niceeval 0.13.2 → 0.13.3

package/dist/sandbox/docker.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["docker.ts"],"names":[],"mappings":";;;;;;AA0BA,wDAMC;AAQD,gDAiBC;AA4GD,wEAuCC;AAeD,4CAyCC;AACD,4DASC;AAED,kEAgBC;AAhSD,kDAAkD;AAClD,mEAAmE;AACnE,+CAA+C;AAC/C,yCAAoD;AACpD,6CAAyC;AACzC,+CAA8E;AAC9E,0DAA+B;AAC/B,mCAAuC;AAEvC,qDAA8E;AAC9E,yCAAwC;AACxC,yDAAmI;AACnI,yCAAkE;AAClE,+CAAyE;AACzE,mDAA0D;AAC1D,+CAAqC;AACrC,wDAA4D;AAC5D,2CAA6F;AAC7F,uDAA8E;AAC9E,6CAAuF;AAEvF,6DAA4D;AAC5D;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,CAAU;IAC7C,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,iDAAiD;IACjD,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,OAAO,YAAY,CAAC;IACxB,OAAO,IAAA,0CAA8B,EAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AACD;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,UAAmB;IACvE,MAAM,MAAM,GAAG,IAAI,mBAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;QAC3C,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,IAAK,CAEH,CAAC,UAAU,KAAK,GAAG;gBACjB,MAAM,CAAC,CAAC;QAChB,CAAC;IACL,CAAC;AACL,CAAC;AACD,wCAAwC;AACxC,MAAM,aAAa,GAAsC;IACrD,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;CACzB,CAAC;AACF,6DAA6D;AAC7D,oDAAoD;AACpD,gDAAgD;AAChD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,sEAAsE;AACtE,sEAAsE;AACtE,+DAA+D;AAC/D,yDAAyD;AACzD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,QAAQ;AACtC,WAAW;AACX,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,0DAA0D;AAC1D,8DAA8D;AAC9D,gEAAgE;AAChE,2CAA2C;AAC3C,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D;;;GAGG;AACU,QAAA,mCAAmC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,IAAI;IACJ,KAAK;IACL;QACI,iFAAiF;QACjF,uFAAuF;QACvF,kCAAkC;QAClC,sGAAsG;QACtG,sDAAsD;QACtD,gCAAgC,oBAAoB,4BAA4B;QAChF,6FAA6F;QAC7F,6HAA6H;KAChI,CAAC,IAAI,CAAC,IAAI,CAAC;CAIf,CAAC,CAAC;AACH,uDAAuD;AACvD,SAAS,kBAAkB,CAAC,KAAa;IACrC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AACnE,CAAC;AA0DD,SAAgB,8BAA8B,CAAC,IAM9C,EAAE,UAA8B,EAAE,QAGtB;IACT,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,UAAU,KAAK,sBAAsB,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sFAAsF;YAClG,WAAW,IAAI,CAAC,aAAa,IAAI,SAAS,YAAY,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iFAAiF;YAC7F,aAAa,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAAC,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,4FAA4F;YACxG,aAAa,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,IAAI,KAAK;QACvE,CAAC,CAAE,KAED,CAAC,UAAU;QACb,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACrC,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;AAC3C,CAAC;AACD,SAAgB,gBAAgB,CAAC,UAA2C,EAAE,SAA2C,EAAE,MAAyB,EAAE,EAAE,WAGvJ;IACG,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC;IACpG,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,KAAK,SAAS;QACvC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC1E,IAAI;YACJ;gBACI,IAAI;gBACJ,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC/C,QAAQ;gBACR,OAAO;gBACP,QAAQ,OAAO,CAAC,SAAS,EAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;aAC/D,CAAC,IAAI,CAAC,GAAG,CAAC;SACd,CAAC,CAAC,CAAC;IACR,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,GAAG,CAAC,UAAU,KAAK,UAAU;YACzB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,WAAW,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACtF,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;aACtC,CAAC;QACN,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QAChF,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KACnD,CAAC;AACN,CAAC;AACM,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAI7D,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAA,eAAI,EAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;QAChB,MAAM,IAAI,SAAS,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AACD,6EAA6E;AAC7E,SAAgB,2BAA2B,CAAC,cAAkC,EAAE,QAAgB,IAAA,wBAAU,GAAE,EAAE,gBAAkD,EAAE;IAC9J,OAAO;QACH,IAAI,EAAE,oBAAoB,KAAK,EAAE;QACjC,cAAc,EAAE,KAAK;QACrB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE;YACL,sCAAsC,EAAE,OAAO;SAClD;QACD,MAAM,EAAE;YACJ,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,cAAc,EAAE,CAAC;YACvF,GAAG,aAAa;SACnB;KACJ,CAAC;AACN,CAAC;AAGD;;;GAGG;AACH,MAAa,aAAa;IACb,OAAO,CAAS;IAChB,QAAQ,CAAgB;IACzB,MAAM,CAAS;IACf,SAAS,GAA4B,IAAI,CAAC;IAC1C,OAAO,GAA0B,IAAI,CAAC;IACtC,YAAY,GAAG,EAAE,CAAC;IAClB,OAAO,CAAU;IACjB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC5B,mEAAmE;IAC3D,WAAW,CAAU;IACrB,OAAO,CAAS;IAChB,KAAK,CAAU;IACf,QAAQ,CAAwC;IAChD,cAAc,CAAU;IACxB,WAAW,CAAe;IAC1B,WAAW,GAA6B,SAAS,CAAC;IAC1D,sDAAsD;IACrC,YAAY,CAAU;IACtB,UAAU,CAAkC;IAC5C,YAAY,CAAiC;IAC7C,SAAS,CAAmC;IAC5C,SAAS,CAAoC;IAC7C,gBAAgB,CAAU;IAC1B,GAAG,CAAoB;IACvB,aAAa,CAAmC;IAChD,mBAAmB,CAGlC;IACe,SAAS,CAAuB;IACjD,sDAAsD;IACrC,WAAW,CAAoB;IAChD,uDAAuD;IAC/C,gBAAgB,CAAU;IAClC,yDAAyD;IACjD,WAAW,GAAG,OAAO,CAAC;IACtB,eAAe,GAAG,MAAM,CAAC;IACzB,aAAa,GAAG,IAAI,CAAC;IACrB,YAAY,GAAG,mBAAmB,CAAC;IACnC,WAAW,CAAS;IACnB,YAAY,GAAG;QACpB,YAAY,EAAE,IAAA,uCAA0B,EAAC,IAAa,CAAC;QACvD,SAAS,EAAE,IAAA,uCAA0B,EAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAA,uCAA0B,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzD,cAAc,EAAE,IAAA,uCAA0B,EAAC,CAAC,cAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC3G,kBAAkB,EAAE,IAAA,uCAA0B,EAAC,CAAC,UAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;KAC/G,CAAC;IACF,YAAY,UAAgC,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAM,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,yDAAyD;QACzD,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,0DAA0D;IAClD,WAAW,CAAC,YAAoB;QACpC,MAAM,IAAI,GAAG,GAAG,YAAY,mEAAmE,CAAC;QAChG,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IACD,2DAA2D;IAC3D,kBAAkB,CAAC,UAAmB;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,UAErC,EAAE;QACF,MAAM,MAAM,GAAG,IAAI,mBAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YACxB,CAAC,CAAC,iBAAiB,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAC9B,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;SAC/C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,IAAI,WAAW,CAAC;QAC9C,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC;QACtD,uDAAuD;QACvD,6DAA6D;QAC7D,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,cAAsB;QAOvC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,OAAO,SAAS,IAAI,cAAc;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;YACtE,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,+CAA+C,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;oBACpF,8BAA8B,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,wCAAwC;aAC9G,CAAC;IACV,CAAC;IACD,yBAAyB;IACzB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAgC,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;YAC3E,sDAAsD;YACtD,+BAA+B;YAC/B,gEAAgE;YAChE,MAAM,aAAa,GAAc,EAAE,CAAC;YACpC,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,OAAO,YAAY,EAAE,CAAC;gBAClB,IAAI,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC7B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,OAAO,YAAY,EAAE,CAAC;gBAClB,IAAI,gBAAgB,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;oBACzC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC3B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACL,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CAAC,CAAC,mBAAmB,EAAE,GAAG,aAAa,CAAC,EAAE,mGAAmG,CAAC,CAAC;YAC3K,CAAC;YACD,MAAM,mBAAmB,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,yDAAyD;IACjD,KAAK,CAAC,6BAA6B,CAAC,KAAc;QACtD,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAC7D,OAAO,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC/B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,IAAA,mCAAgB,EAAC,IAAwC,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7F,IAAI,IAAI,KAAK,EAAE;gBACX,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC;YACH,gCAAgC;QACpC,CAAC;QACD,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,kBAAkB,CAAC,EAAE;oBAC9F,IAAI,EAAE,SAAS;iBAClB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7D,IAAI,IAAI,KAAK,EAAE;oBACX,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACL,CAAC;QACD,MAAM,CAAC;YACH,oDAAoD;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,mCAAmC;IAC3B,KAAK,CAAC,UAAU;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAChB,gDAAgD;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACjC,8BAA8B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/L,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ;gBAC3C,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ;aAC9C,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,cAAc,EAAE,IAAA,wBAAU,GAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvI,CAAC;QACD,WAAW;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACvE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3E,CAAC;QACD,qCAAqC;QACrC,0DAA0D;QAC1D,wEAAwE;QACxE,0DAA0D;QAC1D,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QACzI,2DAA2D;QAC3D,gEAAgE;QAChE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,yCAAoB,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/C,KAAK,EAAE,SAAS;YAChB,GAAG,CAAC,WAAW,KAAK,SAAS;gBACzB,CAAC,CAAC;oBACE,GAAG,EAAE;wBACD,IAAI;wBACJ,IAAI;wBACJ,SAAS,aAAa,eAAe,aAAa,kBAAkB,MAAM,kBAAkB,aAAa,EAAE;qBAC9G;iBACJ;gBACD,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,8CAA8C;YAC9C,0CAA0C;YAC1C,MAAM,EAAE;gBACJ,yBAAyB,EAAE,MAAM;gBACjC,GAAG,CAAC,MAAM;oBACN,CAAC,CAAC;wBACE,wBAAwB,EAAE,MAAM;wBAChC,8BAA8B,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,IAAI,SAAS;qBAC1F;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,yCAAuB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,IAAI,CAAC,aAAa;aACxB;YACD,GAAG,EAAE,IAAI;YACT,qEAAqE;YACrE,wDAAwD;YACxD,+DAA+D;YAC/D,UAAU,EAAE;gBACR,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;gBAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;aACrE;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,4BAA4B;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpC,gBAAgB;QAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,6CAA6C;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,oDAAoD;QACpD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,sEAAsE;IAC9D,gBAAgB;QACpB,OAAO,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5D,CAAC;IACO,sBAAsB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS;YACvB,OAAO,eAAM,CAAC,IAAI,CAAC;QACvB,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY;YACrD,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,OAAO,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;YACxE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;oBACpC,OAAO,EAAE,2CAAmC;oBAC5C,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,QAAQ;oBACR,KAAK,EAAE,6BAA6B;oBACpC,SAAS,EAAE,SAAS,CAAC,SAAS;iBACjC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;gBACpC,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,QAAQ;gBACR,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,SAAS,CAAC,SAAS;aACjC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACO,2BAA2B,CAAC,KAUnC;QACG,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACzC,IAAI,WAAW,GAAG,mBAAmB,CAAC;QACtC,MAAM,OAAO,GAAiC,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ;gBACpB,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,UAAU,CAAC;gBACnC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;gBACrD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa;oBACtG,UAAU,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,MAAM,CAAC,eAAM,CAAC,UAAU,CAAC;gBAClD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBACjD,iBAAiB,EAAE,MAAM;iBAC5B,CAAC;gBACF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC,CAAC;YACJ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBAC3B,OAAO;gBACX,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9G,CAAC;iBACI,CAAC;gBACF,WAAW,GAAG,MAAM,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YACpD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC;gBACd,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAgC,EAAE;YAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC;YACxE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/F,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,mCAAmC;oBAC9E,6CAA6C;gBACjD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,SAAS,OAAO,WAAW,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1H,CAAC,CAAC;QACF,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;;OAIG;IACK,KAAK,CAAC,sBAAsB;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YACvC,IAAI;YACJ,0EAA0E;SAC7E,EAAE;YACC,IAAI,EAAE,IAAI,CAAC,YAAY;gBACnB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,GAAG,KAAK,GAAG,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,WAAW,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,YAAY,GAAG,GAAG,IAAI,CAAC,WAAW,cAAc,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,gEAAgE;IACxD,WAAW;QACf,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,oBAAoB;IACZ,KAAK,CAAC,WAAW,CAAC,SAAiB;QACvC,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC;YACH,uDAAuD;YACvD,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;YACpH,QAAQ,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAChC,QAAQ,CAAC,IAAA,YAAC,EAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACnB,MAAM,MAAM,GAAG;YACX,SAAS;YACT,0CAA0C;YAC1C,uCAAuC;YACvC,6CAA6C;YAC7C,oFAAoF;YACpF,2CAA2C;YAC3C,0DAA0D;YAC1D,gDAAgD;YAChD,2DAA2D;YAC3D,2CAA2C;YAC3C,sDAAsD;YACtD,2CAA2C;YAC3C,sDAAsD;YACtD,MAAM;YACN,iLAAiL;YACjL,YAAY;YACZ,IAAI;YACJ,mJAAmJ;SACtJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,gBAAgB;IACR,KAAK,CAAC,SAAS,CAAC,SAAiB;QACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,MAA6B,EAAE,EAAE;gBAC7E,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,SAAuB,EAAE,EAAE;oBACjE,IAAI,SAAS,EAAE,CAAC;wBACZ,MAAM,CAAC,SAAS,CAAC,CAAC;oBACtB,CAAC;yBACI,CAAC;wBACF,OAAO,EAAE,CAAC;oBACd,CAAC;gBACL,CAAC;gBACD,iBAAiB;gBACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACD,sCAAsC;IACtC,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACjF,0DAA0D;QAC1D,gFAAgF;QAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,4DAA4D;QAC5D,iEAAiE;QACjE,2DAA2D;QAC3D,sCAAsC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAChG,MAAM,GAAG,GAAG;YACR,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,IAAI,CAAC,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,+DAA+D;YAC/D,kBAAkB;YAClB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACpC,GAAG;YACH,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;IACP,CAAC;IACD,2CAA2C;IACnC,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE,OAAuB,EAAE;QACtF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;IACP,CAAC;IACD,8CAA8C;IACtC,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACzC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,iDAAiD;IACzC,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE,OAWxD,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YACtD,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,yDAAyD;YACzD,wDAAwD;YACxD,MAAM,OAAO,GAAG,IAAA,oCAAiB,GAAE,CAAC;YACpC,iDAAiD;YACjD,gDAAgD;YAChD,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;gBAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,IAAI,MAAM,IAAI,QAAQ,KAAK,SAAS;oBAChC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/D,IAAI,MAAM,IAAI,QAAQ,KAAK,SAAS;oBAChC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,gEAAgE;YAChE,gDAAgD;YAChD,MAAM,KAAK,GAAG,IAAA,0BAAY,EAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAClG,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAqD,CAAC;YAC1D,IAAI,cAA0D,CAAC;YAC/D,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,IAAI,SAAS,KAAK,SAAS;oBACvB,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC5B,IAAI,cAAc,KAAK,SAAS;oBAC5B,aAAa,CAAC,cAAc,CAAC,CAAC;gBAClC,IAAI,UAAU,KAAK,SAAS;oBACxB,YAAY,CAAC,UAAU,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC;YACF,MAAM,eAAe,GAAG,CAAC,KAAY,EAAQ,EAAE;gBAC3C,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,KAAK,MAAM;oBAChD,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;wBACjD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;4BAC3B,MAAM,SAAS,CAAC;oBACxB,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;oBACvB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS;gBACrC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,eAAe,CAAC,IAAI,wCAA0B,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1H,CAAC,EAAE,SAAS,CAAC,CAAC;YAClB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACnC,eAAe,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;YAClH,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBACpB,OAAO,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgD,EAAiB,EAAE;gBACrF,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACD,MAAM,aAAa,CAAC;oBACpB,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjD,OAAO,CAAC;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;wBACxB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;wBACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;qBACrC,CAAC,CAAC;gBACP,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACL,CAAC,CAAC;YACF,kEAAkE;YAClE,kEAAkE;YAClE,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC9B,IAAI,OAAO,IAAI,YAAY,IAAI,UAAU,KAAK,SAAS;oBACnD,OAAO;gBACX,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;oBACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBACvE,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACrE,CAAC;gBACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBAChC,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACD,yCAAyC;IACzC,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAuB,EAAE;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,4DAA4D;YAC5D,MAAM,OAAO,GAAG,sBAAsB,MAAM,iBAAiB,aAAa,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,aAAa,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,eAAe;IACf,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACxF,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,OAAuB,EAAE;QAC3D,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,oBAAoB;IACpB,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,uBAAuB;IACf,KAAK,CAAC,mBAAmB,CAAC,KAAoC,EAAE,SAAkB;QACtF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;QACX,CAAC;QACD,WAAW;QACX,MAAM,IAAI,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC,CAAC,CAAC;QACL,MAAM,UAAU,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,IAAA,6BAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,+BAA+B;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,kDAAkD;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAoB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,IAAA,mBAAQ,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,SAAuB,EAAE,SAAkB,EAAE,OAE/D,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,IAAA,kCAAiB,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IACD;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,SAAuB,EAAE,OAEhE,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAA,sCAAmB,EAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5D,OAAO;YACX,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;YACtC,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC,CAAC;IACR,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,OAAO,IAAA,qCAAkB,EAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAO,IAAI,CAAC,SAA8B,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,OAAO,IAAA,mCAAgB,EAAC,MAA+B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAA,qBAAU,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,aAAa,IAAA,qBAAU,EAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrJ,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,qCAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,OAAmB;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,iCAAc,EAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oBAAQ,EAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAO,IAAI,CAAC,SAA8B,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAA,mBAAO,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,OAAe;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC;YAC1D,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAA2C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,KAA+C,EAAQ,EAAE;gBACrE,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,CAAC;YACF,MAAM,gBAAgB,GAAG,GAAS,EAAE;gBAChC,IAAI,OAAO,IAAI,YAAY;oBACvB,OAAO;gBACX,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC/B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;wBACvB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,OAAO,kCAAkC,CAAC,CAAC,CAAC;YACtF,CAAC,EAAE,KAAK,CAAC,CAAC;YACV,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBAChC,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,kCAAkC,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAoB;QACvD,MAAM,WAAW,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAA,oBAAS,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,IAAI;QACN,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,OAAO;QACX,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,aAAa,GAAc,EAAE,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QAC3C,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBACvB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;iBACI,CAAC;gBACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;oBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;oBAClC,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;wBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,oCAAoC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAC7B,CAAC;IACD,mFAAmF;IACnF,IAAI,gBAAgB;QAChB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5B,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACT,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;CACJ;AA/9BD,sCA+9BC","sourcesContent":["// Docker 沙箱 provider:用 dockerode 把容器当隔离工作区跑 eval。\n// 改编自 agent-eval 的 docker-sandbox.ts,签名对齐 ../types.ts 的 Sandbox 契约\n//(runShell/runCommand 的 opts 一律是选项对象,不再用位置参数)。\nimport { basename, dirname, join } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\nimport { mkdir, readFile, realpath, stat, writeFile } from \"node:fs/promises\";\nimport Docker from \"dockerode\";\nimport { Clock, Effect } from \"effect\";\nimport type { CommandResult, CommandOptions, SandboxReuseCapability, SuccessfulCommandResult, } from \"../types.ts\";\nimport { collectLocalFiles, type CollectedLocalFile } from \"./local-files.ts\";\nimport { shellQuote } from \"./shell.ts\";\nimport { createExecDemuxer, extractFileFromTar, extractFilesFromTar, packFilesToTar, readableToBuffer, } from \"./docker-stream.ts\";\nimport { resolveLocalPath, resolveSandboxPath } from \"./paths.ts\";\nimport { commandLimit, SandboxCommandTimeoutError } from \"./deadline.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { t } from \"../i18n/index.ts\";\nimport { reportActivity } from \"../runner/feedback/sink.ts\";\nimport { classifyProvisionErrorFallback, type SandboxProvisionErrorKind } from \"./errors.ts\";\nimport { dockerRunIdentityLabels, type RunIdentity } from \"./run-identity.ts\";\nimport { supportedBackendCapability, type SandboxProviderBackend } from \"./backend.ts\";\nimport type { DockerSandboxAccess, DockerSandboxReadiness, DockerSandboxResources } from \"./layer.ts\";\nimport { dindContainerCommand } from \"./dind-supervisor.ts\";\n/**\n * dockerode 对镜像拉取限流没有专门的错误类型;Docker Hub 429 体现在错误 message 里\n * (如 \"toomanyrequests: You have reached your pull rate limit\")。\n */\nexport function classifyProvisionError(e: unknown): SandboxProvisionErrorKind {\n    const msg = e instanceof Error ? e.message : String(e);\n    // provider 原生限流形态先归拒绝类;没认出的过与文件 IO 共用的保守瞬时兜底分类器。\n    if (/toomanyrequests|rate limit exceeded|429/i.test(msg))\n        return \"rate_limit\";\n    return classifyProvisionErrorFallback(e);\n}\n/**\n * Provisioning 重试前的对账:按 provision token 查询本地 daemon,查到的实例先销毁再重建\n * (不做断线收养,重建比重连语义干净)。docker create 是对本地 daemon 的调用,歧义窗口极小,\n * 这条主要兜 daemon 代理 / 远程 DOCKER_HOST 的场景。查询或销毁失败必须抛出——对账是重试的\n * 硬前置,静默放行等于盲重试(见 docs/feature/sandbox/architecture.md);唯一的例外:\n * 容器已不存在(404),视作对账完成。\n */\nexport async function reconcileProvision(token: string, socketPath?: string): Promise<void> {\n    const docker = new Docker(socketPath === undefined ? undefined : { socketPath });\n    const containers = await docker.listContainers({\n        all: true,\n        filters: { label: [`niceeval.provision-token=${token}`] },\n    });\n    for (const info of containers) {\n        try {\n            await docker.getContainer(info.Id).remove({ force: true });\n        }\n        catch (e) {\n            if ((e as {\n                statusCode?: number;\n            }).statusCode !== 404)\n                throw e;\n        }\n    }\n}\n// 各 Node 运行时对应的镜像。用 -slim 变体下载更快、兼容性够用。\nconst DOCKER_IMAGES: globalThis.Record<string, string> = {\n    node20: \"node:20-slim\",\n    node24: \"node:24-slim\",\n};\n// 容器 dead-man TTL 的兜底基数:四层解析链一个上限都没声明(attempt 没有 deadline)时,\n// TTL 仍需要一个具体秒数烧进 PID1。它只决定「孤儿容器多久自行消失」,不是任何命令的上限——\n// 单条命令的上限恒从 attempt deadline 派生(见 deadline.ts)。\nconst TTL_BASE_WITHOUT_DEADLINE = 600000;\n// 容器「存活上限」(dead-man switch):PID1 用 `timeout <TTL> tail -F` 跑,到点自动退出 →\n// 容器停止 → AutoRemove 清理。这样即便宿主进程被 kill -9 / 崩溃 / 断电(SIGINT handler 来不及\n// 跑 stop()),孤儿容器也会在 TTL 后自行消失,不靠任何外部状态。TTL 取 attempt 超时的 2 倍并设\n// 下限,确保正常运行(setup + agent + 脚本,本就受 attempt 超时约束)绝不会被它误杀。\nconst TTL_MULTIPLIER = 2;\nconst TTL_FLOOR_MS = 1200000; // 20 分钟\n// 容器内工作目录。\nconst CONTAINER_WORKDIR = \"/home/sandbox/workspace\";\n// 容器「主日志」文件:PID1 tail 它 → `docker logs` 实时显示;agent 命令的 stream 输出 tee 进来。\nconst CONTAINER_LOG = \"/tmp/niceeval-agent.log\";\n// 命令默认沿用环境自己声明的执行身份:省略 `user` 时 docker exec 不注入 `--user`,\n// 镜像 `USER` 原样生效(未声明按 Docker 语义是 root)。需要别的身份走 factory `user`\n// (整个 Sandbox 的默认身份)或 runCommand 的 `{ user: \"root\" }`(只这一条命令)——\n// 见 docs/feature/sandbox/library.md「执行身份」。\nconst ROOT_USER = \"root\";\nconst DOCKER_ACCESS_SOCKET = \"unix:///var/run/docker.sock\";\n/**\n * This is intentionally provider-owned.  It proves the Agent's *initial default*\n * endpoint without pretending to constrain commands the Agent may issue later.\n */\nexport const DOCKER_ACCESS_COMPATIBILITY_COMMAND = Object.freeze([\n    \"sh\",\n    \"-ec\",\n    [\n        'test -z \"${DOCKER_HOST+x}\" || { echo \"DOCKER_HOST must be unset\" >&2; exit 1; }',\n        'test -z \"${DOCKER_CONTEXT+x}\" || { echo \"DOCKER_CONTEXT must be unset\" >&2; exit 1; }',\n        'context=\"$(docker context show)\"',\n        'test \"$context\" = \"default\" || { echo \"docker context must be default (got $context)\" >&2; exit 1; }',\n        'default_daemon=\"$(docker info --format \\'{{.ID}}\\')\"',\n        `unix_daemon=\"$(docker --host=${DOCKER_ACCESS_SOCKET} info --format '{{.ID}}')\"`,\n        'test -n \"$default_daemon\" || { echo \"bare docker info returned no daemon ID\" >&2; exit 1; }',\n        'test \"$default_daemon\" = \"$unix_daemon\" || { echo \"bare and Unix Docker endpoints reached different daemons\" >&2; exit 1; }',\n    ].join(\"\\n\"),\n] as const satisfies readonly [\n    string,\n    ...string[]\n]);\n/** `user` 取值是否等价于 root(数字 uid 0、`0:0` 或字面量 `root`)。 */\nfunction isRootLikeUserSpec(value: string): boolean {\n    return value === \"0\" || value === \"0:0\" || value === ROOT_USER;\n}\n/** 创建 Docker 沙箱的选项。 */\nexport interface DockerSandboxOptions {\n    /** attempt 的超时上限(毫秒),单条命令未显式传 `timeout` 时的上限来源;省略 = 没有上限。 */\n    timeout?: number;\n    /** attempt deadline 的截止时刻(epoch ms);单条命令按**剩余量**取上限(见 deadline.ts)。 */\n    deadlineAt?: number;\n    /** 容器实例寿命；与单条命令 timeout 分离。 */\n    lifetimeMs?: number;\n    /** Node 运行时。 */\n    runtime?: \"node20\" | \"node24\";\n    /** 覆盖默认镜像(默认按 runtime 选 `node:*-slim`)。预制模板:烘焙好 agent CLI 的镜像名。 */\n    image?: string;\n    /** runner 绑定到 `sandbox.create` 的反馈句柄(镜像拉取进度走它);省略退回全局 sink。 */\n    feedback?: import(\"../types.ts\").ScopedFeedback;\n    /** 一次性 provision token:写进容器 label,歧义类失败重试前按它对账(见 errors.ts 的两维分类)。 */\n    provisionToken?: string;\n    /**\n     * 创建期写入的运行标识(host/pid/startedAt),供强杀之后的孤儿核对按 label 事后收回(见\n     * docs/feature/sandbox/architecture.md「孤儿核对」)。省略时不写这组 label(如直接单测构造\n     * DockerSandbox,不经 runtime.ts 的 provider materializer)。\n     */\n    runIdentity?: RunIdentity;\n    /**\n     * 覆盖默认 workdir。Compose mainService 附着时用容器 inspect 的 WorkingDir;\n     * 省略 = `/home/sandbox/workspace`。\n     */\n    workdir?: string;\n    /**\n     * 覆盖整个 Sandbox 的默认执行身份;省略时沿用镜像 `USER`(未声明按 Docker 语义是 root)、\n     * Compose service `user:` 或其镜像 `USER`。\n     */\n    user?: string;\n    /** raw = 直接请求 privileged；rootless = 只允许受管 rootless daemon。 */\n    privileged?: \"disabled\" | \"raw\" | \"rootless\";\n    /** Agent在Sandbox内访问Docker的模式；socket模式会显式挂载宿主Unix socket。 */\n    dockerAccess?: Readonly<DockerSandboxAccess>;\n    /** 创建容器时交给 daemon 强制执行的资源边界。 */\n    resources?: Readonly<DockerSandboxResources>;\n    /** PID 1 启动后、任何 setup/prepare/agent 命令之前必须通过的作者声明探针。 */\n    readiness?: Readonly<DockerSandboxReadiness>;\n    /** profile-bound provider fixes every Docker I/O to the attested Unix endpoint. */\n    dockerSocketPath?: string;\n    /** Descriptor-pinned public resolvers; managed privileged mode never invents defaults. */\n    dns?: readonly string[];\n    /** Durable watchdog ownership labels, copied to both container and exclusive network. */\n    managedLabels?: Readonly<Record<string, string>>;\n    rootlessAttestation?: {\n        readonly daemonId: string;\n        readonly dataRoot: string;\n    };\n    afterStop?: () => Promise<void>;\n    /**\n     * 按序前置到受管 `PATH` 的目录;省略 = 不改 PATH(见 docs/feature/sandbox/library.md\n     * 「PATH:受管变量与 pathPrepend」)。\n     */\n    pathPrepend?: readonly string[];\n}\nexport function assertRootlessPrivilegedDaemon(info: {\n    readonly ID?: string;\n    readonly SecurityOptions?: readonly string[];\n    readonly DockerRootDir?: string;\n    readonly CgroupDriver?: string;\n    readonly CgroupVersion?: string;\n}, dockerHost: string | undefined, expected: {\n    readonly daemonId?: string;\n    readonly dataRoot?: string;\n} | undefined): void {\n    if (dockerHost === undefined || !dockerHost.startsWith(\"unix://\")) {\n        throw new Error('privileged Docker sandbox requires an explicit rootless Unix DOCKER_HOST; no default socket or TCP endpoint is allowed');\n    }\n    const socketPath = dockerHost.slice(\"unix://\".length);\n    if (socketPath === \"/var/run/docker.sock\" || socketPath === \"/run/docker.sock\") {\n        throw new Error(\"privileged Docker sandbox refuses the host rootful Docker socket\");\n    }\n    const securityOptions = info.SecurityOptions ?? [];\n    if (!securityOptions.some((entry) => /(?:^|[=,])rootless(?:$|[=,])/i.test(entry))) {\n        throw new Error(\"privileged Docker sandbox requires a daemon whose SecurityOptions report rootless\");\n    }\n    if (info.CgroupVersion !== \"2\" || info.CgroupDriver !== \"systemd\") {\n        throw new Error(`privileged Docker sandbox requires delegated cgroup v2 with the systemd driver; got ` +\n            `version=${info.CgroupVersion ?? \"unknown\"}, driver=${info.CgroupDriver ?? \"unknown\"}`);\n    }\n    if (expected?.daemonId === undefined || expected.daemonId === \"\") {\n        throw new Error(\"privileged Docker sandbox requires NICEEVAL_ROOTLESS_DOCKER_ID attestation\");\n    }\n    if (info.ID !== expected.daemonId) {\n        throw new Error(`privileged Docker sandbox daemon ID does not match NICEEVAL_ROOTLESS_DOCKER_ID ` +\n            `(expected ${expected.daemonId}, got ${info.ID ?? \"unknown\"})`);\n    }\n    if (expected?.dataRoot === undefined || expected.dataRoot === \"\") {\n        throw new Error(\"privileged Docker sandbox requires NICEEVAL_ROOTLESS_DOCKER_DATA_ROOT attestation\");\n    }\n    if (info.DockerRootDir !== expected.dataRoot) {\n        throw new Error(`privileged Docker sandbox DockerRootDir does not match NICEEVAL_ROOTLESS_DOCKER_DATA_ROOT ` +\n            `(expected ${expected.dataRoot}, got ${info.DockerRootDir ?? \"unknown\"})`);\n    }\n}\nfunction dockerStatusCode(error: unknown): number | undefined {\n    return typeof error === \"object\" && error !== null && \"statusCode\" in error\n        ? (error as {\n            readonly statusCode?: number;\n        }).statusCode\n        : undefined;\n}\nfunction benignStopError(error: unknown): boolean {\n    const status = dockerStatusCode(error);\n    return status === 304 || status === 404;\n}\nfunction benignRemoveError(error: unknown): boolean {\n    return dockerStatusCode(error) === 404;\n}\nexport function dockerHostConfig(privileged: \"disabled\" | \"raw\" | \"rootless\", resources: Readonly<DockerSandboxResources>, dns: readonly string[] = [], socketMount?: {\n    readonly source: string;\n    readonly gid: number;\n}): Docker.HostConfig {\n    const nanoCpus = resources.cpus === undefined ? undefined : Math.round(resources.cpus * 1000000000);\n    if (nanoCpus !== undefined && !Number.isSafeInteger(nanoCpus)) {\n        throw new TypeError(\"Docker sandbox resources.cpus is too large to encode as NanoCpus\");\n    }\n    const tmpfs = resources.tmpfs === undefined\n        ? undefined\n        : Object.fromEntries(Object.entries(resources.tmpfs).map(([path, options]) => [\n            path,\n            [\n                \"rw\",\n                options.executable === true ? \"exec\" : \"noexec\",\n                \"nosuid\",\n                \"nodev\",\n                `size=${options.sizeBytes}`,\n                ...(options.mode === undefined ? [] : [`mode=${options.mode.toString(8).padStart(4, \"0\")}`]),\n                ...(options.uid === undefined ? [] : [`uid=${options.uid}`]),\n                ...(options.gid === undefined ? [] : [`gid=${options.gid}`]),\n            ].join(\",\"),\n        ]));\n    return {\n        AutoRemove: false,\n        ...(privileged !== \"disabled\"\n            ? { Privileged: true, ...(dns.length === 0 ? {} : { Dns: [...dns] }) }\n            : {}),\n        ...(socketMount === undefined\n            ? {}\n            : {\n                Mounts: [{ Type: \"bind\", Source: socketMount.source, Target: \"/var/run/docker.sock\" }],\n                GroupAdd: [String(socketMount.gid)],\n            }),\n        ...(nanoCpus === undefined ? {} : { NanoCpus: nanoCpus }),\n        ...(resources.memoryBytes === undefined ? {} : { Memory: resources.memoryBytes }),\n        ...(resources.memoryBytes === undefined ? {} : { MemorySwap: resources.memoryBytes }),\n        ...(resources.pidsLimit === undefined ? {} : { PidsLimit: resources.pidsLimit }),\n        ...(resources.readOnlyRootfs === true ? { ReadonlyRootfs: true } : {}),\n        ...(tmpfs === undefined ? {} : { Tmpfs: tmpfs }),\n    };\n}\nexport async function resolveDockerSocketMount(socketPath: string): Promise<{\n    readonly source: string;\n    readonly gid: number;\n}> {\n    const source = await realpath(socketPath);\n    const info = await stat(source);\n    if (!info.isSocket())\n        throw new TypeError(`Docker socket path is not a Unix socket: ${socketPath}`);\n    return Object.freeze({ source, gid: info.gid });\n}\n/** managed privileged Attempt 的独占 outer network；允许 NAT 出站，但禁止 sibling 互通。 */\nexport function dockerManagedNetworkOptions(provisionToken: string | undefined, nonce: string = randomUUID(), managedLabels: Readonly<Record<string, string>> = {}): Docker.NetworkCreateOptions {\n    return {\n        Name: `niceeval-attempt-${nonce}`,\n        CheckDuplicate: false,\n        Driver: \"bridge\",\n        Internal: false,\n        Attachable: false,\n        Options: {\n            \"com.docker.network.bridge.enable_icc\": \"false\",\n        },\n        Labels: {\n            \"niceeval.managed-network\": \"true\",\n            ...(provisionToken === undefined ? {} : { \"niceeval.provision-token\": provisionToken }),\n            ...managedLabels,\n        },\n    };\n}\n/** `stop()` 时是否销毁容器。Compose 主容器由资源组 `compose down` 回收,附着句柄只松绑。 */\nexport type DockerSandboxReleaseMode = \"destroy\" | \"detach\";\n/**\n * Docker 沙箱:为每次运行起一个隔离容器。\n * 实现 ../types.ts 的 Sandbox 接口。\n */\nexport class DockerSandbox implements SandboxProviderBackend, SandboxReuseCapability {\n    readonly workdir: string;\n    readonly otlpHost: string | null;\n    private docker: Docker;\n    private container: Docker.Container | null = null;\n    private network: Docker.Network | null = null;\n    private _containerId = \"\";\n    private timeout?: number;\n    private deadlineAt?: number;\n    private lifetimeMs?: number;\n    /** 容器 PID1 的 dead-man TTL 到期时刻(initialize 里烧进 `timeout` 那一刻定死)。 */\n    private expiresAtMs?: number;\n    private runtime: string;\n    private image?: string;\n    private feedback?: import(\"../types.ts\").ScopedFeedback;\n    private provisionToken?: string;\n    private runIdentity?: RunIdentity;\n    private releaseMode: DockerSandboxReleaseMode = \"destroy\";\n    /** 起点覆盖(factory `user`);省略 = 沿用镜像/Compose 声明的默认身份。 */\n    private readonly userOverride?: string;\n    private readonly privileged: \"disabled\" | \"raw\" | \"rootless\";\n    private readonly dockerAccess?: Readonly<DockerSandboxAccess>;\n    private readonly resources: Readonly<DockerSandboxResources>;\n    private readonly readiness?: Readonly<DockerSandboxReadiness>;\n    private readonly dockerSocketPath?: string;\n    private readonly dns: readonly string[];\n    private readonly managedLabels: Readonly<Record<string, string>>;\n    private readonly rootlessAttestation?: {\n        readonly daemonId: string;\n        readonly dataRoot: string;\n    };\n    private readonly afterStop?: () => Promise<void>;\n    /** factory `pathPrepend`;按声明顺序前置到受管 PATH,省略 = 空数组。 */\n    private readonly pathPrepend: readonly string[];\n    /** DinD 覆盖容器 User 为 root 后，仍用镜像 USER 作为 Agent 默认身份。 */\n    private imageDefaultUser?: string;\n    /** 下面三项由 `resolveDefaultIdentity()` 探测得出,构造期先给出安全占位值。 */\n    private defaultHome = \"/root\";\n    private defaultUserName = \"root\";\n    private defaultIsRoot = true;\n    private npmGlobalDir = \"/root/.npm-global\";\n    private sandboxPath: string;\n    readonly capabilities = {\n        rootCommands: supportedBackendCapability(true as const),\n        appendLog: supportedBackendCapability((line: string) => this.appendLog(line)),\n        suspend: supportedBackendCapability(() => this.suspend()),\n        ensureLifetime: supportedBackendCapability((minRemainingMs: number) => this.ensureLifetime(minRemainingMs)),\n        setCommandDeadline: supportedBackendCapability((deadlineAt?: number) => this.setCommandDeadline(deadlineAt)),\n    };\n    constructor(options: DockerSandboxOptions = {}) {\n        this.docker = new Docker(options.dockerSocketPath === undefined ? undefined : { socketPath: options.dockerSocketPath });\n        this.workdir = options.workdir ?? CONTAINER_WORKDIR;\n        this.timeout = options.timeout;\n        this.deadlineAt = options.deadlineAt;\n        this.lifetimeMs = options.lifetimeMs;\n        this.runtime = options.runtime ?? \"node24\";\n        this.image = options.image;\n        this.feedback = options.feedback;\n        this.provisionToken = options.provisionToken;\n        this.runIdentity = options.runIdentity;\n        this.userOverride = options.user === \"\" ? undefined : options.user;\n        this.privileged = options.privileged ?? \"disabled\";\n        this.dockerAccess = options.dockerAccess;\n        // Docker bridge 能否回连宿主取决于宿主防火墙与 daemon 网络策略，provider 不能把\n        // host-gateway 伪装成稳定能力。null 让 runner 把 attempt-scope collector 放进沙箱；\n        // 作者确有受控 tunnel 时仍可用 config.telemetry.host 显式覆盖。\n        this.otlpHost = null;\n        this.resources = options.resources ?? {};\n        this.readiness = options.readiness;\n        this.dockerSocketPath = options.dockerSocketPath;\n        this.dns = Object.freeze([...(options.dns ?? [])]);\n        this.managedLabels = Object.freeze({ ...(options.managedLabels ?? {}) });\n        this.rootlessAttestation = options.rootlessAttestation;\n        this.afterStop = options.afterStop;\n        this.pathPrepend = options.pathPrepend ?? [];\n        this.sandboxPath = this.managedPath(this.npmGlobalDir);\n    }\n    /** 受管 PATH:`pathPrepend` 按声明顺序前置到 npm 全局 bin + 系统默认路径。 */\n    private managedPath(npmGlobalDir: string): string {\n        const base = `${npmGlobalDir}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;\n        return this.pathPrepend.length > 0 ? `${this.pathPrepend.join(\":\")}:${base}` : base;\n    }\n    /** 复用下由池在每次借出时换成承接者自己的 deadline(见 sandbox/deadline.ts)。 */\n    setCommandDeadline(deadlineAt?: number): void {\n        this.deadlineAt = deadlineAt;\n    }\n    /**\n     * 附着到已在跑的容器(Compose mainService)。不改 Cmd/WorkingDir/网络——题目语义原样保留;\n     * `stop()` 默认只松绑句柄,整组回收由 Compose 资源组 finalizer 负责。\n     */\n    static async attach(containerId: string, options: DockerSandboxOptions & {\n        releaseMode?: DockerSandboxReleaseMode;\n    } = {}): Promise<DockerSandbox> {\n        const docker = new Docker();\n        const container = docker.getContainer(containerId);\n        const info = await container.inspect();\n        if (!info.State?.Running) {\n            throw new Error(`cannot attach DockerSandbox to container ${containerId.slice(0, 12)}: state is ${info.State?.Status ?? \"unknown\"}`);\n        }\n        const inspectedWorkdir = typeof info.Config?.WorkingDir === \"string\" && info.Config.WorkingDir.length > 0\n            ? info.Config.WorkingDir\n            : CONTAINER_WORKDIR;\n        const sandbox = new DockerSandbox({\n            ...options,\n            workdir: options.workdir ?? inspectedWorkdir,\n        });\n        sandbox.docker = docker;\n        sandbox.container = container;\n        sandbox._containerId = info.Id ?? containerId;\n        sandbox.releaseMode = options.releaseMode ?? \"detach\";\n        // Compose template 是题目的镜像，不能假设预装了 runner 私有分类账所需的 git。\n        // 这属于 provider 兑现 Sandbox 契约的初始化，不应让每条 Eval 改自己的 Dockerfile。\n        await sandbox.ensureRunnerTools();\n        await sandbox.resolveDefaultIdentity();\n        return sandbox;\n    }\n    /**\n     * 寿命确认:容器 TTL 烧在 PID1 的 `timeout` 里,没有续期通道,所以这里只确认、不续期\n     * (`SandboxReuseCapability` 允许二选一)。剩余不够就如实说不够,由 runner 轮换实例。\n     */\n    async ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }> {\n        if (this.lifetimeMs === undefined) {\n            return { ready: false, reason: \"the docker sandbox needs lifetimeMs when sandboxReuse is enabled\" };\n        }\n        if (this.expiresAtMs === undefined) {\n            return { ready: false, reason: \"the docker sandbox has not started yet; its lifetime is unknown\" };\n        }\n        const remaining = this.expiresAtMs - Date.now();\n        return remaining >= minRemainingMs\n            ? { ready: true, expiresAt: new Date(this.expiresAtMs).toISOString() }\n            : {\n                ready: false,\n                reason: `this docker container's dead-man TTL leaves ${Math.round(remaining / 1000)}s, ` +\n                    `but the next attempt needs ${Math.round(minRemainingMs / 1000)}s (a container TTL cannot be extended)`,\n            };\n    }\n    /** 创建并启动一个 Docker 沙箱。 */\n    static async create(options: DockerSandboxOptions = {}): Promise<DockerSandbox> {\n        const sandbox = new DockerSandbox(options);\n        try {\n            await sandbox.initialize();\n        }\n        catch (e) {\n            const initializationError = await sandbox.withInitializationDiagnostics(e);\n            // kill-on-failure:容器创建之后的初始化(start、基础工具安装、工作区属主)一旦失败,\n            // 先尽力销毁容器再抛出原始错误——不给重试层留一台无主容器\n            // (见 docs/feature/sandbox/architecture.md「Provisioning 失败与重试」)。\n            const cleanupErrors: unknown[] = [];\n            try {\n                await sandbox.container?.remove({ force: true });\n                sandbox.container = null;\n            }\n            catch (cleanupError) {\n                if (benignRemoveError(cleanupError)) {\n                    sandbox.container = null;\n                }\n                else {\n                    cleanupErrors.push(cleanupError);\n                }\n            }\n            try {\n                await sandbox.network?.remove();\n                sandbox.network = null;\n            }\n            catch (cleanupError) {\n                if (dockerStatusCode(cleanupError) === 404) {\n                    sandbox.network = null;\n                }\n                else {\n                    cleanupErrors.push(cleanupError);\n                }\n            }\n            if (cleanupErrors.length > 0) {\n                throw new AggregateError([initializationError, ...cleanupErrors], \"Docker sandbox initialization failed and its partial container/network could not be fully removed\");\n            }\n            throw initializationError;\n        }\n        return sandbox;\n    }\n    /** DinD 容器 kill-on-failure 前收集有界诊断，普通 Docker 保持原错误形状。 */\n    private async withInitializationDiagnostics(error: unknown): Promise<unknown> {\n        if (this.dockerAccess?.mode !== \"dind\" || this.container === null)\n            return error;\n        const sections: string[] = [];\n        try {\n            const logs = await this.container.logs({ stdout: true, stderr: true, tail: 256 });\n            const bytes = Buffer.isBuffer(logs)\n                ? logs\n                : await readableToBuffer(logs as unknown as NodeJS.ReadableStream);\n            const tail = bytes.subarray(Math.max(0, bytes.length - 256 * 1024)).toString(\"utf-8\").trim();\n            if (tail !== \"\")\n                sections.push(`docker logs (tail):\\n${tail}`);\n        }\n        catch {\n            // 诊断采集是 best effort；不能覆盖初始化原错误。\n        }\n        try {\n            const state = await this.container.inspect();\n            if (state.State?.Running === true) {\n                const daemonTail = await this.execCommand(\"tail\", [\"-c\", String(256 * 1024), \"/tmp/dockerd.log\"], {\n                    user: ROOT_USER,\n                });\n                const tail = (daemonTail.stderr || daemonTail.stdout).trim();\n                if (tail !== \"\")\n                    sections.push(`dockerd.log (tail):\\n${tail}`);\n            }\n        }\n        catch {\n            // daemon 提前退出时 supervisor 已把有界 tail 写入 docker logs。\n        }\n        if (sections.length === 0)\n            return error;\n        const message = error instanceof Error ? error.message : String(error);\n        return new Error(`${message}\\n${sections.join(\"\\n\")}`, { cause: error });\n    }\n    /** 拉镜像、起容器、装基础工具、备好工作区与 npm 前缀。 */\n    private async initialize(): Promise<void> {\n        const socketMount = this.dockerAccess?.mode === \"socket\"\n            ? await resolveDockerSocketMount(this.dockerAccess.socketPath)\n            : undefined;\n        // 显式 image(预制模板)优先;否则按 runtime 选默认 node:*-slim。\n        const imageName = this.image ?? DOCKER_IMAGES[this.runtime];\n        if (!imageName) {\n            throw new Error(t(\"docker.unsupportedRuntime\", { runtime: this.runtime }));\n        }\n        if (this.privileged === \"rootless\") {\n            assertRootlessPrivilegedDaemon(await this.docker.info(), this.dockerSocketPath === undefined ? undefined : `unix://${this.dockerSocketPath}`, this.rootlessAttestation === undefined ? undefined : {\n                daemonId: this.rootlessAttestation.daemonId,\n                dataRoot: this.rootlessAttestation.dataRoot,\n            });\n            if (this.dns.length === 0)\n                throw new Error(\"managed rootless Docker requires descriptor-pinned DNS servers\");\n            this.network = await this.docker.createNetwork(dockerManagedNetworkOptions(this.provisionToken, randomUUID(), this.managedLabels));\n        }\n        // 确保镜像在本地。\n        await this.ensureImage(imageName);\n        const isDind = this.dockerAccess?.mode === \"dind\";\n        if (isDind) {\n            const inspectedImage = await this.docker.getImage(imageName).inspect();\n            const declaredUser = inspectedImage.Config?.User?.trim();\n            this.imageDefaultUser = declaredUser === \"\" ? undefined : declaredUser;\n        }\n        // 起容器(先以 root 做初始化,之后命令切到非 root 用户)。\n        // PID1 改成 tail 一个日志文件(而非 sleep infinity):这样容器「主日志」= 这个文件,\n        // `docker logs` / Docker UI 的 Logs 标签页能实时显示我们 appendLog 进去的 agent 逐轮活动。\n        // 文件先 touch + chmod 666,好让之后以 1000 用户跑的 exec 也能往里 append。\n        // 外层 `timeout <TTL>` 是 dead-man switch:宿主异常退出(kill -9 / 崩溃)留下的孤儿容器,\n        // 到 TTL 后 PID1 自动退出 → 容器停止 → AutoRemove 清理(见 TTL_* 常量)。\n        const ttlSec = Math.ceil(Math.max(this.lifetimeMs ?? (this.timeout ?? TTL_BASE_WITHOUT_DEADLINE) * TTL_MULTIPLIER, TTL_FLOOR_MS) / 1000);\n        // TTL 一旦烧进 PID1 的 `timeout` 就改不了(容器没有续期通道),所以这里把真实到期时刻记下来,\n        // 供 ensureLifetime 如实回答;不够用时由 runner 轮换实例,而不是让容器在 attempt 中途消失。\n        this.expiresAtMs = Date.now() + ttlSec * 1000;\n        const dindCommand = isDind ? dindContainerCommand(ttlSec, CONTAINER_LOG) : undefined;\n        this.container = await this.docker.createContainer({\n            Image: imageName,\n            ...(dindCommand === undefined\n                ? {\n                    Cmd: [\n                        \"sh\",\n                        \"-c\",\n                        `touch ${CONTAINER_LOG}; chmod 666 ${CONTAINER_LOG}; exec timeout ${ttlSec} tail -n +1 -F ${CONTAINER_LOG}`,\n                    ],\n                }\n                : { Entrypoint: [...dindCommand.Entrypoint], Cmd: [...dindCommand.Cmd], User: ROOT_USER }),\n            WorkingDir: this.workdir,\n            // provision token:歧义类失败的对账通道(按 label 查询本地容器);\n            // keep-candidate:留存候选标记(异常硬退时核对未完成提交的候选)。\n            Labels: {\n                \"niceeval.keep-candidate\": \"true\",\n                ...(isDind\n                    ? {\n                        \"niceeval.docker-access\": \"dind\",\n                        \"niceeval.dind-readiness-user\": this.userOverride ?? this.imageDefaultUser ?? ROOT_USER,\n                    }\n                    : {}),\n                ...(this.provisionToken ? { \"niceeval.provision-token\": this.provisionToken } : {}),\n                ...(this.runIdentity ? dockerRunIdentityLabels(this.runIdentity) : {}),\n                ...this.managedLabels,\n            },\n            Tty: true,\n            // 不带 AutoRemove:留存意图必须在创建期传入(--keep-sandbox 的 suspend = docker stop,\n            // 停驻容器的文件系统落盘持久)。默认路径的销毁由 stop() 显式 stop + remove,行为等价;\n            // 宿主异常硬退留下的孤儿由 TTL dead-man switch 停驻后按 keep-candidate 标签事后核对。\n            HostConfig: {\n                ...dockerHostConfig(this.privileged, this.resources, this.dns, socketMount),\n                ...(this.network === null ? {} : { NetworkMode: this.network.id }),\n            },\n        });\n        this._containerId = this.container.id;\n        await this.container.start();\n        await this.waitForReadiness();\n        // slim 镜像可能缺 CA 证书和 git,补装。\n        await this.ensureRunnerTools();\n        // 探测默认执行身份(镜像 USER,或 factory 的 `user` 覆盖)的 home 目录,后续 chown 与\n        // npm 全局前缀都按它解析,不硬编码 UID/家目录(见 docs/feature/sandbox/library.md「执行身份」)。\n        await this.resolveDefaultIdentity();\n        // 工作目录交给默认执行身份。\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", this.workdir]);\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), this.workdir]);\n        // 为非 root 全局安装准备 npm 目录;root 身份下这一步是无害的自有目录。\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", this.npmGlobalDir]);\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), this.npmGlobalDir]);\n        // 让 npm 用这个目录当全局前缀(配置落在默认身份的家目录,供 agent 全局装 CLI 用)。\n        await this.runCommand(\"npm\", [\"config\", \"set\", \"prefix\", this.npmGlobalDir]);\n    }\n    /** Docker start 只代表 PID 1 存活；Docker access 先证明默认端点，再跑作者 readiness。 */\n    private waitForReadiness(): Promise<void> {\n        return Effect.runPromise(this.waitForReadinessEffect());\n    }\n    private waitForReadinessEffect(): Effect.Effect<void, unknown> {\n        const readiness = this.readiness;\n        if (readiness === undefined)\n            return Effect.void;\n        const readinessUser = readiness.user ?? this.userOverride ??\n            (this.dockerAccess?.mode === \"dind\" ? this.imageDefaultUser : undefined);\n        return Effect.gen(this, function* () {\n            const deadline = (yield* Clock.currentTimeMillis) + readiness.timeoutMs;\n            if (this.dockerAccess !== undefined) {\n                yield* this.waitForReadinessProbeEffect({\n                    command: DOCKER_ACCESS_COMPATIBILITY_COMMAND,\n                    user: readinessUser,\n                    intervalMs: readiness.intervalMs,\n                    deadline,\n                    phase: \"Docker access compatibility\",\n                    timeoutMs: readiness.timeoutMs,\n                });\n            }\n            yield* this.waitForReadinessProbeEffect({\n                command: readiness.command,\n                user: readinessUser,\n                intervalMs: readiness.intervalMs,\n                deadline,\n                phase: \"Docker sandbox readiness\",\n                timeoutMs: readiness.timeoutMs,\n            });\n        });\n    }\n    private waitForReadinessProbeEffect(input: {\n        readonly command: readonly [\n            string,\n            ...string[]\n        ];\n        readonly user: string | undefined;\n        readonly intervalMs: number | undefined;\n        readonly deadline: number;\n        readonly phase: string;\n        readonly timeoutMs: number;\n    }): Effect.Effect<void, unknown> {\n        const [command, ...args] = input.command;\n        let lastFailure = \"probe has not run\";\n        const attempt: Effect.Effect<void, unknown> = Effect.gen(this, function* () {\n            const now = yield* Clock.currentTimeMillis;\n            if (now > input.deadline)\n                return yield* timedOut();\n            const state = yield* Effect.tryPromise({\n                try: () => Promise.resolve(this.container?.inspect()),\n                catch: (error) => error,\n            });\n            if (state?.State?.Running !== true) {\n                return yield* Effect.fail(new Error(`Docker sandbox exited before ${input.phase.toLowerCase()} completed ` +\n                    `(state=${state?.State?.Status ?? \"missing\"})`));\n            }\n            const probeNow = yield* Clock.currentTimeMillis;\n            const result = yield* Effect.either(Effect.tryPromise({\n                try: () => this.execCommand(command, args, {\n                    user: input.user,\n                    timeoutMs: Math.max(1, input.deadline - probeNow),\n                    timeoutRetirement: \"stop\",\n                }),\n                catch: (error) => error,\n            }));\n            if (result._tag === \"Right\") {\n                if (result.right.exitCode === 0)\n                    return;\n                lastFailure = result.right.stderr.trim() || result.right.stdout.trim() || `exit ${result.right.exitCode}`;\n            }\n            else {\n                lastFailure = result.left instanceof Error ? result.left.message : String(result.left);\n            }\n            const afterAttempt = yield* Clock.currentTimeMillis;\n            const remaining = input.deadline - afterAttempt;\n            if (remaining <= 0)\n                return yield* timedOut();\n            yield* Effect.sleep(Math.min(input.intervalMs ?? 250, remaining));\n            return yield* attempt;\n        });\n        const timedOut = (): Effect.Effect<never, Error> => {\n            const diagnosticUser = input.user ?? this.imageDefaultUser ?? ROOT_USER;\n            const permissionHelp = this.dockerAccess?.mode === \"dind\" && /permission denied/i.test(lastFailure)\n                ? `; DinD user ${JSON.stringify(diagnosticUser)} must belong to the docker group ` +\n                    `(the inner socket remains root:docker 0660)`\n                : \"\";\n            return Effect.fail(new Error(`${input.phase} timed out after ${input.timeoutMs}ms: ${lastFailure}${permissionHelp}`));\n        };\n        return attempt;\n    }\n    /**\n     * 探测 Sandbox 默认执行身份(`this.userOverride` 未设置时即容器/镜像的默认身份)的\n     * uid、用户名与家目录:省略 `User` 字段的 exec 沿用容器默认身份,`$HOME` 由容器内\n     * `/etc/passwd` 解析,不在 runner 侧维护一张 UID → 家目录的映射表。\n     */\n    private async resolveDefaultIdentity(): Promise<void> {\n        const probe = await this.execCommand(\"sh\", [\n            \"-c\",\n            'printf \"%s\\\\n%s\\\\n%s\" \"$(id -u)\" \"$(id -un 2>/dev/null || true)\" \"$HOME\"',\n        ], {\n            user: this.userOverride ??\n                (this.dockerAccess?.mode === \"dind\" ? this.imageDefaultUser : undefined),\n        });\n        const [rawUid = \"\", rawName = \"\", rawHome = \"\"] = probe.stdout.split(\"\\n\");\n        const uid = rawUid.trim();\n        const name = rawName.trim();\n        const home = rawHome.trim();\n        this.defaultIsRoot = uid === \"0\";\n        this.defaultUserName = name !== \"\" ? name : (this.defaultIsRoot ? ROOT_USER : (this.userOverride ?? uid));\n        this.defaultHome = home !== \"\" ? home : (this.defaultIsRoot ? \"/root\" : `/home/${this.defaultUserName}`);\n        this.npmGlobalDir = `${this.defaultHome}/.npm-global`;\n        this.sandboxPath = this.managedPath(this.npmGlobalDir);\n    }\n    /** chown 目标:factory 覆盖时原样复用(接受 name / uid[:gid]),否则用探测出的用户名。 */\n    private chownTarget(): string {\n        return this.userOverride ?? this.defaultUserName;\n    }\n    /** 确保镜像在本地,缺了就拉。 */\n    private async ensureImage(imageName: string): Promise<void> {\n        try {\n            const image = this.docker.getImage(imageName);\n            await image.inspect();\n        }\n        catch {\n            // 镜像不存在,拉取。「progress」而非「diagnostic」—— 这是正常进度,不是需要去重/永久\n            // 留痕的 warning。走 create 绑定的 ScopedFeedback(runner 归因到 sandbox.create);\n            // 直调(无 runner)时退回全局 sink。\n            const progress = (message: string) => this.feedback ? this.feedback.progress({ message }) : reportActivity(message);\n            progress(t(\"docker.imagePullStart\", { image: imageName }).trimEnd());\n            await this.pullImage(imageName);\n            progress(t(\"docker.imagePullDone\", { image: imageName }).trimEnd());\n        }\n    }\n    /**\n     * 补齐 NiceEval 自身运行所需的最小工具面。单容器默认镜像与 Compose 附着容器走同一条：\n     * 先 probe，命中时零改动；缺失时以 root 使用镜像已有的包管理器安装。题目镜像无法兑现时\n     * 明确报错，不把 `git: command not found` 延后到 workspace.baseline。\n     */\n    async ensureRunnerTools(): Promise<void> {\n        const script = [\n            \"set -eu\",\n            \"command -v git >/dev/null 2>&1 && exit 0\",\n            \"export DEBIAN_FRONTEND=noninteractive\",\n            \"if command -v apt-get >/dev/null 2>&1; then\",\n            \"  apt-get update -qq && apt-get install -y -qq ca-certificates git curl >/dev/null\",\n            \"elif command -v apk >/dev/null 2>&1; then\",\n            \"  apk add --no-cache ca-certificates git curl >/dev/null\",\n            \"elif command -v microdnf >/dev/null 2>&1; then\",\n            \"  microdnf install -y ca-certificates git curl >/dev/null\",\n            \"elif command -v dnf >/dev/null 2>&1; then\",\n            \"  dnf install -y ca-certificates git curl >/dev/null\",\n            \"elif command -v yum >/dev/null 2>&1; then\",\n            \"  yum install -y ca-certificates git curl >/dev/null\",\n            \"else\",\n            '  printf \"%s\\\\n\" \"niceeval Docker runtime requires git for its private change ledger, but the image has no supported package manager (apt-get, apk, microdnf, dnf, or yum)\" >&2',\n            \"  exit 127\",\n            \"fi\",\n            'command -v git >/dev/null 2>&1 || { printf \"%s\\\\n\" \"niceeval Docker runtime could not install git for its private change ledger\" >&2; exit 127; }',\n        ].join(\"\\n\");\n        const result = await this.runCommandAsRoot(\"sh\", [\"-c\", script]);\n        if (result.exitCode === 0)\n            return;\n        const detail = result.stderr.trim().split(\"\\n\").at(-1);\n        throw new Error(`prepare Docker runner tools failed (exit ${result.exitCode})${detail ? `: ${detail}` : \"\"}`);\n    }\n    /** 拉取镜像并跟进度。 */\n    private async pullImage(imageName: string): Promise<void> {\n        return new Promise((resolve, reject) => {\n            this.docker.pull(imageName, (err: Error | null, stream: NodeJS.ReadableStream) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n                this.docker.modem.followProgress(stream, (followErr: Error | null) => {\n                    if (followErr) {\n                        reject(followErr);\n                    }\n                    else {\n                        resolve();\n                    }\n                }, \n                // 进度回调(可在此挂进度条)。\n                () => { });\n            });\n        });\n    }\n    /** 容器短 ID(像 Docker CLI 那样取前 12 位)。 */\n    get sandboxId(): string {\n        return this._containerId.slice(0, 12);\n    }\n    /**\n     * 在容器里跑一条命令。默认沿用 Sandbox 的默认执行身份(factory `user` 覆盖后的身份,\n     * 否则镜像声明的 USER);`opts.user` 只覆盖这一条命令。\n     */\n    async runCommand(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        // stream:把本命令输出也接到容器主日志(PID1 tail 它)→ Docker Logs 看到原始输出。\n        // 实现:把 cmd+args 安全拼成 shell 串,经 runShell 走 tee(只 tee stdout,保留 stderr 分离 + 退出码)。\n        if (opts.stream) {\n            const joined = [cmd, ...args].map(shellQuote).join(\" \");\n            return this.runShell(joined, {\n                env: opts.env,\n                cwd: opts.cwd,\n                stream: true,\n                user: opts.user,\n                ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n                signal: opts.signal,\n                onStdout: opts.onStdout,\n                onStderr: opts.onStderr,\n            });\n        }\n        // 省略 `user` 时不注入 --user,沿用容器默认身份(factory `user` 覆盖后的身份,否则镜像\n        // 声明的 USER);这时 HOME/USER/LOGNAME 用探测出的默认身份家目录,让 codex(~/.codex)、\n        // npm 全局、bash 的 ~ 展开都落在正确的地方。显式覆盖时把 HOME 决定权交还 docker exec\n        // 自己按容器 /etc/passwd 解析,不代它猜一个可能错的家目录。\n        const isRootUser = opts.user !== undefined ? isRootLikeUserSpec(opts.user) : this.defaultIsRoot;\n        const env = {\n            ...(opts.user === undefined\n                ? { HOME: this.defaultHome, USER: this.defaultUserName, LOGNAME: this.defaultUserName }\n                : {}),\n            ...opts.env,\n            PATH: this.sandboxPath,\n            // root 跑 npm 时让 install 脚本也以 root 跑(否则 npm 会把脚本降权到目录属主,可能写不进)。\n            // 非 root 时此变量无影响。\n            ...(isRootUser ? { npm_config_unsafe_perm: \"true\" } : {}),\n        };\n        return this.execCommand(cmd, [...args], {\n            env,\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            user: opts.user ?? this.userOverride,\n            ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n            onStdout: opts.onStdout,\n            onStderr: opts.onStderr,\n            signal: opts.signal,\n        });\n    }\n    /** 以 root 跑命令(provider 内部用:容器初始化、属主收敛)。 */\n    private async runCommandAsRoot(cmd: string, args: string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        return this.execCommand(cmd, args, {\n            env: opts.env,\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            user: ROOT_USER,\n        });\n    }\n    /** 把目录属主收敛回默认执行身份(putArchive 以 root 解包后用)。 */\n    private async chownToSandboxUser(path: string): Promise<void> {\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), path]);\n    }\n    /** 真正在容器里 exec 一条命令,demux stdout/stderr 并带超时。 */\n    private async execCommand(cmd: string, args: string[] = [], opts: {\n        env?: globalThis.Record<string, string>;\n        cwd?: string;\n        user?: string;\n        /** 这条命令的显式上限;省略 = 按 attempt deadline 的剩余量。 */\n        timeoutMs?: number;\n        /** create/readiness 失败需在删除前采集日志，因此只先停容器。 */\n        timeoutRetirement?: \"destroy\" | \"stop\";\n        onStdout?: (chunk: string) => void | Promise<void>;\n        onStderr?: (chunk: string) => void | Promise<void>;\n        signal?: AbortSignal;\n    } = {}): Promise<CommandResult> {\n        if (!this.container) {\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        }\n        const fullCmd = [cmd, ...args];\n        const env = opts.env\n            ? Object.entries(opts.env).map(([k, v]) => `${k}=${v}`)\n            : undefined;\n        const exec = await this.container.exec({\n            Cmd: fullCmd,\n            AttachStdout: true,\n            AttachStderr: true,\n            WorkingDir: resolveSandboxPath(this.workdir, opts.cwd),\n            Env: env,\n            User: opts.user,\n        });\n        const stream = await exec.start({ hijack: true, stdin: false });\n        return new Promise<CommandResult>((resolve, reject) => {\n            // Docker 把 stdout/stderr 复用在同一条流里(8 字节头 + 载荷),需手动 demux;\n            // 跨 chunk 的帧累积逻辑见 docker-stream.ts 的 createExecDemuxer。\n            const demuxer = createExecDemuxer();\n            // Docker 的 demuxer 先保证帧边界完整，再把每帧即时送给调用方。回调串行化，避免\n            // async consumer（如 JSONL 行缓冲）因后一个 chunk 先完成而乱序。\n            let callbackChain = Promise.resolve();\n            stream.on(\"data\", (chunk: Buffer) => {\n                const beforeStdout = demuxer.stdout().length;\n                const beforeStderr = demuxer.stderr().length;\n                demuxer.push(chunk);\n                const stdout = demuxer.stdout().slice(beforeStdout);\n                const stderr = demuxer.stderr().slice(beforeStderr);\n                const onStdout = opts.onStdout;\n                const onStderr = opts.onStderr;\n                if (stdout && onStdout !== undefined)\n                    callbackChain = callbackChain.then(() => onStdout(stdout));\n                if (stderr && onStderr !== undefined)\n                    callbackChain = callbackChain.then(() => onStderr(stderr));\n            });\n            // 超时:杀流并 reject。上限从 attempt deadline 的剩余量派生(显式传 timeout 时按显式值),\n            // 没有 deadline 就不挂这条 timer——provider 层不发明一条自己的线。\n            const limit = commandLimit(opts, { commandTimeoutMs: this.timeout, deadlineAt: this.deadlineAt });\n            let settled = false;\n            let drainTimer: ReturnType<typeof setTimeout> | undefined;\n            let completionPoll: ReturnType<typeof setInterval> | undefined;\n            let pollInFlight = false;\n            const cleanup = (): void => {\n                if (timeoutId !== undefined)\n                    clearTimeout(timeoutId);\n                if (completionPoll !== undefined)\n                    clearInterval(completionPoll);\n                if (drainTimer !== undefined)\n                    clearTimeout(drainTimer);\n                opts.signal?.removeEventListener(\"abort\", onAbort);\n            };\n            const retireAndReject = (error: Error): void => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                const retirement = opts.timeoutRetirement === \"stop\"\n                    ? this.container?.stop({ t: 5 }).catch((stopError) => {\n                        if (!benignStopError(stopError))\n                            throw stopError;\n                    }) ?? Promise.resolve()\n                    : this.stop();\n                void retirement.then(() => reject(error), reject);\n            };\n            const timeoutMs = limit.timeoutMs;\n            const timeoutId = timeoutMs === undefined\n                ? undefined\n                : setTimeout(() => {\n                    retireAndReject(new SandboxCommandTimeoutError(t(\"docker.commandTimeout\", { timeoutMs }), timeoutMs, limit.explicit));\n                }, timeoutMs);\n            const onAbort = (): void => {\n                const reason = opts.signal?.reason;\n                retireAndReject(reason instanceof Error ? reason : new DOMException(\"sandbox command aborted\", \"AbortError\"));\n            };\n            opts.signal?.addEventListener(\"abort\", onAbort, { once: true });\n            if (opts.signal?.aborted)\n                onAbort();\n            const finish = async (known?: Awaited<ReturnType<typeof exec.inspect>>): Promise<void> => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                try {\n                    await callbackChain;\n                    const inspection = known ?? await exec.inspect();\n                    resolve({\n                        stdout: demuxer.stdout(),\n                        stderr: demuxer.stderr(),\n                        exitCode: inspection.ExitCode ?? 0,\n                    });\n                }\n                catch (error) {\n                    reject(error);\n                }\n            };\n            // rootless Docker 偶尔在 exec 已退出且 ExecIDs 已清空后仍不关闭 hijacked HTTP 流。\n            // 不能只等 `end`：同时以 daemon 的 exec inspect 为完成事实，留 100ms drain 尾帧后收口。\n            completionPoll = setInterval(() => {\n                if (settled || pollInFlight || drainTimer !== undefined)\n                    return;\n                pollInFlight = true;\n                void exec.inspect().then((inspection) => {\n                    if (!settled && inspection.Running === false && drainTimer === undefined) {\n                        drainTimer = setTimeout(() => { void finish(inspection); }, 100);\n                    }\n                }).catch(() => undefined).finally(() => { pollInFlight = false; });\n            }, 250);\n            completionPoll.unref();\n            stream.on(\"end\", () => { void finish(); });\n            stream.on(\"error\", (error: Error) => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                reject(error);\n            });\n        });\n    }\n    /** 经 bash -c 跑一段 shell 脚本。opts 为选项对象。 */\n    async runShell(script: string, opts: CommandOptions = {}): Promise<CommandResult> {\n        if (opts.stream) {\n            // 只 tee stdout 到容器主日志:保留 stderr 分离(解析器要)+ pipefail 保留命令退出码。\n            const wrapped = `set -o pipefail; { ${script} ; } | tee -a ${CONTAINER_LOG}`;\n            return this.runCommand(\"bash\", [\"-c\", wrapped], {\n                env: opts.env,\n                cwd: opts.cwd,\n                user: opts.user,\n                ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n                signal: opts.signal,\n                onStdout: opts.onStdout,\n                onStderr: opts.onStderr,\n            });\n        }\n        return this.runCommand(\"bash\", [\"-c\", script], opts);\n    }\n    /** 追加一行到容器主日志(PID1 在 tail)→ Docker 的 Logs 标签页实时可见。 */\n    async appendLog(line: string): Promise<void> {\n        const esc = line.replace(/'/g, \"'\\\\''\");\n        await this.runCommand(\"sh\", [\"-c\", `printf '%s\\\\n' '${esc}' >> ${CONTAINER_LOG}`]);\n    }\n    /** 读容器里的文件。 */\n    async runCommandOrThrow(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runCommand(cmd, args, opts), opts.sensitiveValues);\n    }\n    async runShellOrThrow(script: string, opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runShell(script, opts), opts.sensitiveValues);\n    }\n    async readText(path: string): Promise<string> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const result = await this.runCommand(\"cat\", [absPath]);\n        if (result.exitCode !== 0) {\n            throw new Error(t(\"docker.readFileFailed\", { path: absPath, stderr: result.stderr }));\n        }\n        return result.stdout;\n    }\n    /** 判断容器里某文件是否存在。 */\n    async pathExists(path: string): Promise<boolean> {\n        const result = await this.runCommand(\"test\", [\"-e\", resolveSandboxPath(this.workdir, path)]);\n        return result.exitCode === 0;\n    }\n    async writeText(path: string, content: string): Promise<void> {\n        await this.writeBytes(path, Buffer.from(content, \"utf-8\"));\n    }\n    /** 用 tar 归档把文件灌进容器。 */\n    private async writeCollectedFiles(files: readonly CollectedLocalFile[], targetDir?: string): Promise<void> {\n        if (!this.container) {\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        }\n        if (files.length === 0) {\n            return;\n        }\n        // 打 tar 包。\n        const pack = packFilesToTar(files.map((file) => ({\n            name: file.path,\n            content: Buffer.from(file.content),\n        })));\n        const targetPath = resolveSandboxPath(this.workdir, targetDir);\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", targetPath]);\n        // Docker 对 ReadonlyRootfs 容器会无条件拒绝 putArchive，即便目标实际位于可写 tmpfs。\n        // 这类 sandbox 逐文件走 exec stdin；路径仍由 resolveSandboxPath 收敛在受管目录内。\n        if (this.resources.readOnlyRootfs === true) {\n            for (const file of files) {\n                const destination = resolveSandboxPath(targetPath, file.path);\n                await this.runCommandAsRoot(\"mkdir\", [\"-p\", dirname(destination)]);\n                await this.writeBytesViaExec(destination, Buffer.from(file.content));\n            }\n            await this.chownToSandboxUser(targetPath);\n            return;\n        }\n        // putArchive 以 root 身份解包到目标目录。\n        await this.container.putArchive(pack, { path: targetPath });\n        // 修正属主:putArchive 上传成 root,改回 node 用户,agent 才能编辑。\n        await this.chownToSandboxUser(targetPath);\n    }\n    async uploadFile(source: string | URL, targetPath: string): Promise<void> {\n        await this.writeBytes(targetPath, await readFile(resolveLocalPath(undefined, source)));\n    }\n    async uploadDirectory(sourceDir: string | URL, targetDir?: string, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        const files = await collectLocalFiles(resolveLocalPath(undefined, sourceDir), opts.ignore);\n        await this.writeCollectedFiles(files, targetDir);\n    }\n    /**\n     * 递归下载容器内一个目录到本地磁盘,与 uploadDirectory 对称。用 getArchive 单次取回\n     * 整棵目录的 tar(而不是逐文件走 downloadFile):getArchive 对目录路径返回的 tar 里,\n     * entry 名以请求路径的 basename 为首段(如请求 `/…/out` 得到 `out/x.txt`),剥离首段\n     * 还原成相对 localDir 的路径。ignore 命中的路径(任意深度、按 basename)整支排除——\n     * tar 已经整体取回,这里是纯本地过滤,不省网络传输,但语义上等价于「命中即剪除」。\n     */\n    async downloadDirectory(sourceDir: string, targetDir: string | URL, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const localDir = resolveLocalPath(undefined, targetDir);\n        const absTargetDir = resolveSandboxPath(this.workdir, sourceDir);\n        const tarBuf = await this.readArchiveBytes(absTargetDir);\n        const files = await extractFilesFromTar(tarBuf);\n        const ignore = new Set(opts.ignore ?? []);\n        await Promise.all(files.map(async (file) => {\n            const parts = file.name.split(\"/\").slice(1);\n            if (parts.length === 0 || parts.some((part) => ignore.has(part)))\n                return;\n            const dest = join(localDir, ...parts);\n            await mkdir(dirname(dest), { recursive: true });\n            await writeFile(dest, file.content);\n        }));\n    }\n    /**\n     * 从容器任意路径读文件 → Buffer。\n     * 用 Docker getArchive API(原生二进制,无 base64 开销);tar 只有一个 entry,直接解包取内容。\n     */\n    async readBytes(path: string): Promise<Uint8Array> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const tarBuf = await this.readArchiveBytes(resolveSandboxPath(this.workdir, path));\n        return extractFileFromTar(tarBuf);\n    }\n    /**\n     * Docker getArchive 对 ReadonlyRootfs 容器中的 tmpfs 会错误返回 404，即使 exec 能看到文件。\n     * readonly 模式改由容器内 tar，再把二进制归档编码成 ASCII 经 exec 流取回。\n     */\n    private async readArchiveBytes(absPath: string): Promise<Buffer> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        if (this.resources.readOnlyRootfs !== true) {\n            const stream = await (this.container as Docker.Container).getArchive({ path: absPath });\n            return readableToBuffer(stream as NodeJS.ReadableStream);\n        }\n        const result = await this.runShell(`tar -C ${shellQuote(dirname(absPath))} -cf - -- ${shellQuote(basename(absPath))} | base64`, { user: ROOT_USER });\n        if (result.exitCode !== 0) {\n            throw new Error(`failed to archive ${absPath} inside read-only Docker sandbox: ${result.stderr.trim()}`);\n        }\n        return Buffer.from(result.stdout.replace(/\\s+/g, \"\"), \"base64\");\n    }\n    /**\n     * 向容器任意路径写文件(二进制)。\n     * 打成单文件 tar → putArchive 到目标目录,与 uploadFiles 同一机制但目标路径自由。\n     *\n     * 修正属主:putArchive 以 root 解包,不 chown 的话文件在容器里保持 root 属主——非 root\n     * 沙箱用户不仅不能编辑它,后续对它做 `mv`/`rm` 这类改动它所在目录项的操作,只要目标目录带\n     * sticky bit(如 `/tmp`),也会因为「非属主不能改别人的目录项」被内核拒成\n     * `Operation not permitted`(与 uploadFiles() 对整个目标目录 chown 是同一个属主问题,\n     * 这里只需精确 chown 这一个文件;真机复现见 memory/docker-uploadfile-tmp-mv-eperm.md)。\n     */\n    async writeBytes(destPath: string, content: Uint8Array): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const absPath = resolveSandboxPath(this.workdir, destPath);\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", dirname(absPath)]);\n        if (this.resources.readOnlyRootfs === true) {\n            await this.writeBytesViaExec(absPath, Buffer.from(content));\n            await this.chownToSandboxUser(absPath);\n            return;\n        }\n        const pack = packFilesToTar([{ name: basename(absPath), content: Buffer.from(content) }]);\n        await (this.container as Docker.Container).putArchive(pack, { path: dirname(absPath) });\n        await this.chownToSandboxUser(absPath);\n    }\n    /** readonly rootfs 下向可写 tmpfs 投递字节；Docker exec stdin 不触发 putArchive 的 blanket 拒绝。 */\n    private async writeBytesViaExec(absPath: string, content: Buffer): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const exec = await this.container.exec({\n            Cmd: [\"sh\", \"-c\", 'cat > \"$1\"', \"niceeval-write\", absPath],\n            AttachStdin: true,\n            AttachStdout: true,\n            AttachStderr: true,\n            User: ROOT_USER,\n        });\n        const stream = await exec.start({ hijack: true, stdin: true });\n        const inspection = await new Promise<Awaited<ReturnType<typeof exec.inspect>>>((resolve, reject) => {\n            let settled = false;\n            let pollInFlight = false;\n            const cleanup = (): void => {\n                clearInterval(poll);\n                clearTimeout(timeout);\n            };\n            const finish = (value: Awaited<ReturnType<typeof exec.inspect>>): void => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                resolve(value);\n            };\n            const inspectAndFinish = (): void => {\n                if (settled || pollInFlight)\n                    return;\n                pollInFlight = true;\n                void exec.inspect().then((value) => {\n                    if (value.Running === false)\n                        finish(value);\n                }).catch(reject).finally(() => { pollInFlight = false; });\n            };\n            const poll = setInterval(inspectAndFinish, 100);\n            const timeout = setTimeout(() => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                reject(new Error(`timed out writing ${absPath} inside read-only Docker sandbox`));\n            }, 30000);\n            stream.on(\"error\", (error: Error) => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                reject(error);\n            });\n            stream.on(\"end\", inspectAndFinish);\n            stream.end(content);\n        });\n        if ((inspection.ExitCode ?? 0) !== 0) {\n            throw new Error(`failed to write ${absPath} inside read-only Docker sandbox`);\n        }\n    }\n    async downloadFile(sourcePath: string, target: string | URL): Promise<void> {\n        const destination = resolveLocalPath(undefined, target);\n        await mkdir(dirname(destination), { recursive: true });\n        await writeFile(destination, await this.readBytes(sourcePath));\n    }\n    /**\n     * 释放句柄。`releaseMode: \"destroy\"`(默认 create 路径)显式 stop + remove;\n     * `releaseMode: \"detach\"`(Compose 附着)只松绑——整组由 compose down 回收,避免主容器先被拆掉留下 sidecar 孤儿。\n     */\n    async stop(): Promise<void> {\n        if (!this.container)\n            return;\n        if (this.releaseMode === \"detach\") {\n            this.container = null;\n            return;\n        }\n        const container = this.container;\n        const cleanupErrors: unknown[] = [];\n        try {\n            await container.stop({ t: 0 }); // 立即停止\n        }\n        catch (error) {\n            if (!benignStopError(error))\n                cleanupErrors.push(error);\n        }\n        let removed = false;\n        try {\n            await container.remove({ force: true });\n            removed = true;\n        }\n        catch (error) {\n            if (benignRemoveError(error)) {\n                removed = true;\n            }\n            else {\n                cleanupErrors.push(error);\n            }\n        }\n        if (removed && this.container === container)\n            this.container = null;\n        if (removed && this.network !== null) {\n            const network = this.network;\n            try {\n                await network.remove();\n                if (this.network === network)\n                    this.network = null;\n            }\n            catch (error) {\n                if (dockerStatusCode(error) === 404) {\n                    if (this.network === network)\n                        this.network = null;\n                }\n                else {\n                    cleanupErrors.push(error);\n                }\n            }\n        }\n        if (cleanupErrors.length > 0) {\n            throw new AggregateError(cleanupErrors, `failed to destroy Docker sandbox ${this.sandboxId}`);\n        }\n        await this.afterStop?.();\n    }\n    /** Watchdog commit records container + exclusive network as one lifecycle unit. */\n    get managedNetworkId(): string | undefined {\n        return this.network?.id;\n    }\n    /**\n     * 留存休眠(suspend):`docker stop`——文件系统落盘持久、不占内存、跨 daemon 重启存活。\n     * 不用 `docker pause`(内存驻留,daemon 重启即失)也不用 `docker commit`(引入第二种资源面)。\n     * 不属于中性 Sandbox 接口——「留下」是 runner 的调度决定,不是沙箱的能力;由 sandbox/keep.ts\n     * 在 sandbox/ 域内路由到这里。\n     */\n    async suspend(): Promise<void> {\n        if (!this.container)\n            throw new Error(\"container already released\");\n        await this.container.stop({ t: 5 });\n    }\n}\n"]}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["docker.ts"],"names":[],"mappings":";;;;;;AA4BA,wDAMC;AAQD,gDAiBC;AA4GD,wEAuCC;AAeD,4CAyCC;AACD,4DASC;AAED,kEAgBC;AAlSD,kDAAkD;AAClD,mEAAmE;AACnE,+CAA+C;AAC/C,yCAAoD;AACpD,6CAA0C;AAC1C,6CAAyC;AACzC,+CAA8E;AAC9E,0DAA+B;AAC/B,mCAAuC;AAEvC,qDAA8E;AAC9E,yCAAwC;AACxC,yDAAmI;AACnI,yCAAkE;AAClE,+CAAyE;AACzE,mDAA0D;AAC1D,+CAAqC;AACrC,wDAA4D;AAC5D,2CAA6F;AAC7F,uDAA8E;AAC9E,6CAAuF;AAEvF,6DAA4D;AAC5D,6DAA4D;AAC5D;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,CAAU;IAC7C,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,iDAAiD;IACjD,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,OAAO,YAAY,CAAC;IACxB,OAAO,IAAA,0CAA8B,EAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AACD;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,UAAmB;IACvE,MAAM,MAAM,GAAG,IAAI,mBAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;QAC3C,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC,EAAE;KAC5D,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,IAAK,CAEH,CAAC,UAAU,KAAK,GAAG;gBACjB,MAAM,CAAC,CAAC;QAChB,CAAC;IACL,CAAC;AACL,CAAC;AACD,wCAAwC;AACxC,MAAM,aAAa,GAAsC;IACrD,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;CACzB,CAAC;AACF,6DAA6D;AAC7D,oDAAoD;AACpD,gDAAgD;AAChD,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,sEAAsE;AACtE,sEAAsE;AACtE,+DAA+D;AAC/D,yDAAyD;AACzD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,QAAQ;AACtC,WAAW;AACX,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AACpD,yEAAyE;AACzE,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,0DAA0D;AAC1D,8DAA8D;AAC9D,gEAAgE;AAChE,2CAA2C;AAC3C,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D;;;GAGG;AACU,QAAA,mCAAmC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,IAAI;IACJ,KAAK;IACL;QACI,iFAAiF;QACjF,uFAAuF;QACvF,kCAAkC;QAClC,sGAAsG;QACtG,sDAAsD;QACtD,gCAAgC,oBAAoB,4BAA4B;QAChF,6FAA6F;QAC7F,6HAA6H;KAChI,CAAC,IAAI,CAAC,IAAI,CAAC;CAIf,CAAC,CAAC;AACH,uDAAuD;AACvD,SAAS,kBAAkB,CAAC,KAAa;IACrC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AACnE,CAAC;AA0DD,SAAgB,8BAA8B,CAAC,IAM9C,EAAE,UAA8B,EAAE,QAGtB;IACT,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,UAAU,KAAK,sBAAsB,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sFAAsF;YAClG,WAAW,IAAI,CAAC,aAAa,IAAI,SAAS,YAAY,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iFAAiF;YAC7F,aAAa,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAAC,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,4FAA4F;YACxG,aAAa,QAAQ,CAAC,QAAQ,SAAS,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG,CAAC,CAAC;IACnF,CAAC;AACL,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,IAAI,KAAK;QACvE,CAAC,CAAE,KAED,CAAC,UAAU;QACb,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc;IACrC,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;AAC3C,CAAC;AACD,SAAgB,gBAAgB,CAAC,UAA2C,EAAE,SAA2C,EAAE,MAAyB,EAAE,EAAE,WAGvJ;IACG,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC;IACpG,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,KAAK,SAAS;QACvC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC1E,IAAI;YACJ;gBACI,IAAI;gBACJ,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC/C,QAAQ;gBACR,OAAO;gBACP,QAAQ,OAAO,CAAC,SAAS,EAAE;gBAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;aAC/D,CAAC,IAAI,CAAC,GAAG,CAAC;SACd,CAAC,CAAC,CAAC;IACR,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,GAAG,CAAC,UAAU,KAAK,UAAU;YACzB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,WAAW,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBACtF,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;aACtC,CAAC;QACN,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QAChF,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KACnD,CAAC;AACN,CAAC;AACM,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAI7D,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAA,eAAI,EAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;QAChB,MAAM,IAAI,SAAS,CAAC,4CAA4C,UAAU,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AACD,6EAA6E;AAC7E,SAAgB,2BAA2B,CAAC,cAAkC,EAAE,QAAgB,IAAA,wBAAU,GAAE,EAAE,gBAAkD,EAAE;IAC9J,OAAO;QACH,IAAI,EAAE,oBAAoB,KAAK,EAAE;QACjC,cAAc,EAAE,KAAK;QACrB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE;YACL,sCAAsC,EAAE,OAAO;SAClD;QACD,MAAM,EAAE;YACJ,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,cAAc,EAAE,CAAC;YACvF,GAAG,aAAa;SACnB;KACJ,CAAC;AACN,CAAC;AAGD;;;GAGG;AACH,MAAa,aAAa;IACb,OAAO,CAAS;IAChB,QAAQ,CAAgB;IACzB,MAAM,CAAS;IACf,SAAS,GAA4B,IAAI,CAAC;IAC1C,OAAO,GAA0B,IAAI,CAAC;IACtC,YAAY,GAAG,EAAE,CAAC;IAClB,OAAO,CAAU;IACjB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC5B,mEAAmE;IAC3D,WAAW,CAAU;IACrB,OAAO,CAAS;IAChB,KAAK,CAAU;IACf,QAAQ,CAAwC;IAChD,cAAc,CAAU;IACxB,WAAW,CAAe;IAC1B,WAAW,GAA6B,SAAS,CAAC;IAC1D,sDAAsD;IACrC,YAAY,CAAU;IACtB,UAAU,CAAkC;IAC5C,YAAY,CAAiC;IAC7C,SAAS,CAAmC;IAC5C,SAAS,CAAoC;IAC7C,gBAAgB,CAAU;IAC1B,GAAG,CAAoB;IACvB,aAAa,CAAmC;IAChD,mBAAmB,CAGlC;IACe,SAAS,CAAuB;IACjD,sDAAsD;IACrC,WAAW,CAAoB;IAChD,uDAAuD;IAC/C,gBAAgB,CAAU;IAClC,yDAAyD;IACjD,WAAW,GAAG,OAAO,CAAC;IACtB,eAAe,GAAG,MAAM,CAAC;IACzB,aAAa,GAAG,IAAI,CAAC;IACrB,YAAY,GAAG,mBAAmB,CAAC;IACnC,WAAW,CAAS;IACnB,YAAY,GAAG;QACpB,YAAY,EAAE,IAAA,uCAA0B,EAAC,IAAa,CAAC;QACvD,SAAS,EAAE,IAAA,uCAA0B,EAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAA,uCAA0B,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzD,cAAc,EAAE,IAAA,uCAA0B,EAAC,CAAC,cAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC3G,kBAAkB,EAAE,IAAA,uCAA0B,EAAC,CAAC,UAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC5G,cAAc,EAAE,IAAA,uCAA0B,EAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;KAC9G,CAAC;IACM,KAAK,CAAC,mBAAmB,CAAC,KAA0B;QACxD,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACtC,MAAM,GAAG,GAAG;YACR,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,IAAI,EAAE,IAAI,CAAC,eAAe;YAC1B,OAAO,EAAE,IAAI,CAAC,eAAe;YAC7B,GAAG,KAAK,CAAC,GAAG;YACZ,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,MAAM,MAAM,GAAG,0BAA0B,IAAA,wBAAU,GAAE,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,sEAAsE;YACtE,0EAA0E;YAC1E,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,MAAM,4BAA4B,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;YAC5G,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC;YACvD,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,yCAAoB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,yBAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,yBAAW,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACpG,IAAI,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,YAAgC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACX,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,OAAO,GAAG,CAAC;gBACX,OAAO;YACX,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBACI,CAAC;gBACF,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAgD,CAAC;QACrD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAqC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,KAAc,EAAQ,EAAE;YACzC,IAAI,OAAO;gBACP,OAAO;YACX,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,IAAI,KAAK,SAAS;gBAClB,aAAa,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,UAAU,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,OAAO,CAA2C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnF,UAAU,GAAG,MAAM,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAClC,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;gBACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;oBACpC,IAAI,UAAU,CAAC,OAAO;wBAClB,OAAO;oBACX,IAAI,OAAO;wBACP,OAAO;oBACX,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,IAAI,KAAK,SAAS;wBAClB,aAAa,CAAC,IAAI,CAAC,CAAC;oBACxB,MAAM,CAAC,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;gBACvD,CAAC,EAAE,WAAW,CAAC,CAAC;YACpB,CAAC,EAAE,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,YAAuC,CAAC;QAC5C,IAAI,gBAA2C,CAAC;QAChD,IAAI,UAAU,GAAkC,MAAM,CAAC;QACvD,OAAO;YACH,MAAM;YACN,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACzD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACX,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAClG,CAAC,CAAC;YACF,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,KAAK,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC7D,UAAU,GAAG,SAAS,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC;YACF,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;YAChB,SAAS,EAAE,GAAG,EAAE,CAAC,gBAAgB,KAAK,CAAC,KAAK,IAAI,EAAE;gBAC9C,UAAU,GAAG,SAAS,CAAC;gBACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/D,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;oBACvB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClC,OAAO;gBACX,CAAC;gBACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;oBAC9H,WAAW,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,0EAA0E;gBAC1E,yEAAyE;gBACzE,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAU,CAAC,IAAI,CAAC;oBACtC,qEAAqE;oBACrE,mEAAmE;oBACnE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;oBAChE,YAAY,EAAE,IAAI;oBAClB,YAAY,EAAE,IAAI;oBAClB,IAAI,EAAE,MAAM;iBACf,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,UAAU,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,oDAAoD,YAAY,qCAAqC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC5J,WAAW,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,IAAI,CAAC;YACf,CAAC,CAAC,EAAE;SACP,CAAC;IACN,CAAC;IACD,YAAY,UAAgC,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAM,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,yDAAyD;QACzD,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,0DAA0D;IAClD,WAAW,CAAC,YAAoB;QACpC,MAAM,IAAI,GAAG,GAAG,YAAY,mEAAmE,CAAC;QAChG,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IACD,2DAA2D;IAC3D,kBAAkB,CAAC,UAAmB;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,UAErC,EAAE;QACF,MAAM,MAAM,GAAG,IAAI,mBAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YACxB,CAAC,CAAC,iBAAiB,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAC9B,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;SAC/C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,IAAI,WAAW,CAAC;QAC9C,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC;QACtD,uDAAuD;QACvD,6DAA6D;QAC7D,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,cAAsB;QAOvC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,OAAO,SAAS,IAAI,cAAc;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;YACtE,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,+CAA+C,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;oBACpF,8BAA8B,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,wCAAwC;aAC9G,CAAC;IACV,CAAC;IACD,yBAAyB;IACzB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAgC,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;YAC3E,sDAAsD;YACtD,+BAA+B;YAC/B,gEAAgE;YAChE,MAAM,aAAa,GAAc,EAAE,CAAC;YACpC,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,OAAO,YAAY,EAAE,CAAC;gBAClB,IAAI,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBAC7B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,OAAO,YAAY,EAAE,CAAC;gBAClB,IAAI,gBAAgB,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;oBACzC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC3B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;YACL,CAAC;YACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CAAC,CAAC,mBAAmB,EAAE,GAAG,aAAa,CAAC,EAAE,mGAAmG,CAAC,CAAC;YAC3K,CAAC;YACD,MAAM,mBAAmB,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,yDAAyD;IACjD,KAAK,CAAC,6BAA6B,CAAC,KAAc;QACtD,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAC7D,OAAO,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC/B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,IAAA,mCAAgB,EAAC,IAAwC,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7F,IAAI,IAAI,KAAK,EAAE;gBACX,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC;YACH,gCAAgC;QACpC,CAAC;QACD,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,kBAAkB,CAAC,EAAE;oBAC9F,IAAI,EAAE,SAAS;iBAClB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7D,IAAI,IAAI,KAAK,EAAE;oBACX,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACL,CAAC;QACD,MAAM,CAAC;YACH,oDAAoD;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,mCAAmC;IAC3B,KAAK,CAAC,UAAU;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAChB,gDAAgD;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACjC,8BAA8B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/L,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ;gBAC3C,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ;aAC9C,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,cAAc,EAAE,IAAA,wBAAU,GAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACvI,CAAC;QACD,WAAW;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACvE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3E,CAAC;QACD,qCAAqC;QACrC,0DAA0D;QAC1D,wEAAwE;QACxE,0DAA0D;QAC1D,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QACzI,2DAA2D;QAC3D,gEAAgE;QAChE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,yCAAoB,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/C,KAAK,EAAE,SAAS;YAChB,GAAG,CAAC,WAAW,KAAK,SAAS;gBACzB,CAAC,CAAC;oBACE,GAAG,EAAE;wBACD,IAAI;wBACJ,IAAI;wBACJ,SAAS,aAAa,eAAe,aAAa,kBAAkB,MAAM,kBAAkB,aAAa,EAAE;qBAC9G;iBACJ;gBACD,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC9F,UAAU,EAAE,IAAI,CAAC,OAAO;YACxB,8CAA8C;YAC9C,0CAA0C;YAC1C,MAAM,EAAE;gBACJ,yBAAyB,EAAE,MAAM;gBACjC,GAAG,CAAC,MAAM;oBACN,CAAC,CAAC;wBACE,wBAAwB,EAAE,MAAM;wBAChC,8BAA8B,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,IAAI,SAAS;qBAC1F;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,yCAAuB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,IAAI,CAAC,aAAa;aACxB;YACD,GAAG,EAAE,IAAI;YACT,qEAAqE;YACrE,wDAAwD;YACxD,+DAA+D;YAC/D,UAAU,EAAE;gBACR,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;gBAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;aACrE;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,4BAA4B;QAC5B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpC,gBAAgB;QAChB,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,6CAA6C;QAC7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,oDAAoD;QACpD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,sEAAsE;IAC9D,gBAAgB;QACpB,OAAO,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5D,CAAC;IACO,sBAAsB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS;YACvB,OAAO,eAAM,CAAC,IAAI,CAAC;QACvB,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY;YACrD,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,OAAO,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;YACxE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;oBACpC,OAAO,EAAE,2CAAmC;oBAC5C,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,QAAQ;oBACR,KAAK,EAAE,6BAA6B;oBACpC,SAAS,EAAE,SAAS,CAAC,SAAS;iBACjC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;gBACpC,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,QAAQ;gBACR,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,SAAS,CAAC,SAAS;aACjC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACO,2BAA2B,CAAC,KAUnC;QACG,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACzC,IAAI,WAAW,GAAG,mBAAmB,CAAC;QACtC,MAAM,OAAO,GAAiC,eAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ;gBACpB,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,UAAU,CAAC;gBACnC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;gBACrD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,eAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa;oBACtG,UAAU,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAM,CAAC,MAAM,CAAC,eAAM,CAAC,UAAU,CAAC;gBAClD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBACjD,iBAAiB,EAAE,MAAM;iBAC5B,CAAC;gBACF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;aAC1B,CAAC,CAAC,CAAC;YACJ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBAC3B,OAAO;gBACX,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9G,CAAC;iBACI,CAAC;gBACF,WAAW,GAAG,MAAM,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,cAAK,CAAC,iBAAiB,CAAC;YACpD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC;YAChD,IAAI,SAAS,IAAI,CAAC;gBACd,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,eAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAgC,EAAE;YAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC;YACxE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/F,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,mCAAmC;oBAC9E,6CAA6C;gBACjD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,eAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC,SAAS,OAAO,WAAW,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1H,CAAC,CAAC;QACF,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;;OAIG;IACK,KAAK,CAAC,sBAAsB;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YACvC,IAAI;YACJ,0EAA0E;SAC7E,EAAE;YACC,IAAI,EAAE,IAAI,CAAC,YAAY;gBACnB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,GAAG,KAAK,GAAG,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,WAAW,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,YAAY,GAAG,GAAG,IAAI,CAAC,WAAW,cAAc,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,gEAAgE;IACxD,WAAW;QACf,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,oBAAoB;IACZ,KAAK,CAAC,WAAW,CAAC,SAAiB;QACvC,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC;YACH,uDAAuD;YACvD,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;YACpH,QAAQ,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAChC,QAAQ,CAAC,IAAA,YAAC,EAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACnB,MAAM,MAAM,GAAG;YACX,SAAS;YACT,0CAA0C;YAC1C,uCAAuC;YACvC,6CAA6C;YAC7C,oFAAoF;YACpF,2CAA2C;YAC3C,0DAA0D;YAC1D,gDAAgD;YAChD,2DAA2D;YAC3D,2CAA2C;YAC3C,sDAAsD;YACtD,2CAA2C;YAC3C,sDAAsD;YACtD,MAAM;YACN,iLAAiL;YACjL,YAAY;YACZ,IAAI;YACJ,mJAAmJ;SACtJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,gBAAgB;IACR,KAAK,CAAC,SAAS,CAAC,SAAiB;QACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,MAA6B,EAAE,EAAE;gBAC7E,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,SAAuB,EAAE,EAAE;oBACjE,IAAI,SAAS,EAAE,CAAC;wBACZ,MAAM,CAAC,SAAS,CAAC,CAAC;oBACtB,CAAC;yBACI,CAAC;wBACF,OAAO,EAAE,CAAC;oBACd,CAAC;gBACL,CAAC;gBACD,iBAAiB;gBACjB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACD,sCAAsC;IACtC,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACjF,0DAA0D;QAC1D,gFAAgF;QAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,4DAA4D;QAC5D,iEAAiE;QACjE,2DAA2D;QAC3D,sCAAsC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;QAChG,MAAM,GAAG,GAAG;YACR,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,IAAI,CAAC,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,+DAA+D;YAC/D,kBAAkB;YAClB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACpC,GAAG;YACH,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;IACP,CAAC;IACD,2CAA2C;IACnC,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE,OAAuB,EAAE;QACtF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;IACP,CAAC;IACD,8CAA8C;IACtC,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACzC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,iDAAiD;IACzC,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE,OAWxD,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;YAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YACtD,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,yDAAyD;YACzD,wDAAwD;YACxD,MAAM,OAAO,GAAG,IAAA,oCAAiB,GAAE,CAAC;YACpC,iDAAiD;YACjD,gDAAgD;YAChD,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;gBAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,IAAI,MAAM,IAAI,QAAQ,KAAK,SAAS;oBAChC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/D,IAAI,MAAM,IAAI,QAAQ,KAAK,SAAS;oBAChC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,gEAAgE;YAChE,gDAAgD;YAChD,MAAM,KAAK,GAAG,IAAA,0BAAY,EAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAClG,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAqD,CAAC;YAC1D,IAAI,cAA0D,CAAC;YAC/D,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,IAAI,SAAS,KAAK,SAAS;oBACvB,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC5B,IAAI,cAAc,KAAK,SAAS;oBAC5B,aAAa,CAAC,cAAc,CAAC,CAAC;gBAClC,IAAI,UAAU,KAAK,SAAS;oBACxB,YAAY,CAAC,UAAU,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC;YACF,MAAM,eAAe,GAAG,CAAC,KAAY,EAAQ,EAAE;gBAC3C,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,KAAK,MAAM;oBAChD,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;wBACjD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;4BAC3B,MAAM,SAAS,CAAC;oBACxB,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;oBACvB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS;gBACrC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,eAAe,CAAC,IAAI,wCAA0B,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1H,CAAC,EAAE,SAAS,CAAC,CAAC;YAClB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBACnC,eAAe,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;YAClH,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBACpB,OAAO,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgD,EAAiB,EAAE;gBACrF,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACD,MAAM,aAAa,CAAC;oBACpB,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjD,OAAO,CAAC;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;wBACxB,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;wBACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;qBACrC,CAAC,CAAC;gBACP,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACL,CAAC,CAAC;YACF,kEAAkE;YAClE,kEAAkE;YAClE,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC9B,IAAI,OAAO,IAAI,YAAY,IAAI,UAAU,KAAK,SAAS;oBACnD,OAAO;gBACX,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;oBACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBACvE,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACrE,CAAC;gBACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBAChC,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IACD,yCAAyC;IACzC,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAuB,EAAE;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,4DAA4D;YAC5D,MAAM,OAAO,GAAG,sBAAsB,MAAM,iBAAiB,aAAa,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;gBAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,aAAa,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,eAAe;IACf,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,OAA0B,EAAE,EAAE,OAAuB,EAAE;QACxF,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,OAAuB,EAAE;QAC3D,OAAO,IAAA,uCAAuB,EAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,oBAAoB;IACpB,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,uBAAuB;IACf,KAAK,CAAC,mBAAmB,CAAC,KAAoC,EAAE,SAAkB;QACtF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;QACX,CAAC;QACD,WAAW;QACX,MAAM,IAAI,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC,CAAC,CAAC;QACL,MAAM,UAAU,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,IAAA,6BAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,+BAA+B;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,kDAAkD;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAoB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,IAAA,mBAAQ,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,SAAuB,EAAE,SAAkB,EAAE,OAE/D,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,IAAA,kCAAiB,EAAC,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IACD;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,SAAuB,EAAE,OAEhE,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAA,sCAAmB,EAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5D,OAAO;YACX,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;YACtC,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC,CAAC;IACR,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,OAAO,IAAA,qCAAkB,EAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAO,IAAI,CAAC,SAA8B,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,OAAO,IAAA,mCAAgB,EAAC,MAA+B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAA,qBAAU,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,aAAa,IAAA,qBAAU,EAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrJ,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,qCAAqC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,OAAmB;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,iCAAc,EAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oBAAQ,EAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAO,IAAI,CAAC,SAA8B,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAA,mBAAO,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,OAAe;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,IAAA,YAAC,EAAC,gCAAgC,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC;YAC1D,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAA2C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACvB,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,KAA+C,EAAQ,EAAE;gBACrE,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,CAAC;YACF,MAAM,gBAAgB,GAAG,GAAS,EAAE;gBAChC,IAAI,OAAO,IAAI,YAAY;oBACvB,OAAO;gBACX,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC/B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;wBACvB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,OAAO,kCAAkC,CAAC,CAAC,CAAC;YACtF,CAAC,EAAE,KAAK,CAAC,CAAC;YACV,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBAChC,IAAI,OAAO;oBACP,OAAO;gBACX,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,kCAAkC,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAoB;QACvD,MAAM,WAAW,GAAG,IAAA,2BAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,IAAA,gBAAK,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAA,oBAAS,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,IAAI;QACN,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,OAAO;QACX,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,aAAa,GAAc,EAAE,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QAC3C,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBACvB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;iBACI,CAAC;gBACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;oBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;oBAClC,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;wBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAC5B,CAAC;qBACI,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,oCAAoC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAC7B,CAAC;IACD,mFAAmF;IACnF,IAAI,gBAAgB;QAChB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC5B,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACT,IAAI,CAAC,IAAI,CAAC,SAAS;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;CACJ;AAzmCD,sCAymCC","sourcesContent":["// Docker 沙箱 provider:用 dockerode 把容器当隔离工作区跑 eval。\n// 改编自 agent-eval 的 docker-sandbox.ts,签名对齐 ../types.ts 的 Sandbox 契约\n//(runShell/runCommand 的 opts 一律是选项对象,不再用位置参数)。\nimport { basename, dirname, join } from \"node:path\";\nimport { PassThrough } from \"node:stream\";\nimport { randomUUID } from \"node:crypto\";\nimport { mkdir, readFile, realpath, stat, writeFile } from \"node:fs/promises\";\nimport Docker from \"dockerode\";\nimport { Clock, Effect } from \"effect\";\nimport type { CommandResult, CommandOptions, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SuccessfulCommandResult, } from \"../types.ts\";\nimport { collectLocalFiles, type CollectedLocalFile } from \"./local-files.ts\";\nimport { shellQuote } from \"./shell.ts\";\nimport { createExecDemuxer, extractFileFromTar, extractFilesFromTar, packFilesToTar, readableToBuffer, } from \"./docker-stream.ts\";\nimport { resolveLocalPath, resolveSandboxPath } from \"./paths.ts\";\nimport { commandLimit, SandboxCommandTimeoutError } from \"./deadline.ts\";\nimport { successfulCommandResult } from \"./operations.ts\";\nimport { t } from \"../i18n/index.ts\";\nimport { reportActivity } from \"../runner/feedback/sink.ts\";\nimport { classifyProvisionErrorFallback, type SandboxProvisionErrorKind } from \"./errors.ts\";\nimport { dockerRunIdentityLabels, type RunIdentity } from \"./run-identity.ts\";\nimport { supportedBackendCapability, type SandboxProviderBackend } from \"./backend.ts\";\nimport type { DockerSandboxAccess, DockerSandboxReadiness, DockerSandboxResources } from \"./layer.ts\";\nimport { dindContainerCommand } from \"./dind-supervisor.ts\";\nimport { ManagedProcessOutput } from \"./managed-process.ts\";\n/**\n * dockerode 对镜像拉取限流没有专门的错误类型;Docker Hub 429 体现在错误 message 里\n * (如 \"toomanyrequests: You have reached your pull rate limit\")。\n */\nexport function classifyProvisionError(e: unknown): SandboxProvisionErrorKind {\n    const msg = e instanceof Error ? e.message : String(e);\n    // provider 原生限流形态先归拒绝类;没认出的过与文件 IO 共用的保守瞬时兜底分类器。\n    if (/toomanyrequests|rate limit exceeded|429/i.test(msg))\n        return \"rate_limit\";\n    return classifyProvisionErrorFallback(e);\n}\n/**\n * Provisioning 重试前的对账:按 provision token 查询本地 daemon,查到的实例先销毁再重建\n * (不做断线收养,重建比重连语义干净)。docker create 是对本地 daemon 的调用,歧义窗口极小,\n * 这条主要兜 daemon 代理 / 远程 DOCKER_HOST 的场景。查询或销毁失败必须抛出——对账是重试的\n * 硬前置,静默放行等于盲重试(见 docs/feature/sandbox/architecture.md);唯一的例外:\n * 容器已不存在(404),视作对账完成。\n */\nexport async function reconcileProvision(token: string, socketPath?: string): Promise<void> {\n    const docker = new Docker(socketPath === undefined ? undefined : { socketPath });\n    const containers = await docker.listContainers({\n        all: true,\n        filters: { label: [`niceeval.provision-token=${token}`] },\n    });\n    for (const info of containers) {\n        try {\n            await docker.getContainer(info.Id).remove({ force: true });\n        }\n        catch (e) {\n            if ((e as {\n                statusCode?: number;\n            }).statusCode !== 404)\n                throw e;\n        }\n    }\n}\n// 各 Node 运行时对应的镜像。用 -slim 变体下载更快、兼容性够用。\nconst DOCKER_IMAGES: globalThis.Record<string, string> = {\n    node20: \"node:20-slim\",\n    node24: \"node:24-slim\",\n};\n// 容器 dead-man TTL 的兜底基数:四层解析链一个上限都没声明(attempt 没有 deadline)时,\n// TTL 仍需要一个具体秒数烧进 PID1。它只决定「孤儿容器多久自行消失」,不是任何命令的上限——\n// 单条命令的上限恒从 attempt deadline 派生(见 deadline.ts)。\nconst TTL_BASE_WITHOUT_DEADLINE = 600000;\n// 容器「存活上限」(dead-man switch):PID1 用 `timeout <TTL> tail -F` 跑,到点自动退出 →\n// 容器停止 → AutoRemove 清理。这样即便宿主进程被 kill -9 / 崩溃 / 断电(SIGINT handler 来不及\n// 跑 stop()),孤儿容器也会在 TTL 后自行消失,不靠任何外部状态。TTL 取 attempt 超时的 2 倍并设\n// 下限,确保正常运行(setup + agent + 脚本,本就受 attempt 超时约束)绝不会被它误杀。\nconst TTL_MULTIPLIER = 2;\nconst TTL_FLOOR_MS = 1200000; // 20 分钟\n// 容器内工作目录。\nconst CONTAINER_WORKDIR = \"/home/sandbox/workspace\";\n// 容器「主日志」文件:PID1 tail 它 → `docker logs` 实时显示;agent 命令的 stream 输出 tee 进来。\nconst CONTAINER_LOG = \"/tmp/niceeval-agent.log\";\n// 命令默认沿用环境自己声明的执行身份:省略 `user` 时 docker exec 不注入 `--user`,\n// 镜像 `USER` 原样生效(未声明按 Docker 语义是 root)。需要别的身份走 factory `user`\n// (整个 Sandbox 的默认身份)或 runCommand 的 `{ user: \"root\" }`(只这一条命令)——\n// 见 docs/feature/sandbox/library.md「执行身份」。\nconst ROOT_USER = \"root\";\nconst DOCKER_ACCESS_SOCKET = \"unix:///var/run/docker.sock\";\n/**\n * This is intentionally provider-owned.  It proves the Agent's *initial default*\n * endpoint without pretending to constrain commands the Agent may issue later.\n */\nexport const DOCKER_ACCESS_COMPATIBILITY_COMMAND = Object.freeze([\n    \"sh\",\n    \"-ec\",\n    [\n        'test -z \"${DOCKER_HOST+x}\" || { echo \"DOCKER_HOST must be unset\" >&2; exit 1; }',\n        'test -z \"${DOCKER_CONTEXT+x}\" || { echo \"DOCKER_CONTEXT must be unset\" >&2; exit 1; }',\n        'context=\"$(docker context show)\"',\n        'test \"$context\" = \"default\" || { echo \"docker context must be default (got $context)\" >&2; exit 1; }',\n        'default_daemon=\"$(docker info --format \\'{{.ID}}\\')\"',\n        `unix_daemon=\"$(docker --host=${DOCKER_ACCESS_SOCKET} info --format '{{.ID}}')\"`,\n        'test -n \"$default_daemon\" || { echo \"bare docker info returned no daemon ID\" >&2; exit 1; }',\n        'test \"$default_daemon\" = \"$unix_daemon\" || { echo \"bare and Unix Docker endpoints reached different daemons\" >&2; exit 1; }',\n    ].join(\"\\n\"),\n] as const satisfies readonly [\n    string,\n    ...string[]\n]);\n/** `user` 取值是否等价于 root(数字 uid 0、`0:0` 或字面量 `root`)。 */\nfunction isRootLikeUserSpec(value: string): boolean {\n    return value === \"0\" || value === \"0:0\" || value === ROOT_USER;\n}\n/** 创建 Docker 沙箱的选项。 */\nexport interface DockerSandboxOptions {\n    /** attempt 的超时上限(毫秒),单条命令未显式传 `timeout` 时的上限来源;省略 = 没有上限。 */\n    timeout?: number;\n    /** attempt deadline 的截止时刻(epoch ms);单条命令按**剩余量**取上限(见 deadline.ts)。 */\n    deadlineAt?: number;\n    /** 容器实例寿命；与单条命令 timeout 分离。 */\n    lifetimeMs?: number;\n    /** Node 运行时。 */\n    runtime?: \"node20\" | \"node24\";\n    /** 覆盖默认镜像(默认按 runtime 选 `node:*-slim`)。预制模板:烘焙好 agent CLI 的镜像名。 */\n    image?: string;\n    /** runner 绑定到 `sandbox.create` 的反馈句柄(镜像拉取进度走它);省略退回全局 sink。 */\n    feedback?: import(\"../types.ts\").ScopedFeedback;\n    /** 一次性 provision token:写进容器 label,歧义类失败重试前按它对账(见 errors.ts 的两维分类)。 */\n    provisionToken?: string;\n    /**\n     * 创建期写入的运行标识(host/pid/startedAt),供强杀之后的孤儿核对按 label 事后收回(见\n     * docs/feature/sandbox/architecture.md「孤儿核对」)。省略时不写这组 label(如直接单测构造\n     * DockerSandbox,不经 runtime.ts 的 provider materializer)。\n     */\n    runIdentity?: RunIdentity;\n    /**\n     * 覆盖默认 workdir。Compose mainService 附着时用容器 inspect 的 WorkingDir;\n     * 省略 = `/home/sandbox/workspace`。\n     */\n    workdir?: string;\n    /**\n     * 覆盖整个 Sandbox 的默认执行身份;省略时沿用镜像 `USER`(未声明按 Docker 语义是 root)、\n     * Compose service `user:` 或其镜像 `USER`。\n     */\n    user?: string;\n    /** raw = 直接请求 privileged；rootless = 只允许受管 rootless daemon。 */\n    privileged?: \"disabled\" | \"raw\" | \"rootless\";\n    /** Agent在Sandbox内访问Docker的模式；socket模式会显式挂载宿主Unix socket。 */\n    dockerAccess?: Readonly<DockerSandboxAccess>;\n    /** 创建容器时交给 daemon 强制执行的资源边界。 */\n    resources?: Readonly<DockerSandboxResources>;\n    /** PID 1 启动后、任何 setup/prepare/agent 命令之前必须通过的作者声明探针。 */\n    readiness?: Readonly<DockerSandboxReadiness>;\n    /** profile-bound provider fixes every Docker I/O to the attested Unix endpoint. */\n    dockerSocketPath?: string;\n    /** Descriptor-pinned public resolvers; managed privileged mode never invents defaults. */\n    dns?: readonly string[];\n    /** Durable watchdog ownership labels, copied to both container and exclusive network. */\n    managedLabels?: Readonly<Record<string, string>>;\n    rootlessAttestation?: {\n        readonly daemonId: string;\n        readonly dataRoot: string;\n    };\n    afterStop?: () => Promise<void>;\n    /**\n     * 按序前置到受管 `PATH` 的目录;省略 = 不改 PATH(见 docs/feature/sandbox/library.md\n     * 「PATH:受管变量与 pathPrepend」)。\n     */\n    pathPrepend?: readonly string[];\n}\nexport function assertRootlessPrivilegedDaemon(info: {\n    readonly ID?: string;\n    readonly SecurityOptions?: readonly string[];\n    readonly DockerRootDir?: string;\n    readonly CgroupDriver?: string;\n    readonly CgroupVersion?: string;\n}, dockerHost: string | undefined, expected: {\n    readonly daemonId?: string;\n    readonly dataRoot?: string;\n} | undefined): void {\n    if (dockerHost === undefined || !dockerHost.startsWith(\"unix://\")) {\n        throw new Error('privileged Docker sandbox requires an explicit rootless Unix DOCKER_HOST; no default socket or TCP endpoint is allowed');\n    }\n    const socketPath = dockerHost.slice(\"unix://\".length);\n    if (socketPath === \"/var/run/docker.sock\" || socketPath === \"/run/docker.sock\") {\n        throw new Error(\"privileged Docker sandbox refuses the host rootful Docker socket\");\n    }\n    const securityOptions = info.SecurityOptions ?? [];\n    if (!securityOptions.some((entry) => /(?:^|[=,])rootless(?:$|[=,])/i.test(entry))) {\n        throw new Error(\"privileged Docker sandbox requires a daemon whose SecurityOptions report rootless\");\n    }\n    if (info.CgroupVersion !== \"2\" || info.CgroupDriver !== \"systemd\") {\n        throw new Error(`privileged Docker sandbox requires delegated cgroup v2 with the systemd driver; got ` +\n            `version=${info.CgroupVersion ?? \"unknown\"}, driver=${info.CgroupDriver ?? \"unknown\"}`);\n    }\n    if (expected?.daemonId === undefined || expected.daemonId === \"\") {\n        throw new Error(\"privileged Docker sandbox requires NICEEVAL_ROOTLESS_DOCKER_ID attestation\");\n    }\n    if (info.ID !== expected.daemonId) {\n        throw new Error(`privileged Docker sandbox daemon ID does not match NICEEVAL_ROOTLESS_DOCKER_ID ` +\n            `(expected ${expected.daemonId}, got ${info.ID ?? \"unknown\"})`);\n    }\n    if (expected?.dataRoot === undefined || expected.dataRoot === \"\") {\n        throw new Error(\"privileged Docker sandbox requires NICEEVAL_ROOTLESS_DOCKER_DATA_ROOT attestation\");\n    }\n    if (info.DockerRootDir !== expected.dataRoot) {\n        throw new Error(`privileged Docker sandbox DockerRootDir does not match NICEEVAL_ROOTLESS_DOCKER_DATA_ROOT ` +\n            `(expected ${expected.dataRoot}, got ${info.DockerRootDir ?? \"unknown\"})`);\n    }\n}\nfunction dockerStatusCode(error: unknown): number | undefined {\n    return typeof error === \"object\" && error !== null && \"statusCode\" in error\n        ? (error as {\n            readonly statusCode?: number;\n        }).statusCode\n        : undefined;\n}\nfunction benignStopError(error: unknown): boolean {\n    const status = dockerStatusCode(error);\n    return status === 304 || status === 404;\n}\nfunction benignRemoveError(error: unknown): boolean {\n    return dockerStatusCode(error) === 404;\n}\nexport function dockerHostConfig(privileged: \"disabled\" | \"raw\" | \"rootless\", resources: Readonly<DockerSandboxResources>, dns: readonly string[] = [], socketMount?: {\n    readonly source: string;\n    readonly gid: number;\n}): Docker.HostConfig {\n    const nanoCpus = resources.cpus === undefined ? undefined : Math.round(resources.cpus * 1000000000);\n    if (nanoCpus !== undefined && !Number.isSafeInteger(nanoCpus)) {\n        throw new TypeError(\"Docker sandbox resources.cpus is too large to encode as NanoCpus\");\n    }\n    const tmpfs = resources.tmpfs === undefined\n        ? undefined\n        : Object.fromEntries(Object.entries(resources.tmpfs).map(([path, options]) => [\n            path,\n            [\n                \"rw\",\n                options.executable === true ? \"exec\" : \"noexec\",\n                \"nosuid\",\n                \"nodev\",\n                `size=${options.sizeBytes}`,\n                ...(options.mode === undefined ? [] : [`mode=${options.mode.toString(8).padStart(4, \"0\")}`]),\n                ...(options.uid === undefined ? [] : [`uid=${options.uid}`]),\n                ...(options.gid === undefined ? [] : [`gid=${options.gid}`]),\n            ].join(\",\"),\n        ]));\n    return {\n        AutoRemove: false,\n        ...(privileged !== \"disabled\"\n            ? { Privileged: true, ...(dns.length === 0 ? {} : { Dns: [...dns] }) }\n            : {}),\n        ...(socketMount === undefined\n            ? {}\n            : {\n                Mounts: [{ Type: \"bind\", Source: socketMount.source, Target: \"/var/run/docker.sock\" }],\n                GroupAdd: [String(socketMount.gid)],\n            }),\n        ...(nanoCpus === undefined ? {} : { NanoCpus: nanoCpus }),\n        ...(resources.memoryBytes === undefined ? {} : { Memory: resources.memoryBytes }),\n        ...(resources.memoryBytes === undefined ? {} : { MemorySwap: resources.memoryBytes }),\n        ...(resources.pidsLimit === undefined ? {} : { PidsLimit: resources.pidsLimit }),\n        ...(resources.readOnlyRootfs === true ? { ReadonlyRootfs: true } : {}),\n        ...(tmpfs === undefined ? {} : { Tmpfs: tmpfs }),\n    };\n}\nexport async function resolveDockerSocketMount(socketPath: string): Promise<{\n    readonly source: string;\n    readonly gid: number;\n}> {\n    const source = await realpath(socketPath);\n    const info = await stat(source);\n    if (!info.isSocket())\n        throw new TypeError(`Docker socket path is not a Unix socket: ${socketPath}`);\n    return Object.freeze({ source, gid: info.gid });\n}\n/** managed privileged Attempt 的独占 outer network；允许 NAT 出站，但禁止 sibling 互通。 */\nexport function dockerManagedNetworkOptions(provisionToken: string | undefined, nonce: string = randomUUID(), managedLabels: Readonly<Record<string, string>> = {}): Docker.NetworkCreateOptions {\n    return {\n        Name: `niceeval-attempt-${nonce}`,\n        CheckDuplicate: false,\n        Driver: \"bridge\",\n        Internal: false,\n        Attachable: false,\n        Options: {\n            \"com.docker.network.bridge.enable_icc\": \"false\",\n        },\n        Labels: {\n            \"niceeval.managed-network\": \"true\",\n            ...(provisionToken === undefined ? {} : { \"niceeval.provision-token\": provisionToken }),\n            ...managedLabels,\n        },\n    };\n}\n/** `stop()` 时是否销毁容器。Compose 主容器由资源组 `compose down` 回收,附着句柄只松绑。 */\nexport type DockerSandboxReleaseMode = \"destroy\" | \"detach\";\n/**\n * Docker 沙箱:为每次运行起一个隔离容器。\n * 实现 ../types.ts 的 Sandbox 接口。\n */\nexport class DockerSandbox implements SandboxProviderBackend, SandboxReuseCapability {\n    readonly workdir: string;\n    readonly otlpHost: string | null;\n    private docker: Docker;\n    private container: Docker.Container | null = null;\n    private network: Docker.Network | null = null;\n    private _containerId = \"\";\n    private timeout?: number;\n    private deadlineAt?: number;\n    private lifetimeMs?: number;\n    /** 容器 PID1 的 dead-man TTL 到期时刻(initialize 里烧进 `timeout` 那一刻定死)。 */\n    private expiresAtMs?: number;\n    private runtime: string;\n    private image?: string;\n    private feedback?: import(\"../types.ts\").ScopedFeedback;\n    private provisionToken?: string;\n    private runIdentity?: RunIdentity;\n    private releaseMode: DockerSandboxReleaseMode = \"destroy\";\n    /** 起点覆盖(factory `user`);省略 = 沿用镜像/Compose 声明的默认身份。 */\n    private readonly userOverride?: string;\n    private readonly privileged: \"disabled\" | \"raw\" | \"rootless\";\n    private readonly dockerAccess?: Readonly<DockerSandboxAccess>;\n    private readonly resources: Readonly<DockerSandboxResources>;\n    private readonly readiness?: Readonly<DockerSandboxReadiness>;\n    private readonly dockerSocketPath?: string;\n    private readonly dns: readonly string[];\n    private readonly managedLabels: Readonly<Record<string, string>>;\n    private readonly rootlessAttestation?: {\n        readonly daemonId: string;\n        readonly dataRoot: string;\n    };\n    private readonly afterStop?: () => Promise<void>;\n    /** factory `pathPrepend`;按声明顺序前置到受管 PATH,省略 = 空数组。 */\n    private readonly pathPrepend: readonly string[];\n    /** DinD 覆盖容器 User 为 root 后，仍用镜像 USER 作为 Agent 默认身份。 */\n    private imageDefaultUser?: string;\n    /** 下面三项由 `resolveDefaultIdentity()` 探测得出,构造期先给出安全占位值。 */\n    private defaultHome = \"/root\";\n    private defaultUserName = \"root\";\n    private defaultIsRoot = true;\n    private npmGlobalDir = \"/root/.npm-global\";\n    private sandboxPath: string;\n    readonly capabilities = {\n        rootCommands: supportedBackendCapability(true as const),\n        appendLog: supportedBackendCapability((line: string) => this.appendLog(line)),\n        suspend: supportedBackendCapability(() => this.suspend()),\n        ensureLifetime: supportedBackendCapability((minRemainingMs: number) => this.ensureLifetime(minRemainingMs)),\n        setCommandDeadline: supportedBackendCapability((deadlineAt?: number) => this.setCommandDeadline(deadlineAt)),\n        managedProcess: supportedBackendCapability((input: ManagedProcessStart) => this.startManagedProcess(input)),\n    };\n    private async startManagedProcess(input: ManagedProcessStart): Promise<ManagedProcess> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const [command, ...args] = input.argv;\n        const env = {\n            HOME: this.defaultHome,\n            USER: this.defaultUserName,\n            LOGNAME: this.defaultUserName,\n            ...input.env,\n            PATH: this.sandboxPath,\n            ...(this.defaultIsRoot ? { npm_config_unsafe_perm: \"true\" } : {}),\n        };\n        const marker = `__NICEEVAL_MANAGED_PID_${randomUUID()}__`;\n        const exec = await this.container.exec({\n            // If the Docker exec leader is already a process-group leader, setsid\n            // forks. --wait keeps Docker's receipt tied to the native child lifetime.\n            Cmd: [\"setsid\", \"--wait\", \"sh\", \"-c\", `printf '${marker}%s\\\\n' \"$$\" >&2; exec \"$@\"`, \"sh\", command, ...args],\n            AttachStdin: true,\n            AttachStdout: true,\n            AttachStderr: true,\n            WorkingDir: resolveSandboxPath(this.workdir, input.cwd),\n            Env: Object.entries(env).map(([key, value]) => `${key}=${value}`),\n            User: this.userOverride,\n        });\n        const stream = await exec.start({ hijack: true, stdin: true });\n        const output = new ManagedProcessOutput();\n        const stdout = new PassThrough();\n        const stderr = new PassThrough();\n        stdout.on(\"data\", (bytes: Buffer) => output.push({ _tag: \"Stdout\", bytes: new Uint8Array(bytes) }));\n        let stderrPrefix = Buffer.alloc(0);\n        let processGroup: number | undefined;\n        stderr.on(\"data\", (bytes: Buffer) => {\n            if (processGroup !== undefined) {\n                output.push({ _tag: \"Stderr\", bytes: new Uint8Array(bytes) });\n                return;\n            }\n            stderrPrefix = Buffer.concat([stderrPrefix, bytes]);\n            const newline = stderrPrefix.indexOf(10);\n            if (newline < 0)\n                return;\n            const first = stderrPrefix.subarray(0, newline).toString(\"utf8\");\n            if (!first.startsWith(marker) || !/^\\d+$/.test(first.slice(marker.length))) {\n                output.push({ _tag: \"Stderr\", bytes: new Uint8Array(stderrPrefix) });\n            }\n            else {\n                processGroup = Number(first.slice(marker.length));\n                const rest = stderrPrefix.subarray(newline + 1);\n                if (rest.length > 0)\n                    output.push({ _tag: \"Stderr\", bytes: new Uint8Array(rest) });\n            }\n            stderrPrefix = Buffer.alloc(0);\n        });\n        this.docker.modem.demuxStream(stream, stdout, stderr);\n        let poll: ReturnType<typeof setInterval> | undefined;\n        let settled = false;\n        let rejectExit!: (error: unknown) => void;\n        const finishError = (error: unknown): void => {\n            if (settled)\n                return;\n            settled = true;\n            if (poll !== undefined)\n                clearInterval(poll);\n            output.end();\n            stream.destroy();\n            rejectExit(error);\n        };\n        const exit = new Promise<import(\"../types.ts\").ManagedProcessExit>((resolve, reject) => {\n            rejectExit = reject;\n            stream.once(\"error\", finishError);\n            poll = setInterval(() => {\n                void exec.inspect().then((inspection) => {\n                    if (inspection.Running)\n                        return;\n                    if (settled)\n                        return;\n                    settled = true;\n                    if (poll !== undefined)\n                        clearInterval(poll);\n                    output.end();\n                    stream.destroy();\n                    resolve({ exitCode: inspection.ExitCode ?? null });\n                }, finishError);\n            }, 100);\n        });\n        let closeReceipt: Promise<void> | undefined;\n        let terminateReceipt: Promise<void> | undefined;\n        let stdinState: \"open\" | \"closing\" | \"closed\" = \"open\";\n        return {\n            output,\n            writeStdin: (bytes) => new Promise<void>((resolve, reject) => {\n                if (stdinState !== \"open\") {\n                    reject(new Error(\"managed process stdin is closed\"));\n                    return;\n                }\n                stream.write(Buffer.from(bytes), (error?: Error | null) => error ? reject(error) : resolve());\n            }),\n            closeStdin: () => closeReceipt ??= new Promise<void>((resolve) => {\n                stdinState = \"closing\";\n                stream.end(() => { stdinState = \"closed\"; resolve(); });\n            }),\n            wait: () => exit,\n            terminate: () => terminateReceipt ??= (async () => {\n                stdinState = \"closing\";\n                const inspection = await exec.inspect().catch(() => undefined);\n                if (!inspection?.Running) {\n                    await exit.catch(() => undefined);\n                    return;\n                }\n                if (processGroup === undefined) {\n                    const error = new Error(\"docker managed process did not disclose its process-group identity; sandbox retirement is required\");\n                    finishError(error);\n                    throw error;\n                }\n                // Do not route this provider-owned control operation through runCommand's\n                // command-tree supervisor: killing the target exec while that supervisor\n                // samples the same tree creates an ambiguous non-zero receipt. Docker's\n                // own exec receipt is the exact acknowledgement for this one kill(2).\n                const killer = await this.container!.exec({\n                    // POSIX `kill` is a shell builtin in slim images (no /usr/bin/kill).\n                    // The PGID is a separate positional parameter, never interpolated.\n                    Cmd: [\"sh\", \"-c\", \"kill -KILL \\\"$1\\\"\", \"sh\", `-${processGroup}`],\n                    AttachStdout: true,\n                    AttachStderr: true,\n                    User: \"root\",\n                });\n                const killStream = await killer.start({});\n                const killOutput = await readableToBuffer(killStream);\n                const killed = await killer.inspect();\n                if (killed.ExitCode !== 0) {\n                    const error = new Error(`docker could not terminate managed process group ${processGroup}; sandbox retirement is required: ${killOutput.toString(\"utf8\")}`);\n                    finishError(error);\n                    throw error;\n                }\n                await exit;\n            })(),\n        };\n    }\n    constructor(options: DockerSandboxOptions = {}) {\n        this.docker = new Docker(options.dockerSocketPath === undefined ? undefined : { socketPath: options.dockerSocketPath });\n        this.workdir = options.workdir ?? CONTAINER_WORKDIR;\n        this.timeout = options.timeout;\n        this.deadlineAt = options.deadlineAt;\n        this.lifetimeMs = options.lifetimeMs;\n        this.runtime = options.runtime ?? \"node24\";\n        this.image = options.image;\n        this.feedback = options.feedback;\n        this.provisionToken = options.provisionToken;\n        this.runIdentity = options.runIdentity;\n        this.userOverride = options.user === \"\" ? undefined : options.user;\n        this.privileged = options.privileged ?? \"disabled\";\n        this.dockerAccess = options.dockerAccess;\n        // Docker bridge 能否回连宿主取决于宿主防火墙与 daemon 网络策略，provider 不能把\n        // host-gateway 伪装成稳定能力。null 让 runner 把 attempt-scope collector 放进沙箱；\n        // 作者确有受控 tunnel 时仍可用 config.telemetry.host 显式覆盖。\n        this.otlpHost = null;\n        this.resources = options.resources ?? {};\n        this.readiness = options.readiness;\n        this.dockerSocketPath = options.dockerSocketPath;\n        this.dns = Object.freeze([...(options.dns ?? [])]);\n        this.managedLabels = Object.freeze({ ...(options.managedLabels ?? {}) });\n        this.rootlessAttestation = options.rootlessAttestation;\n        this.afterStop = options.afterStop;\n        this.pathPrepend = options.pathPrepend ?? [];\n        this.sandboxPath = this.managedPath(this.npmGlobalDir);\n    }\n    /** 受管 PATH:`pathPrepend` 按声明顺序前置到 npm 全局 bin + 系统默认路径。 */\n    private managedPath(npmGlobalDir: string): string {\n        const base = `${npmGlobalDir}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;\n        return this.pathPrepend.length > 0 ? `${this.pathPrepend.join(\":\")}:${base}` : base;\n    }\n    /** 复用下由池在每次借出时换成承接者自己的 deadline(见 sandbox/deadline.ts)。 */\n    setCommandDeadline(deadlineAt?: number): void {\n        this.deadlineAt = deadlineAt;\n    }\n    /**\n     * 附着到已在跑的容器(Compose mainService)。不改 Cmd/WorkingDir/网络——题目语义原样保留;\n     * `stop()` 默认只松绑句柄,整组回收由 Compose 资源组 finalizer 负责。\n     */\n    static async attach(containerId: string, options: DockerSandboxOptions & {\n        releaseMode?: DockerSandboxReleaseMode;\n    } = {}): Promise<DockerSandbox> {\n        const docker = new Docker();\n        const container = docker.getContainer(containerId);\n        const info = await container.inspect();\n        if (!info.State?.Running) {\n            throw new Error(`cannot attach DockerSandbox to container ${containerId.slice(0, 12)}: state is ${info.State?.Status ?? \"unknown\"}`);\n        }\n        const inspectedWorkdir = typeof info.Config?.WorkingDir === \"string\" && info.Config.WorkingDir.length > 0\n            ? info.Config.WorkingDir\n            : CONTAINER_WORKDIR;\n        const sandbox = new DockerSandbox({\n            ...options,\n            workdir: options.workdir ?? inspectedWorkdir,\n        });\n        sandbox.docker = docker;\n        sandbox.container = container;\n        sandbox._containerId = info.Id ?? containerId;\n        sandbox.releaseMode = options.releaseMode ?? \"detach\";\n        // Compose template 是题目的镜像，不能假设预装了 runner 私有分类账所需的 git。\n        // 这属于 provider 兑现 Sandbox 契约的初始化，不应让每条 Eval 改自己的 Dockerfile。\n        await sandbox.ensureRunnerTools();\n        await sandbox.resolveDefaultIdentity();\n        return sandbox;\n    }\n    /**\n     * 寿命确认:容器 TTL 烧在 PID1 的 `timeout` 里,没有续期通道,所以这里只确认、不续期\n     * (`SandboxReuseCapability` 允许二选一)。剩余不够就如实说不够,由 runner 轮换实例。\n     */\n    async ensureLifetime(minRemainingMs: number): Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }> {\n        if (this.lifetimeMs === undefined) {\n            return { ready: false, reason: \"the docker sandbox needs lifetimeMs when sandboxReuse is enabled\" };\n        }\n        if (this.expiresAtMs === undefined) {\n            return { ready: false, reason: \"the docker sandbox has not started yet; its lifetime is unknown\" };\n        }\n        const remaining = this.expiresAtMs - Date.now();\n        return remaining >= minRemainingMs\n            ? { ready: true, expiresAt: new Date(this.expiresAtMs).toISOString() }\n            : {\n                ready: false,\n                reason: `this docker container's dead-man TTL leaves ${Math.round(remaining / 1000)}s, ` +\n                    `but the next attempt needs ${Math.round(minRemainingMs / 1000)}s (a container TTL cannot be extended)`,\n            };\n    }\n    /** 创建并启动一个 Docker 沙箱。 */\n    static async create(options: DockerSandboxOptions = {}): Promise<DockerSandbox> {\n        const sandbox = new DockerSandbox(options);\n        try {\n            await sandbox.initialize();\n        }\n        catch (e) {\n            const initializationError = await sandbox.withInitializationDiagnostics(e);\n            // kill-on-failure:容器创建之后的初始化(start、基础工具安装、工作区属主)一旦失败,\n            // 先尽力销毁容器再抛出原始错误——不给重试层留一台无主容器\n            // (见 docs/feature/sandbox/architecture.md「Provisioning 失败与重试」)。\n            const cleanupErrors: unknown[] = [];\n            try {\n                await sandbox.container?.remove({ force: true });\n                sandbox.container = null;\n            }\n            catch (cleanupError) {\n                if (benignRemoveError(cleanupError)) {\n                    sandbox.container = null;\n                }\n                else {\n                    cleanupErrors.push(cleanupError);\n                }\n            }\n            try {\n                await sandbox.network?.remove();\n                sandbox.network = null;\n            }\n            catch (cleanupError) {\n                if (dockerStatusCode(cleanupError) === 404) {\n                    sandbox.network = null;\n                }\n                else {\n                    cleanupErrors.push(cleanupError);\n                }\n            }\n            if (cleanupErrors.length > 0) {\n                throw new AggregateError([initializationError, ...cleanupErrors], \"Docker sandbox initialization failed and its partial container/network could not be fully removed\");\n            }\n            throw initializationError;\n        }\n        return sandbox;\n    }\n    /** DinD 容器 kill-on-failure 前收集有界诊断，普通 Docker 保持原错误形状。 */\n    private async withInitializationDiagnostics(error: unknown): Promise<unknown> {\n        if (this.dockerAccess?.mode !== \"dind\" || this.container === null)\n            return error;\n        const sections: string[] = [];\n        try {\n            const logs = await this.container.logs({ stdout: true, stderr: true, tail: 256 });\n            const bytes = Buffer.isBuffer(logs)\n                ? logs\n                : await readableToBuffer(logs as unknown as NodeJS.ReadableStream);\n            const tail = bytes.subarray(Math.max(0, bytes.length - 256 * 1024)).toString(\"utf-8\").trim();\n            if (tail !== \"\")\n                sections.push(`docker logs (tail):\\n${tail}`);\n        }\n        catch {\n            // 诊断采集是 best effort；不能覆盖初始化原错误。\n        }\n        try {\n            const state = await this.container.inspect();\n            if (state.State?.Running === true) {\n                const daemonTail = await this.execCommand(\"tail\", [\"-c\", String(256 * 1024), \"/tmp/dockerd.log\"], {\n                    user: ROOT_USER,\n                });\n                const tail = (daemonTail.stderr || daemonTail.stdout).trim();\n                if (tail !== \"\")\n                    sections.push(`dockerd.log (tail):\\n${tail}`);\n            }\n        }\n        catch {\n            // daemon 提前退出时 supervisor 已把有界 tail 写入 docker logs。\n        }\n        if (sections.length === 0)\n            return error;\n        const message = error instanceof Error ? error.message : String(error);\n        return new Error(`${message}\\n${sections.join(\"\\n\")}`, { cause: error });\n    }\n    /** 拉镜像、起容器、装基础工具、备好工作区与 npm 前缀。 */\n    private async initialize(): Promise<void> {\n        const socketMount = this.dockerAccess?.mode === \"socket\"\n            ? await resolveDockerSocketMount(this.dockerAccess.socketPath)\n            : undefined;\n        // 显式 image(预制模板)优先;否则按 runtime 选默认 node:*-slim。\n        const imageName = this.image ?? DOCKER_IMAGES[this.runtime];\n        if (!imageName) {\n            throw new Error(t(\"docker.unsupportedRuntime\", { runtime: this.runtime }));\n        }\n        if (this.privileged === \"rootless\") {\n            assertRootlessPrivilegedDaemon(await this.docker.info(), this.dockerSocketPath === undefined ? undefined : `unix://${this.dockerSocketPath}`, this.rootlessAttestation === undefined ? undefined : {\n                daemonId: this.rootlessAttestation.daemonId,\n                dataRoot: this.rootlessAttestation.dataRoot,\n            });\n            if (this.dns.length === 0)\n                throw new Error(\"managed rootless Docker requires descriptor-pinned DNS servers\");\n            this.network = await this.docker.createNetwork(dockerManagedNetworkOptions(this.provisionToken, randomUUID(), this.managedLabels));\n        }\n        // 确保镜像在本地。\n        await this.ensureImage(imageName);\n        const isDind = this.dockerAccess?.mode === \"dind\";\n        if (isDind) {\n            const inspectedImage = await this.docker.getImage(imageName).inspect();\n            const declaredUser = inspectedImage.Config?.User?.trim();\n            this.imageDefaultUser = declaredUser === \"\" ? undefined : declaredUser;\n        }\n        // 起容器(先以 root 做初始化,之后命令切到非 root 用户)。\n        // PID1 改成 tail 一个日志文件(而非 sleep infinity):这样容器「主日志」= 这个文件,\n        // `docker logs` / Docker UI 的 Logs 标签页能实时显示我们 appendLog 进去的 agent 逐轮活动。\n        // 文件先 touch + chmod 666,好让之后以 1000 用户跑的 exec 也能往里 append。\n        // 外层 `timeout <TTL>` 是 dead-man switch:宿主异常退出(kill -9 / 崩溃)留下的孤儿容器,\n        // 到 TTL 后 PID1 自动退出 → 容器停止 → AutoRemove 清理(见 TTL_* 常量)。\n        const ttlSec = Math.ceil(Math.max(this.lifetimeMs ?? (this.timeout ?? TTL_BASE_WITHOUT_DEADLINE) * TTL_MULTIPLIER, TTL_FLOOR_MS) / 1000);\n        // TTL 一旦烧进 PID1 的 `timeout` 就改不了(容器没有续期通道),所以这里把真实到期时刻记下来,\n        // 供 ensureLifetime 如实回答;不够用时由 runner 轮换实例,而不是让容器在 attempt 中途消失。\n        this.expiresAtMs = Date.now() + ttlSec * 1000;\n        const dindCommand = isDind ? dindContainerCommand(ttlSec, CONTAINER_LOG) : undefined;\n        this.container = await this.docker.createContainer({\n            Image: imageName,\n            ...(dindCommand === undefined\n                ? {\n                    Cmd: [\n                        \"sh\",\n                        \"-c\",\n                        `touch ${CONTAINER_LOG}; chmod 666 ${CONTAINER_LOG}; exec timeout ${ttlSec} tail -n +1 -F ${CONTAINER_LOG}`,\n                    ],\n                }\n                : { Entrypoint: [...dindCommand.Entrypoint], Cmd: [...dindCommand.Cmd], User: ROOT_USER }),\n            WorkingDir: this.workdir,\n            // provision token:歧义类失败的对账通道(按 label 查询本地容器);\n            // keep-candidate:留存候选标记(异常硬退时核对未完成提交的候选)。\n            Labels: {\n                \"niceeval.keep-candidate\": \"true\",\n                ...(isDind\n                    ? {\n                        \"niceeval.docker-access\": \"dind\",\n                        \"niceeval.dind-readiness-user\": this.userOverride ?? this.imageDefaultUser ?? ROOT_USER,\n                    }\n                    : {}),\n                ...(this.provisionToken ? { \"niceeval.provision-token\": this.provisionToken } : {}),\n                ...(this.runIdentity ? dockerRunIdentityLabels(this.runIdentity) : {}),\n                ...this.managedLabels,\n            },\n            Tty: true,\n            // 不带 AutoRemove:留存意图必须在创建期传入(--keep-sandbox 的 suspend = docker stop,\n            // 停驻容器的文件系统落盘持久)。默认路径的销毁由 stop() 显式 stop + remove,行为等价;\n            // 宿主异常硬退留下的孤儿由 TTL dead-man switch 停驻后按 keep-candidate 标签事后核对。\n            HostConfig: {\n                ...dockerHostConfig(this.privileged, this.resources, this.dns, socketMount),\n                ...(this.network === null ? {} : { NetworkMode: this.network.id }),\n            },\n        });\n        this._containerId = this.container.id;\n        await this.container.start();\n        await this.waitForReadiness();\n        // slim 镜像可能缺 CA 证书和 git,补装。\n        await this.ensureRunnerTools();\n        // 探测默认执行身份(镜像 USER,或 factory 的 `user` 覆盖)的 home 目录,后续 chown 与\n        // npm 全局前缀都按它解析,不硬编码 UID/家目录(见 docs/feature/sandbox/library.md「执行身份」)。\n        await this.resolveDefaultIdentity();\n        // 工作目录交给默认执行身份。\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", this.workdir]);\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), this.workdir]);\n        // 为非 root 全局安装准备 npm 目录;root 身份下这一步是无害的自有目录。\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", this.npmGlobalDir]);\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), this.npmGlobalDir]);\n        // 让 npm 用这个目录当全局前缀(配置落在默认身份的家目录,供 agent 全局装 CLI 用)。\n        await this.runCommand(\"npm\", [\"config\", \"set\", \"prefix\", this.npmGlobalDir]);\n    }\n    /** Docker start 只代表 PID 1 存活；Docker access 先证明默认端点，再跑作者 readiness。 */\n    private waitForReadiness(): Promise<void> {\n        return Effect.runPromise(this.waitForReadinessEffect());\n    }\n    private waitForReadinessEffect(): Effect.Effect<void, unknown> {\n        const readiness = this.readiness;\n        if (readiness === undefined)\n            return Effect.void;\n        const readinessUser = readiness.user ?? this.userOverride ??\n            (this.dockerAccess?.mode === \"dind\" ? this.imageDefaultUser : undefined);\n        return Effect.gen(this, function* () {\n            const deadline = (yield* Clock.currentTimeMillis) + readiness.timeoutMs;\n            if (this.dockerAccess !== undefined) {\n                yield* this.waitForReadinessProbeEffect({\n                    command: DOCKER_ACCESS_COMPATIBILITY_COMMAND,\n                    user: readinessUser,\n                    intervalMs: readiness.intervalMs,\n                    deadline,\n                    phase: \"Docker access compatibility\",\n                    timeoutMs: readiness.timeoutMs,\n                });\n            }\n            yield* this.waitForReadinessProbeEffect({\n                command: readiness.command,\n                user: readinessUser,\n                intervalMs: readiness.intervalMs,\n                deadline,\n                phase: \"Docker sandbox readiness\",\n                timeoutMs: readiness.timeoutMs,\n            });\n        });\n    }\n    private waitForReadinessProbeEffect(input: {\n        readonly command: readonly [\n            string,\n            ...string[]\n        ];\n        readonly user: string | undefined;\n        readonly intervalMs: number | undefined;\n        readonly deadline: number;\n        readonly phase: string;\n        readonly timeoutMs: number;\n    }): Effect.Effect<void, unknown> {\n        const [command, ...args] = input.command;\n        let lastFailure = \"probe has not run\";\n        const attempt: Effect.Effect<void, unknown> = Effect.gen(this, function* () {\n            const now = yield* Clock.currentTimeMillis;\n            if (now > input.deadline)\n                return yield* timedOut();\n            const state = yield* Effect.tryPromise({\n                try: () => Promise.resolve(this.container?.inspect()),\n                catch: (error) => error,\n            });\n            if (state?.State?.Running !== true) {\n                return yield* Effect.fail(new Error(`Docker sandbox exited before ${input.phase.toLowerCase()} completed ` +\n                    `(state=${state?.State?.Status ?? \"missing\"})`));\n            }\n            const probeNow = yield* Clock.currentTimeMillis;\n            const result = yield* Effect.either(Effect.tryPromise({\n                try: () => this.execCommand(command, args, {\n                    user: input.user,\n                    timeoutMs: Math.max(1, input.deadline - probeNow),\n                    timeoutRetirement: \"stop\",\n                }),\n                catch: (error) => error,\n            }));\n            if (result._tag === \"Right\") {\n                if (result.right.exitCode === 0)\n                    return;\n                lastFailure = result.right.stderr.trim() || result.right.stdout.trim() || `exit ${result.right.exitCode}`;\n            }\n            else {\n                lastFailure = result.left instanceof Error ? result.left.message : String(result.left);\n            }\n            const afterAttempt = yield* Clock.currentTimeMillis;\n            const remaining = input.deadline - afterAttempt;\n            if (remaining <= 0)\n                return yield* timedOut();\n            yield* Effect.sleep(Math.min(input.intervalMs ?? 250, remaining));\n            return yield* attempt;\n        });\n        const timedOut = (): Effect.Effect<never, Error> => {\n            const diagnosticUser = input.user ?? this.imageDefaultUser ?? ROOT_USER;\n            const permissionHelp = this.dockerAccess?.mode === \"dind\" && /permission denied/i.test(lastFailure)\n                ? `; DinD user ${JSON.stringify(diagnosticUser)} must belong to the docker group ` +\n                    `(the inner socket remains root:docker 0660)`\n                : \"\";\n            return Effect.fail(new Error(`${input.phase} timed out after ${input.timeoutMs}ms: ${lastFailure}${permissionHelp}`));\n        };\n        return attempt;\n    }\n    /**\n     * 探测 Sandbox 默认执行身份(`this.userOverride` 未设置时即容器/镜像的默认身份)的\n     * uid、用户名与家目录:省略 `User` 字段的 exec 沿用容器默认身份,`$HOME` 由容器内\n     * `/etc/passwd` 解析,不在 runner 侧维护一张 UID → 家目录的映射表。\n     */\n    private async resolveDefaultIdentity(): Promise<void> {\n        const probe = await this.execCommand(\"sh\", [\n            \"-c\",\n            'printf \"%s\\\\n%s\\\\n%s\" \"$(id -u)\" \"$(id -un 2>/dev/null || true)\" \"$HOME\"',\n        ], {\n            user: this.userOverride ??\n                (this.dockerAccess?.mode === \"dind\" ? this.imageDefaultUser : undefined),\n        });\n        const [rawUid = \"\", rawName = \"\", rawHome = \"\"] = probe.stdout.split(\"\\n\");\n        const uid = rawUid.trim();\n        const name = rawName.trim();\n        const home = rawHome.trim();\n        this.defaultIsRoot = uid === \"0\";\n        this.defaultUserName = name !== \"\" ? name : (this.defaultIsRoot ? ROOT_USER : (this.userOverride ?? uid));\n        this.defaultHome = home !== \"\" ? home : (this.defaultIsRoot ? \"/root\" : `/home/${this.defaultUserName}`);\n        this.npmGlobalDir = `${this.defaultHome}/.npm-global`;\n        this.sandboxPath = this.managedPath(this.npmGlobalDir);\n    }\n    /** chown 目标:factory 覆盖时原样复用(接受 name / uid[:gid]),否则用探测出的用户名。 */\n    private chownTarget(): string {\n        return this.userOverride ?? this.defaultUserName;\n    }\n    /** 确保镜像在本地,缺了就拉。 */\n    private async ensureImage(imageName: string): Promise<void> {\n        try {\n            const image = this.docker.getImage(imageName);\n            await image.inspect();\n        }\n        catch {\n            // 镜像不存在,拉取。「progress」而非「diagnostic」—— 这是正常进度,不是需要去重/永久\n            // 留痕的 warning。走 create 绑定的 ScopedFeedback(runner 归因到 sandbox.create);\n            // 直调(无 runner)时退回全局 sink。\n            const progress = (message: string) => this.feedback ? this.feedback.progress({ message }) : reportActivity(message);\n            progress(t(\"docker.imagePullStart\", { image: imageName }).trimEnd());\n            await this.pullImage(imageName);\n            progress(t(\"docker.imagePullDone\", { image: imageName }).trimEnd());\n        }\n    }\n    /**\n     * 补齐 NiceEval 自身运行所需的最小工具面。单容器默认镜像与 Compose 附着容器走同一条：\n     * 先 probe，命中时零改动；缺失时以 root 使用镜像已有的包管理器安装。题目镜像无法兑现时\n     * 明确报错，不把 `git: command not found` 延后到 workspace.baseline。\n     */\n    async ensureRunnerTools(): Promise<void> {\n        const script = [\n            \"set -eu\",\n            \"command -v git >/dev/null 2>&1 && exit 0\",\n            \"export DEBIAN_FRONTEND=noninteractive\",\n            \"if command -v apt-get >/dev/null 2>&1; then\",\n            \"  apt-get update -qq && apt-get install -y -qq ca-certificates git curl >/dev/null\",\n            \"elif command -v apk >/dev/null 2>&1; then\",\n            \"  apk add --no-cache ca-certificates git curl >/dev/null\",\n            \"elif command -v microdnf >/dev/null 2>&1; then\",\n            \"  microdnf install -y ca-certificates git curl >/dev/null\",\n            \"elif command -v dnf >/dev/null 2>&1; then\",\n            \"  dnf install -y ca-certificates git curl >/dev/null\",\n            \"elif command -v yum >/dev/null 2>&1; then\",\n            \"  yum install -y ca-certificates git curl >/dev/null\",\n            \"else\",\n            '  printf \"%s\\\\n\" \"niceeval Docker runtime requires git for its private change ledger, but the image has no supported package manager (apt-get, apk, microdnf, dnf, or yum)\" >&2',\n            \"  exit 127\",\n            \"fi\",\n            'command -v git >/dev/null 2>&1 || { printf \"%s\\\\n\" \"niceeval Docker runtime could not install git for its private change ledger\" >&2; exit 127; }',\n        ].join(\"\\n\");\n        const result = await this.runCommandAsRoot(\"sh\", [\"-c\", script]);\n        if (result.exitCode === 0)\n            return;\n        const detail = result.stderr.trim().split(\"\\n\").at(-1);\n        throw new Error(`prepare Docker runner tools failed (exit ${result.exitCode})${detail ? `: ${detail}` : \"\"}`);\n    }\n    /** 拉取镜像并跟进度。 */\n    private async pullImage(imageName: string): Promise<void> {\n        return new Promise((resolve, reject) => {\n            this.docker.pull(imageName, (err: Error | null, stream: NodeJS.ReadableStream) => {\n                if (err) {\n                    reject(err);\n                    return;\n                }\n                this.docker.modem.followProgress(stream, (followErr: Error | null) => {\n                    if (followErr) {\n                        reject(followErr);\n                    }\n                    else {\n                        resolve();\n                    }\n                }, \n                // 进度回调(可在此挂进度条)。\n                () => { });\n            });\n        });\n    }\n    /** 容器短 ID(像 Docker CLI 那样取前 12 位)。 */\n    get sandboxId(): string {\n        return this._containerId.slice(0, 12);\n    }\n    /**\n     * 在容器里跑一条命令。默认沿用 Sandbox 的默认执行身份(factory `user` 覆盖后的身份,\n     * 否则镜像声明的 USER);`opts.user` 只覆盖这一条命令。\n     */\n    async runCommand(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        // stream:把本命令输出也接到容器主日志(PID1 tail 它)→ Docker Logs 看到原始输出。\n        // 实现:把 cmd+args 安全拼成 shell 串,经 runShell 走 tee(只 tee stdout,保留 stderr 分离 + 退出码)。\n        if (opts.stream) {\n            const joined = [cmd, ...args].map(shellQuote).join(\" \");\n            return this.runShell(joined, {\n                env: opts.env,\n                cwd: opts.cwd,\n                stream: true,\n                user: opts.user,\n                ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n                signal: opts.signal,\n                onStdout: opts.onStdout,\n                onStderr: opts.onStderr,\n            });\n        }\n        // 省略 `user` 时不注入 --user,沿用容器默认身份(factory `user` 覆盖后的身份,否则镜像\n        // 声明的 USER);这时 HOME/USER/LOGNAME 用探测出的默认身份家目录,让 codex(~/.codex)、\n        // npm 全局、bash 的 ~ 展开都落在正确的地方。显式覆盖时把 HOME 决定权交还 docker exec\n        // 自己按容器 /etc/passwd 解析,不代它猜一个可能错的家目录。\n        const isRootUser = opts.user !== undefined ? isRootLikeUserSpec(opts.user) : this.defaultIsRoot;\n        const env = {\n            ...(opts.user === undefined\n                ? { HOME: this.defaultHome, USER: this.defaultUserName, LOGNAME: this.defaultUserName }\n                : {}),\n            ...opts.env,\n            PATH: this.sandboxPath,\n            // root 跑 npm 时让 install 脚本也以 root 跑(否则 npm 会把脚本降权到目录属主,可能写不进)。\n            // 非 root 时此变量无影响。\n            ...(isRootUser ? { npm_config_unsafe_perm: \"true\" } : {}),\n        };\n        return this.execCommand(cmd, [...args], {\n            env,\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            user: opts.user ?? this.userOverride,\n            ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n            onStdout: opts.onStdout,\n            onStderr: opts.onStderr,\n            signal: opts.signal,\n        });\n    }\n    /** 以 root 跑命令(provider 内部用:容器初始化、属主收敛)。 */\n    private async runCommandAsRoot(cmd: string, args: string[] = [], opts: CommandOptions = {}): Promise<CommandResult> {\n        return this.execCommand(cmd, args, {\n            env: opts.env,\n            cwd: resolveSandboxPath(this.workdir, opts.cwd),\n            user: ROOT_USER,\n        });\n    }\n    /** 把目录属主收敛回默认执行身份(putArchive 以 root 解包后用)。 */\n    private async chownToSandboxUser(path: string): Promise<void> {\n        await this.runCommandAsRoot(\"chown\", [\"-R\", this.chownTarget(), path]);\n    }\n    /** 真正在容器里 exec 一条命令,demux stdout/stderr 并带超时。 */\n    private async execCommand(cmd: string, args: string[] = [], opts: {\n        env?: globalThis.Record<string, string>;\n        cwd?: string;\n        user?: string;\n        /** 这条命令的显式上限;省略 = 按 attempt deadline 的剩余量。 */\n        timeoutMs?: number;\n        /** create/readiness 失败需在删除前采集日志，因此只先停容器。 */\n        timeoutRetirement?: \"destroy\" | \"stop\";\n        onStdout?: (chunk: string) => void | Promise<void>;\n        onStderr?: (chunk: string) => void | Promise<void>;\n        signal?: AbortSignal;\n    } = {}): Promise<CommandResult> {\n        if (!this.container) {\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        }\n        const fullCmd = [cmd, ...args];\n        const env = opts.env\n            ? Object.entries(opts.env).map(([k, v]) => `${k}=${v}`)\n            : undefined;\n        const exec = await this.container.exec({\n            Cmd: fullCmd,\n            AttachStdout: true,\n            AttachStderr: true,\n            WorkingDir: resolveSandboxPath(this.workdir, opts.cwd),\n            Env: env,\n            User: opts.user,\n        });\n        const stream = await exec.start({ hijack: true, stdin: false });\n        return new Promise<CommandResult>((resolve, reject) => {\n            // Docker 把 stdout/stderr 复用在同一条流里(8 字节头 + 载荷),需手动 demux;\n            // 跨 chunk 的帧累积逻辑见 docker-stream.ts 的 createExecDemuxer。\n            const demuxer = createExecDemuxer();\n            // Docker 的 demuxer 先保证帧边界完整，再把每帧即时送给调用方。回调串行化，避免\n            // async consumer（如 JSONL 行缓冲）因后一个 chunk 先完成而乱序。\n            let callbackChain = Promise.resolve();\n            stream.on(\"data\", (chunk: Buffer) => {\n                const beforeStdout = demuxer.stdout().length;\n                const beforeStderr = demuxer.stderr().length;\n                demuxer.push(chunk);\n                const stdout = demuxer.stdout().slice(beforeStdout);\n                const stderr = demuxer.stderr().slice(beforeStderr);\n                const onStdout = opts.onStdout;\n                const onStderr = opts.onStderr;\n                if (stdout && onStdout !== undefined)\n                    callbackChain = callbackChain.then(() => onStdout(stdout));\n                if (stderr && onStderr !== undefined)\n                    callbackChain = callbackChain.then(() => onStderr(stderr));\n            });\n            // 超时:杀流并 reject。上限从 attempt deadline 的剩余量派生(显式传 timeout 时按显式值),\n            // 没有 deadline 就不挂这条 timer——provider 层不发明一条自己的线。\n            const limit = commandLimit(opts, { commandTimeoutMs: this.timeout, deadlineAt: this.deadlineAt });\n            let settled = false;\n            let drainTimer: ReturnType<typeof setTimeout> | undefined;\n            let completionPoll: ReturnType<typeof setInterval> | undefined;\n            let pollInFlight = false;\n            const cleanup = (): void => {\n                if (timeoutId !== undefined)\n                    clearTimeout(timeoutId);\n                if (completionPoll !== undefined)\n                    clearInterval(completionPoll);\n                if (drainTimer !== undefined)\n                    clearTimeout(drainTimer);\n                opts.signal?.removeEventListener(\"abort\", onAbort);\n            };\n            const retireAndReject = (error: Error): void => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                const retirement = opts.timeoutRetirement === \"stop\"\n                    ? this.container?.stop({ t: 5 }).catch((stopError) => {\n                        if (!benignStopError(stopError))\n                            throw stopError;\n                    }) ?? Promise.resolve()\n                    : this.stop();\n                void retirement.then(() => reject(error), reject);\n            };\n            const timeoutMs = limit.timeoutMs;\n            const timeoutId = timeoutMs === undefined\n                ? undefined\n                : setTimeout(() => {\n                    retireAndReject(new SandboxCommandTimeoutError(t(\"docker.commandTimeout\", { timeoutMs }), timeoutMs, limit.explicit));\n                }, timeoutMs);\n            const onAbort = (): void => {\n                const reason = opts.signal?.reason;\n                retireAndReject(reason instanceof Error ? reason : new DOMException(\"sandbox command aborted\", \"AbortError\"));\n            };\n            opts.signal?.addEventListener(\"abort\", onAbort, { once: true });\n            if (opts.signal?.aborted)\n                onAbort();\n            const finish = async (known?: Awaited<ReturnType<typeof exec.inspect>>): Promise<void> => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                try {\n                    await callbackChain;\n                    const inspection = known ?? await exec.inspect();\n                    resolve({\n                        stdout: demuxer.stdout(),\n                        stderr: demuxer.stderr(),\n                        exitCode: inspection.ExitCode ?? 0,\n                    });\n                }\n                catch (error) {\n                    reject(error);\n                }\n            };\n            // rootless Docker 偶尔在 exec 已退出且 ExecIDs 已清空后仍不关闭 hijacked HTTP 流。\n            // 不能只等 `end`：同时以 daemon 的 exec inspect 为完成事实，留 100ms drain 尾帧后收口。\n            completionPoll = setInterval(() => {\n                if (settled || pollInFlight || drainTimer !== undefined)\n                    return;\n                pollInFlight = true;\n                void exec.inspect().then((inspection) => {\n                    if (!settled && inspection.Running === false && drainTimer === undefined) {\n                        drainTimer = setTimeout(() => { void finish(inspection); }, 100);\n                    }\n                }).catch(() => undefined).finally(() => { pollInFlight = false; });\n            }, 250);\n            completionPoll.unref();\n            stream.on(\"end\", () => { void finish(); });\n            stream.on(\"error\", (error: Error) => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                reject(error);\n            });\n        });\n    }\n    /** 经 bash -c 跑一段 shell 脚本。opts 为选项对象。 */\n    async runShell(script: string, opts: CommandOptions = {}): Promise<CommandResult> {\n        if (opts.stream) {\n            // 只 tee stdout 到容器主日志:保留 stderr 分离(解析器要)+ pipefail 保留命令退出码。\n            const wrapped = `set -o pipefail; { ${script} ; } | tee -a ${CONTAINER_LOG}`;\n            return this.runCommand(\"bash\", [\"-c\", wrapped], {\n                env: opts.env,\n                cwd: opts.cwd,\n                user: opts.user,\n                ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),\n                signal: opts.signal,\n                onStdout: opts.onStdout,\n                onStderr: opts.onStderr,\n            });\n        }\n        return this.runCommand(\"bash\", [\"-c\", script], opts);\n    }\n    /** 追加一行到容器主日志(PID1 在 tail)→ Docker 的 Logs 标签页实时可见。 */\n    async appendLog(line: string): Promise<void> {\n        const esc = line.replace(/'/g, \"'\\\\''\");\n        await this.runCommand(\"sh\", [\"-c\", `printf '%s\\\\n' '${esc}' >> ${CONTAINER_LOG}`]);\n    }\n    /** 读容器里的文件。 */\n    async runCommandOrThrow(cmd: string, args: readonly string[] = [], opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runCommand(cmd, args, opts), opts.sensitiveValues);\n    }\n    async runShellOrThrow(script: string, opts: CommandOptions = {}): Promise<SuccessfulCommandResult> {\n        return successfulCommandResult(await this.runShell(script, opts), opts.sensitiveValues);\n    }\n    async readText(path: string): Promise<string> {\n        const absPath = resolveSandboxPath(this.workdir, path);\n        const result = await this.runCommand(\"cat\", [absPath]);\n        if (result.exitCode !== 0) {\n            throw new Error(t(\"docker.readFileFailed\", { path: absPath, stderr: result.stderr }));\n        }\n        return result.stdout;\n    }\n    /** 判断容器里某文件是否存在。 */\n    async pathExists(path: string): Promise<boolean> {\n        const result = await this.runCommand(\"test\", [\"-e\", resolveSandboxPath(this.workdir, path)]);\n        return result.exitCode === 0;\n    }\n    async writeText(path: string, content: string): Promise<void> {\n        await this.writeBytes(path, Buffer.from(content, \"utf-8\"));\n    }\n    /** 用 tar 归档把文件灌进容器。 */\n    private async writeCollectedFiles(files: readonly CollectedLocalFile[], targetDir?: string): Promise<void> {\n        if (!this.container) {\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        }\n        if (files.length === 0) {\n            return;\n        }\n        // 打 tar 包。\n        const pack = packFilesToTar(files.map((file) => ({\n            name: file.path,\n            content: Buffer.from(file.content),\n        })));\n        const targetPath = resolveSandboxPath(this.workdir, targetDir);\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", targetPath]);\n        // Docker 对 ReadonlyRootfs 容器会无条件拒绝 putArchive，即便目标实际位于可写 tmpfs。\n        // 这类 sandbox 逐文件走 exec stdin；路径仍由 resolveSandboxPath 收敛在受管目录内。\n        if (this.resources.readOnlyRootfs === true) {\n            for (const file of files) {\n                const destination = resolveSandboxPath(targetPath, file.path);\n                await this.runCommandAsRoot(\"mkdir\", [\"-p\", dirname(destination)]);\n                await this.writeBytesViaExec(destination, Buffer.from(file.content));\n            }\n            await this.chownToSandboxUser(targetPath);\n            return;\n        }\n        // putArchive 以 root 身份解包到目标目录。\n        await this.container.putArchive(pack, { path: targetPath });\n        // 修正属主:putArchive 上传成 root,改回 node 用户,agent 才能编辑。\n        await this.chownToSandboxUser(targetPath);\n    }\n    async uploadFile(source: string | URL, targetPath: string): Promise<void> {\n        await this.writeBytes(targetPath, await readFile(resolveLocalPath(undefined, source)));\n    }\n    async uploadDirectory(sourceDir: string | URL, targetDir?: string, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        const files = await collectLocalFiles(resolveLocalPath(undefined, sourceDir), opts.ignore);\n        await this.writeCollectedFiles(files, targetDir);\n    }\n    /**\n     * 递归下载容器内一个目录到本地磁盘,与 uploadDirectory 对称。用 getArchive 单次取回\n     * 整棵目录的 tar(而不是逐文件走 downloadFile):getArchive 对目录路径返回的 tar 里,\n     * entry 名以请求路径的 basename 为首段(如请求 `/…/out` 得到 `out/x.txt`),剥离首段\n     * 还原成相对 localDir 的路径。ignore 命中的路径(任意深度、按 basename)整支排除——\n     * tar 已经整体取回,这里是纯本地过滤,不省网络传输,但语义上等价于「命中即剪除」。\n     */\n    async downloadDirectory(sourceDir: string, targetDir: string | URL, opts: {\n        readonly ignore?: readonly string[];\n    } = {}): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const localDir = resolveLocalPath(undefined, targetDir);\n        const absTargetDir = resolveSandboxPath(this.workdir, sourceDir);\n        const tarBuf = await this.readArchiveBytes(absTargetDir);\n        const files = await extractFilesFromTar(tarBuf);\n        const ignore = new Set(opts.ignore ?? []);\n        await Promise.all(files.map(async (file) => {\n            const parts = file.name.split(\"/\").slice(1);\n            if (parts.length === 0 || parts.some((part) => ignore.has(part)))\n                return;\n            const dest = join(localDir, ...parts);\n            await mkdir(dirname(dest), { recursive: true });\n            await writeFile(dest, file.content);\n        }));\n    }\n    /**\n     * 从容器任意路径读文件 → Buffer。\n     * 用 Docker getArchive API(原生二进制,无 base64 开销);tar 只有一个 entry,直接解包取内容。\n     */\n    async readBytes(path: string): Promise<Uint8Array> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const tarBuf = await this.readArchiveBytes(resolveSandboxPath(this.workdir, path));\n        return extractFileFromTar(tarBuf);\n    }\n    /**\n     * Docker getArchive 对 ReadonlyRootfs 容器中的 tmpfs 会错误返回 404，即使 exec 能看到文件。\n     * readonly 模式改由容器内 tar，再把二进制归档编码成 ASCII 经 exec 流取回。\n     */\n    private async readArchiveBytes(absPath: string): Promise<Buffer> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        if (this.resources.readOnlyRootfs !== true) {\n            const stream = await (this.container as Docker.Container).getArchive({ path: absPath });\n            return readableToBuffer(stream as NodeJS.ReadableStream);\n        }\n        const result = await this.runShell(`tar -C ${shellQuote(dirname(absPath))} -cf - -- ${shellQuote(basename(absPath))} | base64`, { user: ROOT_USER });\n        if (result.exitCode !== 0) {\n            throw new Error(`failed to archive ${absPath} inside read-only Docker sandbox: ${result.stderr.trim()}`);\n        }\n        return Buffer.from(result.stdout.replace(/\\s+/g, \"\"), \"base64\");\n    }\n    /**\n     * 向容器任意路径写文件(二进制)。\n     * 打成单文件 tar → putArchive 到目标目录,与 uploadFiles 同一机制但目标路径自由。\n     *\n     * 修正属主:putArchive 以 root 解包,不 chown 的话文件在容器里保持 root 属主——非 root\n     * 沙箱用户不仅不能编辑它,后续对它做 `mv`/`rm` 这类改动它所在目录项的操作,只要目标目录带\n     * sticky bit(如 `/tmp`),也会因为「非属主不能改别人的目录项」被内核拒成\n     * `Operation not permitted`(与 uploadFiles() 对整个目标目录 chown 是同一个属主问题,\n     * 这里只需精确 chown 这一个文件;真机复现见 memory/docker-uploadfile-tmp-mv-eperm.md)。\n     */\n    async writeBytes(destPath: string, content: Uint8Array): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const absPath = resolveSandboxPath(this.workdir, destPath);\n        await this.runCommandAsRoot(\"mkdir\", [\"-p\", dirname(absPath)]);\n        if (this.resources.readOnlyRootfs === true) {\n            await this.writeBytesViaExec(absPath, Buffer.from(content));\n            await this.chownToSandboxUser(absPath);\n            return;\n        }\n        const pack = packFilesToTar([{ name: basename(absPath), content: Buffer.from(content) }]);\n        await (this.container as Docker.Container).putArchive(pack, { path: dirname(absPath) });\n        await this.chownToSandboxUser(absPath);\n    }\n    /** readonly rootfs 下向可写 tmpfs 投递字节；Docker exec stdin 不触发 putArchive 的 blanket 拒绝。 */\n    private async writeBytesViaExec(absPath: string, content: Buffer): Promise<void> {\n        if (!this.container)\n            throw new Error(t(\"docker.containerNotInitialized\"));\n        const exec = await this.container.exec({\n            Cmd: [\"sh\", \"-c\", 'cat > \"$1\"', \"niceeval-write\", absPath],\n            AttachStdin: true,\n            AttachStdout: true,\n            AttachStderr: true,\n            User: ROOT_USER,\n        });\n        const stream = await exec.start({ hijack: true, stdin: true });\n        const inspection = await new Promise<Awaited<ReturnType<typeof exec.inspect>>>((resolve, reject) => {\n            let settled = false;\n            let pollInFlight = false;\n            const cleanup = (): void => {\n                clearInterval(poll);\n                clearTimeout(timeout);\n            };\n            const finish = (value: Awaited<ReturnType<typeof exec.inspect>>): void => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                resolve(value);\n            };\n            const inspectAndFinish = (): void => {\n                if (settled || pollInFlight)\n                    return;\n                pollInFlight = true;\n                void exec.inspect().then((value) => {\n                    if (value.Running === false)\n                        finish(value);\n                }).catch(reject).finally(() => { pollInFlight = false; });\n            };\n            const poll = setInterval(inspectAndFinish, 100);\n            const timeout = setTimeout(() => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                stream.destroy();\n                reject(new Error(`timed out writing ${absPath} inside read-only Docker sandbox`));\n            }, 30000);\n            stream.on(\"error\", (error: Error) => {\n                if (settled)\n                    return;\n                settled = true;\n                cleanup();\n                reject(error);\n            });\n            stream.on(\"end\", inspectAndFinish);\n            stream.end(content);\n        });\n        if ((inspection.ExitCode ?? 0) !== 0) {\n            throw new Error(`failed to write ${absPath} inside read-only Docker sandbox`);\n        }\n    }\n    async downloadFile(sourcePath: string, target: string | URL): Promise<void> {\n        const destination = resolveLocalPath(undefined, target);\n        await mkdir(dirname(destination), { recursive: true });\n        await writeFile(destination, await this.readBytes(sourcePath));\n    }\n    /**\n     * 释放句柄。`releaseMode: \"destroy\"`(默认 create 路径)显式 stop + remove;\n     * `releaseMode: \"detach\"`(Compose 附着)只松绑——整组由 compose down 回收,避免主容器先被拆掉留下 sidecar 孤儿。\n     */\n    async stop(): Promise<void> {\n        if (!this.container)\n            return;\n        if (this.releaseMode === \"detach\") {\n            this.container = null;\n            return;\n        }\n        const container = this.container;\n        const cleanupErrors: unknown[] = [];\n        try {\n            await container.stop({ t: 0 }); // 立即停止\n        }\n        catch (error) {\n            if (!benignStopError(error))\n                cleanupErrors.push(error);\n        }\n        let removed = false;\n        try {\n            await container.remove({ force: true });\n            removed = true;\n        }\n        catch (error) {\n            if (benignRemoveError(error)) {\n                removed = true;\n            }\n            else {\n                cleanupErrors.push(error);\n            }\n        }\n        if (removed && this.container === container)\n            this.container = null;\n        if (removed && this.network !== null) {\n            const network = this.network;\n            try {\n                await network.remove();\n                if (this.network === network)\n                    this.network = null;\n            }\n            catch (error) {\n                if (dockerStatusCode(error) === 404) {\n                    if (this.network === network)\n                        this.network = null;\n                }\n                else {\n                    cleanupErrors.push(error);\n                }\n            }\n        }\n        if (cleanupErrors.length > 0) {\n            throw new AggregateError(cleanupErrors, `failed to destroy Docker sandbox ${this.sandboxId}`);\n        }\n        await this.afterStop?.();\n    }\n    /** Watchdog commit records container + exclusive network as one lifecycle unit. */\n    get managedNetworkId(): string | undefined {\n        return this.network?.id;\n    }\n    /**\n     * 留存休眠(suspend):`docker stop`——文件系统落盘持久、不占内存、跨 daemon 重启存活。\n     * 不用 `docker pause`(内存驻留,daemon 重启即失)也不用 `docker commit`(引入第二种资源面)。\n     * 不属于中性 Sandbox 接口——「留下」是 runner 的调度决定,不是沙箱的能力;由 sandbox/keep.ts\n     * 在 sandbox/ 域内路由到这里。\n     */\n    async suspend(): Promise<void> {\n        if (!this.container)\n            throw new Error(\"container already released\");\n        await this.container.stop({ t: 5 });\n    }\n}\n"]}

package/dist/sandbox/docker.d.cts

@@ -1,5 +1,5 @@
 import Docker from "dockerode";
-import type { CommandResult, CommandOptions, SandboxReuseCapability, SuccessfulCommandResult } from "../types.cjs";
+import type { CommandResult, CommandOptions, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SuccessfulCommandResult } from "../types.cjs";
 import { type SandboxProvisionErrorKind } from "./errors.cjs";
 import { type RunIdentity } from "./run-identity.cjs";
 import { type SandboxProviderBackend } from "./backend.cjs";
@@ -156,7 +156,9 @@ export declare class DockerSandbox implements SandboxProviderBackend, SandboxReu
             reason: string;
         }>>;
         setCommandDeadline: import("./backend.cjs").SandboxBackendSupport<(deadlineAt?: number) => void>;
+        managedProcess: import("./backend.cjs").SandboxBackendSupport<(input: ManagedProcessStart) => Promise<ManagedProcess>>;
     };
+    private startManagedProcess;
     constructor(options?: DockerSandboxOptions);
     /** 受管 PATH:`pathPrepend` 按声明顺序前置到 npm 全局 bin + 系统默认路径。 */
     private managedPath;