instar 1.3.646 → 1.3.648

package/dist/core/SingleInstanceLock.d.ts

@@ -0,0 +1,103 @@
+/**
+ * SingleInstanceLock — P2 of the SIMPLE fork-bomb prevention design.
+ *
+ * Spec: docs/specs/forkbomb-prevention-simple.md (§P2, §D-LOCK).
+ *
+ * A per-agent, HOST-LOCAL lock so launchd + fleet + tmux cannot run DUPLICATE
+ * server instances of the same agent — the 3× multiplier that made the
+ * 2026-06-20 fork-bomb catastrophic (three concurrent server instances each
+ * re-flooding `claude -p`).
+ *
+ * MECHANISM (mirrors ProjectRoundLock O_CREAT|O_EXCL + the ResumeQueue host-lock
+ * contract):
+ *   - Lock file `<stateDir>/local/server-instance.lock`, holder record =
+ *     `{ pid, hostname, heartbeat }` (ms-epoch mtime-style heartbeat).
+ *   - A FOREIGN-hostname lock is NEVER pid-probed or reclaimed (refuse-loud —
+ *     the multi-machine shared-state-dir hazard, 2026-06-15): a legit standby on
+ *     a DIFFERENT host with its own non-shared state dir boots freely.
+ *   - Same-host stale reclaim is gated on a `df -P` host-local-disk confirmation
+ *     (fail-closed: cannot-confirm-local → never reclaim).
+ *   - DEPLOY HANDOFF (not too blunt): on finding a LIVE same-host holder, WAIT a
+ *     bounded grace for it to release (a normal restart kills-then-respawns, so
+ *     the outgoing holder's exit handler frees the lock) before refusing — so a
+ *     clean restart hands off and only a genuine DUPLICATE (two independent
+ *     supervisors racing) is refused.
+ *   - Override: `INSTAR_ALLOW_SECOND_INSTANCE=1` boots a deliberate admin/debug
+ *     instance without the lock.
+ *
+ * Release is wired by the CALLER via BOTH a `finally`/shutdown path AND a
+ * process exit handler (SIGTERM/SIGINT/exit) — see `installReleaseHandlers`.
+ */
+interface InstanceLockRecord {
+    pid: number;
+    hostname: string;
+    heartbeat: number;
+}
+export interface SingleInstanceLockResult {
+    acquired: boolean;
+    /** Why not (when acquired=false). */
+    reason?: 'duplicate-live-instance' | 'foreign-host-conflict' | 'override-bypassed';
+    /** The conflicting holder (when refused on a same/foreign-host live lock). */
+    currentHolder?: InstanceLockRecord;
+    /** True when bypassed via INSTAR_ALLOW_SECOND_INSTANCE (acquired stays true). */
+    overridden?: boolean;
+}
+export interface SingleInstanceLockDeps {
+    /** `.instar` state dir — the lock lives under `<stateDir>/local/`. */
+    stateDir: string;
+    now?: () => number;
+    hostname?: () => string;
+    pidAlive?: (pid: number) => boolean;
+    /** Host-local FS probe (tests override). */
+    isStateDirHostLocal?: (stateDir: string) => boolean;
+    /** Deploy-handoff grace (ms) to wait for an outgoing same-host holder. Default 8000. */
+    handoffGraceMs?: number;
+    /** Poll interval (ms) while waiting for handoff. Default 250. */
+    pollIntervalMs?: number;
+    /** Awaitable delay (tests override). */
+    sleep?: (ms: number) => Promise<void>;
+    /** Override env read (tests inject). Default `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** Logger (default console.error). */
+    log?: (msg: string) => void;
+}
+/** `df -P` host-local classifier (FAIL-CLOSED) — same contract as ResumeQueue/semaphore. */
+export declare function isStateDirHostLocalForLock(stateDir: string): boolean;
+export declare class SingleInstanceLock {
+    private readonly stateDir;
+    private readonly now;
+    private readonly host;
+    private readonly pidAlive;
+    private readonly isStateDirHostLocal;
+    private readonly handoffGraceMs;
+    private readonly pollIntervalMs;
+    private readonly sleep;
+    private readonly env;
+    private readonly log;
+    private held;
+    constructor(deps: SingleInstanceLockDeps);
+    lockPath(): string;
+    /**
+     * Try to acquire the single-instance lock. Resolves with `acquired: false`
+     * (and a reason) on a genuine duplicate; `acquired: true` on success or a
+     * deliberate override.
+     */
+    acquire(): Promise<SingleInstanceLockResult>;
+    /** Refresh the heartbeat (optional — the lock is primarily pid-guarded). */
+    heartbeat(): void;
+    /** Release the lock — ONLY if WE still hold it (pid+host match). Idempotent. */
+    release(): void;
+    private readLock;
+    /** Atomic O_CREAT|O_EXCL write. Returns false if another writer won the race. */
+    private tryWriteLock;
+    private ensureDir;
+}
+/**
+ * Wire release on every exit path (SIGTERM/SIGINT/exit). The caller's graceful
+ * shutdown should ALSO call `lock.release()` directly (belt-and-suspenders); the
+ * `exit` handler is the last-resort net for a hard exit. Returns a disposer that
+ * removes the handlers (rarely needed; useful in tests).
+ */
+export declare function installReleaseHandlers(lock: SingleInstanceLock): () => void;
+export {};
+//# sourceMappingURL=SingleInstanceLock.d.ts.map

package/dist/core/SingleInstanceLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SingleInstanceLock.d.ts","sourceRoot":"","sources":["../../src/core/SingleInstanceLock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAUH,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,qCAAqC;IACrC,MAAM,CAAC,EAAE,yBAAyB,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;IACnF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sCAAsC;IACtC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,4FAA4F;AAC5F,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmBpE;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,IAAI,CAAS;gBAET,IAAI,EAAE,sBAAsB;IAaxC,QAAQ,IAAI,MAAM;IAIlB;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAoFlD,4EAA4E;IAC5E,SAAS,IAAI,IAAI;IAajB,gFAAgF;IAChF,OAAO,IAAI,IAAI;IAkBf,OAAO,CAAC,QAAQ;IAehB,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAmCpB,OAAO,CAAC,SAAS;CAIlB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAiB3E"}

package/dist/core/SingleInstanceLock.js

@@ -0,0 +1,300 @@
+/**
+ * SingleInstanceLock — P2 of the SIMPLE fork-bomb prevention design.
+ *
+ * Spec: docs/specs/forkbomb-prevention-simple.md (§P2, §D-LOCK).
+ *
+ * A per-agent, HOST-LOCAL lock so launchd + fleet + tmux cannot run DUPLICATE
+ * server instances of the same agent — the 3× multiplier that made the
+ * 2026-06-20 fork-bomb catastrophic (three concurrent server instances each
+ * re-flooding `claude -p`).
+ *
+ * MECHANISM (mirrors ProjectRoundLock O_CREAT|O_EXCL + the ResumeQueue host-lock
+ * contract):
+ *   - Lock file `<stateDir>/local/server-instance.lock`, holder record =
+ *     `{ pid, hostname, heartbeat }` (ms-epoch mtime-style heartbeat).
+ *   - A FOREIGN-hostname lock is NEVER pid-probed or reclaimed (refuse-loud —
+ *     the multi-machine shared-state-dir hazard, 2026-06-15): a legit standby on
+ *     a DIFFERENT host with its own non-shared state dir boots freely.
+ *   - Same-host stale reclaim is gated on a `df -P` host-local-disk confirmation
+ *     (fail-closed: cannot-confirm-local → never reclaim).
+ *   - DEPLOY HANDOFF (not too blunt): on finding a LIVE same-host holder, WAIT a
+ *     bounded grace for it to release (a normal restart kills-then-respawns, so
+ *     the outgoing holder's exit handler frees the lock) before refusing — so a
+ *     clean restart hands off and only a genuine DUPLICATE (two independent
+ *     supervisors racing) is refused.
+ *   - Override: `INSTAR_ALLOW_SECOND_INSTANCE=1` boots a deliberate admin/debug
+ *     instance without the lock.
+ *
+ * Release is wired by the CALLER via BOTH a `finally`/shutdown path AND a
+ * process exit handler (SIGTERM/SIGINT/exit) — see `installReleaseHandlers`.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { SafeFsExecutor } from './SafeFsExecutor.js';
+import { isAlive } from './ProjectRoundLock.js';
+/** `df -P` host-local classifier (FAIL-CLOSED) — same contract as ResumeQueue/semaphore. */
+export function isStateDirHostLocalForLock(stateDir) {
+    let out;
+    try {
+        // lint-allow-sync-spawn: a bounded (3s) one-shot host-FS classification, run
+        // only at server-BOOT during single-instance-lock acquisition (never on a
+        // request/event-loop path). Mirrors ResumeQueue's host-lock df -P contract.
+        out = execFileSync('df', ['-P', stateDir], { timeout: 3000, encoding: 'utf-8' });
+    }
+    catch {
+        // @silent-fallback-ok: df failed ⇒ cannot confirm local ⇒ fail-closed.
+        return false;
+    }
+    const lines = out.trim().split('\n');
+    if (lines.length < 2)
+        return false;
+    const source = lines[1]?.trim().split(/\s+/)[0] ?? '';
+    if (!source)
+        return false;
+    if (source.startsWith('//'))
+        return false;
+    if (/^[^/][^:]*:/.test(source))
+        return false;
+    if (source.startsWith('/dev/'))
+        return true;
+    return false;
+}
+export class SingleInstanceLock {
+    stateDir;
+    now;
+    host;
+    pidAlive;
+    isStateDirHostLocal;
+    handoffGraceMs;
+    pollIntervalMs;
+    sleep;
+    env;
+    log;
+    held = false;
+    constructor(deps) {
+        this.stateDir = deps.stateDir;
+        this.now = deps.now ?? (() => Date.now());
+        this.host = (deps.hostname ?? (() => os.hostname()))();
+        this.pidAlive = deps.pidAlive ?? isAlive;
+        this.isStateDirHostLocal = deps.isStateDirHostLocal ?? isStateDirHostLocalForLock;
+        this.handoffGraceMs = deps.handoffGraceMs ?? 8000;
+        this.pollIntervalMs = deps.pollIntervalMs ?? 250;
+        this.sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.env = deps.env ?? process.env;
+        this.log = deps.log ?? ((m) => console.error(m));
+    }
+    lockPath() {
+        return path.join(this.stateDir, 'local', 'server-instance.lock');
+    }
+    /**
+     * Try to acquire the single-instance lock. Resolves with `acquired: false`
+     * (and a reason) on a genuine duplicate; `acquired: true` on success or a
+     * deliberate override.
+     */
+    async acquire() {
+        // Operator override — a deliberate second/admin instance.
+        if (this.env['INSTAR_ALLOW_SECOND_INSTANCE'] === '1') {
+            this.log('[single-instance] INSTAR_ALLOW_SECOND_INSTANCE=1 — bypassing the single-instance lock (deliberate second instance).');
+            // Still write our record so a LATER third instance sees a holder.
+            this.tryWriteLock();
+            this.held = true;
+            return { acquired: true, overridden: true };
+        }
+        const deadline = this.now() + this.handoffGraceMs;
+        for (;;) {
+            const existing = this.readLock();
+            if (!existing) {
+                // Free — take it.
+                if (this.tryWriteLock()) {
+                    this.held = true;
+                    return { acquired: true };
+                }
+                // Lost a creation race — loop and re-read.
+                if (this.now() >= deadline) {
+                    return { acquired: false, reason: 'duplicate-live-instance' };
+                }
+                await this.sleep(this.pollIntervalMs);
+                continue;
+            }
+            // FOREIGN-host lock → NEVER reclaim (refuse-loud). A standby on another
+            // host with its own non-shared state dir boots freely; this branch only
+            // fires when two hosts SHARE a state dir (a misconfiguration we refuse
+            // rather than corrupt).
+            if (existing.hostname && existing.hostname !== this.host) {
+                this.log(`[single-instance] lock held by FOREIGN host "${existing.hostname}" (this host "${this.host}"). ` +
+                    `Refusing — the state dir must be host-local; a shared volume is unsupported. ` +
+                    `If this is a deliberate second instance, set INSTAR_ALLOW_SECOND_INSTANCE=1.`);
+                return { acquired: false, reason: 'foreign-host-conflict', currentHolder: existing };
+            }
+            // Same-host lock. Is the holder still alive?
+            if (this.pidAlive(existing.pid)) {
+                // A LIVE same-host holder. Could be a normal restart's outgoing instance
+                // (it will exit + release shortly) OR a genuine duplicate. Wait a bounded
+                // grace for a handoff before refusing.
+                if (this.now() >= deadline) {
+                    this.log(`[single-instance] refusing to start: a LIVE instance (pid ${existing.pid}) of this agent is already ` +
+                        `running on this host after a ${this.handoffGraceMs}ms handoff grace. This is the duplicate-flood guard. ` +
+                        `If this is intentional, set INSTAR_ALLOW_SECOND_INSTANCE=1.`);
+                    return { acquired: false, reason: 'duplicate-live-instance', currentHolder: existing };
+                }
+                await this.sleep(this.pollIntervalMs);
+                continue;
+            }
+            // Same-host DEAD holder — reclaim ONLY on a host-local-disk confirmation.
+            if (!this.isStateDirHostLocal(this.stateDir)) {
+                this.log(`[single-instance] same-host lock holder (pid ${existing.pid}) is dead, but the state dir could not be ` +
+                    `confirmed host-local (df -P) — refusing to reclaim (fail-closed). Set INSTAR_ALLOW_SECOND_INSTANCE=1 to override.`);
+                return { acquired: false, reason: 'foreign-host-conflict', currentHolder: existing };
+            }
+            // Reclaim the stale lock atomically and take it.
+            try {
+                SafeFsExecutor.safeUnlinkSync(this.lockPath(), { operation: 'SingleInstanceLock.acquire:reclaim-stale' });
+            }
+            catch {
+                /* race with another reclaimer — loop and re-read */
+            }
+            if (this.tryWriteLock()) {
+                this.held = true;
+                this.log(`[single-instance] reclaimed a stale same-host lock (dead pid ${existing.pid}).`);
+                return { acquired: true };
+            }
+            if (this.now() >= deadline) {
+                return { acquired: false, reason: 'duplicate-live-instance', currentHolder: existing };
+            }
+            await this.sleep(this.pollIntervalMs);
+        }
+    }
+    /** Refresh the heartbeat (optional — the lock is primarily pid-guarded). */
+    heartbeat() {
+        if (!this.held)
+            return;
+        const rec = this.readLock();
+        if (rec && rec.pid === process.pid && rec.hostname === this.host) {
+            rec.heartbeat = this.now();
+            try {
+                fs.writeFileSync(this.lockPath(), JSON.stringify(rec), 'utf-8');
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    /** Release the lock — ONLY if WE still hold it (pid+host match). Idempotent. */
+    release() {
+        if (!this.held)
+            return;
+        this.held = false;
+        const rec = this.readLock();
+        if (!rec)
+            return;
+        if (rec.pid !== process.pid || rec.hostname !== this.host) {
+            // A successor already took it — never delete someone else's lock.
+            return;
+        }
+        try {
+            SafeFsExecutor.safeUnlinkSync(this.lockPath(), { operation: 'SingleInstanceLock.release' });
+        }
+        catch {
+            /* @silent-fallback-ok: the lock is already gone — release is idempotent */
+        }
+    }
+    // ── Internals ─────────────────────────────────────────────────────
+    readLock() {
+        try {
+            const raw = fs.readFileSync(this.lockPath(), 'utf-8');
+            const obj = JSON.parse(raw);
+            if (typeof obj?.pid !== 'number')
+                return null;
+            if (typeof obj?.hostname !== 'string')
+                return null;
+            const heartbeat = typeof obj?.heartbeat === 'number' ? obj.heartbeat : 0;
+            return { pid: obj.pid, hostname: obj.hostname, heartbeat };
+        }
+        catch {
+            // @silent-fallback-ok: a missing/corrupt lock file reads as "no holder"
+            // (null) — the acquire loop then treats the slot as free, the safe direction.
+            return null;
+        }
+    }
+    /** Atomic O_CREAT|O_EXCL write. Returns false if another writer won the race. */
+    tryWriteLock() {
+        this.ensureDir();
+        const rec = { pid: process.pid, hostname: this.host, heartbeat: this.now() };
+        const body = JSON.stringify(rec);
+        const tmp = `${this.lockPath()}.tmp.${process.pid}`;
+        try {
+            const fd = fs.openSync(tmp, 'wx', 0o600);
+            fs.writeSync(fd, body);
+            fs.closeSync(fd);
+        }
+        catch {
+            // @silent-fallback-ok: a tmp-file write race ⇒ report "did not acquire"
+            // (false); the acquire loop re-reads and retries — never a silent grant.
+            try {
+                SafeFsExecutor.safeUnlinkSync(tmp, { operation: 'SingleInstanceLock.tryWriteLock:cleanup-tmp' });
+            }
+            catch { /* @silent-fallback-ok: tmp cleanup is best-effort */ }
+            return false;
+        }
+        // Use link()/rename guarded by an O_EXCL pre-check: rename would clobber an
+        // existing lock, so only rename when the target does NOT exist. The window
+        // is narrow; a clobber would only happen between two simultaneous fresh
+        // starts, and the pid-guarded release prevents deleting the winner's lock.
+        try {
+            if (fs.existsSync(this.lockPath())) {
+                // Someone created the lock between our read and now — back off.
+                try {
+                    SafeFsExecutor.safeUnlinkSync(tmp, { operation: 'SingleInstanceLock.tryWriteLock:exists-backoff' });
+                }
+                catch { /* @silent-fallback-ok: tmp cleanup is best-effort */ }
+                return false;
+            }
+            fs.renameSync(tmp, this.lockPath());
+            return true;
+        }
+        catch {
+            // @silent-fallback-ok: a rename race ⇒ report "did not acquire" (false);
+            // the acquire loop re-reads and retries — never a silent grant past the cap.
+            try {
+                SafeFsExecutor.safeUnlinkSync(tmp, { operation: 'SingleInstanceLock.tryWriteLock:cleanup-tmp' });
+            }
+            catch { /* @silent-fallback-ok: tmp cleanup is best-effort */ }
+            return false;
+        }
+    }
+    ensureDir() {
+        const localDir = path.join(this.stateDir, 'local');
+        if (!fs.existsSync(localDir))
+            fs.mkdirSync(localDir, { recursive: true });
+    }
+}
+/**
+ * Wire release on every exit path (SIGTERM/SIGINT/exit). The caller's graceful
+ * shutdown should ALSO call `lock.release()` directly (belt-and-suspenders); the
+ * `exit` handler is the last-resort net for a hard exit. Returns a disposer that
+ * removes the handlers (rarely needed; useful in tests).
+ */
+export function installReleaseHandlers(lock) {
+    const onExit = () => {
+        try {
+            lock.release();
+        }
+        catch { /* best-effort on teardown */ }
+    };
+    // 'exit' must be synchronous — release() is sync, so this is safe.
+    process.on('exit', onExit);
+    // SIGTERM/SIGINT: the server already installs its own graceful shutdown that
+    // exits the process, which fires 'exit'. We add direct handlers too so the
+    // lock frees even if some other SIGTERM handler exits first.
+    const onSignal = () => { onExit(); };
+    process.on('SIGTERM', onSignal);
+    process.on('SIGINT', onSignal);
+    return () => {
+        process.off('exit', onExit);
+        process.off('SIGTERM', onSignal);
+        process.off('SIGINT', onSignal);
+    };
+}
+//# sourceMappingURL=SingleInstanceLock.js.map

package/dist/core/SingleInstanceLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SingleInstanceLock.js","sourceRoot":"","sources":["../../src/core/SingleInstanceLock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAsChD,4FAA4F;AAC5F,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,IAAI,CAAS;IACb,QAAQ,CAA2B;IACnC,mBAAmB,CAAgC;IACnD,cAAc,CAAS;IACvB,cAAc,CAAS;IACvB,KAAK,CAAgC;IACrC,GAAG,CAAoB;IACvB,GAAG,CAAwB;IACpC,IAAI,GAAG,KAAK,CAAC;IAErB,YAAY,IAA4B;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;QACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;QAClF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,0DAA0D;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,KAAK,GAAG,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,qHAAqH,CAAC,CAAC;YAChI,kEAAkE;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAClD,SAAS,CAAC;YACR,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEjC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,kBAAkB;gBAClB,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC5B,CAAC;gBACD,2CAA2C;gBAC3C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;gBAChE,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,wBAAwB;YACxB,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,CAAC,GAAG,CACN,gDAAgD,QAAQ,CAAC,QAAQ,iBAAiB,IAAI,CAAC,IAAI,MAAM;oBACjG,+EAA+E;oBAC/E,8EAA8E,CAC/E,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YACvF,CAAC;YAED,6CAA6C;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,yEAAyE;gBACzE,0EAA0E;gBAC1E,uCAAuC;gBACvC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC3B,IAAI,CAAC,GAAG,CACN,6DAA6D,QAAQ,CAAC,GAAG,6BAA6B;wBACtG,gCAAgC,IAAI,CAAC,cAAc,uDAAuD;wBAC1G,6DAA6D,CAC9D,CAAC;oBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;gBACzF,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,0EAA0E;YAC1E,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,GAAG,CACN,gDAAgD,QAAQ,CAAC,GAAG,4CAA4C;oBACxG,mHAAmH,CACpH,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YACvF,CAAC;YACD,iDAAiD;YACjD,IAAI,CAAC;gBACH,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC5G,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,gEAAgE,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1D,kEAAkE;YAClE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IAED,qEAAqE;IAE7D,QAAQ;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC9C,IAAI,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,SAAS,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,8EAA8E;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iFAAiF;IACzE,YAAY;QAClB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,GAAG,GAAuB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC;gBAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;YACzK,OAAO,KAAK,CAAC;QACf,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACnC,gEAAgE;gBAChE,IAAI,CAAC;oBAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,gDAAgD,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;gBAC5K,OAAO,KAAK,CAAC;YACf,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,CAAC;gBAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;YACzK,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,SAAS;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,mEAAmE;IACnE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,GAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/SpawnCapIntelligenceProvider.d.ts

@@ -0,0 +1,89 @@
+/**
+ * SpawnCapIntelligenceProvider — P1 chokepoint + P3 bounded ingress of the
+ * SIMPLE fork-bomb prevention design (docs/specs/forkbomb-prevention-simple.md).
+ *
+ * A thin WRAPPER provider, layered EXACTLY like wrapIntelligenceWithCircuitBreaker:
+ * its `evaluate()` ACQUIRES a host-wide spawn slot (the HostSpawnSemaphore),
+ * calls the inner provider's `evaluate()` (the actual `claude -p` / `codex exec`
+ * spawn), and RELEASES the slot in a `finally`. It is installed at every return
+ * arm of `buildIntelligenceProvider`, so EVERY provider the factory hands out is
+ * bounded — and the acquire is PER-`evaluate()`, which is load-bearing:
+ * CoherenceGate builds its provider ONCE and fans ~10 reviewers in parallel
+ * through that ONE shared instance (the primary incident driver), so each of the
+ * N concurrent `evaluate()` calls must independently acquire a slot. A
+ * build-time acquire would NOT bind the fan-out.
+ *
+ * P3 — BOUNDED INGRESS (never an unbounded wait queue):
+ *   When the host cap is saturated, acquire POLLS the holder-set on a short
+ *   interval (~100ms) up to `acquireMs` (default 5000ms) — NOT an in-memory
+ *   waiter queue. Each poll is a cheap lock+count; the caller's large prompt
+ *   state stays where it already lives (no queue-node heap growth). A bound on
+ *   CONCURRENT POLLERS (`waitersMax`, default 64) caps the waiters too.
+ *
+ * On genuine exhaustion (timeout OR waiters-full):
+ *   - A GATING call (options.attribution.gating === true) THROWS
+ *     LlmCapacityUnavailableError — the caller's catch fails CLOSED (hold), NOT
+ *     auto-pass. The four gate seams (MessageSentinel / InputGuard /
+ *     MessagingToneGate / CoherenceReviewer) recognize this typed error.
+ *   - A non-gating BACKGROUND call also THROWS LlmCapacityUnavailableError;
+ *     its existing catch degrades to its heuristic/no-LLM path (loud + counted
+ *     via DegradationReporter, never silent) — same shape as a circuit-open
+ *     throw, so existing background catches already handle it.
+ *
+ * This wrapper SHEDS BEFORE the inner provider runs — no subprocess spawns on a
+ * shed, which is the whole point (no `claude -p`, no RSS).
+ */
+import type { IntelligenceProvider, IntelligenceOptions } from './types.js';
+import { HostSpawnSemaphore } from './hostSpawnSemaphore.js';
+/**
+ * Thrown when the host-wide spawn cap is saturated and the bounded-acquire
+ * window elapsed (or the concurrent-waiter ceiling was hit). A typed,
+ * recognizable shed — distinct from a rate-limit (LlmCircuitOpenError) and from
+ * a provider error — so each gate seam can fail CLOSED on it specifically.
+ */
+export declare class LlmCapacityUnavailableError extends Error {
+    readonly reason: 'acquire-timeout' | 'waiters-full';
+    readonly waitedMs: number;
+    readonly capacityUnavailable: true;
+    constructor(reason: 'acquire-timeout' | 'waiters-full', waitedMs: number);
+}
+/** Narrowing helper for the gate seams (avoids `instanceof` import churn). */
+export declare function isCapacityUnavailable(err: unknown): err is LlmCapacityUnavailableError;
+export interface SpawnCapProviderDeps {
+    semaphore?: HostSpawnSemaphore;
+    /** Poll-retry budget in ms. Default resolved from env/config/5000. */
+    acquireMs?: number;
+    /** Concurrent-poller ceiling. Default resolved from env/config/64. */
+    waitersMax?: number;
+    /** Poll interval in ms (default 100). */
+    pollIntervalMs?: number;
+    now?: () => number;
+    /** Unique-id generator (default the semaphore's). */
+    genId?: () => string;
+    /** Awaitable delay (tests override to avoid real timers). */
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Live count of callers currently polling for a spawn slot (P3 observability). */
+export declare function activeSpawnPollers(): number;
+/** Test seam. */
+export declare function _resetSpawnPollersForTest(): void;
+export declare class SpawnCapIntelligenceProvider implements IntelligenceProvider {
+    private readonly inner;
+    private readonly semaphore;
+    private readonly acquireMs;
+    private readonly waitersMax;
+    private readonly pollIntervalMs;
+    private readonly now;
+    private readonly genId;
+    private readonly sleep;
+    constructor(inner: IntelligenceProvider, deps?: SpawnCapProviderDeps);
+    evaluate(prompt: string, options?: IntelligenceOptions): Promise<string>;
+    /** Poll the semaphore every `pollIntervalMs` until acquired or the budget elapses. */
+    private pollAcquire;
+}
+/**
+ * Wrap a provider with the host spawn cap. No-ops on null (so a possibly-null
+ * factory result passes through unchanged) and is idempotent (never double-wraps).
+ */
+export declare function wrapIntelligenceWithSpawnCap(provider: IntelligenceProvider | null | undefined, deps?: SpawnCapProviderDeps): IntelligenceProvider | null;
+//# sourceMappingURL=SpawnCapIntelligenceProvider.d.ts.map

package/dist/core/SpawnCapIntelligenceProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpawnCapIntelligenceProvider.d.ts","sourceRoot":"","sources":["../../src/core/SpawnCapIntelligenceProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAInB,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IAGlD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAH3B,QAAQ,CAAC,mBAAmB,EAAG,IAAI,CAAU;gBAElC,MAAM,EAAE,iBAAiB,GAAG,cAAc,EAC1C,QAAQ,EAAE,MAAM;CAO5B;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,2BAA2B,CAKtF;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAOD,mFAAmF;AACnF,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,iBAAiB;AACjB,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,qBAAa,4BAA6B,YAAW,oBAAoB;IAUrE,OAAO,CAAC,QAAQ,CAAC,KAAK;IATxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;gBAGnC,KAAK,EAAE,oBAAoB,EAC5C,IAAI,GAAE,oBAAyB;IAY3B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0C9E,sFAAsF;YACxE,WAAW;CAiB1B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACjD,IAAI,CAAC,EAAE,oBAAoB,GAC1B,oBAAoB,GAAG,IAAI,CAI7B"}