@vibgrate/cli 2026.722.1 → 2026.727.1

package/dist/chunk-IS7VTH2Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/firecracker.ts","../src/runtime/sandbox-backend.ts","../src/runtime/gvisor.ts","../src/runtime/execution-env.ts"],"names":["path","fs","spawnSync","path2","fs2","which","commandOnPath"],"mappings":";;;;;;AAgDO,SAAS,sBAAA,CAAuB,OAAyB,OAAA,EAA0D;AACxH,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,eAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,0BAAA;AAAA,IACA,CAAA,OAAA,EAAU,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA,GAC/C;AACA,EAAA,IAAI,OAAA,CAAQ,WAAA,KAAgB,KAAA,EAAO,QAAA,CAAS,KAAK,YAAY,CAAA;AAE7D,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,aAAA,EAAe;AAAA,MACb,mBAAmB,KAAA,CAAM,MAAA;AAAA,MACzB,SAAA,EAAW,QAAA,CAAS,IAAA,CAAK,GAAG;AAAA,KAC9B;AAAA,IACA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,QAAA,EAAU,QAAA;AAAA,QACV,cAAc,KAAA,CAAM,MAAA;AAAA,QACpB,cAAA,EAAgB,IAAA;AAAA,QAChB,YAAA,EAAc;AAAA;AAChB,KACF;AAAA,IACA,gBAAA,EAAkB;AAAA,MAChB,UAAA,EAAY,QAAQ,SAAA,IAAa,CAAA;AAAA,MACjC,YAAA,EAAc,QAAQ,UAAA,IAAc,GAAA;AAAA,MACpC,GAAA,EAAK;AAAA;AACP,GACF;AAIA,EAAC,GAAA,CAA2C,mBAAmB,CAAA,GAAI,CAAC,GAAG,OAAA,CAAQ,aAAa,CAAA,CACzF,GAAA,CAAI,CAAC,CAAA,KAAWA,cAAQ,CAAC,CAAC,EAC1B,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAEpC,EAAA,IAAI,OAAA,CAAQ,gBAAgB,KAAA,EAAO;AACjC,IAAA,GAAA,CAAI,oBAAoB,CAAA,GAAI;AAAA,MAC1B;AAAA,QACE,QAAA,EAAU,MAAA;AAAA,QACV,SAAA,EAAW,mBAAA;AAAA,QACX,aAAA,EAAe;AAAA;AACjB,KACF;AAAA,EACF;AAEA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,eAAA,CAAgB,QAAgB,UAAA,EAA8B;AAC5E,EAAA,OAAO,CAAC,MAAA,EAAQ,eAAA,EAAiB,UAAA,EAAY,UAAU,CAAA;AACzD;AAMO,SAAS,wBACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,WAAA,GAAsC,CAAC,CAAA,KAAM;AAC3C,EAAA,IAAI;AACF,IAAA,OAAUC,eAAW,CAAC,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA,EACyB;AACzB,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,wBAAA,IAA4B,KAAA,CAAM,aAAa,CAAA,IAAK,EAAA;AACvE,EAAA,MAAM,MAAA,GAAS,IAAI,2BAAA,IAA+B,EAAA;AAClD,EAAA,MAAM,MAAA,GAAS,IAAI,2BAAA,IAA+B,EAAA;AAClD,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,IAAU,CAAC,QAAQ,OAAO,IAAA;AAC1C,EAAA,IAAI,CAAC,WAAA,CAAY,MAAM,CAAA,IAAK,CAAC,WAAA,CAAY,MAAM,CAAA,IAAK,CAAC,WAAA,CAAY,MAAM,CAAA,EAAG,OAAO,IAAA;AACjF,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAO;AAClC;AAMO,SAAS,wBAAwB,OAAA,EAKhB;AACtB,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA,KAAU,MAAA,GAAY,uBAAA,KAA4B,OAAA,CAAQ,KAAA;AAChF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,KAAgB,KAAA;AAC5C,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,wBAAA;AAEjC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,aAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA,CAAI,SAAS,OAAA,EAAsB;AACjC,MAAA,MAAM,KAAA,GAAQ,QAAQ,aAAA,CAAc,MAAA,GAAS,QAAQ,aAAA,GAAgB,CAAC,QAAQ,GAAG,CAAA;AACjF,MAAA,MAAM,UAAA,GAAkBD,KAAA,CAAA,IAAA;AAAA,QACtB,OAAA,CAAQ,IAAI,MAAA,IAAU,MAAA;AAAA,QACtB,SAAS,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,KAAK,CAAA,KAAA;AAAA,OACpC;AACA,MAAA,MAAM,GAAA,GAAM,uBAAuB,KAAA,EAAO;AAAA,QACxC,aAAA,EAAe,KAAA;AAAA,QACf,OAAA;AAAA,QACA,WAEF,CAAC,CAAA;AACD,MAAA,IAAI;AACF,QAAGC,GAAA,CAAA,aAAA,CAAc,YAAY,CAAA,EAAG,IAAA,CAAK,UAAU,GAAA,EAAK,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA,EAAM;AAAA,UAChE,QAAA,EAAU,MAAA;AAAA,UACV,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,KAAA,CAAM,MAAA,EAAQ,UAAU,CAAA;AACrD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAA,CAAK,CAAC,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AAAA,UAC7C,QAAA,EAAU,MAAA;AAAA,UACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,UAC9B,SAAA,EAAW,KAAK,IAAA,GAAO,IAAA;AAAA,UACvB,KAAK,OAAA,CAAQ;AAAA,SACd,CAAA;AACD,QAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AAEtE,QAAA,IAAI,IAAI,KAAA,EAAO;AACb,UAAA,OAAO;AAAA,YACL,MAAA,EAAQ,CAAA,6BAAA,EAAgC,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,YACzD,QAAA,EAAU;AAAA,WACZ;AAAA,QACF;AACA,QAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAAA,MAC7C,CAAA,SAAE;AACA,QAAA,IAAI;AACF,UAAGA,eAAW,UAAU,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,MAAM,GAAA,EAA4B;AACzC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAU,OAAA,CAAQ,QAAA,KAAa,UAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG;AAAA,MAC7E,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC7B,IAAA,MAAM,IAAA,GAAA,CAAQ,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,IAAA,EAAK,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK;AAC5D,IAAA,OAAO,IAAA,IAAQ,IAAA;AAAA,EACjB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACpKO,SAAS,yBAAA,CAA0B,QAAA,GAA4B,OAAA,CAAQ,QAAA,EAA+B;AAC3G,EAAA,MAAM,WAAiC,EAAC;AAExC,EAAA,IAAI,aAAa,QAAA,EAAU;AACzB,IAAA,MAAM,QAAA,GAAW,cAAc,cAAc,CAAA;AAC7C,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,EAAA,EAAI,UAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,SAAA,EAAW,QAAA;AAAA,MACX,MAAA,EAAQ,WAAW,sBAAA,GAAyB;AAAA,KAC7C,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,aAAa,OAAA,EAAS;AACxB,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA;AACnC,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,EAAA,EAAI,OAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,SAAA,EAAW,KAAA;AAAA,MACX,MAAA,EAAQ,QAAQ,oBAAA,GAAuB;AAAA,KACxC,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,cAAc,UAAU,CAAA;AACzC,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,EAAA,EAAI,UAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,SAAA,EAAW,QAAA;AAAA,MACX,MAAA,EAAQ,WAAW,kBAAA,GAAqB;AAAA,KACzC,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,cAAc,OAAO,CAAA;AACnC,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA,MACZ,EAAA,EAAI,QAAA;AAAA,MACJ,IAAA,EAAM,IAAA;AAAA,MACN,SAAA,EAAW,KAAA;AAAA,MACX,MAAA,EAAQ,QAAQ,sBAAA,GAAyB;AAAA,KAC1C,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,KAAK,uBAAA,EAAwB;AACnC,EAAA,QAAA,CAAS,IAAA,CAAK;AAAA,IACZ,EAAA,EAAI,aAAA;AAAA,IACJ,IAAA,EAAM,IAAA;AAAA,IACN,SAAA,EAAW,CAAC,CAAC,EAAA;AAAA,IACb,MAAA,EAAQ,EAAA,GACJ,CAAA,wBAAA,EAA2B,EAAA,CAAG,MAAM,CAAA,CAAA,CAAA,GACpC;AAAA,GACL,CAAA;AAED,EAAA,QAAA,CAAS,IAAA,CAAK;AAAA,IACZ,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,IAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,IAAI,QAAA,GAAyB,IAAA;AAC7B,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,IAAI,CAAC,EAAE,SAAA,EAAW;AAClB,IAAA,IAAI,QAAA,CAAS,EAAE,IAAI,CAAA,GAAI,SAAS,QAAQ,CAAA,aAAc,CAAA,CAAE,IAAA;AAAA,EAC1D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,QAAA,EAAS;AACxC;AAGO,SAAS,oBAAA,CACd,SAAA,EACA,IAAA,GAA4B,yBAAA,EAA0B,EAClC;AACpB,EAAA,MAAM,IAAA,GAAO,SAAS,SAAS,CAAA;AAE/B,EAAA,MAAM,YAAY,IAAA,CAAK,QAAA,CAAS,OAAO,CAAC,CAAA,KAAM,EAAE,SAAS,CAAA;AACzD,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,EAAA,KAAO,MAAM,CAAA;AAC3E,EAAA,IAAI,OAAO,OAAO,KAAA;AAElB,EAAA,MAAM,QAAA,GAAW,SAAA,CACd,MAAA,CAAO,CAAC,CAAA,KAAM,SAAS,CAAA,CAAE,IAAI,CAAA,IAAK,IAAA,IAAQ,CAAA,CAAE,EAAA,KAAO,MAAM,CAAA,CACzD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,IAAI,CAAC,CAAA;AACrD,EAAA,IAAI,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,SAAS,CAAC,CAAA;AAElC,EAAA,MAAM,MAAA,GAAS,UACZ,MAAA,CAAO,CAAC,MAAM,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,GAAI,IAAI,CAAA,CACrC,KAAK,CAAC,CAAA,EAAG,MAAM,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,IAAI,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,CAAC,CAAA,EAAG,OAAO,OAAO,CAAC,CAAA;AAC9B,EAAA,OAAO,UAAU,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,KAAO,MAAM,CAAA,IAAK;AAAA,IAC/C,EAAA,EAAI,MAAA;AAAA,IACJ,IAAA,EAAM,IAAA;AAAA,IACN,SAAA,EAAW,IAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACV;AACF;AAMO,SAAS,YAAA,CACd,aAAA,EACA,OAAA,EACA,OAAA,GAAmD,EAAC,EAC1C;AACV,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,UAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,OAAA,CAAQ,WAAA,KAAgB,KAAA,EAAO,IAAA,CAAK,KAAK,YAAY,CAAA;AACzD,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,IAAA,CAAK,IAAA,CAAK,CAAA,YAAA,EAAe,IAAI,CAAA,CAAE,CAAA;AAAA,EACjC;AACA,EAAA,IAAI,QAAQ,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA,YAAA,EAAe,OAAA,CAAQ,GAAG,CAAA,CAAE,CAAA;AACvD,EAAA,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,OAAO,CAAA;AACxC,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,CAAA,EAAyB;AACzC,EAAA,IAAI,CAAA,KAAM,MAAM,OAAO,CAAA;AACvB,EAAA,IAAI,CAAA,KAAM,MAAM,OAAO,CAAA;AACvB,EAAA,IAAI,CAAA,KAAM,MAAM,OAAO,CAAA;AACvB,EAAA,OAAO,CAAA;AACT;AAEA,SAAS,cAAc,GAAA,EAAsB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAMC,SAAAA,CAAU,OAAA,CAAQ,QAAA,KAAa,OAAA,GAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG,EAAE,QAAA,EAAU,QAAQ,CAAA;AACnG,IAAA,OAAO,IAAI,MAAA,KAAW,CAAA,IAAK,QAAQ,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACtIO,SAAS,UAAA,CAAW,OAAoB,OAAA,EAAsC;AACnF,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,KAAA,CAAM,MAAA;AAAA,IACN,iBAAA;AAAA,IACA,YAAA,IAAgB,OAAA,CAAQ,WAAA,KAAgB,KAAA,GAAQ,MAAA,GAAS,MAAA,CAAA;AAAA,IACzD,IAAA;AAAA,IACA,eAAA;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,GAAG,OAAA,CAAQ,aAAa,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAWC,KAAA,CAAA,OAAA,CAAQ,CAAC,CAAC,CAAA,CAAE,MAAK,EAAG;AAChF,IAAA,IAAA,CAAK,KAAK,QAAA,EAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,GAAA,CAAK,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,QAAQ,GAAA,EAAK;AACf,IAAA,IAAA,CAAK,IAAA,CAAK,OAAA,EAAcA,KAAA,CAAA,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,QAAQ,OAAO,CAAA;AAChD,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,mBACd,GAAA,GAAyB,OAAA,CAAQ,GAAA,EACjC,WAAA,GAAsC,CAAC,CAAA,KAAM;AAC3C,EAAA,IAAI;AACF,IAAA,OAAUC,eAAW,CAAC,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA,EACAC,SAAwC,QAAA,EACpB;AACpB,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,mBAAA,IAAuBA,MAAAA,CAAM,OAAO,CAAA,IAAK,EAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,IAAI,sBAAA,IAA0B,EAAA;AAC7C,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,IAAA;AAC/B,EAAA,IAAI,CAAC,YAAY,MAAM,CAAA,IAAK,CAAC,WAAA,CAAY,MAAM,GAAG,OAAO,IAAA;AACzD,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;AAEO,SAAS,mBAAmB,OAAA,EAKX;AACtB,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA,KAAU,MAAA,GAAY,kBAAA,KAAuB,OAAA,CAAQ,KAAA;AAC3E,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,KAAgB,KAAA;AAC5C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,QAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,MAAA,IAAU,iBAAA;AAAA,IAC1B,GAAA,CAAI,SAAS,OAAA,EAAsB;AACjC,MAAA,MAAM,KAAA,GAAQ,QAAQ,aAAA,CAAc,MAAA,GAAS,QAAQ,aAAA,GAAgB,CAAC,QAAQ,GAAG,CAAA;AACjF,MAAA,MAAM,IAAA,GAAO,WAAW,KAAA,EAAO;AAAA,QAC7B,aAAA,EAAe,KAAA;AAAA,QACf,OAAA;AAAA,QACA,WAAA;AAAA,QACA,KAAK,OAAA,CAAQ;AAAA,OACd,CAAA;AACD,MAAA,MAAM,GAAA,GAAMH,UAAU,IAAA,CAAK,CAAC,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AAAA,QAC7C,QAAA,EAAU,MAAA;AAAA,QACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,QAC9B,SAAA,EAAW,KAAK,IAAA,GAAO,IAAA;AAAA,QACvB,KAAK,OAAA,CAAQ;AAAA,OACd,CAAA;AACD,MAAA,IAAI,IAAI,KAAA,EAAO;AACb,QAAA,OAAO,EAAE,QAAQ,CAAA,wBAAA,EAA2B,GAAA,CAAI,MAAM,OAAO,CAAA,CAAA,EAAI,UAAU,CAAA,EAAE;AAAA,MAC/E;AACA,MAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AACtE,MAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAAA,IAC7C;AAAA,GACF;AACF;AAEA,SAAS,SAAS,GAAA,EAA4B;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAMA,UAAU,OAAA,CAAQ,QAAA,KAAa,UAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG;AAAA,MAC7E,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC7B,IAAA,OAAA,CAAQ,GAAA,CAAI,MAAA,IAAU,EAAA,EAAI,IAAA,EAAK,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,IAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AChDO,SAAS,0BAAA,CAA2B,QAAA,GAA4B,OAAA,CAAQ,QAAA,EAAgC;AAC7G,EAAA,IAAI,aAAa,OAAA,EAAS;AACxB,IAAA,OAAO;AAAA,MACL,QAAA;AAAA,MACA,UAAU,sBAAA,EAAuB;AAAA,MACjC,QAAA,EAAU,KAAA;AAAA,MACV,UAAA,EAAYI,eAAc,OAAO,CAAA;AAAA,MACjC,QAAA,EAAUA,eAAc,UAAU,CAAA;AAAA,MAClC,MAAA,EAAQA,eAAc,OAAO;AAAA,KAC/B;AAAA,EACF;AACA,EAAA,IAAI,aAAa,QAAA,EAAU;AACzB,IAAA,OAAO;AAAA,MACL,QAAA;AAAA,MACA,QAAA,EAAU,KAAA;AAAA,MACV,UAAU,oBAAA,EAAqB;AAAA,MAC/B,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,KAAA;AAAA,MACV,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,UAAA,EAAY,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAM;AACzG;AAOO,SAAS,mBAAA,CACd,SAAA,GAA0B,IAAA,EAC1B,OAAA,GAAsC,EAAC,EACzB;AACd,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,YAAA,IAAgB,0BAAA,EAA2B;AAChE,EAAA,MAAM,aAAA,GAAgB,cAAA,CAAe,OAAA,CAAQ,aAAa,CAAA;AAC1D,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,KAAgB,KAAA;AAE5C,EAAA,IAAI,SAAA,KAAc,IAAA,EAAM,OAAO,sBAAA,CAAuB,aAAa,CAAA;AAEnE,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,MAAM,KAAK,uBAAA,CAAwB;AAAA,MACjC,aAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,aAAA,EAAe,aAAa,SAAS,CAAA;AACrE,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,aAAA,EAAe,aAAa,SAAS,CAAA;AACrE,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,OAAO,uBAAuB,uEAAkE,CAAA;AAAA,EAClG;AAEA,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,aAAA,EAAe,aAAa,SAAS,CAAA;AACrE,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,aAAA,EAAe,aAAa,SAAS,CAAA;AACrE,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,OAAO,sBAAA,CAAuB,CAAA,EAAG,SAAS,CAAA,wCAAA,CAAqC,CAAA;AAAA,EACjF;AAEA,EAAA,IAAI,cAAc,IAAA,EAAM;AACtB,IAAA,MAAM,EAAA,GAAK,cAAA,CAAe,IAAA,EAAM,aAAA,EAAe,aAAa,SAAS,CAAA;AACrE,IAAA,IAAI,IAAI,OAAO,EAAA;AACf,IAAA,OAAO,uBAAuB,mEAA8D,CAAA;AAAA,EAC9F;AAEA,EAAA,OAAO,uBAAuB,wCAAmC,CAAA;AACnE;AAEO,SAAS,sBAAA,CAAuB,SAAS,cAAA,EAA8B;AAC5E,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,MAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA,CAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,OAAA,CAAQ,SAAS,OAAO,CAAA;AAAA,IACjC;AAAA,GACF;AACF;AAMO,SAAS,oBAAA,CACd,aAAA,EACA,OAAA,GAA2D,EAAC,EACpD;AACR,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,CAAC,GAAG,aAAA,EAAe,GAAI,OAAA,CAAQ,SAAA,IAAa,gBAAA,EAAmB,CAAC,CAAA;AAC7F,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,aAAA;AAAA,IACA,gBAAA;AAAA,IACA,kBAAA;AAAA,IACA,qBAAA;AAAA,IACA,eAAA;AAAA,IACA,uBAAA;AAAA,IACA,oBAAA;AAAA,IACA,+CAAA;AAAA,IACA,+CAAA;AAAA,IACA,oBAAA;AAAA,IACA,0CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,mBAAmB,IAAI,CAAA;AACvC,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,6BAAA,EAAgC,OAAO,CAAA,GAAA,CAAK,CAAA;AAEvD,IAAA,IAAI,KAAK,UAAA,CAAW,OAAO,KAAK,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,EAAG;AACvD,MAAA,KAAA,CAAM,KAAK,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,WAAW,IAAI,CAAA,CAAE,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IACvF;AACA,IAAA,IAAI,KAAK,UAAA,CAAW,eAAe,KAAK,IAAA,CAAK,UAAA,CAAW,cAAc,CAAA,EAAG;AACvE,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC1C,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAK,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IAC3E;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,gBAAgB,KAAA,EAAO;AACjC,IAAA,KAAA,CAAM,KAAK,iBAAiB,CAAA;AAAA,EAC9B,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAAA,EAC/B;AAEA,EAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,EAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAC3B,EAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAA;AAC5B;AAGO,SAAS,YAAA,CAAa,aAAqB,OAAA,EAA2B;AAC3E,EAAA,OAAO,CAAC,cAAA,EAAgB,IAAA,EAAM,WAAA,EAAa,SAAA,EAAW,MAAM,OAAO,CAAA;AACrE;AAGO,SAAS,cAAA,CACd,aAAA,EACA,OAAA,EACA,OAAA,GAAmD,EAAC,EAC1C;AACV,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,OAAA;AAAA,IACA,mBAAA;AAAA,IACA,WAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,KAAA,GAAQ,eAAe,aAAa,CAAA;AAC1C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AAExB,IAAA,IAAA,CAAK,IAAA,CAAK,QAAA,EAAU,IAAA,EAAM,IAAI,CAAA;AAAA,EAChC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,kBAAiB,EAAG;AAClC,IAAA,IAAO,eAAW,CAAC,CAAA,OAAQ,IAAA,CAAK,QAAA,EAAU,GAAG,CAAC,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,OAAA,CAAQ,gBAAgB,KAAA,EAAO;AACjC,IAAA,IAAA,CAAK,KAAK,eAAe,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,QAAQ,GAAA,EAAK;AACf,IAAA,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,OAAA,CAAQ,GAAG,CAAA;AAAA,EAClC;AACA,EAAA,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,OAAO,CAAA;AACxC,EAAA,OAAO,IAAA;AACT;AAIA,SAAS,cAAA,CACP,IAAA,EACA,aAAA,EACA,WAAA,EACA,SAAA,EACqB;AACrB,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,OAAO,iBAAA;AAAA,MACL,SAAA,KAAc,IAAA,GACV,0BAAA,GACA,CAAA,EAAG,SAAS,CAAA,6BAAA,CAAA;AAAA,MAChB,aAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,MAAM,KAAK,kBAAA,CAAmB;AAAA,MAC5B,aAAA;AAAA,MACA,WAAA;AAAA,MACA,MAAA,EACE,SAAA,KAAc,IAAA,GACV,iBAAA,GACA,GAAG,SAAS,CAAA,2BAAA;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,IAAI,OAAO,EAAA;AAAA,EACjB;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,cAAA,CACP,IAAA,EACA,aAAA,EACA,WAAA,EACA,SAAA,EACqB;AACrB,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,OAAO,iBAAA;AAAA,MACL,SAAA,KAAc,IAAA,GACV,2CAAA,GACA,CAAA,EAAG,SAAS,CAAA,4CAAA,CAAA;AAAA,MAChB,aAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,KAAK,UAAA,EAAY;AACnB,IAAA,OAAO,mBAAA;AAAA,MACL,SAAA,KAAc,IAAA,GACV,8BAAA,GACA,CAAA,EAAG,SAAS,CAAA,+BAAA,CAAA;AAAA,MAChB,aAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAAA,EACF;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,iBAAA,CAAkB,MAAA,EAAgB,aAAA,EAAyB,WAAA,EAAoC;AACtG,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,UAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA,CAAI,SAAS,OAAA,EAAS;AACpB,MAAA,MAAM,QAAQ,aAAA,CAAc,MAAA,GAAS,aAAA,GAAgB,CAAC,QAAQ,GAAG,CAAA;AACjE,MAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,aAAa,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA,EAAG;AACpD,QAAA,KAAA,CAAM,IAAA,CAAU,KAAA,CAAA,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,MACtC;AACA,MAAA,MAAM,IAAA,GAAO,aAAa,KAAA,EAAO,OAAA,EAAS,EAAE,WAAA,EAAa,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC3E,MAAA,MAAM,GAAA,GAAMJ,UAAU,IAAA,CAAK,CAAC,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AAAA,QAC7C,QAAA,EAAU,MAAA;AAAA,QACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,QAC9B,SAAA,EAAW,KAAK,IAAA,GAAO,IAAA;AAAA,QACvB,KAAK,OAAA,CAAQ;AAAA,OACd,CAAA;AACD,MAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AACtE,MAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAAA,IAC7C;AAAA,GACF;AACF;AAEA,SAAS,iBAAA,CAAkB,MAAA,EAAgB,aAAA,EAAyB,WAAA,EAAoC;AACtG,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,UAAA;AAAA,IACP,MAAA;AAAA,IACA,GAAA,CAAI,SAAS,OAAA,EAAS;AACpB,MAAA,MAAM,QAAQ,aAAA,CAAc,MAAA,GAAS,aAAA,GAAgB,CAAC,QAAQ,GAAG,CAAA;AACjE,MAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,KAAA,EAAO,EAAE,aAAa,CAAA;AAC3D,MAAA,MAAM,WAAA,GAAmB,KAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,MAAA,EAAO,EAAG,CAAA,YAAA,EAAe,OAAA,CAAQ,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,GAAA,EAAK,CAAA,GAAA,CAAK,CAAA;AACxF,MAAA,IAAI;AACF,QAAG,GAAA,CAAA,aAAA,CAAc,aAAa,OAAA,EAAS,EAAE,UAAU,MAAA,EAAQ,IAAA,EAAM,KAAO,CAAA;AACxE,QAAA,MAAM,IAAA,GAAO,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AAC9C,QAAA,MAAM,GAAA,GAAMA,UAAU,IAAA,CAAK,CAAC,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AAAA,UAC7C,KAAK,OAAA,CAAQ,GAAA;AAAA,UACb,QAAA,EAAU,MAAA;AAAA,UACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,UAC9B,SAAA,EAAW,KAAK,IAAA,GAAO,IAAA;AAAA,UACvB,KAAK,OAAA,CAAQ;AAAA,SACd,CAAA;AACD,QAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AACtE,QAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAAA,MAC7C,CAAA,SAAE;AACA,QAAA,IAAI;AACF,UAAG,eAAW,WAAW,CAAA;AAAA,QAC3B,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,mBAAA,CACP,MAAA,EACA,aAAA,EACA,WAAA,EACA,eAAA,EACc;AACd,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,kBAAkB,qBAAA,GAAwB,OAAA;AAAA,IACjD,MAAA;AAAA,IACA,GAAA,CAAI,SAAS,OAAA,EAAS;AACpB,MAAA,MAAM,QAAQ,aAAA,CAAc,MAAA,GAAS,aAAA,GAAgB,CAAC,QAAQ,GAAG,CAAA;AAEjE,MAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,aAAa,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA,EAAG;AACpD,QAAA,KAAA,CAAM,IAAA,CAAU,KAAA,CAAA,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,MACtC;AACA,MAAA,MAAM,IAAA,GAAO,eAAe,KAAA,EAAO,OAAA,EAAS,EAAE,WAAA,EAAa,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,CAAA;AAC7E,MAAA,MAAM,GAAA,GAAMA,UAAU,IAAA,CAAK,CAAC,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAG;AAAA,QAC7C,QAAA,EAAU,MAAA;AAAA,QACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,QAC9B,SAAA,EAAW,KAAK,IAAA,GAAO,IAAA;AAAA,QACvB,KAAK,OAAA,CAAQ;AAAA,OACd,CAAA;AACD,MAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AACtE,MAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAAA,IAC7C;AAAA,GACF;AACF;AAEA,SAAS,OAAA,CAAQ,SAAiB,OAAA,EAA2D;AAC3F,EAAA,MAAM,GAAA,GAAMA,UAAU,OAAA,EAAS;AAAA,IAC7B,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,EAAO,IAAA;AAAA,IACP,QAAA,EAAU,MAAA;AAAA,IACV,OAAA,EAAS,QAAQ,SAAA,IAAa,IAAA;AAAA,IAC9B,SAAA,EAAW,KAAK,IAAA,GAAO;AAAA,GACxB,CAAA;AACD,EAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,MAAA,IAAU,EAAA,KAAO,IAAI,MAAA,GAAS;AAAA,EAAK,GAAA,CAAI,MAAM,CAAA,CAAA,GAAK,EAAA,CAAA;AACtE,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,GAAA,CAAI,UAAU,CAAA,EAAE;AAC7C;AAEA,SAAS,sBAAA,GAAkC;AACzC,EAAA,IAAI;AACF,IAAA,OAAU,GAAA,CAAA,UAAA,CAAW,+BAA+B,CAAA,IAAQ,GAAA,CAAA,UAAA,CAAW,2BAA2B,CAAA;AAAA,EACpG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,oBAAA,GAAgC;AACvC,EAAA,OAAOI,eAAc,cAAc,CAAA;AACrC;AAEA,SAASA,eAAc,GAAA,EAAsB;AAC3C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAMJ,SAAAA,CAAU,OAAA,CAAQ,QAAA,KAAa,OAAA,GAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG,EAAE,QAAA,EAAU,QAAQ,CAAA;AACnG,IAAA,OAAO,IAAI,MAAA,KAAW,CAAA,IAAK,QAAQ,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAA,GAA6B;AAGpC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,IAAA,CAAQ,WAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,QAAQ,GAAA,CAAI,MAAA,QAAc,IAAA,CAAK,OAAA,CAAQ,IAAI,MAAM,CAAA;AACrD,EAAA,IAAI,QAAQ,GAAA,CAAI,GAAA,QAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,GAAG,CAAA;AAC/C,EAAA,IAAI,QAAQ,GAAA,CAAI,IAAA,QAAY,IAAA,CAAK,OAAA,CAAQ,IAAI,IAAI,CAAA;AACjD,EAAA,KAAA,CAAM,IAAA,CAAK,QAAQ,cAAc,CAAA;AACjC,EAAA,OAAO,cAAA,CAAe,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAClF;AAEA,SAAS,eAAe,KAAA,EAAuC;AAC7D,EAAA,IAAI,CAAC,KAAA,EAAO,MAAA,EAAQ,OAAO,EAAC;AAC5B,EAAA,OAAO,eAAe,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,OAAO,MAAM,QAAA,IAAY,CAAA,CAAE,IAAA,EAAM,EAAE,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AACnG;AAEA,SAAS,eAAe,KAAA,EAA2B;AACjD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAW,cAAQ,CAAC,CAAA;AAC1B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,MAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,MAAA,GAAA,CAAI,KAAK,GAAG,CAAA;AAAA,IACd,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,GAAA,CAAI,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA;AAC9C;AAEA,SAAS,mBAAmB,CAAA,EAAmB;AAE7C,EAAA,OAAO,EAAE,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,MAAM,KAAK,CAAA;AACrD;AAEA,SAAS,YAAA,CAAa,OAAe,MAAA,EAAyB;AAC5D,EAAA,MAAM,MAAW,KAAA,CAAA,QAAA,CAAc,KAAA,CAAA,OAAA,CAAQ,MAAM,CAAA,EAAQ,KAAA,CAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACnE,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAM,KAAA,CAAA,UAAA,CAAW,GAAG,CAAA;AACrE","file":"chunk-IS7VTH2Q.js","sourcesContent":["/**\n * Firecracker L3 microVM backend (Fusion Runtime Phase 7 / ADR-002).\n *\n * L3 is the strongest isolation tier for `run_command` and untrusted patches:\n * a short-lived microVM with a pinned kernel + rootfs. This module is the pure\n * plan/argv surface and availability probe. When the binary or rootfs is\n * missing, {@link tryCreateFirecrackerEnv} returns null and the execution\n * ladder falls back to L2/L1/L0 — never silently claims L3.\n *\n * Real Firecracker boot is optional infrastructure; unit tests cover the pure\n * config + argv builders only.\n */\n\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport type { ExecutionEnv, ShellResult } from './execution-env.js';\n\nexport const FIRECRACKER_BACKEND_ID = 'firecracker' as const;\n\nexport interface FirecrackerPaths {\n  /** Path to the `firecracker` binary. */\n  binary: string;\n  /** Guest kernel image (vmlinux). */\n  kernel: string;\n  /** Guest rootfs (ext4). */\n  rootfs: string;\n}\n\nexport interface FirecrackerPlanOptions {\n  /** Writable host paths bind-mounted into the guest (project roots). */\n  writableRoots: string[];\n  /** Command to run inside the guest via the agent shim. */\n  command: string;\n  /** Guest memory MiB (default 512). */\n  memSizeMib?: number;\n  /** vCPU count (default 1). */\n  vcpuCount?: number;\n  /** Deny outbound network inside the microVM (default true). */\n  denyNetwork?: boolean;\n  /** Absolute path where the Firecracker JSON config will be written. */\n  configPath: string;\n}\n\n/**\n * Pure Firecracker machine config (API shape). Deterministic for identical inputs.\n * Network interfaces omitted when denyNetwork is true.\n */\nexport function buildFirecrackerConfig(paths: FirecrackerPaths, options: FirecrackerPlanOptions): Record<string, unknown> {\n  const bootArgs = [\n    'console=ttyS0',\n    'reboot=k',\n    'panic=1',\n    'pci=off',\n    'init=/sbin/vg-agent-init',\n    `vg_cmd=${encodeURIComponent(options.command)}`,\n  ];\n  if (options.denyNetwork !== false) bootArgs.push('vg_net=off');\n\n  const cfg: Record<string, unknown> = {\n    'boot-source': {\n      kernel_image_path: paths.kernel,\n      boot_args: bootArgs.join(' '),\n    },\n    drives: [\n      {\n        drive_id: 'rootfs',\n        path_on_host: paths.rootfs,\n        is_root_device: true,\n        is_read_only: false,\n      },\n    ],\n    'machine-config': {\n      vcpu_count: options.vcpuCount ?? 1,\n      mem_size_mib: options.memSizeMib ?? 512,\n      smt: false,\n    },\n  };\n\n  // Record bind intent for the host-side preflight (not a Firecracker native field).\n  // Kept under a namespaced key so real FC ignores unknown fields when/if we switch.\n  (cfg as { 'vg-writable-roots'?: string[] })['vg-writable-roots'] = [...options.writableRoots]\n    .map((r) => path.resolve(r))\n    .sort((a, b) => a.localeCompare(b));\n\n  if (options.denyNetwork === false) {\n    cfg['network-interfaces'] = [\n      {\n        iface_id: 'eth0',\n        guest_mac: '06:00:00:00:00:01',\n        host_dev_name: 'vmtap0',\n      },\n    ];\n  }\n\n  return cfg;\n}\n\n/** Pure argv: firecracker --config-file <path> (no API socket for one-shot plan). */\nexport function firecrackerArgv(binary: string, configPath: string): string[] {\n  return [binary, '--config-file', configPath, '--no-api'];\n}\n\n/**\n * Resolve Firecracker paths from env or well-known defaults.\n * Returns null when binary or images are missing.\n */\nexport function resolveFirecrackerPaths(\n  env: NodeJS.ProcessEnv = process.env,\n  probeExists: (p: string) => boolean = (p) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  },\n): FirecrackerPaths | null {\n  const binary = env.VIBGRATE_FIRECRACKER_BIN || which('firecracker') || '';\n  const kernel = env.VIBGRATE_FIRECRACKER_KERNEL || '';\n  const rootfs = env.VIBGRATE_FIRECRACKER_ROOTFS || '';\n  if (!binary || !kernel || !rootfs) return null;\n  if (!probeExists(binary) || !probeExists(kernel) || !probeExists(rootfs)) return null;\n  return { binary, kernel, rootfs };\n}\n\n/**\n * Create an L3 ExecutionEnv when Firecracker + images are configured.\n * Returns null so the ladder can fall back cleanly.\n */\nexport function tryCreateFirecrackerEnv(options: {\n  writableRoots: string[];\n  denyNetwork?: boolean;\n  paths?: FirecrackerPaths | null;\n  reason?: string;\n}): ExecutionEnv | null {\n  const paths = options.paths === undefined ? resolveFirecrackerPaths() : options.paths;\n  if (!paths) return null;\n\n  const denyNetwork = options.denyNetwork !== false;\n  const reason = options.reason ?? 'L3 Firecracker microVM';\n\n  return {\n    tier: 'L3',\n    label: 'firecracker',\n    reason,\n    run(command, runOpts): ShellResult {\n      const roots = options.writableRoots.length ? options.writableRoots : [runOpts.cwd];\n      const configPath = path.join(\n        process.env.TMPDIR || '/tmp',\n        `vg-fc-${process.pid}-${Date.now()}.json`,\n      );\n      const cfg = buildFirecrackerConfig(paths, {\n        writableRoots: roots,\n        command,\n        denyNetwork,\n        configPath,\n      });\n      try {\n        fs.writeFileSync(configPath, `${JSON.stringify(cfg, null, 2)}\\n`, {\n          encoding: 'utf8',\n          mode: 0o600,\n        });\n        const argv = firecrackerArgv(paths.binary, configPath);\n        const res = spawnSync(argv[0]!, argv.slice(1), {\n          encoding: 'utf8',\n          timeout: runOpts.timeoutMs ?? 120_000,\n          maxBuffer: 10 * 1024 * 1024,\n          env: process.env,\n        });\n        const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n        // If firecracker is not actually runnable, surface a clear exit.\n        if (res.error) {\n          return {\n            stdout: `firecracker failed to start: ${res.error.message}`,\n            exitCode: 1,\n          };\n        }\n        return { stdout, exitCode: res.status ?? 1 };\n      } finally {\n        try {\n          fs.unlinkSync(configPath);\n        } catch {\n          /* best-effort */\n        }\n      }\n    },\n  };\n}\n\nfunction which(bin: string): string | null {\n  try {\n    const res = spawnSync(process.platform === 'win32' ? 'where' : 'which', [bin], {\n      encoding: 'utf8',\n    });\n    if (res.status !== 0) return null;\n    const line = (res.stdout ?? '').trim().split('\\n')[0]?.trim();\n    return line || null;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Sandbox backend ladder interface (Fusion Phase 7 / ADR-002).\n *\n * L0 host · L1 Seatbelt/bwrap · L2 process jail (firejail / gVisor runsc when\n * available) · L3 microVM (Firecracker when binary + guest images are configured).\n *\n * The agent kernel only sees {@link ExecutionEnv}; this module classifies and\n * resolves stronger backends without changing tool semantics.\n */\n\nimport { spawnSync } from 'node:child_process';\nimport type { SecurityTier } from './execution-env.js';\nimport { resolveFirecrackerPaths } from './firecracker.js';\n\nexport type SandboxBackendId = 'host' | 'seatbelt' | 'bwrap' | 'firejail' | 'gvisor' | 'firecracker';\n\nexport interface SandboxBackendInfo {\n  id: SandboxBackendId;\n  /** Maps to security tier this backend satisfies. */\n  tier: SecurityTier;\n  available: boolean;\n  /** Why available/unavailable. */\n  reason: string;\n}\n\nexport interface SandboxCapabilities {\n  platform: NodeJS.Platform;\n  backends: SandboxBackendInfo[];\n  /** Best tier this host can enforce. */\n  bestTier: SecurityTier;\n}\n\n/**\n * Probe optional L2+ backends. Pure over spawn probes — never throws.\n * Firecracker is available only when binary + kernel + rootfs resolve.\n */\nexport function detectSandboxCapabilities(platform: NodeJS.Platform = process.platform): SandboxCapabilities {\n  const backends: SandboxBackendInfo[] = [];\n\n  if (platform === 'darwin') {\n    const seatbelt = commandOnPath('sandbox-exec');\n    backends.push({\n      id: 'seatbelt',\n      tier: 'L1',\n      available: seatbelt,\n      reason: seatbelt ? 'sandbox-exec present' : 'sandbox-exec not found',\n    });\n  }\n\n  if (platform === 'linux') {\n    const bwrap = commandOnPath('bwrap');\n    backends.push({\n      id: 'bwrap',\n      tier: 'L1',\n      available: bwrap,\n      reason: bwrap ? 'bubblewrap present' : 'bwrap not found',\n    });\n    const firejail = commandOnPath('firejail');\n    backends.push({\n      id: 'firejail',\n      tier: 'L2',\n      available: firejail,\n      reason: firejail ? 'firejail present' : 'firejail not found',\n    });\n    const runsc = commandOnPath('runsc');\n    backends.push({\n      id: 'gvisor',\n      tier: 'L2',\n      available: runsc,\n      reason: runsc ? 'gVisor runsc present' : 'runsc not found',\n    });\n  }\n\n  const fc = resolveFirecrackerPaths();\n  backends.push({\n    id: 'firecracker',\n    tier: 'L3',\n    available: !!fc,\n    reason: fc\n      ? `Firecracker configured (${fc.binary})`\n      : 'Firecracker unset — set VIBGRATE_FIRECRACKER_BIN, _KERNEL, _ROOTFS',\n  });\n\n  backends.push({\n    id: 'host',\n    tier: 'L0',\n    available: true,\n    reason: 'always available',\n  });\n\n  let bestTier: SecurityTier = 'L0';\n  for (const b of backends) {\n    if (!b.available) continue;\n    if (tierRank(b.tier) > tierRank(bestTier)) bestTier = b.tier;\n  }\n\n  return { platform, backends, bestTier };\n}\n\n/** Pure: pick the strongest available backend that satisfies `requested`. */\nexport function selectSandboxBackend(\n  requested: SecurityTier,\n  caps: SandboxCapabilities = detectSandboxCapabilities(),\n): SandboxBackendInfo {\n  const want = tierRank(requested);\n  // Prefer exact tier match, then best available ≤ requested, then any higher if requested and available.\n  const available = caps.backends.filter((b) => b.available);\n  const exact = available.find((b) => b.tier === requested && b.id !== 'host');\n  if (exact) return exact;\n  // Stronger than requested is fine (more isolation).\n  const stronger = available\n    .filter((b) => tierRank(b.tier) >= want && b.id !== 'host')\n    .sort((a, b) => tierRank(a.tier) - tierRank(b.tier));\n  if (stronger[0]) return stronger[0];\n  // Fall back to best ≤ requested.\n  const weaker = available\n    .filter((b) => tierRank(b.tier) < want)\n    .sort((a, b) => tierRank(b.tier) - tierRank(a.tier));\n  if (weaker[0]) return weaker[0];\n  return available.find((b) => b.id === 'host') ?? {\n    id: 'host',\n    tier: 'L0',\n    available: true,\n    reason: 'fallback host',\n  };\n}\n\n/**\n * Build firejail argv for L2 path isolation (Linux).\n * Network denied by default when denyNetwork is true.\n */\nexport function firejailArgv(\n  writableRoots: string[],\n  command: string,\n  options: { denyNetwork?: boolean; cwd?: string } = {},\n): string[] {\n  const args: string[] = [\n    'firejail',\n    '--quiet',\n    '--noprofile',\n    '--private-tmp',\n    '--nonewprivs',\n    '--nogroups',\n  ];\n  if (options.denyNetwork !== false) args.push('--net=none');\n  for (const root of writableRoots) {\n    args.push(`--whitelist=${root}`);\n  }\n  if (options.cwd) args.push(`--whitelist=${options.cwd}`);\n  args.push('--', '/bin/sh', '-c', command);\n  return args;\n}\n\nfunction tierRank(t: SecurityTier): number {\n  if (t === 'L0') return 0;\n  if (t === 'L1') return 1;\n  if (t === 'L2') return 2;\n  return 3;\n}\n\nfunction commandOnPath(bin: string): boolean {\n  try {\n    const res = spawnSync(process.platform === 'win32' ? 'where' : 'which', [bin], { encoding: 'utf8' });\n    return res.status === 0 && Boolean(res.stdout?.trim());\n  } catch {\n    return false;\n  }\n}\n","/**\n * gVisor (runsc) L2 sandbox backend (Fusion Runtime Phase 7 / ADR-002).\n *\n * When `runsc` is on PATH and a rootfs is configured, L2 can use gVisor instead\n * of (or as fallback from) firejail. Pure plan/argv builders; execution is\n * best-effort and falls back cleanly when images are missing.\n *\n * Env:\n *   VIBGRATE_GVISOR_BIN     — path to runsc (default: runsc on PATH)\n *   VIBGRATE_GVISOR_ROOTFS  — OCI/rootfs bundle directory\n */\n\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport type { ExecutionEnv, ShellResult } from './execution-env.js';\n\nexport interface GvisorPaths {\n  binary: string;\n  rootfs: string;\n}\n\nexport interface GvisorPlanOptions {\n  writableRoots: string[];\n  command: string;\n  denyNetwork?: boolean;\n  cwd?: string;\n}\n\n/**\n * Pure argv for a one-shot runsc do (no long-lived container).\n * Network is unshared when denyNetwork is true.\n */\nexport function gvisorArgv(paths: GvisorPaths, options: GvisorPlanOptions): string[] {\n  const args: string[] = [\n    paths.binary,\n    '--rootless=true',\n    '--network=' + (options.denyNetwork === false ? 'host' : 'none'),\n    'do',\n    '--rootfs-path',\n    paths.rootfs,\n  ];\n  // Bind writable project roots into the sandbox.\n  for (const root of [...options.writableRoots].map((r) => path.resolve(r)).sort()) {\n    args.push('--bind', `${root}:${root}:rw`);\n  }\n  if (options.cwd) {\n    args.push('--cwd', path.resolve(options.cwd));\n  }\n  args.push('--', '/bin/sh', '-c', options.command);\n  return args;\n}\n\nexport function resolveGvisorPaths(\n  env: NodeJS.ProcessEnv = process.env,\n  probeExists: (p: string) => boolean = (p) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  },\n  which: (bin: string) => string | null = whichBin,\n): GvisorPaths | null {\n  const binary = env.VIBGRATE_GVISOR_BIN || which('runsc') || '';\n  const rootfs = env.VIBGRATE_GVISOR_ROOTFS || '';\n  if (!binary || !rootfs) return null;\n  if (!probeExists(binary) || !probeExists(rootfs)) return null;\n  return { binary, rootfs };\n}\n\nexport function tryCreateGvisorEnv(options: {\n  writableRoots: string[];\n  denyNetwork?: boolean;\n  paths?: GvisorPaths | null;\n  reason?: string;\n}): ExecutionEnv | null {\n  const paths = options.paths === undefined ? resolveGvisorPaths() : options.paths;\n  if (!paths) return null;\n  const denyNetwork = options.denyNetwork !== false;\n  return {\n    tier: 'L2',\n    label: 'gvisor',\n    reason: options.reason ?? 'L2 gVisor runsc',\n    run(command, runOpts): ShellResult {\n      const roots = options.writableRoots.length ? options.writableRoots : [runOpts.cwd];\n      const argv = gvisorArgv(paths, {\n        writableRoots: roots,\n        command,\n        denyNetwork,\n        cwd: runOpts.cwd,\n      });\n      const res = spawnSync(argv[0]!, argv.slice(1), {\n        encoding: 'utf8',\n        timeout: runOpts.timeoutMs ?? 120_000,\n        maxBuffer: 10 * 1024 * 1024,\n        env: process.env,\n      });\n      if (res.error) {\n        return { stdout: `gvisor failed to start: ${res.error.message}`, exitCode: 1 };\n      }\n      const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n      return { stdout, exitCode: res.status ?? 1 };\n    },\n  };\n}\n\nfunction whichBin(bin: string): string | null {\n  try {\n    const res = spawnSync(process.platform === 'win32' ? 'where' : 'which', [bin], {\n      encoding: 'utf8',\n    });\n    if (res.status !== 0) return null;\n    return (res.stdout ?? '').trim().split('\\n')[0]?.trim() || null;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Execution environment ladder (Fusion Runtime Phase 7 / ADR-002).\n *\n * The agent kernel stays the same; only the substrate that runs shell commands\n * changes. L0 is the host process. L1 is path-restricted isolation:\n *   · macOS — Seatbelt via `sandbox-exec` (writes limited to project roots + temp)\n *   · Linux — bubblewrap (`bwrap`) when available (same write scope; optional net deny)\n * When the platform cannot provide a real isolator, resolveExecutionEnv falls\n * back to L0 with an explicit reason rather than failing closed for developers.\n *\n * L2 uses firejail when available (Linux). L3 uses Firecracker when the binary\n * and guest images are configured (`VIBGRATE_FIRECRACKER_*`); otherwise the\n * ladder falls back to best available ≤ L2.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { firejailArgv } from './sandbox-backend.js';\nimport { tryCreateFirecrackerEnv } from './firecracker.js';\nimport { tryCreateGvisorEnv } from './gvisor.js';\n\nexport type SecurityTier = 'L0' | 'L1' | 'L2' | 'L3';\n\nexport interface ShellResult {\n  stdout: string;\n  exitCode: number;\n}\n\nexport interface ExecutionEnv {\n  readonly tier: SecurityTier;\n  /** Human-readable substrate description. */\n  readonly label: string;\n  /** Why this tier was selected (capability / config). */\n  readonly reason: string;\n  run(command: string, options: { cwd: string; timeoutMs?: number }): ShellResult;\n}\n\nexport interface SecurityCapabilities {\n  platform: NodeJS.Platform;\n  /** Linux Landlock filesystem present (best-effort probe). */\n  landlock: boolean;\n  /** macOS Seatbelt / sandbox-exec available. */\n  seatbelt: boolean;\n  /** Linux bubblewrap available (practical L1 isolator). */\n  bubblewrap: boolean;\n  /** Linux firejail available (L2 process jail). */\n  firejail: boolean;\n  /** Linux gVisor runsc available (L2 reserved until wired). */\n  gvisor: boolean;\n}\n\nexport interface ResolveExecutionEnvOptions {\n  capabilities?: SecurityCapabilities;\n  /**\n   * Absolute paths the sandboxed process may write. Defaults to the command\n   * `cwd` at run time (plus system temp). Pass federation member roots so\n   * multi-root agent sessions can write into every workspace folder.\n   */\n  writableRoots?: string[];\n  /**\n   * Deny outbound network inside the sandbox (default true for L1). Parent\n   * process model API calls are unaffected — only `run_command` / verify shell.\n   */\n  denyNetwork?: boolean;\n}\n\n/** Probe host isolation capabilities without throwing. */\nexport function detectSecurityCapabilities(platform: NodeJS.Platform = process.platform): SecurityCapabilities {\n  if (platform === 'linux') {\n    return {\n      platform,\n      landlock: linuxLandlockAvailable(),\n      seatbelt: false,\n      bubblewrap: commandOnPath('bwrap'),\n      firejail: commandOnPath('firejail'),\n      gvisor: commandOnPath('runsc'),\n    };\n  }\n  if (platform === 'darwin') {\n    return {\n      platform,\n      landlock: false,\n      seatbelt: macSeatbeltAvailable(),\n      bubblewrap: false,\n      firejail: false,\n      gvisor: false,\n    };\n  }\n  return { platform, landlock: false, seatbelt: false, bubblewrap: false, firejail: false, gvisor: false };\n}\n\n/**\n * Resolve an execution env for the requested tier.\n * L3 → Firecracker when configured; else L2 → firejail; else L1 Seatbelt/bwrap.\n * Landlock sysfs alone is not enough without a userspace enforcer.\n */\nexport function resolveExecutionEnv(\n  requested: SecurityTier = 'L0',\n  options: ResolveExecutionEnvOptions = {},\n): ExecutionEnv {\n  const caps = options.capabilities ?? detectSecurityCapabilities();\n  const writableRoots = normalizeRoots(options.writableRoots);\n  const denyNetwork = options.denyNetwork !== false;\n\n  if (requested === 'L0') return createHostExecutionEnv('explicit L0');\n\n  if (requested === 'L3') {\n    const l3 = tryCreateFirecrackerEnv({\n      writableRoots,\n      denyNetwork,\n      reason: 'L3 Firecracker microVM',\n    });\n    if (l3) return l3;\n    const l2 = tryCreateL2Env(caps, writableRoots, denyNetwork, requested);\n    if (l2) return l2;\n    const l1 = tryCreateL1Env(caps, writableRoots, denyNetwork, requested);\n    if (l1) return l1;\n    return createHostExecutionEnv('L3 not available (Firecracker images unset) — falling back to L0');\n  }\n\n  if (requested === 'L2') {\n    const l2 = tryCreateL2Env(caps, writableRoots, denyNetwork, requested);\n    if (l2) return l2;\n    const l1 = tryCreateL1Env(caps, writableRoots, denyNetwork, requested);\n    if (l1) return l1;\n    return createHostExecutionEnv(`${requested} not available — falling back to L0`);\n  }\n\n  if (requested === 'L1') {\n    const l1 = tryCreateL1Env(caps, writableRoots, denyNetwork, requested);\n    if (l1) return l1;\n    return createHostExecutionEnv('L1 requested but no Seatbelt/bubblewrap — falling back to L0');\n  }\n\n  return createHostExecutionEnv('unknown tier — falling back to L0');\n}\n\nexport function createHostExecutionEnv(reason = 'host process'): ExecutionEnv {\n  return {\n    tier: 'L0',\n    label: 'host',\n    reason,\n    run(command, options) {\n      return hostRun(command, options);\n    },\n  };\n}\n\n/**\n * Build a macOS Seatbelt (sandbox-exec) profile that allows reads broadly and\n * restricts writes to the given roots + system temp. Pure — used by tests.\n */\nexport function buildSeatbeltProfile(\n  writableRoots: string[],\n  options: { denyNetwork?: boolean; tempRoots?: string[] } = {},\n): string {\n  const roots = uniqueResolved([...writableRoots, ...(options.tempRoots ?? defaultTempRoots())]);\n  const lines: string[] = [\n    '(version 1)',\n    '(deny default)',\n    '(allow process*)',\n    '(allow sysctl-read)',\n    '(allow mach*)',\n    '(allow system-socket)',\n    '(allow file-read*)',\n    '(allow file-write-data (literal \"/dev/null\"))',\n    '(allow file-write-data (literal \"/dev/zero\"))',\n    '(allow file-ioctl)',\n    '(allow file-write* (literal \"/dev/tty\"))',\n    '(allow file-write* (literal \"/dev/dtracehelper\"))',\n  ];\n  for (const root of roots) {\n    const escaped = escapeSeatbeltPath(root);\n    lines.push(`(allow file-write* (subpath \"${escaped}\"))`);\n    // macOS often exposes paths under /private — allow both forms when applicable.\n    if (root.startsWith('/var/') || root.startsWith('/tmp')) {\n      lines.push(`(allow file-write* (subpath \"${escapeSeatbeltPath(`/private${root}`)}\"))`);\n    }\n    if (root.startsWith('/private/var/') || root.startsWith('/private/tmp')) {\n      const short = root.slice('/private'.length);\n      lines.push(`(allow file-write* (subpath \"${escapeSeatbeltPath(short)}\"))`);\n    }\n  }\n  if (options.denyNetwork !== false) {\n    lines.push('(deny network*)');\n  } else {\n    lines.push('(allow network*)');\n  }\n  // POSIX IPC / signals used by shells and test runners.\n  lines.push('(allow ipc*)');\n  lines.push('(allow signal)');\n  lines.push('(allow pseudo-tty)');\n  return `${lines.join('\\n')}\\n`;\n}\n\n/** Pure: argv for sandbox-exec -f <profile> /bin/sh -c <command>. */\nexport function seatbeltArgv(profilePath: string, command: string): string[] {\n  return ['sandbox-exec', '-f', profilePath, '/bin/sh', '-c', command];\n}\n\n/** Pure: argv for bwrap with write binds for roots (read-only host + bind writables). */\nexport function bubblewrapArgv(\n  writableRoots: string[],\n  command: string,\n  options: { denyNetwork?: boolean; cwd?: string } = {},\n): string[] {\n  const args: string[] = [\n    'bwrap',\n    '--die-with-parent',\n    '--ro-bind',\n    '/',\n    '/',\n    '--dev',\n    '/dev',\n    '--proc',\n    '/proc',\n    '--tmpfs',\n    '/tmp',\n  ];\n  const roots = uniqueResolved(writableRoots);\n  for (const root of roots) {\n    // Re-bind writable over the read-only mount.\n    args.push('--bind', root, root);\n  }\n  // System temp must remain writable for compilers / test runners.\n  for (const t of defaultTempRoots()) {\n    if (fs.existsSync(t)) args.push('--bind', t, t);\n  }\n  if (options.denyNetwork !== false) {\n    args.push('--unshare-net');\n  }\n  if (options.cwd) {\n    args.push('--chdir', options.cwd);\n  }\n  args.push('--', '/bin/sh', '-c', command);\n  return args;\n}\n\n// ── internals ──────────────────────────────────────────────────────────────\n\nfunction tryCreateL2Env(\n  caps: SecurityCapabilities,\n  writableRoots: string[],\n  denyNetwork: boolean,\n  requested: SecurityTier,\n): ExecutionEnv | null {\n  if (caps.firejail) {\n    return createFirejailEnv(\n      requested === 'L2'\n        ? 'L2 firejail process jail'\n        : `${requested} requested; using L2 firejail`,\n      writableRoots,\n      denyNetwork,\n    );\n  }\n  // Prefer firejail when both exist; otherwise gVisor when configured.\n  if (caps.gvisor) {\n    const gv = tryCreateGvisorEnv({\n      writableRoots,\n      denyNetwork,\n      reason:\n        requested === 'L2'\n          ? 'L2 gVisor runsc'\n          : `${requested} requested; using L2 gVisor`,\n    });\n    if (gv) return gv;\n  }\n  return null;\n}\n\nfunction tryCreateL1Env(\n  caps: SecurityCapabilities,\n  writableRoots: string[],\n  denyNetwork: boolean,\n  requested: SecurityTier,\n): ExecutionEnv | null {\n  if (caps.seatbelt) {\n    return createSeatbeltEnv(\n      requested === 'L1'\n        ? 'L1 Seatbelt (sandbox-exec) path isolation'\n        : `${requested} requested; using L1 Seatbelt (sandbox-exec)`,\n      writableRoots,\n      denyNetwork,\n    );\n  }\n  if (caps.bubblewrap) {\n    return createBubblewrapEnv(\n      requested === 'L1'\n        ? 'L1 bubblewrap path isolation'\n        : `${requested} requested; using L1 bubblewrap`,\n      writableRoots,\n      denyNetwork,\n      caps.landlock,\n    );\n  }\n  // Landlock sysfs without a userspace enforcer cannot isolate from Node alone.\n  if (caps.landlock) {\n    return null;\n  }\n  return null;\n}\n\nfunction createFirejailEnv(reason: string, writableRoots: string[], denyNetwork: boolean): ExecutionEnv {\n  return {\n    tier: 'L2',\n    label: 'firejail',\n    reason,\n    run(command, options) {\n      const roots = writableRoots.length ? writableRoots : [options.cwd];\n      if (!roots.some((r) => isPathInside(options.cwd, r))) {\n        roots.push(path.resolve(options.cwd));\n      }\n      const argv = firejailArgv(roots, command, { denyNetwork, cwd: options.cwd });\n      const res = spawnSync(argv[0]!, argv.slice(1), {\n        encoding: 'utf8',\n        timeout: options.timeoutMs ?? 120_000,\n        maxBuffer: 10 * 1024 * 1024,\n        env: process.env,\n      });\n      const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n      return { stdout, exitCode: res.status ?? 1 };\n    },\n  };\n}\n\nfunction createSeatbeltEnv(reason: string, writableRoots: string[], denyNetwork: boolean): ExecutionEnv {\n  return {\n    tier: 'L1',\n    label: 'seatbelt',\n    reason,\n    run(command, options) {\n      const roots = writableRoots.length ? writableRoots : [options.cwd];\n      const profile = buildSeatbeltProfile(roots, { denyNetwork });\n      const profilePath = path.join(os.tmpdir(), `vg-seatbelt-${process.pid}-${Date.now()}.sb`);\n      try {\n        fs.writeFileSync(profilePath, profile, { encoding: 'utf8', mode: 0o600 });\n        const argv = seatbeltArgv(profilePath, command);\n        const res = spawnSync(argv[0]!, argv.slice(1), {\n          cwd: options.cwd,\n          encoding: 'utf8',\n          timeout: options.timeoutMs ?? 120_000,\n          maxBuffer: 10 * 1024 * 1024,\n          env: process.env,\n        });\n        const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n        return { stdout, exitCode: res.status ?? 1 };\n      } finally {\n        try {\n          fs.unlinkSync(profilePath);\n        } catch {\n          /* best-effort cleanup */\n        }\n      }\n    },\n  };\n}\n\nfunction createBubblewrapEnv(\n  reason: string,\n  writableRoots: string[],\n  denyNetwork: boolean,\n  landlockPresent: boolean,\n): ExecutionEnv {\n  return {\n    tier: 'L1',\n    label: landlockPresent ? 'bwrap+landlock-host' : 'bwrap',\n    reason,\n    run(command, options) {\n      const roots = writableRoots.length ? writableRoots : [options.cwd];\n      // Ensure cwd is writable even if caller omitted it.\n      if (!roots.some((r) => isPathInside(options.cwd, r))) {\n        roots.push(path.resolve(options.cwd));\n      }\n      const argv = bubblewrapArgv(roots, command, { denyNetwork, cwd: options.cwd });\n      const res = spawnSync(argv[0]!, argv.slice(1), {\n        encoding: 'utf8',\n        timeout: options.timeoutMs ?? 120_000,\n        maxBuffer: 10 * 1024 * 1024,\n        env: process.env,\n      });\n      const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n      return { stdout, exitCode: res.status ?? 1 };\n    },\n  };\n}\n\nfunction hostRun(command: string, options: { cwd: string; timeoutMs?: number }): ShellResult {\n  const res = spawnSync(command, {\n    cwd: options.cwd,\n    shell: true,\n    encoding: 'utf8',\n    timeout: options.timeoutMs ?? 120_000,\n    maxBuffer: 10 * 1024 * 1024,\n  });\n  const stdout = (res.stdout ?? '') + (res.stderr ? `\\n${res.stderr}` : '');\n  return { stdout, exitCode: res.status ?? 1 };\n}\n\nfunction linuxLandlockAvailable(): boolean {\n  try {\n    return fs.existsSync('/sys/kernel/security/landlock') || fs.existsSync('/proc/sys/kernel/landlock');\n  } catch {\n    return false;\n  }\n}\n\nfunction macSeatbeltAvailable(): boolean {\n  return commandOnPath('sandbox-exec');\n}\n\nfunction commandOnPath(bin: string): boolean {\n  try {\n    const res = spawnSync(process.platform === 'win32' ? 'where' : 'which', [bin], { encoding: 'utf8' });\n    return res.status === 0 && Boolean(res.stdout?.trim());\n  } catch {\n    return false;\n  }\n}\n\nfunction defaultTempRoots(): string[] {\n  // Prefer the process temp dir (e.g. /var/folders/.../T) — never the entire\n  // /var/folders tree, or every mkdtemp sibling would be writable under L1.\n  const roots: string[] = [];\n  try {\n    roots.push(os.tmpdir());\n  } catch {\n    /* ignore */\n  }\n  if (process.env.TMPDIR) roots.push(process.env.TMPDIR);\n  if (process.env.TMP) roots.push(process.env.TMP);\n  if (process.env.TEMP) roots.push(process.env.TEMP);\n  roots.push('/tmp', '/private/tmp');\n  return uniqueResolved(roots.filter((r) => typeof r === 'string' && r.length > 0));\n}\n\nfunction normalizeRoots(roots: string[] | undefined): string[] {\n  if (!roots?.length) return [];\n  return uniqueResolved(roots.filter((r) => typeof r === 'string' && r.trim()).map((r) => r.trim()));\n}\n\nfunction uniqueResolved(paths: string[]): string[] {\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const p of paths) {\n    try {\n      const abs = path.resolve(p);\n      if (seen.has(abs)) continue;\n      seen.add(abs);\n      out.push(abs);\n    } catch {\n      /* skip bad paths */\n    }\n  }\n  return out.sort((a, b) => a.localeCompare(b));\n}\n\nfunction escapeSeatbeltPath(p: string): string {\n  // Seatbelt subpath strings: escape backslash and double-quote.\n  return p.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n}\n\nfunction isPathInside(child: string, parent: string): boolean {\n  const rel = path.relative(path.resolve(parent), path.resolve(child));\n  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n}\n"]}

package/dist/chunk-IZDH67DX.js

@@ -0,0 +1,289 @@
+// src/runtime/model-execution-catalogue.ts
+var MODEL_EXECUTION_CATALOGUE = [
+  {
+    match: ["qwen2.5-coder:1.5b", "qwen2.5-coder:3b", "qwen2.5:1.5b", "qwen2.5:3b"],
+    profile: {
+      mode: "spark",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "search_replace",
+      capsuleBudgetTokens: 2e3,
+      maxParallelEdits: 2,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: true,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 4, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["qwen2.5-coder:7b", "qwen2.5-coder:14b", "qwen2.5:7b", "qwen2.5:14b"],
+    profile: {
+      mode: "flow",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "auto",
+      capsuleBudgetTokens: 3500,
+      maxParallelEdits: 4,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: false,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 8, minVramGb: 6, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["qwen2.5-coder:32b", "qwen2.5:32b", "qwen2.5:72b"],
+    profile: {
+      mode: "forge",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "patch_ir_json",
+      capsuleBudgetTokens: 6e3,
+      maxParallelEdits: 6,
+      maxRepairRounds: 3,
+      temperature: 0,
+      constrainedDecoding: false,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 24, minVramGb: 20, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["deepseek-coder", "deepseek-coder-v2"],
+    profile: {
+      mode: "flow",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "auto",
+      capsuleBudgetTokens: 4e3,
+      maxParallelEdits: 4,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: false,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 12, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["codellama:7b", "codellama:13b", "codegemma"],
+    profile: {
+      mode: "flow",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "search_replace",
+      capsuleBudgetTokens: 3e3,
+      maxParallelEdits: 3,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: true,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 8, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["llama3.1:8b", "llama3.2:3b", "llama3.2:1b"],
+    profile: {
+      mode: "spark",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "search_replace",
+      capsuleBudgetTokens: 2500,
+      maxParallelEdits: 2,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: true,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 6, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["granite-code:3b", "granite-code:8b"],
+    profile: {
+      mode: "spark",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "search_replace",
+      capsuleBudgetTokens: 2500,
+      maxParallelEdits: 2,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: true,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 4, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["granite-code:20b", "granite-code:34b"],
+    profile: {
+      mode: "flow",
+      backend: "ollama",
+      toolCalling: "native",
+      editFormat: "auto",
+      capsuleBudgetTokens: 3500,
+      maxParallelEdits: 4,
+      maxRepairRounds: 2,
+      temperature: 0,
+      constrainedDecoding: false,
+      kvCacheStrategy: "stable_prefix",
+      resources: { minRamGb: 16, minVramGb: 12, quant: "q4_k_m" },
+      securityTier: "L1"
+    }
+  },
+  {
+    match: ["claude-3.5-sonnet", "claude-sonnet", "claude-3-opus", "gpt-4o", "o1", "o3"],
+    profile: {
+      mode: "forge",
+      backend: "openai-compatible",
+      toolCalling: "native",
+      editFormat: "auto",
+      capsuleBudgetTokens: 5e3,
+      maxParallelEdits: 6,
+      maxRepairRounds: 3,
+      temperature: 0,
+      constrainedDecoding: false,
+      kvCacheStrategy: "stable_prefix",
+      securityTier: "L1"
+    }
+  }
+];
+function matchCatalogueProfile(model) {
+  const m = model.trim().toLowerCase();
+  if (!m) return null;
+  let best = null;
+  for (const entry of MODEL_EXECUTION_CATALOGUE) {
+    for (const needle of entry.match) {
+      const n = needle.toLowerCase();
+      if (m.includes(n) && (!best || n.length > best.len)) {
+        best = { len: n.length, entry, needle: n };
+      }
+    }
+  }
+  if (!best) return null;
+  const p = best.entry.profile;
+  return {
+    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,
+    id: p.id ?? model.trim(),
+    displayName: p.displayName ?? model.trim(),
+    mode: p.mode,
+    backend: p.backend,
+    toolCalling: p.toolCalling,
+    editFormat: p.editFormat,
+    capsuleBudgetTokens: p.capsuleBudgetTokens,
+    maxParallelEdits: p.maxParallelEdits,
+    maxRepairRounds: p.maxRepairRounds,
+    temperature: p.temperature,
+    constrainedDecoding: p.constrainedDecoding,
+    kvCacheStrategy: p.kvCacheStrategy,
+    resources: p.resources,
+    securityTier: p.securityTier
+  };
+}
+
+// src/runtime/model-execution-profile.ts
+var MODEL_EXECUTION_PROFILE_SCHEMA_VERSION = "model-execution-profile/0";
+function defaultModelExecutionProfile(partial = {}) {
+  const id = partial.id?.trim() || "default";
+  return {
+    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,
+    id,
+    displayName: partial.displayName ?? id,
+    mode: partial.mode ?? "flow",
+    backend: partial.backend ?? "other",
+    toolCalling: "native",
+    editFormat: "auto",
+    capsuleBudgetTokens: partial.capsuleBudgetTokens ?? 3e3,
+    maxParallelEdits: 4,
+    maxRepairRounds: partial.maxRepairRounds ?? 2,
+    temperature: 0,
+    constrainedDecoding: false,
+    kvCacheStrategy: "stable_prefix",
+    resources: partial.quant ? { quant: partial.quant } : void 0,
+    securityTier: partial.securityTier,
+    inferenceIsolation: "embedded"
+  };
+}
+function resolveModelExecutionProfile(input) {
+  const model = (input.model ?? "").trim();
+  const provider = (input.providerId ?? "").toLowerCase();
+  const catalogued = matchCatalogueProfile(model);
+  if (catalogued) {
+    return {
+      ...catalogued,
+      id: model || catalogued.id,
+      displayName: model || catalogued.displayName,
+      capsuleBudgetTokens: input.budget ?? catalogued.capsuleBudgetTokens,
+      maxRepairRounds: input.maxRepairRounds ?? catalogued.maxRepairRounds,
+      securityTier: input.securityTier ?? catalogued.securityTier,
+      backend: provider === "ollama" ? "ollama" : provider === "llama-cpp" || provider === "llamacpp" ? "llama.cpp" : provider === "lmstudio" || provider === "openrouter" || provider === "openai" || provider === "together" ? "openai-compatible" : catalogued.backend
+    };
+  }
+  const backend = provider === "ollama" ? "ollama" : provider === "llama-cpp" || provider === "llamacpp" ? "llama.cpp" : provider === "lmstudio" || provider === "openrouter" || provider === "openai" || provider === "together" ? "openai-compatible" : "other";
+  let mode = "flow";
+  const m = model.toLowerCase();
+  if (/\b(1\.5b|1b|3b|0\.5b|tiny|mini)\b/.test(m)) mode = "spark";
+  if (/\b(32b|70b|72b|405b|large|opus|sonnet)\b/.test(m)) mode = "forge";
+  const quant = /\bq[2-8](_[a-z0-9]+)?\b/i.exec(model)?.[0];
+  return defaultModelExecutionProfile({
+    id: model || provider || "default",
+    displayName: model || provider || "default",
+    backend,
+    mode,
+    capsuleBudgetTokens: input.budget,
+    maxRepairRounds: input.maxRepairRounds,
+    securityTier: input.securityTier,
+    quant: quant ?? void 0
+  });
+}
+function parseModelExecutionProfile(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  const out = {};
+  if (typeof o.id === "string" && o.id.trim()) out.id = o.id.trim();
+  if (typeof o.displayName === "string") out.displayName = o.displayName;
+  if (o.mode === "spark" || o.mode === "flow" || o.mode === "forge") out.mode = o.mode;
+  if (o.backend === "ollama" || o.backend === "llama.cpp" || o.backend === "mlx" || o.backend === "openai-compatible" || o.backend === "other") {
+    out.backend = o.backend;
+  }
+  if (o.toolCalling === "native" || o.toolCalling === "grammar" || o.toolCalling === "disabled") {
+    out.toolCalling = o.toolCalling;
+  }
+  if (o.editFormat === "search_replace" || o.editFormat === "patch_ir_json" || o.editFormat === "whole_file" || o.editFormat === "auto") {
+    out.editFormat = o.editFormat;
+  }
+  if (typeof o.capsuleBudgetTokens === "number" && o.capsuleBudgetTokens > 0) {
+    out.capsuleBudgetTokens = Math.floor(o.capsuleBudgetTokens);
+  }
+  if (typeof o.maxParallelEdits === "number" && o.maxParallelEdits > 0) {
+    out.maxParallelEdits = Math.floor(o.maxParallelEdits);
+  }
+  if (typeof o.maxRepairRounds === "number" && o.maxRepairRounds >= 0) {
+    out.maxRepairRounds = Math.floor(o.maxRepairRounds);
+  }
+  if (typeof o.temperature === "number") out.temperature = o.temperature;
+  if (typeof o.constrainedDecoding === "boolean") out.constrainedDecoding = o.constrainedDecoding;
+  if (o.securityTier === "L0" || o.securityTier === "L1" || o.securityTier === "L2" || o.securityTier === "L3") {
+    out.securityTier = o.securityTier;
+  }
+  return out;
+}
+function mergeModelExecutionProfile(base, override) {
+  if (!override) return base;
+  return {
+    ...base,
+    ...override,
+    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,
+    id: override.id ?? base.id,
+    resources: override.resources ?? base.resources
+  };
+}
+
+export { MODEL_EXECUTION_PROFILE_SCHEMA_VERSION, defaultModelExecutionProfile, mergeModelExecutionProfile, parseModelExecutionProfile, resolveModelExecutionProfile };
+//# sourceMappingURL=chunk-IZDH67DX.js.map
+//# sourceMappingURL=chunk-IZDH67DX.js.map

package/dist/chunk-IZDH67DX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/model-execution-catalogue.ts","../src/runtime/model-execution-profile.ts"],"names":[],"mappings":";AA2BO,IAAM,yBAAA,GAA8C;AAAA,EACzD;AAAA,IACE,KAAA,EAAO,CAAC,oBAAA,EAAsB,kBAAA,EAAoB,gBAAgB,YAAY,CAAA;AAAA,IAC9E,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,gBAAA;AAAA,MACZ,mBAAA,EAAqB,GAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,IAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,SAAA,EAAW,EAAE,QAAA,EAAU,CAAA,EAAG,OAAO,QAAA,EAAS;AAAA,MAC1C,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,kBAAA,EAAoB,mBAAA,EAAqB,cAAc,aAAa,CAAA;AAAA,IAC5E,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,MAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,MAAA;AAAA,MACZ,mBAAA,EAAqB,IAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,KAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,WAAW,EAAE,QAAA,EAAU,GAAG,SAAA,EAAW,CAAA,EAAG,OAAO,QAAA,EAAS;AAAA,MACxD,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,mBAAA,EAAqB,aAAA,EAAe,aAAa,CAAA;AAAA,IACzD,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,eAAA;AAAA,MACZ,mBAAA,EAAqB,GAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,KAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,WAAW,EAAE,QAAA,EAAU,IAAI,SAAA,EAAW,EAAA,EAAI,OAAO,QAAA,EAAS;AAAA,MAC1D,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,IAC7C,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,MAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,MAAA;AAAA,MACZ,mBAAA,EAAqB,GAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,KAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,SAAA,EAAW,EAAE,QAAA,EAAU,EAAA,EAAI,OAAO,QAAA,EAAS;AAAA,MAC3C,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,cAAA,EAAgB,eAAA,EAAiB,WAAW,CAAA;AAAA,IACpD,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,MAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,gBAAA;AAAA,MACZ,mBAAA,EAAqB,GAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,IAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,SAAA,EAAW,EAAE,QAAA,EAAU,CAAA,EAAG,OAAO,QAAA,EAAS;AAAA,MAC1C,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,aAAA,EAAe,aAAA,EAAe,aAAa,CAAA;AAAA,IACnD,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,gBAAA;AAAA,MACZ,mBAAA,EAAqB,IAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,IAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,SAAA,EAAW,EAAE,QAAA,EAAU,CAAA,EAAG,OAAO,QAAA,EAAS;AAAA,MAC1C,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,iBAAA,EAAmB,iBAAiB,CAAA;AAAA,IAC5C,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,gBAAA;AAAA,MACZ,mBAAA,EAAqB,IAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,IAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,SAAA,EAAW,EAAE,QAAA,EAAU,CAAA,EAAG,OAAO,QAAA,EAAS;AAAA,MAC1C,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,KAAA,EAAO,CAAC,kBAAA,EAAoB,kBAAkB,CAAA;AAAA,IAC9C,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,MAAA;AAAA,MACN,OAAA,EAAS,QAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,MAAA;AAAA,MACZ,mBAAA,EAAqB,IAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,KAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,WAAW,EAAE,QAAA,EAAU,IAAI,SAAA,EAAW,EAAA,EAAI,OAAO,QAAA,EAAS;AAAA,MAC1D,YAAA,EAAc;AAAA;AAChB,GACF;AAAA,EACA;AAAA,IACE,OAAO,CAAC,mBAAA,EAAqB,iBAAiB,eAAA,EAAiB,QAAA,EAAU,MAAM,IAAI,CAAA;AAAA,IACnF,OAAA,EAAS;AAAA,MACP,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,mBAAA;AAAA,MACT,WAAA,EAAa,QAAA;AAAA,MACb,UAAA,EAAY,MAAA;AAAA,MACZ,mBAAA,EAAqB,GAAA;AAAA,MACrB,gBAAA,EAAkB,CAAA;AAAA,MAClB,eAAA,EAAiB,CAAA;AAAA,MACjB,WAAA,EAAa,CAAA;AAAA,MACb,mBAAA,EAAqB,KAAA;AAAA,MACrB,eAAA,EAAiB,eAAA;AAAA,MACjB,YAAA,EAAc;AAAA;AAChB;AAEJ,CAAA;AAKO,SAAS,sBAAsB,KAAA,EAA6C;AACjF,EAAA,MAAM,CAAA,GAAI,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AACnC,EAAA,IAAI,CAAC,GAAG,OAAO,IAAA;AACf,EAAA,IAAI,IAAA,GAAsE,IAAA;AAC1E,EAAA,KAAA,MAAW,SAAS,yBAAA,EAA2B;AAC7C,IAAA,KAAA,MAAW,MAAA,IAAU,MAAM,KAAA,EAAO;AAChC,MAAA,MAAM,CAAA,GAAI,OAAO,WAAA,EAAY;AAC7B,MAAA,IAAI,CAAA,CAAE,SAAS,CAAC,CAAA,KAAM,CAAC,IAAA,IAAQ,CAAA,CAAE,MAAA,GAAS,IAAA,CAAK,GAAA,CAAA,EAAM;AACnD,QAAA,IAAA,GAAO,EAAE,GAAA,EAAK,CAAA,CAAE,MAAA,EAAQ,KAAA,EAAO,QAAQ,CAAA,EAAE;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,MAAM,CAAA,GAAI,KAAK,KAAA,CAAM,OAAA;AACrB,EAAA,OAAO;AAAA,IACL,aAAA,EAAe,sCAAA;AAAA,IACf,EAAA,EAAI,CAAA,CAAE,EAAA,IAAM,KAAA,CAAM,IAAA,EAAK;AAAA,IACvB,WAAA,EAAa,CAAA,CAAE,WAAA,IAAe,KAAA,CAAM,IAAA,EAAK;AAAA,IACzC,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,SAAS,CAAA,CAAE,OAAA;AAAA,IACX,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,YAAY,CAAA,CAAE,UAAA;AAAA,IACd,qBAAqB,CAAA,CAAE,mBAAA;AAAA,IACvB,kBAAkB,CAAA,CAAE,gBAAA;AAAA,IACpB,iBAAiB,CAAA,CAAE,eAAA;AAAA,IACnB,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,qBAAqB,CAAA,CAAE,mBAAA;AAAA,IACvB,iBAAiB,CAAA,CAAE,eAAA;AAAA,IACnB,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,cAAc,CAAA,CAAE;AAAA,GAClB;AACF;;;AC3MO,IAAM,sCAAA,GAAyC;AAiD/C,SAAS,4BAAA,CAA6B,OAAA,GAA6B,EAAC,EAA0B;AACnG,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,EAAK,IAAK,SAAA;AACjC,EAAA,OAAO;AAAA,IACL,aAAA,EAAe,sCAAA;AAAA,IACf,EAAA;AAAA,IACA,WAAA,EAAa,QAAQ,WAAA,IAAe,EAAA;AAAA,IACpC,IAAA,EAAM,QAAQ,IAAA,IAAQ,MAAA;AAAA,IACtB,OAAA,EAAS,QAAQ,OAAA,IAAW,OAAA;AAAA,IAC5B,WAAA,EAAa,QAAA;AAAA,IACb,UAAA,EAAY,MAAA;AAAA,IACZ,mBAAA,EAAqB,QAAQ,mBAAA,IAAuB,GAAA;AAAA,IACpD,gBAAA,EAAkB,CAAA;AAAA,IAClB,eAAA,EAAiB,QAAQ,eAAA,IAAmB,CAAA;AAAA,IAC5C,WAAA,EAAa,CAAA;AAAA,IACb,mBAAA,EAAqB,KAAA;AAAA,IACrB,eAAA,EAAiB,eAAA;AAAA,IACjB,WAAW,OAAA,CAAQ,KAAA,GAAQ,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAM,GAAI,MAAA;AAAA,IACtD,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,kBAAA,EAAoB;AAAA,GACtB;AACF;AAMO,SAAS,6BAA6B,KAAA,EAMnB;AACxB,EAAA,MAAM,KAAA,GAAA,CAAS,KAAA,CAAM,KAAA,IAAS,EAAA,EAAI,IAAA,EAAK;AACvC,EAAA,MAAM,QAAA,GAAA,CAAY,KAAA,CAAM,UAAA,IAAc,EAAA,EAAI,WAAA,EAAY;AAGtD,EAAA,MAAM,UAAA,GAAa,sBAAsB,KAAK,CAAA;AAC9C,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,OAAO;AAAA,MACL,GAAG,UAAA;AAAA,MACH,EAAA,EAAI,SAAS,UAAA,CAAW,EAAA;AAAA,MACxB,WAAA,EAAa,SAAS,UAAA,CAAW,WAAA;AAAA,MACjC,mBAAA,EAAqB,KAAA,CAAM,MAAA,IAAU,UAAA,CAAW,mBAAA;AAAA,MAChD,eAAA,EAAiB,KAAA,CAAM,eAAA,IAAmB,UAAA,CAAW,eAAA;AAAA,MACrD,YAAA,EAAc,KAAA,CAAM,YAAA,IAAgB,UAAA,CAAW,YAAA;AAAA,MAC/C,SACE,QAAA,KAAa,QAAA,GACT,WACA,QAAA,KAAa,WAAA,IAAe,aAAa,UAAA,GACvC,WAAA,GACA,QAAA,KAAa,UAAA,IAAc,aAAa,YAAA,IAAgB,QAAA,KAAa,YAAY,QAAA,KAAa,UAAA,GAC5F,sBACA,UAAA,CAAW;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,MAAM,UACJ,QAAA,KAAa,QAAA,GACT,QAAA,GACA,QAAA,KAAa,eAAe,QAAA,KAAa,UAAA,GACvC,WAAA,GACA,QAAA,KAAa,cAAc,QAAA,KAAa,YAAA,IAAgB,aAAa,QAAA,IAAY,QAAA,KAAa,aAC5F,mBAAA,GACA,OAAA;AAEV,EAAA,IAAI,IAAA,GAAkB,MAAA;AACtB,EAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAC5B,EAAA,IAAI,mCAAA,CAAoC,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,GAAO,OAAA;AACxD,EAAA,IAAI,0CAAA,CAA2C,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,GAAO,OAAA;AAE/D,EAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,IAAA,CAAK,KAAK,IAAI,CAAC,CAAA;AAExD,EAAA,OAAO,4BAAA,CAA6B;AAAA,IAClC,EAAA,EAAI,SAAS,QAAA,IAAY,SAAA;AAAA,IACzB,WAAA,EAAa,SAAS,QAAA,IAAY,SAAA;AAAA,IAClC,OAAA;AAAA,IACA,IAAA;AAAA,IACA,qBAAqB,KAAA,CAAM,MAAA;AAAA,IAC3B,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,OAAO,KAAA,IAAS;AAAA,GACjB,CAAA;AACH;AAGO,SAAS,2BAA2B,GAAA,EAAqD;AAC9F,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,IAAA;AAC5C,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,MAAM,MAAsC,EAAC;AAC7C,EAAA,IAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAA,CAAE,EAAA,CAAG,IAAA,EAAK,EAAG,GAAA,CAAI,EAAA,GAAK,CAAA,CAAE,EAAA,CAAG,IAAA,EAAK;AAChE,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,GAAA,CAAI,cAAc,CAAA,CAAE,WAAA;AAC3D,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,OAAA,IAAW,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,OAAA,EAAS,GAAA,CAAI,IAAA,GAAO,CAAA,CAAE,IAAA;AAChF,EAAA,IACE,CAAA,CAAE,OAAA,KAAY,QAAA,IACd,CAAA,CAAE,YAAY,WAAA,IACd,CAAA,CAAE,OAAA,KAAY,KAAA,IACd,CAAA,CAAE,OAAA,KAAY,mBAAA,IACd,CAAA,CAAE,YAAY,OAAA,EACd;AACA,IAAA,GAAA,CAAI,UAAU,CAAA,CAAE,OAAA;AAAA,EAClB;AACA,EAAA,IAAI,CAAA,CAAE,gBAAgB,QAAA,IAAY,CAAA,CAAE,gBAAgB,SAAA,IAAa,CAAA,CAAE,gBAAgB,UAAA,EAAY;AAC7F,IAAA,GAAA,CAAI,cAAc,CAAA,CAAE,WAAA;AAAA,EACtB;AACA,EAAA,IACE,CAAA,CAAE,UAAA,KAAe,gBAAA,IACjB,CAAA,CAAE,UAAA,KAAe,eAAA,IACjB,CAAA,CAAE,UAAA,KAAe,YAAA,IACjB,CAAA,CAAE,UAAA,KAAe,MAAA,EACjB;AACA,IAAA,GAAA,CAAI,aAAa,CAAA,CAAE,UAAA;AAAA,EACrB;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,mBAAA,KAAwB,QAAA,IAAY,CAAA,CAAE,sBAAsB,CAAA,EAAG;AAC1E,IAAA,GAAA,CAAI,mBAAA,GAAsB,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,mBAAmB,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,gBAAA,KAAqB,QAAA,IAAY,CAAA,CAAE,mBAAmB,CAAA,EAAG;AACpE,IAAA,GAAA,CAAI,gBAAA,GAAmB,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,gBAAgB,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,eAAA,KAAoB,QAAA,IAAY,CAAA,CAAE,mBAAmB,CAAA,EAAG;AACnE,IAAA,GAAA,CAAI,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,eAAe,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,WAAA,KAAgB,QAAA,EAAU,GAAA,CAAI,cAAc,CAAA,CAAE,WAAA;AAC3D,EAAA,IAAI,OAAO,CAAA,CAAE,mBAAA,KAAwB,SAAA,EAAW,GAAA,CAAI,sBAAsB,CAAA,CAAE,mBAAA;AAC5E,EAAA,IAAI,CAAA,CAAE,YAAA,KAAiB,IAAA,IAAQ,CAAA,CAAE,YAAA,KAAiB,IAAA,IAAQ,CAAA,CAAE,YAAA,KAAiB,IAAA,IAAQ,CAAA,CAAE,YAAA,KAAiB,IAAA,EAAM;AAC5G,IAAA,GAAA,CAAI,eAAe,CAAA,CAAE,YAAA;AAAA,EACvB;AACA,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,0BAAA,CACd,MACA,QAAA,EACuB;AACvB,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,GAAG,QAAA;AAAA,IACH,aAAA,EAAe,sCAAA;AAAA,IACf,EAAA,EAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,EAAA;AAAA,IACxB,SAAA,EAAW,QAAA,CAAS,SAAA,IAAa,IAAA,CAAK;AAAA,GACxC;AACF","file":"chunk-IZDH67DX.js","sourcesContent":["/**\n * First-party Model Execution Profile catalogue (Fusion Phase 4/7).\n *\n * Named profiles for common local coding models. resolveModelExecutionProfile\n * matches the model slug against this list before falling back to heuristics.\n * Pure data + pure match — no I/O.\n */\n\nimport {\n  MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,\n  type ModelExecutionProfile,\n  type ModelMode,\n} from './model-execution-profile.js';\n\nexport interface CatalogueEntry {\n  /** Substrings matched against the model id (case-insensitive). Longest match wins. */\n  match: string[];\n  profile: Omit<ModelExecutionProfile, 'schemaVersion' | 'id' | 'displayName'> & {\n    id?: string;\n    displayName?: string;\n  };\n}\n\n/**\n * Curated local coding models. Spark = small/fast; Flow = default coding;\n * Forge = large reasoning. Capsule budgets and repair rounds are conservative.\n */\nexport const MODEL_EXECUTION_CATALOGUE: CatalogueEntry[] = [\n  {\n    match: ['qwen2.5-coder:1.5b', 'qwen2.5-coder:3b', 'qwen2.5:1.5b', 'qwen2.5:3b'],\n    profile: {\n      mode: 'spark',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'search_replace',\n      capsuleBudgetTokens: 2000,\n      maxParallelEdits: 2,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: true,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 4, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['qwen2.5-coder:7b', 'qwen2.5-coder:14b', 'qwen2.5:7b', 'qwen2.5:14b'],\n    profile: {\n      mode: 'flow',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'auto',\n      capsuleBudgetTokens: 3500,\n      maxParallelEdits: 4,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: false,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 8, minVramGb: 6, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['qwen2.5-coder:32b', 'qwen2.5:32b', 'qwen2.5:72b'],\n    profile: {\n      mode: 'forge',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'patch_ir_json',\n      capsuleBudgetTokens: 6000,\n      maxParallelEdits: 6,\n      maxRepairRounds: 3,\n      temperature: 0,\n      constrainedDecoding: false,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 24, minVramGb: 20, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['deepseek-coder', 'deepseek-coder-v2'],\n    profile: {\n      mode: 'flow',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'auto',\n      capsuleBudgetTokens: 4000,\n      maxParallelEdits: 4,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: false,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 12, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['codellama:7b', 'codellama:13b', 'codegemma'],\n    profile: {\n      mode: 'flow',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'search_replace',\n      capsuleBudgetTokens: 3000,\n      maxParallelEdits: 3,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: true,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 8, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['llama3.1:8b', 'llama3.2:3b', 'llama3.2:1b'],\n    profile: {\n      mode: 'spark',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'search_replace',\n      capsuleBudgetTokens: 2500,\n      maxParallelEdits: 2,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: true,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 6, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['granite-code:3b', 'granite-code:8b'],\n    profile: {\n      mode: 'spark',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'search_replace',\n      capsuleBudgetTokens: 2500,\n      maxParallelEdits: 2,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: true,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 4, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['granite-code:20b', 'granite-code:34b'],\n    profile: {\n      mode: 'flow',\n      backend: 'ollama',\n      toolCalling: 'native',\n      editFormat: 'auto',\n      capsuleBudgetTokens: 3500,\n      maxParallelEdits: 4,\n      maxRepairRounds: 2,\n      temperature: 0,\n      constrainedDecoding: false,\n      kvCacheStrategy: 'stable_prefix',\n      resources: { minRamGb: 16, minVramGb: 12, quant: 'q4_k_m' },\n      securityTier: 'L1',\n    },\n  },\n  {\n    match: ['claude-3.5-sonnet', 'claude-sonnet', 'claude-3-opus', 'gpt-4o', 'o1', 'o3'],\n    profile: {\n      mode: 'forge',\n      backend: 'openai-compatible',\n      toolCalling: 'native',\n      editFormat: 'auto',\n      capsuleBudgetTokens: 5000,\n      maxParallelEdits: 6,\n      maxRepairRounds: 3,\n      temperature: 0,\n      constrainedDecoding: false,\n      kvCacheStrategy: 'stable_prefix',\n      securityTier: 'L1',\n    },\n  },\n];\n\n/**\n * Find the best catalogue entry for a model slug (longest match substring wins).\n */\nexport function matchCatalogueProfile(model: string): ModelExecutionProfile | null {\n  const m = model.trim().toLowerCase();\n  if (!m) return null;\n  let best: { len: number; entry: CatalogueEntry; needle: string } | null = null;\n  for (const entry of MODEL_EXECUTION_CATALOGUE) {\n    for (const needle of entry.match) {\n      const n = needle.toLowerCase();\n      if (m.includes(n) && (!best || n.length > best.len)) {\n        best = { len: n.length, entry, needle: n };\n      }\n    }\n  }\n  if (!best) return null;\n  const p = best.entry.profile;\n  return {\n    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,\n    id: p.id ?? model.trim(),\n    displayName: p.displayName ?? model.trim(),\n    mode: p.mode as ModelMode,\n    backend: p.backend,\n    toolCalling: p.toolCalling,\n    editFormat: p.editFormat,\n    capsuleBudgetTokens: p.capsuleBudgetTokens,\n    maxParallelEdits: p.maxParallelEdits,\n    maxRepairRounds: p.maxRepairRounds,\n    temperature: p.temperature,\n    constrainedDecoding: p.constrainedDecoding,\n    kvCacheStrategy: p.kvCacheStrategy,\n    resources: p.resources,\n    securityTier: p.securityTier,\n  };\n}\n\n/** All catalogue ids/needles for `vg models` / docs listing. */\nexport function listCatalogueNeedles(): string[] {\n  return MODEL_EXECUTION_CATALOGUE.flatMap((e) => e.match).sort((a, b) => a.localeCompare(b));\n}\n","/**\n * Model Execution Profile (Fusion Runtime Phase 4 / ADR-style contract).\n *\n * Per-model knobs for capsule budget, repair rounds, tool-calling mode, and\n * resource hints. Pure resolve helpers — no I/O. Schema:\n * docs/fusion/model-execution-profile-v0.schema.json\n *\n * {@link resolveModelExecutionProfile} prefers the first-party catalogue\n * ({@link matchCatalogueProfile}) before size/provider heuristics.\n */\n\nimport { matchCatalogueProfile } from './model-execution-catalogue.js';\n\nexport const MODEL_EXECUTION_PROFILE_SCHEMA_VERSION = 'model-execution-profile/0' as const;\n\nexport type ModelMode = 'spark' | 'flow' | 'forge';\nexport type ToolCallingMode = 'native' | 'grammar' | 'disabled';\nexport type EditFormatPreference = 'search_replace' | 'patch_ir_json' | 'whole_file' | 'auto';\n\nexport interface ModelExecutionProfile {\n  schemaVersion: typeof MODEL_EXECUTION_PROFILE_SCHEMA_VERSION;\n  /** Stable id, e.g. \"qwen2.5-coder-7b-q4_k_m\". */\n  id: string;\n  displayName?: string;\n  mode: ModelMode;\n  backend?: 'ollama' | 'llama.cpp' | 'mlx' | 'openai-compatible' | 'other';\n  toolCalling: ToolCallingMode;\n  editFormat: EditFormatPreference;\n  /** Soft token budget for the capsule body (excluding system/tools). */\n  capsuleBudgetTokens: number;\n  maxParallelEdits: number;\n  maxRepairRounds: number;\n  temperature?: number;\n  constrainedDecoding: boolean;\n  kvCacheStrategy?: 'stable_prefix' | 'full_reprefill' | 'auto';\n  resources?: {\n    minRamGb?: number;\n    minVramGb?: number;\n    quant?: string;\n  };\n  /** Preferred security tier for agent shell under this profile. */\n  securityTier?: 'L0' | 'L1' | 'L2' | 'L3';\n  /**\n   * Inference process isolation (ADR-005). `embedded` = Approach B default\n   * (same process as agent). `process` = thin llm-host shell for enterprise.\n   */\n  inferenceIsolation?: 'embedded' | 'process';\n}\n\nexport interface ResolveMepOptions {\n  id?: string;\n  displayName?: string;\n  backend?: ModelExecutionProfile['backend'];\n  mode?: ModelMode;\n  /** Override capsule budget (from --budget / code.json). */\n  capsuleBudgetTokens?: number;\n  maxRepairRounds?: number;\n  securityTier?: ModelExecutionProfile['securityTier'];\n  quant?: string;\n}\n\n/** Default Flow-tier profile for a general coding model. */\nexport function defaultModelExecutionProfile(partial: ResolveMepOptions = {}): ModelExecutionProfile {\n  const id = partial.id?.trim() || 'default';\n  return {\n    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,\n    id,\n    displayName: partial.displayName ?? id,\n    mode: partial.mode ?? 'flow',\n    backend: partial.backend ?? 'other',\n    toolCalling: 'native',\n    editFormat: 'auto',\n    capsuleBudgetTokens: partial.capsuleBudgetTokens ?? 3000,\n    maxParallelEdits: 4,\n    maxRepairRounds: partial.maxRepairRounds ?? 2,\n    temperature: 0,\n    constrainedDecoding: false,\n    kvCacheStrategy: 'stable_prefix',\n    resources: partial.quant ? { quant: partial.quant } : undefined,\n    securityTier: partial.securityTier,\n    inferenceIsolation: 'embedded',\n  };\n}\n\n/**\n * Resolve a profile from loose provider/model metadata.\n * Heuristics only — never invents capabilities not implied by the id.\n */\nexport function resolveModelExecutionProfile(input: {\n  providerId?: string;\n  model?: string;\n  budget?: number;\n  maxRepairRounds?: number;\n  securityTier?: ModelExecutionProfile['securityTier'];\n}): ModelExecutionProfile {\n  const model = (input.model ?? '').trim();\n  const provider = (input.providerId ?? '').toLowerCase();\n\n  // Catalogue first (curated local + common hosted coding models).\n  const catalogued = matchCatalogueProfile(model);\n  if (catalogued) {\n    return {\n      ...catalogued,\n      id: model || catalogued.id,\n      displayName: model || catalogued.displayName,\n      capsuleBudgetTokens: input.budget ?? catalogued.capsuleBudgetTokens,\n      maxRepairRounds: input.maxRepairRounds ?? catalogued.maxRepairRounds,\n      securityTier: input.securityTier ?? catalogued.securityTier,\n      backend:\n        provider === 'ollama'\n          ? 'ollama'\n          : provider === 'llama-cpp' || provider === 'llamacpp'\n            ? 'llama.cpp'\n            : provider === 'lmstudio' || provider === 'openrouter' || provider === 'openai' || provider === 'together'\n              ? 'openai-compatible'\n              : catalogued.backend,\n    };\n  }\n\n  const backend: ModelExecutionProfile['backend'] =\n    provider === 'ollama'\n      ? 'ollama'\n      : provider === 'llama-cpp' || provider === 'llamacpp'\n        ? 'llama.cpp'\n        : provider === 'lmstudio' || provider === 'openrouter' || provider === 'openai' || provider === 'together'\n          ? 'openai-compatible'\n          : 'other';\n\n  let mode: ModelMode = 'flow';\n  const m = model.toLowerCase();\n  if (/\\b(1\\.5b|1b|3b|0\\.5b|tiny|mini)\\b/.test(m)) mode = 'spark';\n  if (/\\b(32b|70b|72b|405b|large|opus|sonnet)\\b/.test(m)) mode = 'forge';\n\n  const quant = /\\bq[2-8](_[a-z0-9]+)?\\b/i.exec(model)?.[0];\n\n  return defaultModelExecutionProfile({\n    id: model || provider || 'default',\n    displayName: model || provider || 'default',\n    backend,\n    mode,\n    capsuleBudgetTokens: input.budget,\n    maxRepairRounds: input.maxRepairRounds,\n    securityTier: input.securityTier,\n    quant: quant ?? undefined,\n  });\n}\n\n/** Sanitize untrusted JSON into a partial profile (config file). */\nexport function parseModelExecutionProfile(raw: unknown): Partial<ModelExecutionProfile> | null {\n  if (!raw || typeof raw !== 'object') return null;\n  const o = raw as Record<string, unknown>;\n  const out: Partial<ModelExecutionProfile> = {};\n  if (typeof o.id === 'string' && o.id.trim()) out.id = o.id.trim();\n  if (typeof o.displayName === 'string') out.displayName = o.displayName;\n  if (o.mode === 'spark' || o.mode === 'flow' || o.mode === 'forge') out.mode = o.mode;\n  if (\n    o.backend === 'ollama' ||\n    o.backend === 'llama.cpp' ||\n    o.backend === 'mlx' ||\n    o.backend === 'openai-compatible' ||\n    o.backend === 'other'\n  ) {\n    out.backend = o.backend;\n  }\n  if (o.toolCalling === 'native' || o.toolCalling === 'grammar' || o.toolCalling === 'disabled') {\n    out.toolCalling = o.toolCalling;\n  }\n  if (\n    o.editFormat === 'search_replace' ||\n    o.editFormat === 'patch_ir_json' ||\n    o.editFormat === 'whole_file' ||\n    o.editFormat === 'auto'\n  ) {\n    out.editFormat = o.editFormat;\n  }\n  if (typeof o.capsuleBudgetTokens === 'number' && o.capsuleBudgetTokens > 0) {\n    out.capsuleBudgetTokens = Math.floor(o.capsuleBudgetTokens);\n  }\n  if (typeof o.maxParallelEdits === 'number' && o.maxParallelEdits > 0) {\n    out.maxParallelEdits = Math.floor(o.maxParallelEdits);\n  }\n  if (typeof o.maxRepairRounds === 'number' && o.maxRepairRounds >= 0) {\n    out.maxRepairRounds = Math.floor(o.maxRepairRounds);\n  }\n  if (typeof o.temperature === 'number') out.temperature = o.temperature;\n  if (typeof o.constrainedDecoding === 'boolean') out.constrainedDecoding = o.constrainedDecoding;\n  if (o.securityTier === 'L0' || o.securityTier === 'L1' || o.securityTier === 'L2' || o.securityTier === 'L3') {\n    out.securityTier = o.securityTier;\n  }\n  return out;\n}\n\n/** Merge a partial override onto a base profile (config wins on set fields). */\nexport function mergeModelExecutionProfile(\n  base: ModelExecutionProfile,\n  override: Partial<ModelExecutionProfile> | null | undefined,\n): ModelExecutionProfile {\n  if (!override) return base;\n  return {\n    ...base,\n    ...override,\n    schemaVersion: MODEL_EXECUTION_PROFILE_SCHEMA_VERSION,\n    id: override.id ?? base.id,\n    resources: override.resources ?? base.resources,\n  };\n}\n"]}

package/dist/chunk-J7LKEB2R.js

@@ -0,0 +1,51 @@
+// src/engine/lookup.ts
+function findNodes(graph, query) {
+  const q = query.trim();
+  if (!q) return [];
+  const byId = graph.nodes.filter((n) => n.id === q);
+  if (byId.length) return byId;
+  const fileLine = /^(.*):(\d+)$/.exec(q);
+  if (fileLine) {
+    const file = fileLine[1];
+    const line = Number(fileLine[2]);
+    const spanning = graph.nodes.filter((n) => n.file === file && n.span.start <= line && n.span.end >= line && n.kind !== "file").sort((a, b) => a.span.end - a.span.start - (b.span.end - b.span.start));
+    if (spanning.length) return spanning;
+  }
+  if (/[*?]/.test(q)) {
+    const re = globToRegExp(q);
+    return rank(graph.nodes.filter((n) => re.test(n.qualifiedName) || re.test(n.name) || re.test(n.file)));
+  }
+  const byQn = graph.nodes.filter((n) => n.qualifiedName === q);
+  if (byQn.length) return rank(byQn);
+  const byName = graph.nodes.filter((n) => n.name === q);
+  if (byName.length) return rank(byName);
+  const lower = q.toLowerCase();
+  const ci = graph.nodes.filter(
+    (n) => n.qualifiedName.toLowerCase() === lower || n.name.toLowerCase() === lower
+  );
+  if (ci.length) return rank(ci);
+  return rank(graph.nodes.filter((n) => n.qualifiedName.toLowerCase().includes(lower))).slice(0, 25);
+}
+function resolveOne(graph, query, pick) {
+  const candidates = findNodes(graph, query);
+  if (candidates.length === 0) return { candidates };
+  if (pick && pick >= 1 && pick <= candidates.length) return { node: candidates[pick - 1], candidates };
+  if (candidates.length === 1) return { node: candidates[0], candidates };
+  return { candidates };
+}
+function nodeById(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
+}
+function rank(nodes) {
+  return [...nodes].sort(
+    (a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)
+  );
+}
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+
+export { findNodes, nodeById, resolveOne };
+//# sourceMappingURL=chunk-J7LKEB2R.js.map
+//# sourceMappingURL=chunk-J7LKEB2R.js.map

package/dist/chunk-J7LKEB2R.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/engine/lookup.ts"],"names":[],"mappings":";AAQO,SAAS,SAAA,CAAU,OAAgB,KAAA,EAA4B;AACpE,EAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,EAAA,IAAI,CAAC,CAAA,EAAG,OAAO,EAAC;AAGhB,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AACjD,EAAA,IAAI,IAAA,CAAK,QAAQ,OAAO,IAAA;AAGxB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA;AACtC,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AACvB,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,CAAC,CAAC,CAAA;AAC/B,IAAA,MAAM,WAAW,KAAA,CAAM,KAAA,CACpB,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,IAAA,IAAQ,CAAA,CAAE,KAAK,KAAA,IAAS,IAAA,IAAQ,CAAA,CAAE,IAAA,CAAK,OAAO,IAAA,IAAQ,CAAA,CAAE,IAAA,KAAS,MAAM,EAChG,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,GAAA,GAAM,CAAA,CAAE,IAAA,CAAK,SAAS,CAAA,CAAE,IAAA,CAAK,GAAA,GAAM,CAAA,CAAE,KAAK,KAAA,CAAM,CAAA;AACzE,IAAA,IAAI,QAAA,CAAS,QAAQ,OAAO,QAAA;AAAA,EAC9B;AAGA,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG;AAClB,IAAA,MAAM,EAAA,GAAK,aAAa,CAAC,CAAA;AACzB,IAAA,OAAO,IAAA,CAAK,MAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,EAAA,CAAG,KAAK,CAAA,CAAE,aAAa,KAAK,EAAA,CAAG,IAAA,CAAK,EAAE,IAAI,CAAA,IAAK,GAAG,IAAA,CAAK,CAAA,CAAE,IAAI,CAAC,CAAC,CAAA;AAAA,EACvG;AAGA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,kBAAkB,CAAC,CAAA;AAC5D,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA,CAAK,IAAI,CAAA;AACjC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAM,CAAA;AAErC,EAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,EAAA,MAAM,EAAA,GAAK,MAAM,KAAA,CAAM,MAAA;AAAA,IACrB,CAAC,CAAA,KAAM,CAAA,CAAE,aAAA,CAAc,WAAA,OAAkB,KAAA,IAAS,CAAA,CAAE,IAAA,CAAK,WAAA,EAAY,KAAM;AAAA,GAC7E;AACA,EAAA,IAAI,EAAA,CAAG,MAAA,EAAQ,OAAO,IAAA,CAAK,EAAE,CAAA;AAG7B,EAAA,OAAO,KAAK,KAAA,CAAM,KAAA,CAAM,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,aAAA,CAAc,WAAA,EAAY,CAAE,SAAS,KAAK,CAAC,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,EAAE,CAAA;AACnG;AAGO,SAAS,UAAA,CACd,KAAA,EACA,KAAA,EACA,IAAA,EAC+C;AAC/C,EAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,EAAO,KAAK,CAAA;AACzC,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,UAAA,EAAW;AACjD,EAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,CAAA,IAAK,IAAA,IAAQ,UAAA,CAAW,MAAA,EAAQ,OAAO,EAAE,IAAA,EAAM,UAAA,CAAW,IAAA,GAAO,CAAC,GAAG,UAAA,EAAW;AACpG,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG,OAAO,EAAE,IAAA,EAAM,UAAA,CAAW,CAAC,CAAA,EAAG,UAAA,EAAW;AACtE,EAAA,OAAO,EAAE,UAAA,EAAW;AACtB;AAEO,SAAS,QAAA,CAAS,OAAgB,EAAA,EAAmC;AAC1E,EAAA,OAAO,MAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,EAAE,CAAA;AAC5C;AAEA,SAAS,KAAK,KAAA,EAAiC;AAC7C,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA;AAAA,IAChB,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,UAAA,GAAa,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,aAAA,CAAc,aAAA,CAAc,CAAA,CAAE,aAAa;AAAA,GACxF;AACF;AAEA,SAAS,aAAa,IAAA,EAAsB;AAC1C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACjG,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,OAAO,KAAK,GAAG,CAAA;AACvC","file":"chunk-J7LKEB2R.js","sourcesContent":["import type { GraphNode, VgGraph } from '../schema.js';\n\n/**\n * Lenient node resolution (VG-CLI-SPEC §3.3): resolve `<name>` by content-hash\n * id, qualified name, `file:line`, short name, or glob. Returns candidates\n * ranked by importance so the best match is first; ambiguity is surfaced (the\n * caller offers `--pick`). Deterministic ordering throughout.\n */\nexport function findNodes(graph: VgGraph, query: string): GraphNode[] {\n  const q = query.trim();\n  if (!q) return [];\n\n  // 1. exact content-hash id\n  const byId = graph.nodes.filter((n) => n.id === q);\n  if (byId.length) return byId;\n\n  // 2. file:line (e.g. src/order.ts:12) → smallest node spanning that line\n  const fileLine = /^(.*):(\\d+)$/.exec(q);\n  if (fileLine) {\n    const file = fileLine[1];\n    const line = Number(fileLine[2]);\n    const spanning = graph.nodes\n      .filter((n) => n.file === file && n.span.start <= line && n.span.end >= line && n.kind !== 'file')\n      .sort((a, b) => a.span.end - a.span.start - (b.span.end - b.span.start));\n    if (spanning.length) return spanning;\n  }\n\n  // 3. glob (contains * or ?)\n  if (/[*?]/.test(q)) {\n    const re = globToRegExp(q);\n    return rank(graph.nodes.filter((n) => re.test(n.qualifiedName) || re.test(n.name) || re.test(n.file)));\n  }\n\n  // 4. exact qualified name, then short name, then case-insensitive\n  const byQn = graph.nodes.filter((n) => n.qualifiedName === q);\n  if (byQn.length) return rank(byQn);\n  const byName = graph.nodes.filter((n) => n.name === q);\n  if (byName.length) return rank(byName);\n\n  const lower = q.toLowerCase();\n  const ci = graph.nodes.filter(\n    (n) => n.qualifiedName.toLowerCase() === lower || n.name.toLowerCase() === lower,\n  );\n  if (ci.length) return rank(ci);\n\n  // 5. substring on qualified name (last resort, ranked)\n  return rank(graph.nodes.filter((n) => n.qualifiedName.toLowerCase().includes(lower))).slice(0, 25);\n}\n\n/** Resolve to a single node, honoring a 1-based `--pick`. */\nexport function resolveOne(\n  graph: VgGraph,\n  query: string,\n  pick?: number,\n): { node?: GraphNode; candidates: GraphNode[] } {\n  const candidates = findNodes(graph, query);\n  if (candidates.length === 0) return { candidates };\n  if (pick && pick >= 1 && pick <= candidates.length) return { node: candidates[pick - 1], candidates };\n  if (candidates.length === 1) return { node: candidates[0], candidates };\n  return { candidates }; // ambiguous\n}\n\nexport function nodeById(graph: VgGraph, id: string): GraphNode | undefined {\n  return graph.nodes.find((n) => n.id === id);\n}\n\nfunction rank(nodes: GraphNode[]): GraphNode[] {\n  return [...nodes].sort(\n    (a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName),\n  );\n}\n\nfunction globToRegExp(glob: string): RegExp {\n  const escaped = glob.replace(/[.+^${}()|[\\]\\\\]/g, '\\\\$&').replace(/\\*/g, '.*').replace(/\\?/g, '.');\n  return new RegExp(`^${escaped}$`, 'i');\n}\n"]}