config precedent).
+ */
+export declare function newSandboxProvisioner(type: string, options: {
+    readonly config: SandboxDriverConfig;
+    readonly logger: Logger;
+}, builtInFactories: ReadonlyMap<string, SandboxProvisionerFactory>, registeredFactories: ReadonlyMap<string, SandboxProvisionerFactory>): SandboxProvisioner | undefined;
+//# sourceMappingURL=provisioner.d.ts.map

package/dist/sandbox/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,uEAAuE;IACvE,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,wEAAwE;IACxE,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,oBAAoB,CAClB,gBAAgB,EAAE,MAAM,EACxB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,uEAAuE;IACvE,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,4EAA4E;IAC5E,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACpE;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,sFAAsF;IACtF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qGAAqG;AACrG,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,EAAE;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KAAK,kBAAkB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,oDAIrC,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC1E,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAChE,mBAAmB,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAClE,kBAAkB,GAAG,SAAS,CAehC"}

package/dist/sandbox/provisioner.js

@@ -0,0 +1,31 @@
+/**
+ * The built-in driver names — reserved: an extension registering one of
+ * these is a boot throw (the registry's shadow rule, extensions/
+ * registry.ts). DD-002's isolation ladder: process → Docker → Kubernetes.
+ */
+export const BUILT_IN_SANDBOX_PROVISIONER_TYPES = [
+    "local-process",
+    "docker",
+    "kubernetes",
+];
+/**
+ * Selects and constructs the configured provisioner, or undefined for
+ * the default external-runner posture (type ""). Unknown names are a
+ * loud boot throw — a typo'd knob must never silently run unisolated
+ * (the validateR2Config precedent).
+ */
+export function newSandboxProvisioner(type, options, builtInFactories, registeredFactories) {
+    if (type === "") {
+        return undefined;
+    }
+    const factory = builtInFactories.get(type) ?? registeredFactories.get(type);
+    if (factory === undefined) {
+        const known = [
+            ...builtInFactories.keys(),
+            ...registeredFactories.keys(),
+        ].sort();
+        throw new Error(`unknown sandbox provisioner type '${type}' — known types: '${known.join("', '")}'`);
+    }
+    return factory(options);
+}
+//# sourceMappingURL=provisioner.js.map

package/dist/sandbox/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../src/sandbox/provisioner.ts"],"names":[],"mappings":"AAyIA;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,eAAe;IACf,QAAQ;IACR,YAAY;CACJ,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAA0E,EAC1E,gBAAgE,EAChE,mBAAmE;IAEnE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG;YACZ,GAAG,gBAAgB,CAAC,IAAI,EAAE;YAC1B,GAAG,mBAAmB,CAAC,IAAI,EAAE;SAC9B,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC"}

package/dist/sandbox/steps.d.ts

@@ -0,0 +1,92 @@
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { WorkflowExecution } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ExecutionPhase as WorkflowExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import type { Logger } from "../boot/logger.js";
+import type { AgentExecutionTemporalConfig } from "../domain/agentexecution/temporal/config.js";
+import { type WorkflowExecutionTemporalConfig } from "../domain/workflowexecution/temporal/config.js";
+import type { PipelineStep } from "../pipeline/pipeline.js";
+import type { Store } from "../store/interface.js";
+import { type SandboxLane } from "./lane.js";
+/**
+ * The pre-stamped root-cause prefix — the cloud edition's
+ * stampProvisioningFailure copy, kept identical (the same failure must
+ * read the same on both editions).
+ */
+export declare const SANDBOX_PROVISIONING_FAILED_PREFIX = "Sandbox provisioning failed: ";
+type AgentExecutionCreateDesc = typeof AgentExecutionSchema;
+export interface EnsureSessionSandboxDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    readonly lane: SandboxLane;
+    readonly temporalConfig: AgentExecutionTemporalConfig;
+}
+/**
+ * The session-lane ensure step (module header posture #1). Placed after
+ * StartWorkflow in the agent-execution create chain and after
+ * StartFreshWorkflow in recover — the sandbox boots concurrently with the
+ * workflow's first activity ScheduleToStart window.
+ *
+ * Dispatch is re-resolved here (one extra session read, on the
+ * enabled+CLOUD arm only) so the step stays self-contained — the same
+ * choice the Java step makes rather than threading dispatch results
+ * through the chain.
+ */
+export declare function newEnsureSessionSandboxStep(deps: EnsureSessionSandboxDeps): PipelineStep<AgentExecutionCreateDesc>;
+/**
+ * The session-lane body, shared by the create step above and the recover
+ * chain's post-StartFreshWorkflow invocation (lifecycle.ts) — the Java
+ * precedent wires ONE step bean into both pipelines; here the two
+ * chains' differing context shapes (newState vs loaded execution) meet
+ * at this seam instead.
+ *
+ * `callerIdentityId` rides into the credential mint (lane.ts): the Java
+ * ensure step mints session tokens FOR the requesting caller, so the
+ * capability mint needs the identity the OSS execution-scoped mint never
+ * did. Empty when the invoking site has no caller.
+ */
+export declare function ensureSessionSandboxForExecution(deps: EnsureSessionSandboxDeps, execution: AgentExecution, callerIdentityId: string): Promise<void>;
+export interface EnsureWorkflowSandboxDeps {
+    readonly logger: Logger;
+    readonly lane: SandboxLane;
+    readonly temporalConfig: WorkflowExecutionTemporalConfig;
+}
+/**
+ * The workflow-lane ensure step (module header posture #2): CRITICAL,
+ * placed before Persist in the workflow-execution create chain — a
+ * provisioning failure answers Unavailable with zero orphaned state.
+ * Only reachable with a provisioner composed AND per-execution routing
+ * resolved to CLOUD, so the copy is new O6 surface, not ported wire
+ * contract.
+ */
+export declare function newEnsureWorkflowSandboxStep(deps: EnsureWorkflowSandboxDeps): PipelineStep<typeof WorkflowExecutionSchema>;
+/**
+ * The workflow-lane body, shared by the create step above and recover's
+ * re-provision (lifecycle.ts — the previous sandbox was deprovisioned at
+ * the terminal FAILED, so a recovered execution needs a fresh one before
+ * its fresh workflow starts). Throws Unavailable on provisioning failure
+ * — the critical posture in both chains. `callerIdentityId` rides into
+ * the credential mint exactly as on the session body.
+ */
+export declare function ensureWorkflowSandboxForExecution(deps: EnsureWorkflowSandboxDeps, execution: WorkflowExecution, callerIdentityId: string): Promise<void>;
+/**
+ * Observes one persisted status write and fires the workflow-sandbox
+ * teardown on a transition INTO a terminal phase — fire-and-forget
+ * (module header posture #3). Invoked from the three status write sites
+ * (the UpdateStatus RPC, the orchestrator's persist activity, the
+ * lifecycle cancel/terminate persists); idempotent deprovision makes the
+ * multi-site wiring safe.
+ */
+export type WorkflowSandboxTerminalObserver = (executionId: string, previousPhase: WorkflowExecutionPhase, currentPhase: WorkflowExecutionPhase) => void;
+export declare function newWorkflowSandboxTerminalObserver(lane: SandboxLane, logger: Logger): WorkflowSandboxTerminalObserver;
+/**
+ * Best-effort session-sandbox teardown for the session delete handler
+ * (module header posture #4; the Java SessionDeleteHandler shape — a
+ * handler call after the delete pipeline, not a pipeline step). A
+ * failure never fails the delete (the row is already gone) but is
+ * ERROR-logged — no reaper exists to catch a leak.
+ */
+export declare function deprovisionSessionSandboxBestEffort(lane: SandboxLane, logger: Logger, sessionId: string): Promise<void>;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/sandbox/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../src/sandbox/steps.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,EACL,oBAAoB,EAErB,MAAM,6DAA6D,CAAC;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,cAAc,IAAI,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AAG3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,gDAAgD,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAM5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,kCACd,CAAC;AAElC,KAAK,wBAAwB,GAAG,OAAO,oBAAoB,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;CACvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,wBAAwB,GAC7B,YAAY,CAAC,wBAAwB,CAAC,CAWxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,wBAAwB,EAC9B,SAAS,EAAE,cAAc,EACzB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CA+Df;AAsCD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,yBAAyB,GAC9B,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAW9C;AAED;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,yBAAyB,EAC/B,SAAS,EAAE,iBAAiB,EAC5B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAC5C,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,sBAAsB,KACjC,IAAI,CAAC;AAEV,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,GACb,+BAA+B,CA6BjC;AAED;;;;;;GAMG;AACH,wBAAsB,mCAAmC,CACvD,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/sandbox/steps.js

@@ -0,0 +1,267 @@
+/**
+ * The sandbox invocation surface — the per-lane postures the cloud
+ * edition proved in production (T01 gate ruling Q2: ONE shared
+ * implementation, per-lane postures — the blueprint §6d "one shared step"
+ * names the session-lane shape, the Java workflow lane is deliberately
+ * its opposite):
+ *
+ *   - EnsureSessionSandbox (agent executions): AFTER StartWorkflow,
+ *     NON-critical. A provisioning failure never fails the launch, but it
+ *     is never silent either — ERROR-logged and PRE-STAMPED onto
+ *     status.error first-non-empty-wins, so when the agent activity dies
+ *     at its ScheduleToStartTimeout minutes later the user sees the root
+ *     cause instead of a generic timeout. The 2026-07 cloud quota outage
+ *     hid for two days behind this step's former WARN-and-swallow — the
+ *     pre-stamp posture is contract (DD-002).
+ *   - EnsureWorkflowSandbox (workflow executions): BEFORE Persist,
+ *     CRITICAL and synchronous — a refusal orphans nothing (no row, no
+ *     Temporal workflow), the verified Java ordering.
+ *   - Workflow-sandbox terminal deprovision: server-side at the three
+ *     status write sites (gate ruling Q3b — the invoke workflow's history
+ *     shape is pinned contract, so no new workflow activity). KNOWN
+ *     WINDOW, ruled acceptable: the orchestrator's terminal persists are
+ *     best-effort, so a persist that never lands leaks the sandbox — OSS
+ *     has no orphan reaper (the cloud's rides its C4 extension workers).
+ *     Deprovision is idempotent, so multiple sites firing is harmless.
+ *   - DeprovisionSessionSandbox (session delete): best-effort teardown,
+ *     ERROR-logged on failure, never fails the delete (the Java
+ *     SessionDeleteHandler posture).
+ *
+ * The pre-stamp rides Store.updateResource (atomic read-modify-write) —
+ * a whole-resource save here would race the runner's concurrent
+ * UpdateStatus writes; load-then-save stays banned in status paths.
+ *
+ * Every step short-circuits when the lane is disabled or the execution's
+ * resolved target is LOCAL — the conformance rosters run entirely on
+ * those fast paths (byte-identity by construction).
+ */
+import { create } from "@bufbuild/protobuf";
+import { AgentExecutionSchema, AgentExecutionStatusSchema, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionTarget } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import { ExecutionPhase as WorkflowExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { WORKFLOW_ROUTING_EXECUTION, } from "../domain/workflowexecution/temporal/config.js";
+import { unavailableError } from "../pipeline/errors.js";
+import { formatSessionTaskQueue, resolveActivityTaskQueue, } from "../temporal/agentexecution/dispatch.js";
+import { resolveWorkflowTaskQueue } from "../temporal/workflowexecution/dispatch.js";
+import { mintSandboxToken } from "./lane.js";
+/**
+ * The pre-stamped root-cause prefix — the cloud edition's
+ * stampProvisioningFailure copy, kept identical (the same failure must
+ * read the same on both editions).
+ */
+export const SANDBOX_PROVISIONING_FAILED_PREFIX = "Sandbox provisioning failed: ";
+/**
+ * The session-lane ensure step (module header posture #1). Placed after
+ * StartWorkflow in the agent-execution create chain and after
+ * StartFreshWorkflow in recover — the sandbox boots concurrently with the
+ * workflow's first activity ScheduleToStart window.
+ *
+ * Dispatch is re-resolved here (one extra session read, on the
+ * enabled+CLOUD arm only) so the step stays self-contained — the same
+ * choice the Java step makes rather than threading dispatch results
+ * through the chain.
+ */
+export function newEnsureSessionSandboxStep(deps) {
+    return {
+        name: "EnsureSessionSandbox",
+        async execute(ctx) {
+            await ensureSessionSandboxForExecution(deps, ctx.newState, ctx.callerIdentity.identityId);
+        },
+    };
+}
+/**
+ * The session-lane body, shared by the create step above and the recover
+ * chain's post-StartFreshWorkflow invocation (lifecycle.ts) — the Java
+ * precedent wires ONE step bean into both pipelines; here the two
+ * chains' differing context shapes (newState vs loaded execution) meet
+ * at this seam instead.
+ *
+ * `callerIdentityId` rides into the credential mint (lane.ts): the Java
+ * ensure step mints session tokens FOR the requesting caller, so the
+ * capability mint needs the identity the OSS execution-scoped mint never
+ * did. Empty when the invoking site has no caller.
+ */
+export async function ensureSessionSandboxForExecution(deps, execution, callerIdentityId) {
+    if (!deps.lane.enabled) {
+        return;
+    }
+    const lane = deps.lane;
+    const executionId = execution.metadata?.id ?? "";
+    const sessionId = execution.spec?.sessionId ?? "";
+    // The wfexec: override lane shares the parent workflow's sandbox —
+    // dispatch forces LOCAL there, but skipping before the store read
+    // keeps the child-execution hot path free of it.
+    if (sessionId === "" || (execution.spec?.activityTaskQueue ?? "") !== "") {
+        return;
+    }
+    try {
+        const dispatch = await resolveActivityTaskQueue(deps.store, sessionId, deps.temporalConfig, "", deps.logger);
+        if (dispatch.executionTarget !== ExecutionTarget.CLOUD) {
+            return;
+        }
+        if (dispatch.taskQueue !== formatSessionTaskQueue(sessionId)) {
+            // CLOUD target under global routing: the sandbox would have to
+            // poll the shared queue, which is the external-runner posture —
+            // boot coherence validation forbids the combination; this arm is
+            // the belt-and-braces skip.
+            deps.logger.warn("Sandbox provisioning skipped: session routing is not per-session", { executionId, sessionId, taskQueue: dispatch.taskQueue });
+            return;
+        }
+        await lane.provisioner.ensureSessionSandbox(sessionId, {
+            taskQueue: dispatch.taskQueue,
+            stigmerToken: mintSandboxToken(lane, {
+                scope: "session",
+                sessionId,
+                executionId,
+                org: execution.metadata?.org ?? "",
+                callerIdentityId,
+            }, deps.logger),
+        });
+    }
+    catch (error) {
+        // Non-critical: never fail the launch — but never silent either
+        // (module header). The real error goes to the log; the sanitized
+        // root cause is pre-stamped for the timeout the user will see.
+        deps.logger.error("Session sandbox provisioning failed - execution will time out unless a runner polls its queue", {
+            executionId,
+            sessionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        await stampProvisioningFailure(deps.store, deps.logger, executionId, error);
+    }
+}
+/**
+ * First-non-empty-wins stamp of the provisioning root cause onto
+ * status.error (the Java setStatusErrorIfEmpty semantic) via the store's
+ * atomic read-modify-write. Touches ONLY the error field — phase stays
+ * the runner-owned lane. Best-effort: a stamp failure is logged, never
+ * thrown (the execution is already launched).
+ */
+async function stampProvisioningFailure(store, logger, executionId, cause) {
+    const message = SANDBOX_PROVISIONING_FAILED_PREFIX +
+        (cause instanceof Error ? cause.message : String(cause));
+    try {
+        await store.updateResource(ApiResourceKind.agent_execution, executionId, AgentExecutionSchema, (execution) => {
+            execution.status ??= create(AgentExecutionStatusSchema);
+            if (execution.status.error === "") {
+                execution.status.error = message;
+            }
+        });
+    }
+    catch (error) {
+        logger.error("Failed to pre-stamp sandbox provisioning failure", {
+            executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * The workflow-lane ensure step (module header posture #2): CRITICAL,
+ * placed before Persist in the workflow-execution create chain — a
+ * provisioning failure answers Unavailable with zero orphaned state.
+ * Only reachable with a provisioner composed AND per-execution routing
+ * resolved to CLOUD, so the copy is new O6 surface, not ported wire
+ * contract.
+ */
+export function newEnsureWorkflowSandboxStep(deps) {
+    return {
+        name: "EnsureWorkflowSandbox",
+        async execute(ctx) {
+            await ensureWorkflowSandboxForExecution(deps, ctx.newState, ctx.callerIdentity.identityId);
+        },
+    };
+}
+/**
+ * The workflow-lane body, shared by the create step above and recover's
+ * re-provision (lifecycle.ts — the previous sandbox was deprovisioned at
+ * the terminal FAILED, so a recovered execution needs a fresh one before
+ * its fresh workflow starts). Throws Unavailable on provisioning failure
+ * — the critical posture in both chains. `callerIdentityId` rides into
+ * the credential mint exactly as on the session body.
+ */
+export async function ensureWorkflowSandboxForExecution(deps, execution, callerIdentityId) {
+    if (!deps.lane.enabled) {
+        return;
+    }
+    const lane = deps.lane;
+    const executionId = execution.metadata?.id ?? "";
+    if (executionId === "" ||
+        deps.temporalConfig.workflowActivityRouting !== WORKFLOW_ROUTING_EXECUTION) {
+        return;
+    }
+    const dispatch = resolveWorkflowTaskQueue(executionId, execution.spec?.executionTarget ?? ExecutionTarget.UNSPECIFIED, deps.temporalConfig, deps.logger);
+    if (dispatch.executionTarget !== ExecutionTarget.CLOUD) {
+        return;
+    }
+    try {
+        await lane.provisioner.ensureWorkflowSandbox(executionId, {
+            taskQueue: dispatch.taskQueue,
+            stigmerToken: mintSandboxToken(lane, {
+                scope: "workflow",
+                sessionId: "",
+                executionId,
+                org: execution.metadata?.org ?? "",
+                callerIdentityId,
+            }, deps.logger),
+        });
+    }
+    catch (error) {
+        deps.logger.error("Workflow sandbox provisioning failed - refusing the request", {
+            executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw unavailableError("failed to provision workflow sandbox");
+    }
+}
+/** The workflow-execution phases after which the per-execution sandbox has no work left. */
+const TERMINAL_WORKFLOW_PHASES = new Set([
+    WorkflowExecutionPhase.EXECUTION_COMPLETED,
+    WorkflowExecutionPhase.EXECUTION_FAILED,
+    WorkflowExecutionPhase.EXECUTION_CANCELLED,
+    WorkflowExecutionPhase.EXECUTION_TERMINATED,
+]);
+export function newWorkflowSandboxTerminalObserver(lane, logger) {
+    return (executionId, previousPhase, currentPhase) => {
+        if (!lane.enabled ||
+            previousPhase === currentPhase ||
+            !TERMINAL_WORKFLOW_PHASES.has(currentPhase)) {
+            return;
+        }
+        void lane.provisioner.deprovisionWorkflowSandbox(executionId).then(() => {
+            logger.info("Workflow sandbox deprovisioned on terminal phase", {
+                executionId,
+                phase: WorkflowExecutionPhase[currentPhase],
+            });
+        }, (error) => {
+            // ERROR, not warn: nothing retries this and no reaper exists —
+            // the log line is the operator's only signal of the leak.
+            logger.error("Workflow sandbox deprovision failed - sandbox may be leaked", {
+                executionId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        });
+    };
+}
+/**
+ * Best-effort session-sandbox teardown for the session delete handler
+ * (module header posture #4; the Java SessionDeleteHandler shape — a
+ * handler call after the delete pipeline, not a pipeline step). A
+ * failure never fails the delete (the row is already gone) but is
+ * ERROR-logged — no reaper exists to catch a leak.
+ */
+export async function deprovisionSessionSandboxBestEffort(lane, logger, sessionId) {
+    if (!lane.enabled || sessionId === "") {
+        return;
+    }
+    try {
+        await lane.provisioner.deprovisionSessionSandbox(sessionId);
+    }
+    catch (error) {
+        logger.error("Session sandbox deprovision failed - sandbox may be leaked", {
+            sessionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+//# sourceMappingURL=steps.js.map

package/dist/sandbox/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../src/sandbox/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAC;AAGxF,OAAO,EAAE,cAAc,IAAI,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AAC3H,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH,OAAO,EACL,0BAA0B,GAE3B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAoB,MAAM,WAAW,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,+BAA+B,CAAC;AAWlC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,gCAAgC,CACpC,IAAI,EACJ,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,CAAC,UAAU,CAC9B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAA8B,EAC9B,SAAyB,EACzB,gBAAwB;IAExB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAClD,mEAAmE;IACnE,kEAAkE;IAClE,iDAAiD;IACjD,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,SAAS,EACT,IAAI,CAAC,cAAc,EACnB,EAAE,EACF,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,IAAI,QAAQ,CAAC,eAAe,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,iEAAiE;YACjE,4BAA4B;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kEAAkE,EAClE,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,SAAS,EAAE;YACrD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,gBAAgB,CAC5B,IAAI,EACJ;gBACE,KAAK,EAAE,SAAS;gBAChB,SAAS;gBACT,WAAW;gBACX,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAClC,gBAAgB;aACjB,EACD,IAAI,CAAC,MAAM,CACZ;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,iEAAiE;QACjE,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+FAA+F,EAC/F;YACE,WAAW;YACX,SAAS;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,MAAM,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAAY,EACZ,MAAc,EACd,WAAmB,EACnB,KAAc;IAEd,MAAM,OAAO,GACX,kCAAkC;QAClC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,CACxB,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,EACpB,CAAC,SAAyB,EAAE,EAAE;YAC5B,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,SAAS,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;YACnC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YAC/D,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,iCAAiC,CACrC,IAAI,EACJ,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,CAAC,UAAU,CAC9B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAA+B,EAC/B,SAA4B,EAC5B,gBAAwB;IAExB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,IACE,WAAW,KAAK,EAAE;QAClB,IAAI,CAAC,cAAc,CAAC,uBAAuB,KAAK,0BAA0B,EAC1E,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CACvC,WAAW,EACX,SAAS,CAAC,IAAI,EAAE,eAAe,IAAI,eAAe,CAAC,WAAW,EAC9D,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,CACZ,CAAC;IACF,IAAI,QAAQ,CAAC,eAAe,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACvD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,WAAW,EAAE;YACxD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,YAAY,EAAE,gBAAgB,CAC5B,IAAI,EACJ;gBACE,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,EAAE;gBACb,WAAW;gBACX,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAClC,gBAAgB;aACjB,EACD,IAAI,CAAC,MAAM,CACZ;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6DAA6D,EAC7D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,wBAAwB,GAAwC,IAAI,GAAG,CAAC;IAC5E,sBAAsB,CAAC,mBAAmB;IAC1C,sBAAsB,CAAC,gBAAgB;IACvC,sBAAsB,CAAC,mBAAmB;IAC1C,sBAAsB,CAAC,oBAAoB;CAC5C,CAAC,CAAC;AAgBH,MAAM,UAAU,kCAAkC,CAChD,IAAiB,EACjB,MAAc;IAEd,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE;QAClD,IACE,CAAC,IAAI,CAAC,OAAO;YACb,aAAa,KAAK,YAAY;YAC9B,CAAC,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,EAC3C,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,IAAI,CAChE,GAAG,EAAE;YACH,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBAC9D,WAAW;gBACX,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,+DAA+D;YAC/D,0DAA0D;YAC1D,MAAM,CAAC,KAAK,CACV,6DAA6D,EAC7D;gBACE,WAAW;gBACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4DAA4D,EAAE;YACzE,SAAS;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}