pi.lock 0.0.0-stage → 0.1.1

package/dist/runtime.js

@@ -0,0 +1,266 @@
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { createAgentSession as createPiSession, createAgentSessionRuntime, SettingsManager, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { lazyStream } from "@earendil-works/pi-ai";
+import { assertEngine } from "./bridge.js";
+import { digest, fail, findProject, replaceRoots } from "./common.js";
+import { readLock, verifyDefinition, verifySnapshot, materialize, draftLock, saveLock } from "./lock.js";
+import { LockedResourceLoader } from "./loader.js";
+import { assertModel, keyBinding, modelIdentity, modelRuntime, selectedModel } from "./model.js";
+const UI_SETTERS = new Set([
+    "setTheme", "setHideThinkingBlock", "setShowCacheMissNotices", "setQuietStartup", "setCollapseChangelog", "setLastChangelogVersion",
+    "setShowImages", "setClearOnShrink", "setShowTerminalProgress", "setTuiMode", "setFullscreenExitOutput", "setFullscreenScrollbar",
+    "setFullscreenCopyOnSelect", "setFullscreenWheelScrollLines", "setDoubleEscapeAction", "setTreeFilterMode", "setShowHardwareCursor",
+    "setEditorPaddingX", "setOutputPad", "setAutocompleteMaxVisible", "setMermaidRenderingMode",
+]);
+function lockedSettings(settings, frozen) {
+    const manager = SettingsManager.inMemory({ ...settings, enableAnalytics: false, enableInstallTelemetry: false, cacheWarming: "off" }, { projectTrusted: true });
+    if (frozen)
+        for (const name of Object.getOwnPropertyNames(SettingsManager.prototype)) {
+            if ((name.startsWith("set") && !UI_SETTERS.has(name)) || name === "applyOverrides") {
+                manager[name] = () => fail("FROZEN_SETTING", `${name} changes locked behavior. Edit .pi/settings.json and run pi-lock lock, or start --dev.`);
+            }
+        }
+    return manager;
+}
+function developmentSettings(projectRoot) {
+    const path = resolve(projectRoot, ".pi/settings.json");
+    return SettingsManager.fromStorage({ withLock(scope, fn) {
+            if (scope === "project") {
+                fn(undefined);
+                return;
+            }
+            const changed = fn(readFileSync(path, "utf8"));
+            if (changed !== undefined)
+                writeFileSync(path, changed);
+        } }, { projectTrusted: true });
+}
+export function headlessUI(overrides = {}) {
+    const required = async () => fail("INTERACTION_REQUIRED", "INTERACTION_REQUIRED: this operation needs an interaction handler. Supply uiContext in the SDK or respond through TUI/RPC.");
+    const noop = () => { };
+    return {
+        select: required, confirm: required, input: required, editor: required, custom: required,
+        notify: noop, onTerminalInput: () => noop, setStatus: noop, setWorkingMessage: noop,
+        setWorkingVisible: noop, setWorkingIndicator: noop, setHiddenThinkingLabel: noop, setWidget: noop,
+        setFooter: noop, setHeader: noop, setTitle: noop, pasteToEditor: noop, setEditorText: noop,
+        getEditorText: () => "", addAutocompleteProvider: noop, setEditorComponent: noop,
+        get theme() { return undefined; },
+        ...overrides,
+    };
+}
+function pinSession(manager, lock, dev) {
+    const pins = manager.getEntries().filter((e) => e.type === "custom" && e.customType === "pi-lock");
+    if (pins.some((e) => e.data?.agentDigest !== lock.agentDigest) && !dev)
+        fail("SESSION_VERSION_MISMATCH", "This session belongs to a different Agent version. Use its matching release or start a new session.");
+    if (!pins.length) {
+        if (manager.buildSessionContext().messages.length && !dev)
+            fail("SESSION_UNPINNED", "This transcript has no Agent version. Start a new locked session; importing history requires an explicit migration.");
+        manager.appendCustomEntry("pi-lock", { agentDigest: lock.agentDigest, lockfileVersion: 1 });
+    }
+}
+export function effectiveConfiguration(session, releaseRoot, cwd, lock) {
+    const loader = session.resourceLoader;
+    const tools = session.getAllTools().map(info => {
+        const tool = session.getToolDefinition(info.name);
+        return { name: info.name, description: info.description, parameters: tool?.parameters ?? info.parameters,
+            promptSnippet: tool?.promptSnippet, promptGuidelines: tool?.promptGuidelines, exposure: info.exposure,
+            constrainedSampling: tool?.constrainedSampling };
+    });
+    return replaceRoots({
+        model: modelIdentity(session.model), thinkingLevel: session.thinkingLevel,
+        settings: lock.definition.settings,
+        extensions: loader.getExtensions().extensions.map(e => ({ path: e.path, commands: [...e.commands.keys()], hooks: [...e.handlers.keys()] })),
+        skills: loader.getSkills().skills, prompts: loader.getPrompts().prompts,
+        context: loader.getAgentsFiles().agentsFiles, systemPrompt: session.systemPrompt,
+        tools, activeTools: session.getActiveToolNames(), mcp: loader.mcp?.catalog,
+    }, [[releaseRoot, "<AGENT>"], [cwd, "<WORKSPACE>"]]);
+}
+export async function createLockedRuntime(options = {}, prepared) {
+    const allowed = new Set(["projectRoot", "cwd", "sessionManager", "sessionDir", "sessionFile", "uiContext", "dev", "apiKey", "credentials", "env"]);
+    for (const key of Object.keys(options))
+        if (!allowed.has(key))
+            fail("UNLOCKED_OVERRIDE", `SDK option ${key} is not a runtime binding. Put Agent behavior in .pi/settings.json or an extension, then lock it.`);
+    assertEngine();
+    const cwd = realpathSync(resolve(options.cwd ?? process.cwd()));
+    const projectRoot = findProject(cwd, options.projectRoot);
+    let lock = prepared ?? (options.dev ? await draftLock(projectRoot, true) : readLock(projectRoot));
+    if (!options.dev)
+        verifyDefinition(projectRoot, lock);
+    let releaseRoot = materialize(projectRoot, lock);
+    const stateDir = resolve(options.sessionDir ?? resolve(projectRoot, ".pi-lock/state/sessions", lock.agentDigest, digest(cwd).slice(0, 12)));
+    const agentDir = resolve(projectRoot, ".pi-lock/state/ui");
+    mkdirSync(agentDir, { recursive: true });
+    const manager = options.sessionManager ?? (options.sessionFile ? SessionManager.open(resolve(options.sessionFile), stateDir, cwd) : SessionManager.create(cwd, stateDir));
+    let host;
+    let lastInspection;
+    const create = async (input) => {
+        verifySnapshot(releaseRoot, lock);
+        pinSession(input.sessionManager, lock, Boolean(options.dev));
+        const settings = options.dev ? developmentSettings(projectRoot) : lockedSettings(lock.definition.settings, true);
+        const models = await modelRuntime(lock.definition, options, Boolean(options.dev));
+        const model = selectedModel(models, lock.definition, Boolean(options.dev));
+        if (!options.dev)
+            assertModel(model, lock.model);
+        const loader = new LockedResourceLoader(releaseRoot, input.cwd, lock.definition, options.env, lock.effective?.mcp);
+        await loader.reload();
+        let result;
+        try {
+            result = await createPiSession({ cwd: input.cwd, agentDir,
+                modelRuntime: models, model, thinkingLevel: lock.definition.settings.defaultThinkingLevel,
+                scopedModels: options.dev ? undefined : [{ model: model, thinkingLevel: lock.definition.settings.defaultThinkingLevel ?? "medium" }],
+                resourceLoader: loader, settingsManager: settings, sessionManager: input.sessionManager,
+                sessionStartEvent: input.sessionStartEvent, });
+        }
+        catch (error) {
+            await loader.mcp?.close();
+            throw error;
+        }
+        const session = result.session;
+        if (options.dev && (!settings.getDefaultProvider() || !settings.getDefaultModel())) {
+            const setModel = session.setModel.bind(session);
+            session.setModel = (async (next, opts = {}) => setModel(next, { ...opts, persist: true }));
+        }
+        if (options.dev)
+            await models.refresh({ allowNetwork: false });
+        const errors = [];
+        const originalBind = session.bindExtensions.bind(session);
+        let boundRunner;
+        let boundMode;
+        const validate = (initial = true) => {
+            if (errors.length)
+                fail("EXTENSION_RUNTIME_FAILED", errors.join("\n"));
+            if (!options.dev)
+                assertModel(session.model, lock.model);
+            const effective = effectiveConfiguration(session, releaseRoot, input.cwd, lock);
+            if (initial && lock.effective && !options.dev && digest(effective) !== digest(lock.effective))
+                fail("EFFECTIVE_CONFIG_DRIFT", "Actual model, prompt, tools, or extensions differ from pi.lock. Mode-dependent extension initialization is not portable.");
+            lastInspection = { agentDigest: lock.agentDigest, effectiveDigest: digest(effective), frozen: !options.dev, pi: lock.runtime.pi,
+                credentialEnvironment: lock.definition.settings.defaultProvider ? keyBinding(lock.definition) : undefined, configuration: effective };
+        };
+        session.bindExtensions = async (bindings) => {
+            // Pi RPC may rebind twice after new_session. Run startup hooks once per extension runtime.
+            if (boundRunner === session.extensionRunner) {
+                if (bindings.mode && bindings.mode !== boundMode)
+                    fail("MODE_ALREADY_BOUND", "Create a fresh runtime when changing its interface mode.");
+                return;
+            }
+            await originalBind({ ...bindings, uiContext: bindings.uiContext ?? headlessUI(options.uiContext), onError: error => { errors.push(`${error.event}: ${error.error}`); bindings.onError?.(error); } });
+            validate();
+            await loader.mcp?.check();
+            boundRunner = session.extensionRunner;
+            boundMode = bindings.mode ?? "print";
+        };
+        if (!options.dev) {
+            const setModel = session.setModel.bind(session);
+            session.setModel = (async (next, opts) => { assertModel(next, lock.model); return setModel(next, opts); });
+            const setThinking = session.setThinkingLevel.bind(session);
+            session.setThinkingLevel = (level, opts) => {
+                if (level !== session.thinkingLevel)
+                    fail("FROZEN_SETTING", "Thinking level is locked. Edit .pi/settings.json and re-lock.");
+                return setThinking(level, opts);
+            };
+            for (const name of ["setSteeringMode", "setFollowUpMode", "setAutoCompactionEnabled", "setAutoRetryEnabled"]) {
+                if (typeof session[name] === "function")
+                    session[name] = () => fail("FROZEN_SETTING", `${name} changes locked behavior. Use --dev, then re-lock.`);
+            }
+        }
+        const originalPrompt = session.prompt.bind(session);
+        session.prompt = async (text, opts) => {
+            verifySnapshot(releaseRoot, lock);
+            validate(false);
+            await loader.mcp?.check();
+            const result = await originalPrompt(text, opts);
+            if (errors.length)
+                fail("EXTENSION_RUNTIME_FAILED", errors.join("\n"));
+            const last = session.messages.at(-1);
+            if (last?.role === "assistant" && last.stopReason === "error")
+                fail("MODEL_REQUEST_FAILED", last.errorMessage ?? "Model request failed.");
+            return result;
+        };
+        const stream = models.streamSimple.bind(models);
+        models.streamSimple = (selected, context, streamOptions) => {
+            verifySnapshot(releaseRoot, lock);
+            if (!options.dev)
+                assertModel(selected, lock.model);
+            return lazyStream(selected, async () => { await loader.mcp?.check(); return stream(selected, context, streamOptions); });
+        };
+        const reload = session.reload.bind(session);
+        session.reload = async (opts) => {
+            if (!options.dev)
+                verifyDefinition(projectRoot, lock);
+            else {
+                const next = await draftLock(projectRoot, true);
+                if (next.model) {
+                    const configured = models.getModel(next.definition.settings.defaultProvider, next.definition.settings.defaultModel);
+                    if (!configured || digest(modelIdentity(configured)) !== digest(next.model))
+                        fail("RESTART_REQUIRED", "Model configuration changed. Restart pi-lock --dev to rebuild its provider runtime.");
+                }
+                lock = next;
+                releaseRoot = materialize(projectRoot, next);
+                loader.root = releaseRoot;
+                loader.definition = next.definition;
+            }
+            await reload(opts);
+            validate();
+            boundRunner = session.extensionRunner;
+        };
+        return { ...result, services: { cwd: input.cwd, agentDir, modelRuntime: models, settingsManager: settings, resourceLoader: loader, diagnostics: [] }, diagnostics: [] };
+    };
+    host = await createAgentSessionRuntime(create, { cwd, agentDir, sessionManager: manager });
+    const originalDispose = host.dispose.bind(host);
+    let disposing;
+    host.dispose = () => disposing ??= (async () => {
+        await host.session.abort();
+        await host.services.settingsManager.flush();
+        await originalDispose();
+    })();
+    const bind = async (mode = "print", ui) => {
+        await host.session.bindExtensions({ mode, uiContext: headlessUI(ui ?? options.uiContext),
+            commandContextActions: {
+                waitForIdle: () => host.session.agent.waitForIdle(),
+                newSession: opts => host.newSession(opts), fork: (id, opts) => host.fork(id, opts),
+                navigateTree: (id, opts) => host.session.navigateTree(id, opts),
+                switchSession: (path, opts) => host.switchSession(path, opts),
+                reload: () => host.session.reload(),
+            },
+        });
+    };
+    host.setRebindSession(() => bind());
+    return { runtime: host, get lock() { return lock; }, projectRoot, get releaseRoot() { return releaseRoot; }, inspect: () => lastInspection, bind, dispose: () => host.dispose() };
+}
+/** Drop-in-shaped SDK entry: same Pi session, with project-only loading and frozen checks. */
+export async function createAgentSession(options = {}) {
+    const locked = await createLockedRuntime(options);
+    try {
+        await locked.bind("print", options.uiContext);
+    }
+    catch (e) {
+        await locked.dispose();
+        throw e;
+    }
+    return {
+        get session() { return locked.runtime.session; },
+        runtime: locked.runtime,
+        inspect: locked.inspect,
+        get agentDigest() { return locked.lock.agentDigest; },
+        dispose: locked.dispose,
+    };
+}
+export async function lockProject(projectRoot) {
+    const root = findProject(projectRoot, projectRoot);
+    const lock = await draftLock(root);
+    const runtime = await createLockedRuntime({ projectRoot: root, cwd: root, sessionManager: SessionManager.inMemory(root) }, lock);
+    try {
+        await runtime.bind();
+        lock.effective = runtime.inspect().configuration;
+        // A source edit during extension initialization must never produce a mixed release.
+        verifyDefinition(root, lock);
+        saveLock(root, lock);
+        materialize(root, lock);
+        return lock;
+    }
+    finally {
+        await runtime.dispose();
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,kBAAkB,IAAI,eAAe,EAAE,yBAAyB,EAAE,eAAe,EAAE,cAAc,GAGlG,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAkB,MAAM,WAAW,CAAC;AACzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAA2B,MAAM,YAAY,CAAC;AAwB1H,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,UAAU,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,yBAAyB;IACnI,eAAe,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,YAAY,EAAE,yBAAyB,EAAE,wBAAwB;IACjI,2BAA2B,EAAE,+BAA+B,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,uBAAuB;IACnI,mBAAmB,EAAE,cAAc,EAAE,2BAA2B,EAAE,yBAAyB;CAC5F,CAAC,CAAC;AACH,SAAS,cAAc,CAAC,QAA6B,EAAE,MAAe;IACpE,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAChK,IAAI,MAAM;QAAE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClF,OAAe,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,IAAI,wFAAwF,CAAC,CAAC;YACzJ,CAAC;QACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACvD,OAAO,eAAe,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE;YACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACnD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAS,GAAgC,EAAE;IACpE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,4HAA4H,CAAC,CAAC;IACxL,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACtB,OAAO;QACL,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;QACxF,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;QACnF,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;QACjG,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;QAC1F,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;QAChF,IAAI,KAAK,KAAK,OAAO,SAAgB,CAAC,CAAC,CAAC;QACxC,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,OAAuB,EAAE,IAAe,EAAE,GAAY;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IACxG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,0BAA0B,EAAE,qGAAqG,CAAC,CAAC;IACrN,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,kBAAkB,EAAE,qHAAqH,CAAC,CAAC;QAC3M,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAE,WAAmB,EAAE,GAAW,EAAE,IAAe;IAC7G,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,IAAK,IAAY,CAAC,UAAU;YAC/G,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAG,IAAY,CAAC,QAAQ;YAC9G,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;QAClB,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;QACzE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;QAClC,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3I,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO;QACvE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;QAChF,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAG,MAA+B,CAAC,GAAG,EAAE,OAAO;KACrG,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAO,GAAyB,EAAE,EAAE,QAAoB;IAChG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;IACnJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,mBAAmB,EAAE,cAAc,GAAG,mGAAmG,CAAC,CAAC;IAC/M,YAAY,EAAE,CAAC;IACf,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,yBAAyB,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5I,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1K,IAAI,IAA0B,CAAC;IAC/B,IAAI,cAAuB,CAAC;IAC5B,MAAM,MAAM,GAAqC,KAAK,EAAC,KAAK,EAAC,EAAE;QAC7D,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClC,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAG,IAAI,CAAC,SAAiB,EAAE,GAAG,CAAC,CAAC;QAC5H,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,IAAI,MAAmD,CAAC;QACxD,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ;gBAC7D,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB;gBACzF,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAM,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,IAAI,QAAQ,EAAE,CAAC;gBACrI,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;gBACvF,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,GAC3C,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAA6B,CAAC;QACzH,CAAC;QACD,IAAI,OAAO,CAAC,GAAG;YAAE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,WAAwD,CAAC;QAC7D,IAAI,SAA6B,CAAC;QAClC,MAAM,QAAQ,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAClC,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChF,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,wBAAwB,EAAE,0HAA0H,CAAC,CAAC;YAC1P,cAAc,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;gBAC7H,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC1I,CAAC,CAAC;QACF,OAAO,CAAC,cAAc,GAAG,KAAK,EAAC,QAAQ,EAAC,EAAE;YACxC,2FAA2F;YAC3F,IAAI,WAAW,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5C,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,oBAAoB,EAAE,0DAA0D,CAAC,CAAC;gBACzI,OAAO;YACT,CAAC;YACD,MAAM,YAAY,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrM,QAAQ,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAC1B,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC;QAC9E,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAA6B,CAAC;YACvI,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,CAAC,gBAAgB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzC,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa;oBAAE,IAAI,CAAC,gBAAgB,EAAE,+DAA+D,CAAC,CAAC;gBAC7H,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,EAAE,CAAC;gBAC7G,IAAI,OAAQ,OAAe,CAAC,IAAI,CAAC,KAAK,UAAU;oBAAG,OAAe,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,IAAI,oDAAoD,CAAC,CAAC;YACvK,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACpC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAClC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAQ,CAAC;YAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;gBAAE,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAC;YAC1I,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;YACzD,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,MAAM,GAAG,KAAK,EAAC,IAAI,EAAC,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;iBACjD,CAAC;gBACJ,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;oBACpH,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,IAAI,CAAC,kBAAkB,EAAE,qFAAqF,CAAC,CAAC;gBAC/L,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC;gBAAC,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC;gBAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACjE,CAAC;YACD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAAC,QAAQ,EAAE,CAAC;YAAC,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;QACxE,CAAC,CAAC;QACF,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC1K,CAAC,CAAC;IACF,IAAI,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAoC,CAAC;IACzC,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,GAAqC,OAAO,EAAE,EAAgC,EAAE,EAAE;QACxG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC;YACtF,qBAAqB,EAAE;gBACrB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBACnD,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;gBAClF,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC;gBAC/D,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC7D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;aACpC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,WAAW,KAAK,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;AACpL,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAO,GAAyB,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC9C,OAAO;QACL,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,WAAW,KAAK,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjI,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAI,OAAO,CAAC,OAAO,EAAU,CAAC,aAAa,CAAC;QAC1D,oFAAoF;QACpF,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxC,CAAC"}

package/docs/acceptance.md

@@ -0,0 +1,54 @@
+# pi.lock Acceptance Report
+
+Acceptance date: 2026-10-18 (Asia/Shanghai). Project and npm package: `pi.lock@0.1.0`. Supported Pi version: **1.3.0**.
+
+The package identifier and SDK self-reference were updated for publication as `pi.lock`; the CLI command remains `pi-lock`.
+
+## Results
+
+`npm test`: **26 passed, 0 failed, 0 skipped**, about 47.2 seconds. TypeScript build passed. The full output is available in [acceptance.tap](acceptance.tap).
+
+Both the source checkout and packed npm package were run. After installation in a clean application directory, the package verified and ran an unchanged agent definition and lockfile. The acceptance test checks that the npm package includes `npm-shrinkwrap` and excludes `.pi-lock` state and `auth.json`.
+
+## Acceptance scope
+
+| Capability | Evidence collected |
+|---|---|
+| Pi version | Official npm registry reported `latest` as 1.3.0; dependency versions are exact-pinned |
+| Global configuration isolation | Polluted HOME, global extensions and skills, parent AGENTS, and task-directory `.pi`; marker extension did not execute and ambient instructions were not loaded |
+| Portable resources | Copied an agent to another directory; digest, effective configuration fingerprint, and content matched |
+| SDK / TUI / RPC / print | Real Pi `AgentSession`; native TUI ran in a PTY; compared provider transcripts/options, including hooks, tool schemas, and the follow-up request after tool execution |
+| HTTP model path | Connected Pi's native OpenAI-compatible HTTP streaming implementation to a local service; compared SDK and CLI request bodies and checked explicit credential injection |
+| Frozen execution | Additions, modifications, and deletions of resources; model/thinking/settings changes; and lockfile or snapshot tampering were rejected |
+| Lifecycle | New, reloaded, forked, and resumed sessions used the locked factory; RPC new-session initialization ran once |
+| Multiple agents | Ran two agents concurrently in one SDK process; reloading one left the other working; process cwd/env stayed unchanged |
+| Git rollback | Committed V1 and V2 in a temporary Git repository, checked out V1, and ran it; an already-started V1 continued reading its snapshot after the source directory changed to V2 |
+| Session version | Resuming an old session with a new agent version failed explicitly |
+| npm package and dependencies | Ran real npm pack/install; package resources, helper imports, and dependency files were locked; tampering was rejected; missing dependencies after relocation prevented execution and `sync --frozen` restored them |
+| MCP | A local stdio server tool call succeeded; schema changes before startup and during a session were detected; codemode/deferred exposure initialized through native tool support |
+| Interaction | SDK without a callback did not auto-approve; explicit native `uiContext.confirm` callback worked |
+| Model fallback | A missing locked model failed instead of selecting another model |
+| Native resource conventions | Project AGENTS, project `.agents/skills`, loose skills, globs, and resource exclusions resolved correctly |
+| Tune, then release | Native model selection API wrote to `.pi/settings.json` in development mode; the next lock used the saved model |
+| RPC output | Extension startup `console.log` did not corrupt JSONL stdout |
+| Package reproducibility | Installed the tarball in a new application without source-project development dependencies; the unchanged lock verified and ran |
+
+Request comparisons normalize deployment paths, session/response IDs, timestamps, durations, and usage statistics from the local mock model. Instructions, content, tool schemas, call arguments, and hook results are compared.
+
+## Environment
+
+- macOS 27.0.1 / arm64
+- Node.js v22.23.2
+- npm 10.9.8
+- Pi `@earendil-works/pi-coding-agent` 1.3.0
+- The PTY driver uses system Python 3; it is not a runtime requirement for pi-lock
+- Demo agent digest: `bf54f0845e5553fc6948add9a1711455feb5bc98d39eb40a9ade8cca00436827`
+- Full test-log SHA-256: `4e41da880942cf2bffa3d2c53cb23c77fdba932a90693c488891a6765265de1d`
+
+## Tested boundaries
+
+Model responses came from a deterministic local provider and local HTTP fixture; no real provider account, paid request, or live model response was used as a substitute for consistency checks. MCP tool calls and drift detection used a local stdio fixture. External MCP HTTP services, OAuth provider login, and the full third-party extension ecosystem were not tested against live services.
+
+Relocation and clean-install tests ran in separate directories on the same macOS machine. The Docker command was available, but its daemon was not, so Linux, Windows, and another physical machine were not tested. Same-machine directory relocation is not represented as cross-platform acceptance.
+
+See the [README](../README.md) and [architecture notes](architecture.md) for extension compatibility, host-command dependencies, session migration, and external side-effect boundaries.

package/docs/acceptance.tap

@@ -0,0 +1,178 @@
+
+> pi.lock@0.1.0 test
+> npm run build && node --test --test-concurrency=1 test/*.test.mjs
+
+
+> pi.lock@0.1.0 build
+> tsc -p tsconfig.json
+
+TAP version 13
+# Subtest: locks latest Pi 1.3.0 and preserves the ordinary .pi layout
+ok 1 - locks latest Pi 1.3.0 and preserves the ordinary .pi layout
+  ---
+  duration_ms: 3073.224209
+  type: 'test'
+  ...
+# Subtest: ignores polluted HOME, global extensions, global skills, parent AGENTS and workspace .pi
+ok 2 - ignores polluted HOME, global extensions, global skills, parent AGENTS and workspace .pi
+  ---
+  duration_ms: 1860.822375
+  type: 'test'
+  ...
+# Subtest: relocation preserves Agent digest and actual effective configuration
+ok 3 - relocation preserves Agent digest and actual effective configuration
+  ---
+  duration_ms: 65.6075
+  type: 'test'
+  ...
+# Subtest: frozen execution rejects changed, removed and added resources before extension execution
+ok 4 - frozen execution rejects changed, removed and added resources before extension execution
+  ---
+  duration_ms: 81.851125
+  type: 'test'
+  ...
+# Subtest: frozen SDK and CLI reject behavioral overrides and thinking changes
+ok 5 - frozen SDK and CLI reject behavioral overrides and thinking changes
+  ---
+  duration_ms: 500.402667
+  type: 'test'
+  ...
+# Subtest: SDK, native print and native RPC produce the same real model requests including hooks and tool rounds
+ok 6 - SDK, native print and native RPC produce the same real model requests including hooks and tool rounds
+  ---
+  duration_ms: 3589.101084
+  type: 'test'
+  ...
+# Subtest: the real native TUI in a PTY uses the same model requests as the SDK
+ok 7 - the real native TUI in a PTY uses the same model requests as the SDK
+  ---
+  duration_ms: 2101.829708
+  type: 'test'
+  ...
+# Subtest: new, reload, fork and resume retain locked resources and session version
+ok 8 - new, reload, fork and resume retain locked resources and session version
+  ---
+  duration_ms: 110.145875
+  type: 'test'
+  ...
+# Subtest: two Agents coexist in one SDK process and reload without changing cwd or environment
+ok 9 - two Agents coexist in one SDK process and reload without changing cwd or environment
+  ---
+  duration_ms: 93.562625
+  type: 'test'
+  ...
+# Subtest: Git rollback restores an earlier Agent; running snapshots survive source changes
+ok 10 - Git rollback restores an earlier Agent; running snapshots survive source changes
+  ---
+  duration_ms: 175.602584
+  type: 'test'
+  ...
+# Subtest: resuming a session with a different Agent version fails explicitly
+ok 11 - resuming a session with a different Agent version fails explicitly
+  ---
+  duration_ms: 64.530166
+  type: 'test'
+  ...
+# Subtest: relative helper imports are captured; absolute paths and escaping symlinks are rejected
+ok 12 - relative helper imports are captured; absolute paths and escaping symlinks are rejected
+  ---
+  duration_ms: 30.073458
+  type: 'test'
+  ...
+# Subtest: unsupported mode-dependent extension initialization fails rather than pretending parity
+ok 13 - unsupported mode-dependent extension initialization fails rather than pretending parity
+  ---
+  duration_ms: 1760.34975
+  type: 'test'
+  ...
+# Subtest: --dev reload reads local edits; frozen running sessions remain on their immutable release
+ok 14 - --dev reload reads local edits; frozen running sessions remain on their immutable release
+  ---
+  duration_ms: 72.374875
+  type: 'test'
+  ...
+# Subtest: lock content and materialized-release corruption fail explicitly
+ok 15 - lock content and materialized-release corruption fail explicitly
+  ---
+  duration_ms: 27.148125
+  type: 'test'
+  ...
+# Subtest: installed npm resource packages and dependency files are pinned, portable, restorable and checked before use
+ok 16 - installed npm resource packages and dependency files are pinned, portable, restorable and checked before use
+  ---
+  duration_ms: 4159.828458
+  type: 'test'
+  ...
+# Subtest: MCP tool schemas are locked, tool calls work, and startup/mid-session drift is blocked
+ok 17 - MCP tool schemas are locked, tool calls work, and startup/mid-session drift is blocked
+  ---
+  duration_ms: 249.616667
+  type: 'test'
+  ...
+# Subtest: MCP codemode and deferred exposure use Pi's native discovery tools in every runtime
+ok 18 - MCP codemode and deferred exposure use Pi's native discovery tools in every runtime
+  ---
+  duration_ms: 335.502875
+  type: 'test'
+  ...
+# Subtest: headless UI does not silently approve and explicit SDK UI handlers work
+ok 19 - headless UI does not silently approve and explicit SDK UI handlers work
+  ---
+  duration_ms: 53.980375
+  type: 'test'
+  ...
+# Subtest: an unavailable locked model never falls back to another model
+ok 20 - an unavailable locked model never falls back to another model
+  ---
+  duration_ms: 4.249167
+  type: 'test'
+  ...
+# PLUGIN_STARTUP_LOG
+# Subtest: native OpenAI-compatible HTTP requests use explicit credentials and match across SDK and CLI
+ok 21 - native OpenAI-compatible HTTP requests use explicit credentials and match across SDK and CLI
+  ---
+  duration_ms: 2070.440458
+  type: 'test'
+  ...
+# Subtest: extension startup logging cannot corrupt native RPC stdout
+ok 22 - extension startup logging cannot corrupt native RPC stdout
+  ---
+  duration_ms: 1933.456042
+  type: 'test'
+  ...
+# > pi.lock@0.1.0 prepack
+# > node scripts/prepack.mjs
+# npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
+# Subtest: native RPC new_session initializes extensions exactly once, matching SDK lifecycle
+ok 23 - native RPC new_session initializes extensions exactly once, matching SDK lifecycle
+  ---
+  duration_ms: 3999.409083
+  type: 'test'
+  ...
+# Subtest: native project context, loose skills, glob selection and resource exclusions are resolved locally
+ok 24 - native project context, loose skills, glob selection and resource exclusions are resolved locally
+  ---
+  duration_ms: 53.543625
+  type: 'test'
+  ...
+# Subtest: development model selection uses native Pi APIs and persists settings for the subsequent lock
+ok 25 - development model selection uses native Pi APIs and persists settings for the subsequent lock
+  ---
+  duration_ms: 63.647584
+  type: 'test'
+  ...
+# Subtest: packed npm release installs into a clean app and runs an unchanged Agent lock
+ok 26 - packed npm release installs into a clean app and runs an unchanged Agent lock
+  ---
+  duration_ms: 16188.030791
+  type: 'test'
+  ...
+1..26
+# tests 26
+# suites 0
+# pass 26
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 44981.566833

package/docs/architecture.md

@@ -0,0 +1,47 @@
+# pi.lock architecture
+
+The project and npm package are named **pi.lock**. The CLI command remains `pi-lock`; the SDK imports from `pi.lock`; the Agent lockfile is also `pi.lock`; local runtime state lives in `.pi-lock/`.
+
+## One construction path
+
+`src/runtime.ts:createLockedRuntime` is shared by the SDK, Pi InteractiveMode, Pi runRpcMode, and Pi runPrintMode. It constructs Pi's AgentSessionRuntime with an explicit runtime factory. Every new/resumed/forked session goes through that factory. No adapter invokes Pi's default service/resource discovery.
+
+`src/bridge.ts` contains the imports that use the pinned Pi 1.3.0 internal layout. Pi exports the ResourceLoader contract, but not its explicit extension-factory initializer or every MCP helper. Those version-specific integration points are isolated instead of modifying the installed Pi package.
+
+## Definition and locking
+
+The human-facing source remains native `.pi` configuration. `readDefinition` computes a project-scoped inventory, follows declared resources/packages, captures relative extension helpers, and records integrity-pinned local npm dependencies. It rejects escaping paths and symlinks. Package hashes include supporting files, not only extension entry points and SKILL.md.
+
+The runtime identity hashes compiled pi-lock JavaScript and the installed production dependency closure, excluding packages containing only TypeScript declarations. npm can hoist a developer's @types/node into a dependency's type-only edge; such non-executable metadata must not change Agent identity. The distributed npm package carries a shrinkwrap generated from the source package-lock so fresh installations restore the runtime dependency graph. The definition and effective startup configuration are included in the lock digest. This prevents a nominally identical Pi version string from silently masking a different installed implementation.
+
+`lockProject` builds a candidate snapshot, initializes extensions, captures the effective model/prompt/resource/tool configuration, rechecks that source did not change during initialization, and only then atomically saves pi.lock. Credentials, wall-clock timestamps and absolute deployment paths are not lock identifiers. Absolute resource/workspace paths in diagnostics are normalized to `<AGENT>` and `<WORKSPACE>`.
+
+## Execution and immutability
+
+Frozen startup checks both the installed implementation and current project inventory against pi.lock. It materializes ordinary files in `.pi-lock/releases/<agentDigest>` and verifies them before executing extensions. That snapshot, not the source tree, supplies lazy Skill/template reads and relative imports. Changing or checking out source files therefore does not switch an existing session's instruction files.
+
+Frozen reload verifies source before reinitializing the locked snapshot. Developer reload intentionally creates a new snapshot from current project resources. Provider/model definition changes during development require a restart; ordinary local prompt/Skill/extension reloads preserve Pi's normal `/reload` workflow.
+
+SessionManager remains Pi's native JSONL/in-memory tree manager. An initial custom entry binds each transcript to agentDigest. An imported transcript without a pin or a transcript from another version is rejected. No automatic history migration is attempted.
+
+## Isolation scope
+
+SettingsManager is in memory in frozen mode. Developer writes use a custom storage backend bound to exactly `.pi/settings.json`. ModelRuntime has an explicit credential store and in-memory model store, no models.json path discovery and no remote catalogue refresh. A missing model never falls back to the first available provider.
+
+The custom ResourceLoader never walks parent context directories or user-global resource locations. Extension compilation disables filesystem cache and tsconfig path discovery; Pi and TypeBox imports are mapped to the pinned host modules. Additional resources returned by `resources_discover` are rejected unless first declared as project resources and locked.
+
+No process-global environment or cwd changes are made by the SDK. The standalone CLI sets Pi's process-level paths before importing Pi so the native TUI's remaining getAgentDir calls target `.pi-lock/state/ui`. This is deliberately confined to the CLI process.
+
+This is a reproducibility contract for cooperating host code and compatible extensions. Unrestricted JavaScript, filesystem tools, shell commands and external services retain their normal effects. It is not a sandbox or a proof that arbitrary dynamically generated code has no ambient dependencies.
+
+## MCP
+
+MCP connections are established before startup validation. The same connected clients supply the recorded catalogue and execute calls. Server instructions, capabilities, and all paginated tool schemas are compared against the lock; catalogues are checked again before requests/tool calls. A server-side change fails explicitly instead of replacing a same-named tool silently.
+
+Pi's native MCP tool-definition adapter and its codemode/tool-search extensions provide tool exposure and execution. The project-specific transport/bootstrap layer supplies only explicit configuration, secrets, roots and process environment. Resource-list/read adapters call the same MCP clients. OAuth providers or non-project command runners require explicit integration.
+
+## Evidence
+
+Acceptance tests compare the actual provider transcript/options across SDK, print, RPC and a PTY-hosted native TUI, including an extension prompt hook and the second tool-result round. Only path relocation, transcript timestamps, durations, response/session identifiers and fake-provider usage metadata are normalized. Another test uses Pi's native OpenAI HTTP implementation and compares actual request bodies and explicit Authorization headers against a local streaming server.
+
+Other tests cover polluted HOME/workspace/ancestor settings, source/dependency/snapshot tampering, npm restoration after relocation, Git rollback with live old snapshots, session version mismatches, lifecycle changes, multiple SDK agents, missing interaction callbacks and MCP drift. The final execution record is in acceptance.md.

package/examples/demo/.pi/SYSTEM.md

@@ -0,0 +1 @@
+You are a helpful agent. Use the supplied tools and skills when needed.

package/examples/demo/.pi/extensions/demo.ts

@@ -0,0 +1,13 @@
+import { Type, fauxProvider, fauxAssistantMessage, fauxToolCall } from "@earendil-works/pi-ai";
+
+// Ordinary Pi extension. The provider is offline and deterministic; no API key or network.
+export default function (pi) {
+  const fake = fauxProvider({ provider: "pi-lock-demo", api: "openai-completions", models: [{ id: "demo", name: "Offline demo", reasoning: false, contextWindow: 32768, maxTokens: 1024 }] });
+  fake.setResponses(Array.from({ length: 100 }, () => (context) => {
+    const last = context.messages.at(-1);
+    if (last?.role === "toolResult") return fauxAssistantMessage("Agent versioned by pi.lock. " + last.content.filter(c => c.type === "text").map(c => c.text).join(""));
+    return fauxAssistantMessage(fauxToolCall("echo", { text: "Hello from the same Pi agent." }, { id: "echo-demo" }), { stopReason: "toolUse" });
+  }));
+  pi.registerProvider("pi-lock-demo", { api: "openai-completions", baseUrl: "http://localhost:0", apiKey: "offline-demo", streamSimple: fake.provider.streamSimple, models: [{ id: "demo", name: "Offline demo", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 32768, maxTokens: 1024 }] });
+  pi.registerTool({ name: "echo", label: "Echo", description: "Echo a text value.", parameters: Type.Object({ text: Type.String() }), execute: async (_id, args) => ({ content: [{ type: "text", text: args.text }], details: {} }) });
+}

package/examples/demo/.pi/models.json

@@ -0,0 +1,26 @@
+{
+  "providers": {
+    "pi-lock-demo": {
+      "api": "openai-completions",
+      "baseUrl": "http://localhost:0",
+      "models": [
+        {
+          "id": "demo",
+          "name": "Offline demo",
+          "reasoning": false,
+          "input": [
+            "text"
+          ],
+          "cost": {
+            "input": 0,
+            "output": 0,
+            "cacheRead": 0,
+            "cacheWrite": 0
+          },
+          "contextWindow": 32768,
+          "maxTokens": 1024
+        }
+      ]
+    }
+  }
+}

package/examples/demo/.pi/prompts/hello.md

@@ -0,0 +1,4 @@
+---
+description: Try the same agent through every interface.
+---
+Say hello using the echo tool. $ARGUMENTS