@tokenfactory/acc-runner 0.44.8 → 0.44.9

package/dist/secure-execution/engine.d.ts

@@ -0,0 +1,24 @@
+import type { AutoCompletionReporter, AutoCompletionRetrySink, AutoLeaseVerifier, DestinationPolicy, ProvenanceSink, PtyFactory, QuarantineSource, ResourceController, SecretProvider, SecureExecutionRequest, SecureExecutionSession } from "./types.js";
+export declare function commandDigest(command: string): string;
+export interface SecureExecutionEngineDeps {
+    pty: PtyFactory;
+    autoLeaseVerifier?: AutoLeaseVerifier;
+    secrets?: SecretProvider;
+    destinations?: DestinationPolicy;
+    provenance?: ProvenanceSink;
+    quarantine?: QuarantineSource;
+    resources?: ResourceController;
+    completionReporter?: AutoCompletionReporter;
+    completionRetry?: AutoCompletionRetrySink;
+    now?: () => Date;
+    quarantinePollMs?: number;
+}
+export declare class SecureExecutionEngine {
+    private readonly deps;
+    private readonly sessions;
+    constructor(deps: SecureExecutionEngineDeps);
+    start(request: SecureExecutionRequest): Promise<SecureExecutionSession>;
+    recover(sessionId: string): SecureExecutionSession | null;
+    killAll(): void;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/secure-execution/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/secure-execution/engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EAAE,uBAAuB,EAAoB,iBAAiB,EAAE,iBAAiB,EACvG,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,sBAAsB,EACxG,sBAAsB,EACvB,MAAM,YAAY,CAAC;AASpB,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAkDD,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,qBAAqB;IAEpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;gBACzC,IAAI,EAAE,yBAAyB;IAEtD,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAoJ7E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IACzD,OAAO,IAAI,IAAI;CAChB"}

package/dist/secure-execution/engine.js

@@ -0,0 +1,272 @@
+import { createHash } from "node:crypto";
+import os from "node:os";
+import { confinedCwd } from "./confinement.js";
+import { assertAutoExecutionPolicy } from "./command-policy.js";
+import { StreamingMachineRedactor } from "../machine-console/redact.js";
+const DEFAULT_LIMITS = { wallMs: 15 * 60_000, outputBytes: 8 * 1024 * 1024, inputBytes: 1024 * 1024, maxCols: 240, maxRows: 120, cpuSeconds: 300, memoryMb: 2048 };
+const SAFE_ENV = new Set(["PATH", "HOME", "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TERM", "TMPDIR", "NO_COLOR"]);
+const SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
+export function commandDigest(command) {
+    return createHash("sha256").update(command, "utf8").digest("hex");
+}
+function boundedLimits(input = {}) {
+    const clamp = (value, fallback, max) => Math.max(1, Math.min(Number.isFinite(value) ? Number(value) : fallback, max));
+    return {
+        wallMs: clamp(input.wallMs, DEFAULT_LIMITS.wallMs, 60 * 60_000),
+        outputBytes: clamp(input.outputBytes, DEFAULT_LIMITS.outputBytes, 32 * 1024 * 1024),
+        inputBytes: clamp(input.inputBytes, DEFAULT_LIMITS.inputBytes, 4 * 1024 * 1024),
+        maxCols: clamp(input.maxCols, DEFAULT_LIMITS.maxCols, 500),
+        maxRows: clamp(input.maxRows, DEFAULT_LIMITS.maxRows, 300),
+        cpuSeconds: clamp(input.cpuSeconds, DEFAULT_LIMITS.cpuSeconds, 3600),
+        memoryMb: clamp(input.memoryMb, DEFAULT_LIMITS.memoryMb, 16_384),
+    };
+}
+function baseEnv(requested = {}) {
+    const result = { ACC_SECURE_EXECUTION: "1" };
+    for (const [name, value] of Object.entries(process.env))
+        if (SAFE_ENV.has(name) && value !== undefined)
+            result[name] = value;
+    for (const [name, value] of Object.entries(requested))
+        if (SAFE_ENV.has(name))
+            result[name] = value;
+    return result;
+}
+class ExactSecretRedactor {
+    tail = "";
+    values;
+    keep;
+    constructor(values) {
+        this.values = [...new Set(values.filter((value) => value.length >= 4))].sort((a, b) => b.length - a.length);
+        this.keep = Math.max(0, ...this.values.map((value) => value.length - 1));
+    }
+    replace(value) {
+        return this.values.reduce((text, secret) => text.split(secret).join("[REDACTED_SECRET]"), value);
+    }
+    push(chunk) {
+        const joined = this.tail + chunk;
+        if (joined.length <= this.keep) {
+            this.tail = joined;
+            return "";
+        }
+        const safeEnd = joined.length - this.keep;
+        let output = "";
+        let index = 0;
+        while (index < safeEnd) {
+            const secret = this.values.find((value) => joined.startsWith(value, index));
+            if (secret) {
+                output += "[REDACTED_SECRET]";
+                index += secret.length;
+            }
+            else {
+                output += joined[index];
+                index += 1;
+            }
+        }
+        this.tail = joined.slice(index);
+        return output;
+    }
+    finish() { const output = this.replace(this.tail); this.tail = ""; return output; }
+}
+export class SecureExecutionEngine {
+    deps;
+    sessions = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async start(request) {
+        if (this.sessions.has(request.sessionId))
+            throw new Error("execution_session_exists");
+        const now = this.deps.now?.() ?? new Date();
+        const digest = commandDigest(request.command);
+        const deny = async (reason) => {
+            await this.deps.provenance?.record("execution.denied", { session_id: request.sessionId, runner_id: request.runnerId, repo: request.repo, command_digest: digest, mode: request.mode, reason });
+            throw new Error(reason);
+        };
+        if (!request.sessionId.trim() || !request.runnerId.trim() || !/^[^/\s]+\/[^/\s]+$/.test(request.repo))
+            return deny("execution_identity_invalid");
+        if (!request.command.trim() || /[\0\r\n]/.test(request.command))
+            return deny("execution_command_invalid");
+        const quarantine = await this.deps.quarantine?.current();
+        if (quarantine?.quarantined)
+            return deny("execution_runner_quarantined");
+        const limits = boundedLimits(request.limits);
+        let leaseVerdict;
+        if (request.mode === "auto") {
+            for (const key of ["wallMs", "outputBytes", "inputBytes", "maxCols", "maxRows", "cpuSeconds", "memoryMb"]) {
+                if (request.limits?.[key] !== undefined && request.limits[key] !== limits[key])
+                    return deny("auto_resource_limit_invalid");
+            }
+            try {
+                assertAutoExecutionPolicy(request);
+            }
+            catch (error) {
+                return deny(error.message);
+            }
+            if (!this.deps.autoLeaseVerifier || !request.autoLease)
+                return deny("auto_lease_verifier_unavailable");
+            const lease = request.autoLease;
+            if (lease.runnerId !== request.runnerId || lease.repo !== request.repo || lease.commandDigest !== digest || Date.parse(lease.expiresAt) <= now.getTime())
+                return deny("auto_lease_mismatch");
+            leaseVerdict = await this.deps.autoLeaseVerifier.verify(lease, {
+                runnerId: request.runnerId, orgId: request.orgId, userId: request.userId,
+                repo: request.repo, paths: request.paths ?? [request.cwd ?? "."],
+                commandClass: request.commandClass, commandDigest: digest,
+                destinations: request.destinations ?? [], limits, now,
+            });
+            if (!leaseVerdict.valid)
+                return deny("auto_lease_denied");
+        }
+        const requestedDestinations = request.destinations ?? [];
+        if (request.mode === "auto" || requestedDestinations.length) {
+            if (!this.deps.destinations)
+                return deny("destination_policy_unavailable");
+            const verdict = await this.deps.destinations.authorize(requestedDestinations, { repo: request.repo, mode: request.mode });
+            if (!verdict.allowed)
+                return deny("destination_policy_denied");
+        }
+        const secretNames = [...new Set(request.secretNames ?? [])];
+        if (secretNames.some((name) => !SECRET_NAME.test(name)))
+            return deny("secret_name_invalid");
+        if (secretNames.length && !this.deps.secrets)
+            return deny("secret_provider_unavailable");
+        const secrets = secretNames.length ? await this.deps.secrets.resolve(secretNames, { repo: request.repo, sessionId: request.sessionId }) : {};
+        if (secretNames.some((name) => typeof secrets[name] !== "string" || !secrets[name]))
+            return deny("secret_unavailable");
+        const cwd = confinedCwd(request.repoRoot, request.cwd);
+        if (request.mode === "auto" && !this.deps.resources)
+            return deny("resource_controller_unavailable");
+        const shell = os.platform() === "win32" ? (process.env.ComSpec ?? "cmd.exe") : (process.env.SHELL ?? "/bin/sh");
+        const args = os.platform() === "win32" ? ["/d", "/s", "/c", request.command] : ["-lc", request.command];
+        const child = this.deps.pty.spawn(shell, args, { cwd, env: { ...baseEnv(request.env), ...secrets }, cols: 80, rows: 24 });
+        const startedAt = now.toISOString();
+        await this.deps.provenance?.record("execution.started", { session_id: request.sessionId, runner_id: request.runnerId, repo: request.repo, command_digest: digest, mode: request.mode, cwd, secret_names: secretNames, destinations: requestedDestinations });
+        let sequence = 0;
+        let outputBytes = 0;
+        let inputBytes = 0;
+        let settled = false;
+        let termination = "exited";
+        const frames = [];
+        const exactRedactor = new ExactSecretRedactor(Object.values(secrets));
+        const genericRedactor = new StreamingMachineRedactor();
+        let resolveReceipt;
+        const wait = new Promise((resolve) => { resolveReceipt = resolve; });
+        const emit = (stream, content, count = true) => {
+            if (!content)
+                return;
+            const bytes = Buffer.byteLength(content);
+            frames.push({ sequence: sequence++, stream, content, bytes, at: (this.deps.now?.() ?? new Date()).toISOString() });
+            if (count)
+                outputBytes += bytes;
+        };
+        const kill = (why) => {
+            if (settled)
+                return;
+            termination = why;
+            emit("system", `Session stopped: ${why}.\n`, false);
+            child.kill("SIGTERM");
+        };
+        let resourceHandle = null;
+        let destinationHandle = null;
+        if (request.mode === "auto") {
+            if (!this.deps.destinations?.activate) {
+                child.kill("SIGKILL");
+                return deny("destination_runtime_enforcement_unavailable");
+            }
+            try {
+                destinationHandle = await this.deps.destinations.activate(child.pid, requestedDestinations, { repo: request.repo, mode: request.mode });
+            }
+            catch {
+                child.kill("SIGKILL");
+                return deny("destination_runtime_enforcement_failed");
+            }
+        }
+        if (this.deps.resources) {
+            try {
+                resourceHandle = await this.deps.resources.attach(child.pid, { cpuSeconds: limits.cpuSeconds, memoryMb: limits.memoryMb }, () => kill("resource_limit"));
+            }
+            catch {
+                destinationHandle?.dispose();
+                child.kill("SIGKILL");
+                return deny("resource_controller_failed");
+            }
+        }
+        const appendPty = (content) => {
+            if (settled)
+                return;
+            emit("pty", content, false);
+        };
+        const dataSubscription = child.onData((content) => {
+            if (settled)
+                return;
+            const bytes = Buffer.byteLength(content);
+            const remaining = limits.outputBytes - outputBytes;
+            outputBytes += Math.min(bytes, Math.max(remaining, 0));
+            const bounded = Buffer.from(content).subarray(0, Math.max(remaining, 0)).toString("utf8");
+            appendPty(genericRedactor.push(exactRedactor.push(bounded)));
+            if (bytes > remaining)
+                kill("output_limit");
+        });
+        const wall = setTimeout(() => kill("expired"), limits.wallMs);
+        wall.unref?.();
+        const quarantinePoll = this.deps.quarantine ? setInterval(async () => {
+            try {
+                if ((await this.deps.quarantine.current()).quarantined)
+                    kill("quarantined");
+            }
+            catch {
+                kill("quarantined");
+            }
+        }, this.deps.quarantinePollMs ?? 1_000) : null;
+        quarantinePoll?.unref?.();
+        const exitSubscription = child.onExit(async ({ exitCode }) => {
+            if (settled)
+                return;
+            appendPty(genericRedactor.push(exactRedactor.finish()) + genericRedactor.finish());
+            settled = true;
+            clearTimeout(wall);
+            if (quarantinePoll)
+                clearInterval(quarantinePoll);
+            resourceHandle?.dispose();
+            destinationHandle?.dispose();
+            dataSubscription.dispose();
+            exitSubscription.dispose();
+            const receipt = Object.freeze({ sessionId: request.sessionId, repo: request.repo, commandDigest: digest, mode: request.mode, cwd, startedAt, finishedAt: (this.deps.now?.() ?? new Date()).toISOString(), exitCode, termination, outputBytes, secretNames: Object.freeze([...secretNames]), destinations: Object.freeze(requestedDestinations.map((destination) => Object.freeze({ ...destination }))) });
+            await this.deps.provenance?.record("execution.finished", { ...receipt, session_id: receipt.sessionId, command_digest: receipt.commandDigest, secret_names: secretNames });
+            if (request.mode === "auto" && request.autoLease && this.deps.completionReporter) {
+                const completion = Object.freeze({
+                    idempotencyKey: `${request.autoLease.leaseId}:completion`,
+                    leaseId: request.autoLease.leaseId,
+                    issueReceiptId: request.autoLease.issueReceiptId,
+                    consumeReceiptId: leaseVerdict?.consumeReceiptId,
+                    profileId: leaseVerdict?.profileId,
+                    execution: receipt,
+                });
+                try {
+                    await this.deps.completionReporter.report(completion);
+                }
+                catch {
+                    await this.deps.completionRetry?.enqueue(completion);
+                }
+            }
+            this.sessions.delete(request.sessionId);
+            resolveReceipt(receipt);
+        });
+        const session = {
+            id: request.sessionId,
+            write: (data) => { if (settled)
+                throw new Error("execution_session_closed"); inputBytes += Buffer.byteLength(data); if (inputBytes > limits.inputBytes)
+                return kill("policy_denied"); child.write(data); },
+            resize: (cols, rows) => { if (settled)
+                throw new Error("execution_session_closed"); child.resize(Math.max(1, Math.min(cols, limits.maxCols)), Math.max(1, Math.min(rows, limits.maxRows))); },
+            cancel: () => kill("cancelled"),
+            reconnect: (after = -1) => frames.filter((frame) => frame.sequence > after).map((frame) => ({ ...frame })),
+            wait: () => wait,
+        };
+        this.sessions.set(request.sessionId, session);
+        return session;
+    }
+    recover(sessionId) { return this.sessions.get(sessionId) ?? null; }
+    killAll() { for (const session of this.sessions.values())
+        session.cancel(); }
+}
+//# sourceMappingURL=engine.js.map

package/dist/secure-execution/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/secure-execution/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AAMzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,cAAc,GAAoB,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpL,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AACvH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,QAAkC,EAAE;IACzD,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,QAAgB,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1J,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC;QAC/D,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACnF,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;QAC/E,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;QAC1D,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC;QACpE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,YAAoC,EAAE;IACrD,MAAM,MAAM,GAA2B,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7H,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,mBAAmB;IACf,IAAI,GAAG,EAAE,CAAC;IACD,MAAM,CAAW;IACjB,IAAI,CAAS;IAC9B,YAAY,MAAgB;QAC1B,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACO,OAAO,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,KAAa;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,IAAI,MAAM,EAAE,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC;gBAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;YAAC,CAAC;iBACjE,CAAC;gBAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAa,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;CAC5F;AAgBD,MAAM,OAAO,qBAAqB;IAEH;IADZ,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtE,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;IAAG,CAAC;IAEhE,KAAK,CAAC,KAAK,CAAC,OAA+B;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAkB,EAAE;YACpD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/L,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACjJ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1G,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QACzD,IAAI,UAAU,EAAE,WAAW;YAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,YAA0C,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAU,EAAE,CAAC;gBACnH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7H,CAAC;YACD,IAAI,CAAC;gBAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACpG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE;gBAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC7L,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC7D,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACxE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;gBAChE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM;gBACzD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,qBAAqB,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1H,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC5F,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9I,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1H,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC7P,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAoC,QAAQ,CAAC;QAC5D,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,eAAe,GAAG,IAAI,wBAAwB,EAAE,CAAC;QACvD,IAAI,cAAoD,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE,GAAG,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,CAAC,MAAgC,EAAE,OAAe,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;YAC/E,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACnH,IAAI,KAAK;gBAAE,WAAW,IAAI,KAAK,CAAC;QAClC,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAoC,EAAE,EAAE;YACpD,IAAI,OAAO;gBAAE,OAAO;YACpB,WAAW,GAAG,GAAG,CAAC;YAClB,IAAI,CAAC,QAAQ,EAAE,oBAAoB,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,IAAI,cAAc,GAA+B,IAAI,CAAC;QACtD,IAAI,iBAAiB,GAA+B,IAAI,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC;gBAAC,iBAAiB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAChJ,MAAM,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC3J,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,EAAE,OAAO,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;YACnD,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1F,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,GAAG,SAAS;gBAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACnE,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAW,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW;oBAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,CAAC;YACrF,MAAM,CAAC;gBAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,CAAC;QAChC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC3D,IAAI,OAAO;gBAAE,OAAO;YACpB,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,cAAc,EAAE,OAAO,EAAE,CAAC;YAC1B,iBAAiB,EAAE,OAAO,EAAE,CAAC;YAC7B,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACvD,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAqB,CAAC;YAChb,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1K,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACjF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC/B,cAAc,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,aAAa;oBACzD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;oBAClC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc;oBAChD,gBAAgB,EAAE,YAAY,EAAE,gBAAgB;oBAChD,SAAS,EAAE,YAAY,EAAE,SAAS;oBAClC,SAAS,EAAE,OAAO;iBACnB,CAAC,CAAC;gBACH,IAAI,CAAC;oBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAC9D,MAAM,CAAC;oBACL,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,OAAO,CAAC,SAAS;YACrB,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1M,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7L,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,SAAS,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1G,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;SACjB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,SAAiB,IAAmC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1G,OAAO,KAAW,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CACpF"}

package/dist/secure-execution/index.d.ts

@@ -0,0 +1,7 @@
+export { confinedCwd } from "./confinement.js";
+export { commandDigest, SecureExecutionEngine } from "./engine.js";
+export { NodePtyFactory } from "./node-pty.js";
+export { SupabaseAutoLeaseVerifier, MemoryCompletionOutbox, bindIssuedAutoLease } from "./auto-lease.js";
+export { assertAutoExecutionPolicy } from "./command-policy.js";
+export type * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/secure-execution/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secure-execution/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,mBAAmB,YAAY,CAAC"}

package/dist/secure-execution/index.js

@@ -0,0 +1,6 @@
+export { confinedCwd } from "./confinement.js";
+export { commandDigest, SecureExecutionEngine } from "./engine.js";
+export { NodePtyFactory } from "./node-pty.js";
+export { SupabaseAutoLeaseVerifier, MemoryCompletionOutbox, bindIssuedAutoLease } from "./auto-lease.js";
+export { assertAutoExecutionPolicy } from "./command-policy.js";
+//# sourceMappingURL=index.js.map

package/dist/secure-execution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secure-execution/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/secure-execution/node-pty.d.ts

@@ -0,0 +1,11 @@
+import type { PtyFactory, PtyProcess } from "./types.js";
+/** Production adapter; tests inject a deterministic PtyFactory. */
+export declare class NodePtyFactory implements PtyFactory {
+    spawn(file: string, args: string[], options: {
+        cwd: string;
+        env: Record<string, string>;
+        cols: number;
+        rows: number;
+    }): PtyProcess;
+}
+//# sourceMappingURL=node-pty.d.ts.map

package/dist/secure-execution/node-pty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-pty.d.ts","sourceRoot":"","sources":["../../src/secure-execution/node-pty.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKzD,mEAAmE;AACnE,qBAAa,cAAe,YAAW,UAAU;IAC/C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;CAqBnI"}

package/dist/secure-execution/node-pty.js

@@ -0,0 +1,27 @@
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+/** Production adapter; tests inject a deterministic PtyFactory. */
+export class NodePtyFactory {
+    spawn(file, args, options) {
+        // Resolve lazily so importing the bounded console does not load a native
+        // addon. Packaged runners include node-pty; stripped test installs can still
+        // exercise every policy through an injected PtyFactory.
+        const nodePty = require("node-pty");
+        const child = nodePty.spawn(file, args, {
+            cwd: options.cwd,
+            env: options.env,
+            cols: options.cols,
+            rows: options.rows,
+            name: options.env.TERM ?? "xterm-256color",
+        });
+        return {
+            get pid() { return child.pid; },
+            write: (data) => child.write(data),
+            resize: (cols, rows) => child.resize(cols, rows),
+            kill: (signal) => child.kill(signal),
+            onData: (callback) => child.onData(callback),
+            onExit: (callback) => child.onExit(callback),
+        };
+    }
+}
+//# sourceMappingURL=node-pty.js.map

package/dist/secure-execution/node-pty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-pty.js","sourceRoot":"","sources":["../../src/secure-execution/node-pty.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,mEAAmE;AACnE,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,IAAY,EAAE,IAAc,EAAE,OAAiF;QACnH,yEAAyE;QACzE,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAkB,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,gBAAgB;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,GAAG,KAAK,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5C,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/secure-execution/types.d.ts

@@ -0,0 +1,176 @@
+export type ExecutionMode = "human" | "auto";
+export type ExecutionTermination = "exited" | "cancelled" | "expired" | "output_limit" | "resource_limit" | "quarantined" | "policy_denied";
+export interface AutoExecutionLease {
+    leaseId: string;
+    leaseToken?: string;
+    issueReceiptId?: string;
+    orgId?: string;
+    userId?: string;
+    profileId?: string;
+    runnerId: string;
+    repo: string;
+    paths?: string[];
+    commandClass?: string;
+    networkDestinations?: string[];
+    commandDigest: string;
+    expiresAt: string;
+    nonce?: string;
+    limits?: Pick<ExecutionLimits, "wallMs" | "outputBytes" | "cpuSeconds" | "memoryMb">;
+}
+export interface AutoLeaseVerifier {
+    verify(lease: AutoExecutionLease, context: AutoLeaseVerificationContext): Promise<AutoLeaseVerdict>;
+}
+export interface AutoLeaseVerificationContext {
+    runnerId: string;
+    orgId?: string;
+    userId?: string;
+    repo: string;
+    paths: string[];
+    commandClass?: string;
+    commandDigest: string;
+    destinations: NetworkDestination[];
+    limits: ExecutionLimits;
+    now: Date;
+}
+export interface AutoLeaseVerdict {
+    valid: boolean;
+    reason?: string;
+    consumeReceiptId?: string;
+    profileId?: string;
+}
+export interface SecretProvider {
+    resolve(names: readonly string[], context: {
+        repo: string;
+        sessionId: string;
+    }): Promise<Record<string, string>>;
+}
+export interface NetworkDestination {
+    host: string;
+    port: number;
+    protocol: "tcp" | "udp" | "https";
+}
+export interface DestinationPolicy {
+    authorize(destinations: readonly NetworkDestination[], context: {
+        repo: string;
+        mode: ExecutionMode;
+    }): Promise<{
+        allowed: boolean;
+        reason?: string;
+    }>;
+    /** Install the runtime egress boundary for a spawned AUTO process. Merely
+     * authorizing a list is insufficient: AUTO fails closed without this hook. */
+    activate?(pid: number, destinations: readonly NetworkDestination[], context: {
+        repo: string;
+        mode: ExecutionMode;
+    }): Promise<{
+        dispose(): void;
+    }>;
+}
+export interface ExecutionLimits {
+    wallMs: number;
+    outputBytes: number;
+    inputBytes: number;
+    maxCols: number;
+    maxRows: number;
+    cpuSeconds: number;
+    memoryMb: number;
+}
+export interface ResourceController {
+    attach(pid: number, limits: Pick<ExecutionLimits, "cpuSeconds" | "memoryMb">, onExceeded: () => void): Promise<{
+        dispose(): void;
+    }>;
+}
+export interface SecureExecutionRequest {
+    sessionId: string;
+    runnerId: string;
+    repo: string;
+    orgId?: string;
+    userId?: string;
+    repoRoot: string;
+    cwd?: string;
+    paths?: string[];
+    commandClass?: string;
+    command: string;
+    mode: ExecutionMode;
+    autoLease?: AutoExecutionLease;
+    secretNames?: string[];
+    destinations?: NetworkDestination[];
+    env?: Record<string, string>;
+    limits?: Partial<ExecutionLimits>;
+}
+export interface AutoCompletionRecord {
+    idempotencyKey: string;
+    leaseId: string;
+    issueReceiptId?: string;
+    consumeReceiptId?: string;
+    profileId?: string;
+    execution: ExecutionReceipt;
+}
+export interface AutoCompletionReporter {
+    report(record: AutoCompletionRecord): Promise<void>;
+}
+export interface AutoCompletionRetrySink {
+    enqueue(record: AutoCompletionRecord): Promise<void>;
+}
+export interface ExecutionFrame {
+    sequence: number;
+    stream: "pty" | "system";
+    content: string;
+    bytes: number;
+    at: string;
+}
+export interface ExecutionReceipt {
+    sessionId: string;
+    repo: string;
+    commandDigest: string;
+    mode: ExecutionMode;
+    cwd: string;
+    startedAt: string;
+    finishedAt: string;
+    exitCode: number | null;
+    termination: ExecutionTermination;
+    outputBytes: number;
+    secretNames: string[];
+    destinations: NetworkDestination[];
+}
+export interface ProvenanceSink {
+    record(event: "execution.started" | "execution.finished" | "execution.denied", payload: Record<string, unknown>): Promise<void>;
+}
+export interface QuarantineSource {
+    current(): Promise<{
+        quarantined: boolean;
+        reason?: string;
+    }>;
+}
+export interface PtyProcess {
+    readonly pid: number;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    kill(signal?: string): void;
+    onData(callback: (data: string) => void): {
+        dispose(): void;
+    };
+    onExit(callback: (event: {
+        exitCode: number;
+        signal?: number;
+    }) => void): {
+        dispose(): void;
+    };
+}
+export interface PtyFactory {
+    spawn(file: string, args: string[], options: {
+        cwd: string;
+        env: Record<string, string>;
+        cols: number;
+        rows: number;
+    }): PtyProcess;
+}
+export interface SecureExecutionSession {
+    readonly id: string;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    cancel(): void;
+    reconnect(afterSequence?: number): ExecutionFrame[];
+    wait(): Promise<ExecutionReceipt>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secure-execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secure-execution/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7C,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,eAAe,CAAC;AAE5I,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACrG;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClH;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvJ;kFAC8E;IAC9E,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC,CAAC;CACnJ;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC,CAAC;CACrI;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,oBAAoB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC;IAC9D,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC;CAC/F;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CAAC;CACpI;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,MAAM,IAAI,IAAI,CAAC;IACf,SAAS,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAAC;IACpD,IAAI,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnC"}

package/dist/secure-execution/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/secure-execution/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secure-execution/types.ts"],"names":[],"mappings":""}

package/dist/staging-migrations/command.d.ts

@@ -0,0 +1,2 @@
+export declare function applyApprovedStagingMigrationCommand(planId: string): Promise<void>;
+//# sourceMappingURL=command.d.ts.map

package/dist/staging-migrations/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/staging-migrations/command.ts"],"names":[],"mappings":"AAWA,wBAAsB,oCAAoC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CxF"}