adispatchd 0.0.0-stage → 0.1.0

package/dist/executors/shell-executor.js

@@ -0,0 +1,478 @@
+/**
+ * Shell executor (Spec §8.2, §8.3, §9, §13, §20): spawns the main worker in
+ * its own process group with a minimal environment, captures logs and
+ * events, enforces timeouts and supervises cancel/termination.
+ */
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { MAX_RESULT_FILE_BYTES, OrchestratorError, SecretRedactor, errorMessage, noopLogger, parseWorkerResult, redactValue, systemClock, systemTimers, } from '../core/index.js';
+import { Channel, Dispatcher } from './dispatcher.js';
+import { buildOrchEnv, buildWorkerEnv } from './env.js';
+import { LogBudget, StreamCapture } from './log-capture.js';
+import { defaultProcessInspector, getStartIdentity, processGroupAlive, processGroupExists, } from './process-identity.js';
+import { StreamRedactor } from './stream-redactor.js';
+import { ensureWorkspaceWithin } from './workspace.js';
+/** Executor for local shell workers (V1). */
+export class ShellExecutor {
+    type = 'shell';
+    deps;
+    constructor(options = {}) {
+        this.deps = {
+            clock: options.clock ?? systemClock,
+            timers: options.timers ?? systemTimers,
+            logger: options.logger ?? noopLogger,
+            baseEnv: options.baseEnv ?? process.env,
+            inspector: options.inspector ?? defaultProcessInspector(),
+            kill: options.kill ?? ((pid, signal) => process.kill(pid, signal)),
+            killConfirmMs: options.killConfirmMs ?? 5000,
+            stdioDrainMs: options.stdioDrainMs ?? 2000,
+            pollIntervalMs: options.pollIntervalMs ?? 25,
+            workspaceBaseDir: options.workspaceBaseDir,
+        };
+    }
+    async start(spec) {
+        const proc = new ShellProcess(spec, this.deps);
+        await proc.launch();
+        // Delivery starts on a later turn, after the caller had the chance to subscribe.
+        proc.openDelivery();
+        return proc;
+    }
+}
+class ShellProcess {
+    spec;
+    deps;
+    log;
+    dispatcher;
+    outputs;
+    events;
+    diagnostics;
+    secretRedactor = new SecretRedactor();
+    child;
+    _pid;
+    _identity;
+    startedAt;
+    captures = [];
+    stdioClosed = Promise.resolve();
+    leaderExited = false;
+    exitCode = null;
+    exitSignal = null;
+    stopReason;
+    terminating;
+    maxTimer;
+    idleTimer;
+    outcome;
+    resolveDone;
+    /** Resolves (via the dispatcher, after all prior notifications) with the outcome. */
+    done;
+    constructor(spec, deps) {
+        this.spec = spec;
+        this.deps = deps;
+        this.log = deps.logger.child({ component: 'shell-executor', runId: spec.runId });
+        this.dispatcher = new Dispatcher(this.log);
+        this.outputs = new Channel(this.dispatcher, this.log);
+        this.events = new Channel(this.dispatcher, this.log);
+        this.diagnostics = new Channel(this.dispatcher, this.log);
+        this.startedAt = deps.clock.now();
+        this.done = new Promise((resolve) => (this.resolveDone = resolve));
+        for (const value of Object.values(spec.secrets))
+            this.secretRedactor.add(value);
+    }
+    get pid() {
+        return this._pid;
+    }
+    get startIdentity() {
+        return this._identity;
+    }
+    onOutput(listener) {
+        return this.outputs.subscribe(listener);
+    }
+    onEvent(listener) {
+        return this.events.subscribe(listener);
+    }
+    onDiagnostic(listener) {
+        return this.diagnostics.subscribe(listener);
+    }
+    wait() {
+        return this.done;
+    }
+    openDelivery() {
+        this.dispatcher.open();
+    }
+    async cancel(graceMs) {
+        if (this.outcome || this._pid === undefined) {
+            await this.done;
+            return;
+        }
+        if (!this.leaderExited && this.stopReason === undefined)
+            this.stopReason = 'cancel';
+        if (!this.leaderExited || processGroupExists(this._pid)) {
+            await this.terminate(graceMs ?? this.spec.cancelGraceMs);
+        }
+        await this.done;
+    }
+    // -------------------------------------------------------------------------
+    // Launch
+    // -------------------------------------------------------------------------
+    async launch() {
+        const spec = this.spec;
+        try {
+            await this.prepareFiles();
+        }
+        catch (err) {
+            this.failStart(err);
+            return;
+        }
+        this.captures = await this.openCaptures();
+        const env = buildWorkerEnv({
+            base: this.deps.baseEnv,
+            env: spec.env,
+            secrets: spec.secrets,
+            orch: buildOrchEnv({
+                runId: spec.runId,
+                context: spec.context,
+                workflowId: spec.workflowId,
+                contextFile: spec.files.contextFile,
+                resultFile: spec.files.resultFile,
+                workspace: spec.workingDirectory,
+            }),
+        });
+        let child;
+        try {
+            child = spawn(spec.command, [...spec.args], {
+                cwd: spec.workingDirectory,
+                env,
+                detached: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            await this.endCaptures();
+            this.failStart(err);
+            return;
+        }
+        const spawned = await new Promise((resolve) => {
+            child.once('spawn', () => resolve(null));
+            child.once('error', (err) => resolve(err));
+        });
+        if (spawned) {
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+            await this.endCaptures();
+            this.failStart(spawned);
+            return;
+        }
+        this.child = child;
+        this._pid = child.pid;
+        this.startedAt = this.deps.clock.now();
+        child.on('error', (err) => this.log.warn('worker process error', { error: err }));
+        this.attachStreams(child);
+        child.once('exit', (code, signal) => this.onLeaderExit(code, signal));
+        this.startTimers();
+        const identity = child.pid !== undefined ? await getStartIdentity(child.pid, this.deps.inspector) : undefined;
+        // If the leader exited meanwhile, its PID may already be reused: never expose that identity.
+        this._identity = this.leaderExited ? undefined : identity;
+        if (!this._identity && !this.leaderExited) {
+            this.log.warn('could not determine process start identity', { pid: child.pid });
+        }
+    }
+    async prepareFiles() {
+        const { workingDirectory, files, createDirectory } = this.spec;
+        for (const p of [workingDirectory, files.contextFile, files.resultFile, files.stdoutLog, files.stderrLog]) {
+            if (!path.isAbsolute(p))
+                throw new OrchestratorError('invalid_path', `path must be absolute: ${p}`);
+        }
+        const baseDir = this.deps.workspaceBaseDir;
+        if (baseDir !== undefined) {
+            await ensureWorkspaceWithin(baseDir, workingDirectory, createDirectory);
+        }
+        else if (createDirectory) {
+            await mkdir(workingDirectory, { recursive: true });
+        }
+        else {
+            const st = await stat(workingDirectory);
+            if (!st.isDirectory()) {
+                throw new OrchestratorError('ENOTDIR', `working directory is not a directory: ${workingDirectory}`);
+            }
+        }
+        await mkdir(path.dirname(files.contextFile), { recursive: true });
+        await mkdir(path.dirname(files.resultFile), { recursive: true });
+        // A stale result file must never be attributed to this execution.
+        await rm(files.resultFile, { force: true });
+        const context = this.secretRedactor.redact(JSON.stringify(this.spec.context, null, 2));
+        const tmp = `${files.contextFile}.tmp-${process.pid}`;
+        await writeFile(tmp, `${context}\n`, { mode: 0o600 });
+        await rename(tmp, files.contextFile);
+    }
+    async openCaptures() {
+        const redactorSecrets = Object.values(this.spec.secrets);
+        const sinks = {
+            output: (chunk) => this.outputs.emit(chunk),
+            event: (type, data, stream) => this.events.emit({ type, data, stream, at: this.deps.clock.now() }),
+            diagnostic: (d) => this.emitDiagnostic(d),
+        };
+        const budget = new LogBudget(this.spec.maxLogBytes);
+        const result = [];
+        for (const [stream, filePath] of [
+            ['stdout', this.spec.files.stdoutLog],
+            ['stderr', this.spec.files.stderrLog],
+        ]) {
+            let openError;
+            try {
+                await mkdir(path.dirname(filePath), { recursive: true });
+            }
+            catch (err) {
+                openError = err;
+            }
+            result.push(new StreamCapture({
+                stream,
+                filePath,
+                openError,
+                budget,
+                redactor: new StreamRedactor(redactorSecrets),
+                clock: this.deps.clock,
+                sinks,
+            }));
+        }
+        return result;
+    }
+    attachStreams(child) {
+        const closes = [];
+        const pairs = [
+            [child.stdout, this.captures[0]],
+            [child.stderr, this.captures[1]],
+        ];
+        for (const [source, capture] of pairs) {
+            if (!source || !capture)
+                continue;
+            closes.push(new Promise((resolve) => source.once('close', () => resolve())));
+            source.on('error', (err) => this.log.warn('worker stream error', { error: err }));
+            source.on('data', (buf) => {
+                this.touch();
+                if (!capture.push(buf, () => source.resume()))
+                    source.pause();
+            });
+        }
+        this.stdioClosed = Promise.all(closes).then(() => undefined);
+    }
+    failStart(err) {
+        const code = err.code;
+        const spawnError = {
+            ...(typeof code === 'string' ? { code } : {}),
+            message: this.secretRedactor.redact(errorMessage(err)),
+        };
+        this.log.warn('worker could not be started', { error: spawnError });
+        this.complete({
+            exitCode: null,
+            signal: null,
+            spawnError,
+            timedOut: false,
+            cancelled: false,
+            resultFile: { state: 'missing' },
+            startedAt: this.startedAt,
+            finishedAt: this.deps.clock.now(),
+            logs: { stdoutBytes: 0, stderrBytes: 0, truncated: false },
+        });
+    }
+    // -------------------------------------------------------------------------
+    // Timeouts
+    // -------------------------------------------------------------------------
+    startTimers() {
+        const { maxDurationMs, idleTimeoutMs } = this.spec.timeouts;
+        if (maxDurationMs !== undefined) {
+            this.maxTimer = this.deps.timers.setTimeout(() => this.onTimeout('max_duration'), maxDurationMs);
+        }
+        if (idleTimeoutMs !== undefined)
+            this.armIdle();
+    }
+    armIdle() {
+        const ms = this.spec.timeouts.idleTimeoutMs;
+        if (ms === undefined || this.leaderExited || this.stopReason)
+            return;
+        if (this.idleTimer)
+            this.deps.timers.clearTimeout(this.idleTimer);
+        this.idleTimer = this.deps.timers.setTimeout(() => this.onTimeout('idle'), ms);
+    }
+    /** Any output (including event lines) resets the idle timeout. */
+    touch() {
+        if (this.idleTimer)
+            this.armIdle();
+    }
+    clearTimers() {
+        if (this.maxTimer)
+            this.deps.timers.clearTimeout(this.maxTimer);
+        if (this.idleTimer)
+            this.deps.timers.clearTimeout(this.idleTimer);
+        this.maxTimer = undefined;
+        this.idleTimer = undefined;
+    }
+    onTimeout(kind) {
+        if (this.leaderExited || this.stopReason)
+            return;
+        this.stopReason = kind;
+        this.clearTimers();
+        this.log.info('worker timed out, terminating process group', { timeout: kind });
+        this.terminate(this.spec.cancelGraceMs).catch(() => {
+            /* kill_failed diagnostic already emitted */
+        });
+    }
+    // -------------------------------------------------------------------------
+    // Termination
+    // -------------------------------------------------------------------------
+    /** SIGTERM to the group, SIGKILL after `graceMs`, then confirm the group is gone. */
+    terminate(graceMs) {
+        this.terminating ??= this.doTerminate(graceMs).catch((err) => {
+            // Allow a later cancel() to retry.
+            this.terminating = undefined;
+            throw err;
+        });
+        return this.terminating;
+    }
+    async doTerminate(graceMs) {
+        this.signalGroup('SIGTERM');
+        if (await this.waitGone(graceMs))
+            return;
+        this.signalGroup('SIGKILL');
+        if (await this.waitGone(this.deps.killConfirmMs))
+            return;
+        const message = `process group ${this._pid} could not be terminated (still alive after SIGKILL)`;
+        this.emitDiagnostic({ type: 'kill_failed', at: this.deps.clock.now(), message, details: { pgid: this._pid } });
+        throw new OrchestratorError('kill_failed', message, { details: { pgid: this._pid } });
+    }
+    /**
+     * Signal our own process group. Safe without identity check: while the
+     * leader is not reaped its PID cannot be reused, and while group members
+     * exist the PGID cannot be reused by a new process.
+     */
+    signalGroup(signal) {
+        const pgid = this._pid;
+        if (pgid === undefined || pgid <= 1)
+            return;
+        if (this.leaderExited && !processGroupExists(pgid))
+            return;
+        try {
+            this.deps.kill(-pgid, signal);
+        }
+        catch (err) {
+            if (err.code !== 'ESRCH') {
+                this.log.warn('failed to signal process group', { pgid, signal, error: err });
+            }
+        }
+    }
+    async isGone() {
+        if (!this.leaderExited)
+            return false;
+        return this._pid === undefined || !(await processGroupAlive(this._pid, this.deps.inspector));
+    }
+    async waitGone(ms) {
+        const step = Math.max(1, this.deps.pollIntervalMs);
+        let waited = 0;
+        while (!(await this.isGone())) {
+            if (waited >= ms)
+                return false;
+            await this.delay(Math.min(step, ms - waited));
+            waited += step;
+        }
+        return true;
+    }
+    delay(ms) {
+        return new Promise((resolve) => this.deps.timers.setTimeout(resolve, ms));
+    }
+    // -------------------------------------------------------------------------
+    // Completion
+    // -------------------------------------------------------------------------
+    onLeaderExit(code, signal) {
+        this.leaderExited = true;
+        this.exitCode = code;
+        this.exitSignal = signal;
+        this.clearTimers();
+        void this.finish().catch((err) => {
+            this.log.error('finishing execution failed', { error: err });
+        });
+    }
+    async finish() {
+        const pgid = this._pid;
+        if (processGroupExists(pgid)) {
+            if (!this.stopReason) {
+                this.log.warn('worker exited but left processes in its group; terminating them', { pgid });
+            }
+            try {
+                await this.terminate(this.spec.cancelGraceMs);
+            }
+            catch {
+                // Never report the execution as finished while the group is alive (Spec §13).
+                while (await processGroupAlive(pgid, this.deps.inspector))
+                    await this.delay(1000);
+            }
+        }
+        // Processes outside the group may still hold stdout/stderr open.
+        let drainTimer;
+        const drained = await Promise.race([
+            this.stdioClosed.then(() => true),
+            new Promise((resolve) => {
+                drainTimer = this.deps.timers.setTimeout(() => resolve(false), this.deps.stdioDrainMs);
+            }),
+        ]);
+        if (drainTimer)
+            this.deps.timers.clearTimeout(drainTimer);
+        if (!drained) {
+            this.log.warn('worker output streams still open after exit; closing them', { pid: pgid });
+            this.child?.stdout?.destroy();
+            this.child?.stderr?.destroy();
+        }
+        await this.endCaptures();
+        const [stdout, stderr] = this.captures;
+        const resultFile = await this.inspectResultFile();
+        this.complete({
+            exitCode: this.exitCode,
+            signal: this.exitSignal,
+            timedOut: this.stopReason === 'max_duration' || this.stopReason === 'idle' ? this.stopReason : false,
+            cancelled: this.stopReason === 'cancel',
+            resultFile,
+            startedAt: this.startedAt,
+            finishedAt: this.deps.clock.now(),
+            logs: {
+                stdoutBytes: stdout?.bytesWritten ?? 0,
+                stderrBytes: stderr?.bytesWritten ?? 0,
+                truncated: (stdout?.truncated ?? false) || (stderr?.truncated ?? false),
+            },
+        });
+    }
+    async endCaptures() {
+        await Promise.all(this.captures.map((c) => c.end()));
+    }
+    async inspectResultFile() {
+        const file = this.spec.files.resultFile;
+        try {
+            const st = await stat(file);
+            if (!st.isFile())
+                return { state: 'invalid', error: 'result file is not a regular file' };
+            if (st.size > MAX_RESULT_FILE_BYTES) {
+                return { state: 'invalid', error: `result file exceeds ${MAX_RESULT_FILE_BYTES} bytes` };
+            }
+            const parsed = parseWorkerResult(await readFile(file, 'utf8'));
+            if (!parsed.ok)
+                return { state: 'invalid', error: this.secretRedactor.redact(parsed.error) };
+            // Spec §9.2: redact sensitive values before the result is persisted anywhere.
+            const result = redactValue(parsed.result, this.secretRedactor.asRedactor);
+            return { state: 'valid', result };
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return { state: 'missing' };
+            return { state: 'invalid', error: `result file could not be read: ${errorMessage(err)}` };
+        }
+    }
+    emitDiagnostic(diagnostic) {
+        this.log.warn('executor diagnostic', { type: diagnostic.type, message: diagnostic.message });
+        this.diagnostics.emit(diagnostic);
+    }
+    complete(outcome) {
+        if (this.outcome)
+            return;
+        this.outcome = outcome;
+        // Resolve after every notification emitted before has been delivered.
+        this.dispatcher.enqueue(() => this.resolveDone(outcome));
+    }
+}
+//# sourceMappingURL=shell-executor.js.map

package/dist/executors/shell-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-executor.js","sourceRoot":"","sources":["../../src/executors/shell-executor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,YAAY,GAgBb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AA6BvD,6CAA6C;AAC7C,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,OAAO,CAAC;IACP,IAAI,CAGnB;IAEF,YAAY,OAAO,GAAyB,EAAE;QAC5C,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,EAAE;YACzD,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;YAC5C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,iFAAiF;QACjF,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAKD,MAAM,YAAY;IA6BG,IAAI;IACJ,IAAI;IA7BN,GAAG,CAAS;IACZ,UAAU,CAAa;IACvB,OAAO,CAAuB;IAC9B,MAAM,CAAuB;IAC7B,WAAW,CAA8B;IACzC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE/C,KAAK,CAA2B;IAChC,IAAI,CAAqB;IACzB,SAAS,CAAmC;IAC5C,SAAS,CAAO;IAChB,QAAQ,GAAoB,EAAE,CAAC;IAC/B,WAAW,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE/C,YAAY,GAAG,KAAK,CAAC;IACrB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,UAAU,GAA0B,IAAI,CAAC;IACzC,UAAU,CAAyB;IACnC,WAAW,CAA4B;IACvC,QAAQ,CAA0B;IAClC,SAAS,CAA0B;IAEnC,OAAO,CAA+B;IACtC,WAAW,CAAuC;IAC1D,qFAAqF;IACpE,IAAI,CAA4B;IAEjD,YACmB,IAAmB,EACnB,IAAU;oBADV,IAAI;oBACJ,IAAI;QAErB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,QAAQ,CAAC,QAAsC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,QAAsC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,QAAkD;QAC7D,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,YAAY;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,IAAI,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,SAAS;IACT,4EAA4E;IAE5E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1C,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,YAAY,CAAC;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;gBACnC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;gBACjC,SAAS,EAAE,IAAI,CAAC,gBAAgB;aACjC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC1C,GAAG,EAAE,IAAI,CAAC,gBAAgB;gBAC1B,GAAG;gBACH,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACvC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,6FAA6F;QAC7F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,yCAAyC,gBAAgB,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,kEAAkE;QAClE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG;YACZ,MAAM,EAAE,CAAC,KAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACxD,KAAK,EAAE,CAAC,IAAY,EAAE,IAA6B,EAAE,MAA2B,EAAE,EAAE,CAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;YACrE,UAAU,EAAE,CAAC,CAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;SAC9D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI;YAC/B,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACrC,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7B,EAAE,CAAC;YACX,IAAI,SAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAY,CAAC;YAC3B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,IAAI,aAAa,CAAC;gBAChB,MAAM;gBACN,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,QAAQ,EAAE,IAAI,cAAc,CAAC,eAAe,CAAC;gBAC7C,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,KAAK;aACN,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,KAAmB;QACvC,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAmD;YAC5D,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACjC,CAAC;QACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;gBAAE,SAAS;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;gBAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAEO,SAAS,CAAC,GAAY;QAC5B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;QAC9C,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SACvD,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,UAAU;YACV,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACjC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,WAAW;IACX,4EAA4E;IAEpE,WAAW;QACjB,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAEO,OAAO;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QACrE,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,kEAAkE;IAC1D,KAAK;QACX,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEO,SAAS,CAAC,IAA6B;QAC7C,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACjD,4CAA4C;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,cAAc;IACd,4EAA4E;IAE5E,qFAAqF;IAC7E,SAAS,CAAC,OAAe;QAC/B,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACpE,mCAAmC;YACnC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,OAAe;QACvC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO;QACzD,MAAM,OAAO,GAAG,iBAAiB,IAAI,CAAC,IAAI,sDAAsD,CAAC;QACjG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/G,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,MAAsB;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QAC5C,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,EAAU;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAI,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAEpE,YAAY,CAAC,IAAmB,EAAE,MAA6B;QACrE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,8EAA8E;gBAC9E,OAAO,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,IAAI,UAAmC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACjC,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBAC/B,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzF,CAAC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;YACpG,SAAS,EAAE,IAAI,CAAC,UAAU,KAAK,QAAQ;YACvC,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACjC,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC;gBACtC,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC;gBACtC,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC;aACxE;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YAC1F,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,qBAAqB,QAAQ,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,8EAA8E;YAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAiB,CAAC;YAC1F,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAClF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,kCAAkC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,UAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAEO,QAAQ,CAAC,OAAyB;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,sEAAsE;QACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/executors/stream-redactor.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Best-effort, chunk-boundary-safe secret redaction for raw process output
+ * (Spec §20.4, §24.8).
+ *
+ * Works on raw bytes: data is mapped 1:1 to a `latin1` string, so bytes that
+ * are not part of a secret are passed through unchanged (also invalid UTF-8).
+ *
+ * Limits (documented, Spec §24.8): only exact occurrences of registered secret
+ * values (and the `\n`-escaped form of multi-line values) are replaced.
+ * Transformed secrets (base64, URL-encoded, reversed, split by other output,
+ * printed character by character with interleaved bytes) are NOT detected. A
+ * worker can always leak secrets it was given; reliable secrecy requires
+ * trusted workers.
+ */
+/** Replacement marker for redacted secrets (same as the core logger). */
+export declare const REDACTION_MARKER = "[REDACTED]";
+/** Secrets shorter than this are ignored (too many false positives). */
+export declare const MIN_STREAM_SECRET_LENGTH = 4;
+/**
+ * Redacts known secret values from a byte stream split into arbitrary chunks.
+ *
+ * Holds back the shortest possible tail: only bytes at the end of a chunk
+ * that could be the beginning of a secret are withheld until the next chunk
+ * (or {@link flush}). Output without such a tail is passed through immediately.
+ */
+export declare class StreamRedactor {
+    /** Secrets as latin1 strings of their UTF-8 bytes, longest first. */
+    private readonly secrets;
+    private carry;
+    constructor(secretValues: Iterable<string>);
+    /** True if at least one secret is registered (otherwise data passes unchanged). */
+    get active(): boolean;
+    /** Feed a chunk; returns the bytes that are safe to emit now. */
+    push(chunk: Buffer): Buffer;
+    /** Emit the withheld tail (it is not a complete secret). */
+    flush(): Buffer;
+    private redact;
+    /** Length of the longest suffix of `text` that is a proper prefix of a secret. */
+    private pendingPrefixLength;
+}

package/dist/executors/stream-redactor.js

@@ -0,0 +1,89 @@
+/**
+ * Best-effort, chunk-boundary-safe secret redaction for raw process output
+ * (Spec §20.4, §24.8).
+ *
+ * Works on raw bytes: data is mapped 1:1 to a `latin1` string, so bytes that
+ * are not part of a secret are passed through unchanged (also invalid UTF-8).
+ *
+ * Limits (documented, Spec §24.8): only exact occurrences of registered secret
+ * values (and the `\n`-escaped form of multi-line values) are replaced.
+ * Transformed secrets (base64, URL-encoded, reversed, split by other output,
+ * printed character by character with interleaved bytes) are NOT detected. A
+ * worker can always leak secrets it was given; reliable secrecy requires
+ * trusted workers.
+ */
+/** Replacement marker for redacted secrets (same as the core logger). */
+export const REDACTION_MARKER = '[REDACTED]';
+/** Secrets shorter than this are ignored (too many false positives). */
+export const MIN_STREAM_SECRET_LENGTH = 4;
+/**
+ * Redacts known secret values from a byte stream split into arbitrary chunks.
+ *
+ * Holds back the shortest possible tail: only bytes at the end of a chunk
+ * that could be the beginning of a secret are withheld until the next chunk
+ * (or {@link flush}). Output without such a tail is passed through immediately.
+ */
+export class StreamRedactor {
+    /** Secrets as latin1 strings of their UTF-8 bytes, longest first. */
+    secrets;
+    carry = '';
+    constructor(secretValues) {
+        const set = new Set();
+        for (const value of secretValues) {
+            if (typeof value !== 'string' || value.length < MIN_STREAM_SECRET_LENGTH)
+                continue;
+            set.add(toLatin1(value));
+            if (value.includes('\n'))
+                set.add(toLatin1(value.replace(/\n/g, '\\n')));
+        }
+        this.secrets = [...set].sort((a, b) => b.length - a.length);
+    }
+    /** True if at least one secret is registered (otherwise data passes unchanged). */
+    get active() {
+        return this.secrets.length > 0;
+    }
+    /** Feed a chunk; returns the bytes that are safe to emit now. */
+    push(chunk) {
+        if (!this.active)
+            return chunk;
+        const text = this.redact(this.carry + chunk.toString('latin1'));
+        const hold = this.pendingPrefixLength(text);
+        this.carry = text.slice(text.length - hold);
+        return Buffer.from(text.slice(0, text.length - hold), 'latin1');
+    }
+    /** Emit the withheld tail (it is not a complete secret). */
+    flush() {
+        const rest = this.carry;
+        this.carry = '';
+        return Buffer.from(rest, 'latin1');
+    }
+    redact(text) {
+        let out = text;
+        for (const secret of this.secrets) {
+            if (out.includes(secret))
+                out = out.split(secret).join(REDACTION_MARKER);
+        }
+        return out;
+    }
+    /** Length of the longest suffix of `text` that is a proper prefix of a secret. */
+    pendingPrefixLength(text) {
+        let best = 0;
+        for (const secret of this.secrets) {
+            const first = secret.charCodeAt(0);
+            const from = Math.max(0, text.length - (secret.length - 1));
+            for (let i = from; i < text.length; i++) {
+                if (text.length - i <= best)
+                    break;
+                if (text.charCodeAt(i) === first && secret.startsWith(text.slice(i))) {
+                    best = text.length - i;
+                    break;
+                }
+            }
+        }
+        return best;
+    }
+}
+function toLatin1(value) {
+    return Buffer.from(value, 'utf8').toString('latin1');
+}
+//# sourceMappingURL=stream-redactor.js.map

package/dist/executors/stream-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-redactor.js","sourceRoot":"","sources":["../../src/executors/stream-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACzB,qEAAqE;IACpD,OAAO,CAAW;IAC3B,KAAK,GAAG,EAAE,CAAC;IAEnB,YAAY,YAA8B;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB;gBAAE,SAAS;YACnF,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,mFAAmF;IACnF,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,kFAAkF;IAC1E,mBAAmB,CAAC,IAAY;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI;oBAAE,MAAM;gBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;oBACvB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC"}

package/dist/executors/workspace.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ensure `target` exists as a directory strictly below `baseDir` (never
+ * `baseDir` itself). Directories are created one segment at a time and each
+ * segment's real path is checked BEFORE anything is created below it, so a
+ * symlink inside `baseDir` cannot cause directories to be created outside.
+ * With `create: false` the existing directory is only verified.
+ *
+ * @throws PathTraversalError on lexical or symlink escapes
+ */
+export declare function ensureWorkspaceWithin(baseDir: string, target: string, create: boolean): Promise<string>;