@travisliu/open-dynamic-workflow 0.3.0

package/dist/workflow/runtime.d.ts

@@ -0,0 +1,46 @@
+import type { ParsedWorkflow, WorkflowRunResult, ResolvedWorkflowIdentity } from "../types/workflow.js";
+import type { ResolvedConfig, CliRunOptions } from "../types/config.js";
+import type { ArtifactStore } from "../types/artifacts.js";
+import type { AgentExecutor } from "../agents/execution-types.js";
+import type { RuntimeEventSink } from "../orchestration/scheduler.js";
+import type { RuntimeState } from "./types.js";
+import { type WorkflowRegistry } from "./registry.js";
+import type { SharedAgentRegistry } from "../shared-agents/registry.js";
+import type { WorkflowInvocationContext } from "./invocation-types.js";
+import type { ToolRegistry } from "../types/tool.js";
+import type { ToolExecutor } from "../tools/executor-types.js";
+export interface Clock {
+    now(): Date;
+}
+export interface IdGenerator {
+    nextId(prefix: string): string;
+}
+export interface RuntimeRunInput {
+    parsedWorkflow: ParsedWorkflow;
+    workflowRegistry?: WorkflowRegistry;
+    workflowIdentity?: ResolvedWorkflowIdentity;
+    config: ResolvedConfig;
+    cli: CliRunOptions;
+    signal?: AbortSignal;
+    sharedAgentRegistry?: SharedAgentRegistry;
+    toolRegistry?: ToolRegistry;
+}
+export interface RuntimeDependencies {
+    agentExecutor: AgentExecutor;
+    eventSink: RuntimeEventSink;
+    artifactStore?: ArtifactStore;
+    clock?: Clock;
+    idGenerator?: IdGenerator;
+    sharedAgentRegistry?: SharedAgentRegistry;
+    toolExecutor?: ToolExecutor;
+}
+export interface RuntimeRunner {
+    run(input: RuntimeRunInput, deps: RuntimeDependencies): Promise<WorkflowRunResult>;
+}
+export declare class DefaultRuntimeRunner implements RuntimeRunner {
+    run(input: RuntimeRunInput, deps: RuntimeDependencies): Promise<WorkflowRunResult>;
+}
+export declare function executeWorkflowModule(runtime: RuntimeState, invocationContext?: WorkflowInvocationContext): Promise<unknown>;
+export declare function buildSucceededRunResult(runtime: RuntimeState, workflowResult: unknown, durationMs: number, finishedAt: string, artifactStore?: ArtifactStore): WorkflowRunResult;
+export declare function buildFailedRunResult(runtime: RuntimeState, error: unknown, durationMs: number, finishedAt: string, artifactStore?: ArtifactStore): WorkflowRunResult;
+export declare function buildCancelledRunResult(runtime: RuntimeState, durationMs: number, finishedAt: string, reason?: string, artifactStore?: ArtifactStore): WorkflowRunResult;

package/dist/workflow/runtime.js

@@ -0,0 +1,398 @@
+import * as path from "node:path";
+import * as vm from "node:vm";
+import { DefaultScheduler } from "../orchestration/scheduler.js";
+import { createDsl } from "./dsl.js";
+import { createSandboxContext } from "./sandbox.js";
+import { createRootWorkflowRegistry } from "./registry.js";
+import { serializeError } from "../errors/serialize.js";
+import { createLinkedAbortController } from "../orchestration/cancellation.js";
+import { OpenDynamicWorkflowError } from "../errors/types.js";
+import { ErrorCode } from "../errors/codes.js";
+import { loadRuntimeCallCache } from "../artifacts/call-cache.js";
+import { DefaultWorkflowInvocationManager } from "./invocation-manager.js";
+import { getActiveWorkflowInvocation } from "./invocation-types.js";
+import { cloneJsonValue, cloneJsonObject } from "./json.js";
+import { withDslExecutionScope, withToolTopLevelWindow } from "./scope.js";
+export class DefaultRuntimeRunner {
+    async run(input, deps) {
+        const startTime = deps.clock ? deps.clock.now() : new Date();
+        const runId = deps.idGenerator ? deps.idGenerator.nextId("run") : crypto.randomUUID();
+        const cwd = input.cli.cwd || input.config.cwd || process.cwd();
+        const artifactsDir = input.cli.outDir || input.config.outDir || path.resolve(cwd, ".open-dynamic-workflow/runs", runId);
+        const schedulerConcurrency = input.cli.concurrency ?? input.config.concurrency ?? 1;
+        const scheduler = new DefaultScheduler({
+            concurrency: schedulerConcurrency,
+            failFast: !!(input.cli.failFast || input.config.failFast)
+        }, { eventSink: deps.eventSink });
+        const runtimeAbortController = createLinkedAbortController(input.signal);
+        const callCache = await loadRuntimeCallCache({
+            resume: input.cli.resume,
+            noCache: input.cli.noCache,
+            outDir: input.config.outDir
+        });
+        const registry = input.workflowRegistry || createRootWorkflowRegistry(input.parsedWorkflow);
+        const runtime = {
+            artifactStore: deps.artifactStore,
+            workflowRegistry: registry,
+            runId,
+            parsedWorkflow: input.parsedWorkflow,
+            config: input.config,
+            cli: input.cli,
+            args: input.cli.args || {},
+            cwd,
+            artifactsDir,
+            agentResults: [],
+            toolResults: [],
+            scheduler,
+            agentExecutor: deps.agentExecutor,
+            eventSink: deps.eventSink,
+            abortController: runtimeAbortController,
+            agentCounter: 0,
+            callSequence: 0,
+            callCache,
+            pipelineCounter: 0,
+            pipelineSummaries: [],
+            workflowSummaries: [],
+            startedAt: startTime.toISOString(),
+            idGenerator: deps.idGenerator !== undefined ? deps.idGenerator : undefined,
+            failFast: input.cli.failFast,
+            sharedAgentRegistry: input.sharedAgentRegistry || deps.sharedAgentRegistry,
+            schedulerConcurrency,
+            toolRegistry: input.toolRegistry,
+            toolExecutor: deps.toolExecutor,
+            toolCallIds: new Set(),
+            toolCounter: 0
+        };
+        const invocationManager = new DefaultWorkflowInvocationManager({
+            runtime,
+            registry,
+            evaluate: (ctx) => executeWorkflowModule(runtime, ctx)
+        });
+        runtime.invocationManager = invocationManager;
+        if (deps.artifactStore && !deps.artifactStore.isRunCreated()) {
+            await deps.artifactStore.createRun({
+                runId,
+                outDir: artifactsDir,
+                workflowPath: input.parsedWorkflow.sourcePath,
+                workflowSource: input.parsedWorkflow.sourceText || "",
+                workflowHash: input.parsedWorkflow.sourceHash,
+                resolvedConfig: input.config,
+                openDynamicWorkflowVersion: input.parsedWorkflow.meta.version || "0.0.0",
+                cwd,
+                configPath: input.config.configPath
+            });
+        }
+        // Listen to external signals / cancellation
+        if (input.signal) {
+            if (input.signal.aborted) {
+                scheduler.abort({ type: "user", message: input.signal.reason || "External cancellation" });
+                runtimeAbortController.abort(input.signal.reason || "External cancellation");
+            }
+            else {
+                input.signal.addEventListener("abort", () => {
+                    scheduler.abort({ type: "user", message: input.signal?.reason || "External cancellation" });
+                    runtimeAbortController.abort(input.signal?.reason || "External cancellation");
+                });
+            }
+        }
+        // Emit workflow.resolved if present
+        if (deps.eventSink && input.workflowIdentity) {
+            deps.eventSink.emit("workflow.resolved", {
+                requestedTarget: input.workflowIdentity.requestedTarget,
+                targetKind: input.workflowIdentity.targetKind,
+                workflowName: input.workflowIdentity.name,
+                workflowFile: input.workflowIdentity.workflowFile,
+                workflowFileRelative: input.workflowIdentity.workflowFileRelative,
+                discoverySource: input.workflowIdentity.discoverySource
+            });
+        }
+        // Emit workflow.started
+        if (deps.eventSink) {
+            deps.eventSink.emit("workflow.started", {
+                meta: input.parsedWorkflow.meta,
+                cwd,
+                artifactsDir
+            });
+        }
+        try {
+            if (runtimeAbortController.signal.aborted) {
+                throw new OpenDynamicWorkflowError(ErrorCode.WORKFLOW_CANCELLED, String(runtimeAbortController.signal.reason || "Workflow cancelled before execution started."));
+            }
+            const workflowResult = await withDslExecutionScope({
+                runId: runtime.runId,
+                workflowInvocationId: runtime.runId,
+                location: "workflow-top-level",
+                toolAllowed: true,
+                topLevelWindow: false
+            }, () => invocationManager.executeRoot(registry.require(input.parsedWorkflow.meta.name), runtime.args));
+            // Wait for scheduler to drain all pending tasks
+            await scheduler.drain();
+            // Check if scheduler is aborted
+            const schedulerSnapshot = scheduler.getSnapshot();
+            if (schedulerSnapshot.aborted) {
+                const abortReason = schedulerSnapshot.abortReason;
+                const isFailFast = abortReason?.type === "fail-fast";
+                const reasonMsg = typeof abortReason === "string" ? abortReason : abortReason?.message;
+                if (isFailFast) {
+                    if (runtime.toolExecutor) {
+                        runtime.toolExecutor.cancel({ name: "FailFastError", message: reasonMsg || "Fail-fast triggered", code: "FAIL_FAST" });
+                        await runtime.toolExecutor.close().catch(() => { });
+                    }
+                    const finishTime = deps.clock ? deps.clock.now() : new Date();
+                    const durationMs = finishTime.getTime() - startTime.getTime();
+                    // Build failed run result for fail-fast
+                    const result = buildFailedRunResult(runtime, new Error(reasonMsg), durationMs, finishTime.toISOString(), deps.artifactStore);
+                    if (deps.eventSink) {
+                        deps.eventSink.emit("workflow.failed", {
+                            status: "failed",
+                            durationMs,
+                            error: result.error
+                        });
+                    }
+                    if (deps.artifactStore) {
+                        await deps.artifactStore.updateManifest("failed", result.error);
+                    }
+                    return result;
+                }
+                else {
+                    if (runtime.toolExecutor) {
+                        runtime.toolExecutor.cancel({ name: "WorkflowCancelledError", message: reasonMsg || "Workflow cancelled", code: "USER_CANCELLED" });
+                        await runtime.toolExecutor.close().catch(() => { });
+                    }
+                    const finishTime = deps.clock ? deps.clock.now() : new Date();
+                    const durationMs = finishTime.getTime() - startTime.getTime();
+                    // Build cancelled run result
+                    const result = buildCancelledRunResult(runtime, durationMs, finishTime.toISOString(), reasonMsg, deps.artifactStore);
+                    if (deps.eventSink) {
+                        deps.eventSink.emit("workflow.cancelled", {
+                            status: "cancelled",
+                            durationMs,
+                            reason: reasonMsg || "Workflow cancelled"
+                        });
+                    }
+                    if (deps.artifactStore) {
+                        await deps.artifactStore.updateManifest("cancelled", result.error);
+                    }
+                    return result;
+                }
+            }
+            if (runtime.toolExecutor) {
+                await runtime.toolExecutor.close();
+            }
+            const finishTime = deps.clock ? deps.clock.now() : new Date();
+            const durationMs = finishTime.getTime() - startTime.getTime();
+            // Build succeeded run result
+            const result = buildSucceededRunResult(runtime, workflowResult, durationMs, finishTime.toISOString(), deps.artifactStore);
+            if (deps.eventSink) {
+                deps.eventSink.emit("workflow.completed", {
+                    status: "succeeded",
+                    durationMs,
+                    result: workflowResult
+                });
+            }
+            if (deps.artifactStore) {
+                await deps.artifactStore.updateManifest("succeeded");
+            }
+            return result;
+        }
+        catch (err) {
+            let abortType = "other";
+            if (err?.code === ErrorCode.WORKFLOW_TIMEOUT) {
+                abortType = "timeout";
+            }
+            else if (err?.code === ErrorCode.WORKFLOW_CANCELLED ||
+                err?.code === ErrorCode.USER_CANCELLED ||
+                err?.name === "AbortError" ||
+                err?.name === "WorkflowCancelledError" ||
+                (err?.name === "OpenDynamicWorkflowError" && (err?.code === ErrorCode.WORKFLOW_CANCELLED || err?.code === ErrorCode.USER_CANCELLED))) {
+                abortType = "user";
+            }
+            scheduler.abort({
+                type: abortType,
+                message: err.message || "Workflow error"
+            });
+            await scheduler.drain().catch(() => { });
+            if (runtime.toolExecutor) {
+                runtime.toolExecutor.cancel(serializeError(err));
+                await runtime.toolExecutor.close().catch(() => { });
+            }
+            const finishTime = deps.clock ? deps.clock.now() : new Date();
+            const durationMs = finishTime.getTime() - startTime.getTime();
+            const isCancellation = err?.code === ErrorCode.WORKFLOW_CANCELLED ||
+                err?.code === ErrorCode.USER_CANCELLED ||
+                err?.name === "AbortError" ||
+                err?.name === "WorkflowCancelledError" ||
+                (err?.name === "OpenDynamicWorkflowError" && (err?.code === ErrorCode.WORKFLOW_CANCELLED || err?.code === ErrorCode.USER_CANCELLED));
+            if (isCancellation) {
+                const result = buildCancelledRunResult(runtime, durationMs, finishTime.toISOString(), err.message, deps.artifactStore);
+                if (deps.eventSink) {
+                    deps.eventSink.emit("workflow.cancelled", {
+                        status: "cancelled",
+                        durationMs,
+                        reason: err.message || "Workflow cancelled"
+                    });
+                }
+                if (deps.artifactStore) {
+                    await deps.artifactStore.updateManifest("cancelled", result.error);
+                }
+                return result;
+            }
+            // Build failed run result
+            const result = buildFailedRunResult(runtime, err, durationMs, finishTime.toISOString(), deps.artifactStore);
+            if (deps.eventSink) {
+                deps.eventSink.emit("workflow.failed", {
+                    status: "failed",
+                    durationMs,
+                    error: result.error
+                });
+            }
+            if (deps.artifactStore) {
+                await deps.artifactStore.updateManifest("failed", result.error);
+            }
+            return result;
+        }
+    }
+}
+export async function executeWorkflowModule(runtime, invocationContext) {
+    let context;
+    try {
+        context = createSandboxContext(runtime);
+    }
+    catch (err) {
+        throw new OpenDynamicWorkflowError(ErrorCode.SECURITY_POLICY_VIOLATION, `Failed to create secure sandbox context: ${err.message}`, { cause: err });
+    }
+    const parsedWorkflow = invocationContext ? invocationContext.definition.parsedWorkflow : runtime.parsedWorkflow;
+    const body = parsedWorkflow.body;
+    const transformedBody = body.replace(/export\s+default\s+/, "__default = ");
+    const wrappedBody = `(async () => {\n${transformedBody}\n})()`;
+    try {
+        const promise = withToolTopLevelWindow(parsedWorkflow.sourcePath, () => vm.runInContext(wrappedBody, context, {
+            filename: parsedWorkflow.sourcePath,
+            lineOffset: -1
+        }));
+        await withToolTopLevelWindow(parsedWorkflow.sourcePath, async () => {
+            await promise;
+        });
+        const workflowFn = context.__default;
+        let result;
+        if (typeof workflowFn === "function") {
+            const dsl = createDsl(runtime);
+            const activeInvocation = getActiveWorkflowInvocation();
+            const args = activeInvocation ? activeInvocation.args : runtime.args;
+            const dslContext = {
+                ...dsl,
+                args: Object.freeze(cloneJsonObject(args, "workflow args")),
+                cwd: runtime.cwd,
+                runId: runtime.runId,
+                artifactsDir: runtime.artifactsDir,
+                signal: activeInvocation?.signal || runtime.abortController.signal
+            };
+            result = await withToolTopLevelWindow(parsedWorkflow.sourcePath, () => workflowFn(dslContext));
+        }
+        else {
+            result = workflowFn;
+        }
+        if (result === undefined)
+            return undefined;
+        if (result === null)
+            return null;
+        try {
+            return cloneJsonValue(result, "workflow result");
+        }
+        catch (err) {
+            throw new OpenDynamicWorkflowError(ErrorCode.WORKFLOW_RESULT_SERIALIZATION_FAILED, `Failed to serialize workflow result: ${err.message}`, { cause: err });
+        }
+    }
+    catch (err) {
+        // Check if it's already an OpenDynamicWorkflowError (e.g. from DSL)
+        // We check both instanceof and the presence of the 'code' property 
+        // to handle errors coming from the VM context.
+        if (err instanceof OpenDynamicWorkflowError || (err && typeof err === "object" && "code" in err && "name" in err && err.name === "OpenDynamicWorkflowError")) {
+            throw err;
+        }
+        // Map potential sandbox escapes or violations to SECURITY_POLICY_VIOLATION
+        const isSecurityViolation = err.name === "SecurityError";
+        if (isSecurityViolation) {
+            throw new OpenDynamicWorkflowError(ErrorCode.SECURITY_POLICY_VIOLATION, `Workflow execution violated security policy: ${err.message}`, { cause: err });
+        }
+        throw err;
+    }
+}
+export function buildSucceededRunResult(runtime, workflowResult, durationMs, finishedAt, artifactStore) {
+    const runArtifacts = artifactStore ? artifactStore.getRunArtifacts() : undefined;
+    const reportPath = runArtifacts?.reportPath || path.join(runtime.artifactsDir, "report.json");
+    const eventsPath = runArtifacts?.eventsPath || path.join(runtime.artifactsDir, "events.jsonl");
+    const result = {
+        schemaVersion: "open-dynamic-workflow.report.v1",
+        runId: runtime.runId,
+        status: "succeeded",
+        meta: runtime.parsedWorkflow.meta,
+        agents: runtime.agentResults,
+        pipelines: runtime.pipelineSummaries,
+        workflows: runtime.workflowSummaries,
+        tools: runtime.toolExecutor && runtime.toolExecutor.getSummaries().length > 0 ? [...runtime.toolExecutor.getSummaries()] : undefined,
+        startedAt: runtime.startedAt,
+        finishedAt,
+        durationMs,
+        artifactsDir: runtime.artifactsDir,
+        reportPath,
+        eventsPath
+    };
+    if (workflowResult !== undefined) {
+        result.result = workflowResult;
+    }
+    return result;
+}
+export function buildFailedRunResult(runtime, error, durationMs, finishedAt, artifactStore) {
+    const runArtifacts = artifactStore ? artifactStore.getRunArtifacts() : undefined;
+    const reportPath = runArtifacts?.reportPath || path.join(runtime.artifactsDir, "report.json");
+    const eventsPath = runArtifacts?.eventsPath || path.join(runtime.artifactsDir, "events.jsonl");
+    const serialized = serializeError(error);
+    const result = {
+        schemaVersion: "open-dynamic-workflow.report.v1",
+        runId: runtime.runId,
+        status: "failed",
+        meta: runtime.parsedWorkflow.meta,
+        agents: runtime.agentResults,
+        pipelines: runtime.pipelineSummaries,
+        workflows: runtime.workflowSummaries,
+        tools: runtime.toolExecutor && runtime.toolExecutor.getSummaries().length > 0 ? [...runtime.toolExecutor.getSummaries()] : undefined,
+        startedAt: runtime.startedAt,
+        finishedAt,
+        durationMs,
+        artifactsDir: runtime.artifactsDir,
+        reportPath,
+        eventsPath,
+        error: serialized
+    };
+    return result;
+}
+export function buildCancelledRunResult(runtime, durationMs, finishedAt, reason, artifactStore) {
+    const runArtifacts = artifactStore ? artifactStore.getRunArtifacts() : undefined;
+    const reportPath = runArtifacts?.reportPath || path.join(runtime.artifactsDir, "report.json");
+    const eventsPath = runArtifacts?.eventsPath || path.join(runtime.artifactsDir, "events.jsonl");
+    const errorPayload = {
+        name: "WorkflowCancelledError",
+        message: reason || "Workflow was cancelled",
+        code: "USER_CANCELLED"
+    };
+    const result = {
+        schemaVersion: "open-dynamic-workflow.report.v1",
+        runId: runtime.runId,
+        status: "cancelled",
+        meta: runtime.parsedWorkflow.meta,
+        agents: runtime.agentResults,
+        pipelines: runtime.pipelineSummaries,
+        workflows: runtime.workflowSummaries,
+        tools: runtime.toolExecutor && runtime.toolExecutor.getSummaries().length > 0 ? [...runtime.toolExecutor.getSummaries()] : undefined,
+        startedAt: runtime.startedAt,
+        finishedAt,
+        durationMs,
+        artifactsDir: runtime.artifactsDir,
+        reportPath,
+        eventsPath,
+        error: errorPayload
+    };
+    return result;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/workflow/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/workflow/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAQ9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAyB,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,EAAgC,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAqC3E,MAAM,OAAO,oBAAoB;IAC/B,KAAK,CAAC,GAAG,CACP,KAAsB,EACtB,IAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAEtF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAExH,MAAM,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAEpF,MAAM,SAAS,GAAG,IAAI,gBAAgB,CACpC;YACE,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC1D,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAC9B,CAAC;QAEF,MAAM,sBAAsB,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;YAC3C,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;YACxB,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,0BAA0B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAE5F,MAAM,OAAO,GAAiB;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,QAAQ;YAC1B,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAG,KAAK,CAAC,GAAG,CAAC,IAAY,IAAI,EAAE;YACnC,GAAG;YACH,YAAY;YACZ,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,EAAE;YACf,SAAS;YACT,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,sBAAsB;YACvC,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,SAAS;YACT,eAAe,EAAE,CAAC;YAClB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,EAAE;YACrB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAC1E,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC,mBAAmB;YAC1E,oBAAoB;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,WAAW,EAAE,CAAC;SACf,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,gCAAgC,CAAC;YAC7D,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAE9C,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;gBACjC,KAAK;gBACL,MAAM,EAAE,YAAY;gBACpB,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU;gBAC7C,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE;gBACrD,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU;gBAC7C,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,0BAA0B,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO;gBACxE,GAAG;gBACH,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;aACpC,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;gBAC3F,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC1C,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;oBAC5F,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,uBAAuB,CAAC,CAAC;gBAChF,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBACvC,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;gBACvD,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,UAAU;gBAC7C,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI;gBACzC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;gBACjD,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,oBAAoB;gBACjE,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,eAAe;aACxD,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBACtC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI;gBAC/B,GAAG;gBACH,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,IAAI,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1C,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,IAAI,8CAA8C,CAAC,CAAC,CAAC;YACnK,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;gBACjD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,oBAAoB,EAAE,OAAO,CAAC,KAAK;gBACnC,QAAQ,EAAE,oBAAoB;gBAC9B,WAAW,EAAE,IAAI;gBACjB,cAAc,EAAE,KAAK;aACtB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,CACpC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAChD,OAAO,CAAC,IAAI,CACb,CAAC,CAAC;YAEH,gDAAgD;YAChD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAExB,gCAAgC;YAChC,MAAM,iBAAiB,GAAI,SAAiB,CAAC,WAAW,EAAE,CAAC;YAC3D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC;gBAClD,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,KAAK,WAAW,CAAC;gBACrD,MAAM,SAAS,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC;gBAEvF,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACzB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,IAAI,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;wBACvH,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrD,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;oBAC9D,wCAAwC;oBACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7H,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE;4BACrC,MAAM,EAAE,QAAQ;4BAChB,UAAU;4BACV,KAAK,EAAE,MAAM,CAAC,KAAM;yBACrB,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACzB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,SAAS,IAAI,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;wBACpI,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrD,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;oBAC9D,6BAA6B;oBAC7B,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;oBACrH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE;4BACxC,MAAM,EAAE,WAAW;4BACnB,UAAU;4BACV,MAAM,EAAE,SAAS,IAAI,oBAAoB;yBAC1C,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrE,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YAE9D,6BAA6B;YAC7B,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1H,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACxC,MAAM,EAAE,WAAW;oBACnB,UAAU;oBACV,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,CAAC;QAEhB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,SAAS,GAAiC,OAAO,CAAC;YACtD,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC7C,SAAS,GAAG,SAAS,CAAC;YACxB,CAAC;iBAAM,IACL,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,kBAAkB;gBAC1C,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc;gBACtC,GAAG,EAAE,IAAI,KAAK,YAAY;gBAC1B,GAAG,EAAE,IAAI,KAAK,wBAAwB;gBACtC,CAAC,GAAG,EAAE,IAAI,KAAK,0BAA0B,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,kBAAkB,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc,CAAC,CAAC,EACpI,CAAC;gBACD,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;YAED,SAAS,CAAC,KAAK,CAAC;gBACd,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;aACzC,CAAC,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAExC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACjD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YAE9D,MAAM,cAAc,GAAG,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,kBAAkB;gBAC1C,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc;gBACtC,GAAG,EAAE,IAAI,KAAK,YAAY;gBAC1B,GAAG,EAAE,IAAI,KAAK,wBAAwB;gBACtC,CAAC,GAAG,EAAE,IAAI,KAAK,0BAA0B,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,kBAAkB,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;YAE5J,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;gBACvH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE;wBACxC,MAAM,EAAE,WAAW;wBACnB,UAAU;wBACV,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,oBAAoB;qBAC5C,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACvB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrE,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,0BAA0B;YAC1B,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5G,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,UAAU;oBACV,KAAK,EAAE,MAAM,CAAC,KAAM;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAqB,EAAE,iBAA6C;IAC9G,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,wBAAwB,CAChC,SAAS,CAAC,yBAAyB,EACnC,4CAA4C,GAAG,CAAC,OAAO,EAAE,EACzD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAChH,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,mBAAmB,eAAe,QAAQ,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,EAAE;YAC5G,QAAQ,EAAE,cAAc,CAAC,UAAU;YACnC,UAAU,EAAE,CAAC,CAAC;SACf,CAAC,CAAC,CAAC;QAEJ,MAAM,sBAAsB,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAI,OAAe,CAAC,SAAS,CAAC;QAC9C,IAAI,MAAe,CAAC;QACpB,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,gBAAgB,GAAG,2BAA2B,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAErE,MAAM,UAAU,GAAG;gBACjB,GAAG,GAAG;gBACN,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,gBAAgB,EAAE,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM;aACnE,CAAC;YACF,MAAM,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC;QAED,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,wBAAwB,CAChC,SAAS,CAAC,oCAAoC,EAC9C,wCAAwC,GAAG,CAAC,OAAO,EAAE,EACrD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,oEAAoE;QACpE,oEAAoE;QACpE,+CAA+C;QAC/C,IAAI,GAAG,YAAY,wBAAwB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,0BAA0B,CAAC,EAAE,CAAC;YAC7J,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,2EAA2E;QAC3E,MAAM,mBAAmB,GAAG,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC;QAEzD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,IAAI,wBAAwB,CAChC,SAAS,CAAC,yBAAyB,EACnC,gDAAgD,GAAG,CAAC,OAAO,EAAE,EAC7D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAqB,EACrB,cAAuB,EACvB,UAAkB,EAClB,UAAkB,EAClB,aAA6B;IAE7B,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAE/F,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,iCAAiC;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI;QACjC,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpI,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU;QACV,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU;QACV,UAAU;KACX,CAAC;IAEF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC;IACjC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,KAAc,EACd,UAAkB,EAClB,UAAkB,EAClB,aAA6B;IAE7B,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAE/F,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,iCAAiC;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI;QACjC,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpI,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU;QACV,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU;QACV,UAAU;QACV,KAAK,EAAE,UAAU;KAClB,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAqB,EACrB,UAAkB,EAClB,UAAkB,EAClB,MAAe,EACf,aAA6B;IAE7B,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAE/F,MAAM,YAAY,GAAG;QACnB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,MAAM,IAAI,wBAAwB;QAC3C,IAAI,EAAE,gBAAgB;KACvB,CAAC;IAEF,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,iCAAiC;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI;QACjC,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,SAAS,EAAE,OAAO,CAAC,iBAAiB;QACpC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpI,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU;QACV,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU;QACV,UAAU;QACV,KAAK,EAAE,YAAY;KACpB,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow/sandbox.d.ts

@@ -0,0 +1,14 @@
+import * as vm from "node:vm";
+import type { RuntimeState } from "./types.js";
+/**
+ * Creates a restricted sandbox context for running a workflow.
+ *
+ * Safety model:
+ * 1. We use a fresh VM context which provides its own globals (Object, Array, etc.)
+ *    that are distinct from the host's versions. This prevents simple prototype
+ *    pollution and constructor.constructor escapes back to host Function.
+ * 2. We only expose safe, necessary DSL functions and data.
+ * 3. We do not provide host-level modules like 'fs' or 'process'.
+ * 4. The sandbox object itself is frozen after setup to prevent modifications to the global scope.
+ */
+export declare function createSandboxContext(runtime: RuntimeState): vm.Context;

package/dist/workflow/sandbox.js

@@ -0,0 +1,79 @@
+import * as vm from "node:vm";
+import { createDsl } from "./dsl.js";
+import { getActiveWorkflowInvocation } from "./invocation-types.js";
+import { cloneJsonObject } from "./json.js";
+import { withToolForbidden } from "./scope.js";
+/**
+ * Creates a restricted sandbox context for running a workflow.
+ *
+ * Safety model:
+ * 1. We use a fresh VM context which provides its own globals (Object, Array, etc.)
+ *    that are distinct from the host's versions. This prevents simple prototype
+ *    pollution and constructor.constructor escapes back to host Function.
+ * 2. We only expose safe, necessary DSL functions and data.
+ * 3. We do not provide host-level modules like 'fs' or 'process'.
+ * 4. The sandbox object itself is frozen after setup to prevent modifications to the global scope.
+ */
+export function createSandboxContext(runtime) {
+    const dsl = createDsl(runtime);
+    const activeInvocation = getActiveWorkflowInvocation();
+    const args = activeInvocation ? activeInvocation.args : runtime.args;
+    // Use a clean object for the sandbox global scope
+    const sandbox = Object.create(null);
+    // Wrap Promise to forbid tool calls in callbacks
+    const OriginalPromise = Promise;
+    class WrappedPromise extends OriginalPromise {
+        then(onfulfilled, onrejected) {
+            const wrappedOnFulfilled = onfulfilled
+                ? (value) => withToolForbidden("asynchronous-callback", () => onfulfilled(value))
+                : undefined;
+            const wrappedOnRejected = onrejected
+                ? (reason) => withToolForbidden("asynchronous-callback", () => onrejected(reason))
+                : undefined;
+            return super.then(wrappedOnFulfilled, wrappedOnRejected);
+        }
+        catch(onrejected) {
+            const wrappedOnRejected = onrejected
+                ? (reason) => withToolForbidden("asynchronous-callback", () => onrejected(reason))
+                : undefined;
+            return super.catch(wrappedOnRejected);
+        }
+        finally(onfinally) {
+            const wrappedOnFinally = onfinally
+                ? () => withToolForbidden("asynchronous-callback", () => onfinally())
+                : undefined;
+            return super.finally(wrappedOnFinally);
+        }
+    }
+    // Define properties on the sandbox
+    // We keep them writable: false where possible, but __default must be writable
+    Object.defineProperties(sandbox, {
+        agent: { value: dsl.agent, enumerable: true, configurable: false, writable: false },
+        tool: { value: dsl.tool, enumerable: true, configurable: false, writable: false },
+        parallel: { value: dsl.parallel, enumerable: true, configurable: false, writable: false },
+        phase: { value: dsl.phase, enumerable: true, configurable: false, writable: false },
+        log: { value: dsl.log, enumerable: true, configurable: false, writable: false },
+        pipeline: { value: dsl.pipeline, enumerable: true, configurable: false, writable: false },
+        workflow: { value: dsl.workflow, enumerable: true, configurable: false, writable: false },
+        args: { value: Object.freeze(cloneJsonObject(args, "workflow args")), enumerable: true, configurable: false, writable: false },
+        cwd: { value: runtime.cwd, enumerable: true, configurable: false, writable: false },
+        runId: { value: runtime.runId, enumerable: true, configurable: false, writable: false },
+        artifactsDir: { value: runtime.artifactsDir, enumerable: true, configurable: false, writable: false },
+        setTimeout: {
+            value: (fn, ms, ...args) => {
+                if (typeof fn !== "function") {
+                    return setTimeout(fn, ms, ...args);
+                }
+                return setTimeout(() => withToolForbidden("asynchronous-callback", () => fn(...args)), ms);
+            },
+            enumerable: true, configurable: false, writable: false
+        },
+        clearTimeout: { value: clearTimeout, enumerable: true, configurable: false, writable: false },
+        Promise: { value: WrappedPromise, enumerable: true, configurable: false, writable: false },
+        // Placeholder for the default export capture. 
+        __default: { value: undefined, enumerable: false, configurable: false, writable: true }
+    });
+    const context = vm.createContext(sandbox);
+    return context;
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/workflow/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/workflow/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,gBAAgB,GAAG,2BAA2B,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAErE,kDAAkD;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEpC,iDAAiD;IACjD,MAAM,eAAe,GAAG,OAAO,CAAC;IAChC,MAAM,cAAkB,SAAQ,eAAkB;QACvC,IAAI,CACX,WAAiF,EACjF,UAAmF;YAEnF,MAAM,kBAAkB,GAAG,WAAW;gBACpC,CAAC,CAAC,CAAC,KAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACpF,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,iBAAiB,GAAG,UAAU;gBAClC,CAAC,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACvF,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAyB,EAAE,iBAAwB,CAAC,CAAC;QACzE,CAAC;QAEQ,KAAK,CACZ,UAAiF;YAEjF,MAAM,iBAAiB,GAAG,UAAU;gBAClC,CAAC,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACvF,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,KAAK,CAAC,KAAK,CAAC,iBAAwB,CAAC,CAAC;QAC/C,CAAC;QAEQ,OAAO,CAAC,SAA2C;YAC1D,MAAM,gBAAgB,GAAG,SAAS;gBAChC,CAAC,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;gBACrE,CAAC,CAAC,SAAS,CAAC;YACd,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;KACF;IAED,mCAAmC;IACnC,8EAA8E;IAC9E,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE;QAC/B,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACnF,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACjF,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzF,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACnF,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC/E,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzF,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzF,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC9H,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACnF,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrG,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,EAAO,EAAE,EAAW,EAAE,GAAG,IAAW,EAAE,EAAE;gBAC9C,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;oBAC7B,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;SACvD;QACD,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC7F,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QAE1F,+CAA+C;QAC/C,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;KACxF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAE1C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/workflow/scope.d.ts

@@ -0,0 +1,18 @@
+import { type WorkflowInvocationContext } from "./invocation-types.js";
+export type DslExecutionLocation = "workflow-top-level" | "parallel-task" | "pipeline-stage" | "shared-agent-definition" | "tool-definition" | "provider-callback" | "asynchronous-callback";
+export interface DslExecutionScope {
+    runId: string;
+    workflowInvocationId: string;
+    parentWorkflowInvocationId?: string | undefined;
+    location: DslExecutionLocation;
+    toolAllowed: boolean;
+    topLevelWindow: boolean;
+    sourcePath?: string | undefined;
+    inheritedToolRestriction?: DslExecutionLocation | undefined;
+}
+export declare function withDslExecutionScope<T>(scope: DslExecutionScope, fn: () => T): T;
+export declare function withToolTopLevelWindow<T>(sourcePath: string | undefined, fn: () => T): T;
+export declare function getDslExecutionScope(): DslExecutionScope | undefined;
+export declare function assertToolAllowed(): DslExecutionScope;
+export declare function deriveChildWorkflowToolScope(parentScope: DslExecutionScope | undefined, childInvocation: WorkflowInvocationContext): DslExecutionScope;
+export declare function withToolForbidden<T>(location: DslExecutionLocation, fn: () => T): T;