@vibe-agent-toolkit/cli 0.2.0-rc.3 → 0.2.0-rc.5

package/dist/commands/resources/check-supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-supervisor.d.ts","sourceRoot":"","sources":["../../../src/commands/resources/check-supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AA+CH,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAK3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CA+BlE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAWP;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACrF;;;;;;;;;;;;;GAaG;GACD;IACA,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,GACC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAChC;;;;;;;;;;;;;;;;;;GAkBG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,qFAAqF;AACrF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5D,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CACvE,GAAG,aAAa,CAchB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,MAAM,GACb,aAAa,CAGf;AAED,kCAAkC;AAClC,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAChF;IACA,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CA2EzB;AAiDD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAO1F"}

package/dist/commands/resources/check-supervisor.js

@@ -0,0 +1,566 @@
+/**
+ * The time bound on `vat resources check`, enforced from OUTSIDE the process
+ * doing the work.
+ *
+ * ## 🚨 Why an external process, and not any of the cheaper things
+ *
+ * This verb runs adopter-authored SQL as an unattended CI gate. An accidental
+ * cross join, or a `WITH RECURSIVE` with no termination, runs forever — and
+ * every in-process lever was tried and MEASURED on Node 24.13.1 before this
+ * shape was chosen. Do not re-derive them:
+ *
+ * - **A worker thread does not work.** `worker.terminate()` never resolves
+ *   against a thread blocked in native SQLite, and the parent's own
+ *   `process.exit()` does not exit either. V8 can unwind a worker spinning in
+ *   JS — which is why the parse pool's `terminate()` genuinely works — but a
+ *   thread inside a synchronous native call is not spinning in JS. Do NOT
+ *   "align" this design with the parse pool's.
+ * - **A signal handler is a REGRESSION.** A process blocked in synchronous
+ *   `node:sqlite` dies INSTANTLY on SIGINT while no handler is installed, and
+ *   SURVIVES both SIGINT and SIGTERM once one is — the handler is a JS callback,
+ *   and the event loop that would schedule it is the resource that is blocked.
+ *   Installing one removes the operator's Ctrl-C. There is no
+ *   `process.on('SIGINT')` here and there must never be.
+ * - **The kill is `SIGKILL` because SIGKILL cannot be REGRESSED.** No code the
+ *   child runs, now or after any future edit, can handle, ignore or block it.
+ *
+ *   ⚠️ This header used to claim, as measured fact, that "SIGTERM does not kill
+ *   the child either, for the same reason". **That is false and was measured to
+ *   be false**: `kill -TERM` on a child blocked inside synchronous `node:sqlite`
+ *   `.all()` killed it instantly. The measurement above is about a process that
+ *   HAS a JS handler installed — a handler is a JS callback and the blocked
+ *   event loop is what would schedule it — and with no handler installed
+ *   SIGTERM's default disposition is kernel-delivered termination that needs no
+ *   cooperation at all. So SIGTERM works today only because nothing here
+ *   installs a handler, which is a property one future edit could silently
+ *   remove; SIGKILL is not a property anything can remove. The design did not
+ *   change, only the reason for it — recorded because a false claim is at its
+ *   worst in a section that tells the next reader not to re-derive it.
+ * - **The database cannot be handed over.** `DatabaseSync` has no `serialize()`
+ *   and `:memory:` is per-CONNECTION, so whoever runs the SQL populates its own
+ *   projection. That is why the child is a whole `vat resources check` run and
+ *   not a query executor.
+ *
+ * ## 🔑 The budget is ABSENCE OF PROGRESS, not total runtime
+ *
+ * A total-runtime bound has to be set above the slowest legitimate run on the
+ * largest adopter tree, which makes it useless as a hang detector, and it kills
+ * healthy runs that are merely large. So the parent watches the child's progress
+ * log and resets its clock on every new line — INCLUDING the population line,
+ * which is what bounds the population itself without charging it the first
+ * check's budget. A gate that can hang forever is the thing being fixed, and
+ * that includes hanging before the first statement.
+ *
+ * ⚠️ **That property holds for the CHECKS. It does NOT hold for the population,
+ * and the difference is not a detail.** The population emits exactly ONE line,
+ * at its end, so for the single longest unit in a cold run the budget degrades
+ * to precisely the total-runtime bound this section argues against: a population
+ * that takes longer than the budget is killed however healthily it is working.
+ *
+ * That is not cheap to fix and a half-fix would be worse than saying so.
+ * `onContributorTiming` does fire per contributor, but ~88% of a cold population
+ * is the BLOB stage — one call, remark-parsing every document, 33-35 s of the
+ * 35 s — and it emits nothing. Per-contributor lines would therefore bound the
+ * cheap part, leave the expensive part exactly as unbounded as it is now, and
+ * make the whole thing LOOK instrumented. So the population stays one
+ * un-instrumented unit, the default budget is set well above a cold one, and the
+ * per-unit property is claimed only where it is true.
+ *
+ * ## Why the child is the CLI itself
+ *
+ * The child is `vat resources check` with a hidden `--cost-log` flag, running
+ * the ordinary in-process path. Forking the logic would give the supervised lane
+ * and the unsupervised one two implementations of the same gate — and the one
+ * nobody runs interactively is the one that would rot.
+ */
+import { spawn } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { safePath } from '@vibe-agent-toolkit/utils';
+import { normalizedTmpdir } from '@vibe-agent-toolkit/utils/fs';
+import { resolveVatBinPath } from '../../utils/vat-bin-path.js';
+/**
+ * The bound applied when `--budget` is not passed, in seconds.
+ *
+ * Not a round number chosen for looks, and no longer sized against this
+ * repository alone. Population is ~1.2 s warm here and 33-35 s with a cold parse
+ * cache; on a real adopter tree of 9,992 tracked files it is ~5 s warm and
+ * **16.5 s cold**, which is the first time the default was checked outside VAT.
+ * So 300 s is ~18× the worst thing anyone has actually measured — deliberately
+ * loose, because a FALSE kill is far worse than a slow honest failure: it
+ * teaches the operator to pass `--budget 0` and lose the bound entirely. Five
+ * minutes still turns an infinite hang into a clean bounded failure, which is
+ * the whole objective. A tree ten times that adopter's lands near 165 s, still
+ * inside the default but no longer comfortably.
+ */
+const DEFAULT_BUDGET_SECONDS = 300;
+/** How many times per budget the parent looks at the log. */
+const POLLS_PER_BUDGET = 10;
+/** Poll bounds, so a huge budget still notices promptly and a tiny one is cheap. */
+const MIN_POLL_MS = 50;
+const MAX_POLL_MS = 250;
+/**
+ * How many refused SIGKILLs the watchdog sends before it stops trying and
+ * REPORTS instead.
+ *
+ * A retry count, not a bound on anything stored. It exists because the two ways
+ * a kill can fail want opposite responses: `ESRCH` is a race that resolves
+ * itself the instant `close` arrives, while `EPERM` is a permission fact that
+ * will be just as true on the thousandth attempt. Retrying a handful of times
+ * covers the first at negligible cost; continuing past that would turn the
+ * supervisor into a second unbounded hang, which is the thing this module
+ * exists to abolish. So it escalates to an honest report naming the pid.
+ */
+const KILL_ATTEMPTS_BEFORE_REPORTING = 5;
+/**
+ * Decide whether the child has gone quiet for longer than the budget.
+ *
+ * Pure, and separated from the timer for exactly that reason: the interesting
+ * behaviour is "a run that keeps making progress is never killed, however long
+ * it takes", and a test of that against a real timer would be a twenty-second
+ * test that flakes. Here it is twenty function calls.
+ *
+ * 🪤 Growth is measured in BYTES rather than parsed lines. A partially written
+ * line also grows the file, and treating that as progress is the safe direction:
+ * the child is demonstrably alive and writing. Counting lines instead would mean
+ * a very slow write could look like silence.
+ *
+ * @param state - What the previous poll saw
+ * @param observation - The run
+ * @param observation.bytes - The progress log's current size
+ * @param observation.now - The clock, in milliseconds
+ * @param observation.budgetMs - How long silence is allowed to last
+ * @returns The state to carry forward, and whether the budget was blown
+ */
+export function pollWatchdog(state, observation) {
+    if (observation.bytes !== state.bytesSeen) {
+        return { state: { bytesSeen: observation.bytes, quietSince: observation.now }, breach: false };
+    }
+    return { state, breach: observation.now - state.quietSince >= observation.budgetMs };
+}
+/**
+ * Read `--budget`, or supply the default.
+ *
+ * 🪤 A typo is REFUSED rather than defaulted. `--budget 2O` (letter O) would
+ * otherwise run with a five-minute bound while the operator believed they had
+ * set two seconds — and they would only find out from a CI job that hung for
+ * five minutes instead of two. Thrown, so it exits 2 as an operator error, in
+ * line with this command's existing contract for an unknown `--check` name.
+ *
+ * 🚨 **A BLANK value is refused before `Number` ever sees it, and that is the
+ * more important half.** `Number('')`, `Number(' ')` and `Number('\n')` are all
+ * `0` — finite, non-negative, and therefore accepted by the range guard below —
+ * and `0` is this flag's documented escape hatch meaning *no bound at all*. So
+ * `--budget "$CHECK_BUDGET"` with the variable unset did not shorten the bound
+ * and did not complain: it silently REMOVED it, on the one flag whose entire
+ * purpose is to stop an unattended job hanging forever. An unset shell variable
+ * is a far more common CI accident than the typo the guard was written for.
+ *
+ * 🚨 **The blank string was only the visible half of the hazard, and the guard
+ * below it is the rest.** What actually removes the bound is `Number(raw) === 0`
+ * for a raw string nobody would recognise as a zero — `--budget 1e-400`
+ * underflows to `0`, and `--budget -0` is negative zero, which sails past the
+ * `seconds < 0` test because `-0 < 0` is false. Both were MEASURED to run
+ * completely unbounded, in process, exiting 0 with no supervision and no word
+ * said. So a value that PARSES to zero is refused unless the operator literally
+ * wrote a zero: `raw.trim() !== '0'` and it is an operator error. The escape
+ * hatch is still there, it just has to be spelled the one unambiguous way.
+ *
+ * ⚠️ That deliberately refuses `0.0` and `0x0` as well. They are not accidents
+ * an operator can fall into, they cost one character to rewrite, and a guard
+ * with an exception list is a guard whose next exception nobody argues about.
+ *
+ * 🔑 **Non-zero hex is deliberately KEPT.** `Number('0x10')` is 16 and
+ * `--budget 0x10` runs with a sixteen-second bound. That is unambiguous, it
+ * cannot arise by accident the way an empty variable can, and refusing it would
+ * buy nothing — recorded here so the next reader does not "fix" it into a
+ * refusal.
+ *
+ * @param raw - Whatever Commander parsed, or undefined
+ * @returns The budget in seconds; 0 means no bound
+ * @throws When the value is blank, means zero without saying so, or is not a
+ *   non-negative number
+ */
+export function parseBudgetSeconds(raw) {
+    if (raw === undefined)
+        return DEFAULT_BUDGET_SECONDS;
+    if (raw.trim() === '') {
+        throw new Error('--budget was given an empty value. That is almost always an unset shell'
+            + ' variable (`--budget "$CHECK_BUDGET"`), and it is refused rather than read'
+            + ' as `--budget 0` — which would remove the bound entirely and let the run'
+            + ' hang forever. Pass a number of seconds, or `--budget 0` explicitly if that'
+            + ' is really what you mean.');
+    }
+    const seconds = Number(raw);
+    if (!Number.isFinite(seconds) || seconds < 0) {
+        throw new Error(`--budget must be a non-negative number of seconds, not "${raw}".`
+            + ` It bounds how long the run may go without completing a unit of work;`
+            + ` --budget 0 removes the bound entirely (and can then hang forever).`);
+    }
+    if (seconds === 0 && raw.trim() !== '0') {
+        throw new Error(`--budget "${raw}" is a number that means ZERO — and 0 is this flag's escape`
+            + ' hatch for "no bound at all", so the run would have gone entirely'
+            + ' unsupervised and could hang forever. `1e-400` underflows to zero and `-0`'
+            + ' is negative zero, neither of which reads as a request to remove the bound.'
+            + ' Pass a positive number of seconds, or exactly `--budget 0` if removing it'
+            + ' is really what you mean.');
+    }
+    return seconds;
+}
+/**
+ * Does this process do the work, or supervise a child that does?
+ *
+ * 🚨 **The recursion guard, and the reason it is a named function.** `--cost-log`
+ * is what a supervising parent hands its child, and it must WIN against the
+ * budget — a child that consulted the budget first would spawn a child of its
+ * own, which would spawn a child of its own. A condition inline in the command
+ * would be a fork bomb one refactor away with nothing asserting on it.
+ *
+ * `--budget 0` also runs here: there is nothing to supervise, and a spawn would
+ * cost a second process startup to buy no bound at all.
+ *
+ * @param options - The run
+ * @param options.costLog - The hidden `--cost-log` value, or undefined
+ * @param options.budgetSecs - The bound in seconds; 0 means none
+ * @returns True when the checks run in this process
+ */
+export function runsInThisProcess(options) {
+    return options.costLog !== undefined || options.budgetSecs === 0;
+}
+/**
+ * Refuse a combination where one flag the operator passed would do nothing.
+ *
+ * 🚨 **The defect: `--cost-log` wins the fork above unconditionally**, so
+ * `vat resources check --budget 60 --cost-log /tmp/x` ran entirely UNBOUNDED and
+ * said nothing about it. That is harmless to the recursion guard — a child must
+ * keep winning — but an explicitly-passed, documented flag that is silently
+ * inert is exactly the shape an operator never discovers until the hang it was
+ * meant to prevent.
+ *
+ * ⚠️ **The real spawn path must survive this.** {@link runsInThisProcess}'s
+ * caller builds the child's argv with `--cost-log` and does NOT forward
+ * `--budget` — which is why the RAW flag is the discriminator here rather than
+ * the parsed seconds: the child's `budgetSecs` is the 300 s default, not
+ * anything the operator typed.
+ *
+ * `--budget 0` alongside `--cost-log` is allowed: both say "nobody is
+ * supervising this", so there is no contradiction to report.
+ *
+ * @param options - The run
+ * @param options.costLog - The hidden `--cost-log` value, or undefined
+ * @param options.budgetRaw - What the operator actually typed for `--budget`
+ * @param options.budgetSecs - The parsed bound; 0 means none
+ * @throws When both flags were passed and the budget could not be honoured
+ */
+export function requireSupervisableFlags(options) {
+    if (options.costLog === undefined)
+        return;
+    if (options.budgetRaw === undefined || options.budgetSecs === 0)
+        return;
+    throw new Error('--budget cannot be combined with --cost-log. --cost-log means "you are the'
+        + ' child a supervisor already spawned", so this process does the work rather'
+        + ' than bounding it, and the budget would be silently ignored. Drop one:'
+        + ' --budget alone gets you the bound, --cost-log alone gets you the progress'
+        + ' log with no bound at all.');
+}
+/**
+ * Read `close`'s two arguments, and the watchdog's belief, into one answer.
+ *
+ * ## 🚨 The defect this closes: a signal death READ AS SUCCESS
+ *
+ * `close` fires with `(code, signal)`, and a process that dies from a signal has
+ * `code === null` with `signal` set. This handler used to read only the code and
+ * coerce it — `resolve(exitCode ?? 0)` — so every signal death became a
+ * COMPLETED run with exit code 0. The parent then forwarded an empty stdout and
+ * exited 0, and a CI gate reads that as a clean pass.
+ *
+ * It needed no external actor. A check whose statement materialises an unbounded
+ * result set — `SELECT i FROM <infinite recursive CTE>`, the row-returning twin
+ * of the aggregate this whole module exists for — makes `.all()` fill the heap
+ * until V8 gives up and Node ABORTS. Measured: `PARENT_EXIT=0`, zero bytes of
+ * stdout, on precisely the input the bound exists to catch. Through the
+ * unsupervised lane the identical input exits 134.
+ *
+ * Every memory death arrives here: Node's own heap abort, a kernel OOM killer on
+ * a memory-capped runner (which picks the large CHILD, never the idle parent),
+ * and a container limit. `?? 0` turned all of them into a pass.
+ *
+ * ## 🪤 A kill only counts if it LANDED
+ *
+ * `killed` says the watchdog fired, not that the child died of it. libuv runs
+ * timers BEFORE the poll phase that reaps the child, so the timer can fire in
+ * the same loop turn as a child that has already exited cleanly. A NORMAL ending
+ * — a non-null code with no signal — is therefore honoured whatever `killed`
+ * says: that run finished on its own terms and its answer is real. Reporting it
+ * as killed fails closed, but it discards a correct result, which is its own
+ * kind of wrong.
+ *
+ * ## 🚨 The ORDER of the tests below is load-bearing
+ *
+ * `spawnError` used to be tested FIRST, so `killed` was never consulted on that
+ * branch — and `child.on('error')` is not only a spawn-failure listener. Node
+ * emits `error` on the ChildProcess when `subprocess.kill()` itself fails, so a
+ * refused SIGKILL landed on the spawn-failure branch and the report said the
+ * child "could not be started at all", that "nothing ran at all, so this is an
+ * installation or PATH problem", and that "the watchdog never fired". Three
+ * statements, all false, about a runaway that was still executing.
+ *
+ * So: a real ending first, then what the SUPERVISOR did (a refused kill, then a
+ * kill), and only then a failure to start. A run whose kill was refused must
+ * never claim the watchdog was uninvolved.
+ *
+ * @param ending - What `close` reported, plus what the supervisor did and saw
+ * @param ending.code - `close`'s first argument
+ * @param ending.signal - `close`'s second argument
+ * @param ending.killed - Whether the watchdog sent SIGKILL
+ * @param ending.spawnError - Set when the child never started at all
+ * @param ending.killFailure - Set when the watchdog's SIGKILL was REFUSED
+ * @returns What actually happened
+ */
+export function resolveChildEnding(ending) {
+    if (ending.code !== null && ending.signal === null) {
+        return { kind: 'completed', code: ending.code };
+    }
+    if (ending.killFailure !== undefined) {
+        return { kind: 'abnormal', death: { kind: 'kill-failed', ...ending.killFailure } };
+    }
+    if (ending.killed)
+        return { kind: 'killed' };
+    if (ending.spawnError !== undefined) {
+        return { kind: 'abnormal', death: { kind: 'spawn-failed', ...ending.spawnError } };
+    }
+    return ending.signal === null
+        ? { kind: 'abnormal', death: { kind: 'no-status' } }
+        : { kind: 'abnormal', death: { kind: 'signal', signal: ending.signal } };
+}
+/**
+ * Reconcile "how the process ended" with "what it left behind".
+ *
+ * ## 🚨 A completion that PUBLISHED NOTHING did not complete
+ *
+ * {@link resolveChildEnding} answers a question about the process — what `close`
+ * reported, reconciled with what the supervisor did. This answers a DIFFERENT
+ * one, about the artifact, and the two disagree in exactly one place: a child
+ * that exited with a code and wrote no document.
+ *
+ * Every in-process path through `checkCommand` ends at `emitCheckDocument` or at
+ * `handleCommandError`, and both write to stdout — a clean pass, a violation, a
+ * bricked config, a mistyped `--check`. There is no exit this command can take
+ * that legitimately publishes nothing. So an empty stdout is not a quiet run, it
+ * is a run that was cut off before it could say anything, and forwarding its
+ * exit code verbatim tells the operator a number and nothing else.
+ *
+ * ## 🪤 Why this is not folded into {@link resolveChildEnding}
+ *
+ * That function's branch ORDER is load-bearing and reasoned entirely about
+ * process endings and supervisor beliefs. The emptiness of stdout belongs to
+ * neither, and threading it through would put an artifact test inside an
+ * ordering argument that has already been got wrong twice. It runs AFTER, on the
+ * one branch it can change, and it changes no other.
+ *
+ * ⚠️ **Blank, not unparseable.** The parent forwards the child's document
+ * verbatim precisely so it stays `--format`-agnostic, so it cannot ask whether
+ * the bytes parse without learning the format. A truncated document — an abort
+ * that landed mid-write — therefore still forwards, and that is the honest
+ * limit of this test rather than an oversight.
+ *
+ * @param resolution - How the process ended
+ * @param stdout - Everything the child wrote to stdout
+ * @returns The resolution, with a silent completion re-read as abnormal
+ */
+export function resolveSilentCompletion(resolution, stdout) {
+    if (resolution.kind !== 'completed' || stdout.trim() !== '')
+        return resolution;
+    return { kind: 'abnormal', death: { kind: 'no-output', code: resolution.code } };
+}
+/**
+ * Run `vat resources check` as a child, bounded by the budget.
+ *
+ * `stdio` is `['ignore', 'pipe', 'inherit']`: the child's stdout is accumulated
+ * so the parent can forward the document verbatim, and its stderr is INHERITED
+ * so warnings and blob-stage refusals stream live exactly as they do today.
+ *
+ * ⚠️ Asynchronous `spawn`, never `spawnSync`. The parent's event loop is the
+ * thing holding the watchdog timer; a synchronous spawn would block it for
+ * precisely as long as the run it is supposed to be bounding.
+ *
+ * 🚨 There is an `error` listener as well as a `close` one, and it is not
+ * optional politeness: without it an unspawnable binary is an unhandled `error`
+ * event, which Node turns into a stack dump instead of a report. It fails
+ * closed, so this is legibility — but a stack dump is not a report.
+ *
+ * ## 🚨 `error` is NOT only a spawn-failure listener, and reading it as one
+ * ABANDONED A LIVE CHILD
+ *
+ * Node emits `error` on the ChildProcess when `subprocess.kill()` itself fails.
+ * The shipped function ends `else { /* Other error, almost certainly EPERM. *\/
+ * this.emit('error', new ErrnoException(err, 'kill')); }`. So: the watchdog
+ * breached, `killed` was set, the SIGKILL was refused, `error` fired, the
+ * handler recorded a SPAWN failure and resolved immediately — which cleared the
+ * watchdog timer, so no further kill could ever be attempted — and the parent
+ * published a report saying the child "could not be started at all" and "the
+ * watchdog never fired" while the runaway was still executing. The bound this
+ * module exists to enforce became an orphaned unbounded hang, described as its
+ * own opposite.
+ *
+ * The handler therefore forks on `killed`, and the two arms are deliberately
+ * asymmetric:
+ *
+ * - **Before the watchdog fired**, an `error` means the child never started.
+ *   Resolve at once: there is nothing alive to wait for.
+ * - **After it fired**, an `error` means the KILL failed and the child is,
+ *   as far as this process can tell, still running. Do NOT resolve. Resolving
+ *   is what clears the timer, and clearing the timer is what makes the failure
+ *   permanent. The poll keeps breaching (the log is not growing and
+ *   `quietSince` is not reset), so it keeps re-sending SIGKILL, and a transient
+ *   refusal still lands. Only after {@link KILL_ATTEMPTS_BEFORE_REPORTING}
+ *   refusals does it give up — and it gives up by REPORTING, naming the pid,
+ *   never by claiming the child never started.
+ *
+ * ⚠️ Reachability of `EPERM` on one's own child is REASONED rather than
+ * reproduced — it is rare on macOS and Linux. Nothing in production was
+ * contorted to make it testable; the branch ordering and the message
+ * composition are pure functions and are pinned as such.
+ *
+ * @param options - The run
+ * @param options.args - The child's argv after the node binary, `--cost-log` included
+ * @param options.logPath - The progress log both sides agreed on
+ * @param options.budgetMs - How long silence is allowed to last
+ * @returns How the child ended, and what it left behind
+ */
+export async function superviseCheck(options) {
+    const startedAt = Date.now();
+    const binary = resolveVatBinPath();
+    const child = spawn(process.execPath, [binary, ...options.args], {
+        stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    const chunks = [];
+    child.stdout?.on('data', (chunk) => chunks.push(chunk));
+    let killed = false;
+    let killAttempts = 0;
+    let killFailure;
+    let spawnError;
+    let state = { bytesSeen: 0, quietSince: startedAt };
+    // 🪤 Declared out here and started INSIDE the promise, so the watchdog can
+    // settle the run itself when it runs out of kills. Starting it outside would
+    // put the escalation out of the timer's reach and force the `error` handler
+    // back into resolving on a child that is still alive.
+    let timer;
+    const resolution = await new Promise((resolve) => {
+        // 🪤 `error` does not always end the process, and it is not always followed
+        // by `close` — so a SPAWN failure is remembered and resolved on immediately.
+        // A promise settles once, so whichever event arrives first wins and the
+        // other is a no-op. A failed KILL is the opposite case: see this function's
+        // header for why it must not settle here.
+        child.on('error', (cause) => {
+            if (killed) {
+                killFailure = { detail: cause.message, pid: child.pid };
+                return;
+            }
+            spawnError = { binary, detail: cause.message };
+            resolve(resolveChildEnding({ code: null, signal: null, killed, spawnError }));
+        });
+        // ⛔ BOTH arguments. `exitCode ?? 0` here read every signal death as a
+        // successful run — see {@link resolveChildEnding}.
+        child.on('close', (code, signal) => {
+            resolve(resolveChildEnding({ code, signal, killed, spawnError, killFailure }));
+        });
+        timer = setInterval(() => {
+            const poll = pollWatchdog(state, {
+                bytes: logSize(options.logPath),
+                now: Date.now(),
+                budgetMs: options.budgetMs,
+            });
+            state = poll.state;
+            if (!poll.breach)
+                return;
+            killed = true;
+            killAttempts += 1;
+            // SIGKILL, because no code the child could ever gain can handle, ignore
+            // or block it. See this module's header — and note the reason is NOT that
+            // SIGTERM fails to reach a blocked process, which was measured false.
+            child.kill('SIGKILL');
+            if (killFailure !== undefined && killAttempts >= KILL_ATTEMPTS_BEFORE_REPORTING) {
+                resolve(resolveChildEnding({ code: null, signal: null, killed, killFailure }));
+            }
+        }, pollIntervalMs(options.budgetMs));
+    });
+    clearInterval(timer);
+    const stdout = Buffer.concat(chunks).toString('utf-8');
+    // 🚨 AFTER the ending is resolved, never inside it. A child that exited with a
+    // code and published nothing did not complete, whatever `close` said — see
+    // {@link resolveSilentCompletion} for the platform this is about.
+    const ending = resolveSilentCompletion(resolution, stdout);
+    if (ending.kind === 'completed') {
+        return { outcome: 'completed', code: ending.code, stdout };
+    }
+    const wreckage = { log: readLog(options.logPath), elapsedMs: Date.now() - startedAt };
+    return ending.kind === 'killed'
+        ? { outcome: 'killed', ...wreckage }
+        : { outcome: 'abnormal', death: ending.death, ...wreckage };
+}
+/**
+ * How often to look at the log.
+ *
+ * Derived from the budget rather than fixed, so `--budget 2` notices in 200 ms
+ * while `--budget 600` does not wake the event loop 12,000 times for nothing.
+ *
+ * @param budgetMs - The budget
+ * @returns The poll interval in milliseconds
+ */
+function pollIntervalMs(budgetMs) {
+    return Math.min(MAX_POLL_MS, Math.max(MIN_POLL_MS, budgetMs / POLLS_PER_BUDGET));
+}
+/**
+ * The progress log's size, or 0 before the child has written anything.
+ *
+ * 🪤 A missing file is 0, not an error. The child creates the log on its first
+ * emission, so every poll before that legitimately finds nothing — and throwing
+ * there would kill the supervisor instead of the runaway.
+ *
+ * @param path - The progress log
+ * @returns Its size in bytes
+ */
+function logSize(path) {
+    try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- a path this process minted for this run
+        return statSync(path).size;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Whatever of the log survived the kill.
+ *
+ * @param path - The progress log
+ * @returns Its contents, or the empty string when the child never wrote one
+ */
+function readLog(path) {
+    try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- a path this process minted for this run
+        return readFileSync(path, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Run `work` with a fresh progress log, and remove it however that ends.
+ *
+ * ⚠️ Ephemeral, per run, and it carries NO format version — see
+ * `check-progress.ts`. It is written and read by one process pair within one run
+ * of one build, so the reader's own `.strict()` schema is the entire contract.
+ *
+ * @param work - Given the log's path
+ * @returns Whatever `work` returned
+ */
+export async function withProgressLog(work) {
+    const dir = mkdtempSync(safePath.join(normalizedTmpdir(), 'vat-check-'));
+    try {
+        return await work(safePath.join(dir, 'progress.jsonl'));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=check-supervisor.js.map

package/dist/commands/resources/check-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-supervisor.js","sourceRoot":"","sources":["../../../src/commands/resources/check-supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,oFAAoF;AACpF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAUzC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAoB,EACpB,WAA6D;IAE7D,IAAI,WAAW,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yEAAyE;cACvE,4EAA4E;cAC5E,0EAA0E;cAC1E,6EAA6E;cAC7E,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,IAAI;cAChE,uEAAuE;cACvE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,6DAA6D;cAC3E,mEAAmE;cACnE,4EAA4E;cAC5E,6EAA6E;cAC7E,4EAA4E;cAC5E,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4D;IAE5D,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAIxC;IACC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC;QAAE,OAAO;IAExE,MAAM,IAAI,KAAK,CACb,4EAA4E;UAC1E,4EAA4E;UAC5E,wEAAwE;UACxE,4EAA4E;UAC5E,4BAA4B,CAC/B,CAAC;AACJ,CAAC;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAMlC;IACC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAyB,EACzB,MAAc;IAEd,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAIpC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAoE,CAAC;IACzE,IAAI,UAA0D,CAAC;IAC/D,IAAI,KAAK,GAAkB,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,KAAiC,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC9D,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,4EAA4E;QAC5E,0CAA0C;QAC1C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACjC,IAAI,MAAM,EAAE,CAAC;gBACX,WAAW,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC/C,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,mDAAmD;QACnD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE;gBAC/B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;gBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACzB,MAAM,GAAG,IAAI,CAAC;YACd,YAAY,IAAI,CAAC,CAAC;YAClB,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,IAAI,8BAA8B,EAAE,CAAC;gBAChF,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,KAAK,CAAC,CAAC;IAErB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,+EAA+E;IAC/E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAE3D,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACtF,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE;QACpC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,8GAA8G;QAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,8GAA8G;QAC9G,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,IAAqC;IAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}