assertledger 1.0.0 → 1.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.fr.md +3 -3
- package/README.md +3 -3
- package/SECURITY.md +11 -6
- package/conformance/schema-extensions.json +36 -0
- package/dist/build-info.d.ts +16 -0
- package/dist/build-info.d.ts.map +1 -0
- package/dist/build-info.js +18 -0
- package/dist/build-info.js.map +1 -0
- package/dist/build-info.json +7 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +117 -19
- package/dist/cli.js.map +1 -1
- package/dist/contracts/index.d.ts +943 -0
- package/dist/contracts/index.d.ts.map +1 -1
- package/dist/contracts/index.js +561 -21
- package/dist/contracts/index.js.map +1 -1
- package/dist/core/index.d.ts +10 -1
- package/dist/core/index.d.ts.map +1 -1
- package/dist/core/index.js +484 -8
- package/dist/core/index.js.map +1 -1
- package/dist/diagnostics.d.ts.map +1 -1
- package/dist/diagnostics.js +42 -2
- package/dist/diagnostics.js.map +1 -1
- package/dist/engine/adapters/node-test-runtime.d.ts +17 -0
- package/dist/engine/adapters/node-test-runtime.d.ts.map +1 -1
- package/dist/engine/adapters/node-test-runtime.js +45 -23
- package/dist/engine/adapters/node-test-runtime.js.map +1 -1
- package/dist/engine/container.d.ts +54 -0
- package/dist/engine/container.d.ts.map +1 -0
- package/dist/engine/container.js +464 -0
- package/dist/engine/container.js.map +1 -0
- package/dist/engine/git-regression.d.ts +12 -2
- package/dist/engine/git-regression.d.ts.map +1 -1
- package/dist/engine/git-regression.js +63 -16
- package/dist/engine/git-regression.js.map +1 -1
- package/dist/engine/index.d.ts +7 -1
- package/dist/engine/index.d.ts.map +1 -1
- package/dist/engine/index.js +300 -74
- package/dist/engine/index.js.map +1 -1
- package/dist/mcp/index.d.ts.map +1 -1
- package/dist/mcp/index.js +53 -1
- package/dist/mcp/index.js.map +1 -1
- package/dist/proof-planner/carry-over.d.ts +21 -0
- package/dist/proof-planner/carry-over.d.ts.map +1 -0
- package/dist/proof-planner/carry-over.js +212 -0
- package/dist/proof-planner/carry-over.js.map +1 -0
- package/dist/proof-planner/index.d.ts +11 -0
- package/dist/proof-planner/index.d.ts.map +1 -0
- package/dist/proof-planner/index.js +11 -0
- package/dist/proof-planner/index.js.map +1 -0
- package/dist/proof-planner/model.d.ts +272 -0
- package/dist/proof-planner/model.d.ts.map +1 -0
- package/dist/proof-planner/model.js +215 -0
- package/dist/proof-planner/model.js.map +1 -0
- package/dist/proof-planner/plan.d.ts +140 -0
- package/dist/proof-planner/plan.d.ts.map +1 -0
- package/dist/proof-planner/plan.js +1124 -0
- package/dist/proof-planner/plan.js.map +1 -0
- package/dist/proof-planner/policy.d.ts +100 -0
- package/dist/proof-planner/policy.d.ts.map +1 -0
- package/dist/proof-planner/policy.js +407 -0
- package/dist/proof-planner/policy.js.map +1 -0
- package/dist/proof-planner/render.d.ts +4 -0
- package/dist/proof-planner/render.d.ts.map +1 -0
- package/dist/proof-planner/render.js +73 -0
- package/dist/proof-planner/render.js.map +1 -0
- package/dist/sdk/index.d.ts +16 -6
- package/dist/sdk/index.d.ts.map +1 -1
- package/dist/sdk/index.js +63 -5
- package/dist/sdk/index.js.map +1 -1
- package/docs/agentic-test-profile.md +5 -0
- package/docs/architecture.md +15 -3
- package/docs/ci.md +7 -1
- package/docs/conformance-v1.md +11 -2
- package/docs/container-isolation.md +156 -0
- package/docs/evidence-export.md +146 -0
- package/docs/git-regression.md +7 -3
- package/docs/migration-timeout-discovery-inconclusive.md +126 -0
- package/docs/migration-verification-v2.md +55 -0
- package/docs/project-intent.md +3 -2
- package/docs/proof-model.md +28 -6
- package/docs/proof-planner.md +368 -0
- package/docs/reference.md +59 -12
- package/docs/roadmap.md +12 -4
- package/examples/agentic-profile/profile-manifest.mjs +5 -1
- package/examples/evidence-export/consumer.mjs +35 -0
- package/package.json +5 -5
- package/schemas/evidence-export-replay-result.v1.json +49 -0
- package/schemas/evidence-export-request.v1.json +681 -0
- package/schemas/evidence-export.v1.json +1479 -0
- package/schemas/evidence-manifest.v2.json +886 -0
- package/schemas/evidence-provider-manifest.v1.json +269 -0
- package/schemas/verification-request.v2.json +457 -0
|
@@ -0,0 +1,464 @@
|
|
|
1
|
+
import { randomUUID } from "node:crypto";
|
|
2
|
+
import { createReadStream } from "node:fs";
|
|
3
|
+
import { lstat, readdir } from "node:fs/promises";
|
|
4
|
+
import path from "node:path";
|
|
5
|
+
// Container backend for a Docker-compatible CLI. Nothing on the host is mounted into the container:
|
|
6
|
+
// the prepared workspace is streamed into an anonymous volume, only the bounded result file is read
|
|
7
|
+
// back as an archive in memory, and every container is removed after one execution.
|
|
8
|
+
export const DEFAULT_CONTAINER_RUNTIME_COMMAND = ["docker"];
|
|
9
|
+
export const DEFAULT_CONTAINER_LIMITS = {
|
|
10
|
+
memoryBytes: 1_073_741_824,
|
|
11
|
+
cpuMillicores: 2_000,
|
|
12
|
+
pids: 256,
|
|
13
|
+
temporaryDirectoryBytes: 67_108_864,
|
|
14
|
+
};
|
|
15
|
+
export const CONTAINER_ROOT = "/assertledger";
|
|
16
|
+
export const CONTAINER_WORKSPACE = `${CONTAINER_ROOT}/repository`;
|
|
17
|
+
export const CONTAINER_RESULT_FILE = `${CONTAINER_ROOT}/out/result.json`;
|
|
18
|
+
export const CONTAINER_REPORTER_FILE = `${CONTAINER_ROOT}/reporter/node-test-reporter.mjs`;
|
|
19
|
+
export const CONTAINER_LIMITATIONS = [
|
|
20
|
+
"Container isolation relies on the operator-administered container runtime and the shared host kernel; it is not a virtual machine boundary.",
|
|
21
|
+
"The writable workspace volume has no size limit enforced by AssertLedger; container storage limits remain operator-administered.",
|
|
22
|
+
"An interrupted AssertLedger process can leave a container labeled assertledger.execution until the operator removes it.",
|
|
23
|
+
"The image contents and declared environment values are operator inputs; AssertLedger verifies the image digest but does not inspect its contents.",
|
|
24
|
+
];
|
|
25
|
+
const SANDBOX_ID = 65_534;
|
|
26
|
+
const SANDBOX_USER = `${SANDBOX_ID}:${SANDBOX_ID}`;
|
|
27
|
+
const CONTROL_TIMEOUT_MS = 30_000;
|
|
28
|
+
const LIFECYCLE_TIMEOUT_MS = 120_000;
|
|
29
|
+
const UPLOAD_TIMEOUT_MS = 600_000;
|
|
30
|
+
const CONTROL_OUTPUT_BYTES = 1_048_576;
|
|
31
|
+
const RESULT_ARCHIVE_OVERHEAD_BYTES = 16_384;
|
|
32
|
+
const TAR_BLOCK_BYTES = 512;
|
|
33
|
+
const EMPTY_OUTPUT_DIGEST = "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
|
|
34
|
+
function runtime(context, args, timeoutMs, maximumOutputBytes, standardInput) {
|
|
35
|
+
const [executable, ...prefix] = context.command;
|
|
36
|
+
return context.runner({
|
|
37
|
+
executable: executable,
|
|
38
|
+
args: [...prefix, ...args],
|
|
39
|
+
cwd: context.workingDirectory,
|
|
40
|
+
environment: Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
|
|
41
|
+
timeoutMs,
|
|
42
|
+
maximumOutputBytes,
|
|
43
|
+
}, standardInput);
|
|
44
|
+
}
|
|
45
|
+
/** Validates an operator runtime command: a non-empty argv array, never a shell string. */
|
|
46
|
+
export function parseContainerRuntimeCommand(value) {
|
|
47
|
+
let command = value;
|
|
48
|
+
if (typeof value === "string") {
|
|
49
|
+
try {
|
|
50
|
+
command = JSON.parse(value);
|
|
51
|
+
}
|
|
52
|
+
catch {
|
|
53
|
+
throw backendError("CONTAINER_RUNTIME_COMMAND_INVALID");
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
if (!Array.isArray(command) ||
|
|
57
|
+
command.length === 0 ||
|
|
58
|
+
command.length > 16 ||
|
|
59
|
+
!command.every((part) => typeof part === "string" && part.length > 0 && part.length <= 4_096)) {
|
|
60
|
+
throw backendError("CONTAINER_RUNTIME_COMMAND_INVALID");
|
|
61
|
+
}
|
|
62
|
+
return [...command];
|
|
63
|
+
}
|
|
64
|
+
function isRecord(value) {
|
|
65
|
+
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
66
|
+
}
|
|
67
|
+
function boundedString(value, maximumLength, minimumLength = 1) {
|
|
68
|
+
return typeof value === "string" && value.length >= minimumLength && value.length <= maximumLength
|
|
69
|
+
? value
|
|
70
|
+
: undefined;
|
|
71
|
+
}
|
|
72
|
+
function backendError(code, detail) {
|
|
73
|
+
return new Error(code, detail === undefined ? undefined : { cause: detail });
|
|
74
|
+
}
|
|
75
|
+
function parseJsonOutput(result) {
|
|
76
|
+
if (result.outcome !== "PASS" || result.stdout.truncated)
|
|
77
|
+
return undefined;
|
|
78
|
+
try {
|
|
79
|
+
return JSON.parse(result.stdout.text.trim());
|
|
80
|
+
}
|
|
81
|
+
catch {
|
|
82
|
+
return undefined;
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
function runtimeDetail(result) {
|
|
86
|
+
return (result.error ?? result.stderr.text).trim().slice(0, 1_024);
|
|
87
|
+
}
|
|
88
|
+
/** Probes the runtime and the pinned image without pulling, creating or starting anything. */
|
|
89
|
+
export async function prepareContainerBackend(command, isolation, runner, workingDirectory) {
|
|
90
|
+
const context = {
|
|
91
|
+
command: parseContainerRuntimeCommand(command),
|
|
92
|
+
runner,
|
|
93
|
+
workingDirectory,
|
|
94
|
+
};
|
|
95
|
+
const version = await runtime(context, ["version", "--format={{json .}}"], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
96
|
+
if (version.outcome === "INFRA_ERROR") {
|
|
97
|
+
throw backendError("CONTAINER_RUNTIME_NOT_FOUND", runtimeDetail(version));
|
|
98
|
+
}
|
|
99
|
+
const versionReport = parseJsonOutput(version);
|
|
100
|
+
const client = isRecord(versionReport) ? versionReport.Client : undefined;
|
|
101
|
+
const server = isRecord(versionReport) ? versionReport.Server : undefined;
|
|
102
|
+
if (!isRecord(client) || !isRecord(server)) {
|
|
103
|
+
throw backendError("CONTAINER_RUNTIME_UNAVAILABLE", runtimeDetail(version));
|
|
104
|
+
}
|
|
105
|
+
const clientVersion = boundedString(client.Version, 128);
|
|
106
|
+
const serverVersion = boundedString(server.Version, 128);
|
|
107
|
+
const serverArchitecture = boundedString(server.Arch, 64);
|
|
108
|
+
if (clientVersion === undefined ||
|
|
109
|
+
serverVersion === undefined ||
|
|
110
|
+
serverArchitecture === undefined) {
|
|
111
|
+
throw backendError("CONTAINER_RUNTIME_UNAVAILABLE", "unrecognized runtime version report");
|
|
112
|
+
}
|
|
113
|
+
if (server.Os !== "linux") {
|
|
114
|
+
throw backendError("CONTAINER_RUNTIME_PLATFORM_UNSUPPORTED", String(server.Os));
|
|
115
|
+
}
|
|
116
|
+
const info = parseJsonOutput(await runtime(context, ["info", "--format={{json .}}"], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES));
|
|
117
|
+
const securityOptions = isRecord(info) ? info.SecurityOptions : undefined;
|
|
118
|
+
const cgroupVersion = isRecord(info) ? boundedString(info.CgroupVersion ?? "", 16, 0) : undefined;
|
|
119
|
+
if (cgroupVersion === undefined ||
|
|
120
|
+
!Array.isArray(securityOptions) ||
|
|
121
|
+
securityOptions.length > 64 ||
|
|
122
|
+
!securityOptions.every((option) => boundedString(option, 512) !== undefined)) {
|
|
123
|
+
throw backendError("CONTAINER_RUNTIME_UNAVAILABLE", "unrecognized runtime information report");
|
|
124
|
+
}
|
|
125
|
+
const inspected = await runtime(context, ["image", "inspect", "--format={{json .}}", isolation.image], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
126
|
+
if (inspected.outcome !== "PASS") {
|
|
127
|
+
throw backendError("CONTAINER_IMAGE_NOT_PRESENT", runtimeDetail(inspected));
|
|
128
|
+
}
|
|
129
|
+
const image = parseJsonOutput(inspected);
|
|
130
|
+
if (!isRecord(image)) {
|
|
131
|
+
throw backendError("CONTAINER_RUNTIME_UNAVAILABLE", "unrecognized image inspection report");
|
|
132
|
+
}
|
|
133
|
+
if (image.Os !== "linux") {
|
|
134
|
+
throw backendError("CONTAINER_IMAGE_PLATFORM_UNSUPPORTED", String(image.Os));
|
|
135
|
+
}
|
|
136
|
+
const digest = isolation.image.slice(isolation.image.lastIndexOf("@") + 1);
|
|
137
|
+
const repositoryDigests = Array.isArray(image.RepoDigests) ? image.RepoDigests : [];
|
|
138
|
+
const imageId = typeof image.Id === "string" ? image.Id : "";
|
|
139
|
+
const architecture = boundedString(image.Architecture, 64);
|
|
140
|
+
if (!/^sha256:[a-f0-9]{64}$/u.test(imageId) ||
|
|
141
|
+
architecture === undefined ||
|
|
142
|
+
!(imageId === digest ||
|
|
143
|
+
repositoryDigests.some((value) => typeof value === "string" && value.endsWith(`@${digest}`)))) {
|
|
144
|
+
throw backendError("CONTAINER_IMAGE_DIGEST_MISMATCH", imageId);
|
|
145
|
+
}
|
|
146
|
+
return {
|
|
147
|
+
runtimeCommand: [...context.command],
|
|
148
|
+
isolation,
|
|
149
|
+
record: {
|
|
150
|
+
kind: "container",
|
|
151
|
+
level: "CONTAINER",
|
|
152
|
+
image: { reference: isolation.image, id: imageId, os: "linux", architecture },
|
|
153
|
+
runtime: {
|
|
154
|
+
clientVersion,
|
|
155
|
+
serverVersion,
|
|
156
|
+
serverOs: "linux",
|
|
157
|
+
serverArchitecture,
|
|
158
|
+
cgroupVersion,
|
|
159
|
+
securityOptions: securityOptions,
|
|
160
|
+
},
|
|
161
|
+
controls: {
|
|
162
|
+
network: "none",
|
|
163
|
+
rootFilesystem: "read-only",
|
|
164
|
+
hostMounts: "none",
|
|
165
|
+
workspace: "anonymous-volume",
|
|
166
|
+
user: SANDBOX_USER,
|
|
167
|
+
capabilities: "none",
|
|
168
|
+
noNewPrivileges: true,
|
|
169
|
+
imagePull: "never",
|
|
170
|
+
logDriver: "none",
|
|
171
|
+
environment: isolation.environment.map(({ name, value }) => ({ name, value })),
|
|
172
|
+
limits: { ...isolation.limits },
|
|
173
|
+
},
|
|
174
|
+
},
|
|
175
|
+
};
|
|
176
|
+
}
|
|
177
|
+
function writeOctal(header, offset, length, value) {
|
|
178
|
+
header.write(`${value.toString(8).padStart(length - 1, "0")}\0`, offset, length, "ascii");
|
|
179
|
+
}
|
|
180
|
+
function paxRecord(key, value) {
|
|
181
|
+
const body = ` ${key}=${value}\n`;
|
|
182
|
+
const bodyBytes = Buffer.byteLength(body, "utf8");
|
|
183
|
+
let length = bodyBytes + 1;
|
|
184
|
+
while (String(length).length + bodyBytes !== length)
|
|
185
|
+
length = String(length).length + bodyBytes;
|
|
186
|
+
return `${length}${body}`;
|
|
187
|
+
}
|
|
188
|
+
function padding(size) {
|
|
189
|
+
return Buffer.alloc((TAR_BLOCK_BYTES - (size % TAR_BLOCK_BYTES)) % TAR_BLOCK_BYTES, 0);
|
|
190
|
+
}
|
|
191
|
+
function ustarHeader(name, type, size, mode, owner) {
|
|
192
|
+
const header = Buffer.alloc(TAR_BLOCK_BYTES, 0);
|
|
193
|
+
header.write(name, 0, 100, "utf8");
|
|
194
|
+
writeOctal(header, 100, 8, mode);
|
|
195
|
+
writeOctal(header, 108, 8, owner);
|
|
196
|
+
writeOctal(header, 116, 8, owner);
|
|
197
|
+
writeOctal(header, 124, 12, size);
|
|
198
|
+
writeOctal(header, 136, 12, 0);
|
|
199
|
+
header.fill(0x20, 148, 156);
|
|
200
|
+
header.write(type, 156, 1, "ascii");
|
|
201
|
+
header.write("ustar\0", 257, 6, "ascii");
|
|
202
|
+
header.write("00", 263, 2, "ascii");
|
|
203
|
+
const checksum = header.reduce((total, byte) => total + byte, 0);
|
|
204
|
+
header.write(`${checksum.toString(8).padStart(6, "0")}\0 `, 148, 8, "ascii");
|
|
205
|
+
return header;
|
|
206
|
+
}
|
|
207
|
+
function* entryHeaders(name, type, size, mode, owner) {
|
|
208
|
+
// Names that do not fit an ASCII ustar field, and sizes beyond its octal range, use PAX records.
|
|
209
|
+
const asciiName = /^[\x20-\x7e]*$/u.test(name) && Buffer.byteLength(name) <= 100;
|
|
210
|
+
const records = [
|
|
211
|
+
...(asciiName ? [] : [paxRecord("path", name)]),
|
|
212
|
+
...(size < 8 ** 11 ? [] : [paxRecord("size", String(size))]),
|
|
213
|
+
];
|
|
214
|
+
if (records.length > 0) {
|
|
215
|
+
const body = Buffer.from(records.join(""), "utf8");
|
|
216
|
+
yield ustarHeader("PaxHeader", "x", body.length, 0o644, 0);
|
|
217
|
+
yield body;
|
|
218
|
+
yield padding(body.length);
|
|
219
|
+
}
|
|
220
|
+
yield ustarHeader(asciiName ? name : `entry${type === "5" ? "/" : ""}`, type, size < 8 ** 11 ? size : 0, mode, owner);
|
|
221
|
+
}
|
|
222
|
+
async function* workspaceEntries(directory, archivePath) {
|
|
223
|
+
const names = (await readdir(directory)).sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
|
|
224
|
+
for (const name of names) {
|
|
225
|
+
const hostPath = path.join(directory, name);
|
|
226
|
+
const entryPath = `${archivePath}/${name}`;
|
|
227
|
+
const stats = await lstat(hostPath);
|
|
228
|
+
if (stats.isDirectory()) {
|
|
229
|
+
yield* entryHeaders(`${entryPath}/`, "5", 0, 0o755, SANDBOX_ID);
|
|
230
|
+
yield* workspaceEntries(hostPath, entryPath);
|
|
231
|
+
}
|
|
232
|
+
else if (stats.isFile()) {
|
|
233
|
+
yield* entryHeaders(entryPath, "0", stats.size, 0o644, SANDBOX_ID);
|
|
234
|
+
let streamed = 0;
|
|
235
|
+
for await (const chunk of createReadStream(hostPath)) {
|
|
236
|
+
const bytes = chunk;
|
|
237
|
+
streamed += bytes.byteLength;
|
|
238
|
+
if (streamed > stats.size)
|
|
239
|
+
throw new Error("CONTAINER_WORKSPACE_CHANGED");
|
|
240
|
+
yield bytes;
|
|
241
|
+
}
|
|
242
|
+
if (streamed !== stats.size)
|
|
243
|
+
throw new Error("CONTAINER_WORKSPACE_CHANGED");
|
|
244
|
+
yield padding(stats.size);
|
|
245
|
+
}
|
|
246
|
+
else {
|
|
247
|
+
throw new Error("CONTAINER_WORKSPACE_ENTRY_UNSUPPORTED");
|
|
248
|
+
}
|
|
249
|
+
}
|
|
250
|
+
}
|
|
251
|
+
async function* uploadArchive(workspace, reporterSource) {
|
|
252
|
+
yield* entryHeaders("out/", "5", 0, 0o755, SANDBOX_ID);
|
|
253
|
+
if (reporterSource !== undefined) {
|
|
254
|
+
const reporter = Buffer.from(reporterSource, "utf8");
|
|
255
|
+
yield* entryHeaders("reporter/", "5", 0, 0o555, 0);
|
|
256
|
+
yield* entryHeaders("reporter/node-test-reporter.mjs", "0", reporter.length, 0o444, 0);
|
|
257
|
+
yield reporter;
|
|
258
|
+
yield padding(reporter.length);
|
|
259
|
+
}
|
|
260
|
+
yield* entryHeaders("repository/", "5", 0, 0o755, SANDBOX_ID);
|
|
261
|
+
yield* workspaceEntries(workspace, "repository");
|
|
262
|
+
yield Buffer.alloc(TAR_BLOCK_BYTES * 2, 0);
|
|
263
|
+
}
|
|
264
|
+
function readOctal(header, offset, length) {
|
|
265
|
+
const text = header
|
|
266
|
+
.subarray(offset, offset + length)
|
|
267
|
+
.toString("ascii")
|
|
268
|
+
.replace(/[\0 ]+$/u, "");
|
|
269
|
+
return /^[0-7]+$/u.test(text) ? Number.parseInt(text, 8) : undefined;
|
|
270
|
+
}
|
|
271
|
+
function nulTerminated(buffer) {
|
|
272
|
+
const end = buffer.indexOf(0);
|
|
273
|
+
return buffer.subarray(0, end < 0 ? buffer.length : end).toString("utf8");
|
|
274
|
+
}
|
|
275
|
+
/**
|
|
276
|
+
* Extracts the single regular `result.json` entry that `cp CONTAINER:FILE -` streams. Links, extra
|
|
277
|
+
* entries, other names, corrupt headers, truncation and oversize content are all rejected.
|
|
278
|
+
*/
|
|
279
|
+
function readContainerResultArchive(archive, maximumBytes) {
|
|
280
|
+
let offset = 0;
|
|
281
|
+
let paxPath;
|
|
282
|
+
let paxSize;
|
|
283
|
+
let result;
|
|
284
|
+
while (offset + TAR_BLOCK_BYTES <= archive.length) {
|
|
285
|
+
const header = archive.subarray(offset, offset + TAR_BLOCK_BYTES);
|
|
286
|
+
if (header.every((byte) => byte === 0))
|
|
287
|
+
return result;
|
|
288
|
+
const recordedChecksum = readOctal(header, 148, 8);
|
|
289
|
+
const checksum = header.reduce((total, byte, index) => total + (index >= 148 && index < 156 ? 0x20 : byte), 0);
|
|
290
|
+
const headerSize = readOctal(header, 124, 12);
|
|
291
|
+
if (recordedChecksum !== checksum || headerSize === undefined)
|
|
292
|
+
return undefined;
|
|
293
|
+
const size = paxSize ?? headerSize;
|
|
294
|
+
const dataStart = offset + TAR_BLOCK_BYTES;
|
|
295
|
+
const next = dataStart + size + padding(size).length;
|
|
296
|
+
if (next > archive.length)
|
|
297
|
+
return undefined;
|
|
298
|
+
const data = archive.subarray(dataStart, dataStart + size);
|
|
299
|
+
const type = String.fromCharCode(header[156] ?? 0);
|
|
300
|
+
offset = next;
|
|
301
|
+
if (type === "x" || type === "g") {
|
|
302
|
+
if (type === "g")
|
|
303
|
+
continue;
|
|
304
|
+
for (const record of data.toString("utf8").split("\n")) {
|
|
305
|
+
const match = /^\d+ (path|size)=(.*)$/su.exec(record);
|
|
306
|
+
if (match?.[1] === "path")
|
|
307
|
+
paxPath = match[2];
|
|
308
|
+
if (match?.[1] === "size")
|
|
309
|
+
paxSize = /^\d+$/u.test(match[2] ?? "") ? Number(match[2]) : NaN;
|
|
310
|
+
}
|
|
311
|
+
if (Number.isNaN(paxSize))
|
|
312
|
+
return undefined;
|
|
313
|
+
continue;
|
|
314
|
+
}
|
|
315
|
+
const prefix = nulTerminated(header.subarray(345, 500));
|
|
316
|
+
const shortName = nulTerminated(header.subarray(0, 100));
|
|
317
|
+
const name = paxPath ?? (prefix.length > 0 ? `${prefix}/${shortName}` : shortName);
|
|
318
|
+
paxPath = undefined;
|
|
319
|
+
paxSize = undefined;
|
|
320
|
+
if (result !== undefined ||
|
|
321
|
+
(type !== "0" && type !== "\0") ||
|
|
322
|
+
name !== "result.json" ||
|
|
323
|
+
size > maximumBytes) {
|
|
324
|
+
return undefined;
|
|
325
|
+
}
|
|
326
|
+
result = Buffer.from(data);
|
|
327
|
+
}
|
|
328
|
+
return undefined;
|
|
329
|
+
}
|
|
330
|
+
export const readContainerResultArchiveForTesting = readContainerResultArchive;
|
|
331
|
+
async function inspectState(context, name) {
|
|
332
|
+
const state = parseJsonOutput(await runtime(context, ["inspect", "--type=container", "--format={{json .State}}", name], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES));
|
|
333
|
+
if (!isRecord(state) ||
|
|
334
|
+
typeof state.Status !== "string" ||
|
|
335
|
+
!Number.isSafeInteger(state.ExitCode) ||
|
|
336
|
+
typeof state.Error !== "string" ||
|
|
337
|
+
typeof state.StartedAt !== "string") {
|
|
338
|
+
return undefined;
|
|
339
|
+
}
|
|
340
|
+
return {
|
|
341
|
+
status: state.Status,
|
|
342
|
+
exitCode: state.ExitCode,
|
|
343
|
+
error: state.Error,
|
|
344
|
+
startedAt: state.StartedAt,
|
|
345
|
+
};
|
|
346
|
+
}
|
|
347
|
+
function emptyOutput() {
|
|
348
|
+
return { text: "", totalBytes: 0, truncated: false, digest: EMPTY_OUTPUT_DIGEST };
|
|
349
|
+
}
|
|
350
|
+
function infrastructureFailure(source) {
|
|
351
|
+
return {
|
|
352
|
+
outcome: "INFRA_ERROR",
|
|
353
|
+
exitCode: null,
|
|
354
|
+
signal: null,
|
|
355
|
+
timedOut: false,
|
|
356
|
+
durationMs: source?.durationMs ?? 0,
|
|
357
|
+
stdout: source?.stdout ?? emptyOutput(),
|
|
358
|
+
stderr: source?.stderr ?? emptyOutput(),
|
|
359
|
+
...(source?.error === undefined ? {} : { error: source.error }),
|
|
360
|
+
};
|
|
361
|
+
}
|
|
362
|
+
function formatCpus(millicores) {
|
|
363
|
+
return String(millicores / 1_000);
|
|
364
|
+
}
|
|
365
|
+
/** Executes one adapter process in a fresh container and always removes that container. */
|
|
366
|
+
export async function runContainerExecution(backend, execution, runner, workingDirectory) {
|
|
367
|
+
const context = { command: backend.runtimeCommand, runner, workingDirectory };
|
|
368
|
+
const limits = backend.isolation.limits;
|
|
369
|
+
const name = `assertledger-${randomUUID()}`;
|
|
370
|
+
const environment = new Map(backend.isolation.environment.map(({ name: key, value }) => [key, value]));
|
|
371
|
+
for (const [key, value] of Object.entries(execution.environment))
|
|
372
|
+
environment.set(key, value);
|
|
373
|
+
const createArguments = [
|
|
374
|
+
"create",
|
|
375
|
+
"--pull=never",
|
|
376
|
+
`--name=${name}`,
|
|
377
|
+
`--label=assertledger.execution=${name}`,
|
|
378
|
+
"--network=none",
|
|
379
|
+
"--read-only",
|
|
380
|
+
`--mount=type=volume,target=${CONTAINER_ROOT}`,
|
|
381
|
+
`--tmpfs=/tmp:rw,nosuid,nodev,size=${limits.temporaryDirectoryBytes}`,
|
|
382
|
+
`--user=${SANDBOX_USER}`,
|
|
383
|
+
"--cap-drop=ALL",
|
|
384
|
+
"--security-opt=no-new-privileges",
|
|
385
|
+
`--pids-limit=${limits.pids}`,
|
|
386
|
+
`--memory=${limits.memoryBytes}`,
|
|
387
|
+
`--memory-swap=${limits.memoryBytes}`,
|
|
388
|
+
`--cpus=${formatCpus(limits.cpuMillicores)}`,
|
|
389
|
+
"--log-driver=none",
|
|
390
|
+
`--workdir=${CONTAINER_WORKSPACE}`,
|
|
391
|
+
...[...environment.entries()]
|
|
392
|
+
.sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
|
|
393
|
+
.map(([key, value]) => `--env=${key}=${value}`),
|
|
394
|
+
`--entrypoint=${execution.executable}`,
|
|
395
|
+
backend.isolation.image,
|
|
396
|
+
...execution.args,
|
|
397
|
+
];
|
|
398
|
+
let created;
|
|
399
|
+
let outcome;
|
|
400
|
+
let failure;
|
|
401
|
+
try {
|
|
402
|
+
created = await runtime(context, createArguments, LIFECYCLE_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
403
|
+
if (created.outcome !== "PASS") {
|
|
404
|
+
outcome = { process: infrastructureFailure(created), result: undefined };
|
|
405
|
+
}
|
|
406
|
+
else {
|
|
407
|
+
const uploaded = await runtime(context, ["cp", "--archive", "-", `${name}:${CONTAINER_ROOT}`], UPLOAD_TIMEOUT_MS, CONTROL_OUTPUT_BYTES, uploadArchive(execution.workspace, execution.reporterSource));
|
|
408
|
+
if (uploaded.outcome !== "PASS") {
|
|
409
|
+
outcome = { process: infrastructureFailure(uploaded), result: undefined };
|
|
410
|
+
}
|
|
411
|
+
else {
|
|
412
|
+
outcome = await startAndCollect(context, name, execution);
|
|
413
|
+
}
|
|
414
|
+
}
|
|
415
|
+
}
|
|
416
|
+
catch (error) {
|
|
417
|
+
failure = error;
|
|
418
|
+
}
|
|
419
|
+
const removed = await runtime(context, ["rm", "--force", "--volumes", name], LIFECYCLE_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
420
|
+
if (removed.outcome !== "PASS" && created?.outcome === "PASS") {
|
|
421
|
+
throw backendError("CONTAINER_CLEANUP_FAILED", `${name}: ${runtimeDetail(removed)}`);
|
|
422
|
+
}
|
|
423
|
+
if (failure !== undefined)
|
|
424
|
+
throw failure;
|
|
425
|
+
return outcome;
|
|
426
|
+
}
|
|
427
|
+
async function startAndCollect(context, name, execution) {
|
|
428
|
+
const run = await runtime(context, ["start", "--attach", name], execution.timeoutMs, execution.maximumOutputBytes);
|
|
429
|
+
if (run.outcome === "TIMEOUT") {
|
|
430
|
+
// Killing the attached client does not stop the container; the runtime kills its cgroup.
|
|
431
|
+
await runtime(context, ["kill", name], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
432
|
+
const { stdoutBytes: _stdoutBytes, ...timedOut } = run;
|
|
433
|
+
return { process: { ...timedOut, exitCode: null, signal: null }, result: undefined };
|
|
434
|
+
}
|
|
435
|
+
const state = await inspectState(context, name);
|
|
436
|
+
if (run.outcome === "INFRA_ERROR" ||
|
|
437
|
+
state === undefined ||
|
|
438
|
+
state.status !== "exited" ||
|
|
439
|
+
state.error !== "" ||
|
|
440
|
+
state.startedAt.startsWith("0001-") ||
|
|
441
|
+
state.exitCode !== run.exitCode) {
|
|
442
|
+
if (state?.status === "running") {
|
|
443
|
+
await runtime(context, ["kill", name], CONTROL_TIMEOUT_MS, CONTROL_OUTPUT_BYTES);
|
|
444
|
+
}
|
|
445
|
+
return { process: infrastructureFailure(run), result: undefined };
|
|
446
|
+
}
|
|
447
|
+
const { stdoutBytes: _stdoutBytes, ...completed } = run;
|
|
448
|
+
const process = {
|
|
449
|
+
...completed,
|
|
450
|
+
outcome: state.exitCode === 0 ? "PASS" : "PROCESS_CRASH",
|
|
451
|
+
exitCode: state.exitCode,
|
|
452
|
+
};
|
|
453
|
+
const maximumBytes = execution.resultMaximumBytes ?? 0;
|
|
454
|
+
if (maximumBytes === 0)
|
|
455
|
+
return { process, result: undefined };
|
|
456
|
+
const copied = await runtime(context, ["cp", `${name}:${CONTAINER_RESULT_FILE}`, "-"], CONTROL_TIMEOUT_MS, maximumBytes + RESULT_ARCHIVE_OVERHEAD_BYTES);
|
|
457
|
+
return {
|
|
458
|
+
process,
|
|
459
|
+
result: copied.outcome === "PASS" && !copied.stdout.truncated
|
|
460
|
+
? readContainerResultArchive(copied.stdoutBytes, maximumBytes)
|
|
461
|
+
: undefined,
|
|
462
|
+
};
|
|
463
|
+
}
|
|
464
|
+
//# sourceMappingURL=container.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/engine/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,oGAAoG;AACpG,oGAAoG;AACpG,oFAAoF;AAEpF,MAAM,CAAC,MAAM,iCAAiC,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,KAAK;IACpB,IAAI,EAAE,GAAG;IACT,uBAAuB,EAAE,UAAU;CAC3B,CAAC;AACX,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,cAAc,aAAa,CAAC;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,cAAc,kBAAkB,CAAC;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,cAAc,kCAAkC,CAAC;AAC3F,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,6IAA6I;IAC7I,kIAAkI;IAClI,yHAAyH;IACzH,mJAAmJ;CACpJ,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,YAAY,GAAG,GAAG,UAAU,IAAI,UAAU,EAAE,CAAC;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,mBAAmB,GACvB,yEAAyE,CAAC;AAyC5E,SAAS,OAAO,CACd,OAAuB,EACvB,IAAc,EACd,SAAiB,EACjB,kBAA0B,EAC1B,aAAyC;IAEzC,MAAM,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,CACnB;QACE,UAAU,EAAE,UAAoB;QAChC,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QAC1B,GAAG,EAAE,OAAO,CAAC,gBAAgB;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF;QACD,SAAS;QACT,kBAAkB;KACnB,EACD,aAAa,CACd,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,EAAE;QACnB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,EAC7F,CAAC;QACD,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAI,OAAoB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,aAAqB,EACrB,aAAa,GAAG,CAAC;IAEjB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa;QAChG,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAe;IACjD,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,eAAe,CAAC,MAA4B;IACnD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAY,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAA4B;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA0B,EAC1B,SAA6B,EAC7B,MAA8B,EAC9B,gBAAwB;IAExB,MAAM,OAAO,GAAmB;QAC9B,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC;QAC9C,MAAM;QACN,gBAAgB;KACjB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,OAAO,EACP,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAClC,kBAAkB,EAClB,oBAAoB,CACrB,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,6BAA6B,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,YAAY,CAAC,+BAA+B,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,IACE,aAAa,KAAK,SAAS;QAC3B,aAAa,KAAK,SAAS;QAC3B,kBAAkB,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,YAAY,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,YAAY,CAAC,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAC1B,MAAM,OAAO,CACX,OAAO,EACP,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC/B,kBAAkB,EAClB,oBAAoB,CACrB,CACF,CAAC;IACF,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC/B,eAAe,CAAC,MAAM,GAAG,EAAE;QAC3B,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC,EAC5E,CAAC;QACD,MAAM,YAAY,CAAC,+BAA+B,EAAE,yCAAyC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,OAAO,EACP,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,CAAC,KAAK,CAAC,EAC5D,kBAAkB,EAClB,oBAAoB,CACrB,CAAC;IACF,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,6BAA6B,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,YAAY,CAAC,+BAA+B,EAAE,sCAAsC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,YAAY,CAAC,sCAAsC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,IACE,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QACvC,YAAY,KAAK,SAAS;QAC1B,CAAC,CACC,OAAO,KAAK,MAAM;YAClB,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAC7F,EACD,CAAC;QACD,MAAM,YAAY,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACpC,SAAS;QACT,MAAM,EAAE;YACN,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;YAC7E,OAAO,EAAE;gBACP,aAAa;gBACb,aAAa;gBACb,QAAQ,EAAE,OAAO;gBACjB,kBAAkB;gBAClB,aAAa;gBACb,eAAe,EAAE,eAA2B;aAC7C;YACD,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM;gBACf,cAAc,EAAE,WAAW;gBAC3B,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,kBAAkB;gBAC7B,IAAI,EAAE,YAAY;gBAClB,YAAY,EAAE,MAAM;gBACpB,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM;gBACjB,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9E,MAAM,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE;aAChC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,KAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,SAAS,KAAK,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;IAChG,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,IAAqB,EACrB,IAAY,EACZ,IAAY,EACZ,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,CAAC,YAAY,CACpB,IAAY,EACZ,IAAe,EACf,IAAY,EACZ,IAAY,EACZ,KAAa;IAEb,iGAAiG;IACjG,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACjF,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC7D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,WAAW,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC;QACX,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,WAAW,CACf,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACpD,IAAI,EACJ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACzB,IAAI,EACJ,KAAK,CACN,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,gBAAgB,CAAC,SAAiB,EAAE,WAAmB;IACrE,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5D,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAChE,KAAK,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,KAAe,CAAC;gBAC9B,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC1E,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,SAAiB,EAAE,cAAuB;IACtE,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,CAAC,YAAY,CAAC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,CAAC;QACf,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9D,KAAK,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,MAAM;SAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;SACjC,QAAQ,CAAC,OAAO,CAAC;SACjB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,OAAe,EAAE,YAAoB;IACvE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAA2B,CAAC;IAChC,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,OAAO,MAAM,GAAG,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACtD,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAC3E,CAAC,CACF,CAAC;QACF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,gBAAgB,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,IAAI,GAAG,OAAO,IAAI,UAAU,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;QAC3C,MAAM,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,GAAG;gBAAE,SAAS;YAC3B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM;oBAAE,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9F,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,OAAO,GAAG,SAAS,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;QACpB,IACE,MAAM,KAAK,SAAS;YACpB,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;YAC/B,IAAI,KAAK,aAAa;YACtB,IAAI,GAAG,YAAY,EACnB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,0BAA0B,CAAC;AAS/E,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,IAAY;IAEZ,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,OAAO,CACX,OAAO,EACP,CAAC,SAAS,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,IAAI,CAAC,EACjE,kBAAkB,EAClB,oBAAoB,CACrB,CACF,CAAC;IACF,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAkB;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwC;IACrE,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE;QACvC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE;QACvC,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyB,EACzB,SAA6B,EAC7B,MAA8B,EAC9B,gBAAwB;IAExB,MAAM,OAAO,GAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC1E,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9F,MAAM,eAAe,GAAG;QACtB,QAAQ;QACR,cAAc;QACd,UAAU,IAAI,EAAE;QAChB,kCAAkC,IAAI,EAAE;QACxC,gBAAgB;QAChB,aAAa;QACb,8BAA8B,cAAc,EAAE;QAC9C,qCAAqC,MAAM,CAAC,uBAAuB,EAAE;QACrE,UAAU,YAAY,EAAE;QACxB,gBAAgB;QAChB,kCAAkC;QAClC,gBAAgB,MAAM,CAAC,IAAI,EAAE;QAC7B,YAAY,MAAM,CAAC,WAAW,EAAE;QAChC,iBAAiB,MAAM,CAAC,WAAW,EAAE;QACrC,UAAU,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;QAC5C,mBAAmB;QACnB,aAAa,mBAAmB,EAAE;QAClC,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;aAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC;QACjD,gBAAgB,SAAS,CAAC,UAAU,EAAE;QACtC,OAAO,CAAC,SAAS,CAAC,KAAK;QACvB,GAAG,SAAS,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,OAAyC,CAAC;IAC9C,IAAI,OAA6C,CAAC;IAClD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,OAAO,EACP,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,cAAc,EAAE,CAAC,EACrD,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,CAC7D,CAAC;YACF,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAChC,OAAO,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,OAAO,EACP,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EACpC,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,YAAY,CAAC,0BAA0B,EAAE,GAAG,IAAI,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IACzC,OAAO,OAAmC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAuB,EACvB,IAAY,EACZ,SAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,OAAO,EACP,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,EAC3B,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,kBAAkB,CAC7B,CAAC;IACF,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,yFAAyF;QACzF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QACjF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,IACE,GAAG,CAAC,OAAO,KAAK,aAAa;QAC7B,KAAK,KAAK,SAAS;QACnB,KAAK,CAAC,MAAM,KAAK,QAAQ;QACzB,KAAK,CAAC,KAAK,KAAK,EAAE;QAClB,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QACnC,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAC/B,CAAC;QACD,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,GAAG,CAAC;IACxD,MAAM,OAAO,GAAkB;QAC7B,GAAG,SAAS;QACZ,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,MAAM,YAAY,GAAG,SAAS,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,OAAO,EACP,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,qBAAqB,EAAE,EAAE,GAAG,CAAC,EAC/C,kBAAkB,EAClB,YAAY,GAAG,6BAA6B,CAC7C,CAAC;IACF,OAAO;QACL,OAAO;QACP,MAAM,EACJ,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YACnD,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;YAC9D,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import type { EvidenceManifestContract } from "../contracts/index.js";
|
|
1
|
+
import type { EvidenceManifestContract, EvidenceManifestV2Contract } from "../contracts/index.js";
|
|
2
|
+
type QualificationManifest = EvidenceManifestContract | EvidenceManifestV2Contract;
|
|
2
3
|
export interface GitRegressionOptions {
|
|
3
4
|
repository: string;
|
|
4
5
|
before: string;
|
|
@@ -10,6 +11,13 @@ export interface GitRegressionOptions {
|
|
|
10
11
|
out: string;
|
|
11
12
|
allowUnsafeExecution: boolean;
|
|
12
13
|
}
|
|
14
|
+
/** Qualifies in digest-pinned containers instead of trusted-local execution; the evidence is v2. */
|
|
15
|
+
export interface GitRegressionV2Options extends Omit<GitRegressionOptions, "allowUnsafeExecution"> {
|
|
16
|
+
container: {
|
|
17
|
+
image: string;
|
|
18
|
+
runtimeCommand?: readonly string[];
|
|
19
|
+
};
|
|
20
|
+
}
|
|
13
21
|
export declare function runBoundedProcessForTesting(options: {
|
|
14
22
|
executable: string;
|
|
15
23
|
args: string[];
|
|
@@ -20,6 +28,8 @@ export declare function runBoundedProcessForTesting(options: {
|
|
|
20
28
|
export declare function decodeGitTextForTesting(bytes: Uint8Array): string;
|
|
21
29
|
export declare function parseGitTreeForTesting(raw: Buffer): ReadonlyMap<string, unknown>;
|
|
22
30
|
export declare function batchOutputLimitForTesting(sizes: readonly number[], oidLength: number): number;
|
|
23
|
-
export declare function renderGitRegressionSummary(manifest:
|
|
31
|
+
export declare function renderGitRegressionSummary(manifest: QualificationManifest, options: GitRegressionOptions | GitRegressionV2Options): string;
|
|
24
32
|
export declare function qualifyGitRegression(options: GitRegressionOptions): Promise<EvidenceManifestContract>;
|
|
33
|
+
export declare function qualifyGitRegressionV2(options: GitRegressionV2Options): Promise<EvidenceManifestV2Contract>;
|
|
34
|
+
export {};
|
|
25
35
|
//# sourceMappingURL=git-regression.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"git-regression.d.ts","sourceRoot":"","sources":["../../src/engine/git-regression.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"git-regression.d.ts","sourceRoot":"","sources":["../../src/engine/git-regression.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAelG,KAAK,qBAAqB,GAAG,wBAAwB,GAAG,0BAA0B,CAAC;AA8CnF,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,oGAAoG;AACpG,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;IAChG,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAClE;AAuID,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAiCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEjE;AA6FD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhF;AAaD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9F;AA+YD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,oBAAoB,GAAG,sBAAsB,GACrD,MAAM,CA8CR;AAwCD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,wBAAwB,CAAC,CAGnC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,0BAA0B,CAAC,CAErC"}
|