taskflow-core 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +247 -862
- package/dist/agents.d.ts +12 -0
- package/dist/agents.d.ts.map +1 -1
- package/dist/agents.js +29 -1
- package/dist/agents.js.map +1 -1
- package/dist/cwd-bridge.d.ts +61 -0
- package/dist/cwd-bridge.d.ts.map +1 -0
- package/dist/cwd-bridge.js +136 -0
- package/dist/cwd-bridge.js.map +1 -0
- package/dist/detached-runner.js +31 -5
- package/dist/detached-runner.js.map +1 -1
- package/dist/exec/driver.d.ts +1 -0
- package/dist/exec/driver.d.ts.map +1 -1
- package/dist/exec/driver.js +15 -2
- package/dist/exec/driver.js.map +1 -1
- package/dist/exec/step-kinds.d.ts.map +1 -1
- package/dist/exec/step-kinds.js +28 -3
- package/dist/exec/step-kinds.js.map +1 -1
- package/dist/exec/step.d.ts +1 -0
- package/dist/exec/step.d.ts.map +1 -1
- package/dist/exec/step.js +18 -0
- package/dist/exec/step.js.map +1 -1
- package/dist/flowir/compile.d.ts.map +1 -1
- package/dist/flowir/compile.js +13 -0
- package/dist/flowir/compile.js.map +1 -1
- package/dist/host/runner-types.d.ts +16 -0
- package/dist/host/runner-types.d.ts.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -0
- package/dist/index.js.map +1 -1
- package/dist/interpolate.d.ts +4 -0
- package/dist/interpolate.d.ts.map +1 -1
- package/dist/interpolate.js +14 -0
- package/dist/interpolate.js.map +1 -1
- package/dist/resources/authority.d.ts +35 -0
- package/dist/resources/authority.d.ts.map +1 -0
- package/dist/resources/authority.js +67 -0
- package/dist/resources/authority.js.map +1 -0
- package/dist/resources/backend.d.ts +302 -0
- package/dist/resources/backend.d.ts.map +1 -0
- package/dist/resources/backend.js +16 -0
- package/dist/resources/backend.js.map +1 -0
- package/dist/resources/baseline.d.ts +116 -0
- package/dist/resources/baseline.d.ts.map +1 -0
- package/dist/resources/baseline.js +447 -0
- package/dist/resources/baseline.js.map +1 -0
- package/dist/resources/canonical-json.d.ts +7 -0
- package/dist/resources/canonical-json.d.ts.map +1 -0
- package/dist/resources/canonical-json.js +75 -0
- package/dist/resources/canonical-json.js.map +1 -0
- package/dist/resources/errors.d.ts +23 -0
- package/dist/resources/errors.d.ts.map +1 -0
- package/dist/resources/errors.js +89 -0
- package/dist/resources/errors.js.map +1 -0
- package/dist/resources/execution.d.ts +90 -0
- package/dist/resources/execution.d.ts.map +1 -0
- package/dist/resources/execution.js +581 -0
- package/dist/resources/execution.js.map +1 -0
- package/dist/resources/index.d.ts +15 -0
- package/dist/resources/index.d.ts.map +1 -0
- package/dist/resources/index.js +15 -0
- package/dist/resources/index.js.map +1 -0
- package/dist/resources/journal.d.ts +138 -0
- package/dist/resources/journal.d.ts.map +1 -0
- package/dist/resources/journal.js +438 -0
- package/dist/resources/journal.js.map +1 -0
- package/dist/resources/leases.d.ts +51 -0
- package/dist/resources/leases.d.ts.map +1 -0
- package/dist/resources/leases.js +354 -0
- package/dist/resources/leases.js.map +1 -0
- package/dist/resources/permits.d.ts +52 -0
- package/dist/resources/permits.d.ts.map +1 -0
- package/dist/resources/permits.js +240 -0
- package/dist/resources/permits.js.map +1 -0
- package/dist/resources/persistence.d.ts +63 -0
- package/dist/resources/persistence.d.ts.map +1 -0
- package/dist/resources/persistence.js +522 -0
- package/dist/resources/persistence.js.map +1 -0
- package/dist/resources/registry.d.ts +56 -0
- package/dist/resources/registry.d.ts.map +1 -0
- package/dist/resources/registry.js +139 -0
- package/dist/resources/registry.js.map +1 -0
- package/dist/resources/resolve.d.ts +49 -0
- package/dist/resources/resolve.d.ts.map +1 -0
- package/dist/resources/resolve.js +309 -0
- package/dist/resources/resolve.js.map +1 -0
- package/dist/resources/sandbox.d.ts +72 -0
- package/dist/resources/sandbox.d.ts.map +1 -0
- package/dist/resources/sandbox.js +952 -0
- package/dist/resources/sandbox.js.map +1 -0
- package/dist/resources/schema.d.ts +195 -0
- package/dist/resources/schema.d.ts.map +1 -0
- package/dist/resources/schema.js +231 -0
- package/dist/resources/schema.js.map +1 -0
- package/dist/resources/types.d.ts +36 -0
- package/dist/resources/types.d.ts.map +1 -0
- package/dist/resources/types.js +75 -0
- package/dist/resources/types.js.map +1 -0
- package/dist/runner-core.d.ts +29 -0
- package/dist/runner-core.d.ts.map +1 -1
- package/dist/runner-core.js +311 -36
- package/dist/runner-core.js.map +1 -1
- package/dist/runtime/phases/script.d.ts.map +1 -1
- package/dist/runtime/phases/script.js +47 -9
- package/dist/runtime/phases/script.js.map +1 -1
- package/dist/runtime.d.ts +39 -0
- package/dist/runtime.d.ts.map +1 -1
- package/dist/runtime.js +542 -50
- package/dist/runtime.js.map +1 -1
- package/dist/schema.d.ts +68 -5
- package/dist/schema.d.ts.map +1 -1
- package/dist/schema.js +163 -22
- package/dist/schema.js.map +1 -1
- package/dist/store.d.ts +7 -0
- package/dist/store.d.ts.map +1 -1
- package/dist/store.js.map +1 -1
- package/dist/trace.d.ts +3 -0
- package/dist/trace.d.ts.map +1 -1
- package/dist/trace.js.map +1 -1
- package/package.json +3 -2
|
@@ -0,0 +1,581 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Resolve-only execution coordinator and partial W1a control-plane scaffold
|
|
3
|
+
* for the 0.2.1 cwd bridge.
|
|
4
|
+
*
|
|
5
|
+
* This is deliberately named for its guarantee: it provides principal/root
|
|
6
|
+
* authorization, canonical resolution, cross-process leases, durable write
|
|
7
|
+
* intents, one-shot mutation permits, and authenticated plans, but it does not
|
|
8
|
+
* claim an OS filesystem sandbox, a race-free FileBroker, or atomic protection
|
|
9
|
+
* against external path replacement. A future native backend can implement the
|
|
10
|
+
* same runtime seam only after an exact host-support baseline cell passes.
|
|
11
|
+
*/
|
|
12
|
+
import * as crypto from "node:crypto";
|
|
13
|
+
import * as fs from "node:fs";
|
|
14
|
+
import * as os from "node:os";
|
|
15
|
+
import * as path from "node:path";
|
|
16
|
+
import { emptyUsage } from "../usage.js";
|
|
17
|
+
import { createHostInvocationAuthority } from "./authority.js";
|
|
18
|
+
import { WriteIntentJournal, } from "./journal.js";
|
|
19
|
+
import { PersistentLeaseCoordinator } from "./leases.js";
|
|
20
|
+
import { createHostRootGrant, createRootRegistry } from "./registry.js";
|
|
21
|
+
import { resolvePathRef } from "./resolve.js";
|
|
22
|
+
import { computeHostBaselineBodyDigest, createSandboxPolicyPlan, SandboxPolicyFactory } from "./sandbox.js";
|
|
23
|
+
import { sameExecutionOwner } from "./types.js";
|
|
24
|
+
export const WORKSPACE_RECONCILE_ACKNOWLEDGEMENT = "I acknowledge the current workspace state";
|
|
25
|
+
export const WORKSPACE_RECONCILE_MODE_ENV = "TASKFLOW_WORKSPACE_RECONCILE_MODE";
|
|
26
|
+
export function workspaceReconcileAllowedFromEnv(value = process.env[WORKSPACE_RECONCILE_MODE_ENV]) {
|
|
27
|
+
return value === "explicit";
|
|
28
|
+
}
|
|
29
|
+
const BASELINE_BODY = {
|
|
30
|
+
schemaVersion: 1,
|
|
31
|
+
policyId: "taskflow-resolve-only",
|
|
32
|
+
policyVersion: "1",
|
|
33
|
+
readableSystemClasses: ["runtime", "dynamic-libraries", "ca-certificates"],
|
|
34
|
+
providerMetadata: [],
|
|
35
|
+
credentialDelivery: { mode: "unavailable" },
|
|
36
|
+
temp: { mode: "private-per-execution", access: "read-write" },
|
|
37
|
+
network: "host-policy",
|
|
38
|
+
};
|
|
39
|
+
const BASELINE_BODY_DIGEST = computeHostBaselineBodyDigest(BASELINE_BODY);
|
|
40
|
+
const RESOLVE_ONLY_BASELINE = Object.freeze({
|
|
41
|
+
schemaVersion: 1,
|
|
42
|
+
policyId: "taskflow-resolve-only",
|
|
43
|
+
policyVersion: "1",
|
|
44
|
+
bodyDigest: BASELINE_BODY_DIGEST,
|
|
45
|
+
readableSystemClasses: ["runtime", "dynamic-libraries", "ca-certificates"],
|
|
46
|
+
providerMetadata: [],
|
|
47
|
+
credentialDelivery: { mode: "unavailable" },
|
|
48
|
+
temp: { mode: "private-per-execution", access: "read-write" },
|
|
49
|
+
network: "host-policy",
|
|
50
|
+
});
|
|
51
|
+
const RESOLVE_ONLY_CAPABILITIES = Object.freeze({
|
|
52
|
+
schemaVersion: 1,
|
|
53
|
+
backendId: "taskflow-resolve-only",
|
|
54
|
+
backendCapabilityVersion: "1",
|
|
55
|
+
agent: "resolve-only",
|
|
56
|
+
script: "resolve-only",
|
|
57
|
+
sandboxFeatures: {
|
|
58
|
+
maxGrants: 1,
|
|
59
|
+
scopeKinds: ["directory"],
|
|
60
|
+
perGrantAccess: true,
|
|
61
|
+
denyAmbientUserData: false,
|
|
62
|
+
exactBaselineMounts: false,
|
|
63
|
+
privateTempPerExecution: false,
|
|
64
|
+
descendantEnforcement: false,
|
|
65
|
+
raceFreeFileBroker: false,
|
|
66
|
+
networkModes: ["host-policy"],
|
|
67
|
+
credentialModes: [],
|
|
68
|
+
},
|
|
69
|
+
brokeredRead: false,
|
|
70
|
+
brokeredWrite: false,
|
|
71
|
+
versionCommitModes: ["generation-only"],
|
|
72
|
+
restoreStrategies: [],
|
|
73
|
+
baselinePolicyId: RESOLVE_ONLY_BASELINE.policyId,
|
|
74
|
+
});
|
|
75
|
+
function isWithin(root, candidate) {
|
|
76
|
+
const relative = path.relative(root, candidate);
|
|
77
|
+
return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
|
|
78
|
+
}
|
|
79
|
+
function stableRootToken(root) {
|
|
80
|
+
const stat = fs.statSync(root, { bigint: true });
|
|
81
|
+
// This compatibility binding is explicitly path-bound (not a persisted host
|
|
82
|
+
// registry UUID). Include both filesystem identity and canonical path so an
|
|
83
|
+
// inode reused for a replacement directory cannot inherit prior authority or
|
|
84
|
+
// dirty journal state.
|
|
85
|
+
return crypto.createHash("sha256").update(`${stat.dev}:${stat.ino}:${root}`).digest("hex");
|
|
86
|
+
}
|
|
87
|
+
function readDirectoryIdentity(directory) {
|
|
88
|
+
const canonicalPath = fs.realpathSync(directory);
|
|
89
|
+
const stat = fs.statSync(canonicalPath, { bigint: true });
|
|
90
|
+
if (!stat.isDirectory())
|
|
91
|
+
throw new Error("TFWS_IDENTITY_MISMATCH: workspace cwd is no longer a directory");
|
|
92
|
+
return { canonicalPath, device: stat.dev.toString(), inode: stat.ino.toString() };
|
|
93
|
+
}
|
|
94
|
+
function sameDirectoryIdentity(left, right) {
|
|
95
|
+
return left.canonicalPath === right.canonicalPath && left.device === right.device && left.inode === right.inode;
|
|
96
|
+
}
|
|
97
|
+
export function defaultWorkspaceControlDirectory(invocationRoot) {
|
|
98
|
+
const canonical = fs.realpathSync(invocationRoot);
|
|
99
|
+
return path.join(os.homedir(), ".taskflow", "workspace-control", stableRootToken(canonical));
|
|
100
|
+
}
|
|
101
|
+
function ensurePrivateDirectory(directory) {
|
|
102
|
+
fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
|
|
103
|
+
if (process.platform !== "win32") {
|
|
104
|
+
const stat = fs.statSync(directory);
|
|
105
|
+
if ((stat.mode & 0o077) !== 0)
|
|
106
|
+
fs.chmodSync(directory, 0o700);
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
function loadOrCreateEnforcementKey(directory) {
|
|
110
|
+
const keyPath = path.join(directory, "enforcement-key-v1");
|
|
111
|
+
try {
|
|
112
|
+
const existing = fs.readFileSync(keyPath);
|
|
113
|
+
if (existing.length !== 32)
|
|
114
|
+
throw new Error("invalid enforcement key length");
|
|
115
|
+
return existing;
|
|
116
|
+
}
|
|
117
|
+
catch (error) {
|
|
118
|
+
if (error.code !== "ENOENT")
|
|
119
|
+
throw error;
|
|
120
|
+
}
|
|
121
|
+
const key = crypto.randomBytes(32);
|
|
122
|
+
try {
|
|
123
|
+
const fd = fs.openSync(keyPath, "wx", 0o600);
|
|
124
|
+
try {
|
|
125
|
+
fs.writeFileSync(fd, key);
|
|
126
|
+
fs.fsyncSync(fd);
|
|
127
|
+
}
|
|
128
|
+
finally {
|
|
129
|
+
fs.closeSync(fd);
|
|
130
|
+
}
|
|
131
|
+
return key;
|
|
132
|
+
}
|
|
133
|
+
catch (error) {
|
|
134
|
+
if (error.code !== "EEXIST")
|
|
135
|
+
throw error;
|
|
136
|
+
const existing = fs.readFileSync(keyPath);
|
|
137
|
+
if (existing.length !== 32)
|
|
138
|
+
throw new Error("invalid enforcement key length");
|
|
139
|
+
return existing;
|
|
140
|
+
}
|
|
141
|
+
}
|
|
142
|
+
function agentFailure(agentName, task, error) {
|
|
143
|
+
const message = error instanceof Error ? error.message : String(error);
|
|
144
|
+
return {
|
|
145
|
+
agent: agentName,
|
|
146
|
+
task,
|
|
147
|
+
exitCode: 1,
|
|
148
|
+
output: "",
|
|
149
|
+
stderr: message,
|
|
150
|
+
usage: emptyUsage(),
|
|
151
|
+
stopReason: "error",
|
|
152
|
+
errorMessage: message,
|
|
153
|
+
workspaceMutationStarted: error instanceof ResolveOnlyExecutionError ? error.mutationStarted : false,
|
|
154
|
+
};
|
|
155
|
+
}
|
|
156
|
+
class ResolveOnlyExecutionError extends Error {
|
|
157
|
+
mutationStarted;
|
|
158
|
+
constructor(error, mutationStarted) {
|
|
159
|
+
super(error instanceof Error ? error.message : String(error), { cause: error });
|
|
160
|
+
this.name = "ResolveOnlyExecutionError";
|
|
161
|
+
this.mutationStarted = mutationStarted;
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
function agentSucceeded(result) {
|
|
165
|
+
return result.exitCode === 0 && result.stopReason !== "error" && result.stopReason !== "aborted" && !result.errorMessage;
|
|
166
|
+
}
|
|
167
|
+
function scriptSucceeded(result) {
|
|
168
|
+
return result.code === 0 && result.timedOut !== true;
|
|
169
|
+
}
|
|
170
|
+
class ResolveOnlyWorkspaceSessionImpl {
|
|
171
|
+
assurance = "resolve-only-no-sandbox";
|
|
172
|
+
invocationRoot;
|
|
173
|
+
registry;
|
|
174
|
+
authority;
|
|
175
|
+
#grant;
|
|
176
|
+
#leases;
|
|
177
|
+
#journal;
|
|
178
|
+
#agentFactory;
|
|
179
|
+
#scriptFactory;
|
|
180
|
+
#leaseTimeoutMs;
|
|
181
|
+
#permitTtlMs;
|
|
182
|
+
#signal;
|
|
183
|
+
#rootIdentity;
|
|
184
|
+
#pendingLeaseReleases = new Set();
|
|
185
|
+
#allowReconcile;
|
|
186
|
+
// A single resolve-only session can fan out many tasks over the same granted
|
|
187
|
+
// root. They are all potential writers and cannot safely overlap without a
|
|
188
|
+
// native broker/snapshot backend. Serialize them before lease acquisition so
|
|
189
|
+
// ordinary parallel/map/tournament phases do not self-deadlock on the 10s
|
|
190
|
+
// cross-process lease timeout. External sessions still contend durably.
|
|
191
|
+
#mutationTail = Promise.resolve();
|
|
192
|
+
constructor(options) {
|
|
193
|
+
this.invocationRoot = fs.realpathSync(options.invocationRoot);
|
|
194
|
+
this.#rootIdentity = readDirectoryIdentity(this.invocationRoot);
|
|
195
|
+
const rootToken = stableRootToken(this.invocationRoot);
|
|
196
|
+
const grantId = options.grantId ?? "invocation";
|
|
197
|
+
const registryId = options.registryId ?? `invocation-${rootToken}`;
|
|
198
|
+
const principalId = options.principalId ?? "local-host-invocation";
|
|
199
|
+
this.authority = createHostInvocationAuthority({
|
|
200
|
+
principalId,
|
|
201
|
+
allowedGrantIds: [grantId],
|
|
202
|
+
allowResolveOnly: true,
|
|
203
|
+
});
|
|
204
|
+
this.#grant = createHostRootGrant({
|
|
205
|
+
grantId,
|
|
206
|
+
bindingId: `binding-${rootToken}`,
|
|
207
|
+
resourceDomainId: `domain-${rootToken}`,
|
|
208
|
+
physicalRoot: this.invocationRoot,
|
|
209
|
+
maxAccess: "read-write",
|
|
210
|
+
allowedPrincipals: [principalId],
|
|
211
|
+
enforcement: "resolve-only",
|
|
212
|
+
});
|
|
213
|
+
this.registry = createRootRegistry({ registryId, grants: [this.#grant] });
|
|
214
|
+
const controlDirectory = options.controlDirectory ?? defaultWorkspaceControlDirectory(this.invocationRoot);
|
|
215
|
+
ensurePrivateDirectory(controlDirectory);
|
|
216
|
+
const canonicalControlDirectory = fs.realpathSync(controlDirectory);
|
|
217
|
+
if (isWithin(this.invocationRoot, canonicalControlDirectory) || isWithin(canonicalControlDirectory, this.invocationRoot)) {
|
|
218
|
+
throw new Error("TFWS_INVALID_POLICY: control-plane storage must not overlap the flow workspace grant");
|
|
219
|
+
}
|
|
220
|
+
this.#leases = new PersistentLeaseCoordinator({ directory: canonicalControlDirectory, registryId });
|
|
221
|
+
this.#journal = new WriteIntentJournal({ directory: canonicalControlDirectory, journalEpoch: 1 });
|
|
222
|
+
const key = loadOrCreateEnforcementKey(canonicalControlDirectory);
|
|
223
|
+
const factory = (executionTarget) => new SandboxPolicyFactory({
|
|
224
|
+
capabilities: RESOLVE_ONLY_CAPABILITIES,
|
|
225
|
+
executionTarget,
|
|
226
|
+
baselineBindings: [RESOLVE_ONLY_BASELINE],
|
|
227
|
+
key,
|
|
228
|
+
keyId: "resolve-only-v1",
|
|
229
|
+
resolveOnlyAdapter: {
|
|
230
|
+
prepareResolveOnly: async () => ({
|
|
231
|
+
assurance: "resolve-only-no-sandbox",
|
|
232
|
+
preparationId: crypto.randomUUID(),
|
|
233
|
+
}),
|
|
234
|
+
},
|
|
235
|
+
authorizeResolveOnly: () => this.authority.allowResolveOnly,
|
|
236
|
+
});
|
|
237
|
+
this.#agentFactory = factory("agent");
|
|
238
|
+
this.#scriptFactory = factory("script");
|
|
239
|
+
this.#leaseTimeoutMs = options.leaseTimeoutMs ?? 10_000;
|
|
240
|
+
this.#permitTtlMs = options.permitTtlMs ?? 60_000;
|
|
241
|
+
this.#signal = options.signal;
|
|
242
|
+
this.#allowReconcile = options.allowReconcile === true;
|
|
243
|
+
}
|
|
244
|
+
async initialize() {
|
|
245
|
+
await this.#leases.recoverStale();
|
|
246
|
+
await this.#journal.recoverPending(undefined, {
|
|
247
|
+
isOwnerActive: async (owner) => {
|
|
248
|
+
const active = await this.#leases.list();
|
|
249
|
+
return active.some((lease) => sameExecutionOwner(lease.owner, owner));
|
|
250
|
+
},
|
|
251
|
+
});
|
|
252
|
+
}
|
|
253
|
+
async bindPhase(input) {
|
|
254
|
+
await this.#drainPendingLeaseReleases();
|
|
255
|
+
this.#assertRootIdentity();
|
|
256
|
+
const authorized = this.registry.authorize(this.#grant.grantId, this.authority, "read-write");
|
|
257
|
+
if (!("physicalRoot" in authorized))
|
|
258
|
+
throw new Error(`${authorized.code}: ${authorized.redactedMessage}`);
|
|
259
|
+
const invocationRoot = fs.realpathSync(input.invocationRoot);
|
|
260
|
+
if (!isWithin(this.invocationRoot, invocationRoot)) {
|
|
261
|
+
throw new Error("TFWS_PATH_ESCAPE: nested invocation root escapes the authorized grant");
|
|
262
|
+
}
|
|
263
|
+
const attemptId = crypto.randomUUID();
|
|
264
|
+
const resolved = await this.#resolve(input, invocationRoot, attemptId);
|
|
265
|
+
return new ResolveOnlyPhaseBindingImpl(this, input, resolved);
|
|
266
|
+
}
|
|
267
|
+
async reconcile(input) {
|
|
268
|
+
if (!this.#allowReconcile) {
|
|
269
|
+
throw new Error("TFWS_RECONCILE_NOT_AUTHORIZED: reconciliation requires an explicit trusted host decision");
|
|
270
|
+
}
|
|
271
|
+
if (input.acknowledgement !== WORKSPACE_RECONCILE_ACKNOWLEDGEMENT) {
|
|
272
|
+
throw new Error(`TFWS_RECONCILE_ACK_REQUIRED: acknowledgement must exactly equal '${WORKSPACE_RECONCILE_ACKNOWLEDGEMENT}'`);
|
|
273
|
+
}
|
|
274
|
+
await this.#drainPendingLeaseReleases();
|
|
275
|
+
this.#assertRootIdentity();
|
|
276
|
+
const owner = {
|
|
277
|
+
runId: `workspace-reconcile-${crypto.randomUUID()}`,
|
|
278
|
+
phaseId: "reconcile",
|
|
279
|
+
attemptId: crypto.randomUUID(),
|
|
280
|
+
unitId: "workspace",
|
|
281
|
+
ancestry: [],
|
|
282
|
+
};
|
|
283
|
+
let lease;
|
|
284
|
+
try {
|
|
285
|
+
lease = await this.#leases.acquire([{
|
|
286
|
+
key: {
|
|
287
|
+
resourceDomainId: this.#grant.resourceDomainId,
|
|
288
|
+
canonicalPrefix: this.invocationRoot,
|
|
289
|
+
},
|
|
290
|
+
access: "read-write",
|
|
291
|
+
owner,
|
|
292
|
+
}], {
|
|
293
|
+
timeoutMs: this.#leaseTimeoutMs,
|
|
294
|
+
signal: input.signal ?? this.#signal,
|
|
295
|
+
});
|
|
296
|
+
this.#assertRootIdentity();
|
|
297
|
+
return await this.#journal.reconcileDomain(this.#grant.resourceDomainId, input.reason?.trim() || "operator acknowledged current external workspace state");
|
|
298
|
+
}
|
|
299
|
+
finally {
|
|
300
|
+
if (lease)
|
|
301
|
+
await this.#releaseLeaseBestEffort(lease);
|
|
302
|
+
}
|
|
303
|
+
}
|
|
304
|
+
async #resolve(input, invocationRoot, attemptId) {
|
|
305
|
+
const generation = await this.#journal.getDomainGeneration(this.#grant.resourceDomainId);
|
|
306
|
+
const rootPrefix = path.relative(this.invocationRoot, invocationRoot).split(path.sep).filter(Boolean).join("/");
|
|
307
|
+
const capability = {
|
|
308
|
+
bindingId: this.#grant.bindingId,
|
|
309
|
+
resourceDomainId: this.#grant.resourceDomainId,
|
|
310
|
+
providerInstanceId: "root",
|
|
311
|
+
logicalWorkspaceId: "invocation",
|
|
312
|
+
logicalPrefix: rootPrefix,
|
|
313
|
+
physicalScopeRoot: invocationRoot,
|
|
314
|
+
access: "read-write",
|
|
315
|
+
version: { identityMode: "path-bound", generation, state: "clean" },
|
|
316
|
+
lifetime: { scope: "run", runId: input.runId },
|
|
317
|
+
};
|
|
318
|
+
const ref = {
|
|
319
|
+
workspace: "invocation",
|
|
320
|
+
...(input.argName === undefined ? {} : { subpath: { argPath: input.argName } }),
|
|
321
|
+
access: "read-write",
|
|
322
|
+
intent: "existing-directory",
|
|
323
|
+
maxLifetime: { scope: "phase" },
|
|
324
|
+
};
|
|
325
|
+
const result = resolvePathRef(ref, {
|
|
326
|
+
workspaces: new Map([["invocation", capability]]),
|
|
327
|
+
runId: input.runId,
|
|
328
|
+
phaseId: input.phaseId,
|
|
329
|
+
attemptId,
|
|
330
|
+
}, { definitions: input.argDefinitions, values: input.argValues });
|
|
331
|
+
if (!result.ok)
|
|
332
|
+
throw new Error(`${result.error.code}: ${result.error.redactedMessage}`);
|
|
333
|
+
return result.value;
|
|
334
|
+
}
|
|
335
|
+
async executeMutation(input, boundPath, unitId, target, callSignal, invoke, succeeded) {
|
|
336
|
+
const previous = this.#mutationTail.catch(() => undefined);
|
|
337
|
+
let releaseTurn;
|
|
338
|
+
const turn = new Promise((resolve) => { releaseTurn = resolve; });
|
|
339
|
+
this.#mutationTail = previous.then(() => turn);
|
|
340
|
+
const signals = [this.#signal, callSignal].filter((candidate) => candidate !== undefined);
|
|
341
|
+
const signal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
|
|
342
|
+
try {
|
|
343
|
+
await this.#waitForMutationTurn(previous, signal);
|
|
344
|
+
return await this.#executeMutationNow(input, boundPath, unitId, target, signal, invoke, succeeded);
|
|
345
|
+
}
|
|
346
|
+
finally {
|
|
347
|
+
releaseTurn();
|
|
348
|
+
}
|
|
349
|
+
}
|
|
350
|
+
async #executeMutationNow(input, boundPath, unitId, target, signal, invoke, succeeded) {
|
|
351
|
+
await this.#drainPendingLeaseReleases();
|
|
352
|
+
const owner = {
|
|
353
|
+
runId: input.runId,
|
|
354
|
+
phaseId: input.phaseId,
|
|
355
|
+
attemptId: crypto.randomUUID(),
|
|
356
|
+
unitId,
|
|
357
|
+
ancestry: [],
|
|
358
|
+
};
|
|
359
|
+
let lease;
|
|
360
|
+
let mutation;
|
|
361
|
+
try {
|
|
362
|
+
this.#assertRootIdentity();
|
|
363
|
+
if (signal?.aborted)
|
|
364
|
+
throw new Error("ABORT_ERR: workspace execution was cancelled before lease acquisition");
|
|
365
|
+
const dirty = (await this.#journal.listIntents()).find((intent) => intent.resourceDomainId === this.#grant.resourceDomainId && intent.status === "dirty-unknown");
|
|
366
|
+
if (dirty)
|
|
367
|
+
throw new Error("TFWS_RESOURCE_DIRTY: workspace requires reconciliation before another write");
|
|
368
|
+
lease = await this.#leases.acquire([{
|
|
369
|
+
key: { resourceDomainId: this.#grant.resourceDomainId, canonicalPrefix: boundPath },
|
|
370
|
+
access: "read-write",
|
|
371
|
+
owner,
|
|
372
|
+
}], { timeoutMs: this.#leaseTimeoutMs, signal });
|
|
373
|
+
this.#assertRootIdentity();
|
|
374
|
+
if (signal?.aborted)
|
|
375
|
+
throw new Error("ABORT_ERR: workspace execution was cancelled before mutation preparation");
|
|
376
|
+
const resolved = await this.#resolve(input, fs.realpathSync(input.invocationRoot), owner.attemptId);
|
|
377
|
+
if (resolved.physicalPath !== boundPath) {
|
|
378
|
+
throw new Error("TFWS_IDENTITY_MISMATCH: cwd changed between binding and execution");
|
|
379
|
+
}
|
|
380
|
+
const boundIdentity = readDirectoryIdentity(boundPath);
|
|
381
|
+
const policy = this.#policy(resolved);
|
|
382
|
+
const factory = target === "agent" ? this.#agentFactory : this.#scriptFactory;
|
|
383
|
+
const prepared = await factory.prepareSandbox(policy, owner);
|
|
384
|
+
mutation = await this.#journal.prepare({
|
|
385
|
+
resourceDomainId: this.#grant.resourceDomainId,
|
|
386
|
+
providerInstanceId: "root",
|
|
387
|
+
scopes: [{ canonicalPrefix: boundPath, scopeDigest: crypto.createHash("sha256").update(resolved.capability.logicalPrefix).digest("hex") }],
|
|
388
|
+
owner,
|
|
389
|
+
commitMode: "generation-only",
|
|
390
|
+
externalMutation: "externally-mutable",
|
|
391
|
+
permitTtlMs: this.#permitTtlMs,
|
|
392
|
+
});
|
|
393
|
+
const sealed = factory.sealSandbox(prepared, [mutation.permit]);
|
|
394
|
+
return await factory.activateOnce(sealed, {
|
|
395
|
+
activateMutationPermits: (permits, activationOwner) => this.#journal.activate(permits, activationOwner),
|
|
396
|
+
// Journal terminal WAL methods own best-effort settlement. This hook is
|
|
397
|
+
// intentionally non-throwing so post-commit cleanup cannot turn a
|
|
398
|
+
// successful filesystem mutation into a retryable runner failure.
|
|
399
|
+
settleMutationPermits: async () => undefined,
|
|
400
|
+
}, async () => {
|
|
401
|
+
try {
|
|
402
|
+
const result = await invoke();
|
|
403
|
+
if (signal?.aborted) {
|
|
404
|
+
await this.#journal.markUnknown(mutation.intent.intentId, `${target} execution completed after cancellation; filesystem outcome is not reusable`);
|
|
405
|
+
throw new Error("ABORT_ERR: workspace execution completed after cancellation and was marked dirty");
|
|
406
|
+
}
|
|
407
|
+
if (succeeded(result)) {
|
|
408
|
+
// A runner may replace the invocation root or the selected subtree
|
|
409
|
+
// while it is active. Success is committable only if the exact root
|
|
410
|
+
// identity and canonical bound path still match after the process ends.
|
|
411
|
+
this.#assertRootIdentity();
|
|
412
|
+
const postResolved = await this.#resolve(input, fs.realpathSync(input.invocationRoot), owner.attemptId);
|
|
413
|
+
// Resolve-only cannot make an externally mutable filesystem path and
|
|
414
|
+
// the WAL commit one atomic operation. Bracket the awaited resolver with
|
|
415
|
+
// root identity checks so every observable replacement fails closed;
|
|
416
|
+
// eliminating the remaining external TOCTOU requires a native directory
|
|
417
|
+
// handle/file broker and is outside resolve-only assurance.
|
|
418
|
+
this.#assertRootIdentity();
|
|
419
|
+
if (postResolved.physicalPath !== boundPath) {
|
|
420
|
+
throw new Error("TFWS_IDENTITY_MISMATCH: cwd changed during workspace execution");
|
|
421
|
+
}
|
|
422
|
+
if (signal?.aborted) {
|
|
423
|
+
await this.#journal.markUnknown(mutation.intent.intentId, `${target} execution was cancelled during post-execution validation`);
|
|
424
|
+
throw new Error("ABORT_ERR: workspace execution was cancelled and marked dirty");
|
|
425
|
+
}
|
|
426
|
+
await this.#journal.commitGeneration(mutation.intent.intentId, {
|
|
427
|
+
preCommitGuard: () => {
|
|
428
|
+
if (signal?.aborted) {
|
|
429
|
+
throw new Error("ABORT_ERR: workspace execution was cancelled before commit");
|
|
430
|
+
}
|
|
431
|
+
this.#assertRootIdentity();
|
|
432
|
+
if (!sameDirectoryIdentity(readDirectoryIdentity(boundPath), boundIdentity)) {
|
|
433
|
+
throw new Error("TFWS_IDENTITY_MISMATCH: cwd changed before workspace commit");
|
|
434
|
+
}
|
|
435
|
+
},
|
|
436
|
+
});
|
|
437
|
+
}
|
|
438
|
+
else {
|
|
439
|
+
await this.#journal.markUnknown(mutation.intent.intentId, `${target} execution failed or was aborted`);
|
|
440
|
+
}
|
|
441
|
+
return result;
|
|
442
|
+
}
|
|
443
|
+
catch (error) {
|
|
444
|
+
await this.#markUnknownIfPending(mutation, `${target} execution threw: ${error instanceof Error ? error.message : String(error)}`);
|
|
445
|
+
throw error;
|
|
446
|
+
}
|
|
447
|
+
});
|
|
448
|
+
}
|
|
449
|
+
catch (error) {
|
|
450
|
+
if (mutation)
|
|
451
|
+
await this.#markUnknownIfPending(mutation, `execution preparation failed: ${error instanceof Error ? error.message : String(error)}`);
|
|
452
|
+
if (error instanceof ResolveOnlyExecutionError)
|
|
453
|
+
throw error;
|
|
454
|
+
throw new ResolveOnlyExecutionError(error, mutation !== undefined);
|
|
455
|
+
}
|
|
456
|
+
finally {
|
|
457
|
+
if (lease)
|
|
458
|
+
await this.#releaseLeaseBestEffort(lease);
|
|
459
|
+
}
|
|
460
|
+
}
|
|
461
|
+
async #waitForMutationTurn(previous, signal) {
|
|
462
|
+
if (!signal) {
|
|
463
|
+
await previous;
|
|
464
|
+
return;
|
|
465
|
+
}
|
|
466
|
+
if (signal.aborted)
|
|
467
|
+
throw new ResolveOnlyExecutionError("ABORT_ERR: workspace execution was cancelled while queued", false);
|
|
468
|
+
let onAbort;
|
|
469
|
+
const aborted = new Promise((_resolve, reject) => {
|
|
470
|
+
onAbort = () => reject(new ResolveOnlyExecutionError("ABORT_ERR: workspace execution was cancelled while queued", false));
|
|
471
|
+
signal.addEventListener("abort", onAbort, { once: true });
|
|
472
|
+
});
|
|
473
|
+
try {
|
|
474
|
+
await Promise.race([previous, aborted]);
|
|
475
|
+
}
|
|
476
|
+
finally {
|
|
477
|
+
signal.removeEventListener("abort", onAbort);
|
|
478
|
+
}
|
|
479
|
+
}
|
|
480
|
+
async #releaseLeaseBestEffort(lease) {
|
|
481
|
+
this.#pendingLeaseReleases.add(lease);
|
|
482
|
+
for (let attempt = 0; attempt < 3; attempt++) {
|
|
483
|
+
try {
|
|
484
|
+
await lease.release();
|
|
485
|
+
this.#pendingLeaseReleases.delete(lease);
|
|
486
|
+
return;
|
|
487
|
+
}
|
|
488
|
+
catch {
|
|
489
|
+
// Retry the same authenticated lease handle. A successful mutation must
|
|
490
|
+
// not be reported as failed merely because cleanup storage was briefly
|
|
491
|
+
// unavailable.
|
|
492
|
+
}
|
|
493
|
+
}
|
|
494
|
+
console.warn(`[taskflow] workspace lease cleanup deferred for lease ${lease.leaseId}`);
|
|
495
|
+
}
|
|
496
|
+
async #drainPendingLeaseReleases() {
|
|
497
|
+
for (const lease of [...this.#pendingLeaseReleases]) {
|
|
498
|
+
await this.#releaseLeaseBestEffort(lease);
|
|
499
|
+
}
|
|
500
|
+
if (this.#pendingLeaseReleases.size > 0) {
|
|
501
|
+
throw new Error("TFWS_CONTROL_PLANE_CLEANUP: a prior workspace lease could not be released");
|
|
502
|
+
}
|
|
503
|
+
}
|
|
504
|
+
#assertRootIdentity() {
|
|
505
|
+
let current;
|
|
506
|
+
try {
|
|
507
|
+
current = readDirectoryIdentity(this.invocationRoot);
|
|
508
|
+
}
|
|
509
|
+
catch {
|
|
510
|
+
current = undefined;
|
|
511
|
+
}
|
|
512
|
+
if (!current || !sameDirectoryIdentity(current, this.#rootIdentity)) {
|
|
513
|
+
throw new Error("TFWS_IDENTITY_MISMATCH: invocation root identity changed after workspace authorization");
|
|
514
|
+
}
|
|
515
|
+
}
|
|
516
|
+
#policy(resolved) {
|
|
517
|
+
return createSandboxPolicyPlan({
|
|
518
|
+
mode: "resolve-only",
|
|
519
|
+
cwd: resolved,
|
|
520
|
+
grants: [{
|
|
521
|
+
bindingId: resolved.capability.bindingId,
|
|
522
|
+
resourceDomainId: resolved.capability.resourceDomainId,
|
|
523
|
+
providerInstanceId: resolved.capability.providerInstanceId,
|
|
524
|
+
logicalWorkspaceId: resolved.capability.logicalWorkspaceId,
|
|
525
|
+
logicalPrefix: resolved.capability.logicalPrefix,
|
|
526
|
+
physicalScopeRoot: resolved.capability.physicalScopeRoot,
|
|
527
|
+
scopeKind: "directory",
|
|
528
|
+
access: resolved.capability.access,
|
|
529
|
+
lifetime: resolved.capability.lifetime,
|
|
530
|
+
}],
|
|
531
|
+
baseline: RESOLVE_ONLY_BASELINE,
|
|
532
|
+
credentialRequirements: [],
|
|
533
|
+
}, RESOLVE_ONLY_CAPABILITIES);
|
|
534
|
+
}
|
|
535
|
+
async #markUnknownIfPending(mutation, reason) {
|
|
536
|
+
const current = await this.#journal.getIntent(mutation.intent.intentId);
|
|
537
|
+
if (current?.status === "pending")
|
|
538
|
+
await this.#journal.markUnknown(current.intentId, reason);
|
|
539
|
+
}
|
|
540
|
+
}
|
|
541
|
+
class ResolveOnlyPhaseBindingImpl {
|
|
542
|
+
assurance = "resolve-only-no-sandbox";
|
|
543
|
+
absolutePath;
|
|
544
|
+
logicalPath;
|
|
545
|
+
resourceDomainId;
|
|
546
|
+
runId;
|
|
547
|
+
phaseId;
|
|
548
|
+
#session;
|
|
549
|
+
#input;
|
|
550
|
+
constructor(session, input, resolved) {
|
|
551
|
+
this.#session = session;
|
|
552
|
+
this.#input = input;
|
|
553
|
+
this.absolutePath = resolved.physicalPath;
|
|
554
|
+
this.logicalPath = resolved.capability.logicalPrefix;
|
|
555
|
+
this.resourceDomainId = resolved.capability.resourceDomainId;
|
|
556
|
+
this.runId = input.runId;
|
|
557
|
+
this.phaseId = input.phaseId;
|
|
558
|
+
}
|
|
559
|
+
async runAgent(call) {
|
|
560
|
+
try {
|
|
561
|
+
const result = await this.#session.executeMutation(this.#input, this.absolutePath, call.unitId ?? this.phaseId, "agent", call.opts.signal, call.invoke, agentSucceeded);
|
|
562
|
+
return { ...result, workspaceMutationStarted: true };
|
|
563
|
+
}
|
|
564
|
+
catch (error) {
|
|
565
|
+
return agentFailure(call.agentName, call.task, error);
|
|
566
|
+
}
|
|
567
|
+
}
|
|
568
|
+
runScript(call) {
|
|
569
|
+
return this.#session.executeMutation(this.#input, this.absolutePath, call.unitId ?? this.phaseId, "script", call.signal, call.invoke, scriptSucceeded);
|
|
570
|
+
}
|
|
571
|
+
}
|
|
572
|
+
export async function createResolveOnlyWorkspaceSession(options) {
|
|
573
|
+
const session = new ResolveOnlyWorkspaceSessionImpl(options);
|
|
574
|
+
await session.initialize();
|
|
575
|
+
return session;
|
|
576
|
+
}
|
|
577
|
+
export async function reconcileResolveOnlyWorkspace(options, input) {
|
|
578
|
+
const session = await createResolveOnlyWorkspaceSession(options);
|
|
579
|
+
return session.reconcile(input);
|
|
580
|
+
}
|
|
581
|
+
//# sourceMappingURL=execution.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/resources/execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAA4B,MAAM,gBAAgB,CAAC;AAEzF,OAAO,EACN,kBAAkB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAoB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAqC,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAE5G,OAAO,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AA4DrE,MAAM,CAAC,MAAM,mCAAmC,GAAG,2CAA2C,CAAC;AAC/F,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAEhF,MAAM,UAAU,gCAAgC,CAC/C,KAAK,GAAuB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAErE,OAAO,KAAK,KAAK,UAAU,CAAC;AAC7B,CAAC;AAmBD,MAAM,aAAa,GAA2C;IAC7D,aAAa,EAAE,CAAC;IAChB,QAAQ,EAAE,uBAAuB;IACjC,aAAa,EAAE,GAAG;IAClB,qBAAqB,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;IAC1E,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;IAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,EAAE;IAC7D,OAAO,EAAE,aAAa;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAC;AAE1E,MAAM,qBAAqB,GAAuB,MAAM,CAAC,MAAM,CAAqB;IACnF,aAAa,EAAE,CAAC;IAChB,QAAQ,EAAE,uBAAuB;IACjC,aAAa,EAAE,GAAG;IAClB,UAAU,EAAE,oBAAoB;IAChC,qBAAqB,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;IAC1E,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;IAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,EAAE;IAC7D,OAAO,EAAE,aAAa;CACtB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAiC,MAAM,CAAC,MAAM,CAA+B;IAC3G,aAAa,EAAE,CAAC;IAChB,SAAS,EAAE,uBAAuB;IAClC,wBAAwB,EAAE,GAAG;IAC7B,KAAK,EAAE,cAAc;IACrB,MAAM,EAAE,cAAc;IACtB,eAAe,EAAE;QAChB,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,mBAAmB,EAAE,KAAK;QAC1B,uBAAuB,EAAE,KAAK;QAC9B,qBAAqB,EAAE,KAAK;QAC5B,kBAAkB,EAAE,KAAK;QACzB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,eAAe,EAAE,EAAE;KACnB;IACD,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,KAAK;IACpB,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;IACvC,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,qBAAqB,CAAC,QAAQ;CAChD,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAQD,SAAS,qBAAqB,CAAC,SAAiB;IAC/C,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB,EAAE,KAAwB;IAC/E,OAAO,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,cAAsB;IACtE,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAChD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAiB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9E,OAAO,QAAQ,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC;YACJ,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9E,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAc;IACpE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,IAAI;QACJ,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,UAAU,EAAE;QACnB,UAAU,EAAE,OAAO;QACnB,YAAY,EAAE,OAAO;QACrB,wBAAwB,EAAE,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK;KACpG,CAAC;AACH,CAAC;AAED,MAAM,yBAA0B,SAAQ,KAAK;IACnC,eAAe,CAAU;IAElC,YAAY,KAAc,EAAE,eAAwB;QACnD,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACxC,CAAC;CACD;AAED,SAAS,cAAc,CAAC,MAAiB;IACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;AAC1H,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B;IACvD,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,+BAA+B;IAC3B,SAAS,GAAG,yBAAkC,CAAC;IAC/C,cAAc,CAAS;IACvB,QAAQ,CAAe;IACvB,SAAS,CAAsB;IAC/B,MAAM,CAAY;IAClB,OAAO,CAA6B;IACpC,QAAQ,CAAqB;IAC7B,aAAa,CAAuB;IACpC,cAAc,CAAuB;IACrC,eAAe,CAAS;IACxB,YAAY,CAAS;IACrB,OAAO,CAAe;IACtB,aAAa,CAAoB;IACjC,qBAAqB,GAAG,IAAI,GAAG,EAAe,CAAC;IAC/C,eAAe,CAAU;IAClC,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEjD,YAAY,OAA2C;QACtD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,SAAS,EAAE,CAAC;QACnE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,6BAA6B,CAAC;YAC9C,WAAW;YACX,eAAe,EAAE,CAAC,OAAO,CAAC;YAC1B,gBAAgB,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC;YACjC,OAAO;YACP,SAAS,EAAE,WAAW,SAAS,EAAE;YACjC,gBAAgB,EAAE,UAAU,SAAS,EAAE;YACvC,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,SAAS,EAAE,YAAY;YACvB,iBAAiB,EAAE,CAAC,WAAW,CAAC;YAChC,WAAW,EAAE,cAAc;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,gCAAgC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3G,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,yBAAyB,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,yBAAyB,CAAC,IAAI,QAAQ,CAAC,yBAAyB,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,0BAA0B,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,CAAC,eAAmC,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC;YACjF,YAAY,EAAE,yBAAyB;YACvC,eAAe;YACf,gBAAgB,EAAE,CAAC,qBAAqB,CAAC;YACzC,GAAG;YACH,KAAK,EAAE,iBAAiB;YACxB,kBAAkB,EAAE;gBACnB,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBAChC,SAAS,EAAE,yBAAyB;oBACpC,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE;iBAClC,CAAC;aACF;YACD,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE;YAC7C,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,CAAC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAgC;QAC/C,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,cAAc,IAAI,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAC1G,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACvE,OAAO,IAAI,2BAA2B,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAyC;QACxD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,mCAAmC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACd,oEAAoE,mCAAmC,GAAG,CAC1G,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAmB;YAC7B,KAAK,EAAE,uBAAuB,MAAM,CAAC,UAAU,EAAE,EAAE;YACnD,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,KAA8B,CAAC;QACnC,IAAI,CAAC;YACJ,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACnC,GAAG,EAAE;wBACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;wBAC9C,eAAe,EAAE,IAAI,CAAC,cAAc;qBACpC;oBACD,MAAM,EAAE,YAAY;oBACpB,KAAK;iBACL,CAAC,EAAE;gBACH,SAAS,EAAE,IAAI,CAAC,eAAe;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CACzC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,wDAAwD,CAChF,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAgC,EAAE,cAAsB,EAAE,SAAiB;QACzF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChH,MAAM,UAAU,GAAqB;YACpC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,kBAAkB,EAAE,MAAM;YAC1B,kBAAkB,EAAE,YAAY;YAChC,aAAa,EAAE,UAAU;YACzB,iBAAiB,EAAE,cAAc;YACjC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;YACnE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SAC9C,CAAC;QACF,MAAM,GAAG,GAAG;YACX,SAAS,EAAE,YAAY;YACvB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/E,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,oBAAoB;YAC5B,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC/B,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAC5B,GAAG,EACH;YACC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACjD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS;SACT,EACD,EAAE,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAC9D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,KAAgC,EAChC,SAAiB,EACjB,MAAc,EACd,MAA0B,EAC1B,UAAmC,EACnC,MAAwB,EACxB,SAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,WAAwB,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAA4B,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACV,WAAW,EAAE,CAAC;QACf,CAAC;IACF,CAAC;IAED,KAAK,CAAC,mBAAmB,CACxB,KAAgC,EAChC,SAAiB,EACjB,MAAc,EACd,MAA0B,EAC1B,MAA+B,EAC/B,MAAwB,EACxB,SAAiC;QAEjC,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxC,MAAM,KAAK,GAAmB;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;YAC9B,MAAM;YACN,QAAQ,EAAE,EAAE;SACZ,CAAC;QACF,IAAI,KAA8B,CAAC;QACnC,IAAI,QAAsC,CAAC;QAC3C,IAAI,CAAC;YACJ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjE,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC;YAChG,IAAI,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;YAC1G,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACnC,GAAG,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE;oBACnF,MAAM,EAAE,YAAY;oBACpB,KAAK;iBACL,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;YACjH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7D,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACtC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,kBAAkB,EAAE,MAAM;gBAC1B,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1I,KAAK;gBACL,UAAU,EAAE,iBAAiB;gBAC7B,gBAAgB,EAAE,oBAAoB;gBACtC,WAAW,EAAE,IAAI,CAAC,YAAY;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,OAAO,MAAM,OAAO,CAAC,YAAY,CAChC,MAAM,EACN;gBACC,uBAAuB,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACvG,wEAAwE;gBACxE,kEAAkE;gBAClE,kEAAkE;gBAClE,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;aAC5C,EACD,KAAK,IAAI,EAAE;gBACV,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;oBAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;wBACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,QAAS,CAAC,MAAM,CAAC,QAAQ,EACzB,GAAG,MAAM,6EAA6E,CACtF,CAAC;wBACF,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;oBACrG,CAAC;oBACD,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,mEAAmE;wBACnE,oEAAoE;wBACpE,wEAAwE;wBACxE,IAAI,CAAC,mBAAmB,EAAE,CAAC;wBAC3B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CACvC,KAAK,EACL,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,EACrC,KAAK,CAAC,SAAS,CACf,CAAC;wBACF,qEAAqE;wBACrE,yEAAyE;wBACzE,qEAAqE;wBACrE,wEAAwE;wBACxE,4DAA4D;wBAC5D,IAAI,CAAC,mBAAmB,EAAE,CAAC;wBAC3B,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;4BAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;wBACnF,CAAC;wBACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;4BACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,QAAS,CAAC,MAAM,CAAC,QAAQ,EACzB,GAAG,MAAM,2DAA2D,CACpE,CAAC;4BACF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;wBAClF,CAAC;wBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;4BAC/D,cAAc,EAAE,GAAG,EAAE;gCACpB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oCACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;gCAC/E,CAAC;gCACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;gCAC3B,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;oCAC7E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gCAChF,CAAC;4BACF,CAAC;yBACD,CAAC,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACP,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,kCAAkC,CAAC,CAAC;oBACzG,CAAC;oBACD,OAAO,MAAM,CAAC;gBACf,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAS,EAAE,GAAG,MAAM,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpI,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC,CACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpJ,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,IAAI,yBAAyB,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACV,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAuB,EAAE,MAA+B;QAClF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC;YACf,OAAO;QACR,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;QAC5H,IAAI,OAAoB,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACvD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC,CAAC;YAC1H,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAkB;QAC/C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;gBACtB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzC,OAAO;YACR,CAAC;YAAC,MAAM,CAAC;gBACR,wEAAwE;gBACxE,uEAAuE;gBACvE,eAAe;YAChB,CAAC;QACF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yDAAyD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,0BAA0B;QAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC9F,CAAC;IACF,CAAC;IAED,mBAAmB;QAClB,IAAI,OAAsC,CAAC;QAC3C,IAAI,CAAC;YACJ,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC3G,CAAC;IACF,CAAC;IAED,OAAO,CAAC,QAAyB;QAChC,OAAO,uBAAuB,CAAC;YAC9B,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,CAAC;oBACR,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS;oBACxC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,gBAAgB;oBACtD,kBAAkB,EAAE,QAAQ,CAAC,UAAU,CAAC,kBAAkB;oBAC1D,kBAAkB,EAAE,QAAQ,CAAC,UAAU,CAAC,kBAAkB;oBAC1D,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa;oBAChD,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,iBAAiB;oBACxD,SAAS,EAAE,WAAW;oBACtB,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;oBAClC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ;iBACtC,CAAC;YACF,QAAQ,EAAE,qBAAqB;YAC/B,sBAAsB,EAAE,EAAE;SAC1B,EAAE,yBAAyB,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAA0B,EAAE,MAAc;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9F,CAAC;CACD;AAED,MAAM,2BAA2B;IACvB,SAAS,GAAG,yBAAkC,CAAC;IAC/C,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,gBAAgB,CAAS;IACzB,KAAK,CAAS;IACd,OAAO,CAAS;IAChB,QAAQ,CAAkC;IAC1C,MAAM,CAA4B;IAE3C,YAAY,OAAwC,EAAE,KAAgC,EAAE,QAAyB;QAChH,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAA0B;QACxC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CACjD,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAC3B,OAAO,EACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,IAAI,CAAC,MAAM,EACX,cAAc,CACd,CAAC;YACF,OAAO,EAAE,GAAG,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IAED,SAAS,CAAC,IAA2B;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CACnC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAC3B,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,eAAe,CACf,CAAC;IACH,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,OAA2C;IAE3C,MAAM,OAAO,GAAG,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,OAA2C,EAC3C,KAAyC;IAEzC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
export * from "./authority.ts";
|
|
2
|
+
export * from "./backend.ts";
|
|
3
|
+
export * from "./canonical-json.ts";
|
|
4
|
+
export * from "./errors.ts";
|
|
5
|
+
export * from "./execution.ts";
|
|
6
|
+
export * from "./baseline.ts";
|
|
7
|
+
export * from "./journal.ts";
|
|
8
|
+
export * from "./leases.ts";
|
|
9
|
+
export * from "./permits.ts";
|
|
10
|
+
export * from "./registry.ts";
|
|
11
|
+
export * from "./resolve.ts";
|
|
12
|
+
export * from "./sandbox.ts";
|
|
13
|
+
export * from "./schema.ts";
|
|
14
|
+
export * from "./types.ts";
|
|
15
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
export * from "./authority.js";
|
|
2
|
+
export * from "./backend.js";
|
|
3
|
+
export * from "./canonical-json.js";
|
|
4
|
+
export * from "./errors.js";
|
|
5
|
+
export * from "./execution.js";
|
|
6
|
+
export * from "./baseline.js";
|
|
7
|
+
export * from "./journal.js";
|
|
8
|
+
export * from "./leases.js";
|
|
9
|
+
export * from "./permits.js";
|
|
10
|
+
export * from "./registry.js";
|
|
11
|
+
export * from "./resolve.js";
|
|
12
|
+
export * from "./sandbox.js";
|
|
13
|
+
export * from "./schema.js";
|
|
14
|
+
export * from "./types.js";
|
|
15
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
|