npm - @vibesdotdev/platform - Versions diffs - 0.0.0-stage → 1.0.0-rc.2 - Mend

@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1657) hide show

package/dist/fleets/daemon/execution-listen-policy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"execution-listen-policy.js","sourceRoot":"","sources":["../../../src/fleets/daemon/execution-listen-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC1P;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,eAAe,EACf,iBAAiB,EACjB,MAAM,IAAI,OAAO,EACjB,SAAS,IAAI,UAAU,EACvB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAwF,MAAM,+BAA+B,CAAC;AAEzJ,OAAO,EACN,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EACrE,qBAAqB,EAAE,sBAAsB,EAC7C,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAyB,MAAM,wCAAwC,CAAC;AAE7I,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAEjC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,QAAQ;IACR,MAAM;IACN,UAAU;IACV,WAAW;IACX,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;CACG,CAAC;AAyCX;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,SAAS;IACT,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;CACJ,CAAC;AAEX,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAQ,KAAY;IACrD,OAAO,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAQ,KAAY;IAChD,OAAO,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAQ,KAAY;IACrD,OAAO,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAQ,KAAY;IAClD,OAAO,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACzD,CAAC;AAiDD,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAE9G,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAQ,KAAY;IACtD,OAAO,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,OAA6B;IACvF,uEAAuE;IACvE,gDAAgD;IAChD,IAAI,WAAW,GAAmD,IAAI,CAAC;IACvE,MAAM,MAAM,GAAG,GAA4C,EAAE;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,aAAa,EAAE;gBAC9E,MAAM,EAAE,2BAA2B;gBACnC,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC;IACpB,CAAC,CAAC;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/F,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7G,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAChB,CAAC;IACF,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAE3B,IAAI,UAAU,GAAyB,IAAI,CAAC;IAC5C,oFAAoF;IACpF,MAAM,cAAc,GAAG,KAAK,EAAE,MAAe,EAAiB,EAAE;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,aAAa,EAAE;YACrF,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,2CAA2C,CAAC;SAChH,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,SAAyC,CAAC;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1B,SAAS,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBACjC,UAAU,KAAK,cAAc,CAAC,SAAS,CAAC,CAAC;gBACzC,MAAM,UAAU,CAAC;gBACjB,MAAM,MAAM,CAAC;YACd,CAAC,EAAE,CAAC;IACL,CAAC;IAED,OAAO;QACN,SAAS;QACT,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,IAAI,EAAE,CAAC,MAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,OAAO,EAAE,CAAC,MAAe,EAAE,EAAE;YAC5B,UAAU,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,aAAa,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,IAAI;QACzE,UAAU,EAAE,KAAK,EAAE,IAAc,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzD,MAAM,IAAI,eAAe,CAAC,iDAAiD,EAAE,aAAa,EAAE;oBAC3F,MAAM,EAAE,4BAA4B;oBACpC,SAAS,EAAE,KAAK;oBAChB,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpC,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,aAAa,EAAE;oBACpF,MAAM,EAAE,4BAA4B;oBACpC,SAAS,EAAE,KAAK;oBAChB,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;KACD,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAQ,KAAY;IACxD,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAmC,EACnC,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC5D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;QACzE,MAAM,KAAK,GAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QACtE,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,4EAA4E;YAC5E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACF,CAAC,CAAC,CAAC;IACH,gFAAgF;IAChF,8CAA8C;IAC9C,IAAI,MAAM,EAAE,CAAC;QACZ,eAAe,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACN,cAAc,EAAE,IAAI;QACpB,SAAS,CAAC,OAAO;YAChB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,KAAK;YACJ,MAAM,GAAG,IAAI,CAAC;YACd,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACnB,eAAe,EAAE,CAAC;QACnB,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAmC;IAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG;QACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACzE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9C,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1C,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAwD,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACnI,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAoC,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3I,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAyC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACxJ,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAA0C,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5J,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,OAAmD,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9O,SAAS,EAAE,CAAC,IAAY,EAAE,IAAqB,EAAE,OAAgE,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAC/K,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1C,KAAK,EAAE,CAAC,GAAG,IAAqD,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC3F,MAAM,EAAE,CAAC,GAAG,IAAsD,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAC9F,MAAM,EAAE,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9E,IAAI,EAAE,CAAC,GAAG,IAAoD,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxF,IAAI,EAAE,CAAC,GAAG,IAAoD,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxF,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC;KACnE,CAAC;IACF,MAAM,OAAO,GAAa,CAAC,GAAG,0BAA0B,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,oBAAoB;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,2BAA2B,CAAC,OAAyB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG;QACZ,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,4BAA4B,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvG,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YACnE,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/E,OAAO,4BAA4B,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;KACD,CAAC;IACF,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAaD,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,MAAqB;IACjD,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA2B,EAAE,IAA2B;IAC5F,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,OAAO,EAAE,KAAK,EAAE,OAAkB,EAAE,EAAE,CACrC,mBAAmB,CAClB,MAAM,SAAS,CAAC,OAAO,CACtB,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzG,CACD;QACF,KAAK,EAAE,KAAK,EAAE,OAAkB,EAAE,EAAE;YACnC,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,IAA0C,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAChF,oBAAoB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,oBAAoB,EAAE;QAC5D,kEAAkE;QAClE,OAAO,EAAE,CAAC,OAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,cAAc,EAAE,CAAC,GAAG,IAAoD,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;QAC9G,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE;QAClD,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE;KAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,mCAAmC,CAAC,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAgC,IAAoB,EAAE,OAA0B;IACxG,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAwE,EAAE,CAAC;IACxF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE;QAChD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI;KACzE,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,KAAY;IACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAAgC,IAAoB;IAClF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,IAAI,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,IAAI,GAAG,KAAK,aAAa;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,UAAU,IAAI,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,gFAAgF;AAChF,KAAK,UAAU,uBAAuB,CAAC,OAAyB;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/D,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,wBAAwB,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG;QACd,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,aAAa,EAAE;YAC7F,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK;YACzD,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,EAAE,iCAAiC,CAAC;SACpE,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAmB,CAAC,KAAK,EAAE,EAAE;IAChE,6EAA6E;IAC7E,gFAAgF;IAChF,kFAAkF;IAClF,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,cAAc;IACd,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,uEAAuE;IACvE,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChK,CAAC;IACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,oDAAoD;QACpD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,IAAI,eAAe,CAAC,8EAA8E,EAAE,eAAe,EAAE;YAC1H,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;SAC3D,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAIF,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAyB;IACjD,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACH,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,eAAe,CAAC,MAAkC,EAAE,OAAe;IAC3E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;IAC1C,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,8EAA8E;IAC9E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,MAA4C,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAE5B,KAAK,UAAU,IAAI,CAAC,MAAoB;QACvC,IAAI,CAAC;YACJ,SAAU,CAAC;gBACV,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,KAAK;oBAAE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,WAAW,EAAE,CAAC;YACrB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,+EAA+E;QAC/E,IAAI,MAAM;YAAE,OAAO;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACzD,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC;IACV,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACzC,MAAM,GAAG,IAAI,CAAC;QACd,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,yEAAyE;YACzE,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CACL,IAAI,eAAe,CAAC,uBAAuB,OAAO,oBAAoB,EAAE,aAAa,EAAE;oBACtF,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,EAAE,OAAO,EAAE;oBACpB,KAAK;iBACL,CAAC,CACF,CAAC;gBACF,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,EAAE,CAAC;YACT,OAAO;QACR,CAAC;QACD,8DAA8D;QAC9D,MAAM,EAAE,CAAC;QACT,kEAAkE;QAClE,IAAI,QAAQ;YAAE,OAAO;QACrB,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAkB;QAC9B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC;gBAChB,KAAK,CAAC,KAAK,IAAI,EAAE;oBAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM;wBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,uBAAuB,OAAO,mBAAmB,EAAE,aAAa,EAAE;4BACvH,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;yBACjG,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,CAAC;gBACV,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAClB,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,sEAAsE;QACtE,iEAAiE;QACjE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;QAChB,KAAK,EAAE,GAAkB,EAAE;YAC1B,OAAO,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;IACF,MAAM,eAAe,GAAG,GAAkB,EAAE;QAC3C,sFAAsF;QACtF,IAAI,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACjD,mFAAmF;QACnF,OAAO,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACtE,IAAI,OAAO,KAAK,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC;QACvB,OAAO;YACN,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;SAC3B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,aAAa,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO;YACN,uEAAuE;YACvE,yEAAyE;YACzE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/F,yEAAyE;YACzE,+CAA+C;YAC/C,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;YAChB,iFAAiF;YACjF,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC/C,uEAAuE;YACvE,gEAAgE;YAChE,OAAO;gBACN,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBACvB,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;oBACf,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE;oBACX,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5B,CAAC;aACD,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC,CAAC"}

package/dist/fleets/daemon/fleet-daemon.d.ts ADDED Viewed

@@ -0,0 +1,271 @@
+import type { RpcSource } from '@vibesdotdev/kernel-rpc';
+import { type InvokePipeline, type VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimeExecution } from '@vibesdotdev/kernel/execution';
+import type { CredentialReference, RuntimeRpcDescriptor } from '@vibesdotdev/kernel-rpc';
+import { RpcHttpHandler, type HttpListener, type HttpListenOptions } from '@vibesdotdev/kernel-rpc/http';
+import type { ReachableRuntimeEntry, ReachableRuntimeRegistry } from '@vibesdotdev/platform/fleets';
+import { type ExecutionResolver, type MonitorResolver, type ClientResolver, type KindResolver } from './daemon-root.ts';
+import { type RelayConnection, type WebSocketFactory } from './relay/connect-relay.ts';
+import type { RelayServerAdapter, RelayServeTarget } from './relay/relay-server-adapter.seam.ts';
+/** Options for standing up a fleet daemon RPC server. */
+export interface FleetDaemonOptions {
+    /**
+     * Stable host id. Used as the registered `runtime/rpc` descriptor id, so a
+     * consumer reaches this daemon via `getVibesRemote(hostId)` / `.withId(hostId)`.
+     */
+    readonly hostId: string;
+    /**
+     * The receiving host's own runtime. Every declared `execute`/`spawn` request
+     * that arrives over the wire is composed against it (`composeDeclaredExecution`
+     * / `composeDeclaredSpawn`): the child's environment is this host's, never the
+     * caller's. It also answers the canonical descriptor query (`query({ kind })`),
+     * so a consumer reads this host's `paths/roots` through the fleet root.
+     */
+    readonly runtime: VibesRuntime;
+    /**
+     * The host-side `runtime/execution` impl the daemon exposes. Resolve this from
+     * the daemon's OWN local runtime
+     * (`runtime.query('runtime/execution').resolve()`) or pass a concrete
+     * impl. A function so it can be lazily (re-)resolved per request.
+     */
+    readonly execution: RuntimeExecution | ExecutionResolver;
+    /**
+     * The L1 invoke pipeline EVERY arriving invoke runs through (authz → friction,
+     * L5's two callee gates). Defaults to a bare `DefaultInvokePipeline` (identity
+     * gates) for a trusted/loopback deployment; a real host MUST register L5's
+     * interceptors so a connection bearer never authorizes an invoke (§4.5).
+     *
+     * ENFORCED: a NON-LOOPBACK bind REQUIRES a pipeline that already has at least
+     * one gate registered (`pipeline.size > 0`). `startFleetDaemon` THROWS on a
+     * remote bind with an empty/absent pipeline — see {@link startFleetDaemon}.
+     */
+    readonly pipeline?: InvokePipeline;
+    /**
+     * The connection bearer(s) the listen side accepts — the resolved value(s) of
+     * the host token's `CredentialReference`. When omitted, the listener is OPEN
+     * (no connection auth): valid ONLY for a trusted/loopback bind. A bearer
+     * authorizes a CONNECTION, never an invoke.
+     *
+     * ENFORCED: a NON-LOOPBACK bind REQUIRES at least one connection token.
+     * `startFleetDaemon` THROWS on a remote bind with no tokens.
+     */
+    readonly connectionTokens?: readonly string[];
+    /** Bind port (0 = ephemeral; the actual port is read back from the listener). */
+    readonly port?: number;
+    /**
+     * Bind host. Defaults to loopback (`127.0.0.1`). A non-loopback bind REQUIRES
+     * BOTH a gated pipeline (`pipeline.size > 0`) AND non-empty `connectionTokens`;
+     * `startFleetDaemon` THROWS otherwise. Loopback (`127.0.0.1`/`::1`/`localhost`
+     * /`127.0.0.0/8`) may stay permissive for local dev.
+     */
+    readonly host?: string;
+    /**
+     * The `CredentialReference` a CONSUMER resolves to obtain the connection bearer
+     * (fleet.md §4.5 — never a bare token in the descriptor). Stamped into the
+     * self-registered `runtime/rpc` descriptor's `auth`. The daemon does not resolve
+     * it; the consumer's runtime does, through `resolveCredential` at connect time.
+     */
+    readonly auth?: CredentialReference;
+    /** Optional scope hint advertised to the resolver (hardware/substrate bias). */
+    readonly remoteScope?: RuntimeRpcDescriptor['remoteScope'];
+    /** Optional human-readable name for the descriptor. */
+    readonly name?: string;
+    /**
+     * Relay mode configuration (fleet-relay §3, R3). When present the daemon dials
+     * out to the broker DO instead of (or alongside) listening on a local port. The
+     * relay mode REQUIRES a gated pipeline — `startFleetDaemon` THROWS if
+     * `relay` is set with an ungated pipeline.
+     */
+    readonly relay?: FleetRelayOptions;
+    /**
+     * OPTIONAL read-only `autoloop/monitor` resolver (fleet fan-out). When supplied,
+     * the daemon ALSO exposes `query('autoloop/monitor')` over the same L5-gated wire,
+     * so a cloud surface (hq-web) can enumerate the host's loops with
+     * `getVibesRemote(hostId).query('autoloop/monitor')`. Resolve it once from the
+     * host runtime's `query('autoloop/monitor')`. Omit it on hosts without the
+     * autoloop consumer plugin — the consumer then reports "monitoring unavailable".
+     *
+     * SECURITY: the monitor is read-only; every invoke against it crosses the SAME
+     * `pipeline` (authz → friction) as execution. It adds no ungated surface.
+     */
+    readonly monitor?: MonitorResolver;
+    /**
+     * OPTIONAL `runtime/client`-by-id resolver (D-DAEMON-CLIENT). When supplied, the
+     * daemon ALSO exposes `query('runtime/client').withId(id)` over the same L5-gated
+     * wire, so a remote desktop/browser client (or any feature client) is reachable
+     * on this fleet host with no per-feature daemon change. Every client invoke
+     * crosses the SAME authz+friction pipeline as execution.
+     */
+    readonly resolveClient?: ClientResolver;
+    /**
+     * OPTIONAL explicit wire-method surface for a resolved client id (defaults to
+     * enumerating the client's methods). Supply to pin a narrow, audited method set.
+     */
+    readonly clientWireMethods?: (clientId: string, client: NonNullable<RpcSource>) => readonly string[];
+    /**
+     * OPTIONAL additional-kind proxy (e.g. `filesystem/adapter` for a remote
+     * code-session workspace). Returns the host-side impl + its explicit async wire
+     * surface; path utilities stay pure/consumer-side and are NOT proxied. Every
+     * invoke crosses the SAME L5-gated pipeline as execution.
+     */
+    readonly resolveKind?: KindResolver;
+}
+/**
+ * Relay dial-out configuration for the fleet daemon (fleet-relay §3.3).
+ *
+ * When `relay` is set in `FleetDaemonOptions`, the daemon dials out to the broker
+ * DO. The relay REQUIRES a gated pipeline (same guard as a non-loopback http bind).
+ */
+export interface FleetRelayOptions {
+    /**
+     * The platform-web origin hosting the broker DO, e.g. `https://platform.vibes.dev`.
+     * Used to build the connect URL: `{brokerOrigin}/api/relay/connect?hostId=<id>`.
+     */
+    readonly brokerOrigin: string;
+    /**
+     * The durable host token (the `host_…` enrollment-issued credential, D-R4).
+     * Sent as `Authorization: Bearer <hostToken>` on the WS upgrade.
+     * This is the CONNECT credential; it does NOT authorize any invoke.
+     */
+    readonly hostToken: string;
+    /**
+     * Optional override for the relay server adapter (R1,
+     * `@vibesdotdev/kernel-rpc/relay`). When omitted, the daemon defaults to the
+     * REAL adapter — `createRealRelayServerAdapter()` (see the `startRelayConnection`
+     * closure below: `ro.relayAdapter ?? createRealRelayServerAdapter()`) — which
+     * dispatches inbound relay frames through the target pipeline.
+     *
+     * The frame-discarding `createStubRelayServerAdapter()` is a TEST-ONLY opt-in:
+     * pass it explicitly for isolated reconnect-loop tests that must not depend on
+     * R1's full dispatch. It is never the default.
+     */
+    readonly relayAdapter?: RelayServerAdapter;
+    /**
+     * Whether to ALSO listen on the local http port in addition to relaying out.
+     * Default false (relay-only). Set to true for hybrid mode: loopback dev tools
+     * reach the daemon directly while the cloud reaches it via relay.
+     */
+    readonly alsoListen?: boolean;
+    /**
+     * WebSocket constructor, injected for tests; defaults to the global `WebSocket`.
+     * Threaded straight to `connectRelay` so a test can supply a mock and exercise the
+     * connected-state / relay-descriptor transition without a real network dial. Has
+     * no effect in production (the global WebSocket is used).
+     */
+    readonly WebSocketImpl?: WebSocketFactory;
+}
+/** A running fleet daemon RPC server. */
+export interface FleetDaemon {
+    /** The stable host id (the registered `runtime/rpc` descriptor id). */
+    readonly hostId: string;
+    /** The loopback/remote origin the daemon listens on, e.g. `http://127.0.0.1:54123`. */
+    readonly origin: string;
+    /** The bound port (ephemeral when `port: 0` was requested). */
+    readonly port: number;
+    /** The underlying L4b http handler (diagnostics, mount-as-middleware, leak assertions). */
+    readonly handler: RpcHttpHandler;
+    /**
+     * The active relay connection when the daemon is in relay mode.
+     * `undefined` when relay is not configured; check `.state` for connection status.
+     */
+    readonly relayConnection: RelayConnection | undefined;
+    /**
+     * Start (or restart) the relay dial-out on an ALREADY-RUNNING daemon.
+     *
+     * The enroll-first-run path needs this: the durable host token is unknown at
+     * `startFleetDaemon` time (we hold only the one-time enroll token), so relay
+     * cannot start at construction. The CLI calls this from the host-agent's
+     * `onEnrolled` seam the instant enrollment yields the durable token, so the
+     * machine becomes inbound-reachable on THIS run — no daemon restart required
+     * (fleet-relay §3.3, G9). The daemon's existing L5-gated target is reused;
+     * relay mode still REQUIRES a gated pipeline (throws on an ungated one).
+     *
+     * Idempotent: when the relay is already connecting/connected this returns the
+     * existing connection without dialing a second socket.
+     */
+    startRelay(relay: FleetRelayOptions): RelayConnection;
+    /**
+     * The self-advertised `runtime/rpc` descriptor naming this daemon's reachable
+     * runtime (fleet.md §4.5, the shared output contract). When relay is configured
+     * AND the relay is connected, emits `transport:'relay'` (§3.2). Falls back to
+     * `transport:'http'` when relay is not configured or the connection is pending.
+     */
+    rpcDescriptor(): RuntimeRpcDescriptor;
+    /**
+     * Convenience: register this daemon's `runtime/rpc` descriptor into a
+     * reachable-runtime registry as a `provisioned`-style sticky entry sourced by
+     * the daemon itself (fleet.md §4.1). The descriptor is the same shared output
+     * contract discovery/provisioning adapters emit.
+     */
+    registerInto(registry: ReachableRuntimeRegistry): ReachableRuntimeEntry;
+    /** Tear down: close every connection (free all refs) + stop the server. */
+    stop(): Promise<void>;
+}
+/** The `sourceAdapterId` a daemon self-registration is attributed to in the registry. */
+export declare const FLEET_DAEMON_SOURCE_ADAPTER_ID = "fleet/daemon";
+/**
+ * Build the self-advertised `runtime/rpc` descriptor for a daemon listening at
+ * `origin` over http (fleet.md §4.5). The shared output contract: `{ transport,
+ * target, auth?, remoteScope? }`. `auth` carries a `CredentialReference` (never a
+ * bare token) the consumer resolves at connect time.
+ */
+export declare function buildDaemonRpcDescriptor(options: {
+    readonly hostId: string;
+    readonly origin: string;
+    readonly auth?: CredentialReference;
+    readonly remoteScope?: RuntimeRpcDescriptor['remoteScope'];
+    readonly name?: string;
+}): RuntimeRpcDescriptor;
+/**
+ * Build the self-advertised `runtime/rpc` descriptor for a daemon connected via
+ * the relay (fleet-relay §3.2). Emits `transport:'relay'` with
+ * `target:{transport:'relay', brokerOrigin, hostId}` so the relay client
+ * transport (R1) can route consumers to this host through the broker DO.
+ */
+export declare function buildRelayDaemonRpcDescriptor(options: {
+    readonly hostId: string;
+    readonly brokerOrigin: string;
+    readonly auth?: CredentialReference;
+    readonly remoteScope?: RuntimeRpcDescriptor['remoteScope'];
+    readonly name?: string;
+}): RuntimeRpcDescriptor;
+/** What the fleet daemon's listen target is built from: the receiving host and what it exposes. */
+export type FleetDaemonTargetOptions = Pick<FleetDaemonOptions, 'runtime' | 'execution' | 'pipeline' | 'monitor' | 'resolveClient' | 'clientWireMethods' | 'resolveKind'> & {
+    /** The receiving host's own cancellation (the daemon's lifetime). */
+    readonly signal: AbortSignal;
+};
+/**
+ * The fleet daemon's listen target: the daemon root over the receiving host,
+ * the L1 invoke pipeline every arriving invoke runs through, and the
+ * execution↔wire policy. Every transport the daemon serves (the http listener
+ * and the relay dial-out) serves exactly this target.
+ */
+export declare function createFleetDaemonTarget(options: FleetDaemonTargetOptions): RelayServeTarget;
+/**
+ * Stand up a fleet daemon RPC server (fleet.md §4.3; L6d phase 4).
+ *
+ * Mounts L4b's `listenHttp` over a daemon root that exposes the host's
+ * `runtime/execution`, with the supplied L1 invoke pipeline (L5's gates) and
+ * connection-bearer auth. Returns a {@link FleetDaemon} whose `rpcDescriptor()` is
+ * the value to register into the reachable-runtime registry — after which a
+ * consumer reaches the host with `getVibesRemote(hostId)`.
+ *
+ * No ungated path: the listen side runs every invoke through `options.pipeline`.
+ *
+ * SECURE-BY-DEFAULT (fleet.md §4.5). A NON-LOOPBACK bind is REFUSED (throws)
+ * unless BOTH hold:
+ *   1. the supplied invoke pipeline already has gates registered
+ *      (`pipeline.size > 0` — an absent or empty/identity pipeline is rejected), AND
+ *   2. `connectionTokens` is non-empty.
+ * A bare/empty pipeline plus a remote bind would expose an UNGATED execution
+ * surface to the network; an open listener plus a remote bind would let any peer
+ * connect. Loopback binds (`127.0.0.1`/`::1`/`localhost`/`127.0.0.0/8`) may stay
+ * permissive for local dev.
+ *
+ * RELAY MODE (fleet-relay §3, R3): when `options.relay` is set the daemon ALSO
+ * dials out to the broker DO. Relay mode REQUIRES a gated pipeline — `startFleetDaemon`
+ * THROWS if `options.relay` is set with an ungated pipeline. The relay guard mirrors
+ * the http non-loopback bind guard: an ungated relay pipeline is equally dangerous.
+ */
+export declare function createFleetDaemon(options: FleetDaemonOptions, listenHttp: (port: number, options: HttpListenOptions, host: string) => HttpListener | Promise<HttpListener>): Promise<FleetDaemon>;
+//# sourceMappingURL=fleet-daemon.d.ts.map

package/dist/fleets/daemon/fleet-daemon.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fleet-daemon.d.ts","sourceRoot":"","sources":["../../../src/fleets/daemon/fleet-daemon.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AA4BzD,OAAO,EAA0C,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EACN,cAAc,EAEd,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAEN,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAEjG,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IAClC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;IAEzD;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAEnC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAEpC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE3D,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAEnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IAEnC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IAExC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;IAErG;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,SAAS,CAAC;IAEtD;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAAC;IAEtD;;;;;OAKG;IACH,aAAa,IAAI,oBAAoB,CAAC;IAEtC;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IAExE,2EAA2E;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,yFAAyF;AACzF,eAAO,MAAM,8BAA8B,iBAAiB,CAAC;AAiC7D;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,oBAAoB,CAavB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,oBAAoB,CAavB;AAED,mGAAmG;AACnG,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAC1C,kBAAkB,EAClB,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,mBAAmB,GAAG,aAAa,CACxG,GAAG;IACH,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,gBAAgB,CA2B3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAC1G,OAAO,CAAC,WAAW,CAAC,CAiMtB"}

package/dist/fleets/daemon/fleet-daemon.js ADDED Viewed

@@ -0,0 +1,327 @@
+import { RuntimeExecutionPortSchema, WireFunctionSchema } from "../../schemas/fleet-wire.js";
+/**
+ * The fleet daemon RPC server (fleet.md §4.3; L6d phase 4 — the daemon-rpc lane).
+ *
+ * A fleet HOST runs the vibes daemon. The daemon exposes a `runtime/rpc` SERVER
+ * over http (L4b's `listenHttp` / `RpcHttpHandler`, the listen side) onto its OWN
+ * local runtime — specifically the host's `runtime/execution` impl (execute /
+ * spawn / session) backed by the local filesystem. A consumer reaches the host
+ * with `getVibesRemote(hostId)` / `query('runtime/execution').on(hostRef)`; the
+ * resolver does the rest. There is NO special "fleet execution adapter" — the
+ * daemon advertises a reachable `runtime/rpc` descriptor (the L6b registry
+ * contract) and the standard rpc resolver routes the call.
+ *
+ * THE GATE CARRIES THROUGH (§4.5, the phase-4 security gate). The daemon adds NO
+ * ungated path: it mounts L4b's `RpcHttpHandler`, whose `HttpListenSession` runs
+ * EVERY arriving invoke through the SAME `dispatchRequest` → L1 `InvokePipeline`
+ * (authz → friction) a local invoke runs through. A remote peer holding a valid
+ * connection bearer is STILL denied an out-of-policy command by friction. The
+ * daemon supplies only the CONNECTION credential (a `CredentialReference` bearer,
+ * the host token); per-invoke authz + friction are L5's, inside the pipeline.
+ *
+ * The daemon advertises its environment identity + execution capabilities
+ * (`resolveCommand` / `getCapabilities` on the exposed impl) so a consumer can
+ * pick it — but those are advertised THROUGH the execution kind it exposes, never
+ * restated on the host (corrections #2/#3).
+ */
+import { getLogger } from '@vibesdotdev/logging/contexts';
+import { CapabilityError, DefaultInvokePipeline } from '@vibesdotdev/kernel';
+import { RpcHttpHandler, TokenRegistry } from '@vibesdotdev/kernel-rpc/http';
+import { createFleetDaemonRoot } from "./daemon-root.js";
+import { classifyExecutionResult, bindExecutionChannel, EXECUTION_KIND_ID } from "./execution-listen-policy.js";
+import { connectRelay } from "./relay/connect-relay.js";
+import { createRealRelayServerAdapter } from "./relay/real-relay-server-adapter.js";
+/** The `sourceAdapterId` a daemon self-registration is attributed to in the registry. */
+export const FLEET_DAEMON_SOURCE_ADAPTER_ID = 'fleet/daemon';
+/** Default loopback bind host. */
+const DEFAULT_BIND_HOST = '127.0.0.1';
+/**
+ * Loopback bind hosts that may stay permissive for local dev (no gates / no
+ * tokens required). Anything else is a non-loopback bind and is held to the
+ * full security gate (fleet.md §4.5). Matched case-insensitively, brackets
+ * stripped so `[::1]` is treated as `::1`.
+ */
+const LOOPBACK_HOSTS = new Set([
+    '127.0.0.1',
+    '::1',
+    '0:0:0:0:0:0:0:1',
+    'localhost'
+]);
+/** Is `host` a loopback bind that may stay permissive for local dev? */
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+    if (LOOPBACK_HOSTS.has(normalized))
+        return true;
+    // `127.0.0.0/8` is entirely loopback (e.g. 127.0.0.2).
+    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized);
+}
+/** Normalize an execution impl-or-resolver into a per-request resolver. */
+function asExecutionResolver(execution) {
+    const implementation = RuntimeExecutionPortSchema.safeParse(execution);
+    if (implementation.success)
+        return () => implementation.data;
+    return () => RuntimeExecutionPortSchema.parse(WireFunctionSchema.parse(execution)());
+}
+/**
+ * Build the self-advertised `runtime/rpc` descriptor for a daemon listening at
+ * `origin` over http (fleet.md §4.5). The shared output contract: `{ transport,
+ * target, auth?, remoteScope? }`. `auth` carries a `CredentialReference` (never a
+ * bare token) the consumer resolves at connect time.
+ */
+export function buildDaemonRpcDescriptor(options) {
+    const descriptor = {
+        id: options.hostId,
+        kind: 'runtime/rpc',
+        name: options.name ?? `Fleet daemon ${options.hostId}`,
+        description: `Fleet daemon runtime/rpc server exposing ${EXECUTION_KIND_ID} over http.`,
+        enabled: true,
+        transport: 'http',
+        target: { transport: 'http', origin: options.origin },
+        auth: options.auth,
+        remoteScope: options.remoteScope
+    };
+    return descriptor;
+}
+/**
+ * Build the self-advertised `runtime/rpc` descriptor for a daemon connected via
+ * the relay (fleet-relay §3.2). Emits `transport:'relay'` with
+ * `target:{transport:'relay', brokerOrigin, hostId}` so the relay client
+ * transport (R1) can route consumers to this host through the broker DO.
+ */
+export function buildRelayDaemonRpcDescriptor(options) {
+    const descriptor = {
+        id: options.hostId,
+        kind: 'runtime/rpc',
+        name: options.name ?? `Fleet daemon ${options.hostId} (relay)`,
+        description: `Fleet daemon runtime/rpc server exposing ${EXECUTION_KIND_ID} via relay broker.`,
+        enabled: true,
+        transport: 'relay',
+        target: { transport: 'relay', brokerOrigin: options.brokerOrigin, hostId: options.hostId },
+        auth: options.auth,
+        remoteScope: options.remoteScope
+    };
+    return descriptor;
+}
+/**
+ * The fleet daemon's listen target: the daemon root over the receiving host,
+ * the L1 invoke pipeline every arriving invoke runs through, and the
+ * execution↔wire policy. Every transport the daemon serves (the http listener
+ * and the relay dial-out) serves exactly this target.
+ */
+export function createFleetDaemonTarget(options) {
+    // Fleet fan-out + D-DAEMON-CLIENT: the daemon ALSO exposes the read-only
+    // autoloop/monitor, and — when supplied — runtime/client by id + any additional
+    // proxied kinds (e.g. filesystem/adapter), all over the same L5-gated wire.
+    const root = createFleetDaemonRoot({ runtime: options.runtime, signal: options.signal }, asExecutionResolver(options.execution), options.monitor, {
+        resolveClient: options.resolveClient,
+        clientWireMethods: options.clientWireMethods,
+        resolveKind: options.resolveKind
+    });
+    return {
+        root,
+        // The two callee gates run here, on every arriving invoke. Identity pipeline
+        // is the loopback default; a real host passes L5's interceptors.
+        pipeline: options.pipeline ?? new DefaultInvokePipeline(),
+        classifyResult: classifyExecutionResult,
+        bindChannel: bindExecutionChannel,
+        // Gate context: invokes against the daemon root are execution-kind invokes.
+        kindOf: () => EXECUTION_KIND_ID,
+        // The receiving host's lifecycle bounds every reverse-leg invoke a relay serves (RC07).
+        lifecycle: options.runtime.lifecycle,
+        runInvocation: (work, connection) => options.runtime.runInvocation(work, { signal: connection.signal })
+    };
+}
+/**
+ * Stand up a fleet daemon RPC server (fleet.md §4.3; L6d phase 4).
+ *
+ * Mounts L4b's `listenHttp` over a daemon root that exposes the host's
+ * `runtime/execution`, with the supplied L1 invoke pipeline (L5's gates) and
+ * connection-bearer auth. Returns a {@link FleetDaemon} whose `rpcDescriptor()` is
+ * the value to register into the reachable-runtime registry — after which a
+ * consumer reaches the host with `getVibesRemote(hostId)`.
+ *
+ * No ungated path: the listen side runs every invoke through `options.pipeline`.
+ *
+ * SECURE-BY-DEFAULT (fleet.md §4.5). A NON-LOOPBACK bind is REFUSED (throws)
+ * unless BOTH hold:
+ *   1. the supplied invoke pipeline already has gates registered
+ *      (`pipeline.size > 0` — an absent or empty/identity pipeline is rejected), AND
+ *   2. `connectionTokens` is non-empty.
+ * A bare/empty pipeline plus a remote bind would expose an UNGATED execution
+ * surface to the network; an open listener plus a remote bind would let any peer
+ * connect. Loopback binds (`127.0.0.1`/`::1`/`localhost`/`127.0.0.0/8`) may stay
+ * permissive for local dev.
+ *
+ * RELAY MODE (fleet-relay §3, R3): when `options.relay` is set the daemon ALSO
+ * dials out to the broker DO. Relay mode REQUIRES a gated pipeline — `startFleetDaemon`
+ * THROWS if `options.relay` is set with an ungated pipeline. The relay guard mirrors
+ * the http non-loopback bind guard: an ungated relay pipeline is equally dangerous.
+ */
+export async function createFleetDaemon(options, listenHttp) {
+    const bindHost = options.host ?? DEFAULT_BIND_HOST;
+    const hasConnectionTokens = !!options.connectionTokens && options.connectionTokens.length > 0;
+    // A pipeline with no registered interceptors is identity (every invoke passes
+    // ungated). `size` is the canonical gate-count accessor on the L1 pipeline.
+    const hasGates = !!options.pipeline && options.pipeline.size > 0;
+    // THE HTTP SECURITY GATE (§4.5). On a non-loopback bind, refuse to expose the
+    // daemon's execution surface unless it is BOTH gated (L5 interceptors present)
+    // AND connection-authenticated (at least one bearer). Loopback stays permissive.
+    if (!isLoopbackHost(bindHost)) {
+        if (!hasGates) {
+            throw new CapabilityError(`startFleetDaemon: refusing a non-loopback bind to "${bindHost}" with an ungated invoke pipeline. ` +
+                `A remote daemon MUST supply an invoke pipeline with L5 gates registered (pipeline.size > 0) ` +
+                `so a connection bearer never authorizes an invoke (fleet.md §4.5). ` +
+                `Bind to 127.0.0.1 for local dev, or pass a gated pipeline.`, 'PERMISSION_DENIED', { reason: 'fleet-daemon-ungated-bind', retryable: false });
+        }
+        if (!hasConnectionTokens) {
+            throw new CapabilityError(`startFleetDaemon: refusing a non-loopback bind to "${bindHost}" with no connectionTokens. ` +
+                `A remote daemon MUST supply at least one connection bearer (fleet.md §4.5) so the listener ` +
+                `is not open to the network. Bind to 127.0.0.1 for local dev, or pass connectionTokens.`, 'PERMISSION_DENIED', { reason: 'fleet-daemon-open-bind', retryable: false });
+        }
+    }
+    // THE RELAY SECURITY GATE (fleet-relay §4). Relay mode REQUIRES a gated pipeline.
+    // An ungated relay pipeline is equivalent to an ungated remote bind: the broker
+    // can forward arbitrary frames to the daemon's execution surface without L5 authz.
+    if (options.relay && !hasGates) {
+        throw new CapabilityError(`startFleetDaemon: refusing to start relay mode with an ungated invoke pipeline. ` +
+            `Relay mode REQUIRES a pipeline with L5 gates registered (pipeline.size > 0) ` +
+            `so the broker cannot authorize any invoke (fleet-relay §4). ` +
+            `Pass a pipeline with createAuthzInterceptor + createFrictionInterceptor.`, 'PERMISSION_DENIED', { reason: 'fleet-daemon-ungated-relay', retryable: false });
+    }
+    // The daemon's lifetime is the only cancellation a declared execute carries:
+    // stopping the daemon aborts its in-flight runs. A remote signal never arrives.
+    const lifetime = new AbortController();
+    const target = createFleetDaemonTarget({ ...options, signal: lifetime.signal });
+    // Connection auth: a bearer authorizes a CONNECTION only. When tokens are
+    // supplied, an unknown/absent bearer is denied at the listener BEFORE a request
+    // reaches a session. Per-invoke authz/friction still run regardless (L5's,
+    // inside the pipeline).
+    let tokenRegistry;
+    if (hasConnectionTokens) {
+        tokenRegistry = new TokenRegistry();
+        for (const token of options.connectionTokens)
+            tokenRegistry.register(token, { label: options.hostId });
+    }
+    // Relay mode: dial out unless alsoListen=false (default) AND relay is the only mode.
+    // When relay.alsoListen=true the http listener is also started for loopback dev tools.
+    // `activeRelayOptions` is mutable: startRelay() (the enroll-first-run path) sets it
+    // when relay was not configured at construction.
+    let activeRelayOptions = options.relay;
+    const startListener = !activeRelayOptions || activeRelayOptions.alsoListen;
+    // connectRelay closure — reused by the initial start AND by startRelay() (the
+    // enroll-first-run path), so both paths build an identical relay dial-out. The
+    // daemon's L5-gated `target`/`hostId` are captured here.
+    const startRelayConnection = (ro) => connectRelay({
+        logger: getLogger('fleet-daemon/relay', options.runtime),
+        brokerOrigin: ro.brokerOrigin,
+        hostId: options.hostId,
+        hostToken: ro.hostToken,
+        target,
+        lifecycle: options.runtime.lifecycle,
+        // MISMATCH 3 RECONCILED: inject the REAL R1-backed adapter (or a caller
+        // override). connectRelay defaults to the real adapter too; we pass it
+        // explicitly so the daemon's choice is legible at the call site.
+        relayAdapter: ro.relayAdapter ?? createRealRelayServerAdapter(),
+        WebSocketImpl: ro.WebSocketImpl,
+        onConnected: () => {
+            getLogger('fleet-daemon/relay', options.runtime).info(`[fleet-daemon/relay] ${options.hostId} connected to ${ro.brokerOrigin}`);
+        },
+        onDisconnected: (reason) => {
+            getLogger('fleet-daemon/relay', options.runtime).warn(`[fleet-daemon/relay] ${options.hostId} disconnected: ${reason}`);
+        },
+        onReconnecting: (attempt, delayMs) => {
+            getLogger('fleet-daemon/relay', options.runtime).info(`[fleet-daemon/relay] ${options.hostId} reconnecting (attempt ${attempt}, delay ${delayMs}ms)`);
+        }
+    });
+    const listener = startListener
+        ? await listenHttp(options.port ?? 0, { ...target, tokenRegistry }, bindHost)
+        : (() => {
+            // Relay-only mode: spin up a loopback-only listener as the http handler
+            // backing diagnostics and handler access, but it is NOT advertised in the
+            // relay descriptor and not expected to receive remote invokes. This keeps
+            // the FleetDaemon interface stable (handler, origin, port are always set).
+            const h = new RpcHttpHandler({ ...target });
+            return {
+                origin: `http://127.0.0.1:0`,
+                port: 0,
+                handler: h,
+                // Nothing is bound in relay-only mode, so there is nothing to tear down.
+                stop: async () => { }
+            };
+        })();
+    // Start the relay dial-out if configured at construction. The enroll-first-run
+    // path instead calls daemon.startRelay() once enrollment yields the durable token.
+    let relayConn;
+    if (activeRelayOptions) {
+        relayConn = startRelayConnection(activeRelayOptions);
+    }
+    const buildDescriptor = () => {
+        // When the relay is connected, advertise transport:'relay' so consumers route
+        // through the broker. Before the relay connects (or when relay is not configured),
+        // fall back to http (the http listener is always available for loopback tools).
+        if (relayConn && activeRelayOptions && relayConn.state === 'connected') {
+            return buildRelayDaemonRpcDescriptor({
+                hostId: options.hostId,
+                brokerOrigin: activeRelayOptions.brokerOrigin,
+                auth: options.auth,
+                remoteScope: options.remoteScope,
+                name: options.name
+            });
+        }
+        return buildDaemonRpcDescriptor({
+            hostId: options.hostId,
+            origin: listener.origin,
+            auth: options.auth,
+            remoteScope: options.remoteScope,
+            name: options.name
+        });
+    };
+    return {
+        hostId: options.hostId,
+        origin: listener.origin,
+        port: listener.port,
+        handler: listener.handler,
+        get relayConnection() {
+            return relayConn;
+        },
+        startRelay(relay) {
+            // Idempotent: a live (connecting/connected/reconnecting) relay is reused —
+            // no second socket. Only a stopped/absent relay is (re)dialed.
+            if (relayConn && relayConn.state !== 'stopped')
+                return relayConn;
+            // Relay mode REQUIRES a gated pipeline — mirror the construction-time guard
+            // (fleet-relay §4). An ungated relay would let the broker forward arbitrary
+            // frames to the daemon's execution surface without L5 authz.
+            if (!hasGates) {
+                throw new CapabilityError(`FleetDaemon.startRelay: refusing to start relay mode with an ungated invoke ` +
+                    `pipeline. Relay mode REQUIRES a pipeline with L5 gates registered ` +
+                    `(pipeline.size > 0) so the broker cannot authorize any invoke (fleet-relay §4).`, 'PERMISSION_DENIED', { reason: 'fleet-daemon-ungated-relay', retryable: false });
+            }
+            activeRelayOptions = relay;
+            relayConn = startRelayConnection(relay);
+            return relayConn;
+        },
+        rpcDescriptor: buildDescriptor,
+        registerInto(registry) {
+            const entry = {
+                rpc: buildDescriptor(),
+                // A daemon-exposed host is sticky like a provisioned resource: it persists
+                // until the daemon stops (fleet.md §4.1 — provisioned entries are sticky;
+                // discovered entries carry a TTL). The daemon owns its own lifecycle.
+                origin: 'provisioned',
+                sourceAdapterId: FLEET_DAEMON_SOURCE_ADAPTER_ID,
+                registeredAt: new Date().toISOString()
+            };
+            registry.register(entry);
+            return entry;
+        },
+        async stop() {
+            lifetime.abort();
+            relayConn?.stop();
+            await relayConn?.settled;
+            // The listener reports its connections' typed close failures; the daemon's stop surfaces them.
+            await listener.stop();
+        }
+    };
+}
+//# sourceMappingURL=fleet-daemon.js.map