jishushell 0.6.5 → 0.7.3

package/dist/services/repair/runtime-repair.js

@@ -0,0 +1,374 @@
+import { getIntegration } from "../integrations/index.js";
+import { resolveIntegrationKindFromMetadata } from "../app-common/integration-refs.js";
+import { resolveNomadJobId } from "../runtime/job-id.js";
+import { dirname, join } from "path";
+import { accessSync, chmodSync, constants, existsSync, statSync, writeFileSync } from "fs";
+import { stringify } from "yaml";
+import { APPS_DIR, JISHUSHELL_HOME } from "../../config.js";
+import { safeReadJson, safeWriteJson } from "../../utils/safe-json.js";
+import { chownToServiceUser, getConfig, getInstance, getRuntimeEnvFiles, listInstances, parseEnvFile, resolveServiceUser, updateInstanceMeta, updateEnvFile, } from "../instances/manager.js";
+import { buildCanonicalManifest, readCanonicalSpecSnapshotsFromDir, } from "../app-common/instance-store.js";
+import { MANIFEST_FILENAME, RESOLVED_SPEC_FILENAME, resolveAppDir, } from "../app-common/paths.js";
+import { bootstrapInstanceProxy, ensureInstanceProxyToken, } from "../llm-proxy/instance-proxy.js";
+import { getDefaultLlmProvider } from "../llm-proxy/providers.js";
+export const LEGACY_JOB_SPEC_RESTART_REPAIR_ID = "legacy-prefixed-nomad-job-spec-v1";
+const ANYTHINGLLM_INSTANCE_ID = "anythingllm-container";
+const ANYTHINGLLM_KNOWLEDGE_CAPABILITY = "knowledge-anythingllm";
+const OPENCLAW_KNOWLEDGE_SLOT = "KNOWLEDGE_BASE_URL";
+const RETIRED_MCP_SLOT = "MCP_SERVERS";
+function runtimeEnv(instanceId) {
+    const env = {};
+    for (const envFile of getRuntimeEnvFiles(instanceId)) {
+        Object.assign(env, parseEnvFile(envFile));
+    }
+    return env;
+}
+function configUsesProxy(config) {
+    if (!config)
+        return false;
+    if (config["x-jishushell"]?.proxy?.enabled)
+        return true;
+    const defaultModel = String(config.agents?.defaults?.model || "");
+    if (defaultModel.startsWith("jsproxy/") || defaultModel.startsWith("js-"))
+        return true;
+    const providers = config.models?.providers;
+    if (!providers || typeof providers !== "object")
+        return false;
+    return Object.values(providers).some((provider) => provider && typeof provider.baseUrl === "string" && provider.baseUrl.includes("/proxy"));
+}
+function legacyProviderKeys(env) {
+    return Object.keys(env)
+        .filter((key) => key.endsWith("_API_KEY") && key !== "JSPROXY_API_KEY")
+        .sort();
+}
+function providerEnvPath(instanceId) {
+    const envFile = getRuntimeEnvFiles(instanceId)[0];
+    return envFile ? join(dirname(envFile), "provider.env") : null;
+}
+function providerSecret(instanceId) {
+    const path = providerEnvPath(instanceId);
+    return path ? (parseEnvFile(path).UPSTREAM_API_KEY || "") : "";
+}
+function hasAnythingllmCredentials() {
+    return existsSync(join(JISHUSHELL_HOME, "provider-credentials", ANYTHINGLLM_INSTANCE_ID, "credentials.json"))
+        || existsSync(join(APPS_DIR, ANYTHINGLLM_INSTANCE_ID, "credentials.json"));
+}
+function maybeRepairOpenClawKnowledgeDefault(instanceId, instance, options, repaired, warnings) {
+    const connections = instance.connections && typeof instance.connections === "object" && !Array.isArray(instance.connections)
+        ? { ...instance.connections }
+        : {};
+    delete connections[RETIRED_MCP_SLOT];
+    if (Object.prototype.hasOwnProperty.call(connections, OPENCLAW_KNOWLEDGE_SLOT))
+        return;
+    if (!hasAnythingllmCredentials())
+        return;
+    // Runtime repair boundary only: pre-Step-5 OpenClaw treated a missing
+    // KNOWLEDGE_BASE_URL binding as "use AnythingLLM if credentials.json exists".
+    // The runtime hook no longer guesses that. Repair can safely preserve the old
+    // behavior by writing the observed historical default into canonical
+    // `instance.connections`, without overwriting explicit user disconnect/binds.
+    const nextConnections = {
+        ...connections,
+        [OPENCLAW_KNOWLEDGE_SLOT]: {
+            kind: "single",
+            providerId: ANYTHINGLLM_INSTANCE_ID,
+            capability: ANYTHINGLLM_KNOWLEDGE_CAPABILITY,
+        },
+    };
+    if (options.dryRun) {
+        warnings.push("would materialize legacy OpenClaw AnythingLLM knowledge default into instance.connections");
+        return;
+    }
+    updateInstanceMeta(instanceId, { connections: nextConnections });
+    repaired.push("knowledge-default-connection");
+}
+function maybeRepairRetiredMcpConnectionSlot(instanceId, instance, options, repaired, warnings) {
+    const connections = instance.connections && typeof instance.connections === "object" && !Array.isArray(instance.connections)
+        ? { ...instance.connections }
+        : {};
+    if (!Object.prototype.hasOwnProperty.call(connections, RETIRED_MCP_SLOT))
+        return;
+    if (options.dryRun) {
+        warnings.push("would remove retired MCP_SERVERS connection slot from instance.connections");
+        repaired.push("retired-mcp-connection-slot");
+        return;
+    }
+    delete connections[RETIRED_MCP_SLOT];
+    updateInstanceMeta(instanceId, { connections });
+    repaired.push("retired-mcp-connection-slot");
+}
+function isRetiredMcpRequire(req) {
+    return !!req
+        && typeof req === "object"
+        && !Array.isArray(req)
+        && req.capability === "mcp"
+        && req.inject_as === RETIRED_MCP_SLOT;
+}
+function maybeRepairRetiredMcpResolvedSpec(instanceId, options, repaired, warnings) {
+    const dir = resolveAppDir(instanceId);
+    const snapshots = readCanonicalSpecSnapshotsFromDir(dir);
+    if (!snapshots)
+        return;
+    const requires = snapshots.resolved.spec.requires;
+    if (!Array.isArray(requires) || !requires.some(isRetiredMcpRequire))
+        return;
+    if (options.dryRun) {
+        warnings.push("would remove retired MCP_SERVERS require from resolved-spec.yaml");
+        repaired.push("retired-mcp-resolved-spec");
+        return;
+    }
+    const nextSpec = {
+        ...snapshots.resolved.spec,
+        requires: requires.filter((req) => !isRetiredMcpRequire(req)),
+    };
+    const resolvedYaml = stringify(nextSpec);
+    writeFileSync(join(dir, RESOLVED_SPEC_FILENAME), resolvedYaml, { mode: 0o644 });
+    chownToServiceUser(join(dir, RESOLVED_SPEC_FILENAME));
+    const existingManifest = safeReadJson(join(dir, MANIFEST_FILENAME), `manifest:${instanceId}`) ?? {};
+    const manifest = buildCanonicalManifest({
+        instanceId,
+        spec: nextSpec,
+        definitionYaml: snapshots.definition.yaml,
+        resolvedSpecYaml: resolvedYaml,
+        installedAt: existingManifest.installedAt,
+        resources: Array.isArray(existingManifest.resources) ? existingManifest.resources : [],
+        ownedResources: Array.isArray(existingManifest.ownedResources) ? existingManifest.ownedResources : [],
+        source: typeof existingManifest.source === "string" ? existingManifest.source : undefined,
+    });
+    safeWriteJson(join(dir, MANIFEST_FILENAME), manifest);
+    chownToServiceUser(join(dir, MANIFEST_FILENAME));
+    repaired.push("retired-mcp-resolved-spec");
+}
+function serviceUserAccessError(path) {
+    if (!existsSync(path))
+        return null;
+    const serviceUser = resolveServiceUser();
+    if (serviceUser) {
+        try {
+            const stat = statSync(path);
+            const mode = stat.mode & 0o777;
+            const ownedByServiceUser = stat.uid === serviceUser.uid && stat.gid === serviceUser.gid;
+            const readableByServiceUser = (stat.uid === serviceUser.uid && (mode & 0o400) !== 0) ||
+                (stat.gid === serviceUser.gid && (mode & 0o040) !== 0) ||
+                ((mode & 0o004) !== 0);
+            if (ownedByServiceUser && readableByServiceUser)
+                return null;
+            return `service user ${serviceUser.username} cannot safely read ${path} (uid=${stat.uid}, gid=${stat.gid}, mode=${mode.toString(8)})`;
+        }
+        catch (error) {
+            return error?.message ?? String(error);
+        }
+    }
+    try {
+        accessSync(path, constants.R_OK);
+        return null;
+    }
+    catch (error) {
+        return error?.message ?? String(error);
+    }
+}
+function repairReadableFile(path, repairId, label, options, repaired, warnings) {
+    if (!path)
+        return;
+    const before = serviceUserAccessError(path);
+    if (!before)
+        return;
+    if (options.dryRun) {
+        warnings.push(`would repair ${label} permissions: ${path}`);
+        return;
+    }
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // chown below may still recover root-owned files when repair runs with sudo.
+    }
+    chownToServiceUser(path);
+    const after = serviceUserAccessError(path);
+    if (after) {
+        warnings.push(`${label} is not readable after ownership repair: ${after}`);
+    }
+    else {
+        repaired.push(repairId);
+    }
+}
+function proxyUpstreamProviderId(instance, config) {
+    return String(config?.["x-jishushell"]?.proxy?.upstream?.providerId
+        ?? instance["x-jishushell"]?.proxy?.upstream?.providerId
+        ?? "").trim();
+}
+function integrationPrefix(integrationKind) {
+    try {
+        return getIntegration(integrationKind).nomadJobPrefix ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function appliedRuntimeRepairRestarts(meta) {
+    const extension = meta?.["x-jishushell"];
+    const current = extension?.runtimeRepairRestartsApplied;
+    if (current && typeof current === "object" && !Array.isArray(current))
+        return current;
+    // Repair boundary only: releases that mixed instance repair into system
+    // reconciliation persisted this old acknowledgement field. Read it once so
+    // already-applied repairs do not start warning again after upgrade.
+    const legacy = extension?.runtimeRestartAdvisoriesApplied;
+    return legacy && typeof legacy === "object" && !Array.isArray(legacy) ? legacy : {};
+}
+function isRuntimeRepairRestartApplied(meta, repairId) {
+    return Boolean(appliedRuntimeRepairRestarts(meta)[repairId]);
+}
+export function markRuntimeRepairRestartApplied(instanceId, repairId = LEGACY_JOB_SPEC_RESTART_REPAIR_ID) {
+    const meta = getInstance(instanceId);
+    if (!meta)
+        return;
+    const extension = meta["x-jishushell"] && typeof meta["x-jishushell"] === "object"
+        ? { ...meta["x-jishushell"] }
+        : {};
+    extension.runtimeRepairRestartsApplied = {
+        ...appliedRuntimeRepairRestarts(meta),
+        [repairId]: {
+            appliedAt: new Date().toISOString(),
+        },
+    };
+    updateInstanceMeta(instanceId, { "x-jishushell": extension });
+}
+export async function repairRuntimeInstance(instance, options = {}) {
+    const instanceId = String(instance.id || "");
+    const integrationKind = resolveIntegrationKindFromMetadata(instance) ?? "unknown";
+    const repaired = [];
+    const warnings = [];
+    try {
+        const envFiles = getRuntimeEnvFiles(instanceId);
+        if (integrationKind === "openclaw" || integrationKind === "hermes") {
+            for (const envFile of envFiles) {
+                repairReadableFile(envFile, "runtime-env-permissions", "runtime env file", options, repaired, warnings);
+            }
+            repairReadableFile(providerEnvPath(instanceId), "provider-secret-permissions", "provider.env", options, repaired, warnings);
+        }
+        const beforeEnv = runtimeEnv(instanceId);
+        const beforeToken = beforeEnv.JSPROXY_API_KEY || "";
+        const beforeConfig = getConfig(instanceId);
+        const beforeUsesProxy = configUsesProxy(beforeConfig);
+        if (integrationKind === "openclaw") {
+            maybeRepairRetiredMcpConnectionSlot(instanceId, instance, options, repaired, warnings);
+            maybeRepairRetiredMcpResolvedSpec(instanceId, options, repaired, warnings);
+            maybeRepairOpenClawKnowledgeDefault(instanceId, instance, options, repaired, warnings);
+            if (!options.dryRun) {
+                await bootstrapInstanceProxy(instanceId, { allowLegacyConfigFallback: true });
+            }
+            else if (!beforeToken || !beforeUsesProxy) {
+                warnings.push("would bootstrap proxy token and jsproxy config");
+            }
+            const afterEnv = runtimeEnv(instanceId);
+            const afterConfig = getConfig(instanceId);
+            if (!beforeToken && afterEnv.JSPROXY_API_KEY)
+                repaired.push("proxy-token");
+            if (!beforeUsesProxy && configUsesProxy(afterConfig))
+                repaired.push("jsproxy-config");
+            if (afterEnv.JSPROXY_API_KEY) {
+                if (!options.dryRun) {
+                    const { writeInstanceVariables } = await import("../runtime/drivers/nomad.js");
+                    await writeInstanceVariables(instanceId);
+                    repaired.push("nomad-variables");
+                }
+                else {
+                    warnings.push("would write Nomad Variables for JSPROXY_API_KEY");
+                }
+            }
+            else {
+                warnings.push("JSPROXY_API_KEY is missing; no Nomad Variables were written");
+            }
+        }
+        else if (integrationKind === "hermes") {
+            maybeRepairRetiredMcpConnectionSlot(instanceId, instance, options, repaired, warnings);
+            maybeRepairRetiredMcpResolvedSpec(instanceId, options, repaired, warnings);
+            if (!beforeToken) {
+                if (!options.dryRun) {
+                    ensureInstanceProxyToken(instanceId);
+                    repaired.push("proxy-token");
+                }
+                else {
+                    warnings.push("would generate proxy-token");
+                }
+            }
+            const beforeSecret = providerSecret(instanceId);
+            const upstreamProviderId = proxyUpstreamProviderId(instance, beforeConfig);
+            if (!beforeSecret && upstreamProviderId) {
+                const defaultProvider = getDefaultLlmProvider();
+                if (defaultProvider?.apiKey && defaultProvider.id === upstreamProviderId) {
+                    if (!options.dryRun) {
+                        const path = providerEnvPath(instanceId);
+                        if (path) {
+                            updateEnvFile(path, { UPSTREAM_API_KEY: defaultProvider.apiKey });
+                            repaired.push("provider-secret");
+                        }
+                        else {
+                            warnings.push("Hermes env file is missing; provider.env path cannot be resolved");
+                        }
+                    }
+                    else {
+                        warnings.push("would write Hermes provider.env UPSTREAM_API_KEY from the default provider");
+                    }
+                }
+                else {
+                    warnings.push(`Hermes provider.env is missing and cannot be auto-repaired for upstream provider '${upstreamProviderId}'`);
+                }
+            }
+        }
+        const env = runtimeEnv(instanceId);
+        const legacyKeys = legacyProviderKeys(env);
+        if (legacyKeys.length > 0) {
+            warnings.push(`note: legacy env key(s) kept for backward compatibility: ${legacyKeys.join(", ")}`);
+        }
+        const prefix = integrationPrefix(integrationKind);
+        const resolvedJobId = resolveNomadJobId(instanceId, prefix);
+        const hadPrefixedId = !!prefix && instanceId === resolvedJobId && instanceId.startsWith(prefix);
+        const restartRequired = (integrationKind === "openclaw" || integrationKind === "hermes")
+            && hadPrefixedId
+            && !isRuntimeRepairRestartApplied(instance, LEGACY_JOB_SPEC_RESTART_REPAIR_ID);
+        const status = restartRequired
+            ? "needs-restart"
+            : repaired.length > 0
+                ? "repaired"
+                : warnings.length > 0
+                    ? "manual"
+                    : "ok";
+        return {
+            instanceId,
+            integrationKind,
+            status,
+            repaired,
+            warnings,
+            restartRequired,
+            ...(restartRequired ? { reason: "Nomad job template path may have changed; restart the instance to resubmit the job" } : {}),
+        };
+    }
+    catch (error) {
+        return {
+            instanceId,
+            integrationKind,
+            status: "error",
+            repaired,
+            warnings,
+            restartRequired: false,
+            error: error?.message ?? String(error),
+        };
+    }
+}
+export async function repairRuntimeInstances(options = {}) {
+    const results = [];
+    for (const instance of listInstances()) {
+        const integrationKind = resolveIntegrationKindFromMetadata(instance);
+        if (integrationKind !== "openclaw" && integrationKind !== "hermes")
+            continue;
+        results.push(await repairRuntimeInstance(instance, options));
+    }
+    return {
+        ok: results.every((result) => result.status !== "error"),
+        dryRun: options.dryRun === true,
+        results,
+    };
+}
+//# sourceMappingURL=runtime-repair.js.map

package/dist/services/repair/runtime-repair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-repair.js","sourceRoot":"","sources":["../../../src/services/repair/runtime-repair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAelE,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AACrF,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AACxD,MAAM,gCAAgC,GAAG,uBAAuB,CAAC;AACjE,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AACrD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAMvC,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,QAAa,EAAE,EAAE,CACrD,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,KAAK,iBAAiB,CAAC;SACtE,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;WACxG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mCAAmC,CAC1C,UAAkB,EAClB,QAA6B,EAC7B,OAA+B,EAC/B,QAAkB,EAClB,QAAkB;IAElB,MAAM,WAAW,GACf,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtG,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC;QAAE,OAAO;IACvF,IAAI,CAAC,yBAAyB,EAAE;QAAE,OAAO;IAEzC,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,8EAA8E;IAC9E,MAAM,eAAe,GAAG;QACtB,GAAG,WAAW;QACd,CAAC,uBAAuB,CAAC,EAAE;YACzB,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,uBAAuB;YACnC,UAAU,EAAE,gCAAgC;SAC7C;KACF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IACD,kBAAkB,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mCAAmC,CAC1C,UAAkB,EAClB,QAA6B,EAC7B,OAA+B,EAC/B,QAAkB,EAClB,QAAkB;IAElB,MAAM,WAAW,GACf,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtG,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC;QAAE,OAAO;IAEjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;QAC5F,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACrC,kBAAkB,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,OAAO,CAAC,CAAC,GAAG;WACP,OAAO,GAAG,KAAK,QAAQ;WACvB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;WAClB,GAA+B,CAAC,UAAU,KAAK,KAAK;WACpD,GAA+B,CAAC,SAAS,KAAK,gBAAgB,CAAC;AACvE,CAAC;AAED,SAAS,iCAAiC,CACxC,UAAkB,EAClB,OAA+B,EAC/B,QAAkB,EAClB,QAAkB;IAElB,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE5E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAClF,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI;QAC1B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;KAC9D,CAAC;IACF,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEtD,MAAM,gBAAgB,GAAG,YAAY,CAAsB,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,YAAY,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;IACzH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,UAAU;QACV,IAAI,EAAE,QAAQ;QACd,cAAc,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI;QACzC,gBAAgB,EAAE,YAAY;QAC9B,WAAW,EAAE,gBAAgB,CAAC,WAAW;QACzC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACtF,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;QACrG,MAAM,EAAE,OAAO,gBAAgB,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC1F,CAAC,CAAC;IACH,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtD,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEjD,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAC/B,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;YACxF,MAAM,qBAAqB,GACzB,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACtD,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACtD,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,IAAI,kBAAkB,IAAI,qBAAqB;gBAAE,OAAO,IAAI,CAAC;YAC7D,OAAO,gBAAgB,WAAW,CAAC,QAAQ,uBAAuB,IAAI,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QACxI,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAmB,EACnB,QAAgB,EAChB,KAAa,EACb,OAA+B,EAC/B,QAAkB,EAClB,QAAkB;IAElB,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,KAAK,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,4CAA4C,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA6B,EAC7B,MAAkC;IAElC,OAAO,MAAM,CACX,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU;WAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU;WACrD,EAAE,CACN,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB,CAAC,eAAuB;IAChD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,eAAsB,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,IAA4C;IAChF,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,EAAE,4BAA4B,CAAC;IACxD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEtF,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,MAAM,GAAG,SAAS,EAAE,+BAA+B,CAAC;IAC1D,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAyB,EAAE,QAAgB;IAChF,OAAO,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,UAAkB,EAClB,QAAQ,GAAG,iCAAiC;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;QAChF,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IACP,SAAS,CAAC,4BAA4B,GAAG;QACvC,GAAG,4BAA4B,CAAC,IAAI,CAAC;QACrC,CAAC,QAAQ,CAAC,EAAE;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;KACF,CAAC;IACF,kBAAkB,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAA6B,EAC7B,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,kCAAkC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,eAAe,KAAK,UAAU,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1G,CAAC;YACD,kBAAkB,CAChB,eAAe,CAAC,UAAU,CAAC,EAC3B,6BAA6B,EAC7B,cAAc,EACd,OAAO,EACP,QAAQ,EACR,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAEtD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,mCAAmC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvF,iCAAiC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3E,mCAAmC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,sBAAsB,CAAC,UAAU,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;iBAAM,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,WAAW,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACtF,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;oBAC/E,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;oBACzC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,mCAAmC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvF,iCAAiC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpB,wBAAwB,CAAC,UAAU,CAAC,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,CAAC,YAAY,IAAI,kBAAkB,EAAE,CAAC;gBACxC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;gBAChD,IAAI,eAAe,EAAE,MAAM,IAAI,eAAe,CAAC,EAAE,KAAK,kBAAkB,EAAE,CAAC;oBACzE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;wBACpB,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;wBACzC,IAAI,IAAI,EAAE,CAAC;4BACT,aAAa,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;4BAClE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBACnC,CAAC;6BAAM,CAAC;4BACN,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;wBACpF,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;oBAC9F,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CACX,qFAAqF,kBAAkB,GAAG,CAC3G,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,4DAA4D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,KAAK,aAAa,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,CAAC,eAAe,KAAK,UAAU,IAAI,eAAe,KAAK,QAAQ,CAAC;eACnF,aAAa;eACb,CAAC,6BAA6B,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAyB,eAAe;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACnB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,IAAI,CAAC;QAEb,OAAO;YACL,UAAU;YACV,eAAe;YACf,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,eAAe;YACf,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,oFAAoF,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7H,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO;YACL,UAAU;YACV,eAAe;YACf,MAAM,EAAE,OAAO;YACf,QAAQ;YACR,QAAQ;YACR,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;SACvC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,EAAE,CAAC;QACvC,MAAM,eAAe,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,eAAe,KAAK,UAAU,IAAI,eAAe,KAAK,QAAQ;YAAE,SAAS;QAC7E,OAAO,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;QAC/B,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/services/runtime/docker-network.d.ts

@@ -0,0 +1,8 @@
+import type { AppSpec } from "../../types.js";
+export declare function ensureAppDockerNetwork(spec: AppSpec, instanceId: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+export declare function removeAppDockerNetwork(spec: AppSpec, instanceId: string): Promise<string | null>;

package/dist/services/runtime/docker-network.js

@@ -0,0 +1,123 @@
+import { spawn } from "child_process";
+import { JISHUSHELL_HOME } from "../../config.js";
+import { buildDockerClientEnv } from "../../utils/docker-host.js";
+const COLIMA_PROFILE = "jishushell";
+const DOCKER_NETWORK_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
+const DOCKER_BUILTIN_NETWORK_NAMES = new Set(["bridge", "host", "none"]);
+function resolveAppDockerNetwork(spec, instanceId) {
+    const network = spec.network;
+    if (!network || network.mode !== "docker-bridge")
+        return null;
+    const rawName = typeof network.name === "string" && network.name.trim()
+        ? network.name.trim()
+        : `jishushell-${instanceId}`;
+    const name = rawName.replace(/\$\{instance\.id\}/g, instanceId);
+    if (!DOCKER_NETWORK_NAME_RE.test(name)) {
+        throw new Error(`Invalid docker bridge network name "${name}"`);
+    }
+    if (DOCKER_BUILTIN_NETWORK_NAMES.has(name.toLowerCase())) {
+        throw new Error(`Docker network name "${name}" is reserved; use an app-scoped user-defined bridge network name`);
+    }
+    return { name };
+}
+function runDocker(args) {
+    return new Promise((resolve) => {
+        const child = spawn("docker", args, {
+            env: buildDockerClientEnv({
+                jishuHome: JISHUSHELL_HOME,
+                colimaProfile: COLIMA_PROFILE,
+            }),
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => { stdout += chunk; });
+        child.stderr.on("data", (chunk) => { stderr += chunk; });
+        child.on("error", (error) => {
+            resolve({ ok: false, stdout, stderr: error.message, code: null });
+        });
+        child.on("close", (code) => {
+            resolve({ ok: code === 0, stdout, stderr, code });
+        });
+    });
+}
+function dockerError(result) {
+    return (result.stderr || result.stdout || `docker exited with code ${result.code ?? "unknown"}`).trim();
+}
+function isDockerAlreadyExistsError(error) {
+    return /\balready exists\b/i.test(error);
+}
+async function inspectNetworkDriver(name) {
+    const result = await runDocker(["network", "inspect", name, "--format", "{{.Driver}}"]);
+    if (!result.ok)
+        return null;
+    return result.stdout.trim();
+}
+async function removeNetworkByName(name) {
+    const result = await runDocker(["network", "rm", name]);
+    return result.ok ? null : dockerError(result);
+}
+async function createAppBridgeNetwork(name, instanceId) {
+    const result = await runDocker([
+        "network",
+        "create",
+        "--driver",
+        "bridge",
+        "--label",
+        "jishushell.managed=true",
+        "--label",
+        `jishushell.instance.id=${instanceId}`,
+        "--label",
+        "jishushell.network.mode=docker-bridge",
+        name,
+    ]);
+    return result.ok ? null : dockerError(result);
+}
+export async function ensureAppDockerNetwork(spec, instanceId) {
+    let network;
+    try {
+        network = resolveAppDockerNetwork(spec, instanceId);
+    }
+    catch (error) {
+        return { ok: false, error: error?.message ?? String(error) };
+    }
+    if (!network)
+        return { ok: true };
+    const driver = await inspectNetworkDriver(network.name);
+    if (driver === "bridge")
+        return { ok: true };
+    if (driver) {
+        const removeError = await removeNetworkByName(network.name);
+        if (removeError) {
+            return {
+                ok: false,
+                error: `Failed to replace Docker network '${network.name}' with bridge driver: ${removeError}`,
+            };
+        }
+    }
+    const createError = await createAppBridgeNetwork(network.name, instanceId);
+    if (createError) {
+        if (isDockerAlreadyExistsError(createError))
+            return { ok: true };
+        return { ok: false, error: `Failed to create Docker bridge network '${network.name}': ${createError}` };
+    }
+    return { ok: true };
+}
+export async function removeAppDockerNetwork(spec, instanceId) {
+    let network;
+    try {
+        network = resolveAppDockerNetwork(spec, instanceId);
+    }
+    catch (error) {
+        return error?.message ?? String(error);
+    }
+    if (!network)
+        return null;
+    const driver = await inspectNetworkDriver(network.name);
+    if (!driver)
+        return null;
+    return removeNetworkByName(network.name);
+}
+//# sourceMappingURL=docker-network.js.map

package/dist/services/runtime/docker-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-network.js","sourceRoot":"","sources":["../../../src/services/runtime/docker-network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AACpE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAazE,SAAS,uBAAuB,CAAC,IAAa,EAAE,UAAkB;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;QACrE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;QACrB,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,mEAAmE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,GAAG,EAAE,oBAAoB,CAAC;gBACxB,SAAS,EAAE,eAAe;gBAC1B,aAAa,EAAE,cAAc;aAC9B,CAAC;YACF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA2B;IAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,2BAA2B,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1G,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,UAAkB;IACpE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,SAAS;QACT,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,SAAS;QACT,yBAAyB;QACzB,SAAS;QACT,0BAA0B,UAAU,EAAE;QACtC,SAAS;QACT,uCAAuC;QACvC,IAAI;KACL,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,UAAkB;IAC5E,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,qCAAqC,OAAO,CAAC,IAAI,yBAAyB,WAAW,EAAE;aAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3E,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,0BAA0B,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAa,EAAE,UAAkB;IAC5E,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/runtime/driver-registry.d.ts

@@ -0,0 +1,25 @@
+import type { AppTask, AppTaskRuntime } from "../../types.js";
+import type { RuntimeSpec } from "./types.js";
+import type { TaskRuntimeContribution } from "./workload-types.js";
+export interface RuntimeDriverCompileContext {
+    instanceId: string;
+    extraEnv: Record<string, string>;
+    runtime?: RuntimeSpec;
+    contribution?: TaskRuntimeContribution;
+    appNetwork?: {
+        mode: "docker-bridge";
+        name: string;
+    };
+}
+export interface CompiledTaskFragment {
+    task: Record<string, unknown>;
+    reservedPorts: Array<Record<string, unknown>>;
+}
+export interface RuntimeDriver<TTask extends AppTask = AppTask> {
+    readonly kind: AppTaskRuntime;
+    compile(task: TTask, ctx: RuntimeDriverCompileContext): CompiledTaskFragment;
+}
+export declare function registerRuntimeDriver(driver: RuntimeDriver): void;
+export declare function hasRuntimeDriver(kind: AppTaskRuntime): boolean;
+export declare function getRuntimeDriver(kind: AppTaskRuntime): RuntimeDriver;
+export declare function __resetRuntimeDriversForTests(): void;

package/dist/services/runtime/driver-registry.js

@@ -0,0 +1,22 @@
+const registry = new Map();
+export function registerRuntimeDriver(driver) {
+    if (registry.has(driver.kind)) {
+        throw new Error(`Runtime driver for kind "${driver.kind}" already registered`);
+    }
+    registry.set(driver.kind, driver);
+}
+export function hasRuntimeDriver(kind) {
+    return registry.has(kind);
+}
+export function getRuntimeDriver(kind) {
+    const driver = registry.get(kind);
+    if (!driver) {
+        throw new Error(`No runtime driver registered for kind="${kind}". ` +
+            `Registered kinds: [${[...registry.keys()].join(", ") || "none"}]`);
+    }
+    return driver;
+}
+export function __resetRuntimeDriversForTests() {
+    registry.clear();
+}
+//# sourceMappingURL=driver-registry.js.map

package/dist/services/runtime/driver-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver-registry.js","sourceRoot":"","sources":["../../../src/services/runtime/driver-registry.ts"],"names":[],"mappings":"AAyBA,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,sBAAsB,CAAC,CAAC;IACjF,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,KAAK;YACjD,sBAAsB,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}