@xioflow/kernel 0.3.0 → 0.5.0

package/dist/cli.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { SqliteStore } from './store/sqlite.js';
+import { KernelMcpServer } from './mcp/server.js';
+import { exportJournalToOtlp } from './otel/otlp.js';
+const USAGE = `usage:
+  xioflow mcp [--domain <dir>] [--domain-id <id>] [--driver auto|node|reaper]
+              [--otlp-endpoint <url>] [--otlp-header k=v ...] [--otlp-interval-ms <n>]
+      Serve the kernel as an MCP server on stdio (recovers the domain first).
+  xioflow otel-export --otlp-endpoint <url> [--domain <dir>] [--domain-id <id>] [--from-seq <n>]
+                      [--otlp-header k=v ...] [--service-name <name>]
+      Export the domain journal as OTLP traces once (read-only; works while a server holds the domain).
+
+  --domain defaults to ./.xioflow-kernel`;
+function headers(values) {
+    const out = {};
+    for (const v of values ?? []) {
+        const i = v.indexOf('=');
+        if (i <= 0)
+            throw new Error(`--otlp-header expects key=value, got "${v}"`);
+        out[v.slice(0, i)] = v.slice(i + 1);
+    }
+    return out;
+}
+async function main() {
+    const [command, ...rest] = process.argv.slice(2);
+    const { values } = parseArgs({
+        args: rest,
+        options: {
+            domain: { type: 'string' },
+            'domain-id': { type: 'string' },
+            driver: { type: 'string' },
+            'otlp-endpoint': { type: 'string' },
+            'otlp-header': { type: 'string', multiple: true },
+            'otlp-interval-ms': { type: 'string' },
+            'from-seq': { type: 'string' },
+            'service-name': { type: 'string' },
+        },
+        strict: true,
+    });
+    const domainPath = path.resolve(values.domain ?? '.xioflow-kernel');
+    const domainId = values['domain-id'] ?? 'default';
+    if (command === 'mcp') {
+        const driver = values.driver ?? 'auto';
+        if (driver !== 'auto' && driver !== 'node' && driver !== 'reaper')
+            throw new Error(`--driver must be auto, node or reaper`);
+        const endpoint = values['otlp-endpoint'];
+        await new KernelMcpServer({
+            domainPath,
+            domainId,
+            driver,
+            otlp: endpoint
+                ? {
+                    endpoint,
+                    headers: headers(values['otlp-header']),
+                    intervalMs: values['otlp-interval-ms'] ? Number(values['otlp-interval-ms']) : undefined,
+                    serviceName: values['service-name'],
+                }
+                : undefined,
+        }).serve();
+        return;
+    }
+    if (command === 'otel-export') {
+        const endpoint = values['otlp-endpoint'];
+        if (!endpoint)
+            throw new Error('otel-export needs --otlp-endpoint');
+        const dbPath = path.join(domainPath, 'domain.db');
+        if (!fs.existsSync(dbPath))
+            throw new Error(`no kernel domain at ${domainPath} (missing domain.db)`);
+        const store = new SqliteStore(dbPath);
+        try {
+            const res = await exportJournalToOtlp({ domainId, getStore: () => store }, {
+                endpoint,
+                headers: headers(values['otlp-header']),
+                fromSeq: values['from-seq'] ? Number(values['from-seq']) : 0,
+                serviceName: values['service-name'],
+            });
+            process.stdout.write(`${JSON.stringify(res)}\n`);
+        }
+        finally {
+            store.close();
+        }
+        return;
+    }
+    process.stderr.write(`${USAGE}\n`);
+    process.exitCode = command ? 64 : 0;
+}
+main().catch((err) => {
+    process.stderr.write(`xioflow: ${err?.message ?? err}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,KAAK,GAAG;;;;;;;;yCAQ2B,CAAC;AAE1C,SAAS,OAAO,CAAC,MAA4B;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;QAC3E,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;IAElD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5H,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC;YACxB,UAAU;YACV,QAAQ;YACR,MAAM;YACN,IAAI,EAAE,QAAQ;gBACZ,CAAC,CAAC;oBACE,QAAQ;oBACR,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBACvC,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;oBACvF,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;iBACpC;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,sBAAsB,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EACnC;gBACE,QAAQ;gBACR,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;aACpC,CACF,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACnC,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/confinement/bubblewrap.d.ts

@@ -0,0 +1,8 @@
+import { ConfinementDriver } from '../types.js';
+import { StructuredCommand } from '../driver/types.js';
+export declare class BubblewrapConfinementDriver implements ConfinementDriver {
+    readonly name = "bubblewrap";
+    static isAvailable(): boolean;
+    wrap(command: StructuredCommand, writableRoots: string[]): StructuredCommand;
+}
+//# sourceMappingURL=bubblewrap.d.ts.map

package/dist/confinement/bubblewrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bubblewrap.d.ts","sourceRoot":"","sources":["../../src/confinement/bubblewrap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiBvD,qBAAa,2BAA4B,YAAW,iBAAiB;IACnE,SAAgB,IAAI,gBAAgB;IAEpC,OAAc,WAAW,IAAI,OAAO,CAEnC;IAEM,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAwBlF;CACF"}

package/dist/confinement/bubblewrap.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveRealPath } from '../capability/path-utils.js';
+function findExecutable(name) {
+    const envPath = process.env.PATH || '';
+    const dirs = envPath.split(path.delimiter);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, name);
+        try {
+            if (fs.existsSync(candidate) && (fs.statSync(candidate).mode & 0o111)) {
+                return candidate;
+            }
+        }
+        catch { }
+    }
+    return null;
+}
+export class BubblewrapConfinementDriver {
+    name = 'bubblewrap';
+    static isAvailable() {
+        return process.platform === 'linux' && findExecutable('bwrap') !== null;
+    }
+    wrap(command, writableRoots) {
+        const bwrapPath = findExecutable('bwrap');
+        if (!bwrapPath || process.platform !== 'linux') {
+            throw new Error("Confinement driver 'bubblewrap' is not available on this platform");
+        }
+        const realRoots = writableRoots.map((r) => resolveRealPath(r));
+        const bwrapArgs = [
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+        ];
+        for (const root of realRoots) {
+            bwrapArgs.push('--bind', root, root);
+        }
+        bwrapArgs.push('--', command.execPath, ...command.args);
+        return {
+            ...command,
+            execPath: bwrapPath,
+            args: bwrapArgs,
+        };
+    }
+}
+//# sourceMappingURL=bubblewrap.js.map

package/dist/confinement/bubblewrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bubblewrap.js","sourceRoot":"","sources":["../../src/confinement/bubblewrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,2BAA2B;IACtB,IAAI,GAAG,YAAY,CAAC;IAE7B,MAAM,CAAC,WAAW;QACvB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC1E,CAAC;IAEM,IAAI,CAAC,OAA0B,EAAE,aAAuB;QAC7D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAa;YAC1B,WAAW,EAAE,GAAG,EAAE,GAAG;YACrB,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;SAClB,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAExD,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/confinement/detector.d.ts

@@ -0,0 +1,4 @@
+import { ConfinementDriver } from '../types.js';
+export declare function detectAvailableConfinementDrivers(): string[];
+export declare function createConfinementDriver(name?: string): ConfinementDriver | null;
+//# sourceMappingURL=detector.d.ts.map

package/dist/confinement/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/confinement/detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAY5D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAa/E"}

package/dist/confinement/detector.js

@@ -0,0 +1,35 @@
+import { SandboxExecConfinementDriver } from './sandbox-exec.js';
+import { BubblewrapConfinementDriver } from './bubblewrap.js';
+import { SrtConfinementDriver } from './srt.js';
+export function detectAvailableConfinementDrivers() {
+    const drivers = [];
+    if (SrtConfinementDriver.isAvailable()) {
+        drivers.push('srt');
+    }
+    if (SandboxExecConfinementDriver.isAvailable()) {
+        drivers.push('sandbox-exec');
+    }
+    if (BubblewrapConfinementDriver.isAvailable()) {
+        drivers.push('bubblewrap');
+    }
+    return drivers;
+}
+export function createConfinementDriver(name) {
+    if (name === 'sandbox-exec')
+        return new SandboxExecConfinementDriver();
+    if (name === 'bubblewrap')
+        return new BubblewrapConfinementDriver();
+    if (name === 'srt')
+        return new SrtConfinementDriver();
+    if (!name) {
+        if (SandboxExecConfinementDriver.isAvailable())
+            return new SandboxExecConfinementDriver();
+        if (BubblewrapConfinementDriver.isAvailable())
+            return new BubblewrapConfinementDriver();
+        if (SrtConfinementDriver.isAvailable())
+            return new SrtConfinementDriver();
+        return null;
+    }
+    throw new Error(`Unknown confinement driver: '${name}'`);
+}
+//# sourceMappingURL=detector.js.map

package/dist/confinement/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/confinement/detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,UAAU,iCAAiC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,4BAA4B,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,2BAA2B,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,4BAA4B,EAAE,CAAC;IACvE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;IACpE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,4BAA4B,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,4BAA4B,EAAE,CAAC;QAC1F,IAAI,2BAA2B,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,2BAA2B,EAAE,CAAC;QACxF,IAAI,oBAAoB,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/confinement/index.d.ts

@@ -0,0 +1,5 @@
+export * from './sandbox-exec.js';
+export * from './bubblewrap.js';
+export * from './srt.js';
+export * from './detector.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/confinement/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/confinement/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC"}

package/dist/confinement/index.js

@@ -0,0 +1,5 @@
+export * from './sandbox-exec.js';
+export * from './bubblewrap.js';
+export * from './srt.js';
+export * from './detector.js';
+//# sourceMappingURL=index.js.map

package/dist/confinement/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/confinement/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC"}

package/dist/confinement/sandbox-exec.d.ts

@@ -0,0 +1,8 @@
+import { ConfinementDriver } from '../types.js';
+import { StructuredCommand } from '../driver/types.js';
+export declare class SandboxExecConfinementDriver implements ConfinementDriver {
+    readonly name = "sandbox-exec";
+    static isAvailable(): boolean;
+    wrap(command: StructuredCommand, writableRoots: string[]): StructuredCommand;
+}
+//# sourceMappingURL=sandbox-exec.d.ts.map

package/dist/confinement/sandbox-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-exec.d.ts","sourceRoot":"","sources":["../../src/confinement/sandbox-exec.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGvD,qBAAa,4BAA6B,YAAW,iBAAiB;IACpE,SAAgB,IAAI,kBAAkB;IAEtC,OAAc,WAAW,IAAI,OAAO,CAEnC;IAEM,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAwBlF;CACF"}

package/dist/confinement/sandbox-exec.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs';
+import { resolveRealPath } from '../capability/path-utils.js';
+export class SandboxExecConfinementDriver {
+    name = 'sandbox-exec';
+    static isAvailable() {
+        return process.platform === 'darwin' && fs.existsSync('/usr/bin/sandbox-exec');
+    }
+    wrap(command, writableRoots) {
+        if (!SandboxExecConfinementDriver.isAvailable()) {
+            throw new Error("Confinement driver 'sandbox-exec' is not available on this platform");
+        }
+        const realRoots = writableRoots.map((r) => resolveRealPath(r));
+        const profileLines = [
+            '(version 1)',
+            '(allow default)',
+            '(deny file-write*)',
+            '(allow file-write* (subpath "/dev"))',
+        ];
+        for (const root of realRoots) {
+            profileLines.push(`(allow file-write* (subpath ${JSON.stringify(root)}))`);
+        }
+        const profile = profileLines.join('\n');
+        return {
+            ...command,
+            execPath: '/usr/bin/sandbox-exec',
+            args: ['-p', profile, command.execPath, ...command.args],
+        };
+    }
+}
+//# sourceMappingURL=sandbox-exec.js.map

package/dist/confinement/sandbox-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-exec.js","sourceRoot":"","sources":["../../src/confinement/sandbox-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,OAAO,4BAA4B;IACvB,IAAI,GAAG,cAAc,CAAC;IAE/B,MAAM,CAAC,WAAW;QACvB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACjF,CAAC;IAEM,IAAI,CAAC,OAA0B,EAAE,aAAuB;QAC7D,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAa;YAC7B,aAAa;YACb,iBAAiB;YACjB,oBAAoB;YACpB,sCAAsC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,uBAAuB;YACjC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;SACzD,CAAC;IACJ,CAAC;CACF"}

package/dist/confinement/srt.d.ts

@@ -0,0 +1,8 @@
+import { ConfinementDriver } from '../types.js';
+import { StructuredCommand } from '../driver/types.js';
+export declare class SrtConfinementDriver implements ConfinementDriver {
+    readonly name = "srt";
+    static isAvailable(): boolean;
+    wrap(command: StructuredCommand, writableRoots: string[]): StructuredCommand;
+}
+//# sourceMappingURL=srt.d.ts.map

package/dist/confinement/srt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"srt.d.ts","sourceRoot":"","sources":["../../src/confinement/srt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiBvD,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,SAAgB,IAAI,SAAS;IAE7B,OAAc,WAAW,IAAI,OAAO,CAEnC;IAEM,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAkBlF;CACF"}

package/dist/confinement/srt.js

@@ -0,0 +1,41 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveRealPath } from '../capability/path-utils.js';
+function findExecutable(name) {
+    const envPath = process.env.PATH || '';
+    const dirs = envPath.split(path.delimiter);
+    for (const dir of dirs) {
+        const candidate = path.join(dir, name);
+        try {
+            if (fs.existsSync(candidate) && (fs.statSync(candidate).mode & 0o111)) {
+                return candidate;
+            }
+        }
+        catch { }
+    }
+    return null;
+}
+export class SrtConfinementDriver {
+    name = 'srt';
+    static isAvailable() {
+        return findExecutable('srt') !== null;
+    }
+    wrap(command, writableRoots) {
+        const srtPath = findExecutable('srt');
+        if (!srtPath) {
+            throw new Error("Confinement driver 'srt' is not available on this system");
+        }
+        const realRoots = writableRoots.map((r) => resolveRealPath(r));
+        const srtArgs = [];
+        for (const root of realRoots) {
+            srtArgs.push('-w', root);
+        }
+        srtArgs.push('--', command.execPath, ...command.args);
+        return {
+            ...command,
+            execPath: srtPath,
+            args: srtArgs,
+        };
+    }
+}
+//# sourceMappingURL=srt.js.map

package/dist/confinement/srt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"srt.js","sourceRoot":"","sources":["../../src/confinement/srt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,oBAAoB;IACf,IAAI,GAAG,KAAK,CAAC;IAEtB,MAAM,CAAC,WAAW;QACvB,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IACxC,CAAC;IAEM,IAAI,CAAC,OAA0B,EAAE,aAAuB;QAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,OAAO;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/domain.d.ts

@@ -1,7 +1,7 @@
 import { SqliteStore } from './store/sqlite.js';
 import { PlatformDriver } from './driver/types.js';
-import { Operation, ResourceLease, OwnerRecord, ResourceBudget, DomainBudget, DomainLockedError, ResourceConflictError, EpochFencedError, TerminationReason, AdjudicationRecord, Task, Run } from './types.js';
-export { DomainLockedError, ResourceConflictError, EpochFencedError, AdjudicationRecord };
+import { Operation, ResourceLease, OwnerRecord, ResourceBudget, DomainBudget, DomainLockedError, ResourceConflictError, EpochFencedError, TerminationReason, AdjudicationRecord, Task, Run, SnapshotDriver, Capability, CapabilityScope, CapabilityViolationError } from './types.js';
+export { DomainLockedError, ResourceConflictError, EpochFencedError, AdjudicationRecord, CapabilityViolationError };
 export interface DomainStatus {
     domainId: string;
     domainPath: string;
@@ -74,6 +74,10 @@ export declare class ExecutionDomain {
     cancelWait(operationId: string): boolean;
     private processWaitQueue;
     setDriver(driver: PlatformDriver): void;
+    getDriver(): PlatformDriver | undefined;
+    private snapshotDriver?;
+    setSnapshotDriver(driver: SnapshotDriver): void;
+    getSnapshotDriver(): SnapshotDriver | undefined;
     /**
      * 内部私有资源释放（走代际栅栏并记录 RESOURCES_RELEASED 事件，§0.2 裁决 1 / N6）
      * @internal 仅供 supervisor、recovery engine 与 adjudicate 等内核内部组件调用
@@ -104,6 +108,26 @@ export declare class ExecutionDomain {
         deleted: string[];
         retained: string[];
     };
+    /**
+     * 签发受管 Capability（ARCHITECTURE §0.2 裁决 9 / 契约 #55）
+     */
+    issueCapability(scope: CapabilityScope, actor: string, ttlMs: number): Capability;
+    /**
+     * 收窄 Capability 作用域（只能收窄，禁止放宽）
+     */
+    attenuate(capId: string, narrowerScope: Partial<CapabilityScope>, actor: string, ttlMs?: number): Capability;
+    /**
+     * 撤销 Capability
+     */
+    revokeCapability(capId: string, actor: string): void;
+    getCapability(capId: string): Capability | null;
+    checkCapabilityAdmission(options: {
+        capabilityId: string;
+        requiredResources?: string[];
+        mutationRoots?: string[];
+        runId?: string;
+        opId?: string;
+    }): import("./capability/check.js").CapabilityAdmissionResult;
     isClosed(): boolean;
     close(): void;
 }

package/dist/domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAEL,SAAS,EACT,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,IAAI,EACJ,GAAG,EACJ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;AAE1F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,UAAU,EAAE,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IACjD,oBAAoB,EAAE,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,aAAa,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,EAAE,CAAC;CACzD;AAED,qBAAa,eAAe;IAC1B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,MAAM,CAAC,CAAiB;IAEhC,OAAO,CAAC,uBAAuB,CAAkC;IAEjE,OAAO,CAAC,oBAAoB,CAA0B;IAEtD,OAAO,CAAC,eAAe,CAA0C;IAEjE,OAAO,CAAC,SAAS,CAUT;IACR,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAkB;IAElC,OAAO,eAqCN;IAED,OAAc,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAkB,GAAG,eAAe,CAgFvF;IAED,OAAO,CAAC,MAAM,CAAC,iBAAiB;IASzB,cAAc,IAAI,WAAW,CAEnC;IAEM,QAAQ,IAAI,MAAM,CAExB;IAEM,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAEjD;IAEM,eAAe,IAAI,YAAY,GAAG,SAAS,CAEjD;IAED,IAAW,MAAM,IAAI,YAAY,CAEhC;IAEM,SAAS,IAAI,YAAY,CAa/B;IAED;;OAEG;IACI,yBAAyB,IAAI,IAAI,CAyBvC;IAEM,QAAQ,IAAI,WAAW,CAE7B;IAEM,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEnD;IAEM,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;IAEM,qBAAqB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAElD;IAEM,cAAc,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACI,cAAc,IAAI,IAAI,CAqB5B;IAED,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,gBAAgB;IAwBxB;;OAEG;IACI,iBAAiB,CACtB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,GAAE,MAAU,EAC5B,MAAM,CAAC,EAAE,cAAc,GACtB,IAAI,CA+BN;IAED;;OAEG;IACU,yBAAyB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,SAAS,GAAE,MAAU,EACrB,MAAM,CAAC,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,MAAM,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmEf;IAED;;OAEG;IACI,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAU9C;IAED,OAAO,CAAC,gBAAgB;IAsDjB,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAE7C;IAED;;;OAGG;IACI,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAuC/E;IAED;;OAEG;IACU,UAAU,CACrB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,EACvD,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,CAqF7B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,iBAAoC,GAAG,IAAI,CAG3F;IAEM,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7C;IAEM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,iBAA+B,GAAG,IAAI,CAGnF;IAED;;OAEG;IACI,uBAAuB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAalD;IAED;;;OAGG;IACI,cAAc,CAAC,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QACzE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAmEA;IAEM,QAAQ,IAAI,OAAO,CAEzB;IAEM,KAAK,IAAI,IAAI,CAyCnB;CACF"}
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAEL,SAAS,EACT,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,IAAI,EACJ,GAAG,EACH,cAAc,EACd,UAAU,EACV,eAAe,EACf,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;AAEpH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,UAAU,EAAE,GAAG,EAAE,CAAC;IAClB,UAAU,EAAE,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IACjD,oBAAoB,EAAE,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,aAAa,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,EAAE,CAAC;CACzD;AAED,qBAAa,eAAe;IAC1B,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,MAAM,CAAC,CAAiB;IAEhC,OAAO,CAAC,uBAAuB,CAAkC;IAEjE,OAAO,CAAC,oBAAoB,CAA0B;IAEtD,OAAO,CAAC,eAAe,CAA0C;IAEjE,OAAO,CAAC,SAAS,CAUT;IACR,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAkB;IAElC,OAAO,eAqCN;IAED,OAAc,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAkB,GAAG,eAAe,CAgFvF;IAED,OAAO,CAAC,MAAM,CAAC,iBAAiB;IASzB,cAAc,IAAI,WAAW,CAEnC;IAEM,QAAQ,IAAI,MAAM,CAExB;IAEM,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAEjD;IAEM,eAAe,IAAI,YAAY,GAAG,SAAS,CAEjD;IAED,IAAW,MAAM,IAAI,YAAY,CAEhC;IAEM,SAAS,IAAI,YAAY,CAa/B;IAED;;OAEG;IACI,yBAAyB,IAAI,IAAI,CAyBvC;IAEM,QAAQ,IAAI,WAAW,CAE7B;IAEM,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEnD;IAEM,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;IAEM,qBAAqB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAElD;IAEM,cAAc,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACI,cAAc,IAAI,IAAI,CAqB5B;IAED,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;IACI,iBAAiB,CACtB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,gBAAgB,GAAE,MAAU,EAC5B,MAAM,CAAC,EAAE,cAAc,GACtB,IAAI,CA+BN;IAED;;OAEG;IACU,yBAAyB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,SAAS,GAAE,MAAU,EACrB,MAAM,CAAC,EAAE,cAAc,EACvB,WAAW,CAAC,EAAE,MAAM,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC,CAuEf;IAED;;OAEG;IACI,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAU9C;IAED,OAAO,CAAC,gBAAgB;IAsDjB,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAE7C;IAEM,SAAS,IAAI,cAAc,GAAG,SAAS,CAE7C;IAED,OAAO,CAAC,cAAc,CAAC,CAAiB;IAEjC,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAErD;IAEM,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAErD;IAED;;;OAGG;IACI,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAuC/E;IAED;;OAEG;IACU,UAAU,CACrB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,EACvD,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,CAiG7B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,iBAAoC,GAAG,IAAI,CAG3F;IAEM,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7C;IAEM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,iBAA+B,GAAG,IAAI,CAGnF;IAED;;OAEG;IACI,uBAAuB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAalD;IAED;;;OAGG;IACI,cAAc,CAAC,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QACzE,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAmEA;IAED;;OAEG;IACI,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAkCvF;IAED;;OAEG;IACI,SAAS,CACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC,EACvC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,UAAU,CA6EZ;IAED;;OAEG;IACI,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAkB1D;IAEM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAErD;IAEM,wBAAwB,CAAC,OAAO,EAAE;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,6DAWA;IAEM,QAAQ,IAAI,OAAO,CAEzB;IAEM,KAAK,IAAI,IAAI,CAyCnB;CACF"}