dodo-mcp 1.0.0

package/dist/services/resources/providers.js

@@ -0,0 +1,120 @@
+import fs from 'node:fs';
+import sharp from 'sharp';
+import { DodoError } from '../../errors.js';
+import { decodeUtf8Strict } from '../../util/bytes.js';
+const MAX_IMAGE_PIXELS = 64 * 1024 * 1024;
+export async function inspectResourceFile(file, mimeType) {
+    if (['image/png', 'image/jpeg', 'image/gif', 'image/webp'].includes(mimeType)) {
+        try {
+            const meta = await sharp(file, { limitInputPixels: MAX_IMAGE_PIXELS, sequentialRead: true, failOn: 'error' }).metadata();
+            if (!meta.width || !meta.height)
+                throw new Error('missing dimensions');
+            return { width: meta.width, height: meta.height, ...(meta.format ? { format: meta.format } : {}) };
+        }
+        catch {
+            throw new DodoError('INVALID_INPUT', 'image decoder rejected corrupt or oversized image metadata');
+        }
+    }
+    if (mimeType === 'application/zip') {
+        return { entries: readZipEntries(file, 1).totalEntries, format: 'zip' };
+    }
+    if (mimeType === 'application/pdf') {
+        const header = Buffer.alloc(16);
+        const fd = fs.openSync(file, 'r');
+        try {
+            fs.readSync(fd, header, 0, header.length, 0);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const version = /^%PDF-(\d\.\d)/.exec(header.toString('ascii'))?.[1];
+        if (!version)
+            throw new DodoError('INVALID_INPUT', 'PDF header is corrupt');
+        return { format: `pdf-${version}` };
+    }
+    if (mimeType === 'application/wasm')
+        return { format: 'wasm' };
+    return {};
+}
+export async function imagePreview(file, maxEdge) {
+    try {
+        const converted = await sharp(file, { limitInputPixels: MAX_IMAGE_PIXELS, sequentialRead: true, failOn: 'error' })
+            .rotate()
+            .resize({ width: maxEdge, height: maxEdge, fit: 'inside', withoutEnlargement: true })
+            .jpeg({ quality: 82, mozjpeg: true })
+            .toBuffer({ resolveWithObject: true });
+        if (converted.data.length > 6 * 1024 * 1024)
+            throw new DodoError('RESOURCE_LIMIT', 'image preview exceeds the 6 MiB MCP block limit');
+        return { bytes: converted.data, mimeType: 'image/jpeg', width: converted.info.width, height: converted.info.height };
+    }
+    catch (error) {
+        if (error instanceof DodoError)
+            throw error;
+        throw new DodoError('INVALID_INPUT', 'image decoder rejected corrupt or oversized image content');
+    }
+}
+export function readTextFile(file, bytes, maxBytes) {
+    if (bytes > maxBytes)
+        throw new DodoError('FILE_TOO_LARGE', `text extraction is limited to ${maxBytes} bytes; use resource_read_range for bounded chunks`);
+    const data = fs.readFileSync(file);
+    const text = decodeUtf8Strict(data);
+    if (text === undefined)
+        throw new DodoError('UNSUPPORTED_ENCODING', 'resource is not valid UTF-8');
+    return { text, truncated: false };
+}
+/** Parse ZIP central-directory metadata only. No entry is inflated or executed. */
+export function readZipEntries(file, limit = 512) {
+    const stat = fs.statSync(file);
+    const tailBytes = Math.min(stat.size, 65_557);
+    const tail = Buffer.alloc(tailBytes);
+    const fd = fs.openSync(file, 'r');
+    try {
+        fs.readSync(fd, tail, 0, tail.length, stat.size - tail.length);
+        let eocd = -1;
+        for (let i = tail.length - 22; i >= 0; i -= 1) {
+            if (tail.readUInt32LE(i) === 0x06054b50) {
+                eocd = i;
+                break;
+            }
+        }
+        if (eocd < 0 || eocd + 22 > tail.length)
+            throw new DodoError('INVALID_INPUT', 'ZIP central directory is missing or corrupt');
+        const totalEntries = tail.readUInt16LE(eocd + 10);
+        const centralBytes = tail.readUInt32LE(eocd + 12);
+        const centralOffset = tail.readUInt32LE(eocd + 16);
+        if (centralBytes > 4 * 1024 * 1024 || centralOffset + centralBytes > stat.size)
+            throw new DodoError('RESOURCE_LIMIT', 'ZIP central directory exceeds the 4 MiB metadata limit');
+        const central = Buffer.alloc(centralBytes);
+        fs.readSync(fd, central, 0, central.length, centralOffset);
+        const entries = [];
+        let offset = 0;
+        for (let index = 0; index < totalEntries; index += 1) {
+            if (offset + 46 > central.length || central.readUInt32LE(offset) !== 0x02014b50)
+                throw new DodoError('INVALID_INPUT', 'ZIP central directory entry is corrupt');
+            const compressedBytes = central.readUInt32LE(offset + 20);
+            const uncompressedBytes = central.readUInt32LE(offset + 24);
+            const nameBytes = central.readUInt16LE(offset + 28);
+            const extraBytes = central.readUInt16LE(offset + 30);
+            const commentBytes = central.readUInt16LE(offset + 32);
+            const end = offset + 46 + nameBytes + extraBytes + commentBytes;
+            if (end > central.length)
+                throw new DodoError('INVALID_INPUT', 'ZIP central directory name is corrupt');
+            if (entries.length < limit) {
+                const rawName = central.subarray(offset + 46, offset + 46 + nameBytes);
+                const name = decodeUtf8Strict(rawName);
+                entries.push({
+                    name: name === undefined || name.includes('\0') ? '[non-UTF8 entry name]' : name.slice(0, 1024),
+                    compressedBytes,
+                    uncompressedBytes,
+                    directory: rawName.length > 0 && rawName[rawName.length - 1] === 0x2f,
+                });
+            }
+            offset = end;
+        }
+        return { entries, totalEntries, truncated: totalEntries > entries.length };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+//# sourceMappingURL=providers.js.map

package/dist/services/resources/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/services/resources/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IACtE,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACnF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IAC9D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;aAC/G,MAAM,EAAE;aACR,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;aACpF,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACpC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;QACtI,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACvH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS;YAAE,MAAM,KAAK,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,QAAgB;IACxE,IAAI,KAAK,GAAG,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,iCAAiC,QAAQ,oDAAoD,CAAC,CAAC;IAC3J,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AASD,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAK,GAAG,GAAG;IACtD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QAC7H,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,aAAa,GAAG,YAAY,GAAG,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,wDAAwD,CAAC,CAAC;QAChL,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YAChK,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;YAChE,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACxG,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;gBACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC/F,eAAe;oBACf,iBAAiB;oBACjB,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7E,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC"}

package/dist/services/resources/resourceService.js

@@ -0,0 +1,282 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { DodoError } from '../../errors.js';
+import { digestOf, newId, sha256Bytes } from '../../util/hash.js';
+import { decodeUtf8Strict } from '../../util/bytes.js';
+import { liveAccess } from '../multimodal/storage.js';
+import { CasStore, RESOURCE_RANGE_MAX_BYTES } from './casStore.js';
+import { isTextMime, resourceFamily, sniffType } from './mime.js';
+import { imagePreview, inspectResourceFile, readTextFile, readZipEntries } from './providers.js';
+import { isWithinPath } from '../../platform/pathPolicy.js';
+import { ResourceProviderRegistry } from './providerRegistry.js';
+const REF_TTL_MS = 24 * 60 * 60 * 1000;
+const REF_MAX_PER_ACTOR = 512;
+const ORPHAN_GRACE_MS = 60 * 60 * 1000;
+const TEXT_MAX_BYTES = 256 * 1024;
+const MCP_BLOCK_MAX_BYTES = 6 * 1024 * 1024;
+function principalKey(ctx) {
+    return digestOf({ grantId: ctx.principal.grantId, clientId: ctx.principal.clientId });
+}
+function safeJson(value, fallback) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return fallback;
+    }
+}
+export class ResourceService {
+    services;
+    cas;
+    configDir;
+    providers = new ResourceProviderRegistry();
+    cursorKey;
+    gcTimer;
+    closed = false;
+    constructor(services, configDir, objectsDir, stagingDir, installSecret) {
+        this.services = services;
+        this.configDir = fs.realpathSync.native(configDir);
+        this.cas = new CasStore(services.store, objectsDir, stagingDir);
+        this.cursorKey = createHmac('sha256', installSecret).update('dodo-resource-range-v1').digest();
+        this.gc();
+        this.gcTimer = setInterval(() => { if (!this.closed)
+            this.gc(); }, 15 * 60 * 1000);
+        this.gcTimer.unref();
+    }
+    close() { this.closed = true; clearInterval(this.gcTimer); }
+    async ingestWorkspace(ctx, inputPath, expectedHash, expectedMimeType) {
+        this.check();
+        liveAccess(ctx, 'dodo:read');
+        const candidate = this.services.wfs.resolve(inputPath);
+        if (isWithinPath(this.configDir, candidate.abs) || path.resolve(candidate.abs) === path.resolve(this.configDir)) {
+            throw new DodoError('PATH_DENIED', 'private DODO installation state cannot enter the resource store');
+        }
+        const object = await this.cas.ingestWorkspace(this.services.wfs, inputPath, expectedHash);
+        try {
+            const head = await this.cas.readRange(object.hash, object.bytes, 0, Math.min(object.bytes, 64 * 1024));
+            const sniffed = sniffType(head, inputPath);
+            this.assertExpectedMime(expectedMimeType, sniffed.mimeType);
+            const metadata = { provider: this.providers.providerFor(sniffed.mimeType).name, ...(await inspectResourceFile(object.path, sniffed.mimeType)) };
+            return this.createReference(ctx, object, sniffed.mimeType, 'workspace', this.services.wfs.normalizeRel(inputPath), metadata);
+        }
+        catch (error) {
+            this.gc();
+            throw error;
+        }
+    }
+    async ingestAsset(ctx, assetId, expectedHash, expectedMimeType) {
+        this.check();
+        liveAccess(ctx, 'dodo:exec');
+        const media = this.services.multimodal;
+        if (!media)
+            throw new DodoError('NOT_SUPPORTED', 'multimodal service is unavailable');
+        const asset = media.storage.get(ctx.principal, assetId);
+        const object = await this.cas.ingestBuffer(asset.bytes, expectedHash);
+        try {
+            const sniffed = sniffType(asset.bytes.subarray(0, 64 * 1024), assetId);
+            if (sniffed.mimeType !== 'application/octet-stream' && sniffed.mimeType !== asset.meta.mimeType) {
+                throw new DodoError('INVALID_INPUT', 'media asset MIME does not match its bytes');
+            }
+            const mimeType = sniffed.mimeType === 'application/octet-stream' ? asset.meta.mimeType : sniffed.mimeType;
+            this.assertExpectedMime(expectedMimeType, mimeType);
+            const metadata = { provider: this.providers.providerFor(mimeType).name, ...(await inspectResourceFile(object.path, mimeType)) };
+            return this.createReference(ctx, object, mimeType, 'media_asset', assetId, metadata);
+        }
+        catch (error) {
+            this.gc();
+            throw error;
+        }
+    }
+    async inspect(ctx, resourceId, expectedHash, expectedMimeType) {
+        const row = await this.lookup(ctx, resourceId, expectedHash);
+        this.assertExpectedMime(expectedMimeType, row.mime_type);
+        await this.cas.verify(row.object_hash, row.bytes);
+        return this.toInfo(row);
+    }
+    async read(ctx, resourceId, maxBytes, expectedHash) {
+        const row = await this.lookup(ctx, resourceId, expectedHash);
+        const amount = Math.min(row.bytes, maxBytes, RESOURCE_RANGE_MAX_BYTES);
+        const bytes = await this.cas.readRange(row.object_hash, row.bytes, 0, amount);
+        const wholeText = amount === row.bytes && isTextMime(row.mime_type) ? decodeUtf8Strict(bytes) : undefined;
+        const end = bytes.length;
+        return {
+            info: this.toInfo(row),
+            encoding: wholeText === undefined ? 'base64' : 'utf8',
+            data: wholeText ?? bytes.toString('base64'),
+            start: 0,
+            endExclusive: end,
+            chunkHash: sha256Bytes(bytes),
+            eof: end >= row.bytes,
+            nextOffset: end < row.bytes ? end : null,
+            resumeToken: end < row.bytes ? this.signCursor(ctx, row, end) : null,
+        };
+    }
+    async readRange(ctx, input) {
+        let resourceId = input.resourceId;
+        let offset = input.offset ?? 0;
+        if (input.cursor !== undefined) {
+            if (resourceId !== undefined || input.offset !== undefined || input.expectedHash !== undefined)
+                throw new DodoError('INVALID_INPUT', 'cursor cannot be combined with resourceId, offset or expectedSha256');
+            const payload = this.verifyCursor(ctx, input.cursor);
+            resourceId = payload.r;
+            offset = payload.o;
+            input.expectedHash = payload.h;
+        }
+        if (!resourceId)
+            throw new DodoError('INVALID_INPUT', 'resourceId is required when cursor is not supplied');
+        const row = await this.lookup(ctx, resourceId, input.expectedHash);
+        if (offset > row.bytes)
+            throw new DodoError('INVALID_INPUT', 'range offset exceeds resource size');
+        const bytes = await this.cas.readRange(row.object_hash, row.bytes, offset, input.length);
+        const end = offset + bytes.length;
+        return {
+            info: this.toInfo(row), data: bytes.toString('base64'), start: offset, endExclusive: end,
+            chunkHash: sha256Bytes(bytes), eof: end >= row.bytes, nextOffset: end < row.bytes ? end : null,
+            resumeToken: end < row.bytes ? this.signCursor(ctx, row, end) : null,
+        };
+    }
+    async preview(ctx, resourceId, maxEdge, expectedHash) {
+        const row = await this.lookup(ctx, resourceId, expectedHash);
+        const info = this.toInfo(row);
+        const verified = await this.cas.verify(row.object_hash, row.bytes);
+        const family = resourceFamily(row.mime_type);
+        if (family === 'image' && row.mime_type !== 'image/svg+xml') {
+            const preview = await imagePreview(verified.path, maxEdge);
+            return { data: { resource: info, previewKind: 'image', previewMimeType: preview.mimeType, previewBytes: preview.bytes.length, width: preview.width, height: preview.height, note: 'Bounded local thumbnail; original resource remains immutable.' }, block: { type: 'image', data: preview.bytes.toString('base64'), mimeType: preview.mimeType } };
+        }
+        if (family === 'audio' && row.bytes <= MCP_BLOCK_MAX_BYTES) {
+            const bytes = await this.cas.readRange(row.object_hash, row.bytes, 0, row.bytes);
+            return { data: { resource: info, previewKind: 'audio', previewMimeType: row.mime_type, previewBytes: bytes.length, note: 'Original bounded audio bytes follow as an MCP audio block.' }, block: { type: 'audio', data: bytes.toString('base64'), mimeType: row.mime_type } };
+        }
+        if (isTextMime(row.mime_type) && row.bytes <= TEXT_MAX_BYTES) {
+            const value = readTextFile(verified.path, row.bytes, TEXT_MAX_BYTES);
+            return { data: { resource: info, previewKind: 'text', text: value.text, note: 'UTF-8 text is untrusted resource content.' } };
+        }
+        return { data: { resource: info, previewKind: 'metadata', note: family === 'audio' ? 'Audio exceeds the MCP block limit; use resource_read_range.' : 'No safe in-process preview provider is registered for this MIME; metadata and bounded ranges remain available.' } };
+    }
+    async extract(ctx, resourceId, kind, expectedHash) {
+        const row = await this.lookup(ctx, resourceId, expectedHash);
+        const info = this.toInfo(row);
+        const verified = await this.cas.verify(row.object_hash, row.bytes);
+        const selected = kind === 'auto' ? (isTextMime(row.mime_type) ? 'text' : row.mime_type === 'application/zip' ? 'archive_entries' : 'metadata') : kind;
+        if (selected === 'text') {
+            if (!isTextMime(row.mime_type))
+                throw new DodoError('NOT_SUPPORTED', `no trusted text extractor is registered for ${row.mime_type}`);
+            const value = readTextFile(verified.path, row.bytes, TEXT_MAX_BYTES);
+            return { resource: info, kind: 'text', text: value.text, truncated: value.truncated, provenance: 'deterministic_local_decoder_untrusted_content' };
+        }
+        if (selected === 'archive_entries') {
+            if (row.mime_type !== 'application/zip')
+                throw new DodoError('INVALID_INPUT', 'archive_entries requires an application/zip resource');
+            const result = readZipEntries(verified.path);
+            return { resource: info, kind: 'archive_entries', entries: result.entries, metadata: { totalEntries: result.totalEntries }, truncated: result.truncated, provenance: 'deterministic_local_decoder_untrusted_content' };
+        }
+        return { resource: info, kind: 'metadata', metadata: { mimeType: row.mime_type, bytes: row.bytes, sha256: row.object_hash, ...safeJson(row.metadata, {}) }, truncated: false, provenance: 'deterministic_local_decoder_untrusted_content' };
+    }
+    async transformImage(ctx, resourceId, maxEdge, expectedHash) {
+        const row = await this.lookup(ctx, resourceId, expectedHash, 'dodo:exec');
+        if (resourceFamily(row.mime_type) !== 'image' || row.mime_type === 'image/svg+xml')
+            throw new DodoError('NOT_SUPPORTED', 'thumbnail transform supports raster PNG/JPEG/GIF/WebP only');
+        const verified = await this.cas.verify(row.object_hash, row.bytes);
+        const preview = await imagePreview(verified.path, maxEdge);
+        const object = await this.cas.ingestBuffer(preview.bytes);
+        return this.createReference(ctx, object, preview.mimeType, 'transform', resourceId, { provider: this.providers.providerFor(preview.mimeType).name, width: preview.width, height: preview.height, format: 'jpeg' });
+    }
+    gc(now = Date.now()) {
+        const transaction = this.services.store.db.transaction(() => {
+            const expired = this.services.store.db.prepare('DELETE FROM resource_refs WHERE expires_at<=?').run(now).changes;
+            // A CAS object is committed before its first reference is derived. Keep
+            // recently created/verified orphans so a concurrent ingest cannot be
+            // collected between those two steps; crash leftovers remain bounded.
+            const cutoff = now - ORPHAN_GRACE_MS;
+            const orphans = this.services.store.db.prepare('SELECT hash FROM resource_objects WHERE verified_at<=? AND NOT EXISTS (SELECT 1 FROM resource_refs WHERE object_hash=resource_objects.hash)').all(cutoff);
+            for (const orphan of orphans)
+                this.cas.removeObject(orphan.hash);
+            if (orphans.length > 0)
+                this.services.store.db.prepare('DELETE FROM resource_objects WHERE verified_at<=? AND NOT EXISTS (SELECT 1 FROM resource_refs WHERE object_hash=resource_objects.hash)').run(cutoff);
+            return { expiredRefs: expired, removedObjects: orphans.length };
+        });
+        return transaction.immediate();
+    }
+    async lookup(ctx, resourceId, expectedHash, scope = 'dodo:read') {
+        this.check();
+        liveAccess(ctx, scope);
+        const row = this.services.store.db.prepare(`SELECT r.*,o.bytes FROM resource_refs r JOIN resource_objects o ON o.hash=r.object_hash
+      WHERE r.id=? AND r.workspace_id=? AND r.principal=?`).get(resourceId, this.services.workspaceId, principalKey(ctx));
+        if (!row || row.expires_at <= Date.now()) {
+            if (row) {
+                this.services.store.db.prepare('DELETE FROM resource_refs WHERE id=?').run(resourceId);
+                this.gc();
+            }
+            throw new DodoError('NOT_FOUND', 'unknown or expired resource for this client/workspace');
+        }
+        if (expectedHash !== undefined && row.object_hash !== expectedHash)
+            throw new DodoError('FILE_CHANGED', 'resource hash does not match expectedSha256', { detail: { expectedHash, actualHash: row.object_hash } });
+        return row;
+    }
+    createReference(ctx, object, mimeType, sourceKind, sourceLabel, metadata) {
+        const owner = principalKey(ctx), now = Date.now(), expiresAt = now + REF_TTL_MS;
+        const capabilities = this.capabilities(mimeType, object.bytes);
+        const id = newId('res');
+        const insert = this.services.store.db.transaction(() => {
+            const count = this.services.store.db.prepare('SELECT COUNT(*) AS count FROM resource_refs WHERE workspace_id=? AND principal=? AND expires_at>?').get(this.services.workspaceId, owner, now);
+            if (count.count >= REF_MAX_PER_ACTOR)
+                throw new DodoError('RESOURCE_LIMIT', 'resource reference limit reached for this client/workspace');
+            this.services.store.db.prepare(`INSERT INTO resource_refs(id,workspace_id,principal,object_hash,mime_type,source_kind,source_label,capabilities,metadata,created_at,expires_at)
+        VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(id, this.services.workspaceId, owner, object.hash, mimeType, sourceKind, sourceLabel, JSON.stringify(capabilities), JSON.stringify(metadata), now, expiresAt);
+        });
+        insert.immediate();
+        return { resourceId: id, uri: this.uri(id), mimeType, bytes: object.bytes, sha256: object.hash, source: { kind: sourceKind, label: sourceLabel }, capabilities, metadata, createdAt: now, expiresAt, deduplicated: object.deduplicated };
+    }
+    toInfo(row) {
+        return {
+            resourceId: row.id, uri: this.uri(row.id), mimeType: row.mime_type, bytes: row.bytes, sha256: row.object_hash,
+            source: { kind: row.source_kind, label: row.source_label },
+            capabilities: safeJson(row.capabilities, this.capabilities(row.mime_type, row.bytes)),
+            metadata: safeJson(row.metadata, {}), createdAt: row.created_at, expiresAt: row.expires_at,
+        };
+    }
+    capabilities(mimeType, _bytes) {
+        return this.providers.providerFor(mimeType).capabilities(mimeType);
+    }
+    uri(resourceId) { return `dodo-resource://${this.services.workspaceId}/${resourceId}`; }
+    check() { if (this.closed)
+        throw new DodoError('STALE_WORKSPACE', 'resource workspace is closed'); }
+    assertExpectedMime(expected, actual) {
+        if (expected !== undefined && expected.toLowerCase() !== actual)
+            throw new DodoError('INVALID_INPUT', `resource MIME mismatch: expected ${expected}, detected ${actual}`);
+    }
+    signCursor(ctx, row, offset) {
+        const payload = { v: 1, r: row.id, h: row.object_hash, o: offset, w: this.services.workspaceId, a: principalKey(ctx), exp: Date.now() + 10 * 60 * 1000 };
+        const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const mac = createHmac('sha256', this.cursorKey).update(encoded).digest('base64url');
+        return `r1.${encoded}.${mac}`;
+    }
+    verifyCursor(ctx, token) {
+        const match = /^r1\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/.exec(token);
+        if (!match)
+            throw new DodoError('INVALID_INPUT', 'invalid resource resume token');
+        const body = Buffer.from(match[1], 'base64url');
+        const actual = Buffer.from(match[2], 'base64url');
+        // Node's decoder accepts non-canonical trailing Base64URL bits. Re-encode
+        // both segments before HMAC comparison so a textually modified token can
+        // never alias the original byte sequence.
+        if (body.toString('base64url') !== match[1] || actual.toString('base64url') !== match[2])
+            throw new DodoError('INVALID_INPUT', 'invalid resource resume token');
+        const expected = createHmac('sha256', this.cursorKey).update(match[1]).digest();
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            throw new DodoError('INVALID_INPUT', 'invalid resource resume token');
+        let payload;
+        try {
+            payload = JSON.parse(body.toString('utf8'));
+        }
+        catch {
+            throw new DodoError('INVALID_INPUT', 'invalid resource resume token');
+        }
+        if (payload.v !== 1 || payload.w !== this.services.workspaceId || payload.a !== principalKey(ctx) || !Number.isSafeInteger(payload.o) || payload.o < 0 || payload.exp <= Date.now())
+            throw new DodoError('STALE_WORKSPACE', 'resource resume token expired or belongs to another client/workspace');
+        return payload;
+    }
+}
+//# sourceMappingURL=resourceService.js.map

package/dist/services/resources/resourceService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceService.js","sourceRoot":"","sources":["../../../src/services/resources/resourceService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAClC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAmB5C,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,QAAQ,CAAI,KAAa,EAAE,QAAW;IAC7C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,QAAQ,CAAC;IAAC,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,eAAe;IAQL;IAPZ,GAAG,CAAW;IACd,SAAS,CAAS;IAClB,SAAS,GAAG,IAAI,wBAAwB,EAAE,CAAC;IACnC,SAAS,CAAS;IAClB,OAAO,CAAiB;IACjC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAqB,QAAqB,EAAE,SAAiB,EAAE,UAAkB,EAAE,UAAkB,EAAE,aAAqB;QAAvG,aAAQ,GAAR,QAAQ,CAAa;QACxC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/F,IAAI,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,KAAW,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAElE,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,SAAiB,EAAE,YAAqB,EAAE,gBAAyB;QACrG,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,iEAAiE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACvG,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChJ,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,OAAe,EAAE,YAAqB,EAAE,gBAAyB;QAC/F,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,0BAA0B,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChG,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1G,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChI,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,UAAkB,EAAE,YAAqB,EAAE,gBAAyB;QAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,UAAkB,EAAE,QAAgB,EAAE,YAAqB;QAGlF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACtB,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YACrD,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK;YACrB,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACxC,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAY,EAAE,KAAuG;QAGnI,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,qEAAqE,CAAC,CAAC;YAC5M,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC5G,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,MAAM,GAAG,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG;YACxF,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC9F,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAqB;QACpF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,+DAA+D,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtV,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjF,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,4DAA4D,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/Q,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,2CAA2C,EAAE,EAAE,CAAC;QAChI,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,gHAAgH,EAAE,EAAE,CAAC;IAC5Q,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,UAAkB,EAAE,IAAsD,EAAE,YAAqB;QAC3H,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtJ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+CAA+C,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACrI,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,+CAA+C,EAAE,CAAC;QACrJ,CAAC;QACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,SAAS,KAAK,iBAAiB;gBAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;YACtI,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,+CAA+C,EAAE,CAAC;QACzN,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAuB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,+CAA+C,EAAE,CAAC;IACpQ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAqB;QAC3F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC1E,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;QACvL,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrN,CAAC;IAED,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACjB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACjH,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,MAAM,GAAG,GAAG,GAAG,eAAe,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,6IAA6I,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;YACrO,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,wIAAwI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7M,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,SAAS,EAAE,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,UAAkB,EAAE,YAAqB,EAAE,QAAmC,WAAW;QAC1H,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC;0DACW,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAA4B,CAAC;QACjJ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,CAAC;YAC/G,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,6CAA6C,EAAE,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClN,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,eAAe,CAAC,GAAY,EAAE,MAA8D,EAAE,QAAgB,EAAE,UAAsC,EAAE,WAAmB,EAAE,QAA8B;QACjN,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;QAChF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,mGAAmG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAsB,CAAC;YAClN,IAAI,KAAK,CAAC,KAAK,IAAI,iBAAiB;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,4DAA4D,CAAC,CAAC;YAC1I,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC;uCACE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACvM,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC3O,CAAC;IAEO,MAAM,CAAC,GAAgB;QAC7B,OAAO;YACL,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW;YAC7G,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE;YAC1D,YAAY,EAAE,QAAQ,CAA2B,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/G,QAAQ,EAAE,QAAQ,CAAuB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU;SACjH,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,QAAgB,EAAE,MAAc;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IAEO,GAAG,CAAC,UAAkB,IAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,KAAK,KAAW,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC;IAC1G,kBAAkB,CAAC,QAA4B,EAAE,MAAc;QACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,oCAAoC,QAAQ,cAAc,MAAM,EAAE,CAAC,CAAC;IAC5K,CAAC;IAEO,UAAU,CAAC,GAAY,EAAE,GAAgB,EAAE,MAAc;QAC/D,MAAM,OAAO,GAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACxK,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO,MAAM,OAAO,IAAI,GAAG,EAAE,CAAC;IAChC,CAAC;IAEO,YAAY,CAAC,GAAY,EAAE,KAAa;QAC9C,MAAM,KAAK,GAAG,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;QACnD,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAChK,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QACnJ,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkB,CAAC;QAAC,CAAC;QACrE,MAAM,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAAC,CAAC;QAChF,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,sEAAsE,CAAC,CAAC;QACpS,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/services/runtime/contracts.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+export const RUNTIME_SCHEMA_VERSION = 1;
+export const RuntimeSessionId = z.string().regex(/^runtime_[0-9a-hjkmnp-tv-z]{8,64}$/);
+export const RuntimeTaskId = z.string().regex(/^rtask_[0-9a-hjkmnp-tv-z]{8,64}$/);
+export const RuntimeEvidenceId = z.string().regex(/^runtimeev_[0-9a-hjkmnp-tv-z]{8,64}$/);
+export const RuntimeTaskKind = z.enum(['process', 'test', 'container']);
+export const RuntimeEvidenceKind = z.enum(['process', 'test', 'container', 'browser', 'snapshot']);
+export const RuntimeEvidenceStatus = z.enum(['CURRENT', 'STALE', 'EXPIRED']);
+export const RuntimeSession = z.object({
+    schemaVersion: z.literal(RUNTIME_SCHEMA_VERSION),
+    sessionId: RuntimeSessionId,
+    label: z.string(),
+    status: z.enum(['OPEN', 'CLOSED', 'EXPIRED']),
+    workspaceId: z.string(),
+    openedEpoch: z.string(),
+    createdAt: z.number().int().nonnegative(),
+    lastSeenAt: z.number().int().nonnegative(),
+    expiresAt: z.number().int().nonnegative(),
+    closedAt: z.number().int().nonnegative().nullable(),
+}).strict();
+export const RuntimeTask = z.object({
+    taskId: RuntimeTaskId,
+    sessionId: RuntimeSessionId,
+    jobId: z.string(),
+    kind: RuntimeTaskKind,
+    status: z.string(),
+    exitCode: z.number().int().nullable(),
+    signal: z.string().nullable(),
+    createdAt: z.number().int().nonnegative(),
+    startedAt: z.number().int().nonnegative().nullable(),
+    endedAt: z.number().int().nonnegative().nullable(),
+    timeoutMs: z.number().int().positive(),
+}).strict();
+export const RuntimeEvidence = z.object({
+    schemaVersion: z.literal(RUNTIME_SCHEMA_VERSION),
+    evidenceId: RuntimeEvidenceId,
+    sessionId: RuntimeSessionId,
+    kind: RuntimeEvidenceKind,
+    status: RuntimeEvidenceStatus,
+    sourceRef: z.string(),
+    sourceHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    contentHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    payload: z.record(z.string(), z.unknown()),
+    staleReason: z.string().nullable(),
+    createdAt: z.number().int().nonnegative(),
+    lastVerifiedAt: z.number().int().nonnegative(),
+    expiresAt: z.number().int().nonnegative(),
+    trust: z.literal('untrusted_runtime_evidence'),
+}).strict();
+export const RuntimeSessionStatus = z.object({
+    session: RuntimeSession,
+    tasks: z.array(RuntimeTask),
+    evidence: z.object({ current: z.number().int().nonnegative(), stale: z.number().int().nonnegative(), expired: z.number().int().nonnegative() }).strict(),
+    reconnectable: z.literal(true),
+    note: z.string(),
+}).strict();
+export const RuntimeDiagnosis = z.object({
+    sessionId: RuntimeSessionId,
+    facts: z.array(z.string()),
+    observations: z.array(z.string()),
+    inferences: z.array(z.object({ statement: z.string(), confidence: z.enum(['low', 'medium', 'high']), evidenceIds: z.array(RuntimeEvidenceId) }).strict()),
+    limitations: z.array(z.string()),
+    trust: z.literal('untrusted_runtime_evidence'),
+}).strict();
+//# sourceMappingURL=contracts.js.map

package/dist/services/runtime/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/services/runtime/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChD,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChD,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,gBAAgB;IAC3B,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,qBAAqB;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACxJ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACzJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC"}