@tianshu-ai/tianshu 0.3.0

package/plugins/microsandbox/dist/runner/pool.js

@@ -0,0 +1,494 @@
+// Per-task sandbox pool.
+//
+// Lifecycle (matches PR #140 + this PR's design):
+//
+//   workboard task pickup
+//     → SandboxPool.acquireTask(taskId)
+//         → first time:  Sandbox.builder(tianshu-task-<taskId>)
+//                          .fromSnapshot(<task-role pointer>)
+//                          .create()         (await; ~500ms warm)
+//         → resume:      Sandbox.start(name) (await; ~200ms)
+//
+//   agent-loop runs on this task
+//     → ExecTool sees ctx.taskId, calls runner.exec({...,taskId})
+//     → SandboxRunner facade routes to pool.execForTask(taskId, req)
+//
+//   worker run terminates (any reason)
+//     → SandboxPool.releaseTask(taskId)
+//         → sandbox.stop()  (preserves disk + installed packages;
+//                            frees RAM)
+//         → state = 'stopped'; pool entry kept so retry can resume
+//
+//   workboard task_delete
+//     → SandboxPool.destroyTask(taskId)
+//         → sandbox.stop() if running, then handle.remove() so
+//                            disk image is reclaimed
+//
+//   plugin deactivate
+//     → SandboxPool.dispose()
+//         → stop every running task sandbox (don't remove; next
+//                            activate can resume)
+//
+// Resource sizing comes from MicroSandboxConfig.task* fields
+// (PR #140); falling back to the browser-role values when not set.
+//
+// `bindSession(sessionId, taskId)` lets the SandboxRunner facade
+// resolve `ctx.sessionId` -> taskId for tool calls that don't
+// carry an explicit `req.taskId`. Workboard wires this from
+// onSessionStart so every worker session lands in the right
+// per-task sandbox.
+import { promises as fs } from "node:fs";
+import { readPointers } from "../build/pointer.js";
+import { snapshotExists } from "../build/builder.js";
+let msbModuleP = null;
+function loadMsb() {
+    if (!msbModuleP) {
+        msbModuleP = import("microsandbox");
+    }
+    return msbModuleP;
+}
+/**
+ * Build a buildTenantUserBlock-equivalent shell wrapper. This is
+ * the same logic as MicrosandboxRunner uses; we reimplement here
+ * to keep the pool independent of the (per-tenant singleton)
+ * runner. The contract is "drop privileges to the tenant user
+ * before running the user-supplied command".
+ *
+ * Kept in sync with microsandbox.ts:buildTenantUserBlock.
+ */
+const TENANT_USER_ID_RE = /^[a-zA-Z][a-zA-Z0-9_-]{0,30}$/;
+function shellEscape(s) {
+    return s.replace(/(["\\$`])/g, "\\$1");
+}
+function hostUid() {
+    const fn = process.getuid;
+    return typeof fn === "function" ? fn.call(process) : 1000;
+}
+function buildScript(userId, workdir, command) {
+    if (!userId) {
+        return `set -e; cd "${shellEscape(workdir)}"; ${command}`;
+    }
+    if (!TENANT_USER_ID_RE.test(userId)) {
+        throw new Error(`invalid tenant userId for sandbox exec: ${JSON.stringify(userId)}`);
+    }
+    const safeUserId = userId;
+    const home = `/workspace/users/${safeUserId}`;
+    const uid = hostUid();
+    const innerCmd = command.replace(/'/g, `'\\''`);
+    return [
+        `set -e`,
+        `if ! id ${safeUserId} >/dev/null 2>&1; then`,
+        `  useradd -d "${home}" -s /bin/bash -u ${uid} -o ${safeUserId} >/dev/null 2>&1 || true`,
+        `  echo '${safeUserId} ALL=(ALL) NOPASSWD:***' > /etc/sudoers.d/${safeUserId}`,
+        `  chmod 440 /etc/sudoers.d/${safeUserId}`,
+        `fi`,
+        `runuser -u ${safeUserId} -- env MSB_USER_ID=${safeUserId} bash -c 'cd "${shellEscape(workdir)}" && ${innerCmd}'`,
+    ].join("\n");
+}
+const STOPPED_STATE = "stopped";
+export class SandboxPool {
+    entries = new Map();
+    sessionToTask = new Map();
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Map a session id back to its task entry, if any. Used by the
+     * SandboxRunner facade so a chat tool call without an explicit
+     * taskId can still find the right per-task sandbox.
+     */
+    resolveBySession(sessionId) {
+        if (!sessionId)
+            return undefined;
+        const taskId = this.sessionToTask.get(sessionId);
+        if (!taskId)
+            return undefined;
+        return this.entries.get(taskId);
+    }
+    /** Direct lookup by taskId. */
+    get(taskId) {
+        return this.entries.get(taskId);
+    }
+    /**
+     * Snapshot every task entry the pool currently tracks. Used by
+     * the admin UI's pool monitor. Mutations to the returned array
+     * don't affect the pool.
+     */
+    list() {
+        const out = [];
+        for (const e of this.entries.values()) {
+            out.push({
+                taskId: e.taskId,
+                sandboxName: e.sandboxName,
+                state: e.state,
+                startError: e.startError,
+            });
+        }
+        return out;
+    }
+    bindSession(sessionId, taskId) {
+        this.sessionToTask.set(sessionId, taskId);
+    }
+    /**
+     * Block until a sandbox exists and is ready for `taskId`. First
+     * call boots from the configured task-role snapshot; subsequent
+     * calls after a release resume the same sandbox so installed
+     * packages and saved files survive across attempts.
+     */
+    async acquireTask(taskId, sessionId) {
+        if (sessionId)
+            this.sessionToTask.set(sessionId, taskId);
+        let entry = this.entries.get(taskId);
+        if (!entry) {
+            entry = {
+                taskId,
+                sandboxName: `tianshu-task-${this.opts.tenantId}-${taskId}`,
+                sandbox: null,
+                state: "starting",
+                startError: null,
+                startPromise: null,
+            };
+            this.entries.set(taskId, entry);
+        }
+        if (entry.state === "running" && entry.sandbox)
+            return;
+        if (entry.startPromise) {
+            await entry.startPromise;
+            if (entry.state !== "running" || !entry.sandbox) {
+                throw new Error(entry.startError ?? "sandbox failed to start");
+            }
+            return;
+        }
+        entry.state = "starting";
+        entry.startError = null;
+        entry.startPromise = this.bringUp(entry).finally(() => {
+            entry.startPromise = null;
+        });
+        await entry.startPromise;
+        if (entry.state !== "running" || !entry.sandbox) {
+            throw new Error(entry.startError ?? "sandbox failed to start");
+        }
+    }
+    async bringUp(entry) {
+        try {
+            const { Sandbox } = await loadMsb();
+            // Resume path: existing sandbox row with on-disk state.
+            // microsandbox throws on Sandbox.start when no row exists,
+            // so we don't need to probe up front; the start will fail
+            // fast and we fall through to the create path.
+            let sandbox = null;
+            try {
+                const SbStart = Sandbox.start;
+                if (typeof SbStart === "function") {
+                    sandbox = await SbStart.call(Sandbox, entry.sandboxName);
+                }
+            }
+            catch {
+                sandbox = null;
+            }
+            if (!sandbox) {
+                // First run: ensure workspace dir, pick the task-role
+                // snapshot if any, fork.
+                const ws = this.opts.workspaceDir;
+                await fs.mkdir(ws, { recursive: true });
+                const pointers = await readPointers(ws);
+                const taskPointer = pointers.task ?? pointers.browser;
+                let snapshotName = null;
+                if (taskPointer) {
+                    const exists = await snapshotExists(taskPointer.snapshotName);
+                    if (exists)
+                        snapshotName = taskPointer.snapshotName;
+                }
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                let builder = Sandbox
+                    .builder(entry.sandboxName)
+                    .cpus(this.opts.config.taskCpus)
+                    .memory(this.opts.config.taskMemoryMib)
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    .volume("/workspace", (m) => 
+                // Same as the long-lived runner: expose host uid so
+                // tenant users created inside the guest can access
+                // the workspace bind-mount.
+                m.bind(ws).statVirtualization("off"))
+                    .replace(true);
+                if (snapshotName) {
+                    builder = builder.fromSnapshot(snapshotName);
+                }
+                else {
+                    builder = builder.image(this.opts.config.image);
+                }
+                sandbox = (await builder.create());
+            }
+            entry.sandbox = sandbox;
+            entry.state = "running";
+            this.opts.log.info(`task sandbox up`, { taskId: entry.taskId, sandboxName: entry.sandboxName });
+        }
+        catch (err) {
+            entry.state = "error";
+            entry.startError = err instanceof Error ? err.message : String(err);
+            this.opts.log.error(`task sandbox failed to start`, {
+                taskId: entry.taskId,
+                err: entry.startError,
+            });
+            throw err;
+        }
+    }
+    /**
+     * Stop the sandbox bound to `taskId` without removing its disk
+     * image. Fire-and-forget — returns once the stop has been kicked
+     * off so callers (worker pool's runOne finally) aren't blocked
+     * on graceful shutdown. Errors are logged.
+     */
+    releaseTask(taskId) {
+        const entry = this.entries.get(taskId);
+        if (!entry)
+            return;
+        if (entry.state === STOPPED_STATE)
+            return;
+        if (entry.state === "starting" && entry.startPromise) {
+            // Defer the stop until startup completes; otherwise we'll
+            // race the SDK's create() lock and likely fail.
+            void entry.startPromise.then(() => this.stopEntry(entry), () => {
+                /* startPromise already updated state to error */
+            });
+            return;
+        }
+        void this.stopEntry(entry);
+    }
+    async stopEntry(entry) {
+        const sb = entry.sandbox;
+        entry.sandbox = null;
+        entry.state = STOPPED_STATE;
+        if (!sb)
+            return;
+        try {
+            if (typeof sb.stopWithTimeout === "function") {
+                await sb.stopWithTimeout(10_000);
+            }
+            else if (typeof sb.stop === "function") {
+                await sb.stop();
+            }
+        }
+        catch (err) {
+            this.opts.log.warn(`task sandbox stop failed`, {
+                taskId: entry.taskId,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    /**
+     * Stop AND remove the sandbox so its disk is reclaimed. Called
+     * from workboard's task delete handler.
+     */
+    async destroyTask(taskId) {
+        const entry = this.entries.get(taskId);
+        // Sandbox name is deterministic (tianshu-task-<tenantId>-<taskId>),
+        // so we can reclaim the on-disk image even when the in-memory
+        // pool entry is missing — the typical case for orphan VMs left
+        // behind by a previous process incarnation. Synthesise an entry
+        // so the regular stop-and-remove path runs uniformly.
+        const sandboxName = entry?.sandboxName ?? `tianshu-task-${this.opts.tenantId}-${taskId}`;
+        if (entry) {
+            // Wait for any in-flight startup so we don't race the SDK.
+            if (entry.startPromise) {
+                try {
+                    await entry.startPromise;
+                }
+                catch {
+                    /* startup may have failed; we can still attempt remove */
+                }
+            }
+            if (entry.state === "running") {
+                await this.stopEntry(entry);
+            }
+            this.entries.delete(taskId);
+            // Drop session bindings pointing at this taskId.
+            for (const [sid, tid] of this.sessionToTask) {
+                if (tid === taskId)
+                    this.sessionToTask.delete(sid);
+            }
+        }
+        try {
+            const { Sandbox } = await loadMsb();
+            const SbGet = Sandbox.get;
+            if (typeof SbGet === "function") {
+                const handle = await SbGet.call(Sandbox, sandboxName);
+                // Orphan VMs may still be 'running' (e.g. a previous process
+                // crashed before stop). Attempt a best-effort stop before
+                // remove; the SDK's remove rejects on a still-running VM.
+                if (typeof handle.stopWithTimeout === "function") {
+                    await handle.stopWithTimeout(10_000).catch(() => { });
+                }
+                await handle.remove();
+            }
+        }
+        catch (err) {
+            this.opts.log.warn(`task sandbox remove failed`, {
+                taskId,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    /**
+     * Stop every running task sandbox without removing them. Called
+     * from plugin deactivate so the next activate cycle can resume.
+     */
+    async dispose() {
+        const tasks = [];
+        for (const entry of this.entries.values()) {
+            if (entry.state === "running" || entry.state === "starting") {
+                tasks.push(this.stopEntry(entry));
+            }
+        }
+        await Promise.allSettled(tasks);
+        this.sessionToTask.clear();
+    }
+    /**
+     * Run an exec inside the sandbox bound to `taskId`. Mirrors the
+     * timeout / kill semantics of MicrosandboxRunner.exec but
+     * without the per-tenant singleton plumbing.
+     */
+    async execForTask(taskId, req) {
+        const entry = this.entries.get(taskId);
+        if (!entry) {
+            throw new Error(`no task sandbox for taskId=${taskId}`);
+        }
+        // Lazy resume: the worker pool is supposed to acquire before
+        // exec, but a chat session bound via bindSession() may hit a
+        // task whose worker run has ended (state=stopped). Resume on
+        // the fly in that case.
+        if (entry.state !== "running") {
+            await this.acquireTask(taskId);
+        }
+        if (!entry.sandbox) {
+            throw new Error(`task sandbox not ready for taskId=${taskId}`);
+        }
+        const start = Date.now();
+        const timeoutMs = typeof req.timeoutMs === "number" && Number.isFinite(req.timeoutMs)
+            ? Math.max(0, req.timeoutMs)
+            : this.opts.config.taskExecTimeoutMs;
+        const workdir = req.workdir ?? "/workspace";
+        const script = buildScript(req.userId, workdir, req.command);
+        const TIMEOUT = Symbol("exec-timeout");
+        const HANDSHAKE = Symbol("exec-handshake-timeout");
+        const ABORTED = Symbol("exec-aborted");
+        const buildAbortP = () => {
+            const sig = req.signal;
+            if (!sig)
+                return new Promise(() => { });
+            if (sig.aborted)
+                return Promise.resolve(ABORTED);
+            return new Promise((resolve) => {
+                sig.addEventListener("abort", () => resolve(ABORTED), { once: true });
+            });
+        };
+        // Mirror MicrosandboxRunner.exec: race shellStream() itself,
+        // not just collect(). If the host-guest agent socket is dead
+        // the SDK blocks on the start-of-stream ack and the inner
+        // timeout never arms.
+        const handshakeP = timeoutMs > 0
+            ? new Promise((resolve) => setTimeout(() => resolve(HANDSHAKE), timeoutMs))
+            : new Promise(() => { });
+        const startedExec = await Promise.race([
+            entry.sandbox.shellStream(script),
+            handshakeP,
+            buildAbortP(),
+        ]);
+        if (startedExec === HANDSHAKE) {
+            // Mark the entry errored so the next acquireTask path can
+            // re-fork instead of handing back the same wedged sandbox.
+            entry.state = "error";
+            entry.startError = `shellStream handshake timeout after ${timeoutMs}ms`;
+            return {
+                exitCode: -1,
+                stdout: "",
+                stderr: `[microsandbox] task sandbox shellStream() did not return ` +
+                    `within ${timeoutMs}ms — marking sandbox errored so the next ` +
+                    `task pickup re-forks from the snapshot.`,
+                durationMs: Date.now() - start,
+                timedOut: true,
+            };
+        }
+        if (startedExec === ABORTED) {
+            return {
+                exitCode: -1,
+                stdout: "",
+                stderr: `[microsandbox] task exec aborted by caller before shellStream returned.`,
+                durationMs: Date.now() - start,
+                timedOut: false,
+                aborted: true,
+            };
+        }
+        const exec = startedExec;
+        let timer = null;
+        const collectP = exec.collect();
+        const timeoutP = timeoutMs > 0
+            ? new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    exec.kill().catch(() => { });
+                    resolve(TIMEOUT);
+                }, timeoutMs);
+            })
+            : new Promise(() => { });
+        const collectAbortP = buildAbortP();
+        const winner = await Promise.race([collectP, timeoutP, collectAbortP]);
+        if (timer)
+            clearTimeout(timer);
+        if (winner === ABORTED) {
+            exec.kill().catch(() => { });
+            let partial = { stdout: "", stderr: "" };
+            try {
+                const drained = await Promise.race([
+                    collectP,
+                    new Promise((r) => setTimeout(() => r(null), 1500)),
+                ]);
+                if (drained) {
+                    partial = { stdout: drained.stdout(), stderr: drained.stderr() };
+                }
+            }
+            catch {
+                /* ignore */
+            }
+            return {
+                exitCode: -1,
+                stdout: partial.stdout,
+                stderr: (partial.stderr ? partial.stderr + "\n" : "") +
+                    `[microsandbox] task exec aborted by caller; SIGKILL sent.`,
+                durationMs: Date.now() - start,
+                timedOut: false,
+                aborted: true,
+            };
+        }
+        if (winner === TIMEOUT) {
+            let partial = { stdout: "", stderr: "" };
+            try {
+                const o = await collectP;
+                partial = { stdout: o.stdout(), stderr: o.stderr() };
+            }
+            catch {
+                /* ignore */
+            }
+            return {
+                exitCode: 124,
+                stdout: partial.stdout,
+                stderr: partial.stderr,
+                durationMs: Date.now() - start,
+                timedOut: true,
+            };
+        }
+        const out = winner;
+        return {
+            exitCode: out.code,
+            stdout: out.stdout(),
+            stderr: out.stderr(),
+            durationMs: Date.now() - start,
+            timedOut: false,
+        };
+    }
+}
+/** Path helper exported for tests. */
+export function taskSandboxName(tenantId, taskId) {
+    return `tianshu-task-${tenantId}-${taskId}`;
+}
+//# sourceMappingURL=pool.js.map

package/plugins/microsandbox/dist/runner/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../../src/runner/pool.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,0BAA0B;AAC1B,wCAAwC;AACxC,gEAAgE;AAChE,8DAA8D;AAC9D,kEAAkE;AAClE,6DAA6D;AAC7D,EAAE;AACF,iCAAiC;AACjC,kEAAkE;AAClE,qEAAqE;AACrE,EAAE;AACF,uCAAuC;AACvC,wCAAwC;AACxC,kEAAkE;AAClE,wCAAwC;AACxC,mEAAmE;AACnE,EAAE;AACF,0BAA0B;AAC1B,wCAAwC;AACxC,+DAA+D;AAC/D,qDAAqD;AACrD,EAAE;AACF,sBAAsB;AACtB,8BAA8B;AAC9B,gEAAgE;AAChE,kDAAkD;AAClD,EAAE;AACF,6DAA6D;AAC7D,mEAAmE;AACnE,EAAE;AACF,iEAAiE;AACjE,8DAA8D;AAC9D,4DAA4D;AAC5D,4DAA4D;AAC5D,oBAAoB;AASpB,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAMrD,IAAI,UAAU,GAA8B,IAAI,CAAC;AACjD,SAAS,OAAO;IACd,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAE1D,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,OAAO;IACd,MAAM,EAAE,GAAI,OAAqC,CAAC,MAAM,CAAC;IACzD,OAAO,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAClB,MAA0B,EAC1B,OAAe,EACf,OAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,eAAe,WAAW,CAAC,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,oBAAoB,UAAU,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ;QACR,WAAW,UAAU,wBAAwB;QAC7C,iBAAiB,IAAI,qBAAqB,GAAG,OAAO,UAAU,0BAA0B;QACxF,WAAW,UAAU,6CAA6C,UAAU,EAAE;QAC9E,8BAA8B,UAAU,EAAE;QAC1C,IAAI;QACJ,cAAc,UAAU,uBAAuB,UAAU,iBAAiB,WAAW,CAAC,OAAO,CAAC,QAAQ,QAAQ,GAAG;KAClH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,aAAa,GAAuB,SAAS,CAAC;AAEpD,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IACvC,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAkB;IAEvC,YAAY,IAAqB;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,SAA6B;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,IAAI;QAMF,MAAM,GAAG,GAKJ,EAAE,CAAC;QACR,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,MAAc;QAC3C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,SAAkB;QAClD,IAAI,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM;gBACN,WAAW,EAAE,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE;gBAC3D,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO;QAEvD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,YAAY,CAAC;YACzB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC;YACjE,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;QACzB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACpD,KAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,YAAY,CAAC;QACzB,IAAK,KAAK,CAAC,KAA4B,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAgB;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACpC,wDAAwD;YACxD,2DAA2D;YAC3D,0DAA0D;YAC1D,+CAA+C;YAC/C,IAAI,OAAO,GAAuB,IAAI,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GACX,OAGD,CAAC,KAAK,CAAC;gBACR,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;oBAClC,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,sDAAsD;gBACtD,yBAAyB;gBACzB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBAClC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC;gBACtD,IAAI,YAAY,GAAkB,IAAI,CAAC;gBACvC,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;oBAC9D,IAAI,MAAM;wBAAE,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;gBACtD,CAAC;gBACD,8DAA8D;gBAC9D,IAAI,OAAO,GAAS,OAAe;qBAChC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;qBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;qBAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;oBACvC,8DAA8D;qBAC7D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAM,EAAE,EAAE;gBAC/B,oDAAoD;gBACpD,mDAAmD;gBACnD,4BAA4B;gBAC5B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACrC;qBACA,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjB,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAgB,CAAC;YACpD,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChB,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CACzD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;YACtB,KAAK,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CACjB,8BAA8B,EAC9B;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,KAAK,CAAC,UAAU;aACtB,CACF,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAc;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;YAAE,OAAO;QAC1C,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrD,0DAA0D;YAC1D,gDAAgD;YAChD,KAAK,KAAK,CAAC,YAAY,CAAC,IAAI,CAC1B,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAC3B,GAAG,EAAE;gBACH,iDAAiD;YACnD,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAgB;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACzB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,aAAa,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBAC7C,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;iBAAM,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,oEAAoE;QACpE,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,sDAAsD;QACtD,MAAM,WAAW,GACf,KAAK,EAAE,WAAW,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvE,IAAI,KAAK,EAAE,CAAC;YACV,2DAA2D;YAC3D,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,YAAY,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,iDAAiD;YACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5C,IAAI,GAAG,KAAK,MAAM;oBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GACT,OAMD,CAAC,GAAG,CAAC;YACN,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACtD,6DAA6D;gBAC7D,0DAA0D;gBAC1D,0DAA0D;gBAC1D,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;oBACjD,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC/C,MAAM;gBACN,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,GAAgB;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,6DAA6D;QAC7D,6DAA6D;QAC7D,6DAA6D;QAC7D,wBAAwB;QACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,GAA4B,EAAE;YAChD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;YACvB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,0DAA0D;QAC1D,sBAAsB;QACtB,MAAM,UAAU,GACd,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACtB,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAChD;YACH,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;YACjC,UAAU;YACV,WAAW,EAAE;SACd,CAAC,CAAC;QACH,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,2DAA2D;YAC3D,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;YACtB,KAAK,CAAC,UAAU,GAAG,uCAAuC,SAAS,IAAI,CAAC;YACxE,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EACJ,2DAA2D;oBAC3D,UAAU,SAAS,2CAA2C;oBAC9D,yCAAyC;gBAC3C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EACJ,yEAAyE;gBAC3E,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC;QACzB,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,QAAQ,GACZ,SAAS,GAAG,CAAC;YACX,CAAC,CAAC,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;gBACtC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC;YACJ,CAAC,CAAC,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjC,QAAQ;oBACR,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;iBAC1D,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EACJ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,2DAA2D;gBAC7D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC;gBACzB,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,GAAG;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAkC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;CACF;AAED,sCAAsC;AACtC,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAc;IAC9D,OAAO,gBAAgB,QAAQ,IAAI,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/plugins/microsandbox/dist/runner/types.d.ts

@@ -0,0 +1,33 @@
+export interface MicroSandboxConfig {
+    /** Sandbox name (becomes the microsandbox identifier). Default
+     *  is `tianshu-<tenantId>` filled in by the facade. */
+    sandboxName: string;
+    /** OCI image to fork from when no snapshot pointer is set. */
+    image: string;
+    /** vCPUs allocated to the Browser microVM. */
+    cpus: number;
+    /** Browser microVM memory in MiB. */
+    memoryMib: number;
+    /** Idle timeout in ms for the Browser sandbox; 0 disables. v0
+     *  records but doesn't act on this. */
+    idleShutdownMs: number;
+    /** Default per-exec timeout in ms for the Browser sandbox. */
+    execTimeoutMs: number;
+    /** vCPUs allocated to each per-task sandbox. Defaults to `cpus`. */
+    taskCpus: number;
+    /** Memory (MiB) for each per-task sandbox. Defaults to `memoryMib`. */
+    taskMemoryMib: number;
+    /** How long a per-task sandbox stays alive after its last task
+     *  releases it before being stopped. 0 = stop immediately. */
+    taskIdleShutdownMs: number;
+    /** Per-exec timeout in ms for task-pool exec calls. Defaults to
+     *  `execTimeoutMs`. */
+    taskExecTimeoutMs: number;
+}
+export declare const DEFAULT_CONFIG: MicroSandboxConfig;
+/** Apply tenant config defaults. Unknown / wrong-typed fields are
+ *  ignored and the default kicks in. Task-role fields fall back to
+ *  the Browser-role value when not explicitly supplied, so legacy
+ *  single-config installs preserve their pre-split behaviour. */
+export declare function resolveConfig(raw: Record<string, unknown>): MicroSandboxConfig;
+//# sourceMappingURL=types.d.ts.map

package/plugins/microsandbox/dist/runner/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runner/types.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,kBAAkB;IACjC;2DACuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IAGd,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB;2CACuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IAItB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,aAAa,EAAE,MAAM,CAAC;IACtB;kEAC8D;IAC9D,kBAAkB,EAAE,MAAM,CAAC;IAC3B;2BACuB;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,cAAc,EAAE,kBAmB5B,CAAC;AAEF;;;iEAGiE;AACjE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAkD9E"}

package/plugins/microsandbox/dist/runner/types.js

@@ -0,0 +1,79 @@
+// Internal types shared across the microsandbox runner.
+//
+// The runner has two roles — the long-lived Browser sandbox and
+// the per-task pool — and each role gets its own resource budget.
+// Top-level fields (cpus, memoryMib, idleShutdownMs, execTimeoutMs)
+// describe the Browser role. The matching task* fields describe
+// per-task sandboxes. When a task* field isn't supplied, it falls
+// back to the Browser-role value, so existing single-config
+// installs see no behaviour change.
+export const DEFAULT_CONFIG = {
+    sandboxName: "default", // overridden per-tenant by the facade
+    image: "python:3.12-slim",
+    cpus: 2,
+    // 4 GiB is the smallest value where pip-installing the standard
+    // Python data science stack + a chromium build doesn't OOM.
+    // Browser-heavy (Playwright + multi-tab) workloads still want
+    // to bump to 8192+ via the plugin config UI, but at 4 GiB the
+    // out-of-the-box experience doesn't hit "the kernel killed our
+    // pip install" on first run.
+    memoryMib: 4096,
+    idleShutdownMs: 14_400_000, // 4h
+    execTimeoutMs: 300_000, // 5min
+    // Task-role defaults mirror the Browser role until the operator
+    // overrides them via plugin config.
+    taskCpus: 2,
+    taskMemoryMib: 4096,
+    taskIdleShutdownMs: 600_000, // 10min after last release
+    taskExecTimeoutMs: 300_000,
+};
+/** Apply tenant config defaults. Unknown / wrong-typed fields are
+ *  ignored and the default kicks in. Task-role fields fall back to
+ *  the Browser-role value when not explicitly supplied, so legacy
+ *  single-config installs preserve their pre-split behaviour. */
+export function resolveConfig(raw) {
+    const out = { ...DEFAULT_CONFIG };
+    if (typeof raw.sandboxName === "string" && raw.sandboxName.length > 0)
+        out.sandboxName = raw.sandboxName;
+    if (typeof raw.image === "string" && raw.image.length > 0)
+        out.image = raw.image;
+    if (typeof raw.cpus === "number" && Number.isFinite(raw.cpus) && raw.cpus > 0)
+        out.cpus = Math.floor(raw.cpus);
+    if (typeof raw.memoryMib === "number" && Number.isFinite(raw.memoryMib) && raw.memoryMib > 0) {
+        out.memoryMib = Math.floor(raw.memoryMib);
+    }
+    if (typeof raw.idleShutdownMs === "number" && Number.isFinite(raw.idleShutdownMs) && raw.idleShutdownMs >= 0) {
+        out.idleShutdownMs = raw.idleShutdownMs;
+    }
+    if (typeof raw.execTimeoutMs === "number" && Number.isFinite(raw.execTimeoutMs) && raw.execTimeoutMs > 0) {
+        out.execTimeoutMs = raw.execTimeoutMs;
+    }
+    // Task-role overrides. Each falls back to the matching
+    // Browser-role value when missing/invalid, so unconfigured
+    // installs see one shared budget across both roles.
+    out.taskCpus = out.cpus;
+    out.taskMemoryMib = out.memoryMib;
+    out.taskExecTimeoutMs = out.execTimeoutMs;
+    if (typeof raw.taskCpus === "number" &&
+        Number.isFinite(raw.taskCpus) &&
+        raw.taskCpus > 0) {
+        out.taskCpus = Math.floor(raw.taskCpus);
+    }
+    if (typeof raw.taskMemoryMib === "number" &&
+        Number.isFinite(raw.taskMemoryMib) &&
+        raw.taskMemoryMib > 0) {
+        out.taskMemoryMib = Math.floor(raw.taskMemoryMib);
+    }
+    if (typeof raw.taskExecTimeoutMs === "number" &&
+        Number.isFinite(raw.taskExecTimeoutMs) &&
+        raw.taskExecTimeoutMs > 0) {
+        out.taskExecTimeoutMs = raw.taskExecTimeoutMs;
+    }
+    if (typeof raw.taskIdleShutdownMs === "number" &&
+        Number.isFinite(raw.taskIdleShutdownMs) &&
+        raw.taskIdleShutdownMs >= 0) {
+        out.taskIdleShutdownMs = raw.taskIdleShutdownMs;
+    }
+    return out;
+}
+//# sourceMappingURL=types.js.map

package/plugins/microsandbox/dist/runner/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/runner/types.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,gEAAgE;AAChE,kEAAkE;AAClE,4DAA4D;AAC5D,oCAAoC;AAkCpC,MAAM,CAAC,MAAM,cAAc,GAAuB;IAChD,WAAW,EAAE,SAAS,EAAE,sCAAsC;IAC9D,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,CAAC;IACP,gEAAgE;IAChE,4DAA4D;IAC5D,8DAA8D;IAC9D,8DAA8D;IAC9D,+DAA+D;IAC/D,6BAA6B;IAC7B,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,UAAU,EAAE,KAAK;IACjC,aAAa,EAAE,OAAO,EAAE,OAAO;IAC/B,gEAAgE;IAChE,oCAAoC;IACpC,QAAQ,EAAE,CAAC;IACX,aAAa,EAAE,IAAI;IACnB,kBAAkB,EAAE,OAAO,EAAE,2BAA2B;IACxD,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF;;;iEAGiE;AACjE,MAAM,UAAU,aAAa,CAAC,GAA4B;IACxD,MAAM,GAAG,GAAuB,EAAE,GAAG,cAAc,EAAE,CAAC;IACtD,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACzG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACjF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IACxC,CAAC;IAED,uDAAuD;IACvD,2DAA2D;IAC3D,oDAAoD;IACpD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;IACxB,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC;IAClC,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1C,IACE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,QAAQ,GAAG,CAAC,EAChB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IACE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;QAClC,GAAG,CAAC,aAAa,GAAG,CAAC,EACrB,CAAC;QACD,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IACD,IACE,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACzC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtC,GAAG,CAAC,iBAAiB,GAAG,CAAC,EACzB,CAAC;QACD,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAChD,CAAC;IACD,IACE,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ;QAC1C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACvC,GAAG,CAAC,kBAAkB,IAAI,CAAC,EAC3B,CAAC;QACD,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/plugins/microsandbox/dist/server.d.ts

@@ -0,0 +1,7 @@
+import type { PluginContext, PluginServerExports } from "@tianshu/plugin-sdk";
+declare const _default: {
+    activate(ctx: PluginContext): Promise<PluginServerExports>;
+    deactivate(): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=server.d.ts.map

package/plugins/microsandbox/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAIV,aAAa,EAEb,mBAAmB,EAGpB,MAAM,qBAAqB,CAAC;;kBAqJP,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;;;AADlE,wBA+JE"}