@straiffi/archon 1.8.20 → 1.8.22

package/dist/server/lib/executionRunAuthority.js

@@ -0,0 +1,467 @@
+import db from '../db.js';
+import { getExecutionProfileRevision, getActiveExecutionProfileRevision, revisionFingerprintMatchesProfile } from './executionProfileStore.js';
+import { createExecutionProfile, EXECUTION_PROFILE_SCHEMA_VERSION, fingerprintCredentialRequirements, fingerprintExecutionProfile, } from './executionProfiles.js';
+import { hostExecutionEnvironmentObservation } from './hostExecutionEnvironment.js';
+import { normalizeExecutionEnvironmentDestinations, networkDestinationTarget, } from './executionEnvironmentLifecycle.js';
+const MAX_AUTHORITY_BYTES = 16 * 1024;
+export const createExecutionProfileSelection = (projectId, reason = 'project_active_at_acceptance') => {
+    const revision = getActiveExecutionProfileRevision(projectId);
+    if (!revision) {
+        throw new Error('The project has no active execution profile revision');
+    }
+    return {
+        revisionId: revision.id,
+        fingerprint: revision.fingerprint,
+        reason,
+    };
+};
+export const validateExecutionProfileSelection = (projectId, selection) => {
+    const revision = getExecutionProfileRevision(projectId, selection.revisionId);
+    if (!revision
+        || revision.fingerprint !== selection.fingerprint
+        || !revisionFingerprintMatchesProfile(revision)) {
+        throw new Error('The selected execution profile revision and fingerprint do not match');
+    }
+    return revision;
+};
+export const executionProfileSelectionMetadata = (selection) => ({
+    execution_profile_revision_id: selection.revisionId,
+    execution_profile_fingerprint: selection.fingerprint,
+    execution_profile_selection_reason: selection.reason,
+});
+export const parseExecutionProfileSelectionMetadata = (metadata) => {
+    if (typeof metadata?.execution_profile_revision_id !== 'string'
+        || typeof metadata.execution_profile_fingerprint !== 'string'
+        || (metadata.execution_profile_selection_reason !== 'project_active_at_acceptance'
+            && metadata.execution_profile_selection_reason !== 'historical_lineage')) {
+        return null;
+    }
+    return {
+        revisionId: metadata.execution_profile_revision_id,
+        fingerprint: metadata.execution_profile_fingerprint,
+        reason: metadata.execution_profile_selection_reason,
+    };
+};
+export const getHistoricalBuildExecutionProfileSelection = (projectId, ticketId) => {
+    const row = db.prepare(`
+    SELECT run.metadata_json
+    FROM execution_runs run
+    JOIN execution_run_links ticket_link
+      ON ticket_link.execution_run_id = run.id
+      AND ticket_link.project_id = run.project_id
+      AND ticket_link.entity_type = 'ticket'
+      AND ticket_link.entity_id = ?
+      AND ticket_link.relationship = 'primary'
+    WHERE run.project_id = ? AND run.kind = 'build'
+    ORDER BY run.created_at DESC, run.id DESC
+    LIMIT 1
+  `).get(ticketId, projectId);
+    let metadata = null;
+    try {
+        metadata = row?.metadata_json ? JSON.parse(row.metadata_json) : null;
+    }
+    catch {
+        metadata = null;
+    }
+    const selection = parseExecutionProfileSelectionMetadata(metadata);
+    if (!selection) {
+        throw new Error('The resumed Build has no historical execution profile lineage');
+    }
+    const historicalSelection = {
+        revisionId: selection.revisionId,
+        fingerprint: selection.fingerprint,
+        reason: 'historical_lineage',
+    };
+    validateExecutionProfileSelection(projectId, historicalSelection);
+    return historicalSelection;
+};
+const historicalSelectionFromMetadata = (projectId, metadataJson) => {
+    let metadata = null;
+    try {
+        metadata = metadataJson ? JSON.parse(metadataJson) : null;
+    }
+    catch {
+        metadata = null;
+    }
+    const selection = parseExecutionProfileSelectionMetadata(metadata);
+    if (!selection) {
+        throw new Error('The resumed Build has no historical execution profile lineage');
+    }
+    const historicalSelection = { ...selection, reason: 'historical_lineage' };
+    validateExecutionProfileSelection(projectId, historicalSelection);
+    return historicalSelection;
+};
+export const getHistoricalBuildExecutionProfileSelectionForRun = (projectId, executionRunId) => {
+    const row = db.prepare(`
+    SELECT metadata_json FROM execution_runs
+    WHERE project_id = ? AND id = ? AND kind IN ('build', 'build_follow_up')
+  `).get(projectId, executionRunId);
+    return historicalSelectionFromMetadata(projectId, row?.metadata_json);
+};
+export const getHistoricalBuildExecutionProfileSelectionForSession = (projectId, ticketId, sessionId) => {
+    const row = db.prepare(`
+    SELECT run.metadata_json
+    FROM execution_runs run
+    JOIN agent_runs agent_run
+      ON agent_run.execution_run_id = run.id
+      AND agent_run.parent_type = 'ticket'
+      AND agent_run.parent_id = ?
+      AND agent_run.role = 'main'
+      AND agent_run.session_id = ?
+    WHERE run.project_id = ? AND run.kind IN ('build', 'build_follow_up')
+    ORDER BY run.created_at DESC, run.id DESC
+    LIMIT 1
+  `).get(ticketId, sessionId, projectId);
+    return historicalSelectionFromMetadata(projectId, row?.metadata_json);
+};
+const parseRunMetadata = (value) => {
+    if (!value) {
+        return null;
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+};
+export const resolveExecutionRunProfile = (project, executionRunId) => {
+    const run = db.prepare(`
+    SELECT metadata_json FROM execution_runs WHERE id = ? AND project_id = ?
+  `).get(executionRunId, project.id);
+    if (!run || 'status' in run) {
+        const profile = createExecutionProfile(project.build_execution_provider ?? 'host');
+        return {
+            id: `legacy-provider-projection:${project.id}`,
+            project_id: project.id,
+            revision: 0,
+            schema_version: EXECUTION_PROFILE_SCHEMA_VERSION,
+            fingerprint: fingerprintExecutionProfile(profile),
+            profile,
+            created_at: '',
+        };
+    }
+    const metadata = parseRunMetadata(run?.metadata_json ?? null);
+    const revisionId = typeof metadata?.execution_profile_revision_id === 'string'
+        ? metadata.execution_profile_revision_id
+        : null;
+    if (revisionId) {
+        const selected = getExecutionProfileRevision(project.id, revisionId);
+        if (!selected) {
+            throw new Error('The selected execution profile revision is unavailable');
+        }
+        if (!revisionFingerprintMatchesProfile(selected)) {
+            throw new Error('The selected execution profile fingerprint is invalid');
+        }
+        return selected;
+    }
+    // Old queued runs can predate profile selection. Their provider projection is retained as explicit compatibility evidence.
+    const provider = metadata?.build_execution_provider;
+    if (provider !== 'host' && provider !== 'docker_sandbox') {
+        throw new Error('The queued Build has no immutable execution profile or provider projection');
+    }
+    const profile = createExecutionProfile(provider);
+    return {
+        id: `legacy-provider-projection:${project.id}`,
+        project_id: project.id,
+        revision: 0,
+        schema_version: EXECUTION_PROFILE_SCHEMA_VERSION,
+        fingerprint: fingerprintExecutionProfile(profile),
+        profile,
+        created_at: '',
+    };
+};
+const SBX_POLICY_INIT_REMEDIATION = 'Initialize a scoped Docker Sandbox network posture with sbx policy init, then retry Build.';
+export const resolveExecutionRunNetworkAuthority = (input) => {
+    const requestedMode = input.profile.network.mode;
+    const observedGlobalPosture = input.evidence?.observed_global_posture ?? 'unknown';
+    const destinations = [...(input.evidence?.destination_decisions ?? [])];
+    const base = {
+        requested_mode: requestedMode,
+        observed_global_posture: observedGlobalPosture,
+        destinations,
+    };
+    if (input.provider === 'host') {
+        if (requestedMode === 'allowlist') {
+            return {
+                ...base,
+                enforcement: 'unknown',
+                note: null,
+                degradations: ['network_enforcement_unsupported'],
+                violation: 'The selected execution profile requests allowlisted network enforcement, '
+                    + 'but the host provider cannot enforce sandbox network policy. '
+                    + `Select a Docker Sandbox provider for this project. ${SBX_POLICY_INIT_REMEDIATION}`,
+            };
+        }
+        return {
+            ...base,
+            enforcement: 'none',
+            note: input.profile.compatibility === 'legacy_host' ? 'legacy_host_inherited' : null,
+            degradations: [],
+            violation: null,
+        };
+    }
+    if (input.profile.compatibility === 'legacy_host') {
+        return {
+            ...base,
+            enforcement: 'none',
+            note: 'legacy_host_inherited',
+            degradations: [],
+            violation: null,
+        };
+    }
+    const requestedTargets = new Set(normalizeExecutionEnvironmentDestinations(input.profile.network.destinations).map(networkDestinationTarget));
+    const allowedEvidenceTargets = new Set(destinations.filter(decision => decision.decision === 'allow').map(decision => decision.target));
+    const allDestinationsAllowed = requestedTargets.size > 0
+        && [...requestedTargets].every(target => allowedEvidenceTargets.has(target));
+    const enforcement = observedGlobalPosture === 'allow_all'
+        ? 'declarative_only'
+        : observedGlobalPosture === 'deny_all' && allDestinationsAllowed
+            ? 'enforced_scoped'
+            : 'unknown';
+    const degradations = enforcement === 'declarative_only'
+        ? ['network_enforcement_declarative_only']
+        : enforcement === 'unknown'
+            ? ['network_enforcement_unknown']
+            : [];
+    let violation = null;
+    if (requestedMode === 'allowlist' && enforcement !== 'enforced_scoped') {
+        const unproven = destinations
+            .filter(decision => decision.decision !== 'allow')
+            .map(decision => decision.decision === 'deny'
+            ? `${decision.target} was denied by the sandbox daemon`
+            : `${decision.target} could not be evaluated by the sandbox daemon`);
+        const detail = unproven.length > 0
+            ? `${unproven.join('; ')}.`
+            : observedGlobalPosture === 'allow_all'
+                ? 'The Docker Sandbox global posture is allow-all, so scoped allowlist access is declarative only.'
+                : 'Qualified scoped network posture evidence is unavailable.';
+        violation = `The selected execution profile requests allowlisted network enforcement, but it was not proven. ${detail} ${SBX_POLICY_INIT_REMEDIATION}`;
+    }
+    return {
+        ...base,
+        enforcement,
+        note: null,
+        degradations,
+        violation,
+    };
+};
+export const createExecutionRunAuthority = (input) => {
+    const { profile } = input.profileRevision;
+    const modelProvider = input.modelProvider ?? null;
+    if (!profile.build_eligible) {
+        throw new Error('The selected execution profile is not eligible for Build workloads');
+    }
+    if (input.provider === 'host' && profile.isolation === 'microvm_required') {
+        throw new Error('The selected execution profile requires microVM isolation');
+    }
+    const requirements = profile.credential_requirements.filter(requirement => (requirement.agent === input.agent
+        && requirement.model_provider === modelProvider
+        && (!input.credentialCapability?.authentication_mode
+            || requirement.authentication_mode === input.credentialCapability.authentication_mode)));
+    if (input.provider === 'host' && profile.compatibility === 'governed' && requirements.length > 0) {
+        throw new Error('Governed host execution cannot inherit ambient host credentials');
+    }
+    const unsupportedRequirement = requirements.find(requirement => (input.provider === 'host'
+        ? requirement.required_protection !== 'legacy_host_inheritance'
+        : requirement.required_protection !== 'docker_brokered'));
+    if (unsupportedRequirement) {
+        throw new Error(`The selected provider cannot satisfy credential requirement ${unsupportedRequirement.id}`);
+    }
+    if (input.provider === 'docker_sandbox' && requirements.length > 0) {
+        const capability = input.credentialCapability;
+        const requirement = requirements[0];
+        if (!capability
+            || capability.agent !== input.agent
+            || capability.model_provider !== modelProvider
+            || capability.authentication_mode !== requirement.authentication_mode
+            || capability.requested_protection !== requirement.required_protection
+            || capability.requirement_fingerprint !== fingerprintCredentialRequirements(profile.credential_requirements)
+            || capability.destination.state !== 'usable'
+            || !capability.satisfies_requested_protection) {
+            throw new Error(`Validated credential evidence does not satisfy requirement ${requirement.id}`);
+        }
+    }
+    const isHost = input.provider === 'host';
+    const network = resolveExecutionRunNetworkAuthority({
+        profile,
+        provider: input.provider,
+        evidence: input.networkEvidence ?? null,
+    });
+    if (network.violation) {
+        throw new Error(network.violation);
+    }
+    return {
+        schema_version: 1,
+        selected_profile: {
+            revision_id: input.profileRevision.id,
+            revision: input.profileRevision.revision,
+            fingerprint: input.profileRevision.fingerprint,
+            compatibility: profile.compatibility,
+        },
+        orchestration: {
+            host_disclosure: isHost ? 'host_orchestration_and_execution' : 'worktree_and_sync_only',
+        },
+        setup: {
+            placement: input.provider,
+            lineage: 'selected_profile',
+            launcher: isHost ? 'host_shell' : 'docker_sandbox_exec',
+        },
+        agent: {
+            placement: input.provider,
+            agent: input.agent,
+            launcher: isHost ? 'host_process' : 'docker_sandbox_exec',
+        },
+        runtime_credentials: requirements.map(requirement => ({
+            requirement_id: requirement.id,
+            model_provider: requirement.model_provider,
+            authentication_mode: requirement.authentication_mode,
+            delivery: isHost ? 'host_environment_inheritance' : 'docker_brokered',
+            ...(input.credentialCapability ? { capability: input.credentialCapability } : {}),
+        })),
+        unsupported_requirements: [],
+        target: {
+            kind: input.target.identity.kind,
+            key: input.target.identity.key,
+            workspace_path: input.target.workspacePath,
+        },
+        effective: {
+            provider: input.provider,
+            isolation: isHost ? 'host_process' : 'microvm',
+            filesystem: {
+                workspace_access: profile.workspace_access.mode,
+                workspace_path: input.target.workspacePath,
+                additional_mounts: [],
+            },
+            integration_access: profile.integration_access,
+            remote_git: profile.remote_git,
+            resources: profile.resources,
+            environment_id: input.environment?.id ?? null,
+            environment_revision: input.environment?.environment_revision ?? null,
+            environment_validation_fingerprint: input.environment?.environment_validation_fingerprint ?? null,
+            execution_profile_fingerprint: input.profileRevision.fingerprint,
+            credential_requirements_fingerprint: fingerprintCredentialRequirements(profile.credential_requirements),
+            network: {
+                requested_mode: network.requested_mode,
+                observed_global_posture: network.observed_global_posture,
+                enforcement: network.enforcement,
+                note: network.note,
+                destinations: network.destinations,
+            },
+        },
+        degradations: [
+            ...(isHost
+                ? [...hostExecutionEnvironmentObservation.degradationReasons]
+                : input.environment?.workspace_mode === 'direct' ? ['direct_workspace_writable'] : []),
+            ...network.degradations,
+        ],
+        fallback: {
+            policy: profile.fallback,
+            used: input.fallback?.used ?? false,
+            from: input.fallback?.from ?? null,
+            reason: input.fallback?.reason ?? null,
+        },
+    };
+};
+const credentialDeliveryForClassification = (classification) => {
+    if (classification === 'brokered_api_key' || classification === 'brokered_oauth') {
+        return 'docker_brokered';
+    }
+    if (classification === 'legacy_host_inherited') {
+        return 'legacy_host_inherited';
+    }
+    return null;
+};
+export const resolveEnvironmentCredentialEvidence = (input) => {
+    const profile = input.profileRevision?.profile ?? null;
+    if (!profile) {
+        return {
+            authentication_mode: 'unknown',
+            credential_delivery: 'unknown',
+            degradation_reasons: ['credential_evidence_unresolved'],
+        };
+    }
+    const requirements = profile.credential_requirements.filter(requirement => (requirement.agent === input.agent
+        && (!input.modelProvider || requirement.model_provider === input.modelProvider)));
+    const capability = input.credentialCapability ?? null;
+    const requirement = requirements[0] ?? null;
+    const authenticationMode = capability?.authentication_mode
+        ?? requirement?.authentication_mode
+        ?? null;
+    if (requirements.length === 0 || profile.compatibility === 'legacy_host') {
+        return {
+            authentication_mode: authenticationMode ?? 'unknown',
+            credential_delivery: profile.compatibility === 'legacy_host'
+                ? 'legacy_host_inherited'
+                : 'none_required',
+            degradation_reasons: authenticationMode ? [] : ['credential_authentication_unresolved'],
+        };
+    }
+    const delivery = capability && requirement
+        && capability.agent === input.agent
+        && (!input.modelProvider || capability.model_provider === input.modelProvider)
+        && capability.authentication_mode === requirement.authentication_mode
+        && capability.requested_protection === requirement.required_protection
+        && capability.requirement_fingerprint === fingerprintCredentialRequirements(profile.credential_requirements)
+        && capability.destination.state === 'usable'
+        && capability.satisfies_requested_protection
+        ? credentialDeliveryForClassification(capability.classification)
+        : null;
+    if (!delivery) {
+        return {
+            authentication_mode: authenticationMode ?? 'unknown',
+            credential_delivery: 'unknown',
+            degradation_reasons: ['credential_delivery_unresolved'],
+        };
+    }
+    return {
+        authentication_mode: authenticationMode,
+        credential_delivery: delivery,
+        degradation_reasons: [],
+    };
+};
+const parseAuthority = (row) => {
+    try {
+        const parsed = JSON.parse(row.authority_json);
+        return parsed.schema_version === 1 && parsed.selected_profile?.fingerprint === row.execution_profile_fingerprint
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+};
+export const persistExecutionRunAuthority = (input) => {
+    if (input.authority.selected_profile.revision_id !== input.profileRevision.id
+        || input.authority.selected_profile.revision !== input.profileRevision.revision
+        || input.authority.selected_profile.fingerprint !== input.profileRevision.fingerprint
+        || input.authority.effective.execution_profile_fingerprint !== input.profileRevision.fingerprint
+        || fingerprintExecutionProfile(input.profileRevision.profile) !== input.profileRevision.fingerprint) {
+        throw new Error('Execution run authority does not match its selected execution profile revision');
+    }
+    const serialized = JSON.stringify(input.authority);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_AUTHORITY_BYTES) {
+        throw new Error('Execution run authority exceeds the durable evidence limit');
+    }
+    const existing = getExecutionRunAuthority(input.projectId, input.executionRunId);
+    if (existing) {
+        if (JSON.stringify(existing) !== serialized) {
+            throw new Error('Conflicting immutable execution run authority already exists');
+        }
+        return existing;
+    }
+    db.prepare(`
+    INSERT INTO execution_run_authorities (
+      execution_run_id, project_id, execution_profile_revision_id,
+      execution_profile_fingerprint, authority_json
+    ) VALUES (?, ?, ?, ?, ?)
+  `).run(input.executionRunId, input.projectId, input.profileRevision.id, input.profileRevision.fingerprint, serialized);
+    return input.authority;
+};
+export const getExecutionRunAuthority = (projectId, executionRunId) => {
+    const row = db.prepare(`
+    SELECT * FROM execution_run_authorities WHERE project_id = ? AND execution_run_id = ?
+  `).get(projectId, executionRunId);
+    return row ? parseAuthority(row) : null;
+};
+//# sourceMappingURL=executionRunAuthority.js.map

package/dist/server/lib/executionRunAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionRunAuthority.js","sourceRoot":"","sources":["../../../server/lib/executionRunAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AACzB,OAAO,EAAE,2BAA2B,EAAE,iCAAiC,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAA;AAC9I,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,iCAAiC,EACjC,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAA;AAEnF,OAAO,EACL,yCAAyC,EACzC,wBAAwB,GAEzB,MAAM,oCAAoC,CAAA;AAqB3C,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA;AAErC,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,SAAiB,EACjB,SAA0C,8BAA8B,EAC7C,EAAE;IAC7B,MAAM,QAAQ,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM;KACP,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,SAAiB,EACjB,SAAoC,EACV,EAAE;IAC5B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,CAAA;IAC7E,IACE,CAAC,QAAQ;WACN,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;WAC9C,CAAC,iCAAiC,CAAC,QAAQ,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,SAAoC,EAAE,EAAE,CAAC,CAAC;IAC1F,6BAA6B,EAAE,SAAS,CAAC,UAAU;IACnD,6BAA6B,EAAE,SAAS,CAAC,WAAW;IACpD,kCAAkC,EAAE,SAAS,CAAC,MAAM;CACrD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,QAAoD,EAClB,EAAE;IACpC,IACE,OAAO,QAAQ,EAAE,6BAA6B,KAAK,QAAQ;WACxD,OAAO,QAAQ,CAAC,6BAA6B,KAAK,QAAQ;WAC1D,CACD,QAAQ,CAAC,kCAAkC,KAAK,8BAA8B;eAC3E,QAAQ,CAAC,kCAAkC,KAAK,oBAAoB,CACxE,EACD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,6BAA6B;QAClD,WAAW,EAAE,QAAQ,CAAC,6BAA6B;QACnD,MAAM,EAAE,QAAQ,CAAC,kCAAkC;KACpD,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2CAA2C,GAAG,CACzD,SAAiB,EACjB,QAAgB,EACW,EAAE;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;GAYtB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAiD,CAAA;IAC3E,IAAI,QAAQ,GAAmC,IAAI,CAAA;IACnD,IAAI,CAAC;QACH,QAAQ,GAAG,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAA4B,CAAC,CAAC,CAAC,IAAI,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,sCAAsC,CAAC,QAAQ,CAAC,CAAA;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,mBAAmB,GAA8B;QACrD,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,MAAM,EAAE,oBAAoB;KAC7B,CAAA;IACD,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IACjE,OAAO,mBAAmB,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CACtC,SAAiB,EACjB,YAAuC,EACZ,EAAE;IAC7B,IAAI,QAAQ,GAAmC,IAAI,CAAA;IACnD,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC,CAAC,CAAC,IAAI,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,sCAAsC,CAAC,QAAQ,CAAC,CAAA;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,mBAAmB,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAA;IACnF,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IACjE,OAAO,mBAAmB,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAC/D,SAAiB,EACjB,cAAsB,EACK,EAAE;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAiD,CAAA;IACjF,OAAO,+BAA+B,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qDAAqD,GAAG,CACnE,SAAiB,EACjB,QAAgB,EAChB,SAAiB,EACU,EAAE;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;GAYtB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAiD,CAAA;IACtF,OAAO,+BAA+B,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAkC,EAAE;IAChF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAAgB,EAChB,cAAsB,EACI,EAAE;IAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;GAEtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAkD,CAAA;IACnF,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,wBAAwB,IAAI,MAAM,CAAC,CAAA;QAClF,OAAO;YACL,EAAE,EAAE,8BAA8B,OAAO,CAAC,EAAE,EAAE;YAC9C,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,gCAAgC;YAChD,WAAW,EAAE,2BAA2B,CAAC,OAAO,CAAC;YACjD,OAAO;YACP,UAAU,EAAE,EAAE;SACf,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,aAAa,IAAI,IAAI,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,OAAO,QAAQ,EAAE,6BAA6B,KAAK,QAAQ;QAC5E,CAAC,CAAC,QAAQ,CAAC,6BAA6B;QACxC,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,2HAA2H;IAC3H,MAAM,QAAQ,GAAG,QAAQ,EAAE,wBAAwB,CAAA;IACnD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAChD,OAAO;QACL,EAAE,EAAE,8BAA8B,OAAO,CAAC,EAAE,EAAE;QAC9C,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,gCAAgC;QAChD,WAAW,EAAE,2BAA2B,CAAC,OAAO,CAAC;QACjD,OAAO;QACP,UAAU,EAAE,EAAE;KACf,CAAA;AACH,CAAC,CAAA;AAYD,MAAM,2BAA2B,GAC/B,4FAA4F,CAAA;AAE9F,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,KAIlD,EAAgC,EAAE;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAChD,MAAM,qBAAqB,GAAG,KAAK,CAAC,QAAQ,EAAE,uBAAuB,IAAI,SAAS,CAAA;IAClF,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,aAAa;QAC7B,uBAAuB,EAAE,qBAAqB;QAC9C,YAAY;KACb,CAAA;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO;gBACL,GAAG,IAAI;gBACP,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE,CAAC,iCAAiC,CAAC;gBACjD,SAAS,EACP,2EAA2E;sBACzE,+DAA+D;sBAC/D,sDAAsD,2BAA2B,EAAE;aACxF,CAAA;QACH,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;YACnB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI;YACpF,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QAClD,OAAO;YACL,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;YACnB,IAAI,EAAE,uBAAuB;YAC7B,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,IAAI;SAChB,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,yCAAyC,CACxE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CACnC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAA;IAChC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChG,CAAA;IACD,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,IAAI,GAAG,CAAC;WACnD,CAAC,GAAG,gBAAgB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9E,MAAM,WAAW,GAAmC,qBAAqB,KAAK,WAAW;QACvF,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,qBAAqB,KAAK,UAAU,IAAI,sBAAsB;YAC9D,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,YAAY,GAAG,WAAW,KAAK,kBAAkB;QACrD,CAAC,CAAC,CAAC,sCAAsC,CAAC;QAC1C,CAAC,CAAC,WAAW,KAAK,SAAS;YACzB,CAAC,CAAC,CAAC,6BAA6B,CAAC;YACjC,CAAC,CAAC,EAAE,CAAA;IACR,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,IAAI,aAAa,KAAK,WAAW,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,YAAY;aAC1B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC;aACjD,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM;YAC3C,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,mCAAmC;YACvD,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,+CAA+C,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3B,CAAC,CAAC,qBAAqB,KAAK,WAAW;gBACrC,CAAC,CAAC,iGAAiG;gBACnG,CAAC,CAAC,2DAA2D,CAAA;QACjE,SAAS,GAAG,mGAAmG,MAAM,IAAI,2BAA2B,EAAE,CAAA;IACxJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,WAAW;QACX,IAAI,EAAE,IAAI;QACV,YAAY;QACZ,SAAS;KACV,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAU1C,EAAiC,EAAE;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,eAAe,CAAA;IACzC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAA;IACjD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CACzE,WAAW,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC9B,WAAW,CAAC,cAAc,KAAK,aAAa;WAC5C,CACD,CAAC,KAAK,CAAC,oBAAoB,EAAE,mBAAmB;eAC7C,WAAW,CAAC,mBAAmB,KAAK,KAAK,CAAC,oBAAoB,CAAC,mBAAmB,CACtF,CACF,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,aAAa,KAAK,UAAU,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAC9D,KAAK,CAAC,QAAQ,KAAK,MAAM;QACvB,CAAC,CAAC,WAAW,CAAC,mBAAmB,KAAK,yBAAyB;QAC/D,CAAC,CAAC,WAAW,CAAC,mBAAmB,KAAK,iBAAiB,CAC1D,CAAC,CAAA;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+DAA+D,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,CAAA;QAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,IACE,CAAC,UAAU;eACR,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAChC,UAAU,CAAC,cAAc,KAAK,aAAa;eAC3C,UAAU,CAAC,mBAAmB,KAAK,WAAW,CAAC,mBAAmB;eAClE,UAAU,CAAC,oBAAoB,KAAK,WAAW,CAAC,mBAAmB;eACnE,UAAU,CAAC,uBAAuB,KAAK,iCAAiC,CAAC,OAAO,CAAC,uBAAuB,CAAC;eACzG,UAAU,CAAC,WAAW,CAAC,KAAK,KAAK,QAAQ;eACzC,CAAC,UAAU,CAAC,8BAA8B,EAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAA;IACxC,MAAM,OAAO,GAAG,mCAAmC,CAAC;QAClD,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;KACxC,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,CAAC;IACD,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE;YAChB,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE;YACrC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ;YACxC,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,WAAW;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC;QACD,aAAa,EAAE;YACb,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,wBAAwB;SACxF;QACD,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,OAAO,EAAE,kBAAkB;YAC3B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB;SACxD;QACD,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB;SAC1D;QACD,mBAAmB,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,EAAE;YAC9B,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iBAAiB;YACrE,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;QACH,wBAAwB,EAAE,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;YAChC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YAC9B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;SAC3C;QACD,SAAS,EAAE;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YAC9C,UAAU,EAAE;gBACV,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;gBAC/C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;gBAC1C,iBAAiB,EAAE,EAAE;aACtB;YACD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;YAC7C,oBAAoB,EAAE,KAAK,CAAC,WAAW,EAAE,oBAAoB,IAAI,IAAI;YACrE,kCAAkC,EAAE,KAAK,CAAC,WAAW,EAAE,kCAAkC,IAAI,IAAI;YACjG,6BAA6B,EAAE,KAAK,CAAC,eAAe,CAAC,WAAW;YAChE,mCAAmC,EAAE,iCAAiC,CAAC,OAAO,CAAC,uBAAuB,CAAC;YACvG,OAAO,EAAE;gBACP,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;SACF;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,CAAC,GAAG,mCAAmC,CAAC,kBAAkB,CAAC;gBAC7D,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,OAAO,CAAC,YAAY;SACxB;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,KAAK;YACnC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;SACvC;KACF,CAAA;AACH,CAAC,CAAA;AAQD,MAAM,mCAAmC,GAAG,CAC1C,cAAyE,EAC1B,EAAE;IACjD,IAAI,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,gBAAgB,EAAE,CAAC;QACjF,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,IAAI,cAAc,KAAK,uBAAuB,EAAE,CAAC;QAC/C,OAAO,uBAAuB,CAAA;IAChC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,KAKE,EAC6B,EAAE;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,OAAO,IAAI,IAAI,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,mBAAmB,EAAE,SAAS;YAC9B,mBAAmB,EAAE,SAAS;YAC9B,mBAAmB,EAAE,CAAC,gCAAgC,CAAC;SACxD,CAAA;IACH,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CACzE,WAAW,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC9B,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,WAAW,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,CAAC,CAChF,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAA;IACrD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAC3C,MAAM,kBAAkB,GAAG,UAAU,EAAE,mBAAmB;WACrD,WAAW,EAAE,mBAAmB;WAChC,IAAI,CAAA;IACT,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QACzE,OAAO;YACL,mBAAmB,EAAE,kBAAkB,IAAI,SAAS;YACpD,mBAAmB,EAAE,OAAO,CAAC,aAAa,KAAK,aAAa;gBAC1D,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,eAAe;YACnB,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC;SACxF,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,IAAI,WAAW;WACrC,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAChC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,CAAC;WAC3E,UAAU,CAAC,mBAAmB,KAAK,WAAW,CAAC,mBAAmB;WAClE,UAAU,CAAC,oBAAoB,KAAK,WAAW,CAAC,mBAAmB;WACnE,UAAU,CAAC,uBAAuB,KAAK,iCAAiC,CAAC,OAAO,CAAC,uBAAuB,CAAC;WACzG,UAAU,CAAC,WAAW,CAAC,KAAK,KAAK,QAAQ;WACzC,UAAU,CAAC,8BAA8B;QAC5C,CAAC,CAAC,mCAAmC,CAAC,UAAU,CAAC,cAAc,CAAC;QAChE,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,mBAAmB,EAAE,kBAAkB,IAAI,SAAS;YACpD,mBAAmB,EAAE,SAAS;YAC9B,mBAAmB,EAAE,CAAC,gCAAgC,CAAC;SACxD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,kBAAkB;QACvC,mBAAmB,EAAE,QAAQ;QAC7B,mBAAmB,EAAE,EAAE;KACxB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAA6B,EAAwC,EAAE;IAC7F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAkC,CAAA;QAC9E,OAAO,MAAM,CAAC,cAAc,KAAK,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,WAAW,KAAK,GAAG,CAAC,6BAA6B;YAC9G,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,KAK3C,EAAiC,EAAE;IACnC,IACE,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE;WACtE,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe,CAAC,QAAQ;WAC5E,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,KAAK,KAAK,CAAC,eAAe,CAAC,WAAW;WAClF,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,6BAA6B,KAAK,KAAK,CAAC,eAAe,CAAC,WAAW;WAC7F,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC,WAAW,EACnG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;IAChF,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,EAAE,CAAC,OAAO,CAAC;;;;;GAKV,CAAC,CAAC,GAAG,CACJ,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,eAAe,CAAC,EAAE,EACxB,KAAK,CAAC,eAAe,CAAC,WAAW,EACjC,UAAU,CACX,CAAA;IACD,OAAO,KAAK,CAAC,SAAS,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,SAAiB,EACjB,cAAsB,EACgB,EAAE;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;GAEtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAyC,CAAA;IACzE,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACzC,CAAC,CAAA"}

package/dist/server/lib/executionRuns.js

@@ -19,6 +19,7 @@ const GENERIC_RETRY_DENIED_KINDS = new Set([
     'automation_commit',
     'automation_push',
     'automation_pull_request',
+    'git_push',
 ]);
 const ARTIFACT_AUDIT_EVENT_TYPES = new Set([
     'artifact_created',
@@ -141,7 +142,7 @@ const updateRunStatement = db.prepare(`
   UPDATE execution_runs
   SET status = ?, domain_status = ?, failure_code = ?, failure_message = ?,
       failure_details_json = ?, started_at = ?, completed_at = ?, updated_at = ?
-  WHERE id = ? AND project_id = ?
+  WHERE id = ? AND project_id = ? AND status = ? AND domain_status IS ?
 `);
 const assertBoundedString = (value, name, maxLength) => {
     if (value !== null && value !== undefined && value.length > maxLength) {
@@ -331,6 +332,9 @@ const PUBLIC_EVENT_METADATA_KEYS = new Set([
     'resolution_attempts',
     'trigger',
     'workflow_id',
+    'approval_request_id',
+    'action_kind',
+    'action_fingerprint',
 ]);
 export const toCanonicalLifecycleEvent = (event) => {
     const metadata = event.metadata
@@ -447,6 +451,12 @@ const resolveLinkLabel = (projectId, link) => {
     `).get(link.entityId, projectId);
         return row ? `Pull request #${row.pr_number}` : null;
     }
+    if (link.entityType === 'approval_request') {
+        const row = db.prepare(`
+      SELECT action_kind FROM approval_requests WHERE id = ? AND project_id = ?
+    `).get(link.entityId, projectId);
+        return row ? `${row.action_kind} approval` : null;
+    }
     return null;
 };
 const resolveLinkOwner = (projectId, link) => {
@@ -542,6 +552,10 @@ const resolveLinkOwner = (projectId, link) => {
       `).get(link.entityId, projectId);
             return row ? { parentEntityType: 'bundle', parentEntityId: row.parent_id } : null;
         }
+        case 'approval_request':
+            return db.prepare('SELECT 1 FROM approval_requests WHERE id = ? AND project_id = ?').get(link.entityId, projectId)
+                ? { parentEntityType: null, parentEntityId: null }
+                : null;
     }
 };
 const assertLinkOwnership = (projectId, link) => {
@@ -987,10 +1001,11 @@ const transitionExecutionRunInTransaction = (input, allowAmbiguousAutomationReco
         }
         return { run: serializeRun(current), event: null };
     }
-    if (current.status === input.status) {
+    const isDomainOnlyTransition = current.status === input.status && current.domain_status !== domainStatus;
+    if (current.status === input.status && !isDomainOnlyTransition) {
         throw new Error(`Execution run ${input.runId} is already ${input.status}`);
     }
-    if (ACTIVE_STATUSES.has(input.status)) {
+    if (ACTIVE_STATUSES.has(input.status) && !isDomainOnlyTransition) {
         const activeTransitionAllowed = (current.status === 'queued' && (input.status === 'running' || input.status === 'waiting'))
             || (current.status === 'running' && input.status === 'waiting')
             || (current.status === 'waiting' && input.status === 'running');
@@ -1004,7 +1019,10 @@ const transitionExecutionRunInTransaction = (input, allowAmbiguousAutomationReco
     const now = new Date().toISOString();
     const completedAt = TERMINAL_STATUSES.has(input.status) ? input.completedAt ?? now : null;
     const startedAt = input.status === 'running' ? current.started_at ?? now : current.started_at;
-    updateRunStatement.run(input.status, domainStatus, failure?.code ?? null, failure?.message ?? null, failureDetailsJson, startedAt, completedAt, now, input.runId, input.projectId);
+    const updated = updateRunStatement.run(input.status, domainStatus, failure?.code ?? null, failure?.message ?? null, failureDetailsJson, startedAt, completedAt, now, input.runId, input.projectId, current.status, current.domain_status);
+    if (updated.changes !== 1) {
+        throw new Error(`Execution run ${input.runId} changed concurrently`);
+    }
     const event = createEvent({
         projectId: input.projectId,
         runId: input.runId,
@@ -1249,6 +1267,10 @@ export const getQueuedBuildExecutionRun = (projectId, ticketId, sequenceId) => {
       AND sequence_link.project_id = execution_runs.project_id
       AND sequence_link.entity_type = 'build_sequence'
       AND sequence_link.relationship = 'context'
+    INNER JOIN build_sequence_tickets sequence_item
+      ON sequence_item.build_sequence_id = sequence_link.entity_id
+      AND sequence_item.ticket_id = ticket_link.entity_id
+      AND sequence_item.activation_execution_run_id = execution_runs.id
     WHERE execution_runs.project_id = ?
       AND execution_runs.kind = 'build'
       AND execution_runs.status = 'queued'
@@ -1479,6 +1501,10 @@ export const listExecutionRuns = (input) => {
         clauses.push(`er.status IN (${statuses.map(() => '?').join(', ')})`);
         parameters.push(...statuses);
     }
+    if (input.domainStatus) {
+        clauses.push('er.domain_status = ?');
+        parameters.push(input.domainStatus);
+    }
     if (cursor) {
         clauses.push('(er.created_at < ? OR (er.created_at = ? AND er.id < ?))');
         parameters.push(cursor.created_at, cursor.created_at, cursor.id);