@vibesdotdev/workers 0.0.0-stage → 1.0.0-rc.2

package/dist/code-execution/server/child-runner.js

@@ -0,0 +1,482 @@
+/**
+ * Code execution in a child process (the only execution path; the in-process
+ * `vm` sandbox is deleted).
+ *
+ * Each run is one child launched through the handed runtime's
+ * `runtime/execution` provider:
+ *
+ * - Where the host declares restricted execution (`executeRestricted` with a
+ *   declared `restrictedExecution.writableBase`), the run goes through it as
+ *   an additional layer (filesystem grants, network denied, env replaced);
+ *   otherwise it is the plain child below.
+ * - `envMode: 'replace'` with only the declared variables below: no host
+ *   environment, no credentials. (The execution contract's name for "only
+ *   what is declared" is `replace`; it has no separate `none`.)
+ * - A fresh scratch cwd from the runtime's temporary root
+ *   (`filesystem/adapter` `createTemporaryDirectory`), removed after the run.
+ * - A deadline through `runtime.lifecycle.wait`; at the deadline the child's
+ *   tree is killed and the run refuses `TIMEOUT code-execution-deadline`.
+ * - Inputs (`testData`, `inputs`: e.g. `previousStepOutput`, `expected`) go
+ *   over stdin as JSON. A JS/TS result comes back over stdout as one JSON
+ *   record; Python keeps its printed-output contract.
+ * - Combined stdout/stderr is capped; over the cap the child is killed and
+ *   the run refuses `INVALID_INPUT code-execution-output-limit`.
+ *
+ * This is process separation, not a hostile-code sandbox: the child runs as
+ * the host user with the host's filesystem and network reach.
+ */
+import { CapabilityError, CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem/client/resolve-adapter';
+import { codeExecutionResultSchema } from "../schemas/index.js";
+import { getLanguageRuntimeDescriptor } from "../schemas/languages.js";
+import { validatePythonSecurity, validateScriptSecurity } from "./security-patterns.js";
+/** Combined stdout+stderr bytes a run may produce before it is refused. */
+export const CODE_EXECUTION_MAX_OUTPUT_BYTES = 1_048_576;
+/** The stdin payload (snippet inputs) a run may carry. */
+export const CODE_EXECUTION_MAX_INPUT_BYTES = 1_048_576;
+/** Marks the harness's result record on a JS/TS child's stdout. */
+const RESULT_MARKER = '\u001eVIBES_CODE_RESULT\u001e';
+const OUTPUT_LINE_LIMIT = 10_000;
+const LOG_ENTRY_LIMIT = 1_000;
+/** Headroom past the provider-enforced deadline before the runtime's own wait gives up. */
+const RESTRICTED_DEADLINE_GRACE_MS = 5_000;
+/**
+ * The JS/TS harness: reads the JSON inputs from stdin (or, under restricted
+ * execution, which carries no stdin, from `--input`), exposes them as
+ * `TEST_DATA` and `INPUT`, captures `console`, imports the snippet module,
+ * and writes one marked JSON record: `{ success, output, logs, returnValue, error }`.
+ */
+const SCRIPT_HARNESS = `
+const inputArgAt = process.argv.indexOf('--input');
+let raw;
+if (inputArgAt >= 0) {
+	raw = process.argv[inputArgAt + 1];
+} else {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	raw = Buffer.concat(chunks).toString('utf8');
+}
+const input = JSON.parse(raw);
+const output = [];
+const logs = [];
+const format = (value) => (typeof value === 'object' && value !== null ? JSON.stringify(value, null, 2) : String(value));
+const record = (level) => (...args) => {
+	const message = args.map(format).join(' ');
+	if (logs.length < input.logLimit) logs.push({ level, message, timestamp: Date.now() });
+	if (output.length < input.outputLimit) output.push(message);
+};
+globalThis.console = {
+	log: record('info'), info: record('info'), warn: record('warn'),
+	error: record('error'), debug: record('debug'), trace: record('trace')
+};
+globalThis.TEST_DATA = input.testData ?? {};
+globalThis.INPUT = input.inputs ?? {};
+globalThis.__result = undefined;
+let failure = null;
+try {
+	await import(input.entry);
+} catch (error) {
+	failure = error instanceof Error ? error.message : String(error);
+}
+const replacer = () => {
+	const seen = new WeakSet();
+	return (_key, value) => {
+		if (typeof value === 'bigint') return value.toString();
+		if (typeof value === 'object' && value !== null) {
+			if (seen.has(value)) return '[Circular]';
+			seen.add(value);
+		}
+		return value;
+	};
+};
+const result = globalThis.__result;
+let returnValue;
+if (failure === null && typeof result !== 'undefined') {
+	const encoded = JSON.stringify(result, replacer());
+	output.push('Return value: ' + encoded);
+	returnValue = encoded === undefined ? null : JSON.parse(encoded);
+}
+const record_ = failure === null
+	? { success: true, output, logs, returnValue }
+	: { success: false, output: [], logs: [], error: failure };
+process.stdout.write(${JSON.stringify(RESULT_MARKER)} + JSON.stringify(record_) + '\\n', () => process.exit(0));
+`;
+/** The Python prelude: reads the JSON inputs (stdin, or `--input` under restricted execution) as `TEST_DATA` and `INPUT`. */
+function pythonSource(code) {
+    return ('import json, sys\n' +
+        "_VIBES_INPUT = json.loads(sys.argv[2] if len(sys.argv) > 2 and sys.argv[1] == '--input' else sys.stdin.read())\n" +
+        "TEST_DATA = _VIBES_INPUT.get('testData') or {}\n" +
+        "INPUT = _VIBES_INPUT.get('inputs') or {}\n" +
+        '# --- user code ---\n' +
+        code +
+        '\n');
+}
+function planFor(language, code) {
+    const descriptor = getLanguageRuntimeDescriptor(language);
+    const binary = descriptor.processBinary;
+    if (!binary) {
+        throw new CapabilityError(`Language '${language}' declares no process binary.`, 'UNAVAILABLE', {
+            reason: 'code-execution-interpreter-unavailable',
+            retryable: false,
+            details: { language }
+        });
+    }
+    if (language === 'python') {
+        return {
+            binary,
+            args: ['-I', '-S', 'main.py'],
+            files: [{ name: 'main.py', data: pythonSource(code) }],
+            env: (scratch) => ({ HOME: scratch, TMPDIR: scratch, PYTHONDONTWRITEBYTECODE: '1', PYTHONUNBUFFERED: '1' }),
+            validate: validatePythonSecurity
+        };
+    }
+    const snippet = language === 'typescript' ? 'snippet.ts' : 'snippet.js';
+    return {
+        binary,
+        args: ['--no-install', 'harness.mjs'],
+        files: [
+            { name: 'harness.mjs', data: SCRIPT_HARNESS },
+            { name: snippet, data: code }
+        ],
+        env: (scratch) => ({ HOME: scratch, TMPDIR: scratch, NO_COLOR: '1' }),
+        validate: validateScriptSecurity
+    };
+}
+function sanitize(message, scratch) {
+    const withoutScratch = scratch ? message.split(scratch).join('[scratch]') : message;
+    return withoutScratch
+        .replace(/\/[^\s]+/g, '[path]')
+        .replace(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g, '[ip]')
+        .replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, '[uuid]')
+        .substring(0, 500);
+}
+/** Drain the child's two streams into one byte budget; `onOverflow` fires once when it is exceeded. */
+class BoundedCapture {
+    limit;
+    onOverflow;
+    total = 0;
+    chunks = { stdout: Array(), stderr: Array() };
+    /** Only cancellation is needed; the structural type holds across Bun's and Node's stream declarations. */
+    readers = [];
+    overflowed = false;
+    constructor(limit, onOverflow) {
+        this.limit = limit;
+        this.onOverflow = onOverflow;
+    }
+    async drain(stream, into) {
+        if (!stream)
+            return;
+        const reader = stream.getReader();
+        this.readers.push(reader);
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return;
+            this.total += value.byteLength;
+            if (this.total > this.limit) {
+                if (!this.overflowed) {
+                    this.overflowed = true;
+                    this.onOverflow();
+                }
+                await reader.cancel();
+                return;
+            }
+            this.chunks[into].push(value);
+        }
+    }
+    /** Stop reading; a stream still held open by a descendant must not pin the run. */
+    async release() {
+        // best-effort cleanup: a reader already closed by its stream rejects cancel(); the run's outcome does not depend on it
+        await Promise.allSettled(this.readers.map((reader) => reader.cancel()));
+    }
+    text(which) {
+        return Buffer.concat(this.chunks[which]).toString('utf8');
+    }
+}
+function exitedOrAborted(handle, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        if (signal.aborted)
+            return onAbort();
+        signal.addEventListener('abort', onAbort, { once: true });
+        handle.exited.then((exit) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(exit);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+    });
+}
+async function settleFailedChild(handle, capture) {
+    return Promise.allSettled([
+        Promise.resolve().then(() => handle.kill('SIGKILL')),
+        Promise.resolve().then(() => handle.exited),
+        Promise.resolve().then(() => capture.release())
+    ]);
+}
+async function openScratch(runtime) {
+    const fs = await resolveFileSystemAdapter(runtime);
+    if (!fs.createTemporaryDirectory) {
+        throw new CapabilityError('Code execution needs a per-run scratch directory from the runtime temporary root.', 'UNAVAILABLE', {
+            reason: 'code-execution-scratch-unavailable',
+            retryable: false,
+            recoveryHint: 'Compose a filesystem adapter with the temporary-directory capability (the Bun adapter over paths/roots).'
+        });
+    }
+    return fs.createTemporaryDirectory();
+}
+async function resolveBinary(execution, binary, language) {
+    const command = await execution.resolveCommand(binary);
+    if (!command) {
+        throw new CapabilityError(`The '${binary}' interpreter for ${language} is not resolvable on this host.`, 'UNAVAILABLE', {
+            reason: 'code-execution-interpreter-unavailable',
+            retryable: false,
+            details: { language, binary }
+        });
+    }
+    return command;
+}
+function outputLimitRefusal(pid, cause) {
+    return new CapabilityError(`Code execution output exceeded ${CODE_EXECUTION_MAX_OUTPUT_BYTES} bytes; the run was stopped.`, 'INVALID_INPUT', {
+        reason: 'code-execution-output-limit',
+        retryable: false,
+        details: pid === undefined
+            ? { limit: CODE_EXECUTION_MAX_OUTPUT_BYTES }
+            : { limit: CODE_EXECUTION_MAX_OUTPUT_BYTES, pid },
+        cause
+    });
+}
+function deadlineRefusal(timeoutMs, pid, cause) {
+    return new CapabilityError(`Code execution exceeded its ${timeoutMs}ms deadline; the run was stopped.`, 'TIMEOUT', {
+        reason: 'code-execution-deadline',
+        retryable: false,
+        details: pid === undefined ? { timeoutMs } : { timeoutMs, pid },
+        cause
+    });
+}
+/**
+ * The restricted layer: the provider's `executeRestricted` (filesystem grants,
+ * network denied, env replaced) when the host declared it. `null` only when
+ * the provider has no such operation or refuses `restricted-base-undeclared`,
+ * both before any launch: the host declared no restricted execution. Every
+ * other refusal is the declared host's and propagates. The contract carries
+ * no stdin, so the inputs travel as `input.json` in the scratch directory,
+ * which must lie inside the host's declared writable base.
+ */
+async function runRestricted(runtime, execution, launch, config, signal) {
+    if (!execution.executeRestricted)
+        return null;
+    const restricted = execution.executeRestricted.bind(execution);
+    const payloadString = new TextDecoder().decode(launch.payload);
+    const interpreterRoot = launch.command.slice(0, launch.command.lastIndexOf('/')) || '/';
+    const outcome = await runtime.lifecycle.wait((signal) => restricted({
+        command: launch.command,
+        args: [...launch.args, '--input', payloadString],
+        cwd: launch.cwd,
+        env: launch.env,
+        readOnlyRoots: [interpreterRoot],
+        writableRoot: launch.cwd,
+        network: 'deny',
+        timeoutMs: config.timeout,
+        maxOutputBytes: CODE_EXECUTION_MAX_OUTPUT_BYTES,
+        signal
+    }), 
+    // The provider enforces the deadline; the wait adds the runtime's disposal.
+    { timeoutMs: config.timeout + RESTRICTED_DEADLINE_GRACE_MS, reason: 'code-execution-deadline', signal }).then((result) => ({ status: 'success', result }), (error) => {
+        return { status: 'failure', error: CaughtFailureSchema.parse(error) };
+    });
+    if (outcome.status === 'failure') {
+        const { error } = outcome;
+        if (error instanceof Error && isCapabilityError(error) && error.reason === 'restricted-base-undeclared')
+            return null;
+        if (error instanceof Error && isCapabilityError(error) && error.code === 'TIMEOUT' && error.reason === 'wait-timeout') {
+            throw deadlineRefusal(config.timeout, undefined, error);
+        }
+        throw error;
+    }
+    const result = outcome.result;
+    if (result.terminationReason === 'timeout')
+        throw deadlineRefusal(config.timeout);
+    if (result.terminationReason === 'output-limit')
+        throw outputLimitRefusal();
+    if (result.terminationReason === 'aborted') {
+        throw new CapabilityError('Code execution was cancelled.', 'CANCELLED', { reason: 'code-execution-aborted', retryable: false });
+    }
+    return { stdout: result.stdout, stderr: result.stderr, exitCode: result.exitCode, restricted: true };
+}
+/** The plain child: `spawn` with inputs on stdin, a lifecycle deadline and a byte-capped capture. */
+async function runPlainChild(runtime, execution, launch, config, signal) {
+    const handle = await execution.spawn({
+        command: launch.command,
+        args: launch.args,
+        cwd: launch.cwd,
+        env: launch.env,
+        envMode: 'replace',
+        stdin: 'pipe',
+        stdout: 'pipe',
+        stderr: 'pipe',
+        killTree: true
+    });
+    const overflow = new AbortController();
+    const capture = new BoundedCapture(CODE_EXECUTION_MAX_OUTPUT_BYTES, () => overflow.abort());
+    const stdoutDone = capture.drain(handle.stdout, 'stdout');
+    const stderrDone = capture.drain(handle.stderr, 'stderr');
+    const result = await (async () => {
+        if (!handle.stdin) {
+            throw new CapabilityError('The execution provider opened no stdin for the child.', 'UNAVAILABLE', {
+                reason: 'code-execution-stdin-unavailable',
+                retryable: false
+            });
+        }
+        const writer = handle.stdin.getWriter();
+        await writer.write(launch.payload);
+        await writer.close();
+        return runtime.lifecycle.wait(async (signal) => {
+            const exited = await exitedOrAborted(handle, signal);
+            await Promise.all([stdoutDone, stderrDone]);
+            return exited;
+        }, { timeoutMs: config.timeout, reason: 'code-execution-deadline', signal: signal ? AbortSignal.any([signal, overflow.signal]) : overflow.signal });
+    })().then((exit) => ({ status: 'success', exit }), async (error) => {
+        return {
+            status: 'failure',
+            error: CaughtFailureSchema.parse(error),
+            cleanup: await settleFailedChild(handle, capture)
+        };
+    });
+    if (result.status === 'failure') {
+        // A provider can reject kill after the child already exited. Always settle
+        // both operations before the caller's finally block removes scratch; retain
+        // either provider failure behind the run's primary refusal.
+        const cleanupFailures = result.cleanup.flatMap((outcome) => outcome.status === 'rejected' ? [outcome.reason] : []);
+        const cause = cleanupFailures.length === 0
+            ? result.error
+            : new AggregateError([result.error, ...cleanupFailures], 'Child execution failed and process cleanup also failed.', { cause: result.error });
+        if (capture.overflowed)
+            throw outputLimitRefusal(handle.pid, cause);
+        if (signal?.aborted) {
+            throw new CapabilityError('Code execution was cancelled.', 'CANCELLED', {
+                reason: 'code-execution-aborted', retryable: false, details: { pid: handle.pid }, cause
+            });
+        }
+        if (result.error instanceof Error && isCapabilityError(result.error) && result.error.code === 'TIMEOUT' && result.error.reason === 'wait-timeout') {
+            throw deadlineRefusal(config.timeout, handle.pid, cause);
+        }
+        if (result.error instanceof Error && isCapabilityError(result.error)) {
+            throw new CapabilityError(result.error.message, result.error.code, {
+                reason: result.error.reason,
+                retryable: result.error.retryable,
+                recoveryHint: result.error.recoveryHint,
+                details: result.error.details,
+                cause
+            });
+        }
+        throw cause;
+    }
+    const exit = result.exit;
+    return {
+        stdout: capture.text('stdout'),
+        stderr: capture.text('stderr'),
+        exitCode: exit.code,
+        restricted: false
+    };
+}
+/**
+ * Run `request` in a child of `runtime`'s execution provider. A pattern-gate
+ * violation returns an unsuccessful result without launching; the deadline,
+ * the output cap and missing capabilities throw typed `CapabilityError`s.
+ */
+export async function runCodeInChild(runtime, request, config, options = {}) {
+    const startTime = Date.now();
+    options.signal?.throwIfAborted();
+    const sessionId = options.sessionId ?? crypto.randomUUID();
+    const plan = planFor(request.language, request.code);
+    const securityValidation = plan.validate(request.code);
+    if (securityValidation.containsDangerousPatterns) {
+        return codeExecutionResultSchema.parse({
+            sessionId,
+            success: false,
+            output: [],
+            logs: [],
+            error: `Security violation: ${securityValidation.dangerousPatterns.join(', ')}`,
+            executionTime: Date.now() - startTime,
+            metadata: { language: request.language, isolationLevel: 'process', securityValidation }
+        });
+    }
+    const payload = new TextEncoder().encode(JSON.stringify({
+        testData: request.testData ?? {},
+        inputs: request.inputs ?? {},
+        entry: request.language === 'typescript' ? './snippet.ts' : './snippet.js',
+        outputLimit: OUTPUT_LINE_LIMIT,
+        logLimit: LOG_ENTRY_LIMIT
+    }));
+    if (payload.byteLength > CODE_EXECUTION_MAX_INPUT_BYTES) {
+        throw new CapabilityError(`Code execution inputs exceed ${CODE_EXECUTION_MAX_INPUT_BYTES} bytes.`, 'INVALID_INPUT', {
+            reason: 'code-execution-input-limit',
+            retryable: false,
+            details: { bytes: payload.byteLength, limit: CODE_EXECUTION_MAX_INPUT_BYTES }
+        });
+    }
+    const execution = await getRuntimeExecution(runtime);
+    const command = await resolveBinary(execution, plan.binary, request.language);
+    const scratch = await openScratch(runtime);
+    try {
+        for (const file of plan.files)
+            await scratch.writeFile(file.name, file.data);
+        const launch = { command, args: plan.args, cwd: scratch.path, env: plan.env(scratch.path), payload };
+        // The restricted layer where the host declares it; the plain child otherwise.
+        const outcome = (await runRestricted(runtime, execution, launch, config, options.signal)) ?? (await runPlainChild(runtime, execution, launch, config, options.signal));
+        const executionTime = Date.now() - startTime;
+        const metadata = {
+            language: request.language,
+            isolationLevel: 'process',
+            exitCode: outcome.exitCode,
+            restricted: outcome.restricted,
+            securityValidation
+        };
+        const { stdout, stderr } = outcome;
+        if (request.language === 'python') {
+            const success = outcome.exitCode === 0;
+            return codeExecutionResultSchema.parse({
+                sessionId,
+                success,
+                output: [stdout, stderr].filter(Boolean).flatMap((text) => text.split('\n').filter(Boolean)),
+                logs: stderr ? [{ level: 'error', message: stderr.slice(0, 1000), timestamp: Date.now() }] : [],
+                error: success ? undefined : stderr.slice(0, 2000) || `python exited ${outcome.exitCode}`,
+                executionTime,
+                metadata
+            });
+        }
+        const markerAt = stdout.lastIndexOf(RESULT_MARKER);
+        if (markerAt < 0) {
+            return codeExecutionResultSchema.parse({
+                sessionId,
+                success: false,
+                output: [],
+                logs: [],
+                error: sanitize(stderr.trim() || `child exited ${outcome.exitCode}`, scratch.path),
+                executionTime,
+                metadata
+            });
+        }
+        const record = codeExecutionResultSchema.omit({ sessionId: true, executionTime: true, memoryUsed: true, metadata: true }).parse(JSON.parse(stdout.slice(markerAt + RESULT_MARKER.length)));
+        const result = {
+            sessionId,
+            success: record.success,
+            output: record.output,
+            logs: record.logs,
+            executionTime,
+            metadata
+        };
+        if (record.returnValue !== undefined)
+            result.returnValue = record.returnValue;
+        if (record.error !== undefined)
+            result.error = sanitize(record.error, scratch.path);
+        return codeExecutionResultSchema.parse(result);
+    }
+    finally {
+        await scratch.cleanup();
+    }
+}
+//# sourceMappingURL=child-runner.js.map

package/dist/code-execution/server/child-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-runner.js","sourceRoot":"","sources":["../../../src/code-execution/server/child-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAgD,MAAM,qBAAqB,CAAC;AAC5I,OAAO,EACN,mBAAmB,EAGnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAA8B,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAExF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC;AACzD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC;AAExD,mEAAmE;AACnE,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,2FAA2F;AAC3F,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAK3C;;;;;GAKG;AACH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAqDA,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;CACnD,CAAC;AAEF,6HAA6H;AAC7H,SAAS,YAAY,CAAC,IAAY;IACjC,OAAO,CACN,oBAAoB;QACpB,kHAAkH;QAClH,kDAAkD;QAClD,4CAA4C;QAC5C,uBAAuB;QACvB,IAAI;QACJ,IAAI,CACJ,CAAC;AACH,CAAC;AAWD,SAAS,OAAO,CAAC,QAA+B,EAAE,IAAY;IAC7D,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,aAAa,QAAQ,+BAA+B,EAAE,aAAa,EAAE;YAC9F,MAAM,EAAE,wCAAwC;YAChD,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE;SACrB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM;YACN,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;YAC7B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;YAC3G,QAAQ,EAAE,sBAAsB;SAChC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,OAAO;QACN,MAAM;QACN,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;QACrC,KAAK,EAAE;YACN,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;YAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7B;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,sBAAsB;KAChC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,OAAgB;IAClD,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,OAAO,cAAc;SACnB,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC9B,OAAO,CAAC,qCAAqC,EAAE,MAAM,CAAC;SACtD,OAAO,CAAC,gEAAgE,EAAE,QAAQ,CAAC;SACnF,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,uGAAuG;AACvG,MAAM,cAAc;IAQD;IACA;IARV,KAAK,GAAG,CAAC,CAAC;IACD,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAc,EAAE,MAAM,EAAE,KAAK,EAAc,EAAE,CAAC;IACvF,0GAA0G;IACzF,OAAO,GAAmE,EAAE,CAAC;IAC9F,UAAU,GAAG,KAAK,CAAC;IAEnB,YACkB,KAAa,EACb,UAAsB;QADtB,UAAK,GAAL,KAAK,CAAQ;QACb,eAAU,GAAV,UAAU,CAAY;IACrC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,MAAyC,EAAE,IAAyB;QAC/E,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnB,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,OAAO;QACZ,uHAAuH;QACvH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,KAA0B;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;CACD;AAED,SAAS,eAAe,CAAC,MAAqB,EAAE,MAAmB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,CACjB,CAAC,IAAI,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAuB;IAC9E,OAAO,OAAO,CAAC,UAAU,CAAC;QACzB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;KAC/C,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA0B;IACpD,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,mFAAmF,EAAE,aAAa,EAAE;YAC7H,MAAM,EAAE,oCAAoC;YAC5C,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,0GAA0G;SACxH,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC,wBAAwB,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAA2B,EAAE,MAAc,EAAE,QAAgB;IACzF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,QAAQ,MAAM,qBAAqB,QAAQ,kCAAkC,EAAE,aAAa,EAAE;YACvH,MAAM,EAAE,wCAAwC;YAChD,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAiBD,SAAS,kBAAkB,CAAC,GAAY,EAAE,KAAuC;IAChF,OAAO,IAAI,eAAe,CACzB,kCAAkC,+BAA+B,8BAA8B,EAC/F,eAAe,EACf;QACC,MAAM,EAAE,6BAA6B;QACrC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,GAAG,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,GAAG,EAAE;QAClD,KAAK;KACL,CACD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,GAAY,EAAE,KAAuC;IAChG,OAAO,IAAI,eAAe,CAAC,+BAA+B,SAAS,mCAAmC,EAAE,SAAS,EAAE;QAClH,MAAM,EAAE,yBAAyB;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QAC/D,KAAK;KACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC3B,OAA0B,EAC1B,SAA2B,EAC3B,MAAmB,EACnB,MAAuB,EACvB,MAAoB;IAEpB,IAAI,CAAC,SAAS,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAC1C,CAAC,MAAM,EAAE,EAAE,CACV,UAAU,CAAC;QACV,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,aAAa,EAAE,CAAC,eAAe,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,GAAG;QACxB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,cAAc,EAAE,+BAA+B;QAC/C,MAAM;KACN,CAAC;IACH,4EAA4E;IAC5E,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,4BAA4B,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,CACvG,CAAC,IAAI,CACL,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC,EACpD,CAAC,KAAc,EAAE,EAAE;QAClB,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAChF,CAAC,CACD,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,4BAA4B;YAAE,OAAO,IAAI,CAAC;QACrH,IAAI,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACvH,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,iBAAiB,KAAK,cAAc;QAAE,MAAM,kBAAkB,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACtG,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,aAAa,CAC3B,OAA0B,EAC1B,SAA2B,EAC3B,MAAmB,EACnB,MAAuB,EACvB,MAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC;QACpC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAA6D,EAAE;QACzF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,aAAa,EAAE;gBACjG,MAAM,EAAE,kCAAkC;gBAC1C,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAC5B,KAAK,EAAE,MAAM,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC;QACf,CAAC,EACD,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAC/I,CAAC;IACH,CAAC,CAAC,EAAE,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,IAAI,EAAE,CAAC,EAChD,KAAK,EAAE,KAAc,EAAE,EAAE;QACxB,OAAO;YACN,MAAM,EAAE,SAAkB;YAC1B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;YACvC,OAAO,EAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;SACjD,CAAC;IACH,CAAC,CACD,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,2EAA2E;QAC3E,4EAA4E;QAC5E,4DAA4D;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,IAAI,cAAc,CACnB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,EAClC,yDAAyD,EACzD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACvB,CAAC;QACH,IAAI,OAAO,CAAC,UAAU;YAAE,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,WAAW,EAAE;gBACvE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK;aACvF,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACnJ,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBAClE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;gBACjC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;gBACvC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,KAAK;aACL,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK;KACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAA0B,EAC1B,OAAmE,EACnE,MAAuB,EACvB,UAAsE,EAAE;IAExE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,CAAC;QAClD,OAAO,yBAAyB,CAAC,KAAK,CAAC;YACtC,SAAS;YACT,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,uBAAuB,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/E,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACrC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE;SACvF,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,IAAI,CAAC,SAAS,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;QAC1E,WAAW,EAAE,iBAAiB;QAC9B,QAAQ,EAAE,eAAe;KACzB,CAAC,CACF,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,gCAAgC,8BAA8B,SAAS,EAAE,eAAe,EAAE;YACnH,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,8BAA8B,EAAE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;QAClH,8EAA8E;QAC9E,MAAM,OAAO,GACZ,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAExJ,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC7C,MAAM,QAAQ,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,SAAkB;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEnC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;YACvC,OAAO,yBAAyB,CAAC,KAAK,CAAC;gBACtC,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC5F,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC/F,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,iBAAiB,OAAO,CAAC,QAAQ,EAAE;gBACzF,aAAa;gBACb,QAAQ;aACR,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,yBAAyB,CAAC,KAAK,CAAC;gBACtC,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,gBAAgB,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC;gBAClF,aAAa;gBACb,QAAQ;aACR,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAC9H,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CACzD,CAAC;QACF,MAAM,MAAM,GAAwB;YACnC,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa;YACb,QAAQ;SACR,CAAC;QACF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;AACF,CAAC"}

package/dist/code-execution/server/exec-backend.d.ts

@@ -0,0 +1,24 @@
+import z from 'zod/v4';
+import { type CodeExecutionJobStatus } from '../schemas/operations.ts';
+import { type ExecBackendRuntime } from '../config/load.ts';
+/**
+ * One request to the exec backend, sent by the secrets owner. Workers supplies
+ * the destination and request options plus a credential reference; the
+ * credential value is resolved, placed on the request and sent inside
+ * `@vibesdotdev/secrets`, which answers with the upstream `Response`. Workers
+ * never sees the value or the authenticated header. Bound to the handed
+ * runtime and the caller's signal; body lifetime also follows the caller/host.
+ */
+export declare function fetchExecBackend(runtime: ExecBackendRuntime, url: string, init?: RequestInit): Promise<Response>;
+export declare function readExecBackendJsonResponse<T>(runtime: ExecBackendRuntime, response: Response, schema: z.ZodType<T>, options?: {
+    signal?: AbortSignal;
+}): Promise<T>;
+export declare function isExecBackendConfigured(runtime: ExecBackendRuntime): Promise<boolean>;
+export declare function getExecBackendStreamUrl(runtime: ExecBackendRuntime, jobId: string): Promise<string>;
+export declare function getExecBackendJobStatus(runtime: ExecBackendRuntime, jobId: string, options?: {
+    signal?: AbortSignal;
+}): Promise<CodeExecutionJobStatus | null>;
+export declare function cancelExecBackendJob(runtime: ExecBackendRuntime, jobId: string, options?: {
+    signal?: AbortSignal;
+}): Promise<boolean>;
+//# sourceMappingURL=exec-backend.d.ts.map

package/dist/code-execution/server/exec-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-backend.d.ts","sourceRoot":"","sources":["../../../src/code-execution/server/exec-backend.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,QAAQ,CAAC;AAKvB,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAOnF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAC9D,OAAO,CAAC,QAAQ,CAAC,CA+CnB;AA+BD,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAqC9K;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3F;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzG;AAED,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GACpC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CASxC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ/I"}