@usine/cloudflare 0.0.0-stage → 0.1.0

package/dist/sandbox/sandbox.js

@@ -0,0 +1,387 @@
+import { CloudflareImageName } from "@usine/core/worker";
+import { DateTime, Duration, Effect, Layer, Option, Schema, Semaphore } from "effect";
+import { HttpServer } from "effect/http";
+import { HttpApi, HttpApiBuilder } from "effect/http-api";
+import { ContainerUnavailable, Destroyed, HealthReport, healthGroup, ImageNotFound, ProcessExited, ProcessNotFound, ProcessRunning, ProcessStatus, SANDBOX_PROTOCOL, SandboxConflict, sandboxGroup, SandboxNotFound, StaleCredentials, Stopped, } from "../api/api.js";
+import { DRAIN_MARKER } from "../api/harness.js";
+import { interceptionsFor } from "./outbound.js";
+import { ContainerFailure, SandboxContainer, SandboxDirectory, SandboxSettings, SandboxStorage, StoredSandbox, } from "./ports.js";
+import { exitCodeOf, pidOf, processFiles, stopCommand, stoppedCount } from "./process.js";
+/** How long the keepalive alarm keeps a container running after the last create, renewal, or command. */
+export const LEASE = Duration.hours(2);
+/** The interval of the keepalive alarm. */
+const KEEPALIVE_INTERVAL = Duration.minutes(4);
+/** The time without a request after which the platform stops the container. */
+const INACTIVITY_TIMEOUT = Duration.minutes(10);
+const decoder = new TextDecoder();
+const unavailable = (name) => (failure) => new ContainerUnavailable({ name, message: `${failure.operation}: ${failure.message}` });
+/** Returns the bytes of `stream`, or none if it's `null`. */
+const readAll = async (stream) => stream === null ? new Uint8Array() : new Uint8Array(await new Response(stream).arrayBuffer());
+/** Waits for `process` to exit and returns its output bytes, unchanged, and exit code. */
+export const collectBytes = (process) => Effect.tryPromise({
+    try: () => Promise.all([readAll(process.stdout), readAll(process.stderr), process.exitCode]),
+    catch: (cause) => new ContainerFailure({
+        operation: "exec",
+        message: cause instanceof Error ? cause.message : String(cause),
+    }),
+}).pipe(Effect.map(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode })));
+/** Waits for `process` to exit and returns its output as UTF-8 text, and exit code. */
+const collect = (process) => collectBytes(process).pipe(Effect.map(({ stdout, stderr, exitCode }) => ({
+    stdout: decoder.decode(stdout),
+    stderr: decoder.decode(stderr),
+    exitCode,
+})));
+/**
+ * Returns `sandbox`'s summary as its container is now. A drain marker that can't be read is
+ * logged and reported as no drain; the executor asks again.
+ */
+const summarize = Effect.fn("Sandbox.summarize")(function* (sandbox) {
+    const container = yield* SandboxContainer;
+    const running = yield* container.running;
+    if (!running)
+        return sandbox.summary(false, false);
+    const draining = yield* container.size(DRAIN_MARKER).pipe(Effect.map(Option.isSome), Effect.tapError((failure) => Effect.logWarning("Could not read the sandbox's drain marker", {
+        sandbox: sandbox.name,
+        operation: failure.operation,
+        message: failure.message,
+    })), Effect.orElseSucceed(() => false));
+    if (draining)
+        yield* Effect.logWarning("The platform is stopping the sandbox's container, which loses its disk", { sandbox: sandbox.name, attempt: sandbox.attempt });
+    return sandbox.summary(true, draining);
+});
+/** Returns the stored sandbox, or fails with `SandboxNotFound`. */
+const stored = Effect.fn("Sandbox.stored")(function* (name) {
+    const storage = yield* SandboxStorage;
+    const found = yield* storage.load;
+    if (Option.isNone(found))
+        return yield* new SandboxNotFound({ name });
+    return found.value;
+});
+/** Returns the stored sandbox if its container runs, or fails with `ContainerUnavailable`. */
+export const runningSandboxFor = Effect.fn("Sandbox.running")(function* (name) {
+    const sandbox = yield* stored(name);
+    const container = yield* SandboxContainer;
+    if (!(yield* container.running))
+        return yield* new ContainerUnavailable({
+            name,
+            message: "The container isn't running, so its disk is gone",
+        });
+    return sandbox;
+});
+/** Sends the container's traffic for GitHub, the providers, and the allowlisted hosts to the outbound handlers. */
+const intercept = Effect.fn("Sandbox.intercept")(function* (name, credentials) {
+    const container = yield* SandboxContainer;
+    const { allowedHosts } = yield* SandboxSettings;
+    const interceptions = interceptionsFor(credentials, allowedHosts);
+    yield* Effect.forEach(interceptions, container.intercept, { discard: true });
+    yield* Effect.logInfo("Registered the sandbox's outbound handlers", {
+        sandbox: name,
+        hosts: interceptions.map(({ _tag, host }) => `${_tag}:${host}`).join(","),
+    });
+});
+/** Fails with `StaleCredentials` if `sandbox` holds credentials issued after `credentials`. */
+const refuseStale = Effect.fn("Sandbox.refuseStale")(function* (sandbox, credentials) {
+    const current = sandbox.credentials.issuedAt;
+    if (!DateTime.isLessThan(credentials.issuedAt, current))
+        return;
+    yield* Effect.logWarning("Refused credentials issued before the ones the sandbox holds", {
+        sandbox: sandbox.name,
+        attempt: sandbox.attempt,
+        issuedAt: DateTime.formatIso(credentials.issuedAt),
+        current: DateTime.formatIso(current),
+    });
+    return yield* new StaleCredentials({
+        name: sandbox.name,
+        issuedAt: credentials.issuedAt,
+        current,
+    });
+});
+/**
+ * Applies `change` to the sandbox as it's stored now, saves the result, and returns it, or fails
+ * with `SandboxNotFound` if the sandbox was destroyed.
+ */
+const updateStored = Effect.fn("Sandbox.updateStored")(function* (name, change) {
+    const storage = yield* SandboxStorage;
+    const updated = yield* storage.modify((stored) => {
+        const changed = Option.map(stored, change);
+        return [changed, changed];
+    });
+    if (Option.isNone(updated))
+        return yield* new SandboxNotFound({ name });
+    return updated.value;
+});
+/**
+ * Extends the sandbox's lease from now and returns the stored sandbox, or fails with
+ * `SandboxNotFound` if it was destroyed.
+ */
+export const extendLease = Effect.fn("Sandbox.extendLease")(function* (name) {
+    const now = yield* DateTime.now;
+    return yield* updateStored(name, (sandbox) => new StoredSandbox({ ...sandbox, leaseUntil: DateTime.addDuration(now, LEASE) }));
+});
+const create = Effect.fn("Sandbox.create")(function* (name, request) {
+    const fields = {
+        sandbox: name,
+        owner: request.owner,
+        attempt: request.attempt,
+        image: request.image,
+        instanceType: request.instanceType,
+    };
+    yield* Effect.annotateCurrentSpan(fields);
+    const container = yield* SandboxContainer;
+    const storage = yield* SandboxStorage;
+    const directory = yield* SandboxDirectory;
+    const existing = yield* storage.load;
+    if (Option.isSome(existing) &&
+        (existing.value.owner !== request.owner || existing.value.attempt !== request.attempt)) {
+        yield* Effect.logWarning("Refused a sandbox that exists for another Attempt", {
+            ...fields,
+            existingOwner: existing.value.owner,
+            existingAttempt: existing.value.attempt,
+        });
+        return yield* new SandboxConflict({
+            name,
+            owner: existing.value.owner,
+            attempt: existing.value.attempt,
+        });
+    }
+    if (Option.isSome(existing))
+        yield* refuseStale(existing.value, request.credentials);
+    const images = yield* container.images;
+    const image = images[request.image];
+    if (image === undefined) {
+        yield* Effect.logWarning("Refused a sandbox for an image the Worker doesn't have", {
+            ...fields,
+            images: Object.keys(images).join(","),
+        });
+        return yield* new ImageNotFound({ image: request.image, images: Object.keys(images) });
+    }
+    const now = yield* DateTime.now;
+    const wasRunning = yield* container.running;
+    if (!wasRunning)
+        yield* container.start(image, request.instanceType).pipe(Effect.mapError(unavailable(name)));
+    yield* container.keepAlive(INACTIVITY_TIMEOUT).pipe(Effect.mapError(unavailable(name)));
+    yield* intercept(name, request.credentials).pipe(Effect.mapError(unavailable(name)));
+    // Reads the stored sandbox again: a hold may have arrived while the container started.
+    const sandbox = yield* storage.modify((current) => {
+        const created = new StoredSandbox({
+            name,
+            owner: request.owner,
+            attempt: request.attempt,
+            image: request.image,
+            instanceType: request.instanceType,
+            createdAt: Option.match(current, { onNone: () => now, onSome: ({ createdAt }) => createdAt }),
+            leaseUntil: DateTime.addDuration(now, LEASE),
+            // A hold lasts until the sandbox is destroyed, through a reattachment.
+            held: Option.exists(current, ({ held }) => held),
+            credentials: request.credentials,
+        });
+        return [created, Option.some(created)];
+    });
+    yield* storage.alarmAt(DateTime.addDuration(now, KEEPALIVE_INTERVAL));
+    const summary = yield* summarize(sandbox);
+    yield* directory.record(summary);
+    yield* Effect.logInfo(Option.isNone(existing)
+        ? "Created the Attempt's sandbox"
+        : wasRunning
+            ? "The Attempt's sandbox already runs; renewed its credentials"
+            : "Restarted the Attempt's sandbox, whose container had stopped", fields);
+    return summary;
+});
+const get = Effect.fn("Sandbox.get")(function* (name) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    return yield* summarize(yield* stored(name));
+});
+const credentials = Effect.fn("Sandbox.credentials")(function* (name, renewed) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    const sandbox = yield* runningSandboxFor(name);
+    yield* refuseStale(sandbox, renewed);
+    yield* intercept(name, renewed).pipe(Effect.mapError(unavailable(name)));
+    const now = yield* DateTime.now;
+    const extended = yield* updateStored(name, (current) => new StoredSandbox({
+        ...current,
+        leaseUntil: DateTime.addDuration(now, LEASE),
+        credentials: renewed,
+    }));
+    yield* Effect.logInfo("Renewed the sandbox's credentials", {
+        sandbox: name,
+        attempt: sandbox.attempt,
+        issuedAt: DateTime.formatIso(renewed.issuedAt),
+        github: Option.isSome(renewed.github),
+        providers: renewed.providers.map(({ provider }) => provider).join(","),
+        leaseUntil: DateTime.formatIso(extended.leaseUntil),
+    });
+    return yield* summarize(extended);
+});
+/**
+ * Holds the sandbox: the keepalive alarm keeps its container running past the lease, until the
+ * sandbox is destroyed. usine holds a sandbox whose checkout it keeps, so that the checkout
+ * survives until usine reconciles it.
+ */
+const hold = Effect.fn("Sandbox.hold")(function* (name) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    const sandbox = yield* runningSandboxFor(name);
+    const storage = yield* SandboxStorage;
+    const now = yield* DateTime.now;
+    const held = yield* updateStored(name, (current) => new StoredSandbox({ ...current, held: true }));
+    yield* storage.alarmAt(DateTime.addDuration(now, KEEPALIVE_INTERVAL));
+    yield* Effect.logInfo(sandbox.held
+        ? "The sandbox was already held"
+        : "Holding the sandbox until usine reconciles or destroys it", { sandbox: name, attempt: sandbox.attempt });
+    return yield* summarize(held);
+});
+const stop = Effect.fn("Sandbox.stop")(function* (name) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    const sandbox = yield* stored(name);
+    const container = yield* SandboxContainer;
+    if (!(yield* container.running)) {
+        yield* Effect.logInfo("The sandbox's container isn't running; no command to stop", {
+            sandbox: name,
+        });
+        return new Stopped({ stopped: 0 });
+    }
+    const process = yield* container
+        .exec(stopCommand, "closed")
+        .pipe(Effect.mapError(unavailable(name)));
+    const result = yield* collect(process).pipe(Effect.mapError(unavailable(name)));
+    const count = stoppedCount(result.stdout);
+    if (result.exitCode !== 0 || Option.isNone(count)) {
+        const message = `The stop script exited with code ${String(result.exitCode)}: ${result.stderr.trim()}`;
+        yield* Effect.logError("Could not stop the sandbox's commands", {
+            sandbox: name,
+            attempt: sandbox.attempt,
+            message,
+        });
+        return yield* new ContainerUnavailable({ name, message });
+    }
+    yield* Effect.logInfo("Stopped the sandbox's commands", {
+        sandbox: name,
+        attempt: sandbox.attempt,
+        stopped: count.value,
+    });
+    return new Stopped({ stopped: count.value });
+});
+const destroy = Effect.fn("Sandbox.destroy")(function* (name) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    const container = yield* SandboxContainer;
+    const storage = yield* SandboxStorage;
+    const directory = yield* SandboxDirectory;
+    const existing = yield* storage.load;
+    if (yield* container.running)
+        yield* container.destroy.pipe(Effect.mapError(unavailable(name)));
+    yield* storage.clear;
+    yield* directory.forget(name);
+    yield* Effect.logInfo(Option.isSome(existing) ? "Destroyed the sandbox" : "No sandbox to destroy", {
+        sandbox: name,
+        attempt: Option.getOrUndefined(Option.map(existing, ({ attempt }) => attempt)),
+    });
+    return new Destroyed({ destroyed: Option.isSome(existing) });
+});
+const processStatus = Effect.fn("Sandbox.process")(function* (name, process) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name, process });
+    yield* runningSandboxFor(name);
+    const container = yield* SandboxContainer;
+    const files = processFiles(process);
+    const read = (path) => container
+        .read(path)
+        .pipe(Effect.mapError(unavailable(name)), Effect.map(Option.map((bytes) => decoder.decode(bytes))));
+    const pid = Option.flatMap(yield* read(files.pid), pidOf);
+    if (Option.isNone(pid))
+        return yield* new ProcessNotFound({ name, process });
+    const exitCode = Option.flatMap(yield* read(files.exit), exitCodeOf);
+    const size = (path) => container
+        .size(path)
+        .pipe(Effect.mapError(unavailable(name)), Effect.map(Option.getOrElse(() => 0)));
+    return new ProcessStatus({
+        process,
+        pid: pid.value,
+        state: Option.match(exitCode, {
+            onNone: () => new ProcessRunning(),
+            onSome: (code) => new ProcessExited({ exitCode: code }),
+        }),
+        stdoutBytes: yield* size(files.stdout),
+        stderrBytes: yield* size(files.stderr),
+    });
+});
+const isImageName = Schema.is(CloudflareImageName);
+const health = Effect.fn("Sandbox.health")(function* () {
+    const container = yield* SandboxContainer;
+    const images = Object.keys(yield* container.images).filter(isImageName);
+    return new HealthReport({ protocol: SANDBOX_PROTOCOL, images });
+});
+/**
+ * Keeps the container running while the sandbox's lease lasts or usine holds it, then lets the
+ * platform stop it after `INACTIVITY_TIMEOUT`. Runs from the Durable Object's alarm, and sets the
+ * next one.
+ */
+export const keepAlive = Effect.fn("Sandbox.keepAlive")(function* () {
+    const storage = yield* SandboxStorage;
+    const container = yield* SandboxContainer;
+    const found = yield* storage.load;
+    if (Option.isNone(found)) {
+        yield* Effect.logDebug("The keepalive alarm found no sandbox; it isn't set again");
+        return;
+    }
+    const sandbox = found.value;
+    const fields = { sandbox: sandbox.name, attempt: sandbox.attempt };
+    const now = yield* DateTime.now;
+    if (!sandbox.held && DateTime.isGreaterThan(now, sandbox.leaseUntil)) {
+        yield* Effect.logWarning("The sandbox's lease expired without a request from usine; the platform stops its container after the inactivity timeout", { ...fields, leaseUntil: DateTime.formatIso(sandbox.leaseUntil) });
+        return;
+    }
+    if (!(yield* container.running)) {
+        yield* Effect.logInfo("The sandbox's container stopped; the keepalive alarm ends", fields);
+        return;
+    }
+    yield* container.keepAlive(INACTIVITY_TIMEOUT).pipe(Effect.tapError((failure) => Effect.logWarning("Could not renew the container's inactivity timeout", {
+        ...fields,
+        operation: failure.operation,
+        message: failure.message,
+    })), Effect.ignore);
+    yield* storage.alarmAt(DateTime.addDuration(now, KEEPALIVE_INTERVAL));
+});
+/**
+ * Registers the outbound handlers and sets the inactivity timeout again after the Durable Object
+ * restarts while its container runs, since the platform resets both for each instance. Does
+ * nothing for a sandbox without a running container.
+ */
+export const restore = Effect.fn("Sandbox.restore")(function* () {
+    const storage = yield* SandboxStorage;
+    const container = yield* SandboxContainer;
+    const found = yield* storage.load;
+    if (Option.isNone(found) || !(yield* container.running))
+        return;
+    const fields = { sandbox: found.value.name, attempt: found.value.attempt };
+    yield* container.keepAlive(INACTIVITY_TIMEOUT).pipe(Effect.tapError((failure) => Effect.logError("Could not set the container's inactivity timeout again", {
+        ...fields,
+        operation: failure.operation,
+        message: failure.message,
+    })), Effect.ignore);
+    yield* intercept(found.value.name, found.value.credentials).pipe(Effect.tapError((failure) => Effect.logError("Could not register the sandbox's outbound handlers again", {
+        ...fields,
+        operation: failure.operation,
+        message: failure.message,
+    })), Effect.ignore);
+    yield* Effect.logInfo("Restored the running sandbox after its Durable Object restarted", fields);
+});
+const SandboxServedApi = HttpApi.make("SandboxApi").add(healthGroup, sandboxGroup);
+const healthHandlers = HttpApiBuilder.group(SandboxServedApi, "health", (routes) => routes.handle("health", () => health()));
+const sandboxHandlers = HttpApiBuilder.group(SandboxServedApi, "sandbox", (routes) => Effect.gen(function* () {
+    // A create or credential change registers handlers, then stores their credentials. One runs
+    // at a time, so another change's handlers never replace them in between.
+    const credentialChanges = yield* Semaphore.make(1);
+    const oneAtATime = credentialChanges.withPermits(1);
+    return routes
+        .handle("create", ({ params, payload }) => oneAtATime(create(params.name, payload)))
+        .handle("get", ({ params }) => get(params.name))
+        .handle("credentials", ({ params, payload }) => oneAtATime(credentials(params.name, payload)))
+        .handle("hold", ({ params }) => hold(params.name))
+        .handle("stop", ({ params }) => stop(params.name))
+        .handle("destroy", ({ params }) => destroy(params.name))
+        .handle("process", ({ params }) => processStatus(params.name, params.process));
+}));
+/**
+ * The health and sandbox routes of `SandboxApi`, served by each sandbox's Durable Object. Requires
+ * `SandboxContainer`, `SandboxStorage`, `SandboxDirectory`, and `SandboxSettings`.
+ */
+export const sandboxRoutes = HttpApiBuilder.layer(SandboxServedApi).pipe(Layer.provide([healthHandlers, sandboxHandlers]), Layer.provide(HttpServer.layerServices));
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/sandbox/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EAEpB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EAEb,aAAa,EACb,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAEhB,eAAe,EACf,YAAY,EAEZ,eAAe,EACf,gBAAgB,EAChB,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,gBAAgB,EAEhB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE1F,yGAAyG;AACzG,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvC,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/C,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEhD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,WAAW,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,CAAC,OAAyB,EAAE,EAAE,CACvE,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAE1F,6DAA6D;AAC7D,MAAM,OAAO,GAAG,KAAK,EAAE,MAAyC,EAAuB,EAAE,CACvF,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEhG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAyB,EAAE,EAAE,CACxD,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5F,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,gBAAgB,CAAC;QACnB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAChE,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAEtF,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC5C,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9B,QAAQ;CACT,CAAC,CAAC,CACJ,CAAC;AAEJ;;;GAGG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAsB;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,MAAM,CAAC,UAAU,CAAC,2CAA2C,EAAE;QAC7D,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CACH,EACD,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAClC,CAAC;IACF,IAAI,QAAQ;QACV,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,wEAAwE,EACxE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CACpD,CAAC;IACJ,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC;YACrC,IAAI;YACJ,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAC;IACL,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,mHAAmH;AACnH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EACxD,IAAiB,EACjB,WAA+B;IAE/B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IAChD,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAClE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,EAAE;QAClE,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAC5D,OAAsB,EACtB,WAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,OAAO;IAChE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,8DAA8D,EAAE;QACvF,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC;QAClD,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;QACjC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAC9D,IAAiB,EACjB,MAAiD;IAEjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,IAAI,EACJ,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAC7F,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB,EAAE,OAAsB;IAC7F,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,IACE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACvB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EACtF,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mDAAmD,EAAE;YAC5E,GAAG,MAAM;YACT,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;YACnC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;SACxC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;YAC3B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;SAChC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,wDAAwD,EAAE;YACjF,GAAG,MAAM;YACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IAC5C,IAAI,CAAC,UAAU;QACb,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,uFAAuF;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,IAAI;YACJ,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC7F,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;YAC5C,uEAAuE;YACvE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAU,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,8DAA8D,EACpE,MAAM,CACP,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IAC/D,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,EAC5D,IAAiB,EACjB,OAA2B;IAE3B,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAClC,IAAI,EACJ,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,aAAa,CAAC;QAChB,GAAG,OAAO;QACV,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;QAC5C,WAAW,EAAE,OAAO;KACrB,CAAC,CACL,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE;QACzD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACjE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAC9B,IAAI,EACJ,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC3D,CAAC;IACF,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,CAAC,IAAI;QACV,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,2DAA2D,EAC/D,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAC5C,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACjE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS;SAC7B,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,oCAAoC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACvG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,EAAE;YAC9D,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QACtD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,KAAK,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAiB;IACvE,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO;QAAE,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,EAC3E;QACE,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;KAC/E,CACF,CAAC;IACF,OAAO,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAC1D,IAAiB,EACjB,OAAkB;IAElB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,SAAS;SACN,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACzD,CAAC;IACN,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,SAAS;SACN,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,IAAI,aAAa,CAAC;QACvB,OAAO;QACP,GAAG,EAAE,GAAG,CAAC,KAAK;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE;YAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACxD,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;AAEnD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,OAAO,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CACtB,yHAAyH,EACzH,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAClE,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,2DAA2D,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,MAAM,CAAC,UAAU,CAAC,oDAAoD,EAAE;QACtE,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IACF,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO;IAChE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3E,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,wDAAwD,EAAE;QACxE,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IACF,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,0DAA0D,EAAE;QAC1E,GAAG,MAAM;QACT,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iEAAiE,EAAE,MAAM,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAEnF,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CACjF,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACnF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,4FAA4F;IAC5F,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,MAAM;SACV,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;SACnF,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;SAC7F,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACjD,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACjD,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACvD,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACtE,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,EAChD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CACxC,CAAC"}

package/dist/sandbox/stream.d.ts

@@ -0,0 +1,26 @@
+import { type Cause, Effect, Queue } from "effect";
+import { SandboxContainer } from "./ports.ts";
+/** A WebSocket that the Durable Object accepted. */
+export interface StreamSocket {
+    /** Sends a message. Does nothing once the socket is closed. */
+    readonly send: (message: string | Uint8Array) => Effect.Effect<void>;
+    readonly close: (code: number, reason: string) => Effect.Effect<void>;
+    /** The client's messages. Ends when the client closes the socket. */
+    readonly messages: Queue.Dequeue<string | Uint8Array, Cause.Done>;
+}
+/**
+ * Runs one command for the client on `socket`: the first message is `ExecStart`, then binary
+ * messages are its stdin, and the sandbox sends `Started`, the output as binary messages, and
+ * `Exited`. The command runs through `PROCESS_SCRIPT`, so it keeps running, and its output keeps
+ * going to its process files, if the client disconnects.
+ */
+export declare const execStream: (name: string & import("effect/Brand").Brand<"SandboxName">, socket: StreamSocket) => Effect.Effect<void, never, SandboxContainer | import("./ports.ts").SandboxStorage>;
+/**
+ * Streams a command's output from its process files, after the bytes in `offsets`, then its exit
+ * code, for a client whose exec stream was cut. Nothing reaches the command's stdin.
+ */
+export declare const attachStream: (name: string & import("effect/Brand").Brand<"SandboxName">, process: string & import("effect/Brand").Brand<"ProcessId">, offsets: {
+    readonly stdout: number;
+    readonly stderr: number;
+}, socket: StreamSocket) => Effect.Effect<void, never, SandboxContainer | import("./ports.ts").SandboxStorage>;
+//# sourceMappingURL=stream.d.ts.map

package/dist/sandbox/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/sandbox/stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAY,MAAM,EAAiB,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAY5F,OAAO,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAIhE,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;CACnE;AAqED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,0KA8ErB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY;;;8GA4DvB,CAAC"}

package/dist/sandbox/stream.js

@@ -0,0 +1,167 @@
+import { Duration, Effect, Fiber, Option, Queue, Result, Stream } from "effect";
+import { decodeClientMessage, encodeServerMessage, Exited, outputFrame, Started, StreamFailed, } from "../api/stream.js";
+import { ContainerFailure, SandboxContainer } from "./ports.js";
+import { exitCodeOf, newProcessId, processCommand, processFiles } from "./process.js";
+import { extendLease, runningSandboxFor } from "./sandbox.js";
+/** The time a client has to send its first message. */
+const START_TIMEOUT = Duration.seconds(30);
+/** The interval at which an attach stream reads the process files again. */
+const ATTACH_POLL = Duration.millis(500);
+/** The maximum bytes in one binary message. */
+const FRAME_BYTES = 64 * 1024;
+const decoder = new TextDecoder();
+/** Sends `message` as a stream failure and closes the socket. */
+const refuse = (socket, message) => socket
+    .send(encodeServerMessage(new StreamFailed({ message })))
+    .pipe(Effect.andThen(socket.close(1011, "stream failed")));
+/** Sends `bytes` of `channel` in messages of at most `FRAME_BYTES`. */
+const sendOutput = (socket, channel, bytes) => Effect.forEach(Array.from({ length: Math.ceil(bytes.length / FRAME_BYTES) }, (_, index) => bytes.subarray(index * FRAME_BYTES, (index + 1) * FRAME_BYTES)), (chunk) => socket.send(outputFrame(channel, chunk)), { discard: true });
+const pump = (socket, channel, stream) => stream === null
+    ? Effect.void
+    : Stream.fromReadableStream({
+        evaluate: () => stream,
+        onError: (cause) => new ContainerFailure({
+            operation: "exec",
+            message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    }).pipe(Stream.runForEach((bytes) => sendOutput(socket, channel, bytes)));
+/**
+ * Writes the client's binary messages to `stdin`, and closes it on `StdinEnd` or when the client
+ * closes the socket, as a dropped SSH connection closes a remote command's stdin.
+ */
+const feed = (socket, stdin) => Effect.gen(function* () {
+    if (stdin === null)
+        return;
+    const writer = stdin.getWriter();
+    const close = Effect.promise(() => writer.close().catch(() => undefined));
+    yield* Stream.fromQueue(socket.messages).pipe(Stream.takeWhile((message) => {
+        if (message instanceof Uint8Array)
+            return true;
+        return Option.match(decodeClientMessage(message), {
+            onNone: () => true,
+            onSome: (decoded) => decoded._tag !== "StdinEnd",
+        });
+    }), Stream.runForEach((message) => message instanceof Uint8Array
+        ? Effect.promise(() => writer.write(message).catch(() => undefined))
+        : Effect.void), Effect.ensuring(close));
+});
+/**
+ * Runs one command for the client on `socket`: the first message is `ExecStart`, then binary
+ * messages are its stdin, and the sandbox sends `Started`, the output as binary messages, and
+ * `Exited`. The command runs through `PROCESS_SCRIPT`, so it keeps running, and its output keeps
+ * going to its process files, if the client disconnects.
+ */
+export const execStream = Effect.fn("Sandbox.execStream")(function* (name, socket) {
+    yield* Effect.annotateCurrentSpan({ sandbox: name });
+    const first = yield* Queue.take(socket.messages).pipe(Effect.timeoutOption(START_TIMEOUT), Effect.catchTag("Done", () => Effect.succeedNone));
+    const start = Option.flatMap(first, (message) => message instanceof Uint8Array
+        ? Option.none()
+        : Option.filter(decodeClientMessage(message), (decoded) => decoded._tag === "ExecStart"));
+    if (Option.isNone(start) || start.value._tag !== "ExecStart") {
+        yield* Effect.logWarning("Refused an exec stream that didn't start a command", {
+            sandbox: name,
+        });
+        return yield* refuse(socket, "The first message must be ExecStart");
+    }
+    const command = start.value.command;
+    const sandbox = yield* runningSandboxFor(name).pipe(Effect.andThen(extendLease(name)), Effect.option);
+    if (Option.isNone(sandbox)) {
+        yield* Effect.logWarning("Refused a command for a sandbox without a running container", {
+            sandbox: name,
+        });
+        return yield* refuse(socket, `Sandbox ${name} doesn't exist or its container isn't running`);
+    }
+    const container = yield* SandboxContainer;
+    const process = newProcessId();
+    const fields = { sandbox: name, attempt: sandbox.value.attempt, process };
+    const started = yield* container
+        .exec(processCommand(process, command), "pipe")
+        .pipe(Effect.option);
+    if (Option.isNone(started)) {
+        yield* Effect.logError("The container didn't start a command", fields);
+        return yield* refuse(socket, "The container didn't start the command");
+    }
+    const handle = started.value;
+    yield* socket.send(encodeServerMessage(new Started({ process })));
+    yield* Effect.logInfo("Started a command in the sandbox", {
+        ...fields,
+        commandBytes: command.length,
+    });
+    const input = yield* Effect.forkChild(feed(socket, handle.stdin));
+    const output = yield* Effect.all([pump(socket, "stdout", handle.stdout), pump(socket, "stderr", handle.stderr)], { concurrency: 2, discard: true }).pipe(Effect.forkChild);
+    const exitCode = yield* Fiber.join(output).pipe(Effect.andThen(Effect.tryPromise({
+        try: () => handle.exitCode,
+        catch: (cause) => new ContainerFailure({
+            operation: "exec",
+            message: cause instanceof Error ? cause.message : String(cause),
+        }),
+    })), Effect.result);
+    yield* Fiber.interrupt(input);
+    if (Result.isFailure(exitCode)) {
+        // Closes without `Exited`, as a dropped connection does: the client then attaches to the
+        // process files from the bytes it received, and gets the rest of the output and the exit code.
+        yield* Effect.logError("Lost the command's output or exit code; the client attaches", {
+            ...fields,
+            error: exitCode.failure.message,
+        });
+        return yield* socket.close(1011, "container stream failed");
+    }
+    yield* socket.send(encodeServerMessage(new Exited({ exitCode: exitCode.success })));
+    yield* socket.close(1000, "exited");
+    yield* Effect.logInfo("The sandbox's command exited", { ...fields, exitCode: exitCode.success });
+});
+/**
+ * Streams a command's output from its process files, after the bytes in `offsets`, then its exit
+ * code, for a client whose exec stream was cut. Nothing reaches the command's stdin.
+ */
+export const attachStream = Effect.fn("Sandbox.attachStream")(function* (name, process, offsets, socket) {
+    const fields = { sandbox: name, process };
+    yield* Effect.annotateCurrentSpan(fields);
+    const sandbox = yield* runningSandboxFor(name).pipe(Effect.option);
+    if (Option.isNone(sandbox))
+        return yield* refuse(socket, `Sandbox ${name} isn't running`);
+    const container = yield* SandboxContainer;
+    const files = processFiles(process);
+    const known = yield* container.read(files.pid).pipe(Effect.option);
+    if (Option.isNone(Option.flatten(known))) {
+        yield* Effect.logWarning("Refused to attach to an unknown command", fields);
+        return yield* refuse(socket, `Sandbox ${name} has no command ${process}`);
+    }
+    if (Option.isNone(yield* extendLease(name).pipe(Effect.option))) {
+        yield* Effect.logWarning("Refused to attach: the sandbox was destroyed", fields);
+        return yield* refuse(socket, `Sandbox ${name} was destroyed`);
+    }
+    yield* Effect.logInfo("Attached to a command's output", { ...fields, ...offsets });
+    let sent = { stdout: offsets.stdout, stderr: offsets.stderr };
+    const forward = (channel) => container.readFrom(files[channel], sent[channel]).pipe(Effect.flatMap((bytes) => {
+        const read = Option.getOrElse(bytes, () => new Uint8Array());
+        sent = { ...sent, [channel]: sent[channel] + read.length };
+        return sendOutput(socket, channel, read);
+    }));
+    const follow = Effect.gen(function* () {
+        while (true) {
+            // Reads the exit file first, so the output read after it is complete when it exists.
+            const exit = Option.flatMap(yield* container.read(files.exit), (bytes) => exitCodeOf(decoder.decode(bytes)));
+            yield* forward("stdout");
+            yield* forward("stderr");
+            if (Option.isSome(exit))
+                return exit.value;
+            yield* Effect.sleep(ATTACH_POLL);
+        }
+    });
+    const disconnected = Stream.fromQueue(socket.messages).pipe(Stream.runDrain);
+    const outcome = yield* Effect.raceFirst(follow.pipe(Effect.map(Option.some)), disconnected.pipe(Effect.as(Option.none()))).pipe(Effect.option);
+    const exitCode = Option.flatten(outcome);
+    if (Option.isNone(outcome)) {
+        yield* Effect.logError("Could not read the command's process files", fields);
+        return yield* refuse(socket, "The container failed to read the command's process files");
+    }
+    if (Option.isNone(exitCode)) {
+        yield* Effect.logInfo("The client left the attach stream", fields);
+        return;
+    }
+    yield* socket.send(encodeServerMessage(new Exited({ exitCode: exitCode.value })));
+    yield* socket.close(1000, "exited");
+    yield* Effect.logInfo("The attached command exited", { ...fields, exitCode: exitCode.value });
+});
+//# sourceMappingURL=stream.js.map

package/dist/sandbox/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/sandbox/stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE5F,OAAO,EAEL,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,EAEN,WAAW,EACX,OAAO,EACP,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAW9D,uDAAuD;AACvD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACzC,+CAA+C;AAC/C,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,iEAAiE;AACjE,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAE,OAAe,EAAE,EAAE,CACvD,MAAM;KACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;KACxD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;AAE/D,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,OAAsB,EAAE,KAAiB,EAAE,EAAE,CACrF,MAAM,CAAC,OAAO,CACZ,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACzE,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAC/D,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EACnD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;AAEJ,MAAM,IAAI,GAAG,CACX,MAAoB,EACpB,OAAsB,EACtB,MAAyC,EACzC,EAAE,CACF,MAAM,KAAK,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;QACtB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,IAAI,gBAAgB,CAAC;YACnB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;KACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,IAAI,GAAG,CAAC,MAAoB,EAAE,KAAwC,EAAE,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,OAAO,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE;YAChD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI;YAClB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,EACF,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,OAAO,YAAY,UAAU;QAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EACjE,IAAiB,EACjB,MAAoB;IAEpB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAClD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9C,OAAO,YAAY,UAAU;QAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAC3F,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC7D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oDAAoD,EAAE;YAC7E,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EACjC,MAAM,CAAC,MAAM,CACd,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,6DAA6D,EAAE;YACtF,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,SAAS;SAC7B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;QACxD,GAAG,MAAM;QACT,YAAY,EAAE,OAAO,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAC9B,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAC9E,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAClC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,UAAU,CAAC;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ;QAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,gBAAgB,CAAC;YACnB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;KACL,CAAC,CACH,EACD,MAAM,CAAC,MAAM,CACd,CAAC;IACF,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,yFAAyF;QACzF,+FAA+F;QAC/F,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,6DAA6D,EAAE;YACpF,GAAG,MAAM;YACT,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;SAChC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EACrE,IAAiB,EACjB,OAAkB,EAClB,OAAsB,EACtB,MAAoB;IAEpB,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1C,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,gBAAgB,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,8CAA8C,EAAE,MAAM,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACnF,IAAI,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,CAAC,OAAsB,EAAE,EAAE,CACzC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CACH,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,OAAO,IAAI,EAAE,CAAC;YACZ,qFAAqF;YACrF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CACvE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAClC,CAAC;YACF,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzB,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC;YAC3C,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CACrC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EACpC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAU,CAAC,CAAC,CACpD,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;AAChG,CAAC,CAAC,CAAC"}