agentic-engineering-harness 0.14.2 → 0.15.1

package/dist/releases/release-1791270071086-18643-d14b01f3/runtime/supervisorV2.d.ts

@@ -0,0 +1,207 @@
+export type RuntimeServiceKindV1 = "paseo" | "serena" | "context" | "control-center" | "provider";
+export type RuntimeServiceStatusV1 = "STARTING" | "READY" | "DEGRADED" | "STOPPED" | "FAILED";
+export type ProviderLeaseModeV1 = "read" | "write";
+export interface RuntimeServiceV1 {
+    version: 1;
+    serviceId: string;
+    kind: RuntimeServiceKindV1;
+    projectId: string;
+    canonicalRoot: string;
+    workspaceId?: string;
+    status: RuntimeServiceStatusV1;
+    ownerId: string;
+    healthUrl?: string;
+    pid?: number;
+    startedAt: string;
+    lastHeartbeatAt: string;
+    metadata: Record<string, string>;
+}
+export interface ProviderLeaseV1 {
+    version: 1;
+    leaseId: string;
+    provider: string;
+    projectId: string;
+    canonicalRoot: string;
+    workspaceId: string;
+    mode: ProviderLeaseModeV1;
+    ownerId: string;
+    acquiredAt: string;
+    expiresAt: string;
+    lifecycle?: ProviderLeaseLifecycleIdentityV1;
+}
+/** Audit/fencing identity for a production session lease; it grants no capability. */
+export interface ProviderLeaseLifecycleIdentityV1 {
+    operationId: string;
+    candidateDigest: string;
+    operationExecutionRevision: number;
+    policyDigest: string;
+    controllerTokenDigest: string;
+    controllerEpoch: number;
+    participantId?: string;
+    participantGeneration?: string;
+    supervisorAgentId?: string;
+    leadAgentId?: string;
+    leadGeneration?: number;
+    sessionId?: string;
+    executionBindingDigest?: string;
+    providerStatus: "ACTIVE" | "UNCERTAIN";
+}
+export interface ProviderLeaseQuiescenceV1 {
+    sessionId: string;
+    status: "idle" | "completed" | "failed" | "stopped";
+    observedAt: string;
+}
+/**
+ * Provider backpressure QUEUE disposition (Unit 3).
+ *
+ * MECHANISM: DETERMINISTIC. The same write-write conflict predicate as
+ * `acquireProviderLease` is evaluated, but a conflict returns a bounded QUEUED
+ * disposition instead of throwing. Caps are unchanged; waits are bounded
+ * (`PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1`); an exhausted wait budget is
+ * terminal (caller treats QUEUED-wait-exhausted as FAIL, never as silent
+ * progress). Telemetry is observation-only via the returned counters.
+ */
+export declare const PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1 = 30000;
+export declare const PROVIDER_LEASE_QUEUE_POLL_MS_V1 = 50;
+export declare const PROVIDER_LEASE_QUEUE_DEFAULT_WAIT_MS_V1 = 250;
+export type ProviderLeaseQueueStatusV1 = "ACQUIRED" | "QUEUED";
+export interface ProviderLeaseQueuedV1 {
+    status: "QUEUED";
+    /** Bounded WAIT hint before re-attempting acquisition (never extends caps). */
+    retryAfterMs: number;
+    /** Number of active conflicting leases in the same provider/workspace scope. */
+    queueDepth: number;
+    reason: string;
+}
+export interface ProviderLeaseAcquiredV1 {
+    status: "ACQUIRED";
+    lease: ProviderLeaseV1;
+}
+export type ProviderLeaseAcquireResultV1 = ProviderLeaseAcquiredV1 | ProviderLeaseQueuedV1;
+export interface ProviderLeaseBackpressureSignalV1 {
+    /** Active leases observed in the conflicting scope (counter). */
+    active: number;
+    /** Queued waiters implied by this disposition (counter). */
+    queued: number;
+    /** Configured ceiling when known (gauge denominator); undefined when unknown. */
+    ceiling?: number;
+    /** True when active meets or exceeds the known ceiling. */
+    saturated: boolean;
+}
+export interface RuntimeSnapshotV1 {
+    version: 1;
+    capturedAt: string;
+    services: RuntimeServiceV1[];
+    providerLeases: ProviderLeaseV1[];
+}
+export interface RuntimeSupervisorOptionsV1 {
+    clock?: () => Date;
+    leaseTtlMs?: number;
+}
+export interface ObservedPaseoDaemonV1 {
+    projectId: string;
+    canonicalRoot: string;
+    serviceId: string;
+    aehVersion: string;
+    paseoVersion: string;
+    observedServerId?: string;
+    observedPid?: number;
+    priorDaemonState: "healthy" | "stopped";
+}
+export declare class RuntimeOwnershipError extends Error {
+    constructor(message: string);
+}
+export declare class RuntimeSupervisorV1 {
+    private readonly services;
+    private readonly leases;
+    private readonly clock;
+    private readonly leaseTtlMs;
+    constructor(options?: RuntimeSupervisorOptionsV1);
+    registerService(input: Omit<RuntimeServiceV1, "version" | "status" | "startedAt" | "lastHeartbeatAt"> & {
+        status?: RuntimeServiceStatusV1;
+    }): RuntimeServiceV1;
+    /**
+     * Record a Paseo daemon only after the caller has observed its current status.
+     * This narrowly reconciles legacy aeh-start-owned Paseo records; it does not
+     * relax the generic service-owner arbitration used by other services.
+     */
+    registerObservedPaseoDaemon(input: ObservedPaseoDaemonV1): RuntimeServiceV1;
+    updateService(serviceId: string, ownerId: string, update: Partial<Pick<RuntimeServiceV1, "status" | "healthUrl" | "pid" | "metadata">>): RuntimeServiceV1;
+    heartbeat(serviceId: string, ownerId: string): RuntimeServiceV1;
+    stopService(serviceId: string, ownerId: string, status?: "STOPPED" | "FAILED"): RuntimeServiceV1;
+    /**
+     * Atomic within one process only (synchronous check-then-insert, no await
+     * between conflict test and insert, so concurrent async callers in the same
+     * event loop cannot interleave). NOT atomic w.r.t. the shared durable
+     * snapshot file across waves/operations/processes: a fresh in-memory
+     * supervisor per wave is blind by construction. Cross-process atomicity
+     * requires the file-locked reload→check→write transact
+     * (`ManagedRuntimeSupervisorV1.transact` for provider lifecycle;
+     * `tryAcquireDurableWaveSlotAtomic`/`acquireDurableWaveSlotOrQueue` in
+     * `operationResources.ts` for wave admission). Luna F3: wave dispatch must
+     * use the durable transact end-to-end, never this alone for shared scopes.
+     */
+    acquireProviderLease(input: Omit<ProviderLeaseV1, "version" | "leaseId" | "acquiredAt" | "expiresAt"> & {
+        ttlMs?: number;
+    }): ProviderLeaseV1;
+    /**
+     * Non-throwing lease acquisition for backpressure-aware callers. Success
+     * returns ACQUIRED with the new lease; a write-write conflict returns QUEUED
+     * with a bounded WAIT hint instead of throwing. All other validation still
+     * throws fail-closed (empty identity, non-positive ttl). Callers honor the
+     * WAIT against their existing deadline budget and treat an exhausted budget
+     * as terminal.
+     */
+    tryAcquireProviderLease(input: Omit<ProviderLeaseV1, "version" | "leaseId" | "acquiredAt" | "expiresAt"> & {
+        ttlMs?: number;
+    }): ProviderLeaseAcquireResultV1;
+    renewProviderLease(leaseId: string, ownerId: string, ttlMs?: number): ProviderLeaseV1;
+    updateProviderLeaseLifecycle(leaseId: string, ownerId: string, lifecycle: ProviderLeaseLifecycleIdentityV1): ProviderLeaseV1;
+    /** Revoke a prior epoch's lease only after its exact provider session is observed quiescent. */
+    completeProviderLeaseTakeover(leaseId: string, currentOwnerId: string, current: ProviderLeaseLifecycleIdentityV1, quiescence: ProviderLeaseQuiescenceV1): void;
+    releaseProviderLease(leaseId: string, ownerId: string): void;
+    snapshot(): RuntimeSnapshotV1;
+    /** Replace the in-memory view from the atomically persisted runtime snapshot. */
+    restoreSnapshot(snapshot: RuntimeSnapshotV1): void;
+    private requireOwnedService;
+    private expireLeases;
+}
+/** DETERMINISTIC classifier: true when the error is the write-write lease conflict (QUEUE, not FAIL). */
+export declare function isProviderLeaseConflictError(error: unknown): boolean;
+/**
+ * Build the observation-only backpressure signal for telemetry (counter/gauge).
+ * No gate consumes it; it only describes active load vs the known ceiling.
+ */
+export declare function providerLeaseBackpressureSignal(active: number, queued: number, ceiling?: number): ProviderLeaseBackpressureSignalV1;
+/**
+ * Honor a QUEUED WAIT against an existing deadline budget. Never extends caps:
+ * returns `min(retryAfterMs, remainingBudgetMs)`, or 0 when exhausted (terminal).
+ */
+export declare function providerLeaseQueueWaitMs(queued: ProviderLeaseQueuedV1 | undefined, remainingBudgetMs?: number): number;
+/**
+ * Shared durable-lease conflict predicate (Luna F2).
+ *
+ * MECHANISM: DETERMINISTIC. This is the exact write-write conflict predicate
+ * that `acquireProviderLease`/`tryAcquireProviderLease` enforce: same
+ * provider/project/normalized-root/workspace scope, different owner, and at
+ * least one side holds write. Both the in-memory supervisor and the durable
+ * snapshot gate (operationResources provider-session leases persisted via the
+ * managed runtime snapshot — the same lease store `acquireProviderLease`
+ * persists to) must evaluate this predicate, never a divergent local rule.
+ * Expired leases never conflict; empty identity never matches.
+ */
+export declare function findConflictingProviderLeases(leases: readonly ProviderLeaseV1[], input: {
+    provider: string;
+    projectId: string;
+    canonicalRoot: string;
+    workspaceId: string;
+    ownerId: string;
+    mode: ProviderLeaseModeV1;
+}): ProviderLeaseV1[];
+/**
+ * Build the bounded QUEUED disposition for a set of conflicting durable or
+ * in-memory leases. Same WAIT-hint rule as `tryAcquireProviderLease`:
+ * min(positive expiresAt-now) else the stampede-avoidance default, clamped to
+ * the queue cap. Pure and clock-injectable (`nowMs`) for deterministic fixtures.
+ */
+export declare function queuedForConflictingLeases(provider: string, workspaceId: string, conflicting: readonly ProviderLeaseV1[], nowMs: number): ProviderLeaseQueuedV1;

package/dist/releases/{release-1791263461761-18664-ac6ba33c → release-1791270071086-18643-d14b01f3}/runtime/supervisorV2.js

@@ -1,4 +1,17 @@
 import { randomUUID } from "node:crypto";
+/**
+ * Provider backpressure QUEUE disposition (Unit 3).
+ *
+ * MECHANISM: DETERMINISTIC. The same write-write conflict predicate as
+ * `acquireProviderLease` is evaluated, but a conflict returns a bounded QUEUED
+ * disposition instead of throwing. Caps are unchanged; waits are bounded
+ * (`PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1`); an exhausted wait budget is
+ * terminal (caller treats QUEUED-wait-exhausted as FAIL, never as silent
+ * progress). Telemetry is observation-only via the returned counters.
+ */
+export const PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1 = 30_000;
+export const PROVIDER_LEASE_QUEUE_POLL_MS_V1 = 50;
+export const PROVIDER_LEASE_QUEUE_DEFAULT_WAIT_MS_V1 = 250;
 export class RuntimeOwnershipError extends Error {
     constructor(message) {
         super(message);
@@ -128,6 +141,18 @@ export class RuntimeSupervisorV1 {
     stopService(serviceId, ownerId, status = "STOPPED") {
         return this.updateService(serviceId, ownerId, { status });
     }
+    /**
+     * Atomic within one process only (synchronous check-then-insert, no await
+     * between conflict test and insert, so concurrent async callers in the same
+     * event loop cannot interleave). NOT atomic w.r.t. the shared durable
+     * snapshot file across waves/operations/processes: a fresh in-memory
+     * supervisor per wave is blind by construction. Cross-process atomicity
+     * requires the file-locked reload→check→write transact
+     * (`ManagedRuntimeSupervisorV1.transact` for provider lifecycle;
+     * `tryAcquireDurableWaveSlotAtomic`/`acquireDurableWaveSlotOrQueue` in
+     * `operationResources.ts` for wave admission). Luna F3: wave dispatch must
+     * use the durable transact end-to-end, never this alone for shared scopes.
+     */
     acquireProviderLease(input) {
         requireText(input.provider, "provider");
         requireText(input.projectId, "projectId");
@@ -160,6 +185,52 @@ export class RuntimeSupervisorV1 {
         this.leases.set(lease.leaseId, lease);
         return clone(lease);
     }
+    /**
+     * Non-throwing lease acquisition for backpressure-aware callers. Success
+     * returns ACQUIRED with the new lease; a write-write conflict returns QUEUED
+     * with a bounded WAIT hint instead of throwing. All other validation still
+     * throws fail-closed (empty identity, non-positive ttl). Callers honor the
+     * WAIT against their existing deadline budget and treat an exhausted budget
+     * as terminal.
+     */
+    tryAcquireProviderLease(input) {
+        requireText(input.provider, "provider");
+        requireText(input.projectId, "projectId");
+        requireText(input.ownerId, "ownerId");
+        requireText(input.workspaceId, "workspaceId");
+        const now = this.clock();
+        this.expireLeases(now);
+        const root = normalizeRoot(input.canonicalRoot);
+        const conflicting = findConflictingProviderLeases([...this.leases.values()], {
+            provider: input.provider,
+            projectId: input.projectId,
+            canonicalRoot: root,
+            workspaceId: input.workspaceId,
+            ownerId: input.ownerId,
+            mode: input.mode,
+        });
+        if (conflicting.length) {
+            return queuedForConflictingLeases(input.provider, input.workspaceId, conflicting, now.getTime());
+        }
+        const ttlMs = input.ttlMs ?? this.leaseTtlMs;
+        if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0)
+            throw new RuntimeOwnershipError("provider lease ttl must be a positive integer.");
+        const lease = {
+            version: 1,
+            leaseId: `lease:${randomUUID()}`,
+            provider: input.provider,
+            projectId: input.projectId,
+            canonicalRoot: root,
+            workspaceId: input.workspaceId,
+            mode: input.mode,
+            ownerId: input.ownerId,
+            acquiredAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+            ...(input.lifecycle ? { lifecycle: validateProviderLeaseLifecycle(input.lifecycle) } : {})
+        };
+        this.leases.set(lease.leaseId, lease);
+        return { status: "ACQUIRED", lease: clone(lease) };
+    }
     renewProviderLease(leaseId, ownerId, ttlMs = this.leaseTtlMs) {
         const now = this.clock();
         this.expireLeases(now);
@@ -309,4 +380,85 @@ function serviceOwnerProcessAlive(service) {
         return error.code === "EPERM";
     }
 }
+/** DETERMINISTIC classifier: true when the error is the write-write lease conflict (QUEUE, not FAIL). */
+export function isProviderLeaseConflictError(error) {
+    const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+    return message.includes("already leased in");
+}
+/**
+ * Build the observation-only backpressure signal for telemetry (counter/gauge).
+ * No gate consumes it; it only describes active load vs the known ceiling.
+ */
+export function providerLeaseBackpressureSignal(active, queued, ceiling) {
+    const safeActive = Number.isFinite(active) && active >= 0 ? Math.floor(active) : 0;
+    const safeQueued = Number.isFinite(queued) && queued >= 0 ? Math.floor(queued) : 0;
+    const safeCeiling = ceiling !== undefined && Number.isFinite(ceiling) && ceiling > 0 ? Math.floor(ceiling) : undefined;
+    return {
+        active: safeActive,
+        queued: safeQueued,
+        ...(safeCeiling !== undefined ? { ceiling: safeCeiling } : {}),
+        saturated: safeCeiling !== undefined ? safeActive >= safeCeiling : safeActive > 0
+    };
+}
+/**
+ * Honor a QUEUED WAIT against an existing deadline budget. Never extends caps:
+ * returns `min(retryAfterMs, remainingBudgetMs)`, or 0 when exhausted (terminal).
+ */
+export function providerLeaseQueueWaitMs(queued, remainingBudgetMs) {
+    if (!queued || queued.status !== "QUEUED")
+        return 0;
+    const bounded = Math.max(0, Math.min(PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1, Math.floor(queued.retryAfterMs)));
+    if (remainingBudgetMs === undefined)
+        return bounded;
+    if (!Number.isFinite(remainingBudgetMs) || remainingBudgetMs <= 0)
+        return 0;
+    return Math.min(bounded, Math.floor(remainingBudgetMs));
+}
+/**
+ * Shared durable-lease conflict predicate (Luna F2).
+ *
+ * MECHANISM: DETERMINISTIC. This is the exact write-write conflict predicate
+ * that `acquireProviderLease`/`tryAcquireProviderLease` enforce: same
+ * provider/project/normalized-root/workspace scope, different owner, and at
+ * least one side holds write. Both the in-memory supervisor and the durable
+ * snapshot gate (operationResources provider-session leases persisted via the
+ * managed runtime snapshot — the same lease store `acquireProviderLease`
+ * persists to) must evaluate this predicate, never a divergent local rule.
+ * Expired leases never conflict; empty identity never matches.
+ */
+export function findConflictingProviderLeases(leases, input) {
+    if (!input.provider.trim() || !input.projectId.trim() || !input.ownerId.trim() || !input.workspaceId.trim())
+        return [];
+    let root;
+    try {
+        root = normalizeRoot(input.canonicalRoot);
+    }
+    catch {
+        return [];
+    }
+    const wanted = key(input.provider, input.projectId, root, input.workspaceId);
+    return leases.filter((lease) => key(lease.provider, lease.projectId, lease.canonicalRoot, lease.workspaceId) === wanted &&
+        lease.ownerId !== input.ownerId &&
+        (lease.mode === "write" || input.mode === "write"));
+}
+/**
+ * Build the bounded QUEUED disposition for a set of conflicting durable or
+ * in-memory leases. Same WAIT-hint rule as `tryAcquireProviderLease`:
+ * min(positive expiresAt-now) else the stampede-avoidance default, clamped to
+ * the queue cap. Pure and clock-injectable (`nowMs`) for deterministic fixtures.
+ */
+export function queuedForConflictingLeases(provider, workspaceId, conflicting, nowMs) {
+    const waits = conflicting
+        .map((lease) => Date.parse(lease.expiresAt) - nowMs)
+        .filter((ms) => Number.isFinite(ms) && ms > 0);
+    const hint = waits.length ? Math.min(...waits) : PROVIDER_LEASE_QUEUE_DEFAULT_WAIT_MS_V1;
+    const retryAfterMs = Math.max(0, Math.min(PROVIDER_LEASE_QUEUE_MAX_WAIT_MS_V1, Math.floor(hint)));
+    const owners = [...new Set(conflicting.map((lease) => lease.ownerId))].slice(0, 3).join(",");
+    return {
+        status: "QUEUED",
+        retryAfterMs,
+        queueDepth: conflicting.length,
+        reason: `provider ${provider} is already leased in ${workspaceId} by ${owners || "another owner"}; QUEUED (wait ${retryAfterMs}ms, depth ${conflicting.length}).`
+    };
+}
 //# sourceMappingURL=supervisorV2.js.map

package/dist/releases/release-1791270071086-18643-d14b01f3/runtime/supervisorV2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisorV2.js","sourceRoot":"","sources":["../../src/runtime/supervisorV2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA4DzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAClD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAsD3D,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,IAAY;IAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAE,IAAY,EAAE,WAAmB;IACjF,OAAO,GAAG,QAAQ,SAAS,SAAS,SAAS,aAAa,CAAC,IAAI,CAAC,SAAS,WAAW,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC/C,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,KAAK,CAAa;IAClB,UAAU,CAAS;IAEpC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;IAChJ,CAAC;IAED,eAAe,CAAC,KAA2H;QACzI,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1J,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,SAAS,gBAAgB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAqB;YAChC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACtD,SAAS,EAAE,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YAC1I,eAAe,EAAE,GAAG;YACpB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;SAChC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,2BAA2B,CAAC,KAA4B;QACtD,MAAM,iBAAiB,GAAG,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB;YAAE,MAAM,IAAI,qBAAqB,CAAC,+DAA+D,CAAC,CAAC;QACvK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,uDAAuD,CAAC,CAAC;QACtJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;QACpH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,qBAAqB,CAAC,uDAAuD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,eAAe,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1H,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,iBAAiB,8DAA8D,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,KAAK,eAAe,CAAC;YACzD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,iBAAiB,8DAA8D,CAAC,CAAC;YACpK,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzD,IAAI,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACtI,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,iBAAiB,mFAAmF,CAAC,CAAC;YACzJ,CAAC;QACH,CAAC;QACD,MAAM,kBAAkB,GAAG,QAAQ,IAAI,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,gBAAgB,CAAC;QAC5H,MAAM,OAAO,GAAqB;YAChC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,iBAAiB;YAC5B,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,OAAO;YACf,OAAO;YACP,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACtE,SAAS,EAAE,kBAAkB,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YACpE,eAAe,EAAE,GAAG;YACpB,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E;SACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,OAAe,EAAE,MAAoF;QACpI,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAAC,WAAW,SAAS,iBAAiB,OAAO,CAAC,MAAM,qCAAqC,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACtJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,OAAe;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,OAAe,EAAE,SAA+B,SAAS;QACtF,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,KAAqG;QACxH,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtJ,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;QAClI,IAAI,WAAW;YAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,KAAK,CAAC,QAAQ,yBAAyB,KAAK,CAAC,WAAW,OAAO,WAAW,CAAC,OAAO,GAAG,CAAC,CAAC;QACpJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,CAAC,CAAC;QAClI,MAAM,KAAK,GAAoB;YAC7B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YACxD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,KAAqG;QAC3H,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,6BAA6B,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAC3E,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,CAAC,CAAC;QAClI,MAAM,KAAK,GAAoB;YAC7B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YACxD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,kBAAkB,CAAC,OAAe,EAAE,OAAe,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,oBAAoB,OAAO,GAAG,CAAC,CAAC;QAClI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,wEAAwE,CAAC,CAAC;QACrL,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,CAAC,CAAC;QAClI,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,4BAA4B,CAAC,OAAe,EAAE,OAAe,EAAE,SAA2C;QACxG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,oBAAoB,OAAO,GAAG,CAAC,CAAC;QAClI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,oCAAoC,CAAC,CAAC;QAC1J,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,gGAAgG;IAChG,6BAA6B,CAC3B,OAAe,EACf,cAAsB,EACtB,OAAyC,EACzC,UAAqC;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,uCAAuC,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,MAAM,IAAI,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;eACzJ,QAAQ,CAAC,0BAA0B,KAAK,IAAI,CAAC,0BAA0B,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;eAClH,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,IAAI,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eAC/F,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClH,MAAM,IAAI,qBAAqB,CAAC,qKAAqK,CAAC,CAAC;QACzM,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,OAAe;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,OAAO,oBAAoB,OAAO,GAAG,CAAC,CAAC;QACxH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACxK,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,QAA2B;QACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3J,MAAM,IAAI,qBAAqB,CAAC,0FAA0F,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;mBACrI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC;mBAChJ,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;mBACpF,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;mBAChF,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;mBAC5F,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;mBACvF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,qBAAqB,CAAC,uFAAuF,CAAC,CAAC;YAC3H,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;mBAC1J,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;mBACxG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;mBACtG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,qBAAqB,CAAC,uFAAuF,CAAC,CAAC;YAC3H,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC3H,MAAM,IAAI,qBAAqB,CAAC,qFAAqF,CAAC,CAAC;YACzH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,SAAiB,EAAE,OAAe;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,SAAS,qBAAqB,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,SAAS,gBAAgB,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QACzH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAAC,GAAS;QAC5B,iFAAiF;QACjF,KAAK,GAAG,CAAC;IACX,CAAC;CACF;AAED,SAAS,8BAA8B,CAAC,KAAuC;IAC7E,MAAM,mBAAmB,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,YAAY,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzI,MAAM,UAAU,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAClG,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;WAC1F,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC;WAC/F,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC;WACjG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC;WAC3F,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;WACnH,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC;WACrD,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;WACjE,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;WACpG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,qBAAqB,CAAC,4IAA4I,CAAC,CAAC;IAChL,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAsC,EAAE,KAAuC;IAC7G,OAAO,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB;WAC1G,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;WAClD,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,IAAqB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACrH,SAAS,SAAS,CAAC,KAAc,IAAqB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/H,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAiB;IAC/D,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAyB;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAI,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC;QAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAAC,CAAC;AAC7E,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,OAAO,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAc,EACd,MAAc,EACd,OAAgB;IAEhB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,UAAU;QAClB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,SAAS,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC;KAClF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyC,EAAE,iBAA0B;IAC5G,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5G,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAkC,EAClC,KAAsI;IAEtI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IACvH,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,MAAM;QACvF,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,WAAmB,EACnB,WAAuC,EACvC,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW;SACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;SACnD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,uCAAuC,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,YAAY;QACZ,UAAU,EAAE,WAAW,CAAC,MAAM;QAC9B,MAAM,EAAE,YAAY,QAAQ,yBAAyB,WAAW,OAAO,MAAM,IAAI,eAAe,kBAAkB,YAAY,aAAa,WAAW,CAAC,MAAM,IAAI;KAClK,CAAC;AACJ,CAAC"}

package/dist/releases/{release-1791263434955-18515-5948278e → release-1791270071086-18643-d14b01f3}/security/isolation.js

@@ -9,6 +9,13 @@ export const ISOLATION_PROVIDER_UNSUPPORTED = "ISOLATION_PROVIDER_UNSUPPORTED";
 export const ISOLATION_ENVIRONMENT_REJECTED = "ISOLATION_ENVIRONMENT_REJECTED";
 export const ISOLATION_COMMAND_INVALID = "ISOLATION_COMMAND_INVALID";
 export const DEFAULT_ISOLATION_ENVIRONMENT_ALLOWLIST = ["PATH", "LANG", "LC_ALL", "LC_CTYPE", "TERM", "TZ", "TMPDIR", "SHELL", "USER"];
+/**
+ * Request-scoped candidate binding for isolated validator commands. It must
+ * only ever come from an explicit IsolatedCommandRequestV1.environment entry;
+ * a stale host process.env value must never leak in via the allowlist when
+ * no candidate is present.
+ */
+const VALIDATION_CANDIDATE_ENVIRONMENT_VARIABLE = "AEH_VALIDATION_CANDIDATE_JSON";
 export const DEFAULT_MASKED_HOST_PATHS = [
     "/root (host)",
     "/run (host)",
@@ -248,6 +255,9 @@ export function isolationEnvironment(request, allowlist) {
         if (value !== undefined)
             environment[name] = value;
     }
+    if (request.environment?.[VALIDATION_CANDIDATE_ENVIRONMENT_VARIABLE] === undefined) {
+        delete environment[VALIDATION_CANDIDATE_ENVIRONMENT_VARIABLE];
+    }
     return environment;
 }
 export async function runIsolatedCommand(request, options = {}) {

package/dist/releases/release-1791270071086-18643-d14b01f3/security/isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.js","sourceRoot":"","sources":["../../src/security/isolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAyC,CAAC;AACxF,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAyC,CAAC;AACxF,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAyC,CAAC;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAAoC,CAAC;AAI9E,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEhJ;;;;;GAKG;AACH,MAAM,yCAAyC,GAAG,+BAAwC,CAAC;AAE3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,cAAc;IACd,aAAa;IACb,uDAAuD;IACvD,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,aAAa;CACL,CAAC;AA8DX,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,IAAI,GAAG,8BAA8B,CAAC;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,GAAG,8BAA8B,KAAK,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4C,CAAC;AAE5E,MAAM,UAAU,6BAA6B;IAC3C,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACpD,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,eAAmC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvH,eAAe,GAAG,iBAAiB,CAAC,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,UAAU,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,cAAc,GAAmB,IAAI,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,6BAA6B,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3J,MAAM,KAAK,GAAG,GAAG,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,cAAc,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,WAAW,UAAU,cAAc,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,MAAM,mCAAmC,EAAE,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,iCAAiC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,EAAE,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,6BAA6B,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACvF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACtC,SAAS;QACT,UAAU,EAAE,SAAS;QACrB,eAAe;QACf,QAAQ,EAAE,IAAI;QACd,cAAc;QACd,gBAAgB,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC9C,aAAa;QACb,QAAQ;QACR,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE;QACpE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE;QAC5C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,mCAAmC;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvG,OAAO,KAAK,KAAK,GAAG,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClH,OAAO,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAA4B;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO;IAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,8BAA8B,yBAAyB,QAAQ,wEAAwE,CAAC,CAAC;AAC9J,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAA4B,EAAE,IAAoB;IAC3F,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAA4B;IACpE,OAAO,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,MAA4B;IACjF,OAAO,CAAC,GAAG,uCAAuC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO;QACrF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACrD,GAAG,CAAC,SAAS,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,MAAM;YAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAAE,MAAM;YACpD,GAAG,CAAC,MAAM,CAAC,CAAC;YACZ,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACtH,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB,EAAE,MAAc;IAChD,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC;AAYD,MAAM,UAAU,cAAc,CAAC,OAAiC,EAAE,YAAqC,EAAE,UAA+B,EAAE;IACxI,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,IAAI,iCAAiC,CAAC,2DAA2D,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,yBAAyB,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,uCAAuC,CAAC,CAAC,CAAC;IAChI,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,oBAAoB,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvH,MAAM,IAAI,GAAa,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvG,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1G,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjJ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAiC;QAC7C,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,YAAY,CAAC,eAAe,IAAI,SAAS;QAC1D,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE;QAC3G,aAAa,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzD,YAAY,EAAE,IAAI;QAClB,oBAAoB;QACpB,eAAe,EAAE,CAAC,GAAG,yBAAyB,CAAC;QAC/C,aAAa,EAAE,QAAQ;QACvB,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;QACrD,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,aAAa;QACtB,aAAa,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;KACjG,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAiC,EAAE,SAA4B;IAClG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,8BAA8B,MAAM,IAAI,kDAAkD,CAAC,CAAC;IACzI,CAAC;IACD,MAAM,WAAW,GAA2B;QAC1C,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B;QACrF,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAS;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,yCAAyC,CAAC,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAiC,EAAE,UAAoC,EAAE;IAChH,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE;QAAE,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChJ,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;IACjI,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;QAClC,SAAS,EAAE,KAAK,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC"}

package/dist/releases/{release-1791263434955-18515-5948278e → release-1791270071086-18643-d14b01f3}/validators/commands.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { runShell } from "../utils/process.js";
 import { ISOLATION_PROVIDER_UNAVAILABLE, assertSupportedIsolationProvider, runIsolatedCommand, validatorIsolationEnvironmentAllowlist, validatorIsolationNetwork, validatorIsolationRequired } from "../security/isolation.js";
+import { validatorEvidenceWritablePaths } from "./toolCommand.js";
 export async function runValidationCommand(root, command, options = {}) {
     const cwd = path.resolve(root, command.workingDirectory ?? ".");
     const timeoutMs = (command.timeoutSeconds ?? 900) * 1000;
@@ -15,7 +16,10 @@ export async function runValidationCommand(root, command, options = {}) {
                 command: command.command,
                 cwd,
                 workspaceRoot: root,
-                writablePaths: [root],
+                // Unified with external/toolCommand validators: read-only workspace,
+                // only the evidence directory is writable. The previous `[root]`
+                // binding made the whole candidate tree writable inside the sandbox.
+                writablePaths: validatorEvidenceWritablePaths(root, options.config),
                 network: validatorIsolationNetwork(options.config),
                 timeoutMs
             }, { environmentAllowlist: validatorIsolationEnvironmentAllowlist(options.config) });

package/dist/releases/release-1791270071086-18643-d14b01f3/validators/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/validators/commands.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAsB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,kBAAkB,EAClB,sCAAsC,EACtC,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAA0B,EAAE,UAA6C,EAAE;IAClI,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChK,IAAI,MAAqB,CAAC;IAC1B,IAAI,SAA8C,CAAC;IACnD,IAAI,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,gCAAgC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;gBACxC,IAAI;gBACJ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG;gBACH,aAAa,EAAE,IAAI;gBACnB,qEAAqE;gBACrE,iEAAiE;gBACjE,qEAAqE;gBACrE,aAAa,EAAE,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;gBACnE,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClD,SAAS;aACV,EAAE,EAAE,oBAAoB,EAAE,sCAAsC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrF,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACzJ,SAAS,GAAG,QAAQ,CAAC,SAA+C,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC5H,OAAO,EAAE,EAAE,EAAE,WAAW,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,6DAA6D,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,yBAAyB,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3V,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IACrC,OAAO;QACL,EAAE,EAAE,WAAW,OAAO,CAAC,EAAE,EAAE;QAC3B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,0BAA0B,MAAM,CAAC,QAAQ,GAAG;QACrG,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE;YACP,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBAC5M,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACvI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1F,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC;AAChF,CAAC"}

package/dist/releases/release-1791270071086-18643-d14b01f3/validators/diffScope.js

@@ -0,0 +1,63 @@
+import { minimatch } from "minimatch";
+import { isSafeRepairScopePath, normalizeRepairScopePath } from "../candidates/repairScope.js";
+function matches(file, patterns) {
+    const normalizedFile = normalizeRepairScopePath(file.trim());
+    return patterns.some((raw) => {
+        const trimmed = raw.trim();
+        // DETERMINISTIC raw-traversal rejection BEFORE normalization (Luna
+        // broadening fix): `src/../**` posix-normalizes to `**`; reject the raw
+        // input so it never broadens to open scope. Fail-closed: an unsafe
+        // pattern never matches (grants nothing, denies nothing via broadening).
+        if (!isSafeRepairScopePath(trimmed))
+            return false;
+        const pattern = normalizeRepairScopePath(trimmed);
+        if (!pattern)
+            return false;
+        if (pattern === "**")
+            return true;
+        if (!normalizedFile)
+            return false;
+        return minimatch(normalizedFile, pattern, { dot: true, matchBase: false });
+    });
+}
+export function validateDiffScope(changedFiles, contract, globalFrozen = []) {
+    const checks = [];
+    const allowed = contract.scope?.allowed ?? [];
+    const forbidden = contract.scope?.forbidden ?? [];
+    const frozen = [...globalFrozen, ...(contract.scope?.frozen ?? [])];
+    // Fail-closed empty allowlist (C2): an empty/missing `allowed` denies all
+    // changes (outsideAllowed = all changed files). Only an explicit `["**"]`
+    // allowlist opens scope. This mirrors repair-scope fail-closed defaults:
+    // `run.ts` assembly defaults to `["**"]` only when `scope.allowed` is
+    // undefined, but validation treats missing/empty as closed so an
+    // unscoped contract cannot silently pass. Documented: closed by default,
+    // open only via explicit `["**"]`.
+    const outsideAllowed = allowed.length > 0
+        ? changedFiles.filter((f) => !matches(f, allowed))
+        : [...changedFiles];
+    checks.push({
+        id: "diff.allowed-scope",
+        category: "diff",
+        status: outsideAllowed.length ? "FAIL" : "PASS",
+        message: outsideAllowed.length ? `Files outside allowed scope: ${outsideAllowed.join(", ")}` : "All changed files are within allowed scope.",
+        details: { outsideAllowed }
+    });
+    const forbiddenChanged = forbidden.length ? changedFiles.filter((f) => matches(f, forbidden)) : [];
+    checks.push({
+        id: "diff.forbidden-paths",
+        category: "diff",
+        status: forbiddenChanged.length ? "FAIL" : "PASS",
+        message: forbiddenChanged.length ? `Forbidden paths changed: ${forbiddenChanged.join(", ")}` : "No forbidden paths changed.",
+        details: { forbiddenChanged }
+    });
+    const frozenChanged = frozen.length ? changedFiles.filter((f) => matches(f, frozen)) : [];
+    checks.push({
+        id: "diff.frozen-paths",
+        category: "trust-boundary",
+        status: frozenChanged.length ? "FAIL" : "PASS",
+        message: frozenChanged.length ? `Frozen validation/contract paths changed: ${frozenChanged.join(", ")}` : "Frozen paths were not modified.",
+        details: { frozenChanged }
+    });
+    return checks;
+}
+//# sourceMappingURL=diffScope.js.map

package/dist/releases/release-1791270071086-18643-d14b01f3/validators/diffScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diffScope.js","sourceRoot":"","sources":["../../src/validators/diffScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE/F,SAAS,OAAO,CAAC,IAAY,EAAE,QAAkB;IAC/C,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,mEAAmE;QACnE,wEAAwE;QACxE,mEAAmE;QACnE,yEAAyE;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAsB,EAAE,QAAsB,EAAE,eAAyB,EAAE;IAC3G,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACvC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC/C,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,6CAA6C;QAC5I,OAAO,EAAE,EAAE,cAAc,EAAE;KAC5B,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,sBAAsB;QAC1B,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACjD,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B;QAC5H,OAAO,EAAE,EAAE,gBAAgB,EAAE;KAC9B,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC9C,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC;QAC3I,OAAO,EAAE,EAAE,aAAa,EAAE;KAC3B,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}