@@ -65,11 +71,25 @@ export async function generateMetadata({
const page = source.getPage(slug, lang);
if (!page) notFound();
+ const suffix = page.slugs.length > 0 ? `${page.slugs.join("/")}/` : "";
+ const localizedUrl = (locale: string) =>
+ `${publicSiteUrl}/${locale}/docs/${suffix}`;
+
return {
title: page.data.title,
description: page.data.description,
+ alternates: {
+ canonical: localizedUrl(lang),
+ languages: {
+ "zh-CN": localizedUrl("cn"),
+ en: localizedUrl("en"),
+ "x-default": localizedUrl("cn"),
+ },
+ },
openGraph: {
- images: getPageImage(page).url,
+ url: localizedUrl(lang),
+ locale: lang === "en" ? "en_US" : "zh_CN",
+ images: `${publicSiteUrl}${getPageImage(page).url}`,
},
};
}
diff --git a/docs-site/app/[lang]/docs/layout.tsx b/docs-site/app/[lang]/docs/layout.tsx
index 98c900a2..607c1357 100644
--- a/docs-site/app/[lang]/docs/layout.tsx
+++ b/docs-site/app/[lang]/docs/layout.tsx
@@ -1,8 +1,8 @@
-import type { ReactNode } from 'react';
-import { source } from '@/lib/source';
-import { DocsLayout } from 'fumadocs-ui/layouts/docs';
-import { baseOptions } from '@/lib/layout.shared';
-import { BookMarked, LayoutGrid, Terminal } from 'lucide-react';
+import { DocsLayout } from "fumadocs-ui/layouts/docs";
+import { BookMarked, LayoutGrid, Terminal } from "lucide-react";
+import type { ReactNode } from "react";
+import { baseOptions } from "@/lib/layout.shared";
+import { source } from "@/lib/source";
export default async function Layout({
params,
@@ -12,25 +12,25 @@ export default async function Layout({
children: ReactNode;
}) {
const { lang } = await params;
- const zh = lang === 'cn';
+ const zh = lang === "cn";
- // Root dropdown (sidebar RootToggle): Framework / CLI / Reference.
+ // Root dropdown (sidebar RootToggle): user journey / CLI / reference.
const tabs = [
{
- title: zh ? '框架' : 'Framework',
- description: zh ? 'SDK 与核心概念' : 'SDK & core concepts',
+ title: zh ? "开发指南" : "Development",
+ description: zh ? "从入门到部署" : "From quickstart to deployment",
url: `/${lang}/docs/framework`,
icon:
,
},
{
- title: zh ? '命令行工具' : 'CLI',
- description: zh ? '命令行参考' : 'Command-line reference',
+ title: zh ? "命令行工具" : "CLI",
+ description: zh ? "命令行参考" : "Command-line reference",
url: `/${lang}/docs/cli`,
icon:
,
},
{
- title: zh ? '参考' : 'Reference',
- description: zh ? 'API · 贡献 · 许可' : 'API · Contributing · License',
+ title: zh ? "参考" : "Reference",
+ description: zh ? "API · 贡献 · 许可" : "API · Contributing · License",
url: `/${lang}/docs/references`,
icon:
,
},
diff --git a/docs-site/app/[lang]/layout.tsx b/docs-site/app/[lang]/layout.tsx
index b9183110..525c6bf5 100644
--- a/docs-site/app/[lang]/layout.tsx
+++ b/docs-site/app/[lang]/layout.tsx
@@ -1,15 +1,36 @@
-import type { ReactNode } from 'react';
-import { RootProvider } from 'fumadocs-ui/provider/next';
-import { i18nProvider } from 'fumadocs-ui/i18n';
-import SearchDialog from '@/components/search';
-import { i18n } from '@/lib/i18n';
-import { translations } from '@/lib/i18n-ui';
-import { HtmlLang } from '@/components/html-lang';
+import { i18nProvider } from "fumadocs-ui/i18n";
+import { RootProvider } from "fumadocs-ui/provider/next";
+import type { Metadata } from "next";
+import type { ReactNode } from "react";
+import SearchDialog from "@/components/search";
+import { i18n } from "@/lib/i18n";
+import { translations } from "@/lib/i18n-ui";
+import { publicSiteUrl } from "@/lib/shared";
+import "../global.css";
export function generateStaticParams() {
return i18n.languages.map((lang) => ({ lang }));
}
+export async function generateMetadata({
+ params,
+}: {
+ params: Promise<{ lang: string }>;
+}): Promise
{
+ const { lang } = await params;
+ return {
+ metadataBase: new URL(`${publicSiteUrl}/`),
+ alternates: {
+ canonical: `${publicSiteUrl}/${lang}/`,
+ languages: {
+ "zh-CN": `${publicSiteUrl}/cn/`,
+ en: `${publicSiteUrl}/en/`,
+ "x-default": `${publicSiteUrl}/cn/`,
+ },
+ },
+ };
+}
+
export default async function LangLayout({
params,
children,
@@ -18,11 +39,18 @@ export default async function LangLayout({
children: ReactNode;
}) {
const { lang } = await params;
+ const htmlLanguage = lang === "en" ? "en" : "zh-CN";
return (
-
-
+
+
+
+ {children}
+
+
+
);
}
diff --git a/docs-site/app/layout.tsx b/docs-site/app/layout.tsx
deleted file mode 100644
index 003da0b2..00000000
--- a/docs-site/app/layout.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { ReactNode } from 'react';
-import './global.css';
-
-// Root layout. The locale-aware provider lives in `app/[lang]/layout.tsx`.
-export default function RootLayout({ children }: { children: ReactNode }) {
- return (
-
- {children}
-
- );
-}
diff --git a/docs-site/components/html-lang.tsx b/docs-site/components/html-lang.tsx
deleted file mode 100644
index 70ff99ba..00000000
--- a/docs-site/components/html-lang.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-'use client';
-
-import { useEffect } from 'react';
-
-/** Keeps in sync with the active locale (root layout is static). */
-export function HtmlLang({ lang }: { lang: string }) {
- useEffect(() => {
- document.documentElement.lang = lang;
- }, [lang]);
-
- return null;
-}
diff --git a/docs-site/content/docs/cli/index.en.mdx b/docs-site/content/docs/cli/index.en.mdx
index b18ddacb..a35cf7e6 100644
--- a/docs-site/content/docs/cli/index.en.mdx
+++ b/docs-site/content/docs/cli/index.en.mdx
@@ -74,7 +74,7 @@ frameworks that can run locally without internal infrastructure.
`agentengine init --framework codex` creates only `agentengine.yaml`, `.env`,
`requirements.txt`, and a README; it does not create `agent.py`. Its
`artifact_type` is `ManagedRuntime`: native Codex runs locally and the server
-selects the cloud Runtime image. See [Codex Managed Runtime](../framework/guides/managed-runtime).
+selects the cloud Runtime image. See [Codex Managed Runtime](../framework/guides/managed-runtime.mdx).
@@ -158,7 +158,7 @@ source. `make build-wheel` and `make public-build-check` validate and package
the reviewed static payload.
For the full workflow from starting a workspace through creating, building, and
-testing an Agent, see [AgentKit Local Studio (New in 0.8.1)](/en/docs/framework/guides/agentkit-local-studio).
+testing an Agent, see [AgentKit Local Studio](/en/docs/framework/guides/agentkit-local-studio).
### `ksadk replay` / `agentengine replay`
@@ -170,7 +170,7 @@ ksadk replay session_123 --after-seq-id 120 --format json
agentengine replay session_123 --before-seq-id 260
```
-The command only reads sessions that persist RuntimeEvent v1; it does not convert legacy SessionEvent records. `--after-seq-id` is exclusive and `--before-seq-id` is an exclusive upper bound, so use both to narrow an investigation window.
+The command only reads sessions persisted through the canonical RuntimeEvent v2 store; it does not silently convert legacy SessionEvent rows into new canonical facts. `--after-seq-id` is exclusive and `--before-seq-id` is an exclusive upper bound, so use both to narrow an investigation window.
## Protocol And Integration
@@ -253,7 +253,7 @@ Sensitive credentials, including secrets passed with `--env`, are redacted from
The `--env-file` you pass is for explicit runtime env injection. Real `.env`
/ `.env.local` files are excluded from Code, Container, and MCP build
contexts; only `.env.example` / `.env.sample` / `.env.template` templates are
- kept. See [Environment Variables Reference](../references/environment-variables).
+ kept. See [Environment Variables Reference](../references/environment-variables.mdx).
### Default observability and explicit opt-out
@@ -272,7 +272,7 @@ agentengine launch . --target serverless --no-observability
agentengine hermes deploy --name my-hermes --no-observability
```
-Disabling observability clears the managed OTLP endpoints, headers, and protocols. Do not use `--env` to override platform-managed observability variables. See the [Environment Variables Reference](../references/environment-variables) for the protocol contract.
+Disabling observability clears the managed OTLP endpoints, headers, and protocols. Do not use `--env` to override platform-managed observability variables. See the [Environment Variables Reference](../references/environment-variables.mdx) for the protocol contract.
### `agentengine hermes`
@@ -330,7 +330,7 @@ Memory backend options (0.6.7):
The `--memory-system` CLI option only exposes `openclaw_default` and `mem0`.
The `lancedb` backend must be declared via a `MEMORY_BACKEND_MANIFEST` on the
runtime side, not through CLI flags; see
- [Environment Variables Reference](../references/environment-variables).
+ [Environment Variables Reference](../references/environment-variables.mdx).
diff --git a/docs-site/content/docs/cli/index.mdx b/docs-site/content/docs/cli/index.mdx
index 61a0171d..48ec2d79 100644
--- a/docs-site/content/docs/cli/index.mdx
+++ b/docs-site/content/docs/cli/index.mdx
@@ -73,7 +73,7 @@ agentengine init my-agent --from-agent ./existing_agent.py
`agentengine init --framework codex` 只生成 `agentengine.yaml`、`.env`、
`requirements.txt` 和 README，不生成 `agent.py`。它的 `artifact_type` 是
`ManagedRuntime`；本机运行原生 Codex 子进程，云端由服务端选择 Runtime 镜像。详见
-[Codex Managed Runtime](../framework/guides/managed-runtime)。
+[Codex Managed Runtime](../framework/guides/managed-runtime.mdx)。
@@ -151,7 +151,7 @@ Studio 的 React / TypeScript 可编辑源码；`make build-wheel` 和 `make pub
会校验并打包经过审计的静态产物。
从启动工作区到创建、构建和测试 Agent 的完整流程见
-[AgentKit Local Studio（0.8.1 新增）](/cn/docs/framework/guides/agentkit-local-studio)。
+[AgentKit Local Studio](/cn/docs/framework/guides/agentkit-local-studio)。
### `ksadk replay` / `agentengine replay`
@@ -164,7 +164,7 @@ ksadk replay session_123 --after-seq-id 120 --format json
agentengine replay session_123 --before-seq-id 260
```
-只有 RuntimeEvent v1 已持久化的 session 可被这个命令读取；旧式 SessionEvent 不会自动转换。
+只有通过 canonical RuntimeEvent v2 store 持久化的 session 可被这个命令读取；旧式 SessionEvent 不会被静默转换成新的 canonical 事实。
`--after-seq-id` 是开区间，`--before-seq-id` 是不含上界，可用二者缩小诊断窗口。
## 协议和集成
@@ -243,7 +243,7 @@ agentengine launch . --env KEY=VALUE --env-file ./runtime.env
传入的 `--env-file` 用于显式注入运行时 env。真实的 `.env` / `.env.local`
不会进入 Code、Container 或 MCP 构建上下文，构建只保留 `.env.example` /
`.env.sample` / `.env.template` 模板文件。详见
- [环境变量参考](../references/environment-variables)。
+ [环境变量参考](../references/environment-variables.mdx)。
### 默认可观测性与显式关闭
@@ -262,7 +262,7 @@ agentengine launch . --target serverless --no-observability
agentengine hermes deploy --name my-hermes --no-observability
```
-关闭后平台会清理托管 OTLP endpoint、headers 和 protocol；不要用 `--env` 覆盖平台托管的可观测变量。环境变量协议见[环境变量参考](../references/environment-variables)。
+关闭后平台会清理托管 OTLP endpoint、headers 和 protocol；不要用 `--env` 覆盖平台托管的可观测变量。环境变量协议见[环境变量参考](../references/environment-variables.mdx)。
### `agentengine hermes`
@@ -316,7 +316,7 @@ agentengine openclaw --help
`--memory-system` CLI 选项只暴露 `openclaw_default` 与 `mem0`。`lancedb`
后端需要通过 `MEMORY_BACKEND_MANIFEST` 在运行时侧声明 manifest，不走 CLI
参数；详见
- [环境变量参考](../references/environment-variables)。
+ [环境变量参考](../references/environment-variables.mdx)。
diff --git a/docs-site/content/docs/cli/meta.en.json b/docs-site/content/docs/cli/meta.en.json
new file mode 100644
index 00000000..b2f37798
--- /dev/null
+++ b/docs-site/content/docs/cli/meta.en.json
@@ -0,0 +1,6 @@
+{
+ "title": "Command Line",
+ "icon": "Terminal",
+ "root": true,
+ "pages": ["index"]
+}
diff --git a/docs-site/content/docs/framework/getting-started/architecture.en.mdx b/docs-site/content/docs/framework/getting-started/architecture.en.mdx
index 836ee6ee..53b3cc75 100644
--- a/docs-site/content/docs/framework/getting-started/architecture.en.mdx
+++ b/docs-site/content/docs/framework/getting-started/architecture.en.mdx
@@ -2,55 +2,51 @@
title: Architecture
---
-KsADK's public architecture is an **Agent Runtime Platform** layer. You keep building business agents with your chosen framework, while KsADK unifies runtime, debugging, protocols, tools, sandboxing, deployment, and observability.
+KsADK provides runtime capabilities for Agents. Agent Kernel centralizes concurrency, recovery, and state consistency. Harness owns unified control and lifecycle, while pluggable Providers connect different execution kernels. Native framework semantics remain inside each Provider, and APIs, Studio, and hosted surfaces share one event fact chain.
-
+
-## Overview
+## Architecture Flow
-The diagram above shows KsADK's three-layer architecture: business Agent frameworks (user-provided) → KsADK Runtime data plane (core) → hosted control plane. KsADK layers runtime, debugging, protocols, tools, sandbox, deployment, and observability on top of your chosen Agent framework, while business logic stays in your framework code.
-
-
- KsADK owns "how the agent runs", not "what it does". Agent logic, prompts, and domain tools stay in your framework code; runtime, sessions, tool protocols, deployment, and observability are handled by KsADK.
+| Layer | Core responsibility |
+| --- | --- |
+| Access | SDK, CLI, Studio, standard APIs, A2A, and automated tasks |
+| Trusted kernel | admission, leases and fencing, concurrency and backpressure, cancel and resume, and state consistency |
+| Harness and plugins | load a composition, select one Provider, and own the Activation lifecycle |
+| Shared capabilities | inject context, tools, safety, MCP, Skill, sandbox, memory, and observability through a capability bus |
+| Events and presentation | adapt native Provider events to RuntimeEvent v2, persist them, and project them to each surface |
+
+
+ Agent Kernel decides whether a run can execute safely. Harness decides how the run is assembled and hosted. The Provider decides how its framework executes. Keeping these responsibilities separate prevents one Agent framework from becoming platform control logic.
-## Main Boundaries
+## Harness and Plugins
-| Layer | Responsibility |
+A plugin composition describes what an activation loads. PluginHost discovers, validates, stages, health-checks, switches, and disposes the selected graph. Each Activation selects exactly one Agent Provider and receives an isolated execution context.
+
+| Component | Ownership |
| --- | --- |
-| Agent frameworks | business orchestration, state, tool calls, and model interaction |
-| KsADK CLI | project creation, config loading, local runs, Web UI startup, packaging |
-| Runner | adapt ADK, LangGraph, LangChain, and DeepAgents to one invocation contract |
-| Local server | expose `/v1/responses`, `/v1/chat/completions`, and local Web UI APIs |
-| Toolsets | provide Skill, Workspace, Platform, and Sandbox tool entrypoints |
-| AgentEngine / Hermes / OpenClaw | remote runtime, deployment, and fuller backend execution |
-| OpenTelemetry | standard tracing output for external observability systems |
-
-## Local Runtime Path
-
-The flow when you run `agentengine run` or `agentengine web`:
-
-
- 1. The CLI resolves the project directory, `.env`, and `agentengine.yaml`.
- 2. Framework detection identifies ADK, LangGraph, LangChain, or DeepAgents.
- 3. The runner factory creates the matching runner.
- 4. The runner loads the user agent.
- 5. The terminal, Web UI, or OpenAI-Compatible API invokes the runner.
- 6. Sessions, attachments, workspace files, tool calls, and tracing use the KsADK runtime path.
-
+| PluginHost | plugin graph, permission admission, health checks, atomic switching, and lifecycle |
+| Harness | control entry, tool access, session continuity, context, and event output |
+| Provider | native framework execution, private thread or checkpoint state, and native event semantics |
+| Capability plugins | composable Session, Memory, Context, Renderer, MCP, and Skill capabilities |
+
+This boundary lets Codex, KsADK Harness, DSH / Cordis, and SubagentProvider share one host contract while preserving their execution models.
+
+## Event Fact Chain
+
+Framework adapters preserve source, scope, and item identity before converting Provider events to `RuntimeEvent v2`. Events are written to the SessionEvent log, then projected into streaming responses, aggregate results, and resumable views.
- Sessions, attachments, workspace, and tracing all flow through the same KsADK runtime path — local and remote behavior match, so you can debug locally and migrate to the hosted runtime seamlessly.
+ APIs, Studio, and hosted surfaces consume the same projections instead of parsing framework-private streams independently. Live output, persisted replay, and final results therefore stay consistent.
-## Why This Architecture Matters
+## SDK and Platform Boundary
-The boundary lets teams keep their preferred agent frameworks while sharing:
+| Inside the KsADK runtime | Connected through external contracts |
+| --- | --- |
+| SDK, CLI, Server, Agent Kernel, Harness, plugin host, Providers, events, and sessions | AgentEngine control plane, model and A2A services, Skill and Sandbox services, and OTLP backends |
-- one local command surface.
-- one browser debugging experience.
-- one OpenAI-Compatible API surface.
-- one Skill / Workspace / Sandbox tool model.
-- one deployment and observability path.
+KsADK does not rebuild a complete control platform inside the SDK. Registration, remote lifecycle, gateway governance, and external service resources remain platform responsibilities exposed through explicit contracts.
-For lower-level implementation details, see [Runtime Architecture](../guides/runtime-architecture).
+For implementation details, see [Runtime Architecture](../guides/runtime-architecture.mdx). For plugin, Provider, and scheduled-task configuration, see [Plugins and Automations](../guides/plugins-and-automations.mdx).
diff --git a/docs-site/content/docs/framework/getting-started/architecture.mdx b/docs-site/content/docs/framework/getting-started/architecture.mdx
index ce79af38..86168262 100644
--- a/docs-site/content/docs/framework/getting-started/architecture.mdx
+++ b/docs-site/content/docs/framework/getting-started/architecture.mdx
@@ -2,55 +2,51 @@
title: 架构
---
-KsADK 的公开架构是一层 **Agent Runtime Platform**：业务 Agent 仍由你选择的框架编写，KsADK 统一负责运行、调试、协议、工具、沙箱、部署与观测。
+KsADK 提供 Agent 的运行时能力。它以 Agent Kernel 收口并发、恢复和状态一致性，以 Harness 承载统一控制与生命周期，再通过可插拔 Provider 接入不同执行内核。框架原生语义保留在 Provider 内，API、Studio 与托管界面共享同一条事件事实链。
-
+
-## 总览
+## 架构主线
-上图展示 KsADK 的三层架构:业务 Agent 框架(用户自带)→ KsADK Runtime 数据面(核心)→ 托管控制面。KsADK 在框架之上补齐运行、调试、协议、工具、沙箱、部署与观测,业务逻辑仍留在你选择的 Agent 框架里。
-
-
- KsADK 只接管"怎么跑"，不接管"做什么"。Agent 的业务逻辑、prompt、domain tools 留在你的框架代码里；运行时、会话、工具协议、部署、观测由 KsADK 统一处理。
+| 层 | 核心责任 |
+| --- | --- |
+| 使用入口 | 汇聚 SDK、CLI、Studio、标准 API、A2A 与自动任务 |
+| 可信内核 | 执行准入、租约与防旧写、并发背压、取消恢复和状态一致性 |
+| Harness 与插件 | 装载插件组合，选择一个 Provider，管理本次 Activation 的生命周期 |
+| 共用能力 | 通过能力总线注入上下文、工具、安全、MCP、Skill、沙箱、记忆与可观测性 |
+| 事件与呈现 | 将 Provider 原生事件适配为 RuntimeEvent v2，持久化后投影到不同界面 |
+
+
+ Agent Kernel 决定一次运行是否可以安全执行；Harness 决定如何装配和托管；Provider 决定具体框架如何运行。三者职责分离，避免把某个 Agent 框架的特性固化到平台控制层。
-## 核心边界
+## Harness 与插件化
-| 层 | 责任 |
+插件组合描述“本次运行装入什么”，PluginHost 负责发现、校验、装载、健康检查、切换和回收。每次 Activation 只选择一个 Agent Provider，并创建隔离的执行上下文。
+
+| 组件 | 所有权 |
| --- | --- |
-| Agent 框架 | 编排业务逻辑、状态、工具调用和模型交互 |
-| KsADK CLI | 创建项目、加载配置、本地运行、Web UI 启动和打包 |
-| Runner | 把 ADK、LangGraph、LangChain、DeepAgents 适配到统一调用接口 |
-| 本地 Server | 暴露 `/v1/responses`、`/v1/chat/completions` 和本地 Web UI API |
-| Toolsets | 提供 Skill、Workspace、Platform、Sandbox 等工具入口 |
-| AgentEngine / Hermes / OpenClaw | 承接远端运行、部署和更完整的 runtime backend |
-| OpenTelemetry | 输出标准 tracing，接入外部观测系统 |
-
-## 本地运行路径
-
-执行 `agentengine run` 或 `agentengine web` 时的处理流程：
-
-
- 1. CLI 解析项目目录、`.env` 和 `agentengine.yaml`。
- 2. 框架检测器识别 ADK、LangGraph、LangChain 或 DeepAgents。
- 3. Runner Factory 创建对应 Runner。
- 4. Runner 加载用户 Agent。
- 5. 本地终端、Web UI 或 OpenAI-Compatible API 调用 Runner。
- 6. 会话、附件、workspace 文件、工具调用和 tracing 由 KsADK 统一处理。
-
+| PluginHost | 插件图、权限准入、健康检查、原子切换和生命周期 |
+| Harness | 控制入口、工具接入、会话连续性、上下文与事件出口 |
+| Provider | 框架原生执行、线程或 checkpoint 等私有状态、原生事件语义 |
+| 能力插件 | Session、Memory、Context、Renderer、MCP、Skill 等可组合能力 |
+
+这种边界允许 Codex、KsADK Harness、DSH / Cordis 与 SubagentProvider 共用一套宿主契约，同时保留各自的执行模型。
+
+## 事件事实链
+
+Provider 事件先由框架适配器保留来源、作用域和 item 身份，再转换为 `RuntimeEvent v2`。事件写入 SessionEvent 日志后，由投影层生成流式响应、聚合结果与断点续传视图。
- 会话、附件、workspace 与 tracing 都走同一条 KsADK 运行时路径——本地与远端行为一致，方便本地调试后无缝迁移到托管 runtime。
+ API、Studio 和托管界面消费统一投影，不分别解析各框架的私有事件流。这使实时输出、持久化回放和最终结果保持一致。
-## 为什么这个架构重要
+## SDK 与平台边界
-这层边界让团队可以保留各自熟悉的 Agent 框架，同时共享：
+| KsADK 运行时内 | 通过外部契约连接 |
+| --- | --- |
+| SDK、CLI、Server、Agent Kernel、Harness、插件宿主、Provider、事件与会话 | AgentEngine 控制面、模型与 A2A 服务、Skill 与 Sandbox 服务、OTLP 后端 |
-- 同一套本地命令。
-- 同一套浏览器调试体验。
-- 同一套 OpenAI-Compatible API。
-- 同一套 Skill / Workspace / Sandbox 工具模型。
-- 同一套部署和观测入口。
+KsADK 不在 SDK 内重复建设完整控制平台。注册、远端生命周期、网关治理和外部服务资源由平台负责，运行时通过明确契约调用。
-更详细的内部本地运行时实现见 [运行时架构](../guides/runtime-architecture)。
+实现细节见 [运行时架构](../guides/runtime-architecture.mdx)；插件、Provider 与自动任务的配置方式见 [插件与自动任务](../guides/plugins-and-automations.mdx)。
diff --git a/docs-site/content/docs/framework/getting-started/comparison.en.mdx b/docs-site/content/docs/framework/getting-started/comparison.en.mdx
index 84743af1..2b5dc62d 100644
--- a/docs-site/content/docs/framework/getting-started/comparison.en.mdx
+++ b/docs-site/content/docs/framework/getting-started/comparison.en.mdx
@@ -44,6 +44,6 @@ boundaries instead of flattening real capabilities into vague yes/no cells.
## Continue Reading
-- [Why KsADK](./why-ksadk)
-- [Architecture](./architecture)
-- [Quick Start](./quickstart)
+- [Why KsADK](./why-ksadk.mdx)
+- [Architecture](./architecture.mdx)
+- [Quick Start](./quickstart.mdx)
diff --git a/docs-site/content/docs/framework/getting-started/comparison.mdx b/docs-site/content/docs/framework/getting-started/comparison.mdx
index 384e6fc1..1ff3a87f 100644
--- a/docs-site/content/docs/framework/getting-started/comparison.mdx
+++ b/docs-site/content/docs/framework/getting-started/comparison.mdx
@@ -42,6 +42,6 @@ KsADK 的核心定位是：在这些框架之上补一层统一运行时平台
## 继续阅读
-- [为什么需要 KsADK](./why-ksadk)
-- [架构](./architecture)
-- [快速开始](./quickstart)
+- [为什么需要 KsADK](./why-ksadk.mdx)
+- [架构](./architecture.mdx)
+- [快速开始](./quickstart.mdx)
diff --git a/docs-site/content/docs/framework/getting-started/configuration.en.mdx b/docs-site/content/docs/framework/getting-started/configuration.en.mdx
index 818f551e..84ed55fb 100644
--- a/docs-site/content/docs/framework/getting-started/configuration.en.mdx
+++ b/docs-site/content/docs/framework/getting-started/configuration.en.mdx
@@ -72,7 +72,7 @@ errors are not swallowed.
For the full variable list and 0.6.7 reasoning / thinking-disable injection
semantics, see
-[Environment variables reference - Unified model policy and fallback](../../references/environment-variables).
+[Environment variables reference - Unified model policy and fallback](../../references/environment-variables.mdx).
## Project Configuration
diff --git a/docs-site/content/docs/framework/getting-started/configuration.mdx b/docs-site/content/docs/framework/getting-started/configuration.mdx
index dbeed08c..91c02972 100644
--- a/docs-site/content/docs/framework/getting-started/configuration.mdx
+++ b/docs-site/content/docs/framework/getting-started/configuration.mdx
@@ -62,7 +62,7 @@ Hermes、OpenClaw 和通用 Agent 共用同一套默认 primary / multimodal / f
业务错误和 tool 错误不会被吞掉。
完整变量列表与 0.6.7 reasoning / thinking disable 注入语义见
-[环境变量参考 - 统一模型策略与 fallback](../../references/environment-variables)。
+[环境变量参考 - 统一模型策略与 fallback](../../references/environment-variables.mdx)。
## 项目配置
diff --git a/docs-site/content/docs/framework/getting-started/meta.en.json b/docs-site/content/docs/framework/getting-started/meta.en.json
new file mode 100644
index 00000000..fd0a96c0
--- /dev/null
+++ b/docs-site/content/docs/framework/getting-started/meta.en.json
@@ -0,0 +1,13 @@
+{
+ "title": "Getting Started",
+ "pages": [
+ "index",
+ "quickstart",
+ "configuration",
+ "project-structure",
+ "why-ksadk",
+ "concepts",
+ "architecture",
+ "comparison"
+ ]
+}
diff --git a/docs-site/content/docs/framework/getting-started/meta.json b/docs-site/content/docs/framework/getting-started/meta.json
index 41afd911..b457ec0c 100644
--- a/docs-site/content/docs/framework/getting-started/meta.json
+++ b/docs-site/content/docs/framework/getting-started/meta.json
@@ -2,12 +2,12 @@
"title": "入门",
"pages": [
"index",
- "why-ksadk",
- "architecture",
- "comparison",
- "concepts",
"quickstart",
"configuration",
- "project-structure"
+ "project-structure",
+ "why-ksadk",
+ "concepts",
+ "architecture",
+ "comparison"
]
}
diff --git a/docs-site/content/docs/framework/getting-started/quickstart.en.mdx b/docs-site/content/docs/framework/getting-started/quickstart.en.mdx
index 8b28507b..4ed31fc6 100644
--- a/docs-site/content/docs/framework/getting-started/quickstart.en.mdx
+++ b/docs-site/content/docs/framework/getting-started/quickstart.en.mdx
@@ -67,7 +67,7 @@ cd my-agent
```
The generated project contains an agent entry file and a project configuration
-file. See [Project Structure](./project-structure) for details.
+file. See [Project Structure](./project-structure.mdx) for details.
Expected files:
@@ -142,7 +142,7 @@ What can this agent do?
```
If the model provider is reachable, the CLI should stream or print a response.
-If it fails, check [Troubleshooting](../../references/troubleshooting#model-calls-fail).
+If it fails, check [Troubleshooting](../../references/troubleshooting.mdx#model-calls-fail).
## Start The Local Web UI
@@ -217,10 +217,10 @@ You now have:
## Next Steps
-- Build a complete example in [Build A LangGraph Agent](../tutorials/langgraph-agent).
-- Wrap an existing project in [Bring An Existing Agent](../tutorials/existing-agent).
-- Configure more settings in [Configuration](./configuration).
-- Learn framework conventions in [Frameworks](../guides/frameworks).
-- Publish a validated project in [Deploy to Kingsoft Cloud](../guides/cloud-deployment).
-- Debug with the [Local Web UI](../guides/local-web-ui).
+- Build a complete example in [Build A LangGraph Agent](../tutorials/langgraph-agent.mdx).
+- Wrap an existing project in [Bring An Existing Agent](../tutorials/existing-agent.mdx).
+- Configure more settings in [Configuration](./configuration.mdx).
+- Learn framework conventions in [Frameworks](../guides/frameworks.mdx).
+- Publish a validated project in [Deploy to Kingsoft Cloud](../guides/cloud-deployment.mdx).
+- Debug with the [Local Web UI](../guides/local-web-ui.mdx).
- Check commands in the [CLI Reference](/en/docs/cli).
diff --git a/docs-site/content/docs/framework/getting-started/quickstart.mdx b/docs-site/content/docs/framework/getting-started/quickstart.mdx
index 74c3ccfd..e8149c07 100644
--- a/docs-site/content/docs/framework/getting-started/quickstart.mdx
+++ b/docs-site/content/docs/framework/getting-started/quickstart.mdx
@@ -63,7 +63,7 @@ cd my-agent
```
生成项目会包含 Agent 入口文件和项目配置文件。更多细节见
-[项目结构](./project-structure)。
+[项目结构](./project-structure.mdx)。
预期文件：
@@ -139,7 +139,7 @@ What can this agent do?
```
如果模型 provider 可访问，CLI 会流式输出或打印响应。失败时看
-[故障排查](../../references/troubleshooting)。
+[故障排查](../../references/troubleshooting.mdx)。
## 启动本地 Web UI
@@ -202,8 +202,8 @@ rm -rf .agentengine/
## 下一步
-- 阅读 [配置项](./configuration)，理解 `.env`、YAML 和 CLI 覆盖顺序。
-- 阅读 [运行时架构](../guides/runtime-architecture)，理解请求如何进入 Runner。
-- 阅读 [部署到金山云](../guides/cloud-deployment)，把已验证的项目发布为托管 Agent。
-- 阅读 [OpenAI 兼容 API](../../references/openai-compatible-api)，把本地 Agent 接到客户端。
-- 阅读 [本地 Web UI](../guides/local-web-ui)，了解会话、上传和工作区预览。
+- 阅读 [配置项](./configuration.mdx)，理解 `.env`、YAML 和 CLI 覆盖顺序。
+- 阅读 [运行时架构](../guides/runtime-architecture.mdx)，理解请求如何进入 Runner。
+- 阅读 [部署到金山云](../guides/cloud-deployment.mdx)，把已验证的项目发布为托管 Agent。
+- 阅读 [OpenAI 兼容 API](../../references/openai-compatible-api.mdx)，把本地 Agent 接到客户端。
+- 阅读 [本地 Web UI](../guides/local-web-ui.mdx)，了解会话、上传和工作区预览。
diff --git a/docs-site/content/docs/framework/guides/a2a-runtime.en.mdx b/docs-site/content/docs/framework/guides/a2a-runtime.en.mdx
index 04539865..b24b63aa 100644
--- a/docs-site/content/docs/framework/guides/a2a-runtime.en.mdx
+++ b/docs-site/content/docs/framework/guides/a2a-runtime.en.mdx
@@ -10,14 +10,12 @@ application simply by setting an environment variable or creating an HTTP client
## Protocol compatibility and Agent Card
-Because `0.8.0` is still a release candidate, its A2A target contract is
-[`a2aproject/A2A`'s `main/docs/specification.md`](https://github.com/a2aproject/A2A/blob/main/docs/specification.md).
-That document makes `specification/a2a.proto` in the same repository the
-normative source of the data model. KsADK pins `a2a-sdk==1.1.0`; its protobuf
-fields for `AgentCard`, `AgentInterface`, `AgentCapabilities`, and
-`SecurityRequirement` match the current main definitions. If upstream main
-changes before release, we must first upgrade the SDK or adapt the implementation
-and update the contract test—not merely change these docs.
+KsADK 0.8.3 fixes its A2A wire contract at A2A 1.0 and pins
+`a2a-sdk==1.1.0` exactly. `AgentCard`, `AgentInterface`,
+`AgentCapabilities`, and `SecurityRequirement` use the protobuf types supplied
+by that SDK. Compatibility is governed by the pinned dependency and repository
+contract tests, not a floating upstream `main`. A protocol upgrade must update
+the SDK, implementation, and contract tests together—not merely these docs.
This is not a KsADK JSON dialect. Each `supportedInterfaces[]` entry uses `url`,
`protocolBinding`, and `protocolVersion`, and discovery uses
@@ -67,9 +65,9 @@ those fields when it has no real values to declare.
}
```
-The current main schema has the following core fields and KsADK behavior:
+The pinned `a2a-sdk==1.1.0` Card schema has the following core fields and KsADK behavior:
-| main-schema field | KsADK behavior |
+| A2A 1.0 field | KsADK behavior |
| --- | --- |
| `name`, `description`, `version` | Produced from `a2a card` arguments or project detection |
| `supportedInterfaces` | Declares JSON-RPC then HTTP+JSON, each at protocol `1.0` |
@@ -79,7 +77,7 @@ The current main schema has the following core fields and KsADK behavior:
| Optional fields such as `securityRequirements` | Produced only when the managed Gateway/identity layer has a real contract; a local minimal Card never invents authentication claims |
The repository test reparses the output through the pinned SDK protobuf and
-asserts that no pre-main legacy Card fields escape. This is a schema gate for the
+asserts that no pre-A2A-1.0 legacy Card fields escape. This is a schema gate for the
release candidate; it deliberately does not treat optional provider or security
values in an illustrative official Card as mandatory for every Agent.
diff --git a/docs-site/content/docs/framework/guides/a2a-runtime.mdx b/docs-site/content/docs/framework/guides/a2a-runtime.mdx
index 726b7e9e..e18279e6 100644
--- a/docs-site/content/docs/framework/guides/a2a-runtime.mdx
+++ b/docs-site/content/docs/framework/guides/a2a-runtime.mdx
@@ -9,12 +9,10 @@ description: "在不削弱入站和出站安全边界的前提下使用平台托
## 协议兼容性与 Agent Card
-`0.8.0` 仍是候选版本，因此 A2A 以
-[`a2aproject/A2A` 的 `main/docs/specification.md`](https://github.com/a2aproject/A2A/blob/main/docs/specification.md)
-为目标契约；该文档明确以同仓的 `specification/a2a.proto` 作为规范性数据模型来源。KsADK
-固定 `a2a-sdk==1.1.0`，其 `AgentCard`、`AgentInterface`、`AgentCapabilities` 和
-`SecurityRequirement` protobuf 字段已与当前 main 的这些定义对齐。发布前若上游 main 再变更，
-必须先升级 SDK 或适配实现并更新契约测试，不能只改文档。
+KsADK 0.8.3 的 A2A wire 合同固定为 A2A 1.0，并精确锁定 `a2a-sdk==1.1.0`。
+`AgentCard`、`AgentInterface`、`AgentCapabilities` 和 `SecurityRequirement` 均使用该 SDK
+提供的 protobuf 类型；兼容性以锁定依赖和仓内契约测试为准，不跟随上游 `main` 浮动。
+升级协议时必须同时升级 SDK、实现和契约测试，不能只改文档。
这不是 KsADK 自定义 JSON 方言：`supportedInterfaces[]` 中的每一项都使用 `url`、
`protocolBinding`、`protocolVersion`，发现地址是 `/.well-known/agent-card.json`。不输出旧
@@ -61,9 +59,9 @@ major.minor 协议版本（不包含 patch）。官方完整示例中出现的 `
}
```
-当前 main 要求的 Card 核心字段及 KsADK 的对应关系如下：
+当前锁定的 `a2a-sdk==1.1.0` Card 核心字段及 KsADK 的对应关系如下：
-| main schema 字段 | KsADK 行为 |
+| A2A 1.0 字段 | KsADK 行为 |
| --- | --- |
| `name`、`description`、`version` | 从 `a2a card` 参数或项目检测结果生成 |
| `supportedInterfaces` | 按偏好顺序声明 JSON-RPC 与 HTTP+JSON，且每项标明 `1.0` |
@@ -72,7 +70,7 @@ major.minor 协议版本（不包含 patch）。官方完整示例中出现的 `
| `skills` | 由 `--skill` 生成；未传时生成 `general`，不会输出空列表 |
| `securityRequirements` 等可选字段 | 由托管 Gateway/身份层有真实契约时再生成；本地最小 Card 不杜撰认证声明 |
-仓库测试会将生成结果重新解析为 pinned SDK 的 protobuf，并断言它不包含 main 之前版本的
+仓库测试会将生成结果重新解析为锁定 SDK 的 protobuf，并断言它不包含 A2A 1.0 之前版本的
Card 字段。这是发布候选的 schema 门禁；它不把某个演示 Card 的可选 provider 或认证值误当成
所有 Agent 都必须携带的字段。
diff --git a/docs-site/content/docs/framework/guides/agentkit-local-studio.en.mdx b/docs-site/content/docs/framework/guides/agentkit-local-studio.en.mdx
index 9bbb40d2..71f33878 100644
--- a/docs-site/content/docs/framework/guides/agentkit-local-studio.en.mdx
+++ b/docs-site/content/docs/framework/guides/agentkit-local-studio.en.mdx
@@ -1,15 +1,10 @@
---
title: AgentKit Local Studio
description: A local workspace for authoring, builds, conversations, and cloud lifecycle operations.
-status: new
---
-
- AgentKit Local Studio is a local-first workspace for authoring, building, and testing Agents in the browser. End users do not need a separate Node.js installation.
-
-
-
- Studio still runs on the developer machine, but it can now deploy and manage cloud Agents through the existing platform APIs and chat with high-code Agents created by the CLI.
+
+ AgentKit Local Studio creates, builds, and tests Agents in the browser and manages cloud lifecycle operations through existing platform APIs. Version 0.8.3 also exposes controlled plugin entry points, one conversation surface, and local Scheduler Lite while preserving Provider, permission, and local-runtime boundaries.
`agentengine studio` is KsADK's local-first workspace. It brings Agent definitions, build history, conversations, resources, traces, and orchestration into one browser surface, while model calls and builds still run through the local KsADK runtime.
@@ -60,7 +55,7 @@ cd my-langgraph-agent
agentengine web .
```
-For generated files, runtime entry-point conventions, and deployment paths, see [Create a project](../getting-started/quickstart), [Codex Managed Runtime](managed-runtime), and [cloud deployment](cloud-deployment).
+For generated files, runtime entry-point conventions, and deployment paths, see [Create a project](../getting-started/quickstart.mdx), [Codex Managed Runtime](./managed-runtime.mdx), and [cloud deployment](./cloud-deployment.mdx).
## Cloud deployment and lifecycle
@@ -76,6 +71,12 @@ Cloud targets combine Studio deployment receipts with Agents already present in
Ordinary chat is a foreground streaming request and does not require Background mode. Background sessions are reserved for tasks that must continue after the foreground connection closes. Conversations support incremental text, reasoning, tools, approvals, attachments, model selection, three approval levels, and Goal / Plan controls. There is no separate “Loop” mode in the composer.
+## Plugins and local automation in 0.8.3
+
+The Studio plugin page exposes two explicit host boundaries. A managed DSH toolchain owns DSH Bundle/Profile lifecycle operations, while official Codex plugins remain owned by Codex App Server. KsADK does not copy plugin implementations or present an arbitrary local directory as an installed capability.
+
+The **Automations** page and the Agent detail automation tab use Scheduler Lite for once, interval, cron, IANA timezone, run-now, and occurrence-history flows. Scheduling belongs to the current Studio process: stopping Studio stops 24x7 wakeups, and no cross-Pod high availability is implied. See [Plugins and automations](./plugins-and-automations.mdx) for the complete boundary.
+
## Studio and the local Web UI
| Scenario | Command | Best for |
@@ -96,4 +97,4 @@ Do not remove Agent source files or `agentengine.yaml` to reset conversations. T
Wheel users do not need to build the Studio frontend: the wheel includes the reviewed production static assets. The public repository, sdist, and wheel do not include editable Studio React / TypeScript source; the public release gate validates and packages only `ksadk/studio/static`.
-See [build and package](build-and-package) and the [Web UI source and release contract](web-ui-source) for details.
+See [build and package](./build-and-package.mdx) and the [Web UI source and release contract](./web-ui-source.mdx) for details.
diff --git a/docs-site/content/docs/framework/guides/agentkit-local-studio.mdx b/docs-site/content/docs/framework/guides/agentkit-local-studio.mdx
index 38d0b1d4..93efbe8d 100644
--- a/docs-site/content/docs/framework/guides/agentkit-local-studio.mdx
+++ b/docs-site/content/docs/framework/guides/agentkit-local-studio.mdx
@@ -1,15 +1,10 @@
---
title: AgentKit Local Studio
description: 本地创作、构建、对话与云端生命周期工作区。
-status: new
---
-
- AgentKit Local Studio 是面向本地开发的 Agent 创作工作区：在浏览器中创建、构建并测试 Agent，不需要另行安装 Node.js。
-
-
-
- Studio 仍运行在开发者本机，但已经可以通过平台既有接口部署和管理云端 Agent，并与账号中由 CLI 创建的高代码 Agent 会话。
+
+ AgentKit Local Studio 在浏览器中创建、构建并测试 Agent，并通过平台既有接口管理云端生命周期。0.8.3 同时提供受控插件入口、统一会话表面和本地 Scheduler Lite；这些能力仍遵守 Provider、权限和本地运行边界。
`agentengine studio` 是 KsADK 的本地优先工作区。它把 Agent 定义、构建记录、会话、资源、Trace 与任务编排放在同一个浏览器界面中；模型调用和构建仍由本机 KsADK 运行时执行。
@@ -60,7 +55,7 @@ cd my-langgraph-agent
agentengine web .
```
-有关模板生成的文件、各运行时的入口约定和部署方式，请分别参阅[创建项目](../getting-started/quickstart)、[Codex Managed Runtime](managed-runtime)和[云端部署](cloud-deployment)。
+有关模板生成的文件、各运行时的入口约定和部署方式，请分别参阅[创建项目](../getting-started/quickstart.mdx)、[Codex Managed Runtime](./managed-runtime.mdx)和[云端部署](./cloud-deployment.mdx)。
## 云端部署与生命周期
@@ -76,6 +71,12 @@ agentengine web .
普通聊天使用前台流式请求，不要求 Background 模式。断开页面后仍需继续的长任务才使用 Background session。当前会话支持增量正文、思考、工具、审批、附件、模型选择、三档审批以及 Goal / Plan；不单独展示一个“Loop”模式。
+## 0.8.3 插件与本地自动化
+
+Studio 的插件页只展示两个明确的宿主边界：DSH Bundle/Profile 由受管理的 DSH 工具链接管生命周期；Codex 官方插件继续由 Codex App Server 管理。KsADK 不复制插件实现，也不把任意本地目录伪装成已安装能力。
+
+**自动化**页和 Agent 详情页的自动化 Tab 使用 Scheduler Lite，支持 once、interval、cron、IANA 时区、立即运行和 occurrence 历史。调度器属于当前 Studio 进程：关闭 Studio 后不会继续提供 24×7 唤醒，也不宣称跨 Pod 高可用。完整边界见[插件与自动化](./plugins-and-automations.mdx)。
+
## Studio 与本地 Web UI 的分工
| 场景 | 使用的命令 | 适合做什么 |
@@ -96,4 +97,4 @@ Studio 的工作区数据和会话是本地开发状态，不是需要提交的
安装 wheel 的用户不需要构建 Studio 前端：wheel 已包含经过审计的生产静态资源。公开仓、sdist 与 wheel 都不包含 Studio 的 React / TypeScript 可编辑源码；公开发布门禁只校验并打包 `ksadk/studio/static`。
-详见[构建与打包](build-and-package)和[Web UI 源码与发布契约](web-ui-source)。
+详见[构建与打包](./build-and-package.mdx)和[Web UI 源码与发布契约](./web-ui-source.mdx)。
diff --git a/docs-site/content/docs/framework/guides/build-and-package.mdx b/docs-site/content/docs/framework/guides/build-and-package.mdx
index ef2fbe38..3e70240b 100644
--- a/docs-site/content/docs/framework/guides/build-and-package.mdx
+++ b/docs-site/content/docs/framework/guides/build-and-package.mdx
@@ -86,7 +86,7 @@ Python 包可包含 `agentengine web` 和 Studio 需要的静态 UI 产物；Hos
`ksadk-web`，Studio 可编辑源码不进入公开仓、sdist 或 wheel。
-正式 PyPI 发布走 `.github/workflows/publish-pypi.yml`，由 GitHub Release `published` 事件或 `workflow_dispatch` 触发；workflow 执行 `make public-preflight`，其中会同步固定的已发布 `@kingsoftcloud/ksadk-web@0.3.2`（可通过 `ksadk_web_version` input 指定一个已发布版本），并校验 clean export 中经过审计的 Studio 静态产物，最后通过 OIDC Trusted Publishing 上传，不依赖长期 PyPI token。同步与校验会比较 npm tarball 中 `dist-ksadk`、`ksadk/server/static` 和 wheel 内静态文件的完整路径与内容哈希，并拒绝任何 Studio React / TypeScript 源码；任一不一致都会拒绝构建。
+正式 PyPI 发布走 `.github/workflows/publish-pypi.yml`，由 GitHub Release `published` 事件或 `workflow_dispatch` 触发；workflow 执行 `make public-preflight`，其中会同步固定的已发布 `@kingsoftcloud/ksadk-web@0.3.4`（可通过 `ksadk_web_version` input 指定一个已发布版本），并校验 clean export 中经过审计的 Studio 静态产物，最后通过 OIDC Trusted Publishing 上传，不依赖长期 PyPI token。同步与校验会比较 npm tarball 中 `dist-ksadk`、`ksadk/server/static` 和 wheel 内静态文件的完整路径与内容哈希，并拒绝任何 Studio React / TypeScript 源码；任一不一致都会拒绝构建。
Serverless 部署会在运行时 Pod 注入 UI 配置环境变量：`KSADK_UI_PROFILE`、`KSADK_UI_PATH`、`KSADK_UI_URL`、`KSADK_UI_BUNDLE_PATH`。Pod 内 `ksadk.server.app` 读取这些变量还原 UI 运行时配置，无需把本地 `.agentengine/` 状态打包进镜像。
diff --git a/docs-site/content/docs/framework/guides/cloud-deployment.en.mdx b/docs-site/content/docs/framework/guides/cloud-deployment.en.mdx
index 2eb02e3f..e93d7a41 100644
--- a/docs-site/content/docs/framework/guides/cloud-deployment.en.mdx
+++ b/docs-site/content/docs/framework/guides/cloud-deployment.en.mdx
@@ -119,7 +119,7 @@ This sends an inline normalized manifest, Runtime name, version, and SHA-256. Do
not pass `--ks3-path`, and do not use `--push` or `--ks3-bucket` for a
ManagedRuntime; those Code-path options are rejected. Record the actual Runtime
version and image digest returned by deployment. See
-[YAML Is the Agent: Codex](../tutorials/best-practices/codex-yaml-agent) for
+[YAML Is the Agent: Codex](../tutorials/best-practices/codex-yaml-agent.mdx) for
the native-local workflow.
## Deploy To Serverless
diff --git a/docs-site/content/docs/framework/guides/cloud-deployment.mdx b/docs-site/content/docs/framework/guides/cloud-deployment.mdx
index 34a8c190..60f2a497 100644
--- a/docs-site/content/docs/framework/guides/cloud-deployment.mdx
+++ b/docs-site/content/docs/framework/guides/cloud-deployment.mdx
@@ -109,7 +109,7 @@ agentengine deploy . --target serverless --region cn-beijing-6 --env-file ./prod
这里发送的是内联规范化 manifest、Runtime 名称、版本和 SHA-256。不要传 `--ks3-path`，也不要为
ManagedRuntime 使用 `--push` 或 `--ks3-bucket`；这些 Code 路径参数会被拒绝。返回值应记录实际
Runtime 版本与镜像 digest。完整本机实践见
-[YAML 即 Agent：Codex](../tutorials/best-practices/codex-yaml-agent)。
+[YAML 即 Agent：Codex](../tutorials/best-practices/codex-yaml-agent.mdx)。
## 一次性部署到 Serverless
diff --git a/docs-site/content/docs/framework/guides/evaluation-observability.en.mdx b/docs-site/content/docs/framework/guides/evaluation-observability.en.mdx
new file mode 100644
index 00000000..b61ee068
--- /dev/null
+++ b/docs-site/content/docs/framework/guides/evaluation-observability.en.mdx
@@ -0,0 +1,388 @@
+---
+title: "Evaluation and Observability"
+description: "Use EvalSet, agentengine eval, Studio, OTLP, and RuntimeEvent to measure Agent quality and diagnose runs."
+---
+
+Evaluation answers “did the result meet the expectation?” Observability answers
+“what ran, where did time go, and why did it fail?” KsADK provides local and
+cloud EvalSets, one evaluation report format, Studio evaluation and Trace
+Explorer, standard OTLP export, and RuntimeEvent replay. These features work
+independently and can also be correlated through `TraceRef`, run, and session
+identifiers.
+
+## Capability overview
+
+| Capability | Entry point | Purpose |
+| --- | --- | --- |
+| EvalSet templates and validation | `agentengine evalset init`, `agentengine eval --validate-only` | Generate a template, validate cases, and inspect the evaluator plan |
+| Local/cloud EvalSet sync | `agentengine evalset preview/push/pull` | Preview the fixed payload, publish, or retrieve an immutable Dataset version |
+| Local-source evaluation | `agentengine eval --agent-dir ...` | Run a local Agent from an isolated source snapshot and retain RuntimeEvent evidence |
+| A2A Agent evaluation | `agentengine eval --a2a-url ...` | Invoke a remote A2A Agent Card for single-turn or multi-turn cases |
+| Studio evaluation | Studio -> **Evaluations** | Evaluate local source, an A2A Agent, or a successful Studio Build |
+| Evaluators | `--evaluator ...` | Check responses, references, latency, tokens, tool trajectories, or use an LLM judge |
+| Local traces | Studio -> **Observability** | Inspect traces, span trees, waterfalls, attributes, events, and raw OTLP |
+| OTLP export | `OTEL_EXPORTER_OTLP_*` | Send spans to Langfuse, an OTel Collector, or another compatible backend |
+| CloudMonitor dual export | `CLOUD_MONITOR_OTLP_*` | Send the same spans to a second OTLP backend from the same process |
+| Runtime event replay | `agentengine replay` | Reconstruct text, reasoning, tools, artifacts, and run status without re-execution |
+
+
+ The CLI executes local `--agent-dir` and remote `--a2a-url` targets.
+ `--codex-worktree` currently supports `--validate-only`; execution returns an
+ explicit not-implemented error. Studio also supports successful Studio Builds
+ that have an immutable digest.
+
+
+## Install and start
+
+The complete installation includes evaluation, A2A, and OTLP support:
+
+```bash
+pip install -U "ksadk[all]"
+```
+
+Create a template, then inspect validation output and the evaluator plan:
+
+```bash
+agentengine evalset init \
+ --template tool-routing \
+ --output-file ./evals/tool-routing.yaml
+
+agentengine eval \
+ --evalset-file ./evals/tool-routing.yaml \
+ --agent-dir ./my-agent \
+ --validate-only \
+ --format json
+```
+
+`--validate-only` does not invoke the Agent. The `evaluationPlan` in JSON output
+lists the evaluators that the EvalSet would use, making the result suitable for
+CI review before execution.
+
+## Write an EvalSet
+
+Prefer the native `ksadk.eval/v1` YAML format. A case can contain one `input` or
+an ordered `turns` list. Its final turn can set `expectedOutput` or
+`reference_output`.
+
+```yaml title="smoke.evalset.yaml"
+schemaVersion: ksadk.eval/v1
+name: agent-smoke
+cases:
+ - id: ping
+ input: "Reply with PONG only"
+ expectedOutput: "PONG"
+ assertions:
+ - type: response.equals
+ value: "PONG"
+ - type: runtime.maxLatencyMs
+ value: 10000
+
+ - id: weather
+ input: "Check tomorrow's weather in Beijing and recommend what to do"
+ reference_output: "Use the weather result to summarize tomorrow's conditions and give travel advice."
+ assertions:
+ - type: tool.succeeded
+ value: weather_lookup
+ - type: tool.sequence
+ value: [weather_lookup]
+```
+
+KsADK also recognizes existing Studio `EvaluationSuite` and ADK `eval_cases`
+formats. It converts them to `ksadk.eval/v1` and calculates a `contentDigest`.
+Case IDs must be unique.
+
+### Built-in templates
+
+| Template | Scenario |
+| --- | --- |
+| `knowledge-qa` | Knowledge questions with reference answers |
+| `structured-output` | JSON output and schema validation |
+| `tool-routing` | Successful tool calls and call order |
+| `service-sla` | Latency and total-token budgets |
+
+```bash
+agentengine evalset init \
+ --template structured-output \
+ --output-file ./evals/structured-output.yaml
+```
+
+### Supported assertions
+
+| Type | `value` | Meaning |
+| --- | --- | --- |
+| `response.equals` | string | Response must match exactly |
+| `response.contains` / `response.notContains` | string | Response must contain or omit the value |
+| `response.jsonSchema` | JSON Schema object | Response must parse as JSON and satisfy the schema |
+| `runtime.maxLatencyMs` | non-negative number | Maximum execution latency |
+| `runtime.maxInputTokens` / `runtime.maxOutputTokens` / `runtime.maxTotalTokens` | non-negative number | Maximum input, output, or total tokens |
+| `tool.called` / `tool.notCalled` | tool name | Require or forbid a tool call |
+| `tool.succeeded` | tool name | Require a successful tool call |
+| `tool.sequence` | non-empty list of tool names | Require a call order |
+
+When evidence is missing, the assertion is `UNAVAILABLE`; an unknown value is
+never treated as zero or as a pass. Tool assertions are usually `UNAVAILABLE`
+for an A2A target that does not expose a standardized tool trajectory. Local
+source and Studio Build targets project tool calls from RuntimeEvent evidence.
+
+## Publish and reuse a cloud EvalSet
+
+`preview` is offline and prints the fixed-schema payload that would be
+published. `push` publishes the current workspace EvalSet. `pull` retrieves one
+fixed Dataset ID and version into a local file.
+
+```bash
+# Inspect the payload before publishing; cloud publishing requires full_trace
+agentengine evalset preview \
+ --evalset-file ./evals/tool-routing.yaml \
+ --data-policy full_trace \
+ --format json
+
+# Publish a new immutable Dataset version
+agentengine evalset push \
+ --file ./evals/tool-routing.yaml \
+ --dataset-id
+
+# Retrieve a fixed version for a reproducible run
+agentengine evalset pull \
+ --dataset-id \
+ --dataset-version 3 \
+ --project-id \
+ --output-file ./evals/imported-v3.yaml
+```
+
+`push` and `pull` require access to the Agent Eval service. Never place a
+temporary download URL, account credential, or token in an EvalSet or commit it
+to the repository.
+
+## Run an evaluation
+
+Each run must use either a local `--evalset-file` or an immutable cloud Dataset
+selected by `--dataset-id --dataset-version`. It must also select exactly one
+target.
+
+### Local source
+
+The local target copies the project into an isolated snapshot, records its
+revision and Git state, and loads a supported ADK, LangGraph, LangChain, or
+DeepAgents entry point. Use `--entrypoint` to override detection.
+
+```bash
+agentengine eval \
+ --evalset-file ./evals/tool-routing.yaml \
+ --agent-dir ./my-agent \
+ --timeout-seconds 120 \
+ --report-dir ./.agentkit/evaluations \
+ --format json
+```
+
+### A2A Agent
+
+Cases run sequentially in file order. A multi-turn case reuses one A2A
+`context_id`. Authentication accepts only an `env://` credential reference, so
+the secret value is not written to the command line or report.
+
+```bash
+export A2A_EVAL_TOKEN=""
+
+agentengine eval \
+ --evalset-file ./evals/tool-routing.yaml \
+ --a2a-url https://agent.example.test/.well-known/agent-card.json \
+ --credential-ref env://A2A_EVAL_TOKEN \
+ --fail-fast
+```
+
+### Cloud Dataset version
+
+Use a fixed version instead of a moving active Dataset so later runs remain
+reproducible:
+
+```bash
+agentengine eval \
+ --dataset-id \
+ --dataset-version 3 \
+ --dataset-project-id \
+ --agent-dir ./my-agent
+```
+
+### Common execution options
+
+| Option | Effect |
+| --- | --- |
+| `--timeout-seconds 120` | Per-case timeout from 1 to 3600 seconds |
+| `--fail-fast` | Stop after the first failed case |
+| `--report-dir ` | Set the local report root |
+| `--format pretty\|json` | Select terminal output; JSON is suitable for CI |
+| `--data-policy ` | Control retained evidence and permitted data disclosure |
+| `--evaluator ` | Select an evaluator; repeat the option for more than one |
+
+`DataPolicy` can be `local_only`, `metadata_only`, `redacted_trace`, or
+`full_trace`. `metadata_only` omits text and attributes, while `redacted_trace`
+retains redacted content. Selecting a policy does not upload a report or trace;
+remote trace export is controlled separately by OTLP environment variables.
+
+## Evaluators and automatic planning
+
+Without `--evaluator`, KsADK derives a plan from the EvalSet. A reference answer
+uses a fully configured `llm_judge@v1` when available and otherwise uses
+`reference_match@v1`. Response, runtime-budget, and tool assertions add their
+deterministic evaluators. A case with neither a reference nor a response
+assertion receives `business_standard@v1` and an unavailable quality result, so
+“the Agent ran” is not mistaken for business success.
+
+| Evaluator | Purpose |
+| --- | --- |
+| `business_standard@v1` | Mark a case that has no business-quality standard |
+| `response_contract@v1` | Execute `response.*` assertions |
+| `runtime_budget@v1` | Execute `runtime.*` assertions |
+| `tool_trajectory@v1` | Execute `tool.*` assertions |
+| `reference_match@v1` | Calculate token overlap with the reference answer |
+| `llm_judge@v1` | Evaluate quality with an explicitly configured OpenAI-compatible model |
+
+Explicit `--evaluator` options replace the automatic plan:
+
+```bash
+agentengine eval \
+ --evalset-file ./evals/structured-output.yaml \
+ --agent-dir ./my-agent \
+ --evaluator response_contract@v1 \
+ --evaluator runtime_budget@v1
+```
+
+The LLM judge requires `ksadk[judge]`, a reference answer, `full_trace`, a
+model, an API base, and an environment variable that contains the key:
+
+```bash
+export KSADK_EVAL_JUDGE_API_KEY=""
+
+agentengine eval \
+ --evalset-file ./evals/knowledge-qa.yaml \
+ --agent-dir ./my-agent \
+ --evaluator llm_judge@v1 \
+ --judge-model \
+ --judge-api-base https://judge.example.test/v1 \
+ --data-policy full_trace
+```
+
+## Read evaluation results
+
+The default report path is:
+
+```text
+.agentkit/evaluations//report.json
+```
+
+The `ksadk.eval.report/v1` report stores snapshots of the EvalSet, target,
+optional cloud Dataset, and evaluation configuration. Each case includes target
+status, latency, usage, metrics, `TraceRef`, and summary status. RuntimeEvent
+evidence for a local target is stored in `evidence/` beside the report.
+
+| Exit code | Meaning |
+| --- | --- |
+| `0` | Evaluation passed |
+| `1` | The Agent ran, but a case or required metric failed |
+| `2` | Invalid input, executor/runtime error, or cancellation |
+| `3` | The target or a required metric has unavailable evidence |
+
+A successful target invocation is not an evaluation pass. Check both
+`EvalRunReport.status` and every required metric.
+
+## Use Studio
+
+Start Studio and open **Evaluations** in the sidebar:
+
+```bash
+agentengine studio ./my-agent-workspace
+```
+
+Upload a YAML or JSON EvalSet, select an A2A Agent, local source, or Studio
+Build, configure timeout, fail-fast behavior, and evaluators, then start the
+background operation. The list shows status and summary; details show cases,
+metrics, target usage, and `TraceRef`. A running evaluation can be cancelled.
+
+A Studio Build target must already be successful and carry an immutable digest.
+Studio does not treat an unfrozen Codex source tree as a reproducible build.
+
+Open **Observability** for local traces, span parent/child trees, waterfalls,
+attributes, events, resources, instrumentation scope, raw OTLP JSON, and
+`traceparent`. Local OTLP files live in `.agentkit/traces/` inside the workspace
+and are intended only for local diagnosis.
+
+## Export to an OTLP backend
+
+Standard OTLP/HTTP settings work with Langfuse, an OTel Collector, and other
+compatible backends:
+
+```bash
+export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"
+export OTEL_EXPORTER_OTLP_ENDPOINT="https://otel.example.test/otel"
+export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer%20"
+
+agentengine run .
+```
+
+Traces-specific variables take precedence:
+
+```bash
+export OTEL_EXPORTER_OTLP_TRACES_PROTOCOL="http/protobuf"
+export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT="https://otel.example.test/otel/v1/traces"
+export OTEL_EXPORTER_OTLP_TRACES_HEADERS="Authorization=Bearer%20"
+```
+
+When only the general endpoint is set, KsADK derives `/v1/traces`. Header values
+use RFC 3986 encoding and multiple headers are comma-separated. To export to a
+second CloudMonitor backend, set `CLOUD_MONITOR_OTLP_ENDPOINT` or
+`CLOUD_MONITOR_OTLP_TRACES_ENDPOINT` and the corresponding headers. Both
+exporters receive the same spans with identical `trace_id` and `span_id` values.
+See [Observability and tracing](./observability-tracing.mdx) for the complete
+variable list.
+
+## Replay RuntimeEvent
+
+OTel spans describe topology, timing, and diagnostics. Canonical RuntimeEvent
+schema v2 describes the semantic order of Agent execution and evaluation
+evidence. The two can be correlated, but one RuntimeEvent does not equal one
+span.
+
+```bash
+# Human-readable transcript
+agentengine replay
+
+# Read a cursor window as JSON
+agentengine replay \
+ --after-seq-id 120 \
+ --before-seq-id 260 \
+ --format json
+```
+
+Replay projects text, reasoning, tools, artifacts, and run status. It does not
+call the model, rerun tools, or repeat approvals. Only sessions persisted through
+the canonical RuntimeEvent v2 store are read; legacy SessionEvent rows are not
+silently converted into new canonical facts.
+
+## Choose the right tool
+
+| Question | Start with |
+| --- | --- |
+| Build an evaluation set quickly | `agentengine evalset init` |
+| Reproduce a fixed test-data version | `evalset pull` or `eval --dataset-id --dataset-version` |
+| Check a deterministic response rule | `response_contract@v1` |
+| Compare with a reference answer | `reference_match@v1` |
+| Ask a model to judge business quality | `llm_judge@v1`, after confirming the disclosure policy |
+| Verify tool calls | Local source or Studio Build with `tool_trajectory@v1` |
+| Find a slow or failed span | Studio Trace Explorer or a remote OTLP backend |
+| Reconstruct tools, approvals, and responses | `agentengine replay` |
+| Trace an evaluation result back to execution | Follow `TraceRef` to a trace or RuntimeEvent evidence |
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Codex worktree execution is not implemented | Use `--validate-only`, or execute a local-source or A2A target |
+| Tool assertion is `UNAVAILABLE` | Confirm that the target provides RuntimeEvent tool evidence; A2A often lacks a standardized trajectory |
+| Token budget is `UNAVAILABLE` | The target did not report usage; KsADK does not replace unknown usage with zero |
+| Quality result is unavailable | Add a reference, response assertion, or explicit business evaluator |
+| LLM judge is `UNAVAILABLE` | Check `ksadk[judge]`, `full_trace`, reference answer, model, API base, and key environment variable |
+| Studio Build cannot be selected | Complete a successful build and verify its immutable digest |
+| Studio has no traces | Run an Agent in this workspace and make sure tracing is enabled |
+| Remote backend has no spans | Check endpoint, protocol, headers, TLS, and authentication; never put credentials in source |
+| Replay has no history | Confirm that the session uses canonical RuntimeEvent v2 persistence and check the cursor window |
diff --git a/docs-site/content/docs/framework/guides/evaluation-observability.mdx b/docs-site/content/docs/framework/guides/evaluation-observability.mdx
index 317df30e..4fd3bf35 100644
--- a/docs-site/content/docs/framework/guides/evaluation-observability.mdx
+++ b/docs-site/content/docs/framework/guides/evaluation-observability.mdx
@@ -279,7 +279,7 @@ export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT="https://otel.example.test/otel/v1/tra
export OTEL_EXPORTER_OTLP_TRACES_HEADERS="Authorization=Bearer%20"
```
-仅配置通用 endpoint 时，KsADK 会派生 `/v1/traces`。Headers 使用逗号分隔，value 应按 RFC 3986 编码。需要第二路 CloudMonitor 时，另配 `CLOUD_MONITOR_OTLP_ENDPOINT` 或 `CLOUD_MONITOR_OTLP_TRACES_ENDPOINT` 及对应 headers；两个 exporter 读取同一批 Span，保持相同的 `trace_id` / `span_id`。变量全集见 [可观测与链路追踪](observability-tracing)。
+仅配置通用 endpoint 时，KsADK 会派生 `/v1/traces`。Headers 使用逗号分隔，value 应按 RFC 3986 编码。需要第二路 CloudMonitor 时，另配 `CLOUD_MONITOR_OTLP_ENDPOINT` 或 `CLOUD_MONITOR_OTLP_TRACES_ENDPOINT` 及对应 headers；两个 exporter 读取同一批 Span，保持相同的 `trace_id` / `span_id`。变量全集见 [可观测与链路追踪](./observability-tracing.mdx)。
## 回放 RuntimeEvent
@@ -296,7 +296,7 @@ agentengine replay \
--format json
```
-回放可投影 text、reasoning、tool、artifact 和 run status；不会调用模型、重跑工具或再次执行审批。只有已持久化 RuntimeEvent v1 的 session 可被读取，旧式 SessionEvent 不会自动转换。
+回放可投影 text、reasoning、tool、artifact 和 run status；不会调用模型、重跑工具或再次执行审批。只有通过 canonical RuntimeEvent v2 store 持久化的 session 可被读取，旧式 SessionEvent 不会被静默转换成新的 canonical 事实。
## 如何选择
@@ -324,4 +324,4 @@ agentengine replay \
| Studio Build 不可选 | 先完成 Build，并确认产物状态为成功且存在不可变 digest |
| Studio 中没有 Trace | 确认在该工作区运行过 Agent，且 tracing 未禁用 |
| 远端后端没有 Span | 检查 endpoint、protocol、headers、TLS 和鉴权；不要把凭据写进源码 |
-| replay 没有历史 | 确认 session 使用 RuntimeEvent v1 持久化，并检查 cursor 范围 |
+| replay 没有历史 | 确认 session 使用 canonical RuntimeEvent v2 持久化，并检查 cursor 范围 |
diff --git a/docs-site/content/docs/framework/guides/frameworks.en.mdx b/docs-site/content/docs/framework/guides/frameworks.en.mdx
index 062999d8..13a88bd2 100644
--- a/docs-site/content/docs/framework/guides/frameworks.en.mdx
+++ b/docs-site/content/docs/framework/guides/frameworks.en.mdx
@@ -36,7 +36,7 @@ prompt: |
You are a coding assistant.
```
-Start with the [YAML Is the Agent: Codex best practice](../tutorials/best-practices/codex-yaml-agent).
+Start with the [YAML Is the Agent: Codex best practice](../tutorials/best-practices/codex-yaml-agent.mdx).
Do not add `entry_point`, `agent_variable`, or a placeholder `agent.py` to this project.
## Framework Runtime Architecture
diff --git a/docs-site/content/docs/framework/guides/frameworks.mdx b/docs-site/content/docs/framework/guides/frameworks.mdx
index 8dbba3ca..0280042e 100644
--- a/docs-site/content/docs/framework/guides/frameworks.mdx
+++ b/docs-site/content/docs/framework/guides/frameworks.mdx
@@ -33,7 +33,7 @@ prompt: |
你是一个编码助手。
```
-从[最佳实践：YAML 即 Agent：Codex](../tutorials/best-practices/codex-yaml-agent)
+从[最佳实践：YAML 即 Agent：Codex](../tutorials/best-practices/codex-yaml-agent.mdx)
开始；不要为这个项目添加 `entry_point`、`agent_variable` 或占位 `agent.py`。
## 框架运行时架构
diff --git a/docs-site/content/docs/framework/guides/harness-app.en.mdx b/docs-site/content/docs/framework/guides/harness-app.en.mdx
index 881bba66..dfbaf5c4 100644
--- a/docs-site/content/docs/framework/guides/harness-app.en.mdx
+++ b/docs-site/content/docs/framework/guides/harness-app.en.mdx
@@ -46,7 +46,7 @@ uvicorn app:app --host 127.0.0.1 --port 8080
`runtime: yaml` uses the Harness YAML runner. `runtime: codex` uses the native
Codex runner, so it also needs `ksadk[codex]` and the same local provider setup
-as [Codex Managed Runtime](./managed-runtime).
+as [Codex Managed Runtime](./managed-runtime.mdx).
## Supported YAML surface
@@ -69,4 +69,4 @@ The public HarnessApp data plane supports `/v1/responses`,
`/v1/chat/completions`, and session routes. It is not an `agentengine web`
project and does not automatically produce a cloud deployment artifact. Use
`agentengine init` for a standard framework project, or
-[Codex Managed Runtime](./managed-runtime) for YAML-driven managed Codex delivery.
+[Codex Managed Runtime](./managed-runtime.mdx) for YAML-driven managed Codex delivery.
diff --git a/docs-site/content/docs/framework/guides/harness-app.mdx b/docs-site/content/docs/framework/guides/harness-app.mdx
index aa009e1a..65e4fc78 100644
--- a/docs-site/content/docs/framework/guides/harness-app.mdx
+++ b/docs-site/content/docs/framework/guides/harness-app.mdx
@@ -41,7 +41,7 @@ uvicorn app:app --host 127.0.0.1 --port 8080
```
`runtime: yaml` 使用 Harness 的 YAML runner；`runtime: codex` 使用本机 Codex runner，
-因此还需要安装 `ksadk[codex]` 并配置与 [Codex Managed Runtime](./managed-runtime)
+因此还需要安装 `ksadk[codex]` 并配置与 [Codex Managed Runtime](./managed-runtime.mdx)
相同的本地 provider 环境。
## 支持的 YAML 范围
@@ -63,4 +63,4 @@ uvicorn app:app --host 127.0.0.1 --port 8080
HarnessApp 的公开数据面兼容 `/v1/responses`、`/v1/chat/completions` 和 session 路由。
它不等同于 `agentengine web` 项目，也不自动产生云端部署包；需要标准框架项目时继续使用
`agentengine init`，需要 YAML 驱动的 Codex 托管交付时使用
-[Codex Managed Runtime](./managed-runtime)。
+[Codex Managed Runtime](./managed-runtime.mdx)。
diff --git a/docs-site/content/docs/framework/guides/hosted-ui-events.en.mdx b/docs-site/content/docs/framework/guides/hosted-ui-events.en.mdx
index 2406d289..7064c41c 100644
--- a/docs-site/content/docs/framework/guides/hosted-ui-events.en.mdx
+++ b/docs-site/content/docs/framework/guides/hosted-ui-events.en.mdx
@@ -1,16 +1,15 @@
---
title: "Hosted UI and Event Replay"
-status: "new"
---
-The `0.8.0` candidate separates Hosted UI transport, interactive presentation,
+KsADK 0.8.3 separates Hosted UI transport, interactive presentation,
and runtime audit. OpenAI Responses remains the compatibility baseline, AG-UI
is an optional transport, A2UI represents structured activities, and
`RuntimeEvent` is the sole persistence and replay boundary. UI evolution does
not change the original model-call protocol.
-
-This page describes interfaces and boundaries on the review branch. It does not mean that an npm/PyPI release exists. A real hosted deployment must still validate its gateway, authentication, runner, database, and provider credentials.
+
+This page describes interfaces and boundaries in the 0.8.3 source. It does not claim that npm/PyPI publication is complete. A real hosted deployment must still validate its gateway, authentication, runner, database, and provider credentials.
## Protocol Selection
@@ -20,7 +19,7 @@ This page describes interfaces and boundaries on the review branch. It does not
| OpenAI Responses | established `/v1/responses` and `/v1/chat/completions` request/response semantics | always available as the compatibility baseline |
| AG-UI | optional streaming transport between Hosted UI and runtime | fall back to Responses when the capability is not negotiated |
| A2UI | structured activities/components and user actions | does not replace model, tool, or approval policy |
-| RuntimeEvent v1 | canonical session events, state, audit, and replay record | unknown event types cannot bypass conformance validation |
+| RuntimeEvent v2 | canonical session events, state, audit, and replay record | unknown event types cannot bypass conformance validation |
AG-UI/A2UI is not a second model API. A client selects it only after Hosted
bootstrap advertises the capability; existing Responses clients can remain unchanged.
@@ -67,4 +66,4 @@ that was rejected or consumed.
3. For reloads, disconnects, or duplicate approvals, use `ksadk replay` to locate the event cursor and terminal state.
4. For LangGraph/ADK interrupt or resume, then validate the framework-native checkpoint configuration. New integrations must not depend on legacy LangChain continuity.
-For browser debugging, see [Local Web UI](local-web-ui). For session and checkpoint semantics, see [Sessions, Runtime, and Files](../../references/runtime-sessions-files).
+For browser debugging, see [Local Web UI](./local-web-ui.mdx). For session and checkpoint semantics, see [Sessions, Runtime, and Files](../../references/runtime-sessions-files.mdx).
diff --git a/docs-site/content/docs/framework/guides/hosted-ui-events.mdx b/docs-site/content/docs/framework/guides/hosted-ui-events.mdx
index 49a5e93a..ddb56f28 100644
--- a/docs-site/content/docs/framework/guides/hosted-ui-events.mdx
+++ b/docs-site/content/docs/framework/guides/hosted-ui-events.mdx
@@ -1,14 +1,13 @@
---
title: "Hosted UI 与事件回放"
-status: "new"
---
-`0.8.0` 候选将 Hosted UI 的 transport、交互展示和运行时审计分开：OpenAI Responses
+KsADK 0.8.3 将 Hosted UI 的 transport、交互展示和运行时审计分开：OpenAI Responses
保持兼容基线，AG-UI 是可选 transport，A2UI 是结构化 activity 表示，`RuntimeEvent`
则是唯一持久化和回放边界。这样前端能力演进不会改变模型调用的原始协议。
-
-本文说明的是评审分支中的接口与边界，不代表已发布的 npm/PyPI 版本。真实 hosted 环境仍应验证自身的网关、鉴权、runner、数据库和 provider 凭证。
+
+本文说明 0.8.3 源码中的接口与边界，不代表 npm/PyPI 已完成正式发布。真实 hosted 环境仍应验证自身的网关、鉴权、runner、数据库和 provider 凭证。
## 协议选择
@@ -18,7 +17,7 @@ status: "new"
| OpenAI Responses | 既有 `/v1/responses`、`/v1/chat/completions` 请求/响应语义 | 始终可作为兼容基线 |
| AG-UI | Hosted UI 与 runtime 的可选流式 transport | capability 未协商时回退到 Responses |
| A2UI | activity/组件和用户 action 的结构化表示 | 不替换模型、工具或审批 policy |
-| RuntimeEvent v1 | session 内事件、状态、审计和回放的 canonical 记录 | 不接受未知事件类型绕过校验 |
+| RuntimeEvent v2 | session 内事件、状态、审计和回放的 canonical 记录 | 不接受未知事件类型绕过校验 |
AG-UI/A2UI 不是第二套模型 API。客户端只有在 Hosted bootstrap 表明支持时才选择它；已有
Responses 客户端可以维持原样。
@@ -59,4 +58,4 @@ agentengine replay --after-seq-id 120 --before-seq-id 260 --format
3. 针对刷新、断线或重复审批，使用 `ksadk replay` 定位 event cursor 与 terminal 状态。
4. 对 LangGraph/ADK 的 interrupt 或 resume，再验证框架原生 checkpoint 配置；新接入不要依赖旧 LangChain 连续性路径。
-更多本地浏览器调试信息见[本地 Web UI](local-web-ui)，会话与 checkpoint 语义见[会话、运行时与文件](../../references/runtime-sessions-files)。
+更多本地浏览器调试信息见[本地 Web UI](./local-web-ui.mdx)，会话与 checkpoint 语义见[会话、运行时与文件](../../references/runtime-sessions-files.mdx)。
diff --git a/docs-site/content/docs/framework/guides/local-web-ui.en.mdx b/docs-site/content/docs/framework/guides/local-web-ui.en.mdx
index 568dfa46..fccc965b 100644
--- a/docs-site/content/docs/framework/guides/local-web-ui.en.mdx
+++ b/docs-site/content/docs/framework/guides/local-web-ui.en.mdx
@@ -78,7 +78,7 @@ The editable Web UI source is planned as a separate repository `kingsoftcloud/ks
The Python SDK should embed generated static assets and record the source version it consumed. Hosted-only deployment files, private routing, Helm values, and generated hosted bundles must not be published as part of the SDK wheel.
-See [Web UI Repository](web-ui-source) for the repository split and release contract.
+See [Web UI Repository](./web-ui-source.mdx) for the repository split and release contract.
## Development Mode
diff --git a/docs-site/content/docs/framework/guides/local-web-ui.mdx b/docs-site/content/docs/framework/guides/local-web-ui.mdx
index a1a1af58..a401bc3d 100644
--- a/docs-site/content/docs/framework/guides/local-web-ui.mdx
+++ b/docs-site/content/docs/framework/guides/local-web-ui.mdx
@@ -77,7 +77,7 @@ UI 调用本地 KsADK 运行时，运行时再调用配置好的框架 Runner。
Python SDK 应内置生成后的静态资源并记录消费的 source version。Hosted-only 部署文件、私有路由、Helm values 和生成后的 hosted bundle 不应进入 SDK wheel。
-见 [Web UI 仓库](web-ui-source) 了解仓库拆分和发布契约。
+见 [Web UI 仓库](./web-ui-source.mdx) 了解仓库拆分和发布契约。
## 开发模式
diff --git a/docs-site/content/docs/framework/guides/managed-runtime.en.mdx b/docs-site/content/docs/framework/guides/managed-runtime.en.mdx
index f51dbe70..ad16d14b 100644
--- a/docs-site/content/docs/framework/guides/managed-runtime.en.mdx
+++ b/docs-site/content/docs/framework/guides/managed-runtime.en.mdx
@@ -9,8 +9,8 @@ by AgentEngine in the cloud. Local development does not require Docker, and a
deployment bundle never contains Python dependencies, credentials, or a platform
binary.
-
-This is the first declarative managed runtime in 0.8: a Codex agent is described
+
+A Codex Agent is described
by YAML `model` and `prompt` fields rather than an object exported from `agent.py`.
diff --git a/docs-site/content/docs/framework/guides/managed-runtime.mdx b/docs-site/content/docs/framework/guides/managed-runtime.mdx
index 42e8d333..009c0820 100644
--- a/docs-site/content/docs/framework/guides/managed-runtime.mdx
+++ b/docs-site/content/docs/framework/guides/managed-runtime.mdx
@@ -7,8 +7,8 @@ Codex 是 KsADK 的第一个 `ManagedRuntime`。它把项目的声明、开发
进程和云端 Linux Runtime 镜像分开：开发机不需要 Docker，部署包也不会带入 Python
依赖、模型凭据或平台二进制。
-
-这是 0.8 首个声明式托管 Runtime：Codex Agent 的行为由 YAML 中的 `model` 与 `prompt`
+
+Codex Agent 的行为由 YAML 中的 `model` 与 `prompt`
声明，而不是由 `agent.py` 导出对象。
diff --git a/docs-site/content/docs/framework/guides/memory-knowledge.en.mdx b/docs-site/content/docs/framework/guides/memory-knowledge.en.mdx
index d0d48f08..f5b06295 100644
--- a/docs-site/content/docs/framework/guides/memory-knowledge.en.mdx
+++ b/docs-site/content/docs/framework/guides/memory-knowledge.en.mdx
@@ -242,7 +242,7 @@ config:
The manifest and secrets above are injected by the hosted platform. Public docs do not expose internal endpoints, accounts, or tokens; examples use placeholders such as `example.com` / `sk-test` / `cm-appkey-placeholder`.
-For the full variable list, see [ksadk environment variables reference](../../references/environment-variables).
+For the full variable list, see [ksadk environment variables reference](../../references/environment-variables.mdx).
## Failure Behavior
diff --git a/docs-site/content/docs/framework/guides/memory-knowledge.mdx b/docs-site/content/docs/framework/guides/memory-knowledge.mdx
index 35feca46..c4c4c77f 100644
--- a/docs-site/content/docs/framework/guides/memory-knowledge.mdx
+++ b/docs-site/content/docs/framework/guides/memory-knowledge.mdx
@@ -100,7 +100,7 @@ Hermes 镜像通过 KsADK memory provider 和知识库工具消费同一套平
- `KSADK_KB_DATASET_ID`
- `KSADK_KB_TOP_K`
-完整列表见 [环境变量](../../references/environment-variables)。
+完整列表见 [环境变量](../../references/environment-variables.mdx)。
## OpenClaw memory backend(可选)
@@ -138,4 +138,4 @@ config:
上述 manifest 与 secret 均由托管平台注入；公开文档不暴露内部 endpoint、account 或 token，示例值使用占位符（如 `example.com` / `sk-test` / `cm-appkey-placeholder`）。
-完整变量列表见 [ksadk 环境变量参考](../../references/environment-variables)。
+完整变量列表见 [ksadk 环境变量参考](../../references/environment-variables.mdx)。
diff --git a/docs-site/content/docs/framework/guides/meta.en.json b/docs-site/content/docs/framework/guides/meta.en.json
new file mode 100644
index 00000000..72b67674
--- /dev/null
+++ b/docs-site/content/docs/framework/guides/meta.en.json
@@ -0,0 +1,30 @@
+{
+ "title": "Capability Guides",
+ "pages": [
+ "---[Monitor]Studio and Local Development---",
+ "agentkit-local-studio",
+ "local-web-ui",
+ "evaluation-observability",
+ "frameworks",
+ "---[Blocks]Harness and Plugins---",
+ "runtime-architecture",
+ "harness-app",
+ "plugins-and-automations",
+ "tools-and-skill-runtime",
+ "agent-context",
+ "memory-knowledge",
+ "attachments-multimodal",
+ "workspace-files",
+ "---[Network]Events and Interoperability---",
+ "hosted-ui-events",
+ "a2a-runtime",
+ "---[Cloud]Build and Deploy---",
+ "managed-runtime",
+ "build-and-package",
+ "cloud-deployment",
+ "runtime-products",
+ "---[Wrench]Operations and Maintenance---",
+ "observability-tracing",
+ "web-ui-source"
+ ]
+}
diff --git a/docs-site/content/docs/framework/guides/meta.json b/docs-site/content/docs/framework/guides/meta.json
index 65b3e5fc..b5fd3f7d 100644
--- a/docs-site/content/docs/framework/guides/meta.json
+++ b/docs-site/content/docs/framework/guides/meta.json
@@ -1,24 +1,30 @@
{
- "title": "运行与能力",
+ "title": "能力指南",
"pages": [
- "frameworks",
- "harness-app",
- "local-web-ui",
+ "---[Monitor]Studio 与本地开发---",
"agentkit-local-studio",
+ "local-web-ui",
"evaluation-observability",
- "hosted-ui-events",
+ "frameworks",
+ "---[Blocks]Harness 与插件化---",
+ "runtime-architecture",
+ "harness-app",
+ "plugins-and-automations",
+ "tools-and-skill-runtime",
"agent-context",
+ "memory-knowledge",
"attachments-multimodal",
"workspace-files",
- "tools-and-skill-runtime",
- "memory-knowledge",
- "observability-tracing",
+ "---[Network]统一事件与互操作---",
+ "hosted-ui-events",
"a2a-runtime",
+ "---[Cloud]构建与部署---",
"managed-runtime",
"build-and-package",
"cloud-deployment",
"runtime-products",
- "runtime-architecture",
+ "---[Wrench]运维与维护---",
+ "observability-tracing",
"web-ui-source"
]
}
diff --git a/docs-site/content/docs/framework/guides/plugins-and-automations.en.mdx b/docs-site/content/docs/framework/guides/plugins-and-automations.en.mdx
new file mode 100644
index 00000000..8d768c43
--- /dev/null
+++ b/docs-site/content/docs/framework/guides/plugins-and-automations.en.mdx
@@ -0,0 +1,132 @@
+---
+title: Plugins and automations
+status: experimental
+---
+
+Phase 2 adds local-first plugin lifecycle operations, ecosystem host bridges, Scheduler Lite, and a shared conversation surface. These features are still behind unreleased gates. Released Agents and precisely identified historical Bundles remain on their original paths and do not require a Runtime rebuild or upgrade.
+
+Studio and Hosted UI pin the versioned Conversation v1 headless module from
+`@kingsoftcloud/ksadk-web@0.3.4`. Candidate source, independent browser, and
+deployed two-turn checks for both a new and a historical Agent are green;
+the stable release still requires a rebuild from the public npm artifact and
+the final artifact audit.
+
+
+ This page is not a stable-release announcement. Cloud PluginHost, cloud 24x7 scheduling, the P2-06 DSH Codex Bundle/child Provider, Claude Code, and game-plugin execution are outside the current support claim. One passing reference DSH AgentProvider E2E does not make arbitrary third-party Providers supported.
+
+
+## Choose an integration mode
+
+| Mode | Owner | Current use |
+| --- | --- | --- |
+| `dsh` | DeepSeek Harness / Cordis | Default plugin format; Bundles may contribute AgentProviders, tools, renderers, and Studio slots |
+| `codex` | Codex App Server | Preserve the native host and permission semantics of official Codex plugins |
+| `linked` | External host | Discovery or navigation only; it must not appear installed and executable |
+
+KsADK does not define a third private package, manifest, or ABI. Plugins do not change Kernel contracts: a new Runtime is a coarse-grained AgentProvider in a standard DSH Bundle, while Codex plugins stay under App Server ownership.
+
+## Develop a DSH Bundle
+
+Developers do not need a DeepSeek Harness source checkout or local build. Install the pinned, managed DSH CLI from public npm, then create, validate, test, and pack a standard DSH Bundle:
+
+```bash title="shell"
+agentengine plugin toolchain status
+agentengine plugin toolchain install
+agentengine plugin create ./my-provider --name @example/my-provider
+agentengine plugin validate ./my-provider
+agentengine plugin test ./my-provider
+agentengine plugin pack ./my-provider --output-dir ./artifacts
+```
+
+The generated project is an ordinary npm package using DSH `dsh.bundle.patch` and Cordis composition; it does not contain `ksadk-plugin.yaml`. `validate` and `test` exercise install, projection, disable, enable, and uninstall in a temporary Profile. `pack` uses the pinned pnpm toolchain and npm `files` semantics to produce a `.tgz`.
+
+Install the packed Bundle into an isolated Profile and use the same DSH lifecycle commands:
+
+```bash title="shell"
+agentengine plugin install ./artifacts/example-my-provider-0.1.0.tgz \
+ --accept-host-permissions
+agentengine plugin disable @example/my-provider
+agentengine plugin enable @example/my-provider
+agentengine plugin uninstall @example/my-provider
+```
+
+The release gate installs the pinned DSH toolchain from public npm and validates a generated Bundle, its `.tgz`, and the package-format and installation boundary of the official Codex subagent package:
+
+```bash title="shell"
+KSADK_DSH_TOOLCHAIN_E2E=1 \
+uv run --extra all pytest -q tests/e2e/test_dsh_managed_toolchain_e2e.py
+```
+
+This check does not claim that the P2-06 DSH Codex Bundle/child Provider execution path is complete. A separate real external Node AgentProvider runs install, two stateful turns, disable, a broken update with rollback, re-enable of the old executable package, and uninstall in one managed Profile.
+
+A local DSH source build may differ when it contains unreleased changes. Normal plugin development, CI, and publishing always use the pinned npm version as the compatibility baseline. Only DSH core contributors validating the next release should set `KSADK_DSH_BIN` explicitly; a version mismatch fails closed. KsADK wraps the official commands and does not copy the DSH compiler.
+
+## Manage Codex plugins
+
+Codex App Server owns plugin discovery, installation state, and uninstall operations. KsADK calls the host protocol and does not interpret or execute plugin code:
+
+```bash title="shell"
+agentengine plugin codex list
+agentengine plugin codex info
+agentengine plugin codex install --accept-host-permissions
+agentengine plugin codex uninstall
+```
+
+The bridge returns a typed unavailable error when Codex App Server is missing. Installation confirms that the plugin runs with the current system user's host permissions; plugin authentication remains in Codex.
+
+## Manage a DSH Profile
+
+An isolated DeepSeek Harness Profile owns DSH plugins. Install, enable/disable, update, and uninstall operations call managed native `dsh plugin`; each mutation runs host configuration preflight. A directory or `.tgz` is frozen into a SHA-256-addressed immutable source. Digest drift fails closed before enable, update, or projection, and a failed update restores the old manifest, lock, state, and executable package:
+
+```bash title="shell"
+export KSADK_DSH_HOME=/path/to/isolated/dsh-home
+export KSADK_DSH_PROFILE=studio
+
+agentengine plugin list
+agentengine plugin install --accept-host-permissions
+agentengine plugin disable
+agentengine plugin enable
+agentengine plugin profile
+agentengine plugin uninstall
+```
+
+`agentengine plugin dsh ...` remains only as a compatibility alias for early scripts.
+
+A DSH bundle may run install scripts, so host permissions require explicit confirmation. An AgentProvider appears in the Runtime selector only after handshake, permission, conversation-projection, and execution conformance pass.
+
+## Create a local scheduled task
+
+Studio's **Automations** page supports once, interval, and cron schedules with IANA timezones. A task can be enabled, disabled, edited, deleted, or run immediately; its detail view shows the next run and occurrence history. The **Automations** tab on an Agent detail page scopes both listing and creation to that Agent.
+
+| Capability | Current behavior |
+| --- | --- |
+| Storage | Workspace-local SQLite |
+| Trigger | Scheduler Lite inside the local Studio process |
+| Continuity | New session, or continuation after explicitly binding an existing session |
+| Concurrency | Overlapping executions of one task are forbidden |
+| Misfire | `skip` or `run_once` |
+| History | Accepted state, run identity, terminal state, and errors are retained |
+
+
+ Stopping Studio stops 24x7 wakeups. A cloud ScheduleStore, independent scheduler workers, and cross-Pod claims belong to a later cloud-projection phase.
+
+
+## Integrate the conversation surface
+
+`ConversationSurface` advertises accepted inputs, `ConversationInput` submits only allowed fields, and `ConversationItem` represents text, reasoning, tools, approvals, A2UI, and unknown output. Studio, Hosted UI, and custom clients merge live and replayed data with the same item identity.
+
+The core renderer provides a generic fallback. Provider-specific UI uses a controlled Renderer or A2UI surface. Unknown items remain visible and non-interactive: clients must not drop them or turn unrecognized data into an action. An approval item is writable only when it carries a durable revision; clients keep an item read-only when revision is missing.
+
+The surface becomes stable and writable only after the shared Web package, Studio, Hosted UI, and independent-client browser E2E gates pass.
+
+## Compatibility and release gates
+
+| Area | Current boundary |
+| --- | --- |
+| Existing Agents | The real 0.8.2 LangGraph Bundle v2 and older framework Bundles stay on the old Runtime path. A historical Harness enters the legacy adapter only when its exact source digest is explicitly registered; unknown v1 Bundles fail closed |
+| New Harness v2 | A ready DSH registration is mandatory; missing registration fails closed and never falls back to the legacy adapter |
+| Local storage | SQLite or memory remains available without PostgreSQL; high availability is not implied |
+| Third-party ecosystems | Claude Code, games, and arbitrary capabilities must use a standard DSH Bundle or native Codex App Server ownership and pass conformance |
+| Stable release | DSH, conversation browser, existing-Agent, clean-provenance, and public artifact audits in `make phase2-release-preflight` must all pass |
+
+A game extension can use one DSH Bundle to combine Tool, Store, Renderer/A2UI, and Studio slots, or contribute a dedicated AgentProvider for a complete game loop. It does not change the Kernel protocol and is not marked supported before permission, lifecycle, conversation-projection, and rollback tests pass.
diff --git a/docs-site/content/docs/framework/guides/plugins-and-automations.mdx b/docs-site/content/docs/framework/guides/plugins-and-automations.mdx
new file mode 100644
index 00000000..60005fdf
--- /dev/null
+++ b/docs-site/content/docs/framework/guides/plugins-and-automations.mdx
@@ -0,0 +1,130 @@
+---
+title: 插件与自动化
+status: experimental
+---
+
+Phase 2 提供本地优先的插件生命周期、生态宿主桥接、Scheduler Lite 和统一会话表面。当前能力仍处于未发布门禁阶段；已发布 Agent 和精确识别的历史 Bundle 继续使用原路径，不要求重建或升级 Runtime。
+
+Studio 与 Hosted UI 固定使用 `@kingsoftcloud/ksadk-web@0.3.4` 的版本化
+Conversation v1 headless 模块。候选源码、独立浏览器及真实部署的新/历史 Agent
+两轮会话已经验证；正式发布仍要求从公开 npm 制品重建并通过最终制品审计。
+
+
+ 本页不代表稳定版已经发布。云端 PluginHost、云端 24×7 调度、P2-06 DSH Codex Bundle/child Provider、Claude Code 和游戏插件执行均不在当前支持声明中。一个参考 DSH AgentProvider 的 E2E 通过不等于任意第三方 Provider 自动受支持。
+
+
+## 选择接入方式
+
+| 方式 | 所有者 | 当前用途 |
+| --- | --- | --- |
+| `dsh` | DeepSeek Harness / Cordis | 默认插件格式；Bundle 可贡献 AgentProvider、Tool、Renderer 和 Studio slot |
+| `codex` | Codex App Server | 兼容 Codex 官方插件，并保留 Codex 的原生宿主与权限语义 |
+| `linked` | 外部宿主 | 只发现或跳转，不能显示为已安装可执行 |
+
+KsADK 不定义第三种私有插件包、manifest 或 ABI。插件不会修改 Kernel 合同；新增 Runtime 由标准 DSH Bundle 贡献粗粒度 AgentProvider，Codex 插件继续由 App Server 管理。
+
+## 开发 DSH Bundle
+
+开发者不需要检出或编译 DeepSeek Harness 源码。先从公网 npm 安装 KsADK 固定版本的受管理 DSH CLI，再创建、校验、测试和打包标准 DSH Bundle：
+
+```bash title="shell"
+agentengine plugin toolchain status
+agentengine plugin toolchain install
+agentengine plugin create ./my-provider --name @example/my-provider
+agentengine plugin validate ./my-provider
+agentengine plugin test ./my-provider
+agentengine plugin pack ./my-provider --output-dir ./artifacts
+```
+
+生成目录是普通 npm 包，使用 DSH 的 `dsh.bundle.patch` / Cordis 组合格式，不包含 `ksadk-plugin.yaml`。`validate` 和 `test` 会在临时 Profile 中验证安装、投射、停用、启用和卸载；`pack` 使用固定 pnpm 按 npm `files` 语义生成 `.tgz`。
+
+把 Bundle 安装到隔离 Profile 后，可以通过同一套 DSH 生命周期命令管理：
+
+```bash title="shell"
+agentengine plugin install ./artifacts/example-my-provider-0.1.0.tgz \
+ --accept-host-permissions
+agentengine plugin disable @example/my-provider
+agentengine plugin enable @example/my-provider
+agentengine plugin uninstall @example/my-provider
+```
+
+发布门禁会从公网 npm 安装固定 DSH 工具链，并验证生成 Bundle、`.tgz`，以及官方 Codex subagent 包的格式和安装边界：
+
+```bash title="shell"
+KSADK_DSH_TOOLCHAIN_E2E=1 \
+uv run --extra all pytest -q tests/e2e/test_dsh_managed_toolchain_e2e.py
+```
+
+这项校验不代表 P2-06 的 DSH Codex Bundle/child Provider 执行链已经完成。另一个真实仓外 Node AgentProvider 会在受管 Profile 中完成安装、连续两轮、停用、损坏升级失败回滚、重新启用旧包继续执行和卸载。
+
+本地 DSH 源码若包含尚未发布的改动，编译结果可能与 npm 包不同。普通插件开发、CI 与发布始终以固定 npm 版本为兼容基线；只有 DSH 核心开发者验证下一版时才显式设置 `KSADK_DSH_BIN`，且版本不匹配会 fail closed。KsADK 只是包装官方命令，不复制 DSH 编译器。
+
+## 管理 Codex 插件
+
+Codex 插件的目录、安装状态和卸载由 Codex App Server 管理。KsADK 只调用宿主协议，不解释执行插件代码，也不会把 `.codex-plugin/plugin.json` 转换成 `ksadk-plugin.yaml`：
+
+```bash title="shell"
+agentengine plugin codex list
+agentengine plugin codex info
+agentengine plugin codex install --accept-host-permissions
+agentengine plugin codex uninstall
+```
+
+缺少 Codex App Server 时返回明确的 unavailable 错误。安装确认表示插件按当前系统用户的宿主权限运行；插件自己的认证仍在 Codex 中完成。
+
+## 管理 DSH Profile
+
+DSH 插件由隔离的 DeepSeek Harness Profile 管理。安装、启停、升级和卸载均调用受管理的原生 `dsh plugin`，修改后通过宿主配置预检。目录或 `.tgz` 会按 SHA-256 固化为不可变安装源；启用、更新或投影前发现摘要漂移会 fail closed，失败升级会恢复旧 manifest、lock、状态与可执行旧包：
+
+```bash title="shell"
+export KSADK_DSH_HOME=/path/to/isolated/dsh-home
+export KSADK_DSH_PROFILE=studio
+
+agentengine plugin list
+agentengine plugin install --accept-host-permissions
+agentengine plugin disable
+agentengine plugin enable
+agentengine plugin profile
+agentengine plugin uninstall
+```
+
+`agentengine plugin dsh ...` 只保留为早期脚本兼容别名。
+
+DSH bundle 可能运行安装脚本，必须显式确认宿主权限。只有通过握手、权限、会话投影与执行 conformance 的 AgentProvider 才能出现在 Runtime 选择器中。
+
+## 创建本地定时任务
+
+Studio 的 **自动化** 页面支持 once、interval 和 cron，并使用 IANA 时区。任务可以启停、编辑、删除、立即运行；详情页显示下次运行时间和 occurrence 状态历史。Agent 详情页的 **自动化** Tab 只展示并创建当前 Agent 的任务。
+
+| 能力 | 当前行为 |
+| --- | --- |
+| 存储 | 工作区本地 SQLite |
+| 触发 | Studio 本地进程中的 Scheduler Lite |
+| 连续性 | 新会话，或显式绑定已有 session 后续接 |
+| 并发 | 同一任务禁止重叠执行 |
+| 误点补偿 | `skip` 或 `run_once` |
+| 历史 | 保留 accepted、run identity、terminal 状态和错误信息 |
+
+
+ Studio 进程停止后不会提供 24×7 唤醒。云端持久 ScheduleStore、独立 scheduler worker 和跨 Pod claim 属于后续端云阶段。
+
+
+## 接入会话表面
+
+`ConversationSurface` 声明输入能力，`ConversationInput` 只提交已允许的字段，`ConversationItem` 表示文本、reasoning、工具、审批、A2UI 和未知输出。Studio、Hosted UI 和自定义前端使用相同的 item identity 进行增量归并与重放。
+
+核心 Renderer 提供通用降级；Provider 特有的 UI 应通过受控 Renderer 或 A2UI surface 扩展。未知 item 必须保持可见和不可执行，不能丢弃，也不能把未经识别的数据变成可点击操作。审批 item 只有在携带持久 revision 时才允许提交；缺少 revision 的客户端保持只读。
+
+共享 Web 包、Studio、Hosted UI 与独立前端的浏览器 E2E 全部通过后，才会把这一表面标记为稳定可写。
+
+## 兼容与发布门禁
+
+| 项目 | 当前边界 |
+| --- | --- |
+| 历史 Agent | 真实 0.8.2 LangGraph Bundle v2 和更早 framework Bundle 继续走旧 Runtime；历史 Harness 只有命中显式登记的精确来源摘要才进入 legacy adapter，未知 v1 fail closed |
+| 新 Harness v2 | 必须解析到就绪的 DSH registration；缺失时 fail closed，不回退 legacy adapter |
+| 本地存储 | 无 PostgreSQL 时继续使用 SQLite 或 memory；高可用能力不被伪造 |
+| 第三方生态 | Claude Code、游戏和任意能力必须由标准 DSH Bundle 承载，或由 Codex App Server 原生管理，并通过 conformance |
+| 稳定发布 | `make phase2-release-preflight` 中的 DSH、会话浏览器、历史 Agent、clean provenance 和公开制品审计必须全部通过 |
+
+游戏类扩展可以由一个 DSH Bundle 组合 Tool、Store、Renderer/A2UI 和 Studio slot；完整游戏循环可以贡献独立 AgentProvider。它们都不需要修改 Kernel 协议，但在通过权限、生命周期、会话投影和回滚测试前，不会显示为已支持插件。
diff --git a/docs-site/content/docs/framework/guides/runtime-architecture.en.mdx b/docs-site/content/docs/framework/guides/runtime-architecture.en.mdx
index 5f7451d9..72d4a263 100644
--- a/docs-site/content/docs/framework/guides/runtime-architecture.en.mdx
+++ b/docs-site/content/docs/framework/guides/runtime-architecture.en.mdx
@@ -2,357 +2,158 @@
title: "Runtime Architecture"
---
-KsADK local runtime has one central job: load a user agent project, adapt the
-selected framework to a common runner interface, and expose predictable local
-protocols for terminal, browser, and API clients.
+KsADK separates runtime control, execution, and presentation into three stable boundaries. Agent Kernel owns trusted control. Harness and PluginHost own composition and lifecycle. Each Provider owns native framework execution. Results enter one event fact chain and are then projected to APIs, Studio, and hosted surfaces.
-## Layer Model
+
-
+## Layers and Main Flow
-Entry → Boot → HTTP/UI → Conversations Runtime → Runner / RuntimeAdapter → Session and RuntimeEvent persistence. The important boundary is that the HTTP server and conversation runtime do not need to know whether the user project is ADK, LangGraph, LangChain, DeepAgents, or Codex. Code projects use `BaseRunner`; cross-Runtime control uses `RuntimeAdapter`.
+```text
+Access
+ -> Agent Kernel
+ -> PluginHost loads the plugin composition
+ -> Harness selects one Provider for the Activation
+ -> Provider executes natively
+ -> RuntimeEvent v2
+ -> SessionEvent log
+ -> API / Studio / hosted-surface projections
+```
+
+Shared capabilities do not become another step in the main execution chain. Context, tools, safety, MCP, Skill, sandbox, memory, and observability are injected into Harness through a capability bus. The Provider keeps framework-specific thread, checkpoint, and event semantics.
## Core Packages
| Package | Responsibility |
| --- | --- |
-| `ksadk.cli` | command entry points, local process setup, user-facing errors |
-| `ksadk.detection` | project config, entry file, framework, and agent variable detection |
-| `ksadk.runners` | common runner contract and framework adapters |
-| `ksadk.runtime` | 0.8 RuntimeAdapter, RuntimeEvent, and cancel / resume / checkpoint boundary |
-| `ksadk.harness` | minimal YAML composition root that reuses the Runtime data plane |
-| `ksadk.server` | FastAPI app, local Web UI APIs, OpenAI-compatible endpoints |
-| `ksadk.conversations` | message normalization, session turn orchestration, protocol payloads |
+| `ksadk.kernel` | control permits, admission, Inbox, leases, fencing, state, and recovery |
+| `ksadk.harness` | Harness configuration, tools, sandbox, reasoner, and native RuntimeAdapter |
+| `ksadk.plugins` | plugin contracts, composition compiler, resolver, PluginHost, Providers, and subagent bridges |
+| `ksadk.events` | RuntimeEvent v2, identity, storage, reducers, replay, and protocol projections |
+| `ksadk.scheduler` | local Scheduler Lite, calendar calculation, task storage, and control-command dispatch |
+| `ksadk.runtime` | cross-Runner, Harness, Codex, and A2A runtime-control interface |
+| `ksadk.server` | FastAPI application, standard APIs, local Studio, and protocol entrypoints |
+| `ksadk.conversations` | turn orchestration, normalized input, session writes, and protocol payloads |
| `ksadk.sessions` | local and pluggable session storage |
-| `ksadk_runtime_common.workspace_files` | reusable workspace file routes and preview security |
+| `ksadk.runners` | Runner adapters for existing framework projects |
-## Startup Lifecycle
+## Startup and Entry
-`agentengine run` and `agentengine web` follow the same broad path:
+`agentengine run`, `agentengine web`, and standard APIs converge on the same runtime boundary.
- 1. resolve the project directory.
- 2. re-execute inside the project virtual environment when needed.
- 3. load environment and project settings.
- 4. detect the framework and entry point, or read a declarative Codex manifest.
- 5. create the matching Runner / RuntimeAdapter.
- 6. load the user Agent, or validate the native managed Runtime.
- 7. run terminal mode or start the local HTTP server.
-
-
-
-If framework detection returns `unknown`, the CLI stops before importing the user project as a runner.
-
-
-
-
-
-
-## Startup Boundaries
-
-The local runtime has a strict startup boundary:
-
-
- 1. CLI code resolves paths, configuration, environment variables, and the
- project virtual environment.
- 2. detection code decides which framework adapter should be used.
- 3. the runner factory creates a framework-specific runner.
- 4. the runner loads user code.
- 5. the server layer exposes HTTP protocols and delegates execution to the
- runner.
+ 1. The CLI or Server resolves the project directory, environment, and `agentengine.yaml`.
+ 2. Explicit configuration or detection selects a Runner, Harness, or plugin Provider path.
+ 3. Application assembly wires FastAPI routes, lifecycle, authentication, and session entrypoints.
+ 4. Agent Kernel applies admission and state protection to requests that require trusted control.
+ 5. Harness creates an Activation, binds shared capabilities, and selects a Provider.
+ 6. The Provider executes its native framework logic and sends events into the fact chain.
-Detection happens before user code is imported. That distinction is important for safety and debuggability: a broken module import should be reported as an agent loading problem, while a missing `agentengine.yaml`, invalid entry point, or unsupported framework should be reported as a project detection problem.
+ `agentengine.yaml` should declare the framework and entrypoint explicitly. Detection failures are project-loading errors and should not surface only after user code is imported.
-For public examples, keep project setup explicit:
-
-```yaml title="agentengine.yaml"
-name: support-agent
-framework: langgraph
-entry_point: agent.py
-agent_variable: root_agent
-```
+## Agent Kernel: Trusted Control Boundary
-Explicit configuration reduces ambiguity in CI and makes the same project work
-the same way under `agentengine run`, `agentengine web`, local API tests, and
-packaging checks.
+Agent Kernel does not execute Agent business logic. It centralizes control semantics that affect safety and consistency in one verifiable boundary.
-## Framework Detection
+| Capability | Constraint |
+| --- | --- |
+| permits and admission | control commands without a valid permit do not enter execution |
+| Inbox and ordering | commands are persisted before a Worker claims them in order |
+| leases and fencing | an expired owner cannot continue writing newer state |
+| concurrency and backpressure | queue capacity, duplicate commands, and parallel work use stable error semantics |
+| cancel and resume | cancel, resume, interaction replies, and checkpoint targets remain explicit |
+| state consistency | run state, control receipts, and event writes share write guards |
-Detection uses explicit configuration first, then convention:
+The storage backend defines durability. Memory suits local or single-process ephemeral runs. SQLite provides local persistence. PostgreSQL supports hosted runtimes that need cross-process takeover and transactional fencing. A durable configuration without its required backend fails at startup instead of silently degrading.
-
+## Harness and Provider: Execution Boundary
+Harness is a stable host, not another Agent framework. It unifies control entry, tool access, session continuity, context, and event output without rewriting a Provider's native execution model.
+| Harness / Host owns | Provider owns |
+| --- | --- |
+| Activation creation and close | native framework execution |
+| plugin graph and capability bindings | private thread, checkpoint, or session state |
+| permission admission and health checks | native tool calls and event semantics |
+| profile fencing and atomic switching | declared cancel, resume, and checkpoint behavior |
+| canonical event exit | Provider events that can be adapted without losing identity |
-
-Public samples should include `agentengine.yaml` because explicit config is easier to review and less dependent on source-code heuristics.
-
+Each Activation selects exactly one Agent Provider. The current plugin package contains a Codex native Provider, KsADK Harness Provider, DSH / Cordis Provider, and SubagentProvider. They share one host contract without pretending to expose identical capabilities.
-The convention-based fallback is still useful for quick experiments. It checks
-common project layouts such as:
+## Plugin Composition and Lifecycle
-- a root `agent.py`, `main.py`, or `app.py`.
-- a package directory with `agent.py`, `main.py`, `app.py`, or `__init__.py`.
-- a `src/` layout.
-- `langgraph.json` graph targets.
+The composition compiler converts an editable Studio Agent revision into an immutable plugin graph. Plugin references use exact versions, capabilities bind to explicit Definitions and slots, and sensitive configuration accepts secret references instead of clear values.
-
-When convention detection is used, the runtime still needs two concrete facts: which file should be imported and which variable inside that file is the agent object. If either value is ambiguous, add `agentengine.yaml` instead of relying on heuristics.
-
+
+ 1. The compiler normalizes runtime, Session, Memory, Context, Renderer, MCP, and Skill bindings.
+ 2. The resolver produces locked versions and digests.
+ 3. PluginHost resolves, admits permissions, stages, and health-checks the candidate graph.
+ 4. A healthy graph switches atomically. Failure preserves the old graph and disposes candidate effects.
+ 5. Existing sessions retain their original Provider-private state until they close, after which the retired graph is reclaimed.
+
-## Runner Contract
+This lifecycle allows configuration switching without tearing an active run.
-Every runner implements the same conceptual contract:
+## Shared Capability Bus
-| Method | Meaning |
+| Capability | Injected content |
| --- | --- |
-| `load_agent()` | import and prepare the user agent object |
-| `invoke(input_data)` | execute one non-streaming turn |
-| `stream(input_data)` | execute one streaming turn |
-| `prepare_for_request(model)` | apply per-request model override where supported |
-| `close()` | release resources when the server shuts down |
+| context and prompts | history compaction, prompt assembly, snapshots, and contributor output |
+| tools and safety | tool catalog, policy, approvals, permissions, and secret references |
+| MCP and Skill | resource discovery, materialized plugin capabilities, and invocation entrypoints |
+| sandbox and workspace | isolated execution, file access, and command boundaries |
+| memory and knowledge | Memory and KnowledgeBase context |
+| tracing and evaluation | Trace, metrics, event correlation, and Eval data |
-This contract is intentionally narrow. Framework-specific behavior belongs in
-the adapter, not in the FastAPI endpoint.
+Capability plugins reach the Provider through a read-only execution context. An MCP or Skill binding without a materialized plugin owner is rejected during the build, preventing a resource from appearing enabled while remaining unavailable at runtime.
-The narrow contract also defines where custom behavior should live:
+## Automated Tasks
-| Need | Preferred location |
-| --- | --- |
-| custom state mapping for LangGraph | `ksadk_prepare_state` in the user module |
-| custom input mapping for LangChain | `ksadk_prepare_input` in the user module |
-| model override handling | runner `prepare_for_request()` |
-| framework-native session continuity | runner session adapter |
-| protocol-specific JSON/SSE formatting | server and conversation runtime |
+Scheduler Lite provides deterministic calendar calculations, local task storage, and due-task dispatch. A triggered task enters the same Agent Kernel and Harness chain instead of creating a second runtime.
-
-If you are adding a new framework adapter, start with `BaseRunner` and implement `load_agent()`, `invoke()`, and `stream()` first. Add session continuity, dynamic model overrides, or protocol-specific event mapping only after the basic invoke and stream paths are stable.
-
+| Component | Responsibility |
+| --- | --- |
+| `SchedulerEngine` | calculate due tasks and maintain occurrence and retry semantics |
+| `SchedulerSQLiteStore` | persist local tasks and scheduling state |
+| `AgentControlSchedulerDispatcher` | convert a schedule trigger into an AgentControl command |
-## RuntimeAdapter (0.8)
+## Event Fact Chain
-`RuntimeAdapter` is the platform runtime interface shared by runners, Harness,
-Codex, and A2A. Ordinary projects do not implement it directly; use it when
-integrating a new Runtime or handing a Runtime to the platform control plane. It
-normalizes native differences into these fixed semantics:
+ADK, LangGraph, Codex, A2A, and Harness events are converted by their adapters into `RuntimeEvent(schema_version=2)`. The adapters preserve source, scope, item, and event identity instead of deduplicating broadly by author or text.
-| Verb | Meaning |
+| Stage | Responsibility |
| --- | --- |
-| `start(request)` | starts a run with user, session, optional model, and configuration and returns an opaque `RunHandle`. |
-| `stream(handle)` | yields normalized `RuntimeEvent` values asynchronously; it is not a duplex channel. |
-| `cancel(handle)` | returns an explicit state (interrupted, pending recorded, not running, or failed), not an ambiguous boolean. |
-| `resume(handle, target, payload)` | represents a resume target separately from approval, tool, or human response payload. |
-| `checkpoint(handle)` | returns the actually declared checkpoint granularity and durability; it does not assume every Runtime can roll back. |
-| `close(handle)` | releases resources held by the run. |
-
-`stream` carries events only; approval decisions, tool results, and HITL input use
-`resume`. This gives AG-UI/A2UI, A2A, and session replay one event boundary and
-prevents a framework's private SSE semantics from leaking to callers.
-`attach(handle)` is the optional cross-process restoration seam and defaults to
-fail-closed: persisting a handle does not prove that a native Runtime is restored
-in the current process.
-
-For a new Runtime, first cover the normal `BaseRunner` path with
-`RunnerRuntimeAdapter`, then declare cancel, resume, and checkpoint capabilities
-one by one. Do not hide framework differences behind a fabricated “fully
-supported” capability.
-
-## Agent Runtime V2 Phase 1 Control Foundation
-
-Version 0.8.2 adds an optional Agent Kernel control foundation. It does not
-silently migrate every historical Agent to the new path. The
-`AgentControlChannel/v1`, `SessionEventEnvelope/v1`, `ActivationLease/v1`,
-`RuntimeCapabilityMatrix/v1`, and `Interaction/v1` contracts are locked by JSON
-Schema, golden fixtures, an aggregate digest, and an additive-only gate. Gateway
-owns trusted routing, Server owns admission and permit issuance, and Runtime
-rejects control commands without a valid permit.
-
-| Store mode | Intended scope | Restart / multi-Pod semantics |
-| --- | --- | --- |
-| InMemory | local development or an explicitly ephemeral single-Pod hosted Runtime | no restart recovery or cross-Pod takeover promise |
-| SQLite | local single-process persistence | local restart persistence without multi-Pod owner semantics |
-| PostgreSQL | highly available hosted Runtime | durable Inbox, nonce, lease, transactional fencing, and takeover |
-
-PostgreSQL is not a universal prerequisite for Agent Kernel. A single-replica
-hosted Agent can explicitly use `memory` with
-`AGENT_KERNEL_DURABILITY_TIER=ephemeral`; PostgreSQL is required only when the
-deployment declares durable, highly available, or cross-Pod recovery semantics.
-Selecting `postgres` without a DSN fails startup because that is a configuration
-error, not a failure that can be silently downgraded.
-
-An older Runtime artifact without version, source, commit id, or an Agent Kernel
-contract digest stays on the historical path and reports the missing fields as
-unknown. An Operator upgrade alone does not auto-enroll it. Only a new deployment
-with an explicit enable flag and a matching digest enters the Kernel path, so the
-control plane can be upgraded before Runtimes are migrated one by one.
-
-## Request Lifecycle
-
-A normal non-streaming `/v1/responses` request follows this path:
-
-```mermaid
-sequenceDiagram
- autonumber
- participant C as Client
- participant API as FastAPI endpoint
- participant Conv as conversations.runtime
- participant Store as session service
- participant Runner as BaseRunner
-
- C->>API: POST /v1/responses
- API->>Conv: invoke_conversation_once
- Conv->>Store: ensure session
- Conv->>Store: append user_message
- Conv->>Conv: build_run_input (history + context)
- Conv->>Conv: PlatformInvocationContext
- Conv->>Store: append run_status=in_progress
- Conv->>Runner: platform_invocation_scope → invoke(payload)
- alt recoverable error
- Runner-->>Conv: raise exception
- Conv->>Conv: fallback_model retry (one attempt)
- Conv->>Store: append run_status=in_progress (fallback)
- Conv->>Runner: invoke(payload) again
- else prompt-too-long
- Runner-->>Conv: raise PTL exception
- Conv->>Store: compact_conversation_history
- Conv->>Runner: invoke(payload) again
- end
- Runner-->>Conv: result (output + metadata)
- opt checkpoint metadata present
- Conv->>Store: append run_checkpoint
- end
- Conv->>Store: append assistant_message
- Conv->>Store: append run_status=completed
- Conv-->>API: output text + metadata
- API-->>C: response object
-```
+| framework event adapters | preserve Provider source and native item identity |
+| RuntimeEvent v2 | represent run, item, content, tool, interaction, and error facts |
+| SessionEvent log | persist ordering, run state, and facts required for recovery |
+| reducer and replay | apply identity-aware append, replace, completed, and final-output selection |
+| protocol projections | generate Responses, Chat, Studio, A2A, and hosted-surface views |
-Streaming uses the same preparation path, then serializes internal semantic
-events into server-sent events. Text deltas, reasoning, tool calls, tool results,
-approval interrupts, final output, and errors are represented as runtime events
-before they become protocol-specific SSE payloads.
-
-## Streaming Event Model
-
-Streaming output is normalized before it is serialized. Framework adapters may
-emit very different native events, but the conversation runtime expects a small
-set of semantic chunk types:
-
-| Chunk type | Meaning | Typical source |
-| --- | --- | --- |
-| `text` | assistant text delta | model token stream |
-| `thinking` | reasoning or thought delta when available | provider or ADK event |
-| `tool_call` | tool call started or arguments updated | LangGraph, ADK, MCP, or custom tool event |
-| `tool_result` | tool output became available | framework tool result event |
-| `interrupt` | run paused for approval or external input | graph interrupt or approval flow |
-| `final` | final authoritative output | framework final state |
-| `error` | execution failed | runner or protocol exception |
-
-The protocol layer then maps those semantic events to `/v1/responses`,
-`/v1/chat/completions`, `/run_sse`, or the local Web UI action format. This is
-why application code should not depend on a specific SSE event name unless it is
-writing a client for that exact public protocol.
-
-### Model Policy And Thinking Semantics
-
-Whether a `thinking` chunk appears, and how reasoning content is injected, is
-decided by the runtime's unified model policy and thinking-disable injection
-semantics (unified from 0.6.6, disable injection completed in 0.6.7):
-
-- **Unified model policy**: hosted deployments inject primary / multimodal /
- fallback defaults through `AGENTENGINE_MODEL_POLICY_JSON`, shared by Hermes,
- OpenClaw, and generic agents. Explicit request parameters or explicit
- environment variables still take precedence over policy defaults.
-- **Fallback retry**: the conversation runtime automatically retries once with
- the fallback model on recoverable errors such as timeouts, rate limiting, 5xx,
- model unavailability, or permission/quota errors. 400 parameter errors,
- business errors, and tool errors are not swallowed. When fallback triggers,
- the next streaming turn may switch to the fallback backend, and whether a
- `thinking` chunk appears depends on the target model's capability.
-- **Thinking-disable injection**: when `model_options.thinking` is disabled
- (`reasoning.effort=none`, `thinking.type=disabled`, or
- `max_reasoning_tokens<=0`), the runtime automatically injects
- `enable_thinking=false` and `chat_template_kwargs.enable_thinking=false` into
- `extra_body` (compatible with DeepSeek-style models) and filters reasoning
- output items from the stream, so no `thinking` chunk is emitted over SSE.
-
-For the policy JSON structure, catalog fields, and injection details see
-[Environment Variables](../../references/environment-variables).
-
-## Session And Context Boundary
-
-Every turn builds a `PlatformInvocationContext` before calling the runner. It
-contains the stable identifiers and runtime facts a framework adapter may need:
-
-- `agent_id`, `user_id`, `session_id`, and invocation metadata.
-- normalized input content and message history.
-- effective attachments and current-turn attachments.
-- model, model metadata, and model options.
-- knowledge and memory context when those integrations are enabled.
-
-The runner receives this context as part of the prepared input. Business logic
-should prefer the documented runner payload fields and framework hooks over
-reading private server globals. That keeps local terminal runs, Web UI runs, and
-OpenAI-compatible API calls aligned.
-
-## Checkpoint, Resume, And Cooperative Cancel
-
-
-KsADK introduces a framework-level checkpoint/resume capability layer and
-completes `CancelRun` cooperative cancellation.
+
+ `RuntimeEvent v2` is the write path. v1 remains a read-only compatibility projection; new runtime events are not written as v1.
+## Sessions and Protocols
-Run-level checkpoint, resume, and cancel sit on top of the session store and
-framework checkpoint backend, as a capability layer independent of streaming
-chunks. The conversation runtime writes a `run_status` event on every turn and
-exposes recovery and cancel entry points at checkpoint boundaries:
-
-| Capability | Meaning | Trigger |
-| --- | --- | --- |
-| checkpoint write | persists a resumable snapshot at a turn boundary | runner writes it on turn completion or interrupt |
-| resume | resumes a run from a checkpoint | `POST /agentengine/api/v1/ResumeRun` |
-| preview | previews resume content and impact | `POST /agentengine/api/v1/GetCheckpointResumePreview` |
-| list | lists checkpoints under a session | `POST /agentengine/api/v1/ListSessionCheckpoints` |
-| cooperative cancel | requests an in-flight run to stop | `POST /agentengine/api/v1/CancelRun` |
-
-`CancelRun` is a **cooperative cancel**: the runtime observes the cancel request
-at the next runner cooperation point (for example the next streaming chunk, a
-tool call boundary, or an interrupt checkpoint), stops the run, writes
-`run_status=cancelled`, and preserves already-produced checkpoints and events
-for later resume where possible. It does not hard-kill the process or discard
-already-persisted turns.
-
-Resume capability is gated by both `RuntimeCapabilities.ResumeRun.ResumeMode`
-and `RunLifecycle` returned from `GetAgentUiBootstrap` (`time_travel` /
-`forward_only` / `none`); the frontend entry point must satisfy both
-`RunLifecycle.Checkpoints` and `RunLifecycle.CheckpointResume` before being
-shown.
-
-For the full action paths, ResumeMode semantics, `SubscribeRunEvents` replay,
-and the 5-minute server protection timeout see
-[Sessions And Files](../../references/runtime-sessions-files).
-
-## Local Protocol Entrypoints
+Each turn receives a stable invocation context with Agent, user, Session, input, attachments, model options, and enabled memory and knowledge. Providers read the public context and capability bindings instead of Server-private global state.
| Endpoint | Purpose |
| --- | --- |
-| `POST /v1/responses` | preferred OpenAI-compatible local protocol |
-| `POST /v1/chat/completions` | compatibility with Chat Completions clients |
-| `POST /agentengine/api/v1/RunAgent` | local Web UI action-style protocol |
-| `POST /run_sse` | ADK Web compatible local execution path |
-| `POST /agentengine/api/v1/UploadFile` | local file upload for UI flows |
-| `/_ksadk/workspace/v1/*` | workspace file list/read/write/delete routes |
+| `POST /v1/responses` | preferred standard invocation protocol |
+| `POST /v1/chat/completions` | Chat Completions compatibility |
+| `POST /agentengine/api/v1/RunAgent` | Studio action-style invocation |
+| `POST /run_sse` | ADK Web-compatible execution path |
+| `POST /agentengine/api/v1/CancelRun` | cooperative cancellation |
+| `POST /agentengine/api/v1/ResumeRun` | capability-gated run recovery |
-
-External clients should prefer `/v1/responses` unless they are integrating with the local Web UI itself.
-
+External clients should prefer `/v1/responses`. Studio and hosted surfaces use SessionEvent projections and subscriptions to receive consistent views.
+
+## Platform Boundary
-## Public Documentation Boundary
+The KsADK runtime contains the SDK, CLI, Server, Kernel, Harness, plugin host, Providers, events, and local stores. Agent registration, remote deployment lifecycle, gateway governance, hosted Skill and Sandbox services, and OTLP backends remain external platform responsibilities connected through explicit contracts.
-This page describes the public local runtime architecture. It intentionally does not publish private gateway behavior, internal cluster deployment details, internal kubeconfig paths, private registry names, or customer-specific runbooks.
+ Public documentation excludes private gateway behavior, internal cluster paths, private registries, and customer-specific operations.
diff --git a/docs-site/content/docs/framework/guides/runtime-architecture.mdx b/docs-site/content/docs/framework/guides/runtime-architecture.mdx
index c8b84e5f..ea52a05a 100644
--- a/docs-site/content/docs/framework/guides/runtime-architecture.mdx
+++ b/docs-site/content/docs/framework/guides/runtime-architecture.mdx
@@ -2,316 +2,158 @@
title: "运行时架构"
---
-KsADK 本地运行时的核心职责是：加载用户 Agent 项目，把所选框架适配到统一 Runner
-接口，并为终端、浏览器和 API 客户端暴露可预测的本地协议。
+KsADK 运行时把控制、执行与呈现拆成三个稳定边界：Agent Kernel 负责可信控制，Harness 与 PluginHost 负责装配和生命周期，Provider 负责框架原生执行。执行结果进入统一事件事实链，再投影到 API、Studio 与托管界面。
-## 分层模型
+
-
+## 分层与主线
-入口 → 启动 → HTTP/UI → 对话运行时 → Runner / RuntimeAdapter → Session 与 RuntimeEvent 持久化。关键边界是：HTTP server 和对话运行时不需要知道用户项目是 ADK、LangGraph、LangChain、DeepAgents 还是 Codex；代码项目经 `BaseRunner`，跨 Runtime 控制面经 `RuntimeAdapter`。
+```text
+使用入口
+ → Agent Kernel
+ → PluginHost 装载插件组合
+ → Harness 为 Activation 选择一个 Provider
+ → Provider 原生执行
+ → RuntimeEvent v2
+ → SessionEvent 日志
+ → API / Studio / 托管界面投影
+```
+
+共用能力不占据主执行链。上下文、工具、安全、MCP、Skill、沙箱、记忆和观测通过能力总线注入 Harness；Provider 仍然保留框架特定的线程、checkpoint 和事件语义。
## 核心包
-| Package | 职责 |
+| Package | 责任 |
| --- | --- |
-| `ksadk.cli` | 命令入口、本地进程准备、用户可读错误 |
-| `ksadk.detection` | 项目配置、入口文件、框架和 Agent 变量检测 |
-| `ksadk.runners` | 统一 Runner 契约和框架适配器 |
-| `ksadk.runtime` | 0.8 RuntimeAdapter、RuntimeEvent、取消 / 恢复 / checkpoint 边界 |
-| `ksadk.harness` | 最小 YAML composition root，复用 Runtime 数据面 |
-| `ksadk.server` | FastAPI app、本地 Web UI API、OpenAI 兼容 endpoint |
-| `ksadk.conversations` | 消息规范化、session turn 编排、协议 payload |
-| `ksadk.sessions` | 本地和可插拔 session 存储 |
-| `ksadk_runtime_common.workspace_files` | 可复用工作区文件路由和预览安全 |
-
-## 启动生命周期
-
-`agentengine run` 和 `agentengine web` 大体路径一致：
-
-
- 1. 解析项目目录。
- 2. 必要时重新进入项目虚拟环境执行。
- 3. 加载环境变量和项目设置。
- 4. 检测框架和入口点，或读取 Codex 声明式 manifest。
- 5. 创建匹配的 Runner / RuntimeAdapter。
- 6. 加载用户 Agent，或验证本机托管 Runtime。
- 7. 进入终端模式或启动本地 HTTP server。
-
-
-
-如果框架检测结果是 `unknown`，CLI 会在导入用户代码作为 Runner 之前停止，避免把不可识别的项目当成 Runner 加载。
-
-
-
-
-
+| `ksadk.kernel` | 控制许可、准入、Inbox、lease、fencing、状态与恢复 |
+| `ksadk.harness` | Harness 配置、工具、沙箱、reasoner 与原生 RuntimeAdapter |
+| `ksadk.plugins` | 插件契约、组合编译、解析、PluginHost、Provider 与子代理桥接 |
+| `ksadk.events` | RuntimeEvent v2、身份、存储、reducer、回放与协议投影 |
+| `ksadk.scheduler` | 本地 Scheduler Lite、日历计算、任务存储与控制命令分发 |
+| `ksadk.runtime` | 跨 Runner、Harness、Codex 与 A2A 的运行控制接口 |
+| `ksadk.server` | FastAPI 应用、标准 API、本地 Studio 和协议入口 |
+| `ksadk.conversations` | turn 编排、输入规范化、会话写入和协议 payload |
+| `ksadk.sessions` | 本地及可插拔的会话存储 |
+| `ksadk.runners` | 历史框架项目的 Runner 适配层 |
-## 启动边界
+## 启动与入口
-本地运行时有严格启动边界：
+`agentengine run`、`agentengine web` 和标准 API 最终进入同一运行时边界。
- 1. CLI 代码解析路径、配置、环境变量和项目虚拟环境。
- 2. detection 代码决定使用哪个框架适配器。
- 3. runner factory 创建框架特定 Runner。
- 4. runner 加载用户代码。
- 5. server 层暴露 HTTP 协议并委托给 runner。
+ 1. CLI 或 Server 解析项目目录、环境变量与 `agentengine.yaml`。
+ 2. 显式配置或检测逻辑确定 Runner、Harness 或插件化 Provider 路径。
+ 3. 应用装配 FastAPI 路由、生命周期、认证和会话入口。
+ 4. Agent Kernel 对需要可信控制的请求执行准入与状态保护。
+ 5. Harness 创建 Activation，绑定共用能力并选择 Provider。
+ 6. Provider 执行原生框架逻辑，事件进入统一事实链。
-检测发生在导入用户代码之前。这个区别对安全和调试很重要：模块导入失败应报告为 Agent 加载问题；缺少 `agentengine.yaml`、入口点无效或框架不受支持，应报告为项目检测问题。
+ `agentengine.yaml` 应明确声明框架与入口点。检测失败属于项目装载问题，不应在导入用户代码后才表现为运行错误。
-公开示例应保持项目配置明确：
-
-```yaml title="agentengine.yaml"
-name: support-agent
-framework: langgraph
-entry_point: agent.py
-agent_variable: root_agent
-```
-
-## 框架检测
-
-检测优先使用显式配置，再使用约定：
-
-
-
+## Agent Kernel：可信控制边界
+Agent Kernel 不执行具体 Agent 逻辑。它把影响安全与一致性的控制语义集中到一个可验证边界。
-
-公开 sample 推荐包含 `agentengine.yaml`，因为显式配置更容易审核，也较少依赖源码启发式。
-
-
-约定检测仍适合快速实验。它会检查：
-
-- 根目录 `agent.py`、`main.py` 或 `app.py`。
-- 包目录中的 `agent.py`、`main.py`、`app.py` 或 `__init__.py`。
-- `src/` 布局。
-- `langgraph.json` graph target。
-
-
-当使用约定检测时，运行时仍然需要两个事实：导入哪个文件，以及该文件里的哪个变量是 Agent 对象。如果任一值不明确，就添加 `agentengine.yaml`。
-
-
-## Runner 契约
-
-每个 Runner 都实现同一组概念契约：
-
-| 方法 | 含义 |
-| --- | --- |
-| `load_agent()` | 导入并准备用户 Agent 对象 |
-| `invoke(input_data)` | 执行一次非流式 turn |
-| `stream(input_data)` | 执行一次流式 turn |
-| `prepare_for_request(model)` | 在支持时应用单请求模型覆盖 |
-| `close()` | server shutdown 时释放资源 |
-
-这个契约刻意保持窄。框架特定行为留在 adapter 中，而不是塞进 FastAPI endpoint。
-
-| 需求 | 推荐位置 |
+| 能力 | 约束 |
| --- | --- |
-| LangGraph 自定义 state mapping | 用户模块中的 `ksadk_prepare_state` |
-| LangChain 自定义 input mapping | 用户模块中的 `ksadk_prepare_input` |
-| 模型覆盖处理 | Runner 的 `prepare_for_request()` |
-| 框架原生 session continuity | Runner session adapter |
-| 协议 JSON/SSE 格式化 | server 和对话运行时 |
+| 许可与准入 | 未通过许可校验的控制命令不会进入执行路径 |
+| Inbox 与顺序 | 控制命令先持久化，再由 Worker 有序领取 |
+| Lease 与 fencing | 过期持有者不能继续写入新的状态 |
+| 并发与背压 | 队列容量、重复命令和并行处理使用稳定错误语义 |
+| 取消与恢复 | 取消、恢复、交互回包与 checkpoint 目标显式分离 |
+| 状态一致性 | 运行状态、控制回执与事件写入共享写入保护 |
-
-新增框架 adapter 时，先从 `BaseRunner` 开始实现 `load_agent()`、`invoke()` 和 `stream()`。session continuity、动态模型覆盖或协议事件映射应在基础路径稳定后再加。
-
+存储后端决定耐久等级：内存适合本地或单进程临时运行，SQLite 适合本地持久化，PostgreSQL 用于需要跨进程接管与事务 fencing 的托管运行时。配置为持久模式却缺少后端时应启动失败，不做静默降级。
-## RuntimeAdapter（0.8）
+## Harness 与 Provider：执行边界
-`RuntimeAdapter` 是跨 Runner、Harness、Codex 和 A2A 的平台运行接口。普通项目不需要
-直接实现它；只有接入一个新的 Runtime 或把 Runtime 交给平台控制面时才应使用。它把原生
-差异收敛为以下固定语义：
+Harness 是稳定宿主，不是新的 Agent 框架。它统一控制入口、工具接入、会话连续性、上下文和事件出口，但不重写 Provider 的原生执行模型。
-| 动词 | 语义 |
+| Harness / Host 负责 | Provider 负责 |
| --- | --- |
-| `start(request)` | 以用户、session、可选模型和配置启动 run，返回不透明 `RunHandle`。 |
-| `stream(handle)` | 输出规范化 `RuntimeEvent` 异步事件流；它不是双工通道。 |
-| `cancel(handle)` | 返回明确的取消状态（已中断、记录 pending、未运行或失败），而非模糊布尔值。 |
-| `resume(handle, target, payload)` | 将恢复目标与审批/工具/人工回包分开表达。 |
-| `checkpoint(handle)` | 返回真实声明的 checkpoint 粒度与持久化能力，不假设所有 Runtime 都能回滚。 |
-| `close(handle)` | 释放 run 占用的运行期资源。 |
-
-`stream` 只传事件；审批决定、工具结果和 HITL 输入走 `resume`。这使 AG-UI/A2UI、A2A 和
-会话回放共享同一事件边界，也避免把某个框架的私有 SSE 语义泄露给调用方。`attach(handle)`
-是可选的跨进程恢复接口，默认 fail-closed；不能因为持久化了一个 handle 就假设原生
-Runtime 已在当前进程恢复。
-
-新 Runtime 应先用 `RunnerRuntimeAdapter` 覆盖标准 `BaseRunner` 路径，再逐项声明 cancel、
-resume 和 checkpoint 能力；不要用伪造的“全支持” capability 掩盖框架差异。
-
-## Agent Runtime V2 Phase 1 控制基座
-
-0.8.2 增加的是可选的 Agent Kernel 控制基座，不会把所有历史 Agent 自动迁移到新路径。
-`AgentControlChannel/v1`、`SessionEventEnvelope/v1`、`ActivationLease/v1`、
-`RuntimeCapabilityMatrix/v1` 和 `Interaction/v1` 由 JSON Schema、golden fixture、聚合
-digest 与 additive-only gate 锁定。Gateway 只负责身份与可信路由，Server 负责准入并签发
-permit，Runtime 缺少有效 permit 时拒绝控制命令。
-
-| 存储模式 | 适用范围 | 重启/跨 Pod 语义 |
-| --- | --- | --- |
-| InMemory | 本地开发或显式单 Pod ephemeral 托管 | 不承诺重启恢复或跨 Pod 接管 |
-| SQLite | 本地单进程持久化 | 进程重启可恢复本地状态，不提供多 Pod owner 语义 |
-| PostgreSQL | 需要高可用的托管 Runtime | durable Inbox、nonce、lease、事务 fencing 与 takeover |
-
-PostgreSQL 不是启用 Agent Kernel 的通用前置条件。单副本托管 Agent 可显式使用
-`memory + AGENT_KERNEL_DURABILITY_TIER=ephemeral`；只有声明 durable、高可用或跨 Pod
-恢复时才需要 PostgreSQL。选择 `postgres` 却未提供 DSN 会直接启动失败，因为这属于错误配置，
-而不是可静默降级的故障。
-
-旧 Runtime 制品如果没有版本、来源、commit id 或 Agent Kernel 合同 digest，仍走历史路径并把
-缺失字段标记为未知，不会仅因 Operator 升级就自动加入新控制协议。只有显式投射启用开关和匹配
-digest 的新部署才进入 Kernel；这使平台可以先升级控制面，再逐个更新 Runtime。
-
-## 请求生命周期
-
-普通非流式 `/v1/responses` 请求路径：
-
-```mermaid
-sequenceDiagram
- autonumber
- participant C as Client
- participant API as FastAPI endpoint
- participant Conv as conversations.runtime
- participant Store as session service
- participant Runner as BaseRunner
-
- C->>API: POST /v1/responses
- API->>Conv: invoke_conversation_once
- Conv->>Store: ensure session
- Conv->>Store: append user_message
- Conv->>Conv: build_run_input (history + context)
- Conv->>Conv: PlatformInvocationContext
- Conv->>Store: append run_status=in_progress
- Conv->>Runner: platform_invocation_scope → invoke(payload)
- alt recoverable error
- Runner-->>Conv: raise exception
- Conv->>Conv: fallback_model retry (one attempt)
- Conv->>Store: append run_status=in_progress (fallback)
- Conv->>Runner: invoke(payload) again
- else prompt-too-long
- Runner-->>Conv: raise PTL exception
- Conv->>Store: compact_conversation_history
- Conv->>Runner: invoke(payload) again
- end
- Runner-->>Conv: result (output + metadata)
- opt checkpoint metadata present
- Conv->>Store: append run_checkpoint
- end
- Conv->>Store: append assistant_message
- Conv->>Store: append run_status=completed
- Conv-->>API: output text + metadata
- API-->>C: response object
-```
+| Activation 创建与关闭 | 框架原生执行 |
+| 插件图和能力绑定 | 私有线程、checkpoint 或会话状态 |
+| 权限准入与健康检查 | 原生工具调用和事件语义 |
+| profile fencing 与原子切换 | 能力矩阵中声明的 cancel、resume、checkpoint 行为 |
+| 统一事件出口 | 将执行结果映射为可适配的 Provider 事件 |
-Streaming 使用同样的准备路径，再把内部语义事件序列化为 server-sent events。文本
-delta、reasoning、tool call、tool result、approval interrupt、final output 和
-error 会先成为运行时事件，再成为协议特定 SSE payload。
+每个 Activation 只选择一个 Agent Provider。当前插件目录包含 Codex 原生 Provider、KsADK Harness Provider、DSH / Cordis Provider 与 SubagentProvider；它们通过同一宿主契约接入，但不假装拥有相同能力。
-## Streaming 事件模型
+## 插件组合与生命周期
-框架 adapter 可能发出很不同的原生事件，但对话运行时期待一小组语义 chunk：
+Studio 中可编辑的 Agent revision 先由组合编译器转换为不可变插件图。插件引用使用精确版本，能力声明绑定到明确的 Definition 和 slot，敏感配置只接受 secret reference。
-| Chunk type | 含义 | 常见来源 |
-| --- | --- | --- |
-| `text` | assistant 文本 delta | 模型 token stream |
-| `thinking` | provider 或 ADK 可用时的 reasoning delta | provider 或 ADK event |
-| `tool_call` | tool call 开始或参数更新 | LangGraph、ADK、MCP 或自定义 tool event |
-| `tool_result` | tool 输出可用 | 框架 tool result event |
-| `interrupt` | 运行暂停，等待审批或外部输入 | graph interrupt 或 approval flow |
-| `final` | 最终权威输出 | 框架最终状态 |
-| `error` | 执行失败 | Runner 或协议异常 |
+
+ 1. 组合编译器把 runtime、Session、Memory、Context、Renderer、MCP 与 Skill 绑定规范化。
+ 2. Resolver 生成锁定版本和摘要。
+ 3. PluginHost 执行解析、权限准入、stage 与健康检查。
+ 4. 候选图健康后原子切换；失败时保留旧图并清理候选副作用。
+ 5. 已建立的会话继续持有原 Provider 私有状态，关闭后再回收旧图。
+
-协议层随后把这些语义事件映射到 `/v1/responses`、`/v1/chat/completions`、
-`/run_sse` 或本地 Web UI action 格式。
+这条生命周期保证“配置可切换”和“运行不被撕裂”同时成立。
-### 模型策略与 thinking 语义
+## 共用能力总线
-`thinking` chunk 是否出现、以及 reasoning 内容如何注入，由运行时的统一模型策略和
-thinking disable 注入语义共同决定（0.6.6 起统一，0.6.7 补全 disable 注入）：
+| 能力 | 注入内容 |
+| --- | --- |
+| 上下文与提示 | 历史压缩、提示拼装、快照和 contributor 输出 |
+| 工具与安全 | 工具目录、策略、审批、权限和 secret reference |
+| MCP 与 Skill | 资源发现、物化后的插件能力和调用入口 |
+| 沙箱与工作区 | 隔离执行、文件访问和命令边界 |
+| 记忆与知识 | Memory 与 KnowledgeBase 上下文 |
+| 追踪与评测 | Trace、指标、事件关联和 Eval 数据 |
-- **统一模型策略**：托管部署通过 `AGENTENGINE_MODEL_POLICY_JSON` 注入 primary /
- multimodal / fallback 默认值，Hermes、OpenClaw 和通用 Agent 共用同一套语义；显式
- 请求参数或显式环境变量仍优先于策略默认值。
-- **fallback 重试**：conversation runtime 对超时、限流、5xx、模型不可用、权限/配额等
- 可恢复错误自动 fallback 重试一次；400 参数错误、业务错误和 tool 错误不会被吞掉。
- fallback 触发时，下一轮 streaming 可能切换到 fallback backend，`thinking` chunk
- 是否出现以目标模型能力为准。
-- **thinking disable 注入**：当 `model_options.thinking` 为 disabled
- （`reasoning.effort=none`、`thinking.type=disabled` 或 `max_reasoning_tokens<=0`）
- 时，runtime 自动向 `extra_body` 注入 `enable_thinking=false` 和
- `chat_template_kwargs.enable_thinking=false`（DeepSeek 等模型兼容），并在流式输出
- 中过滤 reasoning 类 output item，因此 `thinking` chunk 不会出现在 SSE 流中。
+能力插件通过只读执行上下文交给 Provider。没有物化插件所有者的 MCP 或 Skill 绑定会在构建阶段拒绝，避免界面显示“已启用”但运行时实际不可用。
-具体的策略 JSON 结构、catalog 字段和注入细节见
-[环境变量参考](../../references/environment-variables)。
+## 自动任务
-## Session 与上下文边界
+Scheduler Lite 负责确定性日历计算、本地任务存储和到期分发。任务触发后仍通过 Agent Kernel 与 Harness 进入同一执行链，不创建第二套运行时。
-每个 turn 在调用 Runner 前都会构造 `PlatformInvocationContext`。它包含框架 adapter
-可能需要的稳定标识和运行时事实：
+| 组件 | 责任 |
+| --- | --- |
+| `SchedulerEngine` | 计算到期任务、维护 occurrence 与重试语义 |
+| `SchedulerSQLiteStore` | 持久化本地任务和调度状态 |
+| `AgentControlSchedulerDispatcher` | 把调度触发转换为 AgentControl 命令 |
-- `agent_id`、`user_id`、`session_id` 和 invocation metadata。
-- 规范化输入内容和消息历史。
-- 当前 turn 附件和最近有效附件。
-- model、model metadata 和 model options。
-- 启用时的知识库和记忆上下文。
+## 事件事实链
-Runner 会把这个 context 作为准备后输入的一部分收到。业务逻辑应优先读取公开文档中的
-runner payload 字段和框架 hook，而不是读取私有 server globals。
+ADK、LangGraph、Codex、A2A 与 Harness 事件由各自适配器转换为 `RuntimeEvent(schema_version=2)`。适配过程保留 source、scope、item 与 event 身份，避免按作者或文本做模糊去重。
-## Checkpoint、Resume 与协作式取消
+| 阶段 | 责任 |
+| --- | --- |
+| 框架事件适配 | 保留 Provider 来源与原生 item 身份 |
+| RuntimeEvent v2 | 表达 run、item、content、tool、interaction 与 error 事实 |
+| SessionEvent 日志 | 持久化顺序、运行状态与恢复所需事实 |
+| Reducer 与回放 | 按身份执行 append、replace、completed 和最终结果选择 |
+| 协议投影 | 生成 Responses、Chat、Studio、A2A 或托管界面所需视图 |
-
-KsADK 在运行时引入框架级 checkpoint/resume 能力层，并补全 `CancelRun` 协作式取消。
+
+ `RuntimeEvent v2` 是写入主路径。v1 只保留只读兼容投影；新的运行事件不再写入 v1。
+## 会话与协议
-Run 级 checkpoint、resume 和取消建立在 session store 与框架 checkpoint backend 之上，
-是独立于 streaming chunk 的能力层。conversation runtime 在每个 turn 写入
-`run_status` 事件，并以 checkpoint 为边界暴露恢复与取消入口：
-
-| 能力 | 含义 | 触发位置 |
-| --- | --- | --- |
-| checkpoint 写入 | 在 turn 边界持久化可恢复快照 | runner 在 turn 完成或 interrupt 处写入 |
-| resume | 从 checkpoint 恢复 run 执行 | `POST /agentengine/api/v1/ResumeRun` |
-| preview | 预览 resume 内容与影响面 | `POST /agentengine/api/v1/GetCheckpointResumePreview` |
-| list | 列出 session 下可用 checkpoint | `POST /agentengine/api/v1/ListSessionCheckpoints` |
-| 协作式取消 | 请求正在进行的 run 停止 | `POST /agentengine/api/v1/CancelRun` |
-
-`CancelRun` 是**协作式取消**：runtime 在下一个 runner 协作点（如下一个 streaming
-chunk、tool call 边界或 interrupt 检查点）观测到取消请求后停止 run，写入
-`run_status=cancelled`，并尽可能保留已产出的 checkpoint 与事件供后续 resume。它不会
-强杀进程或丢弃已持久化的 turn。
+每个 turn 在执行前构造稳定的调用上下文，包括 Agent、用户、Session、输入、附件、模型选项以及启用的记忆和知识。Provider 只读取公开上下文和能力绑定，不依赖 Server 私有全局状态。
-resume 能力受 `GetAgentUiBootstrap` 返回的 `RuntimeCapabilities.ResumeRun.ResumeMode`
-与 `RunLifecycle` 双重门控（`time_travel` / `forward_only` / `none`）；前端入口必须
-同时满足 `RunLifecycle.Checkpoints` 与 `RunLifecycle.CheckpointResume` 才能展示。
-
-完整的 action 路径、ResumeMode 语义、`SubscribeRunEvents` 续订与 5 分钟服务端保护
-超时见 [会话与文件](../../references/runtime-sessions-files)。
-
-## 本地协议入口
-
-| Endpoint | 目的 |
+| Endpoint | 用途 |
| --- | --- |
-| `POST /v1/responses` | 首选 OpenAI 兼容本地协议 |
-| `POST /v1/chat/completions` | 兼容 Chat Completions 客户端 |
-| `POST /agentengine/api/v1/RunAgent` | 本地 Web UI action 风格协议 |
-| `POST /run_sse` | ADK Web 兼容本地执行路径 |
-| `POST /agentengine/api/v1/UploadFile` | UI 流程的本地文件上传 |
-| `/_ksadk/workspace/v1/*` | 工作区文件 list/read/write/delete 路由 |
+| `POST /v1/responses` | 首选标准调用协议 |
+| `POST /v1/chat/completions` | Chat Completions 兼容入口 |
+| `POST /agentengine/api/v1/RunAgent` | Studio action 风格调用 |
+| `POST /run_sse` | ADK Web 兼容执行路径 |
+| `POST /agentengine/api/v1/CancelRun` | 协作式取消 |
+| `POST /agentengine/api/v1/ResumeRun` | 按声明能力恢复运行 |
-
-外部客户端应优先使用 `/v1/responses`，除非它正在集成本地 Web UI 本身。
-
+外部客户端优先使用 `/v1/responses`。Studio 和托管界面通过 SessionEvent 投影与续订接口获得一致视图。
+
+## 平台边界
-## 公开文档边界
+KsADK 运行时包含 SDK、CLI、Server、Kernel、Harness、插件宿主、Provider、事件与本地存储。Agent 注册、远端部署生命周期、网关治理、托管 Skill / Sandbox 服务和 OTLP 后端属于外部平台，通过明确契约连接。
-本页描述公开本地运行时架构。它不会发布私有网关行为、内部集群部署细节、内部 kubeconfig 路径、私有 registry 名称或客户特定 runbook。
+ 公开文档不包含私有网关行为、内部集群路径、私有镜像仓库或客户特定运维流程。
diff --git a/docs-site/content/docs/framework/guides/tools-and-skill-runtime.en.mdx b/docs-site/content/docs/framework/guides/tools-and-skill-runtime.en.mdx
index 1ee609d9..1936cd38 100644
--- a/docs-site/content/docs/framework/guides/tools-and-skill-runtime.en.mdx
+++ b/docs-site/content/docs/framework/guides/tools-and-skill-runtime.en.mdx
@@ -1484,17 +1484,17 @@ inside a sandbox or an async branch.
-See [Agent Context](agent-context) for the full context fields and
-accessors, and [OpenAI Compatible API](../../references/openai-compatible-api)
+See [Agent Context](./agent-context.mdx) for the full context fields and
+accessors, and [OpenAI Compatible API](../../references/openai-compatible-api.mdx)
for the HTTP endpoint fields.
## Relationship To Other Guides
Read this page with:
-- [Frameworks](frameworks) for runner loading behavior.
-- [Agent Context](agent-context) for the structured invocation context.
-- [Attachments And Multimodal Input](attachments-multimodal) for file input
+- [Frameworks](./frameworks.mdx) for runner loading behavior.
+- [Agent Context](./agent-context.mdx) for the structured invocation context.
+- [Attachments And Multimodal Input](./attachments-multimodal.mdx) for file input
normalization.
-- [Runtime Sessions And Files](../../references/runtime-sessions-files) for how
+- [Runtime Sessions And Files](../../references/runtime-sessions-files.mdx) for how
tool events and file references are stored in local sessions.
diff --git a/docs-site/content/docs/framework/guides/tools-and-skill-runtime.mdx b/docs-site/content/docs/framework/guides/tools-and-skill-runtime.mdx
index 499892a7..ac760391 100644
--- a/docs-site/content/docs/framework/guides/tools-and-skill-runtime.mdx
+++ b/docs-site/content/docs/framework/guides/tools-and-skill-runtime.mdx
@@ -1450,14 +1450,14 @@ memory、sandbox、workspace 和 skill 在执行工具或读写状态时，会
-更多上下文字段和读取方式见 [智能体上下文](agent-context)，HTTP 入口字段
-见 [OpenAI 兼容 API](../../references/openai-compatible-api)。
+更多上下文字段和读取方式见 [智能体上下文](./agent-context.mdx)，HTTP 入口字段
+见 [OpenAI 兼容 API](../../references/openai-compatible-api.mdx)。
## 相关指南
建议结合这些页面阅读：
-- [框架接入](frameworks)：runner 加载和多框架适配。
-- [智能体上下文](agent-context)：结构化调用上下文。
-- [附件与多模态输入](attachments-multimodal)：文件输入归一化。
-- [会话与文件](../../references/runtime-sessions-files)：工具事件和文件引用如何进入本地会话。
+- [框架接入](./frameworks.mdx)：runner 加载和多框架适配。
+- [智能体上下文](./agent-context.mdx)：结构化调用上下文。
+- [附件与多模态输入](./attachments-multimodal.mdx)：文件输入归一化。
+- [会话与文件](../../references/runtime-sessions-files.mdx)：工具事件和文件引用如何进入本地会话。
diff --git a/docs-site/content/docs/framework/guides/web-ui-source.en.mdx b/docs-site/content/docs/framework/guides/web-ui-source.en.mdx
index 107424a5..fc228766 100644
--- a/docs-site/content/docs/framework/guides/web-ui-source.en.mdx
+++ b/docs-site/content/docs/framework/guides/web-ui-source.en.mdx
@@ -10,9 +10,9 @@ production payload lives in `ksadk/studio/static`. Public clean exports, sdists,
and wheels contain only the reviewed static payload, not editable Studio React /
TypeScript source.
-
-Since 0.6.5 `ksadk-python` removed the local `npm ci` / `npm run build:ksadk`
-build chain and no longer pulls GitHub latest release at wheel build time.
+
+`ksadk-python` does not pull a floating GitHub latest release at wheel build
+time or maintain a second editable UI source tree in the public candidate.
The hosted UI payload comes from the `@kingsoftcloud/ksadk-web` npm package;
the Studio static payload is built and reviewed before the public clean export
is created.
@@ -44,8 +44,8 @@ artifacts.
# Default: pull the verified npm version
make sync-ksadk-web-static
-# Pin the concrete 0.8.2 release-candidate version
-make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.2
+# Pin the concrete 0.8.3 release-candidate version
+make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.4
```
@@ -78,7 +78,7 @@ instead provide a complete, validated `ksadk/studio/static` payload.
| Variable | Default | Description |
| --- | --- | --- |
-| `KSADK_WEB_VERSION` | `0.3.2` | published npm package version; release candidates must pin a concrete version |
+| `KSADK_WEB_VERSION` | `0.3.4` | published npm package version; release candidates must pin a concrete version |
| `KSADK_WEB_PACKAGE` | `@kingsoftcloud/ksadk-web` | npm package name |
| `KSADK_WEB_TARBALL_NAME` | `kingsoftcloud-ksadk-web-.tgz` | Tarball filename, derived from the version |
| `KSADK_WEB_RELEASE_URL` | empty | Explicit tarball URL fallback; takes precedence over `npm pack` |
@@ -93,14 +93,14 @@ to exist before it is copied over `ksadk/server/static`.
Each `ksadk-python` release note should record:
-- The `ksadk-python` version (e.g. `0.8.2`).
-- The `KSADK_WEB_VERSION` / npm package version (e.g. `0.8.2` maps to `@kingsoftcloud/ksadk-web@0.3.2`).
-- The controlled build command (e.g. `make build-frontend KSADK_WEB_VERSION=0.3.2`).
+- The `ksadk-python` version (e.g. `0.8.3`).
+- The `KSADK_WEB_VERSION` / npm package version (e.g. `0.8.3` maps to `@kingsoftcloud/ksadk-web@0.3.4`).
+- The controlled build command (e.g. `make build-frontend KSADK_WEB_VERSION=0.3.4`).
- The wheel / sdist audit result (`make public-build-check` / `twine check dist/*`).
-
-- `ksadk-python`: `0.8.2`
-- npm package: `@kingsoftcloud/ksadk-web@0.3.2`
-- frontend build: `make build-frontend KSADK_WEB_VERSION=0.3.2`
+
+- `ksadk-python`: `0.8.3`
+- npm package: `@kingsoftcloud/ksadk-web@0.3.4`
+- frontend build: `make build-frontend KSADK_WEB_VERSION=0.3.4`
- audit: `make public-build-check` passed, `twine check dist/*` passed
diff --git a/docs-site/content/docs/framework/guides/web-ui-source.mdx b/docs-site/content/docs/framework/guides/web-ui-source.mdx
index 85709976..629d4ac7 100644
--- a/docs-site/content/docs/framework/guides/web-ui-source.mdx
+++ b/docs-site/content/docs/framework/guides/web-ui-source.mdx
@@ -9,9 +9,9 @@ KsADK Web UI 源码属于独立仓库 `kingsoftcloud/ksadk-web`，并以 npm 包
clean export、sdist 与 wheel 只携带经过审计的静态产物，不携带 Studio 的 React /
TypeScript 可编辑源码。
-
-自 0.6.5 起 `ksadk-python` 移除了本地 `npm ci` / `npm run build:ksadk` 构建链路，
-不再在 wheel 构建时实时拉取 GitHub latest release。Hosted UI 产物来自 npm 包
+
+`ksadk-python` 不在 wheel 构建时实时拉取 GitHub latest release，也不在公开候选中维护
+第二份可编辑 UI 源码。Hosted UI 产物来自 npm 包
`@kingsoftcloud/ksadk-web`；Studio 静态产物在进入公开 clean export 前完成构建与审计。
@@ -39,8 +39,8 @@ TypeScript 可编辑源码。
# 默认拉已验证的 npm 版本
make sync-ksadk-web-static
-# 0.8.2 发布候选固定具体版本
-make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.2
+# 0.8.3 发布候选固定具体版本
+make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.4
```
@@ -69,7 +69,7 @@ make sync-ksadk-web-static KSADK_WEB_VERSION=0.3.2
| 变量 | 默认值 | 说明 |
| --- | --- | --- |
-| `KSADK_WEB_VERSION` | `0.3.2` | 已发布的 npm 包版本；发布候选必须固定为具体版本 |
+| `KSADK_WEB_VERSION` | `0.3.4` | 已发布的 npm 包版本；发布候选必须固定为具体版本 |
| `KSADK_WEB_PACKAGE` | `@kingsoftcloud/ksadk-web` | npm 包名 |
| `KSADK_WEB_TARBALL_NAME` | `kingsoftcloud-ksadk-web-.tgz` | tarball 文件名，由版本推导 |
| `KSADK_WEB_RELEASE_URL` | 空 | 显式指定 tarball URL 兜底，优先级高于 npm pack |
@@ -83,14 +83,14 @@ sync 优先级：`KSADK_WEB_RELEASE_URL` 显式 tarball > `npm pack` > registry
每次 `ksadk-python` release note 应记录：
-- `ksadk-python` 版本（如 `0.8.2`）。
-- `KSADK_WEB_VERSION` / npm 包版本（如 `0.8.2` 对应 `@kingsoftcloud/ksadk-web@0.3.2`）。
-- 受控构建命令（如 `make build-frontend KSADK_WEB_VERSION=0.3.2`）。
+- `ksadk-python` 版本（如 `0.8.3`）。
+- `KSADK_WEB_VERSION` / npm 包版本（如 `0.8.3` 对应 `@kingsoftcloud/ksadk-web@0.3.4`）。
+- 受控构建命令（如 `make build-frontend KSADK_WEB_VERSION=0.3.4`）。
- wheel / sdist 审计结果（`make public-build-check` / `twine check dist/*`）。
-
-- `ksadk-python`: `0.8.2`
-- npm 包: `@kingsoftcloud/ksadk-web@0.3.2`
-- 前端构建: `make build-frontend KSADK_WEB_VERSION=0.3.2`
+
+- `ksadk-python`: `0.8.3`
+- npm 包: `@kingsoftcloud/ksadk-web@0.3.4`
+- 前端构建: `make build-frontend KSADK_WEB_VERSION=0.3.4`
- 审计: `make public-build-check` 通过，`twine check dist/*` 通过
diff --git a/docs-site/content/docs/framework/index.en.mdx b/docs-site/content/docs/framework/index.en.mdx
index 3b740860..ce117d1d 100644
--- a/docs-site/content/docs/framework/index.en.mdx
+++ b/docs-site/content/docs/framework/index.en.mdx
@@ -4,8 +4,10 @@ description: The user path from a first local Agent to a managed cloud Runtime.
---
**Kingsoft Cloud Agent Development Kit** builds, debugs, deploys, and observes
-enterprise AI Agents. Start by choosing the shape of your project; every path
-then shares the local Web UI, OpenAI-compatible API, sessions, and observability.
+enterprise AI Agents. In 0.8.3, the trusted kernel closes concurrency, recovery,
+and state-consistency boundaries; the Harness owns the execution lifecycle; and
+pluggable Providers connect execution engines. Choose a project shape, then reuse
+the same Studio, API, session, and event capabilities.
```bash
pip install -U "ksadk[all]"
@@ -15,26 +17,33 @@ pip install -U "ksadk[all]"
-## Complete the local-development loop
+## Studio and local development
+
+## Harness and plugins
+
+
+
-## New in 0.8 and advanced topics
+## Events, interoperability, and delivery
-
## Find the exact contract
diff --git a/docs-site/content/docs/framework/index.mdx b/docs-site/content/docs/framework/index.mdx
index 57fc317e..dcdd793f 100644
--- a/docs-site/content/docs/framework/index.mdx
+++ b/docs-site/content/docs/framework/index.mdx
@@ -4,8 +4,9 @@ description: 从第一个本地 Agent 到云端托管 Runtime 的用户文档入
---
**Kingsoft Cloud Agent Development Kit** 用于构建、调试、部署和观测企业级 AI
-Agent。先选择你的项目形态；所有路径随后都能复用同一套本地 Web UI、OpenAI
-兼容 API、会话和可观测能力。
+Agent。0.8.3 以可信内核收口并发、恢复和状态一致性，以 Harness 统一执行生命周期，
+再通过可插拔 Provider 接入不同执行内核。先选择项目形态，随后复用同一套 Studio、
+API、会话和事件能力。
```bash
pip install -U "ksadk[all]"
@@ -15,31 +16,38 @@ pip install -U "ksadk[all]"
-## 完成本地开发闭环
+## Studio 与本地开发
+
+## Harness 与插件化
+
+
+
-## 0.8 新能力与进阶主题
+## 事件、互操作与交付
-
## 查找精确契约
diff --git a/docs-site/content/docs/framework/meta.en.json b/docs-site/content/docs/framework/meta.en.json
new file mode 100644
index 00000000..2ba86381
--- /dev/null
+++ b/docs-site/content/docs/framework/meta.en.json
@@ -0,0 +1,42 @@
+{
+ "title": "Development Guide",
+ "icon": "LayoutGrid",
+ "root": true,
+ "pages": [
+ "---[Rocket]Start Here---",
+ "getting-started/index",
+ "getting-started/quickstart",
+ "getting-started/configuration",
+ "getting-started/project-structure",
+ "getting-started/why-ksadk",
+ "getting-started/concepts",
+ "getting-started/architecture",
+ "getting-started/comparison",
+ "---[Monitor]Studio and Local Development---",
+ "guides/agentkit-local-studio",
+ "guides/local-web-ui",
+ "guides/evaluation-observability",
+ "guides/frameworks",
+ "tutorials",
+ "---[Blocks]Harness and Plugins---",
+ "guides/runtime-architecture",
+ "guides/harness-app",
+ "guides/plugins-and-automations",
+ "guides/tools-and-skill-runtime",
+ "guides/agent-context",
+ "guides/memory-knowledge",
+ "guides/attachments-multimodal",
+ "guides/workspace-files",
+ "---[Network]Events and Interoperability---",
+ "guides/hosted-ui-events",
+ "guides/a2a-runtime",
+ "---[Cloud]Build and Deploy---",
+ "guides/managed-runtime",
+ "guides/build-and-package",
+ "guides/cloud-deployment",
+ "guides/runtime-products",
+ "---[Wrench]Operations and Maintenance---",
+ "guides/observability-tracing",
+ "guides/web-ui-source"
+ ]
+}
diff --git a/docs-site/content/docs/framework/meta.json b/docs-site/content/docs/framework/meta.json
index 9f595346..611dc352 100644
--- a/docs-site/content/docs/framework/meta.json
+++ b/docs-site/content/docs/framework/meta.json
@@ -1,5 +1,5 @@
{
- "title": "框架",
+ "title": "开发指南",
"icon": "LayoutGrid",
"root": true,
"pages": [
@@ -8,34 +8,35 @@
"getting-started/quickstart",
"getting-started/configuration",
"getting-started/project-structure",
- "getting-started/concepts",
"getting-started/why-ksadk",
+ "getting-started/concepts",
"getting-started/architecture",
"getting-started/comparison",
- "---[Code2]创建与本地调试---",
+ "---[Monitor]Studio 与本地开发---",
+ "guides/agentkit-local-studio",
+ "guides/local-web-ui",
+ "guides/evaluation-observability",
"guides/frameworks",
"tutorials",
+ "---[Blocks]Harness 与插件化---",
+ "guides/runtime-architecture",
"guides/harness-app",
- "guides/local-web-ui",
- "guides/agentkit-local-studio",
- "guides/evaluation-observability",
- "guides/hosted-ui-events",
- "---[Blocks]运行时能力---",
+ "guides/plugins-and-automations",
+ "guides/tools-and-skill-runtime",
"guides/agent-context",
+ "guides/memory-knowledge",
"guides/attachments-multimodal",
"guides/workspace-files",
- "guides/tools-and-skill-runtime",
- "guides/memory-knowledge",
- "guides/observability-tracing",
- "---[Network]互操作---",
+ "---[Network]统一事件与互操作---",
+ "guides/hosted-ui-events",
"guides/a2a-runtime",
"---[Cloud]构建与部署---",
"guides/managed-runtime",
"guides/build-and-package",
"guides/cloud-deployment",
"guides/runtime-products",
- "---[Wrench]高级与维护---",
- "guides/runtime-architecture",
+ "---[Wrench]运维与维护---",
+ "guides/observability-tracing",
"guides/web-ui-source"
]
}
diff --git a/docs-site/content/docs/framework/tutorials/adk-agent.en.mdx b/docs-site/content/docs/framework/tutorials/adk-agent.en.mdx
index 8a56eb3d..14a33394 100644
--- a/docs-site/content/docs/framework/tutorials/adk-agent.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/adk-agent.en.mdx
@@ -182,7 +182,7 @@ build/
## Next Steps
-- [Frameworks](../guides/frameworks): ADK runner behavior and detection order.
-- [Agent Best Practices](best-practices/agent-best-practices): ADK, memory, knowledge, MCP, and Skill Runtime patterns.
+- [Frameworks](../guides/frameworks.mdx): ADK runner behavior and detection order.
+- [Agent Best Practices](./best-practices/agent-best-practices.mdx): ADK, memory, knowledge, MCP, and Skill Runtime patterns.
- [Environment Variables](/en/docs/references/environment-variables): model, memory, knowledge, MCP, and tracing variables.
- [OpenAI-Compatible API](/en/docs/references/openai-compatible-api): local protocol shape.
diff --git a/docs-site/content/docs/framework/tutorials/adk-agent.mdx b/docs-site/content/docs/framework/tutorials/adk-agent.mdx
index 18e3c9b1..38f6d51d 100644
--- a/docs-site/content/docs/framework/tutorials/adk-agent.mdx
+++ b/docs-site/content/docs/framework/tutorials/adk-agent.mdx
@@ -177,7 +177,7 @@ build/
## 后续阅读
-- [框架接入](../guides/frameworks)：ADK runner、加载边界和检测顺序。
-- [Agent 最佳实践](best-practices/agent-best-practices)：ADK、记忆、知识库、MCP 和 Skill Runtime 模式。
+- [框架接入](../guides/frameworks.mdx)：ADK runner、加载边界和检测顺序。
+- [Agent 最佳实践](./best-practices/agent-best-practices.mdx)：ADK、记忆、知识库、MCP 和 Skill Runtime 模式。
- [环境变量](/cn/docs/references/environment-variables)：模型、记忆、知识库、MCP 和 tracing 变量。
- [OpenAI 兼容 API](/cn/docs/references/openai-compatible-api)：本地协议形态。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.en.mdx b/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.en.mdx
index f7158bc2..57187e68 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.en.mdx
@@ -466,13 +466,13 @@ def write_report(path: str, content: str) -> dict:
These examples apply the patterns above to real scenarios:
-
+
A real demo combining a LangGraph outer graph with AgentEngine Toolsets.
-
+
A real demo of an agent that resumes long-running tasks.
-
+
A tutorial for hosting a custom-UI agent on AgentEngine.
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.mdx b/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.mdx
index b43da3d0..387f6679 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/agent-best-practices.mdx
@@ -433,13 +433,13 @@ def write_report(path: str, content: str) -> dict:
下面几个例子把上面的模式落到真实场景：
-
+
LangGraph 外层图 + AgentEngine Toolsets 的真实 demo。
-
+
长任务断点恢复 Agent 的真实 demo。
-
+
自定义 UI Agent 托管到 AgentEngine 的教程。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.en.mdx b/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.en.mdx
index 2b5e055f..42a54024 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.en.mdx
@@ -1,9 +1,9 @@
---
title: "YAML Is the Agent: Codex"
-description: "New in 0.8: declare, debug, and deploy a Codex Managed Runtime from one agentengine.yaml."
+description: "Declare, debug, and deploy a Codex Managed Runtime from one agentengine.yaml."
---
-
+
Codex is KsADK's first “YAML is the agent” pattern: `agentengine.yaml` is the
single configuration source. There is no `agent.py`, no second `codex.yaml`, and
no developer-machine binary enters the cloud deployment artifact.
@@ -111,5 +111,5 @@ to the Code artifact path and ManagedRuntime rejects them. Choose explicit
- Before deployment, run `agentengine deploy . --target serverless --dry-run`
and verify the returned Runtime version and image digest.
-See [Codex Managed Runtime](../../guides/managed-runtime) for the full runtime
+See [Codex Managed Runtime](../../guides/managed-runtime.mdx) for the full runtime
contract, image boundary, and environment variables.
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.mdx b/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.mdx
index 471a7ab3..cd38b1a6 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/codex-yaml-agent.mdx
@@ -1,9 +1,9 @@
---
title: "YAML 即 Agent：Codex"
-description: "0.8 新增：用单一 agentengine.yaml 声明、调试并部署 Codex Managed Runtime。"
+description: "用单一 agentengine.yaml 声明、调试并部署 Codex Managed Runtime。"
---
-
+
Codex 是 KsADK 的第一个 YAML 即 Agent 范式：`agentengine.yaml` 是唯一配置源，
没有 `agent.py`、没有第二份 `codex.yaml`，也不会把开发机二进制打进云端部署包。
@@ -100,4 +100,4 @@ agentengine deploy . --target serverless
Runtime 版本和镜像 digest。
完整的 runtime contract、镜像边界和环境变量见
-[Codex Managed Runtime](../../guides/managed-runtime)。
+[Codex Managed Runtime](../../guides/managed-runtime.mdx)。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.en.mdx b/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.en.mdx
index f1a1052e..1fa4a0b9 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.en.mdx
@@ -379,13 +379,13 @@ Expected output (serverless):
## Further reading
-
+
Custom bundle auto-detection, streaming fixes, and common-failure troubleshooting.
-
+
How the serverless image build packages `research-ui/dist` into the artifact, and UI config env injection details.
-
+
How a custom research workbench consumes `CheckpointResumeCapability` to render a resume panel.
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.mdx b/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.mdx
index 5fba4b39..a0f7d20b 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/custom-ui-agent.mdx
@@ -379,13 +379,13 @@ curl -s -X POST https:///agentengine/api/v1/GetAgentUiBootstrap \
## 后续阅读
-
+
自定义 bundle 自动探测、流式修复与常见失败排查。
-
+
serverless 镜像构建如何把 `research-ui/dist` 打进制品,以及 UI 配置环境变量注入细节。
-
+
自定义研究工作台如何消费 `CheckpointResumeCapability` 渲染恢复面板。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.en.mdx b/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.en.mdx
index b1e529f6..b454ed7f 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.en.mdx
@@ -233,13 +233,13 @@ The `component_status` and `graph_status` tools are not just for end users. When
Full source of this demo and more samples (placeholder link; use the actual repo URL).
-
+
A minimal LangGraph agent from scratch; run this first to validate the basic loop.
-
+
Reference for framework adapters and runner loading boundaries.
-
+
Runtime semantics for sessions, uploads, and workspace files.
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.mdx b/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.mdx
index b2b18e92..732bf66a 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/langgraph-toolsets.mdx
@@ -233,13 +233,13 @@ agent_variable: root_agent
本 demo 的完整源码与更多示例(占位链接,以仓库实际地址为准)。
-
+
从零开始的最小 LangGraph agent,适合先跑通基础链路。
-
+
框架适配与 runner 加载边界的参考。
-
+
session、上传和 workspace 文件的运行时语义。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.en.mdx b/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.en.mdx
index 474d43c9..a1ec03d7 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.en.mdx
@@ -478,13 +478,13 @@ Not by default. Locally it uses `InMemorySaver` for interactive demos and does n
## Further reading
-
+
An outer LangGraph graph routes; a ReAct subgraph talks to KSADK built-in toolsets — Skill Space, Workspace, Sandbox.
-
+
Build a locally runnable LangGraph agent from scratch — a good starting point for basic integration.
-
+
Sessions, uploads, workspace files, and checkpoint persistence backends.
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.mdx b/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.mdx
index 4ac7dd1f..6274fc0b 100644
--- a/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.mdx
+++ b/docs-site/content/docs/framework/tutorials/best-practices/long-task-resume.mdx
@@ -478,13 +478,13 @@ REPORT_STAGES = (
## 后续阅读
-
+
外层 LangGraph 图做路由,ReAct 子图通过 KSADK 内置 toolsets 与 Skill Space、Workspace、Sandbox 交互。
-
+
从零创建一个可本地运行的 LangGraph 智能体,适合先跑通基础接入。
-
+
session、上传、工作区文件和 checkpoint 持久化后端。
diff --git a/docs-site/content/docs/framework/tutorials/best-practices/meta.en.json b/docs-site/content/docs/framework/tutorials/best-practices/meta.en.json
new file mode 100644
index 00000000..9f42b8f7
--- /dev/null
+++ b/docs-site/content/docs/framework/tutorials/best-practices/meta.en.json
@@ -0,0 +1,10 @@
+{
+ "title": "Best Practices",
+ "pages": [
+ "codex-yaml-agent",
+ "langgraph-toolsets",
+ "long-task-resume",
+ "custom-ui-agent",
+ "agent-best-practices"
+ ]
+}
diff --git a/docs-site/content/docs/framework/tutorials/langgraph-agent.en.mdx b/docs-site/content/docs/framework/tutorials/langgraph-agent.en.mdx
index 47e3e963..e4e7f10e 100644
--- a/docs-site/content/docs/framework/tutorials/langgraph-agent.en.mdx
+++ b/docs-site/content/docs/framework/tutorials/langgraph-agent.en.mdx
@@ -211,6 +211,6 @@ build/
## Next Steps
-- Add framework-specific patterns from [Frameworks](../guides/frameworks).
+- Add framework-specific patterns from [Frameworks](../guides/frameworks.mdx).
- Add session or file handling from [Runtime Sessions And Files](/en/docs/references/runtime-sessions-files).
-- Package the project with [Build And Package](../guides/build-and-package).
+- Package the project with [Build And Package](../guides/build-and-package.mdx).
diff --git a/docs-site/content/docs/framework/tutorials/langgraph-agent.mdx b/docs-site/content/docs/framework/tutorials/langgraph-agent.mdx
index 28c233c2..9178fed4 100644
--- a/docs-site/content/docs/framework/tutorials/langgraph-agent.mdx
+++ b/docs-site/content/docs/framework/tutorials/langgraph-agent.mdx
@@ -205,6 +205,6 @@ build/
## 后续阅读
-- 阅读 [框架接入](../guides/frameworks)，了解框架适配和 runner 加载边界。
+- 阅读 [框架接入](../guides/frameworks.mdx)，了解框架适配和 runner 加载边界。
- 阅读 [会话与文件](/cn/docs/references/runtime-sessions-files)，了解 session、上传和工作区文件。
-- 阅读 [构建与打包](../guides/build-and-package)，了解本地构建和公开 artifact 规则。
+- 阅读 [构建与打包](../guides/build-and-package.mdx)，了解本地构建和公开 artifact 规则。
diff --git a/docs-site/content/docs/framework/tutorials/meta.en.json b/docs-site/content/docs/framework/tutorials/meta.en.json
new file mode 100644
index 00000000..8682670e
--- /dev/null
+++ b/docs-site/content/docs/framework/tutorials/meta.en.json
@@ -0,0 +1,10 @@
+{
+ "title": "Learn by Framework",
+ "pages": [
+ "langgraph-agent",
+ "adk-agent",
+ "existing-agent",
+ "---[BookOpen]Best Practices---",
+ "best-practices"
+ ]
+}
diff --git a/docs-site/content/docs/meta.en.json b/docs-site/content/docs/meta.en.json
new file mode 100644
index 00000000..201beded
--- /dev/null
+++ b/docs-site/content/docs/meta.en.json
@@ -0,0 +1,3 @@
+{
+ "pages": ["framework", "cli", "references"]
+}
diff --git a/docs-site/content/docs/references/contributing/meta.en.json b/docs-site/content/docs/references/contributing/meta.en.json
new file mode 100644
index 00000000..3f56029e
--- /dev/null
+++ b/docs-site/content/docs/references/contributing/meta.en.json
@@ -0,0 +1,8 @@
+{
+ "title": "Contributing",
+ "pages": [
+ "index",
+ "release",
+ "testing"
+ ]
+}
diff --git a/docs-site/content/docs/references/contributing/release.en.mdx b/docs-site/content/docs/references/contributing/release.en.mdx
index 5176c443..8dc822c5 100644
--- a/docs-site/content/docs/references/contributing/release.en.mdx
+++ b/docs-site/content/docs/references/contributing/release.en.mdx
@@ -14,9 +14,9 @@ The first public release should be prepared from an independent branch and revie
6. Create release tags, GitHub release assets, and TestPyPI/PyPI uploads only
from the reviewed GitHub `main` commit after public CI passes.
7. Before publication, verify the external state with
- `make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.6.7`.
+ `make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=x.y.z`.
8. After publication, verify the external state with
- `make public-publish-check PUBLIC_PUBLISH_PHASE=post-publish V=0.6.7`.
+ `make public-publish-check PUBLIC_PUBLISH_PHASE=post-publish V=x.y.z`.
Public release assets must not be created directly from an unsynced candidate
branch. `make publish`, `make publish-test`, and `make public-release-tag`
@@ -110,7 +110,7 @@ on:
ksadk_web_version:
description: KsADK Web npm version to bundle
required: false
- default: latest
+ default: "0.3.4"
permissions:
id-token: write # required for OIDC Trusted Publishing
```
@@ -128,7 +128,7 @@ current release):
```bash
make sync-ksadk-web-static
make public-preflight
-make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.6.7
+make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=x.y.z
```
## Public Import Approval
diff --git a/docs-site/content/docs/references/contributing/release.mdx b/docs-site/content/docs/references/contributing/release.mdx
index c93d7efd..84b67352 100644
--- a/docs-site/content/docs/references/contributing/release.mdx
+++ b/docs-site/content/docs/references/contributing/release.mdx
@@ -8,7 +8,7 @@ title: 发布流程
```bash
make public-review
-make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.6.7
+make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=x.y.z
```
## GitHub
@@ -63,7 +63,7 @@ on:
ksadk_web_version:
description: KsADK Web npm version to bundle
required: false
- default: latest
+ default: "0.3.4"
permissions:
id-token: write # OIDC Trusted Publishing 必需
```
@@ -79,5 +79,5 @@ permissions:
```bash
make sync-ksadk-web-static
make public-preflight
-make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.6.7
+make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=x.y.z
```
diff --git a/docs-site/content/docs/references/environment-variables.en.mdx b/docs-site/content/docs/references/environment-variables.en.mdx
index e2c0eb4d..07d87d1c 100644
--- a/docs-site/content/docs/references/environment-variables.en.mdx
+++ b/docs-site/content/docs/references/environment-variables.en.mdx
@@ -89,9 +89,9 @@ must not put them in `.env` or commit them.
| --- | --- | --- |
| `KSADK_A2UI_GENERATION_TIMEOUT_SECONDS` | platform / developer | A2UI structured-generation timeout in seconds; valid range `1` through `120`, default `20`. |
-See [A2A Runtime](../framework/guides/a2a-runtime),
-[Codex Managed Runtime](../framework/guides/managed-runtime), and
-[Hosted UI and Event Replay](../framework/guides/hosted-ui-events) for their
+See [A2A Runtime](../framework/guides/a2a-runtime.mdx),
+[Codex Managed Runtime](../framework/guides/managed-runtime.mdx), and
+[Hosted UI and Event Replay](../framework/guides/hosted-ui-events.mdx) for their
protocol and runtime boundaries.
## Unified Model Policy And Fallback (0.6.6+)
@@ -158,7 +158,7 @@ KSADK_STM_BACKEND=sqlite
KSADK_STM_PATH=.agentengine/ui/sessions.sqlite
```
-## Agent Kernel (0.8.2, Optional)
+## Agent Kernel
| Variable | Purpose |
| --- | --- |
@@ -341,7 +341,7 @@ KSADK_MCP_SERVERS='[{"name":"docs","url":"http://127.0.0.1:9000/mcp"}]'
| Variable | Purpose |
| --- | --- |
-| `KSADK_WEB_VERSION` | published `@kingsoftcloud/ksadk-web` npm version used by `make sync-ksadk-web-static`; the 0.8.2 default is `0.3.2`. Publish and verify a new version before using it in a wheel build. |
+| `KSADK_WEB_VERSION` | published `@kingsoftcloud/ksadk-web` npm version used by `make sync-ksadk-web-static`; the 0.8.3 default is `0.3.4`. Publish and verify a new version before using it in a wheel build. |
| `KSADK_WEB_PACKAGE` | npm package name used for local UI static sync; default `@kingsoftcloud/ksadk-web` |
| `KSADK_WEB_TARBALL_NAME` | saved filename when `KSADK_WEB_RELEASE_URL` is set; npm pack mode uses the real tarball filename returned by npm |
| `KSADK_WEB_RELEASE_URL` | optional fallback; when set, skips npm pack and downloads from this tarball URL |
@@ -351,6 +351,14 @@ KSADK_MCP_SERVERS='[{"name":"docs","url":"http://127.0.0.1:9000/mcp"}]'
`make build` / `make build-wheel` automatically run `sync-ksadk-web-static`; no manual sync needed.
+## DSH Plugin Bridge
+
+| Variable | Purpose |
+| --- | --- |
+| `KSADK_DSH_HOME` | Isolated managed DSH Profile directory; defaults to `.agentkit/dsh-home` in the workspace. Studio never mutates an explicitly configured directory. |
+| `KSADK_DSH_PROFILE` | DSH Profile name to use; defaults to `studio`. |
+| `KSADK_DSH_BIN` | Optional absolute DSH command path for fixed-toolchain core development or CI verification; version mismatches fail closed. |
+
## Observability
| Variable | Purpose |
diff --git a/docs-site/content/docs/references/environment-variables.mdx b/docs-site/content/docs/references/environment-variables.mdx
index c5edd281..4c6f7271 100644
--- a/docs-site/content/docs/references/environment-variables.mdx
+++ b/docs-site/content/docs/references/environment-variables.mdx
@@ -88,9 +88,9 @@ OPENAI_MODEL_NAME=my-model
| --- | --- | --- |
| `KSADK_A2UI_GENERATION_TIMEOUT_SECONDS` | 平台 / 开发者 | A2UI 结构化生成超时秒数；有效范围 `1` 到 `120`，默认 `20`。 |
-这些变量的协议与运行边界见 [A2A Runtime](../framework/guides/a2a-runtime)、
-[Codex Managed Runtime](../framework/guides/managed-runtime) 和
-[Hosted UI 与事件回放](../framework/guides/hosted-ui-events)。
+这些变量的协议与运行边界见 [A2A Runtime](../framework/guides/a2a-runtime.mdx)、
+[Codex Managed Runtime](../framework/guides/managed-runtime.mdx) 和
+[Hosted UI 与事件回放](../framework/guides/hosted-ui-events.mdx)。
## 统一模型策略与 fallback（0.6.6+）
@@ -156,7 +156,7 @@ KSADK_STM_BACKEND=sqlite
KSADK_STM_PATH=.agentengine/ui/sessions.sqlite
```
-## Agent Kernel（0.8.2，可选）
+## Agent Kernel
| 变量 | 用途 |
| --- | --- |
@@ -338,7 +338,7 @@ KSADK_MCP_SERVERS='[{"name":"docs","url":"http://127.0.0.1:9000/mcp"}]'
| 变量 | 用途 |
| --- | --- |
-| `KSADK_WEB_VERSION` | `make sync-ksadk-web-static` 使用的已发布 `@kingsoftcloud/ksadk-web` npm 版本，0.8.2 默认 `0.3.2`；wheel 构建前必须先发布并验证新版本 |
+| `KSADK_WEB_VERSION` | `make sync-ksadk-web-static` 使用的已发布 `@kingsoftcloud/ksadk-web` npm 版本，0.8.3 默认 `0.3.4`；wheel 构建前必须先发布并验证新版本 |
| `KSADK_WEB_PACKAGE` | 本地 UI static 同步使用的 npm 包名，默认 `@kingsoftcloud/ksadk-web` |
| `KSADK_WEB_TARBALL_NAME` | 设置 `KSADK_WEB_RELEASE_URL` 时作为下载保存文件名；npm pack 模式使用 npm 返回的真实 tarball 文件名 |
| `KSADK_WEB_RELEASE_URL` | 可选兜底；设置后跳过 npm pack，改从该 tarball URL 下载 |
@@ -348,6 +348,14 @@ KSADK_MCP_SERVERS='[{"name":"docs","url":"http://127.0.0.1:9000/mcp"}]'
`make build` / `make build-wheel` 会自动执行 `sync-ksadk-web-static`，无需手动同步。
+## DSH 插件桥接
+
+| 变量 | 用途 |
+| --- | --- |
+| `KSADK_DSH_HOME` | 受管理 DSH Profile 的隔离目录；默认是工作区中的 `.agentkit/dsh-home`。显式设置后 Studio 不会改写该目录。 |
+| `KSADK_DSH_PROFILE` | 要使用的 DSH Profile 名称，默认 `studio`。 |
+| `KSADK_DSH_BIN` | 可选的 DSH 命令绝对路径，仅用于固定版本工具链的核心开发或 CI 验证；不匹配时拒绝执行。 |
+
## 可观测
| 变量 | 用途 |
diff --git a/docs-site/content/docs/references/index.en.mdx b/docs-site/content/docs/references/index.en.mdx
index 460fe759..9b1f7309 100644
--- a/docs-site/content/docs/references/index.en.mdx
+++ b/docs-site/content/docs/references/index.en.mdx
@@ -8,7 +8,7 @@ Reference material for KsADK: CLI, environment variables, OpenAI-compatible API,
- KsADK Agent Runtime Platform Architecture
- Agent frameworks flow through the KsADK unified runtime, runtime capabilities, and local or AgentEngine hosted deployment targets.
-
+
+ KsADK Technical Architecture
+ Light-theme KsADK architecture highlighting the trusted kernel, Harness execution, and pluggable Providers.
-
-
+
-
-
+
+
+
+
+
-
-
+
-
-
+
+
+
+
-
- KSADK / RUNTIME DATA PLANE
- KsADK Agent Runtime Platform
- LOCAL-FIRST / CLOUD-READY
- One agent codebase from local development to hosted runtime
+ 01 AGENT CODE
- Bring your framework
- Keep your business logic
+
+ KsADK Technical Architecture
+ Runtime capabilities
+
- Google ADK
- root_agent
-
-
- LangGraph
- StateGraph
-
-
- LangChain
- Runnable / chain
-
-
- DeepAgents
- create_deep_agent
+
-
- RUNNER ADAPTERS
-
-
- 02 KSADK RUNTIME
- One execution model · one protocol surface · one runtime contract
-
-
- ENTRYPOINTS
- SDK + CLI
- Browser UI
- OpenAI API
- A2A
- invoke · stream · serve
-
-
-
- Framework Runners
- Adapt invoke · stream · tool binding
- BaseRunner
-
-
- Conversation Runtime
- invocation · streaming · session events
- THE DATA-PLANE CORE
-
-
- Protocol Surface
- OpenAI-compatible · A2A · streaming
-
+
+ 1 · Access
+ One runtime foundation for development, invocation, and protocols
+ 2 · Trusted kernel
+ Concurrency, recovery, and consistency converge at one trusted boundary
+ 3 · Harness and plugin architecture
+ The stable host owns control and lifecycle; Providers preserve native semantics
+ 4 · Harness shared capabilities
+ Injected through a capability bus; framework-independent
+ 5 · Canonical events and presentation
+ Harness events are adapted, persisted, and projected to every surface
+ External platform dependencies
+ KsADK connects through explicit contracts instead of rebuilding platform services
-
- RUNTIME CAPABILITIES
- Kernel dispatch
-
- Session Continuity
- state · transcript · resilient store
-
-
- Checkpoint Control
- resume · cancel · run events
+
+
+
-
- Toolsets + MCP
- discovery · policy · dispatch
+
+ Developer entry
+ Python SDK · AgentEngine CLI
+ Local workbench
+ Studio · debug and replay
+ Standard APIs
+ Responses · Chat · Session
+ Protocol access
+ A2A · AG-UI · A2UI
+ Automation
+ Scheduler · scheduled and batch
-
- Skill Runtime
- discover · load · isolated execute
+
+
+
+
+ Application assembly
+ FastAPI routes · lifecycle
+ Authentication, sessions, and protocols
+ Agent Kernel
+ Admission permits · durable inbox · leases and fencing · recovery
+ Concurrency and backpressure
+ Cancel and resume
+ State consistency
+ Runtime safety boundary
+ Build and deploy
+ Code / container / ManagedRuntime
+ Traceable bundle, digest, and provenance
-
- Workspace + Artifacts
- read · edit · lint · export
+
+ Plugin composition
+ Configuration selects what this activation loads
+ Revision → CompositionProfile → AgentBundle v2
+ PluginHost: discover, load, activate, rollback
+ Lockfile / digest / provenance; atomic switching
+ Default ecosystem: DSH / Cordis; native bridge: Codex
+
+ Harness execution
+ Stable host: unified control without hiding framework features
+ One Activation selects one Provider
+ and creates an isolated execution context
+ Control / tools / continuity
+ Context / events / observability
+ Host owns lifecycle · Provider owns semantics and state
+
+ Pluggable Providers
+ Different execution kernels under one Harness contract
+ Codex native Provider
+ Bridges native execution and events
+ KsADK Harness Provider
+ ADK / LangGraph framework family
+ DSH / Cordis Provider
+ Plugin ecosystem and host collaboration
+ SubagentProvider
+ Subagent routing and nested execution
+
+
+ Load
+ Select
+
+
+
+
-
- Sandbox + Approval
- isolated code · tool safety
+ Capability injection
+ Event channel
+
+ Context and prompts
+ Compaction, assembly, snapshots
+ Tools and safety
+ Policy, approval, permissions
+ MCP and Skill
+ Discovery and capability injection
+ Sandbox and workspace
+ Isolated execution, files, commands
+ Memory and knowledge
+ Memory · KnowledgeBase
+ Tracing and evaluation
+ Trace · metrics · Eval
-
- Memory + Knowledge
- long-term context · retrieval
+
+
+
+
-
- Observability
- traces · usage · evaluation
+
+ Framework event adapters
+ Preserve native Provider identity
+ RuntimeEvent v2
+ Canonical fact model
+ SessionEvent log
+ Persistence and ordering
+ Projection and replay
+ Streaming, aggregation, resume
+ API / Studio / Hosted UI
+ Consistent views from one source
-
- ONE RUNTIME CONTRACT
-
-
- 03 RUN ANYWHERE
- Local to hosted, one contract
-
-
- Local Runtime
- CLI · Browser UI · local process
- FAST FEEDBACK / NO CLOUD REQUIRED
+
+
+ AgentEngine control plane
+ Model / MCP / A2A services
+ Skill / Sandbox services
+ OTLP observability
-
- AgentEngine Hosted Control Plane
- artifact · runtime · route · invoke · observe
-
- Serverless
- Hermes
- OpenClaw
-
- HOSTED LIFECYCLE + PLATFORM SERVICES
-
+
+ Main runtime path
+ Event fact path
+ External contract
diff --git a/docs-site/public/assets/ksadk-runtime-architecture.png b/docs-site/public/assets/ksadk-runtime-architecture.png
index 0489a23e..c3d0e27a 100644
Binary files a/docs-site/public/assets/ksadk-runtime-architecture.png and b/docs-site/public/assets/ksadk-runtime-architecture.png differ
diff --git a/docs-site/public/assets/ksadk-runtime-architecture.svg b/docs-site/public/assets/ksadk-runtime-architecture.svg
index cad65076..37ef0544 100644
--- a/docs-site/public/assets/ksadk-runtime-architecture.svg
+++ b/docs-site/public/assets/ksadk-runtime-architecture.svg
@@ -1,204 +1,268 @@
-
- KsADK 智能体运行时平台架构
- Agent 框架接入 KsADK 统一运行时，通过运行时能力部署到本地或 AgentEngine 托管环境。
-
+
+ KsADK 总体技术架构
+ KsADK 浅色总体技术架构图，突出可信内核、Harness 执行层和插件化 Provider。
-
-
+
-
-
+
+
+
+
+
-
-
+
-
-
+
+
+
+
-
- KSADK / RUNTIME DATA PLANE
- KsADK 智能体运行时平台
- LOCAL-FIRST / CLOUD-READY
- 一套 Agent 代码，贯通本地开发与云端托管
+ 01 AGENT CODE
- 接入你的 Agent 框架
- 业务逻辑保持原生
+
+ KsADK 总体技术架构
+ 运行时能力
+
- Google ADK
- root_agent
-
-
- LangGraph
- StateGraph
-
-
- LangChain
- Runnable / chain
-
-
- DeepAgents
- create_deep_agent
+
-
- 运行时适配
-
-
- 02 KSADK 运行时
- 统一执行语义 · 统一协议 · 统一运行时能力
-
-
- 运行入口
- SDK + CLI
- 浏览器 UI
- OpenAI API
- A2A
- 调用 · 流式 · 服务
-
-
-
- 框架 Runner
- invoke · stream · 工具绑定
- BaseRunner
-
-
- 对话运行时
- 调用 · 流式 · 会话事件
- 数据面核心
-
-
- 协议入口
- OpenAI 兼容 · A2A · 流式
-
+
+ 1 · 使用入口
+ 同一运行底座，多种开发、调用与协议入口
+ 2 · 可信内核
+ 把并发、恢复和状态一致性收口到唯一可信边界
+ 3 · Harness 执行层与插件化架构
+ 稳定外壳负责控制与生命周期，Provider 保留原生执行语义
+ 4 · Harness 共用能力
+ 通过能力总线向上注入，不与具体 Agent 框架绑定
+ 5 · 统一事件与呈现
+ Harness 运行事件依次适配、固化并投影到不同界面
+ 平台外部依赖
+ KsADK 通过明确契约连接，不在 SDK 内重复建设
-
- 运行时能力
- 内核调度
-
- 会话连续性
- 状态 · transcript · 弹性存储
-
-
- 检查点控制
- 恢复 · 取消 · 运行事件
+
+
+
-
- 工具集 + MCP
- 发现 · 策略 · 调度
+
+ 开发者入口
+ Python SDK · AgentEngine CLI
+ 本地工作台
+ Studio · 调试与回放
+ 标准调用接口
+ Responses · Chat · Session
+ 协议接入
+ A2A · AG-UI · A2UI
+ 自动任务
+ Scheduler · 定时与批量触发
-
- Skill Runtime
- 发现 · 加载 · 隔离执行
+
+
+
+
+ 应用装配
+ FastAPI 路由 · 生命周期
+ 认证、会话、协议入口统一编排
+ Agent Kernel
+ 许可控制 · 持久收件箱 · 租约与防旧写 · 交互恢复
+ 并发与背压
+ 取消与恢复
+ 状态一致性
+ 运行时安全边界
+ 构建与部署
+ 代码 / 容器 / ManagedRuntime
+ Bundle、摘要与来源可追溯
-
- Workspace + 产物
- 读取 · 编辑 · 检查 · 导出
+
+ 插件组合
+ 配置决定“本次运行装入什么”
+ 版本 → 组合配置 → AgentBundle v2
+ PluginHost：发现、装载、启停、回滚
+ 锁文件 / 摘要 / 来源证明，支持原子切换
+ 默认生态：DSH / Cordis；原生桥接：Codex
+
+ Harness 执行层
+ 稳定外壳：统一控制，不吞掉框架特性
+ 一次 Activation 选择一个 Provider
+ 并建立隔离的运行上下文
+ 控制 / 工具 / 会话连续性
+ 上下文 / 事件 / 可观测性
+ Host 管生命周期 · Provider 管原生语义与私有状态
+
+ 可插拔 Provider
+ 同一 Harness 契约下接入不同执行内核
+ Codex 原生 Provider
+ 桥接原生执行与事件
+ KsADK Harness Provider
+ ADK / LangGraph 等框架族
+ DSH / Cordis Provider
+ 插件生态与宿主协作
+ SubagentProvider
+ 子代理路由与嵌套执行
+
+
+ 装载
+ 选择
+
+
+
+
-
- Sandbox + 审批
- 隔离代码 · 工具安全
+ 共用能力注入
+ 事件通道
+
+ 上下文与提示
+ 压缩、拼装、快照
+ 工具与安全
+ 策略、审批、权限
+ MCP 与 Skill
+ 工具发现与能力注入
+ 沙箱与工作区
+ 隔离执行、文件与命令
+ 记忆与知识
+ Memory · KnowledgeBase
+ 追踪与评测
+ Trace · 指标 · Eval
-
- 记忆 + 知识库
- 长期上下文 · 检索
+
+
+
+
-
- 可观测性
- traces · 用量 · 评估
+
+ 框架事件适配
+ 保留 Provider 原生身份
+ RuntimeEvent v2
+ 统一事实模型
+ SessionEvent 日志
+ 持久化与顺序保证
+ 投影与回放
+ 流式、聚合、断点续传
+ API / Studio / 托管界面
+ 同源一致呈现
-
- 统一运行时契约
-
-
- 03 随处运行
- 开发与部署共享同一运行时边界
-
-
- 本地运行时
- CLI · 浏览器 UI · local process
- 快速反馈 / 无需云端
+
+
+ AgentEngine 控制面
+ 模型 / MCP / A2A 服务
+ Skill / Sandbox 服务
+ OTLP 可观测平台
-
- AgentEngine 托管控制面
- 产物 · 运行时 · 路由 · 调用 · 观测
-
- Serverless
- Hermes
- OpenClaw
-
- 托管生命周期 + 平台服务
-
+
+ 主运行链路
+ 事件事实链
+ 外部契约
diff --git a/docs/maintainer-approval-record.md b/docs/maintainer-approval-record.md
index 7798d48c..25c279ef 100644
--- a/docs/maintainer-approval-record.md
+++ b/docs/maintainer-approval-record.md
@@ -1,7 +1,6 @@
# KsADK Public Release Approval Record
-This record approves the public `0.8.2` release from the reviewed internal
-candidate and Web sources below. It is the evidence consumed by the release
+This record approves the public `0.8.3` release candidate described below. It is the evidence consumed by the release
gate before GitHub tags, GitHub Releases, PyPI publication, or GitHub Pages
deployment.
@@ -12,7 +11,7 @@ deployment.
| License | Apache-2.0 |
| Python repository | kingsoftcloud/ksadk-python |
| Web UI repository | kingsoftcloud/ksadk-web |
-| Python package version | 0.8.2 |
+| Python package version | 0.8.3 |
| Public docs URL | https://kingsoftcloud.github.io/ksadk-python/ |
| Package metadata repository URL | https://github.com/kingsoftcloud/ksadk-python |
| Package metadata documentation URL | https://kingsoftcloud.github.io/ksadk-python/ |
@@ -31,34 +30,36 @@ Record exactly one approved source publication strategy.
The approved strategy must name the reviewed commit, tag, pull request, or
export archive used for:
-- `ksadk-python`: clean public export from reviewed internal candidate `40060a6560bfeec2f45bca92b589bca8c799073f`.
-- `ksadk-web`: trusted npm package `@kingsoftcloud/ksadk-web@0.3.2`, source commit `2136448e038b4d8c475fa20e4722252b1ddb2ebc`, GitHub merge `4854be4fcb5584a799538536372d38b80447f81e`, integrity `sha512-Ytjd3pIgy6LfHCmguXUDQr/wy9ClqKjbv+J+NAzH/+UIJjhVl3y1SA2eR7WwsWSn42zxBFme/xniUZMNBV53Aw==`; approval is bound to Python source commit `40060a6560bfeec2f45bca92b589bca8c799073f`.
+- `ksadk-python`: Reviewed source commit `0b67fc3ccff3dfb9d38ebb5b60039f29fc29b9c8`; publication uses a clean public export of that reviewed candidate plus release-only evidence updates.
+- `ksadk-web`: GitHub tag `v0.3.4` at `63b30782e9771357185406cb99b504ac3d48a165`; npm integrity `sha512-IudZCNnWAWYJOb/s/lbr02qg17KWQ0s/419StDVZxcEcbJOVVKE4GkbGtGs/5X+WkzbXE9eOUvIEydN5QEV4LQ==`; consumer binding reviewed at `0b67fc3ccff3dfb9d38ebb5b60039f29fc29b9c8`.
Both approved source references include the reviewed Python source commit SHA.
This prevents a stale approval record from passing after candidate changes.
## Recorded Evidence for Approval
-- `@kingsoftcloud/ksadk-web@0.3.2` is published from the source and integrity
- recorded above; the Python build gate verified all 265 embedded static files.
-- The complete Python suite passed 4418 tests, with 73 optional live-service or
- PostgreSQL tests skipped, two expected failures, and one expected-pass marker.
-- The Studio release gate passed 62 contract tests, 190 component tests, 22
- style checks, TypeScript validation, the production build, and browser smoke.
-- The docs static build rendered 201 routes. Wheel/sdist metadata, twine, and
- artifact audits passed with 0 violations across 778 wheel and 862 sdist entries.
-- `make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.8.2` must pass
- again on the exported public candidate before external publication; neither
- public Python package contains version `0.8.2` at approval time.
+- The published `@kingsoftcloud/ksadk-web@0.3.4` package passed source tests,
+ browser E2E and registry-backed consumer rebuild. Its registry tarball
+ SHA-256 is `0d88fb37506bae77ba863b3986b2fde4546cd74cbd3f3021eed1ecd05f15c596`.
+- The Phase 2 compatibility, Codex native host, DSH lifecycle, browser, clean
+ wheel install and clean sdist rebuild gates passed on the interim Python
+ candidate. Wheel/sdist path and content audits reported zero violations.
+- The docs static build rendered 205 routes. Public source export and secret
+ audits must pass again after the final registry-backed rebuild.
+- `make public-publish-check PUBLIC_PUBLISH_PHASE=pre-publish V=0.8.3` must pass
+ on the exported public candidate before external publication; neither public
+ Python package may already contain version `0.8.3` at approval time.
- Branch protection and publish environment are configured according to
`.github/BRANCH_PROTECTION.md`.
-- Web 0.3.2 tests, lint, build, npm pack, audit, interaction E2E, AG-UI E2E,
- reconnect E2E, npm publication, GitHub Release, and Pages deployment are green.
-- Real browser E2E covered an existing CLI high-code Agent and the Kernel Agent
- path: foreground SSE, multi-turn chat, system-role preservation, MCP invocation,
- final-message de-duplication, refresh replay, and cleanup of test sessions.
+- Web 0.3.4 source tests, lint, build, npm pack, audit, Pages demo E2E and browser E2E are green;
+ npm publication, registry verification and the final registry-backed consumer
+ rebuild are complete.
+- Real browser E2E for 0.3.4 passed against a Studio-created Codex Agent and a
+ historical 0.8.2 Agent: multi-turn context, reasoning, refresh replay and
+ final-message de-duplication bind to Hosted UI image digest
+ `sha256:d629384e44a2e35f5dd5f7788ea16097cb49d79c582206d5fe453911fe20d66d`.
- Release notes, `CHANGELOG.md`, public README and docs were reviewed for the
- complete 0.8.2 summary, sensitive environment names, internal endpoints,
+ complete 0.8.3 summary, sensitive environment names, internal endpoints,
tokens, customer data and inaccurate claims.
- PyPI/TestPyPI credentials stay outside the repository.
@@ -66,6 +67,6 @@ This prevents a stale approval record from passing after candidate changes.
| Role | Name | Decision | Date |
| --- | --- | --- | --- |
-| Maintainer | @AgentArcLab | Approved | 2026-08-26 |
-| Security reviewer | @AgentArcLab | Approved after source, artifact and secret gates | 2026-08-26 |
-| Release owner | @AgentArcLab | Approved for clean export and Trusted Publishing | 2026-08-26 |
+| Maintainer | @AgentArcLab | Approved | 2026-09-01 |
+| Security reviewer | @AgentArcLab | Approved | 2026-09-01 |
+| Release owner | @AgentArcLab | Approved | 2026-09-01 |
diff --git a/docs/public-release-workflow.md b/docs/public-release-workflow.md
index 5d0b2291..7c290746 100644
--- a/docs/public-release-workflow.md
+++ b/docs/public-release-workflow.md
@@ -66,6 +66,19 @@ git diff --check
如果本次需要绑定新的 UI 版本，确认 `KSADK_WEB_VERSION` 默认值、README、docs-site、approval record 都引用同一个 npm 版本。
+Phase 2 发布还必须在最终内部 `master` 提交上重新生成本地制品证据，并在 npm 包发布、Hosted UI 以 digest 部署、发布候选环境浏览器矩阵完成后运行：
+
+```bash
+make phase2-release-candidate-gate \
+ PHASE2_FINAL_COMMIT= \
+ PHASE2_LOCAL_EVIDENCE= \
+ PHASE2_WEB_REGISTRY_EVIDENCE= \
+ PHASE2_DEPLOYMENT_EVIDENCE= \
+ PHASE2_PREPROD_EVIDENCE=
+```
+
+该门禁要求 npm integrity、Hosted UI 镜像 digest、Helm revision、wheel/sdist digest 和最终源码提交互相一致；Studio 新建 Agent 与历史 0.8.2 Agent 都必须通过 Studio/Hosted UI 两个入口的多轮流式验证。测试新建的 Agent 必须删除，历史 Agent 必须保留。缺少 registry 正式版本、使用可变镜像 tag、单轮响应或仅本地 mock 时，报告不会变绿。
+
RuntimeEvent schema v2 发布的额外约束：当 Python 发布把运行事件主路径切到 canonical `schema_version=2`（能力描述 `RuntimeEventVersions=[1,2]`、`RuntimeEventDefault=2`、`RuntimeEventV1ProjectionModes=["snapshot_only","identity_replace"]`、`RuntimeEventV1ProjectionDefault="snapshot_only"`）时，配套的 `ksadk-web`、Studio react-ui 与 `agentengine-hosted-ui` 必须是与本次发布一致的 identity-aware 版本，才能按 run/scope/item/part identity 正确归并流式与回放输出。候选报告必须记录 Python 与三个 UI 仓库各自的 commit 和包版本，作为同一发布单元评审。
更新审批记录：
diff --git "a/docs/reference/ksadk\347\216\257\345\242\203\345\217\230\351\207\217\345\217\202\350\200\203.md" "b/docs/reference/ksadk\347\216\257\345\242\203\345\217\230\351\207\217\345\217\202\350\200\203.md"
index 66aca9d0..3267ea13 100644
--- "a/docs/reference/ksadk\347\216\257\345\242\203\345\217\230\351\207\217\345\217\202\350\200\203.md"
+++ "b/docs/reference/ksadk\347\216\257\345\242\203\345\217\230\351\207\217\345\217\202\350\200\203.md"
@@ -367,7 +367,7 @@
| `KSADK_UI_PATH` | 本地 Web UI / Runtime bootstrap | 否 | `/` | 无 | 否 | 开发者 / 平台 | 否 | 自定义 UI 挂载路径，例如 `/research`。 |
| `KSADK_UI_URL` | Runtime bootstrap | 否 | 未设置 | 无 | 否 | 平台 / 开发者 | 否 | 外部自定义 UI URL。 |
| `KSADK_UI_BUNDLE_PATH` | Runtime bootstrap | 否 | 自动探测 `research-ui/dist` | 无 | 否 | 开发者 / 平台 | 否 | 自定义 UI 静态 bundle 相对项目路径。 |
-| `KSADK_WEB_VERSION` | Hosted Web UI static sync | 否 | `0.3.2` | 可显式设置已发布版本 | 否 | 构建环境 / 发版负责人 | 否 | `make sync-ksadk-web-static` 使用的 `@kingsoftcloud/ksadk-web` npm 版本。wheel 构建必须固定一个已发布版本；升级此值前先发布并验证对应的 npm 包。 |
+| `KSADK_WEB_VERSION` | Hosted Web UI static sync | 否 | `0.3.4` | 可显式设置已发布版本 | 否 | 构建环境 / 发版负责人 | 否 | `make sync-ksadk-web-static` 使用的 `@kingsoftcloud/ksadk-web` npm 版本。wheel 构建必须固定一个已发布版本；升级此值前先发布并验证对应的 npm 包。 |
| `KSADK_WEB_PACKAGE` | Hosted Web UI static sync | 否 | `@kingsoftcloud/ksadk-web` | 无 | 否 | 构建环境 / 开发者 | 否 | 本地 UI static 同步使用的 npm 包名。 |
| `KSADK_WEB_TARBALL_NAME` | Hosted Web UI static sync | 否 | 根据 `KSADK_WEB_VERSION` 派生 | 无 | 否 | 构建环境 | 否 | 仅在设置 `KSADK_WEB_RELEASE_URL` 时作为下载保存文件名；npm pack 模式会使用 npm 返回的真实 tarball 文件名。 |
| `KSADK_WEB_RELEASE_URL` | Hosted Web UI static sync | 否 | 未设置 | 无 | 否 | 构建环境 / 开发者 | 否 | 可选兼容兜底。设置后跳过 npm pack，改从该 tarball URL 下载。 |
@@ -377,6 +377,9 @@
| `KSADK_CODEX_ISOLATE_HOME` | Codex runtime | 否 | `1` | 无 | 否 | 开发者 / 测试 | 否 | 默认隔离 Codex 状态；仅调试时可设为 `0` 复用进程 HOME。 |
| `KSADK_CODEX_SANDBOX` | Codex runtime | 否 | `read_only` | 无 | 否 | 开发者 / Studio | 否 | Codex 沙箱模式：`read_only`、`workspace_write` 或 `full_access`。 |
| `KSADK_CODEX_USE_PROXY` | Codex runtime | 否 | 自动探测 | 无 | 否 | 开发者 / 平台 | 否 | `1` 强制启用本地 Responses-to-Chat proxy，`0` 强制直连；未设置时仅对自定义上游进行保守探测。 |
+| `KSADK_DSH_HOME` | Studio 插件桥接 | 否 | `/.agentkit/dsh-home` | 无 | 否 | 开发者 / Studio | 否 | 受管理 DSH Profile 的隔离目录。显式设置后 Studio 不会改写该目录。 |
+| `KSADK_DSH_PROFILE` | Studio 插件桥接 | 否 | `studio` | 无 | 否 | 开发者 / Studio | 否 | 选择 DSH Profile 名称；与 `KSADK_DSH_HOME` 一起用于发现已安装插件。 |
+| `KSADK_DSH_BIN` | Studio 插件桥接 | 否 | 受管理固定工具链 | 无 | 否 | DSH 核心开发 / CI | 否 | 显式指定 DSH 命令路径，仅用于验证固定版本工具链；版本不匹配会拒绝执行。 |
| `KSADK_STUDIO_NO_SECURITY` | AgentKit Studio | 否 | `0` | 无 | 否 | 测试环境 | 否 | 仅受控自动化测试可设为 `1`；正常启动必须保留 loopback session 与 CSRF 校验。 |
| `KSADK_STUDIO_SESSION_TOKEN` | AgentKit Studio | 否 | 随机生成 | 无 | 是 | CLI / 测试 Secret | 否 | 显式指定本地浏览器 session token；正常启动由 CLI 随机生成并写入启动 URL。 |
| `KSADK_STUDIO_TRACE_CONTENT` | AgentKit Studio | 否 | `1` | 无 | 否 | 开发者 / Studio 设置 | 否 | 是否保存 Trace 事件正文；设为 `0` 时只保留排障所需元数据。 |
diff --git a/export-manifest.json b/export-manifest.json
index 4214bda9..b42b4448 100644
--- a/export-manifest.json
+++ b/export-manifest.json
@@ -1,845 +1,14 @@
{
- "generatedAt": "2026-08-26T10:09:38.713417+00:00",
+ "schemaVersion": 1,
+ "generatedAt": "2026-09-01T06:37:22.961623+00:00",
+ "sourceCommit": "35ed384f55dc9a74aade79d2ad38b5ede83904ee",
+ "sourceTree": "clean",
"targetRepository": "https://github.com/kingsoftcloud/ksadk-python",
"documentation": "https://kingsoftcloud.github.io/ksadk-python/",
- "exportPathCount": 1124,
- "excludedPathCount": 751,
- "excludedPaths": [
- "contracts/agent-kernel/v1/activation-lease.schema.json",
- "contracts/agent-kernel/v1/agent-control.schema.json",
- "contracts/agent-kernel/v1/fixtures/activation-lease.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-enqueue.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-inject.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-interrupt.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-pause.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-permit.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-receipts.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-resume.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-steer.json",
- "contracts/agent-kernel/v1/fixtures/agent-control-submit_interaction.json",
- "contracts/agent-kernel/v1/fixtures/agent-control.json",
- "contracts/agent-kernel/v1/fixtures/agent-status-snapshot.json",
- "contracts/agent-kernel/v1/fixtures/interaction-requested.json",
- "contracts/agent-kernel/v1/fixtures/interaction-resolved.json",
- "contracts/agent-kernel/v1/fixtures/interaction-submit.json",
- "contracts/agent-kernel/v1/fixtures/runtime-capability.json",
- "contracts/agent-kernel/v1/fixtures/session-event-control.json",
- "contracts/agent-kernel/v1/fixtures/session-event-runtime.json",
- "contracts/agent-kernel/v1/interaction.schema.json",
- "contracts/agent-kernel/v1/manifest.json",
- "contracts/agent-kernel/v1/runtime-capability.schema.json",
- "contracts/agent-kernel/v1/session-event.schema.json",
- "docs/A2UI-agent驱动UI技术方案.md",
- "docs/Agent 开发者上下文接入指南.md",
- "docs/DeepAgents说明.md",
- "docs/a2ui-v1-alignment-proposal.md",
- "docs/adk-multi-version-compat.md",
- "docs/adk-resume-integration-design.md",
- "docs/agent-loop-convergence-design.md",
- "docs/agentkit-local-studio-phase1-delivery-design.md",
- "docs/agentkit-studio-frontend-design-system-v1.md",
- "docs/archive/kb-memory/knowledge_base_integration_plan.md",
- "docs/archive/kb-memory/knowledge_base_test_report.md",
- "docs/archive/kb-memory/memory_adk_test_practice.md",
- "docs/archive/kb-memory/memory_sdk_integration_plan.md",
- "docs/archive/kb-memory/memory_test_report.md",
- "docs/archive/versions/hermes-agent-v2026.4.16_本地安装配置与ksadk接入流程.md",
- "docs/archive/workspace/agentengine-runtime-common-设计方案.md",
- "docs/archive/workspace/openclaw_通用_memory_backend_bootstrap_设计.md",
- "docs/archive/workspace/workspace_files_v1_实施说明.md",
- "docs/archive/workspace/workspace_files_去重改造方案比较稿.md",
- "docs/evaluation/phase1-smoke-evalset.yaml",
- "docs/evaluation/端云评测一期开发记录.md",
- "docs/evaluation/端云评测方案.md",
- "docs/frameworks/LangGraph开发最佳实践.md",
- "docs/frameworks/人机交互跨框架接入指南.md",
- "docs/guides/Agent 开发者上下文接入指南.md",
- "docs/guides/DeepAgents说明.md",
- "docs/guides/LangGraph开发最佳实践.md",
- "docs/guides/ksadk使用文档.md",
- "docs/guides/知识库与记忆示例.md",
- "docs/guides/记忆使用指南.md",
- "docs/hosted-ui-refactor-plan.md",
- "docs/internal/Runner_Approval_Architecture.md",
- "docs/internal/coding-agent-p0-tooling.md",
- "docs/internal/dry_run_refactor.md",
- "docs/internal/ksadk-skills-analysis-and-design.md",
- "docs/internal/sandbox-runtime-design.md",
- "docs/internal/skill-runtime-e2e.md",
- "docs/ksadk-iteration-plan-condensed.md",
- "docs/ksadk使用文档.md",
- "docs/ksadk开源准备计划.md",
- "docs/ksadk技术设计.md",
- "docs/ksadk环境变量参考.md",
- "docs/ksadk端上Agent观测与评测技术评审方案.md",
- "docs/ksadk端上Agent观测与评测落地技术方案.md",
- "docs/openclaw_client_one_click_deploy.html",
- "docs/openclaw_gateway_channel_flow.svg",
- "docs/openclaw_gateway_channel_flow_hd.png",
- "docs/openclaw_gateway_technical.html",
- "docs/openclaw一键部署指南.md",
- "docs/preview/cli-demo/cli_real_terminal_demo.png",
- "docs/preview/cli-demo/cli_screenshot_demo.sh",
- "docs/preview/images/claw_logo.png",
- "docs/preview/images/claw_robot.png",
- "docs/preview/images/wps_support_group.jpg",
- "docs/prompt-context-memory-implementation.md",
- "docs/prompt-driven-agent-creation-draft.md",
- "docs/qoder-cloud-agent-benchmark-and-phase1-redesign.md",
- "docs/reference/ksadk技术设计.md",
- "docs/reference/远程Agent运行时接口说明.md",
- "docs/runtime-event-v2-cold-recovery-design.md",
- "docs/runtime-foundation-freeze-v1.md",
- "docs/superpowers/evidence/phase0/manifest.json",
- "docs/superpowers/evidence/phase1/REVIEW-HANDOFF.md",
- "docs/superpowers/evidence/phase1/baseline.json",
- "docs/superpowers/evidence/phase1/canary-hosted/deployment.yaml",
- "docs/superpowers/evidence/phase1/canary-hosted/runtime.Dockerfile",
- "docs/superpowers/evidence/phase1/canary/canary.audit.Dockerfile",
- "docs/superpowers/evidence/phase1/canary/canary.e2e.Dockerfile",
- "docs/superpowers/evidence/phase1/local-closure-report.json",
- "docs/superpowers/evidence/phase1/preprod-report.json",
- "docs/superpowers/evidence/phase1/preprod/audit-closure.json",
- "docs/superpowers/evidence/phase1/preprod/contract-mismatch-drill.json",
- "docs/superpowers/evidence/phase1/preprod/cross-repo-versions.json",
- "docs/superpowers/evidence/phase1/preprod/current-main-versions-d4a66a72.json",
- "docs/superpowers/evidence/phase1/preprod/interaction-v1-e2e.json",
- "docs/superpowers/evidence/phase1/preprod/main-flow-audit-d4a66a72.json",
- "docs/superpowers/evidence/phase1/preprod/managed-pg-matrix-d4a66a72.json",
- "docs/superpowers/evidence/phase1/preprod/readiness-fix.json",
- "docs/superpowers/evidence/phase1/preprod/real-codex-closure.json",
- "docs/superpowers/evidence/phase1/preprod/real-codex-deployment.yaml",
- "docs/superpowers/evidence/phase1/preprod/real-interaction-closure.json",
- "docs/superpowers/evidence/phase1/preprod/step456-checks.json",
- "docs/superpowers/evidence/phase1/preprod/step456-e2e.json",
- "docs/superpowers/evidence/phase1/preprod/step789-drill.json",
- "docs/superpowers/evidence/phase1/preprod/studio-main-flow-closure.json",
- "docs/superpowers/evidence/phase1/preprod/v2-audit.json",
- "docs/superpowers/evidence/phase1/preprod/v2-drill.json",
- "docs/superpowers/evidence/phase1/preprod/v2-e2e.json",
- "docs/superpowers/evidence/phase1/preprod/v2-versions.json",
- "docs/superpowers/evidence/phase1/rollback-report.json",
- "docs/superpowers/plans/2026-04-16-hosted-hermes-gateway.md",
- "docs/superpowers/plans/2026-04-20-workspace-files-pvc-implementation.md",
- "docs/superpowers/plans/2026-05-07-thinking-user-control-and-e2e-plan.md",
- "docs/superpowers/plans/2026-06-04-ksadk-0.6.2-public-candidate-audit.md",
- "docs/superpowers/plans/2026-06-04-otel-first-observability-release.md",
- "docs/superpowers/plans/2026-08-04-agentkit-studio-otel-trace-explorer-rewrite.md",
- "docs/superpowers/plans/2026-08-04-runtime-adapter-web-unification.md",
- "docs/superpowers/plans/2026-08-11-runtime-event-schema-v2-release.md",
- "docs/superpowers/plans/2026-08-14-cloud-evaluation-closed-loop-plan.md",
- "docs/superpowers/plans/2026-08-14-edge-cloud-evalset-phase1.md",
- "docs/superpowers/plans/2026-08-14-local-agent-observability.md",
- "docs/superpowers/plans/2026-08-17-agent-runtime-v2-phase1-agent-kernel.md",
- "docs/superpowers/plans/2026-08-18-studio-evaluation-list-detail.md",
- "docs/superpowers/plans/2026-08-18-studio-evaluation-target-controls.md",
- "docs/superpowers/plans/2026-08-18-studio-trajectory-semantic-records.md",
- "docs/superpowers/plans/2026-08-19-cloud-monitor-span-compatibility.md",
- "docs/superpowers/plans/2026-08-20-studio-bundle-deploy-v1.md",
- "docs/superpowers/plans/2026-08-20-studio-cloud-lifecycle-ui.md",
- "docs/superpowers/specs/2026-04-18-ksadk-support-model-design.md",
- "docs/superpowers/specs/2026-04-19-agent-workspace-file-service-design.md",
- "docs/superpowers/specs/2026-08-04-agentkit-studio-unified-runtime-design.md",
- "docs/superpowers/specs/2026-08-11-runtime-event-v2-v1-compatibility-design.md",
- "docs/superpowers/specs/2026-08-14-cloud-evaluation-closed-loop-design.md",
- "docs/superpowers/specs/2026-08-17-agent-eval-endpoint-resolution-design.md",
- "docs/superpowers/specs/2026-08-17-agent-runtime-v2-plugin-architecture-design.md",
- "docs/superpowers/specs/2026-08-18-studio-evaluation-target-controls-design.md",
- "docs/superpowers/specs/2026-08-19-cloud-monitor-span-compatibility-design.md",
- "docs/superpowers/specs/2026-08-20-studio-cloud-lifecycle-workbench-design.md",
- "docs/veadk-benchmark-and-iteration-plan.md",
- "docs/工作区文件技术设计.md",
- "docs/平台可观测与用户反馈设计方案.md",
- "docs/本地Agent构造与评测验证记录-20260819.md",
- "docs/本地Agent评测全流程测试记录.md",
- "docs/知识库与记忆示例.md",
- "docs/自定义请求数据透传方案.md",
- "docs/记忆使用指南.md",
- "docs/远程Agent运行时接口说明.md",
- "ksadk/studio/react-ui/components.json",
- "ksadk/studio/react-ui/index.html",
- "ksadk/studio/react-ui/package-lock.json",
- "ksadk/studio/react-ui/package.json",
- "ksadk/studio/react-ui/postcss.config.js",
- "ksadk/studio/react-ui/src/App.chat-entry.test.tsx",
- "ksadk/studio/react-ui/src/App.routes.test.ts",
- "ksadk/studio/react-ui/src/App.tsx",
- "ksadk/studio/react-ui/src/api.test.mjs",
- "ksadk/studio/react-ui/src/api.ts",
- "ksadk/studio/react-ui/src/approvalModes.test.mjs",
- "ksadk/studio/react-ui/src/approvalModes.ts",
- "ksadk/studio/react-ui/src/authoringStages.test.mjs",
- "ksadk/studio/react-ui/src/authoringStages.ts",
- "ksadk/studio/react-ui/src/chatProtocol.test.mjs",
- "ksadk/studio/react-ui/src/chatProtocol.ts",
- "ksadk/studio/react-ui/src/chatWorkspaceApprovalPlacement.test.mjs",
- "ksadk/studio/react-ui/src/cloudChatWorkspace.test.mjs",
- "ksadk/studio/react-ui/src/cloudDeployments.test.ts",
- "ksadk/studio/react-ui/src/cloudDeployments.ts",
- "ksadk/studio/react-ui/src/components/A2UIRenderer.test.tsx",
- "ksadk/studio/react-ui/src/components/A2UIRenderer.tsx",
- "ksadk/studio/react-ui/src/components/AgentAppearanceEditor.tsx",
- "ksadk/studio/react-ui/src/components/AgentAvatar.tsx",
- "ksadk/studio/react-ui/src/components/ChatComposer.test.tsx",
- "ksadk/studio/react-ui/src/components/ChatComposer.tsx",
- "ksadk/studio/react-ui/src/components/ChatRunPanel.test.ts",
- "ksadk/studio/react-ui/src/components/ChatRunPanel.tsx",
- "ksadk/studio/react-ui/src/components/ChatWorkspace.tsx",
- "ksadk/studio/react-ui/src/components/CloudChatWorkspace.behavior.test.tsx",
- "ksadk/studio/react-ui/src/components/CloudChatWorkspace.tsx",
- "ksadk/studio/react-ui/src/components/ComposerActionMenu.test.tsx",
- "ksadk/studio/react-ui/src/components/ComposerActionMenu.tsx",
- "ksadk/studio/react-ui/src/components/ConfirmDialog.tsx",
- "ksadk/studio/react-ui/src/components/Drawer.tsx",
- "ksadk/studio/react-ui/src/components/MoreActionsMenu.tsx",
- "ksadk/studio/react-ui/src/components/NavigationRail.test.tsx",
- "ksadk/studio/react-ui/src/components/NavigationRail.tsx",
- "ksadk/studio/react-ui/src/components/PageHeaderPortal.tsx",
- "ksadk/studio/react-ui/src/components/PythonToolExample.test.tsx",
- "ksadk/studio/react-ui/src/components/PythonToolExample.tsx",
- "ksadk/studio/react-ui/src/components/RuntimeModeBar.test.tsx",
- "ksadk/studio/react-ui/src/components/RuntimeModeBar.tsx",
- "ksadk/studio/react-ui/src/components/SettingsOverlay.test.ts",
- "ksadk/studio/react-ui/src/components/SettingsOverlay.tsx",
- "ksadk/studio/react-ui/src/components/SkillFileBrowser.test.tsx",
- "ksadk/studio/react-ui/src/components/SkillFileBrowser.tsx",
- "ksadk/studio/react-ui/src/components/Toast.tsx",
- "ksadk/studio/react-ui/src/components/ui/CodeViewer.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/CodeViewer.tsx",
- "ksadk/studio/react-ui/src/components/ui/FileDropzone.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/FileDropzone.tsx",
- "ksadk/studio/react-ui/src/components/ui/FormField.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/FormField.tsx",
- "ksadk/studio/react-ui/src/components/ui/GeneratedIdField.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/GeneratedIdField.tsx",
- "ksadk/studio/react-ui/src/components/ui/MarkdownPreview.tsx",
- "ksadk/studio/react-ui/src/components/ui/PrismRenderer.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioDataTable.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioDataTable.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioDialog.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioDialog.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioMultiSelect.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioMultiSelect.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioScrollArea.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioSelect.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/StudioSelect.tsx",
- "ksadk/studio/react-ui/src/components/ui/TextShimmer.test.tsx",
- "ksadk/studio/react-ui/src/components/ui/TextShimmer.tsx",
- "ksadk/studio/react-ui/src/components/ui/badge.tsx",
- "ksadk/studio/react-ui/src/components/ui/button.tsx",
- "ksadk/studio/react-ui/src/components/ui/card.tsx",
- "ksadk/studio/react-ui/src/components/ui/input.tsx",
- "ksadk/studio/react-ui/src/components/ui/separator.tsx",
- "ksadk/studio/react-ui/src/components/ui/tabs.tsx",
- "ksadk/studio/react-ui/src/composerActions.test.ts",
- "ksadk/studio/react-ui/src/composerActions.ts",
- "ksadk/studio/react-ui/src/createPage.component-contract.test.mjs",
- "ksadk/studio/react-ui/src/evaluationRoute.contract.test.mjs",
- "ksadk/studio/react-ui/src/index.css",
- "ksadk/studio/react-ui/src/kingdesign.contract.test.mjs",
- "ksadk/studio/react-ui/src/kingdesign.css",
- "ksadk/studio/react-ui/src/lib/formErrors.test.ts",
- "ksadk/studio/react-ui/src/lib/formErrors.ts",
- "ksadk/studio/react-ui/src/lib/generatedId.test.ts",
- "ksadk/studio/react-ui/src/lib/generatedId.ts",
- "ksadk/studio/react-ui/src/lib/utils.test.ts",
- "ksadk/studio/react-ui/src/lib/utils.ts",
- "ksadk/studio/react-ui/src/main.tsx",
- "ksadk/studio/react-ui/src/pages/AgentDetailPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/AgentDetailPage.tsx",
- "ksadk/studio/react-ui/src/pages/AgentEditor.test.tsx",
- "ksadk/studio/react-ui/src/pages/AgentEditor.tsx",
- "ksadk/studio/react-ui/src/pages/AgentsPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/AgentsPage.tsx",
- "ksadk/studio/react-ui/src/pages/BuildsPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/BuildsPage.tsx",
- "ksadk/studio/react-ui/src/pages/CreatePage.test.tsx",
- "ksadk/studio/react-ui/src/pages/CreatePage.tsx",
- "ksadk/studio/react-ui/src/pages/DeploymentsPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/DeploymentsPage.tsx",
- "ksadk/studio/react-ui/src/pages/EvaluationDetailPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/EvaluationDetailPage.tsx",
- "ksadk/studio/react-ui/src/pages/EvaluationsPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/EvaluationsPage.tsx",
- "ksadk/studio/react-ui/src/pages/ObservabilityPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/ObservabilityPage.tsx",
- "ksadk/studio/react-ui/src/pages/OrchestrationPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/OrchestrationPage.tsx",
- "ksadk/studio/react-ui/src/pages/ResourcesPage.tsx",
- "ksadk/studio/react-ui/src/pages/RuntimeResourcesPage.test.tsx",
- "ksadk/studio/react-ui/src/pages/RuntimeResourcesPage.tsx",
- "ksadk/studio/react-ui/src/pages/TrajectoryView.test.tsx",
- "ksadk/studio/react-ui/src/pages/TrajectoryView.tsx",
- "ksadk/studio/react-ui/src/pages/evaluationTypes.ts",
- "ksadk/studio/react-ui/src/pages/evaluations.css",
- "ksadk/studio/react-ui/src/pages/trajectory.test.ts",
- "ksadk/studio/react-ui/src/pages/trajectory.ts",
- "ksadk/studio/react-ui/src/responsive.css",
- "ksadk/studio/react-ui/src/responsiveViewport.test.mjs",
- "ksadk/studio/react-ui/src/responsiveViewport.ts",
- "ksadk/studio/react-ui/src/schemas/agentForms.test.ts",
- "ksadk/studio/react-ui/src/schemas/agentForms.ts",
- "ksadk/studio/react-ui/src/schemas/resourceForms.test.ts",
- "ksadk/studio/react-ui/src/schemas/resourceForms.ts",
- "ksadk/studio/react-ui/src/settingsOverlay.cloudAccount.test.mjs",
- "ksadk/studio/react-ui/src/skillBatchImport.test.mjs",
- "ksadk/studio/react-ui/src/skillBatchImport.ts",
- "ksadk/studio/react-ui/src/soft-block.css",
- "ksadk/studio/react-ui/src/studio.css",
- "ksadk/studio/react-ui/src/studioRoutes.test.ts",
- "ksadk/studio/react-ui/src/studioRoutes.ts",
- "ksadk/studio/react-ui/src/studioTheme.test.mjs",
- "ksadk/studio/react-ui/src/studioTheme.ts",
- "ksadk/studio/react-ui/src/test/setup.ts",
- "ksadk/studio/react-ui/src/theme.css",
- "ksadk/studio/react-ui/src/useStudioTheme.ts",
- "ksadk/studio/react-ui/src/useStudioViewportMode.ts",
- "ksadk/studio/react-ui/src/utils/chatErrors.test.ts",
- "ksadk/studio/react-ui/src/utils/chatErrors.ts",
- "ksadk/studio/react-ui/tsconfig.json",
- "ksadk/studio/react-ui/vite.config.ts",
- "ksadk/studio/react-ui/vitest.config.ts",
- "scripts/__init__.py",
- "scripts/build_phase1_baseline.py",
- "scripts/ci-frontend-check.sh",
- "scripts/collect_context_baseline.py",
- "scripts/collect_phase1_live_deployment.py",
- "scripts/collect_real_model_baseline.py",
- "scripts/debug_aicp_memory.py",
- "scripts/export_agent_kernel_contracts.py",
- "scripts/phase1_preprod_gate.py",
- "scripts/run_phase1_managed_pg_matrix.py",
- "scripts/test_ks3_upload.py",
- "scripts/validate_checkpoint_resume_e2e.py",
- "scripts/validate_codex_interaction_e2e.py",
- "scripts/validate_hosted_long_task_e2e.py",
- "scripts/validate_long_task_pilot.py",
- "scripts/validate_session_failopen_e2e.py",
- "scripts/verify_phase1_baseline.py",
- "skills/agentengine-cli-ops/SKILL.md",
- "skills/agentengine-cli-ops/agents/openai.yaml",
- "skills/agentengine-cli-ops/references/prerequisites.md",
- "skills/agentengine-cli-ops/references/routing.md",
- "skills/agentengine-cli-ops/references/shared-defaults.md",
- "skills/agentengine-cluster-debug/SKILL.md",
- "skills/agentengine-cluster-debug/references/commands.md",
- "skills/agentengine-hermes-lifecycle/SKILL.md",
- "skills/agentengine-hermes-lifecycle/agents/openai.yaml",
- "skills/agentengine-hermes-lifecycle/references/dashboard-links.md",
- "skills/agentengine-hermes-lifecycle/references/hermes-lifecycle.md",
- "skills/agentengine-hermes-lifecycle/references/troubleshooting.md",
- "skills/agentengine-openclaw-oneclick-deploy/SKILL.md",
- "skills/agentengine-openclaw-oneclick-deploy/agents/openai.yaml",
- "skills/agentengine-openclaw-oneclick-deploy/references/channel-connect.md",
- "skills/agentengine-openclaw-oneclick-deploy/references/dashboard-links.md",
- "skills/agentengine-openclaw-oneclick-deploy/references/openclaw-lifecycle.md",
- "skills/agentengine-openclaw-oneclick-deploy/references/troubleshooting.md",
- "tests/__init__.py",
- "tests/a2a/compose.yaml",
- "tests/a2a/pg_process_worker.py",
- "tests/a2a/process_server.py",
- "tests/a2a/test_a2a_dependency_contract.py",
- "tests/a2a/test_a2a_discovery.py",
- "tests/a2a/test_a2a_protocol_e2e.py",
- "tests/a2a/test_card.py",
- "tests/a2a/test_context_adapter.py",
- "tests/a2a/test_context_store.py",
- "tests/a2a/test_control_plane.py",
- "tests/a2a/test_credential_and_outbound.py",
- "tests/a2a/test_executor_cancel_honesty.py",
- "tests/a2a/test_executor_resume_runtime_adapter.py",
- "tests/a2a/test_external_transport.py",
- "tests/a2a/test_managed_a2a_card.py",
- "tests/a2a/test_managed_bootstrap.py",
- "tests/a2a/test_owner_resolver.py",
- "tests/a2a/test_pg_process_recovery.py",
- "tests/a2a/test_process_interop.py",
- "tests/a2a/test_reasoning_streaming.py",
- "tests/a2a/test_resume_store.py",
- "tests/a2a/test_task_event_dispatcher.py",
- "tests/a2a/test_trusted_identity.py",
- "tests/a2ui/test_a2ui_core.py",
- "tests/a2ui/test_a2ui_renderer.py",
- "tests/agui/__init__.py",
- "tests/agui/test_copilotkit_a2ui_compat.py",
- "tests/agui/test_langgraph_interrupt_e2e.py",
- "tests/agui/test_protocol_contract.py",
- "tests/agui/test_runtime_adapter.py",
- "tests/agui/test_runtime_preprocessing.py",
- "tests/architecture/test_python_module_size.py",
- "tests/architecture/test_runtime_boundaries.py",
- "tests/builders/test_runtime_entrypoint_templates.py",
- "tests/cli/test_cli_alignment.py",
- "tests/cli/test_cmd_a2a_runtime_adapter.py",
- "tests/cli/test_cmd_managed_runtime.py",
- "tests/cli/test_cmd_observe.py",
- "tests/cli/test_cmd_run_runtime_adapter.py",
- "tests/cli/test_cmd_web_runtime_adapter.py",
- "tests/cli/test_run_chain_e2e.py",
- "tests/codex/fake_app_server.py",
- "tests/codex/test_input_parts.py",
- "tests/codex/test_proxy_injection.py",
- "tests/codex/test_real_proxy_tool_surface.py",
- "tests/codex/test_sdk_transport.py",
- "tests/context_engine/test_adapter_context_capability.py",
- "tests/context_engine/test_baseline_collector.py",
- "tests/context_engine/test_baseline_collector_wiring.py",
- "tests/context_engine/test_baseline_runtime_wiring.py",
- "tests/context_engine/test_cache_observability.py",
- "tests/context_engine/test_capabilities.py",
- "tests/context_engine/test_contributors.py",
- "tests/context_engine/test_deployment_mode.py",
- "tests/context_engine/test_orphan_history.py",
- "tests/context_engine/test_phase01_finishing.py",
- "tests/context_engine/test_planner.py",
- "tests/context_engine/test_prompt_source_trace.py",
- "tests/context_engine/test_runner_conformance.py",
- "tests/context_engine/test_shadow_baseline_acceptance.py",
- "tests/context_engine/test_shadow_plan.py",
- "tests/context_engine/test_shadow_plan_integration.py",
- "tests/context_engine/test_shadow_plan_no_plaintext.py",
- "tests/context_engine/test_token_counter.py",
- "tests/context_engine/test_trace_planned_projected_actual.py",
- "tests/contracts/__init__.py",
- "tests/contracts/test_agent_kernel_schema_compatibility.py",
- "tests/contracts/test_interaction_v1_contract.py",
- "tests/conversations/test_ambient_error_guard.py",
- "tests/conversations/test_dual_threshold_compaction.py",
- "tests/conversations/test_extractive_fallback_corrections.py",
- "tests/conversations/test_history_placeholder_boundaries.py",
- "tests/conversations/test_phase3_memory_flush_summary.py",
- "tests/conversations/test_ptl_retry.py",
- "tests/conversations/test_runtime_input_prompt_compiler.py",
- "tests/conversations/test_session_lock.py",
- "tests/conversations/test_tool_result_budget.py",
- "tests/conversations/test_working_state.py",
- "tests/conversations/test_working_state_acceptance.py",
- "tests/conversations/test_working_state_fix.py",
- "tests/conversations/test_working_state_full_chain.py",
- "tests/conversations/test_working_state_strict.py",
- "tests/e2e/test_codex_sdk_process_e2e.py",
- "tests/events/adapters/test_a2a.py",
- "tests/events/adapters/test_adk.py",
- "tests/events/adapters/test_codex.py",
- "tests/events/adapters/test_langgraph.py",
- "tests/events/fixtures/runtime_event_v1.json",
- "tests/events/fixtures/runtime_event_v2.json",
- "tests/events/test_canonical_runtime_event.py",
- "tests/events/test_cold_recovery.py",
- "tests/events/test_lenient_parsing.py",
- "tests/events/test_mixed_schema_replay.py",
- "tests/events/test_runtime_event.py",
- "tests/events/test_runtime_event_deserialization.py",
- "tests/events/test_runtime_event_recovery.py",
- "tests/events/test_runtime_event_store.py",
- "tests/events/test_runtime_identity.py",
- "tests/events/test_session_event_store.py",
- "tests/events/test_stream_reducer.py",
- "tests/events/test_v1_compat.py",
- "tests/harness/__init__.py",
- "tests/harness/conftest.py",
- "tests/harness/fixtures/__init__.py",
- "tests/harness/fixtures/mcp_server.py",
- "tests/harness/test_harness_app.py",
- "tests/harness/test_harness_codex.py",
- "tests/harness/test_harness_isolation.py",
- "tests/harness/test_harness_mcp_e2e.py",
- "tests/harness/test_harness_reasoner.py",
- "tests/harness/test_harness_sandbox_policy.py",
- "tests/integration/__init__.py",
- "tests/integration/test_cloud_managed_e2e.py",
- "tests/integration/test_codex_adk_conformance.py",
- "tests/integration/test_context_e2e.py",
- "tests/integration/test_hosted_chain_e2e.py",
- "tests/integration/test_main_chain_integration.py",
- "tests/integration/test_pcm_dual_runner_e2e.py",
- "tests/integration/test_pcm_permanent.py",
- "tests/integration/test_three_fixes.py",
- "tests/interaction/__init__.py",
- "tests/interaction/fake_approval_app_server.py",
- "tests/interaction/test_codex_live_approval.py",
- "tests/interaction/test_codex_transport_approval_loop.py",
- "tests/interaction/test_langgraph_checkpoint_resume.py",
- "tests/interaction/test_ledger_conformance.py",
- "tests/interaction/test_postgres_interaction_atomicity.py",
- "tests/interaction/test_provider_dispatch.py",
- "tests/interaction/test_validate_codex_interaction_e2e.py",
- "tests/kernel/__init__.py",
- "tests/kernel/control_harness.py",
- "tests/kernel/store_conformance.py",
- "tests/kernel/test_authorization.py",
- "tests/kernel/test_contract_fingerprints.py",
- "tests/kernel/test_contracts.py",
- "tests/kernel/test_control.py",
- "tests/kernel/test_control_audit.py",
- "tests/kernel/test_degradation_diagnostics.py",
- "tests/kernel/test_ingress_convergence.py",
- "tests/kernel/test_kernel_http_ingress.py",
- "tests/kernel/test_memory_store.py",
- "tests/kernel/test_postgres_store.py",
- "tests/kernel/test_production_bootstrap.py",
- "tests/kernel/test_recovery.py",
- "tests/kernel/test_recovery_settlement.py",
- "tests/kernel/test_runtime_identity.py",
- "tests/kernel/test_session_quarantine.py",
- "tests/kernel/test_sqlite_store.py",
- "tests/kernel/test_worker.py",
- "tests/long_task/__init__.py",
- "tests/long_task/test_checkpoint_resume.py",
- "tests/long_task/test_runtime_cancel.py",
- "tests/long_task/test_tool_idempotency.py",
- "tests/memory/__init__.py",
- "tests/memory/test_memory_v2_contract.py",
- "tests/memory/test_resolved_memory_policy.py",
- "tests/mock_responses_server.py",
- "tests/model_proxy/__init__.py",
- "tests/model_proxy/test_bootstrap.py",
- "tests/model_proxy/test_cache.py",
- "tests/model_proxy/test_detect.py",
- "tests/model_proxy/test_gate.py",
- "tests/model_proxy/test_namespace.py",
- "tests/model_proxy/test_server.py",
- "tests/model_proxy/test_streamer.py",
- "tests/model_proxy/test_transform.py",
- "tests/observability/test_session_log.py",
- "tests/observability/test_trajectory.py",
- "tests/phase1/__init__.py",
- "tests/phase1/canary_app.py",
- "tests/phase1/canary_hosted_app.py",
- "tests/phase1/conftest.py",
- "tests/phase1/test_agent_kernel_preprod_e2e.py",
- "tests/phase1/test_agent_kernel_split_brain.py",
- "tests/phase1/test_canary_app_contract.py",
- "tests/phase1/test_collect_phase1_live_deployment.py",
- "tests/phase1/test_contract_digest_preprod.py",
- "tests/phase1/test_local_closure.py",
- "tests/phase1/test_managed_pg_matrix.py",
- "tests/phase1/test_phase1_gate.py",
- "tests/phase1/test_preprod_config.py",
- "tests/prompts/test_prompt_compiler.py",
- "tests/prompts/test_prompt_models.py",
- "tests/prompts/test_prompt_sources.py",
- "tests/prompts/test_resolved_prompt_projection.py",
- "tests/prompts/test_resolved_prompt_sources.py",
- "tests/protocol/__init__.py",
- "tests/protocol/test_cross_projection_golden.py",
- "tests/release/test_phase1_baseline.py",
- "tests/release/test_runtime_event_v2_release_gate.py",
- "tests/runners/test_adapter_interface.py",
- "tests/runners/test_adk_approval_surface.py",
- "tests/runners/test_adk_runner.py",
- "tests/runners/test_checkpoint_capability_honesty.py",
- "tests/runners/test_codex_runtime_adapter.py",
- "tests/runners/test_codex_sdk_surface.py",
- "tests/runners/test_langchain_hitl_langgraph.py",
- "tests/runners/test_langgraph_observability.py",
- "tests/runners/test_langgraph_runner_projection.py",
- "tests/runners/test_runtime_resume_cancel_e2e.py",
- "tests/runtime/test_capability_matrix.py",
- "tests/runtime/test_conversation_execution.py",
- "tests/runtime/test_default_factory.py",
- "tests/runtime/test_executor.py",
- "tests/runtime/test_hosted_finalizer.py",
- "tests/runtime/test_kernel_start_request_defaults.py",
- "tests/runtime/test_preprocessing.py",
- "tests/runtime/test_registry.py",
- "tests/runtime/test_responses_streaming.py",
- "tests/runtime/test_trajectory_events.py",
- "tests/server/test_app_factory.py",
- "tests/server/test_app_factory_a2a.py",
- "tests/server/test_app_factory_agui.py",
- "tests/server/test_app_factory_isolation.py",
- "tests/server/test_route_manifest_parity.py",
- "tests/server/test_runtime_executor_routes.py",
- "tests/server/test_server_exports_runtime_adapter.py",
- "tests/server/test_ui_bootstrap_agui.py",
- "tests/skills/__init__.py",
- "tests/skills/test_adk_runner_skill_runtime.py",
- "tests/skills/test_loader_and_tools.py",
- "tests/skills/test_package_store.py",
- "tests/skills/test_runtime.py",
- "tests/skills/test_runtime_agent.py",
- "tests/skills/test_service_client_http.py",
- "tests/skills/test_skill_service_client.py",
- "tests/skills/test_skill_space_routing.py",
- "tests/skills/test_web_artifacts_fixture.py",
- "tests/snapshots/error_hint_snapshots.txt",
- "tests/snapshots/help_snapshots.txt",
- "tests/snapshots/resource_output_snapshots.txt",
- "tests/snapshots/workflow_help_snapshots.txt",
- "tests/studio/__init__.py",
- "tests/studio/e2e/fake_studio_server.py",
- "tests/studio/e2e/fixtures/review_workspace/src/demo.py",
- "tests/studio/e2e/pcm_browser_smoke.py",
- "tests/studio/e2e/test_codex_xingliu_demo.py",
- "tests/studio/runtime_adapter_fixtures.py",
- "tests/studio/test_agent_budget_chain.py",
- "tests/studio/test_api.py",
- "tests/studio/test_authoring.py",
- "tests/studio/test_builder.py",
- "tests/studio/test_cli_studio.py",
- "tests/studio/test_cloud_chat_api.py",
- "tests/studio/test_codex_api.py",
- "tests/studio/test_codex_authoring.py",
- "tests/studio/test_codex_authoring_integration.py",
- "tests/studio/test_codex_builder.py",
- "tests/studio/test_codex_manifest.py",
- "tests/studio/test_codex_run_spec.py",
- "tests/studio/test_codex_static.py",
- "tests/studio/test_contracts.py",
- "tests/studio/test_direct_cloud_deployment.py",
- "tests/studio/test_env_alias_unification.py",
- "tests/studio/test_evaluation_build_target.py",
- "tests/studio/test_evaluation_cloud.py",
- "tests/studio/test_evaluation_shell.py",
- "tests/studio/test_event_store.py",
- "tests/studio/test_four_fixes.py",
- "tests/studio/test_framework_bundle_integrity.py",
- "tests/studio/test_framework_import.py",
- "tests/studio/test_framework_run_prompt_ownership.py",
- "tests/studio/test_hosted_kernel_bundle_preflight.py",
- "tests/studio/test_manifest_resolver.py",
- "tests/studio/test_model_client.py",
- "tests/studio/test_multi_runtime_agents.py",
- "tests/studio/test_observability_api.py",
- "tests/studio/test_operations.py",
- "tests/studio/test_otel_trace.py",
- "tests/studio/test_pcm_contracts.py",
- "tests/studio/test_pcm_e2e.py",
- "tests/studio/test_pcm_evidence_api.py",
- "tests/studio/test_pcm_preview_api.py",
- "tests/studio/test_real_model_e2e.py",
- "tests/studio/test_resource_catalog.py",
- "tests/studio/test_run_service.py",
- "tests/studio/test_settings.py",
- "tests/studio/test_shared_web.py",
- "tests/studio/test_skill_discovery.py",
- "tests/studio/test_studio_mcp_runtime.py",
- "tests/studio/test_templates.py",
- "tests/studio/test_validator_compiler.py",
- "tests/studio/test_workspace_repository.py",
- "tests/test_a2a_agent_card.py",
- "tests/test_a2a_cli.py",
- "tests/test_a2a_integration.py",
- "tests/test_a2a_toolset.py",
- "tests/test_adk_resilient_session_service.py",
- "tests/test_agent.py",
- "tests/test_agent_access.py",
- "tests/test_agentengine_client_sessions.py",
- "tests/test_agentengine_toolsets.py",
- "tests/test_aicp_env.py",
- "tests/test_attachment_pipeline.py",
- "tests/test_attachment_storage.py",
- "tests/test_background_run.py",
- "tests/test_build_run_input_prompt_sources.py",
- "tests/test_builder_requirements_merge.py",
- "tests/test_builder_runtime_requirements.py",
- "tests/test_cli_dry_run.py",
- "tests/test_cli_global_options.py",
- "tests/test_cli_platform_refactor.py",
- "tests/test_cli_root_entrypoint.py",
- "tests/test_client_framework_passthrough.py",
- "tests/test_client_get_agent_name.py",
- "tests/test_client_http_error_logging.py",
- "tests/test_client_mcp_payloads.py",
- "tests/test_client_permission_precheck.py",
- "tests/test_client_user_uuid_header.py",
- "tests/test_client_workspace_files.py",
- "tests/test_cmd_build_upload_urls.py",
- "tests/test_cmd_completion.py",
- "tests/test_cmd_config_wizard.py",
- "tests/test_cmd_create_from_agent.py",
- "tests/test_cmd_dashboard_fallback.py",
- "tests/test_cmd_deploy_no_cache.py",
- "tests/test_cmd_eval.py",
- "tests/test_cmd_evalset.py",
- "tests/test_cmd_files.py",
- "tests/test_cmd_hermes.py",
- "tests/test_cmd_invoke.py",
- "tests/test_cmd_launch_no_cache.py",
- "tests/test_cmd_mcp_no_cache.py",
- "tests/test_cmd_model.py",
- "tests/test_code_builder_binary_compat.py",
- "tests/test_code_builder_build_info.py",
- "tests/test_code_builder_pip_indexes.py",
- "tests/test_code_builder_rebuild_fingerprint.py",
- "tests/test_code_builder_static_assets.py",
- "tests/test_compaction_pipeline.py",
- "tests/test_config_root_visibility.py",
- "tests/test_container_registry_credentials.py",
- "tests/test_conversation_runtime.py",
- "tests/test_conversation_runtime_structure.py",
- "tests/test_deepagents_integration.py",
- "tests/test_deepagents_runner_skill_runtime.py",
- "tests/test_deploy_env_forward.py",
- "tests/test_deploy_integration.py",
- "tests/test_detector_accuracy.py",
- "tests/test_error_utils_hints.py",
- "tests/test_evaluation_a2a_adapter.py",
- "tests/test_evaluation_agent_eval_client.py",
- "tests/test_evaluation_auto_evaluators.py",
- "tests/test_evaluation_cloud_binding.py",
- "tests/test_evaluation_cloud_converter.py",
- "tests/test_evaluation_cloud_service.py",
- "tests/test_evaluation_contracts.py",
- "tests/test_evaluation_evalset.py",
- "tests/test_evaluation_evaluators.py",
- "tests/test_evaluation_evidence.py",
- "tests/test_evaluation_executor.py",
- "tests/test_evaluation_global_config.py",
- "tests/test_evaluation_local_adapter.py",
- "tests/test_evaluation_storage.py",
- "tests/test_evaluation_target.py",
- "tests/test_events_for_agent.py",
- "tests/test_help_snapshots.py",
- "tests/test_hermes_container_builder.py",
- "tests/test_hermes_terminal.py",
- "tests/test_hermes_terminal_e2e.py",
- "tests/test_identity_resolver.py",
- "tests/test_json_contracts.py",
- "tests/test_kop_client.py",
- "tests/test_ks3_uploader_urls.py",
- "tests/test_langgraph_runner_resume.py",
- "tests/test_langgraph_runner_skill_runtime.py",
- "tests/test_local_runtime_reexec.py",
- "tests/test_long_task_pilot_validation.py",
- "tests/test_mcp_regressions.py",
- "tests/test_mcp_runtime.py",
- "tests/test_message_projection.py",
- "tests/test_model_context.py",
- "tests/test_model_policy.py",
- "tests/test_openai_protocol_e2e.py",
- "tests/test_openclaw_env_vars.py",
- "tests/test_openclaw_gateway.py",
- "tests/test_orchestration_agents.py",
- "tests/test_patch_langchain.py",
- "tests/test_platform_memory_tools.py",
- "tests/test_postgres_session_service.py",
- "tests/test_prepare_ksadk_python_export.py",
- "tests/test_public_secret_audit.py",
- "tests/test_remote_runner.py",
- "tests/test_resource_output_snapshots.py",
- "tests/test_runner.py",
- "tests/test_runtime_common_memory_backend.py",
- "tests/test_sandbox_backend.py",
- "tests/test_security_boundaries.py",
- "tests/test_semantic_circuit_breaker.py",
- "tests/test_server_app_fastapi_compat.py",
- "tests/test_server_file_upload_parsing.py",
- "tests/test_server_session_app.py",
- "tests/test_server_terminal_sessions.py",
- "tests/test_server_workspace_preview_security.py",
- "tests/test_session_continuity.py",
- "tests/test_session_title.py",
- "tests/test_sessions_service.py",
- "tests/test_settings_otlp_contract.py",
- "tests/test_setup_environment.py",
- "tests/test_stm_config.py",
- "tests/test_storage_defaults.py",
- "tests/test_tool_gateway.py",
- "tests/test_tool_result_budget.py",
- "tests/test_tracing_cloud_monitor_e2e.py",
- "tests/test_tui_app.py",
- "tests/test_tui_loop.py",
- "tests/test_tui_stream.py",
- "tests/test_ui_config_resolution.py",
- "tests/test_unified_agent_ui_local.py",
- "tests/test_usage_accumulator.py",
- "tests/test_validate_hosted_long_task_e2e.py",
- "tests/test_validate_session_failopen_e2e.py",
- "tests/test_web_toolset.py",
- "tests/test_workflow_common.py",
- "tests/test_workflow_help_snapshots.py",
- "tests/unit/conversations/test_ambient_recall_failure_guard.py",
- "tests/unit/knowledge_base/test_client_env.py",
- "tests/unit/knowledge_base/test_kb_recall_failure.py",
- "tests/unit/memory/test_adk_memory_comprehensive.py",
- "tests/unit/memory/test_long_term_memory_structured.py",
- "tests/unit/memory/test_recall_failure_semantics.py"
- ],
- "includePolicy": {
- "rootFiles": [
- ".dockerignore",
- ".gitattributes",
- ".github/BRANCH_PROTECTION.md",
- ".github/ISSUE_TEMPLATE/bug_report.md",
- ".github/ISSUE_TEMPLATE/feature_request.md",
- ".github/dependabot.yml",
- ".github/pull_request_template.md",
- ".github/workflows/ci.yml",
- ".github/workflows/codeql.yml",
- ".github/workflows/pages.yml",
- ".github/workflows/publish-pypi.yml",
- ".github/workflows/release-check.yml",
- ".github/workflows/secret-patterns.yml",
- ".gitignore",
- ".gitleaks.toml",
- "AGENTS.md",
- "CHANGELOG.md",
- "CLAUDE.md",
- "CONTRIBUTING.md",
- "LICENSE",
- "MANIFEST.in",
- "Makefile",
- "README.en.md",
- "README.md",
- "README.zh-CN.md",
- "SECURITY.md",
- "pyproject.toml",
- "uv.lock"
- ],
- "prefixes": [
- "docs-site/",
- "ksadk/",
- "ksadk_runtime_common/"
- ],
- "curatedDocs": [
- "docs/maintainer-approval-record.md",
- "docs/public-release-workflow.md"
- ],
- "curatedReferenceDocs": [
- "docs/reference/ksadk环境变量参考.md"
- ],
- "scripts": [
- "scripts/audit_release_artifacts.py",
- "scripts/build_alias_distribution.py",
- "scripts/check_approval_record.py",
- "scripts/check_publication_state.py",
- "scripts/check_release_version.py",
- "scripts/generate_public_assets.py",
- "scripts/open_source_audit.py",
- "scripts/prepare_ksadk_python_export.py",
- "scripts/prepare_ksadk_web_export.py",
- "scripts/public_secret_audit.py",
- "scripts/verify_ksadk_web_static.py"
- ],
- "tests": [
- "tests/cli/test_cmd_create_codex.py",
- "tests/conftest.py",
- "tests/events/fixtures/runtime_projection_golden.json",
- "tests/runners/test_adapter_contract.py",
- "tests/runners/test_codex_runner.py",
- "tests/studio/e2e/studio_browser_smoke.py",
- "tests/studio/e2e/studio_e2e_support.py",
- "tests/studio/e2e/studio_responsive_smoke.py",
- "tests/studio/test_style_system.py",
- "tests/test_check_approval_record.py",
- "tests/test_check_publication_state.py",
- "tests/test_config_env_registry.py",
- "tests/test_managed_runtime_builder.py",
- "tests/test_managed_runtime_native_smoke.py",
- "tests/test_managed_runtime_resolution.py",
- "tests/test_markdown_repair.py",
- "tests/test_open_source_audit.py",
- "tests/test_public_release_positioning.py",
- "tests/test_runtime_common_packaging.py",
- "tests/test_tracing_setup_otlp.py"
- ]
- },
- "notes": [
- "Local-only clean export candidate.",
- "Clean export uses an allowlist policy for the first public GitHub snapshot.",
- "Run public-repo audit before importing to GitHub.",
- "Do not include PyPI/TestPyPI credentials, .pypirc files, or CI secrets."
- ]
+ "exportPathCount": 1290,
+ "exportPolicy": {
+ "mode": "allowlist",
+ "schemaVersion": 1,
+ "sha256": "80f31e60b49b2073d455b73b4136b9440a72e95879c45df48a00575271a972d2"
+ }
}
diff --git a/ksadk/agui/_agent_helpers.py b/ksadk/agui/_agent_helpers.py
index 6ec8180d..286755f0 100644
--- a/ksadk/agui/_agent_helpers.py
+++ b/ksadk/agui/_agent_helpers.py
@@ -127,6 +127,10 @@ def a2ui_operations(
if isinstance(event.update.data, Mapping):
return project_a2ui_operations("a2ui.surface.update", dict(event.update.data))
return []
+ # A dynamic tool operation batch closes its canonical item for reducer
+ # conformance; that completion is not a request to delete the UI surface.
+ if event.source.metadata.get("operation_batch") is True:
+ return []
# ItemCompleted (end): produce deleteSurface to preserve AG-UI wire
if surface_id:
return [{"version": "v0.9", "deleteSurface": {"surfaceId": surface_id}}]
diff --git a/ksadk/api/client.py b/ksadk/api/client.py
index a2688646..8f08788a 100644
--- a/ksadk/api/client.py
+++ b/ksadk/api/client.py
@@ -2013,6 +2013,7 @@ async def list_session_events(
agent_id: str,
session_id: str,
after_seq_id: int | None = None,
+ offset: int | None = None,
limit: int = 100,
) -> Dict[str, Any]:
"""Read canonical cloud session events through the Server Action API."""
@@ -2024,6 +2025,8 @@ async def list_session_events(
}
if after_seq_id is not None:
params["AfterSeqId"] = after_seq_id
+ if offset is not None:
+ params["Offset"] = offset
return await self._action_async("ListSessionEvents", params)
async def submit_interaction(
diff --git a/ksadk/builders/managed_runtime_builder.py b/ksadk/builders/managed_runtime_builder.py
index 087df2ad..c38d6a25 100644
--- a/ksadk/builders/managed_runtime_builder.py
+++ b/ksadk/builders/managed_runtime_builder.py
@@ -22,6 +22,9 @@
"models",
"prompt",
"task_prompt",
+ "soul",
+ "soul_source",
+ "soul_digest",
"skills",
"mcp_servers",
"sandbox",
diff --git a/ksadk/cli/__init__.py b/ksadk/cli/__init__.py
index 80535994..e5f57eb9 100644
--- a/ksadk/cli/__init__.py
+++ b/ksadk/cli/__init__.py
@@ -77,6 +77,7 @@ def _gradient_line(text: str, colors: list) -> str:
"mcp",
"observe",
"openclaw",
+ "plugin",
"run",
"studio",
"version",
@@ -102,6 +103,7 @@ def _gradient_line(text: str, colors: list) -> str:
"mcp": "MCP 资源管理",
"observe": "导出本地 Agent 观测数据",
"openclaw": "OpenClaw 资源管理",
+ "plugin": "插件验证、安装与启停管理",
"run": "运行 Agent",
"studio": "启动本地 Agent 构建控制台",
"version": "Agent 版本管理",
@@ -210,6 +212,7 @@ def format_help(self, ctx, formatter):
# 配置与工具
formatter.write(click.style(" 🧰 配置:\n\n", fg="yellow", bold=True))
_write_colored_help_row(formatter, "agentengine config", "项目配置向导与模型配置")
+ _write_colored_help_row(formatter, "agentengine plugin", "插件验证、安装与启停管理")
_write_colored_help_row(formatter, "agentengine completion", "Shell 补全管理")
# 自定义 Options 格式化
@@ -372,6 +375,9 @@ def _register_commands():
# MCP 命令组
_register_optional_command(cli, "ksadk.cli.cmd_mcp", "mcp")
+ # Plugin 命令组
+ _register_optional_command(cli, "ksadk.cli.cmd_plugin", "plugin")
+
# Completion 命令组
_register_optional_command(cli, "ksadk.cli.cmd_completion", "completion")
diff --git a/ksadk/cli/cmd_plugin.py b/ksadk/cli/cmd_plugin.py
new file mode 100644
index 00000000..6c7a658e
--- /dev/null
+++ b/ksadk/cli/cmd_plugin.py
@@ -0,0 +1,657 @@
+"""``agentengine plugin`` - DSH-native and Codex-compatible plugin management.
+
+The stable CLI deliberately exposes only two ecosystems. Top-level lifecycle
+commands manage the active DeepSeek Harness Profile; ``plugin dsh`` remains a
+compatibility alias for scripts that adopted the earlier explicit namespace.
+Codex plugins stay under ``plugin codex`` because their lifecycle is owned by
+Codex App Server.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from pathlib import Path
+from typing import Any
+
+import click
+
+from ksadk.cli.error_utils import (
+ EXIT_CODE_RESOLUTION,
+ EXIT_CODE_VALIDATION,
+ CLIError,
+ abort_with_cli_error,
+)
+from ksadk.cli.resource_common import CONTEXT_SETTINGS
+from ksadk.cli.ui import emit_json, is_json_output, print_info, print_kv, print_success
+
+CODEX_HOME_ENV = "KSADK_CODEX_HOME"
+DSH_HOME_ENV = "KSADK_DSH_HOME"
+DSH_BIN_ENV = "KSADK_DSH_BIN"
+DSH_PROFILE_ENV = "KSADK_DSH_PROFILE"
+
+
+def _codex_home() -> Path:
+ """Use the same workspace-isolated Codex home as the local Runtime."""
+
+ configured = os.environ.get(CODEX_HOME_ENV, "").strip()
+ if configured:
+ return Path(configured).expanduser()
+ return Path.cwd() / ".agentkit" / "codex-home"
+
+
+def _dsh_home() -> Path:
+ configured = os.environ.get(DSH_HOME_ENV, "").strip()
+ if configured:
+ return Path(configured).expanduser()
+ return Path.cwd() / ".agentkit" / "dsh-home"
+
+
+def _dsh_command() -> tuple[str, ...] | None:
+ configured = os.environ.get(DSH_BIN_ENV, "").strip()
+ from ksadk.plugins.dsh_toolchain import DshToolchainManager
+
+ return DshToolchainManager().require_command(configured or None)
+
+
+def _dsh_profile() -> str:
+ return os.environ.get(DSH_PROFILE_ENV, "").strip() or "ksadk"
+
+
+def _codex_inventory_payload(value: Any) -> dict[str, Any]:
+ """Project Codex host inventory without leaking marketplace filesystem paths."""
+
+ raw = value.model_dump(mode="json", by_alias=True, exclude_none=True)
+ return {
+ "ecosystem": "codex",
+ "integrationMode": "bridged",
+ "pluginId": raw["pluginId"],
+ "name": raw["name"],
+ "marketplaceName": raw["marketplaceName"],
+ "version": raw.get("version"),
+ "installed": raw["installed"],
+ "enabled": raw["enabled"],
+ "availability": raw["availability"],
+ "permissionsDeclared": False,
+ "riskDisclosures": raw.get("riskDisclosures", []),
+ }
+
+
+def _dsh_inventory_payload(value: Any) -> dict[str, Any]:
+ return value.model_dump(mode="json", by_alias=True, exclude_none=True)
+
+
+async def _with_codex_bridge(operation):
+ from ksadk.plugins.bridges.codex import CodexAppServerPluginBridge
+
+ async with CodexAppServerPluginBridge(codex_home=_codex_home()) as bridge:
+ return bridge.host, await operation(bridge)
+
+
+def _call_codex(operation):
+ """Run one bounded App Server lifecycle request from the synchronous CLI."""
+
+ try:
+ return asyncio.run(_with_codex_bridge(operation))
+ except (KeyboardInterrupt, SystemExit):
+ raise
+ except Exception as err:
+ code = (
+ "codex_plugin_not_found"
+ if type(err).__name__ == "CodexPluginNotFoundError"
+ else (
+ "codex_plugin_permission_confirmation_required"
+ if type(err).__name__ == "CodexPluginApprovalRequired"
+ else "codex_plugin_host_unavailable"
+ )
+ )
+ abort_with_cli_error(
+ CLIError(
+ code=code,
+ message=(
+ "Codex 插件不存在或来源不唯一"
+ if code == "codex_plugin_not_found"
+ else "安装前必须确认 Codex App Server 宿主权限风险"
+ if code == "codex_plugin_permission_confirmation_required"
+ else "Codex 插件宿主当前不可用"
+ ),
+ exit_code=(
+ EXIT_CODE_RESOLUTION
+ if code == "codex_plugin_not_found"
+ else EXIT_CODE_VALIDATION
+ ),
+ ),
+ context="Plugin",
+ )
+
+
+def _call_dsh(operation):
+ """Run one bounded DSH Profile lifecycle request from the synchronous CLI."""
+
+ from ksadk.plugins.bridges.dsh import DshProfilePluginBridge
+
+ try:
+ with DshProfilePluginBridge(
+ dsh_home=_dsh_home(),
+ profile=_dsh_profile(),
+ dsh_command=_dsh_command(),
+ ) as bridge:
+ return bridge.host, operation(bridge)
+ except (KeyboardInterrupt, SystemExit):
+ raise
+ except Exception as err:
+ name = type(err).__name__
+ code = (
+ "dsh_plugin_not_found"
+ if name == "DshPluginNotFoundError"
+ else "dsh_plugin_permission_confirmation_required"
+ if name == "DshPluginApprovalRequired"
+ else "dsh_plugin_operation_failed"
+ if name in {"DshPluginMutationError", "ValueError"}
+ else "dsh_plugin_host_unavailable"
+ )
+ messages = {
+ "dsh_plugin_not_found": "DSH 插件未安装",
+ "dsh_plugin_permission_confirmation_required": (
+ "安装或升级前必须确认 DSH 宿主权限风险"
+ ),
+ "dsh_plugin_operation_failed": "DSH 插件操作失败，原 Profile 已保留",
+ "dsh_plugin_host_unavailable": "DSH 插件宿主当前不可用",
+ }
+ abort_with_cli_error(
+ CLIError(
+ code=code,
+ message=messages[code],
+ exit_code=(
+ EXIT_CODE_RESOLUTION if code == "dsh_plugin_not_found" else EXIT_CODE_VALIDATION
+ ),
+ ),
+ context="Plugin",
+ )
+
+
+def _call_dsh_developer(operation):
+ """Run one bounded standard DSH bundle development operation."""
+
+ from ksadk.plugins.dsh_toolchain import (
+ DshPluginPackError,
+ DshPluginSourceError,
+ DshPluginValidationError,
+ DshToolchainInstallError,
+ DshToolchainUnavailableError,
+ DshToolchainVersionMismatchError,
+ )
+
+ try:
+ return operation()
+ except (KeyboardInterrupt, SystemExit):
+ raise
+ except Exception as err:
+ if isinstance(err, DshToolchainVersionMismatchError):
+ code = "dsh_toolchain_version_mismatch"
+ message = "DSH 或 pnpm 版本与受支持工具链不一致"
+ elif isinstance(err, DshToolchainUnavailableError):
+ code = "dsh_toolchain_unavailable"
+ message = "DSH 插件开发工具链不可用"
+ elif isinstance(err, DshToolchainInstallError):
+ code = "dsh_toolchain_install_failed"
+ message = "DSH 插件开发工具链安装失败"
+ elif isinstance(err, DshPluginSourceError):
+ code = "dsh_plugin_source_invalid"
+ message = "DSH 插件源码不是有效的标准 Bundle"
+ elif isinstance(err, DshPluginValidationError):
+ code = "dsh_plugin_validation_failed"
+ message = "DSH 插件生命周期校验失败"
+ elif isinstance(err, DshPluginPackError):
+ code = "dsh_plugin_pack_failed"
+ message = "DSH 插件 npm 打包失败"
+ else:
+ raise
+ details = {}
+ stage = getattr(err, "stage", None)
+ if isinstance(stage, str) and stage:
+ details["stage"] = stage
+ abort_with_cli_error(
+ CLIError(
+ code=code,
+ message=message,
+ exit_code=EXIT_CODE_VALIDATION,
+ details=details,
+ ),
+ context="Plugin",
+ )
+
+
+@click.group("plugin", context_settings=CONTEXT_SETTINGS)
+def plugin() -> None:
+ """管理 DSH 插件，并兼容 Codex App Server 插件。"""
+
+
+@plugin.group("toolchain", context_settings=CONTEXT_SETTINGS)
+def plugin_toolchain() -> None:
+ """管理固定版本、隔离安装的 DSH 插件开发工具链。"""
+
+
+@plugin_toolchain.command("status", context_settings=CONTEXT_SETTINGS)
+def plugin_toolchain_status() -> None:
+ """检查受管理 DSH CLI、实际版本、pnpm 和锁文件。"""
+
+ from ksadk.plugins.dsh_toolchain import DshToolchainManager
+
+ state = DshToolchainManager().status()
+ payload = state.model_dump(mode="json", by_alias=True, exclude_none=True)
+ if is_json_output():
+ emit_json(payload)
+ return
+ print_kv("DSH", state.actual_version or state.expected_version)
+ print_kv("状态", "可用" if state.usable else "未安装或不完整")
+ print_kv("目录", state.root)
+ if state.problem:
+ print_kv("问题", state.problem)
+
+
+@plugin_toolchain.command("install", context_settings=CONTEXT_SETTINGS)
+def install_plugin_toolchain() -> None:
+ """从 npm 安装受支持的 DSH CLI；不需要 DSH 源码仓。"""
+
+ from ksadk.plugins.dsh_toolchain import DshToolchainManager
+
+ state = _call_dsh_developer(lambda: DshToolchainManager().install())
+ payload = state.model_dump(mode="json", by_alias=True, exclude_none=True)
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件开发工具链已就绪: {state.actual_version}")
+ print_kv("目录", state.root)
+
+
+@plugin.command("create", context_settings=CONTEXT_SETTINGS)
+@click.argument("target", type=click.Path(path_type=Path))
+@click.option("--name", "package_name", default=None, help="标准 npm 包名。")
+def create_dsh_plugin(target: Path, package_name: str | None) -> None:
+ """创建标准 DSH Bundle；不会生成 KsADK 私有 manifest。"""
+
+ from ksadk.plugins.dsh_toolchain import DshPluginDeveloper
+
+ result = _call_dsh_developer(
+ lambda: DshPluginDeveloper().create(target, package_name=package_name)
+ )
+ payload = result.model_dump(mode="json", by_alias=True)
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已创建: {result.package_name}")
+ print_kv("目录", result.target)
+
+
+@plugin.command("validate", context_settings=CONTEXT_SETTINGS)
+@click.argument("source")
+def validate_dsh_plugin(source: str) -> None:
+ """在临时 Profile 验证安装、投射、启停与卸载生命周期。"""
+
+ from ksadk.plugins.dsh_toolchain import DshPluginDeveloper
+
+ configured = os.environ.get(DSH_BIN_ENV, "").strip() or None
+ result = _call_dsh_developer(
+ lambda: DshPluginDeveloper(explicit_dsh=configured).validate(source)
+ )
+ payload = result.model_dump(mode="json", by_alias=True)
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件生命周期已通过: {result.package_name}")
+ print_kv("DSH", result.host_version)
+ print_kv("Profile 摘要", result.profile_digest)
+
+
+@plugin.command("test", context_settings=CONTEXT_SETTINGS)
+@click.argument("source")
+def test_dsh_plugin(source: str) -> None:
+ """运行真实 DSH 生命周期 smoke；不冒充 Provider conformance。"""
+
+ validate_dsh_plugin.callback(source) # type: ignore[attr-defined]
+
+
+@plugin.command("pack", context_settings=CONTEXT_SETTINGS)
+@click.argument("source", type=click.Path(path_type=Path))
+@click.option(
+ "--output-dir",
+ type=click.Path(path_type=Path),
+ default=None,
+ help="npm tarball 输出目录，默认 SOURCE/dist。",
+)
+def pack_dsh_plugin(source: Path, output_dir: Path | None) -> None:
+ """委托固定 pnpm 将标准 DSH Bundle 打包成 npm tgz。"""
+
+ from ksadk.plugins.dsh_toolchain import DshPluginDeveloper
+
+ result = _call_dsh_developer(
+ lambda: DshPluginDeveloper().pack(source, output_dir=output_dir)
+ )
+ payload = result.model_dump(mode="json", by_alias=True)
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已打包: {result.package_name}@{result.package_version}")
+ print_kv("产物", result.artifact)
+
+
+@plugin.group("codex", context_settings=CONTEXT_SETTINGS)
+def codex_plugins() -> None:
+ """通过 Codex App Server 管理 Codex 官方插件。"""
+
+
+@codex_plugins.command("list", context_settings=CONTEXT_SETTINGS)
+@click.option("--installed-only", is_flag=True, help="只显示已安装插件。")
+@click.option("--force-refetch", is_flag=True, help="请求宿主刷新插件目录。")
+def list_codex_plugins(installed_only: bool, force_refetch: bool) -> None:
+ """列出 Codex 宿主可见的官方插件。"""
+
+ async def operation(bridge):
+ return await bridge.list_plugins(force_refetch=force_refetch)
+
+ host, items = _call_codex(operation)
+ visible = [item for item in items if item.installed or not installed_only]
+ payload = {
+ "ecosystem": "codex",
+ "integrationMode": "bridged",
+ "host": {"id": "codex-app-server", "version": host.version, "available": True},
+ "items": [_codex_inventory_payload(item) for item in visible],
+ }
+ if is_json_output():
+ emit_json(payload)
+ return
+ print_info(f"Codex App Server {host.version} · {len(visible)} 个插件")
+ for item in payload["items"]:
+ state = "已安装" if item["installed"] else "可安装"
+ click.echo(f"{item['pluginId']} {item.get('version') or '-'} {state}")
+
+
+@codex_plugins.command("info", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_id")
+@click.option("--marketplace", "marketplace_name", default=None)
+def codex_plugin_info(plugin_id: str, marketplace_name: str | None) -> None:
+ """显示一个 Codex 插件的宿主 inventory 和能力。"""
+
+ async def operation(bridge):
+ return await bridge.read_plugin(plugin_id, marketplace_name=marketplace_name)
+
+ host, detail = _call_codex(operation)
+ payload = {
+ "item": _codex_inventory_payload(detail.inventory),
+ "host": {"id": "codex-app-server", "version": host.version, "available": True},
+ "description": detail.description,
+ "capabilities": {
+ "skills": list(detail.skills),
+ "mcpServers": list(detail.mcp_servers),
+ "hooks": list(detail.hooks),
+ "apps": list(detail.apps),
+ "scheduledTasks": list(detail.scheduled_tasks),
+ },
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"Codex 插件: {plugin_id}")
+ print_kv("宿主", f"Codex App Server {host.version}")
+ print_kv("状态", "已安装" if detail.inventory.installed else "可安装")
+
+
+@codex_plugins.command("install", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_id")
+@click.option("--marketplace", "marketplace_name", default=None)
+@click.option(
+ "--accept-host-permissions",
+ is_flag=True,
+ help="确认插件权限由 Codex 宿主管理并以当前系统用户权限运行。",
+)
+def install_codex_plugin(
+ plugin_id: str,
+ marketplace_name: str | None,
+ accept_host_permissions: bool,
+) -> None:
+ """安装一个 Codex 官方插件；必须显式确认宿主权限风险。"""
+
+ if not accept_host_permissions:
+ abort_with_cli_error(
+ CLIError(
+ code="codex_plugin_permission_confirmation_required",
+ message="安装前必须传入 --accept-host-permissions 确认宿主权限风险",
+ exit_code=EXIT_CODE_VALIDATION,
+ ),
+ context="Plugin",
+ )
+
+ async def operation(bridge):
+ return await bridge.install_plugin(
+ plugin_id,
+ marketplace_name=marketplace_name,
+ accept_undeclared_permissions=True,
+ )
+
+ host, result = _call_codex(operation)
+ payload = {
+ "item": _codex_inventory_payload(result.inventory),
+ "host": {"id": "codex-app-server", "version": host.version, "available": True},
+ "authPolicy": result.auth_policy,
+ "appsNeedingAuth": list(result.apps_needing_auth),
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"Codex 插件已安装: {result.inventory.plugin_id}")
+
+
+@codex_plugins.command("uninstall", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_id")
+def uninstall_codex_plugin(plugin_id: str) -> None:
+ """请求 Codex App Server 卸载插件。"""
+
+ async def operation(bridge):
+ return await bridge.uninstall_plugin(plugin_id)
+
+ host, result = _call_codex(operation)
+ payload = {
+ "ecosystem": "codex",
+ "integrationMode": "bridged",
+ "pluginId": result.plugin_id,
+ "installed": False,
+ "enabled": False,
+ "host": {"id": "codex-app-server", "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"Codex 插件已卸载: {plugin_id}")
+
+
+@plugin.group("dsh", context_settings=CONTEXT_SETTINGS)
+def dsh_plugins() -> None:
+ """通过原生 DeepSeek Harness Profile 管理 DSH 插件。"""
+
+
+@dsh_plugins.command("list", context_settings=CONTEXT_SETTINGS)
+def list_dsh_plugins() -> None:
+ """列出当前隔离 Profile 中的 DSH bundle。"""
+
+ host, items = _call_dsh(lambda bridge: bridge.list_plugins())
+ payload = {
+ "ecosystem": "dsh",
+ "integrationMode": "bridged",
+ "profile": _dsh_profile(),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ "items": [_dsh_inventory_payload(item) for item in items],
+ }
+ if is_json_output():
+ emit_json(payload)
+ return
+ print_info(f"DeepSeek Harness {host.version} · {len(items)} 个 Profile 插件")
+ for item in payload["items"]:
+ state = "已启用" if item["enabled"] else "已停用"
+ click.echo(f"{item['name']} {item.get('version') or '-'} {state}")
+
+
+@dsh_plugins.command("info", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_name")
+def dsh_plugin_info(plugin_name: str) -> None:
+ """显示一个 DSH 插件的原生 Profile inventory。"""
+
+ host, item = _call_dsh(lambda bridge: bridge.get_plugin(plugin_name))
+ payload = {
+ "item": _dsh_inventory_payload(item),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件: {plugin_name}")
+ print_kv("状态", "已启用" if item.enabled else "已停用")
+
+
+@dsh_plugins.command("install", context_settings=CONTEXT_SETTINGS)
+@click.argument("source")
+@click.option(
+ "--accept-host-permissions",
+ is_flag=True,
+ help="确认 DSH 包与安装脚本会以当前宿主用户权限运行。",
+)
+def install_dsh_plugin(source: str, accept_host_permissions: bool) -> None:
+ """把一个 DSH bundle 安装到隔离 Profile；安装后默认停用。"""
+
+ if not accept_host_permissions:
+ abort_with_cli_error(
+ CLIError(
+ code="dsh_plugin_permission_confirmation_required",
+ message="安装前必须传入 --accept-host-permissions 确认宿主权限风险",
+ exit_code=EXIT_CODE_VALIDATION,
+ ),
+ context="Plugin",
+ )
+ host, item = _call_dsh(
+ lambda bridge: bridge.install_plugin(source, accept_host_permissions=True)
+ )
+ payload = {
+ "item": _dsh_inventory_payload(item),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已安装并保持停用: {item.name}；请显式执行 enable")
+
+
+@dsh_plugins.command("enable", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_name")
+def enable_dsh_plugin(plugin_name: str) -> None:
+ """在 DSH Profile 中启用已安装的 bundle。"""
+
+ host, item = _call_dsh(lambda bridge: bridge.set_enabled(plugin_name, enabled=True))
+ payload = {
+ "item": _dsh_inventory_payload(item),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已启用: {plugin_name}")
+
+
+@dsh_plugins.command("disable", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_name")
+def disable_dsh_plugin(plugin_name: str) -> None:
+ """从 DSH Profile 组合中停用 bundle，但保留已安装包。"""
+
+ host, item = _call_dsh(lambda bridge: bridge.set_enabled(plugin_name, enabled=False))
+ payload = {
+ "item": _dsh_inventory_payload(item),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已停用: {plugin_name}")
+
+
+@dsh_plugins.command("update", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_name")
+@click.option(
+ "--accept-host-permissions",
+ is_flag=True,
+ help="确认升级后的包与安装脚本会以当前宿主用户权限运行。",
+)
+def update_dsh_plugin(plugin_name: str, accept_host_permissions: bool) -> None:
+ """由 DSH/pnpm 更新一个插件；失败时恢复旧 Profile。"""
+
+ if not accept_host_permissions:
+ abort_with_cli_error(
+ CLIError(
+ code="dsh_plugin_permission_confirmation_required",
+ message="升级前必须传入 --accept-host-permissions 确认宿主权限风险",
+ exit_code=EXIT_CODE_VALIDATION,
+ ),
+ context="Plugin",
+ )
+ host, item = _call_dsh(
+ lambda bridge: bridge.update_plugin(plugin_name, accept_host_permissions=True)
+ )
+ payload = {
+ "item": _dsh_inventory_payload(item),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已更新: {plugin_name}")
+
+
+@dsh_plugins.command("uninstall", context_settings=CONTEXT_SETTINGS)
+@click.argument("plugin_name")
+def uninstall_dsh_plugin(plugin_name: str) -> None:
+ """从 DSH Profile 卸载一个 bundle。"""
+
+ host, _ = _call_dsh(lambda bridge: bridge.uninstall_plugin(plugin_name))
+ payload = {
+ "ecosystem": "dsh",
+ "integrationMode": "bridged",
+ "profile": _dsh_profile(),
+ "name": plugin_name,
+ "installed": False,
+ "enabled": False,
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH 插件已卸载: {plugin_name}")
+
+
+@dsh_plugins.command("profile", context_settings=CONTEXT_SETTINGS)
+def dsh_profile_info() -> None:
+ """预检并显示当前 DSH Profile 的无 Secret 配置摘要。"""
+
+ host, projection = _call_dsh(lambda bridge: bridge.project_profile())
+ payload = {
+ "profile": projection.model_dump(mode="json", by_alias=True),
+ "host": {"id": host.host_id, "version": host.version, "available": True},
+ }
+ if is_json_output():
+ emit_json(payload)
+ else:
+ print_success(f"DSH Profile 已通过预检: {projection.profile}")
+ print_kv("配置摘要", projection.config_digest)
+
+
+# DSH is the canonical plugin ecosystem. Reuse the exact same Click command
+# objects at the top level so output, validation and typed errors cannot drift
+# between ``plugin list`` and the compatibility alias ``plugin dsh list``.
+for _dsh_command_alias in (
+ list_dsh_plugins,
+ dsh_plugin_info,
+ install_dsh_plugin,
+ enable_dsh_plugin,
+ disable_dsh_plugin,
+ update_dsh_plugin,
+ uninstall_dsh_plugin,
+ dsh_profile_info,
+):
+ plugin.add_command(_dsh_command_alias)
diff --git a/ksadk/codex/runtime.py b/ksadk/codex/runtime.py
index 8f0fb447..ac7c9905 100644
--- a/ksadk/codex/runtime.py
+++ b/ksadk/codex/runtime.py
@@ -107,11 +107,13 @@ def __init__(
*,
sandbox_read_only: bool = True,
turn_timeout_seconds: Optional[float] = None,
+ bound_skill_paths: Mapping[str, str] | None = None,
) -> None:
super().__init__(_CodexAsBaseRuntime(client))
self._client = client
self._sandbox_read_only = sandbox_read_only
self._turn_timeout_seconds = turn_timeout_seconds
+ self._bound_skill_paths = dict(bound_skill_paths or {})
self._threads: dict[str, _CodexThread] = {}
self._requests: dict[str, StartRequest] = {}
self._known_threads: set[str] = set()
@@ -147,6 +149,7 @@ def _unavailable(reason: str) -> RuntimeCapability:
goal=RuntimeCapability(supported=True, mode="native"),
loop=_unavailable("codex_loop_requires_run_control_spec"),
plan=RuntimeCapability(supported=True, mode="native"),
+ interaction_mode="live_submit",
)
# ---- 六动词 ----
@@ -154,6 +157,25 @@ def _unavailable(reason: str) -> RuntimeCapability:
async def start(self, request: StartRequest) -> RunHandle:
# 新 thread 由后端分配真实 thread_id(thread_start);metadata 携带的 thread_id
# 表示接入既有 thread(resume 语义,run_turn 时按 resume 接入)。
+ if self._bound_skill_paths:
+ skills = request.config.get("skills") if request.config else None
+ if isinstance(skills, list):
+ projected_skills = []
+ for item in skills:
+ if not isinstance(item, dict):
+ continue
+ name = str(item.get("name") or "").strip()
+ projected_skills.append(
+ {
+ **item,
+ "path": self._bound_skill_paths.get(
+ name, str(item.get("path") or "")
+ ),
+ }
+ )
+ request = request.model_copy(
+ update={"config": {**request.config, "skills": projected_skills}}
+ )
provided = request.metadata.get("thread_id")
if provided:
thread_id = str(provided)
@@ -353,23 +375,43 @@ async def checkpoint(self, handle: RunHandle) -> CheckpointDescriptor:
)
async def close(self, handle: RunHandle) -> None:
+ self._do_not_persist.add(handle.run_id)
+ await self.close_all()
+
+ async def close_all(self) -> None:
+ """Dispose every thread and the activation-owned App Server process.
+
+ One ``CodexRuntimeAdapter`` owns one client transport. Closing any
+ attached Kernel handle therefore closes the transport as a unit; this
+ additive helper also lets a draining AgentProvider clean up a runtime
+ that has been created but not started yet.
+ """
+
if self._closed:
return
self._closed = True
- thread = self._threads.pop(handle.run_id, None)
- self._requests.pop(handle.run_id, None)
- active = thread is not None and thread.streaming and not thread.done
- if active:
+ threads = tuple(self._threads.values())
+ active_threads = tuple(
+ thread for thread in threads if thread.streaming and not thread.done
+ )
+ for thread in active_threads:
thread.interrupt_event.set()
try:
- if active:
+ for thread in active_threads:
await self._client.interrupt_active_turn(thread.thread_id)
finally:
# AsyncCodex.close owns terminate/wait/kill for the app-server child.
await self._client.close()
- self._do_not_persist.add(handle.run_id)
- self._known_threads.discard(handle.run_id)
- self._pending_cancels.discard(handle.run_id)
+ thread_ids = {
+ *self._known_threads,
+ *self._threads,
+ *self._requests,
+ }
+ self._do_not_persist.update(thread_ids)
+ self._threads.clear()
+ self._requests.clear()
+ self._known_threads.clear()
+ self._pending_cancels.clear()
# ---- stream → RuntimeEvent(phase 翻译 + 中断竞速) ----
diff --git a/ksadk/configs/env_registry.py b/ksadk/configs/env_registry.py
index 3dc5fb1a..eec1f41e 100644
--- a/ksadk/configs/env_registry.py
+++ b/ksadk/configs/env_registry.py
@@ -232,6 +232,28 @@
"Isolate native Codex state under the project workspace; set to 0 for debugging only.",
"1",
),
+ EnvVarSpec(
+ "KSADK_DSH_BIN",
+ "plugins",
+ (
+ "Optional absolute path to the managed DSH command; must match the pinned "
+ "toolchain version."
+ ),
+ ),
+ EnvVarSpec(
+ "KSADK_DSH_HOME",
+ "plugins",
+ (
+ "Directory containing the isolated DSH Profile; defaults to .agentkit/dsh-home "
+ "in the workspace."
+ ),
+ ),
+ EnvVarSpec(
+ "KSADK_DSH_PROFILE",
+ "plugins",
+ "DSH Profile name used by Studio and the plugin bridge.",
+ "studio",
+ ),
EnvVarSpec(
"KSADK_STUDIO_NO_SECURITY",
"studio",
@@ -356,7 +378,10 @@
EnvVarSpec(
"KSADK_LANGGRAPH_AUTO_CHECKPOINT",
"sessions",
- "Allow a hosted LangGraph runner to rebuild a factory-exported graph with the managed PostgreSQL saver.",
+ (
+ "Allow a hosted LangGraph runner to rebuild a factory-exported graph with the "
+ "managed PostgreSQL saver."
+ ),
"false",
),
EnvVarSpec(
@@ -640,7 +665,10 @@
EnvVarSpec(
"KSADK_AGENT_KERNEL",
"kernel",
- "Opt in to Agent Kernel ingress locally; managed deployment may use AGENT_KERNEL_ENABLED instead.",
+ (
+ "Opt in to Agent Kernel ingress locally; managed deployment may use "
+ "AGENT_KERNEL_ENABLED instead."
+ ),
"false",
),
EnvVarSpec("KSADK_SESSION_PATH", "sessions", "Conversation local SQLite database path."),
@@ -810,7 +838,7 @@
"KSADK_WEB_VERSION",
"web",
"Published KsADK Web npm version used for a reproducible wheel build.",
- "0.3.2",
+ "0.3.4",
),
EnvVarSpec(
"KSADK_WORKING_SET_MAX_FILES",
diff --git a/ksadk/configs/settings.py b/ksadk/configs/settings.py
index 358d982c..fb5d62f5 100644
--- a/ksadk/configs/settings.py
+++ b/ksadk/configs/settings.py
@@ -628,3 +628,12 @@ def setup_environment(agent_path: Path | str):
setup_proxy_redirect_if_enabled()
except Exception: # noqa: BLE001 代理可选,失败不影响主流程(默认关时本就不触发)
pass
+
+ # 5. 沙箱控制面 URL 内网探测:在 Pod 内探测 198 公共服务网内网地址,
+ # 可达则覆盖 E2B_API_URL 为内网域名,private_only 节点也能访问沙箱控制面。
+ try:
+ from ksadk.sandbox import setup_sandbox_api_url_if_needed
+
+ setup_sandbox_api_url_if_needed()
+ except Exception: # noqa: BLE001 沙箱可选,失败不影响主流程
+ pass
diff --git a/ksadk/context_engine/contributors.py b/ksadk/context_engine/contributors.py
index 671e84c0..4a5ffa0b 100644
--- a/ksadk/context_engine/contributors.py
+++ b/ksadk/context_engine/contributors.py
@@ -24,6 +24,14 @@
ContributorFailureMode = Literal["skip", "warn", "fail"]
ContributorCacheability = Literal["stable", "turn", "none"]
+_TRUST_RANK: dict[ContextTrustLevel, int] = {
+ "untrusted": 0,
+ "user": 1,
+ "resource": 2,
+ "developer": 3,
+ "platform": 4,
+}
+
@dataclass(frozen=True)
class ContributorCapabilities:
@@ -131,13 +139,15 @@ async def contribute(self, request: ContextContributionRequest) -> list[ContextI
return []
items: list[ContextItem] = []
for index, section in enumerate(sections):
+ raw_tokens = section.metadata.get("tokens", 0)
+ tokens = int(raw_tokens) if isinstance(raw_tokens, (int, str)) else 0
items.append(
_make_item(
contributor_id=self.capabilities.contributor_id,
trust_level=self.capabilities.trust_level,
kind="resource_manifest",
content=section.content,
- tokens=int(section.metadata.get("tokens", 0)) or 1,
+ tokens=tokens or 1,
source=section.source,
metadata={"path": section.metadata.get("path"), "kind": "rule_file"},
)
@@ -267,6 +277,60 @@ class ContributionResult:
warnings: tuple[str, ...]
+def _admit_contribution_items(
+ contributor: ContextContributor,
+ items: object,
+) -> tuple[list[ContextItem], str | None]:
+ """Validate one Contributor result and enforce its declared token ceiling.
+
+ A Contributor is an untrusted capability boundary. It cannot promote an
+ item above the trust level granted at registration, mark context as
+ required, return duplicate identities, or make the Host confuse token
+ counts with list indexes. Items that do not fit the declared budget are
+ deterministically omitted while later, smaller items may still fit.
+ """
+
+ if not isinstance(items, list) or not all(isinstance(item, ContextItem) for item in items):
+ raise TypeError("ContextContributor must return a list of ContextItem values")
+
+ capabilities = contributor.capabilities
+ if capabilities.max_tokens < 0:
+ raise ValueError("ContextContributor max_tokens cannot be negative")
+ if capabilities.timeout_ms <= 0:
+ raise ValueError("ContextContributor timeout_ms must be positive")
+
+ admitted: list[ContextItem] = []
+ seen_ids: set[str] = set()
+ used_tokens = 0
+ omitted = 0
+ maximum_trust = _TRUST_RANK[capabilities.trust_level]
+ for item in items:
+ if not item.item_id or item.item_id in seen_ids:
+ raise ValueError("ContextContributor item ids must be non-empty and unique")
+ seen_ids.add(item.item_id)
+ if item.required:
+ raise ValueError("ContextContributor cannot mark context as required")
+ if _TRUST_RANK[item.trust_level] > maximum_trust:
+ raise ValueError(
+ "ContextContributor cannot elevate item trust above its registered level"
+ )
+ if item.estimated_tokens < 0:
+ raise ValueError("ContextContributor estimated_tokens cannot be negative")
+ if used_tokens + item.estimated_tokens > capabilities.max_tokens:
+ omitted += 1
+ continue
+ admitted.append(item)
+ used_tokens += item.estimated_tokens
+
+ warning = None
+ if omitted:
+ warning = (
+ f"{contributor.id()}: omitted {omitted} context item(s) that exceeded "
+ f"the {capabilities.max_tokens}-token contributor budget"
+ )
+ return admitted, warning
+
+
async def run_contributors(
contributors: Sequence[ContextContributor],
request: ContextContributionRequest,
@@ -284,24 +348,25 @@ async def run_contributors(
async def _run_one(c: ContextContributor) -> tuple[str, list[ContextItem], str, str | None]:
timeout = max(c.capabilities.timeout_ms, 1) / 1000.0
try:
- items = await asyncio.wait_for(c.contribute(request), timeout=timeout)
+ raw_items = await asyncio.wait_for(c.contribute(request), timeout=timeout)
+ items, budget_warning = _admit_contribution_items(c, raw_items)
except asyncio.TimeoutError:
return c.id(), [], "timeout", f"{c.id()}: timeout"
except Exception as exc: # noqa: BLE001
if c.capabilities.failure_mode == "fail":
raise
- return c.id(), [], "error", f"{c.id()}: {exc}"
- # 单 Contributor 总 token 约束
- if items and sum(i.estimated_tokens for i in items) > c.capabilities.max_tokens:
- items = items[: c.capabilities.max_tokens] # best-effort 限条数
- return c.id(), items, "ok", None
+ warning = f"{c.id()}: {exc}" if c.capabilities.failure_mode == "warn" else None
+ return c.id(), [], "error", warning
+ return c.id(), items, "ok", budget_warning
results = await asyncio.gather(*[_run_one(c) for c in contributors], return_exceptions=True)
all_items: list[ContextItem] = []
status: dict[str, str] = {}
warnings: list[str] = []
for contributor, r in zip(contributors, results):
- if isinstance(r, Exception):
+ if isinstance(r, BaseException):
+ if isinstance(r, asyncio.CancelledError):
+ raise r
if contributor.capabilities.failure_mode == "fail":
raise r
warnings.append(f"{contributor.id()}: {r}")
diff --git a/ksadk/conversations/__init__.py b/ksadk/conversations/__init__.py
index 9b34e68b..0fef0ec5 100644
--- a/ksadk/conversations/__init__.py
+++ b/ksadk/conversations/__init__.py
@@ -11,6 +11,25 @@ def _exports(module: str, *names: str) -> dict[str, tuple[str, str]]:
_EXPORTS = {
+ **_exports(
+ "ksadk.conversations.contracts",
+ "ConversationCapability",
+ "ConversationInput",
+ "ConversationAttachmentPart",
+ "ConversationItem",
+ "ConversationSurface",
+ "ConversationTextPart",
+ "validate_conversation_input",
+ "validate_surface_input",
+ ),
+ **_exports(
+ "ksadk.conversations.projector",
+ "project_conversation_item",
+ ),
+ **_exports(
+ "ksadk.conversations.reducer",
+ "ConversationItemReducer",
+ ),
**_exports(
"ksadk.conversations.attachments",
"decode_inline_data",
diff --git a/ksadk/conversations/context.py b/ksadk/conversations/context.py
index 58c70d12..2043d805 100644
--- a/ksadk/conversations/context.py
+++ b/ksadk/conversations/context.py
@@ -5,6 +5,8 @@
from collections.abc import Mapping, Sequence
from typing import Any, Dict, Iterable, List
+from ksadk.events.canonical import ItemCompleted, parse_runtime_event
+from ksadk.events.content import TextContent
from ksadk.sessions.base import SessionEvent
from ksadk.tools.result_budget import (
ToolResultBudget,
@@ -99,6 +101,60 @@ def extract_event_text(event: SessionEvent) -> str:
)
+def _canonical_completed_message(
+ event: SessionEvent,
+) -> tuple[str, str, tuple[str, str]] | None:
+ """Return one canonical assistant message without flattening its identity.
+
+ Canonical RuntimeEvents are persisted inside the existing ``SessionEvent``
+ carrier. Legacy transcript projection only inspects carrier-level fields,
+ so an ``item.completed`` message otherwise disappears from the next turn's
+ history. The canonical event id and ``(scope_id, item_id)`` are both kept:
+ replays are idempotent, while equal text from different items remains
+ distinct.
+ """
+
+ raw = (event.content or {}).get("runtime_event")
+ if not isinstance(raw, Mapping):
+ return None
+ try:
+ canonical = parse_runtime_event(dict(raw))
+ except (TypeError, ValueError):
+ return None
+ if (
+ not isinstance(canonical, ItemCompleted)
+ or canonical.item_kind != "message"
+ or event.event_type != canonical.event_type
+ ):
+ return None
+ text = sanitize_event_text_for_context(
+ "".join(
+ part.text for part in canonical.snapshot.parts if isinstance(part, TextContent)
+ )
+ )
+ if not text:
+ return None
+ return canonical.event_id, text, (canonical.scope_id, canonical.item_id)
+
+
+def _transcript_event_projection(
+ event: SessionEvent,
+) -> tuple[str, str, tuple[str, tuple[str, str]] | None]:
+ canonical_message = _canonical_completed_message(event)
+ if canonical_message is not None:
+ event_id, text, item_identity = canonical_message
+ return "assistant_message", text, (event_id, item_identity)
+ return (
+ canonical_event_type(
+ event.event_type,
+ author=event.author,
+ role=str((event.content or {}).get("role") or ""),
+ ),
+ extract_event_text(event),
+ None,
+ )
+
+
def canonical_event_type(
event_type: str | None,
*,
@@ -276,6 +332,8 @@ def summarize_event_groups(
因此跨消息提取修正，并在预算上限内保留最新长指令首尾（方案 §9.4）。
"""
lines: List[str] = []
+ seen_canonical_event_ids: set[str] = set()
+ seen_canonical_items: set[tuple[str, str]] = set()
if previous_summary:
lines.append(previous_summary)
lines.append("Earlier conversation summary:")
@@ -284,14 +342,18 @@ def summarize_event_groups(
for group in groups:
snippets: List[str] = []
for event in group:
- event_type = canonical_event_type(
- event.event_type,
- author=event.author,
- role=str((event.content or {}).get("role") or ""),
- )
+ event_type, text, canonical_identity = _transcript_event_projection(event)
+ if canonical_identity is not None:
+ event_id, item_identity = canonical_identity
+ if (
+ event_id in seen_canonical_event_ids
+ or item_identity in seen_canonical_items
+ ):
+ continue
+ seen_canonical_event_ids.add(event_id)
+ seen_canonical_items.add(item_identity)
if event_type not in TRANSCRIPT_EVENT_TYPES or event_type == "context_checkpoint":
continue
- text = extract_event_text(event)
if not text:
continue
if event_type in {"assistant_message", "tool_call"}:
@@ -343,6 +405,9 @@ def project_model_messages(
"""
projected: List[Dict[str, str]] = []
placeholder_flags: list[bool] = []
+ identity_boundary_flags: list[bool] = []
+ seen_canonical_event_ids: set[str] = set()
+ seen_canonical_items: set[tuple[str, str]] = set()
compacted_until = compacted_until_seq_id(events)
checkpoint = next(
(
@@ -362,21 +427,26 @@ def project_model_messages(
}
)
placeholder_flags.append(False)
+ identity_boundary_flags.append(False)
for event in events:
- event_type = canonical_event_type(
- event.event_type,
- author=event.author,
- role=str((event.content or {}).get("role") or ""),
- )
+ event_type, text, canonical_identity = _transcript_event_projection(event)
if event.seq_id <= compacted_until and event_type != "context_checkpoint":
continue
if event_type not in TRANSCRIPT_EVENT_TYPES:
continue
if event_type in {"context_checkpoint", "compaction_boundary"}:
continue
+ if canonical_identity is not None:
+ event_id, item_identity = canonical_identity
+ if (
+ event_id in seen_canonical_event_ids
+ or item_identity in seen_canonical_items
+ ):
+ continue
+ seen_canonical_event_ids.add(event_id)
+ seen_canonical_items.add(item_identity)
- text = extract_event_text(event)
if not text:
continue
@@ -405,12 +475,15 @@ def project_model_messages(
projected
and projected[-1]["role"] == role
and not placeholder_flags[-1]
+ and not identity_boundary_flags[-1]
and not is_placeholder
+ and canonical_identity is None
):
projected[-1]["content"] = f"{projected[-1]['content']}\n{text}".strip()
else:
projected.append({"role": role, "content": text})
placeholder_flags.append(is_placeholder)
+ identity_boundary_flags.append(canonical_identity is not None)
return projected
@@ -553,6 +626,8 @@ def project_responses_history(events: List[SessionEvent]) -> List[dict[str, Any]
"""
projected: List[dict[str, Any]] = []
projected_call_ids: set[str] = set()
+ seen_canonical_event_ids: set[str] = set()
+ seen_canonical_items: set[tuple[str, str]] = set()
compacted_until = compacted_until_seq_id(events)
checkpoint = next(
(
@@ -568,17 +643,22 @@ def project_responses_history(events: List[SessionEvent]) -> List[dict[str, Any]
projected.append(summary_message)
for event in events:
- event_type = canonical_event_type(
- event.event_type,
- author=event.author,
- role=str((event.content or {}).get("role") or ""),
- )
+ event_type, text, canonical_identity = _transcript_event_projection(event)
if event.seq_id <= compacted_until and event_type != "context_checkpoint":
continue
if event_type not in TRANSCRIPT_EVENT_TYPES:
continue
if event_type in {"context_checkpoint", "compaction_boundary"}:
continue
+ if canonical_identity is not None:
+ event_id, item_identity = canonical_identity
+ if (
+ event_id in seen_canonical_event_ids
+ or item_identity in seen_canonical_items
+ ):
+ continue
+ seen_canonical_event_ids.add(event_id)
+ seen_canonical_items.add(item_identity)
if event_type == "tool_call":
item = _response_tool_call_item(event)
@@ -586,25 +666,25 @@ def project_responses_history(events: List[SessionEvent]) -> List[dict[str, Any]
projected.append(item)
projected_call_ids.add(str(item["call_id"]))
continue
- message = _responses_message("assistant", f"[tool_call] {extract_event_text(event)}")
+ message = _responses_message("assistant", f"[tool_call] {text}")
elif event_type == "tool_result":
item = _response_tool_output_item(event)
if item and str(item["call_id"]) in projected_call_ids:
projected.append(item)
continue
- message = _responses_message("user", f"[tool_result] {extract_event_text(event)}")
+ message = _responses_message("user", f"[tool_result] {text}")
elif event_type == "assistant_message":
- message = _responses_message("assistant", extract_event_text(event))
+ message = _responses_message("assistant", text)
elif event_type == "approval_request":
message = _responses_message(
- "assistant", f"[approval_request] {extract_event_text(event)}"
+ "assistant", f"[approval_request] {text}"
)
elif event_type == "approval_response":
- message = _responses_message("user", f"[approval_response] {extract_event_text(event)}")
+ message = _responses_message("user", f"[approval_response] {text}")
elif event_type == "attachment_ref":
- message = _responses_message("user", f"[attachment] {extract_event_text(event)}")
+ message = _responses_message("user", f"[attachment] {text}")
else:
- message = _responses_message("user", extract_event_text(event))
+ message = _responses_message("user", text)
if message:
projected.append(message)
diff --git a/ksadk/conversations/contracts.py b/ksadk/conversations/contracts.py
new file mode 100644
index 00000000..4134a80f
--- /dev/null
+++ b/ksadk/conversations/contracts.py
@@ -0,0 +1,266 @@
+"""Additive, provider-neutral conversation presentation contracts (v1)."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class ConversationContractModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+_CAPABILITY = re.compile(r"^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$")
+
+# Provider-neutral wire extensions. These keys are deliberately namespaced:
+# the stable ConversationInput/v1 envelope must not grow a top-level field for
+# every control exposed by Codex, DSH, or a future AgentProvider.
+APPROVAL_MODE_EXTENSION = "ksadk.approval"
+COLLABORATION_MODE_EXTENSION = "ksadk.collaboration"
+GOAL_OBJECTIVE_EXTENSION = "ksadk.goal"
+
+
+class ConversationCapability(ConversationContractModel):
+ name: str = Field(min_length=1, max_length=128)
+ mode: Literal["native", "translated", "degraded", "unavailable"]
+ reason: str | None = Field(default=None, max_length=512)
+
+ @field_validator("name")
+ @classmethod
+ def validate_name(cls, value: str) -> str:
+ if not _CAPABILITY.fullmatch(value):
+ raise ValueError("capability name must be a namespaced identifier")
+ return value
+
+ @model_validator(mode="after")
+ def validate_reason(self) -> "ConversationCapability":
+ if self.mode in {"degraded", "unavailable"} and not self.reason:
+ raise ValueError("degraded or unavailable capability requires a reason")
+ return self
+
+
+class ConversationSurface(ConversationContractModel):
+ api_version: Literal["conversation.ksadk.io/v1"] = "conversation.ksadk.io/v1"
+ kind: Literal["ConversationSurface"] = "ConversationSurface"
+ surface_id: str = Field(min_length=1, max_length=256)
+ session_id: str = Field(min_length=1, max_length=256)
+ provider_ref: str = Field(min_length=1, max_length=256)
+ inputs: tuple[ConversationCapability, ...] = ()
+ outputs: tuple[ConversationCapability, ...] = ()
+
+ @model_validator(mode="after")
+ def validate_unique_capabilities(self) -> "ConversationSurface":
+ for capabilities, direction in ((self.inputs, "input"), (self.outputs, "output")):
+ names = [capability.name for capability in capabilities]
+ if len(names) != len(set(names)):
+ raise ValueError(
+ f"conversation surface must not repeat an {direction} capability"
+ )
+ return self
+
+ def permits_input(self, field: str) -> bool:
+ return any(
+ capability.name == field and capability.mode in {"native", "translated"}
+ for capability in self.inputs
+ )
+
+
+class ConversationTextPart(ConversationContractModel):
+ kind: Literal["text"] = "text"
+ text: str = Field(min_length=1, max_length=131072)
+
+
+class ConversationAttachmentPart(ConversationContractModel):
+ kind: Literal["attachment"] = "attachment"
+ attachment_ref: str = Field(min_length=1, max_length=2048)
+ media_type: str = Field(min_length=1, max_length=256)
+ name: str | None = Field(default=None, max_length=1024)
+
+
+ConversationInputPart = ConversationTextPart | ConversationAttachmentPart
+
+
+class ConversationInput(ConversationContractModel):
+ """A provider-neutral foreground turn submitted by a conversation client.
+
+ It deliberately carries only user intent. A Server/Runtime adapter maps
+ that intent to a provider-specific request after checking the active
+ ConversationSurface; browser clients never forward arbitrary provider
+ parameters.
+ """
+
+ api_version: Literal["conversation.ksadk.io/v1"] = "conversation.ksadk.io/v1"
+ kind: Literal["ConversationInput"] = "ConversationInput"
+ input_id: str = Field(min_length=1, max_length=256)
+ session_id: str = Field(min_length=1, max_length=256)
+ idempotency_key: str = Field(min_length=1, max_length=512)
+ parts: tuple[ConversationInputPart, ...] = Field(min_length=1)
+ model_ref: str | None = Field(default=None, min_length=1, max_length=256)
+ reasoning: str | None = Field(default=None, min_length=1, max_length=64)
+ extensions: dict[str, Any] = Field(default_factory=dict)
+
+ @field_validator("extensions")
+ @classmethod
+ def validate_extensions(cls, value: dict[str, Any]) -> dict[str, Any]:
+ if any(not _CAPABILITY.fullmatch(key) or "." not in key for key in value):
+ raise ValueError("extensions must use namespaced capability keys")
+ approval = value.get(APPROVAL_MODE_EXTENSION)
+ if approval is not None and approval not in {"ask", "risk", "full"}:
+ raise ValueError("ksadk.approval must be ask, risk, or full")
+ collaboration = value.get(COLLABORATION_MODE_EXTENSION)
+ if collaboration is not None and collaboration not in {"default", "plan"}:
+ raise ValueError("ksadk.collaboration must be default or plan")
+ goal = value.get(GOAL_OBJECTIVE_EXTENSION)
+ if goal is not None and (
+ not isinstance(goal, str) or not goal.strip() or len(goal) > 4096
+ ):
+ raise ValueError("ksadk.goal must be a non-empty string up to 4096 characters")
+ return value
+
+ @property
+ def approval_mode(self) -> Literal["ask", "risk", "full"] | None:
+ value = self.extensions.get(APPROVAL_MODE_EXTENSION)
+ return value if value in {"ask", "risk", "full"} else None
+
+ @property
+ def collaboration_mode(self) -> Literal["default", "plan"] | None:
+ value = self.extensions.get(COLLABORATION_MODE_EXTENSION)
+ return value if value in {"default", "plan"} else None
+
+ @property
+ def goal_objective(self) -> str | None:
+ value = self.extensions.get(GOAL_OBJECTIVE_EXTENSION)
+ return value if isinstance(value, str) and value else None
+
+ def required_capabilities(self) -> tuple[str, ...]:
+ required: list[str] = []
+ if any(isinstance(part, ConversationTextPart) for part in self.parts):
+ required.append("text")
+ for part in self.parts:
+ if not isinstance(part, ConversationAttachmentPart):
+ continue
+ required.append(
+ "attachment.image"
+ if part.media_type.lower().startswith("image/")
+ else "attachment.file"
+ )
+ if self.model_ref:
+ required.append("model.select")
+ if self.reasoning:
+ required.append("reasoning.effort")
+ if self.approval_mode:
+ required.append("approval")
+ if self.collaboration_mode == "plan":
+ required.append("plan")
+ if self.goal_objective:
+ required.append("goal")
+ extension_capabilities = {
+ APPROVAL_MODE_EXTENSION: "approval",
+ COLLABORATION_MODE_EXTENSION: "plan"
+ if self.collaboration_mode == "plan"
+ else None,
+ GOAL_OBJECTIVE_EXTENSION: "goal",
+ }
+ required.extend(
+ extension_capabilities.get(key, key)
+ for key in self.extensions
+ if extension_capabilities.get(key, key) is not None
+ )
+ return tuple(dict.fromkeys(required))
+
+
+class ConversationItem(ConversationContractModel):
+ api_version: Literal["conversation.ksadk.io/v1"] = "conversation.ksadk.io/v1"
+ kind_version: Literal[1] = 1
+ item_id: str = Field(min_length=1, max_length=512)
+ parent_item_id: str | None = Field(default=None, min_length=1, max_length=512)
+ source_event_ids: tuple[str, ...] = Field(min_length=1)
+ session_id: str = Field(min_length=1, max_length=256)
+ run_id: str = Field(min_length=1, max_length=256)
+ kind: Literal[
+ "user_message",
+ "assistant_text",
+ "reasoning",
+ "tool_call",
+ "approval",
+ "progress",
+ "plan",
+ "goal",
+ "artifact",
+ "a2ui",
+ "error",
+ "unknown",
+ ]
+ operation: Literal["append", "replace", "completed"]
+ lifecycle: Literal["pending", "streaming", "completed", "failed"]
+ visibility: Literal["public", "internal", "hidden"] = "public"
+ payload_schema_ref: str = Field(min_length=1, max_length=256)
+ payload: dict[str, Any] = Field(default_factory=dict)
+ capability_ref: str | None = Field(default=None, max_length=256)
+ native_ref: dict[str, Any] = Field(default_factory=dict)
+
+ @field_validator("source_event_ids")
+ @classmethod
+ def validate_source_event_ids(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if any(not item for item in value) or len(value) != len(set(value)):
+ raise ValueError("sourceEventIds must be non-empty and unique")
+ return value
+
+ @model_validator(mode="after")
+ def validate_lifecycle(self) -> "ConversationItem":
+ if self.operation == "completed" and self.lifecycle not in {"completed", "failed"}:
+ raise ValueError("completed operation requires a terminal lifecycle")
+ return self
+
+
+def validate_surface_input(surface: ConversationSurface, payload: dict[str, Any]) -> None:
+ """Reject UI input fields not declared by the active ConversationSurface."""
+
+ extensions = payload.get("extensions", {})
+ if extensions is not None and not isinstance(extensions, dict):
+ raise ValueError("extensions must be an object")
+ for field in payload:
+ if field == "extensions":
+ continue
+ if not surface.permits_input(field):
+ raise ValueError(f"conversation input is not declared by surface: {field}")
+
+
+def validate_conversation_input(
+ surface: ConversationSurface,
+ conversation_input: ConversationInput,
+) -> None:
+ """Apply the same capability allowlist before and after the network hop."""
+
+ if surface.session_id != conversation_input.session_id:
+ raise ValueError("conversation input session does not match active surface")
+ for capability in conversation_input.required_capabilities():
+ if not surface.permits_input(capability):
+ raise ValueError(f"conversation input is not declared by surface: {capability}")
+
+
+__all__ = [
+ "APPROVAL_MODE_EXTENSION",
+ "COLLABORATION_MODE_EXTENSION",
+ "ConversationCapability",
+ "ConversationInput",
+ "ConversationAttachmentPart",
+ "ConversationItem",
+ "ConversationSurface",
+ "ConversationTextPart",
+ "GOAL_OBJECTIVE_EXTENSION",
+ "validate_conversation_input",
+ "validate_surface_input",
+]
diff --git a/ksadk/conversations/message_projection.py b/ksadk/conversations/message_projection.py
index 476bed81..3fda5a4a 100644
--- a/ksadk/conversations/message_projection.py
+++ b/ksadk/conversations/message_projection.py
@@ -5,6 +5,8 @@
from urllib.parse import quote
from ksadk.agui.a2ui_projection import project_a2ui_operations
+
+
def _event_metadata(event: Mapping[str, Any]) -> Mapping[str, Any]:
metadata = event.get("Metadata")
return metadata if isinstance(metadata, Mapping) else {}
@@ -620,6 +622,7 @@ def _normalize_canonical_event(
normalized_metadata.update({"call_id": call_id, "tool_name": name, "tool_args": args})
elif item_kind == "data" and source.get("protocol") == "a2ui":
surface_id = str(source.get("metadata", {}).get("surface_id") or "")
+ source_metadata = source.get("metadata")
initial = runtime_event.get("initial") or {}
parts = initial.get("parts") if isinstance(initial, Mapping) else []
data: Any = {}
@@ -627,7 +630,16 @@ def _normalize_canonical_event(
if isinstance(part, Mapping) and part.get("content_type") == "data":
data = part.get("data")
break
- if isinstance(data, list):
+ if (
+ isinstance(data, list)
+ and isinstance(source_metadata, Mapping)
+ and source_metadata.get("operation_batch") is True
+ ):
+ normalized["Content"] = {
+ "surface_id": surface_id,
+ "a2ui_operations": data,
+ }
+ elif isinstance(data, list):
normalized["Content"] = {"surface_id": surface_id, "components": data}
elif isinstance(data, Mapping):
normalized["Content"] = data
@@ -663,6 +675,12 @@ def _normalize_canonical_event(
normalized["Content"] = {"call_id": call_id, "name": "", "result": result}
normalized_metadata.update({"call_id": call_id, "tool_output": result})
elif item_kind == "data" and source.get("protocol") == "a2ui":
+ source_metadata = source.get("metadata")
+ if (
+ isinstance(source_metadata, Mapping)
+ and source_metadata.get("operation_batch") is True
+ ):
+ return event
surface_id = str(source.get("metadata", {}).get("surface_id") or "")
normalized["EventType"] = "a2ui.surface.end"
normalized["Content"] = {"surface_id": surface_id}
diff --git a/ksadk/conversations/projector.py b/ksadk/conversations/projector.py
new file mode 100644
index 00000000..1c23e84e
--- /dev/null
+++ b/ksadk/conversations/projector.py
@@ -0,0 +1,616 @@
+"""One identity-aware RuntimeEvent -> ConversationItem projection."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from ksadk.conversations.contracts import ConversationItem
+from ksadk.events.canonical import (
+ ContextCompactionCompleted,
+ ContextCompactionStarted,
+ ContinuationCreated,
+ ContinuationResumed,
+ InteractionRequested,
+ InteractionResolved,
+ ItemCompleted,
+ ItemFailed,
+ ItemSnapshotReplaced,
+ ItemStarted,
+ ItemUpdated,
+ RunCanceled,
+ RunCompleted,
+ RunFailed,
+ RunInterrupted,
+ RunProgress,
+ RunStarted,
+ RuntimeEvent,
+ UsageReported,
+)
+from ksadk.events.content import (
+ ArtifactContent,
+ ContentSnapshot,
+ DataContent,
+ TextContent,
+ ToolCallContent,
+ ToolResultContent,
+)
+from ksadk.kernel.contracts import SessionEventEnvelope
+
+_INTERACTION_EVENT_TYPES = frozenset(
+ {
+ "interaction.requested",
+ "interaction.resolved",
+ "interaction.cancelled",
+ "interaction.expired",
+ }
+)
+_INTERACTION_KINDS = frozenset({"approval", "structured_input", "plan_review", "custom"})
+
+
+def project_conversation_item(
+ event: RuntimeEvent,
+ *,
+ session_id: str | None = None,
+ run_id: str | None = None,
+) -> ConversationItem:
+ """Create a stable item projection without changing RuntimeEvent truth."""
+
+ item_id = _item_id(event)
+ kind = "unknown"
+ operation = "append"
+ lifecycle = "streaming"
+ # Known conversation kinds render in the UI. Only truly unhandled
+ # events (kind stays "unknown" after the branch chain) are hidden so
+ # they stay observable via the raw event log without spamming cards.
+ visibility = "public"
+ schema = "conversation.item.unknown/v1"
+ payload: dict[str, Any] = {}
+ capability_ref: str | None = None
+ if isinstance(event, ItemStarted) and event.item_kind in {"message", "reasoning"}:
+ kind = "reasoning" if event.item_kind == "reasoning" else "assistant_text"
+ lifecycle = "pending"
+ schema = f"conversation.item.{kind}/v1"
+ payload = {"text": _text_from_snapshot(event.initial)}
+ elif isinstance(event, ItemUpdated) and event.item_kind in {"message", "reasoning"}:
+ kind = "reasoning" if event.item_kind == "reasoning" else "assistant_text"
+ operation = event.op
+ schema = f"conversation.item.{kind}/v1"
+ payload = {"text": _text_from_update(event)}
+ elif isinstance(event, ItemSnapshotReplaced) and event.item_kind in {"message", "reasoning"}:
+ kind = "reasoning" if event.item_kind == "reasoning" else "assistant_text"
+ operation = "replace"
+ schema = f"conversation.item.{kind}/v1"
+ payload = {"text": _text_from_snapshot(event.snapshot)}
+ elif isinstance(event, ItemCompleted) and event.item_kind in {"message", "reasoning"}:
+ kind = "reasoning" if event.item_kind == "reasoning" else "assistant_text"
+ operation = "completed"
+ lifecycle = "completed"
+ schema = f"conversation.item.{kind}/v1"
+ payload = {"text": _text_from_snapshot(event.snapshot)}
+ elif isinstance(event, ItemStarted) and event.item_kind == "tool_call":
+ kind = "tool_call"
+ schema = "conversation.item.tool-call/v1"
+ payload = _tool_payload(event.initial)
+ capability_ref = "tool.inspect"
+ elif isinstance(event, ItemCompleted) and event.item_kind == "tool_call":
+ kind = "tool_call"
+ operation = "completed"
+ lifecycle = "completed"
+ schema = "conversation.item.tool-call/v1"
+ payload = _tool_payload(event.snapshot)
+ capability_ref = "tool.inspect"
+ elif (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "tool_result"
+ ):
+ # Codex emits a separate tool_result item carrying the ToolResultContent.
+ # Project it as a completed tool_call so the UI renders the output instead
+ # of degrading it to an unknown fallback card.
+ kind = "tool_call"
+ schema = "conversation.item.tool-call/v1"
+ capability_ref = "tool.inspect"
+ if isinstance(event, ItemStarted):
+ payload = _tool_payload(event.initial)
+ else:
+ payload = _tool_payload(_item_snapshot(event))
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ elif _is_codex_plan_item(event):
+ kind = "plan"
+ schema = "conversation.item.plan/v1"
+ payload = {"text": _text_from_item_event(event)}
+ capability_ref = "plan"
+ if isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif _is_codex_goal_item(event):
+ kind = "goal"
+ schema = "conversation.item.goal/v1"
+ payload = _goal_payload(_item_snapshot(event))
+ capability_ref = "goal"
+ if isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif _is_codex_user_message(event):
+ # ``userMessage`` is a transcript item. Its item completion must not
+ # be mistaken for completion of the containing Codex turn.
+ kind = "user_message"
+ schema = "conversation.item.user_message/v1"
+ payload = {"text": _codex_user_message_text(_item_snapshot(event))}
+ if isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "artifact"
+ ):
+ kind = "artifact"
+ schema = "conversation.item.artifact/v1"
+ payload = _artifact_payload(_item_snapshot(event))
+ if isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "data"
+ and event.source.protocol == "a2ui"
+ ):
+ kind = "a2ui"
+ schema = "conversation.item.a2ui/v1"
+ payload = _data_payload(_item_snapshot(event))
+ if isinstance(event, ItemSnapshotReplaced):
+ operation = "replace"
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "status"
+ ):
+ # LangGraph subgraph lifecycle and similar status items. Project as
+ # progress so the UI shows a subtle indicator instead of an unknown card.
+ kind = "progress"
+ schema = "conversation.item.progress/v1"
+ payload = _data_payload(_item_snapshot(event))
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif isinstance(event, ItemFailed):
+ kind = "error"
+ operation = "completed"
+ lifecycle = "failed"
+ schema = "conversation.item.error/v1"
+ payload = {"error": event.error.message or event.error.code}
+ elif isinstance(event, InteractionRequested):
+ kind = "approval" if event.interaction_kind == "approval" else "progress"
+ lifecycle = "pending"
+ schema = (
+ "conversation.item.approval/v1"
+ if kind == "approval"
+ else "conversation.item.structured-input/v1"
+ )
+ payload = {
+ "interactionId": event.interaction_id,
+ "kind": getattr(event.request, "kind", event.interaction_kind),
+ "detail": getattr(event.request, "detail", None),
+ "prompt": getattr(event.request, "prompt", None),
+ "inputSchema": getattr(event.request, "schema_", None),
+ "surfaceId": event.source.metadata.get("surface_id"),
+ }
+ capability_ref = "approval" if kind == "approval" else "structured_input"
+ elif isinstance(event, InteractionResolved):
+ kind = "approval" if event.interaction_kind == "approval" else "progress"
+ operation = "completed"
+ lifecycle = "completed"
+ schema = (
+ "conversation.item.approval/v1"
+ if kind == "approval"
+ else "conversation.item.structured-input/v1"
+ )
+ payload = {
+ "interactionId": event.interaction_id,
+ "surfaceId": event.source.metadata.get("surface_id"),
+ }
+ capability_ref = "approval" if kind == "approval" else "structured_input"
+ elif isinstance(event, (RunStarted, RunProgress, RunCompleted, RunInterrupted)):
+ kind = "progress"
+ schema = "conversation.item.progress/v1"
+ if isinstance(event, RunProgress):
+ payload = {
+ "status": "running",
+ "progress": event.progress,
+ "message": event.message,
+ }
+ elif isinstance(event, RunInterrupted):
+ payload = {"status": "interrupted", "reason": event.reason or ""}
+ operation = "completed"
+ lifecycle = "completed"
+ elif isinstance(event, RunCompleted):
+ payload = {"status": "completed"}
+ operation = "completed"
+ lifecycle = "completed"
+ else:
+ payload = {"status": "running"}
+ elif isinstance(event, (RunFailed, RunCanceled)):
+ kind = "error"
+ operation = "completed"
+ lifecycle = "failed"
+ schema = "conversation.item.error/v1"
+ payload = {
+ "status": "failed" if isinstance(event, RunFailed) else "canceled",
+ "error": event.error.message if isinstance(event, RunFailed) else event.reason or ""
+ }
+ elif isinstance(event, (ContinuationCreated, ContinuationResumed)):
+ kind = "progress"
+ schema = "conversation.item.checkpoint/v1"
+ payload = {"continuationId": event.continuation_id}
+ elif isinstance(event, UsageReported):
+ # Token usage is carried in the top-level SSE envelope; no need to
+ # render a conversation card for it. Project as hidden progress.
+ kind = "progress"
+ schema = "conversation.item.progress/v1"
+ visibility = "hidden"
+ payload = {
+ "message": "usage",
+ "inputTokens": event.input_tokens,
+ "outputTokens": event.output_tokens,
+ "totalTokens": event.total_tokens,
+ "cachedTokens": event.cached_tokens,
+ "reasoningTokens": event.reasoning_tokens,
+ }
+ operation = "completed"
+ lifecycle = "completed"
+ elif isinstance(event, (ContextCompactionStarted, ContextCompactionCompleted)):
+ kind = "progress"
+ schema = "conversation.item.progress/v1"
+ payload = {"message": "context_compaction"}
+ if isinstance(event, ContextCompactionCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ elif (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "data"
+ ):
+ # Catch-all for Codex data items that are not plan/goal/a2ui
+ # (fileChange, userMessage, hookPrompt, contextCompaction, etc.).
+ # Project as progress so the UI shows a subtle indicator instead of
+ # rendering an ugly "unsupported content" card for every turn.
+ kind = "progress"
+ schema = "conversation.item.progress/v1"
+ native_kind = event.source.metadata.get("native_item_kind", "")
+ payload = {"message": native_kind or "data", **_data_payload(_item_snapshot(event))}
+ if isinstance(event, ItemCompleted):
+ operation = "completed"
+ lifecycle = "completed"
+ # Unhandled event types fall through with kind == "unknown". They are
+ # hidden unless a trusted projector explicitly marks the event as a public
+ # conversation surface. Public future kinds receive the fixed safe
+ # fallback card; internal provider chatter remains trace/replay-only.
+ if kind == "unknown":
+ visibility = (
+ "public"
+ if event.source.metadata.get("conversation_visibility") == "public"
+ else "hidden"
+ )
+ if visibility == "public":
+ payload = {
+ "eventType": event.event_type,
+ "summary": "This content requires a newer renderer.",
+ }
+ return ConversationItem(
+ item_id=item_id,
+ source_event_ids=(event.event_id,),
+ session_id=session_id or event.scope_id,
+ # A host may own a public/durable Run identity that differs from the
+ # provider-native handle. Conversation clients need the public id for
+ # replay and control; the untouched RuntimeEvent remains the native
+ # source of truth and is carried separately by the host projection.
+ run_id=run_id or event.run_id,
+ kind=kind,
+ operation=operation,
+ lifecycle=lifecycle,
+ visibility=visibility,
+ payload_schema_ref=schema,
+ payload=payload,
+ capability_ref=capability_ref,
+ native_ref=_native_ref(event),
+ )
+
+
+def project_interaction_conversation_item(
+ envelope: SessionEventEnvelope,
+) -> ConversationItem | None:
+ """Project one authoritative Interaction/v1 fact for a conversation surface.
+
+ Interaction revision is the CAS token for ``SubmitInteraction``. It is
+ therefore read only from the durable Interaction/v1 payload and never
+ synthesized from cursor order, lifecycle, or a provider-native event.
+ Malformed legacy rows remain observable through their existing Studio
+ projection, but cannot become a writable ConversationItem.
+ """
+
+ if envelope.family != "interaction" or envelope.family_version != 1:
+ return None
+ payload = envelope.payload
+ event_type = envelope.event_type
+ if event_type not in _INTERACTION_EVENT_TYPES:
+ return None
+ if payload.get("event_type") != event_type:
+ return None
+
+ interaction_id = _nonempty_string(payload.get("interaction_id"))
+ session_id = _nonempty_string(payload.get("session_id"))
+ run_id = _nonempty_string(payload.get("run_id"))
+ interaction_kind = _nonempty_string(payload.get("kind"))
+ revision = _positive_revision(payload.get("revision"))
+ if (
+ interaction_id is None
+ or session_id != envelope.session_id
+ or run_id is None
+ or interaction_kind not in _INTERACTION_KINDS
+ or revision is None
+ ):
+ return None
+ if envelope.run_id is not None and run_id != envelope.run_id:
+ return None
+
+ is_requested = event_type == "interaction.requested"
+ request = payload.get("request")
+ if is_requested and not isinstance(request, Mapping):
+ return None
+ request_payload = request if isinstance(request, Mapping) else {}
+ presentation = request_payload.get("presentation")
+ presentation_payload = presentation if isinstance(presentation, Mapping) else {}
+
+ item_payload: dict[str, Any] = {
+ "interactionId": interaction_id,
+ "interactionKind": interaction_kind,
+ "kind": interaction_kind,
+ "revision": revision,
+ }
+ if is_requested:
+ item_payload.update(
+ {
+ "kind": _nonempty_string(presentation_payload.get("title")) or interaction_kind,
+ "inputSchema": (
+ dict(request_payload.get("request_schema"))
+ if isinstance(request_payload.get("request_schema"), Mapping)
+ else {}
+ ),
+ "createdAt": str(payload.get("timestamp") or envelope.timestamp),
+ }
+ )
+ title = _nonempty_string(presentation_payload.get("title"))
+ detail = _nonempty_string(presentation_payload.get("description"))
+ expires_at = _nonempty_string(request_payload.get("expires_at"))
+ if title is not None:
+ item_payload["title"] = title
+ if detail is not None:
+ item_payload["detail"] = detail
+ item_payload["prompt"] = detail
+ if expires_at is not None:
+ item_payload["expiresAt"] = expires_at
+ if presentation_payload:
+ item_payload["presentation"] = dict(presentation_payload)
+ else:
+ item_payload["resolvedAt"] = str(payload.get("timestamp") or envelope.timestamp)
+ outcome = _nonempty_string(payload.get("outcome"))
+ actor_ref = _nonempty_string(payload.get("actor_ref"))
+ reason = _nonempty_string(payload.get("reason"))
+ if outcome is not None:
+ item_payload["outcome"] = outcome
+ if "response" in payload:
+ item_payload["response"] = payload["response"]
+ if actor_ref is not None:
+ item_payload["actor"] = actor_ref
+ if reason is not None:
+ item_payload["reason"] = reason
+
+ is_approval = interaction_kind == "approval"
+ return ConversationItem(
+ item_id=interaction_id,
+ source_event_ids=(str(envelope.event_id),),
+ session_id=session_id,
+ run_id=run_id,
+ kind="approval" if is_approval else "progress",
+ operation="append" if is_requested else "completed",
+ lifecycle="pending" if is_requested else "completed",
+ payload_schema_ref=(
+ "conversation.item.approval/v1"
+ if is_approval
+ else "conversation.item.structured-input/v1"
+ ),
+ payload=item_payload,
+ capability_ref="approval" if is_approval else "structured_input",
+ native_ref={
+ "protocol": "agent-kernel/interaction-v1",
+ "eventId": str(envelope.event_id),
+ "cursor": envelope.seq,
+ },
+ )
+
+
+def _positive_revision(value: Any) -> int | None:
+ if isinstance(value, bool) or not isinstance(value, int) or value < 1:
+ return None
+ return value
+
+
+def _nonempty_string(value: Any) -> str | None:
+ if not isinstance(value, str) or not value.strip():
+ return None
+ return value
+
+
+def _item_id(event: RuntimeEvent) -> str:
+ if isinstance(
+ event,
+ (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted, ItemFailed),
+ ):
+ return event.item_id
+ if isinstance(event, (InteractionRequested, InteractionResolved)):
+ return event.interaction_id
+ if isinstance(event, (ContinuationCreated, ContinuationResumed)):
+ return event.continuation_id
+ return event.event_id
+
+
+def _text_from_update(event: ItemUpdated) -> str:
+ return event.update.text if isinstance(event.update, TextContent) else ""
+
+
+def _text_from_item_event(
+ event: ItemStarted | ItemUpdated | ItemSnapshotReplaced | ItemCompleted,
+) -> str:
+ if isinstance(event, ItemUpdated):
+ return _text_from_update(event)
+ return _text_from_snapshot(_item_snapshot(event))
+
+
+def _text_from_snapshot(snapshot: ContentSnapshot | None) -> str:
+ if snapshot is None:
+ return ""
+ for part in snapshot.parts:
+ if isinstance(part, TextContent):
+ return part.text
+ return ""
+
+
+def _tool_payload(snapshot: ContentSnapshot | None) -> dict[str, Any]:
+ if snapshot is None:
+ return {}
+ call = next((item for item in snapshot.parts if isinstance(item, ToolCallContent)), None)
+ result = next((item for item in snapshot.parts if isinstance(item, ToolResultContent)), None)
+ payload: dict[str, Any] = {}
+ if call is not None:
+ payload.update({"callId": call.call_id, "tool": call.name, "args": call.arguments})
+ if result is not None:
+ # A Codex tool_result can arrive as a separate native item from the
+ # corresponding tool_call. Keep the provider call identity in both
+ # projections so a renderer can enrich the original card in place
+ # rather than appending a duplicate result card.
+ payload.update(
+ {
+ "callId": result.call_id,
+ "output": result.result,
+ "isError": result.is_error,
+ }
+ )
+ return payload
+
+
+def _item_snapshot(
+ event: ItemStarted | ItemUpdated | ItemSnapshotReplaced | ItemCompleted,
+) -> ContentSnapshot | None:
+ if isinstance(event, ItemStarted):
+ return event.initial
+ if isinstance(event, ItemUpdated):
+ return ContentSnapshot(parts=(event.update,))
+ return event.snapshot
+
+
+def _artifact_payload(snapshot: ContentSnapshot | None) -> dict[str, Any]:
+ if snapshot is None:
+ return {}
+ artifact = next(
+ (part for part in snapshot.parts if isinstance(part, ArtifactContent)), None
+ )
+ if artifact is None:
+ return {}
+ return {
+ "artifactId": artifact.artifact_id,
+ "name": artifact.name,
+ "mimeType": artifact.mime_type,
+ "uri": artifact.uri,
+ }
+
+
+def _data_payload(snapshot: ContentSnapshot | None) -> dict[str, Any]:
+ if snapshot is None:
+ return {}
+ data = next((part for part in snapshot.parts if isinstance(part, DataContent)), None)
+ return {"data": data.data} if data is not None else {}
+
+
+def _goal_payload(snapshot: ContentSnapshot | None) -> dict[str, Any]:
+ wrapped = _data_payload(snapshot)
+ value = wrapped.get("data")
+ return dict(value) if isinstance(value, Mapping) else wrapped
+
+
+def _codex_user_message_text(snapshot: ContentSnapshot | None) -> str:
+ value = _data_payload(snapshot).get("data")
+ if not isinstance(value, Mapping):
+ return ""
+ content = value.get("content")
+ if isinstance(content, str):
+ return content
+ if not isinstance(content, (list, tuple)):
+ return ""
+ return "".join(
+ str(part["text"])
+ for part in content
+ if isinstance(part, Mapping) and isinstance(part.get("text"), str)
+ )
+
+
+def _is_codex_plan_item(event: RuntimeEvent) -> bool:
+ return (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "data"
+ and event.source.framework == "codex"
+ and (
+ event.source.metadata.get("native_item_kind") == "plan"
+ or event.source.metadata.get("method") == "turn/plan/updated"
+ )
+ )
+
+
+def _is_codex_goal_item(event: RuntimeEvent) -> bool:
+ return (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "data"
+ and event.source.framework == "codex"
+ and event.source.metadata.get("method")
+ in {"thread/goal/updated", "thread/goal/cleared"}
+ )
+
+
+def _is_codex_user_message(event: RuntimeEvent) -> bool:
+ return (
+ isinstance(event, (ItemStarted, ItemUpdated, ItemSnapshotReplaced, ItemCompleted))
+ and event.item_kind == "data"
+ and event.source.framework == "codex"
+ and event.source.metadata.get("native_item_kind") == "userMessage"
+ )
+
+
+def _native_ref(event: RuntimeEvent) -> dict[str, Any]:
+ source = event.source
+ return {
+ key: value
+ for key, value in {
+ "framework": source.framework,
+ "protocol": source.protocol,
+ "eventId": source.native_event_id,
+ "cursor": source.native_cursor,
+ "runId": source.native_run_id,
+ "itemId": source.native_item_id,
+ }.items()
+ if value is not None
+ }
+
+
+__all__ = ["project_conversation_item", "project_interaction_conversation_item"]
diff --git a/ksadk/conversations/reducer.py b/ksadk/conversations/reducer.py
new file mode 100644
index 00000000..6b15dad7
--- /dev/null
+++ b/ksadk/conversations/reducer.py
@@ -0,0 +1,98 @@
+"""Identity-aware reducer for a ConversationItem surface.
+
+This reducer deliberately does not deduplicate by author or text. Providers
+may emit the same content in two different items, and both are user-visible
+truth. Reconnect de-duplication is limited to a previously applied source
+event for the same item.
+"""
+
+from __future__ import annotations
+
+from collections import OrderedDict
+
+from ksadk.conversations.contracts import ConversationItem
+
+
+class ConversationItemReducer:
+ """Apply append/replace/completed operations while preserving item identity."""
+
+ def __init__(self) -> None:
+ self._items: OrderedDict[str, ConversationItem] = OrderedDict()
+ self._source_events: set[tuple[str, str]] = set()
+
+ def apply(self, item: ConversationItem) -> bool:
+ """Apply one item operation and return whether this changed the view."""
+
+ keys = {(item.item_id, source_id) for source_id in item.source_event_ids}
+ if keys and keys.issubset(self._source_events):
+ return False
+
+ existing = self._items.get(item.item_id)
+ if existing is not None and _terminal(existing) and not _terminal(item):
+ # A reconnect may replay an older delta after the terminal snapshot
+ # has already arrived on the live connection. Remember its event
+ # identity, but never regress a completed item back to streaming or
+ # append the stale delta a second time.
+ self._source_events.update(keys)
+ return False
+ if existing is None:
+ merged = item
+ elif item.operation == "append":
+ merged = item.model_copy(
+ update={
+ "payload": _append_payload(existing.payload, item.payload),
+ "source_event_ids": _merge_sources(
+ existing.source_event_ids,
+ item.source_event_ids,
+ ),
+ }
+ )
+ else:
+ merged = item.model_copy(
+ update={
+ "source_event_ids": _merge_sources(
+ existing.source_event_ids,
+ item.source_event_ids,
+ )
+ }
+ )
+ self._items[item.item_id] = merged
+ self._source_events.update(keys)
+ return True
+
+ def items(self) -> tuple[ConversationItem, ...]:
+ """Return presentation items in first-seen order."""
+
+ return tuple(self._items.values())
+
+
+def _append_payload(
+ existing: dict[str, object],
+ update: dict[str, object],
+) -> dict[str, object]:
+ merged = dict(existing)
+ for key, value in update.items():
+ previous = merged.get(key)
+ if key == "text" and isinstance(previous, str) and isinstance(value, str):
+ merged[key] = previous + value
+ elif key in {"data", "operations"} and isinstance(previous, list) and isinstance(
+ value, list
+ ):
+ merged[key] = [*previous, *value]
+ else:
+ merged[key] = value
+ return merged
+
+
+def _merge_sources(
+ current: tuple[str, ...],
+ incoming: tuple[str, ...],
+) -> tuple[str, ...]:
+ return tuple(dict.fromkeys((*current, *incoming)))
+
+
+def _terminal(item: ConversationItem) -> bool:
+ return item.lifecycle in {"completed", "failed"}
+
+
+__all__ = ["ConversationItemReducer"]
diff --git a/ksadk/events/_v1_compat/projection.py b/ksadk/events/_v1_compat/projection.py
index d1c994a6..3a7f19e1 100644
--- a/ksadk/events/_v1_compat/projection.py
+++ b/ksadk/events/_v1_compat/projection.py
@@ -370,6 +370,8 @@ def _project_item_completed(
if text_projection or event.item_kind in {"message", "reasoning"}:
return text_projection
if event.item_kind == "data":
+ if event.source.metadata.get("operation_batch") is True:
+ return ()
ref = _a2ui_surface_ref(event, context)
if ref is None:
return ()
diff --git a/ksadk/events/adapters/codex.py b/ksadk/events/adapters/codex.py
index 2e47e76d..cd2b5e61 100644
--- a/ksadk/events/adapters/codex.py
+++ b/ksadk/events/adapters/codex.py
@@ -48,6 +48,7 @@
ContinuationCreated,
ContinuationResumed,
ErrorInfo,
+ InteractionRequested,
ItemCompleted,
ItemFailed,
ItemStarted,
@@ -56,10 +57,12 @@
RunCanceled,
RunCompleted,
RunFailed,
+ RunInterrupted,
RunProgress,
RunStarted,
RuntimeEvent,
SourceRef,
+ StructuredInputRequest,
UsageReported,
)
from ksadk.events.content import (
@@ -191,6 +194,20 @@ def _map_protocol_message(
return self._map_server_request_resolved(
params=params, context=context, cursor=cursor, timestamp=timestamp
)
+ if method == "a2ui/surface":
+ return self._map_a2ui_surface(
+ params=params,
+ context=context,
+ cursor=cursor,
+ timestamp=timestamp,
+ )
+ if method == "a2ui/interaction":
+ return self._map_a2ui_interaction(
+ params=params,
+ context=context,
+ cursor=cursor,
+ timestamp=timestamp,
+ )
if method in _CONTROL_INTERACTION_METHODS:
return self._map_control_interaction_request(
message=message,
@@ -255,6 +272,179 @@ def _map_protocol_message(
)
_fail("unsupported_method", "method", f"Unsupported Codex app-server method: {method}")
+ @staticmethod
+ def _a2ui_scope(
+ params: Mapping[str, Any],
+ context: CodexAdapterContext,
+ *,
+ surface_id: str,
+ ) -> tuple[str, str, str]:
+ thread_value = params.get("threadId", params.get("thread_id"))
+ turn_value = params.get("turnId", params.get("turn_id"))
+ thread_id = (
+ _required_string(thread_value, "params.threadId")
+ if thread_value is not None
+ else f"runtime:{context.run_id}"
+ )
+ turn_id = (
+ _required_string(turn_value, "params.turnId")
+ if turn_value is not None
+ else "a2ui"
+ )
+ return thread_id, turn_id, stable_scope_id("codex", thread_id, turn_id, surface_id)
+
+ @staticmethod
+ def _a2ui_source(
+ *,
+ method: str,
+ cursor: str,
+ thread_id: str,
+ turn_id: str,
+ native_item_id: str,
+ surface_id: str,
+ metadata: Mapping[str, Any] | None = None,
+ ) -> SourceRef:
+ source = _protocol_source(
+ method=method,
+ cursor=cursor,
+ thread_id=thread_id,
+ turn_id=turn_id,
+ native_item_id=native_item_id,
+ native_event_id=native_item_id,
+ )
+ return source.model_copy(
+ update={
+ "protocol": "a2ui",
+ "metadata": {
+ **source.metadata,
+ "surface_id": surface_id,
+ **dict(metadata or {}),
+ },
+ }
+ )
+
+ def _map_a2ui_surface(
+ self,
+ *,
+ params: Mapping[str, Any],
+ context: CodexAdapterContext,
+ cursor: str,
+ timestamp: float,
+ ) -> tuple[RuntimeEvent, ...]:
+ """Map one complete A2UI surface description as an immutable operation batch."""
+
+ surface_id = _required_string(params.get("surface_id"), "params.surface_id")
+ surface = _mapping(params.get("surface"), "params.surface")
+ thread_id, turn_id, scope_id = self._a2ui_scope(
+ params, context, surface_id=surface_id
+ )
+ item_id = stable_item_id("codex", scope_id, "a2ui-surface", surface_id)
+ source = self._a2ui_source(
+ method="a2ui/surface",
+ cursor=cursor,
+ thread_id=thread_id,
+ turn_id=turn_id,
+ native_item_id=surface_id,
+ surface_id=surface_id,
+ metadata={
+ "operation_batch": True,
+ "surface_lifecycle": "begin",
+ "catalog_id": str(surface.get("catalog_id") or surface.get("catalogId") or ""),
+ },
+ )
+ snapshot = ContentSnapshot(
+ parts=(
+ DataContent(
+ part_id="a2ui-surface",
+ data={"surface_id": surface_id, **_json_value(surface)},
+ ),
+ )
+ )
+ env = _envelope(context, cursor, timestamp)
+ return (
+ ItemStarted(
+ **env(scope_id, item_id, "item.started", "a2ui-surface", source),
+ item_id=item_id,
+ item_kind="data",
+ initial=snapshot,
+ ),
+ ItemCompleted(
+ **env(scope_id, item_id, "item.completed", "a2ui-surface", source),
+ item_id=item_id,
+ item_kind="data",
+ snapshot=snapshot,
+ ),
+ )
+
+ def _map_a2ui_interaction(
+ self,
+ *,
+ params: Mapping[str, Any],
+ context: CodexAdapterContext,
+ cursor: str,
+ timestamp: float,
+ ) -> tuple[RuntimeEvent, ...]:
+ """Map the client-owned A2UI input request without changing its live call id."""
+
+ surface_id = _required_string(params.get("surface_id"), "params.surface_id")
+ interaction_id = _required_string(
+ params.get("interaction_id"), "params.interaction_id"
+ )
+ kind = _required_string(params.get("kind"), "params.kind")
+ schema = _mapping(params.get("input_schema"), "params.input_schema")
+ is_blocking = params.get("is_blocking", True)
+ if not isinstance(is_blocking, bool):
+ _fail(
+ "invalid_interaction_request",
+ "params.is_blocking",
+ "A2UI is_blocking must be a boolean",
+ )
+ thread_id, turn_id, scope_id = self._a2ui_scope(
+ params, context, surface_id=surface_id
+ )
+ source = self._a2ui_source(
+ method="a2ui/interaction",
+ cursor=cursor,
+ thread_id=thread_id,
+ turn_id=turn_id,
+ native_item_id=interaction_id,
+ surface_id=surface_id,
+ metadata={"kind": kind, "is_blocking": is_blocking},
+ )
+ env = _envelope(context, cursor, timestamp)
+ requested = InteractionRequested(
+ **env(
+ scope_id,
+ interaction_id,
+ "interaction.requested",
+ "structured_input",
+ source,
+ ),
+ interaction_id=interaction_id,
+ interaction_kind="structured_input",
+ request=StructuredInputRequest(prompt=None, schema=_json_value(schema)),
+ )
+ if not is_blocking:
+ return (requested,)
+ return (
+ requested,
+ RunInterrupted(
+ **env(
+ scope_id,
+ turn_id,
+ "run.interrupted",
+ interaction_id,
+ source,
+ ),
+ status="interrupted",
+ reason="Codex requires user interaction",
+ interaction_id=interaction_id,
+ continuation_id=self._thread_continuations.setdefault(
+ thread_id, _thread_continuation_identity(thread_id)[1]
+ ),
+ ),
+ )
+
def _map_token_usage(
self,
*,
diff --git a/ksadk/harness/__init__.py b/ksadk/harness/__init__.py
index 1c6ae028..e8dedd59 100644
--- a/ksadk/harness/__init__.py
+++ b/ksadk/harness/__init__.py
@@ -1,35 +1,45 @@
-"""HarnessApp — 统一 Runtime 的可部署交付物 / composition root (goal-08)。"""
-
-from ksadk.harness.app import HarnessApp, HarnessCapabilities, HarnessPlugin
-from ksadk.harness.config import (
- HarnessConfig,
- HarnessConfigError,
- McpToolSpec,
- SandboxPolicy,
-)
-from ksadk.harness.reasoner import (
- HarnessReasoner,
- HarnessReasoningTurn,
- HarnessToolCall,
- LiteLLMHarnessReasoner,
-)
-from ksadk.harness.runtime import HarnessRuntime, HarnessRuntimeAdapter
-from ksadk.harness.sandbox import HarnessSandboxExecutor, SandboxPolicyDenied
-
-__all__ = [
- "HarnessApp",
- "HarnessCapabilities",
- "HarnessConfig",
- "HarnessConfigError",
- "HarnessPlugin",
- "HarnessReasoner",
- "HarnessRuntime",
- "HarnessRuntimeAdapter",
- "HarnessReasoningTurn",
- "HarnessSandboxExecutor",
- "HarnessToolCall",
- "LiteLLMHarnessReasoner",
- "McpToolSpec",
- "SandboxPolicy",
- "SandboxPolicyDenied",
-]
+"""Public Harness surface without eagerly requiring an ADK runtime.
+
+Studio must be usable for Codex and DSH Providers from a base ``ksadk``
+installation. Harness keeps ADK as an optional execution dependency, so
+importing its configuration types cannot import the full Harness runtime.
+"""
+
+from __future__ import annotations
+
+from importlib import import_module
+from typing import Any
+
+_EXPORTS = {
+ "HarnessApp": ("ksadk.harness.app", "HarnessApp"),
+ "HarnessCapabilities": ("ksadk.harness.app", "HarnessCapabilities"),
+ "HarnessPlugin": ("ksadk.harness.app", "HarnessPlugin"),
+ "HarnessConfig": ("ksadk.harness.config", "HarnessConfig"),
+ "HarnessConfigError": ("ksadk.harness.config", "HarnessConfigError"),
+ "McpToolSpec": ("ksadk.harness.config", "McpToolSpec"),
+ "SandboxPolicy": ("ksadk.harness.config", "SandboxPolicy"),
+ "HarnessReasoner": ("ksadk.harness.reasoner", "HarnessReasoner"),
+ "HarnessReasoningTurn": ("ksadk.harness.reasoner", "HarnessReasoningTurn"),
+ "HarnessToolCall": ("ksadk.harness.reasoner", "HarnessToolCall"),
+ "LiteLLMHarnessReasoner": ("ksadk.harness.reasoner", "LiteLLMHarnessReasoner"),
+ "HarnessRuntime": ("ksadk.harness.runtime", "HarnessRuntime"),
+ "HarnessRuntimeAdapter": ("ksadk.harness.runtime", "HarnessRuntimeAdapter"),
+ "HarnessSandboxExecutor": ("ksadk.harness.sandbox", "HarnessSandboxExecutor"),
+ "SandboxPolicyDenied": ("ksadk.harness.sandbox", "SandboxPolicyDenied"),
+}
+
+__all__ = list(_EXPORTS)
+
+
+def __getattr__(name: str) -> Any:
+ try:
+ module_name, attribute = _EXPORTS[name]
+ except KeyError:
+ raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
+ value = getattr(import_module(module_name), attribute)
+ globals()[name] = value
+ return value
+
+
+def __dir__() -> list[str]:
+ return sorted({*globals(), *__all__})
diff --git a/ksadk/harness/runtime.py b/ksadk/harness/runtime.py
index 1234ead3..40c8d036 100644
--- a/ksadk/harness/runtime.py
+++ b/ksadk/harness/runtime.py
@@ -72,6 +72,19 @@ class _HarnessRun:
done: bool = False
+@dataclass
+class _HarnessSession:
+ """Process-local transcript and serialization boundary for one Session.
+
+ The public capability matrix deliberately advertises process-scoped,
+ non-durable continuity. Keeping this state on the adapter makes that
+ declaration true without pretending that a restart can recover it.
+ """
+
+ messages: list[dict[str, Any]]
+ lock: asyncio.Lock
+
+
class HarnessRuntimeAdapter(RuntimeAdapter):
"""Execute a YAML Harness config directly as RuntimeEvent streams."""
@@ -95,6 +108,7 @@ def __init__(
self._tools: tuple[HarnessTool, ...] | None = None
self._tool_lock = asyncio.Lock()
self._mcp_toolsets: list[Any] = []
+ self._sessions: dict[tuple[str, str, str], _HarnessSession] = {}
@property
def harness_config(self) -> HarnessConfig:
@@ -167,16 +181,43 @@ async def close(self, handle: RunHandle) -> None:
if not self._runs:
await self._close_tools()
+ async def close_all(self) -> None:
+ """Dispose every process-local run owned by this adapter instance."""
+
+ for run_id, run in list(self._runs.items()):
+ await self.close(
+ RunHandle(
+ run_id=run_id,
+ session_id=run.request.session_id,
+ runtime_type="harness",
+ native_ref={
+ "user_id": run.request.user_id,
+ "agent_id": run.request.agent_id,
+ },
+ )
+ )
+
def is_handle_attached(self, handle: RunHandle) -> bool:
return handle.run_id in self._runs
async def execute_request(self, request: StartRequest) -> dict[str, Any]:
+ session = self._session_for(request)
+ async with session.lock:
+ return await self._execute_session_request(request, session)
+
+ async def _execute_session_request(
+ self,
+ request: StartRequest,
+ session: _HarnessSession,
+ ) -> dict[str, Any]:
tools = await self._ensure_tools()
model, prompt = self._effective(request)
messages: list[dict[str, Any]] = [
{"role": "system", "content": prompt},
- {"role": "user", "content": str(request.input or "")},
+ *[dict(message) for message in session.messages],
]
+ user_message = {"role": "user", "content": str(request.input or "")}
+ messages.append(user_message)
execution_log: list[dict[str, Any]] = []
for _turn_number in range(_MAX_REASONING_TURNS):
@@ -235,6 +276,12 @@ async def execute_request(self, request: StartRequest) -> dict[str, Any]:
raise RuntimeError(
"Harness reasoner returned neither a final response nor a tool call"
)
+ final_message = {"role": "assistant", "content": turn.final_text}
+ messages.append(final_message)
+ # Failed or cancelled turns never commit a partial transcript.
+ # A successful turn atomically replaces the process-local history
+ # while the per-session lock is still held.
+ session.messages[:] = [dict(message) for message in messages[1:]]
return {
"output": turn.final_text,
"model": model,
@@ -244,6 +291,18 @@ async def execute_request(self, request: StartRequest) -> dict[str, Any]:
}
raise RuntimeError(f"Harness reasoning exceeded {_MAX_REASONING_TURNS} turns")
+ def _session_for(self, request: StartRequest) -> _HarnessSession:
+ key = (
+ str(request.agent_id or self._agent_name),
+ str(request.user_id),
+ str(request.session_id),
+ )
+ session = self._sessions.get(key)
+ if session is None:
+ session = _HarnessSession(messages=[], lock=asyncio.Lock())
+ self._sessions[key] = session
+ return session
+
def _effective(self, request: StartRequest) -> tuple[str, str]:
metadata = request.metadata or {}
model = str(
diff --git a/ksadk/kernel/contract_fingerprints.py b/ksadk/kernel/contract_fingerprints.py
index 6e2db12e..f7e9172b 100644
--- a/ksadk/kernel/contract_fingerprints.py
+++ b/ksadk/kernel/contract_fingerprints.py
@@ -15,7 +15,7 @@
AGENT_KERNEL_V1_CONTRACT_SET = "agent-kernel/v1"
AGENT_KERNEL_V1_AGGREGATE_DIGEST = (
- "47e1003e03d97abeba232cc3e03a14b9cbcf78b1109870ccd2ce371f073b6211"
+ "b610a25aae957306b9f84a2cc2c948b30d1ce6218585cfd2a91f96736b92d102"
)
@@ -23,12 +23,13 @@ def runtime_capability_matrix_wire_value(matrix: Any) -> dict[str, Any]:
"""Serialize the additive matrix without materializing absent v2 modes.
Pydantic includes optional ``None`` defaults in ``model_dump``. Omitting
- those three top-level keys preserves the exact pre-extension wire value and
- capability digest for runtimes that do not publish goal/loop/plan.
+ those additive top-level keys preserves the exact pre-extension wire value
+ and capability digest for runtimes that do not publish execution controls
+ or an interaction delivery mode.
"""
dump = matrix.model_dump(mode="json")
- for key in ("goal", "loop", "plan"):
+ for key in ("interaction_mode", "goal", "loop", "plan"):
if dump.get(key) is None:
dump.pop(key, None)
return dump
diff --git a/ksadk/kernel/contracts.py b/ksadk/kernel/contracts.py
index 9e4701de..eaed2997 100644
--- a/ksadk/kernel/contracts.py
+++ b/ksadk/kernel/contracts.py
@@ -309,6 +309,14 @@ class RuntimeCapabilityMatrix(WireModel):
inject: RuntimeCapability
checkpoint: RuntimeCapability
durable_restore: RuntimeCapability
+ # Interaction delivery is deliberately separate from the verb matrix:
+ # ``submit_interaction`` alone does not tell a caller whether the reply
+ # reaches a live process, resumes a checkpoint, or has no native route.
+ # It remains optional so a v1 consumer can read records emitted before
+ # this additive declaration without inventing support.
+ interaction_mode: Literal[
+ "live_submit", "durable_resume", "unavailable"
+ ] | None = None
# Runtime v2 execution controls are additive optional capabilities. Older
# runtimes omit them; a runtime must never infer support from UI presence.
# ``loop`` specifically means an externally bounded, eval-driven
diff --git a/ksadk/kernel/control.py b/ksadk/kernel/control.py
index 2be80212..35cc3e03 100644
--- a/ksadk/kernel/control.py
+++ b/ksadk/kernel/control.py
@@ -57,6 +57,7 @@ def default_capability_matrix() -> RuntimeCapabilityMatrix:
inject=_unavailable("runtime_no_native_inject"),
checkpoint=_unavailable(),
durable_restore=_unavailable(),
+ interaction_mode="unavailable",
)
diff --git a/ksadk/kernel/ingress.py b/ksadk/kernel/ingress.py
index 6294937e..84bdc2e1 100644
--- a/ksadk/kernel/ingress.py
+++ b/ksadk/kernel/ingress.py
@@ -421,6 +421,26 @@ def map_studio_request(
)
+def map_scheduler_request(
+ *,
+ session_id: str,
+ idempotency_key: str,
+ content: Any,
+ occurrence_id: str,
+ trusted: TrustedRuntimeContext,
+) -> AgentControlCommand:
+ """Scheduler occurrence -> enqueue with durable source and correlation IDs."""
+
+ return _command(
+ trusted=trusted,
+ command_type="enqueue",
+ session_id=session_id,
+ idempotency_key=idempotency_key,
+ payload={"content": content},
+ correlation_id=occurrence_id,
+ )
+
+
def map_control_request(
*,
command_type: str,
@@ -1091,6 +1111,7 @@ def agent_kernel_router() -> Any:
"map_control_request",
"map_responses_request",
"map_run_request",
+ "map_scheduler_request",
"map_studio_request",
"receipt_error_payload",
"receipt_http_status",
diff --git a/ksadk/kernel/memory_store.py b/ksadk/kernel/memory_store.py
index b9ff81f2..5b80a46f 100644
--- a/ksadk/kernel/memory_store.py
+++ b/ksadk/kernel/memory_store.py
@@ -1124,6 +1124,7 @@ async def save_run_transition(
"fencing_token": int(expected_fence),
},
run_id=run.run_id,
+ causation_id=str(run.metadata.get("command_id") or "") or None,
),
activation_row=activation,
)
diff --git a/ksadk/kernel/postgres_store.py b/ksadk/kernel/postgres_store.py
index 5d1a1660..6249c9a4 100644
--- a/ksadk/kernel/postgres_store.py
+++ b/ksadk/kernel/postgres_store.py
@@ -1647,6 +1647,7 @@ async def save_run_transition(
"fencing_token": int(expected_fence),
},
run_id=run.run_id,
+ causation_id=str(run.metadata.get("command_id") or "") or None,
),
activation,
expected_fence,
diff --git a/ksadk/kernel/sqlite_store.py b/ksadk/kernel/sqlite_store.py
index f9e896b8..be5d9781 100644
--- a/ksadk/kernel/sqlite_store.py
+++ b/ksadk/kernel/sqlite_store.py
@@ -1400,6 +1400,7 @@ async def save_run_transition(
"fencing_token": int(expected_fence),
},
run_id=run.run_id,
+ causation_id=str(run.metadata.get("command_id") or "") or None,
),
activation,
expected_fence,
diff --git a/ksadk/kernel/worker.py b/ksadk/kernel/worker.py
index c9845022..f70b6af8 100644
--- a/ksadk/kernel/worker.py
+++ b/ksadk/kernel/worker.py
@@ -356,6 +356,17 @@ async def _start_run(self, command: AgentControlCommand, activation: ActivationL
agent_instance_id=command.agent_instance_id,
session_id=command.session_id,
state=RunState.PENDING,
+ # Keep the admitted control identity on the durable run. This is
+ # not user-supplied metadata: it is copied from the trusted
+ # command that the worker actually claimed. Consumers such as the
+ # local Scheduler can therefore reconcile a runtime terminal fact
+ # back to one occurrence without matching text or wall-clock time.
+ metadata={
+ "command_id": str(command.command_id),
+ "source_kind": command.source.kind,
+ "source_ref": command.source.ref,
+ "correlation_id": command.correlation_id,
+ },
)
created = await self._store.save_run_transition(pending, expected_fence=fence)
continuation_metadata = await self._session_continuation_metadata(command.session_id)
diff --git a/ksadk/memory/providers/local_sqlite.py b/ksadk/memory/providers/local_sqlite.py
index 00347068..9672b7a5 100644
--- a/ksadk/memory/providers/local_sqlite.py
+++ b/ksadk/memory/providers/local_sqlite.py
@@ -141,6 +141,13 @@ def __init__(
workspace_id: str = "local",
) -> None:
self._db_path = str(db_path)
+ if self._db_path != ":memory:":
+ # A fresh local Studio has not created its session directory yet.
+ # SQLite creates the database file, but not missing parents.
+ Path(self._db_path).expanduser().resolve().parent.mkdir(
+ parents=True,
+ exist_ok=True,
+ )
self._tenant_id = tenant_id
self._workspace_id = workspace_id
self._lock = threading.Lock()
diff --git a/ksadk/plugins/__init__.py b/ksadk/plugins/__init__.py
new file mode 100644
index 00000000..823043be
--- /dev/null
+++ b/ksadk/plugins/__init__.py
@@ -0,0 +1,167 @@
+"""Versioned contracts for the Phase 2 plugin composition boundary.
+
+This package models discovery, deterministic locking, and the controlled
+PluginHost lifecycle. It does not create a second runtime/event store;
+providers keep their native execution authority behind these contracts.
+"""
+
+from ksadk.plugins.bundle import (
+ PluginBundleError,
+ PluginBundleResolver,
+ ResolvedPluginBundle,
+)
+from ksadk.plugins.context_contributor import (
+ AuthenticatedContextScope,
+ ContextClassification,
+ ContextContributorCacheability,
+ ContextContributorCapabilities,
+ ContextContributorExchange,
+ ContextContributorFailureMode,
+ ContextContributorRequest,
+ ContextContributorResponse,
+ ContextFragment,
+ ContextSourceReference,
+ ProjectedContextContribution,
+ context_contributor_json_schema,
+)
+from ksadk.plugins.contracts import (
+ CapabilityDefinition,
+ CompositionProfile,
+ PluginInventory,
+ PluginLock,
+ canonical_plugin_lock,
+ plugin_lock_digest,
+)
+from ksadk.plugins.ecosystem_bridge import (
+ BridgeAction,
+ BridgeCommitRequest,
+ BridgeCommitResult,
+ BridgeDescribeRequest,
+ BridgeDescribeResult,
+ BridgeDescriptor,
+ BridgeDisposeRequest,
+ BridgeDisposeResult,
+ BridgeHostObservation,
+ BridgeHostRequirement,
+ BridgeInspectExchange,
+ BridgeInspectRequest,
+ BridgeInspectResult,
+ BridgePlanRequest,
+ BridgePlanResult,
+ BridgeProbeExchange,
+ BridgeProbeRequest,
+ BridgeProbeResult,
+ BridgeReconcileRequest,
+ BridgeReconcileResult,
+ BridgeRejection,
+ BridgeRollbackRequest,
+ BridgeRollbackResult,
+ BridgeStageRequest,
+ BridgeStageResult,
+ BridgeTransitionPlan,
+ EcosystemInstallReceipt,
+ EcosystemPluginDescriptor,
+ EcosystemPluginInventory,
+ PluginDesiredState,
+ PluginEcosystem,
+ PluginEcosystemBridge,
+ PluginEcosystemBridgeFixture,
+ PluginEcosystemBridgeTranscript,
+ PluginIntegrationMode,
+ PluginManifestCandidate,
+ PluginObservedState,
+ PluginSupportMaturity,
+ ecosystem_bridge_json_schema,
+)
+from ksadk.plugins.ecosystem_probe import EcosystemProbeError, probe_ecosystem_manifests
+from ksadk.plugins.host import (
+ ExecutableAgentProvider,
+ PluginActivationSession,
+ PluginCapabilityBinding,
+ PluginExecutionContext,
+ PluginHost,
+ PluginHostError,
+ PreparedAgent,
+)
+from ksadk.plugins.resolver import (
+ PluginRegistry,
+ PluginResolutionError,
+ ResolvedComposition,
+ composition_profile_digest,
+)
+
+__all__ = [
+ "AuthenticatedContextScope",
+ "BridgeAction",
+ "BridgeCommitRequest",
+ "BridgeCommitResult",
+ "BridgeDescribeRequest",
+ "BridgeDescribeResult",
+ "BridgeDescriptor",
+ "BridgeDisposeRequest",
+ "BridgeDisposeResult",
+ "BridgeHostObservation",
+ "BridgeHostRequirement",
+ "BridgeInspectExchange",
+ "BridgeInspectRequest",
+ "BridgeInspectResult",
+ "BridgePlanRequest",
+ "BridgePlanResult",
+ "BridgeProbeExchange",
+ "BridgeProbeRequest",
+ "BridgeProbeResult",
+ "BridgeReconcileRequest",
+ "BridgeReconcileResult",
+ "BridgeRejection",
+ "BridgeRollbackRequest",
+ "BridgeRollbackResult",
+ "BridgeStageRequest",
+ "BridgeStageResult",
+ "BridgeTransitionPlan",
+ "CapabilityDefinition",
+ "CompositionProfile",
+ "ContextClassification",
+ "ContextContributorCacheability",
+ "ContextContributorCapabilities",
+ "ContextContributorExchange",
+ "ContextContributorFailureMode",
+ "ContextContributorRequest",
+ "ContextContributorResponse",
+ "ContextFragment",
+ "ContextSourceReference",
+ "EcosystemInstallReceipt",
+ "EcosystemProbeError",
+ "EcosystemPluginDescriptor",
+ "EcosystemPluginInventory",
+ "PluginInventory",
+ "PluginLock",
+ "PluginDesiredState",
+ "PluginEcosystem",
+ "PluginEcosystemBridge",
+ "PluginEcosystemBridgeFixture",
+ "PluginEcosystemBridgeTranscript",
+ "PluginIntegrationMode",
+ "PluginManifestCandidate",
+ "PluginObservedState",
+ "PluginSupportMaturity",
+ "PluginBundleError",
+ "PluginBundleResolver",
+ "ResolvedPluginBundle",
+ "ExecutableAgentProvider",
+ "PluginActivationSession",
+ "PluginCapabilityBinding",
+ "PluginExecutionContext",
+ "PluginHost",
+ "PluginHostError",
+ "PreparedAgent",
+ "PluginRegistry",
+ "PluginResolutionError",
+ "ProjectedContextContribution",
+ "ResolvedComposition",
+ "composition_profile_digest",
+ "context_contributor_json_schema",
+ "ecosystem_bridge_json_schema",
+ "canonical_plugin_lock",
+ "plugin_lock_digest",
+ "probe_ecosystem_manifests",
+]
diff --git a/ksadk/plugins/bridges/__init__.py b/ksadk/plugins/bridges/__init__.py
new file mode 100644
index 00000000..0c8c01d1
--- /dev/null
+++ b/ksadk/plugins/bridges/__init__.py
@@ -0,0 +1,45 @@
+"""Native-host ecosystem bridges.
+
+Bridges keep each ecosystem's executable ABI inside its native host. They do
+not add a generic plugin execution API to KsADK.
+"""
+
+from ksadk.plugins.bridges.codex import (
+ CodexAppServerPluginBridge,
+ CodexBridgeError,
+ CodexPluginApprovalRequired,
+ CodexPluginDetail,
+ CodexPluginInventory,
+ CodexPluginNotFoundError,
+)
+from ksadk.plugins.bridges.dsh import (
+ DshBridgeError,
+ DshBridgeHost,
+ DshClientBundle,
+ DshHostUnavailableError,
+ DshPluginApprovalRequired,
+ DshPluginInventory,
+ DshPluginMutationError,
+ DshPluginNotFoundError,
+ DshProfilePluginBridge,
+ DshProfileProjection,
+)
+
+__all__ = [
+ "CodexAppServerPluginBridge",
+ "CodexBridgeError",
+ "CodexPluginApprovalRequired",
+ "CodexPluginDetail",
+ "CodexPluginInventory",
+ "CodexPluginNotFoundError",
+ "DshBridgeError",
+ "DshBridgeHost",
+ "DshClientBundle",
+ "DshHostUnavailableError",
+ "DshPluginApprovalRequired",
+ "DshPluginInventory",
+ "DshPluginMutationError",
+ "DshPluginNotFoundError",
+ "DshProfilePluginBridge",
+ "DshProfileProjection",
+]
diff --git a/ksadk/plugins/bridges/codex.py b/ksadk/plugins/bridges/codex.py
new file mode 100644
index 00000000..b9f04ea3
--- /dev/null
+++ b/ksadk/plugins/bridges/codex.py
@@ -0,0 +1,552 @@
+"""Restricted Codex App Server plugin lifecycle bridge.
+
+Codex remains the native owner of Codex plugins. KsADK only calls the
+allowlisted App Server lifecycle methods and projects their inventory into
+strict local models. There is intentionally no arbitrary JSON-RPC escape
+hatch and no attempt to execute a Codex plugin inside PluginHost.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import re
+from pathlib import Path
+from typing import Any, Literal, Protocol, TypeVar, cast
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class _CodexWireModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+class _LocalSource(_CodexWireModel):
+ type: Literal["local"]
+ path: str
+
+
+class _GitSource(_CodexWireModel):
+ type: Literal["git"]
+ url: str
+ ref_name: str | None = None
+ sha: str | None = None
+ path: str | None = None
+
+
+class _NpmSource(_CodexWireModel):
+ type: Literal["npm"]
+ package: str
+ version: str | None = None
+ registry: str | None = None
+
+
+class _RemoteSource(_CodexWireModel):
+ type: Literal["remote"]
+
+
+CodexPluginSource = _LocalSource | _GitSource | _NpmSource | _RemoteSource
+
+
+class _PluginSummary(_CodexWireModel):
+ id: str
+ name: str
+ source: CodexPluginSource = Field(discriminator="type")
+ installed: bool
+ enabled: bool
+ install_policy: Literal["NOT_AVAILABLE", "AVAILABLE", "INSTALLED_BY_DEFAULT"]
+ auth_policy: Literal["ON_INSTALL", "ON_USE"]
+ remote_plugin_id: str | None = None
+ version: str | None = None
+ local_version: str | None = None
+ installed_at: int | None = None
+ install_policy_source: str | None = None
+ must_show_installation_interstitial: bool | None = None
+ availability: str = "AVAILABLE"
+ disabled_reason: str | None = None
+ eligible_plan_types: tuple[str, ...] | None = None
+ share_context: dict[str, Any] | None = None
+ interface: dict[str, Any] | None = None
+ keywords: tuple[str, ...] = ()
+
+
+class _Marketplace(_CodexWireModel):
+ name: str
+ path: str | None = None
+ interface: dict[str, Any] | None = None
+ plugins: tuple[_PluginSummary, ...]
+
+
+class _MarketplaceLoadError(_CodexWireModel):
+ marketplace_path: str
+ message: str
+
+
+class _PluginListResponse(_CodexWireModel):
+ marketplaces: tuple[_Marketplace, ...]
+ marketplace_load_errors: tuple[_MarketplaceLoadError, ...] = ()
+ featured_plugin_ids: tuple[str, ...] = ()
+
+
+class _PluginDetailWire(_CodexWireModel):
+ marketplace_name: str
+ marketplace_path: str | None
+ summary: _PluginSummary
+ description: str | None = None
+ share_url: str | None = None
+ skills: tuple[dict[str, Any], ...]
+ hooks: tuple[dict[str, Any], ...]
+ apps: tuple[dict[str, Any], ...]
+ app_templates: tuple[dict[str, Any], ...]
+ mcp_servers: tuple[str, ...]
+ scheduled_tasks: tuple[dict[str, Any], ...] | None = None
+
+
+class _PluginReadResponse(_CodexWireModel):
+ plugin: _PluginDetailWire
+
+
+class _MarketplaceAddResponse(_CodexWireModel):
+ marketplace_name: str
+ installed_root: str
+ already_added: bool
+
+
+class _PluginInstallResponse(_CodexWireModel):
+ auth_policy: Literal["ON_INSTALL", "ON_USE"]
+ apps_needing_auth: tuple[dict[str, Any], ...]
+
+
+class _PluginUninstallResponse(_CodexWireModel):
+ pass
+
+
+class CodexPluginInventory(_CodexWireModel):
+ """Normalized observed state; install receipt never implies these fields."""
+
+ plugin_id: str
+ name: str
+ marketplace_name: str
+ marketplace_path: str | None
+ version: str | None
+ installed: bool
+ enabled: bool
+ availability: str
+ source: CodexPluginSource = Field(discriminator="type")
+ permissions_declared: Literal[False] = False
+ risk_disclosures: tuple[str, ...] = (
+ "Codex plugin permissions are host-managed and not declared in the plugin manifest.",
+ "The Codex App Server and installed plugin run with the current host user privileges.",
+ )
+
+
+class CodexPluginDetail(_CodexWireModel):
+ inventory: CodexPluginInventory
+ description: str | None = None
+ skills: tuple[str, ...] = ()
+ mcp_servers: tuple[str, ...] = ()
+ hooks: tuple[str, ...] = ()
+ apps: tuple[str, ...] = ()
+ scheduled_tasks: tuple[str, ...] = ()
+
+
+class CodexPluginInstallResult(_CodexWireModel):
+ inventory: CodexPluginInventory
+ auth_policy: Literal["ON_INSTALL", "ON_USE"]
+ apps_needing_auth: tuple[str, ...] = ()
+
+
+class CodexPluginUninstallResult(_CodexWireModel):
+ plugin_id: str
+ installed: Literal[False] = False
+ enabled: Literal[False] = False
+
+
+class CodexBridgeHost(_CodexWireModel):
+ host_id: Literal["codex-app-server"] = "codex-app-server"
+ version: str
+ protocol: Literal["codex.app-server/v1"] = "codex.app-server/v1"
+ available: Literal[True] = True
+
+
+class CodexBridgeError(RuntimeError):
+ """Base error for a bounded Codex plugin lifecycle operation."""
+
+
+class CodexPluginNotFoundError(CodexBridgeError):
+ pass
+
+
+class CodexPluginApprovalRequired(CodexBridgeError):
+ pass
+
+
+ResponseT = TypeVar("ResponseT", bound=BaseModel)
+
+
+class _CodexTransport(Protocol):
+ async def start(self) -> None: ...
+
+ async def close(self) -> None: ...
+
+ async def initialize(self) -> Any: ...
+
+ async def request(
+ self,
+ method: str,
+ params: dict[str, Any] | None,
+ *,
+ response_model: type[ResponseT],
+ ) -> ResponseT: ...
+
+
+_HOST_VERSION = re.compile(r"(?:Codex(?: Desktop)?/)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)")
+
+
+def _reported_host_version(metadata: Any) -> str:
+ """Return an App Server version without making its user-agent a gate.
+
+ App Server exposes plugin lifecycle methods as the compatibility contract.
+ Its ``userAgent`` field is diagnostic metadata and has changed shape across
+ CLI, Desktop, and SDK launches. A missing or unfamiliar value must remain
+ visible to callers, but must not prevent an otherwise compatible host from
+ listing, installing, or removing a plugin.
+ """
+ raw = getattr(metadata, "user_agent", None) or getattr(metadata, "userAgent", None)
+ if raw is None and isinstance(metadata, dict):
+ raw = metadata.get("userAgent") or metadata.get("user_agent")
+ if raw is None and isinstance(metadata, BaseModel):
+ payload = metadata.model_dump(by_alias=True)
+ raw = payload.get("userAgent") or payload.get("user_agent")
+ match = _HOST_VERSION.search(str(raw or ""))
+ return match.group(1) if match is not None else "unreported"
+
+
+class CodexAppServerPluginBridge:
+ """Allowlisted Codex plugin manager backed by one App Server process."""
+
+ def __init__(
+ self,
+ *,
+ codex_home: Path | None = None,
+ codex_bin: str | None = None,
+ transport: _CodexTransport | None = None,
+ ) -> None:
+ if transport is not None and (codex_home is not None or codex_bin is not None):
+ raise ValueError("an injected transport cannot be combined with Codex launch options")
+ self._codex_home = codex_home
+ self._codex_bin = codex_bin
+ self._transport = transport
+ self._owns_transport = transport is None
+ self._started = False
+ self._host: CodexBridgeHost | None = None
+ self._lock = asyncio.Lock()
+
+ async def __aenter__(self) -> "CodexAppServerPluginBridge":
+ await self.start()
+ return self
+
+ async def __aexit__(self, _exc_type: object, _exc: object, _tb: object) -> None:
+ await self.close()
+
+ @property
+ def host(self) -> CodexBridgeHost:
+ if self._host is None:
+ raise CodexBridgeError("Codex App Server bridge is not started")
+ return self._host
+
+ async def start(self) -> CodexBridgeHost:
+ if self._started:
+ return self.host
+ if self._codex_home is not None:
+ self._codex_home.mkdir(parents=True, exist_ok=True)
+ if self._transport is None:
+ self._transport = self._create_transport()
+ try:
+ await self._transport.start()
+ metadata = await self._transport.initialize()
+ self._host = CodexBridgeHost(version=_reported_host_version(metadata))
+ self._started = True
+ return self._host
+ except BaseException:
+ await self.close()
+ raise
+
+ async def close(self) -> None:
+ transport = self._transport
+ self._transport = None if self._owns_transport else transport
+ self._started = False
+ self._host = None
+ if transport is not None:
+ await transport.close()
+
+ async def add_marketplace(self, source: str, *, ref_name: str | None = None) -> str:
+ response = await self._request(
+ "marketplace/add",
+ {"source": source, "refName": ref_name, "sparsePaths": None},
+ _MarketplaceAddResponse,
+ )
+ return response.marketplace_name
+
+ async def list_plugins(
+ self, *, force_refetch: bool = False
+ ) -> tuple[CodexPluginInventory, ...]:
+ response = await self._list_wire(force_refetch=force_refetch)
+ return tuple(
+ self._inventory(marketplace, summary)
+ for marketplace in response.marketplaces
+ for summary in marketplace.plugins
+ )
+
+ async def read_plugin(
+ self,
+ plugin_name_or_id: str,
+ *,
+ marketplace_name: str | None = None,
+ ) -> CodexPluginDetail:
+ marketplace, summary = await self._resolve(plugin_name_or_id, marketplace_name)
+ response = await self._request(
+ "plugin/read",
+ {
+ "pluginName": summary.name,
+ "marketplacePath": marketplace.path,
+ "remoteMarketplaceName": None if marketplace.path else marketplace.name,
+ },
+ _PluginReadResponse,
+ )
+ plugin = response.plugin
+ return CodexPluginDetail(
+ inventory=self._inventory(marketplace, plugin.summary),
+ description=plugin.description,
+ skills=tuple(str(item.get("name", "")) for item in plugin.skills if item.get("name")),
+ mcp_servers=plugin.mcp_servers,
+ hooks=tuple(str(item.get("key", "")) for item in plugin.hooks if item.get("key")),
+ apps=tuple(str(item.get("id", "")) for item in plugin.apps if item.get("id")),
+ scheduled_tasks=tuple(
+ str(item.get("key", ""))
+ for item in (plugin.scheduled_tasks or ())
+ if item.get("key")
+ ),
+ )
+
+ async def install_plugin(
+ self,
+ plugin_name_or_id: str,
+ *,
+ marketplace_name: str | None = None,
+ accept_undeclared_permissions: bool = False,
+ install_attempt_id: str | None = None,
+ ) -> CodexPluginInstallResult:
+ if not accept_undeclared_permissions:
+ raise CodexPluginApprovalRequired(
+ "Codex plugins do not expose complete install/runtime permissions; "
+ "explicit accept_undeclared_permissions=True is required"
+ )
+ async with self._lock:
+ marketplace, summary = await self._resolve(plugin_name_or_id, marketplace_name)
+ before = self._inventory(marketplace, summary)
+ try:
+ response = await self._request(
+ "plugin/install",
+ {
+ "pluginName": summary.name,
+ "marketplacePath": marketplace.path,
+ "remoteMarketplaceName": None if marketplace.path else marketplace.name,
+ "installAttemptId": install_attempt_id,
+ },
+ _PluginInstallResponse,
+ )
+ observed = await self._resolve_inventory(
+ summary.id,
+ marketplace.name,
+ force_refetch=True,
+ )
+ if not observed.installed or not observed.enabled:
+ raise CodexBridgeError(
+ "Codex host did not reconcile the installed plugin as enabled"
+ )
+ except BaseException as install_error:
+ try:
+ restored = await asyncio.shield(self._restore_failed_install(before))
+ except BaseException as rollback_error:
+ raise CodexBridgeError(
+ "Codex plugin install failed and its previous inventory "
+ "could not be restored"
+ ) from rollback_error
+ raise CodexBridgeError(
+ "Codex plugin install failed; previous inventory was restored "
+ f"(installed={restored.installed}, enabled={restored.enabled})"
+ ) from install_error
+ return CodexPluginInstallResult(
+ inventory=observed,
+ auth_policy=response.auth_policy,
+ apps_needing_auth=tuple(
+ str(item.get("id", "")) for item in response.apps_needing_auth if item.get("id")
+ ),
+ )
+
+ async def uninstall_plugin(self, plugin_id: str) -> CodexPluginUninstallResult:
+ async with self._lock:
+ marketplace, summary = await self._resolve(plugin_id, None)
+ await self._request(
+ "plugin/uninstall",
+ {"pluginId": summary.id},
+ _PluginUninstallResponse,
+ )
+ observed = await self._resolve_inventory(summary.id, marketplace.name)
+ if observed.installed or observed.enabled:
+ raise CodexBridgeError("Codex host still reports the uninstalled plugin as active")
+ return CodexPluginUninstallResult(plugin_id=summary.id)
+
+ def _create_transport(self) -> _CodexTransport:
+ try:
+ from openai_codex.async_client import AsyncCodexClient
+ from openai_codex.client import CodexConfig
+ except ImportError as exc: # pragma: no cover - depends on optional extra
+ raise CodexBridgeError("Codex plugin bridge requires the ksadk[codex] extra") from exc
+ env = None
+ if self._codex_home is not None:
+ env = {"CODEX_HOME": str(self._codex_home.resolve())}
+ return cast(
+ _CodexTransport,
+ AsyncCodexClient(CodexConfig(codex_bin=self._codex_bin, env=env)),
+ )
+
+ async def _request(
+ self,
+ method: Literal[
+ "marketplace/add",
+ "plugin/list",
+ "plugin/read",
+ "plugin/install",
+ "plugin/uninstall",
+ ],
+ params: dict[str, Any] | None,
+ response_model: type[ResponseT],
+ ) -> ResponseT:
+ if not self._started or self._transport is None:
+ raise CodexBridgeError("Codex App Server bridge is not started")
+ return await self._transport.request(method, params, response_model=response_model)
+
+ async def _list_wire(self, *, force_refetch: bool = False) -> _PluginListResponse:
+ return await self._request(
+ "plugin/list",
+ {"forceRefetch": force_refetch, "cwds": None, "marketplaceKinds": None},
+ _PluginListResponse,
+ )
+
+ async def _resolve(
+ self,
+ plugin_name_or_id: str,
+ marketplace_name: str | None,
+ *,
+ force_refetch: bool = False,
+ ) -> tuple[_Marketplace, _PluginSummary]:
+ response = await self._list_wire(force_refetch=force_refetch)
+ matches = [
+ (marketplace, summary)
+ for marketplace in response.marketplaces
+ if marketplace_name is None or marketplace.name == marketplace_name
+ for summary in marketplace.plugins
+ if summary.id == plugin_name_or_id or summary.name == plugin_name_or_id
+ ]
+ if len(matches) != 1:
+ qualifier = f" in marketplace {marketplace_name!r}" if marketplace_name else ""
+ if not matches:
+ raise CodexPluginNotFoundError(
+ f"Codex plugin {plugin_name_or_id!r}{qualifier} was not found"
+ )
+ raise CodexBridgeError(
+ f"Codex plugin name {plugin_name_or_id!r} is ambiguous; use its full plugin id"
+ )
+ return matches[0]
+
+ async def _resolve_inventory(
+ self,
+ plugin_id: str,
+ marketplace_name: str,
+ *,
+ force_refetch: bool = False,
+ ) -> CodexPluginInventory:
+ marketplace, summary = await self._resolve(
+ plugin_id,
+ marketplace_name,
+ force_refetch=force_refetch,
+ )
+ return self._inventory(marketplace, summary)
+
+ async def _restore_failed_install(
+ self,
+ before: CodexPluginInventory,
+ ) -> CodexPluginInventory:
+ """Compensate an install whose receipt/reconciliation failed.
+
+ App Server may have committed files before its response is lost. For
+ the only state transition exposed by ``install_plugin`` (available ->
+ installed), uninstall is the native compensating action. An already
+ installed plugin is never silently reinstalled because the App Server
+ API cannot pin its previous local bytes; any observed drift therefore
+ fails closed rather than claiming rollback.
+ """
+
+ observed = await self._resolve_inventory(
+ before.plugin_id,
+ before.marketplace_name,
+ force_refetch=True,
+ )
+ if not before.installed and observed.installed:
+ await self._request(
+ "plugin/uninstall",
+ {"pluginId": before.plugin_id},
+ _PluginUninstallResponse,
+ )
+ observed = await self._resolve_inventory(
+ before.plugin_id,
+ before.marketplace_name,
+ force_refetch=True,
+ )
+ if (observed.installed, observed.enabled) != (
+ before.installed,
+ before.enabled,
+ ):
+ raise CodexBridgeError("Codex host inventory differs from the pre-install snapshot")
+ return observed
+
+ @staticmethod
+ def _inventory(
+ marketplace: _Marketplace,
+ summary: _PluginSummary,
+ ) -> CodexPluginInventory:
+ return CodexPluginInventory(
+ plugin_id=summary.id,
+ name=summary.name,
+ marketplace_name=marketplace.name,
+ marketplace_path=marketplace.path,
+ version=summary.local_version or summary.version,
+ installed=summary.installed,
+ enabled=summary.enabled,
+ availability=summary.availability,
+ source=summary.source,
+ )
+
+
+__all__ = [
+ "CodexAppServerPluginBridge",
+ "CodexBridgeError",
+ "CodexBridgeHost",
+ "CodexPluginApprovalRequired",
+ "CodexPluginDetail",
+ "CodexPluginInstallResult",
+ "CodexPluginInventory",
+ "CodexPluginNotFoundError",
+ "CodexPluginUninstallResult",
+]
diff --git a/ksadk/plugins/bridges/dsh.py b/ksadk/plugins/bridges/dsh.py
new file mode 100644
index 00000000..d7257306
--- /dev/null
+++ b/ksadk/plugins/bridges/dsh.py
@@ -0,0 +1,1116 @@
+"""Transactional DeepSeek Harness profile plugin bridge.
+
+DSH remains the native owner of its plugin packages and composed runtime. This
+module only manages one isolated Profile through the public ``dsh plugin`` and
+``--dump-config`` commands, then projects non-secret inventory into KsADK.
+It deliberately does not import Cordis or execute DSH plugin code in PluginHost.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import shutil
+import stat
+import subprocess
+import tempfile
+import threading
+from collections.abc import Callable, Mapping, Sequence
+from contextlib import contextmanager
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterator, Literal, TypedDict
+
+try:
+ import fcntl
+except ImportError: # pragma: no cover - DSH production hosts are Unix
+ fcntl = None # type: ignore[assignment]
+
+from pydantic import BaseModel, ConfigDict
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class _DshModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+class DshBridgeHost(_DshModel):
+ host_id: Literal["deepseek-harness"] = "deepseek-harness"
+ version: str
+ protocol: Literal["dsh.profile/v1"] = "dsh.profile/v1"
+ available: Literal[True] = True
+
+
+class DshClientBundle(_DshModel):
+ """One validated browser half from an installed DSH package."""
+
+ platform: Literal["web"] = "web"
+ digest: str
+ content_bytes: int
+ external: tuple[str, ...] = ()
+ inject: tuple[str, ...] = ()
+ compatible: bool
+ incompatibility_reason: str = ""
+
+
+class DshPluginInventory(_DshModel):
+ ecosystem: Literal["dsh"] = "dsh"
+ integration_mode: Literal["bridged"] = "bridged"
+ profile: str
+ name: str
+ display_name: str
+ description: str = ""
+ version: str
+ requested_spec: str
+ source_digest: str | None = None
+ source_kind: Literal["directory", "tgz"] | None = None
+ installed: Literal[True] = True
+ enabled: bool
+ permissions_declared: Literal[False] = False
+ client_bundle: DshClientBundle | None = None
+ risk_disclosures: tuple[str, ...] = (
+ "DSH packages and install scripts run with the native host user privileges.",
+ "DSH bundle manifests do not declare a complete runtime permission set.",
+ )
+
+
+class DshProfileProjection(_DshModel):
+ profile: str
+ bundles: tuple[str, ...]
+ config_digest: str
+ config_bytes: int
+ host_version: str
+
+
+class DshBridgeError(RuntimeError):
+ """Base failure for one bounded DSH profile operation."""
+
+
+class DshHostUnavailableError(DshBridgeError):
+ pass
+
+
+class DshPluginNotFoundError(DshBridgeError):
+ pass
+
+
+class DshPluginApprovalRequired(DshBridgeError):
+ pass
+
+
+class DshPluginMutationError(DshBridgeError):
+ pass
+
+
+class _CommandResult(_DshModel):
+ stdout: str = ""
+ stderr: str = ""
+
+
+CommandRunner = Callable[[Sequence[str], Path, Mapping[str, str]], _CommandResult]
+
+_PROFILE_NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
+_PACKAGE_NAME = re.compile(r"^(?:@[A-Za-z0-9._-]+/)?[A-Za-z0-9._-]+$")
+_HOST_VERSION = re.compile(r"\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b")
+_STATE_FILE = ".ksadk-dsh-plugins.json"
+_IMMUTABLE_SOURCE_DIR = "immutable-plugin-sources"
+_SNAPSHOT_FILES = ("package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", _STATE_FILE)
+_MAX_JSON_BYTES = 2 * 1024 * 1024
+_MAX_CLIENT_BUNDLE_BYTES = 8 * 1024 * 1024
+_STUDIO_CLIENT_EXTERNALS = frozenset({"react"})
+_PROFILE_LOCK_DIR = "profile-locks"
+_DSH_SUBPROCESS_ENV_KEYS = (
+ "PATH",
+ "HOME",
+ "USER",
+ "LOGNAME",
+ "SHELL",
+ "TMPDIR",
+ "TMP",
+ "TEMP",
+ "LANG",
+ "LANGUAGE",
+ "LC_ALL",
+ "LC_CTYPE",
+ "HTTP_PROXY",
+ "HTTPS_PROXY",
+ "ALL_PROXY",
+ "NO_PROXY",
+ "http_proxy",
+ "https_proxy",
+ "all_proxy",
+ "no_proxy",
+ "SSL_CERT_FILE",
+ "SSL_CERT_DIR",
+ "NODE_EXTRA_CA_CERTS",
+ "REQUESTS_CA_BUNDLE",
+ "CURL_CA_BUNDLE",
+ "NPM_CONFIG_REGISTRY",
+ "npm_config_registry",
+ "SYSTEMROOT",
+ "WINDIR",
+ "COMSPEC",
+ "PATHEXT",
+)
+
+
+def dsh_subprocess_environment(*, dsh_home: Path | None = None) -> dict[str, str]:
+ """Build the explicit environment inherited by DSH and pnpm children.
+
+ DSH bundles may execute package lifecycle scripts. They need process
+ discovery, a home/temp directory, locale, proxies and CA configuration,
+ but never receive arbitrary model, cloud, npm, SSH or host application
+ credentials from the parent process.
+ """
+
+ environment = {
+ name: os.environ[name] for name in _DSH_SUBPROCESS_ENV_KEYS if os.environ.get(name)
+ }
+ if "PATH" not in environment:
+ environment["PATH"] = os.defpath
+ if dsh_home is not None:
+ environment["DSH_HOME"] = str(dsh_home)
+ return environment
+
+
+class _SourceReceipt(TypedDict):
+ digest: str
+ kind: Literal["directory", "tgz"]
+ artifact: str
+ dependency_spec: str
+
+
+class _ProfileState(TypedDict):
+ order: list[str]
+ disabled: list[str]
+ sources: dict[str, _SourceReceipt]
+
+
+@dataclass(frozen=True)
+class _PreparedSource:
+ command_source: str
+ digest: str
+ kind: Literal["directory", "tgz"]
+ artifact: str
+
+
+class DshProfilePluginBridge:
+ """Manage DSH bundles in one isolated Profile with rollback and preflight."""
+
+ def __init__(
+ self,
+ *,
+ dsh_home: Path,
+ profile: str = "ksadk",
+ dsh_command: Sequence[str] | None = None,
+ command_runner: CommandRunner | None = None,
+ cwd: Path | None = None,
+ ) -> None:
+ if not _PROFILE_NAME.fullmatch(profile):
+ raise ValueError("DSH profile must be a simple name without path separators")
+ if dsh_command is not None and not dsh_command:
+ raise ValueError("DSH command cannot be empty")
+ self._dsh_home = dsh_home.expanduser().resolve()
+ self._profile = profile
+ self._profile_root = self._dsh_home / "profiles" / profile
+ self._command = tuple(dsh_command) if dsh_command is not None else None
+ self._runner = command_runner or self._run_command
+ self._cwd = (cwd or Path.cwd()).resolve()
+ self._host: DshBridgeHost | None = None
+ self._lock = threading.RLock()
+ self._transaction_local = threading.local()
+
+ @property
+ def host(self) -> DshBridgeHost:
+ if self._host is None:
+ raise DshHostUnavailableError("DSH bridge is not started")
+ return self._host
+
+ def start(self) -> DshBridgeHost:
+ if self._host is not None:
+ return self._host
+ command = self._resolve_command()
+ result = self._invoke((*command, "--version"), cwd=self._cwd)
+ match = _HOST_VERSION.search(result.stdout or result.stderr)
+ if match is None:
+ raise DshHostUnavailableError("DSH host did not report a parseable version")
+ self._command = command
+ self._host = DshBridgeHost(version=match.group(1))
+ return self._host
+
+ def close(self) -> None:
+ self._host = None
+
+ def __enter__(self) -> "DshProfilePluginBridge":
+ self.start()
+ return self
+
+ def __exit__(self, _exc_type: object, _exc: object, _tb: object) -> None:
+ self.close()
+
+ def list_plugins(self) -> tuple[DshPluginInventory, ...]:
+ with self._profile_transaction(exclusive=False):
+ return self._list_plugins_locked()
+
+ def _list_plugins_locked(self) -> tuple[DshPluginInventory, ...]:
+ self._ensure_started()
+ if not self._manifest_path().is_file():
+ return ()
+ manifest = self._read_manifest()
+ state = self._read_state(manifest)
+ self._verify_source_receipts(manifest, state)
+ active = set(self._bundles(manifest))
+ items: list[DshPluginInventory] = []
+ for name, requested_spec in self._dependencies(manifest).items():
+ package = self._read_package(name)
+ if package is None or self._bundle_patch(package) is None:
+ continue
+ receipt = state["sources"].get(name)
+ items.append(
+ DshPluginInventory(
+ profile=self._profile,
+ name=name,
+ display_name=self._string(package.get("displayName"))
+ or self._string(package.get("name"))
+ or name,
+ description=self._string(package.get("description")),
+ version=self._string(package.get("version")),
+ requested_spec=requested_spec,
+ source_digest=receipt["digest"] if receipt is not None else None,
+ source_kind=receipt["kind"] if receipt is not None else None,
+ enabled=name in active and name not in set(state["disabled"]),
+ client_bundle=self._client_bundle_metadata(name, package),
+ )
+ )
+ return tuple(sorted(items, key=lambda item: (item.display_name.casefold(), item.name)))
+
+ def get_plugin(self, name: str) -> DshPluginInventory:
+ self._validate_package_name(name)
+ matches = [item for item in self.list_plugins() if item.name == name]
+ if not matches:
+ raise DshPluginNotFoundError(f"DSH plugin {name!r} is not installed")
+ return matches[0]
+
+ def install_plugin(
+ self,
+ source: str,
+ *,
+ accept_host_permissions: bool = False,
+ ) -> DshPluginInventory:
+ if not accept_host_permissions:
+ raise DshPluginApprovalRequired(
+ "DSH packages can run install scripts and runtime code with host privileges; "
+ "explicit approval is required"
+ )
+ self._validate_source(source)
+ with self._profile_transaction(exclusive=True):
+ self._require_package_mutation_rollback(new_profile_allowed=True)
+ snapshot = self._snapshot()
+ before = (
+ self._dependencies(self._read_manifest()) if self._manifest_path().is_file() else {}
+ )
+ try:
+ if self._manifest_path().is_file():
+ existing_manifest = self._read_manifest()
+ self._verify_source_receipts(
+ existing_manifest, self._read_state(existing_manifest)
+ )
+ prepared = self._prepare_source(source)
+ self._plugin_command("add", prepared.command_source)
+ manifest = self._read_manifest()
+ added = [name for name in self._dependencies(manifest) if name not in before]
+ if len(added) != 1:
+ raise DshPluginMutationError(
+ "installing one DSH plugin must add exactly one direct dependency"
+ )
+ name = added[0]
+ self._require_bundle(name)
+ state = self._read_state(manifest)
+ state["order"] = [item for item in state["order"] if item != name] + [name]
+ if name not in state["disabled"]:
+ state["disabled"].append(name)
+ if prepared.digest:
+ state["sources"][name] = {
+ "digest": prepared.digest,
+ "kind": prepared.kind,
+ "artifact": prepared.artifact,
+ "dependency_spec": self._dependencies(manifest)[name],
+ }
+ self._write_state(state)
+ self._write_active_bundles(manifest, state)
+ self._preflight()
+ return self.get_plugin(name)
+ except BaseException as error:
+ self._rollback(snapshot, error)
+ raise
+
+ def set_enabled(self, name: str, *, enabled: bool) -> DshPluginInventory:
+ self._validate_package_name(name)
+ with self._profile_transaction(exclusive=True):
+ snapshot = self._snapshot()
+ try:
+ manifest = self._read_manifest()
+ if name not in self._dependencies(manifest):
+ raise DshPluginNotFoundError(f"DSH plugin {name!r} is not installed")
+ self._require_bundle(name)
+ state = self._read_state(manifest)
+ self._verify_source_receipts(manifest, state, names=(name,))
+ if name not in state["order"]:
+ state["order"].append(name)
+ if enabled:
+ state["disabled"] = [item for item in state["disabled"] if item != name]
+ elif name not in state["disabled"]:
+ state["disabled"].append(name)
+ self._write_state(state)
+ self._write_active_bundles(manifest, state)
+ self._preflight()
+ return self.get_plugin(name)
+ except BaseException as error:
+ self._rollback(snapshot, error)
+ raise
+
+ def update_plugin(
+ self,
+ name: str,
+ *,
+ source: str | None = None,
+ accept_host_permissions: bool = False,
+ ) -> DshPluginInventory:
+ self._validate_package_name(name)
+ if not accept_host_permissions:
+ raise DshPluginApprovalRequired(
+ "updating a DSH package requires host permission approval"
+ )
+ with self._profile_transaction(exclusive=True):
+ self._require_package_mutation_rollback(new_profile_allowed=False)
+ snapshot = self._snapshot()
+ try:
+ self.get_plugin(name)
+ before_manifest = self._read_manifest()
+ before_state = self._read_state(before_manifest)
+ self._verify_source_receipts(before_manifest, before_state, names=(name,))
+ existing_source = before_state["sources"].get(name)
+ if existing_source is not None and source is None:
+ raise DshPluginMutationError(
+ "updating an immutable local DSH plugin requires an explicit source"
+ )
+ prepared = None
+ if source is not None:
+ self._validate_source(source)
+ prepared = self._prepare_source(source)
+ if not prepared.digest:
+ raise DshPluginMutationError(
+ "an explicit update source must be a local directory or tgz"
+ )
+ self._plugin_command("add", prepared.command_source)
+ else:
+ self._plugin_command("update", name)
+ manifest = self._read_manifest()
+ if prepared is not None:
+ changed = {
+ dependency
+ for dependency in (
+ set(self._dependencies(before_manifest))
+ | set(self._dependencies(manifest))
+ )
+ if self._dependencies(before_manifest).get(dependency)
+ != self._dependencies(manifest).get(dependency)
+ }
+ if changed != {name}:
+ raise DshPluginMutationError(
+ "updated local source must replace exactly the selected plugin"
+ )
+ self._require_bundle(name)
+ state = self._read_state(manifest)
+ if prepared is not None:
+ if name not in self._dependencies(manifest):
+ raise DshPluginMutationError(
+ "updated local source did not preserve the plugin package name"
+ )
+ state["sources"][name] = {
+ "digest": prepared.digest,
+ "kind": prepared.kind,
+ "artifact": prepared.artifact,
+ "dependency_spec": self._dependencies(manifest)[name],
+ }
+ self._write_state(state)
+ self._write_active_bundles(manifest, state)
+ self._verify_source_receipts(manifest, state, names=(name,))
+ self._preflight()
+ return self.get_plugin(name)
+ except BaseException as error:
+ self._rollback(snapshot, error)
+ raise
+
+ def uninstall_plugin(self, name: str) -> None:
+ self._validate_package_name(name)
+ with self._profile_transaction(exclusive=True):
+ self._require_package_mutation_rollback(new_profile_allowed=False)
+ snapshot = self._snapshot()
+ try:
+ self.get_plugin(name)
+ self._plugin_command("remove", name)
+ manifest = self._read_manifest()
+ state = self._read_state(manifest)
+ state["order"] = [item for item in state["order"] if item != name]
+ state["disabled"] = [item for item in state["disabled"] if item != name]
+ state["sources"].pop(name, None)
+ self._write_state(state)
+ self._write_active_bundles(manifest, state)
+ self._preflight()
+ if any(item.name == name for item in self.list_plugins()):
+ raise DshPluginMutationError("DSH host still reports the removed plugin")
+ except BaseException as error:
+ self._rollback(snapshot, error)
+ raise
+
+ def project_profile(self) -> DshProfileProjection:
+ """Validate the native profile and expose only its digest, never raw config."""
+
+ with self._profile_transaction(exclusive=False):
+ self._ensure_started()
+ manifest = self._read_manifest()
+ self._verify_source_receipts(manifest, self._read_state(manifest))
+ result = self._preflight()
+ payload = result.stdout.encode("utf-8")
+ return DshProfileProjection(
+ profile=self._profile,
+ bundles=tuple(self._bundles(manifest)),
+ config_digest=f"sha256:{hashlib.sha256(payload).hexdigest()}",
+ config_bytes=len(payload),
+ host_version=self.host.version,
+ )
+
+ def read_client_bundle(self, name: str, *, expected_digest: str) -> bytes:
+ """Read one immutable browser artifact after revalidating Profile inventory."""
+
+ with self._profile_transaction(exclusive=False):
+ return self._read_client_bundle_locked(name, expected_digest=expected_digest)
+
+ def _read_client_bundle_locked(self, name: str, *, expected_digest: str) -> bytes:
+ item = self.get_plugin(name)
+ if not item.enabled:
+ raise DshPluginNotFoundError(f"DSH plugin {name!r} is disabled")
+ client = item.client_bundle
+ if client is None or not client.compatible:
+ raise DshPluginNotFoundError(
+ f"DSH plugin {name!r} has no Studio-compatible client bundle"
+ )
+ if client.digest != expected_digest:
+ raise DshPluginMutationError("DSH client bundle digest fence does not match")
+ package = self._read_package(name)
+ assert package is not None
+ path = self._client_bundle_path(name, package)
+ if path is None:
+ raise DshPluginNotFoundError(f"DSH plugin {name!r} client bundle is unavailable")
+ try:
+ content = path.read_bytes()
+ except OSError as error:
+ raise DshPluginMutationError("DSH client bundle became unreadable") from error
+ actual_digest = f"sha256:{hashlib.sha256(content).hexdigest()}"
+ if actual_digest != expected_digest:
+ raise DshPluginMutationError("DSH client bundle changed after inventory projection")
+ return content
+
+ def _resolve_command(self) -> tuple[str, ...]:
+ if self._command is not None:
+ return self._command
+ executable = shutil.which("dsh")
+ if executable is None:
+ raise DshHostUnavailableError(
+ "DSH host is not installed; configure an exact DSH executable "
+ "before using the bridge"
+ )
+ return (executable,)
+
+ def _ensure_started(self) -> None:
+ if self._host is None or self._command is None:
+ raise DshHostUnavailableError("DSH bridge is not started")
+
+ @contextmanager
+ def _profile_transaction(self, *, exclusive: bool) -> Iterator[None]:
+ """Serialize one Profile snapshot across bridge objects and processes."""
+
+ with self._lock:
+ depth = int(getattr(self._transaction_local, "depth", 0))
+ held_exclusive = bool(getattr(self._transaction_local, "exclusive", False))
+ if depth:
+ if exclusive and not held_exclusive:
+ raise DshPluginMutationError(
+ "cannot upgrade a DSH profile read transaction to a mutation"
+ )
+ self._transaction_local.depth = depth + 1
+ try:
+ yield
+ finally:
+ self._transaction_local.depth = depth
+ return
+
+ if fcntl is None:
+ raise DshHostUnavailableError("DSH profile transactions require Unix file locking")
+ lock_root = self._dsh_home / _PROFILE_LOCK_DIR
+ lock_root.mkdir(parents=True, exist_ok=True, mode=0o700)
+ if lock_root.resolve() != lock_root:
+ raise DshPluginMutationError("DSH profile lock directory is not trusted")
+ lock_path = lock_root / f"{self._profile}.lock"
+ flags = os.O_CREAT | os.O_RDWR
+ if hasattr(os, "O_NOFOLLOW"):
+ flags |= os.O_NOFOLLOW
+ try:
+ descriptor = os.open(lock_path, flags, 0o600)
+ except OSError as error:
+ raise DshPluginMutationError(
+ "DSH profile transaction lock is unavailable"
+ ) from error
+ try:
+ metadata = os.fstat(descriptor)
+ if not stat.S_ISREG(metadata.st_mode):
+ raise DshPluginMutationError(
+ "DSH profile transaction lock is not a regular file"
+ )
+ os.fchmod(descriptor, 0o600)
+ fcntl.flock(
+ descriptor,
+ fcntl.LOCK_EX if exclusive else fcntl.LOCK_SH,
+ )
+ self._transaction_local.depth = 1
+ self._transaction_local.exclusive = exclusive
+ try:
+ yield
+ finally:
+ self._transaction_local.depth = 0
+ self._transaction_local.exclusive = False
+ fcntl.flock(descriptor, fcntl.LOCK_UN)
+ finally:
+ os.close(descriptor)
+
+ def _invoke(self, command: Sequence[str], *, cwd: Path) -> _CommandResult:
+ environment = dsh_subprocess_environment(dsh_home=self._dsh_home)
+ try:
+ return self._runner(tuple(command), cwd, environment)
+ except DshBridgeError:
+ raise
+ except Exception as error:
+ raise DshHostUnavailableError("DSH host command could not be executed") from error
+
+ def _plugin_command(self, verb: str, value: str) -> _CommandResult:
+ self._ensure_started()
+ assert self._command is not None
+ return self._invoke(
+ (*self._command, "plugin", "--profile", self._profile, verb, value),
+ cwd=self._cwd,
+ )
+
+ def _preflight(self) -> _CommandResult:
+ self._ensure_started()
+ assert self._command is not None
+ return self._invoke(
+ (*self._command, "--profile", self._profile, "--dump-config"),
+ cwd=self._cwd,
+ )
+
+ def _manifest_path(self) -> Path:
+ return self._profile_root / "package.json"
+
+ def _read_manifest(self) -> dict[str, object]:
+ return self._read_json(self._manifest_path(), required=True)
+
+ def _read_package(self, name: str) -> dict[str, object] | None:
+ return self._read_json(
+ self._profile_root / "node_modules" / Path(*name.split("/")) / "package.json",
+ required=False,
+ )
+
+ @staticmethod
+ def _read_json(path: Path, *, required: bool) -> dict[str, object] | None:
+ try:
+ if path.stat().st_size > _MAX_JSON_BYTES:
+ raise DshBridgeError("DSH manifest exceeds the supported size limit")
+ payload = json.loads(path.read_text(encoding="utf-8"))
+ except FileNotFoundError:
+ if required:
+ raise DshBridgeError("required DSH profile manifest is unavailable") from None
+ return None
+ except (OSError, UnicodeError, json.JSONDecodeError) as error:
+ raise DshBridgeError("DSH profile contains an unreadable JSON manifest") from error
+ if not isinstance(payload, dict):
+ raise DshBridgeError("DSH JSON manifest must be an object")
+ return payload
+
+ @staticmethod
+ def _dependencies(manifest: Mapping[str, object]) -> dict[str, str]:
+ raw = manifest.get("dependencies")
+ if raw is None:
+ return {}
+ if not isinstance(raw, dict) or any(
+ not isinstance(name, str) or not isinstance(value, str) for name, value in raw.items()
+ ):
+ raise DshBridgeError("DSH profile dependencies are invalid")
+ return dict(raw)
+
+ @staticmethod
+ def _bundles(manifest: Mapping[str, object]) -> list[str]:
+ dsh = manifest.get("dsh")
+ profile = dsh.get("profile") if isinstance(dsh, dict) else None
+ bundles = profile.get("bundles") if isinstance(profile, dict) else None
+ if bundles is None:
+ return []
+ if not isinstance(bundles, list) or any(not isinstance(item, str) for item in bundles):
+ raise DshBridgeError("DSH profile bundle order is invalid")
+ return list(bundles)
+
+ @staticmethod
+ def _bundle_patch(package: Mapping[str, object]) -> str | None:
+ dsh = package.get("dsh")
+ bundle = dsh.get("bundle") if isinstance(dsh, dict) else None
+ patch = bundle.get("patch") if isinstance(bundle, dict) else None
+ return patch.strip() if isinstance(patch, str) and patch.strip() else None
+
+ @staticmethod
+ def _client_declaration(package: Mapping[str, object]) -> Mapping[str, object] | None:
+ dsh = package.get("dsh")
+ client = dsh.get("client") if isinstance(dsh, dict) else None
+ return client if isinstance(client, dict) else None
+
+ @staticmethod
+ def _string_tuple(value: object) -> tuple[str, ...] | None:
+ if value is None:
+ return ()
+ if not isinstance(value, list) or any(not isinstance(item, str) for item in value):
+ return None
+ return tuple(value)
+
+ @staticmethod
+ def _client_export(package: Mapping[str, object]) -> str | None:
+ exports = package.get("exports")
+ client = exports.get("./client") if isinstance(exports, dict) else None
+ if isinstance(client, str):
+ return client
+ default = client.get("default") if isinstance(client, dict) else None
+ return default if isinstance(default, str) else None
+
+ def _client_bundle_path(
+ self, name: str, package: Mapping[str, object]
+ ) -> Path | None:
+ declared = self._client_export(package)
+ if not declared:
+ return None
+ relative = Path(declared)
+ if relative.is_absolute() or ".." in relative.parts:
+ return None
+ root = (self._profile_root / "node_modules" / Path(*name.split("/"))).resolve()
+ target = (root / relative).resolve()
+ if not target.is_relative_to(root) or not target.is_file():
+ return None
+ return target
+
+ def _client_bundle_metadata(
+ self, name: str, package: Mapping[str, object]
+ ) -> DshClientBundle | None:
+ declaration = self._client_declaration(package)
+ if declaration is None or declaration.get("platform") != "web":
+ return None
+ inject = self._string_tuple(declaration.get("inject"))
+ external = self._string_tuple(declaration.get("external"))
+ target = self._client_bundle_path(name, package)
+ reason = ""
+ if inject is None or external is None:
+ reason = "dsh.client inject/external must be string arrays"
+ elif target is None:
+ reason = "exports[./client] does not resolve to a built bundle"
+ elif inject:
+ reason = "client bundle dependencies are not present in the Studio graph"
+ elif any(item not in _STUDIO_CLIENT_EXTERNALS for item in external):
+ reason = "client bundle requests unsupported external modules"
+ if target is None:
+ return DshClientBundle(
+ digest="",
+ content_bytes=0,
+ inject=inject or (),
+ external=external or (),
+ compatible=False,
+ incompatibility_reason=reason,
+ )
+ try:
+ size = target.stat().st_size
+ if size > _MAX_CLIENT_BUNDLE_BYTES:
+ reason = "client bundle exceeds the supported size limit"
+ content = b""
+ else:
+ content = target.read_bytes()
+ except OSError:
+ size = 0
+ content = b""
+ reason = "client bundle is unreadable"
+ return DshClientBundle(
+ digest=f"sha256:{hashlib.sha256(content).hexdigest()}" if content else "",
+ content_bytes=size,
+ inject=inject or (),
+ external=external or (),
+ compatible=not reason,
+ incompatibility_reason=reason,
+ )
+
+ def _require_bundle(self, name: str) -> None:
+ package = self._read_package(name)
+ patch = self._bundle_patch(package or {})
+ if package is None or patch is None:
+ raise DshPluginMutationError(f"{name} does not declare dsh.bundle.patch")
+ relative = Path(patch)
+ if relative.is_absolute() or ".." in relative.parts:
+ raise DshPluginMutationError(f"{name} declares an unsafe bundle patch path")
+ root = (self._profile_root / "node_modules" / Path(*name.split("/"))).resolve()
+ target = (root / relative).resolve()
+ if not target.is_relative_to(root) or not target.is_file():
+ raise DshPluginMutationError(f"{name} bundle patch is unavailable")
+
+ def _read_state(self, manifest: Mapping[str, object]) -> _ProfileState:
+ dependencies = set(self._dependencies(manifest))
+ bundle_dependencies = [
+ name
+ for name in dependencies
+ if self._bundle_patch(self._read_package(name) or {}) is not None
+ ]
+ active = [name for name in self._bundles(manifest) if name in dependencies]
+ stored = self._read_json(self._profile_root / _STATE_FILE, required=False) or {}
+ order_raw = stored.get("order")
+ disabled_raw = stored.get("disabled")
+ sources_raw = stored.get("sources")
+ order = (
+ [item for item in order_raw if isinstance(item, str) and item in bundle_dependencies]
+ if isinstance(order_raw, list)
+ else []
+ )
+ for name in [*active, *bundle_dependencies]:
+ if name not in order:
+ order.append(name)
+ disabled = (
+ [item for item in disabled_raw if isinstance(item, str) and item in bundle_dependencies]
+ if isinstance(disabled_raw, list)
+ else [name for name in bundle_dependencies if name not in active]
+ )
+ sources: dict[str, _SourceReceipt] = {}
+ if isinstance(sources_raw, dict):
+ for name, raw in sources_raw.items():
+ if name not in bundle_dependencies:
+ continue
+ if not isinstance(raw, dict):
+ raise DshPluginMutationError("DSH local source receipt is invalid")
+ digest = raw.get("digest")
+ kind = raw.get("kind")
+ artifact = raw.get("artifact")
+ dependency_spec = raw.get("dependencySpec") or raw.get("dependency_spec")
+ if (
+ isinstance(digest, str)
+ and re.fullmatch(r"sha256:[0-9a-f]{64}", digest)
+ and kind in {"directory", "tgz"}
+ and isinstance(artifact, str)
+ and isinstance(dependency_spec, str)
+ ):
+ sources[name] = {
+ "digest": digest,
+ "kind": kind,
+ "artifact": artifact,
+ "dependency_spec": dependency_spec,
+ }
+ else:
+ raise DshPluginMutationError("DSH local source receipt is invalid")
+ return {"order": order, "disabled": disabled, "sources": sources}
+
+ def _write_state(self, state: _ProfileState) -> None:
+ self._write_json(
+ self._profile_root / _STATE_FILE,
+ {
+ "version": 2,
+ "order": list(state["order"]),
+ "disabled": list(state["disabled"]),
+ "sources": {
+ name: {
+ "digest": receipt["digest"],
+ "kind": receipt["kind"],
+ "artifact": receipt["artifact"],
+ "dependencySpec": receipt["dependency_spec"],
+ }
+ for name, receipt in sorted(state["sources"].items())
+ },
+ },
+ )
+
+ def _write_active_bundles(
+ self,
+ manifest: dict[str, object],
+ state: _ProfileState,
+ ) -> None:
+ dependencies = set(self._dependencies(manifest))
+ existing = self._bundles(manifest)
+ builtins = [name for name in existing if name not in dependencies]
+ disabled = set(state["disabled"])
+ enabled = [name for name in state["order"] if name in dependencies and name not in disabled]
+ dsh = manifest.get("dsh") if isinstance(manifest.get("dsh"), dict) else {}
+ assert isinstance(dsh, dict)
+ profile = dsh.get("profile") if isinstance(dsh.get("profile"), dict) else {}
+ assert isinstance(profile, dict)
+ profile["bundles"] = [*builtins, *enabled]
+ dsh["profile"] = profile
+ manifest["dsh"] = dsh
+ self._write_json(self._manifest_path(), manifest)
+
+ def _prepare_source(self, source: str) -> _PreparedSource:
+ value = source.strip()
+ candidate = Path(value).expanduser()
+ if not candidate.is_absolute() or not candidate.exists():
+ return _PreparedSource(value, "", "tgz", "")
+ local = candidate.resolve()
+ with tempfile.TemporaryDirectory(prefix="agentengine-dsh-source-") as directory:
+ if local.is_dir():
+ # Import lazily: dsh_toolchain owns the pinned pnpm workflow and
+ # imports this bridge for validation.
+ from ksadk.plugins.dsh_toolchain import ( # noqa: PLC0415
+ DshPluginDeveloper,
+ DshToolchainManager,
+ )
+
+ output = Path(directory)
+ packed = DshPluginDeveloper(toolchain=DshToolchainManager()).pack(
+ local, output_dir=output
+ )
+ archive = Path(packed.artifact)
+ kind: Literal["directory", "tgz"] = "directory"
+ elif local.is_file() and local.name.endswith(".tgz"):
+ archive = local
+ kind = "tgz"
+ else:
+ raise DshPluginMutationError(
+ "local DSH plugin source must be a directory or .tgz archive"
+ )
+ try:
+ content = archive.read_bytes()
+ except OSError as error:
+ raise DshPluginMutationError("local DSH plugin source is unreadable") from error
+ digest_hex = hashlib.sha256(content).hexdigest()
+ digest = f"sha256:{digest_hex}"
+ root = (self._dsh_home / _IMMUTABLE_SOURCE_DIR / digest_hex).resolve()
+ expected_parent = (self._dsh_home / _IMMUTABLE_SOURCE_DIR).resolve()
+ if root.parent != expected_parent:
+ raise DshPluginMutationError("immutable DSH source path escaped its store")
+ target = root / "package.tgz"
+ root.mkdir(parents=True, exist_ok=True, mode=0o700)
+ if target.exists():
+ if hashlib.sha256(target.read_bytes()).hexdigest() != digest_hex:
+ raise DshPluginMutationError(
+ "immutable DSH source store contains a digest collision"
+ )
+ else:
+ temporary = root / f".package.{os.getpid()}.tmp"
+ try:
+ temporary.write_bytes(content)
+ temporary.chmod(0o400)
+ os.replace(temporary, target)
+ finally:
+ temporary.unlink(missing_ok=True)
+ target.chmod(0o400)
+ relative = target.relative_to(self._dsh_home).as_posix()
+ return _PreparedSource(str(target), digest, kind, relative)
+
+ def _verify_source_receipts(
+ self,
+ manifest: Mapping[str, object],
+ state: _ProfileState,
+ *,
+ names: Sequence[str] | None = None,
+ ) -> None:
+ dependencies = self._dependencies(manifest)
+ for name, spec in dependencies.items():
+ if _IMMUTABLE_SOURCE_DIR in spec and name not in state["sources"]:
+ raise DshPluginMutationError(
+ f"DSH plugin {name!r} is missing its immutable source receipt"
+ )
+ selected = names if names is not None else tuple(state["sources"])
+ store = (self._dsh_home / _IMMUTABLE_SOURCE_DIR).resolve()
+ for name in selected:
+ receipt = state["sources"].get(name)
+ if receipt is None:
+ continue
+ if dependencies.get(name) != receipt["dependency_spec"]:
+ raise DshPluginMutationError(
+ f"DSH plugin {name!r} dependency no longer matches its source receipt"
+ )
+ artifact = (self._dsh_home / receipt["artifact"]).resolve()
+ if not artifact.is_relative_to(store) or not artifact.is_file():
+ raise DshPluginMutationError(
+ f"DSH plugin {name!r} immutable source is unavailable"
+ )
+ try:
+ actual = f"sha256:{hashlib.sha256(artifact.read_bytes()).hexdigest()}"
+ except OSError as error:
+ raise DshPluginMutationError(
+ f"DSH plugin {name!r} immutable source is unreadable"
+ ) from error
+ if actual != receipt["digest"]:
+ raise DshPluginMutationError(
+ f"DSH plugin {name!r} immutable source digest changed"
+ )
+
+ @staticmethod
+ def _write_json(path: Path, payload: object) -> None:
+ path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+ descriptor, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+ try:
+ with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+ json.dump(payload, handle, ensure_ascii=False, indent=2)
+ handle.write("\n")
+ handle.flush()
+ os.fsync(handle.fileno())
+ os.chmod(temporary, 0o600)
+ os.replace(temporary, path)
+ finally:
+ try:
+ os.unlink(temporary)
+ except FileNotFoundError:
+ pass
+
+ def _snapshot(self) -> dict[str, bytes | None]:
+ snapshot: dict[str, bytes | None] = {}
+ for name in _SNAPSHOT_FILES:
+ path = self._profile_root / name
+ try:
+ snapshot[name] = path.read_bytes()
+ except FileNotFoundError:
+ snapshot[name] = None
+ return snapshot
+
+ def _require_package_mutation_rollback(self, *, new_profile_allowed: bool) -> None:
+ """Reject package mutations unless their filesystem effects are reversible."""
+
+ if not self._profile_root.exists():
+ if new_profile_allowed:
+ return
+ raise DshPluginNotFoundError(f"DSH profile {self._profile!r} is not initialized")
+ if not self._manifest_path().is_file():
+ raise DshPluginMutationError(
+ "existing DSH profile directory has no package manifest; refusing to mutate it"
+ )
+ if not (self._profile_root / "pnpm-lock.yaml").is_file():
+ raise DshPluginMutationError(
+ "existing DSH profile has no pnpm lockfile, so package rollback is unavailable"
+ )
+
+ def _rollback(self, snapshot: Mapping[str, bytes | None], original: BaseException) -> None:
+ try:
+ if all(content is None for content in snapshot.values()):
+ profiles_root = (self._dsh_home / "profiles").resolve()
+ profile_root = self._profile_root.resolve()
+ if profile_root.parent != profiles_root:
+ raise DshPluginMutationError("refusing to clean an untrusted DSH profile path")
+ if profile_root.exists():
+ shutil.rmtree(profile_root, ignore_errors=False)
+ return
+ self._profile_root.mkdir(parents=True, exist_ok=True, mode=0o700)
+ for name, content in snapshot.items():
+ path = self._profile_root / name
+ if content is None:
+ path.unlink(missing_ok=True)
+ else:
+ path.write_bytes(content)
+ path.chmod(0o600)
+ if snapshot.get("pnpm-lock.yaml") is not None and self._manifest_path().is_file():
+ self._plugin_command("install", "--frozen-lockfile")
+ for name in ("package.json", _STATE_FILE):
+ content = snapshot.get(name)
+ path = self._profile_root / name
+ if content is None:
+ path.unlink(missing_ok=True)
+ else:
+ path.write_bytes(content)
+ path.chmod(0o600)
+ except BaseException as rollback_error:
+ raise DshPluginMutationError(
+ "DSH plugin mutation failed and profile rollback also failed"
+ ) from rollback_error
+ if isinstance(original, DshBridgeError):
+ return
+
+ @staticmethod
+ def _validate_source(source: str) -> None:
+ value = source.strip()
+ if (
+ not value
+ or len(value) > 2048
+ or value.startswith("-")
+ or any(character in source for character in ("\r", "\n", "\0"))
+ or value in {".", ".."}
+ or value.startswith(("file:", "link:"))
+ or value.startswith(("./", "../", "file:./", "file:../", "link:./", "link:../"))
+ ):
+ raise ValueError("DSH plugin source must be a package, Git URL, or absolute local path")
+
+ @staticmethod
+ def _validate_package_name(name: str) -> None:
+ if not _PACKAGE_NAME.fullmatch(name):
+ raise ValueError("invalid DSH plugin package name")
+
+ @staticmethod
+ def _string(value: object) -> str:
+ return value if isinstance(value, str) else ""
+
+ @staticmethod
+ def _run_command(
+ command: Sequence[str],
+ cwd: Path,
+ environment: Mapping[str, str],
+ ) -> _CommandResult:
+ try:
+ completed = subprocess.run(
+ list(command),
+ cwd=cwd,
+ env=dict(environment),
+ check=False,
+ capture_output=True,
+ text=True,
+ timeout=120,
+ )
+ except (OSError, subprocess.TimeoutExpired) as error:
+ raise DshHostUnavailableError("DSH host command did not complete") from error
+ if completed.returncode != 0:
+ diagnostic = _redact_diagnostic(completed.stderr or completed.stdout)
+ raise DshPluginMutationError(
+ f"DSH host command failed with exit code {completed.returncode}"
+ + (f": {diagnostic[-2000:]}" if diagnostic else "")
+ )
+ return _CommandResult(stdout=completed.stdout, stderr=completed.stderr)
+
+
+def _redact_diagnostic(value: str) -> str:
+ value = re.sub(r"(https?://)[^/\s:@]+:[^/\s@]+@", r"\1[redacted]@", value, flags=re.I)
+ return re.sub(
+ r"((?:token|password|authorization|_authToken)\s*[:=]\s*)[^\s]+",
+ r"\1[redacted]",
+ value,
+ flags=re.I,
+ ).strip()
+
+
+__all__ = [
+ "DshBridgeError",
+ "DshBridgeHost",
+ "DshClientBundle",
+ "DshHostUnavailableError",
+ "DshPluginApprovalRequired",
+ "DshPluginInventory",
+ "DshPluginMutationError",
+ "DshPluginNotFoundError",
+ "DshProfilePluginBridge",
+ "DshProfileProjection",
+ "dsh_subprocess_environment",
+]
diff --git a/ksadk/plugins/builtins.py b/ksadk/plugins/builtins.py
new file mode 100644
index 00000000..9618dbc2
--- /dev/null
+++ b/ksadk/plugins/builtins.py
@@ -0,0 +1,747 @@
+"""Built-in capability runtimes for immutable AgentBundle execution.
+
+These plugins deliberately consume only the already validated
+``ResolvedPluginBundle`` plus explicit process services supplied at host
+construction. They never reach back into Studio's mutable catalogs. The
+module also keeps rendering as a projection of the canonical ConversationItem
+contract; it does not introduce another event or transcript pipeline.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from collections.abc import Callable, Mapping, Sequence
+from pathlib import Path, PurePosixPath
+from typing import Any, cast
+
+from ksadk.conversations.contracts import ConversationItem
+from ksadk.events.session_event import SessionServiceEventStore
+from ksadk.harness.config import McpToolSpec
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import (
+ CompositionProfile,
+ PluginManifest,
+ plugin_lock_digest,
+)
+from ksadk.plugins.host import PluginHostError
+from ksadk.plugins.providers.harness import HarnessSkillContribution, HarnessTurnRequest
+from ksadk.plugins.resolver import composition_profile_digest
+from ksadk.sessions.base import BaseSessionService
+from ksadk.sessions.local_service import LocalSessionService
+
+BUILTIN_PLUGIN_VERSION = "1.0.0"
+
+SQLITE_SESSION_STORE_PLUGIN_ID = "io.ksadk.session-store.sqlite"
+WORKSPACE_MCP_PLUGIN_ID = "io.ksadk.mcp.workspace"
+WORKSPACE_SKILL_PLUGIN_ID = "io.ksadk.skill.workspace"
+READ_ONLY_CONTEXT_PLUGIN_ID = "io.ksadk.context.bundle-readonly"
+CORE_RENDERER_PLUGIN_ID = "io.ksadk.renderer.conversation-core"
+
+SecretResolver = Callable[[str], str | None]
+
+
+def _manifest_digest(plugin_id: str) -> str:
+ payload = f"{plugin_id}@{BUILTIN_PLUGIN_VERSION}:builtin-runtime-v1".encode()
+ return f"sha256:{hashlib.sha256(payload).hexdigest()}"
+
+
+def _manifest(
+ plugin_id: str,
+ *,
+ definition: str,
+ slot: str,
+ mode: str,
+ permissions: Sequence[str] = (),
+ secret_fields: Sequence[str] = (),
+) -> PluginManifest:
+ return cast(
+ PluginManifest,
+ PluginManifest.model_validate(
+ {
+ "metadata": {"id": plugin_id, "version": BUILTIN_PLUGIN_VERSION},
+ "spec": {
+ "domain": "ksadk-platform",
+ "runtime": "python",
+ "entrypoint": "ksadk.plugins.builtins:builtin_capability_factories",
+ "provides": [
+ {"definition": definition, "slot": slot, "mode": mode}
+ ],
+ "secretFields": list(secret_fields),
+ "permissions": list(permissions),
+ "isolation": "in-process",
+ "compatibility": {
+ "kernelApi": ">=1,<2",
+ "runtimeProtocols": ["agentkit.runtime/v1"],
+ "python": ">=3.10,<3.15",
+ },
+ "healthContract": "plugin.health/v1",
+ "provenance": {
+ "source": "builtin",
+ "digest": _manifest_digest(plugin_id),
+ "license": "Apache-2.0",
+ },
+ },
+ },
+ ),
+ )
+
+
+def builtin_capability_manifests() -> tuple[PluginManifest, ...]:
+ """Return the exact, deterministic Phase 2 built-in capability catalog."""
+
+ return (
+ _manifest(
+ SQLITE_SESSION_STORE_PLUGIN_ID,
+ definition="session.event-store/v1",
+ slot="session.events",
+ mode="unique",
+ permissions=("filesystem:session-store",),
+ ),
+ _manifest(
+ WORKSPACE_MCP_PLUGIN_ID,
+ definition="mcp.connector/v1",
+ slot="mcp.workspace",
+ mode="multiple",
+ permissions=("network:mcp",),
+ secret_fields=("apiKeyRef",),
+ ),
+ _manifest(
+ WORKSPACE_SKILL_PLUGIN_ID,
+ definition="skill.source/v1",
+ slot="skill.workspace",
+ mode="multiple",
+ permissions=("filesystem:bundle-read",),
+ ),
+ _manifest(
+ READ_ONLY_CONTEXT_PLUGIN_ID,
+ definition="context.contributor/v1",
+ slot="context.bundle",
+ mode="multiple",
+ permissions=("filesystem:bundle-read",),
+ ),
+ _manifest(
+ CORE_RENDERER_PLUGIN_ID,
+ definition="session.item.renderer/v1",
+ slot="renderer.core",
+ mode="multiple",
+ ),
+ )
+
+
+class _BuiltinRuntime:
+ def __init__(self, plugin_id: str, version: str) -> None:
+ self.plugin_id = plugin_id
+ self.version = version
+ self._ready = False
+ self._disposed = False
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise PluginHostError(
+ "builtin_capability_disposed",
+ f"built-in capability {self.plugin_id}@{self.version} is disposed",
+ )
+ self._ready = True
+
+ async def health(self) -> bool:
+ return self._ready and not self._disposed
+
+ async def drain(self) -> None:
+ self._ready = False
+
+ async def dispose(self) -> None:
+ self._ready = False
+ self._disposed = True
+
+ def _require_ready(self) -> None:
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "builtin_capability_unavailable",
+ f"built-in capability {self.plugin_id}@{self.version} is not ready",
+ )
+
+ def _config(self, bundle: ResolvedPluginBundle) -> Mapping[str, Any]:
+ self._require_ready()
+ return _bound_capability_config(bundle, self.plugin_id, self.version)
+
+
+class SQLiteSessionStoreRuntime(_BuiltinRuntime):
+ """Own one durable SQLite session service for an active profile."""
+
+ def __init__(self, plugin_id: str, version: str, *, db_path: Path) -> None:
+ super().__init__(plugin_id, version)
+ self.db_path = db_path.resolve()
+ self._service: LocalSessionService | None = None
+ self._event_store: SessionServiceEventStore | None = None
+
+ async def start(self) -> None:
+ if self._disposed:
+ await super().start()
+ try:
+ self._service = LocalSessionService(self.db_path)
+ self._event_store = SessionServiceEventStore(self._service)
+ except Exception as error: # noqa: BLE001 - durable backend boundary
+ self._service = None
+ self._event_store = None
+ raise PluginHostError(
+ "builtin_session_store_start_failed",
+ "SQLite session store could not be initialized",
+ ) from error
+ self._ready = True
+
+ def session_service_for(self, bundle: ResolvedPluginBundle) -> BaseSessionService:
+ self._config(bundle)
+ if self._service is None: # pragma: no cover - protected by lifecycle
+ raise PluginHostError(
+ "builtin_capability_unavailable", "SQLite session service is unavailable"
+ )
+ return self._service
+
+ def event_store_for(self, bundle: ResolvedPluginBundle) -> SessionServiceEventStore:
+ self._config(bundle)
+ if self._event_store is None: # pragma: no cover - protected by lifecycle
+ raise PluginHostError(
+ "builtin_capability_unavailable", "SQLite event store is unavailable"
+ )
+ return self._event_store
+
+ async def dispose(self) -> None:
+ service = self._service
+ self._ready = False
+ self._disposed = True
+ if service is not None:
+ await service.aclose()
+
+
+class WorkspaceMCPRuntime(_BuiltinRuntime):
+ """Materialize locked workspace MCP resources for the Harness provider."""
+
+ def __init__(
+ self,
+ plugin_id: str,
+ version: str,
+ *,
+ secret_resolver: SecretResolver | None,
+ ) -> None:
+ super().__init__(plugin_id, version)
+ self._secret_resolver = secret_resolver
+
+ def inventory(self, bundle: ResolvedPluginBundle) -> tuple[dict[str, Any], ...]:
+ resources = self._resources(bundle)
+ inventory: list[dict[str, Any]] = []
+ for materializer, resolved in resources:
+ inventory.append(
+ {
+ "name": resolved["name"],
+ "version": resolved["version"],
+ "transport": resolved["transport"],
+ "endpointUrl": resolved.get("endpointUrl"),
+ "toolFilter": tuple(_string_list(materializer.get("toolFilter"))),
+ }
+ )
+ return tuple(inventory)
+
+ def harness_mcp_specs(
+ self, bundle: ResolvedPluginBundle
+ ) -> tuple[McpToolSpec, ...]:
+ specs: list[McpToolSpec] = []
+ for materializer, resolved in self._resources(bundle):
+ transport = _required_string(resolved, "transport", code="builtin_mcp_invalid")
+ if transport not in {"http", "sse"}:
+ raise PluginHostError(
+ "builtin_mcp_transport_unsupported",
+ f"workspace MCP {resolved['name']!r} uses unsupported transport",
+ )
+ endpoint = _required_string(
+ resolved, "endpointUrl", code="builtin_mcp_endpoint_missing"
+ )
+ secret_ref = _optional_string(materializer.get("apiKeyRef"))
+ api_key: str | None = None
+ if secret_ref is not None:
+ if not _is_secret_reference(secret_ref):
+ raise PluginHostError(
+ "builtin_mcp_secret_ref_invalid",
+ "workspace MCP apiKeyRef must be an external secret reference",
+ )
+ if self._secret_resolver is None:
+ raise PluginHostError(
+ "builtin_mcp_secret_unavailable",
+ "workspace MCP credential resolver is unavailable",
+ )
+ try:
+ api_key = self._secret_resolver(secret_ref)
+ except Exception as error: # noqa: BLE001 - secret-provider boundary
+ raise PluginHostError(
+ "builtin_mcp_secret_unavailable",
+ "workspace MCP credential could not be resolved",
+ ) from error
+ if not api_key:
+ raise PluginHostError(
+ "builtin_mcp_secret_unavailable",
+ "workspace MCP credential could not be resolved",
+ )
+ specs.append(
+ McpToolSpec(
+ name=_required_string(resolved, "name", code="builtin_mcp_invalid"),
+ url=endpoint,
+ api_key=api_key,
+ tool_filter=tuple(_string_list(materializer.get("toolFilter"))),
+ tool_name_prefix=_optional_string(
+ materializer.get("toolNamePrefix")
+ ),
+ )
+ )
+ return tuple(specs)
+
+ def _resources(
+ self, bundle: ResolvedPluginBundle
+ ) -> tuple[tuple[Mapping[str, Any], Mapping[str, Any]], ...]:
+ config = self._config(bundle)
+ declared = _resource_entries(config, expected_kind="mcp")
+ resolved = _resolved_resources(bundle, "mcpServers")
+ return tuple(
+ (
+ _mapping(entry.get("materializer"), code="builtin_mcp_invalid"),
+ _match_resource(entry, resolved, code="builtin_mcp_resource_mismatch"),
+ )
+ for entry in declared
+ )
+
+
+class WorkspaceSkillRuntime(_BuiltinRuntime):
+ """Expose integrity-checked Skill instructions copied into the Bundle."""
+
+ def harness_skill(self, bundle: ResolvedPluginBundle) -> HarnessSkillContribution:
+ config = self._config(bundle)
+ declared = _resource_entries(config, expected_kind="skill")
+ resolved = _resolved_resources(bundle, "skills")
+ contributions: list[HarnessSkillContribution] = []
+ for entry in declared:
+ item = _match_resource(
+ entry, resolved, code="builtin_skill_resource_mismatch"
+ )
+ name = _required_string(item, "name", code="builtin_skill_invalid")
+ bundle_path = _required_string(
+ item, "bundlePath", code="builtin_skill_path_invalid"
+ )
+ directory = _safe_bundle_path(
+ bundle,
+ bundle_path,
+ code="builtin_skill_path_invalid",
+ require_declared=False,
+ )
+ if not directory.is_dir() or directory.is_symlink():
+ raise PluginHostError(
+ "builtin_skill_path_invalid", f"Skill {name!r} is not a Bundle directory"
+ )
+ expected_digest = _required_string(
+ item, "digest", code="builtin_skill_invalid"
+ )
+ if _directory_digest(directory) != expected_digest:
+ raise PluginHostError(
+ "builtin_skill_digest_mismatch",
+ f"Skill {name!r} does not match its locked Bundle digest",
+ )
+ instructions = _required_string(
+ item, "instructions", code="builtin_skill_instructions_missing"
+ )
+ contributions.append(
+ HarnessSkillContribution(name=name, instructions=instructions)
+ )
+ if not contributions:
+ raise PluginHostError(
+ "builtin_skill_resource_missing", "workspace Skill has no locked resource"
+ )
+ if len(contributions) == 1:
+ return contributions[0]
+ return HarnessSkillContribution(
+ name="workspace-skills",
+ instructions="\n\n".join(
+ f"Skill {item.name}:\n{item.instructions}" for item in contributions
+ ),
+ )
+
+
+class ReadOnlyBundleContextRuntime(_BuiltinRuntime):
+ """Read declared UTF-8 context files from the immutable Bundle only."""
+
+ async def harness_context(
+ self, bundle: ResolvedPluginBundle, request: HarnessTurnRequest
+ ) -> str:
+ del request
+ config = self._config(bundle)
+ paths = _string_list(config.get("paths"))
+ max_chars = config.get("maxChars", 32_000)
+ if not isinstance(max_chars, int) or isinstance(max_chars, bool) or max_chars < 1:
+ raise PluginHostError(
+ "builtin_context_config_invalid", "maxChars must be a positive integer"
+ )
+ chunks: list[str] = []
+ remaining = max_chars
+ for relative in paths:
+ path = _safe_bundle_path(
+ bundle,
+ relative,
+ code="builtin_context_path_invalid",
+ require_declared=True,
+ )
+ if not path.is_file() or path.is_symlink():
+ raise PluginHostError(
+ "builtin_context_path_invalid",
+ f"Bundle context path is not a regular file: {relative}",
+ )
+ try:
+ text = path.read_text(encoding="utf-8").strip()
+ except (OSError, UnicodeError) as error:
+ raise PluginHostError(
+ "builtin_context_read_failed",
+ f"Bundle context file could not be read: {relative}",
+ ) from error
+ if not text or remaining == 0:
+ continue
+ chunk = text[:remaining]
+ chunks.append(chunk)
+ remaining -= len(chunk)
+ return "\n\n".join(chunks)
+
+
+class CoreConversationRendererRuntime(_BuiltinRuntime):
+ """Project canonical items into a safe core renderer view model."""
+
+ _COMPONENTS = {
+ "user_message": "markdown",
+ "assistant_text": "markdown",
+ "reasoning": "reasoning",
+ "tool_call": "tool",
+ "approval": "approval",
+ "progress": "progress",
+ "plan": "plan",
+ "goal": "goal",
+ "artifact": "artifact",
+ "a2ui": "a2ui",
+ "error": "error",
+ }
+
+ def render(self, item: ConversationItem) -> dict[str, Any]:
+ base: dict[str, Any] = {
+ "component": self._COMPONENTS.get(item.kind, "unknown"),
+ "itemId": item.item_id,
+ "lifecycle": item.lifecycle,
+ }
+ if item.kind in {"user_message", "assistant_text"}:
+ text = item.payload.get("text", "")
+ base["text"] = text if isinstance(text, str) else str(text)
+ return base
+ if item.kind == "unknown":
+ base["schemaRef"] = item.payload_schema_ref
+ base["summary"] = json.dumps(
+ item.payload,
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ default=str,
+ )[:4096]
+ return base
+ # Structured payload stays data. Consumers choose trusted local UI
+ # components; no Bundle-provided HTML or JavaScript is executed here.
+ base["payload"] = dict(item.payload)
+ base["schemaRef"] = item.payload_schema_ref
+ return base
+
+
+class SQLiteSessionStoreFactory:
+ def __init__(self, state_root: Path) -> None:
+ self._state_root = state_root.resolve()
+ self.runtime: SQLiteSessionStoreRuntime | None = None
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> SQLiteSessionStoreRuntime:
+ del services
+ _require_manifest(manifest, SQLITE_SESSION_STORE_PLUGIN_ID)
+ profile_key = composition_profile_digest(profile).removeprefix("sha256:")
+ runtime = SQLiteSessionStoreRuntime(
+ manifest.metadata.id,
+ manifest.metadata.version,
+ db_path=self._state_root / profile_key / "sessions.sqlite",
+ )
+ self.runtime = runtime
+ return runtime
+
+
+class _WorkspaceMCPFactory:
+ def __init__(self, secret_resolver: SecretResolver | None) -> None:
+ self._secret_resolver = secret_resolver
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> WorkspaceMCPRuntime:
+ del profile
+ _require_manifest(manifest, WORKSPACE_MCP_PLUGIN_ID)
+ resolver = self._secret_resolver
+ service_resolver = services.get("secret_resolver")
+ if resolver is None and callable(service_resolver):
+ resolver = service_resolver
+ return WorkspaceMCPRuntime(
+ manifest.metadata.id,
+ manifest.metadata.version,
+ secret_resolver=resolver,
+ )
+
+
+class _SimpleFactory:
+ def __init__(self, plugin_id: str, runtime_type: type[_BuiltinRuntime]) -> None:
+ self._plugin_id = plugin_id
+ self._runtime_type = runtime_type
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> _BuiltinRuntime:
+ del profile, services
+ _require_manifest(manifest, self._plugin_id)
+ return self._runtime_type(manifest.metadata.id, manifest.metadata.version)
+
+
+def builtin_capability_factories(
+ *,
+ state_root: Path,
+ secret_resolver: SecretResolver | None = None,
+) -> dict[str, Any]:
+ """Create factories with explicit state and secret-provider boundaries."""
+
+ return {
+ SQLITE_SESSION_STORE_PLUGIN_ID: SQLiteSessionStoreFactory(state_root),
+ WORKSPACE_MCP_PLUGIN_ID: _WorkspaceMCPFactory(secret_resolver),
+ WORKSPACE_SKILL_PLUGIN_ID: _SimpleFactory(
+ WORKSPACE_SKILL_PLUGIN_ID, WorkspaceSkillRuntime
+ ),
+ READ_ONLY_CONTEXT_PLUGIN_ID: _SimpleFactory(
+ READ_ONLY_CONTEXT_PLUGIN_ID, ReadOnlyBundleContextRuntime
+ ),
+ CORE_RENDERER_PLUGIN_ID: _SimpleFactory(
+ CORE_RENDERER_PLUGIN_ID, CoreConversationRendererRuntime
+ ),
+ }
+
+
+def _require_manifest(manifest: PluginManifest, plugin_id: str) -> None:
+ if (
+ manifest.metadata.id != plugin_id
+ or manifest.metadata.version != BUILTIN_PLUGIN_VERSION
+ ):
+ raise PluginHostError(
+ "builtin_manifest_mismatch",
+ f"factory cannot stage {manifest.metadata.id}@{manifest.metadata.version}",
+ )
+
+
+def _bound_capability_config(
+ bundle: ResolvedPluginBundle, plugin_id: str, version: str
+) -> Mapping[str, Any]:
+ composition = bundle.composition
+ if composition_profile_digest(composition.profile) != composition.profile_digest:
+ raise PluginHostError(
+ "plugin_bundle_profile_mutated",
+ "resolved Bundle composition profile changed after validation",
+ )
+ if plugin_lock_digest(composition.plugin_lock) != composition.plugin_lock_digest:
+ raise PluginHostError(
+ "plugin_bundle_lock_mutated",
+ "resolved Bundle plugin lock changed after validation",
+ )
+ ref = f"plugin://{plugin_id}@{version}"
+ matches = [item for item in composition.profile.capabilities if item.ref == ref]
+ if len(matches) != 1:
+ raise PluginHostError(
+ "builtin_capability_binding_missing",
+ f"resolved Bundle does not bind built-in capability {plugin_id}@{version}",
+ )
+ if not any(
+ item.id == plugin_id and item.version == version
+ for item in composition.plugin_lock.plugins
+ ):
+ raise PluginHostError(
+ "builtin_capability_lock_missing",
+ f"resolved Bundle does not lock built-in capability {plugin_id}@{version}",
+ )
+ return cast(Mapping[str, Any], matches[0].config)
+
+
+def _resource_entries(
+ config: Mapping[str, Any], *, expected_kind: str
+) -> tuple[Mapping[str, Any], ...]:
+ raw = config.get("resources")
+ if not isinstance(raw, Sequence) or isinstance(raw, (str, bytes)):
+ raise PluginHostError(
+ f"builtin_{expected_kind}_config_invalid", "resources must be an array"
+ )
+ entries: list[Mapping[str, Any]] = []
+ for item in raw:
+ entry = _mapping(item, code=f"builtin_{expected_kind}_config_invalid")
+ if entry.get("kind") != expected_kind:
+ raise PluginHostError(
+ f"builtin_{expected_kind}_resource_mismatch",
+ f"resource kind must be {expected_kind!r}",
+ )
+ for field in ("resourceId", "name", "version", "digest"):
+ _required_string(entry, field, code=f"builtin_{expected_kind}_invalid")
+ entries.append(entry)
+ return tuple(entries)
+
+
+def _resolved_resources(
+ bundle: ResolvedPluginBundle, field: str
+) -> tuple[Mapping[str, Any], ...]:
+ capabilities = _mapping(
+ bundle.resolved_agent_spec.get("capabilities"),
+ code="builtin_bundle_capabilities_missing",
+ )
+ raw = capabilities.get(field)
+ if not isinstance(raw, Sequence) or isinstance(raw, (str, bytes)):
+ raise PluginHostError(
+ "builtin_bundle_capabilities_missing", f"Bundle capabilities.{field} is missing"
+ )
+ return tuple(
+ _mapping(item, code="builtin_bundle_capabilities_invalid") for item in raw
+ )
+
+
+def _match_resource(
+ declared: Mapping[str, Any],
+ resolved: Sequence[Mapping[str, Any]],
+ *,
+ code: str,
+) -> Mapping[str, Any]:
+ name = _required_string(declared, "name", code=code)
+ version = _required_string(declared, "version", code=code)
+ digest = _required_string(declared, "digest", code=code)
+ matches = [
+ item
+ for item in resolved
+ if item.get("name") == name
+ and item.get("version") == version
+ and item.get("digest") == digest
+ ]
+ if len(matches) != 1:
+ raise PluginHostError(
+ code,
+ f"locked resource {name!r}@{version} is missing from resolved Agent spec",
+ )
+ return matches[0]
+
+
+def _safe_bundle_path(
+ bundle: ResolvedPluginBundle,
+ relative_text: str,
+ *,
+ code: str,
+ require_declared: bool,
+) -> Path:
+ relative = PurePosixPath(relative_text)
+ if relative.is_absolute() or not relative.parts or ".." in relative.parts:
+ raise PluginHostError(code, f"unsafe Bundle path: {relative_text}")
+ path = bundle.root.joinpath(*relative.parts)
+ cursor = bundle.root
+ for part in relative.parts:
+ cursor = cursor / part
+ if cursor.is_symlink():
+ raise PluginHostError(code, f"Bundle path cannot use symlinks: {relative_text}")
+ try:
+ resolved = path.resolve(strict=True)
+ resolved.relative_to(bundle.root)
+ except (OSError, ValueError) as error:
+ raise PluginHostError(code, f"Bundle path is unavailable: {relative_text}") from error
+ if require_declared and relative.as_posix() not in {
+ item.path for item in bundle.manifest.files
+ }:
+ raise PluginHostError(code, f"Bundle path is not declared: {relative_text}")
+ return cast(Path, resolved)
+
+
+def _directory_digest(directory: Path) -> str:
+ digest = hashlib.sha256()
+ for path in sorted(item for item in directory.rglob("*") if item.is_file()):
+ if path.is_symlink():
+ raise PluginHostError(
+ "builtin_skill_path_invalid", "Skill Bundle cannot contain symlinks"
+ )
+ relative = path.relative_to(directory).as_posix().encode("utf-8")
+ content = path.read_bytes()
+ digest.update(len(relative).to_bytes(4, "big"))
+ digest.update(relative)
+ digest.update(len(content).to_bytes(8, "big"))
+ digest.update(content)
+ return f"sha256:{digest.hexdigest()}"
+
+
+def _mapping(value: Any, *, code: str) -> Mapping[str, Any]:
+ if not isinstance(value, Mapping):
+ raise PluginHostError(code, "expected an object")
+ return value
+
+
+def _required_string(value: Mapping[str, Any], field: str, *, code: str) -> str:
+ text = value.get(field)
+ if not isinstance(text, str) or not text.strip():
+ raise PluginHostError(code, f"{field} must be a non-empty string")
+ return text.strip()
+
+
+def _optional_string(value: Any) -> str | None:
+ if value is None:
+ return None
+ if not isinstance(value, str):
+ raise PluginHostError(
+ "builtin_config_invalid", "optional configuration value must be a string"
+ )
+ return value.strip() or None
+
+
+def _string_list(value: Any) -> tuple[str, ...]:
+ if value is None:
+ return ()
+ if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+ raise PluginHostError("builtin_config_invalid", "configuration value must be an array")
+ result: list[str] = []
+ for item in value:
+ if not isinstance(item, str) or not item.strip():
+ raise PluginHostError(
+ "builtin_config_invalid", "array entries must be non-empty strings"
+ )
+ result.append(item.strip())
+ return tuple(result)
+
+
+def _is_secret_reference(value: str) -> bool:
+ return value.startswith(("secret://", "env://", "credential://", "vault://"))
+
+
+__all__ = [
+ "BUILTIN_PLUGIN_VERSION",
+ "CORE_RENDERER_PLUGIN_ID",
+ "READ_ONLY_CONTEXT_PLUGIN_ID",
+ "SQLITE_SESSION_STORE_PLUGIN_ID",
+ "WORKSPACE_MCP_PLUGIN_ID",
+ "WORKSPACE_SKILL_PLUGIN_ID",
+ "CoreConversationRendererRuntime",
+ "ReadOnlyBundleContextRuntime",
+ "SQLiteSessionStoreFactory",
+ "SQLiteSessionStoreRuntime",
+ "WorkspaceMCPRuntime",
+ "WorkspaceSkillRuntime",
+ "builtin_capability_factories",
+ "builtin_capability_manifests",
+]
diff --git a/ksadk/plugins/bundle.py b/ksadk/plugins/bundle.py
new file mode 100644
index 00000000..ab7f8d95
--- /dev/null
+++ b/ksadk/plugins/bundle.py
@@ -0,0 +1,246 @@
+"""Resolve the plugin composition embedded in an AgentBundle v2 directory.
+
+``BundleManifest`` remains the single wire contract owned by Studio. This
+module only creates a runtime view after the existing manifest, file digests,
+composition profile, and plugin lock have been checked against one another and
+against the selected :class:`PluginRegistry`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from types import MappingProxyType
+from typing import Any, Mapping
+
+from pydantic import ValidationError
+
+from ksadk.plugins.bundle_security import BundleSecurityError, assert_bundle_security
+from ksadk.plugins.contracts import CompositionProfile, PluginLock
+from ksadk.plugins.resolver import PluginRegistry, PluginResolutionError, ResolvedComposition
+from ksadk.studio.contracts import BundleManifest
+
+
+class PluginBundleError(ValueError):
+ """Stable rejection while loading the plugin portion of a Bundle v2."""
+
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+@dataclass(frozen=True)
+class ResolvedPluginBundle:
+ """Validated runtime view of existing AgentBundle v2 artifacts.
+
+ This deliberately is not another serializable bundle contract. Providers
+ receive the already-resolved composition and the immutable resolved Agent
+ spec; they do not re-read mutable Studio state.
+ """
+
+ root: Path
+ manifest: BundleManifest
+ resolved_agent_spec: Mapping[str, Any]
+ composition: ResolvedComposition
+
+ @property
+ def bundle_digest(self) -> str:
+ return str(self.manifest.bundle_digest)
+
+
+class PluginBundleResolver:
+ """Load and cross-check the composition artifacts of an AgentBundle v2."""
+
+ def __init__(self, registry: PluginRegistry) -> None:
+ self._registry = registry
+
+ def resolve(self, root: str | Path) -> ResolvedPluginBundle:
+ bundle_root = Path(root).resolve()
+ if not bundle_root.is_dir():
+ raise PluginBundleError(
+ "plugin_bundle_unavailable",
+ f"AgentBundle directory does not exist: {bundle_root}",
+ )
+
+ manifest_payload = self._read_json(bundle_root, "manifest.json")
+ try:
+ manifest = BundleManifest.model_validate(manifest_payload)
+ except ValidationError as error:
+ raise PluginBundleError("plugin_bundle_manifest_invalid", str(error)) from error
+ if manifest.bundle_format != "agentkit.bundle/v2":
+ raise PluginBundleError(
+ "plugin_bundle_version_unsupported",
+ "PluginHost execution requires agentkit.bundle/v2",
+ )
+ if manifest.execution_profile != "composed":
+ raise PluginBundleError(
+ "plugin_bundle_legacy_execution",
+ "Bundle v2 selects legacy execution and cannot enter PluginHost",
+ )
+
+ self._verify_manifest_digest(manifest)
+ self._verify_declared_files(bundle_root, manifest)
+ try:
+ assert_bundle_security(bundle_root)
+ except BundleSecurityError as error:
+ raise PluginBundleError(
+ error.code,
+ "Plugin Bundle contains literal secret material",
+ ) from error
+
+ profile_payload = self._read_json(bundle_root, "composition-profile.json")
+ lock_payload = self._read_json(bundle_root, "plugin-lock.json")
+ agent_spec = self._read_json(bundle_root, "resolved-agent-spec.json")
+ try:
+ profile = CompositionProfile.model_validate(profile_payload)
+ embedded_lock = PluginLock.model_validate(lock_payload)
+ except ValidationError as error:
+ raise PluginBundleError("plugin_bundle_composition_invalid", str(error)) from error
+
+ try:
+ composition = self._registry.resolve(profile)
+ except PluginResolutionError as error:
+ raise PluginBundleError(error.code, str(error)) from error
+ if composition.profile_digest != manifest.composition_profile_digest:
+ raise PluginBundleError(
+ "plugin_bundle_profile_digest_mismatch",
+ "composition-profile.json does not match manifest compositionProfileDigest",
+ )
+ if embedded_lock != composition.plugin_lock:
+ raise PluginBundleError(
+ "plugin_bundle_lock_mismatch",
+ "plugin-lock.json does not match deterministic profile resolution",
+ )
+ if composition.plugin_lock_digest != manifest.plugin_lock_digest:
+ raise PluginBundleError(
+ "plugin_bundle_lock_digest_mismatch",
+ "plugin-lock.json does not match manifest pluginLockDigest",
+ )
+
+ return ResolvedPluginBundle(
+ root=bundle_root,
+ manifest=manifest,
+ resolved_agent_spec=_deep_freeze(agent_spec),
+ composition=composition,
+ )
+
+ @staticmethod
+ def _read_json(root: Path, relative: str) -> dict[str, Any]:
+ path = root / relative
+ try:
+ payload = json.loads(path.read_text(encoding="utf-8"))
+ except FileNotFoundError as error:
+ raise PluginBundleError(
+ "plugin_bundle_file_missing", f"Bundle file is missing: {relative}"
+ ) from error
+ except (OSError, UnicodeError, json.JSONDecodeError) as error:
+ raise PluginBundleError(
+ "plugin_bundle_file_invalid", f"Bundle file is invalid: {relative}"
+ ) from error
+ if not isinstance(payload, dict):
+ raise PluginBundleError(
+ "plugin_bundle_file_invalid", f"Bundle file must be an object: {relative}"
+ )
+ return payload
+
+ @staticmethod
+ def _verify_manifest_digest(manifest: BundleManifest) -> None:
+ payload = manifest.model_dump(
+ by_alias=True,
+ exclude={"bundle_digest"},
+ exclude_none=True,
+ mode="json",
+ )
+ actual = _sha256(_canonical_json(payload))
+ if manifest.bundle_digest != actual:
+ raise PluginBundleError(
+ "plugin_bundle_digest_mismatch",
+ "manifest.json does not match its declared bundleDigest",
+ )
+
+ @staticmethod
+ def _verify_declared_files(root: Path, manifest: BundleManifest) -> None:
+ declared: set[str] = set()
+ for entry in manifest.files:
+ relative = PurePosixPath(entry.path)
+ if relative.is_absolute() or ".." in relative.parts:
+ raise PluginBundleError(
+ "plugin_bundle_path_invalid",
+ f"Bundle manifest contains an unsafe path: {entry.path}",
+ )
+ path = (root / Path(*relative.parts)).resolve()
+ try:
+ path.relative_to(root)
+ except ValueError as error:
+ raise PluginBundleError(
+ "plugin_bundle_path_invalid",
+ f"Bundle manifest path escapes its root: {entry.path}",
+ ) from error
+ try:
+ content = path.read_bytes()
+ except OSError as error:
+ raise PluginBundleError(
+ "plugin_bundle_file_missing",
+ f"Declared Bundle file is missing: {entry.path}",
+ ) from error
+ if len(content) != entry.size or _sha256(content) != entry.sha256:
+ raise PluginBundleError(
+ "plugin_bundle_file_digest_mismatch",
+ f"Declared Bundle file failed integrity check: {entry.path}",
+ )
+ declared.add(entry.path)
+
+ required = {
+ "composition-profile.json",
+ "plugin-lock.json",
+ "resolved-agent-spec.json",
+ }
+ missing = sorted(required - declared)
+ if missing:
+ raise PluginBundleError(
+ "plugin_bundle_file_missing",
+ "Bundle manifest does not declare required plugin artifacts: " + ", ".join(missing),
+ )
+ actual = {
+ path.relative_to(root).as_posix()
+ for path in root.rglob("*")
+ if path.is_file() and path.name != "manifest.json"
+ }
+ undeclared = sorted(actual - declared)
+ if undeclared:
+ raise PluginBundleError(
+ "plugin_bundle_file_undeclared",
+ "Bundle contains files outside its integrity manifest: " + ", ".join(undeclared),
+ )
+
+
+def _canonical_json(payload: Any) -> bytes:
+ return json.dumps(
+ payload,
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ ).encode("utf-8")
+
+
+def _sha256(payload: bytes) -> str:
+ return f"sha256:{hashlib.sha256(payload).hexdigest()}"
+
+
+def _deep_freeze(value: Any) -> Any:
+ """Prevent a Provider from mutating any nested resolved-spec value."""
+
+ if isinstance(value, dict):
+ return MappingProxyType({key: _deep_freeze(child) for key, child in value.items()})
+ if isinstance(value, list):
+ return tuple(_deep_freeze(child) for child in value)
+ return value
+
+
+__all__ = [
+ "PluginBundleError",
+ "PluginBundleResolver",
+ "ResolvedPluginBundle",
+]
diff --git a/ksadk/plugins/bundle_security.py b/ksadk/plugins/bundle_security.py
new file mode 100644
index 00000000..5fff2120
--- /dev/null
+++ b/ksadk/plugins/bundle_security.py
@@ -0,0 +1,167 @@
+"""Secret and local-path admission for immutable Agent Bundles.
+
+This is deliberately narrower than a generic source-code linter. A Bundle
+may legitimately contain documentation and examples, so we inspect all
+structured deployment inputs and only use high-confidence token signatures in
+runtime source files. The result is suitable for a build/deployment boundary:
+it prevents a resolved Bundle from becoming a durable copy of a credential
+without treating every mention of the word ``token`` as a secret.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlsplit
+
+_SENSITIVE_KEY = re.compile(
+ r"(?:^|[_-])(?:password|passwd|api[_-]?key|access[_-]?key|secret[_-]?key|"
+ r"access[_-]?token|refresh[_-]?token|credential|private[_-]?key)(?:[_-]?ref)?$",
+ re.IGNORECASE,
+)
+_REFERENCE_PREFIXES = ("env://", "secret://", "keyring://", "vault://")
+_HIGH_CONFIDENCE_TOKENS: tuple[tuple[str, re.Pattern[str]], ...] = (
+ ("private-key", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
+ ("aws-access-key", re.compile(r"\b(?:AKIA|ASIA)[A-Z0-9]{16}\b")),
+ ("openai-style-key", re.compile(r"\bsk-[A-Za-z0-9_-]{20,}\b")),
+ ("bearer-token", re.compile(r"\bBearer\s+[A-Za-z0-9._~+/=-]{24,}")),
+)
+_STRUCTURED_SUFFIXES = frozenset({".json", ".yaml", ".yml"})
+_RUNTIME_SOURCE_SUFFIXES = frozenset({".py", ".js", ".mjs", ".cjs", ".ts", ".tsx"})
+
+
+@dataclass(frozen=True)
+class BundleSecurityFinding:
+ """One deterministic admission finding without leaking the matched value."""
+
+ path: str
+ kind: str
+ field: str | None = None
+
+
+class BundleSecurityError(ValueError):
+ """Raised when a Bundle would persist a literal credential or host path."""
+
+ code = "bundle_secret_detected"
+
+ def __init__(self, findings: tuple[BundleSecurityFinding, ...]) -> None:
+ self.findings = findings
+ locations = ", ".join(
+ f"{finding.path}{f' ({finding.field})' if finding.field else ''}"
+ for finding in findings[:3]
+ )
+ suffix = " …" if len(findings) > 3 else ""
+ super().__init__(f"Agent Bundle contains literal secret material: {locations}{suffix}")
+
+
+def scan_bundle_security(root: str | Path) -> tuple[BundleSecurityFinding, ...]:
+ """Return high-confidence security findings for an already materialized Bundle.
+
+ Structured files receive semantic key/value inspection. Runtime source is
+ only searched for credential signatures; user Markdown and arbitrary
+ package assets are intentionally outside this detector to avoid false
+ positive build failures.
+ """
+
+ bundle_root = Path(root).resolve()
+ findings: list[BundleSecurityFinding] = []
+ for path in sorted(
+ (candidate for candidate in bundle_root.rglob("*") if candidate.is_file()),
+ key=lambda candidate: candidate.relative_to(bundle_root).as_posix(),
+ ):
+ relative = path.relative_to(bundle_root).as_posix()
+ suffix = path.suffix.lower()
+ if suffix not in _STRUCTURED_SUFFIXES and not (
+ relative.startswith("runtime/") and suffix in _RUNTIME_SOURCE_SUFFIXES
+ ):
+ continue
+ try:
+ text = path.read_text(encoding="utf-8")
+ except (OSError, UnicodeDecodeError):
+ continue
+ if suffix == ".json":
+ try:
+ payload = json.loads(text)
+ except json.JSONDecodeError:
+ findings.append(BundleSecurityFinding(relative, "invalid-structured-input"))
+ continue
+ _scan_value(payload, relative, "$", findings)
+ elif suffix in {".yaml", ".yml"}:
+ # Bundle-owned YAML is a narrow runtime launch declaration. It
+ # has no credential-bearing fields today, but token patterns still
+ # catch accidental inline credentials without introducing a second
+ # YAML parser/security grammar.
+ _scan_text(text, relative, findings)
+ else:
+ _scan_text(text, relative, findings)
+ return tuple(findings)
+
+
+def assert_bundle_security(root: str | Path) -> None:
+ findings = scan_bundle_security(root)
+ if findings:
+ raise BundleSecurityError(findings)
+
+
+def _scan_value(
+ value: Any,
+ relative: str,
+ field: str,
+ findings: list[BundleSecurityFinding],
+) -> None:
+ if isinstance(value, dict):
+ for key, child in value.items():
+ key_text = str(key)
+ child_field = f"{field}.{key_text}"
+ normalized = key_text.replace("_", "").replace("-", "").lower()
+ # Metadata that *names* secret fields is not a secret value.
+ if normalized in {"secretfields", "credentialfields"}:
+ continue
+ if _SENSITIVE_KEY.search(key_text) and _has_literal_secret(child):
+ findings.append(
+ BundleSecurityFinding(relative, "literal-secret-field", child_field)
+ )
+ _scan_value(child, relative, child_field, findings)
+ return
+ if isinstance(value, list):
+ for index, child in enumerate(value):
+ _scan_value(child, relative, f"{field}[{index}]", findings)
+ return
+ if isinstance(value, str):
+ _scan_text(value, relative, findings, field=field)
+ split = urlsplit(value)
+ # ``plugin://name@version`` is a pinned package reference, not URL
+ # userinfo. Only network endpoint schemes can carry credentials here.
+ if split.scheme in {"http", "https"} and (
+ split.username is not None or split.password is not None
+ ):
+ findings.append(BundleSecurityFinding(relative, "url-credentials", field))
+ if value.startswith(("/Users/", "/home/", "C:\\Users\\")):
+ findings.append(BundleSecurityFinding(relative, "local-home-path", field))
+
+
+def _has_literal_secret(value: Any) -> bool:
+ return isinstance(value, str) and bool(value) and not value.startswith(_REFERENCE_PREFIXES)
+
+
+def _scan_text(
+ text: str,
+ relative: str,
+ findings: list[BundleSecurityFinding],
+ *,
+ field: str | None = None,
+) -> None:
+ for kind, pattern in _HIGH_CONFIDENCE_TOKENS:
+ if pattern.search(text):
+ findings.append(BundleSecurityFinding(relative, kind, field))
+
+
+__all__ = [
+ "BundleSecurityError",
+ "BundleSecurityFinding",
+ "assert_bundle_security",
+ "scan_bundle_security",
+]
diff --git a/ksadk/plugins/composition.py b/ksadk/plugins/composition.py
new file mode 100644
index 00000000..a92601af
--- /dev/null
+++ b/ksadk/plugins/composition.py
@@ -0,0 +1,529 @@
+"""Compile an Agent revision into one resolvable plugin composition.
+
+This module is the build-time boundary between Studio's editable bindings and
+the immutable plugin graph. It deliberately does not install or execute
+plugins. Every selected capability must already have an exact ``plugin://``
+materialization whose manifest provides the expected Definition; the existing
+``PluginRegistry`` then produces the authoritative lock.
+
+In particular, ``mcp://`` and ``skill://`` are catalog identities, not active
+PluginHost owners. Accepting them in a profile without a materializer would
+make a Studio binding look enabled while the resolver silently omitted it.
+This compiler therefore rejects that state before a Bundle is built.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from copy import deepcopy
+from dataclasses import dataclass, field
+from typing import Literal, Protocol
+
+from pydantic import ValidationError
+
+from ksadk.plugins.contracts import (
+ CompositionCapability,
+ CompositionProfile,
+ PluginReference,
+)
+from ksadk.plugins.resolver import (
+ PluginRegistry,
+ PluginResolutionError,
+ ResolvedComposition,
+)
+from ksadk.studio.contracts import AgentDraft, CapabilityBinding, ResourceDescriptor
+from ksadk.studio.errors import StudioError
+
+
+class CompositionCompileError(ValueError):
+ """Stable, typed failure while normalizing one Agent revision."""
+
+ def __init__(self, code: str, message: str, *, field: str | None = None) -> None:
+ super().__init__(message)
+ self.code = code
+ self.field = field
+
+
+class StudioResourceCatalog(Protocol):
+ """Narrow catalog seam implemented by ``LocalResourceCatalog``."""
+
+ def get(self, resource: str) -> ResourceDescriptor: ...
+
+
+@dataclass(frozen=True)
+class PluginCapabilitySelection:
+ """One exact platform capability selected by build/deployment policy."""
+
+ ref: str
+ definition: str
+ slot: str | None = None
+ required: bool = True
+ config: Mapping[str, object] = field(default_factory=dict)
+
+
+@dataclass(frozen=True)
+class RuntimePluginSelection:
+ """One coarse-grained AgentProvider selected by trusted product policy.
+
+ Execution semantics remain inside the provider. ``supported_strategies``
+ is admission metadata, not another executable plugin slot.
+ """
+
+ provider_ref: str
+ provider_config: Mapping[str, object] = field(default_factory=dict)
+ supported_strategies: frozenset[str] = frozenset({"direct"})
+
+
+@dataclass(frozen=True)
+class ResourcePluginMaterialization:
+ """Proof that one Studio MCP/Skill resource has an executable plugin owner."""
+
+ kind: Literal["mcp", "skill"]
+ plugin_ref: str
+ config: Mapping[str, object] = field(default_factory=dict)
+ required: bool = True
+
+
+@dataclass(frozen=True)
+class CompositionPolicy:
+ """Trusted build policy used to normalize an Agent revision.
+
+ The policy is supplied by the product/runtime distribution, not generated
+ by an LLM and not stored as a second editable Agent specification.
+ """
+
+ runtimes: Mapping[str, RuntimePluginSelection]
+ session_store: PluginCapabilitySelection
+ providers: Mapping[str, RuntimePluginSelection] = field(default_factory=dict)
+ resource_materializations: Mapping[str, ResourcePluginMaterialization] = field(
+ default_factory=dict
+ )
+ memory_providers: Mapping[str, PluginCapabilitySelection] = field(default_factory=dict)
+ context_contributors: Mapping[str, PluginCapabilitySelection] = field(
+ default_factory=dict
+ )
+ renderers: tuple[PluginCapabilitySelection, ...] = ()
+ default_runtime: str = "codex"
+
+
+class CompositionCompiler:
+ """Normalize Studio bindings and resolve the resulting immutable graph."""
+
+ def __init__(
+ self,
+ registry: PluginRegistry,
+ catalog: StudioResourceCatalog,
+ policy: CompositionPolicy,
+ ) -> None:
+ self._registry = registry
+ self._catalog = catalog
+ self._policy = policy
+
+ def compile(self, revision: AgentDraft) -> ResolvedComposition:
+ runtime_type = (
+ revision.spec.runtime.type
+ if revision.spec.runtime is not None
+ else self._policy.default_runtime
+ )
+ provider_ref = (
+ revision.spec.runtime.provider_ref
+ if revision.spec.runtime is not None
+ and revision.spec.runtime.type == "plugin"
+ else None
+ )
+ runtime = (
+ self._policy.providers.get(provider_ref)
+ if provider_ref is not None
+ else self._policy.runtimes.get(runtime_type)
+ )
+ if runtime is None:
+ raise CompositionCompileError(
+ "agent_provider_unavailable",
+ (
+ f"provider {provider_ref!r} is not installed and enabled"
+ if provider_ref is not None
+ else f"runtime {runtime_type!r} has no materialized AgentProvider"
+ ),
+ field=(
+ "spec.runtime.providerRef"
+ if provider_ref is not None
+ else "spec.runtime.type"
+ ),
+ )
+ if provider_ref is not None and runtime.provider_ref != provider_ref:
+ raise CompositionCompileError(
+ "agent_provider_reference_mismatch",
+ "installed AgentProvider selection does not match runtime providerRef",
+ field="spec.runtime.providerRef",
+ )
+
+ provider_config = deepcopy(dict(runtime.provider_config))
+ if revision.spec.runtime is not None:
+ for key, value in revision.spec.runtime.provider_config.items():
+ if key in provider_config and provider_config[key] != value:
+ raise CompositionCompileError(
+ "agent_provider_config_conflict",
+ f"AgentProvider config {key!r} conflicts with installation policy",
+ field=f"spec.runtime.providerConfig.{key}",
+ )
+ provider_config[key] = deepcopy(value)
+ provider_config["runtimeType"] = runtime_type
+ if revision.spec.runtime is not None and revision.spec.runtime.version:
+ provider_config["runtimeVersion"] = revision.spec.runtime.version
+
+ capabilities: list[CompositionCapability] = []
+ self._validate_plugin_owner(
+ runtime.provider_ref,
+ definition="agent.provider/v1",
+ slot="agent.execution",
+ field="spec.runtime.type",
+ )
+ self._validate_provider_strategy(revision, runtime)
+ self._append_selection(
+ capabilities,
+ self._policy.session_store,
+ field="policy.sessionStore",
+ )
+
+ if revision.spec.memory.enabled:
+ memory = self._policy.memory_providers.get(revision.spec.memory.provider_ref)
+ if memory is None:
+ raise CompositionCompileError(
+ "memory_provider_unmaterialized",
+ "enabled memory provider has no materialized plugin owner",
+ field="spec.memory.providerRef",
+ )
+ self._append_selection(
+ capabilities,
+ memory,
+ field="spec.memory.providerRef",
+ extra_config={
+ "providerRef": revision.spec.memory.provider_ref,
+ "scopes": sorted(revision.spec.memory.scopes),
+ },
+ )
+
+ if revision.spec.context.rollout.context_engine != "off":
+ contributor_flags = revision.spec.context.contributors.model_dump(
+ mode="python"
+ )
+ for contributor, selection in sorted(self._policy.context_contributors.items()):
+ # ``None`` means policy-owned default. Supplying the selection
+ # in this trusted policy makes it active unless the revision
+ # explicitly disables it.
+ if contributor_flags.get(contributor) is False:
+ continue
+ self._append_selection(
+ capabilities,
+ selection,
+ field=f"spec.context.contributors.{contributor}",
+ extra_config={"contributor": contributor},
+ )
+
+ for selection in self._policy.renderers:
+ self._append_selection(
+ capabilities,
+ selection,
+ field="policy.renderers",
+ )
+
+ resource_entries: dict[str, list[dict[str, object]]] = {}
+ resource_required: dict[str, bool] = {}
+ resource_definitions: dict[str, set[str]] = {}
+ resource_groups: tuple[
+ tuple[Literal["mcp", "skill"], list[CapabilityBinding]], ...
+ ] = (
+ ("mcp", revision.spec.bindings.mcp_servers),
+ ("skill", revision.spec.bindings.skills),
+ )
+ for kind, bindings in resource_groups:
+ for binding in bindings:
+ if not binding.enabled:
+ continue
+ materialization = self._materialization(binding, expected_kind=kind)
+ definition = (
+ "mcp.connector/v1" if kind == "mcp" else "skill.source/v1"
+ )
+ self._validate_plugin_owner(
+ materialization.plugin_ref,
+ definition=definition,
+ field=f"spec.bindings.{kind}",
+ )
+ descriptor = self._catalog_resource(
+ binding.resource_id,
+ field=f"spec.bindings.{kind}",
+ )
+ if descriptor.kind != kind:
+ raise CompositionCompileError(
+ "resource_kind_mismatch",
+ f"resource {binding.resource_id!r} is not a {kind} resource",
+ field=f"spec.bindings.{kind}",
+ )
+ if descriptor.status != "ready":
+ raise CompositionCompileError(
+ "resource_not_ready",
+ f"resource {binding.resource_id!r} is {descriptor.status!r}",
+ field=f"spec.bindings.{kind}",
+ )
+ entry: dict[str, object] = {
+ "resourceId": descriptor.resource_id,
+ "kind": kind,
+ "name": descriptor.name,
+ "version": descriptor.version,
+ "digest": descriptor.digest,
+ "binding": deepcopy(binding.config),
+ "materializer": deepcopy(dict(materialization.config)),
+ }
+ resource_entries.setdefault(materialization.plugin_ref, []).append(entry)
+ resource_required[materialization.plugin_ref] = (
+ resource_required.get(materialization.plugin_ref, False)
+ or materialization.required
+ )
+ resource_definitions.setdefault(materialization.plugin_ref, set()).add(
+ definition
+ )
+
+ for plugin_ref, resources in sorted(resource_entries.items()):
+ definitions = resource_definitions[plugin_ref]
+ if len(definitions) > 1:
+ raise CompositionCompileError(
+ "resource_materializer_ambiguous",
+ f"plugin {plugin_ref!r} cannot materialize MCP and Skill resources "
+ "in one capability entry",
+ field="spec.bindings",
+ )
+ resources.sort(key=lambda item: (str(item["kind"]), str(item["resourceId"])))
+ capabilities.append(
+ self._capability(
+ plugin_ref,
+ required=resource_required[plugin_ref],
+ config={"resources": resources},
+ field="spec.bindings",
+ )
+ )
+
+ capabilities = self._merge_capabilities(capabilities)
+ policies = {
+ "network": f"policy://{revision.spec.security.network.mode}@1",
+ "tool": f"policy://{revision.spec.bindings.policy_template}@1",
+ }
+ try:
+ profile = CompositionProfile(
+ agent_provider=PluginReference(
+ ref=runtime.provider_ref,
+ config=provider_config,
+ ),
+ capabilities=capabilities,
+ policies=policies,
+ ui_contributions=sorted(selection.ref for selection in self._policy.renderers),
+ )
+ except ValidationError as exc:
+ raise CompositionCompileError(
+ "composition_profile_invalid",
+ f"normalized composition profile is invalid: {exc}",
+ ) from exc
+
+ dangling = [
+ item.ref
+ for item in profile.capabilities
+ if item.ref.startswith(("mcp://", "skill://"))
+ ]
+ if dangling:
+ raise CompositionCompileError(
+ "resource_capability_unmaterialized",
+ f"catalog references are not active plugin owners: {', '.join(dangling)}",
+ )
+ try:
+ return self._registry.resolve(profile)
+ except PluginResolutionError as exc:
+ raise CompositionCompileError(exc.code, str(exc)) from exc
+
+ def _validate_provider_strategy(
+ self,
+ revision: AgentDraft,
+ runtime: RuntimePluginSelection,
+ ) -> None:
+ strategy_name = revision.spec.execution.strategy
+ if strategy_name not in runtime.supported_strategies:
+ raise CompositionCompileError(
+ "execution_strategy_unavailable",
+ f"AgentProvider does not support execution strategy {strategy_name!r}",
+ field="spec.execution.strategy",
+ )
+
+ def _materialization(
+ self,
+ binding: CapabilityBinding,
+ *,
+ expected_kind: Literal["mcp", "skill"],
+ ) -> ResourcePluginMaterialization:
+ materialization = self._policy.resource_materializations.get(binding.resource_id)
+ if materialization is None:
+ raise CompositionCompileError(
+ "resource_capability_unmaterialized",
+ f"resource {binding.resource_id!r} has no active plugin materialization",
+ field=f"spec.bindings.{expected_kind}",
+ )
+ if materialization.kind != expected_kind:
+ raise CompositionCompileError(
+ "resource_materializer_kind_mismatch",
+ f"resource {binding.resource_id!r} is mapped as {materialization.kind!r}",
+ field=f"spec.bindings.{expected_kind}",
+ )
+ if materialization.plugin_ref.startswith(("mcp://", "skill://")):
+ raise CompositionCompileError(
+ "resource_capability_unmaterialized",
+ f"resource {binding.resource_id!r} still points at catalog identity "
+ f"{materialization.plugin_ref!r}",
+ field=f"spec.bindings.{expected_kind}",
+ )
+ return materialization
+
+ def _catalog_resource(self, resource_id: str, *, field: str) -> ResourceDescriptor:
+ try:
+ return self._catalog.get(resource_id)
+ except (KeyError, StudioError) as exc:
+ raise CompositionCompileError(
+ "resource_not_found",
+ f"materialized resource {resource_id!r} is absent from the revision catalog",
+ field=field,
+ ) from exc
+
+ def _append_selection(
+ self,
+ capabilities: list[CompositionCapability],
+ selection: PluginCapabilitySelection,
+ *,
+ field: str,
+ extra_config: Mapping[str, object] | None = None,
+ ) -> None:
+ self._validate_plugin_owner(
+ selection.ref,
+ definition=selection.definition,
+ slot=selection.slot,
+ field=field,
+ )
+ config = deepcopy(dict(selection.config))
+ if extra_config:
+ overlap = set(config).intersection(extra_config)
+ if overlap:
+ raise CompositionCompileError(
+ "composition_config_conflict",
+ f"compiler-owned config keys cannot be overridden: {sorted(overlap)}",
+ field=field,
+ )
+ config.update(deepcopy(dict(extra_config)))
+ capabilities.append(
+ self._capability(
+ selection.ref,
+ required=selection.required,
+ config=config,
+ field=field,
+ )
+ )
+
+ @staticmethod
+ def _merge_capabilities(
+ capabilities: list[CompositionCapability],
+ ) -> list[CompositionCapability]:
+ """Collapse multiple Definition selections owned by one plugin.
+
+ A single plugin can legitimately provide Store, Context, and renderer
+ Definitions. ``CompositionProfile`` pins that plugin once, so the
+ compiler merges disjoint (or identical) config keys before validation
+ rather than rejecting a valid multi-capability owner as a duplicate.
+ Conflicting values remain a typed build error instead of last-write
+ wins behavior.
+ """
+
+ merged: dict[str, tuple[bool, dict[str, object]]] = {}
+ for capability in capabilities:
+ required, config = merged.get(capability.ref, (False, {}))
+ for key, value in capability.config.items():
+ if key in config and config[key] != value:
+ raise CompositionCompileError(
+ "composition_config_conflict",
+ f"plugin {capability.ref!r} received conflicting config for {key!r}",
+ )
+ config[key] = deepcopy(value)
+ merged[capability.ref] = (required or capability.required, config)
+ return [
+ CompositionCapability(ref=ref, required=required, config=config)
+ for ref, (required, config) in sorted(merged.items())
+ ]
+
+ @staticmethod
+ def _capability(
+ ref: str,
+ *,
+ required: bool,
+ config: Mapping[str, object],
+ field: str,
+ ) -> CompositionCapability:
+ if ref.startswith(("mcp://", "skill://")):
+ raise CompositionCompileError(
+ "resource_capability_unmaterialized",
+ f"catalog identity {ref!r} has no active plugin owner",
+ field=field,
+ )
+ try:
+ return CompositionCapability(
+ ref=ref,
+ required=required,
+ config=deepcopy(dict(config)),
+ )
+ except ValidationError as exc:
+ raise CompositionCompileError(
+ "plugin_reference_invalid",
+ f"invalid materialized plugin reference {ref!r}: {exc}",
+ field=field,
+ ) from exc
+
+ def _validate_plugin_owner(
+ self,
+ ref: str,
+ *,
+ definition: str,
+ slot: str | None = None,
+ field: str,
+ ) -> None:
+ if ref.startswith(("mcp://", "skill://")):
+ raise CompositionCompileError(
+ "resource_capability_unmaterialized",
+ f"catalog identity {ref!r} has no active plugin owner",
+ field=field,
+ )
+ try:
+ parsed = PluginReference(ref=ref)
+ except ValidationError as exc:
+ raise CompositionCompileError(
+ "plugin_reference_invalid",
+ f"invalid plugin reference {ref!r}",
+ field=field,
+ ) from exc
+ plugin_id, version = parsed.ref.removeprefix("plugin://").rsplit("@", 1)
+ try:
+ manifest = self._registry.manifest_for(plugin_id, version)
+ except PluginResolutionError as exc:
+ raise CompositionCompileError(exc.code, str(exc), field=field) from exc
+ if any(
+ offer.definition == definition and (slot is None or offer.slot == slot)
+ for offer in manifest.spec.provides
+ ):
+ return
+ slot_suffix = f" at slot {slot!r}" if slot is not None else ""
+ raise CompositionCompileError(
+ "plugin_capability_mismatch",
+ f"plugin {ref!r} does not provide {definition!r}{slot_suffix}",
+ field=field,
+ )
+
+
+__all__ = [
+ "CompositionCompileError",
+ "CompositionCompiler",
+ "CompositionPolicy",
+ "PluginCapabilitySelection",
+ "ResourcePluginMaterialization",
+ "RuntimePluginSelection",
+]
diff --git a/ksadk/plugins/context_contributor.py b/ksadk/plugins/context_contributor.py
new file mode 100644
index 00000000..e452b23a
--- /dev/null
+++ b/ksadk/plugins/context_contributor.py
@@ -0,0 +1,437 @@
+"""Frozen ContextContributor/v1 wire contract and source projections.
+
+The wire contract is deliberately read-only. A plugin receives an already
+authenticated scope and a bounded request, then returns provenance-bearing
+fragments. This module validates that exchange before projecting it into the
+existing Context Engine dataclasses; it does not grant filesystem access,
+write memory, mutate prompts, or append SessionEvents.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Annotated, Any, Literal, cast
+
+from pydantic import AwareDatetime, Field, WithJsonSchema, field_validator, model_validator
+
+from ksadk.context_engine.contributors import (
+ ContextContributionRequest,
+ ContributorCapabilities,
+)
+from ksadk.context_engine.models import ContextItem, ContextKind, ContextTrustLevel
+from ksadk.plugins.contracts import PluginContractModel
+
+ContextClassification = Annotated[
+ str,
+ WithJsonSchema(
+ {
+ "type": "string",
+ "minLength": 1,
+ "maxLength": 64,
+ "pattern": "^[a-z][a-z0-9._-]*$",
+ "not": {"enum": ["credential", "secret"]},
+ }
+ ),
+]
+ContextSourceReference = Annotated[
+ str,
+ WithJsonSchema(
+ {
+ "type": "string",
+ "minLength": 4,
+ "maxLength": 2048,
+ "pattern": "^[a-z][a-z0-9+.-]*://\\S+$",
+ "not": {"pattern": "^(?:credential|env|secret|vault)://"},
+ }
+ ),
+]
+ContextExpiry = Annotated[
+ AwareDatetime,
+ WithJsonSchema(
+ {
+ "type": "string",
+ "format": "date-time",
+ "pattern": "(?:Z|[+-][0-9]{2}:[0-9]{2})$",
+ }
+ ),
+]
+ContextContributorCacheability = Literal["stable", "turn", "none"]
+ContextContributorFailureMode = Literal["skip", "warn", "fail"]
+
+_CLASSIFICATION = re.compile(r"^[a-z][a-z0-9._-]{0,63}$")
+_CONTRIBUTOR_ID = re.compile(r"^[a-z][a-z0-9._-]{0,127}$")
+_POLICY_REF = re.compile(r"^policy://[^\s@]+@[^\s@]+$")
+_SOURCE_REF = re.compile(r"^[a-z][a-z0-9+.-]*://\S+$")
+_DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")
+_FORBIDDEN_CLASSIFICATIONS = {"credential", "secret"}
+_FORBIDDEN_SOURCE_SCHEMES = {"credential", "env", "secret", "vault"}
+_SENSITIVE_KEY = re.compile(r"(?:secret|password|token|api[_-]?key)", re.IGNORECASE)
+_SECRET_REF_PREFIXES = ("secret://", "env://", "credential://", "vault://")
+_TRUST_RANK: dict[ContextTrustLevel, int] = {
+ "untrusted": 0,
+ "user": 1,
+ "resource": 2,
+ "developer": 3,
+ "platform": 4,
+}
+
+
+def _validate_classification(value: str) -> str:
+ if not _CLASSIFICATION.fullmatch(value) or value in _FORBIDDEN_CLASSIFICATIONS:
+ raise ValueError("classification must be a non-secret qualified name")
+ return value
+
+
+def _validate_secret_references(value: Any, *, path: str) -> None:
+ """Permit secret references in metadata, but never clear secret values."""
+
+ if isinstance(value, dict):
+ for key, child in value.items():
+ key_text = str(key)
+ child_path = f"{path}.{key_text}"
+ if _SENSITIVE_KEY.search(key_text) and child is not None:
+ if not isinstance(child, str) or not child.startswith(
+ _SECRET_REF_PREFIXES
+ ):
+ raise ValueError(f"{child_path} must contain a secret reference")
+ _validate_secret_references(child, path=child_path)
+ elif isinstance(value, (list, tuple)):
+ for index, child in enumerate(value):
+ _validate_secret_references(child, path=f"{path}[{index}]")
+
+
+class AuthenticatedContextScope(PluginContractModel):
+ """Identity established by the Host before a Contributor is invoked."""
+
+ authenticated: Literal[True]
+ actor_id: str = Field(min_length=1, max_length=256)
+ agent_id: str = Field(min_length=1, max_length=256)
+ session_id: str = Field(min_length=1, max_length=256)
+ turn_id: str = Field(min_length=1, max_length=256)
+
+
+class ContextContributorCapabilities(PluginContractModel):
+ """Maximum authority and resource envelope granted to one Contributor."""
+
+ contributor_id: str = Field(
+ min_length=1,
+ max_length=128,
+ pattern=r"^[a-z][a-z0-9._-]*$",
+ )
+ trust_level: ContextTrustLevel
+ max_tokens: int = Field(ge=0)
+ timeout_ms: int = Field(ge=1)
+ cacheability: ContextContributorCacheability
+ failure_mode: ContextContributorFailureMode
+
+ @field_validator("contributor_id")
+ @classmethod
+ def validate_contributor_id(cls, value: str) -> str:
+ if not _CONTRIBUTOR_ID.fullmatch(value):
+ raise ValueError("contributorId must be a lowercase qualified name")
+ return value
+
+ def to_context_engine(self) -> ContributorCapabilities:
+ """Project the frozen wire shape into the installed Context Engine type."""
+
+ return ContributorCapabilities(
+ contributor_id=self.contributor_id,
+ trust_level=self.trust_level,
+ max_tokens=self.max_tokens,
+ timeout_ms=self.timeout_ms,
+ cacheability=self.cacheability,
+ failure_mode=self.failure_mode,
+ )
+
+
+class ContextContributorRequest(PluginContractModel):
+ """One authenticated, policy-bound and token-bounded read request."""
+
+ request_format: Literal["ksadk.context-request/v1"]
+ scope: AuthenticatedContextScope
+ invocation_id: str = Field(min_length=1, max_length=256)
+ user_input: str = Field(max_length=131_072)
+ workspace_root: str = Field(max_length=4096)
+ policy_ref: str = Field(
+ min_length=1,
+ max_length=512,
+ pattern=r"^policy://[^\s@]+@[^\s@]+$",
+ )
+ remaining_budget: int = Field(ge=0)
+ allowed_classifications: tuple[ContextClassification, ...] = Field(
+ json_schema_extra={"uniqueItems": True}
+ )
+ metadata: dict[str, Any]
+
+ @field_validator("policy_ref")
+ @classmethod
+ def validate_policy_ref(cls, value: str) -> str:
+ if not _POLICY_REF.fullmatch(value):
+ raise ValueError("policyRef must be a pinned policy:// reference")
+ return value
+
+ @field_validator("allowed_classifications")
+ @classmethod
+ def validate_allowed_classifications(
+ cls, value: tuple[str, ...]
+ ) -> tuple[str, ...]:
+ normalized = tuple(_validate_classification(item) for item in value)
+ if len(normalized) != len(set(normalized)):
+ raise ValueError("allowedClassifications must be unique")
+ return tuple(sorted(normalized))
+
+ @field_validator("metadata")
+ @classmethod
+ def validate_metadata(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _validate_secret_references(value, path="request.metadata")
+ return value
+
+ def to_context_engine(self) -> ContextContributionRequest:
+ """Project scope and policy facts without losing their wire identity."""
+
+ return ContextContributionRequest(
+ user_input=self.user_input,
+ session_id=self.scope.session_id,
+ invocation_id=self.invocation_id,
+ workspace_root=self.workspace_root,
+ user_id=self.scope.actor_id,
+ agent_id=self.scope.agent_id,
+ metadata={
+ **self.metadata,
+ "authenticated_scope": self.scope.model_dump(
+ by_alias=True, mode="json"
+ ),
+ "turn_id": self.scope.turn_id,
+ "policy_ref": self.policy_ref,
+ "remaining_budget": self.remaining_budget,
+ "allowed_classifications": list(self.allowed_classifications),
+ },
+ )
+
+
+class ContextFragment(PluginContractModel):
+ """One read-only, attributed Context candidate returned by a plugin."""
+
+ fragment_format: Literal["ksadk.context-fragment/v1"]
+ item_id: str = Field(min_length=1, max_length=256)
+ kind: ContextKind
+ content: Any
+ source_refs: tuple[ContextSourceReference, ...] = Field(
+ min_length=1,
+ json_schema_extra={"uniqueItems": True},
+ )
+ classification: ContextClassification
+ expires_at: ContextExpiry | None
+ token_estimate: int = Field(ge=0)
+ trust_level: ContextTrustLevel
+ priority: int
+ required: Literal[False]
+ droppable: bool
+ truncatable: bool
+ stable: bool
+ group_id: str | None = Field(max_length=256)
+ seq_start: int | None = Field(ge=0)
+ seq_end: int | None = Field(ge=0)
+ score: float | None
+ content_hash: Annotated[
+ str,
+ Field(pattern=r"^sha256:[0-9a-f]{64}$", max_length=71),
+ ] | None
+ metadata: dict[str, Any]
+
+ @field_validator("content")
+ @classmethod
+ def validate_content(cls, value: Any) -> Any:
+ # Structured context is subject to the same secret-reference rule as
+ # metadata. A Contributor cannot bypass admission by moving a clear
+ # credential from ``metadata`` into a JSON-shaped ``content`` value.
+ _validate_secret_references(value, path="fragment.content")
+ return value
+
+ @field_validator("source_refs")
+ @classmethod
+ def validate_source_refs(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if len(value) != len(set(value)):
+ raise ValueError("sourceRefs must be unique")
+ for source_ref in value:
+ if not _SOURCE_REF.fullmatch(source_ref):
+ raise ValueError("sourceRefs must be absolute URI-like references")
+ scheme, location = source_ref.split("://", 1)
+ if scheme in _FORBIDDEN_SOURCE_SCHEMES:
+ raise ValueError("sourceRefs cannot point at secret material")
+ authority = location.split("/", 1)[0]
+ if "@" in authority:
+ raise ValueError("sourceRefs cannot contain embedded credentials")
+ return tuple(sorted(value))
+
+ @field_validator("classification")
+ @classmethod
+ def validate_classification(cls, value: str) -> str:
+ return _validate_classification(value)
+
+ @field_validator("expires_at")
+ @classmethod
+ def validate_expires_at(cls, value: datetime | None) -> datetime | None:
+ if value is not None and (value.tzinfo is None or value.utcoffset() is None):
+ raise ValueError("expiresAt must include a timezone")
+ return value
+
+ @field_validator("content_hash")
+ @classmethod
+ def validate_content_hash(cls, value: str | None) -> str | None:
+ if value is not None and not _DIGEST.fullmatch(value):
+ raise ValueError("contentHash must be a lowercase sha256: digest")
+ return value
+
+ @field_validator("metadata")
+ @classmethod
+ def validate_metadata(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _validate_secret_references(value, path="fragment.metadata")
+ return value
+
+ @model_validator(mode="after")
+ def validate_sequence_range(self) -> "ContextFragment":
+ if (self.seq_start is None) != (self.seq_end is None):
+ raise ValueError("seqStart and seqEnd must be supplied together")
+ if (
+ self.seq_start is not None
+ and self.seq_end is not None
+ and self.seq_end < self.seq_start
+ ):
+ raise ValueError("seqEnd cannot precede seqStart")
+ return self
+
+ def to_context_engine(self) -> ContextItem:
+ """Project one already-admitted fragment into a Context Engine item."""
+
+ expires_at = (
+ self.model_dump(by_alias=True, mode="json")["expiresAt"]
+ if self.expires_at is not None
+ else None
+ )
+ return ContextItem(
+ item_id=self.item_id,
+ kind=self.kind,
+ content=self.content,
+ source=self.source_refs[0],
+ trust_level=self.trust_level,
+ priority=self.priority,
+ estimated_tokens=self.token_estimate,
+ required=False,
+ droppable=self.droppable,
+ truncatable=self.truncatable,
+ stable=self.stable,
+ group_id=self.group_id,
+ seq_start=self.seq_start,
+ seq_end=self.seq_end,
+ score=self.score,
+ content_hash=self.content_hash,
+ provenance={
+ "source_refs": list(self.source_refs),
+ "classification": self.classification,
+ "expires_at": expires_at,
+ },
+ metadata=dict(self.metadata),
+ )
+
+
+class ContextContributorResponse(PluginContractModel):
+ """Ordered fragments returned for one request."""
+
+ response_format: Literal["ksadk.context-response/v1"]
+ fragments: tuple[ContextFragment, ...]
+
+ @model_validator(mode="after")
+ def validate_unique_item_ids(self) -> "ContextContributorResponse":
+ item_ids = [fragment.item_id for fragment in self.fragments]
+ if len(item_ids) != len(set(item_ids)):
+ raise ValueError("ContextFragment item identity must be unique")
+ return self
+
+
+@dataclass(frozen=True)
+class ProjectedContextContribution:
+ """Typed bridge into the pre-existing Context Engine source contracts."""
+
+ capabilities: ContributorCapabilities
+ request: ContextContributionRequest
+ items: tuple[ContextItem, ...]
+
+
+class ContextContributorExchange(PluginContractModel):
+ """Complete golden exchange used by hosts and cross-language conformance."""
+
+ contract_format: Literal["ksadk.context-contributor/v1"]
+ capabilities: ContextContributorCapabilities
+ request: ContextContributorRequest
+ response: ContextContributorResponse
+
+ @model_validator(mode="after")
+ def validate_admission_bounds(self) -> "ContextContributorExchange":
+ allowed = set(self.request.allowed_classifications)
+ maximum_trust = _TRUST_RANK[self.capabilities.trust_level]
+ token_ceiling = min(
+ self.capabilities.max_tokens,
+ self.request.remaining_budget,
+ )
+ used_tokens = 0
+ for fragment in self.response.fragments:
+ if fragment.classification not in allowed:
+ raise ValueError("ContextFragment classification is not allowed")
+ if _TRUST_RANK[fragment.trust_level] > maximum_trust:
+ raise ValueError("ContextFragment cannot elevate contributor trust")
+ used_tokens += fragment.token_estimate
+ if used_tokens > token_ceiling:
+ raise ValueError(
+ "ContextFragment token estimate exceeds the effective remaining budget"
+ )
+ return self
+
+ def project(
+ self,
+ *,
+ now: datetime | None = None,
+ ) -> ProjectedContextContribution:
+ """Validate expiry and project the admitted response into engine types."""
+
+ current = now or datetime.now(timezone.utc)
+ if current.tzinfo is None or current.utcoffset() is None:
+ raise ValueError("projection time must include a timezone")
+ for fragment in self.response.fragments:
+ if fragment.expires_at is not None and fragment.expires_at <= current:
+ raise ValueError(f"ContextFragment {fragment.item_id} has expired")
+ return ProjectedContextContribution(
+ capabilities=self.capabilities.to_context_engine(),
+ request=self.request.to_context_engine(),
+ items=tuple(fragment.to_context_engine() for fragment in self.response.fragments),
+ )
+
+
+def context_contributor_json_schema() -> dict[str, Any]:
+ """Return the canonical Draft 2020-12 source projection for export gates."""
+
+ schema = ContextContributorExchange.model_json_schema(by_alias=True)
+ schema["$schema"] = "https://json-schema.org/draft/2020-12/schema"
+ schema["$id"] = (
+ "https://ksadk.local/contracts/plugin/v1/context-contributor.schema.json"
+ )
+ schema["title"] = "ContextContributor/v1 exchange"
+ return cast(dict[str, Any], schema)
+
+
+__all__ = [
+ "AuthenticatedContextScope",
+ "ContextClassification",
+ "ContextContributorCacheability",
+ "ContextContributorCapabilities",
+ "ContextContributorExchange",
+ "ContextContributorFailureMode",
+ "ContextContributorRequest",
+ "ContextContributorResponse",
+ "ContextFragment",
+ "ContextSourceReference",
+ "ProjectedContextContribution",
+ "context_contributor_json_schema",
+]
diff --git a/ksadk/plugins/contracts.py b/ksadk/plugins/contracts.py
new file mode 100644
index 00000000..ef4fd53d
--- /dev/null
+++ b/ksadk/plugins/contracts.py
@@ -0,0 +1,451 @@
+"""Frozen source contracts and internal records for plugin composition.
+
+Only the models exported through ``__all__`` are public Phase 2 contracts.
+``PluginManifest`` and its supporting models are internal admission records:
+they project DSH/Codex host inventory into the Python composition engine and
+are not a third installable package format or a stable public contract.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from collections.abc import Mapping
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class PluginContractModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+_SEMVER = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
+_PLUGIN_ID = re.compile(r"^[a-z0-9]+(?:[._-][a-z0-9]+)*$")
+_DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")
+_DEFINITION = re.compile(r"^[a-z][a-z0-9._-]*/v[1-9][0-9]*$")
+_SENSITIVE_KEY = re.compile(r"(?:secret|password|token|api[_-]?key)", re.IGNORECASE)
+_SECRET_REF_PREFIXES = ("secret://", "env://", "credential://", "vault://")
+
+
+def _validate_semver(value: str, *, field: str) -> str:
+ if not _SEMVER.fullmatch(value):
+ raise ValueError(f"{field} must use an exact semantic version")
+ return value
+
+
+def _validate_digest(value: str) -> str:
+ if not _DIGEST.fullmatch(value):
+ raise ValueError("digest must be a lowercase sha256: digest")
+ return value
+
+
+def _validate_secret_references(value: Any, *, path: str = "config") -> None:
+ """Configuration may carry references but never clear secret material."""
+
+ if isinstance(value, Mapping):
+ for key, child in value.items():
+ key_text = str(key)
+ child_path = f"{path}.{key_text}"
+ if _SENSITIVE_KEY.search(key_text) and child is not None:
+ if not isinstance(child, str) or not child.startswith(_SECRET_REF_PREFIXES):
+ raise ValueError(f"{child_path} must contain a secret reference, not a value")
+ _validate_secret_references(child, path=child_path)
+ elif isinstance(value, list):
+ for index, child in enumerate(value):
+ _validate_secret_references(child, path=f"{path}[{index}]")
+
+
+class PluginMetadata(PluginContractModel):
+ id: str = Field(min_length=3, max_length=128)
+ version: str
+
+ @field_validator("id")
+ @classmethod
+ def validate_plugin_id(cls, value: str) -> str:
+ if not _PLUGIN_ID.fullmatch(value):
+ raise ValueError("plugin id must be lowercase dot/dash/underscore qualified")
+ return value
+
+ @field_validator("version")
+ @classmethod
+ def validate_version(cls, value: str) -> str:
+ return _validate_semver(value, field="plugin version")
+
+
+class CapabilityOffer(PluginContractModel):
+ definition: str
+ slot: str = Field(min_length=3, max_length=128)
+ mode: Literal["unique", "multiple"]
+
+ @field_validator("definition")
+ @classmethod
+ def validate_definition(cls, value: str) -> str:
+ if not _DEFINITION.fullmatch(value):
+ raise ValueError(
+ "definition must be a versioned capability name such as agent.provider/v1"
+ )
+ return value
+
+
+class CapabilityRequirement(PluginContractModel):
+ definition: str
+ version: str = Field(min_length=1, max_length=128)
+
+ @field_validator("definition")
+ @classmethod
+ def validate_definition(cls, value: str) -> str:
+ if not _DEFINITION.fullmatch(value):
+ raise ValueError("definition must be a versioned capability name")
+ return value
+
+
+class PluginCompatibility(PluginContractModel):
+ kernel_api: str = Field(min_length=1, max_length=128)
+ runtime_protocols: list[str] = Field(default_factory=list)
+ python: str | None = Field(default=None, max_length=128)
+ platforms: list[str] = Field(default_factory=list)
+
+
+class PluginProvenance(PluginContractModel):
+ source: Literal["builtin", "registry", "local", "market", "runtime-native"]
+ digest: str
+ signature_ref: str | None = Field(default=None, max_length=512)
+ license: str | None = Field(default=None, max_length=128)
+
+ @field_validator("digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class PluginSpec(PluginContractModel):
+ domain: Literal["ksadk-platform", "runtime-native"]
+ runtime: Literal["python", "node", "process", "remote", "native"]
+ entrypoint: str | None = Field(default=None, max_length=512)
+ provides: list[CapabilityOffer] = Field(min_length=1)
+ requires: list[CapabilityRequirement] = Field(default_factory=list)
+ optional: list[CapabilityRequirement] = Field(default_factory=list)
+ config_schema: str | None = Field(default=None, max_length=512)
+ secret_fields: list[str] = Field(default_factory=list)
+ permissions: list[str] = Field(default_factory=list)
+ isolation: Literal["in-process", "process", "sidecar", "remote", "native"]
+ compatibility: PluginCompatibility
+ health_contract: str = Field(min_length=1, max_length=128)
+ provenance: PluginProvenance
+
+ @model_validator(mode="after")
+ def validate_shape(self) -> "PluginSpec":
+ if self.runtime == "native" and self.domain != "runtime-native":
+ raise ValueError("native runtime plugins must use runtime-native domain")
+ if self.runtime != "native" and not self.entrypoint:
+ raise ValueError("non-native plugins require an entrypoint")
+ offers = [(item.definition, item.slot) for item in self.provides]
+ if len(offers) != len(set(offers)):
+ raise ValueError("plugin provides duplicate capability/slot offers")
+ if len(self.secret_fields) != len(set(self.secret_fields)):
+ raise ValueError("plugin secretFields must be unique")
+ if len(self.permissions) != len(set(self.permissions)):
+ raise ValueError("plugin permissions must be unique")
+ return self
+
+
+class PluginManifest(PluginContractModel):
+ """Internal host projection; never a developer-authored plugin package."""
+
+ api_version: Literal["plugin.ksadk.io/v1"] = "plugin.ksadk.io/v1"
+ kind: Literal["Plugin"] = "Plugin"
+ metadata: PluginMetadata
+ spec: PluginSpec
+
+
+class CapabilityDefinitionSpec(PluginContractModel):
+ definition: str
+ slot: str = Field(min_length=3, max_length=128)
+ multiplicity: Literal["unique", "multiple"]
+ owner_required: bool = True
+ config_schema: str | None = Field(default=None, max_length=512)
+
+ @field_validator("definition")
+ @classmethod
+ def validate_definition(cls, value: str) -> str:
+ if not _DEFINITION.fullmatch(value):
+ raise ValueError("definition must be a versioned capability name")
+ return value
+
+
+class CapabilityDefinition(PluginContractModel):
+ api_version: Literal["capability.ksadk.io/v1"] = "capability.ksadk.io/v1"
+ kind: Literal["CapabilityDefinition"] = "CapabilityDefinition"
+ metadata: PluginMetadata
+ spec: CapabilityDefinitionSpec
+
+
+class PluginReference(PluginContractModel):
+ ref: str = Field(min_length=12, max_length=256)
+ config: dict[str, Any] = Field(default_factory=dict)
+
+ @field_validator("ref")
+ @classmethod
+ def validate_reference(cls, value: str) -> str:
+ if not value.startswith("plugin://") or "@" not in value:
+ raise ValueError("plugin reference must be plugin://@")
+ plugin_id, version = value.removeprefix("plugin://").rsplit("@", 1)
+ if not _PLUGIN_ID.fullmatch(plugin_id):
+ raise ValueError("plugin reference id is invalid")
+ _validate_semver(version, field="plugin reference version")
+ return value
+
+ @field_validator("config")
+ @classmethod
+ def validate_config(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _validate_secret_references(value)
+ return value
+
+
+class CompositionCapability(PluginContractModel):
+ ref: str = Field(min_length=8, max_length=512)
+ required: bool = True
+ config: dict[str, Any] = Field(default_factory=dict)
+
+ @field_validator("ref")
+ @classmethod
+ def validate_reference(cls, value: str) -> str:
+ if not value.startswith(("plugin://", "mcp://", "skill://")) or "@" not in value:
+ raise ValueError(
+ "capability ref must be a pinned plugin://, mcp://, or skill:// reference"
+ )
+ return value
+
+ @field_validator("config")
+ @classmethod
+ def validate_config(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _validate_secret_references(value)
+ return value
+
+
+class NativeExtension(PluginContractModel):
+ runtime: str = Field(min_length=1, max_length=64)
+ ref: str = Field(min_length=8, max_length=512)
+
+
+class CompositionProfile(PluginContractModel):
+ api_version: Literal["composition.ksadk.io/v1"] = "composition.ksadk.io/v1"
+ agent_provider: PluginReference
+ capabilities: list[CompositionCapability] = Field(default_factory=list)
+ native_extensions: list[NativeExtension] = Field(default_factory=list)
+ policies: dict[str, str] = Field(default_factory=dict)
+ ui_contributions: list[str] = Field(default_factory=list)
+
+ @model_validator(mode="after")
+ def validate_profile(self) -> "CompositionProfile":
+ refs = [item.ref for item in self.capabilities]
+ if len(refs) != len(set(refs)):
+ raise ValueError("composition capabilities must not repeat a reference")
+ extensions = [(item.runtime, item.ref) for item in self.native_extensions]
+ if len(extensions) != len(set(extensions)):
+ raise ValueError("native extensions must not repeat a runtime/reference pair")
+ return self
+
+
+class LockedCapability(PluginContractModel):
+ definition: str
+ slot: str = Field(min_length=3, max_length=128)
+ owner: str = Field(min_length=3, max_length=128)
+
+ @field_validator("definition")
+ @classmethod
+ def validate_definition(cls, value: str) -> str:
+ if not _DEFINITION.fullmatch(value):
+ raise ValueError("definition must be a versioned capability name")
+ return value
+
+
+class PluginDependency(PluginContractModel):
+ id: str = Field(min_length=3, max_length=128)
+ version: str
+ digest: str
+
+ @field_validator("id")
+ @classmethod
+ def validate_id(cls, value: str) -> str:
+ if not _PLUGIN_ID.fullmatch(value):
+ raise ValueError("dependency id is invalid")
+ return value
+
+ @field_validator("version")
+ @classmethod
+ def validate_version(cls, value: str) -> str:
+ return _validate_semver(value, field="dependency version")
+
+ @field_validator("digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class PluginLockEntry(PluginContractModel):
+ id: str = Field(min_length=3, max_length=128)
+ version: str
+ digest: str
+ source: Literal["builtin", "registry", "local", "market", "runtime-native"]
+ signature_ref: str | None = Field(default=None, max_length=512)
+ license: str | None = Field(default=None, max_length=128)
+ provides: list[LockedCapability] = Field(default_factory=list)
+ dependencies: list[PluginDependency] = Field(default_factory=list)
+
+ @field_validator("id")
+ @classmethod
+ def validate_id(cls, value: str) -> str:
+ if not _PLUGIN_ID.fullmatch(value):
+ raise ValueError("plugin lock id is invalid")
+ return value
+
+ @field_validator("version")
+ @classmethod
+ def validate_version(cls, value: str) -> str:
+ return _validate_semver(value, field="plugin lock version")
+
+ @field_validator("digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class PluginLock(PluginContractModel):
+ """The current Bundle v2 lock shape, now with an exact typed entry form."""
+
+ lock_format: Literal["agentkit.plugin-lock/v1"] = "agentkit.plugin-lock/v1"
+ plugins: list[PluginLockEntry] = Field(default_factory=list)
+
+ @field_validator("plugins")
+ @classmethod
+ def sort_plugins(cls, value: list[PluginLockEntry]) -> list[PluginLockEntry]:
+ return sorted(value, key=lambda item: (item.id, item.version, item.digest))
+
+ @model_validator(mode="after")
+ def validate_graph(self) -> "PluginLock":
+ by_id = {item.id: item for item in self.plugins}
+ if len(by_id) != len(self.plugins):
+ raise ValueError("plugin lock must pin exactly one version for each plugin id")
+ for item in self.plugins:
+ for dependency in item.dependencies:
+ target = by_id.get(dependency.id)
+ if target is None:
+ raise ValueError(f"plugin dependency {dependency.id!r} is not pinned")
+ if (target.version, target.digest) != (dependency.version, dependency.digest):
+ raise ValueError(
+ f"plugin dependency {dependency.id!r} does not match its lock entry"
+ )
+ if dependency.id == item.id:
+ raise ValueError("plugin lock cannot depend on itself")
+ visiting: set[str] = set()
+ visited: set[str] = set()
+
+ def visit(plugin_id: str) -> None:
+ if plugin_id in visiting:
+ raise ValueError("plugin lock dependency cycle")
+ if plugin_id in visited:
+ return
+ visiting.add(plugin_id)
+ for dependency in by_id[plugin_id].dependencies:
+ visit(dependency.id)
+ visiting.remove(plugin_id)
+ visited.add(plugin_id)
+
+ for plugin_id in by_id:
+ visit(plugin_id)
+ return self
+
+
+class PluginInventoryItem(PluginContractModel):
+ id: str = Field(min_length=3, max_length=128)
+ version: str
+ digest: str
+ state: Literal[
+ "resolved",
+ "admitted",
+ "staged",
+ "starting",
+ "ready",
+ "degraded",
+ "failed",
+ "draining",
+ "stopped",
+ "disposed",
+ "rejected",
+ ]
+ health: Literal["unknown", "healthy", "unhealthy"] = "unknown"
+ reason: str | None = Field(default=None, max_length=1024)
+
+ @field_validator("id")
+ @classmethod
+ def validate_id(cls, value: str) -> str:
+ if not _PLUGIN_ID.fullmatch(value):
+ raise ValueError("plugin inventory id is invalid")
+ return value
+
+ @field_validator("version")
+ @classmethod
+ def validate_version(cls, value: str) -> str:
+ return _validate_semver(value, field="plugin inventory version")
+
+ @field_validator("digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class PluginInventory(PluginContractModel):
+ api_version: Literal["plugin.ksadk.io/v1"] = "plugin.ksadk.io/v1"
+ kind: Literal["PluginInventory"] = "PluginInventory"
+ profile_digest: str = Field(min_length=8, max_length=80)
+ plugin_lock_digest: str = Field(min_length=8, max_length=80)
+ plugins: list[PluginInventoryItem] = Field(default_factory=list)
+
+ @field_validator("profile_digest", "plugin_lock_digest")
+ @classmethod
+ def validate_optional_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("plugins")
+ @classmethod
+ def sort_plugins(cls, value: list[PluginInventoryItem]) -> list[PluginInventoryItem]:
+ return sorted(value, key=lambda item: item.id)
+
+
+def canonical_plugin_lock(lock: PluginLock) -> bytes:
+ """Canonical JSON bytes used by Bundle v2 and admission fingerprinting."""
+
+ return json.dumps(
+ lock.model_dump(by_alias=True, exclude_none=True, mode="json"),
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ ).encode("utf-8")
+
+
+def plugin_lock_digest(lock: PluginLock) -> str:
+ return f"sha256:{hashlib.sha256(canonical_plugin_lock(lock)).hexdigest()}"
+
+
+__all__ = [
+ "CapabilityDefinition",
+ "CompositionProfile",
+ "PluginLock",
+ "PluginLockEntry",
+ "PluginInventory",
+ "PluginInventoryItem",
+ "canonical_plugin_lock",
+ "plugin_lock_digest",
+]
diff --git a/ksadk/plugins/dsh_toolchain.py b/ksadk/plugins/dsh_toolchain.py
new file mode 100644
index 00000000..25ea78a5
--- /dev/null
+++ b/ksadk/plugins/dsh_toolchain.py
@@ -0,0 +1,935 @@
+"""Managed DeepSeek Harness toolchain and standard bundle developer workflow.
+
+KsADK does not copy, fork, or rebuild DeepSeek Harness. It installs one
+published CLI package into an isolated AgentEngine configuration directory and
+delegates bundle composition to that exact executable. Plugin source remains
+an ordinary npm package that follows DSH's public ``dsh.bundle.patch`` format.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+import time
+import uuid
+from collections.abc import Callable, Mapping, Sequence
+from contextlib import contextmanager
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterator, Literal
+
+from pydantic import BaseModel, ConfigDict
+
+from ksadk.configs.global_config import get_global_config_dir
+from ksadk.plugins.bridges.dsh import (
+ DshBridgeError,
+ DshProfilePluginBridge,
+ dsh_subprocess_environment,
+)
+
+DSH_PACKAGE = "@deepseek-ai/dsh"
+DSH_VERSION = "0.1.1-rc.2"
+DSH_PACKAGE_SPEC = f"{DSH_PACKAGE}@{DSH_VERSION}"
+CORDIS_VERSION_RANGE = "^4.0.1"
+PNPM_VERSION = "11.7.0"
+
+TOOLCHAIN_HOME_ENV = "AGENTENGINE_PLUGIN_TOOLCHAIN_HOME"
+PNPM_BIN_ENV = "AGENTENGINE_PNPM_BIN"
+
+_VERSION = re.compile(r"\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b")
+_PACKAGE_NAME = re.compile(
+ r"^(?:@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$"
+)
+_LOCK_TIMEOUT_SECONDS = 30.0
+_STALE_LOCK_SECONDS = 10 * 60
+_MAX_MANIFEST_BYTES = 2 * 1024 * 1024
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class _ToolchainModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+class DshToolchainStatus(_ToolchainModel):
+ package: Literal["@deepseek-ai/dsh"] = DSH_PACKAGE
+ expected_version: Literal["0.1.1-rc.2"] = DSH_VERSION
+ installed: bool
+ usable: bool
+ root: str
+ executable: str | None = None
+ actual_version: str | None = None
+ lockfile_present: bool = False
+ pnpm_available: bool = False
+ pnpm_version: str | None = None
+ problem: str | None = None
+
+
+class DshPluginCreateResult(_ToolchainModel):
+ ecosystem: Literal["dsh"] = "dsh"
+ package_name: str
+ target: str
+ entrypoint: str
+ bundle_patch: str
+
+
+class DshPluginValidationResult(_ToolchainModel):
+ ecosystem: Literal["dsh"] = "dsh"
+ package_name: str
+ package_version: str
+ host_version: str
+ profile_digest: str
+ lifecycle: tuple[str, ...] = (
+ "install",
+ "project",
+ "disable",
+ "enable",
+ "uninstall",
+ )
+
+
+class DshPluginPackResult(_ToolchainModel):
+ ecosystem: Literal["dsh"] = "dsh"
+ package_name: str
+ package_version: str
+ artifact: str
+
+
+class DshToolchainError(RuntimeError):
+ """Base error for the managed DSH development toolchain."""
+
+
+class DshToolchainUnavailableError(DshToolchainError):
+ pass
+
+
+class DshToolchainVersionMismatchError(DshToolchainError):
+ pass
+
+
+class DshToolchainInstallError(DshToolchainError):
+ pass
+
+
+class DshPluginSourceError(DshToolchainError):
+ pass
+
+
+class DshPluginValidationError(DshToolchainError):
+ def __init__(self, stage: str, message: str = "DSH plugin validation failed") -> None:
+ super().__init__(message)
+ self.stage = stage
+
+
+class DshPluginPackError(DshToolchainError):
+ pass
+
+
+@dataclass(frozen=True)
+class CommandResult:
+ stdout: str = ""
+ stderr: str = ""
+
+
+CommandRunner = Callable[[Sequence[str], Path, Mapping[str, str]], CommandResult]
+
+
+class DshToolchainManager:
+ """Install and resolve the one supported published DSH CLI version."""
+
+ def __init__(
+ self,
+ *,
+ base_dir: Path | None = None,
+ pnpm_command: Sequence[str] | None = None,
+ command_runner: CommandRunner | None = None,
+ lock_timeout_seconds: float = _LOCK_TIMEOUT_SECONDS,
+ ) -> None:
+ configured = os.environ.get(TOOLCHAIN_HOME_ENV, "").strip()
+ base = (
+ base_dir
+ or (Path(configured).expanduser() if configured else None)
+ or get_global_config_dir() / "plugin-toolchains"
+ )
+ self._base_dir = base.expanduser().resolve()
+ self._root = self._base_dir / "dsh" / DSH_VERSION
+ self._pnpm_command = tuple(pnpm_command) if pnpm_command is not None else None
+ if self._pnpm_command is not None and not self._pnpm_command:
+ raise ValueError("pnpm command cannot be empty")
+ self._runner = command_runner or self._run_command
+ self._lock_timeout_seconds = lock_timeout_seconds
+ self._assert_safe_managed_root(self._root)
+
+ @property
+ def root(self) -> Path:
+ return self._root
+
+ @property
+ def executable(self) -> Path:
+ return self._root / "node_modules" / ".bin" / "dsh"
+
+ def status(self) -> DshToolchainStatus:
+ """Inspect the managed installation without mutating it."""
+
+ pnpm_path, pnpm_version = self._inspect_pnpm()
+ manifest_valid = self._manifest_is_pinned()
+ lock_valid = self._lockfile_is_pinned()
+ executable = self.executable
+ if not manifest_valid:
+ problem = "not_installed" if not self._root.exists() else "manifest_mismatch"
+ return self._status(
+ installed=False,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ problem=problem,
+ )
+ if not lock_valid:
+ return self._status(
+ installed=True,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ problem="lockfile_missing_or_mismatched",
+ )
+ try:
+ resolved = executable.resolve(strict=True)
+ except (FileNotFoundError, OSError):
+ return self._status(
+ installed=True,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ problem="executable_missing",
+ )
+ if not resolved.is_relative_to(self._root.resolve()):
+ return self._status(
+ installed=True,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ executable=str(resolved),
+ problem="executable_outside_managed_root",
+ )
+ try:
+ actual = self._command_version((str(executable),), cwd=self._root)
+ except DshToolchainUnavailableError:
+ return self._status(
+ installed=True,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ executable=str(executable),
+ problem="executable_unavailable",
+ )
+ if actual != DSH_VERSION:
+ return self._status(
+ installed=True,
+ usable=False,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ executable=str(executable),
+ actual_version=actual,
+ problem="version_mismatch",
+ )
+ return self._status(
+ installed=True,
+ usable=True,
+ pnpm_path=pnpm_path,
+ pnpm_version=pnpm_version,
+ executable=str(executable),
+ actual_version=actual,
+ )
+
+ def install(self) -> DshToolchainStatus:
+ """Atomically install the pinned official npm package with a pnpm lock."""
+
+ pnpm = self.require_pnpm()
+ with self._install_lock():
+ current = self.status()
+ if current.usable:
+ return current
+ parent = self._root.parent
+ parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+ self._clean_abandoned_staging(parent)
+ staging = Path(tempfile.mkdtemp(prefix=f".{DSH_VERSION}.install-", dir=parent))
+ backup: Path | None = None
+ try:
+ self._write_install_manifest(staging)
+ environment = self._installation_environment()
+ self._runner(
+ (
+ *pnpm,
+ "install",
+ "--lockfile-only",
+ "--ignore-scripts",
+ "--config.auto-install-peers=true",
+ ),
+ staging,
+ environment,
+ )
+ lockfile = staging / "pnpm-lock.yaml"
+ if not self._lockfile_is_pinned(lockfile):
+ raise DshToolchainInstallError(
+ "pnpm did not create a lockfile pinned to the supported DSH package"
+ )
+ self._runner(
+ (
+ *pnpm,
+ "install",
+ "--frozen-lockfile",
+ "--ignore-scripts",
+ "--config.auto-install-peers=true",
+ ),
+ staging,
+ environment,
+ )
+ staged_executable = staging / "node_modules" / ".bin" / "dsh"
+ resolved = staged_executable.resolve(strict=True)
+ if not resolved.is_relative_to(staging.resolve()):
+ raise DshToolchainInstallError(
+ "installed DSH executable escapes the managed toolchain directory"
+ )
+ actual = self._command_version((str(staged_executable),), cwd=staging)
+ if actual != DSH_VERSION:
+ raise DshToolchainVersionMismatchError(
+ f"expected DSH {DSH_VERSION}, got {actual}"
+ )
+ self._write_receipt(staging, actual)
+ if self._root.exists():
+ backup = parent / f".{DSH_VERSION}.backup-{uuid.uuid4().hex}"
+ os.replace(self._root, backup)
+ try:
+ os.replace(staging, self._root)
+ installed = self.status()
+ if not installed.usable:
+ raise DshToolchainInstallError(
+ f"installed DSH toolchain failed verification: {installed.problem}"
+ )
+ except BaseException:
+ if self._root.exists():
+ shutil.rmtree(self._root)
+ if backup is not None and backup.exists():
+ os.replace(backup, self._root)
+ raise
+ if backup is not None and backup.exists():
+ shutil.rmtree(backup)
+ return installed
+ except DshToolchainError:
+ raise
+ except Exception as error:
+ raise DshToolchainInstallError("could not install the DSH toolchain") from error
+ finally:
+ if staging.exists():
+ shutil.rmtree(staging)
+ if backup is not None and backup.exists() and self._root.exists():
+ shutil.rmtree(backup)
+
+ def require_command(self, explicit: str | Path | None = None) -> tuple[str, ...]:
+ """Return an exact-version DSH executable, managed unless explicitly set."""
+
+ if explicit is not None and str(explicit).strip():
+ executable = self._resolve_program(str(explicit))
+ actual = self._command_version((executable,), cwd=self._root)
+ if actual != DSH_VERSION:
+ raise DshToolchainVersionMismatchError(
+ f"expected DSH {DSH_VERSION}, got {actual}"
+ )
+ return (executable,)
+ state = self.status()
+ if state.problem == "version_mismatch":
+ raise DshToolchainVersionMismatchError(
+ f"expected DSH {DSH_VERSION}, got {state.actual_version or 'unknown'}"
+ )
+ if not state.usable or state.executable is None:
+ raise DshToolchainUnavailableError(
+ "managed DSH toolchain is not installed; run "
+ "`agentengine plugin toolchain install`"
+ )
+ return (state.executable,)
+
+ def resolve_module_entry(self, package_name: str) -> Path:
+ """Resolve one dependency from the pinned DSH installation.
+
+ Provider sidecars may need the exact Cordis implementation owned by
+ their DSH host. Resolution is anchored at the installed DSH package,
+ never at a source checkout or the caller's ambient ``node_modules``.
+ The result is fenced to the managed toolchain root.
+ """
+
+ self._validate_package_name(package_name)
+ self.require_command()
+ dsh_manifest = self._root / "node_modules" / DSH_PACKAGE / "package.json"
+ try:
+ dsh_manifest = dsh_manifest.resolve(strict=True)
+ except (FileNotFoundError, OSError) as error:
+ raise DshToolchainUnavailableError(
+ "managed DSH package manifest is unavailable"
+ ) from error
+ node = self._resolve_program("node")
+ script = (
+ "const {createRequire}=require('node:module');"
+ f"const resolve=createRequire({json.dumps(str(dsh_manifest))}).resolve;"
+ f"process.stdout.write(resolve({json.dumps(package_name)}));"
+ )
+ try:
+ result = self._invoke((node, "-e", script), cwd=self._root)
+ except DshToolchainError as error:
+ raise DshToolchainUnavailableError(
+ f"managed DSH dependency is unavailable: {package_name}"
+ ) from error
+ raw = result.stdout.strip()
+ try:
+ resolved = Path(raw).resolve(strict=True)
+ except (FileNotFoundError, OSError) as error:
+ raise DshToolchainUnavailableError(
+ f"managed DSH dependency is unavailable: {package_name}"
+ ) from error
+ if not resolved.is_relative_to(self._root):
+ raise DshToolchainUnavailableError(
+ f"managed DSH dependency escapes the toolchain root: {package_name}"
+ )
+ return resolved
+
+ def require_pnpm(self) -> tuple[str, ...]:
+ command = self._resolve_pnpm_command()
+ result = self._runner(
+ (*command, "--version"),
+ self._pnpm_probe_cwd(),
+ self._pnpm_environment(),
+ )
+ match = _VERSION.search(result.stdout or result.stderr)
+ if match is None:
+ raise DshToolchainUnavailableError("pnpm did not report a parseable version")
+ if match.group(1) != PNPM_VERSION:
+ raise DshToolchainVersionMismatchError(
+ f"expected pnpm {PNPM_VERSION}, got {match.group(1)}"
+ )
+ return command
+
+ def _status(
+ self,
+ *,
+ installed: bool,
+ usable: bool,
+ pnpm_path: str | None,
+ pnpm_version: str | None,
+ problem: str | None = None,
+ executable: str | None = None,
+ actual_version: str | None = None,
+ ) -> DshToolchainStatus:
+ return DshToolchainStatus(
+ installed=installed,
+ usable=usable,
+ root=str(self._root),
+ executable=executable,
+ actual_version=actual_version,
+ lockfile_present=(self._root / "pnpm-lock.yaml").is_file(),
+ pnpm_available=pnpm_path is not None,
+ pnpm_version=pnpm_version,
+ problem=problem,
+ )
+
+ def _inspect_pnpm(self) -> tuple[str | None, str | None]:
+ try:
+ command = self.require_pnpm()
+ result = self._runner(
+ (*command, "--version"),
+ self._root,
+ self._pnpm_environment(),
+ )
+ except DshToolchainError:
+ return None, None
+ match = _VERSION.search(result.stdout or result.stderr)
+ return " ".join(command), match.group(1) if match else None
+
+ def _resolve_pnpm_command(self) -> tuple[str, ...]:
+ if self._pnpm_command is not None:
+ command = self._pnpm_command
+ else:
+ configured = os.environ.get(PNPM_BIN_ENV, "").strip()
+ if configured:
+ command = (configured,)
+ else:
+ corepack = shutil.which("corepack")
+ command = (
+ (corepack, f"pnpm@{PNPM_VERSION}")
+ if corepack is not None
+ else ("pnpm",)
+ )
+ executable = self._resolve_program(command[0])
+ return (executable, *command[1:])
+
+ def _pnpm_probe_cwd(self) -> Path:
+ # require_pnpm() must also work before the managed toolchain root
+ # exists (first install), so the version probe cannot unconditionally
+ # use self._root as cwd.
+ if self._root.exists():
+ return self._root
+ self._base_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+ return self._base_dir
+
+ def _manifest_is_pinned(self, path: Path | None = None) -> bool:
+ manifest_path = path or self._root / "package.json"
+ try:
+ payload = json.loads(manifest_path.read_text(encoding="utf-8"))
+ except (FileNotFoundError, OSError, UnicodeError, json.JSONDecodeError):
+ return False
+ return (
+ isinstance(payload, dict)
+ and payload.get("private") is True
+ and payload.get("packageManager") == f"pnpm@{PNPM_VERSION}"
+ and isinstance(payload.get("dependencies"), dict)
+ and payload["dependencies"].get(DSH_PACKAGE) == DSH_VERSION
+ )
+
+ def _lockfile_is_pinned(self, path: Path | None = None) -> bool:
+ lockfile = path or self._root / "pnpm-lock.yaml"
+ try:
+ if lockfile.stat().st_size > _MAX_MANIFEST_BYTES:
+ return False
+ value = lockfile.read_text(encoding="utf-8")
+ except (FileNotFoundError, OSError, UnicodeError):
+ return False
+ return DSH_PACKAGE in value and DSH_VERSION in value
+
+ def _command_version(self, command: Sequence[str], *, cwd: Path) -> str:
+ result = self._invoke((*command, "--version"), cwd=cwd)
+ match = _VERSION.search(result.stdout or result.stderr)
+ if match is None:
+ raise DshToolchainUnavailableError("DSH did not report a parseable version")
+ return match.group(1)
+
+ def _invoke(self, command: Sequence[str], *, cwd: Path) -> CommandResult:
+ try:
+ return self._runner(tuple(command), cwd, dsh_subprocess_environment())
+ except DshToolchainError:
+ raise
+ except Exception as error:
+ raise DshToolchainUnavailableError("toolchain command could not be executed") from error
+
+ @staticmethod
+ def _resolve_program(value: str) -> str:
+ candidate = Path(value).expanduser()
+ if candidate.is_absolute() or len(candidate.parts) > 1:
+ if not candidate.is_file():
+ raise DshToolchainUnavailableError(f"required executable is unavailable: {value}")
+ return str(candidate.resolve())
+ resolved = shutil.which(value)
+ if resolved is None:
+ raise DshToolchainUnavailableError(f"required executable is unavailable: {value}")
+ return resolved
+
+ @staticmethod
+ def _validate_package_name(name: str) -> None:
+ if len(name) > 214 or not _PACKAGE_NAME.fullmatch(name):
+ raise DshToolchainUnavailableError("invalid managed DSH package name")
+
+ def _write_install_manifest(self, root: Path) -> None:
+ self._write_json(
+ root / "package.json",
+ {
+ "name": "agentengine-managed-dsh-toolchain",
+ "private": True,
+ "packageManager": f"pnpm@{PNPM_VERSION}",
+ "dependencies": {DSH_PACKAGE: DSH_VERSION},
+ },
+ )
+
+ def _write_receipt(self, root: Path, actual: str) -> None:
+ self._write_json(
+ root / "toolchain.json",
+ {
+ "schemaVersion": 1,
+ "package": DSH_PACKAGE,
+ "requestedVersion": DSH_VERSION,
+ "actualVersion": actual,
+ "packageManager": f"pnpm@{PNPM_VERSION}",
+ },
+ )
+
+ @staticmethod
+ def _write_json(path: Path, value: object) -> None:
+ path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+ temporary = path.with_name(f".{path.name}.{uuid.uuid4().hex}.tmp")
+ try:
+ temporary.write_text(
+ json.dumps(value, ensure_ascii=False, indent=2) + "\n",
+ encoding="utf-8",
+ )
+ temporary.chmod(0o600)
+ os.replace(temporary, path)
+ finally:
+ temporary.unlink(missing_ok=True)
+
+ @staticmethod
+ def _installation_environment() -> dict[str, str]:
+ environment = dsh_subprocess_environment()
+ environment.update(
+ {
+ "CI": "1",
+ "COREPACK_ENABLE_PROJECT_SPEC": "0",
+ "NPM_CONFIG_AUDIT": "false",
+ "NPM_CONFIG_FUND": "false",
+ }
+ )
+ return environment
+
+ @staticmethod
+ def _pnpm_environment() -> dict[str, str]:
+ environment = dsh_subprocess_environment()
+ environment["COREPACK_ENABLE_PROJECT_SPEC"] = "0"
+ return environment
+
+ @contextmanager
+ def _install_lock(self) -> Iterator[None]:
+ parent = self._root.parent
+ parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+ lock = parent / f".{DSH_VERSION}.install.lock"
+ deadline = time.monotonic() + self._lock_timeout_seconds
+ while True:
+ try:
+ lock.mkdir(mode=0o700)
+ self._write_json(lock / "owner.json", {"pid": os.getpid()})
+ break
+ except FileExistsError:
+ if self._lock_is_stale(lock):
+ try:
+ shutil.rmtree(lock)
+ except FileNotFoundError:
+ pass
+ continue
+ if time.monotonic() >= deadline:
+ raise DshToolchainInstallError(
+ "another DSH toolchain installation is still in progress"
+ )
+ time.sleep(0.05)
+ try:
+ yield
+ finally:
+ shutil.rmtree(lock, ignore_errors=True)
+
+ @staticmethod
+ def _lock_is_stale(lock: Path) -> bool:
+ try:
+ age = time.time() - lock.stat().st_mtime
+ except FileNotFoundError:
+ return False
+ if age <= _STALE_LOCK_SECONDS:
+ return False
+ try:
+ payload = json.loads((lock / "owner.json").read_text(encoding="utf-8"))
+ pid = int(payload.get("pid", -1))
+ except (OSError, ValueError, TypeError, json.JSONDecodeError):
+ return True
+ if pid <= 0:
+ return True
+ try:
+ os.kill(pid, 0)
+ except ProcessLookupError:
+ return True
+ except (PermissionError, OSError):
+ return False
+ return False
+
+ @staticmethod
+ def _clean_abandoned_staging(parent: Path) -> None:
+ for candidate in parent.glob(f".{DSH_VERSION}.install-*"):
+ if candidate.is_dir() and candidate.parent == parent:
+ shutil.rmtree(candidate)
+
+ def _assert_safe_managed_root(self, root: Path) -> None:
+ if root.name != DSH_VERSION or root.parent.name != "dsh":
+ raise ValueError("managed DSH root must end in dsh/")
+ if root in {Path(root.anchor), Path.home().resolve(), self._base_dir}:
+ raise ValueError("managed DSH root is too broad")
+
+ @staticmethod
+ def _run_command(
+ command: Sequence[str],
+ cwd: Path,
+ environment: Mapping[str, str],
+ ) -> CommandResult:
+ try:
+ completed = subprocess.run(
+ list(command),
+ cwd=cwd,
+ env=dict(environment),
+ check=False,
+ capture_output=True,
+ text=True,
+ timeout=180,
+ )
+ except (OSError, subprocess.TimeoutExpired) as error:
+ raise DshToolchainUnavailableError("toolchain command did not complete") from error
+ if completed.returncode != 0:
+ diagnostic = _redact_diagnostic(completed.stderr or completed.stdout)
+ raise DshToolchainInstallError(
+ f"toolchain command failed with exit code {completed.returncode}"
+ + (f": {diagnostic[-2000:]}" if diagnostic else "")
+ )
+ return CommandResult(stdout=completed.stdout, stderr=completed.stderr)
+
+
+class DshPluginDeveloper:
+ """Create, validate, and pack standard DSH npm bundle projects."""
+
+ def __init__(
+ self,
+ *,
+ toolchain: DshToolchainManager | None = None,
+ explicit_dsh: str | Path | None = None,
+ bridge_factory: Callable[..., DshProfilePluginBridge] = DshProfilePluginBridge,
+ command_runner: CommandRunner | None = None,
+ ) -> None:
+ self._toolchain = toolchain or DshToolchainManager(command_runner=command_runner)
+ self._explicit_dsh = explicit_dsh
+ self._bridge_factory = bridge_factory
+ self._runner = command_runner or DshToolchainManager._run_command
+
+ def create(self, target: Path, *, package_name: str | None = None) -> DshPluginCreateResult:
+ target = target.expanduser().resolve()
+ if target.exists():
+ raise DshPluginSourceError("plugin target already exists")
+ name = package_name or self._default_package_name(target.name)
+ self._validate_package_name(name)
+ target.parent.mkdir(parents=True, exist_ok=True)
+ target.mkdir(mode=0o755)
+ try:
+ package = {
+ "name": name,
+ "version": "0.1.0",
+ "description": "A DeepSeek Harness Cordis plugin bundle.",
+ "type": "module",
+ "main": "index.js",
+ "types": "index.d.ts",
+ "files": ["index.js", "index.d.ts", "cordis.patch.yml"],
+ "engines": {"node": ">=22.19.0"},
+ "peerDependencies": {"@deepseek-ai/cordis": CORDIS_VERSION_RANGE},
+ "dsh": {"bundle": {"patch": "./cordis.patch.yml"}},
+ }
+ (target / "package.json").write_text(
+ json.dumps(package, ensure_ascii=False, indent=2) + "\n",
+ encoding="utf-8",
+ )
+ (target / "cordis.patch.yml").write_text(
+ "- insert:\n"
+ " - id: plugin-main\n"
+ f" name: {json.dumps(name)}\n",
+ encoding="utf-8",
+ )
+ symbol = re.sub(r"[^A-Za-z0-9]+", "-", name).strip("-") or "plugin"
+ (target / "index.js").write_text(
+ f"export const name = {json.dumps(symbol)}\n\n"
+ "/** @param {import('@deepseek-ai/cordis').Context} ctx */\n"
+ "export function apply(ctx) {\n"
+ " // Register resources through Cordis effects so unload is reversible.\n"
+ " ctx.effect(() => () => {})\n"
+ "}\n",
+ encoding="utf-8",
+ )
+ (target / "index.d.ts").write_text(
+ "import type { Context } from '@deepseek-ai/cordis'\n\n"
+ "export declare const name: string\n"
+ "export declare function apply(ctx: Context): void\n",
+ encoding="utf-8",
+ )
+ except BaseException:
+ shutil.rmtree(target, ignore_errors=True)
+ raise
+ return DshPluginCreateResult(
+ package_name=name,
+ target=str(target),
+ entrypoint="index.js",
+ bundle_patch="cordis.patch.yml",
+ )
+
+ def validate(self, source: str | Path) -> DshPluginValidationResult:
+ local_source, _package = self._resolve_local_bundle(source)
+ source_value = str(local_source) if local_source is not None else str(source).strip()
+ command = self._toolchain.require_command(self._explicit_dsh)
+ stage = "start"
+ with tempfile.TemporaryDirectory(prefix="agentengine-dsh-validate-") as directory:
+ root = Path(directory)
+ try:
+ with self._bridge_factory(
+ dsh_home=root / "home",
+ profile="validate",
+ dsh_command=command,
+ cwd=(local_source.parent if local_source is not None else Path.cwd()),
+ ) as bridge:
+ stage = "install"
+ installed = bridge.install_plugin(
+ source_value,
+ accept_host_permissions=True,
+ )
+ stage = "project"
+ projection = bridge.project_profile()
+ stage = "disable"
+ bridge.set_enabled(installed.name, enabled=False)
+ stage = "enable"
+ bridge.set_enabled(installed.name, enabled=True)
+ stage = "uninstall"
+ bridge.uninstall_plugin(installed.name)
+ return DshPluginValidationResult(
+ package_name=installed.name,
+ package_version=installed.version,
+ host_version=projection.host_version,
+ profile_digest=projection.config_digest,
+ )
+ except DshToolchainError:
+ raise
+ except DshBridgeError as error:
+ raise DshPluginValidationError(stage) from error
+ except Exception as error:
+ raise DshPluginValidationError(stage) from error
+
+ def pack(
+ self,
+ source: Path,
+ *,
+ output_dir: Path | None = None,
+ ) -> DshPluginPackResult:
+ local_source, package = self._resolve_local_bundle(source)
+ assert local_source is not None
+ if not local_source.is_dir():
+ raise DshPluginSourceError("only a DSH bundle source directory can be packed")
+ output = (output_dir or local_source / "dist").expanduser().resolve()
+ output.mkdir(parents=True, exist_ok=True)
+ before = {item.resolve() for item in output.glob("*.tgz") if item.is_file()}
+ pnpm = self._toolchain.require_pnpm()
+ environment = dsh_subprocess_environment()
+ # Keep the pinned pnpm selected above even when an ancestor workspace
+ # declares another package manager through Corepack.
+ environment["COREPACK_ENABLE_PROJECT_SPEC"] = "0"
+ try:
+ self._runner(
+ (*pnpm, "pack", "--pack-destination", str(output)),
+ local_source,
+ environment,
+ )
+ except DshToolchainError as error:
+ raise DshPluginPackError("pnpm could not pack the DSH bundle") from error
+ except Exception as error:
+ raise DshPluginPackError("pnpm could not pack the DSH bundle") from error
+ created = [
+ item.resolve()
+ for item in output.glob("*.tgz")
+ if item.is_file() and item.resolve() not in before
+ ]
+ if len(created) != 1 or not created[0].is_relative_to(output):
+ raise DshPluginPackError("pnpm pack did not produce exactly one bounded npm tarball")
+ return DshPluginPackResult(
+ package_name=str(package["name"]),
+ package_version=str(package["version"]),
+ artifact=str(created[0]),
+ )
+
+ @classmethod
+ def _resolve_local_bundle(
+ cls,
+ source: str | Path,
+ ) -> tuple[Path | None, dict[str, Any]]:
+ raw = str(source).strip()
+ candidate = Path(raw).expanduser()
+ looks_local = isinstance(source, Path) or candidate.is_absolute() or raw.startswith(".")
+ if not candidate.exists():
+ if looks_local:
+ raise DshPluginSourceError("local DSH plugin source does not exist")
+ if not raw or raw.startswith("-") or any(char in raw for char in "\r\n\0"):
+ raise DshPluginSourceError("invalid DSH plugin source")
+ return None, {}
+ root = candidate.resolve()
+ if root.is_file() and root.name.endswith(".tgz"):
+ return root, {}
+ if root.is_file() and root.name == "package.json":
+ root = root.parent
+ if not root.is_dir():
+ raise DshPluginSourceError("local DSH plugin source must be a directory")
+ manifest_path = root / "package.json"
+ try:
+ if manifest_path.stat().st_size > _MAX_MANIFEST_BYTES:
+ raise DshPluginSourceError("DSH plugin package.json is too large")
+ package = json.loads(manifest_path.read_text(encoding="utf-8"))
+ except FileNotFoundError:
+ raise DshPluginSourceError("DSH plugin package.json is missing") from None
+ except (OSError, UnicodeError, json.JSONDecodeError) as error:
+ raise DshPluginSourceError("DSH plugin package.json is invalid") from error
+ if not isinstance(package, dict):
+ raise DshPluginSourceError("DSH plugin package.json must be an object")
+ name = package.get("name")
+ version = package.get("version")
+ if not isinstance(name, str) or not isinstance(version, str) or not version.strip():
+ raise DshPluginSourceError("DSH plugin package name/version is invalid")
+ cls._validate_package_name(name)
+ dsh = package.get("dsh")
+ bundle = dsh.get("bundle") if isinstance(dsh, dict) else None
+ patch = bundle.get("patch") if isinstance(bundle, dict) else None
+ if not isinstance(patch, str) or not patch.strip():
+ raise DshPluginSourceError("package.json must declare dsh.bundle.patch")
+ relative = Path(patch)
+ target = (root / relative).resolve()
+ if relative.is_absolute() or ".." in relative.parts or not target.is_relative_to(root):
+ raise DshPluginSourceError("dsh.bundle.patch must stay inside the package")
+ if not target.is_file():
+ raise DshPluginSourceError("declared DSH bundle patch does not exist")
+ return root, package
+
+ @staticmethod
+ def _default_package_name(target_name: str) -> str:
+ value = re.sub(r"[^a-z0-9._-]+", "-", target_name.casefold()).strip("-._")
+ if not value:
+ value = "plugin"
+ return value if value.startswith("dsh-") else f"dsh-{value}"
+
+ @staticmethod
+ def _validate_package_name(name: str) -> None:
+ if len(name) > 214 or not _PACKAGE_NAME.fullmatch(name):
+ raise DshPluginSourceError("plugin name must be a valid lowercase npm package name")
+
+
+__all__ = [
+ "CORDIS_VERSION_RANGE",
+ "DSH_PACKAGE",
+ "DSH_PACKAGE_SPEC",
+ "DSH_VERSION",
+ "PNPM_BIN_ENV",
+ "PNPM_VERSION",
+ "TOOLCHAIN_HOME_ENV",
+ "CommandResult",
+ "DshPluginCreateResult",
+ "DshPluginDeveloper",
+ "DshPluginPackError",
+ "DshPluginPackResult",
+ "DshPluginSourceError",
+ "DshPluginValidationError",
+ "DshPluginValidationResult",
+ "DshToolchainError",
+ "DshToolchainInstallError",
+ "DshToolchainManager",
+ "DshToolchainStatus",
+ "DshToolchainUnavailableError",
+ "DshToolchainVersionMismatchError",
+]
+
+
+def _redact_diagnostic(value: str) -> str:
+ value = re.sub(r"(https?://)[^/\s:@]+:[^/\s@]+@", r"\1[redacted]@", value, flags=re.I)
+ return re.sub(
+ r"((?:token|password|authorization|_authToken)\s*[:=]\s*)[^\s]+",
+ r"\1[redacted]",
+ value,
+ flags=re.I,
+ ).strip()
diff --git a/ksadk/plugins/ecosystem_bridge.py b/ksadk/plugins/ecosystem_bridge.py
new file mode 100644
index 00000000..36feb2db
--- /dev/null
+++ b/ksadk/plugins/ecosystem_bridge.py
@@ -0,0 +1,1105 @@
+"""Frozen ``PluginEcosystemBridge/v1`` source contract.
+
+An ecosystem bridge gives KsADK one lifecycle vocabulary while leaving Codex
+and DeepSeek Harness in charge of their native
+plugin ABI. The contract is deliberately declarative: it does not import
+third-party plugin code, run install scripts, translate Agent loops, or grant
+permissions. Inspection may report unknown versions and undeclared
+permissions, but planning such an external transition fails closed.
+
+The lifecycle is split into read-only discovery (``describe``/``probe``/
+``inspect``), an immutable transition (``plan``/``stage``/``commit``), and
+truthful observed state (``reconcile``/``rollback``/``dispose``). External
+plugins without an explicit permission declaration are rejected fail-closed.
+Secrets may only cross the boundary as references.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Annotated, Literal, Protocol, cast, runtime_checkable
+from urllib.parse import parse_qsl, urlsplit
+
+from pydantic import AwareDatetime, ConfigDict, Field, RootModel, field_validator, model_validator
+
+from ksadk.plugins.contracts import PluginContractModel
+
+PluginEcosystem = Literal["codex", "dsh"]
+PluginIntegrationMode = Literal["bridged", "linked"]
+PluginSupportMaturity = Literal[
+ "detected",
+ "linked-ready",
+ "bridged-ready",
+ "unsupported",
+ "experimental",
+]
+PluginDesiredState = Literal["disabled", "enabled"]
+PluginObservedState = Literal[
+ "resolved",
+ "admitted",
+ "staged",
+ "starting",
+ "ready",
+ "degraded",
+ "failed",
+ "draining",
+ "stopped",
+ "disposed",
+ "rejected",
+]
+BridgeAction = Literal[
+ "describe",
+ "probe",
+ "inspect",
+ "plan",
+ "stage",
+ "commit",
+ "reconcile",
+ "rollback",
+ "dispose",
+]
+
+_ID = re.compile(r"^[a-z0-9]+(?:[._-][a-z0-9]+)*$")
+_SEMVER = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
+_DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")
+_REF = re.compile(r"^[a-z][a-z0-9+.-]*://\S+$")
+_SECRET_REF = re.compile(r"^(?:secret|env|credential|vault)://\S+$")
+_PROTOCOL = re.compile(r"^[a-z][a-z0-9._-]*/v[1-9][0-9]*$")
+_SENSITIVE_QUERY_KEY = re.compile(r"(?:secret|password|token|api[_-]?key)", re.IGNORECASE)
+
+
+def _validate_id(value: str, *, field: str) -> str:
+ if not _ID.fullmatch(value):
+ raise ValueError(f"{field} must be a lowercase qualified id")
+ return value
+
+
+def _validate_semver(value: str, *, field: str) -> str:
+ if not _SEMVER.fullmatch(value):
+ raise ValueError(f"{field} must use an exact semantic version")
+ return value
+
+
+def _validate_digest(value: str) -> str:
+ if not _DIGEST.fullmatch(value):
+ raise ValueError("digest must be a lowercase sha256: digest")
+ return value
+
+
+def _validate_ref(value: str, *, field: str) -> str:
+ if not _REF.fullmatch(value):
+ raise ValueError(f"{field} must be an absolute typed reference")
+ parsed = urlsplit(value)
+ if parsed.username is not None or parsed.password is not None:
+ raise ValueError(f"{field} must not embed credentials")
+ if any(_SENSITIVE_QUERY_KEY.search(key) for key, _ in parse_qsl(parsed.query)):
+ raise ValueError(f"{field} must not embed secret query parameters")
+ return value
+
+
+def _unique(value: tuple[str, ...], *, field: str) -> tuple[str, ...]:
+ if any(not item for item in value):
+ raise ValueError(f"{field} entries must not be empty")
+ if len(value) != len(set(value)):
+ raise ValueError(f"{field} entries must be unique")
+ return value
+
+
+class BridgeHostRequirement(PluginContractModel):
+ host_id: str = Field(min_length=2, max_length=128)
+ version_constraint: str = Field(min_length=1, max_length=128)
+ protocol: str = Field(min_length=3, max_length=128)
+ protocol_constraint: str = Field(min_length=1, max_length=128)
+
+ @field_validator("host_id")
+ @classmethod
+ def validate_host_id(cls, value: str) -> str:
+ return _validate_id(value, field="hostId")
+
+ @field_validator("protocol")
+ @classmethod
+ def validate_protocol(cls, value: str) -> str:
+ if not _PROTOCOL.fullmatch(value):
+ raise ValueError("protocol must be a versioned protocol id")
+ return value
+
+
+class BridgeHostObservation(PluginContractModel):
+ host_id: str = Field(min_length=2, max_length=128)
+ available: bool
+ version: str | None = None
+ protocol: str | None = Field(default=None, min_length=3, max_length=128)
+ protocol_version: str | None = None
+ digest: str | None = None
+
+ @field_validator("host_id")
+ @classmethod
+ def validate_host_id(cls, value: str) -> str:
+ return _validate_id(value, field="hostId")
+
+ @field_validator("version", "protocol_version")
+ @classmethod
+ def validate_optional_version(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_semver(value, field="host version")
+ return value
+
+ @field_validator("protocol")
+ @classmethod
+ def validate_optional_protocol(cls, value: str | None) -> str | None:
+ if value is not None and not _PROTOCOL.fullmatch(value):
+ raise ValueError("host protocol must be a versioned protocol id")
+ return value
+
+ @field_validator("digest")
+ @classmethod
+ def validate_optional_digest(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_digest(value)
+ return value
+
+ @model_validator(mode="after")
+ def validate_observation(self) -> "BridgeHostObservation":
+ trace = (self.version, self.protocol, self.protocol_version, self.digest)
+ if self.available and any(item is None for item in trace):
+ raise ValueError("available host observations require version, protocol, and digest")
+ if not self.available and any(item is not None for item in trace):
+ raise ValueError("unavailable host observations cannot claim host identity facts")
+ return self
+
+
+class BridgeDescriptor(PluginContractModel):
+ descriptor_format: Literal["ksadk.plugin-ecosystem-bridge-descriptor/v1"] = (
+ "ksadk.plugin-ecosystem-bridge-descriptor/v1"
+ )
+ bridge_id: str = Field(min_length=3, max_length=128)
+ bridge_version: str
+ bridge_digest: str
+ ecosystem: PluginEcosystem
+ integration_mode: PluginIntegrationMode
+ maturity: PluginSupportMaturity
+ host_requirement: BridgeHostRequirement | None
+ supported_actions: tuple[BridgeAction, ...]
+
+ @field_validator("bridge_id")
+ @classmethod
+ def validate_bridge_id(cls, value: str) -> str:
+ return _validate_id(value, field="bridgeId")
+
+ @field_validator("bridge_version")
+ @classmethod
+ def validate_bridge_version(cls, value: str) -> str:
+ return _validate_semver(value, field="bridge version")
+
+ @field_validator("bridge_digest")
+ @classmethod
+ def validate_bridge_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("supported_actions")
+ @classmethod
+ def validate_actions(cls, value: tuple[BridgeAction, ...]) -> tuple[BridgeAction, ...]:
+ if not value or len(value) != len(set(value)):
+ raise ValueError("supportedActions must be non-empty and unique")
+ return value
+
+ @model_validator(mode="after")
+ def validate_mode(self) -> "BridgeDescriptor":
+ if self.host_requirement is None:
+ raise ValueError("bridged and linked bridges require an external host")
+ if self.maturity == "bridged-ready" and self.integration_mode != "bridged":
+ raise ValueError("bridged-ready maturity requires bridged integration")
+ if self.maturity == "linked-ready" and self.integration_mode != "linked":
+ raise ValueError("linked-ready maturity requires linked integration")
+ return self
+
+
+class BridgeDescribeRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-describe/v1"] = "ksadk.bridge-describe/v1"
+ ecosystem: PluginEcosystem
+
+
+class BridgeDescribeResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-describe-result/v1"] = "ksadk.bridge-describe-result/v1"
+ descriptor: BridgeDescriptor
+
+
+class PluginManifestCandidate(PluginContractModel):
+ ecosystem: PluginEcosystem
+ integration_mode: PluginIntegrationMode
+ maturity: PluginSupportMaturity
+ manifest_kind: Literal["codex-plugin", "dsh-bundle"]
+ manifest_ref: str = Field(min_length=4, max_length=4096)
+ manifest_digest: str
+
+ @field_validator("manifest_ref")
+ @classmethod
+ def validate_manifest_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="manifestRef")
+
+ @field_validator("manifest_digest")
+ @classmethod
+ def validate_manifest_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @model_validator(mode="after")
+ def validate_candidate_mode(self) -> "PluginManifestCandidate":
+ expected_kind = {"codex": "codex-plugin", "dsh": "dsh-bundle"}[
+ self.ecosystem
+ ]
+ if self.manifest_kind != expected_kind:
+ raise ValueError("manifestKind does not match the detected ecosystem")
+ return self
+
+
+class BridgeProbeRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-probe/v1"] = "ksadk.bridge-probe/v1"
+ source_ref: str = Field(min_length=4, max_length=4096)
+ source_digest: str
+ selected_manifest_ref: str | None = Field(default=None, min_length=4, max_length=4096)
+
+ @field_validator("source_ref", "selected_manifest_ref")
+ @classmethod
+ def validate_source_ref(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_ref(value, field="source reference")
+ return value
+
+ @field_validator("source_digest")
+ @classmethod
+ def validate_source_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class BridgeRejection(PluginContractModel):
+ rejection_format: Literal["ksadk.bridge-rejection/v1"] = "ksadk.bridge-rejection/v1"
+ action: BridgeAction
+ code: Literal[
+ "ambiguous_manifest",
+ "permissions_undeclared",
+ "host_unavailable",
+ "host_incompatible",
+ "digest_mismatch",
+ "unsupported",
+ ]
+ retryable: bool
+ message: str = Field(min_length=1, max_length=1024)
+ host: BridgeHostObservation | None = None
+
+ @model_validator(mode="after")
+ def validate_host_rejection(self) -> "BridgeRejection":
+ if self.code in {"host_unavailable", "host_incompatible"} and self.host is None:
+ raise ValueError("host rejection requires a typed host observation")
+ if self.code == "host_unavailable" and self.host is not None and self.host.available:
+ raise ValueError("host_unavailable cannot claim that the host is available")
+ return self
+
+
+class BridgeProbeResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-probe-result/v1"] = "ksadk.bridge-probe-result/v1"
+ candidates: tuple[PluginManifestCandidate, ...] = ()
+ selection_required: bool
+ selected_manifest_ref: str | None = Field(default=None, min_length=4, max_length=4096)
+ rejection: BridgeRejection | None = None
+
+ @field_validator("selected_manifest_ref")
+ @classmethod
+ def validate_selected_manifest_ref(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_ref(value, field="selectedManifestRef")
+ return value
+
+ @model_validator(mode="after")
+ def validate_candidates(self) -> "BridgeProbeResult":
+ refs = [item.manifest_ref for item in self.candidates]
+ if len(refs) != len(set(refs)):
+ raise ValueError("probe candidates must have unique manifestRef values")
+ if not refs:
+ if self.rejection is None or self.rejection.action != "probe":
+ raise ValueError("empty probe requires a typed probe rejection")
+ if self.selection_required or self.selected_manifest_ref is not None:
+ raise ValueError("rejected probe cannot claim a manifest selection")
+ return self
+ if self.rejection is not None:
+ raise ValueError("successful probe candidates cannot carry a rejection")
+ if self.selection_required and self.selected_manifest_ref is not None:
+ raise ValueError("selectionRequired cannot also claim a selected manifest")
+ if not self.selection_required:
+ if self.selected_manifest_ref is None:
+ raise ValueError("a completed probe requires selectedManifestRef")
+ if self.selected_manifest_ref not in refs:
+ raise ValueError("selectedManifestRef must identify a probe candidate")
+ return self
+
+
+class BridgeProbeExchange(PluginContractModel):
+ fixture_kind: Literal["probe"] = "probe"
+ request: BridgeProbeRequest
+ result: BridgeProbeResult
+
+ @model_validator(mode="after")
+ def validate_explicit_selection(self) -> "BridgeProbeExchange":
+ candidate_refs = {item.manifest_ref for item in self.result.candidates}
+ if not candidate_refs:
+ return self
+ selected = self.request.selected_manifest_ref
+ if len(candidate_refs) > 1 and selected is None:
+ if not self.result.selection_required or self.result.selected_manifest_ref is not None:
+ raise ValueError("multiple manifests require explicit selection")
+ else:
+ if selected is None:
+ selected = next(iter(candidate_refs))
+ if selected not in candidate_refs:
+ raise ValueError("requested manifest selection was not detected")
+ if self.result.selection_required or self.result.selected_manifest_ref != selected:
+ raise ValueError("probe result must preserve the explicit manifest selection")
+ return self
+
+
+class EcosystemPluginDescriptor(PluginContractModel):
+ descriptor_format: Literal["ksadk.ecosystem-plugin-descriptor/v1"] = (
+ "ksadk.ecosystem-plugin-descriptor/v1"
+ )
+ ecosystem: PluginEcosystem
+ plugin_id: str = Field(min_length=2, max_length=256)
+ plugin_version: str | None = None
+ integration_mode: PluginIntegrationMode
+ maturity: PluginSupportMaturity
+ source_ref: str = Field(min_length=4, max_length=4096)
+ artifact_digest: str
+ manifest_ref: str = Field(min_length=4, max_length=4096)
+ manifest_digest: str
+ host_requirement: BridgeHostRequirement | None
+ permissions_declared: bool
+ install_permissions: tuple[str, ...] = ()
+ runtime_permissions: tuple[str, ...] = ()
+ auth_scopes: tuple[str, ...] = ()
+ secret_refs: tuple[str, ...] = ()
+ components: tuple[str, ...] = ()
+
+ @field_validator("plugin_id")
+ @classmethod
+ def validate_plugin_id(cls, value: str) -> str:
+ return _validate_id(value, field="pluginId")
+
+ @field_validator("plugin_version")
+ @classmethod
+ def validate_plugin_version(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_semver(value, field="plugin version")
+ return value
+
+ @field_validator("source_ref", "manifest_ref")
+ @classmethod
+ def validate_descriptor_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="descriptor reference")
+
+ @field_validator("artifact_digest", "manifest_digest")
+ @classmethod
+ def validate_descriptor_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("install_permissions", "runtime_permissions", "auth_scopes", "components")
+ @classmethod
+ def validate_unique_values(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ return _unique(value, field="descriptor list")
+
+ @field_validator("secret_refs")
+ @classmethod
+ def validate_secret_refs(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ _unique(value, field="secretRefs")
+ if any(not _SECRET_REF.fullmatch(item) for item in value):
+ raise ValueError("secretRefs may contain references only")
+ return value
+
+ @model_validator(mode="after")
+ def validate_external_shape(self) -> "EcosystemPluginDescriptor":
+ if self.integration_mode != "native" and self.host_requirement is None:
+ raise ValueError("bridged and linked plugins require an external host")
+ if self.integration_mode == "native" and self.host_requirement is not None:
+ raise ValueError("native plugins cannot require an external host")
+ return self
+
+
+class BridgeInspectRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-inspect/v1"] = "ksadk.bridge-inspect/v1"
+ bridge_id: str = Field(min_length=3, max_length=128)
+ source_ref: str = Field(min_length=4, max_length=4096)
+ source_digest: str
+ candidate: PluginManifestCandidate
+
+ @field_validator("bridge_id")
+ @classmethod
+ def validate_bridge_id(cls, value: str) -> str:
+ return _validate_id(value, field="bridgeId")
+
+ @field_validator("source_ref")
+ @classmethod
+ def validate_source_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="sourceRef")
+
+ @field_validator("source_digest")
+ @classmethod
+ def validate_source_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class BridgeInspectResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-inspect-result/v1"] = "ksadk.bridge-inspect-result/v1"
+ status: Literal["accepted", "rejected"]
+ descriptor: EcosystemPluginDescriptor | None = None
+ rejection: BridgeRejection | None = None
+
+ @model_validator(mode="after")
+ def validate_outcome(self) -> "BridgeInspectResult":
+ if self.status == "accepted" and (self.descriptor is None or self.rejection is not None):
+ raise ValueError("accepted inspection requires descriptor only")
+ if self.status == "rejected" and (self.rejection is None or self.descriptor is not None):
+ raise ValueError("rejected inspection requires rejection only")
+ return self
+
+
+class BridgeInspectExchange(PluginContractModel):
+ fixture_kind: Literal["rejection"] = "rejection"
+ request: BridgeInspectRequest
+ result: BridgeInspectResult
+
+
+class BridgePlanRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-plan/v1"] = "ksadk.bridge-plan/v1"
+ descriptor: EcosystemPluginDescriptor
+ operation: Literal["install", "update", "enable", "disable", "uninstall"]
+ desired_state: PluginDesiredState
+ bound_references: tuple[str, ...] = ()
+ authorization_ref: str = Field(min_length=4, max_length=2048)
+ accept_undeclared_permissions: bool = False
+
+ @field_validator("bound_references")
+ @classmethod
+ def validate_bound_references(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ return _unique(value, field="boundReferences")
+
+ @field_validator("authorization_ref")
+ @classmethod
+ def validate_authorization_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="authorizationRef")
+
+ @model_validator(mode="after")
+ def validate_admission(self) -> "BridgePlanRequest":
+ if self.descriptor.plugin_version is None:
+ raise ValueError("planning requires an exact inspected plugin version")
+ permissions_undeclared = (
+ self.descriptor.integration_mode != "native"
+ and not self.descriptor.permissions_declared
+ )
+ if permissions_undeclared and not self.accept_undeclared_permissions:
+ raise ValueError(
+ "external plugin permissions are undeclared; explicit risk acceptance is required"
+ )
+ if permissions_undeclared and (
+ not self.descriptor.install_permissions
+ or "process:host-user" not in self.descriptor.runtime_permissions
+ ):
+ raise ValueError(
+ "undeclared external permissions require conservative install permissions "
+ "and process:host-user runtime disclosure"
+ )
+ return self
+
+
+class BridgeTransitionPlan(PluginContractModel):
+ plan_format: Literal["ksadk.bridge-transition-plan/v1"] = "ksadk.bridge-transition-plan/v1"
+ plan_id: str = Field(min_length=1, max_length=256)
+ bridge_id: str = Field(min_length=3, max_length=128)
+ bridge_version: str
+ bridge_digest: str
+ ecosystem: PluginEcosystem
+ plugin_id: str = Field(min_length=2, max_length=256)
+ plugin_version: str
+ integration_mode: PluginIntegrationMode
+ operation: Literal["install", "update", "enable", "disable", "uninstall"]
+ desired_state: PluginDesiredState
+ descriptor_digest: str
+ artifact_digest: str
+ manifest_digest: str
+ install_permissions: tuple[str, ...] = ()
+ runtime_permissions: tuple[str, ...] = ()
+ auth_scopes: tuple[str, ...] = ()
+ authorization_ref: str = Field(min_length=4, max_length=2048)
+ permissions_declared: bool
+ undeclared_permissions_accepted: bool = False
+ bound_references: tuple[str, ...] = ()
+ host_requirement: BridgeHostRequirement | None
+ rollback_point_ref: str | None = Field(default=None, min_length=4, max_length=2048)
+ rollback_point_digest: str | None = None
+ plan_digest: str
+ created_at: AwareDatetime
+
+ @field_validator("bridge_id", "plugin_id")
+ @classmethod
+ def validate_ids(cls, value: str) -> str:
+ return _validate_id(value, field="plan id")
+
+ @field_validator("bridge_version", "plugin_version")
+ @classmethod
+ def validate_versions(cls, value: str) -> str:
+ return _validate_semver(value, field="plan version")
+
+ @field_validator(
+ "bridge_digest",
+ "descriptor_digest",
+ "artifact_digest",
+ "manifest_digest",
+ "rollback_point_digest",
+ "plan_digest",
+ )
+ @classmethod
+ def validate_digests(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_digest(value)
+ return value
+
+ @field_validator("authorization_ref", "rollback_point_ref")
+ @classmethod
+ def validate_plan_refs(cls, value: str | None) -> str | None:
+ if value is not None:
+ return _validate_ref(value, field="plan reference")
+ return value
+
+ @field_validator(
+ "install_permissions", "runtime_permissions", "auth_scopes", "bound_references"
+ )
+ @classmethod
+ def validate_plan_lists(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ return _unique(value, field="plan list")
+
+ @model_validator(mode="after")
+ def validate_rollback_pair(self) -> "BridgeTransitionPlan":
+ if (self.rollback_point_ref is None) != (self.rollback_point_digest is None):
+ raise ValueError("rollback point reference and digest must appear together")
+ if self.integration_mode != "native" and self.host_requirement is None:
+ raise ValueError("external transition plans require a host")
+ if self.permissions_declared and self.undeclared_permissions_accepted:
+ raise ValueError(
+ "undeclaredPermissionsAccepted must be false when permissions are declared"
+ )
+ if (
+ self.integration_mode != "native"
+ and not self.permissions_declared
+ and not self.undeclared_permissions_accepted
+ ):
+ raise ValueError("external undeclared permissions require recorded risk acceptance")
+ return self
+
+
+class BridgePlanResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-plan-result/v1"] = "ksadk.bridge-plan-result/v1"
+ plan: BridgeTransitionPlan
+
+
+class BridgeStageRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-stage/v1"] = "ksadk.bridge-stage/v1"
+ plan: BridgeTransitionPlan
+ expected_plan_digest: str
+
+ @field_validator("expected_plan_digest")
+ @classmethod
+ def validate_expected_plan_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @model_validator(mode="after")
+ def validate_plan_digest(self) -> "BridgeStageRequest":
+ if self.expected_plan_digest != self.plan.plan_digest:
+ raise ValueError("expectedPlanDigest does not match the immutable plan")
+ return self
+
+
+class BridgeStageResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-stage-result/v1"] = "ksadk.bridge-stage-result/v1"
+ stage_id: str = Field(min_length=1, max_length=256)
+ plan_id: str = Field(min_length=1, max_length=256)
+ plan_digest: str
+ bridge_version: str
+ bridge_digest: str
+ host: BridgeHostObservation
+ artifact_digest: str
+ manifest_digest: str
+ native_stage_ref: str = Field(min_length=4, max_length=2048)
+ native_stage_digest: str
+ staged_at: AwareDatetime
+
+ @field_validator(
+ "plan_digest", "bridge_digest", "artifact_digest", "manifest_digest", "native_stage_digest"
+ )
+ @classmethod
+ def validate_stage_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("bridge_version")
+ @classmethod
+ def validate_bridge_version(cls, value: str) -> str:
+ return _validate_semver(value, field="bridge version")
+
+ @field_validator("native_stage_ref")
+ @classmethod
+ def validate_native_stage_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeStageRef")
+
+ @model_validator(mode="after")
+ def validate_host_available(self) -> "BridgeStageResult":
+ if not self.host.available:
+ raise ValueError("successful stage result requires an available host")
+ return self
+
+
+class BridgeCommitRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-commit/v1"] = "ksadk.bridge-commit/v1"
+ stage_id: str = Field(min_length=1, max_length=256)
+ plan_id: str = Field(min_length=1, max_length=256)
+ plan_digest: str
+ native_stage_ref: str = Field(min_length=4, max_length=2048)
+ native_stage_digest: str
+ idempotency_key: str = Field(min_length=8, max_length=256)
+
+ @field_validator("plan_digest", "native_stage_digest")
+ @classmethod
+ def validate_commit_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("native_stage_ref")
+ @classmethod
+ def validate_native_stage_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeStageRef")
+
+
+class EcosystemInstallReceipt(PluginContractModel):
+ receipt_format: Literal["ksadk.ecosystem-install-receipt/v1"] = (
+ "ksadk.ecosystem-install-receipt/v1"
+ )
+ receipt_id: str = Field(min_length=1, max_length=256)
+ plan_id: str = Field(min_length=1, max_length=256)
+ plan_digest: str
+ stage_id: str = Field(min_length=1, max_length=256)
+ ecosystem: PluginEcosystem
+ plugin_id: str = Field(min_length=2, max_length=256)
+ plugin_version: str
+ integration_mode: PluginIntegrationMode
+ desired_state: PluginDesiredState
+ bridge_id: str = Field(min_length=3, max_length=128)
+ bridge_version: str
+ bridge_digest: str
+ host: BridgeHostObservation
+ artifact_digest: str
+ manifest_digest: str
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+ bound_references: tuple[str, ...] = ()
+ committed_at: AwareDatetime
+
+ @field_validator("plugin_id", "bridge_id")
+ @classmethod
+ def validate_receipt_ids(cls, value: str) -> str:
+ return _validate_id(value, field="receipt id")
+
+ @field_validator("plugin_version", "bridge_version")
+ @classmethod
+ def validate_receipt_versions(cls, value: str) -> str:
+ return _validate_semver(value, field="receipt version")
+
+ @field_validator(
+ "plan_digest",
+ "bridge_digest",
+ "artifact_digest",
+ "manifest_digest",
+ "native_receipt_digest",
+ )
+ @classmethod
+ def validate_receipt_digests(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("bound_references")
+ @classmethod
+ def validate_bound_references(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ return _unique(value, field="boundReferences")
+
+ @model_validator(mode="after")
+ def validate_host_available(self) -> "EcosystemInstallReceipt":
+ if self.integration_mode != "native" and not self.host.available:
+ raise ValueError("external install receipt requires an available native host")
+ return self
+
+
+class BridgeCommitResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-commit-result/v1"] = "ksadk.bridge-commit-result/v1"
+ receipt: EcosystemInstallReceipt
+
+
+class BridgeReconcileRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-reconcile/v1"] = "ksadk.bridge-reconcile/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("native_receipt_digest")
+ @classmethod
+ def validate_native_receipt_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class EcosystemPluginInventory(PluginContractModel):
+ inventory_format: Literal["ksadk.ecosystem-inventory/v1"] = "ksadk.ecosystem-inventory/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ ecosystem: PluginEcosystem
+ plugin_id: str = Field(min_length=2, max_length=256)
+ plugin_version: str
+ integration_mode: PluginIntegrationMode
+ desired_state: PluginDesiredState
+ observed_state: PluginObservedState
+ maturity: PluginSupportMaturity
+ bridge_id: str = Field(min_length=3, max_length=128)
+ bridge_version: str
+ bridge_digest: str
+ host: BridgeHostObservation | None
+ artifact_digest: str
+ manifest_digest: str
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+ bound_references: tuple[str, ...] = ()
+ reason_code: str | None = Field(default=None, max_length=128)
+ reconciled_at: AwareDatetime
+
+ @field_validator("plugin_id", "bridge_id")
+ @classmethod
+ def validate_inventory_ids(cls, value: str) -> str:
+ return _validate_id(value, field="inventory id")
+
+ @field_validator("plugin_version", "bridge_version")
+ @classmethod
+ def validate_inventory_versions(cls, value: str) -> str:
+ return _validate_semver(value, field="inventory version")
+
+ @field_validator("bridge_digest", "artifact_digest", "manifest_digest", "native_receipt_digest")
+ @classmethod
+ def validate_inventory_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("bound_references")
+ @classmethod
+ def validate_bound_references(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ return _unique(value, field="boundReferences")
+
+ @model_validator(mode="after")
+ def validate_observed_truth(self) -> "EcosystemPluginInventory":
+ if self.integration_mode != "native" and self.host is None:
+ raise ValueError("external inventory requires a host observation")
+ if self.host is not None and not self.host.available and self.observed_state == "ready":
+ raise ValueError("unavailable host cannot be reconciled as ready")
+ if self.observed_state in {"degraded", "failed", "rejected"} and not self.reason_code:
+ raise ValueError("unhealthy inventory requires reasonCode")
+ return self
+
+
+class BridgeReconcileResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-reconcile-result/v1"] = "ksadk.bridge-reconcile-result/v1"
+ inventory: EcosystemPluginInventory
+
+
+class BridgeRollbackRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-rollback/v1"] = "ksadk.bridge-rollback/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ rollback_point_ref: str = Field(min_length=4, max_length=2048)
+ rollback_point_digest: str
+ expected_native_receipt_digest: str
+
+ @field_validator("rollback_point_ref")
+ @classmethod
+ def validate_rollback_point_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="rollbackPointRef")
+
+ @field_validator("rollback_point_digest", "expected_native_receipt_digest")
+ @classmethod
+ def validate_rollback_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class BridgeRollbackResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-rollback-result/v1"] = "ksadk.bridge-rollback-result/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ state: Literal["rolled-back"]
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+ rolled_back_at: AwareDatetime
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("native_receipt_digest")
+ @classmethod
+ def validate_native_receipt_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class BridgeDisposeRequest(PluginContractModel):
+ request_format: Literal["ksadk.bridge-dispose/v1"] = "ksadk.bridge-dispose/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("native_receipt_digest")
+ @classmethod
+ def validate_native_receipt_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class BridgeDisposeResult(PluginContractModel):
+ result_format: Literal["ksadk.bridge-dispose-result/v1"] = "ksadk.bridge-dispose-result/v1"
+ receipt_id: str = Field(min_length=1, max_length=256)
+ state: Literal["disposed"]
+ native_receipt_ref: str = Field(min_length=4, max_length=2048)
+ native_receipt_digest: str
+ disposed_at: AwareDatetime
+
+ @field_validator("native_receipt_ref")
+ @classmethod
+ def validate_native_receipt_ref(cls, value: str) -> str:
+ return _validate_ref(value, field="nativeReceiptRef")
+
+ @field_validator("native_receipt_digest")
+ @classmethod
+ def validate_native_receipt_digest(cls, value: str) -> str:
+ return _validate_digest(value)
+
+
+class PluginEcosystemBridgeTranscript(PluginContractModel):
+ fixture_kind: Literal["lifecycle"] = "lifecycle"
+ contract_format: Literal["ksadk.plugin-ecosystem-bridge/v1"] = (
+ "ksadk.plugin-ecosystem-bridge/v1"
+ )
+ describe_request: BridgeDescribeRequest
+ describe_result: BridgeDescribeResult
+ probe: BridgeProbeExchange
+ inspect_request: BridgeInspectRequest
+ inspect_result: BridgeInspectResult
+ plan_request: BridgePlanRequest
+ plan_result: BridgePlanResult
+ stage_request: BridgeStageRequest
+ stage_result: BridgeStageResult
+ commit_request: BridgeCommitRequest
+ commit_result: BridgeCommitResult
+ reconcile_request: BridgeReconcileRequest
+ reconcile_result: BridgeReconcileResult
+ rollback_request: BridgeRollbackRequest
+ rollback_result: BridgeRollbackResult
+ dispose_request: BridgeDisposeRequest
+ dispose_result: BridgeDisposeResult
+
+ @model_validator(mode="after")
+ def validate_traceability(self) -> "PluginEcosystemBridgeTranscript":
+ bridge = self.describe_result.descriptor
+ descriptor = self.inspect_result.descriptor
+ if descriptor is None:
+ raise ValueError("lifecycle transcript requires an accepted inspection")
+ plan = self.plan_result.plan
+ receipt = self.commit_result.receipt
+ inventory = self.reconcile_result.inventory
+ if self.describe_request.ecosystem != bridge.ecosystem:
+ raise ValueError("describe result ecosystem does not match request")
+ if descriptor.ecosystem != bridge.ecosystem or plan.ecosystem != bridge.ecosystem:
+ raise ValueError("ecosystem identity must be preserved through planning")
+ if self.plan_request.descriptor != descriptor:
+ raise ValueError("plan request must preserve the inspected plugin descriptor")
+ if (plan.bridge_id, plan.bridge_version, plan.bridge_digest) != (
+ bridge.bridge_id,
+ bridge.bridge_version,
+ bridge.bridge_digest,
+ ):
+ raise ValueError("transition plan must pin the described bridge identity")
+ if descriptor.host_requirement != bridge.host_requirement:
+ raise ValueError("plugin descriptor must preserve the bridge host requirement")
+ if plan.host_requirement != bridge.host_requirement:
+ raise ValueError("transition plan must preserve the bridge host requirement")
+ if (
+ plan.permissions_declared != descriptor.permissions_declared
+ or plan.undeclared_permissions_accepted
+ != self.plan_request.accept_undeclared_permissions
+ ):
+ raise ValueError("transition plan must preserve permission disclosure and acceptance")
+ if (
+ plan.plugin_id,
+ plan.plugin_version,
+ plan.integration_mode,
+ plan.desired_state,
+ plan.bound_references,
+ ) != (
+ descriptor.plugin_id,
+ descriptor.plugin_version,
+ descriptor.integration_mode,
+ self.plan_request.desired_state,
+ self.plan_request.bound_references,
+ ):
+ raise ValueError("transition plan must preserve plugin identity and desired state")
+ expected_digests = (
+ descriptor.artifact_digest,
+ descriptor.manifest_digest,
+ )
+ observed_digest_pairs = (
+ (plan.artifact_digest, plan.manifest_digest),
+ (self.stage_result.artifact_digest, self.stage_result.manifest_digest),
+ (receipt.artifact_digest, receipt.manifest_digest),
+ (inventory.artifact_digest, inventory.manifest_digest),
+ )
+ if any(pair != expected_digests for pair in observed_digest_pairs):
+ raise ValueError("artifact and manifest digests must remain traceable")
+ if (
+ self.stage_result.plan_id != plan.plan_id
+ or self.stage_result.plan_digest != plan.plan_digest
+ ):
+ raise ValueError("stage result must trace to the immutable transition plan")
+ if self.commit_request.stage_id != self.stage_result.stage_id:
+ raise ValueError("commit request must trace to the staged transition")
+ if receipt.plan_id != plan.plan_id or receipt.stage_id != self.stage_result.stage_id:
+ raise ValueError("install receipt must trace to plan and stage")
+ if self.reconcile_request.receipt_id != receipt.receipt_id:
+ raise ValueError("reconcile request must trace to the install receipt")
+ if inventory.receipt_id != receipt.receipt_id:
+ raise ValueError("inventory must trace to the install receipt")
+ host_observations = (self.stage_result.host, receipt.host, inventory.host)
+ if inventory.host is None or any(
+ item != self.stage_result.host for item in host_observations
+ ):
+ raise ValueError("native host version, protocol, and digest must remain traceable")
+ if self.rollback_request.receipt_id != receipt.receipt_id:
+ raise ValueError("rollback request must trace to the install receipt")
+ if self.dispose_request.receipt_id != receipt.receipt_id:
+ raise ValueError("dispose request must trace to the install receipt")
+ native_digests = {
+ receipt.native_receipt_digest,
+ self.reconcile_request.native_receipt_digest,
+ inventory.native_receipt_digest,
+ self.rollback_request.expected_native_receipt_digest,
+ }
+ if len(native_digests) != 1:
+ raise ValueError("native host receipt digest must remain traceable")
+ if (
+ self.dispose_request.native_receipt_ref != self.rollback_result.native_receipt_ref
+ or self.dispose_request.native_receipt_digest
+ != self.rollback_result.native_receipt_digest
+ ):
+ raise ValueError("dispose request must consume the rollback receipt")
+ if (
+ self.dispose_result.native_receipt_ref != self.dispose_request.native_receipt_ref
+ or self.dispose_result.native_receipt_digest
+ != self.dispose_request.native_receipt_digest
+ ):
+ raise ValueError("dispose result must preserve the disposed native receipt")
+ return self
+
+
+BridgeFixturePayload = Annotated[
+ PluginEcosystemBridgeTranscript | BridgeProbeExchange | BridgeInspectExchange,
+ Field(discriminator="fixture_kind"),
+]
+
+
+class PluginEcosystemBridgeFixture(RootModel[BridgeFixturePayload]):
+ """Schema root shared by lifecycle, ambiguous-manifest and rejection goldens."""
+
+ model_config = ConfigDict(frozen=True)
+
+
+def ecosystem_bridge_json_schema() -> dict[str, object]:
+ """Return the canonical JSON Schema for all v1 bridge conformance fixtures."""
+
+ schema = cast(dict[str, object], PluginEcosystemBridgeFixture.model_json_schema(by_alias=True))
+ schema["$schema"] = "https://json-schema.org/draft/2020-12/schema"
+ schema["$id"] = "https://ksadk.local/contracts/plugin/v1/plugin-ecosystem-bridge.schema.json"
+ schema["title"] = "PluginEcosystemBridge/v1 conformance fixtures"
+ return schema
+
+
+@runtime_checkable
+class PluginEcosystemBridge(Protocol):
+ """Execution-neutral bridge SPI; implementations live outside this contract."""
+
+ async def describe(self, request: BridgeDescribeRequest) -> BridgeDescribeResult: ...
+
+ async def probe(self, request: BridgeProbeRequest) -> BridgeProbeResult: ...
+
+ async def inspect(self, request: BridgeInspectRequest) -> BridgeInspectResult: ...
+
+ async def plan(self, request: BridgePlanRequest) -> BridgePlanResult: ...
+
+ async def stage(self, request: BridgeStageRequest) -> BridgeStageResult: ...
+
+ async def commit(self, request: BridgeCommitRequest) -> BridgeCommitResult: ...
+
+ async def reconcile(self, request: BridgeReconcileRequest) -> BridgeReconcileResult: ...
+
+ async def rollback(self, request: BridgeRollbackRequest) -> BridgeRollbackResult: ...
+
+ async def dispose(self, request: BridgeDisposeRequest) -> BridgeDisposeResult: ...
+
+
+__all__ = [
+ "BridgeAction",
+ "BridgeCommitRequest",
+ "BridgeCommitResult",
+ "BridgeDescribeRequest",
+ "BridgeDescribeResult",
+ "BridgeDescriptor",
+ "BridgeDisposeRequest",
+ "BridgeDisposeResult",
+ "BridgeHostObservation",
+ "BridgeHostRequirement",
+ "BridgeInspectExchange",
+ "BridgeInspectRequest",
+ "BridgeInspectResult",
+ "BridgePlanRequest",
+ "BridgePlanResult",
+ "BridgeProbeExchange",
+ "BridgeProbeRequest",
+ "BridgeProbeResult",
+ "BridgeReconcileRequest",
+ "BridgeReconcileResult",
+ "BridgeRejection",
+ "BridgeRollbackRequest",
+ "BridgeRollbackResult",
+ "BridgeStageRequest",
+ "BridgeStageResult",
+ "BridgeTransitionPlan",
+ "EcosystemInstallReceipt",
+ "EcosystemPluginDescriptor",
+ "EcosystemPluginInventory",
+ "PluginDesiredState",
+ "PluginEcosystem",
+ "PluginEcosystemBridge",
+ "PluginEcosystemBridgeFixture",
+ "PluginEcosystemBridgeTranscript",
+ "PluginIntegrationMode",
+ "PluginManifestCandidate",
+ "PluginObservedState",
+ "PluginSupportMaturity",
+ "ecosystem_bridge_json_schema",
+]
diff --git a/ksadk/plugins/ecosystem_probe.py b/ksadk/plugins/ecosystem_probe.py
new file mode 100644
index 00000000..58dc403d
--- /dev/null
+++ b/ksadk/plugins/ecosystem_probe.py
@@ -0,0 +1,191 @@
+"""Read-only detection for supported plugin ecosystem manifests.
+
+Detection examines only fixed manifest paths. It never walks or imports a
+package, executes install scripts, or parses DSH Cordis YAML (which may contain
+JavaScript tags). A directory with more than one ecosystem manifest remains
+ambiguous until the caller selects an exact manifest reference.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+from ksadk.plugins.ecosystem_bridge import (
+ BridgeProbeExchange,
+ BridgeProbeRequest,
+ BridgeProbeResult,
+ BridgeRejection,
+ PluginManifestCandidate,
+)
+
+_MAX_MANIFEST_BYTES = 1024 * 1024
+
+
+class EcosystemProbeError(ValueError):
+ """A fixed manifest exists but cannot be inspected safely."""
+
+
+def _read_manifest(path: Path, *, root: Path) -> bytes:
+ try:
+ relative = path.relative_to(root)
+ except ValueError as exc:
+ raise EcosystemProbeError("plugin manifest escaped the source root") from exc
+ cursor = root
+ for part in relative.parts:
+ cursor /= part
+ if cursor.is_symlink():
+ raise EcosystemProbeError(
+ f"plugin manifest path must not contain symlinks: {relative.as_posix()}"
+ )
+ if path.is_symlink():
+ raise EcosystemProbeError(f"plugin manifest must not be a symlink: {path.name}")
+ try:
+ stat = path.stat()
+ except OSError as exc:
+ raise EcosystemProbeError(f"plugin manifest cannot be inspected: {path.name}") from exc
+ if not path.is_file():
+ raise EcosystemProbeError(f"plugin manifest is not a regular file: {path.name}")
+ if stat.st_size > _MAX_MANIFEST_BYTES:
+ raise EcosystemProbeError(
+ f"plugin manifest exceeds {_MAX_MANIFEST_BYTES} bytes: {path.name}"
+ )
+ try:
+ return path.read_bytes()
+ except OSError as exc:
+ raise EcosystemProbeError(f"plugin manifest cannot be read: {path.name}") from exc
+
+
+def _json_object(raw: bytes, *, name: str) -> dict[str, Any]:
+ try:
+ value = json.loads(raw)
+ except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+ raise EcosystemProbeError(f"{name} must contain valid UTF-8 JSON") from exc
+ if not isinstance(value, dict):
+ raise EcosystemProbeError(f"{name} must contain one JSON object")
+ return value
+
+
+def _digest(raw: bytes) -> str:
+ return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def _candidate(
+ *,
+ ecosystem: str,
+ integration_mode: str,
+ maturity: str,
+ manifest_kind: str,
+ path: Path,
+ raw: bytes,
+) -> PluginManifestCandidate:
+ return PluginManifestCandidate.model_validate(
+ {
+ "ecosystem": ecosystem,
+ "integrationMode": integration_mode,
+ "maturity": maturity,
+ "manifestKind": manifest_kind,
+ "manifestRef": path.resolve().as_uri(),
+ "manifestDigest": _digest(raw),
+ }
+ )
+
+
+def probe_ecosystem_manifests(
+ root: Path,
+ *,
+ selected_manifest_ref: str | None = None,
+) -> BridgeProbeExchange:
+ """Detect the two supported Codex/DSH manifest formats without executing them."""
+
+ if root.is_symlink():
+ raise EcosystemProbeError("plugin source root must not be a symlink")
+ if not root.is_dir():
+ raise EcosystemProbeError("plugin source root must be an existing directory")
+ root = root.resolve()
+ candidates: list[PluginManifestCandidate] = []
+ source_parts: list[tuple[str, bytes]] = []
+
+ codex_path = root / ".codex-plugin" / "plugin.json"
+ if codex_path.exists():
+ raw = _read_manifest(codex_path, root=root)
+ payload = _json_object(raw, name=".codex-plugin/plugin.json")
+ if not isinstance(payload.get("name"), str) or not payload["name"]:
+ raise EcosystemProbeError("Codex plugin manifest requires a non-empty name")
+ candidates.append(
+ _candidate(
+ ecosystem="codex",
+ integration_mode="bridged",
+ maturity="detected",
+ manifest_kind="codex-plugin",
+ path=codex_path,
+ raw=raw,
+ )
+ )
+ source_parts.append((".codex-plugin/plugin.json", raw))
+
+ package_path = root / "package.json"
+ if package_path.exists():
+ raw = _read_manifest(package_path, root=root)
+ payload = _json_object(raw, name="package.json")
+ dsh = payload.get("dsh")
+ bundle = dsh.get("bundle") if isinstance(dsh, dict) else None
+ patch = bundle.get("patch") if isinstance(bundle, dict) else None
+ if isinstance(patch, str) and patch.strip():
+ candidates.append(
+ _candidate(
+ ecosystem="dsh",
+ integration_mode="linked",
+ maturity="experimental",
+ manifest_kind="dsh-bundle",
+ path=package_path,
+ raw=raw,
+ )
+ )
+ source_parts.append(("package.json", raw))
+
+ source_hash = hashlib.sha256()
+ for relative_path, raw in sorted(source_parts):
+ source_hash.update(relative_path.encode("utf-8"))
+ source_hash.update(b"\0")
+ source_hash.update(raw)
+ source_hash.update(b"\0")
+ source_digest = "sha256:" + source_hash.hexdigest()
+ request = BridgeProbeRequest(
+ source_ref=root.as_uri(),
+ source_digest=source_digest,
+ selected_manifest_ref=selected_manifest_ref,
+ )
+
+ if not candidates:
+ result = BridgeProbeResult(
+ candidates=(),
+ selection_required=False,
+ rejection=BridgeRejection(
+ action="probe",
+ code="unsupported",
+ retryable=False,
+ message="No supported plugin ecosystem manifest was detected.",
+ ),
+ )
+ else:
+ refs = {candidate.manifest_ref for candidate in candidates}
+ if selected_manifest_ref is not None and selected_manifest_ref not in refs:
+ raise EcosystemProbeError("selected manifest was not detected in the source directory")
+ selection_required = len(candidates) > 1 and selected_manifest_ref is None
+ selected = (
+ None
+ if selection_required
+ else selected_manifest_ref or candidates[0].manifest_ref
+ )
+ result = BridgeProbeResult(
+ candidates=tuple(candidates),
+ selection_required=selection_required,
+ selected_manifest_ref=selected,
+ )
+ return BridgeProbeExchange(request=request, result=result)
+
+
+__all__ = ["EcosystemProbeError", "probe_ecosystem_manifests"]
diff --git a/ksadk/plugins/host.py b/ksadk/plugins/host.py
new file mode 100644
index 00000000..33dcdeac
--- /dev/null
+++ b/ksadk/plugins/host.py
@@ -0,0 +1,724 @@
+"""Transactional, side-effect-owning PluginHost foundation (P2-03A).
+
+The host has no knowledge of AgentControl, SessionEvent sequencing, or cloud
+deployment. It only stages a fully resolved profile, atomically swaps it once
+healthy, and disposes owned effects in reverse dependency order.
+"""
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Coroutine, Mapping
+from dataclasses import dataclass
+from typing import Any, Protocol, runtime_checkable
+from uuid import uuid4
+
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import (
+ CompositionProfile,
+ PluginInventory,
+ PluginInventoryItem,
+ PluginLockEntry,
+ PluginManifest,
+)
+from ksadk.plugins.resolver import (
+ PluginRegistry,
+ PluginResolutionError,
+ ResolvedComposition,
+)
+
+
+class PluginHostError(RuntimeError):
+ """Stable reject/failure from PluginHost profile transactions."""
+
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+@runtime_checkable
+class ManagedPlugin(Protocol):
+ """Effects owned by one staged plugin instance."""
+
+ async def start(self) -> None: ...
+
+ async def health(self) -> bool: ...
+
+ async def drain(self) -> None: ...
+
+ async def dispose(self) -> None: ...
+
+
+@runtime_checkable
+class PluginFactory(Protocol):
+ """Factory seam; `stage` must not expose partially started effects."""
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> ManagedPlugin: ...
+
+
+@dataclass(frozen=True)
+class PluginCapabilityBinding:
+ """One locked capability and the active runtime that owns it."""
+
+ plugin_id: str
+ plugin_version: str
+ definition: str
+ slot: str
+ runtime: ManagedPlugin
+
+
+@dataclass(frozen=True)
+class PluginExecutionContext:
+ """Read-only capability view passed to the active AgentProvider."""
+
+ profile_digest: str
+ plugin_lock_digest: str
+ bindings: tuple[PluginCapabilityBinding, ...]
+
+ def all(
+ self,
+ definition: str,
+ *,
+ slot: str | None = None,
+ ) -> tuple[PluginCapabilityBinding, ...]:
+ return tuple(
+ binding
+ for binding in self.bindings
+ if binding.definition == definition
+ and (slot is None or binding.slot == slot)
+ )
+
+ def require(
+ self,
+ definition: str,
+ *,
+ slot: str | None = None,
+ ) -> PluginCapabilityBinding:
+ matches = self.all(definition, slot=slot)
+ if not matches:
+ suffix = f" in slot {slot!r}" if slot is not None else ""
+ raise PluginHostError(
+ "plugin_capability_unavailable",
+ f"active profile does not provide {definition!r}{suffix}",
+ )
+ if len(matches) != 1:
+ raise PluginHostError(
+ "plugin_capability_ambiguous",
+ f"active profile provides more than one {definition!r}; select a slot",
+ )
+ return matches[0]
+
+
+@runtime_checkable
+class PreparedAgent(ManagedPlugin, Protocol):
+ """One provider-owned activation prepared from an immutable Bundle."""
+
+ async def execute(self, request: Any) -> Any: ...
+
+
+@runtime_checkable
+class ExecutableAgentProvider(ManagedPlugin, Protocol):
+ """AgentProvider execution seam used by the first PluginHost vertical.
+
+ ``prepare`` must either return an unstarted activation or clean up all of
+ its own partial effects before raising. PluginHost owns start, health,
+ drain, and dispose for every returned activation.
+ """
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> PreparedAgent: ...
+
+
+@dataclass(frozen=True)
+class _ActivePlugin:
+ entry: PluginLockEntry
+ runtime: ManagedPlugin
+
+
+@dataclass(frozen=True)
+class _ActiveGraph:
+ resolved: ResolvedComposition
+ plugins: tuple[_ActivePlugin, ...]
+
+
+@dataclass
+class _ActiveActivation:
+ key: str
+ graph: _ActiveGraph
+ bundle_digest: str
+ runtime: PreparedAgent
+ operation_lock: asyncio.Lock
+ closed: bool = False
+
+
+class PluginActivationSession:
+ """Provider-owned activation retained across turns for one session.
+
+ The handle is deliberately small: PluginHost still owns lifecycle and
+ profile fencing, while the provider owns any native thread/checkpoint state
+ inside ``PreparedAgent``. Calls are serialized per activation because a
+ conversational session is an ordered command stream.
+ """
+
+ def __init__(self, host: "PluginHost", active: _ActiveActivation) -> None:
+ self._host = host
+ self._active = active
+
+ @property
+ def key(self) -> str:
+ return self._active.key
+
+ @property
+ def bundle_digest(self) -> str:
+ return self._active.bundle_digest
+
+ @property
+ def closed(self) -> bool:
+ return self._active.closed
+
+ async def execute(self, request: Any) -> Any:
+ return await self._host._execute_activation(self._active, request)
+
+ async def runtime_adapter(self) -> Any:
+ """Return an optional provider-owned RuntimeAdapter for AgentKernel.
+
+ ``execute`` remains the minimum cross-provider ABI. Providers that
+ need durable AgentControl/SessionEvent ownership (for example local
+ Scheduler Lite) may expose this additive seam. PluginHost retains the
+ activation/profile fence; unsupported providers fail explicitly.
+ """
+
+ return await self._host._runtime_adapter_activation(self._active)
+
+ async def close(self) -> None:
+ await self._host.close_activation(self._active.key, expected=self._active)
+
+
+class PluginHost:
+ """Apply resolved profiles without tearing down a healthy old graph first."""
+
+ def __init__(
+ self,
+ registry: PluginRegistry,
+ factories: Mapping[str, PluginFactory],
+ *,
+ allowed_permissions: frozenset[str] = frozenset(),
+ services: Mapping[str, Any] | None = None,
+ ) -> None:
+ self._registry = registry
+ self._factories = dict(factories)
+ self._allowed_permissions = frozenset(allowed_permissions)
+ self._services = dict(services or {})
+ self._transaction_lock = asyncio.Lock()
+ self._active: _ActiveGraph | None = None
+ # A profile switch moves default admission atomically, while already
+ # prepared conversations may hold provider-native thread/checkpoint
+ # state. Retired graphs are reclaimed only after their last session
+ # activation closes.
+ self._retired: list[_ActiveGraph] = []
+ self._activations: dict[str, _ActiveActivation] = {}
+ self._last_failure: PluginHostError | None = None
+
+ async def apply(self, profile: CompositionProfile) -> PluginInventory:
+ """Resolve, admit, stage, health-check, then atomically switch profile.
+
+ Any resolve/admission/stage/health error leaves the current graph
+ untouched. Staged effects from the failed candidate are drained and
+ disposed before the error is returned.
+ """
+
+ async with self._transaction_lock:
+ resolved = self.preflight(profile)
+ if self._active and (
+ self._active.resolved.profile_digest == resolved.profile_digest
+ and self._active.resolved.plugin_lock_digest == resolved.plugin_lock_digest
+ ):
+ return self._inventory_for(self._active)
+
+ ordered_entries = _dependency_order(resolved.plugin_lock.plugins)
+ staged: list[_ActivePlugin] = []
+ try:
+ for entry in ordered_entries:
+ manifest = self._registry.manifest_for(entry.id, entry.version)
+ factory = self._factories[entry.id]
+ runtime = await factory.stage(
+ manifest,
+ profile=resolved.profile,
+ services=self._services,
+ )
+ staged.append(_ActivePlugin(entry=entry, runtime=runtime))
+ for plugin in staged:
+ await plugin.runtime.start()
+ if not await plugin.runtime.health():
+ raise PluginHostError(
+ "plugin_health_failed",
+ f"plugin {plugin.entry.id}@{plugin.entry.version} failed health check",
+ )
+ except asyncio.CancelledError:
+ await self._finish_cleanup(self._dispose_staged(staged))
+ raise
+ except PluginHostError as error:
+ await self._finish_cleanup(self._dispose_staged(staged))
+ self._last_failure = error
+ raise
+ except Exception as error: # noqa: BLE001 - boundary adapts plugins
+ await self._finish_cleanup(self._dispose_staged(staged))
+ failure = PluginHostError("plugin_stage_failed", str(error))
+ self._last_failure = failure
+ raise failure from error
+
+ candidate = _ActiveGraph(resolved=resolved, plugins=tuple(staged))
+ previous = self._active
+ # This single assignment is the profile switch. It only happens
+ # after every staged effect has passed health, preserving the old
+ # graph on all earlier failures.
+ self._active = candidate
+ self._last_failure = None
+ if previous is not None:
+ self._retired.append(previous)
+ await self._finish_cleanup(self._dispose_unpinned_retired_graphs())
+ return self._inventory_for(candidate)
+
+ def preflight(self, profile: CompositionProfile) -> ResolvedComposition:
+ """Resolve and admit a profile without importing or starting a plugin."""
+
+ try:
+ resolved = self._registry.resolve(profile)
+ except PluginResolutionError as error:
+ failure = PluginHostError(error.code, str(error))
+ self._last_failure = failure
+ raise failure from error
+ entries = _dependency_order(resolved.plugin_lock.plugins)
+ self._admit(entries)
+ for entry in entries:
+ if entry.id not in self._factories:
+ failure = PluginHostError(
+ "plugin_factory_unavailable",
+ f"no factory is registered for {entry.id}@{entry.version}",
+ )
+ self._last_failure = failure
+ raise failure
+ return resolved
+
+ def inventory(self) -> PluginInventory | None:
+ """Return only the currently active profile inventory, if any."""
+
+ if self._active is None:
+ return None
+ return self._inventory_for(self._active)
+
+ @property
+ def activation_count(self) -> int:
+ """Number of live provider-owned activations (diagnostic only)."""
+
+ return sum(not active.closed for active in self._activations.values())
+
+ async def execute(self, bundle: ResolvedPluginBundle, request: Any) -> Any:
+ """Execute one disposable activation (compatibility convenience API)."""
+
+ session = await self.open_activation(
+ bundle,
+ activation_key=f"one-shot:{uuid4().hex}",
+ )
+ try:
+ return await session.execute(request)
+ finally:
+ await session.close()
+
+ async def open_activation(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ activation_key: str,
+ ) -> PluginActivationSession:
+ """Open or reuse one profile-fenced, provider-owned activation.
+
+ Reuse is permitted for the exact graph and immutable Bundle digest. A
+ profile switch retires its old graph for new sessions, but an existing
+ session key remains pinned to that graph until it closes.
+ """
+
+ key = str(activation_key).strip()
+ if not key or len(key) > 512:
+ raise PluginHostError(
+ "agent_activation_key_invalid",
+ "activation_key must be a non-empty value of at most 512 characters",
+ )
+ async with self._transaction_lock:
+ existing = self._activations.get(key)
+ if existing is not None:
+ if (
+ not existing.closed
+ and existing.bundle_digest == bundle.bundle_digest
+ and self._bundle_matches_graph(bundle, existing.graph)
+ ):
+ # This activation may belong to a retired graph: it was
+ # pinned before a newer profile became active.
+ return PluginActivationSession(self, existing)
+ await self._close_activation_record(existing)
+ if self._activations.get(key) is existing:
+ self._activations.pop(key, None)
+ await self._finish_cleanup(self._dispose_unpinned_retired_graphs())
+
+ graph = self._require_bundle_graph(bundle)
+ runtime = await self._prepare_activation(graph, bundle)
+ active = _ActiveActivation(
+ key=key,
+ graph=graph,
+ bundle_digest=bundle.bundle_digest,
+ runtime=runtime,
+ operation_lock=asyncio.Lock(),
+ )
+ self._activations[key] = active
+ return PluginActivationSession(self, active)
+
+ async def close_activation(
+ self,
+ activation_key: str,
+ *,
+ expected: _ActiveActivation | None = None,
+ ) -> None:
+ """Drain and dispose a retained activation if it is still current."""
+
+ async with self._transaction_lock:
+ active = self._activations.get(activation_key)
+ if active is None or (expected is not None and active is not expected):
+ return
+ await self._close_activation_record(active)
+ if self._activations.get(activation_key) is active:
+ self._activations.pop(activation_key, None)
+ await self._finish_cleanup(self._dispose_unpinned_retired_graphs())
+
+ @property
+ def last_failure(self) -> PluginHostError | None:
+ return self._last_failure
+
+ async def dispose(self) -> None:
+ """Drain and dispose active plus retired graphs; there is no implicit restart."""
+
+ async with self._transaction_lock:
+ graphs = [
+ graph
+ for graph in [self._active, *self._retired]
+ if graph is not None
+ ]
+ self._active = None
+ self._retired = []
+ if graphs:
+ await self._finish_cleanup(self._dispose_all_graphs(graphs))
+
+ @staticmethod
+ async def _finish_cleanup(cleanup: Coroutine[Any, Any, None]) -> None:
+ """Defer caller cancellation until an owned-effect cleanup finishes."""
+
+ cleanup_task = asyncio.create_task(cleanup)
+ interrupted = False
+ while not cleanup_task.done():
+ try:
+ await asyncio.shield(cleanup_task)
+ except asyncio.CancelledError:
+ interrupted = True
+ cleanup_task.result()
+ if interrupted:
+ raise asyncio.CancelledError
+
+ async def _dispose_graph(self, graph: _ActiveGraph) -> None:
+ await self._close_graph_activations(graph)
+ await self._dispose_staged(list(graph.plugins))
+
+ async def _dispose_all_graphs(self, graphs: list[_ActiveGraph]) -> None:
+ await self._close_all_activations()
+ for graph in graphs:
+ await self._dispose_staged(list(graph.plugins))
+
+ async def _dispose_unpinned_retired_graphs(self) -> None:
+ for graph in tuple(self._retired):
+ if any(
+ not activation.closed and activation.graph is graph
+ for activation in self._activations.values()
+ ):
+ continue
+ await self._dispose_staged(list(graph.plugins))
+ self._retired.remove(graph)
+
+ def _admit(self, entries: list[PluginLockEntry]) -> None:
+ for entry in entries:
+ manifest = self._registry.manifest_for(entry.id, entry.version)
+ missing = sorted(set(manifest.spec.permissions) - self._allowed_permissions)
+ if missing:
+ raise PluginHostError(
+ "plugin_permission_denied",
+ f"plugin {entry.id}@{entry.version} requests unapproved permissions: "
+ + ", ".join(missing),
+ )
+
+ @staticmethod
+ async def _dispose_staged(staged: list[_ActivePlugin]) -> None:
+ """Best-effort cleanup preserves the primary failure while draining all effects."""
+
+ for plugin in reversed(staged):
+ try:
+ await plugin.runtime.drain()
+ except Exception: # noqa: BLE001 - disposal must continue
+ pass
+ try:
+ await plugin.runtime.dispose()
+ except Exception: # noqa: BLE001 - disposal must continue
+ pass
+
+ @staticmethod
+ async def _dispose_activation(activation: PreparedAgent) -> None:
+ """Best-effort cleanup for a prepared one-shot activation."""
+
+ try:
+ await activation.drain()
+ except Exception: # noqa: BLE001 - disposal must continue
+ pass
+ try:
+ await activation.dispose()
+ except Exception: # noqa: BLE001 - disposal must continue
+ pass
+
+ def _require_bundle_graph(self, bundle: ResolvedPluginBundle) -> _ActiveGraph:
+ graph = self._active
+ if graph is None:
+ raise PluginHostError(
+ "plugin_profile_inactive", "no plugin profile is active"
+ )
+ if not self._bundle_matches_graph(bundle, graph):
+ raise PluginHostError(
+ "plugin_bundle_profile_mismatch",
+ "Bundle composition does not match the active plugin graph",
+ )
+ return graph
+
+ @staticmethod
+ def _bundle_matches_graph(bundle: ResolvedPluginBundle, graph: _ActiveGraph) -> bool:
+ return (
+ bundle.composition.profile_digest == graph.resolved.profile_digest
+ and bundle.composition.plugin_lock_digest == graph.resolved.plugin_lock_digest
+ )
+
+ async def _prepare_activation(
+ self,
+ graph: _ActiveGraph,
+ bundle: ResolvedPluginBundle,
+ ) -> PreparedAgent:
+ capabilities = self._execution_context(graph)
+ provider_binding = capabilities.require(
+ "agent.provider/v1", slot="agent.execution"
+ )
+ provider = provider_binding.runtime
+ if not isinstance(provider, ExecutableAgentProvider):
+ raise PluginHostError(
+ "agent_provider_not_executable",
+ f"plugin {provider_binding.plugin_id}@"
+ f"{provider_binding.plugin_version} does not implement prepare",
+ )
+
+ activation: PreparedAgent | None = None
+ try:
+ try:
+ activation = await provider.prepare(bundle, capabilities=capabilities)
+ except PluginHostError:
+ raise
+ except Exception as error: # noqa: BLE001 - provider boundary
+ raise PluginHostError("agent_prepare_failed", str(error)) from error
+ if not isinstance(activation, PreparedAgent):
+ raise PluginHostError(
+ "agent_activation_invalid",
+ "AgentProvider.prepare returned an invalid activation",
+ )
+ try:
+ await activation.start()
+ except Exception as error: # noqa: BLE001 - activation boundary
+ raise PluginHostError(
+ "agent_activation_start_failed", str(error)
+ ) from error
+ try:
+ healthy = await activation.health()
+ except Exception as error: # noqa: BLE001 - activation boundary
+ raise PluginHostError(
+ "agent_activation_health_failed", str(error)
+ ) from error
+ if not healthy:
+ raise PluginHostError(
+ "agent_activation_health_failed",
+ "prepared Agent activation failed health check",
+ )
+ return activation
+ except asyncio.CancelledError:
+ if activation is not None:
+ await self._dispose_activation(activation)
+ raise
+ except PluginHostError as error:
+ self._last_failure = error
+ if activation is not None:
+ await self._dispose_activation(activation)
+ raise
+
+ async def _execute_activation(
+ self,
+ active: _ActiveActivation,
+ request: Any,
+ ) -> Any:
+ async with active.operation_lock:
+ if active.closed:
+ raise PluginHostError(
+ "agent_activation_closed",
+ f"Agent activation {active.key!r} is closed",
+ )
+ try:
+ result = await active.runtime.execute(request)
+ except asyncio.CancelledError:
+ await self._dispose_activation(active.runtime)
+ active.closed = True
+ raise
+ except PluginHostError as error:
+ self._last_failure = error
+ await self._dispose_activation(active.runtime)
+ active.closed = True
+ raise
+ except Exception as error: # noqa: BLE001 - provider boundary
+ failure = PluginHostError("agent_execution_failed", str(error))
+ self._last_failure = failure
+ await self._dispose_activation(active.runtime)
+ active.closed = True
+ raise failure from error
+ self._last_failure = None
+ return result
+
+ async def _runtime_adapter_activation(self, active: _ActiveActivation) -> Any:
+ async with active.operation_lock:
+ if active.closed:
+ raise PluginHostError(
+ "agent_activation_closed",
+ f"Agent activation {active.key!r} is closed",
+ )
+ provide = getattr(active.runtime, "runtime_adapter", None)
+ if not callable(provide):
+ raise PluginHostError(
+ "agent_provider_runtime_adapter_unavailable",
+ "AgentProvider does not expose a Kernel RuntimeAdapter",
+ )
+ try:
+ adapter = provide()
+ if asyncio.iscoroutine(adapter):
+ adapter = await adapter
+ except PluginHostError:
+ raise
+ except Exception as error: # noqa: BLE001 - provider boundary
+ raise PluginHostError(
+ "agent_provider_runtime_adapter_failed", str(error)
+ ) from error
+ return adapter
+
+ async def _close_activation_record(self, active: _ActiveActivation) -> None:
+ async with active.operation_lock:
+ if active.closed:
+ return
+ await self._dispose_activation(active.runtime)
+ active.closed = True
+
+ async def _close_graph_activations(self, graph: _ActiveGraph) -> None:
+ for key, active in tuple(self._activations.items()):
+ if active.graph is not graph:
+ continue
+ await self._close_activation_record(active)
+ if self._activations.get(key) is active:
+ self._activations.pop(key, None)
+
+ async def _close_all_activations(self) -> None:
+ for key, active in tuple(self._activations.items()):
+ await self._close_activation_record(active)
+ if self._activations.get(key) is active:
+ self._activations.pop(key, None)
+
+ @staticmethod
+ def _execution_context(graph: _ActiveGraph) -> PluginExecutionContext:
+ bindings = tuple(
+ PluginCapabilityBinding(
+ plugin_id=plugin.entry.id,
+ plugin_version=plugin.entry.version,
+ definition=capability.definition,
+ slot=capability.slot,
+ runtime=plugin.runtime,
+ )
+ for plugin in graph.plugins
+ for capability in plugin.entry.provides
+ )
+ return PluginExecutionContext(
+ profile_digest=graph.resolved.profile_digest,
+ plugin_lock_digest=graph.resolved.plugin_lock_digest,
+ bindings=bindings,
+ )
+
+ @staticmethod
+ def _inventory_for(graph: _ActiveGraph) -> PluginInventory:
+ return PluginInventory(
+ profile_digest=graph.resolved.profile_digest,
+ plugin_lock_digest=graph.resolved.plugin_lock_digest,
+ plugins=[
+ PluginInventoryItem(
+ id=plugin.entry.id,
+ version=plugin.entry.version,
+ digest=plugin.entry.digest,
+ state="ready",
+ health="healthy",
+ )
+ for plugin in graph.plugins
+ ],
+ )
+
+
+def _dependency_order(entries: list[PluginLockEntry]) -> list[PluginLockEntry]:
+ """Dependency-first deterministic topological order from the locked graph."""
+
+ by_id = {entry.id: entry for entry in entries}
+ visiting: set[str] = set()
+ visited: set[str] = set()
+ ordered: list[PluginLockEntry] = []
+
+ def visit(plugin_id: str) -> None:
+ if plugin_id in visiting:
+ raise PluginHostError("plugin_dependency_cycle", "plugin lock dependency cycle")
+ if plugin_id in visited:
+ return
+ entry = by_id.get(plugin_id)
+ if entry is None:
+ raise PluginHostError(
+ "plugin_dependency_unresolved",
+ f"plugin dependency {plugin_id!r} is missing from the lock",
+ )
+ visiting.add(plugin_id)
+ for dependency in sorted(entry.dependencies, key=lambda item: item.id):
+ visit(dependency.id)
+ visiting.remove(plugin_id)
+ visited.add(plugin_id)
+ ordered.append(entry)
+
+ for entry in sorted(entries, key=lambda item: item.id):
+ visit(entry.id)
+ return ordered
+
+
+__all__ = [
+ "ExecutableAgentProvider",
+ "ManagedPlugin",
+ "PluginCapabilityBinding",
+ "PluginActivationSession",
+ "PluginExecutionContext",
+ "PluginFactory",
+ "PluginHost",
+ "PluginHostError",
+ "PreparedAgent",
+]
diff --git a/ksadk/plugins/providers/__init__.py b/ksadk/plugins/providers/__init__.py
new file mode 100644
index 00000000..7416b710
--- /dev/null
+++ b/ksadk/plugins/providers/__init__.py
@@ -0,0 +1,85 @@
+"""Public Provider index without eagerly starting optional runtimes.
+
+The catalog must remain usable in a base install. ADK-backed Harness code is
+loaded only when a caller actually asks for a Harness-specific symbol.
+"""
+
+from __future__ import annotations
+
+from importlib import import_module
+from typing import Any
+
+_EXPORTS = {
+ "BUILTIN_PROVIDER_VERSION": ("legacy_catalog", "BUILTIN_PROVIDER_VERSION"),
+ "CODEX_AGENT_PROVIDER_PLUGIN_ID": ("legacy_catalog", "CODEX_AGENT_PROVIDER_PLUGIN_ID"),
+ "KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID": (
+ "legacy_catalog",
+ "KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID",
+ ),
+ "builtin_agent_provider_manifests": ("legacy_catalog", "builtin_agent_provider_manifests"),
+ "legacy_harness_agent_provider_manifest": (
+ "legacy_catalog",
+ "legacy_harness_agent_provider_manifest",
+ ),
+ "CodexAgentProviderFactory": ("codex", "CodexAgentProviderFactory"),
+ "CodexAgentProviderRuntime": ("codex", "CodexAgentProviderRuntime"),
+ "CodexProviderInventory": ("codex", "CodexProviderInventory"),
+ "CodexTurnRequest": ("codex", "CodexTurnRequest"),
+ "CodexTurnResult": ("codex", "CodexTurnResult"),
+ "SHIPPED_CODEX_DSH_PACKAGE": ("codex_dsh", "SHIPPED_CODEX_DSH_PACKAGE"),
+ "SHIPPED_CODEX_PROVIDER_ID": ("codex_dsh", "SHIPPED_CODEX_PROVIDER_ID"),
+ "SHIPPED_CODEX_PROVIDER_VERSION": ("codex_dsh", "SHIPPED_CODEX_PROVIDER_VERSION"),
+ "KsADKCodexDshBridgeFactory": ("codex_dsh", "KsADKCodexDshBridgeFactory"),
+ "KsADKCodexDshBridgeRuntime": ("codex_dsh", "KsADKCodexDshBridgeRuntime"),
+ "ShippedCodexDshBundle": ("codex_dsh", "ShippedCodexDshBundle"),
+ "shipped_codex_dsh_bundle": ("codex_dsh", "shipped_codex_dsh_bundle"),
+ "shipped_codex_dsh_host_command": ("codex_dsh", "shipped_codex_dsh_host_command"),
+ "DSH_AGENT_PROVIDER_HOST_METHODS": ("dsh", "DSH_AGENT_PROVIDER_HOST_METHODS"),
+ "DSH_AGENT_PROVIDER_HOST_PROTOCOL": ("dsh", "DSH_AGENT_PROVIDER_HOST_PROTOCOL"),
+ "DSH_HOST_USER_PERMISSION": ("dsh", "DSH_HOST_USER_PERMISSION"),
+ "DshAgentProviderDescriptor": ("dsh", "DshAgentProviderDescriptor"),
+ "DshAgentProviderFactory": ("dsh", "DshAgentProviderFactory"),
+ "DshAgentProviderHost": ("dsh", "DshAgentProviderHost"),
+ "DshAgentProviderInventory": ("dsh", "DshAgentProviderInventory"),
+ "DshAgentProviderPreflight": ("dsh", "DshAgentProviderPreflight"),
+ "DshAgentProviderRegistration": ("dsh", "DshAgentProviderRegistration"),
+ "DshAgentProviderRuntime": ("dsh", "DshAgentProviderRuntime"),
+ "DshPreparedAgent": ("dsh", "DshPreparedAgent"),
+ "dsh_agent_provider_manifest": ("dsh", "dsh_agent_provider_manifest"),
+ "HarnessContextSource": ("harness", "HarnessContextSource"),
+ "HarnessMCPSource": ("harness", "HarnessMCPSource"),
+ "HarnessProviderInventory": ("harness", "HarnessProviderInventory"),
+ "HarnessSkillContribution": ("harness", "HarnessSkillContribution"),
+ "HarnessSkillSource": ("harness", "HarnessSkillSource"),
+ "HarnessTurnRequest": ("harness", "HarnessTurnRequest"),
+ "HarnessTurnResult": ("harness", "HarnessTurnResult"),
+ "KsADKHarnessProviderFactory": ("harness", "KsADKHarnessProviderFactory"),
+ "KsADKHarnessProviderRuntime": ("harness", "KsADKHarnessProviderRuntime"),
+ "SHIPPED_HARNESS_DSH_PACKAGE": ("harness_dsh", "SHIPPED_HARNESS_DSH_PACKAGE"),
+ "KsADKHarnessDshBridgeFactory": ("harness_dsh", "KsADKHarnessDshBridgeFactory"),
+ "KsADKHarnessDshBridgeRuntime": ("harness_dsh", "KsADKHarnessDshBridgeRuntime"),
+ "ShippedHarnessDshBundle": ("harness_dsh", "ShippedHarnessDshBundle"),
+ "shipped_harness_dsh_bundle": ("harness_dsh", "shipped_harness_dsh_bundle"),
+ "shipped_harness_dsh_host_command": ("harness_dsh", "shipped_harness_dsh_host_command"),
+ "HarnessProviderSelection": ("legacy", "HarnessProviderSelection"),
+ "LegacyBundleAdapter": ("legacy", "LegacyBundleAdapter"),
+ "LegacyBundleCompatibilityError": ("legacy", "LegacyBundleCompatibilityError"),
+ "LegacyHarnessSource": ("legacy", "LegacyHarnessSource"),
+}
+
+__all__ = list(_EXPORTS)
+
+
+def __getattr__(name: str) -> Any:
+ try:
+ relative_module, attribute = _EXPORTS[name]
+ except KeyError:
+ raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
+ module = import_module(f"{__name__}.{relative_module}")
+ value = getattr(module, attribute)
+ globals()[name] = value
+ return value
+
+
+def __dir__() -> list[str]:
+ return sorted({*globals(), *__all__})
diff --git a/ksadk/plugins/providers/bundles/ksadk-codex/cordis.patch.yml b/ksadk/plugins/providers/bundles/ksadk-codex/cordis.patch.yml
new file mode 100644
index 00000000..b24e9d05
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-codex/cordis.patch.yml
@@ -0,0 +1,3 @@
+- insert:
+ - id: ksadk-codex-provider
+ name: '@kingsoftcloud/ksadk-codex-provider'
diff --git a/ksadk/plugins/providers/bundles/ksadk-codex/index.mjs b/ksadk/plugins/providers/bundles/ksadk-codex/index.mjs
new file mode 100644
index 00000000..596839b8
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-codex/index.mjs
@@ -0,0 +1,18 @@
+const contribution = Object.freeze({
+ ecosystem: 'dsh',
+ definition: 'agent.provider/v1',
+ slot: 'agent.execution',
+ providerId: 'io.ksadk.codex-provider',
+ providerVersion: '1.0.0',
+ displayName: 'Codex',
+ runtimeProtocols: Object.freeze(['agentkit.runtime/v1']),
+})
+
+export const name = 'ksadk-codex-provider'
+
+export function apply(ctx) {
+ // DSH owns package/Profile lifecycle. The fixed KsADK bridge retains the
+ // existing Codex App Server backend and never executes package supplied argv.
+ ctx.provide('ksadkAgentProvider', contribution)
+ ctx.effect(() => () => {})
+}
diff --git a/ksadk/plugins/providers/bundles/ksadk-codex/package.json b/ksadk/plugins/providers/bundles/ksadk-codex/package.json
new file mode 100644
index 00000000..1e365b8b
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-codex/package.json
@@ -0,0 +1,19 @@
+{
+ "name": "@kingsoftcloud/ksadk-codex-provider",
+ "version": "1.0.0",
+ "description": "Official Codex AgentProvider for DeepSeek Harness profiles",
+ "type": "module",
+ "exports": {
+ ".": "./index.mjs",
+ "./cordis.patch.yml": "./cordis.patch.yml"
+ },
+ "files": [
+ "index.mjs",
+ "cordis.patch.yml"
+ ],
+ "dsh": {
+ "bundle": {
+ "patch": "./cordis.patch.yml"
+ }
+ }
+}
diff --git a/ksadk/plugins/providers/bundles/ksadk-harness/cordis.patch.yml b/ksadk/plugins/providers/bundles/ksadk-harness/cordis.patch.yml
new file mode 100644
index 00000000..6e97feff
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-harness/cordis.patch.yml
@@ -0,0 +1,3 @@
+- insert:
+ - id: ksadk-harness-provider
+ name: '@kingsoftcloud/ksadk-harness-provider'
diff --git a/ksadk/plugins/providers/bundles/ksadk-harness/index.mjs b/ksadk/plugins/providers/bundles/ksadk-harness/index.mjs
new file mode 100644
index 00000000..592fdb66
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-harness/index.mjs
@@ -0,0 +1,19 @@
+const contribution = Object.freeze({
+ ecosystem: 'dsh',
+ definition: 'agent.provider/v1',
+ slot: 'agent.execution',
+ providerId: 'io.ksadk.harness-provider',
+ providerVersion: '1.0.0',
+ displayName: 'KsADK Harness',
+ runtimeProtocols: Object.freeze(['agentkit.runtime/v1']),
+})
+
+export const name = 'ksadk-harness-provider'
+
+export function apply(ctx) {
+ // The DSH Profile owns discovery and lifecycle. KsADK consumes this
+ // contribution through its frozen provider-host bridge; the existing
+ // RuntimeAdapter remains the execution backend during migration.
+ ctx.provide('ksadkAgentProvider', contribution)
+ ctx.effect(() => () => {})
+}
diff --git a/ksadk/plugins/providers/bundles/ksadk-harness/package.json b/ksadk/plugins/providers/bundles/ksadk-harness/package.json
new file mode 100644
index 00000000..d05bba7e
--- /dev/null
+++ b/ksadk/plugins/providers/bundles/ksadk-harness/package.json
@@ -0,0 +1,19 @@
+{
+ "name": "@kingsoftcloud/ksadk-harness-provider",
+ "version": "1.0.0",
+ "description": "KsADK Harness AgentProvider for DeepSeek Harness profiles",
+ "type": "module",
+ "exports": {
+ ".": "./index.mjs",
+ "./cordis.patch.yml": "./cordis.patch.yml"
+ },
+ "files": [
+ "index.mjs",
+ "cordis.patch.yml"
+ ],
+ "dsh": {
+ "bundle": {
+ "patch": "./cordis.patch.yml"
+ }
+ }
+}
diff --git a/ksadk/plugins/providers/codex.py b/ksadk/plugins/providers/codex.py
new file mode 100644
index 00000000..c692cfa1
--- /dev/null
+++ b/ksadk/plugins/providers/codex.py
@@ -0,0 +1,722 @@
+"""Runtime-native Codex AgentProvider for the controlled PluginHost.
+
+The provider only projects an immutable AgentBundle into the existing Codex
+RuntimeAdapter/RuntimeExecutor conversation path. Canonical SessionEvents and
+native thread continuation remain owned by that path; no provider-local event
+stream or transcript is created here.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from typing import Any
+
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import CompositionProfile, PluginManifest
+from ksadk.plugins.host import PluginExecutionContext, PluginHostError
+from ksadk.runtime import (
+ RuntimeExecutor,
+ RuntimeLaunchContext,
+ RuntimeServices,
+ build_default_runtime_registry,
+)
+from ksadk.runtime.conversation_execution import invoke_runtime_conversation_once
+from ksadk.sessions import create_session_service
+from ksadk.sessions.base import BaseSessionService
+
+
+@dataclass(frozen=True)
+class CodexProviderInventory:
+ provider: str
+ model: str
+ mcp_servers: tuple[str, ...]
+ skills: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class CodexTurnRequest:
+ user_id: str
+ session_id: str | None
+ messages: tuple[Mapping[str, Any], ...]
+ request_metadata: Mapping[str, Any] | None = None
+ invocation_id: str | None = None
+ model: str | None = None
+ collaboration_mode: str | None = None
+ goal_objective: str | None = None
+
+ @classmethod
+ def parse(cls, value: Any) -> "CodexTurnRequest":
+ if isinstance(value, cls):
+ return value
+ if not isinstance(value, Mapping):
+ raise PluginHostError("codex_input_invalid", "Codex input must be an object")
+ allowed_fields = {
+ "user_id",
+ "userId",
+ "session_id",
+ "sessionId",
+ "messages",
+ "input",
+ "request_metadata",
+ "requestMetadata",
+ "invocation_id",
+ "invocationId",
+ "model",
+ "collaboration_mode",
+ "collaborationMode",
+ "goal_objective",
+ "goalObjective",
+ }
+ unsupported = sorted(str(field) for field in value if field not in allowed_fields)
+ if unsupported:
+ raise PluginHostError(
+ "codex_input_unsupported",
+ "Codex input contains undeclared fields: " + ", ".join(unsupported),
+ )
+ _reject_aliased_duplicates(
+ value,
+ ("user_id", "userId"),
+ ("session_id", "sessionId"),
+ ("request_metadata", "requestMetadata"),
+ ("invocation_id", "invocationId"),
+ ("collaboration_mode", "collaborationMode"),
+ ("goal_objective", "goalObjective"),
+ )
+ if "messages" in value and "input" in value:
+ raise PluginHostError(
+ "codex_input_invalid",
+ "Codex input must use exactly one of messages or input",
+ )
+ user_id = str(value.get("user_id") or value.get("userId") or "").strip()
+ if not user_id:
+ raise PluginHostError("codex_input_invalid", "Codex input requires user_id")
+ raw_messages = value.get("messages")
+ if raw_messages is None and value.get("input") is not None:
+ raw_messages = ({"role": "user", "content": value.get("input")},)
+ if not isinstance(raw_messages, Sequence) or isinstance(
+ raw_messages, (str, bytes)
+ ):
+ raise PluginHostError("codex_input_invalid", "Codex input requires messages")
+ messages: list[Mapping[str, Any]] = []
+ for index, message in enumerate(raw_messages):
+ if not isinstance(message, Mapping):
+ raise PluginHostError(
+ "codex_input_invalid", f"Codex messages[{index}] must be an object"
+ )
+ role = str(message.get("role") or "").strip()
+ if role not in {"system", "user", "assistant", "tool"}:
+ raise PluginHostError(
+ "codex_input_invalid",
+ f"Codex messages[{index}] has unsupported role {role!r}",
+ )
+ messages.append(dict(message))
+ if not messages or messages[-1].get("role") != "user":
+ raise PluginHostError(
+ "codex_input_invalid", "Codex turn must end with a user message"
+ )
+ metadata = value.get("request_metadata") or value.get("requestMetadata")
+ if metadata is not None and not isinstance(metadata, Mapping):
+ raise PluginHostError(
+ "codex_input_invalid", "request_metadata must be an object"
+ )
+ session_id = str(
+ value.get("session_id") or value.get("sessionId") or ""
+ ).strip()
+ invocation_id = str(
+ value.get("invocation_id") or value.get("invocationId") or ""
+ ).strip()
+ if len(invocation_id) > 256:
+ raise PluginHostError(
+ "codex_input_invalid", "Codex invocation_id exceeds 256 characters"
+ )
+ model = str(value.get("model") or "").strip()
+ if len(model) > 256:
+ raise PluginHostError(
+ "codex_input_invalid", "Codex model exceeds 256 characters"
+ )
+ collaboration_mode = (
+ str(value.get("collaboration_mode") or value.get("collaborationMode") or "")
+ .strip()
+ .lower()
+ )
+ if collaboration_mode and collaboration_mode not in {"default", "plan"}:
+ raise PluginHostError(
+ "codex_input_unsupported",
+ "Codex collaboration_mode must be default or plan",
+ )
+ goal_objective = str(
+ value.get("goal_objective") or value.get("goalObjective") or ""
+ ).strip()
+ if len(goal_objective) > 4096:
+ raise PluginHostError(
+ "codex_input_invalid", "Codex goal_objective exceeds 4096 characters"
+ )
+ return cls(
+ user_id=user_id,
+ session_id=session_id or None,
+ messages=tuple(messages),
+ request_metadata=dict(metadata) if metadata is not None else None,
+ invocation_id=invocation_id or None,
+ model=model or None,
+ collaboration_mode=collaboration_mode or None,
+ goal_objective=goal_objective or None,
+ )
+
+
+@dataclass(frozen=True)
+class CodexTurnResult:
+ session_id: str
+ output_text: str
+ usage: Mapping[str, Any]
+ metadata: Mapping[str, Any]
+ inventory: CodexProviderInventory
+
+
+@dataclass(frozen=True)
+class _CodexBundleConfig:
+ model: str
+ allowed_models: tuple[str, ...]
+ prompt: str
+ project_dir: Path
+ launch_config: Mapping[str, Any]
+ inventory: CodexProviderInventory
+
+
+class CodexAgentProviderRuntime:
+ """ExecutableAgentProvider that preserves Codex native loop ownership."""
+
+ def __init__(
+ self,
+ *,
+ plugin_id: str,
+ session_service: BaseSessionService,
+ codex_client_factory: Callable[..., Any] | None,
+ credential_resolver: Any = None,
+ ) -> None:
+ self._plugin_id = plugin_id
+ self._session_service = session_service
+ self._client_factory = codex_client_factory
+ self._credentials = credential_resolver
+ self._ready = False
+ self._disposed = False
+ self._last_activation: CodexAgentActivation | None = None
+
+ @property
+ def disposed(self) -> bool:
+ return self._disposed
+
+ @property
+ def last_activation(self) -> "CodexAgentActivation | None":
+ return self._last_activation
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise RuntimeError("Codex provider is disposed")
+ self._ready = True
+
+ async def health(self) -> bool:
+ return self._ready and not self._disposed
+
+ async def drain(self) -> None:
+ self._ready = False
+
+ async def dispose(self) -> None:
+ self._ready = False
+ self._disposed = True
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> "CodexAgentActivation":
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "codex_provider_unavailable", "Codex provider is not ready"
+ )
+ _reject_external_execution(bundle, capabilities)
+ config = _resolve_bundle_config(
+ bundle,
+ plugin_id=self._plugin_id,
+ credential_resolver=self._credentials,
+ )
+ activation = CodexAgentActivation(
+ bundle=bundle,
+ config=config,
+ session_service=self._session_service,
+ codex_client_factory=self._client_factory,
+ )
+ self._last_activation = activation
+ return activation
+
+
+class CodexAgentProviderFactory:
+ def __init__(
+ self,
+ *,
+ session_service: BaseSessionService | None = None,
+ codex_client_factory: Callable[..., Any] | None = None,
+ credential_resolver: Any = None,
+ ) -> None:
+ self._session_service = session_service
+ self._client_factory = codex_client_factory
+ self._credentials = credential_resolver
+ self.runtime: CodexAgentProviderRuntime | None = None
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> CodexAgentProviderRuntime:
+ del profile
+ service = self._session_service or services.get("session_service")
+ if service is None:
+ service = create_session_service(backend="memory")
+ if not isinstance(service, BaseSessionService):
+ raise PluginHostError(
+ "codex_session_service_invalid",
+ "Codex provider requires a BaseSessionService",
+ )
+ client_factory = self._client_factory or services.get("codex_client_factory")
+ credentials = self._credentials or services.get("credential_resolver")
+ self.runtime = CodexAgentProviderRuntime(
+ plugin_id=manifest.metadata.id,
+ session_service=service,
+ codex_client_factory=client_factory,
+ credential_resolver=credentials,
+ )
+ return self.runtime
+
+
+class CodexAgentActivation:
+ def __init__(
+ self,
+ *,
+ bundle: ResolvedPluginBundle,
+ config: _CodexBundleConfig,
+ session_service: BaseSessionService,
+ codex_client_factory: Callable[..., Any] | None,
+ ) -> None:
+ self._bundle = bundle
+ self._config = config
+ self._session_service = session_service
+ self._executor = RuntimeExecutor(build_default_runtime_registry())
+ self._launch_context = RuntimeLaunchContext(
+ runtime_type="codex",
+ project_dir=config.project_dir,
+ config=config.launch_config,
+ services=RuntimeServices(codex_client_factory=codex_client_factory),
+ )
+ self._ready = False
+ self._disposed = False
+ self._kernel_adapters: list[Any] = []
+
+ @property
+ def disposed(self) -> bool:
+ return self._disposed
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise RuntimeError("Codex activation is disposed")
+ self._ready = True
+
+ async def health(self) -> bool:
+ return self._ready and not self._disposed
+
+ async def execute(self, request: Any) -> CodexTurnResult:
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "codex_activation_unavailable", "Codex activation is not ready"
+ )
+ turn = CodexTurnRequest.parse(request)
+ selected_model = turn.model or self._config.model
+ if selected_model not in self._config.allowed_models:
+ raise PluginHostError(
+ "codex_model_unsupported",
+ f"Codex model {selected_model!r} is not declared by the immutable Bundle",
+ )
+ launch_context = self._turn_launch_context(turn)
+ preparation = await self._executor.prepare_start(launch_context)
+ session_id, result = await invoke_runtime_conversation_once(
+ executor=self._executor,
+ launch_context=launch_context,
+ agent_id=self._bundle.manifest.agent_id,
+ user_id=turn.user_id,
+ messages=[dict(item) for item in turn.messages],
+ session_id=turn.session_id,
+ model=selected_model,
+ instructions=self._config.prompt,
+ request_metadata=turn.request_metadata,
+ invocation_id=turn.invocation_id,
+ session_service_provider=lambda: self._session_service,
+ runtime_preparation=preparation,
+ )
+ return CodexTurnResult(
+ session_id=session_id,
+ output_text=str(result.get("output_text") or ""),
+ usage=dict(result.get("usage") or {}),
+ metadata=dict(result.get("metadata") or {}),
+ inventory=CodexProviderInventory(
+ provider=self._config.inventory.provider,
+ model=selected_model,
+ mcp_servers=self._config.inventory.mcp_servers,
+ skills=self._config.inventory.skills,
+ ),
+ )
+
+ def runtime_adapter(self) -> Any:
+ """Create one activation-owned native adapter for AgentKernel.
+
+ Each Kernel command receives a fresh App Server transport. Durable
+ SessionEvent metadata reconnects the next command to the same Codex
+ Thread, while retaining adapters here lets activation disposal close a
+ command that is still active during Profile drain.
+ """
+
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "codex_activation_unavailable", "Codex activation is not ready"
+ )
+ adapter = self._executor.create_adapter(self._launch_context)
+ self._kernel_adapters.append(adapter)
+ return adapter
+
+ def _turn_launch_context(self, turn: CodexTurnRequest) -> RuntimeLaunchContext:
+ config = dict(self._config.launch_config)
+ if turn.model:
+ config["model"] = turn.model
+ if turn.collaboration_mode:
+ config["collaboration_mode"] = turn.collaboration_mode
+ if turn.goal_objective:
+ config["goal_objective"] = turn.goal_objective
+ return RuntimeLaunchContext(
+ runtime_type=self._launch_context.runtime_type,
+ project_dir=self._launch_context.project_dir,
+ config=config,
+ services=self._launch_context.services,
+ deployment_mode=self._launch_context.deployment_mode,
+ )
+
+ async def drain(self) -> None:
+ self._ready = False
+
+ async def dispose(self) -> None:
+ self._ready = False
+ first_error: BaseException | None = None
+ for adapter in reversed(self._kernel_adapters):
+ close_all = getattr(adapter, "close_all", None)
+ if not callable(close_all):
+ continue
+ try:
+ await close_all()
+ except BaseException as error: # cleanup must continue
+ if first_error is None:
+ first_error = error
+ self._kernel_adapters.clear()
+ try:
+ await self._executor.close_all()
+ except BaseException as error: # cleanup must continue
+ if first_error is None:
+ first_error = error
+ self._disposed = True
+ if first_error is not None:
+ raise first_error
+
+
+def _reject_aliased_duplicates(
+ value: Mapping[str, Any],
+ *aliases: tuple[str, str],
+) -> None:
+ for snake_case, camel_case in aliases:
+ if snake_case in value and camel_case in value:
+ raise PluginHostError(
+ "codex_input_invalid",
+ f"Codex input cannot contain both {snake_case} and {camel_case}",
+ )
+
+
+def _reject_external_execution(
+ bundle: ResolvedPluginBundle,
+ capabilities: PluginExecutionContext,
+) -> None:
+ del capabilities
+ profile_config = bundle.composition.profile.agent_provider.config
+ allowed_config = {"runtimeType", "runtimeVersion"}
+ unsupported_config = sorted(set(profile_config) - allowed_config)
+ execution = bundle.resolved_agent_spec.get("execution")
+ strategy = (
+ str(execution.get("strategy") or "direct").strip()
+ if isinstance(execution, Mapping)
+ else "direct"
+ )
+ if unsupported_config:
+ raise PluginHostError(
+ "codex_provider_config_unsupported",
+ "Codex AgentProvider received unsupported configuration: "
+ + ", ".join(unsupported_config),
+ )
+ if strategy != "direct":
+ raise PluginHostError(
+ "codex_external_execution_unsupported",
+ f"Codex AgentProvider owns its execution semantics and does not support {strategy!r}",
+ )
+
+
+def _resolve_bundle_config(
+ bundle: ResolvedPluginBundle,
+ *,
+ plugin_id: str,
+ credential_resolver: Any,
+) -> _CodexBundleConfig:
+ spec = bundle.resolved_agent_spec
+ raw_model = spec.get("model")
+ if not isinstance(raw_model, Mapping):
+ raise PluginHostError(
+ "codex_bundle_model_invalid", "Bundle resolved model must be an object"
+ )
+ model = str(raw_model.get("model") or "").strip()
+ if not model:
+ raise PluginHostError(
+ "codex_bundle_model_missing", "Bundle resolved Agent spec has no model"
+ )
+ allowed_models = _resolve_allowed_models(bundle, default_model=model)
+ instructions = spec.get("instructions")
+ if not isinstance(instructions, Mapping):
+ raise PluginHostError(
+ "codex_bundle_prompt_invalid", "Bundle instructions must be an object"
+ )
+ prompt = "\n\n".join(
+ part
+ for part in (
+ str(instructions.get("system") or "").strip(),
+ str(instructions.get("task") or "").strip(),
+ )
+ if part
+ )
+ if not prompt:
+ raise PluginHostError(
+ "codex_bundle_prompt_missing", "Bundle resolved Agent spec has no instructions"
+ )
+ capabilities = spec.get("capabilities")
+ if not isinstance(capabilities, Mapping):
+ raise PluginHostError(
+ "codex_bundle_capabilities_invalid", "Bundle capabilities must be an object"
+ )
+ if capabilities.get("tools"):
+ raise PluginHostError(
+ "codex_tools_unsupported", "Codex only accepts its native tools, MCP, and Skills"
+ )
+ skills = _resolve_skills(bundle.root, capabilities.get("skills"))
+ mcp_servers, env = _resolve_mcp(
+ capabilities.get("mcpServers") or capabilities.get("mcp_servers"),
+ credential_resolver=credential_resolver,
+ )
+ execution = spec.get("execution")
+ execution = execution if isinstance(execution, Mapping) else {}
+ project_dir = bundle.root / "runtime"
+ if not project_dir.is_dir():
+ project_dir = bundle.root
+ launch_config: dict[str, Any] = {
+ "model": model,
+ "models": list(allowed_models),
+ "prompt": str(instructions.get("system") or "").strip(),
+ "task_prompt": str(instructions.get("task") or "").strip(),
+ "sandbox": str(execution.get("sandbox") or "read_only"),
+ "approval_mode": str(execution.get("approvalMode") or execution.get("approval_mode") or ""),
+ "turn_timeout_seconds": int(
+ execution.get("timeoutSeconds") or execution.get("timeout_seconds") or 120
+ ),
+ "mcp_servers": mcp_servers,
+ "skills": skills,
+ "env": env,
+ }
+ return _CodexBundleConfig(
+ model=model,
+ allowed_models=allowed_models,
+ prompt=prompt,
+ project_dir=project_dir,
+ launch_config=launch_config,
+ inventory=CodexProviderInventory(
+ provider=plugin_id,
+ model=model,
+ mcp_servers=tuple(item["name"] for item in mcp_servers),
+ skills=tuple(item["name"] for item in skills),
+ ),
+ )
+
+
+def _resolve_allowed_models(
+ bundle: ResolvedPluginBundle,
+ *,
+ default_model: str,
+) -> tuple[str, ...]:
+ """Read the immutable model allowlist produced by the Bundle compiler.
+
+ Older Bundle fixtures without ``runtime-lock.json`` remain pinned to their
+ resolved default. A declared lock is already digest-verified by
+ ``PluginBundleResolver``; malformed model inventory must fail activation
+ instead of silently widening run-level model selection.
+ """
+
+ if not any(
+ entry.path == "runtime-lock.json" for entry in bundle.manifest.files
+ ):
+ return (default_model,)
+ try:
+ payload = json.loads(
+ (bundle.root / "runtime-lock.json").read_text(encoding="utf-8")
+ )
+ except (OSError, UnicodeError, json.JSONDecodeError) as error:
+ raise PluginHostError(
+ "codex_bundle_model_inventory_invalid",
+ "Bundle runtime-lock.json is not a valid model inventory",
+ ) from error
+ if not isinstance(payload, Mapping):
+ raise PluginHostError(
+ "codex_bundle_model_inventory_invalid",
+ "Bundle runtime-lock.json must be an object",
+ )
+ raw_models = payload.get("models")
+ if not isinstance(raw_models, Sequence) or isinstance(raw_models, (str, bytes)):
+ raise PluginHostError(
+ "codex_bundle_model_inventory_invalid",
+ "Bundle runtime-lock.json must declare models as a list",
+ )
+ models = tuple(
+ dict.fromkeys(str(item).strip() for item in raw_models if str(item).strip())
+ )
+ if not models or default_model not in models:
+ raise PluginHostError(
+ "codex_bundle_model_inventory_invalid",
+ "Bundle model inventory must include its resolved default model",
+ )
+ return models
+
+
+def _resolve_skills(root: Path, value: Any) -> list[dict[str, str]]:
+ if value is None:
+ return []
+ if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+ raise PluginHostError("codex_skill_invalid", "Bundle Skills must be a list")
+ resolved: list[dict[str, str]] = []
+ seen: set[str] = set()
+ for index, item in enumerate(value):
+ if not isinstance(item, Mapping):
+ raise PluginHostError(
+ "codex_skill_invalid", f"Bundle Skills[{index}] must be an object"
+ )
+ name = str(item.get("name") or "").strip()
+ relative = PurePosixPath(str(item.get("bundlePath") or item.get("bundle_path") or ""))
+ if not name or not relative.parts or relative.is_absolute() or ".." in relative.parts:
+ raise PluginHostError(
+ "codex_skill_invalid", f"Bundle Skills[{index}] has an invalid native path"
+ )
+ path = (root / Path(*relative.parts)).resolve()
+ try:
+ path.relative_to(root)
+ except ValueError as error:
+ raise PluginHostError(
+ "codex_skill_invalid", f"Bundle Skill {name!r} escapes the Bundle root"
+ ) from error
+ if not (path / "SKILL.md").is_file():
+ raise PluginHostError(
+ "codex_skill_missing", f"Bundle Skill {name!r} has no SKILL.md"
+ )
+ if name in seen:
+ raise PluginHostError("codex_skill_invalid", f"duplicate Bundle Skill {name!r}")
+ seen.add(name)
+ # Codex's native SkillInput expects the concrete SKILL.md source, not
+ # its containing directory. A directory is accepted by the Python
+ # model but silently omitted by the real App Server turn projection.
+ resolved.append({"name": name, "path": str(path / "SKILL.md")})
+ return resolved
+
+
+def _resolve_mcp(
+ value: Any,
+ *,
+ credential_resolver: Any,
+) -> tuple[list[dict[str, str]], dict[str, str]]:
+ if value is None:
+ return [], {}
+ if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
+ raise PluginHostError("codex_mcp_invalid", "Bundle MCP servers must be a list")
+ servers: list[dict[str, str]] = []
+ env: dict[str, str] = {}
+ seen: set[str] = set()
+ for index, item in enumerate(value):
+ if not isinstance(item, Mapping):
+ raise PluginHostError(
+ "codex_mcp_invalid", f"Bundle MCP servers[{index}] must be an object"
+ )
+ name = str(item.get("name") or "").strip()
+ transport = str(item.get("transport") or "").strip().lower()
+ url = str(item.get("endpointUrl") or item.get("endpoint_url") or "").strip()
+ if not name or name in seen:
+ raise PluginHostError("codex_mcp_invalid", "Bundle MCP names must be unique")
+ if transport not in {"http", "sse"} or not url:
+ raise PluginHostError(
+ "codex_mcp_transport_unsupported",
+ f"Codex Bundle MCP {name!r} requires an http/sse endpoint",
+ )
+ env_refs = item.get("envRefs") or item.get("env_refs") or {}
+ if not isinstance(env_refs, Mapping):
+ raise PluginHostError(
+ "codex_mcp_invalid", f"Bundle MCP {name!r} envRefs must be an object"
+ )
+ if len(env_refs) > 1:
+ raise PluginHostError(
+ "codex_mcp_credentials_unsupported",
+ f"Codex HTTP MCP {name!r} accepts at most one bearer credential",
+ )
+ server = {"name": name, "url": url}
+ for env_name, reference in env_refs.items():
+ env_key = str(env_name).strip()
+ ref = str(reference).strip()
+ if not env_key or not ref.startswith(
+ ("env://", "secret://", "credential://", "vault://")
+ ):
+ raise PluginHostError(
+ "codex_mcp_credential_invalid",
+ f"Bundle MCP {name!r} contains an invalid credential reference",
+ )
+ if credential_resolver is None:
+ raise PluginHostError(
+ "codex_mcp_credential_unavailable",
+ f"Bundle MCP {name!r} requires a credential resolver",
+ )
+ try:
+ value = (
+ credential_resolver.resolve(ref)
+ if hasattr(credential_resolver, "resolve")
+ else credential_resolver(ref)
+ )
+ except Exception as error:
+ raise PluginHostError(
+ "codex_mcp_credential_unavailable",
+ f"Bundle MCP {name!r} credential could not be resolved",
+ ) from error
+ if not str(value):
+ raise PluginHostError(
+ "codex_mcp_credential_unavailable",
+ f"Bundle MCP {name!r} credential is empty",
+ )
+ env[env_key] = str(value)
+ server["env_key"] = env_key
+ servers.append(server)
+ seen.add(name)
+ return servers, env
+
+
+__all__ = [
+ "CodexAgentProviderFactory",
+ "CodexAgentProviderRuntime",
+ "CodexProviderInventory",
+ "CodexTurnRequest",
+ "CodexTurnResult",
+]
diff --git a/ksadk/plugins/providers/codex_dsh.py b/ksadk/plugins/providers/codex_dsh.py
new file mode 100644
index 00000000..c2ee7b19
--- /dev/null
+++ b/ksadk/plugins/providers/codex_dsh.py
@@ -0,0 +1,83 @@
+"""Official Codex AgentProvider packaged as a standard DSH Bundle.
+
+DSH owns installation and discovery. The shared DSH bridge validates that
+registration, then delegates execution to the existing Codex RuntimeAdapter;
+this module contains no second Codex loop.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from ksadk.plugins.contracts import CompositionProfile, PluginManifest
+from ksadk.plugins.providers.codex import CodexAgentProviderFactory
+from ksadk.plugins.providers.dsh import DshAgentProviderHost, DshAgentProviderRegistration
+from ksadk.plugins.providers.shipped_dsh import (
+ CODEX_DSH_SPEC,
+ ShippedDshBridgeFactory,
+ ShippedDshBridgeRuntime,
+ ShippedDshBundle,
+ load_shipped_dsh_bundle,
+ shipped_dsh_host_command,
+)
+
+SHIPPED_CODEX_DSH_PACKAGE = CODEX_DSH_SPEC.package_name
+SHIPPED_CODEX_PROVIDER_ID = CODEX_DSH_SPEC.provider_id
+SHIPPED_CODEX_PROVIDER_VERSION = CODEX_DSH_SPEC.version
+ShippedCodexDshBundle = ShippedDshBundle
+
+
+def shipped_codex_dsh_bundle() -> ShippedCodexDshBundle:
+ return load_shipped_dsh_bundle(CODEX_DSH_SPEC)
+
+
+def shipped_codex_dsh_host_command(*, python_executable: str | None = None) -> tuple[str, ...]:
+ return shipped_dsh_host_command(CODEX_DSH_SPEC, python_executable=python_executable)
+
+
+class KsADKCodexDshBridgeRuntime(ShippedDshBridgeRuntime):
+ """Named Codex bridge type retained for inventory and public typing."""
+
+
+class KsADKCodexDshBridgeFactory(ShippedDshBridgeFactory):
+ runtime_class = KsADKCodexDshBridgeRuntime
+
+ def __init__(
+ self,
+ host: DshAgentProviderHost,
+ registration: DshAgentProviderRegistration,
+ *,
+ execution_factory: CodexAgentProviderFactory | None = None,
+ owns_host: bool = True,
+ ) -> None:
+ super().__init__(
+ spec=CODEX_DSH_SPEC,
+ host=host,
+ registration=registration,
+ execution_factory=execution_factory or CodexAgentProviderFactory(),
+ owns_host=owns_host,
+ )
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> KsADKCodexDshBridgeRuntime:
+ runtime = await super().stage(manifest, profile=profile, services=services)
+ assert isinstance(runtime, KsADKCodexDshBridgeRuntime)
+ return runtime
+
+
+__all__ = [
+ "KsADKCodexDshBridgeFactory",
+ "KsADKCodexDshBridgeRuntime",
+ "SHIPPED_CODEX_DSH_PACKAGE",
+ "SHIPPED_CODEX_PROVIDER_ID",
+ "SHIPPED_CODEX_PROVIDER_VERSION",
+ "ShippedCodexDshBundle",
+ "shipped_codex_dsh_bundle",
+ "shipped_codex_dsh_host_command",
+]
diff --git a/ksadk/plugins/providers/dsh.py b/ksadk/plugins/providers/dsh.py
new file mode 100644
index 00000000..efe030a6
--- /dev/null
+++ b/ksadk/plugins/providers/dsh.py
@@ -0,0 +1,951 @@
+"""DeepSeek Harness Profile -> AgentProvider sidecar vertical.
+
+DSH owns its Bundle/Profile ABI and executes all Cordis plugin code. KsADK
+only starts a trusted, fixed host command and consumes the host's typed
+``agent.provider/v1`` descriptor over a bounded JSONL RPC protocol. The
+descriptor is projected into an internal :class:`PluginManifest` solely so the
+existing PluginHost can keep ownership of admission, activation fencing, and
+cleanup; DSH package authors do not need to publish a KsADK manifest.
+
+The sidecar is language-neutral: any executable that implements the frozen
+JSONL protocol can host the Cordis composition. Python is not part of the ABI.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import re
+import time
+from collections import deque
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Literal
+
+from pydantic import ConfigDict, Field, field_validator
+
+from ksadk.plugins.bridges.dsh import DshProfileProjection
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import PluginContractModel, PluginManifest
+from ksadk.plugins.host import PluginExecutionContext, PluginHostError
+
+DSH_AGENT_PROVIDER_HOST_PROTOCOL = "ksadk.dsh-agent-provider-host/v1"
+DSH_AGENT_PROVIDER_HOST_METHODS = frozenset(
+ {
+ "handshake",
+ "describe",
+ "preflight",
+ "activate",
+ "inventory",
+ "execute",
+ "cancel",
+ "health",
+ "drain",
+ "dispose",
+ }
+)
+DSH_HOST_USER_PERMISSION = "process:host-user"
+
+_MAX_LINE_BYTES = 1024 * 1024
+_ID = re.compile(r"^[a-z0-9]+(?:[._-][a-z0-9]+)*$")
+_SEMVER = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
+_DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")
+_PACKAGE = re.compile(r"^(?:@[A-Za-z0-9._-]+/)?[A-Za-z0-9._-]+$")
+_ENV_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+_SECRET_ENV = re.compile(
+ r"(?:^|_)(?:API_?KEY|ACCESS_?KEY|AUTH|BEARER|CREDENTIAL|PASSWORD|"
+ r"PRIVATE_?KEY|SECRET|TOKEN)(?:_|$)",
+ re.IGNORECASE,
+)
+_DIAGNOSTIC_SECRET = re.compile(
+ r"(?ix)(?:\bsk-[a-z0-9_-]{12,}\b|\bBearer\s+[a-z0-9._~+/=-]{8,}|"
+ r"\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|secret)"
+ r"\s*(?:=|:)\s*[^\s,;]+)"
+)
+_SAFE_INHERITED_ENV = frozenset(
+ {"LANG", "LC_ALL", "PATH", "SYSTEMROOT", "TEMP", "TMP", "TMPDIR", "TZ", "WINDIR"}
+)
+_BLOCKED_ENV = frozenset({"PYTHONHOME", "PYTHONPATH", "LD_PRELOAD"})
+
+
+@dataclass(frozen=True)
+class DshCircuitSnapshot:
+ """Observable host health state; it contains no command or credential data."""
+
+ state: Literal["closed", "open", "half-open"]
+ consecutive_failures: int
+ retry_after_seconds: float
+
+
+class DshCircuitBreaker:
+ """Single-probe circuit breaker for DSH host transport and protocol faults.
+
+ It deliberately does not retry RPC calls. An ``execute`` frame can create
+ external side effects, so replay remains the responsibility of the
+ caller's idempotent run/session protocol.
+ """
+
+ def __init__(
+ self,
+ *,
+ failure_threshold: int = 3,
+ recovery_timeout: float = 5.0,
+ clock: Callable[[], float] = time.monotonic,
+ ) -> None:
+ if failure_threshold < 1:
+ raise ValueError("failure_threshold must be positive")
+ if recovery_timeout < 0:
+ raise ValueError("recovery_timeout cannot be negative")
+ self._failure_threshold = failure_threshold
+ self._recovery_timeout = recovery_timeout
+ self._clock = clock
+ self._failures = 0
+ self._opened_at: float | None = None
+ self._half_open_claimed = False
+
+ def acquire(self) -> bool:
+ if self._opened_at is None:
+ return True
+ if self._clock() - self._opened_at < self._recovery_timeout:
+ return False
+ if self._half_open_claimed:
+ return False
+ self._half_open_claimed = True
+ return True
+
+ def succeed(self) -> None:
+ self._failures = 0
+ self._opened_at = None
+ self._half_open_claimed = False
+
+ def fail(self) -> None:
+ self._failures += 1
+ self._half_open_claimed = False
+ if self._failures >= self._failure_threshold:
+ self._opened_at = self._clock()
+
+ def snapshot(self) -> DshCircuitSnapshot:
+ if self._opened_at is None:
+ return DshCircuitSnapshot("closed", self._failures, 0.0)
+ retry_after = max(0.0, self._recovery_timeout - (self._clock() - self._opened_at))
+ return DshCircuitSnapshot(
+ "half-open" if retry_after == 0 else "open",
+ self._failures,
+ retry_after,
+ )
+
+
+class _DshProviderModel(PluginContractModel):
+ model_config = ConfigDict(
+ alias_generator=lambda value: (
+ value.split("_")[0] + "".join(part.capitalize() for part in value.split("_")[1:])
+ ),
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+class DshAgentProviderDescriptor(_DshProviderModel):
+ """One AgentProvider contribution exposed by the composed DSH host."""
+
+ descriptor_format: Literal["dsh.agent-provider-descriptor/v1"] = (
+ "dsh.agent-provider-descriptor/v1"
+ )
+ ecosystem: Literal["dsh"] = "dsh"
+ provider_id: str = Field(min_length=3, max_length=128)
+ provider_version: str
+ display_name: str = Field(min_length=1, max_length=256)
+ plugin_name: str = Field(min_length=1, max_length=256)
+ profile: str = Field(min_length=1, max_length=64)
+ profile_digest: str
+ definition: Literal["agent.provider/v1"] = "agent.provider/v1"
+ slot: Literal["agent.execution"] = "agent.execution"
+ runtime_protocols: tuple[str, ...] = ()
+
+ @field_validator("provider_id")
+ @classmethod
+ def validate_provider_id(cls, value: str) -> str:
+ if not _ID.fullmatch(value):
+ raise ValueError("providerId must be a lowercase qualified id")
+ return value
+
+ @field_validator("provider_version")
+ @classmethod
+ def validate_provider_version(cls, value: str) -> str:
+ if not _SEMVER.fullmatch(value):
+ raise ValueError("providerVersion must use exact semantic versioning")
+ return value
+
+ @field_validator("plugin_name")
+ @classmethod
+ def validate_plugin_name(cls, value: str) -> str:
+ if not _PACKAGE.fullmatch(value):
+ raise ValueError("pluginName must be a valid DSH package name")
+ return value
+
+ @field_validator("profile_digest")
+ @classmethod
+ def validate_profile_digest(cls, value: str) -> str:
+ if not _DIGEST.fullmatch(value):
+ raise ValueError("profileDigest must be a lowercase sha256 digest")
+ return value
+
+ @field_validator("runtime_protocols")
+ @classmethod
+ def validate_runtime_protocols(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if any(not item or len(item) > 128 for item in value):
+ raise ValueError("runtimeProtocols entries must be non-empty and bounded")
+ if len(value) != len(set(value)):
+ raise ValueError("runtimeProtocols entries must be unique")
+ return value
+
+ @property
+ def descriptor_digest(self) -> str:
+ payload = json.dumps(
+ self.model_dump(by_alias=True, exclude_none=True, mode="json"),
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ ).encode("utf-8")
+ return f"sha256:{hashlib.sha256(payload).hexdigest()}"
+
+
+class DshAgentProviderPreflight(_DshProviderModel):
+ ready: bool
+ descriptor_digest: str
+ profile_digest: str
+
+ @field_validator("descriptor_digest", "profile_digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ if not _DIGEST.fullmatch(value):
+ raise ValueError("preflight digests must be lowercase sha256 values")
+ return value
+
+
+class DshAgentProviderInventory(_DshProviderModel):
+ provider_id: str = Field(min_length=3, max_length=128)
+ provider_version: str
+ profile: str = Field(min_length=1, max_length=64)
+ profile_digest: str
+ descriptor_digest: str
+ state: Literal["ready", "draining", "disposed", "failed"]
+ activation_count: int = Field(ge=0)
+
+ @field_validator("profile_digest", "descriptor_digest")
+ @classmethod
+ def validate_digest(cls, value: str) -> str:
+ if not _DIGEST.fullmatch(value):
+ raise ValueError("inventory digests must be lowercase sha256 values")
+ return value
+
+
+@dataclass(frozen=True)
+class DshAgentProviderRegistration:
+ """Selector-safe registration emitted only after successful preflight."""
+
+ descriptor: DshAgentProviderDescriptor
+ preflight: DshAgentProviderPreflight
+ manifest: PluginManifest
+
+
+class DshAgentProviderHost:
+ """Supervise one fixed DSH provider host for an immutable Profile projection."""
+
+ def __init__(
+ self,
+ command: Sequence[str],
+ *,
+ projection: DshProfileProjection,
+ cwd: str | Path | None = None,
+ environment: Mapping[str, str] | None = None,
+ startup_timeout: float = 5.0,
+ request_timeout: float = 30.0,
+ shutdown_timeout: float = 2.0,
+ circuit_failure_threshold: int = 3,
+ circuit_recovery_timeout: float = 5.0,
+ ) -> None:
+ self._command = _validate_command(command)
+ self._projection = projection
+ self._cwd = Path(cwd).resolve() if cwd is not None else None
+ self._environment = _minimal_environment(environment or {})
+ self._startup_timeout = _positive_timeout(startup_timeout, "startup_timeout")
+ self._request_timeout = _positive_timeout(request_timeout, "request_timeout")
+ self._shutdown_timeout = _positive_timeout(shutdown_timeout, "shutdown_timeout")
+ self._circuit = DshCircuitBreaker(
+ failure_threshold=circuit_failure_threshold,
+ recovery_timeout=circuit_recovery_timeout,
+ )
+ self._process: asyncio.subprocess.Process | None = None
+ self._request_lock = asyncio.Lock()
+ self._lifecycle_lock = asyncio.Lock()
+ self._stderr_task: asyncio.Task[None] | None = None
+ self._stderr_tail: deque[str] = deque(maxlen=64)
+ self._next_request_id = 0
+ self._descriptor: DshAgentProviderDescriptor | None = None
+ self._preflight: DshAgentProviderPreflight | None = None
+ self._disposed = False
+
+ @property
+ def pid(self) -> int | None:
+ process = self._process
+ return process.pid if process is not None and process.returncode is None else None
+
+ @property
+ def stderr_tail(self) -> tuple[str, ...]:
+ return tuple(self._stderr_tail)
+
+ @property
+ def circuit_snapshot(self) -> DshCircuitSnapshot:
+ return self._circuit.snapshot()
+
+ async def start(self) -> None:
+ async with self._lifecycle_lock:
+ if self.pid is not None:
+ return
+ if self._disposed:
+ raise PluginHostError("dsh_provider_host_disposed", "DSH provider host is disposed")
+ self._require_circuit_probe()
+ try:
+ process = await asyncio.create_subprocess_exec(
+ *self._command,
+ cwd=str(self._cwd) if self._cwd is not None else None,
+ env=self._environment,
+ stdin=asyncio.subprocess.PIPE,
+ stdout=asyncio.subprocess.PIPE,
+ stderr=asyncio.subprocess.PIPE,
+ limit=_MAX_LINE_BYTES + 1,
+ start_new_session=os.name == "posix",
+ )
+ except (OSError, ValueError) as error:
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_host_start_failed",
+ f"cannot start fixed DSH provider host: {type(error).__name__}",
+ ) from error
+ self._process = process
+ self._stderr_task = asyncio.create_task(self._capture_stderr(process))
+ try:
+ handshake = await self._request(
+ "handshake",
+ {"profile": self._projection_payload()},
+ timeout=self._startup_timeout,
+ circuit_probe_acquired=True,
+ )
+ try:
+ self._validate_handshake(handshake)
+ except PluginHostError:
+ self._circuit.fail()
+ raise
+ except BaseException:
+ await self._terminate()
+ raise
+
+ async def describe(self) -> DshAgentProviderDescriptor:
+ await self.start()
+ if self._descriptor is not None:
+ return self._descriptor
+ payload = await self._request("describe", {"profile": self._projection_payload()})
+ try:
+ descriptor = DshAgentProviderDescriptor.model_validate(payload)
+ except Exception as error: # noqa: BLE001 - external protocol boundary
+ raise PluginHostError(
+ "dsh_provider_descriptor_invalid",
+ "DSH host returned an invalid provider descriptor",
+ ) from error
+ if descriptor.profile != self._projection.profile:
+ raise PluginHostError(
+ "dsh_provider_descriptor_mismatch", "DSH provider descriptor profile does not match"
+ )
+ if descriptor.profile_digest != self._projection.config_digest:
+ raise PluginHostError(
+ "dsh_provider_descriptor_mismatch",
+ "DSH provider descriptor is not fenced to the selected Profile digest",
+ )
+ if descriptor.plugin_name not in self._projection.bundles:
+ raise PluginHostError(
+ "dsh_provider_descriptor_mismatch",
+ "DSH provider descriptor does not belong to an active Profile bundle",
+ )
+ self._descriptor = descriptor
+ return descriptor
+
+ async def preflight(self) -> DshAgentProviderPreflight:
+ descriptor = await self.describe()
+ payload = await self._request(
+ "preflight",
+ {
+ "profileDigest": self._projection.config_digest,
+ "descriptorDigest": descriptor.descriptor_digest,
+ },
+ )
+ try:
+ result = DshAgentProviderPreflight.model_validate(payload)
+ except Exception as error: # noqa: BLE001 - external protocol boundary
+ raise PluginHostError(
+ "dsh_provider_preflight_invalid", "DSH host returned an invalid preflight result"
+ ) from error
+ if (
+ result.descriptor_digest != descriptor.descriptor_digest
+ or result.profile_digest != self._projection.config_digest
+ ):
+ raise PluginHostError(
+ "dsh_provider_preflight_mismatch", "DSH preflight result crossed a Profile fence"
+ )
+ if not result.ready:
+ raise PluginHostError(
+ "dsh_provider_preflight_failed", "DSH AgentProvider is not ready for activation"
+ )
+ self._preflight = result
+ return result
+
+ async def registration(self) -> DshAgentProviderRegistration:
+ """Return a selector-visible projection only after the provider is ready."""
+
+ descriptor = await self.describe()
+ preflight = await self.preflight()
+ return DshAgentProviderRegistration(
+ descriptor=descriptor,
+ preflight=preflight,
+ manifest=dsh_agent_provider_manifest(descriptor, preflight=preflight),
+ )
+
+ async def activate(
+ self,
+ bundle: ResolvedPluginBundle,
+ capabilities: PluginExecutionContext,
+ ) -> str:
+ descriptor = await self.describe()
+ await self.preflight()
+ payload = await self._request(
+ "activate",
+ {
+ "descriptorDigest": descriptor.descriptor_digest,
+ "bundle": _bundle_payload(bundle),
+ "capabilities": _capability_payload(capabilities),
+ },
+ )
+ if not isinstance(payload, dict):
+ raise PluginHostError(
+ "dsh_provider_activation_invalid", "DSH host activation result must be an object"
+ )
+ activation_id = str(payload.get("activationId") or "").strip()
+ if not activation_id or len(activation_id) > 256:
+ raise PluginHostError(
+ "dsh_provider_activation_invalid", "DSH host returned no valid activationId"
+ )
+ return activation_id
+
+ async def inventory(self) -> DshAgentProviderInventory:
+ descriptor = await self.describe()
+ payload = await self._request(
+ "inventory", {"descriptorDigest": descriptor.descriptor_digest}
+ )
+ try:
+ result = DshAgentProviderInventory.model_validate(payload)
+ except Exception as error: # noqa: BLE001 - external protocol boundary
+ raise PluginHostError(
+ "dsh_provider_inventory_invalid", "DSH host returned invalid provider inventory"
+ ) from error
+ if (
+ result.provider_id != descriptor.provider_id
+ or result.provider_version != descriptor.provider_version
+ or result.profile != descriptor.profile
+ or result.profile_digest != descriptor.profile_digest
+ or result.descriptor_digest != descriptor.descriptor_digest
+ ):
+ raise PluginHostError(
+ "dsh_provider_inventory_mismatch",
+ "DSH provider inventory crossed a descriptor fence",
+ )
+ return result
+
+ async def health(self, *, activation_id: str | None = None) -> bool:
+ params: dict[str, Any] = {"scope": "activation" if activation_id else "provider"}
+ if activation_id:
+ params["activationId"] = activation_id
+ payload = await self._request("health", params)
+ if not isinstance(payload, dict) or not isinstance(payload.get("healthy"), bool):
+ raise PluginHostError(
+ "dsh_provider_health_invalid", "DSH provider health must contain boolean healthy"
+ )
+ return bool(payload["healthy"])
+
+ async def execute(self, activation_id: str, request: Any) -> Any:
+ return await self._request(
+ "execute", {"activationId": activation_id, "request": _json_value(request)}
+ )
+
+ async def cancel_activation(self, activation_id: str) -> None:
+ await self._request("cancel", {"activationId": activation_id})
+
+ async def drain(self, *, activation_id: str | None = None) -> None:
+ params: dict[str, Any] = {"scope": "activation" if activation_id else "provider"}
+ if activation_id:
+ params["activationId"] = activation_id
+ await self._request("drain", params)
+
+ async def dispose_activation(self, activation_id: str) -> None:
+ await self._request("dispose", {"scope": "activation", "activationId": activation_id})
+
+ async def dispose(self) -> None:
+ async with self._lifecycle_lock:
+ if self._disposed:
+ return
+ self._disposed = True
+ failure: Exception | None = None
+ if self.pid is not None:
+ try:
+ await self._request("dispose", {"scope": "host"})
+ except Exception as error: # cleanup must still terminate the sidecar
+ failure = error
+ await self._terminate()
+ if failure is not None:
+ raise failure
+
+ async def _request(
+ self,
+ method: str,
+ params: Mapping[str, Any],
+ *,
+ timeout: float | None = None,
+ circuit_probe_acquired: bool = False,
+ ) -> Any:
+ if method not in DSH_AGENT_PROVIDER_HOST_METHODS:
+ raise PluginHostError(
+ "dsh_provider_method_denied", f"DSH provider host method {method!r} is denied"
+ )
+ if not circuit_probe_acquired:
+ self._require_circuit_probe()
+ self._next_request_id += 1
+ request_id = f"dsh-{self._next_request_id}"
+ try:
+ encoded = json.dumps(
+ {"id": request_id, "method": method, "params": dict(params)},
+ ensure_ascii=False,
+ allow_nan=False,
+ separators=(",", ":"),
+ ).encode("utf-8")
+ except (TypeError, ValueError) as error:
+ raise PluginHostError(
+ "dsh_provider_request_invalid", "DSH provider request is not strict JSON"
+ ) from error
+ if len(encoded) > _MAX_LINE_BYTES:
+ raise PluginHostError(
+ "dsh_provider_request_too_large", "DSH provider request exceeds the protocol limit"
+ )
+ async with self._request_lock:
+ process = self._process
+ if (
+ process is None
+ or process.returncode is not None
+ or process.stdin is None
+ or process.stdout is None
+ ):
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_host_unavailable", "DSH provider host is not running"
+ )
+ try:
+ process.stdin.write(encoded + b"\n")
+ await process.stdin.drain()
+ line = await asyncio.wait_for(
+ process.stdout.readline(),
+ timeout=timeout if timeout is not None else self._request_timeout,
+ )
+ except asyncio.TimeoutError as error:
+ await self._terminate()
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_request_timeout", f"DSH provider host timed out during {method}"
+ ) from error
+ except (BrokenPipeError, ConnectionError, OSError, ValueError) as error:
+ await self._terminate()
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_transport_failed", f"DSH provider host failed during {method}"
+ ) from error
+ if not line or len(line) > _MAX_LINE_BYTES:
+ await self._terminate()
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_protocol_invalid", "DSH provider host emitted no bounded response"
+ )
+ try:
+ response = json.loads(line)
+ except (UnicodeDecodeError, ValueError) as error:
+ await self._terminate()
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_protocol_invalid", "DSH provider host emitted invalid JSONL"
+ ) from error
+ if not isinstance(response, dict) or response.get("id") != request_id:
+ await self._terminate()
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_response_mismatch", "DSH provider response id does not match"
+ )
+ if response.get("error") is not None:
+ raise PluginHostError(
+ "dsh_provider_remote_error", "DSH provider host rejected the request"
+ )
+ if "result" not in response:
+ self._circuit.fail()
+ raise PluginHostError(
+ "dsh_provider_protocol_invalid", "DSH provider response has no result"
+ )
+ self._circuit.succeed()
+ return response["result"]
+
+ def _require_circuit_probe(self) -> None:
+ if self._circuit.acquire():
+ return
+ snapshot = self._circuit.snapshot()
+ raise PluginHostError(
+ "dsh_provider_circuit_open",
+ "DSH provider host circuit is open; wait "
+ f"{snapshot.retry_after_seconds:.1f}s before another probe",
+ )
+
+ def _validate_handshake(self, payload: Any) -> None:
+ if not isinstance(payload, dict):
+ raise PluginHostError(
+ "dsh_provider_handshake_invalid", "DSH provider handshake must be an object"
+ )
+ methods = payload.get("methods")
+ host_version = payload.get("hostVersion")
+ if (
+ payload.get("protocolVersion") != DSH_AGENT_PROVIDER_HOST_PROTOCOL
+ or not isinstance(methods, list)
+ or set(methods) != DSH_AGENT_PROVIDER_HOST_METHODS
+ or len(methods) != len(DSH_AGENT_PROVIDER_HOST_METHODS)
+ or not isinstance(host_version, str)
+ or not _SEMVER.fullmatch(host_version)
+ ):
+ raise PluginHostError(
+ "dsh_provider_handshake_invalid",
+ "DSH provider host protocol, methods, or version is incompatible",
+ )
+
+ def _projection_payload(self) -> dict[str, Any]:
+ return self._projection.model_dump(by_alias=True, mode="json")
+
+ async def _capture_stderr(self, process: asyncio.subprocess.Process) -> None:
+ if process.stderr is None:
+ return
+ while True:
+ line = await process.stderr.readline()
+ if not line:
+ return
+ diagnostic = line.decode("utf-8", errors="replace").rstrip()[:4096]
+ self._stderr_tail.append(_DIAGNOSTIC_SECRET.sub("[REDACTED]", diagnostic))
+
+ async def _terminate(self) -> None:
+ process = self._process
+ self._process = None
+ if process is not None and process.returncode is None:
+ process.terminate()
+ try:
+ await asyncio.wait_for(process.wait(), timeout=self._shutdown_timeout)
+ except asyncio.TimeoutError:
+ process.kill()
+ await process.wait()
+ task = self._stderr_task
+ self._stderr_task = None
+ if task is not None and task is not asyncio.current_task():
+ try:
+ await asyncio.wait_for(task, timeout=self._shutdown_timeout)
+ except asyncio.TimeoutError:
+ task.cancel()
+ await asyncio.gather(task, return_exceptions=True)
+
+
+class DshAgentProviderRuntime:
+ """Existing PluginHost AgentProvider SPI backed by one DSH host."""
+
+ def __init__(self, host: DshAgentProviderHost) -> None:
+ self._host = host
+ self._ready = False
+ self._disposed = False
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise PluginHostError("dsh_provider_disposed", "DSH AgentProvider is disposed")
+ await self._host.preflight()
+ self._ready = True
+
+ async def health(self) -> bool:
+ return (
+ self._ready
+ and not self._disposed
+ and self._host.pid is not None
+ and await self._host.health()
+ )
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> "DshPreparedAgent":
+ if not await self.health():
+ raise PluginHostError("dsh_provider_unavailable", "DSH AgentProvider is not healthy")
+ activation_id = await self._host.activate(bundle, capabilities)
+ return DshPreparedAgent(self._host, activation_id)
+
+ async def inventory(self) -> DshAgentProviderInventory:
+ return await self._host.inventory()
+
+ async def drain(self) -> None:
+ if self._ready and not self._disposed and self._host.pid is not None:
+ await self._host.drain()
+ self._ready = False
+
+ async def dispose(self) -> None:
+ if self._disposed:
+ return
+ self._disposed = True
+ self._ready = False
+ await self._host.dispose()
+
+
+class DshPreparedAgent:
+ def __init__(self, host: DshAgentProviderHost, activation_id: str) -> None:
+ self._host = host
+ self._activation_id = activation_id
+ self._started = False
+ self._drained = False
+ self._disposed = False
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise PluginHostError("dsh_activation_disposed", "DSH activation is disposed")
+ self._started = True
+
+ async def health(self) -> bool:
+ return (
+ self._started
+ and not self._drained
+ and not self._disposed
+ and await self._host.health(activation_id=self._activation_id)
+ )
+
+ async def execute(self, request: Any) -> Any:
+ if not await self.health():
+ raise PluginHostError("dsh_activation_unavailable", "DSH activation is not healthy")
+ return await self._host.execute(self._activation_id, request)
+
+ async def cancel(self) -> None:
+ """Request bounded cancellation without losing the disposable handle."""
+
+ if self._disposed:
+ return
+ await self._host.cancel_activation(self._activation_id)
+
+ async def drain(self) -> None:
+ if self._disposed or self._drained:
+ return
+ await self._host.drain(activation_id=self._activation_id)
+ self._drained = True
+
+ async def dispose(self) -> None:
+ if self._disposed:
+ return
+ self._disposed = True
+ if self._host.pid is not None:
+ await self._host.dispose_activation(self._activation_id)
+
+
+class DshAgentProviderFactory:
+ """Project one discovered DSH provider into the internal PluginFactory seam."""
+
+ def __init__(
+ self,
+ host: DshAgentProviderHost,
+ registration: DshAgentProviderRegistration,
+ ) -> None:
+ self._host = host
+ self._registration = registration
+ self.runtime: DshAgentProviderRuntime | None = None
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: Any,
+ services: Mapping[str, Any],
+ ) -> DshAgentProviderRuntime:
+ del profile, services
+ expected = dsh_agent_provider_manifest(
+ self._registration.descriptor,
+ preflight=self._registration.preflight,
+ )
+ if manifest != expected:
+ raise PluginHostError(
+ "dsh_provider_manifest_mismatch",
+ "internal DSH provider projection does not match the discovered descriptor",
+ )
+ self.runtime = DshAgentProviderRuntime(self._host)
+ return self.runtime
+
+
+def dsh_agent_provider_manifest(
+ descriptor: DshAgentProviderDescriptor,
+ *,
+ preflight: DshAgentProviderPreflight,
+) -> PluginManifest:
+ """Create an internal admission projection; this is not a DSH package format."""
+
+ if (
+ not preflight.ready
+ or preflight.descriptor_digest != descriptor.descriptor_digest
+ or preflight.profile_digest != descriptor.profile_digest
+ ):
+ raise PluginHostError(
+ "dsh_provider_not_ready",
+ "DSH AgentProvider cannot enter the selector before matching preflight",
+ )
+
+ return PluginManifest.model_validate(
+ {
+ "metadata": {
+ "id": descriptor.provider_id,
+ "version": descriptor.provider_version,
+ },
+ "spec": {
+ "domain": "runtime-native",
+ "runtime": "process",
+ "entrypoint": "deepseek-harness:profile-agent-provider",
+ "provides": [
+ {
+ "definition": descriptor.definition,
+ "slot": descriptor.slot,
+ "mode": "unique",
+ }
+ ],
+ "permissions": [DSH_HOST_USER_PERMISSION],
+ "isolation": "sidecar",
+ "compatibility": {
+ "kernelApi": ">=1,<2",
+ "runtimeProtocols": list(descriptor.runtime_protocols),
+ },
+ "healthContract": "plugin.health/v1",
+ "provenance": {
+ "source": "runtime-native",
+ "digest": descriptor.descriptor_digest,
+ },
+ },
+ }
+ )
+
+
+def _validate_command(command: Sequence[str]) -> tuple[str, ...]:
+ if isinstance(command, (str, bytes)):
+ raise PluginHostError(
+ "dsh_provider_command_invalid", "DSH host command must be an argv sequence"
+ )
+ normalized = tuple(str(item) for item in command)
+ if not normalized or any(not item or "\x00" in item for item in normalized):
+ raise PluginHostError(
+ "dsh_provider_command_invalid", "DSH host command contains an invalid argv item"
+ )
+ return normalized
+
+
+def _minimal_environment(explicit: Mapping[str, str]) -> dict[str, str]:
+ environment = {
+ key: value
+ for key, value in os.environ.items()
+ if key in _SAFE_INHERITED_ENV and not _SECRET_ENV.search(key)
+ }
+ for key, value in explicit.items():
+ if (
+ not _ENV_NAME.fullmatch(key)
+ or key in _BLOCKED_ENV
+ or key.startswith("DYLD_")
+ or _SECRET_ENV.search(key)
+ ):
+ raise PluginHostError(
+ "dsh_provider_environment_denied",
+ f"DSH host environment key {key!r} is not allowed",
+ )
+ environment[key] = str(value)
+ return environment
+
+
+def _positive_timeout(value: float, field: str) -> float:
+ normalized = float(value)
+ if normalized <= 0:
+ raise PluginHostError("dsh_provider_timeout_invalid", f"{field} must be positive")
+ return normalized
+
+
+def _bundle_payload(bundle: ResolvedPluginBundle) -> dict[str, Any]:
+ return {
+ "root": str(bundle.root),
+ "manifest": bundle.manifest.model_dump(by_alias=True, exclude_none=True, mode="json"),
+ "resolvedAgentSpec": _json_value(bundle.resolved_agent_spec),
+ "composition": {
+ "profileDigest": bundle.composition.profile_digest,
+ "pluginLockDigest": bundle.composition.plugin_lock_digest,
+ },
+ }
+
+
+def _capability_payload(context: PluginExecutionContext) -> dict[str, Any]:
+ return {
+ "profileDigest": context.profile_digest,
+ "pluginLockDigest": context.plugin_lock_digest,
+ "bindings": [
+ {
+ "pluginId": binding.plugin_id,
+ "pluginVersion": binding.plugin_version,
+ "definition": binding.definition,
+ "slot": binding.slot,
+ }
+ for binding in context.bindings
+ ],
+ }
+
+
+def _json_value(value: Any) -> Any:
+ if isinstance(value, Mapping):
+ normalized: Any = {str(key): _json_value(child) for key, child in value.items()}
+ elif isinstance(value, (list, tuple)):
+ normalized = [_json_value(child) for child in value]
+ elif value is None or isinstance(value, (str, int, float, bool)):
+ normalized = value
+ else:
+ raise PluginHostError(
+ "dsh_provider_request_invalid",
+ f"DSH provider value {type(value).__name__} is not JSON compatible",
+ )
+ try:
+ json.dumps(normalized, ensure_ascii=False, allow_nan=False)
+ except (TypeError, ValueError) as error:
+ raise PluginHostError(
+ "dsh_provider_request_invalid", "DSH provider value is not strict JSON"
+ ) from error
+ return normalized
+
+
+__all__ = [
+ "DSH_AGENT_PROVIDER_HOST_METHODS",
+ "DSH_AGENT_PROVIDER_HOST_PROTOCOL",
+ "DSH_HOST_USER_PERMISSION",
+ "DshAgentProviderDescriptor",
+ "DshAgentProviderFactory",
+ "DshAgentProviderHost",
+ "DshAgentProviderInventory",
+ "DshAgentProviderPreflight",
+ "DshAgentProviderRegistration",
+ "DshAgentProviderRuntime",
+ "DshCircuitBreaker",
+ "DshCircuitSnapshot",
+ "DshPreparedAgent",
+ "dsh_agent_provider_manifest",
+]
diff --git a/ksadk/plugins/providers/dsh_descriptor_host.py b/ksadk/plugins/providers/dsh_descriptor_host.py
new file mode 100644
index 00000000..20aa7fb4
--- /dev/null
+++ b/ksadk/plugins/providers/dsh_descriptor_host.py
@@ -0,0 +1,226 @@
+"""Single frozen descriptor host for wheel-owned DSH AgentProviders.
+
+The provider key is a fixed command argument selected by KsADK. The host
+owns discovery and lifecycle only; model credentials and execution services
+remain in the parent RuntimeAdapter bridge.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from dataclasses import dataclass
+from typing import Any, Sequence
+
+from ksadk.plugins.providers.dsh import (
+ DSH_AGENT_PROVIDER_HOST_METHODS,
+ DSH_AGENT_PROVIDER_HOST_PROTOCOL,
+ DshAgentProviderDescriptor,
+)
+from ksadk.plugins.providers.shipped_dsh import (
+ SHIPPED_DSH_PROVIDER_SPECS,
+ ShippedDshProviderSpec,
+)
+
+
+class HostRequestError(RuntimeError):
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+@dataclass
+class DescriptorHostState:
+ spec: ShippedDshProviderSpec
+ profile: dict[str, Any] | None = None
+ descriptor: DshAgentProviderDescriptor | None = None
+ state: str = "ready"
+
+ def handshake(self, params: dict[str, Any]) -> dict[str, Any]:
+ projection = self._profile(params)
+ bundles = projection.get("bundles")
+ if not isinstance(bundles, list) or self.spec.package_name not in bundles:
+ raise HostRequestError(
+ self.spec.error_code("bundle_inactive"),
+ f"{self.spec.display_name} Bundle is not active in the selected DSH Profile",
+ )
+ if self.profile is not None and (
+ projection.get("configDigest") != self.profile.get("configDigest")
+ ):
+ raise HostRequestError(
+ self.spec.error_code("profile_changed"),
+ "host cannot cross a DSH Profile fence",
+ )
+ self.profile = projection
+ self.descriptor = DshAgentProviderDescriptor.model_validate(
+ {
+ "providerId": self.spec.provider_id,
+ "providerVersion": self.spec.version,
+ "displayName": self.spec.display_name,
+ "pluginName": self.spec.package_name,
+ "profile": projection.get("profile"),
+ "profileDigest": projection.get("configDigest"),
+ "runtimeProtocols": ["agentkit.runtime/v1"],
+ }
+ )
+ return {
+ "protocolVersion": DSH_AGENT_PROVIDER_HOST_PROTOCOL,
+ "methods": sorted(DSH_AGENT_PROVIDER_HOST_METHODS),
+ "hostVersion": self.spec.version,
+ }
+
+ def describe(self, params: dict[str, Any]) -> dict[str, Any]:
+ descriptor = self._require_ready_descriptor()
+ if self._profile(params).get("configDigest") != descriptor.profile_digest:
+ raise HostRequestError(
+ self.spec.error_code("profile_mismatch"),
+ "descriptor crossed a DSH Profile fence",
+ )
+ return descriptor.model_dump(by_alias=True, mode="json")
+
+ def preflight(self, params: dict[str, Any]) -> dict[str, Any]:
+ descriptor = self._require_ready_descriptor()
+ self._check_fences(params)
+ return {
+ "ready": self.state == "ready",
+ "descriptorDigest": descriptor.descriptor_digest,
+ "profileDigest": descriptor.profile_digest,
+ }
+
+ def inventory(self, params: dict[str, Any]) -> dict[str, Any]:
+ descriptor = self._require_descriptor()
+ self._check_fences(params, profile_optional=True)
+ return {
+ "providerId": descriptor.provider_id,
+ "providerVersion": descriptor.provider_version,
+ "profile": descriptor.profile,
+ "profileDigest": descriptor.profile_digest,
+ "descriptorDigest": descriptor.descriptor_digest,
+ "state": self.state,
+ "activationCount": 0,
+ }
+
+ def health(self, params: dict[str, Any]) -> dict[str, Any]:
+ if params.get("activationId"):
+ return {"healthy": False}
+ return {"healthy": self.state == "ready"}
+
+ def drain(self, params: dict[str, Any]) -> dict[str, Any]:
+ if params.get("scope") != "provider":
+ raise self._execution_bridge_required()
+ self.state = "draining"
+ return {"ok": True}
+
+ def dispose(self, params: dict[str, Any]) -> dict[str, Any]:
+ if params.get("scope") != "host":
+ raise self._execution_bridge_required()
+ self.state = "disposed"
+ return {"ok": True}
+
+ def dispatch(self, method: str, params: dict[str, Any]) -> dict[str, Any]:
+ handler = getattr(self, method, None)
+ if method in {
+ "handshake",
+ "describe",
+ "preflight",
+ "inventory",
+ "health",
+ "drain",
+ "dispose",
+ } and callable(handler):
+ return handler(params)
+ raise self._execution_bridge_required()
+
+ def _profile(self, params: dict[str, Any]) -> dict[str, Any]:
+ value = params.get("profile")
+ if not isinstance(value, dict):
+ raise HostRequestError(
+ self.spec.error_code("profile_invalid"),
+ "request requires a DSH Profile projection",
+ )
+ return value
+
+ def _require_descriptor(self) -> DshAgentProviderDescriptor:
+ if self.descriptor is None:
+ raise HostRequestError(
+ self.spec.error_code("handshake_required"),
+ "DSH Profile handshake is incomplete",
+ )
+ return self.descriptor
+
+ def _require_ready_descriptor(self) -> DshAgentProviderDescriptor:
+ descriptor = self._require_descriptor()
+ if self.state != "ready":
+ raise HostRequestError(
+ self.spec.error_code("provider_unavailable"),
+ f"{self.spec.display_name} DSH provider is not ready",
+ )
+ return descriptor
+
+ def _check_fences(self, params: dict[str, Any], *, profile_optional: bool = False) -> None:
+ descriptor = self._require_descriptor()
+ if not profile_optional and params.get("profileDigest") != descriptor.profile_digest:
+ raise HostRequestError(
+ self.spec.error_code("profile_mismatch"),
+ "request crossed a DSH Profile fence",
+ )
+ if params.get("descriptorDigest") != descriptor.descriptor_digest:
+ raise HostRequestError(
+ self.spec.error_code("descriptor_mismatch"),
+ "request crossed a descriptor fence",
+ )
+
+ def _execution_bridge_required(self) -> HostRequestError:
+ return HostRequestError(
+ self.spec.bridge_required_code,
+ self.spec.bridge_required_message,
+ )
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+ arguments = list(sys.argv[1:] if argv is None else argv)
+ if len(arguments) != 1 or arguments[0] not in SHIPPED_DSH_PROVIDER_SPECS:
+ return 2
+ spec = SHIPPED_DSH_PROVIDER_SPECS[arguments[0]]
+ state = DescriptorHostState(spec)
+ for line in sys.stdin:
+ request: dict[str, Any] | None = None
+ try:
+ value = json.loads(line)
+ if not isinstance(value, dict):
+ raise HostRequestError(
+ spec.error_code("request_invalid"), "request must be an object"
+ )
+ request = value
+ request_id = request.get("id")
+ method = request.get("method")
+ params = request.get("params") or {}
+ if (
+ not isinstance(request_id, str)
+ or method not in DSH_AGENT_PROVIDER_HOST_METHODS
+ or not isinstance(params, dict)
+ ):
+ raise HostRequestError(
+ spec.error_code("request_invalid"), "request envelope is invalid"
+ )
+ response = {"id": request_id, "result": state.dispatch(str(method), params)}
+ except Exception as error: # protocol boundary must always answer
+ response = {
+ "id": request.get("id") if isinstance(request, dict) else "unknown",
+ "error": {
+ "code": getattr(error, "code", spec.error_code("internal_error")),
+ "message": str(error),
+ },
+ }
+ sys.stdout.write(json.dumps(response, separators=(",", ":")) + "\n")
+ sys.stdout.flush()
+ if state.state == "disposed":
+ break
+ return 0
+
+
+if __name__ == "__main__": # pragma: no cover - subprocess entrypoint
+ raise SystemExit(main())
+
+
+__all__ = ["DescriptorHostState", "HostRequestError", "main"]
diff --git a/ksadk/plugins/providers/harness.py b/ksadk/plugins/providers/harness.py
new file mode 100644
index 00000000..92d93e2a
--- /dev/null
+++ b/ksadk/plugins/providers/harness.py
@@ -0,0 +1,627 @@
+"""KsADK Harness AgentProvider backed by the canonical RuntimeExecutor.
+
+The provider composes locked MCP, Skill, and Context capabilities, then
+delegates every turn to ``HarnessRuntimeAdapter`` through
+``invoke_runtime_conversation_once``. RuntimeEvent persistence and Session
+history therefore stay on the existing conversation pipeline; this module does
+not create another event stream or transcript store.
+"""
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import Any, Protocol, cast, runtime_checkable
+
+from ksadk.harness.config import HarnessConfig, McpToolSpec, SandboxPolicy
+from ksadk.harness.reasoner import HarnessReasoner, LiteLLMHarnessReasoner
+from ksadk.harness.runtime import HarnessRuntimeAdapter
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import CompositionProfile, PluginManifest
+from ksadk.plugins.host import PluginExecutionContext, PluginHostError
+from ksadk.runtime import RuntimeExecutor, RuntimeLaunchContext, RuntimeRegistry, StartRequest
+from ksadk.runtime.conversation_execution import invoke_runtime_conversation_once
+from ksadk.sessions import create_session_service
+from ksadk.sessions.base import BaseSessionService
+
+_HISTORY_ENVELOPE_PREFIX = "agentkit.conversation-history/v1:"
+
+
+@dataclass(frozen=True)
+class HarnessSkillContribution:
+ name: str
+ instructions: str
+
+
+@dataclass(frozen=True)
+class HarnessProviderInventory:
+ provider: str
+ execution_strategy: str
+ model: str
+ history_owner: str
+ mcp_servers: tuple[str, ...]
+ skills: tuple[str, ...]
+ context_contributors: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class HarnessTurnRequest:
+ user_id: str
+ session_id: str | None
+ messages: tuple[Mapping[str, Any], ...]
+ model: str | None = None
+ request_metadata: Mapping[str, Any] | None = None
+ invocation_id: str | None = None
+
+ @classmethod
+ def parse(cls, value: Any) -> "HarnessTurnRequest":
+ if isinstance(value, cls):
+ return value
+ if not isinstance(value, Mapping):
+ raise PluginHostError(
+ "harness_input_invalid", "Harness input must be an object"
+ )
+ user_id = str(value.get("user_id") or value.get("userId") or "").strip()
+ if not user_id:
+ raise PluginHostError(
+ "harness_input_invalid", "Harness input requires user_id"
+ )
+ raw_messages = value.get("messages")
+ if raw_messages is None and value.get("input") is not None:
+ raw_messages = [{"role": "user", "content": value.get("input")}]
+ if not isinstance(raw_messages, Sequence) or isinstance(
+ raw_messages, (str, bytes)
+ ):
+ raise PluginHostError(
+ "harness_input_invalid", "Harness input requires messages"
+ )
+ messages: list[Mapping[str, Any]] = []
+ for index, message in enumerate(raw_messages):
+ if not isinstance(message, Mapping):
+ raise PluginHostError(
+ "harness_input_invalid",
+ f"Harness messages[{index}] must be an object",
+ )
+ role = str(message.get("role") or "").strip()
+ if role not in {"system", "user", "assistant", "tool"}:
+ raise PluginHostError(
+ "harness_input_invalid",
+ f"Harness messages[{index}] has unsupported role {role!r}",
+ )
+ messages.append(dict(message))
+ if not messages or messages[-1].get("role") != "user":
+ raise PluginHostError(
+ "harness_input_invalid", "Harness turn must end with a user message"
+ )
+ session_id = str(
+ value.get("session_id") or value.get("sessionId") or ""
+ ).strip()
+ model = str(value.get("model") or "").strip()
+ metadata = value.get("request_metadata") or value.get("requestMetadata")
+ if metadata is not None and not isinstance(metadata, Mapping):
+ raise PluginHostError(
+ "harness_input_invalid", "request_metadata must be an object"
+ )
+ return cls(
+ user_id=user_id,
+ session_id=session_id or None,
+ messages=tuple(messages),
+ model=model or None,
+ request_metadata=dict(metadata) if metadata is not None else None,
+ invocation_id=str(
+ value.get("invocation_id") or value.get("invocationId") or ""
+ ).strip()
+ or None,
+ )
+
+
+@dataclass(frozen=True)
+class HarnessTurnResult:
+ session_id: str
+ output_text: str
+ usage: Mapping[str, Any]
+ metadata: Mapping[str, Any]
+ inventory: HarnessProviderInventory
+
+
+@runtime_checkable
+class HarnessMCPSource(Protocol):
+ def harness_mcp_specs(
+ self, bundle: ResolvedPluginBundle
+ ) -> Sequence[McpToolSpec]: ...
+
+
+@runtime_checkable
+class HarnessSkillSource(Protocol):
+ def harness_skill(
+ self, bundle: ResolvedPluginBundle
+ ) -> HarnessSkillContribution: ...
+
+
+@runtime_checkable
+class HarnessContextSource(Protocol):
+ async def harness_context(
+ self, bundle: ResolvedPluginBundle, request: HarnessTurnRequest
+ ) -> str: ...
+
+
+class _ConversationHistoryReasoner:
+ """Restore canonical message roles before calling the Harness reasoner.
+
+ HarnessRuntimeAdapter currently builds ``system + current user`` itself.
+ The provider encodes the canonical conversation input into that user slot;
+ this wrapper expands it back into structured roles without reimplementing
+ the Harness reasoning/tool loop.
+ """
+
+ def __init__(self, delegate: HarnessReasoner) -> None:
+ self._delegate = delegate
+
+ async def complete(
+ self,
+ *,
+ model: str,
+ prompt: str,
+ messages: Sequence[dict[str, Any]],
+ tools: Sequence[Any],
+ ) -> Any:
+ expanded = list(messages)
+ if len(expanded) >= 2:
+ content = expanded[1].get("content")
+ if isinstance(content, str) and content.startswith(_HISTORY_ENVELOPE_PREFIX):
+ raw = content.removeprefix(_HISTORY_ENVELOPE_PREFIX)
+ try:
+ history = json.loads(raw)
+ except json.JSONDecodeError as error:
+ raise RuntimeError("invalid canonical Harness history envelope") from error
+ if not isinstance(history, list) or not all(
+ isinstance(item, dict) for item in history
+ ):
+ raise RuntimeError("invalid canonical Harness history payload")
+ expanded = [expanded[0], *_chat_history(history), *expanded[2:]]
+ return await self._delegate.complete(
+ model=model,
+ prompt=prompt,
+ messages=expanded,
+ tools=tools,
+ )
+
+
+class _ConversationHistoryHarnessAdapter(HarnessRuntimeAdapter):
+ """Compatibility adapter with SessionService as the only history owner."""
+
+ async def start(self, request: StartRequest): # type: ignore[no-untyped-def]
+ preprocessing = request.conversation_preprocessing()
+ if preprocessing is not None and preprocessing.messages:
+ request = request.model_copy(
+ update={
+ "input": _HISTORY_ENVELOPE_PREFIX
+ + json.dumps(
+ preprocessing.messages,
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ )
+ }
+ )
+ return await super().start(request)
+
+ async def execute_request(self, request: StartRequest) -> dict[str, Any]:
+ # The standalone Harness adapter intentionally offers process-local
+ # continuity. PluginHost already prepares the complete canonical
+ # SessionService history, so retaining that same turn again inside the
+ # adapter would create two history owners and duplicate future turns.
+ session = self._session_for(request)
+ async with session.lock:
+ session.messages.clear()
+ try:
+ result = await self._execute_session_request(request, session)
+ return cast(dict[str, Any], result)
+ finally:
+ session.messages.clear()
+
+
+class KsADKHarnessProviderRuntime:
+ """PluginHost AgentProvider that owns Harness activation assembly."""
+
+ def __init__(
+ self,
+ *,
+ plugin_id: str,
+ session_service: BaseSessionService,
+ reasoner: HarnessReasoner,
+ ) -> None:
+ self._plugin_id = plugin_id
+ self._session_service = session_service
+ self._reasoner = reasoner
+ self._ready = False
+ self._disposed = False
+ self._last_inventory: HarnessProviderInventory | None = None
+
+ @property
+ def last_inventory(self) -> HarnessProviderInventory | None:
+ return self._last_inventory
+
+ @property
+ def disposed(self) -> bool:
+ return self._disposed
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise RuntimeError("Harness provider is disposed")
+ self._ready = True
+
+ async def health(self) -> bool:
+ return self._ready and not self._disposed
+
+ async def drain(self) -> None:
+ self._ready = False
+
+ async def dispose(self) -> None:
+ self._ready = False
+ self._disposed = True
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> "KsADKHarnessActivation":
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "harness_provider_unavailable", "Harness provider is not ready"
+ )
+
+ mcp_specs: list[McpToolSpec] = []
+ mcp_owners: list[str] = []
+ for binding in capabilities.all("mcp.connector/v1"):
+ if not isinstance(binding.runtime, HarnessMCPSource):
+ raise PluginHostError(
+ "harness_mcp_incompatible",
+ f"plugin {binding.plugin_id} cannot project Harness MCP config",
+ )
+ mcp_specs.extend(binding.runtime.harness_mcp_specs(bundle))
+ mcp_owners.append(binding.plugin_id)
+
+ skills: list[HarnessSkillContribution] = []
+ skill_owners: list[str] = []
+ for binding in capabilities.all("skill.source/v1"):
+ if not isinstance(binding.runtime, HarnessSkillSource):
+ raise PluginHostError(
+ "harness_skill_incompatible",
+ f"plugin {binding.plugin_id} cannot project Harness instructions",
+ )
+ contribution = binding.runtime.harness_skill(bundle)
+ if not contribution.name.strip() or not contribution.instructions.strip():
+ raise PluginHostError(
+ "harness_skill_invalid",
+ f"plugin {binding.plugin_id} returned an empty Skill contribution",
+ )
+ skills.append(contribution)
+ skill_owners.append(binding.plugin_id)
+
+ context_sources: list[HarnessContextSource] = []
+ context_owners: list[str] = []
+ for binding in capabilities.all("context.contributor/v1"):
+ if not isinstance(binding.runtime, HarnessContextSource):
+ raise PluginHostError(
+ "harness_context_incompatible",
+ f"plugin {binding.plugin_id} cannot contribute Harness context",
+ )
+ context_sources.append(binding.runtime)
+ context_owners.append(binding.plugin_id)
+
+ execution = bundle.resolved_agent_spec.get("execution")
+ strategy = (
+ str(execution.get("strategy") or "direct").strip()
+ if isinstance(execution, Mapping)
+ else "direct"
+ )
+ if strategy != "direct":
+ raise PluginHostError(
+ "harness_execution_strategy_unsupported",
+ f"KsADK Harness Provider does not support {strategy!r}",
+ )
+
+ model, prompt = _bundle_model_and_prompt(bundle)
+ if skills:
+ prompt = _append_prompt_sections(
+ prompt,
+ [f"Skill {item.name}:\n{item.instructions}" for item in skills],
+ )
+ config = HarnessConfig(
+ model=model,
+ prompt=prompt,
+ mcp_tools=tuple(mcp_specs),
+ sandbox=SandboxPolicy(read_only=True),
+ runtime="yaml",
+ )
+ inventory = HarnessProviderInventory(
+ provider=self._plugin_id,
+ execution_strategy=strategy,
+ model=model,
+ history_owner="canonical_session_service",
+ mcp_servers=tuple(mcp_owners),
+ skills=tuple(item.name for item in skills),
+ context_contributors=tuple(context_owners),
+ )
+ self._last_inventory = inventory
+ workspace_root = bundle.root / "runtime"
+ if not workspace_root.is_dir():
+ workspace_root = bundle.root
+ return KsADKHarnessActivation(
+ bundle=bundle,
+ config=config,
+ agent_name=bundle.manifest.agent_id,
+ workspace_root=workspace_root,
+ reasoner=self._reasoner,
+ context_sources=tuple(context_sources),
+ session_service=self._session_service,
+ inventory=inventory,
+ )
+
+
+class KsADKHarnessProviderFactory:
+ def __init__(
+ self,
+ *,
+ session_service: BaseSessionService | None = None,
+ reasoner: HarnessReasoner | None = None,
+ ) -> None:
+ self._session_service = session_service
+ self._reasoner = reasoner
+ self.runtime: KsADKHarnessProviderRuntime | None = None
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> KsADKHarnessProviderRuntime:
+ del profile
+ service = self._session_service or services.get("session_service")
+ if service is None:
+ service = create_session_service(backend="memory")
+ if not isinstance(service, BaseSessionService):
+ raise PluginHostError(
+ "harness_session_service_invalid",
+ "Harness provider requires a BaseSessionService",
+ )
+ reasoner = self._reasoner or services.get("harness_reasoner")
+ if reasoner is None:
+ reasoner = LiteLLMHarnessReasoner()
+ self.runtime = KsADKHarnessProviderRuntime(
+ plugin_id=manifest.metadata.id,
+ session_service=service,
+ reasoner=reasoner,
+ )
+ return self.runtime
+
+
+class KsADKHarnessActivation:
+ def __init__(
+ self,
+ *,
+ bundle: ResolvedPluginBundle,
+ config: HarnessConfig,
+ agent_name: str,
+ workspace_root: Path,
+ reasoner: HarnessReasoner,
+ context_sources: tuple[HarnessContextSource, ...],
+ session_service: BaseSessionService,
+ inventory: HarnessProviderInventory,
+ ) -> None:
+ self._bundle = bundle
+ self._config = config
+ self._agent_name = agent_name
+ self._workspace_root = workspace_root
+ self._reasoner = reasoner
+ self._context_sources = context_sources
+ self._session_service = session_service
+ self._inventory = inventory
+ self._ready = False
+ self._disposed = False
+ self._executors: list[RuntimeExecutor] = []
+ self._kernel_adapter: HarnessRuntimeAdapter | None = None
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise RuntimeError("Harness activation is disposed")
+ self._ready = True
+
+ async def health(self) -> bool:
+ return self._ready and not self._disposed
+
+ async def execute(self, request: Any) -> HarnessTurnResult:
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "harness_activation_unavailable", "Harness activation is not ready"
+ )
+ turn = HarnessTurnRequest.parse(request)
+ context_sections = [
+ text.strip()
+ for source in self._context_sources
+ if (text := await source.harness_context(self._bundle, turn)).strip()
+ ]
+ config = replace(
+ self._config,
+ prompt=_append_prompt_sections(self._config.prompt, context_sections),
+ )
+ executor, launch_context = _build_direct_backend(
+ config,
+ agent_name=self._agent_name,
+ workspace_root=self._workspace_root,
+ reasoner=self._reasoner,
+ )
+ self._executors.append(executor)
+ preparation = await executor.prepare_start(launch_context)
+ session_id, result = await invoke_runtime_conversation_once(
+ executor=executor,
+ launch_context=launch_context,
+ agent_id=self._agent_name,
+ user_id=turn.user_id,
+ messages=[dict(item) for item in turn.messages],
+ session_id=turn.session_id,
+ model=turn.model or config.model,
+ instructions=config.prompt,
+ request_metadata=turn.request_metadata,
+ invocation_id=turn.invocation_id,
+ session_service_provider=lambda: self._session_service,
+ runtime_preparation=preparation,
+ )
+ return HarnessTurnResult(
+ session_id=session_id,
+ output_text=str(result.get("output_text") or ""),
+ usage=dict(result.get("usage") or {}),
+ metadata=dict(result.get("metadata") or {}),
+ inventory=self._inventory,
+ )
+
+ def runtime_adapter(self) -> HarnessRuntimeAdapter:
+ """Return the activation-owned adapter used by AgentKernel Scheduler.
+
+ The immutable profile has already assembled model instructions, MCP,
+ Skills, sandbox and permissions into ``self._config``. Reusing one
+ adapter per session activation preserves Harness' honest process-local
+ continuity while AgentKernel remains the only event persistence owner.
+ """
+
+ if not self._ready or self._disposed:
+ raise PluginHostError(
+ "harness_activation_unavailable", "Harness activation is not ready"
+ )
+ if self._kernel_adapter is None:
+ self._kernel_adapter = HarnessRuntimeAdapter(
+ self._config,
+ agent_name=self._agent_name,
+ reasoner=self._reasoner,
+ workspace_root=self._workspace_root,
+ )
+ return self._kernel_adapter
+
+ async def drain(self) -> None:
+ self._ready = False
+
+ async def dispose(self) -> None:
+ self._ready = False
+ first_error: BaseException | None = None
+ if self._kernel_adapter is not None:
+ try:
+ await self._kernel_adapter.close_all()
+ except BaseException as error: # cleanup must continue
+ first_error = error
+ self._kernel_adapter = None
+ for executor in reversed(self._executors):
+ try:
+ await executor.close_all()
+ except BaseException as error: # cleanup must continue
+ if first_error is None:
+ first_error = error
+ self._executors.clear()
+ self._disposed = True
+ if first_error is not None:
+ raise first_error
+
+
+def _build_direct_backend(
+ config: HarnessConfig,
+ *,
+ agent_name: str,
+ workspace_root: Path,
+ reasoner: HarnessReasoner,
+) -> tuple[RuntimeExecutor, RuntimeLaunchContext]:
+ """Internal execution seam; Phase 2 does not expose strategy as a plugin."""
+
+ history_reasoner = _ConversationHistoryReasoner(reasoner)
+ registry = RuntimeRegistry()
+ registry.register(
+ "harness",
+ lambda _context: _ConversationHistoryHarnessAdapter(
+ config,
+ agent_name=agent_name,
+ reasoner=history_reasoner,
+ workspace_root=workspace_root,
+ ),
+ )
+ return RuntimeExecutor(registry), RuntimeLaunchContext(
+ runtime_type="harness",
+ project_dir=workspace_root,
+ config={
+ "model": config.model,
+ "base_instructions": config.prompt,
+ "sandbox_read_only": config.sandbox.read_only,
+ },
+ )
+
+
+def _bundle_model_and_prompt(bundle: ResolvedPluginBundle) -> tuple[str, str]:
+ spec = bundle.resolved_agent_spec
+ raw_model = spec.get("model")
+ model = (
+ str(raw_model.get("model") or "").strip()
+ if isinstance(raw_model, Mapping)
+ else str(raw_model or "").strip()
+ )
+ instructions = spec.get("instructions")
+ if not isinstance(instructions, Mapping):
+ instructions = {}
+ system = str(instructions.get("system") or "").strip()
+ task = str(instructions.get("task") or "").strip()
+ prompt = _append_prompt_sections(system, [task])
+ if not model:
+ raise PluginHostError(
+ "harness_bundle_model_missing", "Bundle resolved Agent spec has no model"
+ )
+ if not prompt:
+ raise PluginHostError(
+ "harness_bundle_prompt_missing", "Bundle resolved Agent spec has no instructions"
+ )
+ return model, prompt
+
+
+def _append_prompt_sections(base: str, sections: Sequence[str]) -> str:
+ values = [base.strip(), *(section.strip() for section in sections)]
+ return "\n\n".join(value for value in values if value)
+
+
+def _chat_history(history: Sequence[Mapping[str, Any]]) -> list[dict[str, Any]]:
+ """Translate Responses message content into the Harness chat shape."""
+
+ normalized: list[dict[str, Any]] = []
+ for item in history:
+ role = str(item.get("role") or "").strip().lower()
+ if role == "model":
+ role = "assistant"
+ if role not in {"user", "assistant", "tool"}:
+ continue
+ content = item.get("content")
+ if isinstance(content, Sequence) and not isinstance(
+ content, (str, bytes, bytearray)
+ ):
+ segments = [
+ str(part.get("text") or "")
+ for part in content
+ if isinstance(part, Mapping) and part.get("text") is not None
+ ]
+ content = "\n".join(segment for segment in segments if segment)
+ message = {"role": role, "content": str(content or "")}
+ for key in ("tool_call_id", "name", "tool_calls"):
+ if key in item:
+ message[key] = item[key]
+ normalized.append(message)
+ return normalized
+
+
+__all__ = [
+ "HarnessContextSource",
+ "HarnessMCPSource",
+ "HarnessProviderInventory",
+ "HarnessSkillContribution",
+ "HarnessSkillSource",
+ "HarnessTurnRequest",
+ "HarnessTurnResult",
+ "KsADKHarnessProviderFactory",
+ "KsADKHarnessProviderRuntime",
+]
diff --git a/ksadk/plugins/providers/harness_dsh.py b/ksadk/plugins/providers/harness_dsh.py
new file mode 100644
index 00000000..d9b1c459
--- /dev/null
+++ b/ksadk/plugins/providers/harness_dsh.py
@@ -0,0 +1,91 @@
+"""KsADK Harness AgentProvider packaged as a standard DSH Bundle.
+
+DSH owns installation and discovery. The shared bridge validates the exact
+registration, then delegates execution to the optional in-process KsADK
+Harness implementation so credentials and runtime services stay in KsADK.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import TYPE_CHECKING, Any
+
+from ksadk.plugins.contracts import CompositionProfile, PluginManifest
+from ksadk.plugins.providers.dsh import DshAgentProviderHost, DshAgentProviderRegistration
+from ksadk.plugins.providers.shipped_dsh import (
+ HARNESS_DSH_SPEC,
+ ShippedDshBridgeFactory,
+ ShippedDshBridgeRuntime,
+ ShippedDshBundle,
+ load_shipped_dsh_bundle,
+ shipped_dsh_host_command,
+)
+
+if TYPE_CHECKING:
+ from ksadk.plugins.providers.harness import KsADKHarnessProviderFactory
+
+SHIPPED_HARNESS_DSH_PACKAGE = HARNESS_DSH_SPEC.package_name
+SHIPPED_HARNESS_PROVIDER_ID = HARNESS_DSH_SPEC.provider_id
+SHIPPED_HARNESS_PROVIDER_VERSION = HARNESS_DSH_SPEC.version
+ShippedHarnessDshBundle = ShippedDshBundle
+
+
+def shipped_harness_dsh_bundle() -> ShippedHarnessDshBundle:
+ return load_shipped_dsh_bundle(HARNESS_DSH_SPEC)
+
+
+def shipped_harness_dsh_host_command(*, python_executable: str | None = None) -> tuple[str, ...]:
+ return shipped_dsh_host_command(HARNESS_DSH_SPEC, python_executable=python_executable)
+
+
+class KsADKHarnessDshBridgeRuntime(ShippedDshBridgeRuntime):
+ """Named Harness bridge type retained for inventory and public typing."""
+
+
+class KsADKHarnessDshBridgeFactory(ShippedDshBridgeFactory):
+ runtime_class = KsADKHarnessDshBridgeRuntime
+
+ def __init__(
+ self,
+ host: DshAgentProviderHost,
+ registration: DshAgentProviderRegistration,
+ *,
+ execution_factory: KsADKHarnessProviderFactory | None = None,
+ owns_host: bool = True,
+ ) -> None:
+ if execution_factory is None:
+ # Keep the Harness/ADK dependency optional until this provider is
+ # selected; listing Codex or DSH plugins must stay cheap.
+ from ksadk.plugins.providers.harness import KsADKHarnessProviderFactory
+
+ execution_factory = KsADKHarnessProviderFactory()
+ super().__init__(
+ spec=HARNESS_DSH_SPEC,
+ host=host,
+ registration=registration,
+ execution_factory=execution_factory,
+ owns_host=owns_host,
+ )
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> KsADKHarnessDshBridgeRuntime:
+ runtime = await super().stage(manifest, profile=profile, services=services)
+ assert isinstance(runtime, KsADKHarnessDshBridgeRuntime)
+ return runtime
+
+
+__all__ = [
+ "KsADKHarnessDshBridgeFactory",
+ "KsADKHarnessDshBridgeRuntime",
+ "SHIPPED_HARNESS_DSH_PACKAGE",
+ "SHIPPED_HARNESS_PROVIDER_ID",
+ "SHIPPED_HARNESS_PROVIDER_VERSION",
+ "ShippedHarnessDshBundle",
+ "shipped_harness_dsh_bundle",
+ "shipped_harness_dsh_host_command",
+]
diff --git a/ksadk/plugins/providers/legacy.py b/ksadk/plugins/providers/legacy.py
new file mode 100644
index 00000000..b0013e12
--- /dev/null
+++ b/ksadk/plugins/providers/legacy.py
@@ -0,0 +1,215 @@
+"""Central compatibility boundary for pre-DSH Harness AgentBundles.
+
+Reading an old Bundle and selecting the in-process Harness provider are two
+different decisions. Existing ADK, LangGraph and Codex artifacts continue to
+use their established adapters. The Harness compatibility adapter is only
+available for an immutable Bundle v1 digest that a release/migration owner has
+explicitly registered as a historical Harness artifact.
+
+Bundle v2 is never eligible for this bridge. It must resolve the Harness
+provider from the active DSH registration and its deterministic PluginLock.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from typing import Iterable, Literal
+
+from pydantic import ValidationError
+
+from ksadk.plugins.contracts import PluginManifest
+from ksadk.plugins.providers.legacy_catalog import (
+ KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID,
+ legacy_harness_agent_provider_manifest,
+)
+from ksadk.studio.capabilities import compute_bundle_digest
+from ksadk.studio.contracts import BundleManifest
+
+
+class LegacyBundleCompatibilityError(ValueError):
+ """Stable fail-closed result from the legacy Bundle normalizer."""
+
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+@dataclass(frozen=True)
+class LegacyHarnessSource:
+ """Immutable identity approved by a release or migration process."""
+
+ bundle_digest: str
+ resolved_digest: str
+ source_revision: int
+
+ @classmethod
+ def from_verified_manifest(cls, manifest: BundleManifest) -> "LegacyHarnessSource":
+ """Capture an already-verified historical Bundle v1 identity."""
+
+ if manifest.bundle_format != "agentkit.bundle/v1":
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_bundle_version_unsupported",
+ "Only an AgentBundle v1 can be registered as a legacy Harness source",
+ )
+ _require_self_consistent_digest(manifest)
+ return cls(
+ bundle_digest=manifest.bundle_digest,
+ resolved_digest=manifest.resolved_digest,
+ source_revision=manifest.source_revision,
+ )
+
+
+@dataclass(frozen=True)
+class HarnessProviderSelection:
+ """Normalized provider choice; execution stays with the owning runtime."""
+
+ route: Literal["dsh", "legacy"]
+ manifest: PluginManifest | None = None
+
+
+class LegacyBundleAdapter:
+ """Select Harness compatibility without broad version-based fallback."""
+
+ def __init__(self, sources: Iterable[LegacyHarnessSource] = ()) -> None:
+ source_by_digest: dict[str, LegacyHarnessSource] = {}
+ for source in sources:
+ previous = source_by_digest.setdefault(source.bundle_digest, source)
+ if previous != source:
+ raise ValueError("conflicting legacy Harness identities use the same bundle digest")
+ self._sources = source_by_digest
+
+ def select_from_bundle(
+ self,
+ root: str | Path,
+ *,
+ registered_provider_ids: Iterable[str] = (),
+ ) -> tuple[BundleManifest, HarnessProviderSelection | None]:
+ """Verify one immutable Bundle before applying the compatibility rule."""
+
+ bundle_root = Path(root).resolve()
+ try:
+ payload = json.loads((bundle_root / "manifest.json").read_text(encoding="utf-8"))
+ manifest = BundleManifest.model_validate(payload)
+ except (OSError, UnicodeError, json.JSONDecodeError, ValidationError) as error:
+ raise LegacyBundleCompatibilityError(
+ "bundle_manifest_invalid", "AgentBundle manifest is invalid"
+ ) from error
+ _require_self_consistent_digest(manifest)
+ declared: set[str] = set()
+ for entry in manifest.files:
+ relative = PurePosixPath(entry.path)
+ if relative.is_absolute() or ".." in relative.parts:
+ raise LegacyBundleCompatibilityError(
+ "bundle_path_invalid", "AgentBundle contains an unsafe file path"
+ )
+ path = (bundle_root / Path(*relative.parts)).resolve()
+ if not path.is_relative_to(bundle_root):
+ raise LegacyBundleCompatibilityError(
+ "bundle_path_invalid", "AgentBundle file path escapes its root"
+ )
+ try:
+ content = path.read_bytes()
+ except OSError as error:
+ raise LegacyBundleCompatibilityError(
+ "bundle_file_missing", f"AgentBundle file is missing: {entry.path}"
+ ) from error
+ digest = f"sha256:{hashlib.sha256(content).hexdigest()}"
+ if len(content) != entry.size or digest != entry.sha256:
+ raise LegacyBundleCompatibilityError(
+ "bundle_file_digest_mismatch",
+ f"AgentBundle file failed integrity verification: {entry.path}",
+ )
+ declared.add(entry.path)
+ actual = {
+ path.relative_to(bundle_root).as_posix()
+ for path in bundle_root.rglob("*")
+ if path.is_file() and path.name != "manifest.json"
+ }
+ if actual != declared:
+ raise LegacyBundleCompatibilityError(
+ "bundle_membership_mismatch",
+ "AgentBundle contains missing or undeclared files",
+ )
+ return manifest, self.select_harness_provider(
+ manifest,
+ registered_provider_ids=registered_provider_ids,
+ )
+
+ def select_harness_provider(
+ self,
+ manifest: BundleManifest,
+ *,
+ registered_provider_ids: Iterable[str] = (),
+ ) -> HarnessProviderSelection | None:
+ """Return the exact Harness route, or ``None`` for non-Harness Bundles.
+
+ For Bundle v1, a matching approved digest is the Harness discriminator;
+ this also supports historical manifests that predate ``runtimeType``.
+ For Bundle v2, ``runtimeType=harness`` always requires a ready DSH
+ provider registration. No v1 allowlist entry can change that rule.
+ """
+
+ runtime_type = manifest.runtime_type.strip().lower()
+ registered = frozenset(registered_provider_ids)
+
+ if manifest.bundle_format == "agentkit.bundle/v2":
+ if runtime_type != "harness":
+ return None
+ if KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID not in registered:
+ raise LegacyBundleCompatibilityError(
+ "agent_provider_not_registered",
+ "Harness Bundle v2 requires a ready DSH provider registration",
+ )
+ return HarnessProviderSelection(route="dsh")
+
+ source = self._sources.get(manifest.bundle_digest)
+ if source is None:
+ if runtime_type == "harness":
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_source_unrecognized",
+ "Bundle v1 is not an explicitly registered historical Harness artifact",
+ )
+ return None
+
+ _require_self_consistent_digest(manifest)
+ if (
+ manifest.resolved_digest != source.resolved_digest
+ or manifest.source_revision != source.source_revision
+ ):
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_source_mismatch",
+ "Bundle v1 metadata does not match its registered historical identity",
+ )
+ if runtime_type not in {"", "harness"}:
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_runtime_mismatch",
+ "Registered historical Harness Bundle declares another runtime type",
+ )
+ if manifest.plugin_lock_digest or manifest.composition_profile_digest:
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_composition_forbidden",
+ "A legacy Harness Bundle cannot carry partial Bundle v2 composition state",
+ )
+ return HarnessProviderSelection(
+ route="legacy",
+ manifest=legacy_harness_agent_provider_manifest(),
+ )
+
+
+def _require_self_consistent_digest(manifest: BundleManifest) -> None:
+ if not manifest.bundle_digest or manifest.bundle_digest != compute_bundle_digest(manifest):
+ raise LegacyBundleCompatibilityError(
+ "legacy_harness_bundle_digest_mismatch",
+ "Historical Harness manifest does not match its declared bundle digest",
+ )
+
+
+__all__ = [
+ "HarnessProviderSelection",
+ "LegacyBundleAdapter",
+ "LegacyBundleCompatibilityError",
+ "LegacyHarnessSource",
+]
diff --git a/ksadk/plugins/providers/legacy_catalog.py b/ksadk/plugins/providers/legacy_catalog.py
new file mode 100644
index 00000000..c655dad6
--- /dev/null
+++ b/ksadk/plugins/providers/legacy_catalog.py
@@ -0,0 +1,100 @@
+"""Explicit compatibility catalog for pre-DSH AgentProvider manifests.
+
+All new AgentProviders, including the official Codex and KsADK Harness
+Bundles, enter Bundle v2 composition only through a ready DSH registration.
+The old in-process Harness manifest remains an explicit compatibility artifact
+for already-built Agents; callers must never add it to new resolution silently.
+"""
+
+from __future__ import annotations
+
+import hashlib
+
+from ksadk.plugins.contracts import PluginManifest
+
+BUILTIN_PROVIDER_VERSION = "1.0.0"
+CODEX_AGENT_PROVIDER_PLUGIN_ID = "io.ksadk.codex-provider"
+KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID = "io.ksadk.harness-provider"
+
+
+def _digest(plugin_id: str) -> str:
+ payload = f"{plugin_id}@{BUILTIN_PROVIDER_VERSION}:builtin-provider-v1".encode()
+ return f"sha256:{hashlib.sha256(payload).hexdigest()}"
+
+
+def _provider_manifest(
+ plugin_id: str,
+ *,
+ domain: str,
+ runtime: str,
+ isolation: str,
+ source: str,
+ entrypoint: str | None = None,
+) -> PluginManifest:
+ spec: dict[str, object] = {
+ "domain": domain,
+ "runtime": runtime,
+ "provides": [
+ {
+ "definition": "agent.provider/v1",
+ "slot": "agent.execution",
+ "mode": "unique",
+ }
+ ],
+ "permissions": [],
+ "isolation": isolation,
+ "compatibility": {
+ "kernelApi": ">=1,<2",
+ "runtimeProtocols": ["agentkit.runtime/v1"],
+ "python": ">=3.10,<3.15" if runtime == "python" else None,
+ },
+ "healthContract": "plugin.health/v1",
+ "provenance": {
+ "source": source,
+ "digest": _digest(plugin_id),
+ "license": "Apache-2.0",
+ },
+ }
+ if entrypoint is not None:
+ spec["entrypoint"] = entrypoint
+ compatibility = spec["compatibility"]
+ assert isinstance(compatibility, dict)
+ if compatibility["python"] is None:
+ del compatibility["python"]
+ manifest = PluginManifest.model_validate(
+ {
+ "metadata": {"id": plugin_id, "version": BUILTIN_PROVIDER_VERSION},
+ "spec": spec,
+ }
+ )
+ if not isinstance(manifest, PluginManifest): # pragma: no cover - Pydantic invariant
+ raise TypeError("built-in provider manifest validation returned an invalid type")
+ return manifest
+
+
+def builtin_agent_provider_manifests() -> tuple[PluginManifest, ...]:
+ """Return no Bundle v2 providers; DSH registration is authoritative."""
+
+ return ()
+
+
+def legacy_harness_agent_provider_manifest() -> PluginManifest:
+ """Return the old manifest only for an explicitly detected legacy Agent."""
+
+ return _provider_manifest(
+ KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID,
+ domain="ksadk-platform",
+ runtime="python",
+ isolation="in-process",
+ source="builtin",
+ entrypoint="ksadk.plugins.providers.harness:KsADKHarnessProviderFactory",
+ )
+
+
+__all__ = [
+ "BUILTIN_PROVIDER_VERSION",
+ "CODEX_AGENT_PROVIDER_PLUGIN_ID",
+ "KSADK_HARNESS_AGENT_PROVIDER_PLUGIN_ID",
+ "builtin_agent_provider_manifests",
+ "legacy_harness_agent_provider_manifest",
+]
diff --git a/ksadk/plugins/providers/shipped_dsh.py b/ksadk/plugins/providers/shipped_dsh.py
new file mode 100644
index 00000000..455f447d
--- /dev/null
+++ b/ksadk/plugins/providers/shipped_dsh.py
@@ -0,0 +1,370 @@
+"""Shared implementation for wheel-owned DSH AgentProvider bundles.
+
+Provider-specific modules declare identity and select an execution factory.
+This module owns the repeated package validation, fixed host command,
+registration fences, and bridge lifecycle. It does not own an agent loop.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Protocol
+
+from ksadk.plugins.bundle import ResolvedPluginBundle
+from ksadk.plugins.contracts import CompositionProfile, PluginManifest
+from ksadk.plugins.host import PluginExecutionContext, PluginHostError
+from ksadk.plugins.providers.dsh import (
+ DshAgentProviderHost,
+ DshAgentProviderRegistration,
+ dsh_agent_provider_manifest,
+)
+
+
+@dataclass(frozen=True)
+class ShippedDshProviderSpec:
+ key: str
+ display_name: str
+ package_name: str
+ provider_id: str
+ version: str
+ bundle_directory: str
+ bridge_required_code: str
+ bridge_required_message: str
+
+ @property
+ def provider_ref(self) -> str:
+ return f"plugin://{self.provider_id}@{self.version}"
+
+ def error_code(self, suffix: str) -> str:
+ return f"{self.key}_dsh_{suffix}"
+
+
+CODEX_DSH_SPEC = ShippedDshProviderSpec(
+ key="codex",
+ display_name="Codex",
+ package_name="@kingsoftcloud/ksadk-codex-provider",
+ provider_id="io.ksadk.codex-provider",
+ version="1.0.0",
+ bundle_directory="ksadk-codex",
+ bridge_required_code="codex_provider_bridge_required",
+ bridge_required_message=(
+ "Codex execution requires the registration-gated RuntimeAdapter bridge"
+ ),
+)
+
+HARNESS_DSH_SPEC = ShippedDshProviderSpec(
+ key="harness",
+ display_name="KsADK Harness",
+ package_name="@kingsoftcloud/ksadk-harness-provider",
+ provider_id="io.ksadk.harness-provider",
+ version="1.0.0",
+ bundle_directory="ksadk-harness",
+ bridge_required_code="harness_legacy_bridge_required",
+ bridge_required_message=(
+ "Harness execution requires the registration-gated RuntimeAdapter bridge"
+ ),
+)
+
+SHIPPED_DSH_PROVIDER_SPECS = {
+ CODEX_DSH_SPEC.key: CODEX_DSH_SPEC,
+ HARNESS_DSH_SPEC.key: HARNESS_DSH_SPEC,
+}
+
+
+@dataclass(frozen=True)
+class ShippedDshBundle:
+ package_name: str
+ version: str
+ root: Path
+ patch: Path
+
+
+def load_shipped_dsh_bundle(spec: ShippedDshProviderSpec) -> ShippedDshBundle:
+ """Locate and validate one immutable DSH bundle shipped in the wheel."""
+
+ root = Path(__file__).with_name("bundles") / spec.bundle_directory
+ package_path = root / "package.json"
+ try:
+ payload = json.loads(package_path.read_text(encoding="utf-8"))
+ except (OSError, UnicodeError, json.JSONDecodeError) as error:
+ raise PluginHostError(
+ spec.error_code("bundle_invalid"),
+ f"shipped {spec.display_name} DSH Bundle package.json is unavailable",
+ ) from error
+ if not isinstance(payload, dict):
+ raise PluginHostError(
+ spec.error_code("bundle_invalid"),
+ f"shipped {spec.display_name} DSH Bundle package.json must be an object",
+ )
+ dsh = payload.get("dsh")
+ bundle = dsh.get("bundle") if isinstance(dsh, dict) else None
+ patch_value = bundle.get("patch") if isinstance(bundle, dict) else None
+ if (
+ payload.get("name") != spec.package_name
+ or payload.get("version") != spec.version
+ or patch_value != "./cordis.patch.yml"
+ or "ksadk" in payload
+ ):
+ raise PluginHostError(
+ spec.error_code("bundle_invalid"),
+ f"shipped {spec.display_name} provider is not a standard pinned DSH Bundle",
+ )
+ patch = (root / str(patch_value)).resolve()
+ try:
+ patch.relative_to(root.resolve())
+ except ValueError as error:
+ raise PluginHostError(
+ spec.error_code("bundle_invalid"),
+ "DSH Bundle patch escapes its package root",
+ ) from error
+ if not patch.is_file() or not (root / "index.mjs").is_file():
+ raise PluginHostError(
+ spec.error_code("bundle_invalid"),
+ "DSH Bundle contribution files are missing",
+ )
+ return ShippedDshBundle(
+ package_name=spec.package_name,
+ version=spec.version,
+ root=root.resolve(),
+ patch=patch,
+ )
+
+
+def shipped_dsh_host_command(
+ spec: ShippedDshProviderSpec,
+ *,
+ python_executable: str | None = None,
+) -> tuple[str, ...]:
+ """Return fixed argv; bundle content never controls the executable."""
+
+ load_shipped_dsh_bundle(spec)
+ executable = str(python_executable or sys.executable).strip()
+ if not executable or "\x00" in executable:
+ raise PluginHostError(spec.error_code("host_invalid"), "Python host executable is invalid")
+ return executable, "-m", "ksadk.plugins.providers.dsh_descriptor_host", spec.key
+
+
+class _ExecutionRuntime(Protocol):
+ async def start(self) -> None: ...
+
+ async def health(self) -> bool: ...
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> Any: ...
+
+ async def drain(self) -> None: ...
+
+ async def dispose(self) -> None: ...
+
+
+class _ExecutionFactory(Protocol):
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> _ExecutionRuntime: ...
+
+
+class ShippedDshBridgeRuntime:
+ """DSH registration lifecycle delegating execution to the owning runtime."""
+
+ def __init__(
+ self,
+ *,
+ spec: ShippedDshProviderSpec,
+ host: DshAgentProviderHost,
+ registration: DshAgentProviderRegistration,
+ execution_runtime: _ExecutionRuntime,
+ owns_host: bool,
+ ) -> None:
+ self._spec = spec
+ self._host = host
+ self._registration = registration
+ self._execution_runtime = execution_runtime
+ self._owns_host = owns_host
+ self._started = False
+ self._disposed = False
+
+ async def start(self) -> None:
+ if self._disposed:
+ raise PluginHostError(
+ self._spec.error_code("bridge_disposed"),
+ f"{self._spec.display_name} DSH bridge is disposed",
+ )
+ current = await self._host.registration()
+ require_same_registration(self._spec, current, self._registration)
+ await self._execution_runtime.start()
+ self._started = True
+
+ async def health(self) -> bool:
+ if not self._started or self._disposed:
+ return False
+ return await self._host.health() and await self._execution_runtime.health()
+
+ async def prepare(
+ self,
+ bundle: ResolvedPluginBundle,
+ *,
+ capabilities: PluginExecutionContext,
+ ) -> Any:
+ if not await self.health():
+ raise PluginHostError(
+ self._spec.error_code("bridge_unavailable"),
+ f"{self._spec.display_name} DSH provider is not ready",
+ )
+ if bundle.composition.profile.agent_provider.ref != self._spec.provider_ref:
+ raise PluginHostError(
+ self._spec.error_code("profile_mismatch"),
+ "Agent Bundle does not select the registered "
+ f"{self._spec.display_name} DSH provider",
+ )
+ return await self._execution_runtime.prepare(bundle, capabilities=capabilities)
+
+ async def drain(self) -> None:
+ if self._disposed:
+ return
+ await self._execution_runtime.drain()
+ if self._owns_host and self._host.pid is not None:
+ await self._host.drain()
+ self._started = False
+
+ async def dispose(self) -> None:
+ if self._disposed:
+ return
+ self._disposed = True
+ self._started = False
+ first_error: BaseException | None = None
+ try:
+ await self._execution_runtime.dispose()
+ except BaseException as error: # cleanup must continue
+ first_error = error
+ if self._owns_host:
+ try:
+ await self._host.dispose()
+ except BaseException as error: # cleanup must continue
+ if first_error is None:
+ first_error = error
+ if first_error is not None:
+ raise first_error
+
+
+class ShippedDshBridgeFactory:
+ """Admit one exact DSH registration and create its execution bridge."""
+
+ runtime_class = ShippedDshBridgeRuntime
+
+ def __init__(
+ self,
+ *,
+ spec: ShippedDshProviderSpec,
+ host: DshAgentProviderHost,
+ registration: DshAgentProviderRegistration,
+ execution_factory: _ExecutionFactory,
+ owns_host: bool = True,
+ ) -> None:
+ validate_registration(spec, registration)
+ self._spec = spec
+ self._host = host
+ self._registration = registration
+ self._execution_factory = execution_factory
+ self._owns_host = owns_host
+ self.runtime: ShippedDshBridgeRuntime | None = None
+
+ async def stage(
+ self,
+ manifest: PluginManifest,
+ *,
+ profile: CompositionProfile,
+ services: Mapping[str, Any],
+ ) -> ShippedDshBridgeRuntime:
+ expected_manifest = dsh_agent_provider_manifest(
+ self._registration.descriptor,
+ preflight=self._registration.preflight,
+ )
+ if manifest != expected_manifest:
+ raise PluginHostError(
+ self._spec.error_code("manifest_mismatch"),
+ f"{self._spec.display_name} provider manifest did not come from "
+ "the ready DSH registration",
+ )
+ if profile.agent_provider.ref != self._spec.provider_ref:
+ raise PluginHostError(
+ self._spec.error_code("profile_mismatch"),
+ "composition profile does not select the shipped "
+ f"{self._spec.display_name} DSH provider",
+ )
+ current = await self._host.registration()
+ require_same_registration(self._spec, current, self._registration)
+ execution_runtime = await self._execution_factory.stage(
+ manifest, profile=profile, services=services
+ )
+ self.runtime = self.runtime_class(
+ spec=self._spec,
+ host=self._host,
+ registration=self._registration,
+ execution_runtime=execution_runtime,
+ owns_host=self._owns_host,
+ )
+ return self.runtime
+
+
+def validate_registration(
+ spec: ShippedDshProviderSpec,
+ registration: DshAgentProviderRegistration,
+) -> None:
+ descriptor = registration.descriptor
+ preflight = registration.preflight
+ if (
+ descriptor.provider_id != spec.provider_id
+ or descriptor.provider_version != spec.version
+ or descriptor.plugin_name != spec.package_name
+ or not preflight.ready
+ or preflight.profile_digest != descriptor.profile_digest
+ or preflight.descriptor_digest != descriptor.descriptor_digest
+ ):
+ raise PluginHostError(
+ spec.error_code("registration_invalid"),
+ f"{spec.display_name} DSH registration does not match the shipped provider fences",
+ )
+
+
+def require_same_registration(
+ spec: ShippedDshProviderSpec,
+ current: DshAgentProviderRegistration,
+ expected: DshAgentProviderRegistration,
+) -> None:
+ validate_registration(spec, current)
+ if (
+ current.descriptor != expected.descriptor
+ or current.preflight != expected.preflight
+ or current.manifest != expected.manifest
+ ):
+ raise PluginHostError(
+ spec.error_code("registration_changed"),
+ f"{spec.display_name} DSH provider changed after admission",
+ )
+
+
+__all__ = [
+ "CODEX_DSH_SPEC",
+ "HARNESS_DSH_SPEC",
+ "SHIPPED_DSH_PROVIDER_SPECS",
+ "ShippedDshBridgeFactory",
+ "ShippedDshBridgeRuntime",
+ "ShippedDshBundle",
+ "ShippedDshProviderSpec",
+ "load_shipped_dsh_bundle",
+ "require_same_registration",
+ "shipped_dsh_host_command",
+ "validate_registration",
+]
diff --git a/ksadk/plugins/resolver.py b/ksadk/plugins/resolver.py
new file mode 100644
index 00000000..91093977
--- /dev/null
+++ b/ksadk/plugins/resolver.py
@@ -0,0 +1,331 @@
+"""Pure, deterministic Profile -> PluginLock resolver.
+
+This module is intentionally side-effect free: it resolves only supplied
+manifests and never imports their entrypoints. PluginHost will later own
+admission, staging, start, health, and disposal.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from dataclasses import dataclass
+from typing import Iterable
+
+from ksadk.plugins.contracts import (
+ CompositionProfile,
+ LockedCapability,
+ PluginDependency,
+ PluginLock,
+ PluginLockEntry,
+ PluginManifest,
+ PluginReference,
+ plugin_lock_digest,
+)
+
+
+class PluginResolutionError(ValueError):
+ """Stable, typed rejection from the pure composition resolver."""
+
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+@dataclass(frozen=True)
+class ResolvedComposition:
+ profile: CompositionProfile
+ profile_digest: str
+ plugin_lock: PluginLock
+ plugin_lock_digest: str
+ # Build-time audit facts from the exact manifests that produced the lock.
+ # This is an internal immutable projection, not another wire manifest: the
+ # public Bundle continues to bind only CompositionProfile and PluginLock.
+ manifests: tuple[PluginManifest, ...] = ()
+
+
+def canonical_composition_profile(profile: CompositionProfile) -> bytes:
+ return json.dumps(
+ profile.model_dump(by_alias=True, exclude_none=True, mode="json"),
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ ).encode("utf-8")
+
+
+def composition_profile_digest(profile: CompositionProfile) -> str:
+ return f"sha256:{hashlib.sha256(canonical_composition_profile(profile)).hexdigest()}"
+
+
+class PluginRegistry:
+ """Immutable in-memory manifest catalog used by build-time resolution."""
+
+ def __init__(self, manifests: Iterable[PluginManifest]) -> None:
+ indexed: dict[tuple[str, str], PluginManifest] = {}
+ for manifest in manifests:
+ key = (manifest.metadata.id, manifest.metadata.version)
+ if key in indexed:
+ raise PluginResolutionError(
+ "plugin_manifest_duplicate",
+ f"duplicate plugin manifest {manifest.metadata.id}@{manifest.metadata.version}",
+ )
+ indexed[key] = manifest
+ self._manifests = indexed
+
+ def resolve(self, profile: CompositionProfile) -> ResolvedComposition:
+ """Resolve the requested graph without running any plugin code."""
+
+ selected: dict[str, PluginManifest] = {}
+ dependencies: dict[str, set[str]] = {}
+
+ def select_reference(reference: PluginReference) -> PluginManifest:
+ plugin_id, version = _parse_plugin_reference(reference.ref)
+ manifest = self._manifests.get((plugin_id, version))
+ if manifest is None:
+ raise PluginResolutionError(
+ "plugin_manifest_unresolved",
+ f"plugin {plugin_id}@{version} is not in the selected catalog",
+ )
+ select_manifest(manifest)
+ return manifest
+
+ def select_manifest(manifest: PluginManifest) -> None:
+ plugin_id = manifest.metadata.id
+ if plugin_id in selected:
+ if selected[plugin_id].metadata.version != manifest.metadata.version:
+ raise PluginResolutionError(
+ "plugin_version_conflict",
+ f"profile requires conflicting versions of plugin {plugin_id}",
+ )
+ return
+ selected[plugin_id] = manifest
+ dependencies.setdefault(plugin_id, set())
+ for requirement in manifest.spec.requires:
+ provider = self._resolve_requirement(requirement.definition, requirement.version)
+ if provider.metadata.id == plugin_id:
+ raise PluginResolutionError(
+ "plugin_dependency_cycle",
+ f"plugin {plugin_id} cannot provide its own required capability",
+ )
+ dependencies[plugin_id].add(provider.metadata.id)
+ select_manifest(provider)
+
+ provider = select_reference(profile.agent_provider)
+ self._require_agent_provider(provider)
+ for capability in profile.capabilities:
+ if capability.ref.startswith("plugin://"):
+ # A capability entry uses the same pinning grammar as the
+ # agent provider, but it has no special agent-provider role.
+ plugin_id, version = _parse_plugin_reference(capability.ref)
+ manifest = self._manifests.get((plugin_id, version))
+ if manifest is None:
+ raise PluginResolutionError(
+ "plugin_manifest_unresolved",
+ f"plugin {plugin_id}@{version} is not in the selected catalog",
+ )
+ select_manifest(manifest)
+
+ self._validate_unique_slots(selected.values())
+ lock = self._build_lock(selected, dependencies)
+ return ResolvedComposition(
+ profile=profile,
+ profile_digest=composition_profile_digest(profile),
+ plugin_lock=lock,
+ plugin_lock_digest=plugin_lock_digest(lock),
+ manifests=tuple(
+ sorted(
+ selected.values(),
+ key=lambda item: (item.metadata.id, item.metadata.version),
+ )
+ ),
+ )
+
+ def manifest_for(self, plugin_id: str, version: str) -> PluginManifest:
+ """Return an exact manifest already admitted to this local catalog."""
+
+ manifest = self._manifests.get((plugin_id, version))
+ if manifest is None:
+ raise PluginResolutionError(
+ "plugin_manifest_unresolved",
+ f"plugin {plugin_id}@{version} is not in the selected catalog",
+ )
+ return manifest
+
+ def _resolve_requirement(self, definition: str, constraint: str) -> PluginManifest:
+ candidates = [
+ manifest
+ for manifest in self._manifests.values()
+ if any(offer.definition == definition for offer in manifest.spec.provides)
+ and _version_satisfies(manifest.metadata.version, constraint)
+ ]
+ if not candidates:
+ raise PluginResolutionError(
+ "plugin_requirement_unresolved",
+ f"no plugin provides {definition!r} matching {constraint!r}",
+ )
+ if len(candidates) > 1:
+ names = ", ".join(
+ f"{item.metadata.id}@{item.metadata.version}"
+ for item in sorted(
+ candidates,
+ key=lambda item: (item.metadata.id, item.metadata.version),
+ )
+ )
+ raise PluginResolutionError(
+ "plugin_requirement_ambiguous",
+ f"multiple plugins provide {definition!r}: {names}",
+ )
+ return candidates[0]
+
+ @staticmethod
+ def _require_agent_provider(manifest: PluginManifest) -> None:
+ if any(
+ offer.definition == "agent.provider/v1"
+ and offer.slot == "agent.execution"
+ and offer.mode == "unique"
+ for offer in manifest.spec.provides
+ ):
+ return
+ raise PluginResolutionError(
+ "agent_provider_invalid",
+ f"plugin {manifest.metadata.id}@{manifest.metadata.version} "
+ "does not own agent.execution",
+ )
+
+ @staticmethod
+ def _validate_unique_slots(manifests: Iterable[PluginManifest]) -> None:
+ owners: dict[str, str] = {}
+ for manifest in manifests:
+ for offer in manifest.spec.provides:
+ if offer.mode != "unique":
+ continue
+ existing = owners.get(offer.slot)
+ if existing and existing != manifest.metadata.id:
+ raise PluginResolutionError(
+ "plugin_slot_conflict",
+ f"unique slot {offer.slot!r} is owned by both {existing} "
+ f"and {manifest.metadata.id}",
+ )
+ owners[offer.slot] = manifest.metadata.id
+
+ @staticmethod
+ def _build_lock(
+ selected: dict[str, PluginManifest], dependencies: dict[str, set[str]]
+ ) -> PluginLock:
+ entries: list[PluginLockEntry] = []
+ for plugin_id, manifest in selected.items():
+ entries.append(
+ PluginLockEntry(
+ id=plugin_id,
+ version=manifest.metadata.version,
+ digest=manifest.spec.provenance.digest,
+ source=manifest.spec.provenance.source,
+ signature_ref=manifest.spec.provenance.signature_ref,
+ license=manifest.spec.provenance.license,
+ provides=[
+ LockedCapability(
+ definition=offer.definition,
+ slot=offer.slot,
+ owner=plugin_id,
+ )
+ for offer in manifest.spec.provides
+ ],
+ dependencies=[
+ PluginDependency(
+ id=dependency_id,
+ version=selected[dependency_id].metadata.version,
+ digest=selected[dependency_id].spec.provenance.digest,
+ )
+ for dependency_id in sorted(dependencies.get(plugin_id, set()))
+ ],
+ )
+ )
+ return PluginLock(plugins=entries)
+
+
+def _parse_plugin_reference(value: str) -> tuple[str, str]:
+ # The Pydantic type validates this at the public boundary. Keeping the
+ # parser defensive makes this pure resolver safe for values reconstructed
+ # by other language consumers.
+ if not value.startswith("plugin://") or "@" not in value:
+ raise PluginResolutionError(
+ "plugin_reference_invalid", f"invalid plugin reference {value!r}"
+ )
+ plugin_id, version = value.removeprefix("plugin://").rsplit("@", 1)
+ return plugin_id, version
+
+
+_COMPARATOR = re.compile(r"^(>=|<=|>|<|=)?(\d+)\.(\d+)\.(\d+)$")
+
+
+def _version_satisfies(version: str, constraint: str) -> bool:
+ """Small exact-range evaluator for manifest capability requirements.
+
+ The manifest accepts a SemVer range string rather than an unbounded
+ dependency resolver. P2-00A supports the explicit comparator form used
+ by the contract examples (for example ``>=1,<2``); unsupported forms are
+ rejected instead of silently accepting a possibly incompatible plugin.
+ """
+
+ parsed_version = _parse_release(version, field="plugin version")
+ comparators = [part.strip() for part in constraint.split(",") if part.strip()]
+ if not comparators:
+ raise PluginResolutionError("plugin_constraint_invalid", "empty plugin requirement version")
+ for comparator in comparators:
+ match = _COMPARATOR.fullmatch(comparator)
+ if match is None:
+ # ``>=1,<2`` is a concise allowed major range in the published
+ # manifest. Expand it deterministically rather than treating it
+ # as a lax string comparison.
+ major_range = re.fullmatch(r"(>=|>|<=|<)(\d+)", comparator)
+ if major_range is None:
+ raise PluginResolutionError(
+ "plugin_constraint_invalid",
+ f"unsupported plugin requirement version {constraint!r}",
+ )
+ operator, major = major_range.groups()
+ target = (int(major), 0, 0)
+ else:
+ operator = match.group(1) or "="
+ target = (
+ int(match.group(2)),
+ int(match.group(3)),
+ int(match.group(4)),
+ )
+ if not _compare(parsed_version, target, operator):
+ return False
+ return True
+
+
+def version_satisfies(version: str, constraint: str) -> bool:
+ """Evaluate the exact compatibility-range grammar used by plugin manifests."""
+
+ return _version_satisfies(version, constraint)
+
+
+def _parse_release(value: str, *, field: str) -> tuple[int, int, int]:
+ match = re.match(r"^(\d+)\.(\d+)\.(\d+)", value)
+ if match is None:
+ raise PluginResolutionError("plugin_constraint_invalid", f"invalid {field} {value!r}")
+ return int(match.group(1)), int(match.group(2)), int(match.group(3))
+
+
+def _compare(left: tuple[int, int, int], right: tuple[int, int, int], operator: str) -> bool:
+ return {
+ ">": left > right,
+ ">=": left >= right,
+ "<": left < right,
+ "<=": left <= right,
+ "=": left == right,
+ }[operator]
+
+
+__all__ = [
+ "PluginRegistry",
+ "PluginResolutionError",
+ "ResolvedComposition",
+ "canonical_composition_profile",
+ "composition_profile_digest",
+ "version_satisfies",
+]
diff --git a/ksadk/plugins/subagent_providers/__init__.py b/ksadk/plugins/subagent_providers/__init__.py
new file mode 100644
index 00000000..e0a9bb0c
--- /dev/null
+++ b/ksadk/plugins/subagent_providers/__init__.py
@@ -0,0 +1,12 @@
+"""Optional SubagentProvider implementations.
+
+Subagents are child executions selected by a parent agent. They are not
+top-level AgentProviders and therefore live outside ``plugins.providers``.
+"""
+
+from ksadk.plugins.subagent_providers.codex import (
+ DEFAULT_CODEX_CHILD_PROVIDER_REF,
+ CodexOneShotSubagentProvider,
+)
+
+__all__ = ["CodexOneShotSubagentProvider", "DEFAULT_CODEX_CHILD_PROVIDER_REF"]
diff --git a/ksadk/plugins/subagent_providers/codex.py b/ksadk/plugins/subagent_providers/codex.py
new file mode 100644
index 00000000..e65b14e4
--- /dev/null
+++ b/ksadk/plugins/subagent_providers/codex.py
@@ -0,0 +1,443 @@
+"""Isolated one-shot Codex implementation of ``SubagentProvider/v1``.
+
+Each child owns one App Server client, one native thread, and one temporary
+``CODEX_HOME``. The provider deliberately exposes no follow-up or resume
+surface: a parent may stream, cancel, interrupt, inspect, and dispose exactly
+one bounded read-only turn.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import shutil
+import tempfile
+import uuid
+from collections.abc import AsyncIterator, Callable, Mapping
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from ksadk.plugins.subagents import (
+ ChildHandle,
+ SpawnSubagentRequest,
+ SubagentEvent,
+ SubagentProviderError,
+ SubagentResult,
+ SubagentStatus,
+)
+
+DEFAULT_CODEX_CHILD_PROVIDER_REF = "plugin://io.ksadk.codex-child@1.0.0"
+_CAPABILITIES = ("cancel", "interrupt", "streaming")
+_TERMINAL_STATES = frozenset({"succeeded", "failed", "cancelled", "interrupted"})
+
+
+def _now() -> datetime:
+ return datetime.now(timezone.utc)
+
+
+@dataclass
+class _ChildState:
+ handle: ChildHandle
+ client: Any
+ native_thread_id: str
+ home: Path
+ timeout_seconds: int
+ task_text: str
+ thread_config: dict[str, Any]
+ events: list[SubagentEvent] = field(default_factory=list)
+ condition: asyncio.Condition = field(default_factory=asyncio.Condition)
+ task: asyncio.Task[None] | None = None
+ state: str = "accepted"
+ reason: str | None = None
+ updated_at: datetime = field(default_factory=_now)
+ requested_terminal: str | None = None
+ result_value: SubagentResult | None = None
+ final_text: str = ""
+ closed: bool = False
+
+
+class CodexOneShotSubagentProvider:
+ """Run bounded Codex children without sharing process or conversation state."""
+
+ def __init__(
+ self,
+ *,
+ project_dir: str | Path,
+ provider_ref: str = DEFAULT_CODEX_CHILD_PROVIDER_REF,
+ model: str | None = None,
+ base_instructions: str | None = None,
+ client_factory: Callable[[Path], Any] | None = None,
+ ) -> None:
+ self._project_dir = Path(project_dir).resolve()
+ self._provider_ref = provider_ref
+ self._model = model
+ self._base_instructions = base_instructions
+ self._client_factory = client_factory
+ self._states: dict[str, _ChildState] = {}
+
+ async def describe(self) -> Mapping[str, Any]:
+ return {
+ "providerRef": self._provider_ref,
+ "mode": "one-shot",
+ "capabilities": list(_CAPABILITIES),
+ "sandbox": "read-only",
+ "resumable": False,
+ }
+
+ async def available(self) -> bool:
+ if self._client_factory is not None:
+ return True
+ try:
+ import openai_codex # noqa: F401
+ except ImportError:
+ return False
+ return True
+
+ async def spawn(self, request: SpawnSubagentRequest) -> ChildHandle:
+ if request.provider_ref != self._provider_ref:
+ raise SubagentProviderError(
+ "subagent_provider_mismatch",
+ "Codex child request does not target this exact provider version",
+ )
+ if request.policy.background:
+ raise SubagentProviderError(
+ "codex_child_policy_unsupported",
+ "One-shot Codex children do not support detached background execution",
+ )
+ if request.policy.allowed_tools or request.policy.allowed_permissions:
+ raise SubagentProviderError(
+ "codex_child_policy_unsupported",
+ "Codex child tool and permission allowlists require an enforceable native mapping",
+ )
+
+ home = Path(tempfile.mkdtemp(prefix="ksadk-codex-child-"))
+ client: Any = None
+ try:
+ client = self._new_client(home)
+ thread_config = self._thread_config()
+ native_thread_id = str(await client.start_thread(thread_config))
+ except Exception:
+ if client is not None:
+ await client.close()
+ shutil.rmtree(home, ignore_errors=True)
+ raise
+
+ handle_id = f"codex-child-{uuid.uuid4().hex}"
+ digest = hashlib.sha256(
+ json.dumps(
+ {
+ "providerRef": self._provider_ref,
+ "mode": "one-shot",
+ "capabilities": _CAPABILITIES,
+ "sandbox": "read-only",
+ },
+ sort_keys=True,
+ separators=(",", ":"),
+ ).encode("utf-8")
+ ).hexdigest()
+ handle = ChildHandle(
+ handle_id=handle_id,
+ provider_ref=self._provider_ref,
+ parent_session_id=request.parent_session_id,
+ parent_run_id=request.parent_run_id,
+ child_session_id=native_thread_id,
+ child_run_id=f"codex-turn-{uuid.uuid4().hex}",
+ depth=request.depth,
+ capabilities=_CAPABILITIES,
+ capability_digest=f"sha256:{digest}",
+ created_at=_now(),
+ resumable=False,
+ )
+ state = _ChildState(
+ handle=handle,
+ client=client,
+ native_thread_id=native_thread_id,
+ home=home,
+ timeout_seconds=request.policy.timeout_seconds,
+ task_text=request.task,
+ thread_config=thread_config,
+ )
+ self._states[handle_id] = state
+ await self._append_event(
+ state,
+ "progress",
+ {"state": "accepted"},
+ {"threadId": native_thread_id},
+ )
+ state.task = asyncio.create_task(self._drive(state), name=f"ksadk-{handle_id}")
+ return handle
+
+ async def followup(self, handle: ChildHandle, input: Any) -> None:
+ del input
+ self._state(handle)
+ raise SubagentProviderError(
+ "codex_child_one_shot",
+ "Codex one-shot children do not accept follow-up input",
+ )
+
+ async def status(self, handle: ChildHandle) -> SubagentStatus:
+ state = self._state(handle)
+ return SubagentStatus(
+ handle_id=handle.handle_id,
+ state=state.state,
+ last_seq=len(state.events),
+ updated_at=state.updated_at,
+ reason=state.reason,
+ )
+
+ async def interrupt(self, handle: ChildHandle) -> None:
+ await self._stop(self._state(handle), "interrupted")
+
+ async def cancel(self, handle: ChildHandle) -> None:
+ await self._stop(self._state(handle), "cancelled")
+
+ def subscribe(self, handle: ChildHandle, *, after_seq: int = 0) -> AsyncIterator[SubagentEvent]:
+ if after_seq < 0:
+ raise SubagentProviderError(
+ "subagent_cursor_invalid", "subagent after_seq cannot be negative"
+ )
+ state = self._state(handle)
+ return self._subscribe(state, after_seq)
+
+ async def result(self, handle: ChildHandle) -> SubagentResult:
+ state = self._state(handle)
+ if state.task is not None and not state.task.done():
+ await asyncio.shield(state.task)
+ if state.result_value is None:
+ raise SubagentProviderError(
+ "codex_child_result_unavailable", "Codex child has no terminal result"
+ )
+ return state.result_value
+
+ async def dispose(self, handle: ChildHandle) -> None:
+ state = self._state(handle)
+ if state.state not in _TERMINAL_STATES and state.state != "disposed":
+ await self._stop(state, "cancelled")
+ if not state.closed:
+ state.closed = True
+ try:
+ await state.client.close()
+ finally:
+ shutil.rmtree(state.home, ignore_errors=True)
+ state.state = "disposed"
+ state.updated_at = _now()
+ async with state.condition:
+ state.condition.notify_all()
+
+ def _new_client(self, home: Path) -> Any:
+ if self._client_factory is not None:
+ return self._client_factory(home)
+ import openai_codex
+
+ from ksadk.codex.client import AsyncCodexClient
+
+ return AsyncCodexClient(openai_codex.CodexConfig(env={"CODEX_HOME": str(home)}))
+
+ def _thread_config(self) -> dict[str, Any]:
+ config: dict[str, Any] = {
+ "cwd": str(self._project_dir),
+ "sandbox_read_only": True,
+ "approval_mode": "deny_all",
+ "ephemeral": True,
+ }
+ if self._model:
+ config["model"] = self._model
+ if self._base_instructions:
+ config["base_instructions"] = self._base_instructions
+ return config
+
+ def _state(self, handle: ChildHandle) -> _ChildState:
+ state = self._states.get(handle.handle_id)
+ if state is None or state.handle != handle:
+ raise SubagentProviderError(
+ "subagent_handle_unknown", "Codex child handle is unknown or was modified"
+ )
+ return state
+
+ async def _drive(self, state: _ChildState) -> None:
+ try:
+ await asyncio.wait_for(self._consume_turn(state), timeout=state.timeout_seconds)
+ except asyncio.CancelledError:
+ terminal = state.requested_terminal or "cancelled"
+ await self._finish(state, terminal)
+ except asyncio.TimeoutError:
+ try:
+ await state.client.interrupt_active_turn(state.native_thread_id)
+ finally:
+ await self._finish(
+ state,
+ "failed",
+ error_code="codex_child_timeout",
+ error_message="Codex child exceeded its parent-owned timeout",
+ )
+ except Exception as error:
+ await self._finish(
+ state,
+ "failed",
+ error_code="codex_child_failed",
+ error_message=str(error)[:2048],
+ )
+
+ async def _consume_turn(self, state: _ChildState) -> None:
+ state.state = "running"
+ state.updated_at = _now()
+ await self._append_event(
+ state,
+ "progress",
+ {"state": "running"},
+ {"threadId": state.native_thread_id},
+ )
+ async for raw in state.client.run_turn(
+ state.native_thread_id,
+ state.task_text,
+ config=state.thread_config,
+ ):
+ await self._project_native_event(state, raw)
+ await self._finish(state, "succeeded", output=state.final_text)
+
+ async def _project_native_event(self, state: _ChildState, raw: Mapping[str, Any]) -> None:
+ method = str(raw.get("method") or "")
+ params = raw.get("params")
+ if not isinstance(params, Mapping):
+ params = {}
+ native_ref = {
+ key: str(value)
+ for key, value in {
+ "method": method,
+ "threadId": params.get("threadId") or state.native_thread_id,
+ "turnId": params.get("turnId") or _mapping_value(params.get("turn"), "id"),
+ "itemId": params.get("itemId") or _mapping_value(params.get("item"), "id"),
+ }.items()
+ if value
+ }
+ if method in {"turn/started", "thread/tokenUsage/updated"}:
+ await self._append_event(state, "progress", {"method": method}, native_ref)
+ return
+ if method == "item/agentMessage/delta":
+ delta = str(params.get("delta") or "")
+ state.final_text += delta
+ if delta:
+ await self._append_event(
+ state, "item", {"type": "agent_message_delta", "text": delta}, native_ref
+ )
+ return
+ if method == "item/completed":
+ item = params.get("item")
+ item_type = _mapping_value(item, "type") or "item"
+ text = _item_text(item)
+ if item_type in {"agentMessage", "message"} and text:
+ state.final_text = text
+ await self._append_event(
+ state,
+ "item",
+ {"type": str(item_type), **({"text": text} if text else {})},
+ native_ref,
+ )
+ return
+ if method == "error":
+ message = str(params.get("message") or params.get("error") or "Codex error")
+ raise RuntimeError(message)
+
+ async def _stop(self, state: _ChildState, terminal: str) -> None:
+ if state.state in _TERMINAL_STATES or state.state == "disposed":
+ return
+ state.requested_terminal = terminal
+ try:
+ await state.client.interrupt_active_turn(state.native_thread_id)
+ except Exception as error:
+ # A dead or already-finished native process must not prevent local
+ # cancellation and, critically, must not prevent ``dispose`` from
+ # closing the client and deleting its isolated CODEX_HOME.
+ state.reason = f"native interrupt failed: {error}"[:2048]
+ finally:
+ if state.task is not None and not state.task.done():
+ state.task.cancel()
+ await asyncio.gather(state.task, return_exceptions=True)
+ if state.result_value is None:
+ await self._finish(state, terminal)
+
+ async def _finish(
+ self,
+ state: _ChildState,
+ terminal: str,
+ *,
+ output: Any = None,
+ error_code: str | None = None,
+ error_message: str | None = None,
+ ) -> None:
+ if state.result_value is not None:
+ return
+ state.state = terminal
+ if error_message is not None:
+ state.reason = error_message
+ state.updated_at = _now()
+ state.result_value = SubagentResult(
+ handle_id=state.handle.handle_id,
+ state=terminal,
+ output=output,
+ error_code=error_code,
+ error_message=error_message,
+ )
+ await self._append_event(
+ state,
+ "terminal",
+ {"state": terminal, **({"errorCode": error_code} if error_code else {})},
+ {"threadId": state.native_thread_id},
+ )
+
+ async def _append_event(
+ self,
+ state: _ChildState,
+ kind: str,
+ payload: dict[str, Any],
+ native_ref: dict[str, str],
+ ) -> None:
+ seq = len(state.events) + 1
+ state.events.append(
+ SubagentEvent(
+ handle_id=state.handle.handle_id,
+ event_id=f"{state.handle.handle_id}:{seq}",
+ seq=seq,
+ kind=kind,
+ payload=payload,
+ native_ref=native_ref,
+ )
+ )
+ state.updated_at = _now()
+ async with state.condition:
+ state.condition.notify_all()
+
+ async def _subscribe(self, state: _ChildState, after_seq: int) -> AsyncIterator[SubagentEvent]:
+ cursor = after_seq
+ while True:
+ while cursor < len(state.events):
+ event = state.events[cursor]
+ cursor = event.seq
+ yield event
+ if state.result_value is not None or state.state == "disposed":
+ return
+ async with state.condition:
+ if cursor >= len(state.events) and state.result_value is None:
+ await state.condition.wait()
+
+
+def _mapping_value(value: Any, key: str) -> Any:
+ return value.get(key) if isinstance(value, Mapping) else None
+
+
+def _item_text(item: Any) -> str:
+ if not isinstance(item, Mapping):
+ return ""
+ direct = item.get("text")
+ if isinstance(direct, str):
+ return direct
+ content = item.get("content")
+ if not isinstance(content, list):
+ return ""
+ return "".join(str(part.get("text") or "") for part in content if isinstance(part, Mapping))
+
+
+__all__ = ["CodexOneShotSubagentProvider", "DEFAULT_CODEX_CHILD_PROVIDER_REF"]
diff --git a/ksadk/plugins/subagents.py b/ksadk/plugins/subagents.py
new file mode 100644
index 00000000..6864e8a6
--- /dev/null
+++ b/ksadk/plugins/subagents.py
@@ -0,0 +1,333 @@
+"""Frozen SubagentProvider/v1 seam with explicit lineage and policy bounds.
+
+The Kernel does not know whether a child is implemented by Codex, DSH,
+Claude, another KsADK AgentProvider, or a remote service. It only routes a
+bounded request to a named provider and retains the returned child identity.
+Provider-private state and event logs remain with that provider; projected
+child events keep their own ids and sequence numbers.
+"""
+
+from __future__ import annotations
+
+from collections.abc import AsyncIterator, Mapping, Sequence
+from datetime import datetime
+from typing import Any, Literal, Protocol, cast, runtime_checkable
+
+from pydantic import Field, field_validator, model_validator
+
+from ksadk.plugins.contracts import PluginContractModel, PluginReference
+
+
+class SubagentPolicy(PluginContractModel):
+ """Parent-owned limits that a child provider may only narrow."""
+
+ max_depth: int = Field(default=1, ge=1, le=16)
+ timeout_seconds: int = Field(default=120, ge=1, le=86_400)
+ max_steps: int = Field(default=12, ge=1, le=10_000)
+ background: bool = False
+ allowed_tools: tuple[str, ...] = ()
+ allowed_permissions: tuple[str, ...] = ()
+
+ @field_validator("allowed_tools", "allowed_permissions")
+ @classmethod
+ def validate_unique_values(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if any(not item.strip() for item in value):
+ raise ValueError("subagent policy entries must be non-empty")
+ if len(value) != len(set(value)):
+ raise ValueError("subagent policy entries must be unique")
+ return tuple(sorted(value))
+
+
+class SpawnSubagentRequest(PluginContractModel):
+ """One bounded child task requested by an authenticated parent Run."""
+
+ request_format: Literal["ksadk.subagent-spawn/v1"] = "ksadk.subagent-spawn/v1"
+ provider_ref: str
+ parent_session_id: str = Field(min_length=1, max_length=256)
+ parent_run_id: str = Field(min_length=1, max_length=256)
+ task: str = Field(min_length=1, max_length=131_072)
+ depth: int = Field(default=1, ge=1, le=16)
+ policy: SubagentPolicy = Field(default_factory=SubagentPolicy)
+ metadata: dict[str, Any] = Field(default_factory=dict)
+
+ @field_validator("provider_ref")
+ @classmethod
+ def validate_provider_ref(cls, value: str) -> str:
+ return cast(str, PluginReference(ref=value).ref)
+
+ @field_validator("metadata")
+ @classmethod
+ def validate_metadata(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _reject_secret_values(value)
+ return value
+
+ @model_validator(mode="after")
+ def validate_depth(self) -> "SpawnSubagentRequest":
+ if self.depth > self.policy.max_depth:
+ raise ValueError("subagent depth exceeds the parent policy maxDepth")
+ return self
+
+
+class ChildHandle(PluginContractModel):
+ """Stable lineage and recovery descriptor for one provider-owned child."""
+
+ handle_format: Literal["ksadk.child-handle/v1"] = "ksadk.child-handle/v1"
+ handle_id: str = Field(min_length=1, max_length=256)
+ provider_ref: str
+ parent_session_id: str = Field(min_length=1, max_length=256)
+ parent_run_id: str = Field(min_length=1, max_length=256)
+ child_session_id: str | None = Field(default=None, max_length=256)
+ child_run_id: str | None = Field(default=None, max_length=256)
+ depth: int = Field(ge=1, le=16)
+ capabilities: tuple[str, ...] = ()
+ capability_digest: str = Field(pattern=r"^sha256:[0-9a-f]{64}$")
+ created_at: datetime
+ resumable: bool = False
+ resume_descriptor: dict[str, Any] | None = None
+
+ @field_validator("provider_ref")
+ @classmethod
+ def validate_provider_ref(cls, value: str) -> str:
+ return cast(str, PluginReference(ref=value).ref)
+
+ @field_validator("capabilities")
+ @classmethod
+ def validate_capabilities(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if any(not item.strip() for item in value):
+ raise ValueError("child capabilities must be non-empty")
+ if len(value) != len(set(value)):
+ raise ValueError("child capabilities must be unique")
+ return tuple(sorted(value))
+
+ @field_validator("created_at")
+ @classmethod
+ def validate_created_at(cls, value: datetime) -> datetime:
+ if value.tzinfo is None or value.utcoffset() is None:
+ raise ValueError("child handle createdAt must include a timezone")
+ return value
+
+ @field_validator("resume_descriptor")
+ @classmethod
+ def validate_resume_descriptor(
+ cls, value: dict[str, Any] | None
+ ) -> dict[str, Any] | None:
+ if value is not None:
+ _reject_secret_values(value)
+ return value
+
+ @model_validator(mode="after")
+ def validate_recovery_shape(self) -> "ChildHandle":
+ if self.resumable and not self.resume_descriptor:
+ raise ValueError("resumable child handle requires a resumeDescriptor")
+ if not self.resumable and self.resume_descriptor is not None:
+ raise ValueError("non-resumable child handle cannot carry a resumeDescriptor")
+ return self
+
+
+class SubagentStatus(PluginContractModel):
+ status_format: Literal["ksadk.subagent-status/v1"] = "ksadk.subagent-status/v1"
+ handle_id: str = Field(min_length=1, max_length=256)
+ state: Literal[
+ "accepted",
+ "running",
+ "waiting_input",
+ "succeeded",
+ "failed",
+ "cancelled",
+ "interrupted",
+ "disposed",
+ ]
+ last_seq: int = Field(default=0, ge=0)
+ updated_at: datetime
+ reason: str | None = Field(default=None, max_length=2048)
+
+ @field_validator("updated_at")
+ @classmethod
+ def validate_updated_at(cls, value: datetime) -> datetime:
+ if value.tzinfo is None or value.utcoffset() is None:
+ raise ValueError("subagent status updatedAt must include a timezone")
+ return value
+
+
+class SubagentEvent(PluginContractModel):
+ """Identity-preserving child event; parent projection must not merge by text."""
+
+ event_format: Literal["ksadk.subagent-event/v1"] = "ksadk.subagent-event/v1"
+ handle_id: str = Field(min_length=1, max_length=256)
+ event_id: str = Field(min_length=1, max_length=256)
+ seq: int = Field(ge=1)
+ kind: Literal["progress", "item", "interaction", "terminal"]
+ payload: dict[str, Any] = Field(default_factory=dict)
+ native_ref: dict[str, str] = Field(default_factory=dict)
+
+ @field_validator("payload")
+ @classmethod
+ def validate_payload(cls, value: dict[str, Any]) -> dict[str, Any]:
+ _reject_secret_values(value)
+ return value
+
+
+class SubagentResult(PluginContractModel):
+ result_format: Literal["ksadk.subagent-result/v1"] = "ksadk.subagent-result/v1"
+ handle_id: str = Field(min_length=1, max_length=256)
+ state: Literal["succeeded", "failed", "cancelled", "interrupted"]
+ output: Any = None
+ output_refs: tuple[str, ...] = ()
+ error_code: str | None = Field(default=None, max_length=256)
+ error_message: str | None = Field(default=None, max_length=2048)
+
+ @field_validator("output_refs")
+ @classmethod
+ def validate_output_refs(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+ if any(not item.strip() for item in value):
+ raise ValueError("subagent output references must be non-empty")
+ if len(value) != len(set(value)):
+ raise ValueError("subagent output references must be unique")
+ return tuple(sorted(value))
+
+ @model_validator(mode="after")
+ def validate_terminal_shape(self) -> "SubagentResult":
+ if self.state == "succeeded" and (self.error_code or self.error_message):
+ raise ValueError("successful subagent result cannot carry an error")
+ if self.state == "failed" and not self.error_code:
+ raise ValueError("failed subagent result requires errorCode")
+ return self
+
+
+@runtime_checkable
+class SubagentProvider(Protocol):
+ """Named child execution provider; every method is provider-owned."""
+
+ async def describe(self) -> Mapping[str, Any]: ...
+
+ async def available(self) -> bool: ...
+
+ async def spawn(self, request: SpawnSubagentRequest) -> ChildHandle: ...
+
+ async def followup(self, handle: ChildHandle, input: Any) -> None: ...
+
+ async def status(self, handle: ChildHandle) -> SubagentStatus: ...
+
+ async def interrupt(self, handle: ChildHandle) -> None: ...
+
+ async def cancel(self, handle: ChildHandle) -> None: ...
+
+ def subscribe(
+ self, handle: ChildHandle, *, after_seq: int = 0
+ ) -> AsyncIterator[SubagentEvent]: ...
+
+ async def result(self, handle: ChildHandle) -> SubagentResult: ...
+
+ async def dispose(self, handle: ChildHandle) -> None: ...
+
+
+class SubagentProviderError(RuntimeError):
+ """Stable typed failure at the provider routing boundary."""
+
+ def __init__(self, code: str, message: str) -> None:
+ super().__init__(message)
+ self.code = code
+
+
+class SubagentProviderRouter:
+ """Route child handles to exact providers without interpreting their state."""
+
+ def __init__(self, providers: Mapping[str, SubagentProvider]) -> None:
+ self._providers = dict(providers)
+
+ async def spawn(self, request: SpawnSubagentRequest) -> ChildHandle:
+ provider = self._provider(request.provider_ref)
+ if not await provider.available():
+ raise SubagentProviderError(
+ "subagent_provider_unavailable",
+ f"SubagentProvider {request.provider_ref} is unavailable",
+ )
+ handle = await provider.spawn(request)
+ self._validate_handle(request, handle)
+ return handle
+
+ async def status(self, handle: ChildHandle) -> SubagentStatus:
+ return await self._provider_for_handle(handle).status(handle)
+
+ async def followup(self, handle: ChildHandle, input: Any) -> None:
+ await self._provider_for_handle(handle).followup(handle, input)
+
+ async def interrupt(self, handle: ChildHandle) -> None:
+ await self._provider_for_handle(handle).interrupt(handle)
+
+ async def cancel(self, handle: ChildHandle) -> None:
+ await self._provider_for_handle(handle).cancel(handle)
+
+ def subscribe(
+ self, handle: ChildHandle, *, after_seq: int = 0
+ ) -> AsyncIterator[SubagentEvent]:
+ if after_seq < 0:
+ raise SubagentProviderError(
+ "subagent_cursor_invalid", "subagent after_seq cannot be negative"
+ )
+ return self._provider_for_handle(handle).subscribe(handle, after_seq=after_seq)
+
+ async def result(self, handle: ChildHandle) -> SubagentResult:
+ return await self._provider_for_handle(handle).result(handle)
+
+ async def dispose(self, handle: ChildHandle) -> None:
+ await self._provider_for_handle(handle).dispose(handle)
+
+ def _provider_for_handle(self, handle: ChildHandle) -> SubagentProvider:
+ return self._provider(handle.provider_ref)
+
+ def _provider(self, provider_ref: str) -> SubagentProvider:
+ provider = self._providers.get(provider_ref)
+ if provider is None:
+ raise SubagentProviderError(
+ "subagent_provider_not_found",
+ f"SubagentProvider {provider_ref} is not registered",
+ )
+ return provider
+
+ @staticmethod
+ def _validate_handle(
+ request: SpawnSubagentRequest,
+ handle: ChildHandle,
+ ) -> None:
+ if (
+ handle.provider_ref != request.provider_ref
+ or handle.parent_session_id != request.parent_session_id
+ or handle.parent_run_id != request.parent_run_id
+ or handle.depth != request.depth
+ ):
+ raise SubagentProviderError(
+ "subagent_handle_mismatch",
+ "SubagentProvider returned a child handle outside the requested lineage",
+ )
+
+
+_SECRET_KEY_PARTS = ("secret", "password", "token", "apikey", "api_key")
+_SECRET_REF_PREFIXES = ("secret://", "env://", "credential://", "vault://")
+
+
+def _reject_secret_values(value: Any, *, path: str = "payload") -> None:
+ if isinstance(value, Mapping):
+ for key, child in value.items():
+ key_text = str(key)
+ normalized = key_text.replace("-", "").lower()
+ if any(part in normalized for part in _SECRET_KEY_PARTS) and child is not None:
+ if not isinstance(child, str) or not child.startswith(_SECRET_REF_PREFIXES):
+ raise ValueError(f"{path}.{key_text} must contain a secret reference")
+ _reject_secret_values(child, path=f"{path}.{key_text}")
+ elif isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+ for index, child in enumerate(value):
+ _reject_secret_values(child, path=f"{path}[{index}]")
+
+
+__all__ = [
+ "ChildHandle",
+ "SpawnSubagentRequest",
+ "SubagentEvent",
+ "SubagentPolicy",
+ "SubagentProvider",
+ "SubagentProviderError",
+ "SubagentProviderRouter",
+ "SubagentResult",
+ "SubagentStatus",
+]
diff --git a/ksadk/runtime/_runner_adapter/stream_mapping.py b/ksadk/runtime/_runner_adapter/stream_mapping.py
index b2107b7a..d0af0468 100644
--- a/ksadk/runtime/_runner_adapter/stream_mapping.py
+++ b/ksadk/runtime/_runner_adapter/stream_mapping.py
@@ -69,7 +69,7 @@ def _a2ui_surface_event(
self: Any,
handle: RunHandle,
chunk: Any,
-) -> RuntimeEvent | None:
+) -> tuple[RuntimeEvent, ...]:
"""Recognize a validated A2UI tool envelope and emit a canonical data-item event.
The dynamic ``generate_a2ui`` tool returns official v0.9 operations as a
@@ -83,7 +83,7 @@ def _a2ui_surface_event(
"""
if not isinstance(chunk, dict):
- return None
+ return ()
value = chunk.get("tool_output", chunk.get("output"))
if value is not None and hasattr(value, "content"):
value = value.content
@@ -91,15 +91,15 @@ def _a2ui_surface_event(
try:
value = json.loads(value)
except (TypeError, ValueError):
- return None
+ return ()
if not isinstance(value, Mapping):
- return None
+ return ()
operations_raw = value.get("a2ui_operations")
if not isinstance(operations_raw, list) or not operations_raw:
- return None
+ return ()
operations = [dict(operation) for operation in operations_raw if isinstance(operation, Mapping)]
if not operations:
- return None
+ return ()
known: list[tuple[str, str]] = [] # (surface_id, lifecycle)
for operation in operations:
@@ -116,71 +116,75 @@ def _a2ui_surface_event(
known.append((surface_id, lifecycle))
break
if not known:
- return None
+ return ()
surface_ids = {surface_id for surface_id, _lifecycle in known}
if len(surface_ids) != 1:
logger.warning("ignoring A2UI tool result with multiple surfaces")
- return None
+ return ()
surface_id = known[0][0]
lifecycle = "begin" if any(lc == "begin" for _, lc in known) else known[0][1]
framework = self._runtime_type
run_id = handle.run_id
scope_id = stable_scope_id(framework, run_id)
- item_id = stable_item_id(framework, run_id, "a2ui", surface_id)
+ # A dynamic A2UI tool result is a complete, immutable operation batch. It
+ # must therefore be represented by a closed canonical item. Reusing one
+ # long-lived item per surface leaves a create/update-only batch open at the
+ # run terminal and makes strict reducers reject the stream.
+ start_seq = self._next_seq()
+ batch_ref = str(chunk.get("call_id") or chunk.get("run_id") or chunk.get("id") or "")
+ if not batch_ref:
+ batch_ref = json.dumps(
+ operations,
+ ensure_ascii=False,
+ sort_keys=True,
+ separators=(",", ":"),
+ )
+ item_id = stable_item_id(framework, run_id, "a2ui-batch", surface_id, batch_ref)
source = SourceRef(
framework=framework,
protocol="a2ui",
native_run_id=run_id,
- metadata={"surface_id": surface_id},
+ metadata={
+ "surface_id": surface_id,
+ "operation_batch": True,
+ "surface_lifecycle": lifecycle,
+ },
)
# TODO(runtime-event-v2): dict chunk 退化路径,chunk_ordinal 用 seq counter;
# LangGraph/Codex 切 stream_canonical_events 后清理
- n = self._next_seq()
timestamp = time.time()
- if lifecycle == "begin":
- return ItemStarted(
+ snapshot = ContentSnapshot(parts=(DataContent(part_id="a2ui-ops", data=operations),))
+ completed_seq = self._next_seq()
+ return (
+ ItemStarted(
schema_version=2,
event_id=stable_event_id(
- framework, scope_id, item_id, "item.started", "a2ui", run_id, n
+ framework, scope_id, item_id, "item.started", "a2ui", run_id, start_seq
),
- seq=n,
+ seq=start_seq,
timestamp=timestamp,
run_id=run_id,
scope_id=scope_id,
source=source,
item_id=item_id,
item_kind="data",
- initial=ContentSnapshot(parts=(DataContent(part_id="a2ui-ops", data=operations),)),
- )
- if lifecycle == "update":
- return ItemUpdated(
+ initial=snapshot,
+ ),
+ ItemCompleted(
schema_version=2,
event_id=stable_event_id(
- framework, scope_id, item_id, "item.updated", "a2ui", run_id, n
+ framework, scope_id, item_id, "item.completed", "a2ui", run_id, completed_seq
),
- seq=n,
+ seq=completed_seq,
timestamp=timestamp,
run_id=run_id,
scope_id=scope_id,
source=source,
item_id=item_id,
item_kind="data",
- op="replace",
- update=DataContent(part_id="a2ui-ops", data=operations),
- )
- # lifecycle == "end"
- return ItemCompleted(
- schema_version=2,
- event_id=stable_event_id(framework, scope_id, item_id, "item.completed", "a2ui", run_id, n),
- seq=n,
- timestamp=timestamp,
- run_id=run_id,
- scope_id=scope_id,
- source=source,
- item_id=item_id,
- item_kind="data",
- snapshot=ContentSnapshot(parts=()),
+ snapshot=snapshot,
+ ),
)
@@ -323,8 +327,7 @@ async def _map_runner_stream(
usage.update(raw_usage)
for event in self._chunk_to_event(handle, run, chunk): # type: ignore[attr-defined]
yield event
- a2ui_surface = _a2ui_surface_event(self, handle, chunk)
- if a2ui_surface is not None:
+ for a2ui_surface in _a2ui_surface_event(self, handle, chunk):
yield a2ui_surface
finally:
if accumulated_output:
@@ -708,8 +711,10 @@ def ensure_started(
if run is not None:
run.final_answer_item_id = item_id
text_content = TextContent(part_id="text-0", text=output)
- # Auto-close any open commentary/reasoning item before emitting final_answer.
- # Text/thinking deltas create items that are never ItemCompleted;
+ # Auto-close any open explicit commentary/reasoning item before completing
+ # final_answer. Text deltas already belong to the final-answer item and must
+ # keep that identity through completion.
+ # Commentary/thinking deltas create items that are never ItemCompleted;
# without this, RunCompleted fails _ensure_no_open_items.
#
# Close them *before* allocating the final-answer item. Event
@@ -764,9 +769,13 @@ def ensure_started(
text = self._coerce(chunk.get("delta") or chunk.get("output") or chunk.get("data")) # type: ignore[attr-defined]
if not text:
return []
- item_id = stable_item_id(framework, run_id, "message", "commentary")
+ is_commentary = chunk_type in {"commentary", "commentary_delta"}
+ phase = "commentary" if is_commentary else "final_answer"
+ item_id = stable_item_id(framework, run_id, "message", phase)
+ if run is not None and not is_commentary:
+ run.final_answer_item_id = item_id
op: str = "replace" if chunk.get("replace") else "append"
- events = ensure_started(item_id=item_id, item_kind="message", phase="commentary")
+ events = ensure_started(item_id=item_id, item_kind="message", phase=phase)
events.append(
ItemUpdated(
**self._canonical_kwargs( # type: ignore[attr-defined]
diff --git a/ksadk/runtime/adapter.py b/ksadk/runtime/adapter.py
index 9a14e8a5..b510cac6 100644
--- a/ksadk/runtime/adapter.py
+++ b/ksadk/runtime/adapter.py
@@ -417,6 +417,7 @@ def _unavailable(reason: str = "not_implemented") -> RuntimeCapability:
inject=_unavailable("runtime_no_native_inject"),
checkpoint=_unavailable(),
durable_restore=_unavailable(),
+ interaction_mode="unavailable",
)
def native_capabilities(self) -> dict[str, object]:
diff --git a/ksadk/runtime/factory.py b/ksadk/runtime/factory.py
index 53c06f9c..380a8475 100644
--- a/ksadk/runtime/factory.py
+++ b/ksadk/runtime/factory.py
@@ -3,7 +3,10 @@
from __future__ import annotations
import dataclasses
+import hashlib
import os
+import re
+import shutil
import tempfile
from pathlib import Path
from typing import Any
@@ -11,8 +14,7 @@
from ksadk.codex.client import AsyncCodexClient
from ksadk.codex.runtime import CodexRuntimeAdapter
from ksadk.runners.base_runner import BaseRunner
-from ksadk.runtime.adapter import StartRequest
-from ksadk.runtime.adapter import RuntimeAdapter, RuntimeRegistry
+from ksadk.runtime.adapter import RuntimeAdapter, RuntimeRegistry, StartRequest
from ksadk.runtime.framework_adapters import ADKRuntimeAdapter, LangGraphRuntimeAdapter
from ksadk.runtime.launch import RuntimeLaunchContext
@@ -88,6 +90,19 @@ def kernel_start_request_defaults(context: RuntimeLaunchContext) -> dict[str, An
}
if base_instructions:
request_config["base_instructions"] = base_instructions
+ collaboration_mode = str(config.get("collaboration_mode") or "").strip().lower()
+ if collaboration_mode:
+ if collaboration_mode not in {"default", "plan"}:
+ raise ValueError("Codex collaboration_mode must be default or plan")
+ request_config["collaboration_mode"] = collaboration_mode
+ goal_objective = str(config.get("goal_objective") or "").strip()
+ if goal_objective:
+ request_config["goal_objective"] = goal_objective
+ raw_skills = config.get("skills")
+ if isinstance(raw_skills, (list, tuple)):
+ request_config["skills"] = [
+ dict(item) for item in raw_skills if isinstance(item, dict)
+ ]
defaults["config"] = request_config
return defaults
@@ -158,6 +173,7 @@ def _manifest_mcp_overrides(config: dict[str, Any]) -> list[str]:
def _create_codex(context: RuntimeLaunchContext) -> RuntimeAdapter:
client_factory = context.services.codex_client_factory or AsyncCodexClient
config = dict(context.config)
+ bound_skill_paths: dict[str, str] = {}
overrides = list(config.get("codex_overrides") or [])
manifest_mcp_overrides = _manifest_mcp_overrides(config)
overrides.extend(item for item in manifest_mcp_overrides if item not in overrides)
@@ -185,6 +201,9 @@ def _create_codex(context: RuntimeLaunchContext) -> RuntimeAdapter:
)
env = dict(getattr(base_cfg, "env", None) or {})
isolated_home = _isolated_codex_home(context.project_dir)
+ bound_skill_paths = _materialize_bound_codex_skills(
+ isolated_home, config.get("skills")
+ )
env.setdefault("CODEX_HOME", str(isolated_home))
# HOME 级隔离：codex app-server 还会按约定扫 ~/.agents/skills、
# ~/.claude/skills 等宿主目录，仅设 CODEX_HOME 挡不住。隔离 HOME 后这些
@@ -219,6 +238,7 @@ def _create_codex(context: RuntimeLaunchContext) -> RuntimeAdapter:
client,
sandbox_read_only=sandbox_read_only,
turn_timeout_seconds=float(timeout) if timeout is not None else None,
+ bound_skill_paths=bound_skill_paths,
)
@@ -263,6 +283,60 @@ def _isolated_codex_home(project_dir: Any) -> Path:
return fallback_home
+def _materialize_bound_codex_skills(
+ codex_home: Path, value: Any
+) -> dict[str, str]:
+ """Expose immutable Bundle Skills through Codex's native skill catalog.
+
+ Passing an arbitrary ``SkillInput`` path is accepted by the Python SDK but
+ ignored by the real App Server unless the Skill is discoverable by the
+ native host. Copy each content-addressed Bundle Skill into the isolated
+ CODEX_HOME so the host owns discovery while the Bundle remains read-only.
+ Content-addressed directory names avoid overwriting user-managed Skills
+ when an explicit KSADK_CODEX_HOME is used.
+ """
+
+ if not isinstance(value, (list, tuple)):
+ return {}
+ skills_root = codex_home / "skills"
+ skills_root.mkdir(parents=True, exist_ok=True)
+ installed: dict[str, str] = {}
+ for item in value:
+ if not isinstance(item, dict):
+ continue
+ name = str(item.get("name") or "").strip()
+ raw_path = str(item.get("path") or "").strip()
+ if not name or not raw_path:
+ continue
+ skill_file = Path(raw_path).resolve()
+ if skill_file.name != "SKILL.md" or not skill_file.is_file():
+ continue
+ source_dir = skill_file.parent
+ digest = hashlib.sha256()
+ for source in sorted(path for path in source_dir.rglob("*") if path.is_file()):
+ digest.update(source.relative_to(source_dir).as_posix().encode("utf-8"))
+ digest.update(b"\0")
+ digest.update(source.read_bytes())
+ digest.update(b"\0")
+ safe_name = re.sub(r"[^A-Za-z0-9._-]+", "-", name).strip(".-") or "skill"
+ target = skills_root / f"ksadk-{digest.hexdigest()[:16]}-{safe_name}"
+ if target.is_dir():
+ installed[name] = str(target / "SKILL.md")
+ continue
+ staging = Path(tempfile.mkdtemp(prefix=".ksadk-skill-", dir=skills_root))
+ try:
+ shutil.copytree(source_dir, staging, dirs_exist_ok=True)
+ try:
+ staging.replace(target)
+ except FileExistsError:
+ pass
+ finally:
+ if staging.exists():
+ shutil.rmtree(staging)
+ installed[name] = str(target / "SKILL.md")
+ return installed
+
+
def _apply_codex_overrides(client: Any, overrides: Any) -> None:
"""Append MCP server --config overrides to the client's CodexConfig."""
try:
diff --git a/ksadk/runtime/framework_adapters.py b/ksadk/runtime/framework_adapters.py
index f6775b2c..37cc38f4 100644
--- a/ksadk/runtime/framework_adapters.py
+++ b/ksadk/runtime/framework_adapters.py
@@ -63,6 +63,24 @@ class LangGraphRuntimeAdapter(RunnerRuntimeAdapter):
def __init__(self, runner: BaseRunner) -> None:
super().__init__(runner, runtime_type="langgraph")
+ def capabilities(self): # noqa: ANN201
+ """Advertise checkpoint interaction only when LangGraph can resume it.
+
+ ``RunnerRuntimeAdapter`` is intentionally conservative because a
+ generic checkpoint is not proof of original-interrupt delivery. The
+ LangGraph adapter owns that mapping, so it is the only runner-family
+ adapter that may publish ``durable_resume``.
+ """
+
+ matrix = super().capabilities()
+ return matrix.model_copy(
+ update={
+ "interaction_mode": (
+ "durable_resume" if matrix.resume.supported else "unavailable"
+ )
+ }
+ )
+
async def _resume_native(
self,
handle: RunHandle,
diff --git a/ksadk/runtime/runner_adapter.py b/ksadk/runtime/runner_adapter.py
index 96676f45..2238609a 100644
--- a/ksadk/runtime/runner_adapter.py
+++ b/ksadk/runtime/runner_adapter.py
@@ -185,6 +185,11 @@ def _unavailable(reason: str) -> RuntimeCapability:
if durable_supported
else _unavailable("durable_restore_requires_cross_process_checkpoint")
),
+ # A generic Runner cannot claim interaction delivery merely from a
+ # checkpoint capability. ADK is forward-only and only the
+ # LangGraph specialization below binds a checkpoint to the
+ # original interrupt identity.
+ interaction_mode="unavailable",
)
async def durable_restore(self, handle: RunHandle) -> RunHandle:
diff --git a/ksadk/sandbox/__init__.py b/ksadk/sandbox/__init__.py
index 1bf49685..039f16fe 100644
--- a/ksadk/sandbox/__init__.py
+++ b/ksadk/sandbox/__init__.py
@@ -12,7 +12,7 @@
SandboxSpec,
SandboxType,
)
-from ksadk.sandbox.factory import create_sandbox_backend, sandbox_spec_from_env
+from ksadk.sandbox.factory import create_sandbox_backend, sandbox_spec_from_env, setup_sandbox_api_url_if_needed
__all__ = [
"E2BSandboxBackend",
@@ -28,4 +28,5 @@
"SandboxType",
"create_sandbox_backend",
"sandbox_spec_from_env",
+ "setup_sandbox_api_url_if_needed",
]
diff --git a/ksadk/sandbox/factory.py b/ksadk/sandbox/factory.py
index 2efdb734..c6b701d6 100644
--- a/ksadk/sandbox/factory.py
+++ b/ksadk/sandbox/factory.py
@@ -16,11 +16,83 @@ def bool_env(name: str, default: bool = True) -> bool:
return raw.strip().lower() in {"1", "true", "yes", "on"}
+def _resolve_sandbox_api_url() -> str:
+ """Probe sandbox control-plane URL at runtime (in-Pod).
+
+ agentengine-server injects public E2B_API_URL on the management cluster.
+ public_only compute pods can reach the public address directly; private_only
+ pods have no public egress. Strategy: try the original (public) URL first;
+ if reachable keep it, otherwise fall back to the 198 public-service-net
+ internal address. Mirrors KSPMAS get_kspmas_api_base(): probe runs in-Pod.
+ """
+ raw = (os.environ.get("E2B_API_URL") or "").strip()
+ if not raw:
+ return raw
+
+ from urllib.parse import urlsplit, urlunsplit
+
+ parsed = urlsplit(raw)
+ host = (parsed.hostname or "").lower()
+ if host.endswith(".sdns.ksyun.com"):
+ return raw
+ if not host.endswith(".sandbox.ksyun.com"):
+ return raw
+
+ parts = host.split(".")
+ region = ""
+ if len(parts) >= 4 and parts[0] == "mgr":
+ region = parts[1]
+ elif len(parts) >= 4:
+ region = parts[1] if parts[1] != "sandbox" else ""
+ if not region:
+ return raw
+
+ import socket
+
+ port = parsed.port or (443 if parsed.scheme == "https" else 80)
+
+ # 1) Try the original (public) URL first; reachable => keep it.
+ try:
+ s = socket.socket()
+ s.settimeout(1.5)
+ s.connect((host, port))
+ s.close()
+ return raw
+ except OSError:
+ pass
+
+ # 2) Public unreachable (e.g. private_only node) => fall back to internal.
+ internal_host = f"sandbox.{region}.sandbox.sdns.ksyun.com"
+ try:
+ s = socket.socket()
+ s.settimeout(1.5)
+ s.connect((internal_host, port))
+ s.close()
+ except OSError:
+ return raw
+
+ internal_url = urlunsplit((parsed.scheme or "https", internal_host, parsed.path, parsed.query, ""))
+ return internal_url
+
+
+def setup_sandbox_api_url_if_needed() -> None:
+ """Override E2B_API_URL to internal address before creating E2B backend.
+
+ Only runs in managed runtime (AGENT_RUNTIME_ID / K8S); local dev unaffected.
+ """
+ if not os.environ.get("AGENT_RUNTIME_ID") and not os.environ.get("KUBERNETES_SERVICE_HOST"):
+ return
+ resolved = _resolve_sandbox_api_url()
+ if resolved != (os.environ.get("E2B_API_URL") or ""):
+ os.environ["E2B_API_URL"] = resolved
+
+
def create_sandbox_backend(
backend: str | None = None,
*,
sandbox_cls: Any | None = None,
) -> SandboxBackend:
+ setup_sandbox_api_url_if_needed()
resolved = (backend or os.environ.get("KSADK_SANDBOX_BACKEND") or "e2b").strip().lower()
if resolved in {"local", "local_process"}:
return LocalProcessSandboxBackend(
diff --git a/ksadk/scheduler/__init__.py b/ksadk/scheduler/__init__.py
new file mode 100644
index 00000000..2ec7e908
--- /dev/null
+++ b/ksadk/scheduler/__init__.py
@@ -0,0 +1,18 @@
+"""Local Scheduler Lite contracts and deterministic calendar calculations."""
+
+from ksadk.scheduler.calendar import next_schedule_time
+from ksadk.scheduler.contracts import ScheduledTask, ScheduleOccurrence, ScheduleSpec
+from ksadk.scheduler.dispatcher import AgentControlSchedulerDispatcher
+from ksadk.scheduler.engine import SchedulerDispatchError, SchedulerEngine
+from ksadk.scheduler.sqlite_store import SchedulerSQLiteStore
+
+__all__ = [
+ "ScheduleOccurrence",
+ "ScheduledTask",
+ "ScheduleSpec",
+ "AgentControlSchedulerDispatcher",
+ "SchedulerDispatchError",
+ "SchedulerEngine",
+ "SchedulerSQLiteStore",
+ "next_schedule_time",
+]
diff --git a/ksadk/scheduler/calendar.py b/ksadk/scheduler/calendar.py
new file mode 100644
index 00000000..22e140e5
--- /dev/null
+++ b/ksadk/scheduler/calendar.py
@@ -0,0 +1,102 @@
+"""Deterministic, dependency-free calendar calculations for Scheduler Lite.
+
+The supported cron dialect intentionally stays small and explicit: five fields,
+numeric values, comma lists, ranges and ``*/step``. It is sufficient for the
+Studio scheduler and avoids inheriting an accidental transitive dependency.
+All matching happens after UTC -> IANA timezone conversion. That means a
+nonexistent DST local minute is skipped and the repeated fall-back minute runs
+once (the first ``fold`` only).
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from zoneinfo import ZoneInfo
+
+from ksadk.scheduler.contracts import ScheduleSpec, _parse_cron
+
+
+def next_schedule_time(
+ schedule: ScheduleSpec,
+ *,
+ after: datetime,
+ anchor_at: datetime | None = None,
+) -> datetime | None:
+ """Return the first scheduled UTC timestamp strictly after ``after``."""
+
+ if after.tzinfo is None:
+ raise ValueError("after must include a timezone")
+ after = after.astimezone(timezone.utc)
+ if schedule.kind == "once":
+ assert schedule.at is not None
+ return schedule.at if schedule.at > after else None
+ if schedule.kind == "interval":
+ assert schedule.every_seconds is not None
+ anchor = (schedule.anchor_at or anchor_at or after).astimezone(timezone.utc)
+ if anchor > after:
+ return anchor
+ elapsed = (after - anchor).total_seconds()
+ step = schedule.every_seconds
+ return anchor + timedelta(seconds=(int(elapsed // step) + 1) * step)
+ assert schedule.expression is not None
+ return _next_cron(schedule.expression, schedule.timezone, after)
+
+
+def _next_cron(expression: str, timezone_name: str, after: datetime) -> datetime:
+ minute, hour, day, month, weekday = _parse_cron(expression)
+ fields = (
+ _expand_field(minute, 0, 59),
+ _expand_field(hour, 0, 23),
+ _expand_field(day, 1, 31),
+ _expand_field(month, 1, 12),
+ _expand_field(weekday, 0, 6),
+ )
+ zone = ZoneInfo(timezone_name)
+ candidate = after.replace(second=0, microsecond=0) + timedelta(minutes=1)
+ # Five years is a deliberate guard against impossible expressions such as
+ # 31 February. The caller receives a typed validation error rather than a
+ # scheduler loop that runs forever.
+ deadline = candidate + timedelta(days=366 * 5)
+ while candidate <= deadline:
+ local = candidate.astimezone(zone)
+ # datetime.weekday uses Monday=0. Cron uses Sunday=0.
+ cron_weekday = (local.weekday() + 1) % 7
+ if (
+ local.fold == 0
+ and local.minute in fields[0]
+ and local.hour in fields[1]
+ and local.day in fields[2]
+ and local.month in fields[3]
+ and cron_weekday in fields[4]
+ ):
+ return candidate
+ candidate += timedelta(minutes=1)
+ raise ValueError("cron expression has no matching time within five years")
+
+
+def _expand_field(value: str, minimum: int, maximum: int) -> set[int]:
+ result: set[int] = set()
+ for item in value.split(","):
+ if "/" in item:
+ base, step_text = item.split("/", 1)
+ else:
+ base, step_text = item, None
+ step = int(step_text) if step_text is not None else 1
+ if step <= 0:
+ raise ValueError("cron step must be positive")
+ if base == "*":
+ start, end = minimum, maximum
+ elif "-" in base:
+ start_text, end_text = base.split("-", 1)
+ start, end = int(start_text), int(end_text)
+ else:
+ start = end = int(base)
+ if start < minimum or end > maximum or start > end:
+ raise ValueError("cron field is outside its valid range")
+ result.update(range(start, end + 1, step))
+ if not result:
+ raise ValueError("cron field must not be empty")
+ return result
+
+
+__all__ = ["next_schedule_time"]
diff --git a/ksadk/scheduler/contracts.py b/ksadk/scheduler/contracts.py
new file mode 100644
index 00000000..fb98f485
--- /dev/null
+++ b/ksadk/scheduler/contracts.py
@@ -0,0 +1,254 @@
+"""Versioned Scheduler Lite source contracts (P2-06 foundation)."""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime, timezone
+from typing import Any, Literal
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+
+def _to_camel(value: str) -> str:
+ head, *tail = value.split("_")
+ return head + "".join(part.capitalize() for part in tail)
+
+
+class ScheduleModel(BaseModel):
+ model_config = ConfigDict(
+ alias_generator=_to_camel,
+ populate_by_name=True,
+ extra="forbid",
+ frozen=True,
+ )
+
+
+_TASK_ID = re.compile(r"^[a-z][a-z0-9-]{2,62}$")
+ScheduleOccurrenceState = Literal[
+ "claimed",
+ "accepted",
+ "running",
+ "succeeded",
+ "failed",
+ "skipped",
+ "cancelled",
+]
+
+
+class ScheduleSpec(ScheduleModel):
+ kind: Literal["once", "interval", "cron"]
+ timezone: str = "UTC"
+ at: datetime | None = None
+ every_seconds: int | None = Field(default=None, ge=60, le=31_536_000)
+ anchor_at: datetime | None = None
+ expression: str | None = Field(default=None, min_length=9, max_length=128)
+ misfire_policy: Literal["skip", "run_once"] = "skip"
+
+ @field_validator("timezone")
+ @classmethod
+ def validate_timezone(cls, value: str) -> str:
+ try:
+ ZoneInfo(value)
+ except ZoneInfoNotFoundError as error:
+ raise ValueError("timezone must be an IANA timezone") from error
+ return value
+
+ @field_validator("at", "anchor_at")
+ @classmethod
+ def normalize_timestamp(cls, value: datetime | None) -> datetime | None:
+ if value is None:
+ return None
+ if value.tzinfo is None:
+ raise ValueError("schedule timestamps must include a timezone")
+ return value.astimezone(timezone.utc)
+
+ @model_validator(mode="after")
+ def validate_kind_shape(self) -> "ScheduleSpec":
+ if self.kind == "once":
+ if self.at is None or self.every_seconds is not None or self.expression is not None:
+ raise ValueError("once schedule requires only at")
+ elif self.kind == "interval":
+ if self.every_seconds is None or self.at is not None or self.expression is not None:
+ raise ValueError("interval schedule requires everySeconds and no expression")
+ elif self.kind == "cron":
+ if self.expression is None or self.at is not None or self.every_seconds is not None:
+ raise ValueError("cron schedule requires only expression")
+ _parse_cron(self.expression)
+ return self
+
+
+class ScheduledTaskTarget(ScheduleModel):
+ # ``agent_instance_id`` identifies the concrete Kernel owner which will
+ # consume an Inbox command. ``agent_id`` is the Studio-facing stable
+ # logical Agent identity used to retain a task on its detail page even when
+ # the task is pinned to an older immutable Build. It is optional only so
+ # existing v1 SQLite rows remain readable; all Studio-authored tasks set it.
+ agent_id: str | None = Field(default=None, min_length=1, max_length=256)
+ tenant_id: str = Field(min_length=1, max_length=256)
+ agent_instance_id: str = Field(min_length=1, max_length=256)
+ agent_version_ref: str | None = Field(default=None, min_length=1, max_length=256)
+ session_id: str | None = Field(default=None, min_length=1, max_length=256)
+ authorization_ref: str = Field(min_length=1, max_length=512)
+
+
+class ScheduleCommandTemplate(ScheduleModel):
+ """The sole supported Scheduler Lite action: durable enqueue via AgentControl."""
+
+ command_type: Literal["enqueue"] = "enqueue"
+ payload: dict[str, Any]
+
+ @model_validator(mode="after")
+ def validate_payload(self) -> "ScheduleCommandTemplate":
+ if "content" not in self.payload:
+ raise ValueError("scheduled enqueue payload requires content")
+ _reject_clear_secrets(self.payload)
+ return self
+
+
+class ScheduledTask(ScheduleModel):
+ api_version: Literal["schedule.ksadk.io/v1"] = "schedule.ksadk.io/v1"
+ kind: Literal["ScheduledTask"] = "ScheduledTask"
+ schema_version: Literal[1] = 1
+ task_id: str = Field(min_length=3, max_length=63)
+ # A human-facing task label belongs to the durable schedule intent, not a
+ # transient Studio card. Optional keeps the previously frozen v1 rows
+ # and third-party producers readable during this additive transition.
+ display_name: str | None = Field(default=None, min_length=1, max_length=128)
+ target: ScheduledTaskTarget
+ schedule: ScheduleSpec
+ command: ScheduleCommandTemplate
+ enabled: bool = True
+ continuity: Literal["new_session", "continue_session"] = "new_session"
+ concurrency_policy: Literal["forbid"] = "forbid"
+ next_run_at: datetime | None = None
+ created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+ updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+
+ @field_validator("task_id")
+ @classmethod
+ def validate_task_id(cls, value: str) -> str:
+ if not _TASK_ID.fullmatch(value):
+ raise ValueError("taskId must be a lowercase stable identifier")
+ return value
+
+ @model_validator(mode="after")
+ def validate_continuity_target(self) -> "ScheduledTask":
+ if self.continuity == "continue_session" and not self.target.session_id:
+ raise ValueError("continue_session schedule requires target.sessionId")
+ return self
+
+ @field_validator("next_run_at", "created_at", "updated_at")
+ @classmethod
+ def normalize_timestamp(cls, value: datetime | None) -> datetime | None:
+ if value is None:
+ return None
+ if value.tzinfo is None:
+ raise ValueError("scheduler timestamps must include a timezone")
+ return value.astimezone(timezone.utc)
+
+
+class ScheduleOccurrenceTransition(ScheduleModel):
+ """One durable state change displayed by Studio's execution history."""
+
+ state: ScheduleOccurrenceState
+ at: datetime
+ detail: str | None = Field(default=None, max_length=1024)
+ error_code: str | None = Field(default=None, max_length=128)
+
+ @field_validator("at")
+ @classmethod
+ def normalize_timestamp(cls, value: datetime) -> datetime:
+ if value.tzinfo is None:
+ raise ValueError("occurrence transition timestamps must include a timezone")
+ return value.astimezone(timezone.utc)
+
+
+class ScheduleOccurrence(ScheduleModel):
+ api_version: Literal["schedule.ksadk.io/v1"] = "schedule.ksadk.io/v1"
+ kind: Literal["ScheduleOccurrence"] = "ScheduleOccurrence"
+ schema_version: Literal[1] = 1
+ occurrence_id: str = Field(min_length=8, max_length=256)
+ task_id: str = Field(min_length=3, max_length=63)
+ # Keep the execution target as an immutable occurrence snapshot. Tasks can
+ # later be edited or deleted, but history/reconciliation must still know
+ # exactly which Agent revision accepted this occurrence.
+ target: ScheduledTaskTarget | None = None
+ scheduled_for: datetime
+ session_id: str = Field(min_length=1, max_length=256)
+ trigger: Literal["schedule", "manual"] = "schedule"
+ state: ScheduleOccurrenceState
+ attempt: int = Field(default=1, ge=1, le=100)
+ command_id: str | None = None
+ accepted_seq: int | None = Field(default=None, ge=0)
+ last_event_seq: int | None = Field(default=None, ge=0)
+ run_id: str | None = Field(default=None, min_length=1, max_length=256)
+ claimed_at: datetime | None = None
+ accepted_at: datetime | None = None
+ started_at: datetime | None = None
+ error_code: str | None = Field(default=None, max_length=128)
+ detail: str | None = Field(default=None, max_length=1024)
+ completed_at: datetime | None = None
+ transitions: tuple[ScheduleOccurrenceTransition, ...] = ()
+
+ @field_validator("scheduled_for", "claimed_at", "accepted_at", "started_at", "completed_at")
+ @classmethod
+ def normalize_timestamp(cls, value: datetime | None) -> datetime | None:
+ if value is None:
+ return None
+ if value.tzinfo is None:
+ raise ValueError("occurrence timestamps must include a timezone")
+ return value.astimezone(timezone.utc)
+
+ @model_validator(mode="after")
+ def validate_terminal_fields(self) -> "ScheduleOccurrence":
+ terminal = {"succeeded", "failed", "skipped", "cancelled"}
+ if self.state in terminal and self.completed_at is None:
+ raise ValueError("terminal occurrence requires completedAt")
+ if self.state == "failed" and not self.error_code:
+ raise ValueError("failed occurrence requires errorCode")
+ if self.state == "running" and (not self.run_id or self.started_at is None):
+ raise ValueError("running occurrence requires runId and startedAt")
+ if self.transitions:
+ timestamps = [transition.at for transition in self.transitions]
+ if timestamps != sorted(timestamps):
+ raise ValueError("occurrence transitions must be chronological")
+ if self.transitions[-1].state != self.state:
+ raise ValueError("last occurrence transition must match state")
+ return self
+
+
+def _reject_clear_secrets(value: Any, *, key: str = "payload") -> None:
+ if isinstance(value, dict):
+ for name, item in value.items():
+ lowered = str(name).lower()
+ if any(term in lowered for term in ("secret", "password", "token", "api_key")):
+ if not isinstance(item, str) or not item.startswith(
+ ("env://", "secret://", "credential://", "vault://")
+ ):
+ raise ValueError(f"{key}.{name} must be a secret reference, not a value")
+ _reject_clear_secrets(item, key=f"{key}.{name}")
+ elif isinstance(value, list):
+ for index, item in enumerate(value):
+ _reject_clear_secrets(item, key=f"{key}[{index}]")
+
+
+def _parse_cron(expression: str) -> tuple[str, str, str, str, str]:
+ fields = tuple(part for part in expression.split() if part)
+ if len(fields) != 5:
+ raise ValueError("cron expression must use exactly five fields")
+ for value in fields:
+ if not re.fullmatch(r"[0-9*/,-]+", value):
+ raise ValueError("cron fields only support numbers, ranges, lists and steps")
+ return fields # detailed field grammar is shared with calendar.py
+
+
+__all__ = [
+ "ScheduleCommandTemplate",
+ "ScheduleOccurrence",
+ "ScheduleOccurrenceState",
+ "ScheduleOccurrenceTransition",
+ "ScheduleSpec",
+ "ScheduledTask",
+ "ScheduledTaskTarget",
+]
diff --git a/ksadk/scheduler/dispatcher.py b/ksadk/scheduler/dispatcher.py
new file mode 100644
index 00000000..5b3e33d0
--- /dev/null
+++ b/ksadk/scheduler/dispatcher.py
@@ -0,0 +1,129 @@
+"""Local Scheduler Lite's explicit AgentControl dispatcher."""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable, Sequence
+
+from ksadk.kernel.contracts import (
+ AgentControlCommand,
+ AgentControlPermit,
+ AgentControlReceipt,
+)
+from ksadk.kernel.ingress import (
+ map_scheduler_request,
+ submit_command,
+ subscribe_projected,
+ trusted_context,
+)
+from ksadk.scheduler.contracts import ScheduledTask, ScheduledTaskTarget, ScheduleOccurrence
+from ksadk.scheduler.engine import SchedulerDispatchError, SchedulerDispatchReceipt
+
+SubmitCommand = Callable[[AgentControlCommand, AgentControlPermit], Awaitable[AgentControlReceipt]]
+ReadOccurrenceEvents = Callable[
+ [ScheduleOccurrence], Awaitable[Sequence[tuple[int, object]]]
+]
+PrepareTarget = Callable[[ScheduledTaskTarget], Awaitable[object]]
+
+
+class AgentControlSchedulerDispatcher:
+ """Translate one occurrence into a single durable AgentControl enqueue.
+
+ This dispatcher is intentionally local-runtime only. A hosted scheduler
+ must obtain a Server-issued permit at its admission boundary in Phase 3;
+ this class never makes local permits look valid against hosted JWKS.
+ """
+
+ def __init__(
+ self,
+ submitter: SubmitCommand | None = None,
+ *,
+ event_reader: ReadOccurrenceEvents | None = None,
+ target_preparer: PrepareTarget | None = None,
+ ) -> None:
+ self._submitter = submitter or _submit_via_ingress
+ self._event_reader = event_reader
+ self._target_preparer = target_preparer
+
+ async def dispatch(
+ self, task: ScheduledTask, occurrence: ScheduleOccurrence
+ ) -> SchedulerDispatchReceipt:
+ target = task.target
+ if self._target_preparer is not None:
+ await self._target_preparer(target)
+ trusted = trusted_context(
+ source_kind="scheduler",
+ source_ref=occurrence.occurrence_id,
+ tenant_id=target.tenant_id,
+ agent_instance_id=target.agent_instance_id,
+ session_id=occurrence.session_id,
+ operations=("enqueue",),
+ )
+ command = map_scheduler_request(
+ session_id=occurrence.session_id,
+ idempotency_key=occurrence.occurrence_id,
+ content=task.command.payload["content"],
+ occurrence_id=occurrence.occurrence_id,
+ trusted=trusted,
+ )
+ receipt = await self._submitter(command, trusted.permit)
+ if receipt.status not in {"accepted", "duplicate"}:
+ error = receipt.error
+ raise SchedulerDispatchError(
+ error.code if error else f"KERNEL_{receipt.status.upper()}",
+ error.message if error else f"kernel rejected occurrence: {receipt.status}",
+ )
+ return SchedulerDispatchReceipt(str(receipt.command_id), accepted_seq=receipt.accepted_seq)
+
+ async def read_events(self, occurrence: ScheduleOccurrence) -> tuple[tuple[int, object], ...]:
+ """Read currently available canonical facts without holding an SSE open.
+
+ The local scheduler wakes frequently; each read resumes from the
+ durable session cursor persisted on the occurrence. This avoids a
+ hidden second event log and lets a Studio restart continue settling an
+ already-accepted run.
+ """
+
+ if self._event_reader is not None:
+ return tuple(await self._event_reader(occurrence))
+
+ target = occurrence.target
+ if target is None:
+ return ()
+ trusted = trusted_context(
+ source_kind="scheduler",
+ source_ref=occurrence.occurrence_id,
+ tenant_id=target.tenant_id,
+ agent_instance_id=target.agent_instance_id,
+ session_id=occurrence.session_id,
+ operations=("subscribe_events",),
+ )
+ cursor = occurrence.last_event_seq
+ if cursor is None:
+ cursor = occurrence.accepted_seq or 0
+ stream = subscribe_projected(
+ occurrence.session_id,
+ trusted=trusted,
+ after_seq=cursor,
+ projector=lambda event: event,
+ )
+ events: list[tuple[int, object]] = []
+ try:
+ while len(events) < 100:
+ try:
+ value = await asyncio.wait_for(anext(stream), timeout=0.05)
+ except TimeoutError:
+ break
+ events.append(value)
+ finally:
+ await stream.aclose()
+ return tuple(events)
+
+
+async def _submit_via_ingress(
+ command: AgentControlCommand, permit: AgentControlPermit
+) -> AgentControlReceipt:
+ return await submit_command(command, permit=permit)
+
+
+__all__ = ["AgentControlSchedulerDispatcher"]
diff --git a/ksadk/scheduler/engine.py b/ksadk/scheduler/engine.py
new file mode 100644
index 00000000..192c456b
--- /dev/null
+++ b/ksadk/scheduler/engine.py
@@ -0,0 +1,416 @@
+"""Explicitly started local Scheduler Lite engine.
+
+There is intentionally no import-time loop and no Studio lifespan hook here.
+Local schedules run only while a caller starts this engine; deployment-wide
+always-on scheduling belongs to the Server/Operator phase, not this component.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Callable, Sequence
+from datetime import datetime, timedelta, timezone
+from typing import Protocol
+from uuid import uuid4
+
+from ksadk.scheduler.calendar import next_schedule_time
+from ksadk.scheduler.contracts import ScheduledTask, ScheduleOccurrence
+from ksadk.scheduler.sqlite_store import SchedulerSQLiteStore
+
+
+class SchedulerEventReader(Protocol):
+ """Read canonical SessionEvents for one accepted occurrence."""
+
+ async def read_events(self, occurrence: ScheduleOccurrence) -> Sequence[tuple[int, object]]: ...
+
+
+class SchedulerDispatchReceipt(str):
+ """A backward-compatible dispatcher result with an event-log cursor.
+
+ It remains a ``str`` so existing local dispatcher implementations keep
+ working. The new ``accepted_seq`` lets the scheduler resume from exactly
+ the AgentControl admission fact rather than guessing from wall-clock time.
+ """
+
+ accepted_seq: int | None
+
+ def __new__(cls, command_id: str, *, accepted_seq: int | None = None):
+ value = super().__new__(cls, command_id)
+ value.accepted_seq = accepted_seq
+ return value
+
+
+class SchedulerDispatchError(RuntimeError):
+ """A typed dispatcher failure safe to persist in occurrence history."""
+
+ def __init__(self, code: str, detail: str) -> None:
+ super().__init__(detail)
+ self.code = code
+ self.detail = detail
+
+
+class SchedulerDispatcher(Protocol):
+ """The one execution seam. Implementations must submit AgentControl only."""
+
+ async def dispatch(self, task: ScheduledTask, occurrence: ScheduleOccurrence) -> str:
+ """Return AgentControl's accepted command ID, or raise a typed error."""
+
+
+Clock = Callable[[], datetime]
+TickGuard = Callable[[], bool]
+
+
+class SchedulerEngine:
+ def __init__(
+ self,
+ store: SchedulerSQLiteStore,
+ dispatcher: SchedulerDispatcher,
+ *,
+ owner_id: str | None = None,
+ clock: Clock | None = None,
+ tick_guard: TickGuard | None = None,
+ lease_seconds: int = 30,
+ ) -> None:
+ self.store = store
+ self.dispatcher = dispatcher
+ self.owner_id = owner_id or f"studio-{uuid4().hex}"
+ self.clock = clock or (lambda: datetime.now(timezone.utc))
+ self.tick_guard = tick_guard
+ self.lease_seconds = lease_seconds
+ self._task: asyncio.Task[None] | None = None
+ self._stop = asyncio.Event()
+ self._poll_seconds: float | None = None
+ self._last_scan_at: datetime | None = None
+ self._last_scan_result: str | None = None
+ self._last_scan_detail: str | None = None
+ self._next_scan_at: datetime | None = None
+
+ @property
+ def running(self) -> bool:
+ return self._task is not None and not self._task.done()
+
+ def status(self) -> dict[str, object]:
+ """Return a UI-safe snapshot of the local trigger process.
+
+ This is operational state, not a claim that every configured task is
+ executable. ``waiting_runtime`` deliberately means the monitor is
+ alive but will not claim due work until its trusted Kernel route is
+ available again.
+ """
+
+ return {
+ "running": self.running,
+ "ownerId": self.owner_id,
+ "pollSeconds": self._poll_seconds,
+ "lastScanAt": self._last_scan_at,
+ "lastScanResult": self._last_scan_result,
+ "lastScanDetail": self._last_scan_detail,
+ "nextScanAt": self._next_scan_at,
+ }
+
+ async def tick(self) -> list[ScheduleOccurrence]:
+ """Claim every due occurrence once and submit it through AgentControl."""
+
+ now = self.clock().astimezone(timezone.utc)
+ self._last_scan_at = now
+ if self.tick_guard is not None and not self.tick_guard():
+ self._last_scan_result = "waiting_runtime"
+ self._last_scan_detail = "agent_kernel_route_inactive"
+ return []
+ owns_lease = await asyncio.to_thread(
+ self.store.acquire_lease,
+ owner_id=self.owner_id,
+ now=now,
+ ttl_seconds=self.lease_seconds,
+ )
+ if not owns_lease:
+ self._last_scan_result = "lease_not_owned"
+ self._last_scan_detail = "another_local_scheduler_owns_the_lease"
+ return []
+ await self.reconcile()
+ due = await asyncio.to_thread(self.store.list_due, now)
+ result: list[ScheduleOccurrence] = []
+ for task, generation in due:
+ occurrence = await self._claim_scheduled(task, generation, now)
+ if occurrence is None:
+ continue
+ result.append(occurrence)
+ if occurrence.state == "skipped":
+ continue
+ try:
+ dispatch = await self.dispatcher.dispatch(task, occurrence)
+ except SchedulerDispatchError as exc:
+ result[-1] = await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=False,
+ error_code=exc.code,
+ detail=exc.detail,
+ )
+ except Exception as exc: # noqa: BLE001 - normalize boundary errors
+ result[-1] = await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=False,
+ error_code="DISPATCH_FAILED",
+ detail=str(exc)[:1024],
+ )
+ else:
+ result[-1] = await asyncio.to_thread(
+ self.store.mark_accepted,
+ occurrence.occurrence_id,
+ str(dispatch),
+ accepted_seq=getattr(dispatch, "accepted_seq", None),
+ )
+ self._last_scan_result = "ok"
+ self._last_scan_detail = f"claimed={len(result)}"
+ return result
+
+ async def _claim_scheduled(
+ self,
+ task: ScheduledTask,
+ generation: int,
+ now: datetime,
+ ) -> ScheduleOccurrence | None:
+ assert task.next_run_at is not None
+ missed = task.next_run_at < now
+ next_run_at = next_schedule_time(
+ task.schedule,
+ after=now if missed else task.next_run_at,
+ anchor_at=task.created_at,
+ )
+ if missed and task.schedule.misfire_policy == "skip":
+ return await asyncio.to_thread(
+ self.store.claim_and_advance,
+ task,
+ generation=generation,
+ next_run_at=next_run_at,
+ state="skipped",
+ detail="misfire_skipped",
+ claimed_at=now,
+ )
+ if task.concurrency_policy == "forbid" and await asyncio.to_thread(
+ self.store.has_active_occurrence, task.task_id
+ ):
+ return await asyncio.to_thread(
+ self.store.claim_and_advance,
+ task,
+ generation=generation,
+ next_run_at=next_run_at,
+ state="skipped",
+ detail="concurrency_forbid_active_occurrence",
+ claimed_at=now,
+ )
+ return await asyncio.to_thread(
+ self.store.claim_and_advance,
+ task,
+ generation=generation,
+ next_run_at=next_run_at,
+ claimed_at=now,
+ )
+
+ async def run_now(self, task_id: str) -> ScheduleOccurrence:
+ """Explicit user action; it still uses the dispatcher and durable log."""
+
+ value = await asyncio.to_thread(self.store.get_task, task_id)
+ if value is None:
+ raise KeyError(task_id)
+ task, generation = value
+ if not task.enabled:
+ raise SchedulerDispatchError("TASK_DISABLED", "scheduled task is disabled")
+ if task.concurrency_policy == "forbid" and await asyncio.to_thread(
+ self.store.has_active_occurrence, task.task_id
+ ):
+ raise SchedulerDispatchError(
+ "CONCURRENCY_FORBID", "an earlier occurrence is still active"
+ )
+ # Run-now has a separate manual occurrence identity. It is intentionally
+ # not an implicit reschedule and does not advance the natural next time.
+ now = self.clock().astimezone(timezone.utc)
+ occurrence = await asyncio.to_thread(
+ self.store.claim_manual,
+ task,
+ generation=generation,
+ now=now,
+ )
+ if occurrence is None:
+ raise SchedulerDispatchError("TASK_CHANGED", "task changed while starting manually")
+ try:
+ dispatch = await self.dispatcher.dispatch(task, occurrence)
+ except SchedulerDispatchError as exc:
+ return await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=False,
+ error_code=exc.code,
+ detail=exc.detail,
+ )
+ except Exception as exc: # noqa: BLE001
+ return await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=False,
+ error_code="DISPATCH_FAILED",
+ detail=str(exc)[:1024],
+ )
+ return await asyncio.to_thread(
+ self.store.mark_accepted,
+ occurrence.occurrence_id,
+ str(dispatch),
+ accepted_seq=getattr(dispatch, "accepted_seq", None),
+ )
+
+ async def reconcile(self) -> list[ScheduleOccurrence]:
+ """Settle accepted work only from correlated canonical runtime facts.
+
+ ``AgentControlReceipt.accepted`` means the command entered Inbox; it
+ is deliberately not a success signal. The control run-transition
+ event carries the originating command id, then the matching runtime
+ terminal event decides the immutable occurrence outcome.
+ """
+
+ reader = getattr(self.dispatcher, "read_events", None)
+ if not callable(reader):
+ return []
+ changed: list[ScheduleOccurrence] = []
+ for occurrence in await asyncio.to_thread(self.store.list_active_occurrences):
+ if not occurrence.command_id or occurrence.target is None:
+ # Legacy local records lack the new immutable target snapshot.
+ # Preserve their accepted status rather than guessing a target.
+ continue
+ try:
+ events = await reader(occurrence)
+ except Exception: # noqa: BLE001 - retain accepted state for a later poll
+ continue
+ current = occurrence
+ for seq, envelope in events:
+ current = await self._reconcile_event(current, seq=seq, envelope=envelope)
+ if current.state in {"succeeded", "failed", "skipped", "cancelled"}:
+ break
+ if current != occurrence:
+ changed.append(current)
+ return changed
+
+ async def _reconcile_event(
+ self, occurrence: ScheduleOccurrence, *, seq: int, envelope: object
+ ) -> ScheduleOccurrence:
+ event_type = str(getattr(envelope, "event_type", ""))
+ event_run_id = str(getattr(envelope, "run_id", "") or "")
+ causation_id = str(getattr(envelope, "causation_id", "") or "")
+ payload = getattr(envelope, "payload", {}) or {}
+ if not isinstance(payload, dict):
+ payload = {}
+
+ if event_type == "control.run_transition" and causation_id == occurrence.command_id:
+ run_id = event_run_id or str(payload.get("run_id") or "")
+ if run_id:
+ run_state = str(payload.get("state") or "")
+ if run_state not in {"running", "paused", "waiting"}:
+ return await asyncio.to_thread(
+ self.store.bind_run,
+ occurrence.occurrence_id,
+ run_id=run_id,
+ last_event_seq=seq,
+ )
+ return await asyncio.to_thread(
+ self.store.mark_running,
+ occurrence.occurrence_id,
+ run_id=run_id,
+ last_event_seq=seq,
+ )
+ if occurrence.run_id and event_run_id == occurrence.run_id:
+ if event_type == "run.completed":
+ return await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=True,
+ detail="runtime_completed",
+ )
+ if event_type in {"run.failed", "run.canceled", "run.interrupted"}:
+ error = payload.get("error")
+ code = (
+ str(error.get("code") or "RUNTIME_FAILED")
+ if isinstance(error, dict)
+ else event_type.upper().replace(".", "_")
+ )
+ detail = (
+ str(error.get("message") or event_type)
+ if isinstance(error, dict)
+ else event_type
+ )
+ return await asyncio.to_thread(
+ self.store.finish,
+ occurrence.occurrence_id,
+ succeeded=False,
+ error_code=code[:128],
+ detail=detail[:1024],
+ )
+ return await asyncio.to_thread(
+ self.store.advance_reconciliation_cursor,
+ occurrence.occurrence_id,
+ last_event_seq=seq,
+ )
+
+ async def settle(
+ self,
+ occurrence_id: str,
+ *,
+ succeeded: bool,
+ error_code: str | None = None,
+ detail: str | None = None,
+ ) -> ScheduleOccurrence:
+ """Called by the runtime-event reconciler, never by receipt handling."""
+
+ return await asyncio.to_thread(
+ self.store.finish,
+ occurrence_id,
+ succeeded=succeeded,
+ error_code=error_code,
+ detail=detail,
+ )
+
+ async def start(self, *, poll_seconds: float = 5.0) -> None:
+ if poll_seconds <= 0:
+ raise ValueError("poll_seconds must be positive")
+ if self._task is not None and not self._task.done():
+ return
+ # asyncio primitives bind to the loop that first waits on them. Studio
+ # tests and embedded hosts may start/stop the same service through a
+ # fresh event loop, so never reuse the previous loop's Event.
+ self._stop = asyncio.Event()
+ self._poll_seconds = poll_seconds
+
+ async def loop() -> None:
+ while not self._stop.is_set():
+ try:
+ await self.tick()
+ except Exception as exc: # noqa: BLE001 - keep the monitor alive
+ self._last_scan_at = self.clock().astimezone(timezone.utc)
+ self._last_scan_result = "error"
+ self._last_scan_detail = f"{type(exc).__name__}: {exc}"[:512]
+ self._next_scan_at = self.clock().astimezone(timezone.utc) + timedelta(
+ seconds=poll_seconds
+ )
+ try:
+ await asyncio.wait_for(self._stop.wait(), timeout=poll_seconds)
+ except TimeoutError:
+ pass
+
+ self._task = asyncio.create_task(loop(), name="ksadk-local-scheduler")
+
+ async def stop(self) -> None:
+ self._stop.set()
+ if self._task is None:
+ return
+ await self._task
+ self._task = None
+ self._next_scan_at = None
+
+
+__all__ = [
+ "SchedulerDispatchError",
+ "SchedulerDispatchReceipt",
+ "SchedulerDispatcher",
+ "SchedulerEngine",
+ "SchedulerEventReader",
+]
diff --git a/ksadk/scheduler/sqlite_store.py b/ksadk/scheduler/sqlite_store.py
new file mode 100644
index 00000000..c7a4249a
--- /dev/null
+++ b/ksadk/scheduler/sqlite_store.py
@@ -0,0 +1,563 @@
+"""Durable local persistence for Scheduler Lite.
+
+This store is deliberately independent from AgentKernel's Inbox tables. It
+owns scheduling decisions, occurrence identity and its *single process*
+lease; AgentControl remains the only execution ingress.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sqlite3
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Literal
+
+from ksadk.scheduler.contracts import (
+ ScheduledTask,
+ ScheduleOccurrence,
+ ScheduleOccurrenceTransition,
+)
+
+_SCHEMA_VERSION = 2
+_ACTIVE_STATES = ("claimed", "accepted", "running")
+_SCHEMA = """
+CREATE TABLE IF NOT EXISTS scheduler_tasks (
+ task_id TEXT PRIMARY KEY,
+ generation INTEGER NOT NULL,
+ body_json TEXT NOT NULL,
+ enabled INTEGER NOT NULL,
+ next_run_at TEXT,
+ created_at TEXT NOT NULL,
+ updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_scheduler_tasks_due
+ ON scheduler_tasks (enabled, next_run_at);
+CREATE TABLE IF NOT EXISTS scheduler_occurrences (
+ occurrence_id TEXT PRIMARY KEY,
+ task_id TEXT NOT NULL,
+ generation INTEGER NOT NULL,
+ scheduled_for TEXT NOT NULL,
+ trigger_kind TEXT NOT NULL,
+ body_json TEXT NOT NULL,
+ state TEXT NOT NULL,
+ command_id TEXT,
+ completed_at TEXT,
+ UNIQUE(task_id, generation, scheduled_for, trigger_kind)
+);
+CREATE INDEX IF NOT EXISTS idx_scheduler_occurrences_task_state
+ ON scheduler_occurrences (task_id, state, scheduled_for DESC);
+CREATE TABLE IF NOT EXISTS scheduler_leases (
+ lease_name TEXT PRIMARY KEY,
+ owner_id TEXT NOT NULL,
+ expires_at TEXT NOT NULL
+);
+"""
+
+
+def _iso(value: datetime) -> str:
+ if value.tzinfo is None:
+ raise ValueError("timestamp must include a timezone")
+ return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _parse(value: str) -> datetime:
+ return datetime.fromisoformat(value.replace("Z", "+00:00")).astimezone(timezone.utc)
+
+
+def occurrence_id(
+ task_id: str,
+ generation: int,
+ scheduled_for: datetime,
+ trigger: Literal["schedule", "manual"] = "schedule",
+) -> str:
+ raw = f"{task_id}\x00{generation}\x00{_iso(scheduled_for)}\x00{trigger}".encode()
+ return f"occ_{hashlib.sha256(raw).hexdigest()[:32]}"
+
+
+def _session_id(task: ScheduledTask, *, occurrence_id_value: str) -> str:
+ if task.continuity == "continue_session":
+ assert task.target.session_id is not None
+ return task.target.session_id
+ # A new scheduled start has an independent durable Session namespace. It
+ # is derived from the immutable occurrence id so a retry cannot create a
+ # second conversation.
+ return f"sched-{occurrence_id_value}"
+
+
+class SchedulerSQLiteStore:
+ """Synchronous SQLite store; callers may use it through ``to_thread``.
+
+ Every mutation uses its own connection and ``BEGIN IMMEDIATE``. That is
+ intentional: this component has no undeclared aiosqlite dependency and
+ remains correct when multiple local Studio processes contend for its DB.
+ """
+
+ def __init__(self, path: str | Path) -> None:
+ self.path = Path(path).expanduser().resolve()
+ self.path.parent.mkdir(parents=True, exist_ok=True)
+ self.ensure_schema()
+
+ def _connect(self) -> sqlite3.Connection:
+ connection = sqlite3.connect(self.path, timeout=5, isolation_level=None)
+ connection.row_factory = sqlite3.Row
+ connection.execute("PRAGMA journal_mode=WAL")
+ connection.execute("PRAGMA synchronous=FULL")
+ return connection
+
+ def ensure_schema(self) -> None:
+ with self._connect() as connection:
+ connection.executescript(_SCHEMA)
+ connection.execute(f"PRAGMA user_version={_SCHEMA_VERSION}")
+
+ def put_task(self, task: ScheduledTask, *, generation: int | None = None) -> int:
+ now = _iso(datetime.now(timezone.utc))
+ encoded = task.model_dump_json(by_alias=True, exclude_none=True)
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ existing = connection.execute(
+ "SELECT generation, created_at FROM scheduler_tasks WHERE task_id=?",
+ (task.task_id,),
+ ).fetchone()
+ actual_generation = generation
+ if actual_generation is None:
+ actual_generation = int(existing["generation"]) + 1 if existing else 1
+ created_at = existing["created_at"] if existing else _iso(task.created_at)
+ connection.execute(
+ """INSERT INTO scheduler_tasks(
+ task_id,generation,body_json,enabled,next_run_at,created_at,updated_at
+ )
+ VALUES(?,?,?,?,?,?,?)
+ ON CONFLICT(task_id) DO UPDATE SET generation=excluded.generation,
+ body_json=excluded.body_json,enabled=excluded.enabled,next_run_at=excluded.next_run_at,
+ updated_at=excluded.updated_at""",
+ (
+ task.task_id,
+ actual_generation,
+ encoded,
+ int(task.enabled),
+ _iso(task.next_run_at) if task.next_run_at else None,
+ created_at,
+ now,
+ ),
+ )
+ connection.commit()
+ return actual_generation
+
+ def get_task(self, task_id: str) -> tuple[ScheduledTask, int] | None:
+ with self._connect() as connection:
+ row = connection.execute(
+ "SELECT body_json,generation,next_run_at,enabled "
+ "FROM scheduler_tasks WHERE task_id=?",
+ (task_id,),
+ ).fetchone()
+ if row is None:
+ return None
+ body = json.loads(row["body_json"])
+ body["nextRunAt"] = row["next_run_at"]
+ body["enabled"] = bool(row["enabled"])
+ return ScheduledTask.model_validate(body), int(row["generation"])
+
+ def list_due(self, now: datetime) -> list[tuple[ScheduledTask, int]]:
+ with self._connect() as connection:
+ rows = connection.execute(
+ """SELECT body_json,generation,next_run_at FROM scheduler_tasks
+ WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=?
+ ORDER BY next_run_at,task_id""",
+ (_iso(now),),
+ ).fetchall()
+ result: list[tuple[ScheduledTask, int]] = []
+ for row in rows:
+ body = json.loads(row["body_json"])
+ body["nextRunAt"] = row["next_run_at"]
+ result.append((ScheduledTask.model_validate(body), int(row["generation"])))
+ return result
+
+ def list_tasks(self) -> list[tuple[ScheduledTask, int]]:
+ with self._connect() as connection:
+ rows = connection.execute(
+ "SELECT body_json,generation,next_run_at,enabled FROM scheduler_tasks "
+ "ORDER BY updated_at DESC,task_id"
+ ).fetchall()
+ result: list[tuple[ScheduledTask, int]] = []
+ for row in rows:
+ body = json.loads(row["body_json"])
+ body["nextRunAt"] = row["next_run_at"]
+ body["enabled"] = bool(row["enabled"])
+ result.append((ScheduledTask.model_validate(body), int(row["generation"])))
+ return result
+
+ def delete_task(self, task_id: str) -> bool:
+ """Remove the scheduling intent but retain immutable occurrence history."""
+
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ removed = connection.execute(
+ "DELETE FROM scheduler_tasks WHERE task_id=?", (task_id,)
+ ).rowcount
+ connection.commit()
+ return removed == 1
+
+ def list_occurrences(self, task_id: str, *, limit: int = 50) -> list[ScheduleOccurrence]:
+ if limit < 1 or limit > 200:
+ raise ValueError("occurrence limit must be between 1 and 200")
+ with self._connect() as connection:
+ rows = connection.execute(
+ """SELECT body_json FROM scheduler_occurrences WHERE task_id=?
+ ORDER BY scheduled_for DESC,occurrence_id DESC LIMIT ?""",
+ (task_id, limit),
+ ).fetchall()
+ return [ScheduleOccurrence.model_validate_json(row["body_json"]) for row in rows]
+
+ def list_all_occurrences(self, *, limit: int = 200) -> list[ScheduleOccurrence]:
+ """Return cross-task history, including records whose task was deleted."""
+
+ if limit < 1 or limit > 500:
+ raise ValueError("occurrence limit must be between 1 and 500")
+ with self._connect() as connection:
+ rows = connection.execute(
+ "SELECT body_json FROM scheduler_occurrences "
+ "ORDER BY scheduled_for DESC,occurrence_id DESC LIMIT ?",
+ (limit,),
+ ).fetchall()
+ return [ScheduleOccurrence.model_validate_json(row["body_json"]) for row in rows]
+
+ def list_active_occurrences(self, *, limit: int = 200) -> list[ScheduleOccurrence]:
+ """Return only non-terminal occurrences for event reconciliation.
+
+ The target snapshot is stored on the occurrence itself, so deleting a
+ task deliberately does not orphan a previously accepted execution.
+ """
+
+ if limit < 1 or limit > 200:
+ raise ValueError("active occurrence limit must be between 1 and 200")
+ placeholders = ",".join("?" for _ in _ACTIVE_STATES)
+ with self._connect() as connection:
+ rows = connection.execute(
+ "SELECT body_json FROM scheduler_occurrences "
+ f"WHERE state IN ({placeholders}) "
+ "ORDER BY scheduled_for,occurrence_id LIMIT ?",
+ (*_ACTIVE_STATES, limit),
+ ).fetchall()
+ return [ScheduleOccurrence.model_validate_json(row["body_json"]) for row in rows]
+
+ def has_active_occurrence(self, task_id: str) -> bool:
+ placeholders = ",".join("?" for _ in _ACTIVE_STATES)
+ with self._connect() as connection:
+ row = connection.execute(
+ "SELECT 1 FROM scheduler_occurrences "
+ f"WHERE task_id=? AND state IN ({placeholders}) LIMIT 1",
+ (task_id, *_ACTIVE_STATES),
+ ).fetchone()
+ return row is not None
+
+ def claim_and_advance(
+ self,
+ task: ScheduledTask,
+ *,
+ generation: int,
+ next_run_at: datetime | None,
+ state: Literal["claimed", "skipped"] = "claimed",
+ detail: str | None = None,
+ trigger: Literal["schedule", "manual"] = "schedule",
+ claimed_at: datetime | None = None,
+ ) -> ScheduleOccurrence | None:
+ if task.next_run_at is None:
+ raise ValueError("task must have next_run_at before it can be claimed")
+ scheduled_for = task.next_run_at
+ now = claimed_at or datetime.now(timezone.utc)
+ completed_at = now if state == "skipped" else None
+ transitions = [ScheduleOccurrenceTransition(state="claimed", at=now)]
+ if state == "skipped":
+ transitions.append(ScheduleOccurrenceTransition(state="skipped", at=now, detail=detail))
+ occurrence = ScheduleOccurrence(
+ occurrence_id=occurrence_id(task.task_id, generation, scheduled_for, trigger),
+ task_id=task.task_id,
+ target=task.target,
+ scheduled_for=scheduled_for,
+ session_id=_session_id(
+ task,
+ occurrence_id_value=occurrence_id(task.task_id, generation, scheduled_for, trigger),
+ ),
+ trigger=trigger,
+ state=state,
+ claimed_at=now,
+ detail=detail,
+ completed_at=completed_at,
+ transitions=tuple(transitions),
+ )
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ updated = connection.execute(
+ """UPDATE scheduler_tasks SET next_run_at=?,updated_at=?
+ WHERE task_id=? AND generation=? AND next_run_at=? AND enabled=1""",
+ (
+ _iso(next_run_at) if next_run_at else None,
+ _iso(now),
+ task.task_id,
+ generation,
+ _iso(scheduled_for),
+ ),
+ ).rowcount
+ if updated != 1:
+ connection.rollback()
+ return None
+ connection.execute(
+ """INSERT OR IGNORE INTO scheduler_occurrences(
+ occurrence_id,task_id,generation,scheduled_for,trigger_kind,body_json,state,command_id,completed_at)
+ VALUES(?,?,?,?,?,?,?,?,?)""",
+ (
+ occurrence.occurrence_id,
+ task.task_id,
+ generation,
+ _iso(scheduled_for),
+ trigger,
+ occurrence.model_dump_json(by_alias=True, exclude_none=True),
+ state,
+ None,
+ _iso(completed_at) if completed_at else None,
+ ),
+ )
+ connection.commit()
+ return occurrence
+
+ def mark_accepted(
+ self,
+ occurrence_id_value: str,
+ command_id: str,
+ *,
+ accepted_seq: int | None = None,
+ ) -> ScheduleOccurrence:
+ return self._transition(
+ occurrence_id_value,
+ state="accepted",
+ command_id=command_id,
+ accepted_seq=accepted_seq,
+ last_event_seq=accepted_seq,
+ accepted_at=datetime.now(timezone.utc),
+ )
+
+ def claim_manual(
+ self,
+ task: ScheduledTask,
+ *,
+ generation: int,
+ now: datetime,
+ ) -> ScheduleOccurrence | None:
+ """Create a durable manual occurrence without changing the timetable."""
+
+ occurrence = ScheduleOccurrence(
+ occurrence_id=occurrence_id(task.task_id, generation, now, "manual"),
+ task_id=task.task_id,
+ target=task.target,
+ scheduled_for=now,
+ session_id=_session_id(
+ task,
+ occurrence_id_value=occurrence_id(task.task_id, generation, now, "manual"),
+ ),
+ trigger="manual",
+ state="claimed",
+ claimed_at=now,
+ transitions=(ScheduleOccurrenceTransition(state="claimed", at=now),),
+ )
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ current = connection.execute(
+ "SELECT generation,enabled FROM scheduler_tasks WHERE task_id=?",
+ (task.task_id,),
+ ).fetchone()
+ if (
+ current is None
+ or int(current["generation"]) != generation
+ or not current["enabled"]
+ ):
+ connection.rollback()
+ return None
+ inserted = connection.execute(
+ """INSERT OR IGNORE INTO scheduler_occurrences(
+ occurrence_id,task_id,generation,scheduled_for,trigger_kind,
+ body_json,state,command_id,completed_at
+ ) VALUES(?,?,?,?,?,?,?,?,?)""",
+ (
+ occurrence.occurrence_id,
+ task.task_id,
+ generation,
+ _iso(now),
+ "manual",
+ occurrence.model_dump_json(by_alias=True, exclude_none=True),
+ occurrence.state,
+ None,
+ None,
+ ),
+ ).rowcount
+ if inserted != 1:
+ connection.rollback()
+ return None
+ connection.commit()
+ return occurrence
+
+ def finish(
+ self,
+ occurrence_id_value: str,
+ *,
+ succeeded: bool,
+ error_code: str | None = None,
+ detail: str | None = None,
+ ) -> ScheduleOccurrence:
+ if not succeeded and not error_code:
+ raise ValueError("failed scheduler occurrence requires error_code")
+ return self._transition(
+ occurrence_id_value,
+ state="succeeded" if succeeded else "failed",
+ error_code=error_code,
+ detail=detail,
+ completed_at=datetime.now(timezone.utc),
+ )
+
+ def mark_running(
+ self,
+ occurrence_id_value: str,
+ *,
+ run_id: str,
+ last_event_seq: int,
+ ) -> ScheduleOccurrence:
+ return self._transition(
+ occurrence_id_value,
+ state="running",
+ run_id=run_id,
+ started_at=datetime.now(timezone.utc),
+ last_event_seq=last_event_seq,
+ )
+
+ def bind_run(
+ self,
+ occurrence_id_value: str,
+ *,
+ run_id: str,
+ last_event_seq: int,
+ ) -> ScheduleOccurrence:
+ """Record a durable run identity before that run becomes runnable."""
+
+ return self._transition(
+ occurrence_id_value,
+ run_id=run_id,
+ last_event_seq=last_event_seq,
+ )
+
+ def advance_reconciliation_cursor(
+ self, occurrence_id_value: str, *, last_event_seq: int
+ ) -> ScheduleOccurrence:
+ return self._transition(
+ occurrence_id_value,
+ last_event_seq=last_event_seq,
+ )
+
+ def _transition(self, occurrence_id_value: str, **updates: object) -> ScheduleOccurrence:
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ row = connection.execute(
+ "SELECT body_json,state FROM scheduler_occurrences WHERE occurrence_id=?",
+ (occurrence_id_value,),
+ ).fetchone()
+ if row is None:
+ connection.rollback()
+ raise KeyError(occurrence_id_value)
+ body = json.loads(row["body_json"])
+ current = ScheduleOccurrence.model_validate(body)
+ terminal = {"succeeded", "failed", "skipped", "cancelled"}
+ # Terminal facts are first-wins. A replayed SSE frame or a later
+ # contradictory event must never rewrite auditable scheduler
+ # history after it has reached a conclusion.
+ if current.state in terminal:
+ connection.rollback()
+ return current
+ current_seq = current.last_event_seq
+ requested_seq = updates.get("last_event_seq")
+ if (
+ isinstance(requested_seq, int)
+ and current_seq is not None
+ and requested_seq < current_seq
+ ):
+ connection.rollback()
+ return current
+ # Stored JSON uses the public camelCase aliases. Updating with a
+ # Python field name while an older alias is present would create
+ # two values for one field and Pydantic correctly rejects it as an
+ # ambiguous/extra input. Normalize every mutation at this one
+ # persistence boundary instead.
+ for key, value in updates.items():
+ if value is None:
+ continue
+ field = ScheduleOccurrence.model_fields.get(key)
+ encoded_key = field.alias if field and field.alias else key
+ body[encoded_key] = _iso(value) if isinstance(value, datetime) else value
+ requested_state = updates.get("state")
+ if isinstance(requested_state, str) and requested_state != current.state:
+ transition_at = next(
+ (
+ value
+ for name in ("completed_at", "started_at", "accepted_at")
+ if isinstance((value := updates.get(name)), datetime)
+ ),
+ datetime.now(timezone.utc),
+ )
+ transitions = list(current.transitions)
+ if transitions and transition_at < transitions[-1].at:
+ # Custom/test clocks and small host clock corrections must
+ # not make a durable audit timeline go backwards.
+ transition_at = transitions[-1].at
+ transitions.append(
+ ScheduleOccurrenceTransition(
+ state=requested_state, # type: ignore[arg-type]
+ at=transition_at,
+ detail=(str(updates["detail"]) if updates.get("detail") else None),
+ error_code=(
+ str(updates["error_code"]) if updates.get("error_code") else None
+ ),
+ )
+ )
+ body["transitions"] = [
+ item.model_dump(mode="json", by_alias=True, exclude_none=True)
+ for item in transitions
+ ]
+ occurrence = ScheduleOccurrence.model_validate(body)
+ connection.execute(
+ """UPDATE scheduler_occurrences SET body_json=?,state=?,command_id=?,completed_at=?
+ WHERE occurrence_id=?""",
+ (
+ occurrence.model_dump_json(by_alias=True, exclude_none=True),
+ occurrence.state,
+ occurrence.command_id,
+ _iso(occurrence.completed_at) if occurrence.completed_at else None,
+ occurrence_id_value,
+ ),
+ )
+ connection.commit()
+ return occurrence
+
+ def acquire_lease(self, *, owner_id: str, now: datetime, ttl_seconds: int = 30) -> bool:
+ expiry = now.astimezone(timezone.utc).timestamp() + ttl_seconds
+ expires_at = datetime.fromtimestamp(expiry, tz=timezone.utc)
+ with self._connect() as connection:
+ connection.execute("BEGIN IMMEDIATE")
+ row = connection.execute(
+ "SELECT owner_id,expires_at FROM scheduler_leases "
+ "WHERE lease_name='local-scheduler'"
+ ).fetchone()
+ allowed = row is None or _parse(row["expires_at"]) <= now or row["owner_id"] == owner_id
+ if allowed:
+ connection.execute(
+ """INSERT INTO scheduler_leases(lease_name,owner_id,expires_at)
+ VALUES('local-scheduler',?,?)
+ ON CONFLICT(lease_name) DO UPDATE SET
+ owner_id=excluded.owner_id,expires_at=excluded.expires_at""",
+ (owner_id, _iso(expires_at)),
+ )
+ connection.commit()
+ return True
+ connection.rollback()
+ return False
+
+
+__all__ = ["SchedulerSQLiteStore", "occurrence_id"]
diff --git a/ksadk/server/static/assets/ArtifactsPanel-DSU1sWD_.js b/ksadk/server/static/assets/ArtifactsPanel-10GPXIJ6.js
similarity index 96%
rename from ksadk/server/static/assets/ArtifactsPanel-DSU1sWD_.js
rename to ksadk/server/static/assets/ArtifactsPanel-10GPXIJ6.js
index 63c973a1..77247746 100644
--- a/ksadk/server/static/assets/ArtifactsPanel-DSU1sWD_.js
+++ b/ksadk/server/static/assets/ArtifactsPanel-10GPXIJ6.js
@@ -1 +1 @@
-import{St as e,Tt as t,bt as n,gt as r,lt as i,n as a,t as o,ut as s,xt as c}from"./index-8ipRcQ-M.js";var l=t(e(),1),u=n();function d(){let e=c(e=>e.visible),t=c(e=>e.content),n=c(e=>e.type),d=c(e=>e.hide),f=(0,l.useRef)(null);if(a(f),!e||!t)return null;let p=o(t);return(0,u.jsxs)(`aside`,{className:i(`flex h-full flex-shrink-0 flex-col border-l border-slate-200/30 bg-white dark:border-slate-800/40 dark:bg-slate-950`,`w-[min(42rem,50vw)]`),children:[(0,u.jsxs)(`div`,{className:`flex h-14 flex-shrink-0 items-center justify-between border-b border-slate-200/30 px-4 dark:border-slate-800/40`,children:[(0,u.jsxs)(`div`,{className:`flex min-w-0 items-center gap-2`,children:[(0,u.jsx)(`span`,{className:`text-sm font-semibold text-slate-900 dark:text-slate-100`,children:`Artifact`}),(0,u.jsx)(`span`,{className:`rounded-md bg-slate-100 px-1.5 py-0.5 font-mono text-[11px] text-slate-500 dark:bg-slate-900 dark:text-slate-400`,children:n})]}),(0,u.jsxs)(`div`,{className:`flex items-center gap-1.5`,children:[(0,u.jsxs)(`button`,{type:`button`,onClick:()=>{let e=new Blob([t],{type:`text/html;charset=utf-8`}),r=URL.createObjectURL(e),i=document.createElement(`a`);i.href=r,i.download=`artifact.${n===`svg`?`svg`:`html`}`,document.body.appendChild(i),i.click(),document.body.removeChild(i),URL.revokeObjectURL(r)},className:`inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-slate-600 transition hover:bg-slate-100 dark:text-slate-300 dark:hover:bg-slate-900`,title:`Download`,children:[(0,u.jsx)(r,{className:`h-3.5 w-3.5`}),`Download`]}),(0,u.jsx)(`button`,{type:`button`,onClick:d,className:`rounded-lg p-1.5 text-slate-500 transition hover:bg-slate-100 hover:text-slate-900 dark:text-slate-400 dark:hover:bg-slate-900 dark:hover:text-slate-100`,"aria-label":`Close Artifact`,title:`Close`,children:(0,u.jsx)(s,{className:`h-4 w-4`})})]})]}),(0,u.jsx)(`div`,{className:`min-h-0 flex-1`,children:(0,u.jsx)(`iframe`,{ref:f,srcDoc:p,sandbox:`allow-scripts allow-downloads`,title:`Artifact Preview`,className:`h-full w-full border-0 bg-white`})})]})}export{d as ArtifactsPanel};
\ No newline at end of file
+import{St as e,Tt as t,bt as n,gt as r,lt as i,n as a,t as o,ut as s,xt as c}from"./index-B2k_urY8.js";var l=t(e(),1),u=n();function d(){let e=c(e=>e.visible),t=c(e=>e.content),n=c(e=>e.type),d=c(e=>e.hide),f=(0,l.useRef)(null);if(a(f),!e||!t)return null;let p=o(t);return(0,u.jsxs)(`aside`,{className:i(`flex h-full flex-shrink-0 flex-col border-l border-slate-200/30 bg-white dark:border-slate-800/40 dark:bg-slate-950`,`w-[min(42rem,50vw)]`),children:[(0,u.jsxs)(`div`,{className:`flex h-14 flex-shrink-0 items-center justify-between border-b border-slate-200/30 px-4 dark:border-slate-800/40`,children:[(0,u.jsxs)(`div`,{className:`flex min-w-0 items-center gap-2`,children:[(0,u.jsx)(`span`,{className:`text-sm font-semibold text-slate-900 dark:text-slate-100`,children:`Artifact`}),(0,u.jsx)(`span`,{className:`rounded-md bg-slate-100 px-1.5 py-0.5 font-mono text-[11px] text-slate-500 dark:bg-slate-900 dark:text-slate-400`,children:n})]}),(0,u.jsxs)(`div`,{className:`flex items-center gap-1.5`,children:[(0,u.jsxs)(`button`,{type:`button`,onClick:()=>{let e=new Blob([t],{type:`text/html;charset=utf-8`}),r=URL.createObjectURL(e),i=document.createElement(`a`);i.href=r,i.download=`artifact.${n===`svg`?`svg`:`html`}`,document.body.appendChild(i),i.click(),document.body.removeChild(i),URL.revokeObjectURL(r)},className:`inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-slate-600 transition hover:bg-slate-100 dark:text-slate-300 dark:hover:bg-slate-900`,title:`Download`,children:[(0,u.jsx)(r,{className:`h-3.5 w-3.5`}),`Download`]}),(0,u.jsx)(`button`,{type:`button`,onClick:d,className:`rounded-lg p-1.5 text-slate-500 transition hover:bg-slate-100 hover:text-slate-900 dark:text-slate-400 dark:hover:bg-slate-900 dark:hover:text-slate-100`,"aria-label":`Close Artifact`,title:`Close`,children:(0,u.jsx)(s,{className:`h-4 w-4`})})]})]}),(0,u.jsx)(`div`,{className:`min-h-0 flex-1`,children:(0,u.jsx)(`iframe`,{ref:f,srcDoc:p,sandbox:`allow-scripts allow-downloads`,title:`Artifact Preview`,className:`h-full w-full border-0 bg-white`})})]})}export{d as ArtifactsPanel};
\ No newline at end of file
diff --git a/ksadk/server/static/assets/CodeBlock-DOH6MVcn.js b/ksadk/server/static/assets/CodeBlock-BXk1l-G1.js
similarity index 99%
rename from ksadk/server/static/assets/CodeBlock-DOH6MVcn.js
rename to ksadk/server/static/assets/CodeBlock-BXk1l-G1.js
index 722fac1e..1354f4c6 100644
--- a/ksadk/server/static/assets/CodeBlock-DOH6MVcn.js
+++ b/ksadk/server/static/assets/CodeBlock-BXk1l-G1.js
@@ -1,4 +1,4 @@
-import{St as e,Tt as t,U as n,_t as r,at as i,bt as a,ht as o,it as s,lt as c,n as l,nt as u,ot as d,rt as f,st as p,t as m,tt as h,ut as g,vt as _,yt as v}from"./index-8ipRcQ-M.js";var y=v(`text-wrap`,[[`path`,{d:`m16 16-3 3 3 3`,key:`117b85`}],[`path`,{d:`M3 12h14.5a1 1 0 0 1 0 7H13`,key:`18xa6z`}],[`path`,{d:`M3 19h6`,key:`1ygdsz`}],[`path`,{d:`M3 5h18`,key:`1u36vt`}]]);b.displayName=`abap`,b.aliases=[];function b(e){e.languages.abap={comment:/^\*.*/m,string:/(`|')(?:\\.|(?!\1)[^\\\r\n])*\1/,"string-template":{pattern:/([|}])(?:\\.|[^\\|{\r\n])*(?=[|{])/,lookbehind:!0,alias:`string`},"eol-comment":{pattern:/(^|\s)".*/m,lookbehind:!0,alias:`comment`},keyword:{pattern:/(\s|\.|^)(?:\*-INPUT|\?TO|ABAP-SOURCE|ABBREVIATED|ABS|ABSTRACT|ACCEPT|ACCEPTING|ACCESSPOLICY|ACCORDING|ACOS|ACTIVATION|ACTUAL|ADD|ADD-CORRESPONDING|ADJACENT|AFTER|ALIAS|ALIASES|ALIGN|ALL|ALLOCATE|ALPHA|ANALYSIS|ANALYZER|AND|ANY|APPEND|APPENDAGE|APPENDING|APPLICATION|ARCHIVE|AREA|ARITHMETIC|AS|ASCENDING|ASIN|ASPECT|ASSERT|ASSIGN|ASSIGNED|ASSIGNING|ASSOCIATION|ASYNCHRONOUS|AT|ATAN|ATTRIBUTES|AUTHORITY|AUTHORITY-CHECK|AVG|BACK|BACKGROUND|BACKUP|BACKWARD|BADI|BASE|BEFORE|BEGIN|BETWEEN|BIG|BINARY|BINDING|BIT|BIT-AND|BIT-NOT|BIT-OR|BIT-XOR|BLACK|BLANK|BLANKS|BLOB|BLOCK|BLOCKS|BLUE|BOUND|BOUNDARIES|BOUNDS|BOXED|BREAK-POINT|BT|BUFFER|BY|BYPASSING|BYTE|BYTE-CA|BYTE-CN|BYTE-CO|BYTE-CS|BYTE-NA|BYTE-NS|BYTE-ORDER|C|CA|CALL|CALLING|CASE|CAST|CASTING|CATCH|CEIL|CENTER|CENTERED|CHAIN|CHAIN-INPUT|CHAIN-REQUEST|CHANGE|CHANGING|CHANNELS|CHAR-TO-HEX|CHARACTER|CHARLEN|CHECK|CHECKBOX|CIRCULAR|CI_|CLASS|CLASS-CODING|CLASS-DATA|CLASS-EVENTS|CLASS-METHODS|CLASS-POOL|CLEANUP|CLEAR|CLIENT|CLOB|CLOCK|CLOSE|CN|CNT|CO|COALESCE|CODE|CODING|COLLECT|COLOR|COLUMN|COLUMNS|COL_BACKGROUND|COL_GROUP|COL_HEADING|COL_KEY|COL_NEGATIVE|COL_NORMAL|COL_POSITIVE|COL_TOTAL|COMMENT|COMMENTS|COMMIT|COMMON|COMMUNICATION|COMPARING|COMPONENT|COMPONENTS|COMPRESSION|COMPUTE|CONCAT|CONCATENATE|COND|CONDENSE|CONDITION|CONNECT|CONNECTION|CONSTANTS|CONTEXT|CONTEXTS|CONTINUE|CONTROL|CONTROLS|CONV|CONVERSION|CONVERT|COPIES|COPY|CORRESPONDING|COS|COSH|COUNT|COUNTRY|COVER|CP|CPI|CREATE|CREATING|CRITICAL|CS|CURRENCY|CURRENCY_CONVERSION|CURRENT|CURSOR|CURSOR-SELECTION|CUSTOMER|CUSTOMER-FUNCTION|DANGEROUS|DATA|DATABASE|DATAINFO|DATASET|DATE|DAYLIGHT|DBMAXLEN|DD\/MM\/YY|DD\/MM\/YYYY|DDMMYY|DEALLOCATE|DECIMALS|DECIMAL_SHIFT|DECLARATIONS|DEEP|DEFAULT|DEFERRED|DEFINE|DEFINING|DEFINITION|DELETE|DELETING|DEMAND|DEPARTMENT|DESCENDING|DESCRIBE|DESTINATION|DETAIL|DIALOG|DIRECTORY|DISCONNECT|DISPLAY|DISPLAY-MODE|DISTANCE|DISTINCT|DIV|DIVIDE|DIVIDE-CORRESPONDING|DIVISION|DO|DUMMY|DUPLICATE|DUPLICATES|DURATION|DURING|DYNAMIC|DYNPRO|E|EACH|EDIT|EDITOR-CALL|ELSE|ELSEIF|EMPTY|ENABLED|ENABLING|ENCODING|END|END-ENHANCEMENT-SECTION|END-LINES|END-OF-DEFINITION|END-OF-FILE|END-OF-PAGE|END-OF-SELECTION|ENDAT|ENDCASE|ENDCATCH|ENDCHAIN|ENDCLASS|ENDDO|ENDENHANCEMENT|ENDEXEC|ENDFOR|ENDFORM|ENDFUNCTION|ENDIAN|ENDIF|ENDING|ENDINTERFACE|ENDLOOP|ENDMETHOD|ENDMODULE|ENDON|ENDPROVIDE|ENDSELECT|ENDTRY|ENDWHILE|ENGINEERING|ENHANCEMENT|ENHANCEMENT-POINT|ENHANCEMENT-SECTION|ENHANCEMENTS|ENTRIES|ENTRY|ENVIRONMENT|EQ|EQUAL|EQUIV|ERRORMESSAGE|ERRORS|ESCAPE|ESCAPING|EVENT|EVENTS|EXACT|EXCEPT|EXCEPTION|EXCEPTION-TABLE|EXCEPTIONS|EXCLUDE|EXCLUDING|EXEC|EXECUTE|EXISTS|EXIT|EXIT-COMMAND|EXP|EXPAND|EXPANDING|EXPIRATION|EXPLICIT|EXPONENT|EXPORT|EXPORTING|EXTEND|EXTENDED|EXTENSION|EXTRACT|FAIL|FETCH|FIELD|FIELD-GROUPS|FIELD-SYMBOL|FIELD-SYMBOLS|FIELDS|FILE|FILTER|FILTER-TABLE|FILTERS|FINAL|FIND|FIRST|FIRST-LINE|FIXED-POINT|FKEQ|FKGE|FLOOR|FLUSH|FONT|FOR|FORM|FORMAT|FORWARD|FOUND|FRAC|FRAME|FRAMES|FREE|FRIENDS|FROM|FUNCTION|FUNCTION-POOL|FUNCTIONALITY|FURTHER|GAPS|GE|GENERATE|GET|GIVING|GKEQ|GKGE|GLOBAL|GRANT|GREATER|GREEN|GROUP|GROUPS|GT|HANDLE|HANDLER|HARMLESS|HASHED|HAVING|HDB|HEAD-LINES|HEADER|HEADERS|HEADING|HELP-ID|HELP-REQUEST|HIDE|HIGH|HINT|HOLD|HOTSPOT|I|ICON|ID|IDENTIFICATION|IDENTIFIER|IDS|IF|IGNORE|IGNORING|IMMEDIATELY|IMPLEMENTATION|IMPLEMENTATIONS|IMPLEMENTED|IMPLICIT|IMPORT|IMPORTING|IN|INACTIVE|INCL|INCLUDE|INCLUDES|INCLUDING|INCREMENT|INDEX|INDEX-LINE|INFOTYPES|INHERITING|INIT|INITIAL|INITIALIZATION|INNER|INOUT|INPUT|INSERT|INSTANCES|INTENSIFIED|INTERFACE|INTERFACE-POOL|INTERFACES|INTERNAL|INTERVALS|INTO|INVERSE|INVERTED-DATE|IS|ISO|ITERATOR|ITNO|JOB|JOIN|KEEP|KEEPING|KERNEL|KEY|KEYS|KEYWORDS|KIND|LANGUAGE|LAST|LATE|LAYOUT|LE|LEADING|LEAVE|LEFT|LEFT-JUSTIFIED|LEFTPLUS|LEFTSPACE|LEGACY|LENGTH|LESS|LET|LEVEL|LEVELS|LIKE|LINE|LINE-COUNT|LINE-SELECTION|LINE-SIZE|LINEFEED|LINES|LIST|LIST-PROCESSING|LISTBOX|LITTLE|LLANG|LOAD|LOAD-OF-PROGRAM|LOB|LOCAL|LOCALE|LOCATOR|LOG|LOG-POINT|LOG10|LOGFILE|LOGICAL|LONG|LOOP|LOW|LOWER|LPAD|LPI|LT|M|MAIL|MAIN|MAJOR-ID|MAPPING|MARGIN|MARK|MASK|MATCH|MATCHCODE|MAX|MAXIMUM|MEDIUM|MEMBERS|MEMORY|MESH|MESSAGE|MESSAGE-ID|MESSAGES|MESSAGING|METHOD|METHODS|MIN|MINIMUM|MINOR-ID|MM\/DD\/YY|MM\/DD\/YYYY|MMDDYY|MOD|MODE|MODIF|MODIFIER|MODIFY|MODULE|MOVE|MOVE-CORRESPONDING|MULTIPLY|MULTIPLY-CORRESPONDING|NA|NAME|NAMETAB|NATIVE|NB|NE|NESTED|NESTING|NEW|NEW-LINE|NEW-PAGE|NEW-SECTION|NEXT|NO|NO-DISPLAY|NO-EXTENSION|NO-GAP|NO-GAPS|NO-GROUPING|NO-HEADING|NO-SCROLLING|NO-SIGN|NO-TITLE|NO-TOPOFPAGE|NO-ZERO|NODE|NODES|NON-UNICODE|NON-UNIQUE|NOT|NP|NS|NULL|NUMBER|NUMOFCHAR|O|OBJECT|OBJECTS|OBLIGATORY|OCCURRENCE|OCCURRENCES|OCCURS|OF|OFF|OFFSET|OLE|ON|ONLY|OPEN|OPTION|OPTIONAL|OPTIONS|OR|ORDER|OTHER|OTHERS|OUT|OUTER|OUTPUT|OUTPUT-LENGTH|OVERFLOW|OVERLAY|PACK|PACKAGE|PAD|PADDING|PAGE|PAGES|PARAMETER|PARAMETER-TABLE|PARAMETERS|PART|PARTIALLY|PATTERN|PERCENTAGE|PERFORM|PERFORMING|PERSON|PF|PF-STATUS|PINK|PLACES|POOL|POSITION|POS_HIGH|POS_LOW|PRAGMAS|PRECOMPILED|PREFERRED|PRESERVING|PRIMARY|PRINT|PRINT-CONTROL|PRIORITY|PRIVATE|PROCEDURE|PROCESS|PROGRAM|PROPERTY|PROTECTED|PROVIDE|PUBLIC|PUSHBUTTON|PUT|QUEUE-ONLY|QUICKINFO|RADIOBUTTON|RAISE|RAISING|RANGE|RANGES|RAW|READ|READ-ONLY|READER|RECEIVE|RECEIVED|RECEIVER|RECEIVING|RED|REDEFINITION|REDUCE|REDUCED|REF|REFERENCE|REFRESH|REGEX|REJECT|REMOTE|RENAMING|REPLACE|REPLACEMENT|REPLACING|REPORT|REQUEST|REQUESTED|RESERVE|RESET|RESOLUTION|RESPECTING|RESPONSIBLE|RESULT|RESULTS|RESUMABLE|RESUME|RETRY|RETURN|RETURNCODE|RETURNING|RIGHT|RIGHT-JUSTIFIED|RIGHTPLUS|RIGHTSPACE|RISK|RMC_COMMUNICATION_FAILURE|RMC_INVALID_STATUS|RMC_SYSTEM_FAILURE|ROLE|ROLLBACK|ROUND|ROWS|RTTI|RUN|SAP|SAP-SPOOL|SAVING|SCALE_PRESERVING|SCALE_PRESERVING_SCIENTIFIC|SCAN|SCIENTIFIC|SCIENTIFIC_WITH_LEADING_ZERO|SCREEN|SCROLL|SCROLL-BOUNDARY|SCROLLING|SEARCH|SECONDARY|SECONDS|SECTION|SELECT|SELECT-OPTIONS|SELECTION|SELECTION-SCREEN|SELECTION-SET|SELECTION-SETS|SELECTION-TABLE|SELECTIONS|SELECTOR|SEND|SEPARATE|SEPARATED|SET|SHARED|SHIFT|SHORT|SHORTDUMP-ID|SIGN|SIGN_AS_POSTFIX|SIMPLE|SIN|SINGLE|SINH|SIZE|SKIP|SKIPPING|SMART|SOME|SORT|SORTABLE|SORTED|SOURCE|SPACE|SPECIFIED|SPLIT|SPOOL|SPOTS|SQL|SQLSCRIPT|SQRT|STABLE|STAMP|STANDARD|START-OF-SELECTION|STARTING|STATE|STATEMENT|STATEMENTS|STATIC|STATICS|STATUSINFO|STEP-LOOP|STOP|STRLEN|STRUCTURE|STRUCTURES|STYLE|SUBKEY|SUBMATCHES|SUBMIT|SUBROUTINE|SUBSCREEN|SUBSTRING|SUBTRACT|SUBTRACT-CORRESPONDING|SUFFIX|SUM|SUMMARY|SUMMING|SUPPLIED|SUPPLY|SUPPRESS|SWITCH|SWITCHSTATES|SYMBOL|SYNCPOINTS|SYNTAX|SYNTAX-CHECK|SYNTAX-TRACE|SYSTEM-CALL|SYSTEM-EXCEPTIONS|SYSTEM-EXIT|TAB|TABBED|TABLE|TABLES|TABLEVIEW|TABSTRIP|TAN|TANH|TARGET|TASK|TASKS|TEST|TESTING|TEXT|TEXTPOOL|THEN|THROW|TIME|TIMES|TIMESTAMP|TIMEZONE|TITLE|TITLE-LINES|TITLEBAR|TO|TOKENIZATION|TOKENS|TOP-LINES|TOP-OF-PAGE|TRACE-FILE|TRACE-TABLE|TRAILING|TRANSACTION|TRANSFER|TRANSFORMATION|TRANSLATE|TRANSPORTING|TRMAC|TRUNC|TRUNCATE|TRUNCATION|TRY|TYPE|TYPE-POOL|TYPE-POOLS|TYPES|ULINE|UNASSIGN|UNDER|UNICODE|UNION|UNIQUE|UNIT|UNIT_CONVERSION|UNIX|UNPACK|UNTIL|UNWIND|UP|UPDATE|UPPER|USER|USER-COMMAND|USING|UTF-8|VALID|VALUE|VALUE-REQUEST|VALUES|VARY|VARYING|VERIFICATION-MESSAGE|VERSION|VIA|VIEW|VISIBLE|WAIT|WARNING|WHEN|WHENEVER|WHERE|WHILE|WIDTH|WINDOW|WINDOWS|WITH|WITH-HEADING|WITH-TITLE|WITHOUT|WORD|WORK|WRITE|WRITER|X|XML|XOR|XSD|XSTRLEN|YELLOW|YES|YYMMDD|Z|ZERO|ZONE)(?![\w-])/i,lookbehind:!0},number:/\b\d+\b/,operator:{pattern:/(\s)(?:\*\*?|<[=>]?|>=?|\?=|[-+\/=])(?=\s)/,lookbehind:!0},"string-operator":{pattern:/(\s)&&?(?=\s)/,lookbehind:!0,alias:`keyword`},"token-operator":[{pattern:/(\w)(?:->?|=>|[~|{}])(?=\w)/,lookbehind:!0,alias:`punctuation`},{pattern:/[|{}]/,alias:`punctuation`}],punctuation:/[,.:()]/}}x.displayName=`abnf`,x.aliases=[];function x(e){(function(e){var t=`(?:ALPHA|BIT|CHAR|CR|CRLF|CTL|DIGIT|DQUOTE|HEXDIG|HTAB|LF|LWSP|OCTET|SP|VCHAR|WSP)`;e.languages.abnf={comment:/;.*/,string:{pattern:/(?:%[is])?"[^"\n\r]*"/,greedy:!0,inside:{punctuation:/^%[is]/}},range:{pattern:/%(?:b[01]+-[01]+|d\d+-\d+|x[A-F\d]+-[A-F\d]+)/i,alias:`number`},terminal:{pattern:/%(?:b[01]+(?:\.[01]+)*|d\d+(?:\.\d+)*|x[A-F\d]+(?:\.[A-F\d]+)*)/i,alias:`number`},repetition:{pattern:/(^|[^\w-])(?:\d*\*\d*|\d+)/,lookbehind:!0,alias:`operator`},definition:{pattern:/(^[ \t]*)(?:[a-z][\w-]*|<[^<>\r\n]*>)(?=\s*=)/m,lookbehind:!0,alias:`keyword`,inside:{punctuation:/<|>/}},"core-rule":{pattern:RegExp(`(?:(^|[^<\\w-])`+t+`|<`+t+`>)(?![\\w-])`,`i`),lookbehind:!0,alias:[`rule`,`constant`],inside:{punctuation:/<|>/}},rule:{pattern:/(^|[^<\w-])[a-z][\w-]*|<[^<>\r\n]*>/i,lookbehind:!0,inside:{punctuation:/<|>/}},operator:/=\/?|\//,punctuation:/[()\[\]]/}})(e)}S.displayName=`clike`,S.aliases=[];function S(e){e.languages.clike={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"class-name":{pattern:/(\b(?:class|extends|implements|instanceof|interface|new|trait)\s+|\bcatch\s+\()[\w.\\]+/i,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:break|catch|continue|do|else|finally|for|function|if|in|instanceof|new|null|return|throw|try|while)\b/,boolean:/\b(?:false|true)\b/,function:/\b\w+(?=\()/,number:/\b0x[\da-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?/i,operator:/[<>]=?|[!=]=?=?|--?|\+\+?|&&?|\|\|?|[?*/~^%]/,punctuation:/[{}[\];(),.:]/}}C.displayName=`javascript`,C.aliases=[`js`];function C(e){e.register(S),e.languages.javascript=e.languages.extend(`clike`,{"class-name":[e.languages.clike[`class-name`],{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$A-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\.(?:constructor|prototype))/,lookbehind:!0}],keyword:[{pattern:/((?:^|\})\s*)catch\b/,lookbehind:!0},{pattern:/(^|[^.]|\.\.\.\s*)\b(?:as|assert(?=\s*\{)|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally(?=\s*(?:\{|$))|for|from(?=\s*(?:['"]|$))|function|(?:get|set)(?=\s*(?:[#\[$\w\xA0-\uFFFF]|$))|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],function:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,number:{pattern:RegExp(`(^|[^\\w$])(?:NaN|Infinity|0[bB][01]+(?:_[01]+)*n?|0[oO][0-7]+(?:_[0-7]+)*n?|0[xX][\\dA-Fa-f]+(?:_[\\dA-Fa-f]+)*n?|\\d+(?:_\\d+)*n|(?:\\d+(?:_\\d+)*(?:\\.(?:\\d+(?:_\\d+)*)?)?|\\.\\d+(?:_\\d+)*)(?:[Ee][+-]?\\d+(?:_\\d+)*)?)(?![\\w$])`),lookbehind:!0},operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/}),e.languages.javascript[`class-name`][0].pattern=/(\b(?:class|extends|implements|instanceof|interface|new)\s+)[\w.\\]+/,e.languages.insertBefore(`javascript`,`keyword`,{regex:{pattern:RegExp(`((?:^|[^$\\w\\xA0-\\uFFFF."'\\])\\s]|\\b(?:return|yield))\\s*)\\/(?:(?:\\[(?:[^\\]\\\\\\r\\n]|\\\\.)*\\]|\\\\.|[^/\\\\\\[\\r\\n])+\\/[dgimyus]{0,7}|(?:\\[(?:[^[\\]\\\\\\r\\n]|\\\\.|\\[(?:[^[\\]\\\\\\r\\n]|\\\\.|\\[(?:[^[\\]\\\\\\r\\n]|\\\\.)*\\])*\\])*\\]|\\\\.|[^/\\\\\\[\\r\\n])+\\/[dgimyus]{0,7}v[dgimyus]{0,7})(?=(?:\\s|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/)*(?:$|[\\r\\n,.;:})\\]]|\\/\\/))`),lookbehind:!0,greedy:!0,inside:{"regex-source":{pattern:/^(\/)[\s\S]+(?=\/[a-z]*$)/,lookbehind:!0,alias:`language-regex`,inside:e.languages.regex},"regex-delimiter":/^\/|\/$/,"regex-flags":/^[a-z]+$/}},"function-variable":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:`function`},parameter:[{pattern:/(function(?:\s+(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)?\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\))/,lookbehind:!0,inside:e.languages.javascript},{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*=>)/i,lookbehind:!0,inside:e.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*=>)/,lookbehind:!0,inside:e.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*)\(\s*|\]\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*\{)/,lookbehind:!0,inside:e.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),e.languages.insertBefore(`javascript`,`string`,{hashbang:{pattern:/^#!.*/,greedy:!0,alias:`comment`},"template-string":{pattern:/`(?:\\[\s\S]|\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}|(?!\$\{)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:`string`},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`},rest:e.languages.javascript}},string:/[\s\S]+/}},"string-property":{pattern:/((?:^|[,{])[ \t]*)(["'])(?:\\(?:\r\n|[\s\S])|(?!\2)[^\\\r\n])*\2(?=\s*:)/m,lookbehind:!0,greedy:!0,alias:`property`}}),e.languages.insertBefore(`javascript`,`operator`,{"literal-property":{pattern:/((?:^|[,{])[ \t]*)(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*:)/m,lookbehind:!0,alias:`property`}}),e.languages.markup&&(e.languages.markup.tag.addInlined(`script`,`javascript`),e.languages.markup.tag.addAttribute(`on(?:abort|blur|change|click|composition(?:end|start|update)|dblclick|error|focus(?:in|out)?|key(?:down|up)|load|mouse(?:down|enter|leave|move|out|over|up)|reset|resize|scroll|select|slotchange|submit|unload|wheel)`,`javascript`)),e.languages.js=e.languages.javascript}w.displayName=`actionscript`,w.aliases=[];function w(e){e.register(C),e.languages.actionscript=e.languages.extend(`javascript`,{keyword:/\b(?:as|break|case|catch|class|const|default|delete|do|dynamic|each|else|extends|final|finally|for|function|get|if|implements|import|in|include|instanceof|interface|internal|is|namespace|native|new|null|override|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|use|var|void|while|with)\b/,operator:/\+\+|--|(?:[+\-*\/%^]|&&?|\|\|?|<>?>?|[!=]=?)=?|[~?@]/}),e.languages.actionscript[`class-name`].alias=`function`,delete e.languages.actionscript.parameter,delete e.languages.actionscript[`literal-property`],e.languages.markup&&e.languages.insertBefore(`actionscript`,`string`,{xml:{pattern:/(^|[^.])<\/?\w+(?:\s+[^\s>\/=]+=("|')(?:\\[\s\S]|(?!\2)[^\\])*\2)*\s*\/?>/,lookbehind:!0,inside:e.languages.markup}})}T.displayName=`ada`,T.aliases=[];function T(e){e.languages.ada={comment:/--.*/,string:/"(?:""|[^"\r\f\n])*"/,number:[{pattern:/\b\d(?:_?\d)*#[\dA-F](?:_?[\dA-F])*(?:\.[\dA-F](?:_?[\dA-F])*)?#(?:E[+-]?\d(?:_?\d)*)?/i},{pattern:/\b\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:E[+-]?\d(?:_?\d)*)?\b/i}],attribute:{pattern:/\b'\w+/,alias:`attr-name`},keyword:/\b(?:abort|abs|abstract|accept|access|aliased|all|and|array|at|begin|body|case|constant|declare|delay|delta|digits|do|else|elsif|end|entry|exception|exit|for|function|generic|goto|if|in|interface|is|limited|loop|mod|new|not|null|of|or|others|out|overriding|package|pragma|private|procedure|protected|raise|range|record|rem|renames|requeue|return|reverse|select|separate|some|subtype|synchronized|tagged|task|terminate|then|type|until|use|when|while|with|xor)\b/i,boolean:/\b(?:false|true)\b/i,operator:/<[=>]?|>=?|=>?|:=|\/=?|\*\*?|[&+-]/,punctuation:/\.\.?|[,;():]/,char:/'.'/,variable:/\b[a-z](?:\w)*\b/i}}E.displayName=`agda`,E.aliases=[];function E(e){(function(e){e.languages.agda={comment:/\{-[\s\S]*?(?:-\}|$)|--.*/,string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},punctuation:/[(){}⦃⦄.;@]/,"class-name":{pattern:/((?:data|record) +)\S+/,lookbehind:!0},function:{pattern:/(^[ \t]*)(?!\s)[^:\r\n]+(?=:)/m,lookbehind:!0},operator:{pattern:/(^\s*|\s)(?:[=|:∀→λ\\?_]|->)(?=\s)/,lookbehind:!0},keyword:/\b(?:Set|abstract|constructor|data|eta-equality|field|forall|hiding|import|in|inductive|infix|infixl|infixr|instance|let|macro|module|mutual|no-eta-equality|open|overlap|pattern|postulate|primitive|private|public|quote|quoteContext|quoteGoal|quoteTerm|record|renaming|rewrite|syntax|tactic|unquote|unquoteDecl|unquoteDef|using|variable|where|with)\b/}})(e)}D.displayName=`al`,D.aliases=[];function D(e){e.languages.al={comment:/\/\/.*|\/\*[\s\S]*?\*\//,string:{pattern:/'(?:''|[^'\r\n])*'(?!')|"(?:""|[^"\r\n])*"(?!")/,greedy:!0},function:{pattern:/(\b(?:event|procedure|trigger)\s+|(?:^|[^.])\.\s*)[a-z_]\w*(?=\s*\()/i,lookbehind:!0},keyword:[/\b(?:array|asserterror|begin|break|case|do|downto|else|end|event|exit|for|foreach|function|if|implements|in|indataset|interface|internal|local|of|procedure|program|protected|repeat|runonclient|securityfiltering|suppressdispose|temporary|then|to|trigger|until|var|while|with|withevents)\b/i,/\b(?:action|actions|addafter|addbefore|addfirst|addlast|area|assembly|chartpart|codeunit|column|controladdin|cuegroup|customizes|dataitem|dataset|dotnet|elements|enum|enumextension|extends|field|fieldattribute|fieldelement|fieldgroup|fieldgroups|fields|filter|fixed|grid|group|key|keys|label|labels|layout|modify|moveafter|movebefore|movefirst|movelast|page|pagecustomization|pageextension|part|profile|query|repeater|report|requestpage|schema|separator|systempart|table|tableelement|tableextension|textattribute|textelement|type|usercontrol|value|xmlport)\b/i],number:/\b(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?)(?:F|LL?|U(?:LL?)?)?\b/i,boolean:/\b(?:false|true)\b/i,variable:/\b(?:Curr(?:FieldNo|Page|Report)|x?Rec|RequestOptionsPage)\b/,"class-name":/\b(?:automation|biginteger|bigtext|blob|boolean|byte|char|clienttype|code|completiontriggererrorlevel|connectiontype|database|dataclassification|datascope|date|dateformula|datetime|decimal|defaultlayout|dialog|dictionary|dotnetassembly|dotnettypedeclaration|duration|errorinfo|errortype|executioncontext|executionmode|fieldclass|fieldref|fieldtype|file|filterpagebuilder|guid|httpclient|httpcontent|httpheaders|httprequestmessage|httpresponsemessage|instream|integer|joker|jsonarray|jsonobject|jsontoken|jsonvalue|keyref|list|moduledependencyinfo|moduleinfo|none|notification|notificationscope|objecttype|option|outstream|pageresult|record|recordid|recordref|reportformat|securityfilter|sessionsettings|tableconnectiontype|tablefilter|testaction|testfield|testfilterfield|testpage|testpermissions|testrequestpage|text|textbuilder|textconst|textencoding|time|transactionmodel|transactiontype|variant|verbosity|version|view|views|webserviceactioncontext|webserviceactionresultcode|xmlattribute|xmlattributecollection|xmlcdata|xmlcomment|xmldeclaration|xmldocument|xmldocumenttype|xmlelement|xmlnamespacemanager|xmlnametable|xmlnode|xmlnodelist|xmlprocessinginstruction|xmlreadoptions|xmltext|xmlwriteoptions)\b/i,operator:/\.\.|:[=:]|[-+*/]=?|<>|[<>]=?|=|\b(?:and|div|mod|not|or|xor)\b/i,punctuation:/[()\[\]{}:.;,]/}}O.displayName=`antlr4`,O.aliases=[`g4`];function O(e){e.languages.antlr4={comment:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,string:{pattern:/'(?:\\.|[^\\'\r\n])*'/,greedy:!0},"character-class":{pattern:/\[(?:\\.|[^\\\]\r\n])*\]/,greedy:!0,alias:`regex`,inside:{range:{pattern:/([^[]|(?:^|[^\\])(?:\\\\)*\\\[)-(?!\])/,lookbehind:!0,alias:`punctuation`},escape:/\\(?:u(?:[a-fA-F\d]{4}|\{[a-fA-F\d]+\})|[pP]\{[=\w-]+\}|[^\r\nupP])/,punctuation:/[\[\]]/}},action:{pattern:/\{(?:[^{}]|\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\})*\}/,greedy:!0,inside:{content:{pattern:/(\{)[\s\S]+(?=\})/,lookbehind:!0},punctuation:/[{}]/}},command:{pattern:/(->\s*(?!\s))(?:\s*(?:,\s*)?\b[a-z]\w*(?:\s*\([^()\r\n]*\))?)+(?=\s*;)/i,lookbehind:!0,inside:{function:/\b\w+(?=\s*(?:[,(]|$))/,punctuation:/[,()]/}},annotation:{pattern:/@\w+(?:::\w+)*/,alias:`keyword`},label:{pattern:/#[ \t]*\w+/,alias:`punctuation`},keyword:/\b(?:catch|channels|finally|fragment|grammar|import|lexer|locals|mode|options|parser|returns|throws|tokens)\b/,definition:[{pattern:/\b[a-z]\w*(?=\s*:)/,alias:[`rule`,`class-name`]},{pattern:/\b[A-Z]\w*(?=\s*:)/,alias:[`token`,`constant`]}],constant:/\b[A-Z][A-Z_]*\b/,operator:/\.\.|->|[|~]|[*+?]\??/,punctuation:/[;:()=]/},e.languages.g4=e.languages.antlr4}k.displayName=`apacheconf`,k.aliases=[];function k(e){e.languages.apacheconf={comment:/#.*/,"directive-inline":{pattern:/(^[\t ]*)\b(?:AcceptFilter|AcceptPathInfo|AccessFileName|Action|Add(?:Alt|AltByEncoding|AltByType|Charset|DefaultCharset|Description|Encoding|Handler|Icon|IconByEncoding|IconByType|InputFilter|Language|ModuleInfo|OutputFilter|OutputFilterByType|Type)|Alias|AliasMatch|Allow(?:CONNECT|EncodedSlashes|Methods|Override|OverrideList)?|Anonymous(?:_LogEmail|_MustGiveEmail|_NoUserID|_VerifyEmail)?|AsyncRequestWorkerFactor|Auth(?:BasicAuthoritative|BasicFake|BasicProvider|BasicUseDigestAlgorithm|DBDUserPWQuery|DBDUserRealmQuery|DBMGroupFile|DBMType|DBMUserFile|Digest(?:Algorithm|Domain|NonceLifetime|Provider|Qop|ShmemSize)|Form(?:Authoritative|Body|DisableNoStore|FakeBasicAuth|Location|LoginRequiredLocation|LoginSuccessLocation|LogoutLocation|Method|Mimetype|Password|Provider|SitePassphrase|Size|Username)|GroupFile|LDAP(?:AuthorizePrefix|BindAuthoritative|BindDN|BindPassword|CharsetConfig|CompareAsUser|CompareDNOnServer|DereferenceAliases|GroupAttribute|GroupAttributeIsDN|InitialBindAsUser|InitialBindPattern|MaxSubGroupDepth|RemoteUserAttribute|RemoteUserIsDN|SearchAsUser|SubGroupAttribute|SubGroupClass|Url)|Merging|Name|nCache(?:Context|Enable|ProvideFor|SOCache|Timeout)|nzFcgiCheckAuthnProvider|nzFcgiDefineProvider|Type|UserFile|zDBDLoginToReferer|zDBDQuery|zDBDRedirectQuery|zDBMType|zSendForbiddenOnFailure)|BalancerGrowth|BalancerInherit|BalancerMember|BalancerPersist|BrowserMatch|BrowserMatchNoCase|BufferedLogs|BufferSize|Cache(?:DefaultExpire|DetailHeader|DirLength|DirLevels|Disable|Enable|File|Header|IgnoreCacheControl|IgnoreHeaders|IgnoreNoLastMod|IgnoreQueryString|IgnoreURLSessionIdentifiers|KeyBaseURL|LastModifiedFactor|Lock|LockMaxAge|LockPath|MaxExpire|MaxFileSize|MinExpire|MinFileSize|NegotiatedDocs|QuickHandler|ReadSize|ReadTime|Root|Socache(?:MaxSize|MaxTime|MinTime|ReadSize|ReadTime)?|StaleOnError|StoreExpired|StoreNoStore|StorePrivate)|CGIDScriptTimeout|CGIMapExtension|CharsetDefault|CharsetOptions|CharsetSourceEnc|CheckCaseOnly|CheckSpelling|ChrootDir|ContentDigest|CookieDomain|CookieExpires|CookieName|CookieStyle|CookieTracking|CoreDumpDirectory|CustomLog|Dav|DavDepthInfinity|DavGenericLockDB|DavLockDB|DavMinTimeout|DBDExptime|DBDInitSQL|DBDKeep|DBDMax|DBDMin|DBDParams|DBDPersist|DBDPrepareSQL|DBDriver|DefaultIcon|DefaultLanguage|DefaultRuntimeDir|DefaultType|Define|Deflate(?:BufferSize|CompressionLevel|FilterNote|InflateLimitRequestBody|InflateRatio(?:Burst|Limit)|MemLevel|WindowSize)|Deny|DirectoryCheckHandler|DirectoryIndex|DirectoryIndexRedirect|DirectorySlash|DocumentRoot|DTracePrivileges|DumpIOInput|DumpIOOutput|EnableExceptionHook|EnableMMAP|EnableSendfile|Error|ErrorDocument|ErrorLog|ErrorLogFormat|Example|ExpiresActive|ExpiresByType|ExpiresDefault|ExtendedStatus|ExtFilterDefine|ExtFilterOptions|FallbackResource|FileETag|FilterChain|FilterDeclare|FilterProtocol|FilterProvider|FilterTrace|ForceLanguagePriority|ForceType|ForensicLog|GprofDir|GracefulShutdownTimeout|Group|Header|HeaderName|Heartbeat(?:Address|Listen|MaxServers|Storage)|HostnameLookups|IdentityCheck|IdentityCheckTimeout|ImapBase|ImapDefault|ImapMenu|Include|IncludeOptional|Index(?:HeadInsert|Ignore|IgnoreReset|Options|OrderDefault|StyleSheet)|InputSed|ISAPI(?:AppendLogToErrors|AppendLogToQuery|CacheFile|FakeAsync|LogNotSupported|ReadAheadBuffer)|KeepAlive|KeepAliveTimeout|KeptBodySize|LanguagePriority|LDAP(?:CacheEntries|CacheTTL|ConnectionPoolTTL|ConnectionTimeout|LibraryDebug|OpCacheEntries|OpCacheTTL|ReferralHopLimit|Referrals|Retries|RetryDelay|SharedCacheFile|SharedCacheSize|Timeout|TrustedClientCert|TrustedGlobalCert|TrustedMode|VerifyServerCert)|Limit(?:InternalRecursion|Request(?:Body|Fields|FieldSize|Line)|XMLRequestBody)|Listen|ListenBackLog|LoadFile|LoadModule|LogFormat|LogLevel|LogMessage|LuaAuthzProvider|LuaCodeCache|Lua(?:Hook(?:AccessChecker|AuthChecker|CheckUserID|Fixups|InsertFilter|Log|MapToStorage|TranslateName|TypeChecker)|Inherit|InputFilter|MapHandler|OutputFilter|PackageCPath|PackagePath|QuickHandler|Root|Scope)|Max(?:ConnectionsPerChild|KeepAliveRequests|MemFree|RangeOverlaps|RangeReversals|Ranges|RequestWorkers|SpareServers|SpareThreads|Threads)|MergeTrailers|MetaDir|MetaFiles|MetaSuffix|MimeMagicFile|MinSpareServers|MinSpareThreads|MMapFile|ModemStandard|ModMimeUsePathInfo|MultiviewsMatch|Mutex|NameVirtualHost|NoProxy|NWSSLTrustedCerts|NWSSLUpgradeable|Options|Order|OutputSed|PassEnv|PidFile|PrivilegesMode|Protocol|ProtocolEcho|Proxy(?:AddHeaders|BadHeader|Block|Domain|ErrorOverride|ExpressDBMFile|ExpressDBMType|ExpressEnable|FtpDirCharset|FtpEscapeWildcards|FtpListOnWildcard|HTML(?:BufSize|CharsetOut|DocType|Enable|Events|Extended|Fixups|Interp|Links|Meta|StripComments|URLMap)|IOBufferSize|MaxForwards|Pass(?:Inherit|InterpolateEnv|Match|Reverse|ReverseCookieDomain|ReverseCookiePath)?|PreserveHost|ReceiveBufferSize|Remote|RemoteMatch|Requests|SCGIInternalRedirect|SCGISendfile|Set|SourceAddress|Status|Timeout|Via)|ReadmeName|ReceiveBufferSize|Redirect|RedirectMatch|RedirectPermanent|RedirectTemp|ReflectorHeader|RemoteIP(?:Header|InternalProxy|InternalProxyList|ProxiesHeader|TrustedProxy|TrustedProxyList)|RemoveCharset|RemoveEncoding|RemoveHandler|RemoveInputFilter|RemoveLanguage|RemoveOutputFilter|RemoveType|RequestHeader|RequestReadTimeout|Require|Rewrite(?:Base|Cond|Engine|Map|Options|Rule)|RLimitCPU|RLimitMEM|RLimitNPROC|Satisfy|ScoreBoardFile|Script(?:Alias|AliasMatch|InterpreterSource|Log|LogBuffer|LogLength|Sock)?|SecureListen|SeeRequestTail|SendBufferSize|Server(?:Admin|Alias|Limit|Name|Path|Root|Signature|Tokens)|Session(?:Cookie(?:Name|Name2|Remove)|Crypto(?:Cipher|Driver|Passphrase|PassphraseFile)|DBD(?:CookieName|CookieName2|CookieRemove|DeleteLabel|InsertLabel|PerUser|SelectLabel|UpdateLabel)|Env|Exclude|Header|Include|MaxAge)?|SetEnv|SetEnvIf|SetEnvIfExpr|SetEnvIfNoCase|SetHandler|SetInputFilter|SetOutputFilter|SSIEndTag|SSIErrorMsg|SSIETag|SSILastModified|SSILegacyExprParser|SSIStartTag|SSITimeFormat|SSIUndefinedEcho|SSL(?:CACertificateFile|CACertificatePath|CADNRequestFile|CADNRequestPath|CARevocationCheck|CARevocationFile|CARevocationPath|CertificateChainFile|CertificateFile|CertificateKeyFile|CipherSuite|Compression|CryptoDevice|Engine|FIPS|HonorCipherOrder|InsecureRenegotiation|OCSP(?:DefaultResponder|Enable|OverrideResponder|ResponderTimeout|ResponseMaxAge|ResponseTimeSkew|UseRequestNonce)|OpenSSLConfCmd|Options|PassPhraseDialog|Protocol|Proxy(?:CACertificateFile|CACertificatePath|CARevocation(?:Check|File|Path)|CheckPeer(?:CN|Expire|Name)|CipherSuite|Engine|MachineCertificate(?:ChainFile|File|Path)|Protocol|Verify|VerifyDepth)|RandomSeed|RenegBufferSize|Require|RequireSSL|Session(?:Cache|CacheTimeout|TicketKeyFile|Tickets)|SRPUnknownUserSeed|SRPVerifierFile|Stapling(?:Cache|ErrorCacheTimeout|FakeTryLater|ForceURL|ResponderTimeout|ResponseMaxAge|ResponseTimeSkew|ReturnResponderErrors|StandardCacheTimeout)|StrictSNIVHostCheck|UserName|UseStapling|VerifyClient|VerifyDepth)|StartServers|StartThreads|Substitute|Suexec|SuexecUserGroup|ThreadLimit|ThreadsPerChild|ThreadStackSize|TimeOut|TraceEnable|TransferLog|TypesConfig|UnDefine|UndefMacro|UnsetEnv|Use|UseCanonicalName|UseCanonicalPhysicalPort|User|UserDir|VHostCGIMode|VHostCGIPrivs|VHostGroup|VHostPrivs|VHostSecure|VHostUser|Virtual(?:DocumentRoot|ScriptAlias)(?:IP)?|WatchdogInterval|XBitHack|xml2EncAlias|xml2EncDefault|xml2StartParse)\b/im,lookbehind:!0,alias:`property`},"directive-block":{pattern:/<\/?\b(?:Auth[nz]ProviderAlias|Directory|DirectoryMatch|Else|ElseIf|Files|FilesMatch|If|IfDefine|IfModule|IfVersion|Limit|LimitExcept|Location|LocationMatch|Macro|Proxy|Require(?:All|Any|None)|VirtualHost)\b.*>/i,inside:{"directive-block":{pattern:/^<\/?\w+/,inside:{punctuation:/^<\/?/},alias:`tag`},"directive-block-parameter":{pattern:/.*[^>]/,inside:{punctuation:/:/,string:{pattern:/("|').*\1/,inside:{variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/}}},alias:`attr-value`},punctuation:/>/},alias:`tag`},"directive-flags":{pattern:/\[(?:[\w=],?)+\]/,alias:`keyword`},string:{pattern:/("|').*\1/,inside:{variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/}},variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/,regex:/\^?.*\$|\^.*\$?/}}A.displayName=`sql`,A.aliases=[];function A(e){e.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},identifier:{pattern:/(^|[^@\\])`(?:\\[\s\S]|[^`\\]|``)*`/,greedy:!0,lookbehind:!0,inside:{punctuation:/^`|`$/}},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:COL|_INSERT)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURN(?:ING|S)?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:FALSE|NULL|TRUE)\b/i,number:/\b0x[\da-f]+\b|\b\d+(?:\.\d*)?|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|DIV|ILIKE|IN|IS|LIKE|NOT|OR|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/}}j.displayName=`apex`,j.aliases=[];function j(e){e.register(S),e.register(A),(function(e){var t=/\b(?:(?:after|before)(?=\s+[a-z])|abstract|activate|and|any|array|as|asc|autonomous|begin|bigdecimal|blob|boolean|break|bulk|by|byte|case|cast|catch|char|class|collect|commit|const|continue|currency|date|datetime|decimal|default|delete|desc|do|double|else|end|enum|exception|exit|export|extends|final|finally|float|for|from|get(?=\s*[{};])|global|goto|group|having|hint|if|implements|import|in|inner|insert|instanceof|int|integer|interface|into|join|like|limit|list|long|loop|map|merge|new|not|null|nulls|number|object|of|on|or|outer|override|package|parallel|pragma|private|protected|public|retrieve|return|rollback|select|set|short|sObject|sort|static|string|super|switch|synchronized|system|testmethod|then|this|throw|time|transaction|transient|trigger|try|undelete|update|upsert|using|virtual|void|webservice|when|where|while|(?:inherited|with|without)\s+sharing)\b/i,n=`\\b(?:(?=[a-z_]\\w*\\s*[<\\[])|(?!))[A-Z_]\\w*(?:\\s*\\.\\s*[A-Z_]\\w*)*\\b(?:\\s*(?:\\[\\s*\\]|<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>))*`.replace(//g,function(){return t.source});function r(e){return RegExp(e.replace(//g,function(){return n}),`i`)}var i={keyword:t,punctuation:/[()\[\]{};,:.<>]/};e.languages.apex={comment:e.languages.clike.comment,string:e.languages.clike.string,sql:{pattern:/((?:[=,({:]|\breturn)\s*)\[[^\[\]]*\]/i,lookbehind:!0,greedy:!0,alias:`language-sql`,inside:e.languages.sql},annotation:{pattern:/@\w+\b/,alias:`punctuation`},"class-name":[{pattern:r(`(\\b(?:class|enum|extends|implements|instanceof|interface|new|trigger\\s+\\w+\\s+on)\\s+)`),lookbehind:!0,inside:i},{pattern:r(`(\\(\\s*)(?=\\s*\\)\\s*[\\w(])`),lookbehind:!0,inside:i},{pattern:r(`(?=\\s*\\w+\\s*[;=,(){:])`),inside:i}],trigger:{pattern:/(\btrigger\s+)\w+\b/i,lookbehind:!0,alias:`class-name`},keyword:t,function:/\b[a-z_]\w*(?=\s*\()/i,boolean:/\b(?:false|true)\b/i,number:/(?:\B\.\d+|\b\d+(?:\.\d+|L)?)\b/i,operator:/[!=](?:==?)?|\?\.?|&&|\|\||--|\+\+|[-+*/^&|]=?|:|<{1,3}=?/,punctuation:/[()\[\]{};,.]/}})(e)}M.displayName=`apl`,M.aliases=[];function M(e){e.languages.apl={comment:/(?:⍝|#[! ]).*$/m,string:{pattern:/'(?:[^'\r\n]|'')*'/,greedy:!0},number:/¯?(?:\d*\.?\b\d+(?:e[+¯]?\d+)?|¯|∞)(?:j¯?(?:(?:\d+(?:\.\d+)?|\.\d+)(?:e[+¯]?\d+)?|¯|∞))?/i,statement:/:[A-Z][a-z][A-Za-z]*\b/,"system-function":{pattern:/⎕[A-Z]+/i,alias:`function`},constant:/[⍬⌾#⎕⍞]/,function:/[-+×÷⌈⌊∣|⍳⍸?*⍟○!⌹<≤=>≥≠≡≢∊⍷∪∩~∨∧⍱⍲⍴,⍪⌽⊖⍉↑↓⊂⊃⊆⊇⌷⍋⍒⊤⊥⍕⍎⊣⊢⍁⍂≈⍯↗¤→]/,"monadic-operator":{pattern:/[\\\/⌿⍀¨⍨⌶&∥]/,alias:`operator`},"dyadic-operator":{pattern:/[.⍣⍠⍤∘⌸@⌺⍥]/,alias:`operator`},assignment:{pattern:/←/,alias:`keyword`},punctuation:/[\[;\]()◇⋄]/,dfn:{pattern:/[{}⍺⍵⍶⍹∇⍫:]/,alias:`builtin`}}}N.displayName=`applescript`,N.aliases=[];function N(e){e.languages.applescript={comment:[/\(\*(?:\(\*(?:[^*]|\*(?!\)))*\*\)|(?!\(\*)[\s\S])*?\*\)/,/--.+/,/#.+/],string:/"(?:\\.|[^"\\\r\n])*"/,number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e-?\d+)?\b/i,operator:[/[&=≠≤≥*+\-\/÷^]|[<>]=?/,/\b(?:(?:begin|end|start)s? with|(?:contains?|(?:does not|doesn't) contain)|(?:is|isn't|is not) (?:contained by|in)|(?:(?:is|isn't|is not) )?(?:greater|less) than(?: or equal)?(?: to)?|(?:comes|(?:does not|doesn't) come) (?:after|before)|(?:is|isn't|is not) equal(?: to)?|(?:(?:does not|doesn't) equal|equal to|equals|is not|isn't)|(?:a )?(?:ref(?: to)?|reference to)|(?:and|as|div|mod|not|or))\b/],keyword:/\b(?:about|above|after|against|apart from|around|aside from|at|back|before|beginning|behind|below|beneath|beside|between|but|by|considering|continue|copy|does|eighth|else|end|equal|error|every|exit|false|fifth|first|for|fourth|from|front|get|given|global|if|ignoring|in|instead of|into|is|it|its|last|local|me|middle|my|ninth|of|on|onto|out of|over|prop|property|put|repeat|return|returning|second|set|seventh|since|sixth|some|tell|tenth|that|the|then|third|through|thru|timeout|times|to|transaction|true|try|until|where|while|whose|with|without)\b/,"class-name":/\b(?:POSIX file|RGB color|alias|application|boolean|centimeters|centimetres|class|constant|cubic centimeters|cubic centimetres|cubic feet|cubic inches|cubic meters|cubic metres|cubic yards|date|degrees Celsius|degrees Fahrenheit|degrees Kelvin|feet|file|gallons|grams|inches|integer|kilograms|kilometers|kilometres|list|liters|litres|meters|metres|miles|number|ounces|pounds|quarts|real|record|reference|script|square feet|square kilometers|square kilometres|square meters|square metres|square miles|square yards|text|yards)\b/,punctuation:/[{}():,¬«»《》]/}}P.displayName=`aql`,P.aliases=[];function P(e){e.languages.aql={comment:/\/\/.*|\/\*[\s\S]*?\*\//,property:{pattern:/([{,]\s*)(?:(?!\d)\w+|(["'´`])(?:(?!\2)[^\\\r\n]|\\.)*\2)(?=\s*:)/,lookbehind:!0,greedy:!0},string:{pattern:/(["'])(?:(?!\1)[^\\\r\n]|\\.)*\1/,greedy:!0},identifier:{pattern:/([´`])(?:(?!\1)[^\\\r\n]|\\.)*\1/,greedy:!0},variable:/@@?\w+/,keyword:[{pattern:/(\bWITH\s+)COUNT(?=\s+INTO\b)/i,lookbehind:!0},/\b(?:AGGREGATE|ALL|AND|ANY|ASC|COLLECT|DESC|DISTINCT|FILTER|FOR|GRAPH|IN|INBOUND|INSERT|INTO|K_PATHS|K_SHORTEST_PATHS|LET|LIKE|LIMIT|NONE|NOT|NULL|OR|OUTBOUND|REMOVE|REPLACE|RETURN|SHORTEST_PATH|SORT|UPDATE|UPSERT|WINDOW|WITH)\b/i,{pattern:/(^|[^\w.[])(?:KEEP|PRUNE|SEARCH|TO)\b/i,lookbehind:!0},{pattern:/(^|[^\w.[])(?:CURRENT|NEW|OLD)\b/,lookbehind:!0},{pattern:/\bOPTIONS(?=\s*\{)/i}],function:/\b(?!\d)\w+(?=\s*\()/,boolean:/\b(?:false|true)\b/i,range:{pattern:/\.\./,alias:`operator`},number:[/\b0b[01]+/i,/\b0x[0-9a-f]+/i,/(?:\B\.\d+|\b(?:0|[1-9]\d*)(?:\.\d+)?)(?:e[+-]?\d+)?/i],operator:/\*{2,}|[=!]~|[!=<>]=?|&&|\|\||[-+*/%]/,punctuation:/::|[?.:,;()[\]{}]/}}F.displayName=`c`,F.aliases=[];function F(e){e.register(S),e.languages.c=e.languages.extend(`clike`,{comment:{pattern:/\/\/(?:[^\r\n\\]|\\(?:\r\n?|\n|(?![\r\n])))*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},"class-name":{pattern:/(\b(?:enum|struct)\s+(?:__attribute__\s*\(\([\s\S]*?\)\)\s*)?)\w+|\b[a-z]\w*_t\b/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|__attribute__|asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|inline|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|typeof|union|unsigned|void|volatile|while)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/(?:\b0x(?:[\da-f]+(?:\.[\da-f]*)?|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?)[ful]{0,4}/i,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/}),e.languages.insertBefore(`c`,`string`,{char:{pattern:/'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n]){0,32}'/,greedy:!0}}),e.languages.insertBefore(`c`,`string`,{macro:{pattern:/(^[\t ]*)#\s*[a-z](?:[^\r\n\\/]|\/(?!\*)|\/\*(?:[^*]|\*(?!\/))*\*\/|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,greedy:!0,alias:`property`,inside:{string:[{pattern:/^(#\s*include\s*)<[^>]+>/,lookbehind:!0},e.languages.c.string],char:e.languages.c.char,comment:e.languages.c.comment,"macro-name":[{pattern:/(^#\s*define\s+)\w+\b(?!\()/i,lookbehind:!0},{pattern:/(^#\s*define\s+)\w+\b(?=\()/i,lookbehind:!0,alias:`function`}],directive:{pattern:/^(#\s*)[a-z]+/,lookbehind:!0,alias:`keyword`},"directive-hash":/^#/,punctuation:/##|\\(?=[\r\n])/,expression:{pattern:/\S[\s\S]*/,inside:e.languages.c}}}}),e.languages.insertBefore(`c`,`function`,{constant:/\b(?:EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|__DATE__|__FILE__|__LINE__|__TIMESTAMP__|__TIME__|__func__|stderr|stdin|stdout)\b/}),delete e.languages.c.boolean}I.displayName=`cpp`,I.aliases=[];function I(e){e.register(F),(function(e){var t=/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|char8_t|class|co_await|co_return|co_yield|compl|concept|const|const_cast|consteval|constexpr|constinit|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|final|float|for|friend|goto|if|import|inline|int|int16_t|int32_t|int64_t|int8_t|long|module|mutable|namespace|new|noexcept|nullptr|operator|override|private|protected|public|register|reinterpret_cast|requires|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|uint16_t|uint32_t|uint64_t|uint8_t|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,n=`\\b(?!)\\w+(?:\\s*\\.\\s*\\w+)*\\b`.replace(//g,function(){return t.source});e.languages.cpp=e.languages.extend(`c`,{"class-name":[{pattern:RegExp(`(\\b(?:class|concept|enum|struct|typename)\\s+)(?!)\\w+`.replace(//g,function(){return t.source})),lookbehind:!0},/\b[A-Z]\w*(?=\s*::\s*\w+\s*\()/,/\b[A-Z_]\w*(?=\s*::\s*~\w+\s*\()/i,/\b\w+(?=\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>\s*::\s*\w+\s*\()/],keyword:t,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+(?:\.[\da-f']*)?|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+(?:\.[\d']*)?|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]{0,4}/i,greedy:!0},operator:/>>=?|<<=?|->|--|\+\+|&&|\|\||[?:~]|<=>|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:false|true)\b/}),e.languages.insertBefore(`cpp`,`string`,{module:{pattern:RegExp(`(\\b(?:import|module)\\s+)(?:"(?:\\\\(?:\\r\\n|[\\s\\S])|[^"\\\\\\r\\n])*"|<[^<>\\r\\n]*>|`+`(?:\\s*:\\s*)?|:\\s*`.replace(//g,function(){return n})+`)`),lookbehind:!0,greedy:!0,inside:{string:/^[<"][\s\S]+/,operator:/:/,punctuation:/\./}},"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:`string`,greedy:!0}}),e.languages.insertBefore(`cpp`,`keyword`,{"generic-function":{pattern:/\b(?!operator\b)[a-z_]\w*\s*<(?:[^<>]|<[^<>]*>)*>(?=\s*\()/i,inside:{function:/^\w+/,generic:{pattern:/<[\s\S]+/,alias:`class-name`,inside:e.languages.cpp}}}}),e.languages.insertBefore(`cpp`,`operator`,{"double-colon":{pattern:/::/,alias:`punctuation`}}),e.languages.insertBefore(`cpp`,`class-name`,{"base-clause":{pattern:/(\b(?:class|struct)\s+\w+\s*:\s*)[^;{}"'\s]+(?:\s+[^;{}"'\s]+)*(?=\s*[;{])/,lookbehind:!0,greedy:!0,inside:e.languages.extend(`cpp`,{})}}),e.languages.insertBefore(`inside`,`double-colon`,{"class-name":/\b[a-z_]\w*\b(?!\s*::)/i},e.languages.cpp[`base-clause`])})(e)}ee.displayName=`arduino`,ee.aliases=[`ino`];function ee(e){e.register(I),e.languages.arduino=e.languages.extend(`cpp`,{keyword:/\b(?:String|array|bool|boolean|break|byte|case|catch|continue|default|do|double|else|finally|for|function|goto|if|in|instanceof|int|integer|long|loop|new|null|return|setup|string|switch|throw|try|void|while|word)\b/,constant:/\b(?:ANALOG_MESSAGE|DEFAULT|DIGITAL_MESSAGE|EXTERNAL|FIRMATA_STRING|HIGH|INPUT|INPUT_PULLUP|INTERNAL|INTERNAL1V1|INTERNAL2V56|LED_BUILTIN|LOW|OUTPUT|REPORT_ANALOG|REPORT_DIGITAL|SET_PIN_MODE|SYSEX_START|SYSTEM_RESET)\b/,builtin:/\b(?:Audio|BSSID|Bridge|Client|Console|EEPROM|Esplora|EsploraTFT|Ethernet|EthernetClient|EthernetServer|EthernetUDP|File|FileIO|FileSystem|Firmata|GPRS|GSM|GSMBand|GSMClient|GSMModem|GSMPIN|GSMScanner|GSMServer|GSMVoiceCall|GSM_SMS|HttpClient|IPAddress|IRread|Keyboard|KeyboardController|LiquidCrystal|LiquidCrystal_I2C|Mailbox|Mouse|MouseController|PImage|Process|RSSI|RobotControl|RobotMotor|SD|SPI|SSID|Scheduler|Serial|Server|Servo|SoftwareSerial|Stepper|Stream|TFT|Task|USBHost|WiFi|WiFiClient|WiFiServer|WiFiUDP|Wire|YunClient|YunServer|abs|addParameter|analogRead|analogReadResolution|analogReference|analogWrite|analogWriteResolution|answerCall|attach|attachGPRS|attachInterrupt|attached|autoscroll|available|background|beep|begin|beginPacket|beginSD|beginSMS|beginSpeaker|beginTFT|beginTransmission|beginWrite|bit|bitClear|bitRead|bitSet|bitWrite|blink|blinkVersion|buffer|changePIN|checkPIN|checkPUK|checkReg|circle|cityNameRead|cityNameWrite|clear|clearScreen|click|close|compassRead|config|connect|connected|constrain|cos|countryNameRead|countryNameWrite|createChar|cursor|debugPrint|delay|delayMicroseconds|detach|detachInterrupt|digitalRead|digitalWrite|disconnect|display|displayLogos|drawBMP|drawCompass|encryptionType|end|endPacket|endSMS|endTransmission|endWrite|exists|exitValue|fill|find|findUntil|flush|gatewayIP|get|getAsynchronously|getBand|getButton|getCurrentCarrier|getIMEI|getKey|getModifiers|getOemKey|getPINUsed|getResult|getSignalStrength|getSocket|getVoiceCallStatus|getXChange|getYChange|hangCall|height|highByte|home|image|interrupts|isActionDone|isDirectory|isListening|isPIN|isPressed|isValid|keyPressed|keyReleased|keyboardRead|knobRead|leftToRight|line|lineFollowConfig|listen|listenOnLocalhost|loadImage|localIP|lowByte|macAddress|maintain|map|max|messageAvailable|micros|millis|min|mkdir|motorsStop|motorsWrite|mouseDragged|mouseMoved|mousePressed|mouseReleased|move|noAutoscroll|noBlink|noBuffer|noCursor|noDisplay|noFill|noInterrupts|noListenOnLocalhost|noStroke|noTone|onReceive|onRequest|open|openNextFile|overflow|parseCommand|parseFloat|parseInt|parsePacket|pauseMode|peek|pinMode|playFile|playMelody|point|pointTo|position|pow|prepare|press|print|printFirmwareVersion|printVersion|println|process|processInput|pulseIn|put|random|randomSeed|read|readAccelerometer|readBlue|readButton|readBytes|readBytesUntil|readGreen|readJoystickButton|readJoystickSwitch|readJoystickX|readJoystickY|readLightSensor|readMessage|readMicrophone|readNetworks|readRed|readSlider|readString|readStringUntil|readTemperature|ready|rect|release|releaseAll|remoteIP|remoteNumber|remotePort|remove|requestFrom|retrieveCallingNumber|rewindDirectory|rightToLeft|rmdir|robotNameRead|robotNameWrite|run|runAsynchronously|runShellCommand|runShellCommandAsynchronously|running|scanNetworks|scrollDisplayLeft|scrollDisplayRight|seek|sendAnalog|sendDigitalPortPair|sendDigitalPorts|sendString|sendSysex|serialEvent|setBand|setBitOrder|setClockDivider|setCursor|setDNS|setDataMode|setFirmwareVersion|setMode|setPINUsed|setSpeed|setTextSize|setTimeout|shiftIn|shiftOut|shutdown|sin|size|sqrt|startLoop|step|stop|stroke|subnetMask|switchPIN|tan|tempoWrite|text|tone|transfer|tuneWrite|turn|updateIR|userNameRead|userNameWrite|voiceCall|waitContinue|width|write|writeBlue|writeGreen|writeJSON|writeMessage|writeMicroseconds|writeRGB|writeRed|yield)\b/}),e.languages.ino=e.languages.arduino}L.displayName=`arff`,L.aliases=[];function L(e){e.languages.arff={comment:/%.*/,string:{pattern:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0},keyword:/@(?:attribute|data|end|relation)\b/i,number:/\b\d+(?:\.\d+)?\b/,punctuation:/[{},]/}}te.displayName=`armasm`,te.aliases=[`arm-asm`];function te(e){e.languages.armasm={comment:{pattern:/;.*/,greedy:!0},string:{pattern:/"(?:[^"\r\n]|"")*"/,greedy:!0,inside:{variable:{pattern:/((?:^|[^$])(?:\${2})*)\$\w+/,lookbehind:!0}}},char:{pattern:/'(?:[^'\r\n]{0,4}|'')'/,greedy:!0},"version-symbol":{pattern:/\|[\w@]+\|/,greedy:!0,alias:`property`},boolean:/\b(?:FALSE|TRUE)\b/,directive:{pattern:/\b(?:ALIAS|ALIGN|AREA|ARM|ASSERT|ATTR|CN|CODE|CODE16|CODE32|COMMON|CP|DATA|DCB|DCD|DCDO|DCDU|DCFD|DCFDU|DCI|DCQ|DCQU|DCW|DCWU|DN|ELIF|ELSE|END|ENDFUNC|ENDIF|ENDP|ENTRY|EQU|EXPORT|EXPORTAS|EXTERN|FIELD|FILL|FN|FUNCTION|GBLA|GBLL|GBLS|GET|GLOBAL|IF|IMPORT|INCBIN|INCLUDE|INFO|KEEP|LCLA|LCLL|LCLS|LTORG|MACRO|MAP|MEND|MEXIT|NOFP|OPT|PRESERVE8|PROC|QN|READONLY|RELOC|REQUIRE|REQUIRE8|RLIST|ROUT|SETA|SETL|SETS|SN|SPACE|SUBT|THUMB|THUMBX|TTL|WEND|WHILE)\b/,alias:`property`},instruction:{pattern:/((?:^|(?:^|[^\\])(?:\r\n?|\n))[ \t]*(?:(?:[A-Z][A-Z0-9_]*[a-z]\w*|[a-z]\w*|\d+)[ \t]+)?)\b[A-Z.]+\b/,lookbehind:!0,alias:`keyword`},variable:/\$\w+/,number:/(?:\b[2-9]_\d+|(?:\b\d+(?:\.\d+)?|\B\.\d+)(?:e-?\d+)?|\b0(?:[fd]_|x)[0-9a-f]+|&[0-9a-f]+)\b/i,register:{pattern:/\b(?:r\d|lr)\b/,alias:`symbol`},operator:/<>|<<|>>|&&|\|\||[=!<>/]=?|[+\-*%#?&|^]|:[A-Z]+:/,punctuation:/[()[\],]/},e.languages[`arm-asm`]=e.languages.armasm}ne.displayName=`arturo`,ne.aliases=[`art`];function ne(e){(function(e){var t=function(t,n){return{pattern:RegExp(`\\{!(?:`+(n||t)+`)$[\\s\\S]*\\}`,`m`),greedy:!0,inside:{embedded:{pattern:/(^\{!\w+\b)[\s\S]+(?=\}$)/,lookbehind:!0,alias:`language-`+t,inside:e.languages[t]},string:/[\s\S]+/}}};e.languages.arturo={comment:{pattern:/;.*/,greedy:!0},character:{pattern:/`.`/,alias:`char`,greedy:!0},number:{pattern:/\b\d+(?:\.\d+(?:\.\d+(?:-[\w+-]+)?)?)?\b/},string:{pattern:/"(?:[^"\\\r\n]|\\.)*"/,greedy:!0},regex:{pattern:/\{\/.*?\/\}/,greedy:!0},"html-string":t(`html`),"css-string":t(`css`),"js-string":t(`js`),"md-string":t(`md`),"sql-string":t(`sql`),"sh-string":t(`shell`,`sh`),multistring:{pattern:/».*|\{:[\s\S]*?:\}|\{[\s\S]*?\}|^-{6}$[\s\S]*/m,alias:`string`,greedy:!0},label:{pattern:/\w+\b\??:/,alias:`property`},literal:{pattern:/'(?:\w+\b\??:?)/,alias:`constant`},type:{pattern:/:(?:\w+\b\??:?)/,alias:`class-name`},color:/#\w+/,predicate:{pattern:/\b(?:all|and|any|ascii|attr|attribute|attributeLabel|binary|block|char|contains|database|date|dictionary|empty|equal|even|every|exists|false|floating|function|greater|greaterOrEqual|if|in|inline|integer|is|key|label|leap|less|lessOrEqual|literal|logical|lower|nand|negative|nor|not|notEqual|null|numeric|odd|or|path|pathLabel|positive|prefix|prime|regex|same|set|some|sorted|standalone|string|subset|suffix|superset|symbol|symbolLiteral|true|try|type|unless|upper|when|whitespace|word|xnor|xor|zero)\?/,alias:`keyword`},"builtin-function":{pattern:/\b(?:abs|acos|acosh|acsec|acsech|actan|actanh|add|after|alert|alias|and|angle|append|arg|args|arity|array|as|asec|asech|asin|asinh|atan|atan2|atanh|attr|attrs|average|before|benchmark|blend|break|call|capitalize|case|ceil|chop|clear|clip|close|color|combine|conj|continue|copy|cos|cosh|crc|csec|csech|ctan|ctanh|cursor|darken|dec|decode|define|delete|desaturate|deviation|dialog|dictionary|difference|digest|digits|div|do|download|drop|dup|e|else|empty|encode|ensure|env|escape|execute|exit|exp|extend|extract|factors|fdiv|filter|first|flatten|floor|fold|from|function|gamma|gcd|get|goto|hash|hypot|if|inc|indent|index|infinity|info|input|insert|inspect|intersection|invert|jaro|join|keys|kurtosis|last|let|levenshtein|lighten|list|ln|log|loop|lower|mail|map|match|max|median|min|mod|module|mul|nand|neg|new|nor|normalize|not|now|null|open|or|outdent|pad|palette|panic|path|pause|permissions|permutate|pi|pop|popup|pow|powerset|powmod|prefix|print|prints|process|product|query|random|range|read|relative|remove|rename|render|repeat|replace|request|return|reverse|round|sample|saturate|script|sec|sech|select|serve|set|shl|shr|shuffle|sin|sinh|size|skewness|slice|sort|spin|split|sqrt|squeeze|stack|strip|sub|suffix|sum|switch|symbols|symlink|sys|take|tan|tanh|terminal|terminate|to|truncate|try|type|unclip|union|unique|unless|until|unzip|upper|values|var|variance|volume|webview|while|with|wordwrap|write|xnor|xor|zip)\b/,alias:`keyword`},sugar:{pattern:/->|=>|\||::/,alias:`operator`},punctuation:/[()[\],]/,symbol:{pattern:/<:|-:|ø|@|#|\+|\||\*|\$|---|-|%|\/|\.\.|\^|~|=|<|>|\\/},boolean:{pattern:/\b(?:false|maybe|true)\b/}},e.languages.art=e.languages.arturo})(e)}R.displayName=`asciidoc`,R.aliases=[`adoc`];function R(e){(function(e){var t={pattern:/(^[ \t]*)\[(?!\[)(?:(["'$`])(?:(?!\2)[^\\]|\\.)*\2|\[(?:[^\[\]\\]|\\.)*\]|[^\[\]\\"'$`]|\\.)*\]/m,lookbehind:!0,inside:{quoted:{pattern:/([$`])(?:(?!\1)[^\\]|\\.)*\1/,inside:{punctuation:/^[$`]|[$`]$/}},interpreted:{pattern:/'(?:[^'\\]|\\.)*'/,inside:{punctuation:/^'|'$/}},string:/"(?:[^"\\]|\\.)*"/,variable:/\w+(?==)/,punctuation:/^\[|\]$|,/,operator:/=/,"attr-value":/(?!^\s+$).+/}},n=e.languages.asciidoc={"comment-block":{pattern:/^(\/{4,})$[\s\S]*?^\1/m,alias:`comment`},table:{pattern:/^\|={3,}(?:(?:\r?\n|\r(?!\n)).*)*?(?:\r?\n|\r)\|={3,}$/m,inside:{specifiers:{pattern:/(?:(?:(?:\d+(?:\.\d+)?|\.\d+)[+*](?:[<^>](?:\.[<^>])?|\.[<^>])?|[<^>](?:\.[<^>])?|\.[<^>])[a-z]*|[a-z]+)(?=\|)/,alias:`attr-value`},punctuation:{pattern:/(^|[^\\])[|!]=*/,lookbehind:!0}}},"passthrough-block":{pattern:/^(\+{4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^\++|\++$/}},"literal-block":{pattern:/^(-{4,}|\.{4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^(?:-+|\.+)|(?:-+|\.+)$/}},"other-block":{pattern:/^(--|\*{4,}|_{4,}|={4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^(?:-+|\*+|_+|=+)|(?:-+|\*+|_+|=+)$/}},"list-punctuation":{pattern:/(^[ \t]*)(?:-|\*{1,5}|\.{1,5}|(?:[a-z]|\d+)\.|[xvi]+\))(?= )/im,lookbehind:!0,alias:`punctuation`},"list-label":{pattern:/(^[ \t]*)[a-z\d].+(?::{2,4}|;;)(?=\s)/im,lookbehind:!0,alias:`symbol`},"indented-block":{pattern:/((\r?\n|\r)\2)([ \t]+)\S.*(?:(?:\r?\n|\r)\3.+)*(?=\2{2}|$)/,lookbehind:!0},comment:/^\/\/.*/m,title:{pattern:/^.+(?:\r?\n|\r)(?:={3,}|-{3,}|~{3,}|\^{3,}|\+{3,})$|^={1,5} .+|^\.(?![\s.]).*/m,alias:`important`,inside:{punctuation:/^(?:\.|=+)|(?:=+|-+|~+|\^+|\++)$/}},"attribute-entry":{pattern:/^:[^:\r\n]+:(?: .*?(?: \+(?:\r?\n|\r).*?)*)?$/m,alias:`tag`},attributes:t,hr:{pattern:/^'{3,}$/m,alias:`punctuation`},"page-break":{pattern:/^<{3,}$/m,alias:`punctuation`},admonition:{pattern:/^(?:CAUTION|IMPORTANT|NOTE|TIP|WARNING):/m,alias:`keyword`},callout:[{pattern:/(^[ \t]*)/m,lookbehind:!0,alias:`symbol`},{pattern:/<\d+>/,alias:`symbol`}],macro:{pattern:/\b[a-z\d][a-z\d-]*::?(?:[^\s\[\]]*\[(?:[^\]\\"']|(["'])(?:(?!\1)[^\\]|\\.)*\1|\\.)*\])/,inside:{function:/^[a-z\d-]+(?=:)/,punctuation:/^::?/,attributes:{pattern:/(?:\[(?:[^\]\\"']|(["'])(?:(?!\1)[^\\]|\\.)*\1|\\.)*\])/,inside:t.inside}}},inline:{pattern:/(^|[^\\])(?:(?:\B\[(?:[^\]\\"']|(["'])(?:(?!\2)[^\\]|\\.)*\2|\\.)*\])?(?:\b_(?!\s)(?: _|[^_\\\r\n]|\\.)+(?:(?:\r?\n|\r)(?: _|[^_\\\r\n]|\\.)+)*_\b|\B``(?!\s).+?(?:(?:\r?\n|\r).+?)*''\B|\B`(?!\s)(?:[^`'\s]|\s+\S)+['`]\B|\B(['*+#])(?!\s)(?: \3|(?!\3)[^\\\r\n]|\\.)+(?:(?:\r?\n|\r)(?: \3|(?!\3)[^\\\r\n]|\\.)+)*\3\B)|(?:\[(?:[^\]\\"']|(["'])(?:(?!\4)[^\\]|\\.)*\4|\\.)*\])?(?:(__|\*\*|\+\+\+?|##|\$\$|[~^]).+?(?:(?:\r?\n|\r).+?)*\5|\{[^}\r\n]+\}|\[\[\[?.+?(?:(?:\r?\n|\r).+?)*\]?\]\]|<<.+?(?:(?:\r?\n|\r).+?)*>>|\(\(\(?.+?(?:(?:\r?\n|\r).+?)*\)?\)\)))/m,lookbehind:!0,inside:{attributes:t,url:{pattern:/^(?:\[\[\[?.+?\]?\]\]|<<.+?>>)$/,inside:{punctuation:/^(?:\[\[\[?|<<)|(?:\]\]\]?|>>)$/}},"attribute-ref":{pattern:/^\{.+\}$/,inside:{variable:{pattern:/(^\{)[a-z\d,+_-]+/,lookbehind:!0},operator:/^[=?!#%@$]|!(?=[:}])/,punctuation:/^\{|\}$|::?/}},italic:{pattern:/^(['_])[\s\S]+\1$/,inside:{punctuation:/^(?:''?|__?)|(?:''?|__?)$/}},bold:{pattern:/^\*[\s\S]+\*$/,inside:{punctuation:/^\*\*?|\*\*?$/}},punctuation:/^(?:``?|\+{1,3}|##?|\$\$|[~^]|\(\(\(?)|(?:''?|\+{1,3}|##?|\$\$|[~^`]|\)?\)\))$/}},replacement:{pattern:/\((?:C|R|TM)\)/,alias:`builtin`},entity:/&#?[\da-z]{1,8};/i,"line-continuation":{pattern:/(^| )\+$/m,lookbehind:!0,alias:`punctuation`}};function r(e){e=e.split(` `);for(var t={},r=0,i=e.length;r>/g,function(){return`(?:`+e+`)`});return e.replace(/<>/g,`[^\\s\\S]`)}var i={type:`bool byte char decimal double dynamic float int long object sbyte short string uint ulong ushort var void`,typeDeclaration:`class enum interface record struct`,contextual:`add alias and ascending async await by descending from(?=\\s*(?:\\w|$)) get global group into init(?=\\s*;) join let nameof not notnull on or orderby partial remove select set unmanaged value when where with(?=\\s*{)`,other:`abstract as base break case catch checked const continue default delegate do else event explicit extern finally fixed for foreach goto if implicit in internal is lock namespace new null operator out override params private protected public readonly ref return sealed sizeof stackalloc static switch this throw try typeof unchecked unsafe using virtual volatile while yield`};function a(e){return`\\b(?:`+e.trim().replace(/ /g,`|`)+`)\\b`}var o=a(i.typeDeclaration),s=RegExp(a(i.type+` `+i.typeDeclaration+` `+i.contextual+` `+i.other)),c=a(i.typeDeclaration+` `+i.contextual+` `+i.other),l=a(i.type+` `+i.typeDeclaration+` `+i.other),u=r(`<(?:[^<>;=+\\-*/%&|^]|<>)*>`,2),d=r(`\\((?:[^()]|<>)*\\)`,2),f=`@?\\b[A-Za-z_]\\w*\\b`,p=t(`<<0>>(?:\\s*<<1>>)?`,[f,u]),m=t(`(?!<<0>>)<<1>>(?:\\s*\\.\\s*<<1>>)*`,[c,p]),h=`\\[\\s*(?:,\\s*)*\\]`,g=t(`<<0>>(?:\\s*(?:\\?\\s*)?<<1>>)*(?:\\s*\\?)?`,[m,h]),_=t(`(?:<<0>>|<<1>>)(?:\\s*(?:\\?\\s*)?<<2>>)*(?:\\s*\\?)?`,[t(`\\(<<0>>+(?:,<<0>>+)+\\)`,[t(`[^,()<>[\\];=+\\-*/%&|^]|<<0>>|<<1>>|<<2>>`,[u,d,h])]),m,h]),v={keyword:s,punctuation:/[<>()?,.:[\]]/},y=`'(?:[^\\r\\n'\\\\]|\\\\.|\\\\[Uux][\\da-fA-F]{1,8})'`,b=`"(?:\\\\.|[^\\\\"\\r\\n])*"`,x=`@"(?:""|\\\\[\\s\\S]|[^\\\\"])*"(?!")`;e.languages.csharp=e.languages.extend(`clike`,{string:[{pattern:n(`(^|[^$\\\\])<<0>>`,[x]),lookbehind:!0,greedy:!0},{pattern:n(`(^|[^@$\\\\])<<0>>`,[b]),lookbehind:!0,greedy:!0}],"class-name":[{pattern:n(`(\\busing\\s+static\\s+)<<0>>(?=\\s*;)`,[m]),lookbehind:!0,inside:v},{pattern:n(`(\\busing\\s+<<0>>\\s*=\\s*)<<1>>(?=\\s*;)`,[f,_]),lookbehind:!0,inside:v},{pattern:n(`(\\busing\\s+)<<0>>(?=\\s*=)`,[f]),lookbehind:!0},{pattern:n(`(\\b<<0>>\\s+)<<1>>`,[o,p]),lookbehind:!0,inside:v},{pattern:n(`(\\bcatch\\s*\\(\\s*)<<0>>`,[m]),lookbehind:!0,inside:v},{pattern:n(`(\\bwhere\\s+)<<0>>`,[f]),lookbehind:!0},{pattern:n(`(\\b(?:is(?:\\s+not)?|as)\\s+)<<0>>`,[g]),lookbehind:!0,inside:v},{pattern:n(`\\b<<0>>(?=\\s+(?!<<1>>|with\\s*\\{)<<2>>(?:\\s*[=,;:{)\\]]|\\s+(?:in|when)\\b))`,[_,l,f]),inside:v}],keyword:s,number:/(?:\b0(?:x[\da-f_]*[\da-f]|b[01_]*[01])|(?:\B\.\d+(?:_+\d+)*|\b\d+(?:_+\d+)*(?:\.\d+(?:_+\d+)*)?)(?:e[-+]?\d+(?:_+\d+)*)?)(?:[dflmu]|lu|ul)?\b/i,operator:/>>=?|<<=?|[-=]>|([-+&|])\1|~|\?\?=?|[-+*/%&|^!=<>]=?/,punctuation:/\?\.?|::|[{}[\];(),.:]/}),e.languages.insertBefore(`csharp`,`number`,{range:{pattern:/\.\./,alias:`operator`}}),e.languages.insertBefore(`csharp`,`punctuation`,{"named-parameter":{pattern:n(`([(,]\\s*)<<0>>(?=\\s*:)`,[f]),lookbehind:!0,alias:`punctuation`}}),e.languages.insertBefore(`csharp`,`class-name`,{namespace:{pattern:n(`(\\b(?:namespace|using)\\s+)<<0>>(?:\\s*\\.\\s*<<0>>)*(?=\\s*[;{])`,[f]),lookbehind:!0,inside:{punctuation:/\./}},"type-expression":{pattern:n(`(\\b(?:default|sizeof|typeof)\\s*\\(\\s*(?!\\s))(?:[^()\\s]|\\s(?!\\s)|<<0>>)*(?=\\s*\\))`,[d]),lookbehind:!0,alias:`class-name`,inside:v},"return-type":{pattern:n(`<<0>>(?=\\s+(?:<<1>>\\s*(?:=>|[({]|\\.\\s*this\\s*\\[)|this\\s*\\[))`,[_,m]),inside:v,alias:`class-name`},"constructor-invocation":{pattern:n(`(\\bnew\\s+)<<0>>(?=\\s*[[({])`,[_]),lookbehind:!0,inside:v,alias:`class-name`},"generic-method":{pattern:n(`<<0>>\\s*<<1>>(?=\\s*\\()`,[f,u]),inside:{function:n(`^<<0>>`,[f]),generic:{pattern:RegExp(u),alias:`class-name`,inside:v}}},"type-list":{pattern:n(`\\b((?:<<0>>\\s+<<1>>|record\\s+<<1>>\\s*<<5>>|where\\s+<<2>>)\\s*:\\s*)(?:<<3>>|<<4>>|<<1>>\\s*<<5>>|<<6>>)(?:\\s*,\\s*(?:<<3>>|<<4>>|<<6>>))*(?=\\s*(?:where|[{;]|=>|$))`,[o,p,f,_,s.source,d,`\\bnew\\s*\\(\\s*\\)`]),lookbehind:!0,inside:{"record-arguments":{pattern:n(`(^(?!new\\s*\\()<<0>>\\s*)<<1>>`,[p,d]),lookbehind:!0,greedy:!0,inside:e.languages.csharp},keyword:s,"class-name":{pattern:RegExp(_),greedy:!0,inside:v},punctuation:/[,()]/}},preprocessor:{pattern:/(^[\t ]*)#.*/m,lookbehind:!0,alias:`property`,inside:{directive:{pattern:/(#)\b(?:define|elif|else|endif|endregion|error|if|line|nullable|pragma|region|undef|warning)\b/,lookbehind:!0,alias:`keyword`}}}});var S=b+`|`+y,C=t(`\\/(?![*/])|\\/\\/[^\\r\\n]*[\\r\\n]|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|<<0>>`,[S]),w=r(t(`[^"'/()]|<<0>>|\\(<>*\\)`,[C]),2),T=`\\b(?:assembly|event|field|method|module|param|property|return|type)\\b`,E=t(`<<0>>(?:\\s*\\(<<1>>*\\))?`,[m,w]);e.languages.insertBefore(`csharp`,`class-name`,{attribute:{pattern:n(`((?:^|[^\\s\\w>)?])\\s*\\[\\s*)(?:<<0>>\\s*:\\s*)?<<1>>(?:\\s*,\\s*<<1>>)*(?=\\s*\\])`,[T,E]),lookbehind:!0,greedy:!0,inside:{target:{pattern:n(`^<<0>>(?=\\s*:)`,[T]),alias:`keyword`},"attribute-arguments":{pattern:n(`\\(<<0>>*\\)`,[w]),inside:e.languages.csharp},"class-name":{pattern:RegExp(m),inside:{punctuation:/\./}},punctuation:/[:,]/}}});var D=`:[^}\\r\\n]+`,O=r(t(`[^"'/()]|<<0>>|\\(<>*\\)`,[C]),2),k=t(`\\{(?!\\{)(?:(?![}:])<<0>>)*<<1>>?\\}`,[O,D]),A=r(t(`[^"'/()]|\\/(?!\\*)|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|<<0>>|\\(<>*\\)`,[S]),2),j=t(`\\{(?!\\{)(?:(?![}:])<<0>>)*<<1>>?\\}`,[A,D]);function M(t,r){return{interpolation:{pattern:n(`((?:^|[^{])(?:\\{\\{)*)<<0>>`,[t]),lookbehind:!0,inside:{"format-string":{pattern:n(`(^\\{(?:(?![}:])<<0>>)*)<<1>>(?=\\}$)`,[r,D]),lookbehind:!0,inside:{punctuation:/^:/}},punctuation:/^\{|\}$/,expression:{pattern:/[\s\S]+/,alias:`language-csharp`,inside:e.languages.csharp}}},string:/[\s\S]+/}}e.languages.insertBefore(`csharp`,`string`,{"interpolation-string":[{pattern:n(`(^|[^\\\\])(?:\\$@|@\\$)"(?:""|\\\\[\\s\\S]|\\{\\{|<<0>>|[^\\\\{"])*"`,[k]),lookbehind:!0,greedy:!0,inside:M(k,O)},{pattern:n(`(^|[^@\\\\])\\$"(?:\\\\.|\\{\\{|<<0>>|[^\\\\"{])*"`,[j]),lookbehind:!0,greedy:!0,inside:M(j,A)}],char:{pattern:RegExp(y),greedy:!0}}),e.languages.dotnet=e.languages.cs=e.languages.csharp})(e)}B.displayName=`markup`,B.aliases=[`atom`,`html`,`mathml`,`rss`,`ssml`,`svg`,`xml`];function B(e){e.languages.markup={comment:{pattern://,greedy:!0},prolog:{pattern:/<\?[\s\S]+?\?>/,greedy:!0},doctype:{pattern:/"'[\]]|"[^"]*"|'[^']*')+(?:\[(?:[^<"'\]]|"[^"]*"|'[^']*'|<(?!!--)|)*\]\s*)?>/i,greedy:!0,inside:{"internal-subset":{pattern:/(^[^\[]*\[)[\s\S]+(?=\]>$)/,lookbehind:!0,greedy:!0,inside:null},string:{pattern:/"[^"]*"|'[^']*'/,greedy:!0},punctuation:/^$|[[\]]/,"doctype-tag":/^DOCTYPE/i,name:/[^\s<>'"]+/}},cdata:{pattern://i,greedy:!0},tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"special-attr":[],"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/,inside:{punctuation:[{pattern:/^=/,alias:`attr-equals`},{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:[{pattern:/&[\da-z]{1,8};/i,alias:`named-entity`},/&#x?[\da-f]{1,8};/i]},e.languages.markup.tag.inside[`attr-value`].inside.entity=e.languages.markup.entity,e.languages.markup.doctype.inside[`internal-subset`].inside=e.languages.markup,e.hooks.add(`wrap`,function(e){e.type===`entity`&&(e.attributes.title=e.content.value.replace(/&/,`&`))}),Object.defineProperty(e.languages.markup.tag,"addInlined",{value:function(t,n){var r={};r[`language-`+n]={pattern:/(^$)/i,lookbehind:!0,inside:e.languages[n]},r.cdata=/^$/i;var i={"included-cdata":{pattern://i,inside:r}};i[`language-`+n]={pattern:/[\s\S]+/,inside:e.languages[n]};var a={};a[t]={pattern:RegExp(`(<__[^>]*>)(?:))*\\]\\]>|(?!)`.replace(/__/g,function(){return t}),`i`),lookbehind:!0,greedy:!0,inside:i},e.languages.insertBefore(`markup`,`cdata`,a)}}),Object.defineProperty(e.languages.markup.tag,"addAttribute",{value:function(t,n){e.languages.markup.tag.inside[`special-attr`].push({pattern:RegExp(`(^|["'\\s])(?:`+t+`)\\s*=\\s*(?:"[^"]*"|'[^']*'|[^\\s'">=]+(?=[\\s>]))`,`i`),lookbehind:!0,inside:{"attr-name":/^[^\s=]+/,"attr-value":{pattern:/=[\s\S]+/,inside:{value:{pattern:/(^=\s*(["']|(?!["'])))\S[\s\S]*(?=\2$)/,lookbehind:!0,alias:[n,`language-`+n],inside:e.languages[n]},punctuation:[{pattern:/^=/,alias:`attr-equals`},/"|'/]}}}})}}),e.languages.html=e.languages.markup,e.languages.mathml=e.languages.markup,e.languages.svg=e.languages.markup,e.languages.xml=e.languages.extend(`markup`,{}),e.languages.ssml=e.languages.xml,e.languages.atom=e.languages.xml,e.languages.rss=e.languages.xml}ae.displayName=`aspnet`,ae.aliases=[];function ae(e){e.register(z),e.register(B),e.languages.aspnet=e.languages.extend(`markup`,{"page-directive":{pattern:/<%\s*@.*%>/,alias:`tag`,inside:{"page-directive":{pattern:/<%\s*@\s*(?:Assembly|Control|Implements|Import|Master(?:Type)?|OutputCache|Page|PreviousPageType|Reference|Register)?|%>/i,alias:`tag`},rest:e.languages.markup.tag.inside}},directive:{pattern:/<%.*%>/,alias:`tag`,inside:{directive:{pattern:/<%\s*?[$=%#:]{0,2}|%>/,alias:`tag`},rest:e.languages.csharp}}}),e.languages.aspnet.tag.pattern=/<(?!%)\/?[^\s>\/]+(?:\s+[^\s>\/=]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">=]+))?)*\s*\/?>/,e.languages.insertBefore(`inside`,`punctuation`,{directive:e.languages.aspnet.directive},e.languages.aspnet.tag.inside[`attr-value`]),e.languages.insertBefore(`aspnet`,`comment`,{"asp-comment":{pattern:/<%--[\s\S]*?--%>/,alias:[`asp`,`comment`]}}),e.languages.insertBefore(`aspnet`,e.languages.javascript?`script`:`tag`,{"asp-script":{pattern:/(]*>)[\s\S]*?(?=<\/script>)/i,lookbehind:!0,alias:[`asp`,`script`],inside:e.languages.csharp||{}}})}oe.displayName=`autohotkey`,oe.aliases=[];function oe(e){e.languages.autohotkey={comment:[{pattern:/(^|\s);.*/,lookbehind:!0},{pattern:/(^[\t ]*)\/\*(?:[\r\n](?![ \t]*\*\/)|[^\r\n])*(?:[\r\n][ \t]*\*\/)?/m,lookbehind:!0,greedy:!0}],tag:{pattern:/^([ \t]*)[^\s,`":]+(?=:[ \t]*$)/m,lookbehind:!0},string:/"(?:[^"\n\r]|"")*"/,variable:/%\w+%/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/\?|\/\/?=?|:=|\|[=|]?|&[=&]?|\+[=+]?|-[=-]?|\*[=*]?|<(?:<=?|>|=)?|>>?=?|[.^!=~]=?|\b(?:AND|NOT|OR)\b/,boolean:/\b(?:false|true)\b/,command:{pattern:/\b(?:AutoTrim|BlockInput|Break|Click|ClipWait|Continue|Control|ControlClick|ControlFocus|ControlGet|ControlGetFocus|ControlGetPos|ControlGetText|ControlMove|ControlSend|ControlSendRaw|ControlSetText|CoordMode|Critical|DetectHiddenText|DetectHiddenWindows|Drive|DriveGet|DriveSpaceFree|EnvAdd|EnvDiv|EnvGet|EnvMult|EnvSet|EnvSub|EnvUpdate|Exit|ExitApp|FileAppend|FileCopy|FileCopyDir|FileCreateDir|FileCreateShortcut|FileDelete|FileEncoding|FileGetAttrib|FileGetShortcut|FileGetSize|FileGetTime|FileGetVersion|FileInstall|FileMove|FileMoveDir|FileRead|FileReadLine|FileRecycle|FileRecycleEmpty|FileRemoveDir|FileSelectFile|FileSelectFolder|FileSetAttrib|FileSetTime|FormatTime|GetKeyState|Gosub|Goto|GroupActivate|GroupAdd|GroupClose|GroupDeactivate|Gui|GuiControl|GuiControlGet|Hotkey|ImageSearch|IniDelete|IniRead|IniWrite|Input|InputBox|KeyWait|ListHotkeys|ListLines|ListVars|Loop|Menu|MouseClick|MouseClickDrag|MouseGetPos|MouseMove|MsgBox|OnExit|OutputDebug|Pause|PixelGetColor|PixelSearch|PostMessage|Process|Progress|Random|RegDelete|RegRead|RegWrite|Reload|Repeat|Return|Run|RunAs|RunWait|Send|SendEvent|SendInput|SendMessage|SendMode|SendPlay|SendRaw|SetBatchLines|SetCapslockState|SetControlDelay|SetDefaultMouseSpeed|SetEnv|SetFormat|SetKeyDelay|SetMouseDelay|SetNumlockState|SetRegView|SetScrollLockState|SetStoreCapslockMode|SetTimer|SetTitleMatchMode|SetWinDelay|SetWorkingDir|Shutdown|Sleep|Sort|SoundBeep|SoundGet|SoundGetWaveVolume|SoundPlay|SoundSet|SoundSetWaveVolume|SplashImage|SplashTextOff|SplashTextOn|SplitPath|StatusBarGetText|StatusBarWait|StringCaseSense|StringGetPos|StringLeft|StringLen|StringLower|StringMid|StringReplace|StringRight|StringSplit|StringTrimLeft|StringTrimRight|StringUpper|Suspend|SysGet|Thread|ToolTip|Transform|TrayTip|URLDownloadToFile|WinActivate|WinActivateBottom|WinClose|WinGet|WinGetActiveStats|WinGetActiveTitle|WinGetClass|WinGetPos|WinGetText|WinGetTitle|WinHide|WinKill|WinMaximize|WinMenuSelectItem|WinMinimize|WinMinimizeAll|WinMinimizeAllUndo|WinMove|WinRestore|WinSet|WinSetTitle|WinShow|WinWait|WinWaitActive|WinWaitClose|WinWaitNotActive)\b/i,alias:`selector`},constant:/\b(?:a_ahkpath|a_ahkversion|a_appdata|a_appdatacommon|a_autotrim|a_batchlines|a_caretx|a_carety|a_computername|a_controldelay|a_cursor|a_dd|a_ddd|a_dddd|a_defaultmousespeed|a_desktop|a_desktopcommon|a_detecthiddentext|a_detecthiddenwindows|a_endchar|a_eventinfo|a_exitreason|a_fileencoding|a_formatfloat|a_formatinteger|a_gui|a_guicontrol|a_guicontrolevent|a_guievent|a_guiheight|a_guiwidth|a_guix|a_guiy|a_hour|a_iconfile|a_iconhidden|a_iconnumber|a_icontip|a_index|a_ipaddress1|a_ipaddress2|a_ipaddress3|a_ipaddress4|a_is64bitos|a_isadmin|a_iscompiled|a_iscritical|a_ispaused|a_issuspended|a_isunicode|a_keydelay|a_language|a_lasterror|a_linefile|a_linenumber|a_loopfield|a_loopfileattrib|a_loopfiledir|a_loopfileext|a_loopfilefullpath|a_loopfilelongpath|a_loopfilename|a_loopfileshortname|a_loopfileshortpath|a_loopfilesize|a_loopfilesizekb|a_loopfilesizemb|a_loopfiletimeaccessed|a_loopfiletimecreated|a_loopfiletimemodified|a_loopreadline|a_loopregkey|a_loopregname|a_loopregsubkey|a_loopregtimemodified|a_loopregtype|a_mday|a_min|a_mm|a_mmm|a_mmmm|a_mon|a_mousedelay|a_msec|a_mydocuments|a_now|a_nowutc|a_numbatchlines|a_ostype|a_osversion|a_priorhotkey|a_priorkey|a_programfiles|a_programs|a_programscommon|a_ptrsize|a_regview|a_screendpi|a_screenheight|a_screenwidth|a_scriptdir|a_scriptfullpath|a_scripthwnd|a_scriptname|a_sec|a_space|a_startmenu|a_startmenucommon|a_startup|a_startupcommon|a_stringcasesense|a_tab|a_temp|a_thisfunc|a_thishotkey|a_thislabel|a_thismenu|a_thismenuitem|a_thismenuitempos|a_tickcount|a_timeidle|a_timeidlephysical|a_timesincepriorhotkey|a_timesincethishotkey|a_titlematchmode|a_titlematchmodespeed|a_username|a_wday|a_windelay|a_windir|a_workingdir|a_yday|a_year|a_yweek|a_yyyy|clipboard|clipboardall|comspec|errorlevel|programfiles)\b/i,builtin:/\b(?:abs|acos|asc|asin|atan|ceil|chr|class|comobjactive|comobjarray|comobjconnect|comobjcreate|comobjerror|comobjflags|comobjget|comobjquery|comobjtype|comobjvalue|cos|dllcall|exp|fileexist|Fileopen|floor|format|il_add|il_create|il_destroy|instr|isfunc|islabel|IsObject|ln|log|ltrim|lv_add|lv_delete|lv_deletecol|lv_getcount|lv_getnext|lv_gettext|lv_insert|lv_insertcol|lv_modify|lv_modifycol|lv_setimagelist|mod|numget|numput|onmessage|regexmatch|regexreplace|registercallback|round|rtrim|sb_seticon|sb_setparts|sb_settext|sin|sqrt|strlen|strreplace|strsplit|substr|tan|tv_add|tv_delete|tv_get|tv_getchild|tv_getcount|tv_getnext|tv_getparent|tv_getprev|tv_getselection|tv_gettext|tv_modify|varsetcapacity|winactive|winexist|__Call|__Get|__New|__Set)\b/i,symbol:/\b(?:alt|altdown|altup|appskey|backspace|browser_back|browser_favorites|browser_forward|browser_home|browser_refresh|browser_search|browser_stop|bs|capslock|ctrl|ctrlbreak|ctrldown|ctrlup|del|delete|down|end|enter|esc|escape|f1|f10|f11|f12|f13|f14|f15|f16|f17|f18|f19|f2|f20|f21|f22|f23|f24|f3|f4|f5|f6|f7|f8|f9|home|ins|insert|joy1|joy10|joy11|joy12|joy13|joy14|joy15|joy16|joy17|joy18|joy19|joy2|joy20|joy21|joy22|joy23|joy24|joy25|joy26|joy27|joy28|joy29|joy3|joy30|joy31|joy32|joy4|joy5|joy6|joy7|joy8|joy9|joyaxes|joybuttons|joyinfo|joyname|joypov|joyr|joyu|joyv|joyx|joyy|joyz|lalt|launch_app1|launch_app2|launch_mail|launch_media|lbutton|lcontrol|lctrl|left|lshift|lwin|lwindown|lwinup|mbutton|media_next|media_play_pause|media_prev|media_stop|numlock|numpad0|numpad1|numpad2|numpad3|numpad4|numpad5|numpad6|numpad7|numpad8|numpad9|numpadadd|numpadclear|numpaddel|numpaddiv|numpaddot|numpaddown|numpadend|numpadenter|numpadhome|numpadins|numpadleft|numpadmult|numpadpgdn|numpadpgup|numpadright|numpadsub|numpadup|pgdn|pgup|printscreen|ralt|rbutton|rcontrol|rctrl|right|rshift|rwin|rwindown|rwinup|scrolllock|shift|shiftdown|shiftup|space|tab|up|volume_down|volume_mute|volume_up|wheeldown|wheelleft|wheelright|wheelup|xbutton1|xbutton2)\b/i,directive:{pattern:/#[a-z]+\b/i,alias:`important`},keyword:/\b(?:Abort|AboveNormal|Add|ahk_class|ahk_exe|ahk_group|ahk_id|ahk_pid|All|Alnum|Alpha|AltSubmit|AltTab|AltTabAndMenu|AltTabMenu|AltTabMenuDismiss|AlwaysOnTop|AutoSize|Background|BackgroundTrans|BelowNormal|between|BitAnd|BitNot|BitOr|BitShiftLeft|BitShiftRight|BitXOr|Bold|Border|Button|ByRef|Catch|Checkbox|Checked|CheckedGray|Choose|ChooseString|Close|Color|ComboBox|Contains|ControlList|Count|Date|DateTime|Days|DDL|Default|DeleteAll|Delimiter|Deref|Destroy|Digit|Disable|Disabled|DropDownList|Edit|Eject|Else|Enable|Enabled|Error|Exist|Expand|ExStyle|FileSystem|Finally|First|Flash|Float|FloatFast|Focus|Font|for|global|Grid|Group|GroupBox|GuiClose|GuiContextMenu|GuiDropFiles|GuiEscape|GuiSize|Hdr|Hidden|Hide|High|HKCC|HKCR|HKCU|HKEY_CLASSES_ROOT|HKEY_CURRENT_CONFIG|HKEY_CURRENT_USER|HKEY_LOCAL_MACHINE|HKEY_USERS|HKLM|HKU|Hours|HScroll|Icon|IconSmall|ID|IDLast|If|IfEqual|IfExist|IfGreater|IfGreaterOrEqual|IfInString|IfLess|IfLessOrEqual|IfMsgBox|IfNotEqual|IfNotExist|IfNotInString|IfWinActive|IfWinExist|IfWinNotActive|IfWinNotExist|Ignore|ImageList|in|Integer|IntegerFast|Interrupt|is|italic|Join|Label|LastFound|LastFoundExist|Limit|Lines|List|ListBox|ListView|local|Lock|Logoff|Low|Lower|Lowercase|MainWindow|Margin|Maximize|MaximizeBox|MaxSize|Minimize|MinimizeBox|MinMax|MinSize|Minutes|MonthCal|Mouse|Move|Multi|NA|No|NoActivate|NoDefault|NoHide|NoIcon|NoMainWindow|norm|Normal|NoSort|NoSortHdr|NoStandard|Not|NoTab|NoTimers|Number|Off|Ok|On|OwnDialogs|Owner|Parse|Password|Picture|Pixel|Pos|Pow|Priority|ProcessName|Radio|Range|Read|ReadOnly|Realtime|Redraw|Region|REG_BINARY|REG_DWORD|REG_EXPAND_SZ|REG_MULTI_SZ|REG_SZ|Relative|Rename|Report|Resize|Restore|Retry|RGB|Screen|Seconds|Section|Serial|SetLabel|ShiftAltTab|Show|Single|Slider|SortDesc|Standard|static|Status|StatusBar|StatusCD|strike|Style|Submit|SysMenu|Tab2|TabStop|Text|Theme|Throw|Tile|ToggleCheck|ToggleEnable|ToolWindow|Top|Topmost|TransColor|Transparent|Tray|TreeView|Try|TryAgain|Type|UnCheck|underline|Unicode|Unlock|Until|UpDown|Upper|Uppercase|UseErrorLevel|Vis|VisFirst|Visible|VScroll|Wait|WaitClose|WantCtrlA|WantF2|WantReturn|While|Wrap|Xdigit|xm|xp|xs|Yes|ym|yp|ys)\b/i,function:/[^(); \t,\n+*\-=?>:\\\/<&%\[\]]+(?=\()/,punctuation:/[{}[\]():,]/}}se.displayName=`autoit`,se.aliases=[];function se(e){e.languages.autoit={comment:[/;.*/,{pattern:/(^[\t ]*)#(?:comments-start|cs)[\s\S]*?^[ \t]*#(?:ce|comments-end)/m,lookbehind:!0}],url:{pattern:/(^[\t ]*#include\s+)(?:<[^\r\n>]+>|"[^\r\n"]+")/m,lookbehind:!0},string:{pattern:/(["'])(?:\1\1|(?!\1)[^\r\n])*\1/,greedy:!0,inside:{variable:/([%$@])\w+\1/}},directive:{pattern:/(^[\t ]*)#[\w-]+/m,lookbehind:!0,alias:`keyword`},function:/\b\w+(?=\()/,variable:/[$@]\w+/,keyword:/\b(?:Case|Const|Continue(?:Case|Loop)|Default|Dim|Do|Else(?:If)?|End(?:Func|If|Select|Switch|With)|Enum|Exit(?:Loop)?|For|Func|Global|If|In|Local|Next|Null|ReDim|Select|Static|Step|Switch|Then|To|Until|Volatile|WEnd|While|With)\b/i,number:/\b(?:0x[\da-f]+|\d+(?:\.\d+)?(?:e[+-]?\d+)?)\b/i,boolean:/\b(?:False|True)\b/i,operator:/<[=>]?|[-+*\/=&>]=?|[?^]|\b(?:And|Not|Or)\b/i,punctuation:/[\[\]().,:]/}}ce.displayName=`avisynth`,ce.aliases=[`avs`];function ce(e){(function(e){function t(e,t){return e.replace(/<<(\d+)>>/g,function(e,n){return t[+n]})}function n(e,n,r){return RegExp(t(e,n),r||``)}var r=`bool|clip|float|int|string|val`,i=[[`is(?:bool|clip|float|int|string)|defined|(?:(?:internal)?function|var)?exists?`,`apply|assert|default|eval|import|nop|select|undefined`,`opt_(?:allowfloataudio|avipadscanlines|dwchannelmask|enable_(?:b64a|planartopackedrgb|v210|y3_10_10|y3_10_16)|usewaveextensible|vdubplanarhack)|set(?:cachemode|maxcpu|memorymax|planarlegacyalignment|workingdir)`,`hex(?:value)?|value`,`abs|ceil|continued(?:denominator|numerator)?|exp|floor|fmod|frac|log(?:10)?|max|min|muldiv|pi|pow|rand|round|sign|spline|sqrt`,`a?sinh?|a?cosh?|a?tan[2h]?`,`(?:bit(?:and|not|x?or|[lr]?shift[aslu]?|sh[lr]|sa[lr]|[lr]rotatel?|ro[rl]|te?st|set(?:count)?|cl(?:ea)?r|ch(?:an)?ge?))`,`average(?:[bgr]|chroma[uv]|luma)|(?:[rgb]|chroma[uv]|luma|rgb|[yuv](?=difference(?:fromprevious|tonext)))difference(?:fromprevious|tonext)?|[yuvrgb]plane(?:median|min|max|minmaxdifference)`,`getprocessinfo|logmsg|script(?:dir(?:utf8)?|file(?:utf8)?|name(?:utf8)?)|setlogparams`,`chr|(?:fill|find|left|mid|replace|rev|right)str|format|[lu]case|ord|str(?:cmpi?|fromutf8|len|toutf8)|time|trim(?:all|left|right)`,`isversionorgreater|version(?:number|string)`,`buildpixeltype|colorspacenametopixeltype`,`addautoloaddir|on(?:cpu|cuda)|prefetch|setfiltermtmode`].join(`|`),[`has(?:audio|video)`,`height|width`,`frame(?:count|rate)|framerate(?:denominator|numerator)`,`getparity|is(?:field|frame)based`,`bitspercomponent|componentsize|hasalpha|is(?:planar(?:rgba?)?|interleaved|rgb(?:24|32|48|64)?|y(?:8|u(?:va?|y2))?|yv(?:12|16|24|411)|420|422|444|packedrgb)|numcomponents|pixeltype`,`audio(?:bits|channels|duration|length(?:[fs]|hi|lo)?|rate)|isaudio(?:float|int)`].join(`|`),[`avi(?:file)?source|directshowsource|image(?:reader|source|sourceanim)|opendmlsource|segmented(?:avisource|directshowsource)|wavsource`,`coloryuv|convertbacktoyuy2|convertto(?:RGB(?:24|32|48|64)|(?:planar)?RGBA?|Y8?|YV(?:12|16|24|411)|YUVA?(?:411|420|422|444)|YUY2)|fixluminance|gr[ae]yscale|invert|levels|limiter|mergea?rgb|merge(?:chroma|luma)|rgbadjust|show(?:alpha|blue|green|red)|swapuv|tweak|[uv]toy8?|ytouv`,`(?:colorkey|reset)mask|layer|mask(?:hs)?|merge|overlay|subtract`,`addborders|(?:bicubic|bilinear|blackman|gauss|lanczos4|lanczos|point|sinc|spline(?:16|36|64))resize|crop(?:bottom)?|flip(?:horizontal|vertical)|(?:horizontal|vertical)?reduceby2|letterbox|skewrows|turn(?:180|left|right)`,`blur|fixbrokenchromaupsampling|generalconvolution|(?:spatial|temporal)soften|sharpen`,`trim|(?:un)?alignedsplice|(?:assume|assumescaled|change|convert)FPS|(?:delete|duplicate)frame|dissolve|fade(?:in|io|out)[02]?|freezeframe|interleave|loop|reverse|select(?:even|odd|(?:range)?every)`,`assume[bt]ff|assume(?:field|frame)based|bob|complementparity|doubleweave|peculiarblend|pulldown|separate(?:columns|fields|rows)|swapfields|weave(?:columns|rows)?`,`amplify(?:db)?|assumesamplerate|audiodub(?:ex)?|audiotrim|convertaudioto(?:(?:8|16|24|32)bit|float)|converttomono|delayaudio|ensurevbrmp3sync|get(?:left|right)?channel|kill(?:audio|video)|mergechannels|mixaudio|monotostereo|normalize|resampleaudio|ssrc|supereq|timestretch`,`animate|applyrange|conditional(?:filter|reader|select)|frameevaluate|scriptclip|tcp(?:server|source)|writefile(?:end|if|start)?`,`imagewriter`,`blackness|blankclip|colorbars(?:hd)?|compare|dumpfiltergraph|echo|histogram|info|messageclip|preroll|setgraphanalysis|show(?:framenumber|smpte|time)|showfiveversions|stack(?:horizontal|vertical)|subtitle|tone|version`].join(`|`)].join(`|`);e.languages.avisynth={comment:[{pattern:/(^|[^\\])\[\*(?:[^\[*]|\[(?!\*)|\*(?!\])|\[\*(?:[^\[*]|\[(?!\*)|\*(?!\]))*\*\])*\*\]/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\$])#.*/,lookbehind:!0,greedy:!0}],argument:{pattern:n(`\\b(?:<<0>>)\\s+("?)\\w+\\1`,[r],`i`),inside:{keyword:/^\w+/}},"argument-label":{pattern:/([,(][\s\\]*)\w+\s*=(?!=)/,lookbehind:!0,inside:{"argument-name":{pattern:/^\w+/,alias:`punctuation`},punctuation:/=$/}},string:[{pattern:/"""[\s\S]*?"""/,greedy:!0},{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0,inside:{constant:{pattern:/\b(?:DEFAULT_MT_MODE|(?:MAINSCRIPT|PROGRAM|SCRIPT)DIR|(?:MACHINE|USER)_(?:CLASSIC|PLUS)_PLUGINS)\b/}}}],variable:/\b(?:last)\b/i,boolean:/\b(?:false|no|true|yes)\b/i,keyword:/\b(?:catch|else|for|function|global|if|return|try|while|__END__)\b/i,constant:/\bMT_(?:MULTI_INSTANCE|NICE_FILTER|SERIALIZED|SPECIAL_MT)\b/,"builtin-function":{pattern:n(`\\b(?:<<0>>)\\b`,[i],`i`),alias:`function`},"type-cast":{pattern:n(`\\b(?:<<0>>)(?=\\s*\\()`,[r],`i`),alias:`keyword`},function:{pattern:/\b[a-z_]\w*(?=\s*\()|(\.)[a-z_]\w*\b/i,lookbehind:!0},"line-continuation":{pattern:/(^[ \t]*)\\|\\(?=[ \t]*$)/m,lookbehind:!0,alias:`punctuation`},number:/\B\$(?:[\da-f]{6}|[\da-f]{8})\b|(?:(?:\b|\B-)\d+(?:\.\d*)?\b|\B\.\d+\b)/i,operator:/\+\+?|[!=<>]=?|&&|\|\||[?:*/%-]/,punctuation:/[{}\[\]();,.]/},e.languages.avs=e.languages.avisynth})(e)}le.displayName=`avro-idl`,le.aliases=[`avdl`];function le(e){e.languages[`avro-idl`]={comment:{pattern:/\/\/.*|\/\*[\s\S]*?\*\//,greedy:!0},string:{pattern:/(^|[^\\])"(?:[^\r\n"\\]|\\.)*"/,lookbehind:!0,greedy:!0},annotation:{pattern:/@(?:[$\w.-]|`[^\r\n`]+`)+/,greedy:!0,alias:`function`},"function-identifier":{pattern:/`[^\r\n`]+`(?=\s*\()/,greedy:!0,alias:`function`},identifier:{pattern:/`[^\r\n`]+`/,greedy:!0},"class-name":{pattern:/(\b(?:enum|error|protocol|record|throws)\b\s+)[$\w]+/,lookbehind:!0,greedy:!0},keyword:/\b(?:array|boolean|bytes|date|decimal|double|enum|error|false|fixed|float|idl|import|int|local_timestamp_ms|long|map|null|oneway|protocol|record|schema|string|throws|time_ms|timestamp_ms|true|union|uuid|void)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:[{pattern:/(^|[^\w.])-?(?:(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|0x(?:[a-f0-9]+(?:\.[a-f0-9]*)?|\.[a-f0-9]+)(?:p[+-]?\d+)?)[dfl]?(?![\w.])/i,lookbehind:!0},/-?\b(?:Infinity|NaN)\b/],operator:/=/,punctuation:/[()\[\]{}<>.:,;-]/},e.languages.avdl=e.languages[`avro-idl`]}ue.displayName=`awk`,ue.aliases=[`gawk`];function ue(e){e.languages.awk={hashbang:{pattern:/^#!.*/,greedy:!0,alias:`comment`},comment:{pattern:/#.*/,greedy:!0},string:{pattern:/(^|[^\\])"(?:[^\\"\r\n]|\\.)*"/,lookbehind:!0,greedy:!0},regex:{pattern:/((?:^|[^\w\s)])\s*)\/(?:[^\/\\\r\n]|\\.)*\//,lookbehind:!0,greedy:!0},variable:/\$\w+/,keyword:/\b(?:BEGIN|BEGINFILE|END|ENDFILE|break|case|continue|default|delete|do|else|exit|for|function|getline|if|in|next|nextfile|printf?|return|switch|while)\b|@(?:include|load)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/\b(?:\d+(?:\.\d+)?(?:e[+-]?\d+)?|0x[a-fA-F0-9]+)\b/,operator:/--|\+\+|!?~|>&|>>|<<|(?:\*\*|[<>!=+\-*/%^])=?|&&|\|[|&]|[?:]/,punctuation:/[()[\]{},;]/},e.languages.gawk=e.languages.awk}de.displayName=`bash`,de.aliases=[`sh`,`shell`];function de(e){(function(e){var t=`\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b`,n={pattern:/(^(["']?)\w+\2)[ \t]+\S.*/,lookbehind:!0,alias:`punctuation`,inside:null},r={bash:n,environment:{pattern:RegExp(`\\$`+t),alias:`constant`},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--|\+\+|\*\*=?|<<=?|>>=?|&&|\|\||[=!+\-*/%<>^&|]=?|[?~:]/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp(`(\\{)`+t),lookbehind:!0,alias:`constant`}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|U[0-9a-fA-F]{8}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{1,2})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:`important`},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)[\w-]+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:`function`},{pattern:/\b[\w-]+(?=\s*\(\s*\)\s*\{)/,alias:`function`}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:`variable`,lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?:\.\w+)*(?=\+?=)/,inside:{environment:{pattern:RegExp(`(^|[\\s;|&]|[<>]\\()`+t),lookbehind:!0,alias:`constant`}},alias:`variable`,lookbehind:!0},parameter:{pattern:/(^|\s)-{1,2}(?:\w+:[+-]?)?\w+(?:\.\w+)*(?=[=\s]|$)/,alias:`variable`,lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+)\s[\s\S]*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:r},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s[\s\S]*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0,inside:{bash:n}},{pattern:/(^|[^\\](?:\\\\)*)"(?:\\[\s\S]|\$\([^)]+\)|\$(?!\()|`[^`]+`|[^"\\`$])*"/,lookbehind:!0,greedy:!0,inside:r},{pattern:/(^|[^$\\])'[^']*'/,lookbehind:!0,greedy:!0},{pattern:/\$'(?:[^'\\]|\\[\s\S])*'/,greedy:!0,inside:{entity:r.entity}}],environment:{pattern:RegExp(`\\$?`+t),alias:`constant`},variable:r.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|apt-cache|apt-get|aptitude|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cargo|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|composer|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|docker|docker-compose|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|java|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|node|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|podman|podman-compose|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|sysctl|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vcpkg|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:case|do|done|elif|else|esac|fi|for|function|if|in|select|then|until|while)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|alias|bind|break|builtin|caller|cd|command|continue|declare|echo|enable|eval|exec|exit|export|getopts|hash|help|let|local|logout|mapfile|printf|pwd|read|readarray|readonly|return|set|shift|shopt|source|test|times|trap|type|typeset|ulimit|umask|unalias|unset)(?=$|[)\s;|&])/,lookbehind:!0,alias:`class-name`},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:false|true)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:`important`},operator:{pattern:/\d?<>|>\||\+=|=[=~]?|!=?|<<[<-]?|[&\d]?>>|\d[<>]&?|[<>][&=]?|&[>&]?|\|[&|]?/,inside:{"file-descriptor":{pattern:/^\d/,alias:`important`}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}},n.inside=e.languages.bash;for(var i=[`comment`,`function-name`,`for-or-select`,`assign-left`,`parameter`,`string`,`environment`,`function`,`keyword`,`builtin`,`boolean`,`file-descriptor`,`operator`,`punctuation`,`number`],a=r.variable[1].inside,o=0;o?^\w +\-.])*"/,greedy:!0},number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,keyword:/\b(?:AS|BEEP|BLOAD|BSAVE|CALL(?: ABSOLUTE)?|CASE|CHAIN|CHDIR|CLEAR|CLOSE|CLS|COM|COMMON|CONST|DATA|DECLARE|DEF(?: FN| SEG|DBL|INT|LNG|SNG|STR)|DIM|DO|DOUBLE|ELSE|ELSEIF|END|ENVIRON|ERASE|ERROR|EXIT|FIELD|FILES|FOR|FUNCTION|GET|GOSUB|GOTO|IF|INPUT|INTEGER|IOCTL|KEY|KILL|LINE INPUT|LOCATE|LOCK|LONG|LOOP|LSET|MKDIR|NAME|NEXT|OFF|ON(?: COM| ERROR| KEY| TIMER)?|OPEN|OPTION BASE|OUT|POKE|PUT|READ|REDIM|REM|RESTORE|RESUME|RETURN|RMDIR|RSET|RUN|SELECT CASE|SHARED|SHELL|SINGLE|SLEEP|STATIC|STEP|STOP|STRING|SUB|SWAP|SYSTEM|THEN|TIMER|TO|TROFF|TRON|TYPE|UNLOCK|UNTIL|USING|VIEW PRINT|WAIT|WEND|WHILE|WRITE)(?:\$|\b)/i,function:/\b(?:ABS|ACCESS|ACOS|ANGLE|AREA|ARITHMETIC|ARRAY|ASIN|ASK|AT|ATN|BASE|BEGIN|BREAK|CAUSE|CEIL|CHR|CLIP|COLLATE|COLOR|CON|COS|COSH|COT|CSC|DATE|DATUM|DEBUG|DECIMAL|DEF|DEG|DEGREES|DELETE|DET|DEVICE|DISPLAY|DOT|ELAPSED|EPS|ERASABLE|EXLINE|EXP|EXTERNAL|EXTYPE|FILETYPE|FIXED|FP|GO|GRAPH|HANDLER|IDN|IMAGE|IN|INT|INTERNAL|IP|IS|KEYED|LBOUND|LCASE|LEFT|LEN|LENGTH|LET|LINE|LINES|LOG|LOG10|LOG2|LTRIM|MARGIN|MAT|MAX|MAXNUM|MID|MIN|MISSING|MOD|NATIVE|NUL|NUMERIC|OF|OPTION|ORD|ORGANIZATION|OUTIN|OUTPUT|PI|POINT|POINTER|POINTS|POS|PRINT|PROGRAM|PROMPT|RAD|RADIANS|RANDOMIZE|RECORD|RECSIZE|RECTYPE|RELATIVE|REMAINDER|REPEAT|REST|RETRY|REWRITE|RIGHT|RND|ROUND|RTRIM|SAME|SEC|SELECT|SEQUENTIAL|SET|SETTER|SGN|SIN|SINH|SIZE|SKIP|SQR|STANDARD|STATUS|STR|STREAM|STYLE|TAB|TAN|TANH|TEMPLATE|TEXT|THERE|TIME|TIMEOUT|TRACE|TRANSFORM|TRUNCATE|UBOUND|UCASE|USE|VAL|VARIABLE|VIEWPORT|WHEN|WINDOW|WITH|ZER|ZONEWIDTH)(?:\$|\b)/i,operator:/<[=>]?|>=?|[+\-*\/^=&]|\b(?:AND|EQV|IMP|NOT|OR|XOR)\b/i,punctuation:/[,;:()]/}}pe.displayName=`batch`,pe.aliases=[];function pe(e){(function(e){var t=/%%?[~:\w]+%?|!\S+!/,n={pattern:/\/[a-z?]+(?=[ :]|$):?|-[a-z]\b|--[a-z-]+\b/im,alias:`attr-name`,inside:{punctuation:/:/}},r=/"(?:[\\"]"|[^"])*"(?!")/,i=/(?:\b|-)\d+\b/;e.languages.batch={comment:[/^::.*/m,{pattern:/((?:^|[&(])[ \t]*)rem\b(?:[^^&)\r\n]|\^(?:\r\n|[\s\S]))*/im,lookbehind:!0}],label:{pattern:/^:.*/m,alias:`property`},command:[{pattern:/((?:^|[&(])[ \t]*)for(?: \/[a-z?](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* \S+ in \([^)]+\) do/im,lookbehind:!0,inside:{keyword:/\b(?:do|in)\b|^for\b/i,string:r,parameter:n,variable:t,number:i,punctuation:/[()',]/}},{pattern:/((?:^|[&(])[ \t]*)if(?: \/[a-z?](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* (?:not )?(?:cmdextversion \d+|defined \w+|errorlevel \d+|exist \S+|(?:"[^"]*"|(?!")(?:(?!==)\S)+)?(?:==| (?:equ|geq|gtr|leq|lss|neq) )(?:"[^"]*"|[^\s"]\S*))/im,lookbehind:!0,inside:{keyword:/\b(?:cmdextversion|defined|errorlevel|exist|not)\b|^if\b/i,string:r,parameter:n,variable:t,number:i,operator:/\^|==|\b(?:equ|geq|gtr|leq|lss|neq)\b/i}},{pattern:/((?:^|[&()])[ \t]*)else\b/im,lookbehind:!0,inside:{keyword:/^else\b/i}},{pattern:/((?:^|[&(])[ \t]*)set(?: \/[a-z](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* (?:[^^&)\r\n]|\^(?:\r\n|[\s\S]))*/im,lookbehind:!0,inside:{keyword:/^set\b/i,string:r,parameter:n,variable:[t,/\w+(?=(?:[*\/%+\-&^|]|<<|>>)?=)/],number:i,operator:/[*\/%+\-&^|]=?|<<=?|>>=?|[!~_=]/,punctuation:/[()',]/}},{pattern:/((?:^|[&(])[ \t]*@?)\w+\b(?:"(?:[\\"]"|[^"])*"(?!")|[^"^&)\r\n]|\^(?:\r\n|[\s\S]))*/m,lookbehind:!0,inside:{keyword:/^\w+\b/,string:r,parameter:n,label:{pattern:/(^\s*):\S+/m,lookbehind:!0,alias:`property`},variable:t,number:i,operator:/\^/}}],operator:/[&@]/,punctuation:/[()']/}})(e)}me.displayName=`bbcode`,me.aliases=[`shortcode`];function me(e){e.languages.bbcode={tag:{pattern:/\[\/?[^\s=\]]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+))?(?:\s+[^\s=\]]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+))*\s*\]/,inside:{tag:{pattern:/^\[\/?[^\s=\]]+/,inside:{punctuation:/^\[\/?/}},"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+)/,inside:{punctuation:[/^=/,{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\]/,"attr-name":/[^\s=\]]+/}}},e.languages.shortcode=e.languages.bbcode}he.displayName=`bbj`,he.aliases=[];function he(e){(function(e){e.languages.bbj={comment:{pattern:/(^|[^\\:])rem\s+.*/i,lookbehind:!0,greedy:!0},string:{pattern:/(['"])(?:(?!\1|\\).|\\.)*\1/,greedy:!0},number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,keyword:/\b(?:abstract|all|argc|begin|bye|callback|case|chn|class|classend|ctl|day|declare|delete|dim|dom|dread|dsz|else|end|endif|err|exitto|extends|fi|field|for|from|gosub|goto|if|implements|interface|interfaceend|iol|iolist|let|list|load|method|methodend|methodret|on|opts|pfx|print|private|process_events|protected|psz|public|read|read_resource|release|remove_callback|repeat|restore|return|rev|seterr|setesc|sqlchn|sqlunt|ssn|start|static|swend|switch|sys|then|tim|unt|until|use|void|wend|where|while)\b/i,function:/\b\w+(?=\()/,boolean:/\b(?:BBjAPI\.TRUE|BBjAPI\.FALSE)\b/i,operator:/<[=>]?|>=?|[+\-*\/^=&]|\b(?:and|not|or|xor)\b/i,punctuation:/[.,;:()]/}})(e)}ge.displayName=`bicep`,ge.aliases=[];function ge(e){e.languages.bicep={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],property:[{pattern:/([\r\n][ \t]*)[a-z_]\w*(?=[ \t]*:)/i,lookbehind:!0},{pattern:/([\r\n][ \t]*)'(?:\\.|\$(?!\{)|[^'\\\r\n$])*'(?=[ \t]*:)/,lookbehind:!0,greedy:!0}],string:[{pattern:/'''[^'][\s\S]*?'''/,greedy:!0},{pattern:/(^|[^\\'])'(?:\\.|\$(?!\{)|[^'\\\r\n$])*'/,lookbehind:!0,greedy:!0}],"interpolated-string":{pattern:/(^|[^\\'])'(?:\\.|\$(?:(?!\{)|\{[^{}\r\n]*\})|[^'\\\r\n$])*'/,lookbehind:!0,greedy:!0,inside:{interpolation:{pattern:/\$\{[^{}\r\n]*\}/,inside:{expression:{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0},punctuation:/^\$\{|\}$/}},string:/[\s\S]+/}},datatype:{pattern:/(\b(?:output|param)\b[ \t]+\w+[ \t]+)\w+\b/,lookbehind:!0,alias:`class-name`},boolean:/\b(?:false|true)\b/,keyword:/\b(?:existing|for|if|in|module|null|output|param|resource|targetScope|var)\b/,decorator:/@\w+\b/,function:/\b[a-z_]\w*(?=[ \t]*\()/i,number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/,punctuation:/[{}[\];(),.:]/},e.languages.bicep[`interpolated-string`].inside.interpolation.inside.expression.inside=e.languages.bicep}_e.displayName=`birb`,_e.aliases=[];function _e(e){e.register(S),e.languages.birb=e.languages.extend(`clike`,{string:{pattern:/r?("|')(?:\\.|(?!\1)[^\\])*\1/,greedy:!0},"class-name":[/\b[A-Z](?:[\d_]*[a-zA-Z]\w*)?\b/,/\b(?:[A-Z]\w*|(?!(?:var|void)\b)[a-z]\w*)(?=\s+\w+\s*[;,=()])/],keyword:/\b(?:assert|break|case|class|const|default|else|enum|final|follows|for|grab|if|nest|new|next|noSeeb|return|static|switch|throw|var|void|while)\b/,operator:/\+\+|--|&&|\|\||<<=?|>>=?|~(?:\/=?)?|[+\-*\/%&^|=!<>]=?|\?|:/,variable:/\b[a-z_]\w*\b/}),e.languages.insertBefore(`birb`,`function`,{metadata:{pattern:/<\w+>/,greedy:!0,alias:`symbol`}})}ve.displayName=`bison`,ve.aliases=[];function ve(e){e.register(F),e.languages.bison=e.languages.extend(`c`,{}),e.languages.insertBefore(`bison`,`comment`,{bison:{pattern:/^(?:[^%]|%(?!%))*%%[\s\S]*?%%/,inside:{c:{pattern:/%\{[\s\S]*?%\}|\{(?:\{[^}]*\}|[^{}])*\}/,inside:{delimiter:{pattern:/^%?\{|%?\}$/,alias:`punctuation`},"bison-variable":{pattern:/[$@](?:<[^\s>]+>)?[\w$]+/,alias:`variable`,inside:{punctuation:/<|>/}},rest:e.languages.c}},comment:e.languages.c.comment,string:e.languages.c.string,property:/\S+(?=:)/,keyword:/%\w+/,number:{pattern:/(^|[^@])\b(?:0x[\da-f]+|\d+)/i,lookbehind:!0},punctuation:/%[%?]|[|:;\[\]<>]/}}})}ye.displayName=`bnf`,ye.aliases=[`rbnf`];function ye(e){e.languages.bnf={string:{pattern:/"[^\r\n"]*"|'[^\r\n']*'/},definition:{pattern:/<[^<>\r\n\t]+>(?=\s*::=)/,alias:[`rule`,`keyword`],inside:{punctuation:/^<|>$/}},rule:{pattern:/<[^<>\r\n\t]+>/,inside:{punctuation:/^<|>$/}},operator:/::=|[|()[\]{}*+?]|\.{3}/},e.languages.rbnf=e.languages.bnf}be.displayName=`bqn`,be.aliases=[];function be(e){e.languages.bqn={shebang:{pattern:/^#![ \t]*\/.*/,alias:`important`,greedy:!0},comment:{pattern:/#.*/,greedy:!0},"string-literal":{pattern:/"(?:[^"]|"")*"/,greedy:!0,alias:`string`},"character-literal":{pattern:/'(?:[\s\S]|[\uD800-\uDBFF][\uDC00-\uDFFF])'/,greedy:!0,alias:`char`},function:/•[\w¯.∞π]+[\w¯.∞π]*/,"dot-notation-on-brackets":{pattern:/\{(?=.*\}\.)|\}\./,alias:`namespace`},"special-name":{pattern:/(?:𝕨|𝕩|𝕗|𝕘|𝕤|𝕣|𝕎|𝕏|𝔽|𝔾|𝕊|_𝕣_|_𝕣)/,alias:`keyword`},"dot-notation-on-name":{pattern:/[A-Za-z_][\w¯∞π]*\./,alias:`namespace`},"word-number-scientific":{pattern:/\d+(?:\.\d+)?[eE]¯?\d+/,alias:`number`},"word-name":{pattern:/[A-Za-z_][\w¯∞π]*/,alias:`symbol`},"word-number":{pattern:/[¯∞π]?(?:\d*\.?\b\d+(?:e[+¯]?\d+|E[+¯]?\d+)?|¯|∞|π)(?:j¯?(?:(?:\d+(?:\.\d+)?|\.\d+)(?:e[+¯]?\d+|E[+¯]?\d+)?|¯|∞|π))?/,alias:`number`},"null-literal":{pattern:/@/,alias:`char`},"primitive-functions":{pattern:/[-+×÷⋆√⌊⌈|¬∧∨<>≠=≤≥≡≢⊣⊢⥊∾≍⋈↑↓↕«»⌽⍉/⍋⍒⊏⊑⊐⊒∊⍷⊔!]/,alias:`operator`},"primitive-1-operators":{pattern:/[`˜˘¨⁼⌜´˝˙]/,alias:`operator`},"primitive-2-operators":{pattern:/[∘⊸⟜○⌾⎉⚇⍟⊘◶⎊]/,alias:`operator`},punctuation:/[←⇐↩(){}⟨⟩[\]‿·⋄,.;:?]/}}xe.displayName=`brainfuck`,xe.aliases=[];function xe(e){e.languages.brainfuck={pointer:{pattern:/<|>/,alias:`keyword`},increment:{pattern:/\+/,alias:`inserted`},decrement:{pattern:/-/,alias:`deleted`},branching:{pattern:/\[|\]/,alias:`important`},operator:/[.,]/,comment:/\S+/}}Se.displayName=`brightscript`,Se.aliases=[];function Se(e){e.languages.brightscript={comment:/(?:\brem|').*/i,"directive-statement":{pattern:/(^[\t ]*)#(?:const|else(?:[\t ]+if)?|end[\t ]+if|error|if).*/im,lookbehind:!0,alias:`property`,inside:{"error-message":{pattern:/(^#error).+/,lookbehind:!0},directive:{pattern:/^#(?:const|else(?:[\t ]+if)?|end[\t ]+if|error|if)/,alias:`keyword`},expression:{pattern:/[\s\S]+/,inside:null}}},property:{pattern:/([\r\n{,][\t ]*)(?:(?!\d)\w+|"(?:[^"\r\n]|"")*"(?!"))(?=[ \t]*:)/,lookbehind:!0,greedy:!0},string:{pattern:/"(?:[^"\r\n]|"")*"(?!")/,greedy:!0},"class-name":{pattern:/(\bAs[\t ]+)\w+/i,lookbehind:!0},keyword:/\b(?:As|Dim|Each|Else|Elseif|End|Exit|For|Function|Goto|If|In|Print|Return|Step|Stop|Sub|Then|To|While)\b/i,boolean:/\b(?:false|true)\b/i,function:/\b(?!\d)\w+(?=[\t ]*\()/,number:/(?:\b\d+(?:\.\d+)?(?:[ed][+-]\d+)?|&h[a-f\d]+)\b[%&!#]?/i,operator:/--|\+\+|>>=?|<<=?|<>|[-+*/\\<>]=?|[:^=?]|\b(?:and|mod|not|or)\b/i,punctuation:/[.,;()[\]{}]/,constant:/\b(?:LINE_NUM)\b/i},e.languages.brightscript[`directive-statement`].inside.expression.inside=e.languages.brightscript}Ce.displayName=`bro`,Ce.aliases=[];function Ce(e){e.languages.bro={comment:{pattern:/(^|[^\\$])#.*/,lookbehind:!0,inside:{italic:/\b(?:FIXME|TODO|XXX)\b/}},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},boolean:/\b[TF]\b/,function:{pattern:/(\b(?:event|function|hook)[ \t]+)\w+(?:::\w+)?/,lookbehind:!0},builtin:/(?:@(?:load(?:-(?:plugin|sigs))?|unload|prefixes|ifn?def|else|(?:end)?if|DIR|FILENAME))|(?:&?(?:add_func|create_expire|default|delete_func|encrypt|error_handler|expire_func|group|log|mergeable|optional|persistent|priority|raw_output|read_expire|redef|rotate_interval|rotate_size|synchronized|type_column|write_expire))/,constant:{pattern:/(\bconst[ \t]+)\w+/i,lookbehind:!0},keyword:/\b(?:add|addr|alarm|any|bool|break|const|continue|count|delete|double|else|enum|event|export|file|for|function|global|hook|if|in|int|interval|local|module|next|of|opaque|pattern|port|print|record|return|schedule|set|string|subnet|table|time|timeout|using|vector|when)\b/,operator:/--?|\+\+?|!=?=?|<=?|>=?|==?=?|&&|\|\|?|\?|\*|\/|~|\^|%/,number:/\b0x[\da-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?/i,punctuation:/[{}[\];(),.:]/}}we.displayName=`bsl`,we.aliases=[`oscript`];function we(e){e.languages.bsl={comment:/\/\/.*/,string:[{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},{pattern:/'(?:[^'\r\n\\]|\\.)*'/}],keyword:[{pattern:/(^|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:пока|для|новый|прервать|попытка|исключение|вызватьисключение|иначе|конецпопытки|неопределено|функция|перем|возврат|конецфункции|если|иначеесли|процедура|конецпроцедуры|тогда|знач|экспорт|конецесли|из|каждого|истина|ложь|по|цикл|конеццикла|выполнить)(?![\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])/i,lookbehind:!0},{pattern:/\b(?:break|do|each|else|elseif|enddo|endfunction|endif|endprocedure|endtry|except|execute|export|false|for|function|if|in|new|null|procedure|raise|return|then|to|true|try|undefined|val|var|while)\b/i}],number:{pattern:/(^(?=\d)|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:\d+(?:\.\d*)?|\.\d+)(?:E[+-]?\d+)?/i,lookbehind:!0},operator:[/[<>+\-*/]=?|[%=]/,{pattern:/(^|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:и|или|не)(?![\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])/i,lookbehind:!0},{pattern:/\b(?:and|not|or)\b/i}],punctuation:/\(\.|\.\)|[()\[\]:;,.]/,directive:[{pattern:/^([ \t]*)&.*/m,lookbehind:!0,greedy:!0,alias:`important`},{pattern:/^([ \t]*)#.*/gm,lookbehind:!0,greedy:!0,alias:`important`}]},e.languages.oscript=e.languages.bsl}Te.displayName=`cfscript`,Te.aliases=[`cfc`];function Te(e){e.register(S),e.languages.cfscript=e.languages.extend(`clike`,{comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,inside:{annotation:{pattern:/(?:^|[^.])@[\w\.]+/,alias:`punctuation`}}},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],keyword:/\b(?:abstract|break|catch|component|continue|default|do|else|extends|final|finally|for|function|if|in|include|package|private|property|public|remote|required|rethrow|return|static|switch|throw|try|var|while|xml)\b(?!\s*=)/,operator:[/\+\+|--|&&|\|\||::|=>|[!=]==|[-+*/%&|^!=<>]=?|\?(?:\.|:)?|:/,/\b(?:and|contains|eq|equal|eqv|gt|gte|imp|is|lt|lte|mod|not|or|xor)\b/],scope:{pattern:/\b(?:application|arguments|cgi|client|cookie|local|session|super|this|variables)\b/,alias:`global`},type:{pattern:/\b(?:any|array|binary|boolean|date|guid|numeric|query|string|struct|uuid|void|xml)\b/,alias:`builtin`}}),e.languages.insertBefore(`cfscript`,`keyword`,{"function-variable":{pattern:/[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:`function`}}),delete e.languages.cfscript[`class-name`],e.languages.cfc=e.languages.cfscript}Ee.displayName=`chaiscript`,Ee.aliases=[];function Ee(e){e.register(S),e.register(I),e.languages.chaiscript=e.languages.extend(`clike`,{string:{pattern:/(^|[^\\])'(?:[^'\\]|\\[\s\S])*'/,lookbehind:!0,greedy:!0},"class-name":[{pattern:/(\bclass\s+)\w+/,lookbehind:!0},{pattern:/(\b(?:attr|def)\s+)\w+(?=\s*::)/,lookbehind:!0}],keyword:/\b(?:attr|auto|break|case|catch|class|continue|def|default|else|finally|for|fun|global|if|return|switch|this|try|var|while)\b/,number:[e.languages.cpp.number,/\b(?:Infinity|NaN)\b/],operator:/>>=?|<<=?|\|\||&&|:[:=]?|--|\+\+|[=!<>+\-*/%|&^]=?|[?~]|`[^`\r\n]{1,4}`/}),e.languages.insertBefore(`chaiscript`,`operator`,{"parameter-type":{pattern:/([,(]\s*)\w+(?=\s+\w)/,lookbehind:!0,alias:`class-name`}}),e.languages.insertBefore(`chaiscript`,`string`,{"string-interpolation":{pattern:/(^|[^\\])"(?:[^"$\\]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\})*"/,lookbehind:!0,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\}/,lookbehind:!0,inside:{"interpolation-expression":{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0,inside:e.languages.chaiscript},"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`}}},string:/[\s\S]+/}}})}De.displayName=`cil`,De.aliases=[];function De(e){e.languages.cil={comment:/\/\/.*/,string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},directive:{pattern:/(^|\W)\.[a-z]+(?=\s)/,lookbehind:!0,alias:`class-name`},variable:/\[[\w\.]+\]/,keyword:/\b(?:abstract|ansi|assembly|auto|autochar|beforefieldinit|bool|bstr|byvalstr|catch|char|cil|class|currency|date|decimal|default|enum|error|explicit|extends|extern|famandassem|family|famorassem|final(?:ly)?|float32|float64|hidebysig|u?int(?:8|16|32|64)?|iant|idispatch|implements|import|initonly|instance|interface|iunknown|literal|lpstr|lpstruct|lptstr|lpwstr|managed|method|native(?:Type)?|nested|newslot|object(?:ref)?|pinvokeimpl|private|privatescope|public|reqsecobj|rtspecialname|runtime|sealed|sequential|serializable|specialname|static|string|struct|syschar|tbstr|unicode|unmanagedexp|unsigned|value(?:type)?|variant|virtual|void)\b/,function:/\b(?:(?:constrained|no|readonly|tail|unaligned|volatile)\.)?(?:conv\.(?:[iu][1248]?|ovf\.[iu][1248]?(?:\.un)?|r\.un|r4|r8)|ldc\.(?:i4(?:\.\d+|\.[mM]1|\.s)?|i8|r4|r8)|ldelem(?:\.[iu][1248]?|\.r[48]|\.ref|a)?|ldind\.(?:[iu][1248]?|r[48]|ref)|stelem\.?(?:i[1248]?|r[48]|ref)?|stind\.(?:i[1248]?|r[48]|ref)?|end(?:fault|filter|finally)|ldarg(?:\.[0-3s]|a(?:\.s)?)?|ldloc(?:\.\d+|\.s)?|sub(?:\.ovf(?:\.un)?)?|mul(?:\.ovf(?:\.un)?)?|add(?:\.ovf(?:\.un)?)?|stloc(?:\.[0-3s])?|refany(?:type|val)|blt(?:\.un)?(?:\.s)?|ble(?:\.un)?(?:\.s)?|bgt(?:\.un)?(?:\.s)?|bge(?:\.un)?(?:\.s)?|unbox(?:\.any)?|init(?:blk|obj)|call(?:i|virt)?|brfalse(?:\.s)?|bne\.un(?:\.s)?|ldloca(?:\.s)?|brzero(?:\.s)?|brtrue(?:\.s)?|brnull(?:\.s)?|brinst(?:\.s)?|starg(?:\.s)?|leave(?:\.s)?|shr(?:\.un)?|rem(?:\.un)?|div(?:\.un)?|clt(?:\.un)?|alignment|castclass|ldvirtftn|beq(?:\.s)?|ckfinite|ldsflda|ldtoken|localloc|mkrefany|rethrow|cgt\.un|arglist|switch|stsfld|sizeof|newobj|newarr|ldsfld|ldnull|ldflda|isinst|throw|stobj|stfld|ldstr|ldobj|ldlen|ldftn|ldfld|cpobj|cpblk|break|br\.s|xor|shl|ret|pop|not|nop|neg|jmp|dup|cgt|ceq|box|and|or|br)\b/,boolean:/\b(?:false|true)\b/,number:/\b-?(?:0x[0-9a-f]+|\d+)(?:\.[0-9a-f]+)?\b/i,punctuation:/[{}[\];(),:=]|IL_[0-9A-Za-z]+/}}Oe.displayName=`cilkc`,Oe.aliases=[`cilk-c`];function Oe(e){e.register(F),e.languages.cilkc=e.languages.insertBefore(`c`,`function`,{"parallel-keyword":{pattern:/\bcilk_(?:for|reducer|s(?:cope|pawn|ync))\b/,alias:`keyword`}}),e.languages[`cilk-c`]=e.languages.cilkc}ke.displayName=`cilkcpp`,ke.aliases=[`cilk`,`cilk-cpp`];function ke(e){e.register(I),e.languages.cilkcpp=e.languages.insertBefore(`cpp`,`function`,{"parallel-keyword":{pattern:/\bcilk_(?:for|reducer|s(?:cope|pawn|ync))\b/,alias:`keyword`}}),e.languages[`cilk-cpp`]=e.languages.cilkcpp,e.languages.cilk=e.languages.cilkcpp}Ae.displayName=`clojure`,Ae.aliases=[];function Ae(e){e.languages.clojure={comment:{pattern:/;.*/,greedy:!0},string:{pattern:/"(?:[^"\\]|\\.)*"/,greedy:!0},char:/\\\w+/,symbol:{pattern:/(^|[\s()\[\]{},])::?[\w*+!?'<>=/.-]+/,lookbehind:!0},keyword:{pattern:/(\()(?:-|->|->>|\.|\.\.|\*|\/|\+|<|<=|=|==|>|>=|accessor|agent|agent-errors|aget|alength|all-ns|alter|and|append-child|apply|array-map|aset|aset-boolean|aset-byte|aset-char|aset-double|aset-float|aset-int|aset-long|aset-short|assert|assoc|await|await-for|bean|binding|bit-and|bit-not|bit-or|bit-shift-left|bit-shift-right|bit-xor|boolean|branch\?|butlast|byte|cast|char|children|class|clear-agent-errors|comment|commute|comp|comparator|complement|concat|cond|conj|cons|constantly|construct-proxy|contains\?|count|create-ns|create-struct|cycle|dec|declare|def|def-|definline|definterface|defmacro|defmethod|defmulti|defn|defn-|defonce|defproject|defprotocol|defrecord|defstruct|deftype|deref|difference|disj|dissoc|distinct|do|doall|doc|dorun|doseq|dosync|dotimes|doto|double|down|drop|drop-while|edit|end\?|ensure|eval|every\?|false\?|ffirst|file-seq|filter|find|find-doc|find-ns|find-var|first|float|flush|fn|fnseq|for|frest|gensym|get|get-proxy-class|hash-map|hash-set|identical\?|identity|if|if-let|if-not|import|in-ns|inc|index|insert-child|insert-left|insert-right|inspect-table|inspect-tree|instance\?|int|interleave|intersection|into|into-array|iterate|join|key|keys|keyword|keyword\?|last|lazy-cat|lazy-cons|left|lefts|let|line-seq|list|list\*|load|load-file|locking|long|loop|macroexpand|macroexpand-1|make-array|make-node|map|map-invert|map\?|mapcat|max|max-key|memfn|merge|merge-with|meta|min|min-key|monitor-enter|name|namespace|neg\?|new|newline|next|nil\?|node|not|not-any\?|not-every\?|not=|ns|ns-imports|ns-interns|ns-map|ns-name|ns-publics|ns-refers|ns-resolve|ns-unmap|nth|nthrest|or|parse|partial|path|peek|pop|pos\?|pr|pr-str|print|print-str|println|println-str|prn|prn-str|project|proxy|proxy-mappings|quot|quote|rand|rand-int|range|re-find|re-groups|re-matcher|re-matches|re-pattern|re-seq|read|read-line|recur|reduce|ref|ref-set|refer|rem|remove|remove-method|remove-ns|rename|rename-keys|repeat|replace|replicate|resolve|rest|resultset-seq|reverse|rfirst|right|rights|root|rrest|rseq|second|select|select-keys|send|send-off|seq|seq-zip|seq\?|set|set!|short|slurp|some|sort|sort-by|sorted-map|sorted-map-by|sorted-set|special-symbol\?|split-at|split-with|str|string\?|struct|struct-map|subs|subvec|symbol|symbol\?|sync|take|take-nth|take-while|test|throw|time|to-array|to-array-2d|tree-seq|true\?|try|union|up|update-proxy|val|vals|var|var-get|var-set|var\?|vector|vector-zip|vector\?|when|when-first|when-let|when-not|with-local-vars|with-meta|with-open|with-out-str|xml-seq|xml-zip|zero\?|zipmap|zipper)(?=[\s)]|$)/,lookbehind:!0},boolean:/\b(?:false|nil|true)\b/,number:{pattern:/(^|[^\w$@])(?:\d+(?:[/.]\d+)?(?:e[+-]?\d+)?|0x[a-f0-9]+|[1-9]\d?r[a-z0-9]+)[lmn]?(?![\w$@])/i,lookbehind:!0},function:{pattern:/((?:^|[^'])\()[\w*+!?'<>=/.-]+(?=[\s)]|$)/,lookbehind:!0},operator:/[#@^`~]/,punctuation:/[{}\[\](),]/}}je.displayName=`cmake`,je.aliases=[];function je(e){e.languages.cmake={comment:/#.*/,string:{pattern:/"(?:[^\\"]|\\.)*"/,greedy:!0,inside:{interpolation:{pattern:/\$\{(?:[^{}$]|\$\{[^{}$]*\})*\}/,inside:{punctuation:/\$\{|\}/,variable:/\w+/}}}},variable:/\b(?:CMAKE_\w+|\w+_(?:(?:BINARY|SOURCE)_DIR|DESCRIPTION|HOMEPAGE_URL|ROOT|VERSION(?:_MAJOR|_MINOR|_PATCH|_TWEAK)?)|(?:ANDROID|APPLE|BORLAND|BUILD_SHARED_LIBS|CACHE|CPACK_(?:ABSOLUTE_DESTINATION_FILES|COMPONENT_INCLUDE_TOPLEVEL_DIRECTORY|ERROR_ON_ABSOLUTE_INSTALL_DESTINATION|INCLUDE_TOPLEVEL_DIRECTORY|INSTALL_DEFAULT_DIRECTORY_PERMISSIONS|INSTALL_SCRIPT|PACKAGING_INSTALL_PREFIX|SET_DESTDIR|WARN_ON_ABSOLUTE_INSTALL_DESTINATION)|CTEST_(?:BINARY_DIRECTORY|BUILD_COMMAND|BUILD_NAME|BZR_COMMAND|BZR_UPDATE_OPTIONS|CHANGE_ID|CHECKOUT_COMMAND|CONFIGURATION_TYPE|CONFIGURE_COMMAND|COVERAGE_COMMAND|COVERAGE_EXTRA_FLAGS|CURL_OPTIONS|CUSTOM_(?:COVERAGE_EXCLUDE|ERROR_EXCEPTION|ERROR_MATCH|ERROR_POST_CONTEXT|ERROR_PRE_CONTEXT|MAXIMUM_FAILED_TEST_OUTPUT_SIZE|MAXIMUM_NUMBER_OF_(?:ERRORS|WARNINGS)|MAXIMUM_PASSED_TEST_OUTPUT_SIZE|MEMCHECK_IGNORE|POST_MEMCHECK|POST_TEST|PRE_MEMCHECK|PRE_TEST|TESTS_IGNORE|WARNING_EXCEPTION|WARNING_MATCH)|CVS_CHECKOUT|CVS_COMMAND|CVS_UPDATE_OPTIONS|DROP_LOCATION|DROP_METHOD|DROP_SITE|DROP_SITE_CDASH|DROP_SITE_PASSWORD|DROP_SITE_USER|EXTRA_COVERAGE_GLOB|GIT_COMMAND|GIT_INIT_SUBMODULES|GIT_UPDATE_CUSTOM|GIT_UPDATE_OPTIONS|HG_COMMAND|HG_UPDATE_OPTIONS|LABELS_FOR_SUBPROJECTS|MEMORYCHECK_(?:COMMAND|COMMAND_OPTIONS|SANITIZER_OPTIONS|SUPPRESSIONS_FILE|TYPE)|NIGHTLY_START_TIME|P4_CLIENT|P4_COMMAND|P4_OPTIONS|P4_UPDATE_OPTIONS|RUN_CURRENT_SCRIPT|SCP_COMMAND|SITE|SOURCE_DIRECTORY|SUBMIT_URL|SVN_COMMAND|SVN_OPTIONS|SVN_UPDATE_OPTIONS|TEST_LOAD|TEST_TIMEOUT|TRIGGER_SITE|UPDATE_COMMAND|UPDATE_OPTIONS|UPDATE_VERSION_ONLY|USE_LAUNCHERS)|CYGWIN|ENV|EXECUTABLE_OUTPUT_PATH|GHS-MULTI|IOS|LIBRARY_OUTPUT_PATH|MINGW|MSVC(?:10|11|12|14|60|70|71|80|90|_IDE|_TOOLSET_VERSION|_VERSION)?|MSYS|PROJECT_NAME|UNIX|WIN32|WINCE|WINDOWS_PHONE|WINDOWS_STORE|XCODE))\b/,property:/\b(?:cxx_\w+|(?:ARCHIVE_OUTPUT_(?:DIRECTORY|NAME)|COMPILE_DEFINITIONS|COMPILE_PDB_NAME|COMPILE_PDB_OUTPUT_DIRECTORY|EXCLUDE_FROM_DEFAULT_BUILD|IMPORTED_(?:IMPLIB|LIBNAME|LINK_DEPENDENT_LIBRARIES|LINK_INTERFACE_LANGUAGES|LINK_INTERFACE_LIBRARIES|LINK_INTERFACE_MULTIPLICITY|LOCATION|NO_SONAME|OBJECTS|SONAME)|INTERPROCEDURAL_OPTIMIZATION|LIBRARY_OUTPUT_DIRECTORY|LIBRARY_OUTPUT_NAME|LINK_FLAGS|LINK_INTERFACE_LIBRARIES|LINK_INTERFACE_MULTIPLICITY|LOCATION|MAP_IMPORTED_CONFIG|OSX_ARCHITECTURES|OUTPUT_NAME|PDB_NAME|PDB_OUTPUT_DIRECTORY|RUNTIME_OUTPUT_DIRECTORY|RUNTIME_OUTPUT_NAME|STATIC_LIBRARY_FLAGS|VS_CSHARP|VS_DOTNET_REFERENCEPROP|VS_DOTNET_REFERENCE|VS_GLOBAL_SECTION_POST|VS_GLOBAL_SECTION_PRE|VS_GLOBAL|XCODE_ATTRIBUTE)_\w+|\w+_(?:CLANG_TIDY|COMPILER_LAUNCHER|CPPCHECK|CPPLINT|INCLUDE_WHAT_YOU_USE|OUTPUT_NAME|POSTFIX|VISIBILITY_PRESET)|ABSTRACT|ADDITIONAL_MAKE_CLEAN_FILES|ADVANCED|ALIASED_TARGET|ALLOW_DUPLICATE_CUSTOM_TARGETS|ANDROID_(?:ANT_ADDITIONAL_OPTIONS|API|API_MIN|ARCH|ASSETS_DIRECTORIES|GUI|JAR_DEPENDENCIES|NATIVE_LIB_DEPENDENCIES|NATIVE_LIB_DIRECTORIES|PROCESS_MAX|PROGUARD|PROGUARD_CONFIG_PATH|SECURE_PROPS_PATH|SKIP_ANT_STEP|STL_TYPE)|ARCHIVE_OUTPUT_DIRECTORY|ATTACHED_FILES|ATTACHED_FILES_ON_FAIL|AUTOGEN_(?:BUILD_DIR|ORIGIN_DEPENDS|PARALLEL|SOURCE_GROUP|TARGETS_FOLDER|TARGET_DEPENDS)|AUTOMOC|AUTOMOC_(?:COMPILER_PREDEFINES|DEPEND_FILTERS|EXECUTABLE|MACRO_NAMES|MOC_OPTIONS|SOURCE_GROUP|TARGETS_FOLDER)|AUTORCC|AUTORCC_EXECUTABLE|AUTORCC_OPTIONS|AUTORCC_SOURCE_GROUP|AUTOUIC|AUTOUIC_EXECUTABLE|AUTOUIC_OPTIONS|AUTOUIC_SEARCH_PATHS|BINARY_DIR|BUILDSYSTEM_TARGETS|BUILD_RPATH|BUILD_RPATH_USE_ORIGIN|BUILD_WITH_INSTALL_NAME_DIR|BUILD_WITH_INSTALL_RPATH|BUNDLE|BUNDLE_EXTENSION|CACHE_VARIABLES|CLEAN_NO_CUSTOM|COMMON_LANGUAGE_RUNTIME|COMPATIBLE_INTERFACE_(?:BOOL|NUMBER_MAX|NUMBER_MIN|STRING)|COMPILE_(?:DEFINITIONS|FEATURES|FLAGS|OPTIONS|PDB_NAME|PDB_OUTPUT_DIRECTORY)|COST|CPACK_DESKTOP_SHORTCUTS|CPACK_NEVER_OVERWRITE|CPACK_PERMANENT|CPACK_STARTUP_SHORTCUTS|CPACK_START_MENU_SHORTCUTS|CPACK_WIX_ACL|CROSSCOMPILING_EMULATOR|CUDA_EXTENSIONS|CUDA_PTX_COMPILATION|CUDA_RESOLVE_DEVICE_SYMBOLS|CUDA_SEPARABLE_COMPILATION|CUDA_STANDARD|CUDA_STANDARD_REQUIRED|CXX_EXTENSIONS|CXX_STANDARD|CXX_STANDARD_REQUIRED|C_EXTENSIONS|C_STANDARD|C_STANDARD_REQUIRED|DEBUG_CONFIGURATIONS|DEFINE_SYMBOL|DEFINITIONS|DEPENDS|DEPLOYMENT_ADDITIONAL_FILES|DEPLOYMENT_REMOTE_DIRECTORY|DISABLED|DISABLED_FEATURES|ECLIPSE_EXTRA_CPROJECT_CONTENTS|ECLIPSE_EXTRA_NATURES|ENABLED_FEATURES|ENABLED_LANGUAGES|ENABLE_EXPORTS|ENVIRONMENT|EXCLUDE_FROM_ALL|EXCLUDE_FROM_DEFAULT_BUILD|EXPORT_NAME|EXPORT_PROPERTIES|EXTERNAL_OBJECT|EchoString|FAIL_REGULAR_EXPRESSION|FIND_LIBRARY_USE_LIB32_PATHS|FIND_LIBRARY_USE_LIB64_PATHS|FIND_LIBRARY_USE_LIBX32_PATHS|FIND_LIBRARY_USE_OPENBSD_VERSIONING|FIXTURES_CLEANUP|FIXTURES_REQUIRED|FIXTURES_SETUP|FOLDER|FRAMEWORK|Fortran_FORMAT|Fortran_MODULE_DIRECTORY|GENERATED|GENERATOR_FILE_NAME|GENERATOR_IS_MULTI_CONFIG|GHS_INTEGRITY_APP|GHS_NO_SOURCE_GROUP_FILE|GLOBAL_DEPENDS_DEBUG_MODE|GLOBAL_DEPENDS_NO_CYCLES|GNUtoMS|HAS_CXX|HEADER_FILE_ONLY|HELPSTRING|IMPLICIT_DEPENDS_INCLUDE_TRANSFORM|IMPORTED|IMPORTED_(?:COMMON_LANGUAGE_RUNTIME|CONFIGURATIONS|GLOBAL|IMPLIB|LIBNAME|LINK_DEPENDENT_LIBRARIES|LINK_INTERFACE_(?:LANGUAGES|LIBRARIES|MULTIPLICITY)|LOCATION|NO_SONAME|OBJECTS|SONAME)|IMPORT_PREFIX|IMPORT_SUFFIX|INCLUDE_DIRECTORIES|INCLUDE_REGULAR_EXPRESSION|INSTALL_NAME_DIR|INSTALL_RPATH|INSTALL_RPATH_USE_LINK_PATH|INTERFACE_(?:AUTOUIC_OPTIONS|COMPILE_DEFINITIONS|COMPILE_FEATURES|COMPILE_OPTIONS|INCLUDE_DIRECTORIES|LINK_DEPENDS|LINK_DIRECTORIES|LINK_LIBRARIES|LINK_OPTIONS|POSITION_INDEPENDENT_CODE|SOURCES|SYSTEM_INCLUDE_DIRECTORIES)|INTERPROCEDURAL_OPTIMIZATION|IN_TRY_COMPILE|IOS_INSTALL_COMBINED|JOB_POOLS|JOB_POOL_COMPILE|JOB_POOL_LINK|KEEP_EXTENSION|LABELS|LANGUAGE|LIBRARY_OUTPUT_DIRECTORY|LINKER_LANGUAGE|LINK_(?:DEPENDS|DEPENDS_NO_SHARED|DIRECTORIES|FLAGS|INTERFACE_LIBRARIES|INTERFACE_MULTIPLICITY|LIBRARIES|OPTIONS|SEARCH_END_STATIC|SEARCH_START_STATIC|WHAT_YOU_USE)|LISTFILE_STACK|LOCATION|MACOSX_BUNDLE|MACOSX_BUNDLE_INFO_PLIST|MACOSX_FRAMEWORK_INFO_PLIST|MACOSX_PACKAGE_LOCATION|MACOSX_RPATH|MACROS|MANUALLY_ADDED_DEPENDENCIES|MEASUREMENT|MODIFIED|NAME|NO_SONAME|NO_SYSTEM_FROM_IMPORTED|OBJECT_DEPENDS|OBJECT_OUTPUTS|OSX_ARCHITECTURES|OUTPUT_NAME|PACKAGES_FOUND|PACKAGES_NOT_FOUND|PARENT_DIRECTORY|PASS_REGULAR_EXPRESSION|PDB_NAME|PDB_OUTPUT_DIRECTORY|POSITION_INDEPENDENT_CODE|POST_INSTALL_SCRIPT|PREDEFINED_TARGETS_FOLDER|PREFIX|PRE_INSTALL_SCRIPT|PRIVATE_HEADER|PROCESSORS|PROCESSOR_AFFINITY|PROJECT_LABEL|PUBLIC_HEADER|REPORT_UNDEFINED_PROPERTIES|REQUIRED_FILES|RESOURCE|RESOURCE_LOCK|RULE_LAUNCH_COMPILE|RULE_LAUNCH_CUSTOM|RULE_LAUNCH_LINK|RULE_MESSAGES|RUNTIME_OUTPUT_DIRECTORY|RUN_SERIAL|SKIP_AUTOGEN|SKIP_AUTOMOC|SKIP_AUTORCC|SKIP_AUTOUIC|SKIP_BUILD_RPATH|SKIP_RETURN_CODE|SOURCES|SOURCE_DIR|SOVERSION|STATIC_LIBRARY_FLAGS|STATIC_LIBRARY_OPTIONS|STRINGS|SUBDIRECTORIES|SUFFIX|SYMBOLIC|TARGET_ARCHIVES_MAY_BE_SHARED_LIBS|TARGET_MESSAGES|TARGET_SUPPORTS_SHARED_LIBS|TESTS|TEST_INCLUDE_FILE|TEST_INCLUDE_FILES|TIMEOUT|TIMEOUT_AFTER_MATCH|TYPE|USE_FOLDERS|VALUE|VARIABLES|VERSION|VISIBILITY_INLINES_HIDDEN|VS_(?:CONFIGURATION_TYPE|COPY_TO_OUT_DIR|DEBUGGER_(?:COMMAND|COMMAND_ARGUMENTS|ENVIRONMENT|WORKING_DIRECTORY)|DEPLOYMENT_CONTENT|DEPLOYMENT_LOCATION|DOTNET_REFERENCES|DOTNET_REFERENCES_COPY_LOCAL|INCLUDE_IN_VSIX|IOT_STARTUP_TASK|KEYWORD|RESOURCE_GENERATOR|SCC_AUXPATH|SCC_LOCALPATH|SCC_PROJECTNAME|SCC_PROVIDER|SDK_REFERENCES|SHADER_(?:DISABLE_OPTIMIZATIONS|ENABLE_DEBUG|ENTRYPOINT|FLAGS|MODEL|OBJECT_FILE_NAME|OUTPUT_HEADER_FILE|TYPE|VARIABLE_NAME)|STARTUP_PROJECT|TOOL_OVERRIDE|USER_PROPS|WINRT_COMPONENT|WINRT_EXTENSIONS|WINRT_REFERENCES|XAML_TYPE)|WILL_FAIL|WIN32_EXECUTABLE|WINDOWS_EXPORT_ALL_SYMBOLS|WORKING_DIRECTORY|WRAP_EXCLUDE|XCODE_(?:EMIT_EFFECTIVE_PLATFORM_NAME|EXPLICIT_FILE_TYPE|FILE_ATTRIBUTES|LAST_KNOWN_FILE_TYPE|PRODUCT_TYPE|SCHEME_(?:ADDRESS_SANITIZER|ADDRESS_SANITIZER_USE_AFTER_RETURN|ARGUMENTS|DISABLE_MAIN_THREAD_CHECKER|DYNAMIC_LIBRARY_LOADS|DYNAMIC_LINKER_API_USAGE|ENVIRONMENT|EXECUTABLE|GUARD_MALLOC|MAIN_THREAD_CHECKER_STOP|MALLOC_GUARD_EDGES|MALLOC_SCRIBBLE|MALLOC_STACK|THREAD_SANITIZER(?:_STOP)?|UNDEFINED_BEHAVIOUR_SANITIZER(?:_STOP)?|ZOMBIE_OBJECTS))|XCTEST)\b/,keyword:/\b(?:add_compile_definitions|add_compile_options|add_custom_command|add_custom_target|add_definitions|add_dependencies|add_executable|add_library|add_link_options|add_subdirectory|add_test|aux_source_directory|break|build_command|build_name|cmake_host_system_information|cmake_minimum_required|cmake_parse_arguments|cmake_policy|configure_file|continue|create_test_sourcelist|ctest_build|ctest_configure|ctest_coverage|ctest_empty_binary_directory|ctest_memcheck|ctest_read_custom_files|ctest_run_script|ctest_sleep|ctest_start|ctest_submit|ctest_test|ctest_update|ctest_upload|define_property|else|elseif|enable_language|enable_testing|endforeach|endfunction|endif|endmacro|endwhile|exec_program|execute_process|export|export_library_dependencies|file|find_file|find_library|find_package|find_path|find_program|fltk_wrap_ui|foreach|function|get_cmake_property|get_directory_property|get_filename_component|get_property|get_source_file_property|get_target_property|get_test_property|if|include|include_directories|include_external_msproject|include_guard|include_regular_expression|install|install_files|install_programs|install_targets|link_directories|link_libraries|list|load_cache|load_command|macro|make_directory|mark_as_advanced|math|message|option|output_required_files|project|qt_wrap_cpp|qt_wrap_ui|remove|remove_definitions|return|separate_arguments|set|set_directory_properties|set_property|set_source_files_properties|set_target_properties|set_tests_properties|site_name|source_group|string|subdir_depends|subdirs|target_compile_definitions|target_compile_features|target_compile_options|target_include_directories|target_link_directories|target_link_libraries|target_link_options|target_sources|try_compile|try_run|unset|use_mangled_mesa|utility_source|variable_requires|variable_watch|while|write_file)(?=\s*\()\b/,boolean:/\b(?:FALSE|OFF|ON|TRUE)\b/,namespace:/\b(?:INTERFACE|PRIVATE|PROPERTIES|PUBLIC|SHARED|STATIC|TARGET_OBJECTS)\b/,operator:/\b(?:AND|DEFINED|EQUAL|GREATER|LESS|MATCHES|NOT|OR|STREQUAL|STRGREATER|STRLESS|VERSION_EQUAL|VERSION_GREATER|VERSION_LESS)\b/,inserted:{pattern:/\b\w+::\w+\b/,alias:`class-name`},number:/\b\d+(?:\.\d+)*\b/,function:/\b[a-z_]\w*(?=\s*\()\b/i,punctuation:/[()>}]|\$[<{]/}}Me.displayName=`cobol`,Me.aliases=[];function Me(e){e.languages.cobol={comment:{pattern:/\*>.*|(^[ \t]*)\*.*/m,lookbehind:!0,greedy:!0},string:{pattern:/[xzgn]?(?:"(?:[^\r\n"]|"")*"(?!")|'(?:[^\r\n']|'')*'(?!'))/i,greedy:!0},level:{pattern:/(^[ \t]*)\d+\b/m,lookbehind:!0,greedy:!0,alias:`number`},"class-name":{pattern:/(\bpic(?:ture)?\s+)(?:(?:[-\w$/,:*+<>]|\.(?!\s|$))(?:\(\d+\))?)+/i,lookbehind:!0,inside:{number:{pattern:/(\()\d+/,lookbehind:!0},punctuation:/[()]/}},keyword:{pattern:/(^|[^\w-])(?:ABORT|ACCEPT|ACCESS|ADD|ADDRESS|ADVANCING|AFTER|ALIGNED|ALL|ALPHABET|ALPHABETIC|ALPHABETIC-LOWER|ALPHABETIC-UPPER|ALPHANUMERIC|ALPHANUMERIC-EDITED|ALSO|ALTER|ALTERNATE|ANY|ARE|AREA|AREAS|AS|ASCENDING|ASCII|ASSIGN|ASSOCIATED-DATA|ASSOCIATED-DATA-LENGTH|AT|ATTRIBUTE|AUTHOR|AUTO|AUTO-SKIP|BACKGROUND-COLOR|BACKGROUND-COLOUR|BASIS|BEEP|BEFORE|BEGINNING|BELL|BINARY|BIT|BLANK|BLINK|BLOCK|BOTTOM|BOUNDS|BY|BYFUNCTION|BYTITLE|CALL|CANCEL|CAPABLE|CCSVERSION|CD|CF|CH|CHAINING|CHANGED|CHANNEL|CHARACTER|CHARACTERS|CLASS|CLASS-ID|CLOCK-UNITS|CLOSE|CLOSE-DISPOSITION|COBOL|CODE|CODE-SET|COL|COLLATING|COLUMN|COM-REG|COMMA|COMMITMENT|COMMON|COMMUNICATION|COMP|COMP-1|COMP-2|COMP-3|COMP-4|COMP-5|COMPUTATIONAL|COMPUTATIONAL-1|COMPUTATIONAL-2|COMPUTATIONAL-3|COMPUTATIONAL-4|COMPUTATIONAL-5|COMPUTE|CONFIGURATION|CONTAINS|CONTENT|CONTINUE|CONTROL|CONTROL-POINT|CONTROLS|CONVENTION|CONVERTING|COPY|CORR|CORRESPONDING|COUNT|CRUNCH|CURRENCY|CURSOR|DATA|DATA-BASE|DATE|DATE-COMPILED|DATE-WRITTEN|DAY|DAY-OF-WEEK|DBCS|DE|DEBUG-CONTENTS|DEBUG-ITEM|DEBUG-LINE|DEBUG-NAME|DEBUG-SUB-1|DEBUG-SUB-2|DEBUG-SUB-3|DEBUGGING|DECIMAL-POINT|DECLARATIVES|DEFAULT|DEFAULT-DISPLAY|DEFINITION|DELETE|DELIMITED|DELIMITER|DEPENDING|DESCENDING|DESTINATION|DETAIL|DFHRESP|DFHVALUE|DISABLE|DISK|DISPLAY|DISPLAY-1|DIVIDE|DIVISION|DONTCARE|DOUBLE|DOWN|DUPLICATES|DYNAMIC|EBCDIC|EGCS|EGI|ELSE|EMI|EMPTY-CHECK|ENABLE|END|END-ACCEPT|END-ADD|END-CALL|END-COMPUTE|END-DELETE|END-DIVIDE|END-EVALUATE|END-IF|END-MULTIPLY|END-OF-PAGE|END-PERFORM|END-READ|END-RECEIVE|END-RETURN|END-REWRITE|END-SEARCH|END-START|END-STRING|END-SUBTRACT|END-UNSTRING|END-WRITE|ENDING|ENTER|ENTRY|ENTRY-PROCEDURE|ENVIRONMENT|EOL|EOP|EOS|ERASE|ERROR|ESCAPE|ESI|EVALUATE|EVENT|EVERY|EXCEPTION|EXCLUSIVE|EXHIBIT|EXIT|EXPORT|EXTEND|EXTENDED|EXTERNAL|FD|FILE|FILE-CONTROL|FILLER|FINAL|FIRST|FOOTING|FOR|FOREGROUND-COLOR|FOREGROUND-COLOUR|FROM|FULL|FUNCTION|FUNCTION-POINTER|FUNCTIONNAME|GENERATE|GIVING|GLOBAL|GO|GOBACK|GRID|GROUP|HEADING|HIGH-VALUE|HIGH-VALUES|HIGHLIGHT|I-O|I-O-CONTROL|ID|IDENTIFICATION|IF|IMPLICIT|IMPORT|IN|INDEX|INDEXED|INDICATE|INITIAL|INITIALIZE|INITIATE|INPUT|INPUT-OUTPUT|INSPECT|INSTALLATION|INTEGER|INTO|INVALID|INVOKE|IS|JUST|JUSTIFIED|KANJI|KEPT|KEY|KEYBOARD|LABEL|LANGUAGE|LAST|LB|LD|LEADING|LEFT|LEFTLINE|LENGTH|LENGTH-CHECK|LIBACCESS|LIBPARAMETER|LIBRARY|LIMIT|LIMITS|LINAGE|LINAGE-COUNTER|LINE|LINE-COUNTER|LINES|LINKAGE|LIST|LOCAL|LOCAL-STORAGE|LOCK|LONG-DATE|LONG-TIME|LOW-VALUE|LOW-VALUES|LOWER|LOWLIGHT|MEMORY|MERGE|MESSAGE|MMDDYYYY|MODE|MODULES|MORE-LABELS|MOVE|MULTIPLE|MULTIPLY|NAMED|NATIONAL|NATIONAL-EDITED|NATIVE|NEGATIVE|NETWORK|NEXT|NO|NO-ECHO|NULL|NULLS|NUMBER|NUMERIC|NUMERIC-DATE|NUMERIC-EDITED|NUMERIC-TIME|OBJECT-COMPUTER|OCCURS|ODT|OF|OFF|OMITTED|ON|OPEN|OPTIONAL|ORDER|ORDERLY|ORGANIZATION|OTHER|OUTPUT|OVERFLOW|OVERLINE|OWN|PACKED-DECIMAL|PADDING|PAGE|PAGE-COUNTER|PASSWORD|PERFORM|PF|PH|PIC|PICTURE|PLUS|POINTER|PORT|POSITION|POSITIVE|PRINTER|PRINTING|PRIVATE|PROCEDURE|PROCEDURE-POINTER|PROCEDURES|PROCEED|PROCESS|PROGRAM|PROGRAM-ID|PROGRAM-LIBRARY|PROMPT|PURGE|QUEUE|QUOTE|QUOTES|RANDOM|RD|READ|READER|REAL|RECEIVE|RECEIVED|RECORD|RECORDING|RECORDS|RECURSIVE|REDEFINES|REEL|REF|REFERENCE|REFERENCES|RELATIVE|RELEASE|REMAINDER|REMARKS|REMOTE|REMOVAL|REMOVE|RENAMES|REPLACE|REPLACING|REPORT|REPORTING|REPORTS|REQUIRED|RERUN|RESERVE|RESET|RETURN|RETURN-CODE|RETURNING|REVERSE-VIDEO|REVERSED|REWIND|REWRITE|RF|RH|RIGHT|ROUNDED|RUN|SAME|SAVE|SCREEN|SD|SEARCH|SECTION|SECURE|SECURITY|SEGMENT|SEGMENT-LIMIT|SELECT|SEND|SENTENCE|SEPARATE|SEQUENCE|SEQUENTIAL|SET|SHARED|SHAREDBYALL|SHAREDBYRUNUNIT|SHARING|SHIFT-IN|SHIFT-OUT|SHORT-DATE|SIGN|SIZE|SORT|SORT-CONTROL|SORT-CORE-SIZE|SORT-FILE-SIZE|SORT-MERGE|SORT-MESSAGE|SORT-MODE-SIZE|SORT-RETURN|SOURCE|SOURCE-COMPUTER|SPACE|SPACES|SPECIAL-NAMES|STANDARD|STANDARD-1|STANDARD-2|START|STATUS|STOP|STRING|SUB-QUEUE-1|SUB-QUEUE-2|SUB-QUEUE-3|SUBTRACT|SUM|SUPPRESS|SYMBOL|SYMBOLIC|SYNC|SYNCHRONIZED|TABLE|TALLY|TALLYING|TAPE|TASK|TERMINAL|TERMINATE|TEST|TEXT|THEN|THREAD|THREAD-LOCAL|THROUGH|THRU|TIME|TIMER|TIMES|TITLE|TO|TODAYS-DATE|TODAYS-NAME|TOP|TRAILING|TRUNCATED|TYPE|TYPEDEF|UNDERLINE|UNIT|UNSTRING|UNTIL|UP|UPON|USAGE|USE|USING|VALUE|VALUES|VARYING|VIRTUAL|WAIT|WHEN|WHEN-COMPILED|WITH|WORDS|WORKING-STORAGE|WRITE|YEAR|YYYYDDD|YYYYMMDD|ZERO-FILL|ZEROES|ZEROS)(?![\w-])/i,lookbehind:!0},boolean:{pattern:/(^|[^\w-])(?:false|true)(?![\w-])/i,lookbehind:!0},number:{pattern:/(^|[^\w-])(?:[+-]?(?:(?:\d+(?:[.,]\d+)?|[.,]\d+)(?:e[+-]?\d+)?|zero))(?![\w-])/i,lookbehind:!0},operator:[/<>|[<>]=?|[=+*/&]/,{pattern:/(^|[^\w-])(?:-|and|equal|greater|less|not|or|than)(?![\w-])/i,lookbehind:!0}],punctuation:/[.:,()]/}}Ne.displayName=`coffeescript`,Ne.aliases=[`coffee`];function Ne(e){e.register(C),(function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:`variable`};e.languages.coffeescript=e.languages.extend(`javascript`,{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:`variable`}}),e.languages.insertBefore(`coffeescript`,`comment`,{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:`comment`},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:`regex`,inside:{comment:t,interpolation:n}}}),e.languages.insertBefore(`coffeescript`,`string`,{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:`punctuation`},script:{pattern:/[\s\S]+/,alias:`language-javascript`,inside:e.languages.javascript}}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:`string`},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:`string`,inside:{interpolation:n}}]}),e.languages.insertBefore(`coffeescript`,`keyword`,{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript[`template-string`],e.languages.coffee=e.languages.coffeescript})(e)}Pe.displayName=`concurnas`,Pe.aliases=[`conc`];function Pe(e){e.languages.concurnas={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?(?:\*\/|$)|\/\/.*)/,lookbehind:!0,greedy:!0},langext:{pattern:/\b\w+\s*\|\|[\s\S]+?\|\|/,greedy:!0,inside:{"class-name":/^\w+/,string:{pattern:/(^\s*\|\|)[\s\S]+(?=\|\|$)/,lookbehind:!0},punctuation:/\|\|/}},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/,lookbehind:!0},keyword:/\b(?:abstract|actor|also|annotation|assert|async|await|bool|boolean|break|byte|case|catch|changed|char|class|closed|constant|continue|def|default|del|double|elif|else|enum|every|extends|false|finally|float|for|from|global|gpudef|gpukernel|if|import|in|init|inject|int|lambda|local|long|loop|match|new|nodefault|null|of|onchange|open|out|override|package|parfor|parforsync|post|pre|private|protected|provide|provider|public|return|shared|short|single|size_t|sizeof|super|sync|this|throw|trait|trans|transient|true|try|typedef|unchecked|using|val|var|void|while|with)\b/,boolean:/\b(?:false|true)\b/,number:/\b0b[01][01_]*L?\b|\b0x(?:[\da-f_]*\.)?[\da-f_p+-]+\b|(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.\d[\d_]*)(?:e[+-]?\d[\d_]*)?[dfls]?/i,punctuation:/[{}[\];(),.:]/,operator:/<==|>==|=>|->|<-|<>|&==|&<>|\?:?|\.\?|\+\+|--|[-+*/=<>]=?|[!^~]|\b(?:and|as|band|bor|bxor|comp|is|isnot|mod|or)\b=?/,annotation:{pattern:/@(?:\w+:)?(?:\w+|\[[^\]]+\])?/,alias:`builtin`}},e.languages.insertBefore(`concurnas`,`langext`,{"regex-literal":{pattern:/\br("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:e.languages.concurnas},regex:/[\s\S]+/}},"string-literal":{pattern:/(?:\B|\bs)("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:e.languages.concurnas},string:/[\s\S]+/}}}),e.languages.conc=e.languages.concurnas}Fe.displayName=`cooklang`,Fe.aliases=[];function Fe(e){(function(e){var t=`(?:(?!\\s)[\\d$+<=a-zA-Z\\x80-\\uFFFF])+`,n=`[^{}@#]+`,r=n+`\\{[^}#@]*\\}`,i=`(?:h|hours|hrs|m|min|minutes)`,a={pattern:/\{[^{}]*\}/,inside:{amount:{pattern:/([\{|])[^{}|*%]+/,lookbehind:!0,alias:`number`},unit:{pattern:/(%)[^}]+/,lookbehind:!0,alias:`symbol`},"servings-scaler":{pattern:/\*/,alias:`operator`},"servings-alternative-separator":{pattern:/\|/,alias:`operator`},"unit-separator":{pattern:/(?:%|(\*)%)/,lookbehind:!0,alias:`operator`},punctuation:/[{}]/}};e.languages.cooklang={comment:{pattern:/\[-[\s\S]*?-\]|--.*/,greedy:!0},meta:{pattern:/>>.*:.*/,inside:{property:{pattern:/(>>\s*)[^\s:](?:[^:]*[^\s:])?/,lookbehind:!0}}},"cookware-group":{pattern:RegExp(`#(?:`+r+`|`+t+`)`),inside:{cookware:{pattern:RegExp(`(^#)(?:`+n+`)`),lookbehind:!0,alias:`variable`},"cookware-keyword":{pattern:/^#/,alias:`keyword`},"quantity-group":{pattern:new RegExp(/\{[^{}@#]*\}/),inside:{quantity:{pattern:RegExp(`(^\\{)`+n),lookbehind:!0,alias:`number`},punctuation:/[{}]/}}}},"ingredient-group":{pattern:RegExp(`@(?:`+r+`|`+t+`)`),inside:{ingredient:{pattern:RegExp(`(^@)(?:`+n+`)`),lookbehind:!0,alias:`variable`},"ingredient-keyword":{pattern:/^@/,alias:`keyword`},"amount-group":a}},"timer-group":{pattern:/~(?!\s)[^@#~{}]*\{[^{}]*\}/,inside:{timer:{pattern:/(^~)[^{]+/,lookbehind:!0,alias:`variable`},"duration-group":{pattern:/\{[^{}]*\}/,inside:{punctuation:/[{}]/,unit:{pattern:RegExp(`(%\\s*)`+i+`\\b`),lookbehind:!0,alias:`symbol`},operator:/%/,duration:{pattern:/\d+/,alias:`number`}}},"timer-keyword":{pattern:/^~/,alias:`keyword`}}}}})(e)}Ie.displayName=`coq`,Ie.aliases=[];function Ie(e){(function(e){for(var t=`\\(\\*(?:[^(*]|\\((?!\\*)|\\*(?!\\))|)*\\*\\)`,n=0;n<2;n++)t=t.replace(//g,function(){return t});t=t.replace(//g,`[]`),e.languages.coq={comment:RegExp(t),string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},attribute:[{pattern:RegExp(`#\\[(?:[^\\[\\]("]|"(?:[^"]|"")*"(?!")|\\((?!\\*)|)*\\]`.replace(//g,function(){return t})),greedy:!0,alias:`attr-name`,inside:{comment:RegExp(t),string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},operator:/=/,punctuation:/^#\[|\]$|[,()]/}},{pattern:/\b(?:Cumulative|Global|Local|Monomorphic|NonCumulative|Polymorphic|Private|Program)\b/,alias:`attr-name`}],keyword:/\b(?:Abort|About|Add|Admit|Admitted|All|Arguments|As|Assumptions|Axiom|Axioms|Back|BackTo|Backtrace|BinOp|BinOpSpec|BinRel|Bind|Blacklist|Canonical|Case|Cd|Check|Class|Classes|Close|CoFixpoint|CoInductive|Coercion|Coercions|Collection|Combined|Compute|Conjecture|Conjectures|Constant|Constants|Constraint|Constructors|Context|Corollary|Create|CstOp|Custom|Cut|Debug|Declare|Defined|Definition|Delimit|Dependencies|Dependent|Derive|Diffs|Drop|Elimination|End|Entry|Equality|Eval|Example|Existential|Existentials|Existing|Export|Extern|Extraction|Fact|Fail|Field|File|Firstorder|Fixpoint|Flags|Focus|From|Funclass|Function|Functional|GC|Generalizable|Goal|Grab|Grammar|Graph|Guarded|Haskell|Heap|Hide|Hint|HintDb|Hints|Hypotheses|Hypothesis|IF|Identity|Immediate|Implicit|Implicits|Import|Include|Induction|Inductive|Infix|Info|Initial|InjTyp|Inline|Inspect|Instance|Instances|Intro|Intros|Inversion|Inversion_clear|JSON|Language|Left|Lemma|Let|Lia|Libraries|Library|Load|LoadPath|Locate|Ltac|Ltac2|ML|Match|Method|Minimality|Module|Modules|Morphism|Next|NoInline|Notation|Number|OCaml|Obligation|Obligations|Opaque|Open|Optimize|Parameter|Parameters|Parametric|Path|Paths|Prenex|Preterm|Primitive|Print|Profile|Projections|Proof|Prop|PropBinOp|PropOp|PropUOp|Property|Proposition|Pwd|Qed|Quit|Rec|Record|Recursive|Redirect|Reduction|Register|Relation|Remark|Remove|Require|Reserved|Reset|Resolve|Restart|Rewrite|Right|Ring|Rings|SProp|Saturate|Save|Scheme|Scope|Scopes|Search|SearchHead|SearchPattern|SearchRewrite|Section|Separate|Set|Setoid|Show|Signatures|Solve|Solver|Sort|Sortclass|Sorted|Spec|Step|Strategies|Strategy|String|Structure|SubClass|Subgraph|SuchThat|Tactic|Term|TestCompile|Theorem|Time|Timeout|To|Transparent|Type|Typeclasses|Types|Typing|UnOp|UnOpSpec|Undelimit|Undo|Unfocus|Unfocused|Unfold|Universe|Universes|Unshelve|Variable|Variables|Variant|Verbose|View|Visibility|Zify|_|apply|as|at|by|cofix|else|end|exists|exists2|fix|for|forall|fun|if|in|let|match|measure|move|removed|return|struct|then|using|wf|where|with)\b/,number:/\b(?:0x[a-f0-9][a-f0-9_]*(?:\.[a-f0-9_]+)?(?:p[+-]?\d[\d_]*)?|\d[\d_]*(?:\.[\d_]+)?(?:e[+-]?\d[\d_]*)?)\b/i,punct:{pattern:/@\{|\{\||\[=|:>/,alias:`punctuation`},operator:/\/\\|\\\/|\.{2,3}|:{1,2}=|\*\*|[-=]>|<(?:->?|[+:=>]|<:)|>(?:=|->)|\|[-|]?|[-!%&*+/<=>?@^~']/,punctuation:/\.\(|`\(|@\{|`\{|\{\||\[=|:>|[:.,;(){}\[\]]/}})(e)}V.displayName=`ruby`,V.aliases=[`rb`];function V(e){e.register(S),(function(e){e.languages.ruby=e.languages.extend(`clike`,{comment:{pattern:/#.*|^=begin\s[\s\S]*?^=end/m,greedy:!0},"class-name":{pattern:/(\b(?:class|module)\s+|\bcatch\s+\()[\w.\\]+|\b[A-Z_]\w*(?=\s*\.\s*new\b)/,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:BEGIN|END|alias|and|begin|break|case|class|def|define_method|defined|do|each|else|elsif|end|ensure|extend|for|if|in|include|module|new|next|nil|not|or|prepend|private|protected|public|raise|redo|require|rescue|retry|return|self|super|then|throw|undef|unless|until|when|while|yield)\b/,operator:/\.{2,3}|&\.|===||[!=]?~|(?:&&|\|\||<<|>>|\*\*|[+\-*/%<>!^&|=])=?|[?:]/,punctuation:/[(){}[\].,;]/}),e.languages.insertBefore(`ruby`,`operator`,{"double-colon":{pattern:/::/,alias:`punctuation`}});var t={pattern:/((?:^|[^\\])(?:\\{2})*)#\{(?:[^{}]|\{[^{}]*\})*\}/,lookbehind:!0,inside:{content:{pattern:/^(#\{)[\s\S]+(?=\}$)/,lookbehind:!0,inside:e.languages.ruby},delimiter:{pattern:/^#\{|\}$/,alias:`punctuation`}}};delete e.languages.ruby.function;var n=`(?:`+[`([^a-zA-Z0-9\\s{(\\[<=])(?:(?!\\1)[^\\\\]|\\\\[\\s\\S])*\\1`,`\\((?:[^()\\\\]|\\\\[\\s\\S]|\\((?:[^()\\\\]|\\\\[\\s\\S])*\\))*\\)`,`\\{(?:[^{}\\\\]|\\\\[\\s\\S]|\\{(?:[^{}\\\\]|\\\\[\\s\\S])*\\})*\\}`,`\\[(?:[^\\[\\]\\\\]|\\\\[\\s\\S]|\\[(?:[^\\[\\]\\\\]|\\\\[\\s\\S])*\\])*\\]`,`<(?:[^<>\\\\]|\\\\[\\s\\S]|<(?:[^<>\\\\]|\\\\[\\s\\S])*>)*>`].join(`|`)+`)`,r=`(?:"(?:\\\\.|[^"\\\\\\r\\n])*"|(?:\\b[a-zA-Z_]\\w*|[^\\s\\0-\\x7F]+)[?!]?|\\$.)`;e.languages.insertBefore(`ruby`,`keyword`,{"regex-literal":[{pattern:RegExp(`%r`+n+`[egimnosux]{0,6}`),greedy:!0,inside:{interpolation:t,regex:/[\s\S]+/}},{pattern:/(^|[^/])\/(?!\/)(?:\[[^\r\n\]]+\]|\\.|[^[/\\\r\n])+\/[egimnosux]{0,6}(?=\s*(?:$|[\r\n,.;})#]))/,lookbehind:!0,greedy:!0,inside:{interpolation:t,regex:/[\s\S]+/}}],variable:/[@$]+[a-zA-Z_]\w*(?:[?!]|\b)/,symbol:[{pattern:RegExp(`(^|[^:]):`+r),lookbehind:!0,greedy:!0},{pattern:RegExp(`([\\r\\n{(,][ \\t]*)`+r+`(?=:(?!:))`),lookbehind:!0,greedy:!0}],"method-definition":{pattern:/(\bdef\s+)\w+(?:\s*\.\s*\w+)?/,lookbehind:!0,inside:{function:/\b\w+$/,keyword:/^self\b/,"class-name":/^\w+/,punctuation:/\./}}}),e.languages.insertBefore(`ruby`,`string`,{"string-literal":[{pattern:RegExp(`%[qQiIwWs]?`+n),greedy:!0,inside:{interpolation:t,string:/[\s\S]+/}},{pattern:/("|')(?:#\{[^}]+\}|#(?!\{)|\\(?:\r\n|[\s\S])|(?!\1)[^\\#\r\n])*\1/,greedy:!0,inside:{interpolation:t,string:/[\s\S]+/}},{pattern:/<<[-~]?([a-z_]\w*)[\r\n](?:.*[\r\n])*?[\t ]*\1/i,alias:`heredoc-string`,greedy:!0,inside:{delimiter:{pattern:/^<<[-~]?[a-z_]\w*|\b[a-z_]\w*$/i,inside:{symbol:/\b\w+/,punctuation:/^<<[-~]?/}},interpolation:t,string:/[\s\S]+/}},{pattern:/<<[-~]?'([a-z_]\w*)'[\r\n](?:.*[\r\n])*?[\t ]*\1/i,alias:`heredoc-string`,greedy:!0,inside:{delimiter:{pattern:/^<<[-~]?'[a-z_]\w*'|\b[a-z_]\w*$/i,inside:{symbol:/\b\w+/,punctuation:/^<<[-~]?'|'$/}},string:/[\s\S]+/}}],"command-literal":[{pattern:RegExp(`%x`+n),greedy:!0,inside:{interpolation:t,command:{pattern:/[\s\S]+/,alias:`string`}}},{pattern:/`(?:#\{[^}]+\}|#(?!\{)|\\(?:\r\n|[\s\S])|[^\\`#\r\n])*`/,greedy:!0,inside:{interpolation:t,command:{pattern:/[\s\S]+/,alias:`string`}}}]}),delete e.languages.ruby.string,e.languages.insertBefore(`ruby`,`number`,{builtin:/\b(?:Array|Bignum|Binding|Class|Continuation|Dir|Exception|FalseClass|File|Fixnum|Float|Hash|IO|Integer|MatchData|Method|Module|NilClass|Numeric|Object|Proc|Range|Regexp|Stat|String|Struct|Symbol|TMS|Thread|ThreadGroup|Time|TrueClass)\b/,constant:/\b[A-Z][A-Z0-9_]*(?:[?!]|\b)/}),e.languages.rb=e.languages.ruby})(e)}Le.displayName=`crystal`,Le.aliases=[];function Le(e){e.register(V),(function(e){e.languages.crystal=e.languages.extend(`ruby`,{keyword:[/\b(?:__DIR__|__END_LINE__|__FILE__|__LINE__|abstract|alias|annotation|as|asm|begin|break|case|class|def|do|else|elsif|end|ensure|enum|extend|for|fun|if|ifdef|include|instance_sizeof|lib|macro|module|next|of|out|pointerof|private|protected|ptr|require|rescue|return|select|self|sizeof|struct|super|then|type|typeof|undef|uninitialized|union|unless|until|when|while|with|yield)\b/,{pattern:/(\.\s*)(?:is_a|responds_to)\?/,lookbehind:!0}],number:/\b(?:0b[01_]*[01]|0o[0-7_]*[0-7]|0x[\da-fA-F_]*[\da-fA-F]|(?:\d(?:[\d_]*\d)?)(?:\.[\d_]*\d)?(?:[eE][+-]?[\d_]*\d)?)(?:_(?:[uif](?:8|16|32|64))?)?\b/,operator:[/->/,e.languages.ruby.operator],punctuation:/[(){}[\].,;\\]/}),e.languages.insertBefore(`crystal`,`string-literal`,{attribute:{pattern:/@\[.*?\]/,inside:{delimiter:{pattern:/^@\[|\]$/,alias:`punctuation`},attribute:{pattern:/^(\s*)\w+/,lookbehind:!0,alias:`class-name`},args:{pattern:/\S(?:[\s\S]*\S)?/,inside:e.languages.crystal}}},expansion:{pattern:/\{(?:\{.*?\}|%.*?%)\}/,inside:{content:{pattern:/^(\{.)[\s\S]+(?=.\}$)/,lookbehind:!0,inside:e.languages.crystal},delimiter:{pattern:/^\{[\{%]|[\}%]\}$/,alias:`operator`}}},char:{pattern:/'(?:[^\\\r\n]{1,2}|\\(?:.|u(?:[A-Fa-f0-9]{1,4}|\{[A-Fa-f0-9]{1,6}\})))'/,greedy:!0}})})(e)}Re.displayName=`cshtml`,Re.aliases=[`razor`];function Re(e){e.register(z),e.register(B),(function(e){var t=`\\/(?![/*])|\\/\\/.*[\\r\\n]|\\/\\*[^*]*(?:\\*(?!\\/)[^*]*)*\\*\\/`,n=`@(?!")|"(?:[^\\r\\n\\\\"]|\\\\.)*"|@"(?:[^\\\\"]|""|\\\\[\\s\\S])*"(?!")|'(?:(?:[^\\r\\n'\\\\]|\\\\.|\\\\[Uux][\\da-fA-F]{1,8})'|(?=[^\\\\](?!')))`;function r(e,r){for(var i=0;i/g,function(){return`(?:`+e+`)`});return e.replace(//g,`[^\\s\\S]`).replace(//g,`(?:`+n+`)`).replace(//g,`(?:`+t+`)`)}var i=r(`\\((?:[^()'"@/]|||)*\\)`,2),a=r(`\\[(?:[^\\[\\]'"@/]|||)*\\]`,1),o=r(`\\{(?:[^{}'"@/]|||)*\\}`,2),s=r(`<(?:[^<>'"@/]||)*>`,1),c=`@(?:await\\b\\s*)?(?:(?!await\\b)\\w+\\b|`+i+`)(?:[?!]?\\.\\w+\\b|(?:`+s+`)?`+i+`|`+a+`)*(?![?!\\.(\\[]|<(?!\\/))`,l=`(?:"[^"@]*"|'[^'@]*'|[^\\s'"@>=]+(?=[\\s>])|["'][^"'@]*(?:(?:`+(`@(?![\\w()])|`+c)+`)[^"'@]*)+["'])`,u=`(?:\\s(?:\\s*[^\\s>\\/=]+(?:\\s*=\\s*|(?=[\\s/>])))+)?`.replace(//,l),d=`(?!\\d)[^\\s>\\/=$<%]+`+u+`\\s*\\/?>`,f=`\\B@?(?:<([a-zA-Z][\\w:]*)`+u+`\\s*>(?:`+(`[^<]|<\\/?(?!\\1\\b)`+d+`|`+r(`<\\1`+u+`\\s*>(?:`+(`[^<]|<\\/?(?!\\1\\b)`+d+`|`)+`)*<\\/\\1\\s*>`,2))+`)*<\\/\\1\\s*>|<`+d+`)`;e.languages.cshtml=e.languages.extend(`markup`,{});var p={pattern:/\S[\s\S]*/,alias:`language-csharp`,inside:e.languages.insertBefore(`csharp`,`string`,{html:{pattern:RegExp(f),greedy:!0,inside:e.languages.cshtml}},{csharp:e.languages.extend(`csharp`,{})})},m={pattern:RegExp(`(^|[^@])`+c),lookbehind:!0,greedy:!0,alias:`variable`,inside:{keyword:/^@/,csharp:p}};e.languages.cshtml.tag.pattern=RegExp(`<\\/?`+d),e.languages.cshtml.tag.inside[`attr-value`].pattern=RegExp(`=\\s*`+l),e.languages.insertBefore(`inside`,`punctuation`,{value:m},e.languages.cshtml.tag.inside[`attr-value`]),e.languages.insertBefore(`cshtml`,`prolog`,{"razor-comment":{pattern:/@\*[\s\S]*?\*@/,greedy:!0,alias:`comment`},block:{pattern:RegExp(`(^|[^@])@(?:`+[o,`(?:code|functions)\\s*`+o,`(?:for|foreach|lock|switch|using|while)\\s*`+i+`\\s*`+o,`do\\s*`+o+`\\s*while\\s*`+i+`(?:\\s*;)?`,`try\\s*`+o+`\\s*catch\\s*`+i+`\\s*`+o+`\\s*finally\\s*`+o,`if\\s*`+i+`\\s*`+o+`(?:\\s*else(?:\\s+if\\s*`+i+`)?\\s*`+o+`)*`,`helper\\s+\\w+\\s*`+i+`\\s*`+o].join(`|`)+`)`),lookbehind:!0,greedy:!0,inside:{keyword:/^@\w*/,csharp:p}},directive:{pattern:/^([ \t]*)@(?:addTagHelper|attribute|implements|inherits|inject|layout|model|namespace|page|preservewhitespace|removeTagHelper|section|tagHelperPrefix|using)(?=\s).*/m,lookbehind:!0,greedy:!0,inside:{keyword:/^@\w+/,csharp:p}},value:m,"delegate-operator":{pattern:/(^|[^@])@(?=<)/,lookbehind:!0,alias:`operator`}}),e.languages.razor=e.languages.cshtml})(e)}ze.displayName=`csp`,ze.aliases=[];function ze(e){(function(e){function t(e){return RegExp(`([ \\t])(?:`+e+`)(?=[\\s;]|$)`,`i`)}e.languages.csp={directive:{pattern:/(^|[\s;])(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|prefetch|script|style|worker)-src|disown-opener|form-action|frame-(?:ancestors|options)|input-protection(?:-(?:clip|selectors))?|navigate-to|plugin-types|policy-uri|referrer|reflected-xss|report-(?:to|uri)|require-sri-for|sandbox|(?:script|style)-src-(?:attr|elem)|upgrade-insecure-requests)(?=[\s;]|$)/i,lookbehind:!0,alias:`property`},scheme:{pattern:t(`[a-z][a-z0-9.+-]*:`),lookbehind:!0},none:{pattern:t(`'none'`),lookbehind:!0,alias:`keyword`},nonce:{pattern:t(`'nonce-[-+/\\w=]+'`),lookbehind:!0,alias:`number`},hash:{pattern:t(`'sha(?:256|384|512)-[-+/\\w=]+'`),lookbehind:!0,alias:`number`},host:{pattern:t(`[a-z][a-z0-9.+-]*:\\/\\/[^\\s;,']*|\\*[^\\s;,']*|[a-z0-9-]+(?:\\.[a-z0-9-]+)+(?::[\\d*]+)?(?:\\/[^\\s;,']*)?`),lookbehind:!0,alias:`url`,inside:{important:/\*/}},keyword:[{pattern:t(`'unsafe-[a-z-]+'`),lookbehind:!0,alias:`unsafe`},{pattern:t(`'[a-z-]+'`),lookbehind:!0,alias:`safe`}],punctuation:/;/}})(e)}H.displayName=`css`,H.aliases=[];function H(e){(function(e){var t=/(?:"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n])*')/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:RegExp(`@[\\w-](?:[^;{\\s"']|\\s+(?!\\s)|`+t.source+`)*?(?:;|(?=\\s*\\{))`),inside:{rule:/^@[\w-]+/,"selector-function-argument":{pattern:/(\bselector\s*\(\s*(?![\s)]))(?:[^()\s]|\s+(?![\s)])|\((?:[^()]|\([^()]*\))*\))+(?=\s*\))/,lookbehind:!0,alias:`selector`},keyword:{pattern:/(^|[^\w-])(?:and|not|only|or)(?![\w-])/,lookbehind:!0}}},url:{pattern:RegExp(`\\burl\\((?:`+t.source+`|(?:[^\\\\\\r\\n()"']|\\\\[\\s\\S])*)\\)`,`i`),greedy:!0,inside:{function:/^url/i,punctuation:/^\(|\)$/,string:{pattern:RegExp(`^`+t.source+`$`),alias:`url`}}},selector:{pattern:RegExp(`(^|[{}\\s])[^{}\\s](?:[^{};"'\\s]|\\s+(?![\\s{])|`+t.source+`)*(?=\\s*\\{)`),lookbehind:!0},string:{pattern:t,greedy:!0},property:{pattern:/(^|[^-\w\xA0-\uFFFF])(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*(?=\s*:)/i,lookbehind:!0},important:/!important\b/i,function:{pattern:/(^|[^-a-z0-9])[-a-z0-9]+(?=\()/i,lookbehind:!0},punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined(`style`,`css`),n.tag.addAttribute(`style`,`css`))})(e)}Be.displayName=`css-extras`,Be.aliases=[];function Be(e){e.register(H),(function(e){var t=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,n;e.languages.css.selector={pattern:e.languages.css.selector.pattern,lookbehind:!0,inside:n={"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-\w]+/,id:/#[-\w]+/,attribute:{pattern:RegExp(`\\[(?:[^[\\]"']|`+t.source+`)*\\]`),greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:`keyword`},namespace:{pattern:/^(\s*)(?:(?!\s)[-*\w\xA0-\uFFFF])*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},"attr-name":{pattern:/^(\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+/,lookbehind:!0},"attr-value":[t,{pattern:/(=\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],combinator:/>|\+|~|\|\|/,punctuation:/[(),]/}},e.languages.css.atrule.inside[`selector-function-argument`].inside=n,e.languages.insertBefore(`css`,`property`,{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*/i,lookbehind:!0}});var r={pattern:/(\b\d+)(?:%|[a-z]+(?![\w-]))/,lookbehind:!0},i={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0};e.languages.insertBefore(`css`,`function`,{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:{pattern:/\B#[\da-f]{3,8}\b/i,alias:`color`},color:[{pattern:/(^|[^\w-])(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|RebeccaPurple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)(?![\w-])/i,lookbehind:!0},{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:r,number:i,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:r,number:i})})(e)}Ve.displayName=`csv`,Ve.aliases=[];function Ve(e){e.languages.csv={value:/[^\r\n,"]+|"(?:[^"]|"")*"(?!")/,punctuation:/,/}}He.displayName=`cue`,He.aliases=[];function He(e){(function(e){var t=`(?:`+`"""(?:[^\\\\"]|"(?!""\\2)|)*"""|'''(?:[^\\\\']|'(?!''\\2)|)*'''|"(?:[^\\\\\\r\\n"]|"(?!\\2)|)*"|'(?:[^\\\\\\r\\n']|'(?!\\2)|)*'`.replace(//g,`\\\\(?:(?!\\2)|\\2(?:[^()\\r\\n]|\\([^()]*\\)))`)+`)`;e.languages.cue={comment:{pattern:/\/\/.*/,greedy:!0},"string-literal":{pattern:RegExp(`(^|[^#"'\\\\])(#*)`+t+`(?!["'])\\2`),lookbehind:!0,greedy:!0,inside:{escape:{pattern:/(?=[\s\S]*["'](#*)$)\\\1(?:U[a-fA-F0-9]{1,8}|u[a-fA-F0-9]{1,4}|x[a-fA-F0-9]{1,2}|\d{2,3}|[^(])/,greedy:!0,alias:`string`},interpolation:{pattern:/(?=[\s\S]*["'](#*)$)\\\1\([^()]*\)/,greedy:!0,inside:{punctuation:/^\\#*\(|\)$/,expression:{pattern:/[\s\S]+/,inside:null}}},string:/[\s\S]+/}},keyword:{pattern:/(^|[^\w$])(?:for|if|import|in|let|null|package)(?![\w$])/,lookbehind:!0},boolean:{pattern:/(^|[^\w$])(?:false|true)(?![\w$])/,lookbehind:!0},builtin:{pattern:/(^|[^\w$])(?:bool|bytes|float|float(?:32|64)|u?int(?:8|16|32|64|128)?|number|rune|string)(?![\w$])/,lookbehind:!0},attribute:{pattern:/@[\w$]+(?=\s*\()/,alias:`function`},function:{pattern:/(^|[^\w$])[a-z_$][\w$]*(?=\s*\()/i,lookbehind:!0},number:{pattern:/(^|[^\w$.])(?:0b[01]+(?:_[01]+)*|0o[0-7]+(?:_[0-7]+)*|0[xX][0-9A-Fa-f]+(?:_[0-9A-Fa-f]+)*|(?:\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\.\d+(?:_\d+)*)(?:[eE][+-]?\d+(?:_\d+)*)?(?:[KMGTP]i?)?)(?![\w$])/,lookbehind:!0},operator:/\.{3}|_\|_|&&?|\|\|?|[=!]~|[<>=!]=?|[+\-*/?]/,punctuation:/[()[\]{},.:]/},e.languages.cue[`string-literal`].inside.interpolation.inside.expression.inside=e.languages.cue})(e)}Ue.displayName=`cypher`,Ue.aliases=[];function Ue(e){e.languages.cypher={comment:/\/\/.*/,string:{pattern:/"(?:[^"\\\r\n]|\\.)*"|'(?:[^'\\\r\n]|\\.)*'/,greedy:!0},"class-name":{pattern:/(:\s*)(?:\w+|`(?:[^`\\\r\n])*`)(?=\s*[{):])/,lookbehind:!0,greedy:!0},relationship:{pattern:/(-\[\s*(?:\w+\s*|`(?:[^`\\\r\n])*`\s*)?:\s*|\|\s*:\s*)(?:\w+|`(?:[^`\\\r\n])*`)/,lookbehind:!0,greedy:!0,alias:`property`},identifier:{pattern:/`(?:[^`\\\r\n])*`/,greedy:!0},variable:/\$\w+/,keyword:/\b(?:ADD|ALL|AND|AS|ASC|ASCENDING|ASSERT|BY|CALL|CASE|COMMIT|CONSTRAINT|CONTAINS|CREATE|CSV|DELETE|DESC|DESCENDING|DETACH|DISTINCT|DO|DROP|ELSE|END|ENDS|EXISTS|FOR|FOREACH|IN|INDEX|IS|JOIN|KEY|LIMIT|LOAD|MANDATORY|MATCH|MERGE|NODE|NOT|OF|ON|OPTIONAL|OR|ORDER(?=\s+BY)|PERIODIC|REMOVE|REQUIRE|RETURN|SCALAR|SCAN|SET|SKIP|START|STARTS|THEN|UNION|UNIQUE|UNWIND|USING|WHEN|WHERE|WITH|XOR|YIELD)\b/i,function:/\b\w+\b(?=\s*\()/,boolean:/\b(?:false|null|true)\b/i,number:/\b(?:0x[\da-fA-F]+|\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\b/,operator:/:|<--?|--?>?|<>|=~?|[<>]=?|[+*/%^|]|\.\.\.?/,punctuation:/[()[\]{},;.]/}}We.displayName=`d`,We.aliases=[];function We(e){e.register(S),e.languages.d=e.languages.extend(`clike`,{comment:[{pattern:/^\s*#!.+/,greedy:!0},{pattern:RegExp(`(^|[^\\\\])(?:`+[`\\/\\+(?:\\/\\+(?:[^+]|\\+(?!\\/))*\\+\\/|(?!\\/\\+)[\\s\\S])*?\\+\\/`,`\\/\\/.*`,`\\/\\*[\\s\\S]*?\\*\\/`].join(`|`)+`)`),lookbehind:!0,greedy:!0}],string:[{pattern:RegExp([`\\b[rx]"(?:\\\\[\\s\\S]|[^\\\\"])*"[cwd]?`,`\\bq"(?:\\[[\\s\\S]*?\\]|\\([\\s\\S]*?\\)|<[\\s\\S]*?>|\\{[\\s\\S]*?\\})"`,`\\bq"((?!\\d)\\w+)$[\\s\\S]*?^\\1"`,`\\bq"(.)[\\s\\S]*?\\2"`,'(["`])(?:\\\\[\\s\\S]|(?!\\3)[^\\\\])*\\3[cwd]?'].join(`|`),`m`),greedy:!0},{pattern:/\bq\{(?:\{[^{}]*\}|[^{}])*\}/,greedy:!0,alias:`token-string`}],keyword:/\$|\b(?:__(?:(?:DATE|EOF|FILE|FUNCTION|LINE|MODULE|PRETTY_FUNCTION|TIMESTAMP|TIME|VENDOR|VERSION)__|gshared|parameters|traits|vector)|abstract|alias|align|asm|assert|auto|body|bool|break|byte|case|cast|catch|cdouble|cent|cfloat|char|class|const|continue|creal|dchar|debug|default|delegate|delete|deprecated|do|double|dstring|else|enum|export|extern|false|final|finally|float|for|foreach|foreach_reverse|function|goto|idouble|if|ifloat|immutable|import|inout|int|interface|invariant|ireal|lazy|long|macro|mixin|module|new|nothrow|null|out|override|package|pragma|private|protected|ptrdiff_t|public|pure|real|ref|return|scope|shared|short|size_t|static|string|struct|super|switch|synchronized|template|this|throw|true|try|typedef|typeid|typeof|ubyte|ucent|uint|ulong|union|unittest|ushort|version|void|volatile|wchar|while|with|wstring)\b/,number:[/\b0x\.?[a-f\d_]+(?:(?!\.\.)\.[a-f\d_]*)?(?:p[+-]?[a-f\d_]+)?[ulfi]{0,4}/i,{pattern:/((?:\.\.)?)(?:\b0b\.?|\b|\.)\d[\d_]*(?:(?!\.\.)\.[\d_]*)?(?:e[+-]?\d[\d_]*)?[ulfi]{0,4}/i,lookbehind:!0}],operator:/\|[|=]?|&[&=]?|\+[+=]?|-[-=]?|\.?\.\.|=[>=]?|!(?:i[ns]\b|<>?=?|>=?|=)?|\bi[ns]\b|(?:<[<>]?|>>?>?|\^\^|[*\/%^~])=?/}),e.languages.insertBefore(`d`,`string`,{char:/'(?:\\(?:\W|\w+)|[^\\])'/}),e.languages.insertBefore(`d`,`keyword`,{property:/\B@\w*/}),e.languages.insertBefore(`d`,`function`,{register:{pattern:/\b(?:[ABCD][LHX]|E?(?:BP|DI|SI|SP)|[BS]PL|[ECSDGF]S|CR[0234]|[DS]IL|DR[012367]|E[ABCD]X|X?MM[0-7]|R(?:1[0-5]|[89])[BWD]?|R[ABCD]X|R[BS]P|R[DS]I|TR[3-7]|XMM(?:1[0-5]|[89])|YMM(?:1[0-5]|\d))\b|\bST(?:\([0-7]\)|\b)/,alias:`variable`}})}Ge.displayName=`dart`,Ge.aliases=[];function Ge(e){e.register(S),(function(e){var t=[/\b(?:async|sync|yield)\*/,/\b(?:abstract|assert|async|await|break|case|catch|class|const|continue|covariant|default|deferred|do|dynamic|else|enum|export|extends|extension|external|factory|final|finally|for|get|hide|if|implements|import|in|interface|library|mixin|new|null|on|operator|part|rethrow|return|set|show|static|super|switch|sync|this|throw|try|typedef|var|void|while|with|yield)\b/],n=`(^|[^\\w.])(?:[a-z]\\w*\\s*\\.\\s*)*(?:[A-Z]\\w*\\s*\\.\\s*)*`,r={pattern:RegExp(n+`[A-Z](?:[\\d_A-Z]*[a-z]\\w*)?\\b`),lookbehind:!0,inside:{namespace:{pattern:/^[a-z]\w*(?:\s*\.\s*[a-z]\w*)*(?:\s*\.)?/,inside:{punctuation:/\./}}}};e.languages.dart=e.languages.extend(`clike`,{"class-name":[r,{pattern:RegExp(n+`[A-Z]\\w*(?=\\s+\\w+\\s*[;,=()])`),lookbehind:!0,inside:r.inside}],keyword:t,operator:/\bis!|\b(?:as|is)\b|\+\+|--|&&|\|\||<<=?|>>=?|~(?:\/=?)?|[+\-*\/%&^|=!<>]=?|\?/}),e.languages.insertBefore(`dart`,`string`,{"string-literal":{pattern:/r?(?:("""|''')[\s\S]*?\1|(["'])(?:\\.|(?!\2)[^\\\r\n])*\2(?!\2))/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$(?:\w+|\{(?:[^{}]|\{[^{}]*\})*\})/,lookbehind:!0,inside:{punctuation:/^\$\{?|\}$/,expression:{pattern:/[\s\S]+/,inside:e.languages.dart}}},string:/[\s\S]+/}},string:void 0}),e.languages.insertBefore(`dart`,`class-name`,{metadata:{pattern:/@\w+/,alias:`function`}}),e.languages.insertBefore(`dart`,`class-name`,{generics:{pattern:/<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<[\w\s,.&?]*>)*>)*>)*>/,inside:{"class-name":r,keyword:t,punctuation:/[<>(),.:]/,operator:/[?&|]/}}})})(e)}Ke.displayName=`dataweave`,Ke.aliases=[];function Ke(e){(function(e){e.languages.dataweave={url:/\b[A-Za-z]+:\/\/[\w/:.?=&-]+|\burn:[\w:.?=&-]+/,property:{pattern:/(?:\b\w+#)?(?:"(?:\\.|[^\\"\r\n])*"|\b\w+)(?=\s*[:@])/,greedy:!0},string:{pattern:/(["'`])(?:\\[\s\S]|(?!\1)[^\\])*\1/,greedy:!0},"mime-type":/\b(?:application|audio|image|multipart|text|video)\/[\w+-]+/,date:{pattern:/\|[\w:+-]+\|/,greedy:!0},comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],regex:{pattern:/\/(?:[^\\\/\r\n]|\\[^\r\n])+\//,greedy:!0},keyword:/\b(?:and|as|at|case|do|else|fun|if|input|is|match|not|ns|null|or|output|type|unless|update|using|var)\b/,function:/\b[A-Z_]\w*(?=\s*\()/i,number:/-?\b\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,punctuation:/[{}[\];(),.:@]/,operator:/<<|>>|->|[<>~=]=?|!=|--?-?|\+\+?|!|\?/,boolean:/\b(?:false|true)\b/}})(e)}qe.displayName=`dax`,qe.aliases=[];function qe(e){e.languages.dax={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/).*)/,lookbehind:!0},"data-field":{pattern:/'(?:[^']|'')*'(?!')(?:\[[ \w\xA0-\uFFFF]+\])?|\w+\[[ \w\xA0-\uFFFF]+\]/,alias:`symbol`},measure:{pattern:/\[[ \w\xA0-\uFFFF]+\]/,alias:`constant`},string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},function:/\b(?:ABS|ACOS|ACOSH|ACOT|ACOTH|ADDCOLUMNS|ADDMISSINGITEMS|ALL|ALLCROSSFILTERED|ALLEXCEPT|ALLNOBLANKROW|ALLSELECTED|AND|APPROXIMATEDISTINCTCOUNT|ASIN|ASINH|ATAN|ATANH|AVERAGE|AVERAGEA|AVERAGEX|BETA\.DIST|BETA\.INV|BLANK|CALCULATE|CALCULATETABLE|CALENDAR|CALENDARAUTO|CEILING|CHISQ\.DIST|CHISQ\.DIST\.RT|CHISQ\.INV|CHISQ\.INV\.RT|CLOSINGBALANCEMONTH|CLOSINGBALANCEQUARTER|CLOSINGBALANCEYEAR|COALESCE|COMBIN|COMBINA|COMBINEVALUES|CONCATENATE|CONCATENATEX|CONFIDENCE\.NORM|CONFIDENCE\.T|CONTAINS|CONTAINSROW|CONTAINSSTRING|CONTAINSSTRINGEXACT|CONVERT|COS|COSH|COT|COTH|COUNT|COUNTA|COUNTAX|COUNTBLANK|COUNTROWS|COUNTX|CROSSFILTER|CROSSJOIN|CURRENCY|CURRENTGROUP|CUSTOMDATA|DATATABLE|DATE|DATEADD|DATEDIFF|DATESBETWEEN|DATESINPERIOD|DATESMTD|DATESQTD|DATESYTD|DATEVALUE|DAY|DEGREES|DETAILROWS|DISTINCT|DISTINCTCOUNT|DISTINCTCOUNTNOBLANK|DIVIDE|EARLIER|EARLIEST|EDATE|ENDOFMONTH|ENDOFQUARTER|ENDOFYEAR|EOMONTH|ERROR|EVEN|EXACT|EXCEPT|EXP|EXPON\.DIST|FACT|FALSE|FILTER|FILTERS|FIND|FIRSTDATE|FIRSTNONBLANK|FIRSTNONBLANKVALUE|FIXED|FLOOR|FORMAT|GCD|GENERATE|GENERATEALL|GENERATESERIES|GEOMEAN|GEOMEANX|GROUPBY|HASONEFILTER|HASONEVALUE|HOUR|IF|IF\.EAGER|IFERROR|IGNORE|INT|INTERSECT|ISBLANK|ISCROSSFILTERED|ISEMPTY|ISERROR|ISEVEN|ISFILTERED|ISINSCOPE|ISLOGICAL|ISNONTEXT|ISNUMBER|ISO\.CEILING|ISODD|ISONORAFTER|ISSELECTEDMEASURE|ISSUBTOTAL|ISTEXT|KEEPFILTERS|KEYWORDMATCH|LASTDATE|LASTNONBLANK|LASTNONBLANKVALUE|LCM|LEFT|LEN|LN|LOG|LOG10|LOOKUPVALUE|LOWER|MAX|MAXA|MAXX|MEDIAN|MEDIANX|MID|MIN|MINA|MINUTE|MINX|MOD|MONTH|MROUND|NATURALINNERJOIN|NATURALLEFTOUTERJOIN|NEXTDAY|NEXTMONTH|NEXTQUARTER|NEXTYEAR|NONVISUAL|NORM\.DIST|NORM\.INV|NORM\.S\.DIST|NORM\.S\.INV|NOT|NOW|ODD|OPENINGBALANCEMONTH|OPENINGBALANCEQUARTER|OPENINGBALANCEYEAR|OR|PARALLELPERIOD|PATH|PATHCONTAINS|PATHITEM|PATHITEMREVERSE|PATHLENGTH|PERCENTILE\.EXC|PERCENTILE\.INC|PERCENTILEX\.EXC|PERCENTILEX\.INC|PERMUT|PI|POISSON\.DIST|POWER|PREVIOUSDAY|PREVIOUSMONTH|PREVIOUSQUARTER|PREVIOUSYEAR|PRODUCT|PRODUCTX|QUARTER|QUOTIENT|RADIANS|RAND|RANDBETWEEN|RANK\.EQ|RANKX|RELATED|RELATEDTABLE|REMOVEFILTERS|REPLACE|REPT|RIGHT|ROLLUP|ROLLUPADDISSUBTOTAL|ROLLUPGROUP|ROLLUPISSUBTOTAL|ROUND|ROUNDDOWN|ROUNDUP|ROW|SAMEPERIODLASTYEAR|SAMPLE|SEARCH|SECOND|SELECTCOLUMNS|SELECTEDMEASURE|SELECTEDMEASUREFORMATSTRING|SELECTEDMEASURENAME|SELECTEDVALUE|SIGN|SIN|SINH|SQRT|SQRTPI|STARTOFMONTH|STARTOFQUARTER|STARTOFYEAR|STDEV\.P|STDEV\.S|STDEVX\.P|STDEVX\.S|SUBSTITUTE|SUBSTITUTEWITHINDEX|SUM|SUMMARIZE|SUMMARIZECOLUMNS|SUMX|SWITCH|T\.DIST|T\.DIST\.2T|T\.DIST\.RT|T\.INV|T\.INV\.2T|TAN|TANH|TIME|TIMEVALUE|TODAY|TOPN|TOPNPERLEVEL|TOPNSKIP|TOTALMTD|TOTALQTD|TOTALYTD|TREATAS|TRIM|TRUE|TRUNC|UNICHAR|UNICODE|UNION|UPPER|USERELATIONSHIP|USERNAME|USEROBJECTID|USERPRINCIPALNAME|UTCNOW|UTCTODAY|VALUE|VALUES|VAR\.P|VAR\.S|VARX\.P|VARX\.S|WEEKDAY|WEEKNUM|XIRR|XNPV|YEAR|YEARFRAC)(?=\s*\()/i,keyword:/\b(?:DEFINE|EVALUATE|MEASURE|ORDER\s+BY|RETURN|VAR|START\s+AT|ASC|DESC)\b/i,boolean:{pattern:/\b(?:FALSE|NULL|TRUE)\b/i,alias:`constant`},number:/\b\d+(?:\.\d*)?|\B\.\d+\b/,operator:/:=|[-+*\/=^]|&&?|\|\||<(?:=>?|<|>)?|>[>=]?|\b(?:IN|NOT)\b/i,punctuation:/[;\[\](){}`,.]/}}Je.displayName=`dhall`,Je.aliases=[];function Je(e){e.languages.dhall={comment:/--.*|\{-(?:[^-{]|-(?!\})|\{(?!-)|\{-(?:[^-{]|-(?!\})|\{(?!-))*-\})*-\}/,string:{pattern:/"(?:[^"\\]|\\.)*"|''(?:[^']|'(?!')|'''|''\$\{)*''(?!'|\$)/,greedy:!0,inside:{interpolation:{pattern:/\$\{[^{}]*\}/,inside:{expression:{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0,alias:`language-dhall`,inside:null},punctuation:/\$\{|\}/}}}},label:{pattern:/`[^`]*`/,greedy:!0},url:{pattern:/\bhttps?:\/\/[\w.:%!$&'*+;=@~-]+(?:\/[\w.:%!$&'*+;=@~-]*)*(?:\?[/?\w.:%!$&'*+;=@~-]*)?/,greedy:!0},env:{pattern:/\benv:(?:(?!\d)\w+|"(?:[^"\\=]|\\.)*")/,greedy:!0,inside:{function:/^env/,operator:/^:/,variable:/[\s\S]+/}},hash:{pattern:/\bsha256:[\da-fA-F]{64}\b/,inside:{function:/sha256/,operator:/:/,number:/[\da-fA-F]{64}/}},keyword:/\b(?:as|assert|else|forall|if|in|let|merge|missing|then|toMap|using|with)\b|\u2200/,builtin:/\b(?:None|Some)\b/,boolean:/\b(?:False|True)\b/,number:/\bNaN\b|-?\bInfinity\b|[+-]?\b(?:0x[\da-fA-F]+|\d+(?:\.\d+)?(?:e[+-]?\d+)?)\b/,operator:/\/\\|\/\/\\\\|&&|\|\||===|[!=]=|\/\/|->|\+\+|::|[+*#@=:?<>|\\\u2227\u2a53\u2261\u2afd\u03bb\u2192]/,punctuation:/\.\.|[{}\[\](),./]/,"class-name":/\b[A-Z]\w*\b/},e.languages.dhall.string.inside.interpolation.inside.expression.inside=e.languages.dhall}Ye.displayName=`diff`,Ye.aliases=[];function Ye(e){(function(e){e.languages.diff={coord:[/^(?:\*{3}|-{3}|\+{3}).*$/m,/^@@.*@@$/m,/^\d.*$/m]};var t={"deleted-sign":`-`,"deleted-arrow":`<`,"inserted-sign":`+`,"inserted-arrow":`>`,unchanged:` `,diff:`!`};Object.keys(t).forEach(function(n){var r=t[n],i=[];/^\w+$/.test(n)||i.push(/\w+/.exec(n)[0]),n===`diff`&&i.push(`bold`),e.languages.diff[n]={pattern:RegExp(`^(?:[`+r+`].*(?:\r
+import{St as e,Tt as t,U as n,_t as r,at as i,bt as a,ht as o,it as s,lt as c,n as l,nt as u,ot as d,rt as f,st as p,t as m,tt as h,ut as g,vt as _,yt as v}from"./index-B2k_urY8.js";var y=v(`text-wrap`,[[`path`,{d:`m16 16-3 3 3 3`,key:`117b85`}],[`path`,{d:`M3 12h14.5a1 1 0 0 1 0 7H13`,key:`18xa6z`}],[`path`,{d:`M3 19h6`,key:`1ygdsz`}],[`path`,{d:`M3 5h18`,key:`1u36vt`}]]);b.displayName=`abap`,b.aliases=[];function b(e){e.languages.abap={comment:/^\*.*/m,string:/(`|')(?:\\.|(?!\1)[^\\\r\n])*\1/,"string-template":{pattern:/([|}])(?:\\.|[^\\|{\r\n])*(?=[|{])/,lookbehind:!0,alias:`string`},"eol-comment":{pattern:/(^|\s)".*/m,lookbehind:!0,alias:`comment`},keyword:{pattern:/(\s|\.|^)(?:\*-INPUT|\?TO|ABAP-SOURCE|ABBREVIATED|ABS|ABSTRACT|ACCEPT|ACCEPTING|ACCESSPOLICY|ACCORDING|ACOS|ACTIVATION|ACTUAL|ADD|ADD-CORRESPONDING|ADJACENT|AFTER|ALIAS|ALIASES|ALIGN|ALL|ALLOCATE|ALPHA|ANALYSIS|ANALYZER|AND|ANY|APPEND|APPENDAGE|APPENDING|APPLICATION|ARCHIVE|AREA|ARITHMETIC|AS|ASCENDING|ASIN|ASPECT|ASSERT|ASSIGN|ASSIGNED|ASSIGNING|ASSOCIATION|ASYNCHRONOUS|AT|ATAN|ATTRIBUTES|AUTHORITY|AUTHORITY-CHECK|AVG|BACK|BACKGROUND|BACKUP|BACKWARD|BADI|BASE|BEFORE|BEGIN|BETWEEN|BIG|BINARY|BINDING|BIT|BIT-AND|BIT-NOT|BIT-OR|BIT-XOR|BLACK|BLANK|BLANKS|BLOB|BLOCK|BLOCKS|BLUE|BOUND|BOUNDARIES|BOUNDS|BOXED|BREAK-POINT|BT|BUFFER|BY|BYPASSING|BYTE|BYTE-CA|BYTE-CN|BYTE-CO|BYTE-CS|BYTE-NA|BYTE-NS|BYTE-ORDER|C|CA|CALL|CALLING|CASE|CAST|CASTING|CATCH|CEIL|CENTER|CENTERED|CHAIN|CHAIN-INPUT|CHAIN-REQUEST|CHANGE|CHANGING|CHANNELS|CHAR-TO-HEX|CHARACTER|CHARLEN|CHECK|CHECKBOX|CIRCULAR|CI_|CLASS|CLASS-CODING|CLASS-DATA|CLASS-EVENTS|CLASS-METHODS|CLASS-POOL|CLEANUP|CLEAR|CLIENT|CLOB|CLOCK|CLOSE|CN|CNT|CO|COALESCE|CODE|CODING|COLLECT|COLOR|COLUMN|COLUMNS|COL_BACKGROUND|COL_GROUP|COL_HEADING|COL_KEY|COL_NEGATIVE|COL_NORMAL|COL_POSITIVE|COL_TOTAL|COMMENT|COMMENTS|COMMIT|COMMON|COMMUNICATION|COMPARING|COMPONENT|COMPONENTS|COMPRESSION|COMPUTE|CONCAT|CONCATENATE|COND|CONDENSE|CONDITION|CONNECT|CONNECTION|CONSTANTS|CONTEXT|CONTEXTS|CONTINUE|CONTROL|CONTROLS|CONV|CONVERSION|CONVERT|COPIES|COPY|CORRESPONDING|COS|COSH|COUNT|COUNTRY|COVER|CP|CPI|CREATE|CREATING|CRITICAL|CS|CURRENCY|CURRENCY_CONVERSION|CURRENT|CURSOR|CURSOR-SELECTION|CUSTOMER|CUSTOMER-FUNCTION|DANGEROUS|DATA|DATABASE|DATAINFO|DATASET|DATE|DAYLIGHT|DBMAXLEN|DD\/MM\/YY|DD\/MM\/YYYY|DDMMYY|DEALLOCATE|DECIMALS|DECIMAL_SHIFT|DECLARATIONS|DEEP|DEFAULT|DEFERRED|DEFINE|DEFINING|DEFINITION|DELETE|DELETING|DEMAND|DEPARTMENT|DESCENDING|DESCRIBE|DESTINATION|DETAIL|DIALOG|DIRECTORY|DISCONNECT|DISPLAY|DISPLAY-MODE|DISTANCE|DISTINCT|DIV|DIVIDE|DIVIDE-CORRESPONDING|DIVISION|DO|DUMMY|DUPLICATE|DUPLICATES|DURATION|DURING|DYNAMIC|DYNPRO|E|EACH|EDIT|EDITOR-CALL|ELSE|ELSEIF|EMPTY|ENABLED|ENABLING|ENCODING|END|END-ENHANCEMENT-SECTION|END-LINES|END-OF-DEFINITION|END-OF-FILE|END-OF-PAGE|END-OF-SELECTION|ENDAT|ENDCASE|ENDCATCH|ENDCHAIN|ENDCLASS|ENDDO|ENDENHANCEMENT|ENDEXEC|ENDFOR|ENDFORM|ENDFUNCTION|ENDIAN|ENDIF|ENDING|ENDINTERFACE|ENDLOOP|ENDMETHOD|ENDMODULE|ENDON|ENDPROVIDE|ENDSELECT|ENDTRY|ENDWHILE|ENGINEERING|ENHANCEMENT|ENHANCEMENT-POINT|ENHANCEMENT-SECTION|ENHANCEMENTS|ENTRIES|ENTRY|ENVIRONMENT|EQ|EQUAL|EQUIV|ERRORMESSAGE|ERRORS|ESCAPE|ESCAPING|EVENT|EVENTS|EXACT|EXCEPT|EXCEPTION|EXCEPTION-TABLE|EXCEPTIONS|EXCLUDE|EXCLUDING|EXEC|EXECUTE|EXISTS|EXIT|EXIT-COMMAND|EXP|EXPAND|EXPANDING|EXPIRATION|EXPLICIT|EXPONENT|EXPORT|EXPORTING|EXTEND|EXTENDED|EXTENSION|EXTRACT|FAIL|FETCH|FIELD|FIELD-GROUPS|FIELD-SYMBOL|FIELD-SYMBOLS|FIELDS|FILE|FILTER|FILTER-TABLE|FILTERS|FINAL|FIND|FIRST|FIRST-LINE|FIXED-POINT|FKEQ|FKGE|FLOOR|FLUSH|FONT|FOR|FORM|FORMAT|FORWARD|FOUND|FRAC|FRAME|FRAMES|FREE|FRIENDS|FROM|FUNCTION|FUNCTION-POOL|FUNCTIONALITY|FURTHER|GAPS|GE|GENERATE|GET|GIVING|GKEQ|GKGE|GLOBAL|GRANT|GREATER|GREEN|GROUP|GROUPS|GT|HANDLE|HANDLER|HARMLESS|HASHED|HAVING|HDB|HEAD-LINES|HEADER|HEADERS|HEADING|HELP-ID|HELP-REQUEST|HIDE|HIGH|HINT|HOLD|HOTSPOT|I|ICON|ID|IDENTIFICATION|IDENTIFIER|IDS|IF|IGNORE|IGNORING|IMMEDIATELY|IMPLEMENTATION|IMPLEMENTATIONS|IMPLEMENTED|IMPLICIT|IMPORT|IMPORTING|IN|INACTIVE|INCL|INCLUDE|INCLUDES|INCLUDING|INCREMENT|INDEX|INDEX-LINE|INFOTYPES|INHERITING|INIT|INITIAL|INITIALIZATION|INNER|INOUT|INPUT|INSERT|INSTANCES|INTENSIFIED|INTERFACE|INTERFACE-POOL|INTERFACES|INTERNAL|INTERVALS|INTO|INVERSE|INVERTED-DATE|IS|ISO|ITERATOR|ITNO|JOB|JOIN|KEEP|KEEPING|KERNEL|KEY|KEYS|KEYWORDS|KIND|LANGUAGE|LAST|LATE|LAYOUT|LE|LEADING|LEAVE|LEFT|LEFT-JUSTIFIED|LEFTPLUS|LEFTSPACE|LEGACY|LENGTH|LESS|LET|LEVEL|LEVELS|LIKE|LINE|LINE-COUNT|LINE-SELECTION|LINE-SIZE|LINEFEED|LINES|LIST|LIST-PROCESSING|LISTBOX|LITTLE|LLANG|LOAD|LOAD-OF-PROGRAM|LOB|LOCAL|LOCALE|LOCATOR|LOG|LOG-POINT|LOG10|LOGFILE|LOGICAL|LONG|LOOP|LOW|LOWER|LPAD|LPI|LT|M|MAIL|MAIN|MAJOR-ID|MAPPING|MARGIN|MARK|MASK|MATCH|MATCHCODE|MAX|MAXIMUM|MEDIUM|MEMBERS|MEMORY|MESH|MESSAGE|MESSAGE-ID|MESSAGES|MESSAGING|METHOD|METHODS|MIN|MINIMUM|MINOR-ID|MM\/DD\/YY|MM\/DD\/YYYY|MMDDYY|MOD|MODE|MODIF|MODIFIER|MODIFY|MODULE|MOVE|MOVE-CORRESPONDING|MULTIPLY|MULTIPLY-CORRESPONDING|NA|NAME|NAMETAB|NATIVE|NB|NE|NESTED|NESTING|NEW|NEW-LINE|NEW-PAGE|NEW-SECTION|NEXT|NO|NO-DISPLAY|NO-EXTENSION|NO-GAP|NO-GAPS|NO-GROUPING|NO-HEADING|NO-SCROLLING|NO-SIGN|NO-TITLE|NO-TOPOFPAGE|NO-ZERO|NODE|NODES|NON-UNICODE|NON-UNIQUE|NOT|NP|NS|NULL|NUMBER|NUMOFCHAR|O|OBJECT|OBJECTS|OBLIGATORY|OCCURRENCE|OCCURRENCES|OCCURS|OF|OFF|OFFSET|OLE|ON|ONLY|OPEN|OPTION|OPTIONAL|OPTIONS|OR|ORDER|OTHER|OTHERS|OUT|OUTER|OUTPUT|OUTPUT-LENGTH|OVERFLOW|OVERLAY|PACK|PACKAGE|PAD|PADDING|PAGE|PAGES|PARAMETER|PARAMETER-TABLE|PARAMETERS|PART|PARTIALLY|PATTERN|PERCENTAGE|PERFORM|PERFORMING|PERSON|PF|PF-STATUS|PINK|PLACES|POOL|POSITION|POS_HIGH|POS_LOW|PRAGMAS|PRECOMPILED|PREFERRED|PRESERVING|PRIMARY|PRINT|PRINT-CONTROL|PRIORITY|PRIVATE|PROCEDURE|PROCESS|PROGRAM|PROPERTY|PROTECTED|PROVIDE|PUBLIC|PUSHBUTTON|PUT|QUEUE-ONLY|QUICKINFO|RADIOBUTTON|RAISE|RAISING|RANGE|RANGES|RAW|READ|READ-ONLY|READER|RECEIVE|RECEIVED|RECEIVER|RECEIVING|RED|REDEFINITION|REDUCE|REDUCED|REF|REFERENCE|REFRESH|REGEX|REJECT|REMOTE|RENAMING|REPLACE|REPLACEMENT|REPLACING|REPORT|REQUEST|REQUESTED|RESERVE|RESET|RESOLUTION|RESPECTING|RESPONSIBLE|RESULT|RESULTS|RESUMABLE|RESUME|RETRY|RETURN|RETURNCODE|RETURNING|RIGHT|RIGHT-JUSTIFIED|RIGHTPLUS|RIGHTSPACE|RISK|RMC_COMMUNICATION_FAILURE|RMC_INVALID_STATUS|RMC_SYSTEM_FAILURE|ROLE|ROLLBACK|ROUND|ROWS|RTTI|RUN|SAP|SAP-SPOOL|SAVING|SCALE_PRESERVING|SCALE_PRESERVING_SCIENTIFIC|SCAN|SCIENTIFIC|SCIENTIFIC_WITH_LEADING_ZERO|SCREEN|SCROLL|SCROLL-BOUNDARY|SCROLLING|SEARCH|SECONDARY|SECONDS|SECTION|SELECT|SELECT-OPTIONS|SELECTION|SELECTION-SCREEN|SELECTION-SET|SELECTION-SETS|SELECTION-TABLE|SELECTIONS|SELECTOR|SEND|SEPARATE|SEPARATED|SET|SHARED|SHIFT|SHORT|SHORTDUMP-ID|SIGN|SIGN_AS_POSTFIX|SIMPLE|SIN|SINGLE|SINH|SIZE|SKIP|SKIPPING|SMART|SOME|SORT|SORTABLE|SORTED|SOURCE|SPACE|SPECIFIED|SPLIT|SPOOL|SPOTS|SQL|SQLSCRIPT|SQRT|STABLE|STAMP|STANDARD|START-OF-SELECTION|STARTING|STATE|STATEMENT|STATEMENTS|STATIC|STATICS|STATUSINFO|STEP-LOOP|STOP|STRLEN|STRUCTURE|STRUCTURES|STYLE|SUBKEY|SUBMATCHES|SUBMIT|SUBROUTINE|SUBSCREEN|SUBSTRING|SUBTRACT|SUBTRACT-CORRESPONDING|SUFFIX|SUM|SUMMARY|SUMMING|SUPPLIED|SUPPLY|SUPPRESS|SWITCH|SWITCHSTATES|SYMBOL|SYNCPOINTS|SYNTAX|SYNTAX-CHECK|SYNTAX-TRACE|SYSTEM-CALL|SYSTEM-EXCEPTIONS|SYSTEM-EXIT|TAB|TABBED|TABLE|TABLES|TABLEVIEW|TABSTRIP|TAN|TANH|TARGET|TASK|TASKS|TEST|TESTING|TEXT|TEXTPOOL|THEN|THROW|TIME|TIMES|TIMESTAMP|TIMEZONE|TITLE|TITLE-LINES|TITLEBAR|TO|TOKENIZATION|TOKENS|TOP-LINES|TOP-OF-PAGE|TRACE-FILE|TRACE-TABLE|TRAILING|TRANSACTION|TRANSFER|TRANSFORMATION|TRANSLATE|TRANSPORTING|TRMAC|TRUNC|TRUNCATE|TRUNCATION|TRY|TYPE|TYPE-POOL|TYPE-POOLS|TYPES|ULINE|UNASSIGN|UNDER|UNICODE|UNION|UNIQUE|UNIT|UNIT_CONVERSION|UNIX|UNPACK|UNTIL|UNWIND|UP|UPDATE|UPPER|USER|USER-COMMAND|USING|UTF-8|VALID|VALUE|VALUE-REQUEST|VALUES|VARY|VARYING|VERIFICATION-MESSAGE|VERSION|VIA|VIEW|VISIBLE|WAIT|WARNING|WHEN|WHENEVER|WHERE|WHILE|WIDTH|WINDOW|WINDOWS|WITH|WITH-HEADING|WITH-TITLE|WITHOUT|WORD|WORK|WRITE|WRITER|X|XML|XOR|XSD|XSTRLEN|YELLOW|YES|YYMMDD|Z|ZERO|ZONE)(?![\w-])/i,lookbehind:!0},number:/\b\d+\b/,operator:{pattern:/(\s)(?:\*\*?|<[=>]?|>=?|\?=|[-+\/=])(?=\s)/,lookbehind:!0},"string-operator":{pattern:/(\s)&&?(?=\s)/,lookbehind:!0,alias:`keyword`},"token-operator":[{pattern:/(\w)(?:->?|=>|[~|{}])(?=\w)/,lookbehind:!0,alias:`punctuation`},{pattern:/[|{}]/,alias:`punctuation`}],punctuation:/[,.:()]/}}x.displayName=`abnf`,x.aliases=[];function x(e){(function(e){var t=`(?:ALPHA|BIT|CHAR|CR|CRLF|CTL|DIGIT|DQUOTE|HEXDIG|HTAB|LF|LWSP|OCTET|SP|VCHAR|WSP)`;e.languages.abnf={comment:/;.*/,string:{pattern:/(?:%[is])?"[^"\n\r]*"/,greedy:!0,inside:{punctuation:/^%[is]/}},range:{pattern:/%(?:b[01]+-[01]+|d\d+-\d+|x[A-F\d]+-[A-F\d]+)/i,alias:`number`},terminal:{pattern:/%(?:b[01]+(?:\.[01]+)*|d\d+(?:\.\d+)*|x[A-F\d]+(?:\.[A-F\d]+)*)/i,alias:`number`},repetition:{pattern:/(^|[^\w-])(?:\d*\*\d*|\d+)/,lookbehind:!0,alias:`operator`},definition:{pattern:/(^[ \t]*)(?:[a-z][\w-]*|<[^<>\r\n]*>)(?=\s*=)/m,lookbehind:!0,alias:`keyword`,inside:{punctuation:/<|>/}},"core-rule":{pattern:RegExp(`(?:(^|[^<\\w-])`+t+`|<`+t+`>)(?![\\w-])`,`i`),lookbehind:!0,alias:[`rule`,`constant`],inside:{punctuation:/<|>/}},rule:{pattern:/(^|[^<\w-])[a-z][\w-]*|<[^<>\r\n]*>/i,lookbehind:!0,inside:{punctuation:/<|>/}},operator:/=\/?|\//,punctuation:/[()\[\]]/}})(e)}S.displayName=`clike`,S.aliases=[];function S(e){e.languages.clike={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"class-name":{pattern:/(\b(?:class|extends|implements|instanceof|interface|new|trait)\s+|\bcatch\s+\()[\w.\\]+/i,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:break|catch|continue|do|else|finally|for|function|if|in|instanceof|new|null|return|throw|try|while)\b/,boolean:/\b(?:false|true)\b/,function:/\b\w+(?=\()/,number:/\b0x[\da-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?/i,operator:/[<>]=?|[!=]=?=?|--?|\+\+?|&&?|\|\|?|[?*/~^%]/,punctuation:/[{}[\];(),.:]/}}C.displayName=`javascript`,C.aliases=[`js`];function C(e){e.register(S),e.languages.javascript=e.languages.extend(`clike`,{"class-name":[e.languages.clike[`class-name`],{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$A-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\.(?:constructor|prototype))/,lookbehind:!0}],keyword:[{pattern:/((?:^|\})\s*)catch\b/,lookbehind:!0},{pattern:/(^|[^.]|\.\.\.\s*)\b(?:as|assert(?=\s*\{)|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally(?=\s*(?:\{|$))|for|from(?=\s*(?:['"]|$))|function|(?:get|set)(?=\s*(?:[#\[$\w\xA0-\uFFFF]|$))|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],function:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,number:{pattern:RegExp(`(^|[^\\w$])(?:NaN|Infinity|0[bB][01]+(?:_[01]+)*n?|0[oO][0-7]+(?:_[0-7]+)*n?|0[xX][\\dA-Fa-f]+(?:_[\\dA-Fa-f]+)*n?|\\d+(?:_\\d+)*n|(?:\\d+(?:_\\d+)*(?:\\.(?:\\d+(?:_\\d+)*)?)?|\\.\\d+(?:_\\d+)*)(?:[Ee][+-]?\\d+(?:_\\d+)*)?)(?![\\w$])`),lookbehind:!0},operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/}),e.languages.javascript[`class-name`][0].pattern=/(\b(?:class|extends|implements|instanceof|interface|new)\s+)[\w.\\]+/,e.languages.insertBefore(`javascript`,`keyword`,{regex:{pattern:RegExp(`((?:^|[^$\\w\\xA0-\\uFFFF."'\\])\\s]|\\b(?:return|yield))\\s*)\\/(?:(?:\\[(?:[^\\]\\\\\\r\\n]|\\\\.)*\\]|\\\\.|[^/\\\\\\[\\r\\n])+\\/[dgimyus]{0,7}|(?:\\[(?:[^[\\]\\\\\\r\\n]|\\\\.|\\[(?:[^[\\]\\\\\\r\\n]|\\\\.|\\[(?:[^[\\]\\\\\\r\\n]|\\\\.)*\\])*\\])*\\]|\\\\.|[^/\\\\\\[\\r\\n])+\\/[dgimyus]{0,7}v[dgimyus]{0,7})(?=(?:\\s|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/)*(?:$|[\\r\\n,.;:})\\]]|\\/\\/))`),lookbehind:!0,greedy:!0,inside:{"regex-source":{pattern:/^(\/)[\s\S]+(?=\/[a-z]*$)/,lookbehind:!0,alias:`language-regex`,inside:e.languages.regex},"regex-delimiter":/^\/|\/$/,"regex-flags":/^[a-z]+$/}},"function-variable":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:`function`},parameter:[{pattern:/(function(?:\s+(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)?\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\))/,lookbehind:!0,inside:e.languages.javascript},{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*=>)/i,lookbehind:!0,inside:e.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*=>)/,lookbehind:!0,inside:e.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*)\(\s*|\]\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*\{)/,lookbehind:!0,inside:e.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),e.languages.insertBefore(`javascript`,`string`,{hashbang:{pattern:/^#!.*/,greedy:!0,alias:`comment`},"template-string":{pattern:/`(?:\\[\s\S]|\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}|(?!\$\{)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:`string`},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`},rest:e.languages.javascript}},string:/[\s\S]+/}},"string-property":{pattern:/((?:^|[,{])[ \t]*)(["'])(?:\\(?:\r\n|[\s\S])|(?!\2)[^\\\r\n])*\2(?=\s*:)/m,lookbehind:!0,greedy:!0,alias:`property`}}),e.languages.insertBefore(`javascript`,`operator`,{"literal-property":{pattern:/((?:^|[,{])[ \t]*)(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*:)/m,lookbehind:!0,alias:`property`}}),e.languages.markup&&(e.languages.markup.tag.addInlined(`script`,`javascript`),e.languages.markup.tag.addAttribute(`on(?:abort|blur|change|click|composition(?:end|start|update)|dblclick|error|focus(?:in|out)?|key(?:down|up)|load|mouse(?:down|enter|leave|move|out|over|up)|reset|resize|scroll|select|slotchange|submit|unload|wheel)`,`javascript`)),e.languages.js=e.languages.javascript}w.displayName=`actionscript`,w.aliases=[];function w(e){e.register(C),e.languages.actionscript=e.languages.extend(`javascript`,{keyword:/\b(?:as|break|case|catch|class|const|default|delete|do|dynamic|each|else|extends|final|finally|for|function|get|if|implements|import|in|include|instanceof|interface|internal|is|namespace|native|new|null|override|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|use|var|void|while|with)\b/,operator:/\+\+|--|(?:[+\-*\/%^]|&&?|\|\|?|<>?>?|[!=]=?)=?|[~?@]/}),e.languages.actionscript[`class-name`].alias=`function`,delete e.languages.actionscript.parameter,delete e.languages.actionscript[`literal-property`],e.languages.markup&&e.languages.insertBefore(`actionscript`,`string`,{xml:{pattern:/(^|[^.])<\/?\w+(?:\s+[^\s>\/=]+=("|')(?:\\[\s\S]|(?!\2)[^\\])*\2)*\s*\/?>/,lookbehind:!0,inside:e.languages.markup}})}T.displayName=`ada`,T.aliases=[];function T(e){e.languages.ada={comment:/--.*/,string:/"(?:""|[^"\r\f\n])*"/,number:[{pattern:/\b\d(?:_?\d)*#[\dA-F](?:_?[\dA-F])*(?:\.[\dA-F](?:_?[\dA-F])*)?#(?:E[+-]?\d(?:_?\d)*)?/i},{pattern:/\b\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:E[+-]?\d(?:_?\d)*)?\b/i}],attribute:{pattern:/\b'\w+/,alias:`attr-name`},keyword:/\b(?:abort|abs|abstract|accept|access|aliased|all|and|array|at|begin|body|case|constant|declare|delay|delta|digits|do|else|elsif|end|entry|exception|exit|for|function|generic|goto|if|in|interface|is|limited|loop|mod|new|not|null|of|or|others|out|overriding|package|pragma|private|procedure|protected|raise|range|record|rem|renames|requeue|return|reverse|select|separate|some|subtype|synchronized|tagged|task|terminate|then|type|until|use|when|while|with|xor)\b/i,boolean:/\b(?:false|true)\b/i,operator:/<[=>]?|>=?|=>?|:=|\/=?|\*\*?|[&+-]/,punctuation:/\.\.?|[,;():]/,char:/'.'/,variable:/\b[a-z](?:\w)*\b/i}}E.displayName=`agda`,E.aliases=[];function E(e){(function(e){e.languages.agda={comment:/\{-[\s\S]*?(?:-\}|$)|--.*/,string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},punctuation:/[(){}⦃⦄.;@]/,"class-name":{pattern:/((?:data|record) +)\S+/,lookbehind:!0},function:{pattern:/(^[ \t]*)(?!\s)[^:\r\n]+(?=:)/m,lookbehind:!0},operator:{pattern:/(^\s*|\s)(?:[=|:∀→λ\\?_]|->)(?=\s)/,lookbehind:!0},keyword:/\b(?:Set|abstract|constructor|data|eta-equality|field|forall|hiding|import|in|inductive|infix|infixl|infixr|instance|let|macro|module|mutual|no-eta-equality|open|overlap|pattern|postulate|primitive|private|public|quote|quoteContext|quoteGoal|quoteTerm|record|renaming|rewrite|syntax|tactic|unquote|unquoteDecl|unquoteDef|using|variable|where|with)\b/}})(e)}D.displayName=`al`,D.aliases=[];function D(e){e.languages.al={comment:/\/\/.*|\/\*[\s\S]*?\*\//,string:{pattern:/'(?:''|[^'\r\n])*'(?!')|"(?:""|[^"\r\n])*"(?!")/,greedy:!0},function:{pattern:/(\b(?:event|procedure|trigger)\s+|(?:^|[^.])\.\s*)[a-z_]\w*(?=\s*\()/i,lookbehind:!0},keyword:[/\b(?:array|asserterror|begin|break|case|do|downto|else|end|event|exit|for|foreach|function|if|implements|in|indataset|interface|internal|local|of|procedure|program|protected|repeat|runonclient|securityfiltering|suppressdispose|temporary|then|to|trigger|until|var|while|with|withevents)\b/i,/\b(?:action|actions|addafter|addbefore|addfirst|addlast|area|assembly|chartpart|codeunit|column|controladdin|cuegroup|customizes|dataitem|dataset|dotnet|elements|enum|enumextension|extends|field|fieldattribute|fieldelement|fieldgroup|fieldgroups|fields|filter|fixed|grid|group|key|keys|label|labels|layout|modify|moveafter|movebefore|movefirst|movelast|page|pagecustomization|pageextension|part|profile|query|repeater|report|requestpage|schema|separator|systempart|table|tableelement|tableextension|textattribute|textelement|type|usercontrol|value|xmlport)\b/i],number:/\b(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?)(?:F|LL?|U(?:LL?)?)?\b/i,boolean:/\b(?:false|true)\b/i,variable:/\b(?:Curr(?:FieldNo|Page|Report)|x?Rec|RequestOptionsPage)\b/,"class-name":/\b(?:automation|biginteger|bigtext|blob|boolean|byte|char|clienttype|code|completiontriggererrorlevel|connectiontype|database|dataclassification|datascope|date|dateformula|datetime|decimal|defaultlayout|dialog|dictionary|dotnetassembly|dotnettypedeclaration|duration|errorinfo|errortype|executioncontext|executionmode|fieldclass|fieldref|fieldtype|file|filterpagebuilder|guid|httpclient|httpcontent|httpheaders|httprequestmessage|httpresponsemessage|instream|integer|joker|jsonarray|jsonobject|jsontoken|jsonvalue|keyref|list|moduledependencyinfo|moduleinfo|none|notification|notificationscope|objecttype|option|outstream|pageresult|record|recordid|recordref|reportformat|securityfilter|sessionsettings|tableconnectiontype|tablefilter|testaction|testfield|testfilterfield|testpage|testpermissions|testrequestpage|text|textbuilder|textconst|textencoding|time|transactionmodel|transactiontype|variant|verbosity|version|view|views|webserviceactioncontext|webserviceactionresultcode|xmlattribute|xmlattributecollection|xmlcdata|xmlcomment|xmldeclaration|xmldocument|xmldocumenttype|xmlelement|xmlnamespacemanager|xmlnametable|xmlnode|xmlnodelist|xmlprocessinginstruction|xmlreadoptions|xmltext|xmlwriteoptions)\b/i,operator:/\.\.|:[=:]|[-+*/]=?|<>|[<>]=?|=|\b(?:and|div|mod|not|or|xor)\b/i,punctuation:/[()\[\]{}:.;,]/}}O.displayName=`antlr4`,O.aliases=[`g4`];function O(e){e.languages.antlr4={comment:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,string:{pattern:/'(?:\\.|[^\\'\r\n])*'/,greedy:!0},"character-class":{pattern:/\[(?:\\.|[^\\\]\r\n])*\]/,greedy:!0,alias:`regex`,inside:{range:{pattern:/([^[]|(?:^|[^\\])(?:\\\\)*\\\[)-(?!\])/,lookbehind:!0,alias:`punctuation`},escape:/\\(?:u(?:[a-fA-F\d]{4}|\{[a-fA-F\d]+\})|[pP]\{[=\w-]+\}|[^\r\nupP])/,punctuation:/[\[\]]/}},action:{pattern:/\{(?:[^{}]|\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\})*\}/,greedy:!0,inside:{content:{pattern:/(\{)[\s\S]+(?=\})/,lookbehind:!0},punctuation:/[{}]/}},command:{pattern:/(->\s*(?!\s))(?:\s*(?:,\s*)?\b[a-z]\w*(?:\s*\([^()\r\n]*\))?)+(?=\s*;)/i,lookbehind:!0,inside:{function:/\b\w+(?=\s*(?:[,(]|$))/,punctuation:/[,()]/}},annotation:{pattern:/@\w+(?:::\w+)*/,alias:`keyword`},label:{pattern:/#[ \t]*\w+/,alias:`punctuation`},keyword:/\b(?:catch|channels|finally|fragment|grammar|import|lexer|locals|mode|options|parser|returns|throws|tokens)\b/,definition:[{pattern:/\b[a-z]\w*(?=\s*:)/,alias:[`rule`,`class-name`]},{pattern:/\b[A-Z]\w*(?=\s*:)/,alias:[`token`,`constant`]}],constant:/\b[A-Z][A-Z_]*\b/,operator:/\.\.|->|[|~]|[*+?]\??/,punctuation:/[;:()=]/},e.languages.g4=e.languages.antlr4}k.displayName=`apacheconf`,k.aliases=[];function k(e){e.languages.apacheconf={comment:/#.*/,"directive-inline":{pattern:/(^[\t ]*)\b(?:AcceptFilter|AcceptPathInfo|AccessFileName|Action|Add(?:Alt|AltByEncoding|AltByType|Charset|DefaultCharset|Description|Encoding|Handler|Icon|IconByEncoding|IconByType|InputFilter|Language|ModuleInfo|OutputFilter|OutputFilterByType|Type)|Alias|AliasMatch|Allow(?:CONNECT|EncodedSlashes|Methods|Override|OverrideList)?|Anonymous(?:_LogEmail|_MustGiveEmail|_NoUserID|_VerifyEmail)?|AsyncRequestWorkerFactor|Auth(?:BasicAuthoritative|BasicFake|BasicProvider|BasicUseDigestAlgorithm|DBDUserPWQuery|DBDUserRealmQuery|DBMGroupFile|DBMType|DBMUserFile|Digest(?:Algorithm|Domain|NonceLifetime|Provider|Qop|ShmemSize)|Form(?:Authoritative|Body|DisableNoStore|FakeBasicAuth|Location|LoginRequiredLocation|LoginSuccessLocation|LogoutLocation|Method|Mimetype|Password|Provider|SitePassphrase|Size|Username)|GroupFile|LDAP(?:AuthorizePrefix|BindAuthoritative|BindDN|BindPassword|CharsetConfig|CompareAsUser|CompareDNOnServer|DereferenceAliases|GroupAttribute|GroupAttributeIsDN|InitialBindAsUser|InitialBindPattern|MaxSubGroupDepth|RemoteUserAttribute|RemoteUserIsDN|SearchAsUser|SubGroupAttribute|SubGroupClass|Url)|Merging|Name|nCache(?:Context|Enable|ProvideFor|SOCache|Timeout)|nzFcgiCheckAuthnProvider|nzFcgiDefineProvider|Type|UserFile|zDBDLoginToReferer|zDBDQuery|zDBDRedirectQuery|zDBMType|zSendForbiddenOnFailure)|BalancerGrowth|BalancerInherit|BalancerMember|BalancerPersist|BrowserMatch|BrowserMatchNoCase|BufferedLogs|BufferSize|Cache(?:DefaultExpire|DetailHeader|DirLength|DirLevels|Disable|Enable|File|Header|IgnoreCacheControl|IgnoreHeaders|IgnoreNoLastMod|IgnoreQueryString|IgnoreURLSessionIdentifiers|KeyBaseURL|LastModifiedFactor|Lock|LockMaxAge|LockPath|MaxExpire|MaxFileSize|MinExpire|MinFileSize|NegotiatedDocs|QuickHandler|ReadSize|ReadTime|Root|Socache(?:MaxSize|MaxTime|MinTime|ReadSize|ReadTime)?|StaleOnError|StoreExpired|StoreNoStore|StorePrivate)|CGIDScriptTimeout|CGIMapExtension|CharsetDefault|CharsetOptions|CharsetSourceEnc|CheckCaseOnly|CheckSpelling|ChrootDir|ContentDigest|CookieDomain|CookieExpires|CookieName|CookieStyle|CookieTracking|CoreDumpDirectory|CustomLog|Dav|DavDepthInfinity|DavGenericLockDB|DavLockDB|DavMinTimeout|DBDExptime|DBDInitSQL|DBDKeep|DBDMax|DBDMin|DBDParams|DBDPersist|DBDPrepareSQL|DBDriver|DefaultIcon|DefaultLanguage|DefaultRuntimeDir|DefaultType|Define|Deflate(?:BufferSize|CompressionLevel|FilterNote|InflateLimitRequestBody|InflateRatio(?:Burst|Limit)|MemLevel|WindowSize)|Deny|DirectoryCheckHandler|DirectoryIndex|DirectoryIndexRedirect|DirectorySlash|DocumentRoot|DTracePrivileges|DumpIOInput|DumpIOOutput|EnableExceptionHook|EnableMMAP|EnableSendfile|Error|ErrorDocument|ErrorLog|ErrorLogFormat|Example|ExpiresActive|ExpiresByType|ExpiresDefault|ExtendedStatus|ExtFilterDefine|ExtFilterOptions|FallbackResource|FileETag|FilterChain|FilterDeclare|FilterProtocol|FilterProvider|FilterTrace|ForceLanguagePriority|ForceType|ForensicLog|GprofDir|GracefulShutdownTimeout|Group|Header|HeaderName|Heartbeat(?:Address|Listen|MaxServers|Storage)|HostnameLookups|IdentityCheck|IdentityCheckTimeout|ImapBase|ImapDefault|ImapMenu|Include|IncludeOptional|Index(?:HeadInsert|Ignore|IgnoreReset|Options|OrderDefault|StyleSheet)|InputSed|ISAPI(?:AppendLogToErrors|AppendLogToQuery|CacheFile|FakeAsync|LogNotSupported|ReadAheadBuffer)|KeepAlive|KeepAliveTimeout|KeptBodySize|LanguagePriority|LDAP(?:CacheEntries|CacheTTL|ConnectionPoolTTL|ConnectionTimeout|LibraryDebug|OpCacheEntries|OpCacheTTL|ReferralHopLimit|Referrals|Retries|RetryDelay|SharedCacheFile|SharedCacheSize|Timeout|TrustedClientCert|TrustedGlobalCert|TrustedMode|VerifyServerCert)|Limit(?:InternalRecursion|Request(?:Body|Fields|FieldSize|Line)|XMLRequestBody)|Listen|ListenBackLog|LoadFile|LoadModule|LogFormat|LogLevel|LogMessage|LuaAuthzProvider|LuaCodeCache|Lua(?:Hook(?:AccessChecker|AuthChecker|CheckUserID|Fixups|InsertFilter|Log|MapToStorage|TranslateName|TypeChecker)|Inherit|InputFilter|MapHandler|OutputFilter|PackageCPath|PackagePath|QuickHandler|Root|Scope)|Max(?:ConnectionsPerChild|KeepAliveRequests|MemFree|RangeOverlaps|RangeReversals|Ranges|RequestWorkers|SpareServers|SpareThreads|Threads)|MergeTrailers|MetaDir|MetaFiles|MetaSuffix|MimeMagicFile|MinSpareServers|MinSpareThreads|MMapFile|ModemStandard|ModMimeUsePathInfo|MultiviewsMatch|Mutex|NameVirtualHost|NoProxy|NWSSLTrustedCerts|NWSSLUpgradeable|Options|Order|OutputSed|PassEnv|PidFile|PrivilegesMode|Protocol|ProtocolEcho|Proxy(?:AddHeaders|BadHeader|Block|Domain|ErrorOverride|ExpressDBMFile|ExpressDBMType|ExpressEnable|FtpDirCharset|FtpEscapeWildcards|FtpListOnWildcard|HTML(?:BufSize|CharsetOut|DocType|Enable|Events|Extended|Fixups|Interp|Links|Meta|StripComments|URLMap)|IOBufferSize|MaxForwards|Pass(?:Inherit|InterpolateEnv|Match|Reverse|ReverseCookieDomain|ReverseCookiePath)?|PreserveHost|ReceiveBufferSize|Remote|RemoteMatch|Requests|SCGIInternalRedirect|SCGISendfile|Set|SourceAddress|Status|Timeout|Via)|ReadmeName|ReceiveBufferSize|Redirect|RedirectMatch|RedirectPermanent|RedirectTemp|ReflectorHeader|RemoteIP(?:Header|InternalProxy|InternalProxyList|ProxiesHeader|TrustedProxy|TrustedProxyList)|RemoveCharset|RemoveEncoding|RemoveHandler|RemoveInputFilter|RemoveLanguage|RemoveOutputFilter|RemoveType|RequestHeader|RequestReadTimeout|Require|Rewrite(?:Base|Cond|Engine|Map|Options|Rule)|RLimitCPU|RLimitMEM|RLimitNPROC|Satisfy|ScoreBoardFile|Script(?:Alias|AliasMatch|InterpreterSource|Log|LogBuffer|LogLength|Sock)?|SecureListen|SeeRequestTail|SendBufferSize|Server(?:Admin|Alias|Limit|Name|Path|Root|Signature|Tokens)|Session(?:Cookie(?:Name|Name2|Remove)|Crypto(?:Cipher|Driver|Passphrase|PassphraseFile)|DBD(?:CookieName|CookieName2|CookieRemove|DeleteLabel|InsertLabel|PerUser|SelectLabel|UpdateLabel)|Env|Exclude|Header|Include|MaxAge)?|SetEnv|SetEnvIf|SetEnvIfExpr|SetEnvIfNoCase|SetHandler|SetInputFilter|SetOutputFilter|SSIEndTag|SSIErrorMsg|SSIETag|SSILastModified|SSILegacyExprParser|SSIStartTag|SSITimeFormat|SSIUndefinedEcho|SSL(?:CACertificateFile|CACertificatePath|CADNRequestFile|CADNRequestPath|CARevocationCheck|CARevocationFile|CARevocationPath|CertificateChainFile|CertificateFile|CertificateKeyFile|CipherSuite|Compression|CryptoDevice|Engine|FIPS|HonorCipherOrder|InsecureRenegotiation|OCSP(?:DefaultResponder|Enable|OverrideResponder|ResponderTimeout|ResponseMaxAge|ResponseTimeSkew|UseRequestNonce)|OpenSSLConfCmd|Options|PassPhraseDialog|Protocol|Proxy(?:CACertificateFile|CACertificatePath|CARevocation(?:Check|File|Path)|CheckPeer(?:CN|Expire|Name)|CipherSuite|Engine|MachineCertificate(?:ChainFile|File|Path)|Protocol|Verify|VerifyDepth)|RandomSeed|RenegBufferSize|Require|RequireSSL|Session(?:Cache|CacheTimeout|TicketKeyFile|Tickets)|SRPUnknownUserSeed|SRPVerifierFile|Stapling(?:Cache|ErrorCacheTimeout|FakeTryLater|ForceURL|ResponderTimeout|ResponseMaxAge|ResponseTimeSkew|ReturnResponderErrors|StandardCacheTimeout)|StrictSNIVHostCheck|UserName|UseStapling|VerifyClient|VerifyDepth)|StartServers|StartThreads|Substitute|Suexec|SuexecUserGroup|ThreadLimit|ThreadsPerChild|ThreadStackSize|TimeOut|TraceEnable|TransferLog|TypesConfig|UnDefine|UndefMacro|UnsetEnv|Use|UseCanonicalName|UseCanonicalPhysicalPort|User|UserDir|VHostCGIMode|VHostCGIPrivs|VHostGroup|VHostPrivs|VHostSecure|VHostUser|Virtual(?:DocumentRoot|ScriptAlias)(?:IP)?|WatchdogInterval|XBitHack|xml2EncAlias|xml2EncDefault|xml2StartParse)\b/im,lookbehind:!0,alias:`property`},"directive-block":{pattern:/<\/?\b(?:Auth[nz]ProviderAlias|Directory|DirectoryMatch|Else|ElseIf|Files|FilesMatch|If|IfDefine|IfModule|IfVersion|Limit|LimitExcept|Location|LocationMatch|Macro|Proxy|Require(?:All|Any|None)|VirtualHost)\b.*>/i,inside:{"directive-block":{pattern:/^<\/?\w+/,inside:{punctuation:/^<\/?/},alias:`tag`},"directive-block-parameter":{pattern:/.*[^>]/,inside:{punctuation:/:/,string:{pattern:/("|').*\1/,inside:{variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/}}},alias:`attr-value`},punctuation:/>/},alias:`tag`},"directive-flags":{pattern:/\[(?:[\w=],?)+\]/,alias:`keyword`},string:{pattern:/("|').*\1/,inside:{variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/}},variable:/[$%]\{?(?:\w\.?[-+:]?)+\}?/,regex:/\^?.*\$|\^.*\$?/}}A.displayName=`sql`,A.aliases=[];function A(e){e.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},identifier:{pattern:/(^|[^@\\])`(?:\\[\s\S]|[^`\\]|``)*`/,greedy:!0,lookbehind:!0,inside:{punctuation:/^`|`$/}},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:COL|_INSERT)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURN(?:ING|S)?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:FALSE|NULL|TRUE)\b/i,number:/\b0x[\da-f]+\b|\b\d+(?:\.\d*)?|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|DIV|ILIKE|IN|IS|LIKE|NOT|OR|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/}}j.displayName=`apex`,j.aliases=[];function j(e){e.register(S),e.register(A),(function(e){var t=/\b(?:(?:after|before)(?=\s+[a-z])|abstract|activate|and|any|array|as|asc|autonomous|begin|bigdecimal|blob|boolean|break|bulk|by|byte|case|cast|catch|char|class|collect|commit|const|continue|currency|date|datetime|decimal|default|delete|desc|do|double|else|end|enum|exception|exit|export|extends|final|finally|float|for|from|get(?=\s*[{};])|global|goto|group|having|hint|if|implements|import|in|inner|insert|instanceof|int|integer|interface|into|join|like|limit|list|long|loop|map|merge|new|not|null|nulls|number|object|of|on|or|outer|override|package|parallel|pragma|private|protected|public|retrieve|return|rollback|select|set|short|sObject|sort|static|string|super|switch|synchronized|system|testmethod|then|this|throw|time|transaction|transient|trigger|try|undelete|update|upsert|using|virtual|void|webservice|when|where|while|(?:inherited|with|without)\s+sharing)\b/i,n=`\\b(?:(?=[a-z_]\\w*\\s*[<\\[])|(?!))[A-Z_]\\w*(?:\\s*\\.\\s*[A-Z_]\\w*)*\\b(?:\\s*(?:\\[\\s*\\]|<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>))*`.replace(//g,function(){return t.source});function r(e){return RegExp(e.replace(//g,function(){return n}),`i`)}var i={keyword:t,punctuation:/[()\[\]{};,:.<>]/};e.languages.apex={comment:e.languages.clike.comment,string:e.languages.clike.string,sql:{pattern:/((?:[=,({:]|\breturn)\s*)\[[^\[\]]*\]/i,lookbehind:!0,greedy:!0,alias:`language-sql`,inside:e.languages.sql},annotation:{pattern:/@\w+\b/,alias:`punctuation`},"class-name":[{pattern:r(`(\\b(?:class|enum|extends|implements|instanceof|interface|new|trigger\\s+\\w+\\s+on)\\s+)`),lookbehind:!0,inside:i},{pattern:r(`(\\(\\s*)(?=\\s*\\)\\s*[\\w(])`),lookbehind:!0,inside:i},{pattern:r(`(?=\\s*\\w+\\s*[;=,(){:])`),inside:i}],trigger:{pattern:/(\btrigger\s+)\w+\b/i,lookbehind:!0,alias:`class-name`},keyword:t,function:/\b[a-z_]\w*(?=\s*\()/i,boolean:/\b(?:false|true)\b/i,number:/(?:\B\.\d+|\b\d+(?:\.\d+|L)?)\b/i,operator:/[!=](?:==?)?|\?\.?|&&|\|\||--|\+\+|[-+*/^&|]=?|:|<{1,3}=?/,punctuation:/[()\[\]{};,.]/}})(e)}M.displayName=`apl`,M.aliases=[];function M(e){e.languages.apl={comment:/(?:⍝|#[! ]).*$/m,string:{pattern:/'(?:[^'\r\n]|'')*'/,greedy:!0},number:/¯?(?:\d*\.?\b\d+(?:e[+¯]?\d+)?|¯|∞)(?:j¯?(?:(?:\d+(?:\.\d+)?|\.\d+)(?:e[+¯]?\d+)?|¯|∞))?/i,statement:/:[A-Z][a-z][A-Za-z]*\b/,"system-function":{pattern:/⎕[A-Z]+/i,alias:`function`},constant:/[⍬⌾#⎕⍞]/,function:/[-+×÷⌈⌊∣|⍳⍸?*⍟○!⌹<≤=>≥≠≡≢∊⍷∪∩~∨∧⍱⍲⍴,⍪⌽⊖⍉↑↓⊂⊃⊆⊇⌷⍋⍒⊤⊥⍕⍎⊣⊢⍁⍂≈⍯↗¤→]/,"monadic-operator":{pattern:/[\\\/⌿⍀¨⍨⌶&∥]/,alias:`operator`},"dyadic-operator":{pattern:/[.⍣⍠⍤∘⌸@⌺⍥]/,alias:`operator`},assignment:{pattern:/←/,alias:`keyword`},punctuation:/[\[;\]()◇⋄]/,dfn:{pattern:/[{}⍺⍵⍶⍹∇⍫:]/,alias:`builtin`}}}N.displayName=`applescript`,N.aliases=[];function N(e){e.languages.applescript={comment:[/\(\*(?:\(\*(?:[^*]|\*(?!\)))*\*\)|(?!\(\*)[\s\S])*?\*\)/,/--.+/,/#.+/],string:/"(?:\\.|[^"\\\r\n])*"/,number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e-?\d+)?\b/i,operator:[/[&=≠≤≥*+\-\/÷^]|[<>]=?/,/\b(?:(?:begin|end|start)s? with|(?:contains?|(?:does not|doesn't) contain)|(?:is|isn't|is not) (?:contained by|in)|(?:(?:is|isn't|is not) )?(?:greater|less) than(?: or equal)?(?: to)?|(?:comes|(?:does not|doesn't) come) (?:after|before)|(?:is|isn't|is not) equal(?: to)?|(?:(?:does not|doesn't) equal|equal to|equals|is not|isn't)|(?:a )?(?:ref(?: to)?|reference to)|(?:and|as|div|mod|not|or))\b/],keyword:/\b(?:about|above|after|against|apart from|around|aside from|at|back|before|beginning|behind|below|beneath|beside|between|but|by|considering|continue|copy|does|eighth|else|end|equal|error|every|exit|false|fifth|first|for|fourth|from|front|get|given|global|if|ignoring|in|instead of|into|is|it|its|last|local|me|middle|my|ninth|of|on|onto|out of|over|prop|property|put|repeat|return|returning|second|set|seventh|since|sixth|some|tell|tenth|that|the|then|third|through|thru|timeout|times|to|transaction|true|try|until|where|while|whose|with|without)\b/,"class-name":/\b(?:POSIX file|RGB color|alias|application|boolean|centimeters|centimetres|class|constant|cubic centimeters|cubic centimetres|cubic feet|cubic inches|cubic meters|cubic metres|cubic yards|date|degrees Celsius|degrees Fahrenheit|degrees Kelvin|feet|file|gallons|grams|inches|integer|kilograms|kilometers|kilometres|list|liters|litres|meters|metres|miles|number|ounces|pounds|quarts|real|record|reference|script|square feet|square kilometers|square kilometres|square meters|square metres|square miles|square yards|text|yards)\b/,punctuation:/[{}():,¬«»《》]/}}P.displayName=`aql`,P.aliases=[];function P(e){e.languages.aql={comment:/\/\/.*|\/\*[\s\S]*?\*\//,property:{pattern:/([{,]\s*)(?:(?!\d)\w+|(["'´`])(?:(?!\2)[^\\\r\n]|\\.)*\2)(?=\s*:)/,lookbehind:!0,greedy:!0},string:{pattern:/(["'])(?:(?!\1)[^\\\r\n]|\\.)*\1/,greedy:!0},identifier:{pattern:/([´`])(?:(?!\1)[^\\\r\n]|\\.)*\1/,greedy:!0},variable:/@@?\w+/,keyword:[{pattern:/(\bWITH\s+)COUNT(?=\s+INTO\b)/i,lookbehind:!0},/\b(?:AGGREGATE|ALL|AND|ANY|ASC|COLLECT|DESC|DISTINCT|FILTER|FOR|GRAPH|IN|INBOUND|INSERT|INTO|K_PATHS|K_SHORTEST_PATHS|LET|LIKE|LIMIT|NONE|NOT|NULL|OR|OUTBOUND|REMOVE|REPLACE|RETURN|SHORTEST_PATH|SORT|UPDATE|UPSERT|WINDOW|WITH)\b/i,{pattern:/(^|[^\w.[])(?:KEEP|PRUNE|SEARCH|TO)\b/i,lookbehind:!0},{pattern:/(^|[^\w.[])(?:CURRENT|NEW|OLD)\b/,lookbehind:!0},{pattern:/\bOPTIONS(?=\s*\{)/i}],function:/\b(?!\d)\w+(?=\s*\()/,boolean:/\b(?:false|true)\b/i,range:{pattern:/\.\./,alias:`operator`},number:[/\b0b[01]+/i,/\b0x[0-9a-f]+/i,/(?:\B\.\d+|\b(?:0|[1-9]\d*)(?:\.\d+)?)(?:e[+-]?\d+)?/i],operator:/\*{2,}|[=!]~|[!=<>]=?|&&|\|\||[-+*/%]/,punctuation:/::|[?.:,;()[\]{}]/}}F.displayName=`c`,F.aliases=[];function F(e){e.register(S),e.languages.c=e.languages.extend(`clike`,{comment:{pattern:/\/\/(?:[^\r\n\\]|\\(?:\r\n?|\n|(?![\r\n])))*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},"class-name":{pattern:/(\b(?:enum|struct)\s+(?:__attribute__\s*\(\([\s\S]*?\)\)\s*)?)\w+|\b[a-z]\w*_t\b/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|__attribute__|asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|inline|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|typeof|union|unsigned|void|volatile|while)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/(?:\b0x(?:[\da-f]+(?:\.[\da-f]*)?|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?)[ful]{0,4}/i,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/}),e.languages.insertBefore(`c`,`string`,{char:{pattern:/'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n]){0,32}'/,greedy:!0}}),e.languages.insertBefore(`c`,`string`,{macro:{pattern:/(^[\t ]*)#\s*[a-z](?:[^\r\n\\/]|\/(?!\*)|\/\*(?:[^*]|\*(?!\/))*\*\/|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,greedy:!0,alias:`property`,inside:{string:[{pattern:/^(#\s*include\s*)<[^>]+>/,lookbehind:!0},e.languages.c.string],char:e.languages.c.char,comment:e.languages.c.comment,"macro-name":[{pattern:/(^#\s*define\s+)\w+\b(?!\()/i,lookbehind:!0},{pattern:/(^#\s*define\s+)\w+\b(?=\()/i,lookbehind:!0,alias:`function`}],directive:{pattern:/^(#\s*)[a-z]+/,lookbehind:!0,alias:`keyword`},"directive-hash":/^#/,punctuation:/##|\\(?=[\r\n])/,expression:{pattern:/\S[\s\S]*/,inside:e.languages.c}}}}),e.languages.insertBefore(`c`,`function`,{constant:/\b(?:EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|__DATE__|__FILE__|__LINE__|__TIMESTAMP__|__TIME__|__func__|stderr|stdin|stdout)\b/}),delete e.languages.c.boolean}I.displayName=`cpp`,I.aliases=[];function I(e){e.register(F),(function(e){var t=/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|char8_t|class|co_await|co_return|co_yield|compl|concept|const|const_cast|consteval|constexpr|constinit|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|final|float|for|friend|goto|if|import|inline|int|int16_t|int32_t|int64_t|int8_t|long|module|mutable|namespace|new|noexcept|nullptr|operator|override|private|protected|public|register|reinterpret_cast|requires|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|uint16_t|uint32_t|uint64_t|uint8_t|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,n=`\\b(?!)\\w+(?:\\s*\\.\\s*\\w+)*\\b`.replace(//g,function(){return t.source});e.languages.cpp=e.languages.extend(`c`,{"class-name":[{pattern:RegExp(`(\\b(?:class|concept|enum|struct|typename)\\s+)(?!)\\w+`.replace(//g,function(){return t.source})),lookbehind:!0},/\b[A-Z]\w*(?=\s*::\s*\w+\s*\()/,/\b[A-Z_]\w*(?=\s*::\s*~\w+\s*\()/i,/\b\w+(?=\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>\s*::\s*\w+\s*\()/],keyword:t,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+(?:\.[\da-f']*)?|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+(?:\.[\d']*)?|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]{0,4}/i,greedy:!0},operator:/>>=?|<<=?|->|--|\+\+|&&|\|\||[?:~]|<=>|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:false|true)\b/}),e.languages.insertBefore(`cpp`,`string`,{module:{pattern:RegExp(`(\\b(?:import|module)\\s+)(?:"(?:\\\\(?:\\r\\n|[\\s\\S])|[^"\\\\\\r\\n])*"|<[^<>\\r\\n]*>|`+`(?:\\s*:\\s*)?|:\\s*`.replace(//g,function(){return n})+`)`),lookbehind:!0,greedy:!0,inside:{string:/^[<"][\s\S]+/,operator:/:/,punctuation:/\./}},"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:`string`,greedy:!0}}),e.languages.insertBefore(`cpp`,`keyword`,{"generic-function":{pattern:/\b(?!operator\b)[a-z_]\w*\s*<(?:[^<>]|<[^<>]*>)*>(?=\s*\()/i,inside:{function:/^\w+/,generic:{pattern:/<[\s\S]+/,alias:`class-name`,inside:e.languages.cpp}}}}),e.languages.insertBefore(`cpp`,`operator`,{"double-colon":{pattern:/::/,alias:`punctuation`}}),e.languages.insertBefore(`cpp`,`class-name`,{"base-clause":{pattern:/(\b(?:class|struct)\s+\w+\s*:\s*)[^;{}"'\s]+(?:\s+[^;{}"'\s]+)*(?=\s*[;{])/,lookbehind:!0,greedy:!0,inside:e.languages.extend(`cpp`,{})}}),e.languages.insertBefore(`inside`,`double-colon`,{"class-name":/\b[a-z_]\w*\b(?!\s*::)/i},e.languages.cpp[`base-clause`])})(e)}ee.displayName=`arduino`,ee.aliases=[`ino`];function ee(e){e.register(I),e.languages.arduino=e.languages.extend(`cpp`,{keyword:/\b(?:String|array|bool|boolean|break|byte|case|catch|continue|default|do|double|else|finally|for|function|goto|if|in|instanceof|int|integer|long|loop|new|null|return|setup|string|switch|throw|try|void|while|word)\b/,constant:/\b(?:ANALOG_MESSAGE|DEFAULT|DIGITAL_MESSAGE|EXTERNAL|FIRMATA_STRING|HIGH|INPUT|INPUT_PULLUP|INTERNAL|INTERNAL1V1|INTERNAL2V56|LED_BUILTIN|LOW|OUTPUT|REPORT_ANALOG|REPORT_DIGITAL|SET_PIN_MODE|SYSEX_START|SYSTEM_RESET)\b/,builtin:/\b(?:Audio|BSSID|Bridge|Client|Console|EEPROM|Esplora|EsploraTFT|Ethernet|EthernetClient|EthernetServer|EthernetUDP|File|FileIO|FileSystem|Firmata|GPRS|GSM|GSMBand|GSMClient|GSMModem|GSMPIN|GSMScanner|GSMServer|GSMVoiceCall|GSM_SMS|HttpClient|IPAddress|IRread|Keyboard|KeyboardController|LiquidCrystal|LiquidCrystal_I2C|Mailbox|Mouse|MouseController|PImage|Process|RSSI|RobotControl|RobotMotor|SD|SPI|SSID|Scheduler|Serial|Server|Servo|SoftwareSerial|Stepper|Stream|TFT|Task|USBHost|WiFi|WiFiClient|WiFiServer|WiFiUDP|Wire|YunClient|YunServer|abs|addParameter|analogRead|analogReadResolution|analogReference|analogWrite|analogWriteResolution|answerCall|attach|attachGPRS|attachInterrupt|attached|autoscroll|available|background|beep|begin|beginPacket|beginSD|beginSMS|beginSpeaker|beginTFT|beginTransmission|beginWrite|bit|bitClear|bitRead|bitSet|bitWrite|blink|blinkVersion|buffer|changePIN|checkPIN|checkPUK|checkReg|circle|cityNameRead|cityNameWrite|clear|clearScreen|click|close|compassRead|config|connect|connected|constrain|cos|countryNameRead|countryNameWrite|createChar|cursor|debugPrint|delay|delayMicroseconds|detach|detachInterrupt|digitalRead|digitalWrite|disconnect|display|displayLogos|drawBMP|drawCompass|encryptionType|end|endPacket|endSMS|endTransmission|endWrite|exists|exitValue|fill|find|findUntil|flush|gatewayIP|get|getAsynchronously|getBand|getButton|getCurrentCarrier|getIMEI|getKey|getModifiers|getOemKey|getPINUsed|getResult|getSignalStrength|getSocket|getVoiceCallStatus|getXChange|getYChange|hangCall|height|highByte|home|image|interrupts|isActionDone|isDirectory|isListening|isPIN|isPressed|isValid|keyPressed|keyReleased|keyboardRead|knobRead|leftToRight|line|lineFollowConfig|listen|listenOnLocalhost|loadImage|localIP|lowByte|macAddress|maintain|map|max|messageAvailable|micros|millis|min|mkdir|motorsStop|motorsWrite|mouseDragged|mouseMoved|mousePressed|mouseReleased|move|noAutoscroll|noBlink|noBuffer|noCursor|noDisplay|noFill|noInterrupts|noListenOnLocalhost|noStroke|noTone|onReceive|onRequest|open|openNextFile|overflow|parseCommand|parseFloat|parseInt|parsePacket|pauseMode|peek|pinMode|playFile|playMelody|point|pointTo|position|pow|prepare|press|print|printFirmwareVersion|printVersion|println|process|processInput|pulseIn|put|random|randomSeed|read|readAccelerometer|readBlue|readButton|readBytes|readBytesUntil|readGreen|readJoystickButton|readJoystickSwitch|readJoystickX|readJoystickY|readLightSensor|readMessage|readMicrophone|readNetworks|readRed|readSlider|readString|readStringUntil|readTemperature|ready|rect|release|releaseAll|remoteIP|remoteNumber|remotePort|remove|requestFrom|retrieveCallingNumber|rewindDirectory|rightToLeft|rmdir|robotNameRead|robotNameWrite|run|runAsynchronously|runShellCommand|runShellCommandAsynchronously|running|scanNetworks|scrollDisplayLeft|scrollDisplayRight|seek|sendAnalog|sendDigitalPortPair|sendDigitalPorts|sendString|sendSysex|serialEvent|setBand|setBitOrder|setClockDivider|setCursor|setDNS|setDataMode|setFirmwareVersion|setMode|setPINUsed|setSpeed|setTextSize|setTimeout|shiftIn|shiftOut|shutdown|sin|size|sqrt|startLoop|step|stop|stroke|subnetMask|switchPIN|tan|tempoWrite|text|tone|transfer|tuneWrite|turn|updateIR|userNameRead|userNameWrite|voiceCall|waitContinue|width|write|writeBlue|writeGreen|writeJSON|writeMessage|writeMicroseconds|writeRGB|writeRed|yield)\b/}),e.languages.ino=e.languages.arduino}L.displayName=`arff`,L.aliases=[];function L(e){e.languages.arff={comment:/%.*/,string:{pattern:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0},keyword:/@(?:attribute|data|end|relation)\b/i,number:/\b\d+(?:\.\d+)?\b/,punctuation:/[{},]/}}te.displayName=`armasm`,te.aliases=[`arm-asm`];function te(e){e.languages.armasm={comment:{pattern:/;.*/,greedy:!0},string:{pattern:/"(?:[^"\r\n]|"")*"/,greedy:!0,inside:{variable:{pattern:/((?:^|[^$])(?:\${2})*)\$\w+/,lookbehind:!0}}},char:{pattern:/'(?:[^'\r\n]{0,4}|'')'/,greedy:!0},"version-symbol":{pattern:/\|[\w@]+\|/,greedy:!0,alias:`property`},boolean:/\b(?:FALSE|TRUE)\b/,directive:{pattern:/\b(?:ALIAS|ALIGN|AREA|ARM|ASSERT|ATTR|CN|CODE|CODE16|CODE32|COMMON|CP|DATA|DCB|DCD|DCDO|DCDU|DCFD|DCFDU|DCI|DCQ|DCQU|DCW|DCWU|DN|ELIF|ELSE|END|ENDFUNC|ENDIF|ENDP|ENTRY|EQU|EXPORT|EXPORTAS|EXTERN|FIELD|FILL|FN|FUNCTION|GBLA|GBLL|GBLS|GET|GLOBAL|IF|IMPORT|INCBIN|INCLUDE|INFO|KEEP|LCLA|LCLL|LCLS|LTORG|MACRO|MAP|MEND|MEXIT|NOFP|OPT|PRESERVE8|PROC|QN|READONLY|RELOC|REQUIRE|REQUIRE8|RLIST|ROUT|SETA|SETL|SETS|SN|SPACE|SUBT|THUMB|THUMBX|TTL|WEND|WHILE)\b/,alias:`property`},instruction:{pattern:/((?:^|(?:^|[^\\])(?:\r\n?|\n))[ \t]*(?:(?:[A-Z][A-Z0-9_]*[a-z]\w*|[a-z]\w*|\d+)[ \t]+)?)\b[A-Z.]+\b/,lookbehind:!0,alias:`keyword`},variable:/\$\w+/,number:/(?:\b[2-9]_\d+|(?:\b\d+(?:\.\d+)?|\B\.\d+)(?:e-?\d+)?|\b0(?:[fd]_|x)[0-9a-f]+|&[0-9a-f]+)\b/i,register:{pattern:/\b(?:r\d|lr)\b/,alias:`symbol`},operator:/<>|<<|>>|&&|\|\||[=!<>/]=?|[+\-*%#?&|^]|:[A-Z]+:/,punctuation:/[()[\],]/},e.languages[`arm-asm`]=e.languages.armasm}ne.displayName=`arturo`,ne.aliases=[`art`];function ne(e){(function(e){var t=function(t,n){return{pattern:RegExp(`\\{!(?:`+(n||t)+`)$[\\s\\S]*\\}`,`m`),greedy:!0,inside:{embedded:{pattern:/(^\{!\w+\b)[\s\S]+(?=\}$)/,lookbehind:!0,alias:`language-`+t,inside:e.languages[t]},string:/[\s\S]+/}}};e.languages.arturo={comment:{pattern:/;.*/,greedy:!0},character:{pattern:/`.`/,alias:`char`,greedy:!0},number:{pattern:/\b\d+(?:\.\d+(?:\.\d+(?:-[\w+-]+)?)?)?\b/},string:{pattern:/"(?:[^"\\\r\n]|\\.)*"/,greedy:!0},regex:{pattern:/\{\/.*?\/\}/,greedy:!0},"html-string":t(`html`),"css-string":t(`css`),"js-string":t(`js`),"md-string":t(`md`),"sql-string":t(`sql`),"sh-string":t(`shell`,`sh`),multistring:{pattern:/».*|\{:[\s\S]*?:\}|\{[\s\S]*?\}|^-{6}$[\s\S]*/m,alias:`string`,greedy:!0},label:{pattern:/\w+\b\??:/,alias:`property`},literal:{pattern:/'(?:\w+\b\??:?)/,alias:`constant`},type:{pattern:/:(?:\w+\b\??:?)/,alias:`class-name`},color:/#\w+/,predicate:{pattern:/\b(?:all|and|any|ascii|attr|attribute|attributeLabel|binary|block|char|contains|database|date|dictionary|empty|equal|even|every|exists|false|floating|function|greater|greaterOrEqual|if|in|inline|integer|is|key|label|leap|less|lessOrEqual|literal|logical|lower|nand|negative|nor|not|notEqual|null|numeric|odd|or|path|pathLabel|positive|prefix|prime|regex|same|set|some|sorted|standalone|string|subset|suffix|superset|symbol|symbolLiteral|true|try|type|unless|upper|when|whitespace|word|xnor|xor|zero)\?/,alias:`keyword`},"builtin-function":{pattern:/\b(?:abs|acos|acosh|acsec|acsech|actan|actanh|add|after|alert|alias|and|angle|append|arg|args|arity|array|as|asec|asech|asin|asinh|atan|atan2|atanh|attr|attrs|average|before|benchmark|blend|break|call|capitalize|case|ceil|chop|clear|clip|close|color|combine|conj|continue|copy|cos|cosh|crc|csec|csech|ctan|ctanh|cursor|darken|dec|decode|define|delete|desaturate|deviation|dialog|dictionary|difference|digest|digits|div|do|download|drop|dup|e|else|empty|encode|ensure|env|escape|execute|exit|exp|extend|extract|factors|fdiv|filter|first|flatten|floor|fold|from|function|gamma|gcd|get|goto|hash|hypot|if|inc|indent|index|infinity|info|input|insert|inspect|intersection|invert|jaro|join|keys|kurtosis|last|let|levenshtein|lighten|list|ln|log|loop|lower|mail|map|match|max|median|min|mod|module|mul|nand|neg|new|nor|normalize|not|now|null|open|or|outdent|pad|palette|panic|path|pause|permissions|permutate|pi|pop|popup|pow|powerset|powmod|prefix|print|prints|process|product|query|random|range|read|relative|remove|rename|render|repeat|replace|request|return|reverse|round|sample|saturate|script|sec|sech|select|serve|set|shl|shr|shuffle|sin|sinh|size|skewness|slice|sort|spin|split|sqrt|squeeze|stack|strip|sub|suffix|sum|switch|symbols|symlink|sys|take|tan|tanh|terminal|terminate|to|truncate|try|type|unclip|union|unique|unless|until|unzip|upper|values|var|variance|volume|webview|while|with|wordwrap|write|xnor|xor|zip)\b/,alias:`keyword`},sugar:{pattern:/->|=>|\||::/,alias:`operator`},punctuation:/[()[\],]/,symbol:{pattern:/<:|-:|ø|@|#|\+|\||\*|\$|---|-|%|\/|\.\.|\^|~|=|<|>|\\/},boolean:{pattern:/\b(?:false|maybe|true)\b/}},e.languages.art=e.languages.arturo})(e)}R.displayName=`asciidoc`,R.aliases=[`adoc`];function R(e){(function(e){var t={pattern:/(^[ \t]*)\[(?!\[)(?:(["'$`])(?:(?!\2)[^\\]|\\.)*\2|\[(?:[^\[\]\\]|\\.)*\]|[^\[\]\\"'$`]|\\.)*\]/m,lookbehind:!0,inside:{quoted:{pattern:/([$`])(?:(?!\1)[^\\]|\\.)*\1/,inside:{punctuation:/^[$`]|[$`]$/}},interpreted:{pattern:/'(?:[^'\\]|\\.)*'/,inside:{punctuation:/^'|'$/}},string:/"(?:[^"\\]|\\.)*"/,variable:/\w+(?==)/,punctuation:/^\[|\]$|,/,operator:/=/,"attr-value":/(?!^\s+$).+/}},n=e.languages.asciidoc={"comment-block":{pattern:/^(\/{4,})$[\s\S]*?^\1/m,alias:`comment`},table:{pattern:/^\|={3,}(?:(?:\r?\n|\r(?!\n)).*)*?(?:\r?\n|\r)\|={3,}$/m,inside:{specifiers:{pattern:/(?:(?:(?:\d+(?:\.\d+)?|\.\d+)[+*](?:[<^>](?:\.[<^>])?|\.[<^>])?|[<^>](?:\.[<^>])?|\.[<^>])[a-z]*|[a-z]+)(?=\|)/,alias:`attr-value`},punctuation:{pattern:/(^|[^\\])[|!]=*/,lookbehind:!0}}},"passthrough-block":{pattern:/^(\+{4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^\++|\++$/}},"literal-block":{pattern:/^(-{4,}|\.{4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^(?:-+|\.+)|(?:-+|\.+)$/}},"other-block":{pattern:/^(--|\*{4,}|_{4,}|={4,})$[\s\S]*?^\1$/m,inside:{punctuation:/^(?:-+|\*+|_+|=+)|(?:-+|\*+|_+|=+)$/}},"list-punctuation":{pattern:/(^[ \t]*)(?:-|\*{1,5}|\.{1,5}|(?:[a-z]|\d+)\.|[xvi]+\))(?= )/im,lookbehind:!0,alias:`punctuation`},"list-label":{pattern:/(^[ \t]*)[a-z\d].+(?::{2,4}|;;)(?=\s)/im,lookbehind:!0,alias:`symbol`},"indented-block":{pattern:/((\r?\n|\r)\2)([ \t]+)\S.*(?:(?:\r?\n|\r)\3.+)*(?=\2{2}|$)/,lookbehind:!0},comment:/^\/\/.*/m,title:{pattern:/^.+(?:\r?\n|\r)(?:={3,}|-{3,}|~{3,}|\^{3,}|\+{3,})$|^={1,5} .+|^\.(?![\s.]).*/m,alias:`important`,inside:{punctuation:/^(?:\.|=+)|(?:=+|-+|~+|\^+|\++)$/}},"attribute-entry":{pattern:/^:[^:\r\n]+:(?: .*?(?: \+(?:\r?\n|\r).*?)*)?$/m,alias:`tag`},attributes:t,hr:{pattern:/^'{3,}$/m,alias:`punctuation`},"page-break":{pattern:/^<{3,}$/m,alias:`punctuation`},admonition:{pattern:/^(?:CAUTION|IMPORTANT|NOTE|TIP|WARNING):/m,alias:`keyword`},callout:[{pattern:/(^[ \t]*)/m,lookbehind:!0,alias:`symbol`},{pattern:/<\d+>/,alias:`symbol`}],macro:{pattern:/\b[a-z\d][a-z\d-]*::?(?:[^\s\[\]]*\[(?:[^\]\\"']|(["'])(?:(?!\1)[^\\]|\\.)*\1|\\.)*\])/,inside:{function:/^[a-z\d-]+(?=:)/,punctuation:/^::?/,attributes:{pattern:/(?:\[(?:[^\]\\"']|(["'])(?:(?!\1)[^\\]|\\.)*\1|\\.)*\])/,inside:t.inside}}},inline:{pattern:/(^|[^\\])(?:(?:\B\[(?:[^\]\\"']|(["'])(?:(?!\2)[^\\]|\\.)*\2|\\.)*\])?(?:\b_(?!\s)(?: _|[^_\\\r\n]|\\.)+(?:(?:\r?\n|\r)(?: _|[^_\\\r\n]|\\.)+)*_\b|\B``(?!\s).+?(?:(?:\r?\n|\r).+?)*''\B|\B`(?!\s)(?:[^`'\s]|\s+\S)+['`]\B|\B(['*+#])(?!\s)(?: \3|(?!\3)[^\\\r\n]|\\.)+(?:(?:\r?\n|\r)(?: \3|(?!\3)[^\\\r\n]|\\.)+)*\3\B)|(?:\[(?:[^\]\\"']|(["'])(?:(?!\4)[^\\]|\\.)*\4|\\.)*\])?(?:(__|\*\*|\+\+\+?|##|\$\$|[~^]).+?(?:(?:\r?\n|\r).+?)*\5|\{[^}\r\n]+\}|\[\[\[?.+?(?:(?:\r?\n|\r).+?)*\]?\]\]|<<.+?(?:(?:\r?\n|\r).+?)*>>|\(\(\(?.+?(?:(?:\r?\n|\r).+?)*\)?\)\)))/m,lookbehind:!0,inside:{attributes:t,url:{pattern:/^(?:\[\[\[?.+?\]?\]\]|<<.+?>>)$/,inside:{punctuation:/^(?:\[\[\[?|<<)|(?:\]\]\]?|>>)$/}},"attribute-ref":{pattern:/^\{.+\}$/,inside:{variable:{pattern:/(^\{)[a-z\d,+_-]+/,lookbehind:!0},operator:/^[=?!#%@$]|!(?=[:}])/,punctuation:/^\{|\}$|::?/}},italic:{pattern:/^(['_])[\s\S]+\1$/,inside:{punctuation:/^(?:''?|__?)|(?:''?|__?)$/}},bold:{pattern:/^\*[\s\S]+\*$/,inside:{punctuation:/^\*\*?|\*\*?$/}},punctuation:/^(?:``?|\+{1,3}|##?|\$\$|[~^]|\(\(\(?)|(?:''?|\+{1,3}|##?|\$\$|[~^`]|\)?\)\))$/}},replacement:{pattern:/\((?:C|R|TM)\)/,alias:`builtin`},entity:/&#?[\da-z]{1,8};/i,"line-continuation":{pattern:/(^| )\+$/m,lookbehind:!0,alias:`punctuation`}};function r(e){e=e.split(` `);for(var t={},r=0,i=e.length;r>/g,function(){return`(?:`+e+`)`});return e.replace(/<>/g,`[^\\s\\S]`)}var i={type:`bool byte char decimal double dynamic float int long object sbyte short string uint ulong ushort var void`,typeDeclaration:`class enum interface record struct`,contextual:`add alias and ascending async await by descending from(?=\\s*(?:\\w|$)) get global group into init(?=\\s*;) join let nameof not notnull on or orderby partial remove select set unmanaged value when where with(?=\\s*{)`,other:`abstract as base break case catch checked const continue default delegate do else event explicit extern finally fixed for foreach goto if implicit in internal is lock namespace new null operator out override params private protected public readonly ref return sealed sizeof stackalloc static switch this throw try typeof unchecked unsafe using virtual volatile while yield`};function a(e){return`\\b(?:`+e.trim().replace(/ /g,`|`)+`)\\b`}var o=a(i.typeDeclaration),s=RegExp(a(i.type+` `+i.typeDeclaration+` `+i.contextual+` `+i.other)),c=a(i.typeDeclaration+` `+i.contextual+` `+i.other),l=a(i.type+` `+i.typeDeclaration+` `+i.other),u=r(`<(?:[^<>;=+\\-*/%&|^]|<>)*>`,2),d=r(`\\((?:[^()]|<>)*\\)`,2),f=`@?\\b[A-Za-z_]\\w*\\b`,p=t(`<<0>>(?:\\s*<<1>>)?`,[f,u]),m=t(`(?!<<0>>)<<1>>(?:\\s*\\.\\s*<<1>>)*`,[c,p]),h=`\\[\\s*(?:,\\s*)*\\]`,g=t(`<<0>>(?:\\s*(?:\\?\\s*)?<<1>>)*(?:\\s*\\?)?`,[m,h]),_=t(`(?:<<0>>|<<1>>)(?:\\s*(?:\\?\\s*)?<<2>>)*(?:\\s*\\?)?`,[t(`\\(<<0>>+(?:,<<0>>+)+\\)`,[t(`[^,()<>[\\];=+\\-*/%&|^]|<<0>>|<<1>>|<<2>>`,[u,d,h])]),m,h]),v={keyword:s,punctuation:/[<>()?,.:[\]]/},y=`'(?:[^\\r\\n'\\\\]|\\\\.|\\\\[Uux][\\da-fA-F]{1,8})'`,b=`"(?:\\\\.|[^\\\\"\\r\\n])*"`,x=`@"(?:""|\\\\[\\s\\S]|[^\\\\"])*"(?!")`;e.languages.csharp=e.languages.extend(`clike`,{string:[{pattern:n(`(^|[^$\\\\])<<0>>`,[x]),lookbehind:!0,greedy:!0},{pattern:n(`(^|[^@$\\\\])<<0>>`,[b]),lookbehind:!0,greedy:!0}],"class-name":[{pattern:n(`(\\busing\\s+static\\s+)<<0>>(?=\\s*;)`,[m]),lookbehind:!0,inside:v},{pattern:n(`(\\busing\\s+<<0>>\\s*=\\s*)<<1>>(?=\\s*;)`,[f,_]),lookbehind:!0,inside:v},{pattern:n(`(\\busing\\s+)<<0>>(?=\\s*=)`,[f]),lookbehind:!0},{pattern:n(`(\\b<<0>>\\s+)<<1>>`,[o,p]),lookbehind:!0,inside:v},{pattern:n(`(\\bcatch\\s*\\(\\s*)<<0>>`,[m]),lookbehind:!0,inside:v},{pattern:n(`(\\bwhere\\s+)<<0>>`,[f]),lookbehind:!0},{pattern:n(`(\\b(?:is(?:\\s+not)?|as)\\s+)<<0>>`,[g]),lookbehind:!0,inside:v},{pattern:n(`\\b<<0>>(?=\\s+(?!<<1>>|with\\s*\\{)<<2>>(?:\\s*[=,;:{)\\]]|\\s+(?:in|when)\\b))`,[_,l,f]),inside:v}],keyword:s,number:/(?:\b0(?:x[\da-f_]*[\da-f]|b[01_]*[01])|(?:\B\.\d+(?:_+\d+)*|\b\d+(?:_+\d+)*(?:\.\d+(?:_+\d+)*)?)(?:e[-+]?\d+(?:_+\d+)*)?)(?:[dflmu]|lu|ul)?\b/i,operator:/>>=?|<<=?|[-=]>|([-+&|])\1|~|\?\?=?|[-+*/%&|^!=<>]=?/,punctuation:/\?\.?|::|[{}[\];(),.:]/}),e.languages.insertBefore(`csharp`,`number`,{range:{pattern:/\.\./,alias:`operator`}}),e.languages.insertBefore(`csharp`,`punctuation`,{"named-parameter":{pattern:n(`([(,]\\s*)<<0>>(?=\\s*:)`,[f]),lookbehind:!0,alias:`punctuation`}}),e.languages.insertBefore(`csharp`,`class-name`,{namespace:{pattern:n(`(\\b(?:namespace|using)\\s+)<<0>>(?:\\s*\\.\\s*<<0>>)*(?=\\s*[;{])`,[f]),lookbehind:!0,inside:{punctuation:/\./}},"type-expression":{pattern:n(`(\\b(?:default|sizeof|typeof)\\s*\\(\\s*(?!\\s))(?:[^()\\s]|\\s(?!\\s)|<<0>>)*(?=\\s*\\))`,[d]),lookbehind:!0,alias:`class-name`,inside:v},"return-type":{pattern:n(`<<0>>(?=\\s+(?:<<1>>\\s*(?:=>|[({]|\\.\\s*this\\s*\\[)|this\\s*\\[))`,[_,m]),inside:v,alias:`class-name`},"constructor-invocation":{pattern:n(`(\\bnew\\s+)<<0>>(?=\\s*[[({])`,[_]),lookbehind:!0,inside:v,alias:`class-name`},"generic-method":{pattern:n(`<<0>>\\s*<<1>>(?=\\s*\\()`,[f,u]),inside:{function:n(`^<<0>>`,[f]),generic:{pattern:RegExp(u),alias:`class-name`,inside:v}}},"type-list":{pattern:n(`\\b((?:<<0>>\\s+<<1>>|record\\s+<<1>>\\s*<<5>>|where\\s+<<2>>)\\s*:\\s*)(?:<<3>>|<<4>>|<<1>>\\s*<<5>>|<<6>>)(?:\\s*,\\s*(?:<<3>>|<<4>>|<<6>>))*(?=\\s*(?:where|[{;]|=>|$))`,[o,p,f,_,s.source,d,`\\bnew\\s*\\(\\s*\\)`]),lookbehind:!0,inside:{"record-arguments":{pattern:n(`(^(?!new\\s*\\()<<0>>\\s*)<<1>>`,[p,d]),lookbehind:!0,greedy:!0,inside:e.languages.csharp},keyword:s,"class-name":{pattern:RegExp(_),greedy:!0,inside:v},punctuation:/[,()]/}},preprocessor:{pattern:/(^[\t ]*)#.*/m,lookbehind:!0,alias:`property`,inside:{directive:{pattern:/(#)\b(?:define|elif|else|endif|endregion|error|if|line|nullable|pragma|region|undef|warning)\b/,lookbehind:!0,alias:`keyword`}}}});var S=b+`|`+y,C=t(`\\/(?![*/])|\\/\\/[^\\r\\n]*[\\r\\n]|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|<<0>>`,[S]),w=r(t(`[^"'/()]|<<0>>|\\(<>*\\)`,[C]),2),T=`\\b(?:assembly|event|field|method|module|param|property|return|type)\\b`,E=t(`<<0>>(?:\\s*\\(<<1>>*\\))?`,[m,w]);e.languages.insertBefore(`csharp`,`class-name`,{attribute:{pattern:n(`((?:^|[^\\s\\w>)?])\\s*\\[\\s*)(?:<<0>>\\s*:\\s*)?<<1>>(?:\\s*,\\s*<<1>>)*(?=\\s*\\])`,[T,E]),lookbehind:!0,greedy:!0,inside:{target:{pattern:n(`^<<0>>(?=\\s*:)`,[T]),alias:`keyword`},"attribute-arguments":{pattern:n(`\\(<<0>>*\\)`,[w]),inside:e.languages.csharp},"class-name":{pattern:RegExp(m),inside:{punctuation:/\./}},punctuation:/[:,]/}}});var D=`:[^}\\r\\n]+`,O=r(t(`[^"'/()]|<<0>>|\\(<>*\\)`,[C]),2),k=t(`\\{(?!\\{)(?:(?![}:])<<0>>)*<<1>>?\\}`,[O,D]),A=r(t(`[^"'/()]|\\/(?!\\*)|\\/\\*(?:[^*]|\\*(?!\\/))*\\*\\/|<<0>>|\\(<>*\\)`,[S]),2),j=t(`\\{(?!\\{)(?:(?![}:])<<0>>)*<<1>>?\\}`,[A,D]);function M(t,r){return{interpolation:{pattern:n(`((?:^|[^{])(?:\\{\\{)*)<<0>>`,[t]),lookbehind:!0,inside:{"format-string":{pattern:n(`(^\\{(?:(?![}:])<<0>>)*)<<1>>(?=\\}$)`,[r,D]),lookbehind:!0,inside:{punctuation:/^:/}},punctuation:/^\{|\}$/,expression:{pattern:/[\s\S]+/,alias:`language-csharp`,inside:e.languages.csharp}}},string:/[\s\S]+/}}e.languages.insertBefore(`csharp`,`string`,{"interpolation-string":[{pattern:n(`(^|[^\\\\])(?:\\$@|@\\$)"(?:""|\\\\[\\s\\S]|\\{\\{|<<0>>|[^\\\\{"])*"`,[k]),lookbehind:!0,greedy:!0,inside:M(k,O)},{pattern:n(`(^|[^@\\\\])\\$"(?:\\\\.|\\{\\{|<<0>>|[^\\\\"{])*"`,[j]),lookbehind:!0,greedy:!0,inside:M(j,A)}],char:{pattern:RegExp(y),greedy:!0}}),e.languages.dotnet=e.languages.cs=e.languages.csharp})(e)}B.displayName=`markup`,B.aliases=[`atom`,`html`,`mathml`,`rss`,`ssml`,`svg`,`xml`];function B(e){e.languages.markup={comment:{pattern://,greedy:!0},prolog:{pattern:/<\?[\s\S]+?\?>/,greedy:!0},doctype:{pattern:/"'[\]]|"[^"]*"|'[^']*')+(?:\[(?:[^<"'\]]|"[^"]*"|'[^']*'|<(?!!--)|)*\]\s*)?>/i,greedy:!0,inside:{"internal-subset":{pattern:/(^[^\[]*\[)[\s\S]+(?=\]>$)/,lookbehind:!0,greedy:!0,inside:null},string:{pattern:/"[^"]*"|'[^']*'/,greedy:!0},punctuation:/^$|[[\]]/,"doctype-tag":/^DOCTYPE/i,name:/[^\s<>'"]+/}},cdata:{pattern://i,greedy:!0},tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"special-attr":[],"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/,inside:{punctuation:[{pattern:/^=/,alias:`attr-equals`},{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:[{pattern:/&[\da-z]{1,8};/i,alias:`named-entity`},/&#x?[\da-f]{1,8};/i]},e.languages.markup.tag.inside[`attr-value`].inside.entity=e.languages.markup.entity,e.languages.markup.doctype.inside[`internal-subset`].inside=e.languages.markup,e.hooks.add(`wrap`,function(e){e.type===`entity`&&(e.attributes.title=e.content.value.replace(/&/,`&`))}),Object.defineProperty(e.languages.markup.tag,"addInlined",{value:function(t,n){var r={};r[`language-`+n]={pattern:/(^$)/i,lookbehind:!0,inside:e.languages[n]},r.cdata=/^$/i;var i={"included-cdata":{pattern://i,inside:r}};i[`language-`+n]={pattern:/[\s\S]+/,inside:e.languages[n]};var a={};a[t]={pattern:RegExp(`(<__[^>]*>)(?:))*\\]\\]>|(?!)`.replace(/__/g,function(){return t}),`i`),lookbehind:!0,greedy:!0,inside:i},e.languages.insertBefore(`markup`,`cdata`,a)}}),Object.defineProperty(e.languages.markup.tag,"addAttribute",{value:function(t,n){e.languages.markup.tag.inside[`special-attr`].push({pattern:RegExp(`(^|["'\\s])(?:`+t+`)\\s*=\\s*(?:"[^"]*"|'[^']*'|[^\\s'">=]+(?=[\\s>]))`,`i`),lookbehind:!0,inside:{"attr-name":/^[^\s=]+/,"attr-value":{pattern:/=[\s\S]+/,inside:{value:{pattern:/(^=\s*(["']|(?!["'])))\S[\s\S]*(?=\2$)/,lookbehind:!0,alias:[n,`language-`+n],inside:e.languages[n]},punctuation:[{pattern:/^=/,alias:`attr-equals`},/"|'/]}}}})}}),e.languages.html=e.languages.markup,e.languages.mathml=e.languages.markup,e.languages.svg=e.languages.markup,e.languages.xml=e.languages.extend(`markup`,{}),e.languages.ssml=e.languages.xml,e.languages.atom=e.languages.xml,e.languages.rss=e.languages.xml}ae.displayName=`aspnet`,ae.aliases=[];function ae(e){e.register(z),e.register(B),e.languages.aspnet=e.languages.extend(`markup`,{"page-directive":{pattern:/<%\s*@.*%>/,alias:`tag`,inside:{"page-directive":{pattern:/<%\s*@\s*(?:Assembly|Control|Implements|Import|Master(?:Type)?|OutputCache|Page|PreviousPageType|Reference|Register)?|%>/i,alias:`tag`},rest:e.languages.markup.tag.inside}},directive:{pattern:/<%.*%>/,alias:`tag`,inside:{directive:{pattern:/<%\s*?[$=%#:]{0,2}|%>/,alias:`tag`},rest:e.languages.csharp}}}),e.languages.aspnet.tag.pattern=/<(?!%)\/?[^\s>\/]+(?:\s+[^\s>\/=]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">=]+))?)*\s*\/?>/,e.languages.insertBefore(`inside`,`punctuation`,{directive:e.languages.aspnet.directive},e.languages.aspnet.tag.inside[`attr-value`]),e.languages.insertBefore(`aspnet`,`comment`,{"asp-comment":{pattern:/<%--[\s\S]*?--%>/,alias:[`asp`,`comment`]}}),e.languages.insertBefore(`aspnet`,e.languages.javascript?`script`:`tag`,{"asp-script":{pattern:/(]*>)[\s\S]*?(?=<\/script>)/i,lookbehind:!0,alias:[`asp`,`script`],inside:e.languages.csharp||{}}})}oe.displayName=`autohotkey`,oe.aliases=[];function oe(e){e.languages.autohotkey={comment:[{pattern:/(^|\s);.*/,lookbehind:!0},{pattern:/(^[\t ]*)\/\*(?:[\r\n](?![ \t]*\*\/)|[^\r\n])*(?:[\r\n][ \t]*\*\/)?/m,lookbehind:!0,greedy:!0}],tag:{pattern:/^([ \t]*)[^\s,`":]+(?=:[ \t]*$)/m,lookbehind:!0},string:/"(?:[^"\n\r]|"")*"/,variable:/%\w+%/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/\?|\/\/?=?|:=|\|[=|]?|&[=&]?|\+[=+]?|-[=-]?|\*[=*]?|<(?:<=?|>|=)?|>>?=?|[.^!=~]=?|\b(?:AND|NOT|OR)\b/,boolean:/\b(?:false|true)\b/,command:{pattern:/\b(?:AutoTrim|BlockInput|Break|Click|ClipWait|Continue|Control|ControlClick|ControlFocus|ControlGet|ControlGetFocus|ControlGetPos|ControlGetText|ControlMove|ControlSend|ControlSendRaw|ControlSetText|CoordMode|Critical|DetectHiddenText|DetectHiddenWindows|Drive|DriveGet|DriveSpaceFree|EnvAdd|EnvDiv|EnvGet|EnvMult|EnvSet|EnvSub|EnvUpdate|Exit|ExitApp|FileAppend|FileCopy|FileCopyDir|FileCreateDir|FileCreateShortcut|FileDelete|FileEncoding|FileGetAttrib|FileGetShortcut|FileGetSize|FileGetTime|FileGetVersion|FileInstall|FileMove|FileMoveDir|FileRead|FileReadLine|FileRecycle|FileRecycleEmpty|FileRemoveDir|FileSelectFile|FileSelectFolder|FileSetAttrib|FileSetTime|FormatTime|GetKeyState|Gosub|Goto|GroupActivate|GroupAdd|GroupClose|GroupDeactivate|Gui|GuiControl|GuiControlGet|Hotkey|ImageSearch|IniDelete|IniRead|IniWrite|Input|InputBox|KeyWait|ListHotkeys|ListLines|ListVars|Loop|Menu|MouseClick|MouseClickDrag|MouseGetPos|MouseMove|MsgBox|OnExit|OutputDebug|Pause|PixelGetColor|PixelSearch|PostMessage|Process|Progress|Random|RegDelete|RegRead|RegWrite|Reload|Repeat|Return|Run|RunAs|RunWait|Send|SendEvent|SendInput|SendMessage|SendMode|SendPlay|SendRaw|SetBatchLines|SetCapslockState|SetControlDelay|SetDefaultMouseSpeed|SetEnv|SetFormat|SetKeyDelay|SetMouseDelay|SetNumlockState|SetRegView|SetScrollLockState|SetStoreCapslockMode|SetTimer|SetTitleMatchMode|SetWinDelay|SetWorkingDir|Shutdown|Sleep|Sort|SoundBeep|SoundGet|SoundGetWaveVolume|SoundPlay|SoundSet|SoundSetWaveVolume|SplashImage|SplashTextOff|SplashTextOn|SplitPath|StatusBarGetText|StatusBarWait|StringCaseSense|StringGetPos|StringLeft|StringLen|StringLower|StringMid|StringReplace|StringRight|StringSplit|StringTrimLeft|StringTrimRight|StringUpper|Suspend|SysGet|Thread|ToolTip|Transform|TrayTip|URLDownloadToFile|WinActivate|WinActivateBottom|WinClose|WinGet|WinGetActiveStats|WinGetActiveTitle|WinGetClass|WinGetPos|WinGetText|WinGetTitle|WinHide|WinKill|WinMaximize|WinMenuSelectItem|WinMinimize|WinMinimizeAll|WinMinimizeAllUndo|WinMove|WinRestore|WinSet|WinSetTitle|WinShow|WinWait|WinWaitActive|WinWaitClose|WinWaitNotActive)\b/i,alias:`selector`},constant:/\b(?:a_ahkpath|a_ahkversion|a_appdata|a_appdatacommon|a_autotrim|a_batchlines|a_caretx|a_carety|a_computername|a_controldelay|a_cursor|a_dd|a_ddd|a_dddd|a_defaultmousespeed|a_desktop|a_desktopcommon|a_detecthiddentext|a_detecthiddenwindows|a_endchar|a_eventinfo|a_exitreason|a_fileencoding|a_formatfloat|a_formatinteger|a_gui|a_guicontrol|a_guicontrolevent|a_guievent|a_guiheight|a_guiwidth|a_guix|a_guiy|a_hour|a_iconfile|a_iconhidden|a_iconnumber|a_icontip|a_index|a_ipaddress1|a_ipaddress2|a_ipaddress3|a_ipaddress4|a_is64bitos|a_isadmin|a_iscompiled|a_iscritical|a_ispaused|a_issuspended|a_isunicode|a_keydelay|a_language|a_lasterror|a_linefile|a_linenumber|a_loopfield|a_loopfileattrib|a_loopfiledir|a_loopfileext|a_loopfilefullpath|a_loopfilelongpath|a_loopfilename|a_loopfileshortname|a_loopfileshortpath|a_loopfilesize|a_loopfilesizekb|a_loopfilesizemb|a_loopfiletimeaccessed|a_loopfiletimecreated|a_loopfiletimemodified|a_loopreadline|a_loopregkey|a_loopregname|a_loopregsubkey|a_loopregtimemodified|a_loopregtype|a_mday|a_min|a_mm|a_mmm|a_mmmm|a_mon|a_mousedelay|a_msec|a_mydocuments|a_now|a_nowutc|a_numbatchlines|a_ostype|a_osversion|a_priorhotkey|a_priorkey|a_programfiles|a_programs|a_programscommon|a_ptrsize|a_regview|a_screendpi|a_screenheight|a_screenwidth|a_scriptdir|a_scriptfullpath|a_scripthwnd|a_scriptname|a_sec|a_space|a_startmenu|a_startmenucommon|a_startup|a_startupcommon|a_stringcasesense|a_tab|a_temp|a_thisfunc|a_thishotkey|a_thislabel|a_thismenu|a_thismenuitem|a_thismenuitempos|a_tickcount|a_timeidle|a_timeidlephysical|a_timesincepriorhotkey|a_timesincethishotkey|a_titlematchmode|a_titlematchmodespeed|a_username|a_wday|a_windelay|a_windir|a_workingdir|a_yday|a_year|a_yweek|a_yyyy|clipboard|clipboardall|comspec|errorlevel|programfiles)\b/i,builtin:/\b(?:abs|acos|asc|asin|atan|ceil|chr|class|comobjactive|comobjarray|comobjconnect|comobjcreate|comobjerror|comobjflags|comobjget|comobjquery|comobjtype|comobjvalue|cos|dllcall|exp|fileexist|Fileopen|floor|format|il_add|il_create|il_destroy|instr|isfunc|islabel|IsObject|ln|log|ltrim|lv_add|lv_delete|lv_deletecol|lv_getcount|lv_getnext|lv_gettext|lv_insert|lv_insertcol|lv_modify|lv_modifycol|lv_setimagelist|mod|numget|numput|onmessage|regexmatch|regexreplace|registercallback|round|rtrim|sb_seticon|sb_setparts|sb_settext|sin|sqrt|strlen|strreplace|strsplit|substr|tan|tv_add|tv_delete|tv_get|tv_getchild|tv_getcount|tv_getnext|tv_getparent|tv_getprev|tv_getselection|tv_gettext|tv_modify|varsetcapacity|winactive|winexist|__Call|__Get|__New|__Set)\b/i,symbol:/\b(?:alt|altdown|altup|appskey|backspace|browser_back|browser_favorites|browser_forward|browser_home|browser_refresh|browser_search|browser_stop|bs|capslock|ctrl|ctrlbreak|ctrldown|ctrlup|del|delete|down|end|enter|esc|escape|f1|f10|f11|f12|f13|f14|f15|f16|f17|f18|f19|f2|f20|f21|f22|f23|f24|f3|f4|f5|f6|f7|f8|f9|home|ins|insert|joy1|joy10|joy11|joy12|joy13|joy14|joy15|joy16|joy17|joy18|joy19|joy2|joy20|joy21|joy22|joy23|joy24|joy25|joy26|joy27|joy28|joy29|joy3|joy30|joy31|joy32|joy4|joy5|joy6|joy7|joy8|joy9|joyaxes|joybuttons|joyinfo|joyname|joypov|joyr|joyu|joyv|joyx|joyy|joyz|lalt|launch_app1|launch_app2|launch_mail|launch_media|lbutton|lcontrol|lctrl|left|lshift|lwin|lwindown|lwinup|mbutton|media_next|media_play_pause|media_prev|media_stop|numlock|numpad0|numpad1|numpad2|numpad3|numpad4|numpad5|numpad6|numpad7|numpad8|numpad9|numpadadd|numpadclear|numpaddel|numpaddiv|numpaddot|numpaddown|numpadend|numpadenter|numpadhome|numpadins|numpadleft|numpadmult|numpadpgdn|numpadpgup|numpadright|numpadsub|numpadup|pgdn|pgup|printscreen|ralt|rbutton|rcontrol|rctrl|right|rshift|rwin|rwindown|rwinup|scrolllock|shift|shiftdown|shiftup|space|tab|up|volume_down|volume_mute|volume_up|wheeldown|wheelleft|wheelright|wheelup|xbutton1|xbutton2)\b/i,directive:{pattern:/#[a-z]+\b/i,alias:`important`},keyword:/\b(?:Abort|AboveNormal|Add|ahk_class|ahk_exe|ahk_group|ahk_id|ahk_pid|All|Alnum|Alpha|AltSubmit|AltTab|AltTabAndMenu|AltTabMenu|AltTabMenuDismiss|AlwaysOnTop|AutoSize|Background|BackgroundTrans|BelowNormal|between|BitAnd|BitNot|BitOr|BitShiftLeft|BitShiftRight|BitXOr|Bold|Border|Button|ByRef|Catch|Checkbox|Checked|CheckedGray|Choose|ChooseString|Close|Color|ComboBox|Contains|ControlList|Count|Date|DateTime|Days|DDL|Default|DeleteAll|Delimiter|Deref|Destroy|Digit|Disable|Disabled|DropDownList|Edit|Eject|Else|Enable|Enabled|Error|Exist|Expand|ExStyle|FileSystem|Finally|First|Flash|Float|FloatFast|Focus|Font|for|global|Grid|Group|GroupBox|GuiClose|GuiContextMenu|GuiDropFiles|GuiEscape|GuiSize|Hdr|Hidden|Hide|High|HKCC|HKCR|HKCU|HKEY_CLASSES_ROOT|HKEY_CURRENT_CONFIG|HKEY_CURRENT_USER|HKEY_LOCAL_MACHINE|HKEY_USERS|HKLM|HKU|Hours|HScroll|Icon|IconSmall|ID|IDLast|If|IfEqual|IfExist|IfGreater|IfGreaterOrEqual|IfInString|IfLess|IfLessOrEqual|IfMsgBox|IfNotEqual|IfNotExist|IfNotInString|IfWinActive|IfWinExist|IfWinNotActive|IfWinNotExist|Ignore|ImageList|in|Integer|IntegerFast|Interrupt|is|italic|Join|Label|LastFound|LastFoundExist|Limit|Lines|List|ListBox|ListView|local|Lock|Logoff|Low|Lower|Lowercase|MainWindow|Margin|Maximize|MaximizeBox|MaxSize|Minimize|MinimizeBox|MinMax|MinSize|Minutes|MonthCal|Mouse|Move|Multi|NA|No|NoActivate|NoDefault|NoHide|NoIcon|NoMainWindow|norm|Normal|NoSort|NoSortHdr|NoStandard|Not|NoTab|NoTimers|Number|Off|Ok|On|OwnDialogs|Owner|Parse|Password|Picture|Pixel|Pos|Pow|Priority|ProcessName|Radio|Range|Read|ReadOnly|Realtime|Redraw|Region|REG_BINARY|REG_DWORD|REG_EXPAND_SZ|REG_MULTI_SZ|REG_SZ|Relative|Rename|Report|Resize|Restore|Retry|RGB|Screen|Seconds|Section|Serial|SetLabel|ShiftAltTab|Show|Single|Slider|SortDesc|Standard|static|Status|StatusBar|StatusCD|strike|Style|Submit|SysMenu|Tab2|TabStop|Text|Theme|Throw|Tile|ToggleCheck|ToggleEnable|ToolWindow|Top|Topmost|TransColor|Transparent|Tray|TreeView|Try|TryAgain|Type|UnCheck|underline|Unicode|Unlock|Until|UpDown|Upper|Uppercase|UseErrorLevel|Vis|VisFirst|Visible|VScroll|Wait|WaitClose|WantCtrlA|WantF2|WantReturn|While|Wrap|Xdigit|xm|xp|xs|Yes|ym|yp|ys)\b/i,function:/[^(); \t,\n+*\-=?>:\\\/<&%\[\]]+(?=\()/,punctuation:/[{}[\]():,]/}}se.displayName=`autoit`,se.aliases=[];function se(e){e.languages.autoit={comment:[/;.*/,{pattern:/(^[\t ]*)#(?:comments-start|cs)[\s\S]*?^[ \t]*#(?:ce|comments-end)/m,lookbehind:!0}],url:{pattern:/(^[\t ]*#include\s+)(?:<[^\r\n>]+>|"[^\r\n"]+")/m,lookbehind:!0},string:{pattern:/(["'])(?:\1\1|(?!\1)[^\r\n])*\1/,greedy:!0,inside:{variable:/([%$@])\w+\1/}},directive:{pattern:/(^[\t ]*)#[\w-]+/m,lookbehind:!0,alias:`keyword`},function:/\b\w+(?=\()/,variable:/[$@]\w+/,keyword:/\b(?:Case|Const|Continue(?:Case|Loop)|Default|Dim|Do|Else(?:If)?|End(?:Func|If|Select|Switch|With)|Enum|Exit(?:Loop)?|For|Func|Global|If|In|Local|Next|Null|ReDim|Select|Static|Step|Switch|Then|To|Until|Volatile|WEnd|While|With)\b/i,number:/\b(?:0x[\da-f]+|\d+(?:\.\d+)?(?:e[+-]?\d+)?)\b/i,boolean:/\b(?:False|True)\b/i,operator:/<[=>]?|[-+*\/=&>]=?|[?^]|\b(?:And|Not|Or)\b/i,punctuation:/[\[\]().,:]/}}ce.displayName=`avisynth`,ce.aliases=[`avs`];function ce(e){(function(e){function t(e,t){return e.replace(/<<(\d+)>>/g,function(e,n){return t[+n]})}function n(e,n,r){return RegExp(t(e,n),r||``)}var r=`bool|clip|float|int|string|val`,i=[[`is(?:bool|clip|float|int|string)|defined|(?:(?:internal)?function|var)?exists?`,`apply|assert|default|eval|import|nop|select|undefined`,`opt_(?:allowfloataudio|avipadscanlines|dwchannelmask|enable_(?:b64a|planartopackedrgb|v210|y3_10_10|y3_10_16)|usewaveextensible|vdubplanarhack)|set(?:cachemode|maxcpu|memorymax|planarlegacyalignment|workingdir)`,`hex(?:value)?|value`,`abs|ceil|continued(?:denominator|numerator)?|exp|floor|fmod|frac|log(?:10)?|max|min|muldiv|pi|pow|rand|round|sign|spline|sqrt`,`a?sinh?|a?cosh?|a?tan[2h]?`,`(?:bit(?:and|not|x?or|[lr]?shift[aslu]?|sh[lr]|sa[lr]|[lr]rotatel?|ro[rl]|te?st|set(?:count)?|cl(?:ea)?r|ch(?:an)?ge?))`,`average(?:[bgr]|chroma[uv]|luma)|(?:[rgb]|chroma[uv]|luma|rgb|[yuv](?=difference(?:fromprevious|tonext)))difference(?:fromprevious|tonext)?|[yuvrgb]plane(?:median|min|max|minmaxdifference)`,`getprocessinfo|logmsg|script(?:dir(?:utf8)?|file(?:utf8)?|name(?:utf8)?)|setlogparams`,`chr|(?:fill|find|left|mid|replace|rev|right)str|format|[lu]case|ord|str(?:cmpi?|fromutf8|len|toutf8)|time|trim(?:all|left|right)`,`isversionorgreater|version(?:number|string)`,`buildpixeltype|colorspacenametopixeltype`,`addautoloaddir|on(?:cpu|cuda)|prefetch|setfiltermtmode`].join(`|`),[`has(?:audio|video)`,`height|width`,`frame(?:count|rate)|framerate(?:denominator|numerator)`,`getparity|is(?:field|frame)based`,`bitspercomponent|componentsize|hasalpha|is(?:planar(?:rgba?)?|interleaved|rgb(?:24|32|48|64)?|y(?:8|u(?:va?|y2))?|yv(?:12|16|24|411)|420|422|444|packedrgb)|numcomponents|pixeltype`,`audio(?:bits|channels|duration|length(?:[fs]|hi|lo)?|rate)|isaudio(?:float|int)`].join(`|`),[`avi(?:file)?source|directshowsource|image(?:reader|source|sourceanim)|opendmlsource|segmented(?:avisource|directshowsource)|wavsource`,`coloryuv|convertbacktoyuy2|convertto(?:RGB(?:24|32|48|64)|(?:planar)?RGBA?|Y8?|YV(?:12|16|24|411)|YUVA?(?:411|420|422|444)|YUY2)|fixluminance|gr[ae]yscale|invert|levels|limiter|mergea?rgb|merge(?:chroma|luma)|rgbadjust|show(?:alpha|blue|green|red)|swapuv|tweak|[uv]toy8?|ytouv`,`(?:colorkey|reset)mask|layer|mask(?:hs)?|merge|overlay|subtract`,`addborders|(?:bicubic|bilinear|blackman|gauss|lanczos4|lanczos|point|sinc|spline(?:16|36|64))resize|crop(?:bottom)?|flip(?:horizontal|vertical)|(?:horizontal|vertical)?reduceby2|letterbox|skewrows|turn(?:180|left|right)`,`blur|fixbrokenchromaupsampling|generalconvolution|(?:spatial|temporal)soften|sharpen`,`trim|(?:un)?alignedsplice|(?:assume|assumescaled|change|convert)FPS|(?:delete|duplicate)frame|dissolve|fade(?:in|io|out)[02]?|freezeframe|interleave|loop|reverse|select(?:even|odd|(?:range)?every)`,`assume[bt]ff|assume(?:field|frame)based|bob|complementparity|doubleweave|peculiarblend|pulldown|separate(?:columns|fields|rows)|swapfields|weave(?:columns|rows)?`,`amplify(?:db)?|assumesamplerate|audiodub(?:ex)?|audiotrim|convertaudioto(?:(?:8|16|24|32)bit|float)|converttomono|delayaudio|ensurevbrmp3sync|get(?:left|right)?channel|kill(?:audio|video)|mergechannels|mixaudio|monotostereo|normalize|resampleaudio|ssrc|supereq|timestretch`,`animate|applyrange|conditional(?:filter|reader|select)|frameevaluate|scriptclip|tcp(?:server|source)|writefile(?:end|if|start)?`,`imagewriter`,`blackness|blankclip|colorbars(?:hd)?|compare|dumpfiltergraph|echo|histogram|info|messageclip|preroll|setgraphanalysis|show(?:framenumber|smpte|time)|showfiveversions|stack(?:horizontal|vertical)|subtitle|tone|version`].join(`|`)].join(`|`);e.languages.avisynth={comment:[{pattern:/(^|[^\\])\[\*(?:[^\[*]|\[(?!\*)|\*(?!\])|\[\*(?:[^\[*]|\[(?!\*)|\*(?!\]))*\*\])*\*\]/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\$])#.*/,lookbehind:!0,greedy:!0}],argument:{pattern:n(`\\b(?:<<0>>)\\s+("?)\\w+\\1`,[r],`i`),inside:{keyword:/^\w+/}},"argument-label":{pattern:/([,(][\s\\]*)\w+\s*=(?!=)/,lookbehind:!0,inside:{"argument-name":{pattern:/^\w+/,alias:`punctuation`},punctuation:/=$/}},string:[{pattern:/"""[\s\S]*?"""/,greedy:!0},{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0,inside:{constant:{pattern:/\b(?:DEFAULT_MT_MODE|(?:MAINSCRIPT|PROGRAM|SCRIPT)DIR|(?:MACHINE|USER)_(?:CLASSIC|PLUS)_PLUGINS)\b/}}}],variable:/\b(?:last)\b/i,boolean:/\b(?:false|no|true|yes)\b/i,keyword:/\b(?:catch|else|for|function|global|if|return|try|while|__END__)\b/i,constant:/\bMT_(?:MULTI_INSTANCE|NICE_FILTER|SERIALIZED|SPECIAL_MT)\b/,"builtin-function":{pattern:n(`\\b(?:<<0>>)\\b`,[i],`i`),alias:`function`},"type-cast":{pattern:n(`\\b(?:<<0>>)(?=\\s*\\()`,[r],`i`),alias:`keyword`},function:{pattern:/\b[a-z_]\w*(?=\s*\()|(\.)[a-z_]\w*\b/i,lookbehind:!0},"line-continuation":{pattern:/(^[ \t]*)\\|\\(?=[ \t]*$)/m,lookbehind:!0,alias:`punctuation`},number:/\B\$(?:[\da-f]{6}|[\da-f]{8})\b|(?:(?:\b|\B-)\d+(?:\.\d*)?\b|\B\.\d+\b)/i,operator:/\+\+?|[!=<>]=?|&&|\|\||[?:*/%-]/,punctuation:/[{}\[\]();,.]/},e.languages.avs=e.languages.avisynth})(e)}le.displayName=`avro-idl`,le.aliases=[`avdl`];function le(e){e.languages[`avro-idl`]={comment:{pattern:/\/\/.*|\/\*[\s\S]*?\*\//,greedy:!0},string:{pattern:/(^|[^\\])"(?:[^\r\n"\\]|\\.)*"/,lookbehind:!0,greedy:!0},annotation:{pattern:/@(?:[$\w.-]|`[^\r\n`]+`)+/,greedy:!0,alias:`function`},"function-identifier":{pattern:/`[^\r\n`]+`(?=\s*\()/,greedy:!0,alias:`function`},identifier:{pattern:/`[^\r\n`]+`/,greedy:!0},"class-name":{pattern:/(\b(?:enum|error|protocol|record|throws)\b\s+)[$\w]+/,lookbehind:!0,greedy:!0},keyword:/\b(?:array|boolean|bytes|date|decimal|double|enum|error|false|fixed|float|idl|import|int|local_timestamp_ms|long|map|null|oneway|protocol|record|schema|string|throws|time_ms|timestamp_ms|true|union|uuid|void)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:[{pattern:/(^|[^\w.])-?(?:(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|0x(?:[a-f0-9]+(?:\.[a-f0-9]*)?|\.[a-f0-9]+)(?:p[+-]?\d+)?)[dfl]?(?![\w.])/i,lookbehind:!0},/-?\b(?:Infinity|NaN)\b/],operator:/=/,punctuation:/[()\[\]{}<>.:,;-]/},e.languages.avdl=e.languages[`avro-idl`]}ue.displayName=`awk`,ue.aliases=[`gawk`];function ue(e){e.languages.awk={hashbang:{pattern:/^#!.*/,greedy:!0,alias:`comment`},comment:{pattern:/#.*/,greedy:!0},string:{pattern:/(^|[^\\])"(?:[^\\"\r\n]|\\.)*"/,lookbehind:!0,greedy:!0},regex:{pattern:/((?:^|[^\w\s)])\s*)\/(?:[^\/\\\r\n]|\\.)*\//,lookbehind:!0,greedy:!0},variable:/\$\w+/,keyword:/\b(?:BEGIN|BEGINFILE|END|ENDFILE|break|case|continue|default|delete|do|else|exit|for|function|getline|if|in|next|nextfile|printf?|return|switch|while)\b|@(?:include|load)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/\b(?:\d+(?:\.\d+)?(?:e[+-]?\d+)?|0x[a-fA-F0-9]+)\b/,operator:/--|\+\+|!?~|>&|>>|<<|(?:\*\*|[<>!=+\-*/%^])=?|&&|\|[|&]|[?:]/,punctuation:/[()[\]{},;]/},e.languages.gawk=e.languages.awk}de.displayName=`bash`,de.aliases=[`sh`,`shell`];function de(e){(function(e){var t=`\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b`,n={pattern:/(^(["']?)\w+\2)[ \t]+\S.*/,lookbehind:!0,alias:`punctuation`,inside:null},r={bash:n,environment:{pattern:RegExp(`\\$`+t),alias:`constant`},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--|\+\+|\*\*=?|<<=?|>>=?|&&|\|\||[=!+\-*/%<>^&|]=?|[?~:]/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp(`(\\{)`+t),lookbehind:!0,alias:`constant`}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|U[0-9a-fA-F]{8}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{1,2})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:`important`},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)[\w-]+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:`function`},{pattern:/\b[\w-]+(?=\s*\(\s*\)\s*\{)/,alias:`function`}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:`variable`,lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?:\.\w+)*(?=\+?=)/,inside:{environment:{pattern:RegExp(`(^|[\\s;|&]|[<>]\\()`+t),lookbehind:!0,alias:`constant`}},alias:`variable`,lookbehind:!0},parameter:{pattern:/(^|\s)-{1,2}(?:\w+:[+-]?)?\w+(?:\.\w+)*(?=[=\s]|$)/,alias:`variable`,lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+)\s[\s\S]*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:r},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s[\s\S]*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0,inside:{bash:n}},{pattern:/(^|[^\\](?:\\\\)*)"(?:\\[\s\S]|\$\([^)]+\)|\$(?!\()|`[^`]+`|[^"\\`$])*"/,lookbehind:!0,greedy:!0,inside:r},{pattern:/(^|[^$\\])'[^']*'/,lookbehind:!0,greedy:!0},{pattern:/\$'(?:[^'\\]|\\[\s\S])*'/,greedy:!0,inside:{entity:r.entity}}],environment:{pattern:RegExp(`\\$?`+t),alias:`constant`},variable:r.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|apt-cache|apt-get|aptitude|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cargo|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|composer|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|docker|docker-compose|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|java|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|node|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|podman|podman-compose|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|sysctl|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vcpkg|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:case|do|done|elif|else|esac|fi|for|function|if|in|select|then|until|while)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|alias|bind|break|builtin|caller|cd|command|continue|declare|echo|enable|eval|exec|exit|export|getopts|hash|help|let|local|logout|mapfile|printf|pwd|read|readarray|readonly|return|set|shift|shopt|source|test|times|trap|type|typeset|ulimit|umask|unalias|unset)(?=$|[)\s;|&])/,lookbehind:!0,alias:`class-name`},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:false|true)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:`important`},operator:{pattern:/\d?<>|>\||\+=|=[=~]?|!=?|<<[<-]?|[&\d]?>>|\d[<>]&?|[<>][&=]?|&[>&]?|\|[&|]?/,inside:{"file-descriptor":{pattern:/^\d/,alias:`important`}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}},n.inside=e.languages.bash;for(var i=[`comment`,`function-name`,`for-or-select`,`assign-left`,`parameter`,`string`,`environment`,`function`,`keyword`,`builtin`,`boolean`,`file-descriptor`,`operator`,`punctuation`,`number`],a=r.variable[1].inside,o=0;o?^\w +\-.])*"/,greedy:!0},number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,keyword:/\b(?:AS|BEEP|BLOAD|BSAVE|CALL(?: ABSOLUTE)?|CASE|CHAIN|CHDIR|CLEAR|CLOSE|CLS|COM|COMMON|CONST|DATA|DECLARE|DEF(?: FN| SEG|DBL|INT|LNG|SNG|STR)|DIM|DO|DOUBLE|ELSE|ELSEIF|END|ENVIRON|ERASE|ERROR|EXIT|FIELD|FILES|FOR|FUNCTION|GET|GOSUB|GOTO|IF|INPUT|INTEGER|IOCTL|KEY|KILL|LINE INPUT|LOCATE|LOCK|LONG|LOOP|LSET|MKDIR|NAME|NEXT|OFF|ON(?: COM| ERROR| KEY| TIMER)?|OPEN|OPTION BASE|OUT|POKE|PUT|READ|REDIM|REM|RESTORE|RESUME|RETURN|RMDIR|RSET|RUN|SELECT CASE|SHARED|SHELL|SINGLE|SLEEP|STATIC|STEP|STOP|STRING|SUB|SWAP|SYSTEM|THEN|TIMER|TO|TROFF|TRON|TYPE|UNLOCK|UNTIL|USING|VIEW PRINT|WAIT|WEND|WHILE|WRITE)(?:\$|\b)/i,function:/\b(?:ABS|ACCESS|ACOS|ANGLE|AREA|ARITHMETIC|ARRAY|ASIN|ASK|AT|ATN|BASE|BEGIN|BREAK|CAUSE|CEIL|CHR|CLIP|COLLATE|COLOR|CON|COS|COSH|COT|CSC|DATE|DATUM|DEBUG|DECIMAL|DEF|DEG|DEGREES|DELETE|DET|DEVICE|DISPLAY|DOT|ELAPSED|EPS|ERASABLE|EXLINE|EXP|EXTERNAL|EXTYPE|FILETYPE|FIXED|FP|GO|GRAPH|HANDLER|IDN|IMAGE|IN|INT|INTERNAL|IP|IS|KEYED|LBOUND|LCASE|LEFT|LEN|LENGTH|LET|LINE|LINES|LOG|LOG10|LOG2|LTRIM|MARGIN|MAT|MAX|MAXNUM|MID|MIN|MISSING|MOD|NATIVE|NUL|NUMERIC|OF|OPTION|ORD|ORGANIZATION|OUTIN|OUTPUT|PI|POINT|POINTER|POINTS|POS|PRINT|PROGRAM|PROMPT|RAD|RADIANS|RANDOMIZE|RECORD|RECSIZE|RECTYPE|RELATIVE|REMAINDER|REPEAT|REST|RETRY|REWRITE|RIGHT|RND|ROUND|RTRIM|SAME|SEC|SELECT|SEQUENTIAL|SET|SETTER|SGN|SIN|SINH|SIZE|SKIP|SQR|STANDARD|STATUS|STR|STREAM|STYLE|TAB|TAN|TANH|TEMPLATE|TEXT|THERE|TIME|TIMEOUT|TRACE|TRANSFORM|TRUNCATE|UBOUND|UCASE|USE|VAL|VARIABLE|VIEWPORT|WHEN|WINDOW|WITH|ZER|ZONEWIDTH)(?:\$|\b)/i,operator:/<[=>]?|>=?|[+\-*\/^=&]|\b(?:AND|EQV|IMP|NOT|OR|XOR)\b/i,punctuation:/[,;:()]/}}pe.displayName=`batch`,pe.aliases=[];function pe(e){(function(e){var t=/%%?[~:\w]+%?|!\S+!/,n={pattern:/\/[a-z?]+(?=[ :]|$):?|-[a-z]\b|--[a-z-]+\b/im,alias:`attr-name`,inside:{punctuation:/:/}},r=/"(?:[\\"]"|[^"])*"(?!")/,i=/(?:\b|-)\d+\b/;e.languages.batch={comment:[/^::.*/m,{pattern:/((?:^|[&(])[ \t]*)rem\b(?:[^^&)\r\n]|\^(?:\r\n|[\s\S]))*/im,lookbehind:!0}],label:{pattern:/^:.*/m,alias:`property`},command:[{pattern:/((?:^|[&(])[ \t]*)for(?: \/[a-z?](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* \S+ in \([^)]+\) do/im,lookbehind:!0,inside:{keyword:/\b(?:do|in)\b|^for\b/i,string:r,parameter:n,variable:t,number:i,punctuation:/[()',]/}},{pattern:/((?:^|[&(])[ \t]*)if(?: \/[a-z?](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* (?:not )?(?:cmdextversion \d+|defined \w+|errorlevel \d+|exist \S+|(?:"[^"]*"|(?!")(?:(?!==)\S)+)?(?:==| (?:equ|geq|gtr|leq|lss|neq) )(?:"[^"]*"|[^\s"]\S*))/im,lookbehind:!0,inside:{keyword:/\b(?:cmdextversion|defined|errorlevel|exist|not)\b|^if\b/i,string:r,parameter:n,variable:t,number:i,operator:/\^|==|\b(?:equ|geq|gtr|leq|lss|neq)\b/i}},{pattern:/((?:^|[&()])[ \t]*)else\b/im,lookbehind:!0,inside:{keyword:/^else\b/i}},{pattern:/((?:^|[&(])[ \t]*)set(?: \/[a-z](?:[ :](?:"[^"]*"|[^\s"/]\S*))?)* (?:[^^&)\r\n]|\^(?:\r\n|[\s\S]))*/im,lookbehind:!0,inside:{keyword:/^set\b/i,string:r,parameter:n,variable:[t,/\w+(?=(?:[*\/%+\-&^|]|<<|>>)?=)/],number:i,operator:/[*\/%+\-&^|]=?|<<=?|>>=?|[!~_=]/,punctuation:/[()',]/}},{pattern:/((?:^|[&(])[ \t]*@?)\w+\b(?:"(?:[\\"]"|[^"])*"(?!")|[^"^&)\r\n]|\^(?:\r\n|[\s\S]))*/m,lookbehind:!0,inside:{keyword:/^\w+\b/,string:r,parameter:n,label:{pattern:/(^\s*):\S+/m,lookbehind:!0,alias:`property`},variable:t,number:i,operator:/\^/}}],operator:/[&@]/,punctuation:/[()']/}})(e)}me.displayName=`bbcode`,me.aliases=[`shortcode`];function me(e){e.languages.bbcode={tag:{pattern:/\[\/?[^\s=\]]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+))?(?:\s+[^\s=\]]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+))*\s*\]/,inside:{tag:{pattern:/^\[\/?[^\s=\]]+/,inside:{punctuation:/^\[\/?/}},"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'"\]=]+)/,inside:{punctuation:[/^=/,{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\]/,"attr-name":/[^\s=\]]+/}}},e.languages.shortcode=e.languages.bbcode}he.displayName=`bbj`,he.aliases=[];function he(e){(function(e){e.languages.bbj={comment:{pattern:/(^|[^\\:])rem\s+.*/i,lookbehind:!0,greedy:!0},string:{pattern:/(['"])(?:(?!\1|\\).|\\.)*\1/,greedy:!0},number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,keyword:/\b(?:abstract|all|argc|begin|bye|callback|case|chn|class|classend|ctl|day|declare|delete|dim|dom|dread|dsz|else|end|endif|err|exitto|extends|fi|field|for|from|gosub|goto|if|implements|interface|interfaceend|iol|iolist|let|list|load|method|methodend|methodret|on|opts|pfx|print|private|process_events|protected|psz|public|read|read_resource|release|remove_callback|repeat|restore|return|rev|seterr|setesc|sqlchn|sqlunt|ssn|start|static|swend|switch|sys|then|tim|unt|until|use|void|wend|where|while)\b/i,function:/\b\w+(?=\()/,boolean:/\b(?:BBjAPI\.TRUE|BBjAPI\.FALSE)\b/i,operator:/<[=>]?|>=?|[+\-*\/^=&]|\b(?:and|not|or|xor)\b/i,punctuation:/[.,;:()]/}})(e)}ge.displayName=`bicep`,ge.aliases=[];function ge(e){e.languages.bicep={comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],property:[{pattern:/([\r\n][ \t]*)[a-z_]\w*(?=[ \t]*:)/i,lookbehind:!0},{pattern:/([\r\n][ \t]*)'(?:\\.|\$(?!\{)|[^'\\\r\n$])*'(?=[ \t]*:)/,lookbehind:!0,greedy:!0}],string:[{pattern:/'''[^'][\s\S]*?'''/,greedy:!0},{pattern:/(^|[^\\'])'(?:\\.|\$(?!\{)|[^'\\\r\n$])*'/,lookbehind:!0,greedy:!0}],"interpolated-string":{pattern:/(^|[^\\'])'(?:\\.|\$(?:(?!\{)|\{[^{}\r\n]*\})|[^'\\\r\n$])*'/,lookbehind:!0,greedy:!0,inside:{interpolation:{pattern:/\$\{[^{}\r\n]*\}/,inside:{expression:{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0},punctuation:/^\$\{|\}$/}},string:/[\s\S]+/}},datatype:{pattern:/(\b(?:output|param)\b[ \t]+\w+[ \t]+)\w+\b/,lookbehind:!0,alias:`class-name`},boolean:/\b(?:false|true)\b/,keyword:/\b(?:existing|for|if|in|module|null|output|param|resource|targetScope|var)\b/,decorator:/@\w+\b/,function:/\b[a-z_]\w*(?=[ \t]*\()/i,number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:E[+-]?\d+)?/i,operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/,punctuation:/[{}[\];(),.:]/},e.languages.bicep[`interpolated-string`].inside.interpolation.inside.expression.inside=e.languages.bicep}_e.displayName=`birb`,_e.aliases=[];function _e(e){e.register(S),e.languages.birb=e.languages.extend(`clike`,{string:{pattern:/r?("|')(?:\\.|(?!\1)[^\\])*\1/,greedy:!0},"class-name":[/\b[A-Z](?:[\d_]*[a-zA-Z]\w*)?\b/,/\b(?:[A-Z]\w*|(?!(?:var|void)\b)[a-z]\w*)(?=\s+\w+\s*[;,=()])/],keyword:/\b(?:assert|break|case|class|const|default|else|enum|final|follows|for|grab|if|nest|new|next|noSeeb|return|static|switch|throw|var|void|while)\b/,operator:/\+\+|--|&&|\|\||<<=?|>>=?|~(?:\/=?)?|[+\-*\/%&^|=!<>]=?|\?|:/,variable:/\b[a-z_]\w*\b/}),e.languages.insertBefore(`birb`,`function`,{metadata:{pattern:/<\w+>/,greedy:!0,alias:`symbol`}})}ve.displayName=`bison`,ve.aliases=[];function ve(e){e.register(F),e.languages.bison=e.languages.extend(`c`,{}),e.languages.insertBefore(`bison`,`comment`,{bison:{pattern:/^(?:[^%]|%(?!%))*%%[\s\S]*?%%/,inside:{c:{pattern:/%\{[\s\S]*?%\}|\{(?:\{[^}]*\}|[^{}])*\}/,inside:{delimiter:{pattern:/^%?\{|%?\}$/,alias:`punctuation`},"bison-variable":{pattern:/[$@](?:<[^\s>]+>)?[\w$]+/,alias:`variable`,inside:{punctuation:/<|>/}},rest:e.languages.c}},comment:e.languages.c.comment,string:e.languages.c.string,property:/\S+(?=:)/,keyword:/%\w+/,number:{pattern:/(^|[^@])\b(?:0x[\da-f]+|\d+)/i,lookbehind:!0},punctuation:/%[%?]|[|:;\[\]<>]/}}})}ye.displayName=`bnf`,ye.aliases=[`rbnf`];function ye(e){e.languages.bnf={string:{pattern:/"[^\r\n"]*"|'[^\r\n']*'/},definition:{pattern:/<[^<>\r\n\t]+>(?=\s*::=)/,alias:[`rule`,`keyword`],inside:{punctuation:/^<|>$/}},rule:{pattern:/<[^<>\r\n\t]+>/,inside:{punctuation:/^<|>$/}},operator:/::=|[|()[\]{}*+?]|\.{3}/},e.languages.rbnf=e.languages.bnf}be.displayName=`bqn`,be.aliases=[];function be(e){e.languages.bqn={shebang:{pattern:/^#![ \t]*\/.*/,alias:`important`,greedy:!0},comment:{pattern:/#.*/,greedy:!0},"string-literal":{pattern:/"(?:[^"]|"")*"/,greedy:!0,alias:`string`},"character-literal":{pattern:/'(?:[\s\S]|[\uD800-\uDBFF][\uDC00-\uDFFF])'/,greedy:!0,alias:`char`},function:/•[\w¯.∞π]+[\w¯.∞π]*/,"dot-notation-on-brackets":{pattern:/\{(?=.*\}\.)|\}\./,alias:`namespace`},"special-name":{pattern:/(?:𝕨|𝕩|𝕗|𝕘|𝕤|𝕣|𝕎|𝕏|𝔽|𝔾|𝕊|_𝕣_|_𝕣)/,alias:`keyword`},"dot-notation-on-name":{pattern:/[A-Za-z_][\w¯∞π]*\./,alias:`namespace`},"word-number-scientific":{pattern:/\d+(?:\.\d+)?[eE]¯?\d+/,alias:`number`},"word-name":{pattern:/[A-Za-z_][\w¯∞π]*/,alias:`symbol`},"word-number":{pattern:/[¯∞π]?(?:\d*\.?\b\d+(?:e[+¯]?\d+|E[+¯]?\d+)?|¯|∞|π)(?:j¯?(?:(?:\d+(?:\.\d+)?|\.\d+)(?:e[+¯]?\d+|E[+¯]?\d+)?|¯|∞|π))?/,alias:`number`},"null-literal":{pattern:/@/,alias:`char`},"primitive-functions":{pattern:/[-+×÷⋆√⌊⌈|¬∧∨<>≠=≤≥≡≢⊣⊢⥊∾≍⋈↑↓↕«»⌽⍉/⍋⍒⊏⊑⊐⊒∊⍷⊔!]/,alias:`operator`},"primitive-1-operators":{pattern:/[`˜˘¨⁼⌜´˝˙]/,alias:`operator`},"primitive-2-operators":{pattern:/[∘⊸⟜○⌾⎉⚇⍟⊘◶⎊]/,alias:`operator`},punctuation:/[←⇐↩(){}⟨⟩[\]‿·⋄,.;:?]/}}xe.displayName=`brainfuck`,xe.aliases=[];function xe(e){e.languages.brainfuck={pointer:{pattern:/<|>/,alias:`keyword`},increment:{pattern:/\+/,alias:`inserted`},decrement:{pattern:/-/,alias:`deleted`},branching:{pattern:/\[|\]/,alias:`important`},operator:/[.,]/,comment:/\S+/}}Se.displayName=`brightscript`,Se.aliases=[];function Se(e){e.languages.brightscript={comment:/(?:\brem|').*/i,"directive-statement":{pattern:/(^[\t ]*)#(?:const|else(?:[\t ]+if)?|end[\t ]+if|error|if).*/im,lookbehind:!0,alias:`property`,inside:{"error-message":{pattern:/(^#error).+/,lookbehind:!0},directive:{pattern:/^#(?:const|else(?:[\t ]+if)?|end[\t ]+if|error|if)/,alias:`keyword`},expression:{pattern:/[\s\S]+/,inside:null}}},property:{pattern:/([\r\n{,][\t ]*)(?:(?!\d)\w+|"(?:[^"\r\n]|"")*"(?!"))(?=[ \t]*:)/,lookbehind:!0,greedy:!0},string:{pattern:/"(?:[^"\r\n]|"")*"(?!")/,greedy:!0},"class-name":{pattern:/(\bAs[\t ]+)\w+/i,lookbehind:!0},keyword:/\b(?:As|Dim|Each|Else|Elseif|End|Exit|For|Function|Goto|If|In|Print|Return|Step|Stop|Sub|Then|To|While)\b/i,boolean:/\b(?:false|true)\b/i,function:/\b(?!\d)\w+(?=[\t ]*\()/,number:/(?:\b\d+(?:\.\d+)?(?:[ed][+-]\d+)?|&h[a-f\d]+)\b[%&!#]?/i,operator:/--|\+\+|>>=?|<<=?|<>|[-+*/\\<>]=?|[:^=?]|\b(?:and|mod|not|or)\b/i,punctuation:/[.,;()[\]{}]/,constant:/\b(?:LINE_NUM)\b/i},e.languages.brightscript[`directive-statement`].inside.expression.inside=e.languages.brightscript}Ce.displayName=`bro`,Ce.aliases=[];function Ce(e){e.languages.bro={comment:{pattern:/(^|[^\\$])#.*/,lookbehind:!0,inside:{italic:/\b(?:FIXME|TODO|XXX)\b/}},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},boolean:/\b[TF]\b/,function:{pattern:/(\b(?:event|function|hook)[ \t]+)\w+(?:::\w+)?/,lookbehind:!0},builtin:/(?:@(?:load(?:-(?:plugin|sigs))?|unload|prefixes|ifn?def|else|(?:end)?if|DIR|FILENAME))|(?:&?(?:add_func|create_expire|default|delete_func|encrypt|error_handler|expire_func|group|log|mergeable|optional|persistent|priority|raw_output|read_expire|redef|rotate_interval|rotate_size|synchronized|type_column|write_expire))/,constant:{pattern:/(\bconst[ \t]+)\w+/i,lookbehind:!0},keyword:/\b(?:add|addr|alarm|any|bool|break|const|continue|count|delete|double|else|enum|event|export|file|for|function|global|hook|if|in|int|interval|local|module|next|of|opaque|pattern|port|print|record|return|schedule|set|string|subnet|table|time|timeout|using|vector|when)\b/,operator:/--?|\+\+?|!=?=?|<=?|>=?|==?=?|&&|\|\|?|\?|\*|\/|~|\^|%/,number:/\b0x[\da-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?/i,punctuation:/[{}[\];(),.:]/}}we.displayName=`bsl`,we.aliases=[`oscript`];function we(e){e.languages.bsl={comment:/\/\/.*/,string:[{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},{pattern:/'(?:[^'\r\n\\]|\\.)*'/}],keyword:[{pattern:/(^|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:пока|для|новый|прервать|попытка|исключение|вызватьисключение|иначе|конецпопытки|неопределено|функция|перем|возврат|конецфункции|если|иначеесли|процедура|конецпроцедуры|тогда|знач|экспорт|конецесли|из|каждого|истина|ложь|по|цикл|конеццикла|выполнить)(?![\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])/i,lookbehind:!0},{pattern:/\b(?:break|do|each|else|elseif|enddo|endfunction|endif|endprocedure|endtry|except|execute|export|false|for|function|if|in|new|null|procedure|raise|return|then|to|true|try|undefined|val|var|while)\b/i}],number:{pattern:/(^(?=\d)|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:\d+(?:\.\d*)?|\.\d+)(?:E[+-]?\d+)?/i,lookbehind:!0},operator:[/[<>+\-*/]=?|[%=]/,{pattern:/(^|[^\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])(?:и|или|не)(?![\w\u0400-\u0484\u0487-\u052f\u1d2b\u1d78\u2de0-\u2dff\ua640-\ua69f\ufe2e\ufe2f])/i,lookbehind:!0},{pattern:/\b(?:and|not|or)\b/i}],punctuation:/\(\.|\.\)|[()\[\]:;,.]/,directive:[{pattern:/^([ \t]*)&.*/m,lookbehind:!0,greedy:!0,alias:`important`},{pattern:/^([ \t]*)#.*/gm,lookbehind:!0,greedy:!0,alias:`important`}]},e.languages.oscript=e.languages.bsl}Te.displayName=`cfscript`,Te.aliases=[`cfc`];function Te(e){e.register(S),e.languages.cfscript=e.languages.extend(`clike`,{comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,inside:{annotation:{pattern:/(?:^|[^.])@[\w\.]+/,alias:`punctuation`}}},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],keyword:/\b(?:abstract|break|catch|component|continue|default|do|else|extends|final|finally|for|function|if|in|include|package|private|property|public|remote|required|rethrow|return|static|switch|throw|try|var|while|xml)\b(?!\s*=)/,operator:[/\+\+|--|&&|\|\||::|=>|[!=]==|[-+*/%&|^!=<>]=?|\?(?:\.|:)?|:/,/\b(?:and|contains|eq|equal|eqv|gt|gte|imp|is|lt|lte|mod|not|or|xor)\b/],scope:{pattern:/\b(?:application|arguments|cgi|client|cookie|local|session|super|this|variables)\b/,alias:`global`},type:{pattern:/\b(?:any|array|binary|boolean|date|guid|numeric|query|string|struct|uuid|void|xml)\b/,alias:`builtin`}}),e.languages.insertBefore(`cfscript`,`keyword`,{"function-variable":{pattern:/[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:`function`}}),delete e.languages.cfscript[`class-name`],e.languages.cfc=e.languages.cfscript}Ee.displayName=`chaiscript`,Ee.aliases=[];function Ee(e){e.register(S),e.register(I),e.languages.chaiscript=e.languages.extend(`clike`,{string:{pattern:/(^|[^\\])'(?:[^'\\]|\\[\s\S])*'/,lookbehind:!0,greedy:!0},"class-name":[{pattern:/(\bclass\s+)\w+/,lookbehind:!0},{pattern:/(\b(?:attr|def)\s+)\w+(?=\s*::)/,lookbehind:!0}],keyword:/\b(?:attr|auto|break|case|catch|class|continue|def|default|else|finally|for|fun|global|if|return|switch|this|try|var|while)\b/,number:[e.languages.cpp.number,/\b(?:Infinity|NaN)\b/],operator:/>>=?|<<=?|\|\||&&|:[:=]?|--|\+\+|[=!<>+\-*/%|&^]=?|[?~]|`[^`\r\n]{1,4}`/}),e.languages.insertBefore(`chaiscript`,`operator`,{"parameter-type":{pattern:/([,(]\s*)\w+(?=\s+\w)/,lookbehind:!0,alias:`class-name`}}),e.languages.insertBefore(`chaiscript`,`string`,{"string-interpolation":{pattern:/(^|[^\\])"(?:[^"$\\]|\\[\s\S]|\$(?!\{)|\$\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\})*"/,lookbehind:!0,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\}/,lookbehind:!0,inside:{"interpolation-expression":{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0,inside:e.languages.chaiscript},"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`}}},string:/[\s\S]+/}}})}De.displayName=`cil`,De.aliases=[];function De(e){e.languages.cil={comment:/\/\/.*/,string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},directive:{pattern:/(^|\W)\.[a-z]+(?=\s)/,lookbehind:!0,alias:`class-name`},variable:/\[[\w\.]+\]/,keyword:/\b(?:abstract|ansi|assembly|auto|autochar|beforefieldinit|bool|bstr|byvalstr|catch|char|cil|class|currency|date|decimal|default|enum|error|explicit|extends|extern|famandassem|family|famorassem|final(?:ly)?|float32|float64|hidebysig|u?int(?:8|16|32|64)?|iant|idispatch|implements|import|initonly|instance|interface|iunknown|literal|lpstr|lpstruct|lptstr|lpwstr|managed|method|native(?:Type)?|nested|newslot|object(?:ref)?|pinvokeimpl|private|privatescope|public|reqsecobj|rtspecialname|runtime|sealed|sequential|serializable|specialname|static|string|struct|syschar|tbstr|unicode|unmanagedexp|unsigned|value(?:type)?|variant|virtual|void)\b/,function:/\b(?:(?:constrained|no|readonly|tail|unaligned|volatile)\.)?(?:conv\.(?:[iu][1248]?|ovf\.[iu][1248]?(?:\.un)?|r\.un|r4|r8)|ldc\.(?:i4(?:\.\d+|\.[mM]1|\.s)?|i8|r4|r8)|ldelem(?:\.[iu][1248]?|\.r[48]|\.ref|a)?|ldind\.(?:[iu][1248]?|r[48]|ref)|stelem\.?(?:i[1248]?|r[48]|ref)?|stind\.(?:i[1248]?|r[48]|ref)?|end(?:fault|filter|finally)|ldarg(?:\.[0-3s]|a(?:\.s)?)?|ldloc(?:\.\d+|\.s)?|sub(?:\.ovf(?:\.un)?)?|mul(?:\.ovf(?:\.un)?)?|add(?:\.ovf(?:\.un)?)?|stloc(?:\.[0-3s])?|refany(?:type|val)|blt(?:\.un)?(?:\.s)?|ble(?:\.un)?(?:\.s)?|bgt(?:\.un)?(?:\.s)?|bge(?:\.un)?(?:\.s)?|unbox(?:\.any)?|init(?:blk|obj)|call(?:i|virt)?|brfalse(?:\.s)?|bne\.un(?:\.s)?|ldloca(?:\.s)?|brzero(?:\.s)?|brtrue(?:\.s)?|brnull(?:\.s)?|brinst(?:\.s)?|starg(?:\.s)?|leave(?:\.s)?|shr(?:\.un)?|rem(?:\.un)?|div(?:\.un)?|clt(?:\.un)?|alignment|castclass|ldvirtftn|beq(?:\.s)?|ckfinite|ldsflda|ldtoken|localloc|mkrefany|rethrow|cgt\.un|arglist|switch|stsfld|sizeof|newobj|newarr|ldsfld|ldnull|ldflda|isinst|throw|stobj|stfld|ldstr|ldobj|ldlen|ldftn|ldfld|cpobj|cpblk|break|br\.s|xor|shl|ret|pop|not|nop|neg|jmp|dup|cgt|ceq|box|and|or|br)\b/,boolean:/\b(?:false|true)\b/,number:/\b-?(?:0x[0-9a-f]+|\d+)(?:\.[0-9a-f]+)?\b/i,punctuation:/[{}[\];(),:=]|IL_[0-9A-Za-z]+/}}Oe.displayName=`cilkc`,Oe.aliases=[`cilk-c`];function Oe(e){e.register(F),e.languages.cilkc=e.languages.insertBefore(`c`,`function`,{"parallel-keyword":{pattern:/\bcilk_(?:for|reducer|s(?:cope|pawn|ync))\b/,alias:`keyword`}}),e.languages[`cilk-c`]=e.languages.cilkc}ke.displayName=`cilkcpp`,ke.aliases=[`cilk`,`cilk-cpp`];function ke(e){e.register(I),e.languages.cilkcpp=e.languages.insertBefore(`cpp`,`function`,{"parallel-keyword":{pattern:/\bcilk_(?:for|reducer|s(?:cope|pawn|ync))\b/,alias:`keyword`}}),e.languages[`cilk-cpp`]=e.languages.cilkcpp,e.languages.cilk=e.languages.cilkcpp}Ae.displayName=`clojure`,Ae.aliases=[];function Ae(e){e.languages.clojure={comment:{pattern:/;.*/,greedy:!0},string:{pattern:/"(?:[^"\\]|\\.)*"/,greedy:!0},char:/\\\w+/,symbol:{pattern:/(^|[\s()\[\]{},])::?[\w*+!?'<>=/.-]+/,lookbehind:!0},keyword:{pattern:/(\()(?:-|->|->>|\.|\.\.|\*|\/|\+|<|<=|=|==|>|>=|accessor|agent|agent-errors|aget|alength|all-ns|alter|and|append-child|apply|array-map|aset|aset-boolean|aset-byte|aset-char|aset-double|aset-float|aset-int|aset-long|aset-short|assert|assoc|await|await-for|bean|binding|bit-and|bit-not|bit-or|bit-shift-left|bit-shift-right|bit-xor|boolean|branch\?|butlast|byte|cast|char|children|class|clear-agent-errors|comment|commute|comp|comparator|complement|concat|cond|conj|cons|constantly|construct-proxy|contains\?|count|create-ns|create-struct|cycle|dec|declare|def|def-|definline|definterface|defmacro|defmethod|defmulti|defn|defn-|defonce|defproject|defprotocol|defrecord|defstruct|deftype|deref|difference|disj|dissoc|distinct|do|doall|doc|dorun|doseq|dosync|dotimes|doto|double|down|drop|drop-while|edit|end\?|ensure|eval|every\?|false\?|ffirst|file-seq|filter|find|find-doc|find-ns|find-var|first|float|flush|fn|fnseq|for|frest|gensym|get|get-proxy-class|hash-map|hash-set|identical\?|identity|if|if-let|if-not|import|in-ns|inc|index|insert-child|insert-left|insert-right|inspect-table|inspect-tree|instance\?|int|interleave|intersection|into|into-array|iterate|join|key|keys|keyword|keyword\?|last|lazy-cat|lazy-cons|left|lefts|let|line-seq|list|list\*|load|load-file|locking|long|loop|macroexpand|macroexpand-1|make-array|make-node|map|map-invert|map\?|mapcat|max|max-key|memfn|merge|merge-with|meta|min|min-key|monitor-enter|name|namespace|neg\?|new|newline|next|nil\?|node|not|not-any\?|not-every\?|not=|ns|ns-imports|ns-interns|ns-map|ns-name|ns-publics|ns-refers|ns-resolve|ns-unmap|nth|nthrest|or|parse|partial|path|peek|pop|pos\?|pr|pr-str|print|print-str|println|println-str|prn|prn-str|project|proxy|proxy-mappings|quot|quote|rand|rand-int|range|re-find|re-groups|re-matcher|re-matches|re-pattern|re-seq|read|read-line|recur|reduce|ref|ref-set|refer|rem|remove|remove-method|remove-ns|rename|rename-keys|repeat|replace|replicate|resolve|rest|resultset-seq|reverse|rfirst|right|rights|root|rrest|rseq|second|select|select-keys|send|send-off|seq|seq-zip|seq\?|set|set!|short|slurp|some|sort|sort-by|sorted-map|sorted-map-by|sorted-set|special-symbol\?|split-at|split-with|str|string\?|struct|struct-map|subs|subvec|symbol|symbol\?|sync|take|take-nth|take-while|test|throw|time|to-array|to-array-2d|tree-seq|true\?|try|union|up|update-proxy|val|vals|var|var-get|var-set|var\?|vector|vector-zip|vector\?|when|when-first|when-let|when-not|with-local-vars|with-meta|with-open|with-out-str|xml-seq|xml-zip|zero\?|zipmap|zipper)(?=[\s)]|$)/,lookbehind:!0},boolean:/\b(?:false|nil|true)\b/,number:{pattern:/(^|[^\w$@])(?:\d+(?:[/.]\d+)?(?:e[+-]?\d+)?|0x[a-f0-9]+|[1-9]\d?r[a-z0-9]+)[lmn]?(?![\w$@])/i,lookbehind:!0},function:{pattern:/((?:^|[^'])\()[\w*+!?'<>=/.-]+(?=[\s)]|$)/,lookbehind:!0},operator:/[#@^`~]/,punctuation:/[{}\[\](),]/}}je.displayName=`cmake`,je.aliases=[];function je(e){e.languages.cmake={comment:/#.*/,string:{pattern:/"(?:[^\\"]|\\.)*"/,greedy:!0,inside:{interpolation:{pattern:/\$\{(?:[^{}$]|\$\{[^{}$]*\})*\}/,inside:{punctuation:/\$\{|\}/,variable:/\w+/}}}},variable:/\b(?:CMAKE_\w+|\w+_(?:(?:BINARY|SOURCE)_DIR|DESCRIPTION|HOMEPAGE_URL|ROOT|VERSION(?:_MAJOR|_MINOR|_PATCH|_TWEAK)?)|(?:ANDROID|APPLE|BORLAND|BUILD_SHARED_LIBS|CACHE|CPACK_(?:ABSOLUTE_DESTINATION_FILES|COMPONENT_INCLUDE_TOPLEVEL_DIRECTORY|ERROR_ON_ABSOLUTE_INSTALL_DESTINATION|INCLUDE_TOPLEVEL_DIRECTORY|INSTALL_DEFAULT_DIRECTORY_PERMISSIONS|INSTALL_SCRIPT|PACKAGING_INSTALL_PREFIX|SET_DESTDIR|WARN_ON_ABSOLUTE_INSTALL_DESTINATION)|CTEST_(?:BINARY_DIRECTORY|BUILD_COMMAND|BUILD_NAME|BZR_COMMAND|BZR_UPDATE_OPTIONS|CHANGE_ID|CHECKOUT_COMMAND|CONFIGURATION_TYPE|CONFIGURE_COMMAND|COVERAGE_COMMAND|COVERAGE_EXTRA_FLAGS|CURL_OPTIONS|CUSTOM_(?:COVERAGE_EXCLUDE|ERROR_EXCEPTION|ERROR_MATCH|ERROR_POST_CONTEXT|ERROR_PRE_CONTEXT|MAXIMUM_FAILED_TEST_OUTPUT_SIZE|MAXIMUM_NUMBER_OF_(?:ERRORS|WARNINGS)|MAXIMUM_PASSED_TEST_OUTPUT_SIZE|MEMCHECK_IGNORE|POST_MEMCHECK|POST_TEST|PRE_MEMCHECK|PRE_TEST|TESTS_IGNORE|WARNING_EXCEPTION|WARNING_MATCH)|CVS_CHECKOUT|CVS_COMMAND|CVS_UPDATE_OPTIONS|DROP_LOCATION|DROP_METHOD|DROP_SITE|DROP_SITE_CDASH|DROP_SITE_PASSWORD|DROP_SITE_USER|EXTRA_COVERAGE_GLOB|GIT_COMMAND|GIT_INIT_SUBMODULES|GIT_UPDATE_CUSTOM|GIT_UPDATE_OPTIONS|HG_COMMAND|HG_UPDATE_OPTIONS|LABELS_FOR_SUBPROJECTS|MEMORYCHECK_(?:COMMAND|COMMAND_OPTIONS|SANITIZER_OPTIONS|SUPPRESSIONS_FILE|TYPE)|NIGHTLY_START_TIME|P4_CLIENT|P4_COMMAND|P4_OPTIONS|P4_UPDATE_OPTIONS|RUN_CURRENT_SCRIPT|SCP_COMMAND|SITE|SOURCE_DIRECTORY|SUBMIT_URL|SVN_COMMAND|SVN_OPTIONS|SVN_UPDATE_OPTIONS|TEST_LOAD|TEST_TIMEOUT|TRIGGER_SITE|UPDATE_COMMAND|UPDATE_OPTIONS|UPDATE_VERSION_ONLY|USE_LAUNCHERS)|CYGWIN|ENV|EXECUTABLE_OUTPUT_PATH|GHS-MULTI|IOS|LIBRARY_OUTPUT_PATH|MINGW|MSVC(?:10|11|12|14|60|70|71|80|90|_IDE|_TOOLSET_VERSION|_VERSION)?|MSYS|PROJECT_NAME|UNIX|WIN32|WINCE|WINDOWS_PHONE|WINDOWS_STORE|XCODE))\b/,property:/\b(?:cxx_\w+|(?:ARCHIVE_OUTPUT_(?:DIRECTORY|NAME)|COMPILE_DEFINITIONS|COMPILE_PDB_NAME|COMPILE_PDB_OUTPUT_DIRECTORY|EXCLUDE_FROM_DEFAULT_BUILD|IMPORTED_(?:IMPLIB|LIBNAME|LINK_DEPENDENT_LIBRARIES|LINK_INTERFACE_LANGUAGES|LINK_INTERFACE_LIBRARIES|LINK_INTERFACE_MULTIPLICITY|LOCATION|NO_SONAME|OBJECTS|SONAME)|INTERPROCEDURAL_OPTIMIZATION|LIBRARY_OUTPUT_DIRECTORY|LIBRARY_OUTPUT_NAME|LINK_FLAGS|LINK_INTERFACE_LIBRARIES|LINK_INTERFACE_MULTIPLICITY|LOCATION|MAP_IMPORTED_CONFIG|OSX_ARCHITECTURES|OUTPUT_NAME|PDB_NAME|PDB_OUTPUT_DIRECTORY|RUNTIME_OUTPUT_DIRECTORY|RUNTIME_OUTPUT_NAME|STATIC_LIBRARY_FLAGS|VS_CSHARP|VS_DOTNET_REFERENCEPROP|VS_DOTNET_REFERENCE|VS_GLOBAL_SECTION_POST|VS_GLOBAL_SECTION_PRE|VS_GLOBAL|XCODE_ATTRIBUTE)_\w+|\w+_(?:CLANG_TIDY|COMPILER_LAUNCHER|CPPCHECK|CPPLINT|INCLUDE_WHAT_YOU_USE|OUTPUT_NAME|POSTFIX|VISIBILITY_PRESET)|ABSTRACT|ADDITIONAL_MAKE_CLEAN_FILES|ADVANCED|ALIASED_TARGET|ALLOW_DUPLICATE_CUSTOM_TARGETS|ANDROID_(?:ANT_ADDITIONAL_OPTIONS|API|API_MIN|ARCH|ASSETS_DIRECTORIES|GUI|JAR_DEPENDENCIES|NATIVE_LIB_DEPENDENCIES|NATIVE_LIB_DIRECTORIES|PROCESS_MAX|PROGUARD|PROGUARD_CONFIG_PATH|SECURE_PROPS_PATH|SKIP_ANT_STEP|STL_TYPE)|ARCHIVE_OUTPUT_DIRECTORY|ATTACHED_FILES|ATTACHED_FILES_ON_FAIL|AUTOGEN_(?:BUILD_DIR|ORIGIN_DEPENDS|PARALLEL|SOURCE_GROUP|TARGETS_FOLDER|TARGET_DEPENDS)|AUTOMOC|AUTOMOC_(?:COMPILER_PREDEFINES|DEPEND_FILTERS|EXECUTABLE|MACRO_NAMES|MOC_OPTIONS|SOURCE_GROUP|TARGETS_FOLDER)|AUTORCC|AUTORCC_EXECUTABLE|AUTORCC_OPTIONS|AUTORCC_SOURCE_GROUP|AUTOUIC|AUTOUIC_EXECUTABLE|AUTOUIC_OPTIONS|AUTOUIC_SEARCH_PATHS|BINARY_DIR|BUILDSYSTEM_TARGETS|BUILD_RPATH|BUILD_RPATH_USE_ORIGIN|BUILD_WITH_INSTALL_NAME_DIR|BUILD_WITH_INSTALL_RPATH|BUNDLE|BUNDLE_EXTENSION|CACHE_VARIABLES|CLEAN_NO_CUSTOM|COMMON_LANGUAGE_RUNTIME|COMPATIBLE_INTERFACE_(?:BOOL|NUMBER_MAX|NUMBER_MIN|STRING)|COMPILE_(?:DEFINITIONS|FEATURES|FLAGS|OPTIONS|PDB_NAME|PDB_OUTPUT_DIRECTORY)|COST|CPACK_DESKTOP_SHORTCUTS|CPACK_NEVER_OVERWRITE|CPACK_PERMANENT|CPACK_STARTUP_SHORTCUTS|CPACK_START_MENU_SHORTCUTS|CPACK_WIX_ACL|CROSSCOMPILING_EMULATOR|CUDA_EXTENSIONS|CUDA_PTX_COMPILATION|CUDA_RESOLVE_DEVICE_SYMBOLS|CUDA_SEPARABLE_COMPILATION|CUDA_STANDARD|CUDA_STANDARD_REQUIRED|CXX_EXTENSIONS|CXX_STANDARD|CXX_STANDARD_REQUIRED|C_EXTENSIONS|C_STANDARD|C_STANDARD_REQUIRED|DEBUG_CONFIGURATIONS|DEFINE_SYMBOL|DEFINITIONS|DEPENDS|DEPLOYMENT_ADDITIONAL_FILES|DEPLOYMENT_REMOTE_DIRECTORY|DISABLED|DISABLED_FEATURES|ECLIPSE_EXTRA_CPROJECT_CONTENTS|ECLIPSE_EXTRA_NATURES|ENABLED_FEATURES|ENABLED_LANGUAGES|ENABLE_EXPORTS|ENVIRONMENT|EXCLUDE_FROM_ALL|EXCLUDE_FROM_DEFAULT_BUILD|EXPORT_NAME|EXPORT_PROPERTIES|EXTERNAL_OBJECT|EchoString|FAIL_REGULAR_EXPRESSION|FIND_LIBRARY_USE_LIB32_PATHS|FIND_LIBRARY_USE_LIB64_PATHS|FIND_LIBRARY_USE_LIBX32_PATHS|FIND_LIBRARY_USE_OPENBSD_VERSIONING|FIXTURES_CLEANUP|FIXTURES_REQUIRED|FIXTURES_SETUP|FOLDER|FRAMEWORK|Fortran_FORMAT|Fortran_MODULE_DIRECTORY|GENERATED|GENERATOR_FILE_NAME|GENERATOR_IS_MULTI_CONFIG|GHS_INTEGRITY_APP|GHS_NO_SOURCE_GROUP_FILE|GLOBAL_DEPENDS_DEBUG_MODE|GLOBAL_DEPENDS_NO_CYCLES|GNUtoMS|HAS_CXX|HEADER_FILE_ONLY|HELPSTRING|IMPLICIT_DEPENDS_INCLUDE_TRANSFORM|IMPORTED|IMPORTED_(?:COMMON_LANGUAGE_RUNTIME|CONFIGURATIONS|GLOBAL|IMPLIB|LIBNAME|LINK_DEPENDENT_LIBRARIES|LINK_INTERFACE_(?:LANGUAGES|LIBRARIES|MULTIPLICITY)|LOCATION|NO_SONAME|OBJECTS|SONAME)|IMPORT_PREFIX|IMPORT_SUFFIX|INCLUDE_DIRECTORIES|INCLUDE_REGULAR_EXPRESSION|INSTALL_NAME_DIR|INSTALL_RPATH|INSTALL_RPATH_USE_LINK_PATH|INTERFACE_(?:AUTOUIC_OPTIONS|COMPILE_DEFINITIONS|COMPILE_FEATURES|COMPILE_OPTIONS|INCLUDE_DIRECTORIES|LINK_DEPENDS|LINK_DIRECTORIES|LINK_LIBRARIES|LINK_OPTIONS|POSITION_INDEPENDENT_CODE|SOURCES|SYSTEM_INCLUDE_DIRECTORIES)|INTERPROCEDURAL_OPTIMIZATION|IN_TRY_COMPILE|IOS_INSTALL_COMBINED|JOB_POOLS|JOB_POOL_COMPILE|JOB_POOL_LINK|KEEP_EXTENSION|LABELS|LANGUAGE|LIBRARY_OUTPUT_DIRECTORY|LINKER_LANGUAGE|LINK_(?:DEPENDS|DEPENDS_NO_SHARED|DIRECTORIES|FLAGS|INTERFACE_LIBRARIES|INTERFACE_MULTIPLICITY|LIBRARIES|OPTIONS|SEARCH_END_STATIC|SEARCH_START_STATIC|WHAT_YOU_USE)|LISTFILE_STACK|LOCATION|MACOSX_BUNDLE|MACOSX_BUNDLE_INFO_PLIST|MACOSX_FRAMEWORK_INFO_PLIST|MACOSX_PACKAGE_LOCATION|MACOSX_RPATH|MACROS|MANUALLY_ADDED_DEPENDENCIES|MEASUREMENT|MODIFIED|NAME|NO_SONAME|NO_SYSTEM_FROM_IMPORTED|OBJECT_DEPENDS|OBJECT_OUTPUTS|OSX_ARCHITECTURES|OUTPUT_NAME|PACKAGES_FOUND|PACKAGES_NOT_FOUND|PARENT_DIRECTORY|PASS_REGULAR_EXPRESSION|PDB_NAME|PDB_OUTPUT_DIRECTORY|POSITION_INDEPENDENT_CODE|POST_INSTALL_SCRIPT|PREDEFINED_TARGETS_FOLDER|PREFIX|PRE_INSTALL_SCRIPT|PRIVATE_HEADER|PROCESSORS|PROCESSOR_AFFINITY|PROJECT_LABEL|PUBLIC_HEADER|REPORT_UNDEFINED_PROPERTIES|REQUIRED_FILES|RESOURCE|RESOURCE_LOCK|RULE_LAUNCH_COMPILE|RULE_LAUNCH_CUSTOM|RULE_LAUNCH_LINK|RULE_MESSAGES|RUNTIME_OUTPUT_DIRECTORY|RUN_SERIAL|SKIP_AUTOGEN|SKIP_AUTOMOC|SKIP_AUTORCC|SKIP_AUTOUIC|SKIP_BUILD_RPATH|SKIP_RETURN_CODE|SOURCES|SOURCE_DIR|SOVERSION|STATIC_LIBRARY_FLAGS|STATIC_LIBRARY_OPTIONS|STRINGS|SUBDIRECTORIES|SUFFIX|SYMBOLIC|TARGET_ARCHIVES_MAY_BE_SHARED_LIBS|TARGET_MESSAGES|TARGET_SUPPORTS_SHARED_LIBS|TESTS|TEST_INCLUDE_FILE|TEST_INCLUDE_FILES|TIMEOUT|TIMEOUT_AFTER_MATCH|TYPE|USE_FOLDERS|VALUE|VARIABLES|VERSION|VISIBILITY_INLINES_HIDDEN|VS_(?:CONFIGURATION_TYPE|COPY_TO_OUT_DIR|DEBUGGER_(?:COMMAND|COMMAND_ARGUMENTS|ENVIRONMENT|WORKING_DIRECTORY)|DEPLOYMENT_CONTENT|DEPLOYMENT_LOCATION|DOTNET_REFERENCES|DOTNET_REFERENCES_COPY_LOCAL|INCLUDE_IN_VSIX|IOT_STARTUP_TASK|KEYWORD|RESOURCE_GENERATOR|SCC_AUXPATH|SCC_LOCALPATH|SCC_PROJECTNAME|SCC_PROVIDER|SDK_REFERENCES|SHADER_(?:DISABLE_OPTIMIZATIONS|ENABLE_DEBUG|ENTRYPOINT|FLAGS|MODEL|OBJECT_FILE_NAME|OUTPUT_HEADER_FILE|TYPE|VARIABLE_NAME)|STARTUP_PROJECT|TOOL_OVERRIDE|USER_PROPS|WINRT_COMPONENT|WINRT_EXTENSIONS|WINRT_REFERENCES|XAML_TYPE)|WILL_FAIL|WIN32_EXECUTABLE|WINDOWS_EXPORT_ALL_SYMBOLS|WORKING_DIRECTORY|WRAP_EXCLUDE|XCODE_(?:EMIT_EFFECTIVE_PLATFORM_NAME|EXPLICIT_FILE_TYPE|FILE_ATTRIBUTES|LAST_KNOWN_FILE_TYPE|PRODUCT_TYPE|SCHEME_(?:ADDRESS_SANITIZER|ADDRESS_SANITIZER_USE_AFTER_RETURN|ARGUMENTS|DISABLE_MAIN_THREAD_CHECKER|DYNAMIC_LIBRARY_LOADS|DYNAMIC_LINKER_API_USAGE|ENVIRONMENT|EXECUTABLE|GUARD_MALLOC|MAIN_THREAD_CHECKER_STOP|MALLOC_GUARD_EDGES|MALLOC_SCRIBBLE|MALLOC_STACK|THREAD_SANITIZER(?:_STOP)?|UNDEFINED_BEHAVIOUR_SANITIZER(?:_STOP)?|ZOMBIE_OBJECTS))|XCTEST)\b/,keyword:/\b(?:add_compile_definitions|add_compile_options|add_custom_command|add_custom_target|add_definitions|add_dependencies|add_executable|add_library|add_link_options|add_subdirectory|add_test|aux_source_directory|break|build_command|build_name|cmake_host_system_information|cmake_minimum_required|cmake_parse_arguments|cmake_policy|configure_file|continue|create_test_sourcelist|ctest_build|ctest_configure|ctest_coverage|ctest_empty_binary_directory|ctest_memcheck|ctest_read_custom_files|ctest_run_script|ctest_sleep|ctest_start|ctest_submit|ctest_test|ctest_update|ctest_upload|define_property|else|elseif|enable_language|enable_testing|endforeach|endfunction|endif|endmacro|endwhile|exec_program|execute_process|export|export_library_dependencies|file|find_file|find_library|find_package|find_path|find_program|fltk_wrap_ui|foreach|function|get_cmake_property|get_directory_property|get_filename_component|get_property|get_source_file_property|get_target_property|get_test_property|if|include|include_directories|include_external_msproject|include_guard|include_regular_expression|install|install_files|install_programs|install_targets|link_directories|link_libraries|list|load_cache|load_command|macro|make_directory|mark_as_advanced|math|message|option|output_required_files|project|qt_wrap_cpp|qt_wrap_ui|remove|remove_definitions|return|separate_arguments|set|set_directory_properties|set_property|set_source_files_properties|set_target_properties|set_tests_properties|site_name|source_group|string|subdir_depends|subdirs|target_compile_definitions|target_compile_features|target_compile_options|target_include_directories|target_link_directories|target_link_libraries|target_link_options|target_sources|try_compile|try_run|unset|use_mangled_mesa|utility_source|variable_requires|variable_watch|while|write_file)(?=\s*\()\b/,boolean:/\b(?:FALSE|OFF|ON|TRUE)\b/,namespace:/\b(?:INTERFACE|PRIVATE|PROPERTIES|PUBLIC|SHARED|STATIC|TARGET_OBJECTS)\b/,operator:/\b(?:AND|DEFINED|EQUAL|GREATER|LESS|MATCHES|NOT|OR|STREQUAL|STRGREATER|STRLESS|VERSION_EQUAL|VERSION_GREATER|VERSION_LESS)\b/,inserted:{pattern:/\b\w+::\w+\b/,alias:`class-name`},number:/\b\d+(?:\.\d+)*\b/,function:/\b[a-z_]\w*(?=\s*\()\b/i,punctuation:/[()>}]|\$[<{]/}}Me.displayName=`cobol`,Me.aliases=[];function Me(e){e.languages.cobol={comment:{pattern:/\*>.*|(^[ \t]*)\*.*/m,lookbehind:!0,greedy:!0},string:{pattern:/[xzgn]?(?:"(?:[^\r\n"]|"")*"(?!")|'(?:[^\r\n']|'')*'(?!'))/i,greedy:!0},level:{pattern:/(^[ \t]*)\d+\b/m,lookbehind:!0,greedy:!0,alias:`number`},"class-name":{pattern:/(\bpic(?:ture)?\s+)(?:(?:[-\w$/,:*+<>]|\.(?!\s|$))(?:\(\d+\))?)+/i,lookbehind:!0,inside:{number:{pattern:/(\()\d+/,lookbehind:!0},punctuation:/[()]/}},keyword:{pattern:/(^|[^\w-])(?:ABORT|ACCEPT|ACCESS|ADD|ADDRESS|ADVANCING|AFTER|ALIGNED|ALL|ALPHABET|ALPHABETIC|ALPHABETIC-LOWER|ALPHABETIC-UPPER|ALPHANUMERIC|ALPHANUMERIC-EDITED|ALSO|ALTER|ALTERNATE|ANY|ARE|AREA|AREAS|AS|ASCENDING|ASCII|ASSIGN|ASSOCIATED-DATA|ASSOCIATED-DATA-LENGTH|AT|ATTRIBUTE|AUTHOR|AUTO|AUTO-SKIP|BACKGROUND-COLOR|BACKGROUND-COLOUR|BASIS|BEEP|BEFORE|BEGINNING|BELL|BINARY|BIT|BLANK|BLINK|BLOCK|BOTTOM|BOUNDS|BY|BYFUNCTION|BYTITLE|CALL|CANCEL|CAPABLE|CCSVERSION|CD|CF|CH|CHAINING|CHANGED|CHANNEL|CHARACTER|CHARACTERS|CLASS|CLASS-ID|CLOCK-UNITS|CLOSE|CLOSE-DISPOSITION|COBOL|CODE|CODE-SET|COL|COLLATING|COLUMN|COM-REG|COMMA|COMMITMENT|COMMON|COMMUNICATION|COMP|COMP-1|COMP-2|COMP-3|COMP-4|COMP-5|COMPUTATIONAL|COMPUTATIONAL-1|COMPUTATIONAL-2|COMPUTATIONAL-3|COMPUTATIONAL-4|COMPUTATIONAL-5|COMPUTE|CONFIGURATION|CONTAINS|CONTENT|CONTINUE|CONTROL|CONTROL-POINT|CONTROLS|CONVENTION|CONVERTING|COPY|CORR|CORRESPONDING|COUNT|CRUNCH|CURRENCY|CURSOR|DATA|DATA-BASE|DATE|DATE-COMPILED|DATE-WRITTEN|DAY|DAY-OF-WEEK|DBCS|DE|DEBUG-CONTENTS|DEBUG-ITEM|DEBUG-LINE|DEBUG-NAME|DEBUG-SUB-1|DEBUG-SUB-2|DEBUG-SUB-3|DEBUGGING|DECIMAL-POINT|DECLARATIVES|DEFAULT|DEFAULT-DISPLAY|DEFINITION|DELETE|DELIMITED|DELIMITER|DEPENDING|DESCENDING|DESTINATION|DETAIL|DFHRESP|DFHVALUE|DISABLE|DISK|DISPLAY|DISPLAY-1|DIVIDE|DIVISION|DONTCARE|DOUBLE|DOWN|DUPLICATES|DYNAMIC|EBCDIC|EGCS|EGI|ELSE|EMI|EMPTY-CHECK|ENABLE|END|END-ACCEPT|END-ADD|END-CALL|END-COMPUTE|END-DELETE|END-DIVIDE|END-EVALUATE|END-IF|END-MULTIPLY|END-OF-PAGE|END-PERFORM|END-READ|END-RECEIVE|END-RETURN|END-REWRITE|END-SEARCH|END-START|END-STRING|END-SUBTRACT|END-UNSTRING|END-WRITE|ENDING|ENTER|ENTRY|ENTRY-PROCEDURE|ENVIRONMENT|EOL|EOP|EOS|ERASE|ERROR|ESCAPE|ESI|EVALUATE|EVENT|EVERY|EXCEPTION|EXCLUSIVE|EXHIBIT|EXIT|EXPORT|EXTEND|EXTENDED|EXTERNAL|FD|FILE|FILE-CONTROL|FILLER|FINAL|FIRST|FOOTING|FOR|FOREGROUND-COLOR|FOREGROUND-COLOUR|FROM|FULL|FUNCTION|FUNCTION-POINTER|FUNCTIONNAME|GENERATE|GIVING|GLOBAL|GO|GOBACK|GRID|GROUP|HEADING|HIGH-VALUE|HIGH-VALUES|HIGHLIGHT|I-O|I-O-CONTROL|ID|IDENTIFICATION|IF|IMPLICIT|IMPORT|IN|INDEX|INDEXED|INDICATE|INITIAL|INITIALIZE|INITIATE|INPUT|INPUT-OUTPUT|INSPECT|INSTALLATION|INTEGER|INTO|INVALID|INVOKE|IS|JUST|JUSTIFIED|KANJI|KEPT|KEY|KEYBOARD|LABEL|LANGUAGE|LAST|LB|LD|LEADING|LEFT|LEFTLINE|LENGTH|LENGTH-CHECK|LIBACCESS|LIBPARAMETER|LIBRARY|LIMIT|LIMITS|LINAGE|LINAGE-COUNTER|LINE|LINE-COUNTER|LINES|LINKAGE|LIST|LOCAL|LOCAL-STORAGE|LOCK|LONG-DATE|LONG-TIME|LOW-VALUE|LOW-VALUES|LOWER|LOWLIGHT|MEMORY|MERGE|MESSAGE|MMDDYYYY|MODE|MODULES|MORE-LABELS|MOVE|MULTIPLE|MULTIPLY|NAMED|NATIONAL|NATIONAL-EDITED|NATIVE|NEGATIVE|NETWORK|NEXT|NO|NO-ECHO|NULL|NULLS|NUMBER|NUMERIC|NUMERIC-DATE|NUMERIC-EDITED|NUMERIC-TIME|OBJECT-COMPUTER|OCCURS|ODT|OF|OFF|OMITTED|ON|OPEN|OPTIONAL|ORDER|ORDERLY|ORGANIZATION|OTHER|OUTPUT|OVERFLOW|OVERLINE|OWN|PACKED-DECIMAL|PADDING|PAGE|PAGE-COUNTER|PASSWORD|PERFORM|PF|PH|PIC|PICTURE|PLUS|POINTER|PORT|POSITION|POSITIVE|PRINTER|PRINTING|PRIVATE|PROCEDURE|PROCEDURE-POINTER|PROCEDURES|PROCEED|PROCESS|PROGRAM|PROGRAM-ID|PROGRAM-LIBRARY|PROMPT|PURGE|QUEUE|QUOTE|QUOTES|RANDOM|RD|READ|READER|REAL|RECEIVE|RECEIVED|RECORD|RECORDING|RECORDS|RECURSIVE|REDEFINES|REEL|REF|REFERENCE|REFERENCES|RELATIVE|RELEASE|REMAINDER|REMARKS|REMOTE|REMOVAL|REMOVE|RENAMES|REPLACE|REPLACING|REPORT|REPORTING|REPORTS|REQUIRED|RERUN|RESERVE|RESET|RETURN|RETURN-CODE|RETURNING|REVERSE-VIDEO|REVERSED|REWIND|REWRITE|RF|RH|RIGHT|ROUNDED|RUN|SAME|SAVE|SCREEN|SD|SEARCH|SECTION|SECURE|SECURITY|SEGMENT|SEGMENT-LIMIT|SELECT|SEND|SENTENCE|SEPARATE|SEQUENCE|SEQUENTIAL|SET|SHARED|SHAREDBYALL|SHAREDBYRUNUNIT|SHARING|SHIFT-IN|SHIFT-OUT|SHORT-DATE|SIGN|SIZE|SORT|SORT-CONTROL|SORT-CORE-SIZE|SORT-FILE-SIZE|SORT-MERGE|SORT-MESSAGE|SORT-MODE-SIZE|SORT-RETURN|SOURCE|SOURCE-COMPUTER|SPACE|SPACES|SPECIAL-NAMES|STANDARD|STANDARD-1|STANDARD-2|START|STATUS|STOP|STRING|SUB-QUEUE-1|SUB-QUEUE-2|SUB-QUEUE-3|SUBTRACT|SUM|SUPPRESS|SYMBOL|SYMBOLIC|SYNC|SYNCHRONIZED|TABLE|TALLY|TALLYING|TAPE|TASK|TERMINAL|TERMINATE|TEST|TEXT|THEN|THREAD|THREAD-LOCAL|THROUGH|THRU|TIME|TIMER|TIMES|TITLE|TO|TODAYS-DATE|TODAYS-NAME|TOP|TRAILING|TRUNCATED|TYPE|TYPEDEF|UNDERLINE|UNIT|UNSTRING|UNTIL|UP|UPON|USAGE|USE|USING|VALUE|VALUES|VARYING|VIRTUAL|WAIT|WHEN|WHEN-COMPILED|WITH|WORDS|WORKING-STORAGE|WRITE|YEAR|YYYYDDD|YYYYMMDD|ZERO-FILL|ZEROES|ZEROS)(?![\w-])/i,lookbehind:!0},boolean:{pattern:/(^|[^\w-])(?:false|true)(?![\w-])/i,lookbehind:!0},number:{pattern:/(^|[^\w-])(?:[+-]?(?:(?:\d+(?:[.,]\d+)?|[.,]\d+)(?:e[+-]?\d+)?|zero))(?![\w-])/i,lookbehind:!0},operator:[/<>|[<>]=?|[=+*/&]/,{pattern:/(^|[^\w-])(?:-|and|equal|greater|less|not|or|than)(?![\w-])/i,lookbehind:!0}],punctuation:/[.:,()]/}}Ne.displayName=`coffeescript`,Ne.aliases=[`coffee`];function Ne(e){e.register(C),(function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:`variable`};e.languages.coffeescript=e.languages.extend(`javascript`,{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:`variable`}}),e.languages.insertBefore(`coffeescript`,`comment`,{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:`comment`},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:`regex`,inside:{comment:t,interpolation:n}}}),e.languages.insertBefore(`coffeescript`,`string`,{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:`punctuation`},script:{pattern:/[\s\S]+/,alias:`language-javascript`,inside:e.languages.javascript}}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:`string`},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:`string`,inside:{interpolation:n}}]}),e.languages.insertBefore(`coffeescript`,`keyword`,{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript[`template-string`],e.languages.coffee=e.languages.coffeescript})(e)}Pe.displayName=`concurnas`,Pe.aliases=[`conc`];function Pe(e){e.languages.concurnas={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?(?:\*\/|$)|\/\/.*)/,lookbehind:!0,greedy:!0},langext:{pattern:/\b\w+\s*\|\|[\s\S]+?\|\|/,greedy:!0,inside:{"class-name":/^\w+/,string:{pattern:/(^\s*\|\|)[\s\S]+(?=\|\|$)/,lookbehind:!0},punctuation:/\|\|/}},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/,lookbehind:!0},keyword:/\b(?:abstract|actor|also|annotation|assert|async|await|bool|boolean|break|byte|case|catch|changed|char|class|closed|constant|continue|def|default|del|double|elif|else|enum|every|extends|false|finally|float|for|from|global|gpudef|gpukernel|if|import|in|init|inject|int|lambda|local|long|loop|match|new|nodefault|null|of|onchange|open|out|override|package|parfor|parforsync|post|pre|private|protected|provide|provider|public|return|shared|short|single|size_t|sizeof|super|sync|this|throw|trait|trans|transient|true|try|typedef|unchecked|using|val|var|void|while|with)\b/,boolean:/\b(?:false|true)\b/,number:/\b0b[01][01_]*L?\b|\b0x(?:[\da-f_]*\.)?[\da-f_p+-]+\b|(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.\d[\d_]*)(?:e[+-]?\d[\d_]*)?[dfls]?/i,punctuation:/[{}[\];(),.:]/,operator:/<==|>==|=>|->|<-|<>|&==|&<>|\?:?|\.\?|\+\+|--|[-+*/=<>]=?|[!^~]|\b(?:and|as|band|bor|bxor|comp|is|isnot|mod|or)\b=?/,annotation:{pattern:/@(?:\w+:)?(?:\w+|\[[^\]]+\])?/,alias:`builtin`}},e.languages.insertBefore(`concurnas`,`langext`,{"regex-literal":{pattern:/\br("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:e.languages.concurnas},regex:/[\s\S]+/}},"string-literal":{pattern:/(?:\B|\bs)("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:e.languages.concurnas},string:/[\s\S]+/}}}),e.languages.conc=e.languages.concurnas}Fe.displayName=`cooklang`,Fe.aliases=[];function Fe(e){(function(e){var t=`(?:(?!\\s)[\\d$+<=a-zA-Z\\x80-\\uFFFF])+`,n=`[^{}@#]+`,r=n+`\\{[^}#@]*\\}`,i=`(?:h|hours|hrs|m|min|minutes)`,a={pattern:/\{[^{}]*\}/,inside:{amount:{pattern:/([\{|])[^{}|*%]+/,lookbehind:!0,alias:`number`},unit:{pattern:/(%)[^}]+/,lookbehind:!0,alias:`symbol`},"servings-scaler":{pattern:/\*/,alias:`operator`},"servings-alternative-separator":{pattern:/\|/,alias:`operator`},"unit-separator":{pattern:/(?:%|(\*)%)/,lookbehind:!0,alias:`operator`},punctuation:/[{}]/}};e.languages.cooklang={comment:{pattern:/\[-[\s\S]*?-\]|--.*/,greedy:!0},meta:{pattern:/>>.*:.*/,inside:{property:{pattern:/(>>\s*)[^\s:](?:[^:]*[^\s:])?/,lookbehind:!0}}},"cookware-group":{pattern:RegExp(`#(?:`+r+`|`+t+`)`),inside:{cookware:{pattern:RegExp(`(^#)(?:`+n+`)`),lookbehind:!0,alias:`variable`},"cookware-keyword":{pattern:/^#/,alias:`keyword`},"quantity-group":{pattern:new RegExp(/\{[^{}@#]*\}/),inside:{quantity:{pattern:RegExp(`(^\\{)`+n),lookbehind:!0,alias:`number`},punctuation:/[{}]/}}}},"ingredient-group":{pattern:RegExp(`@(?:`+r+`|`+t+`)`),inside:{ingredient:{pattern:RegExp(`(^@)(?:`+n+`)`),lookbehind:!0,alias:`variable`},"ingredient-keyword":{pattern:/^@/,alias:`keyword`},"amount-group":a}},"timer-group":{pattern:/~(?!\s)[^@#~{}]*\{[^{}]*\}/,inside:{timer:{pattern:/(^~)[^{]+/,lookbehind:!0,alias:`variable`},"duration-group":{pattern:/\{[^{}]*\}/,inside:{punctuation:/[{}]/,unit:{pattern:RegExp(`(%\\s*)`+i+`\\b`),lookbehind:!0,alias:`symbol`},operator:/%/,duration:{pattern:/\d+/,alias:`number`}}},"timer-keyword":{pattern:/^~/,alias:`keyword`}}}}})(e)}Ie.displayName=`coq`,Ie.aliases=[];function Ie(e){(function(e){for(var t=`\\(\\*(?:[^(*]|\\((?!\\*)|\\*(?!\\))|)*\\*\\)`,n=0;n<2;n++)t=t.replace(//g,function(){return t});t=t.replace(//g,`[]`),e.languages.coq={comment:RegExp(t),string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},attribute:[{pattern:RegExp(`#\\[(?:[^\\[\\]("]|"(?:[^"]|"")*"(?!")|\\((?!\\*)|)*\\]`.replace(//g,function(){return t})),greedy:!0,alias:`attr-name`,inside:{comment:RegExp(t),string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},operator:/=/,punctuation:/^#\[|\]$|[,()]/}},{pattern:/\b(?:Cumulative|Global|Local|Monomorphic|NonCumulative|Polymorphic|Private|Program)\b/,alias:`attr-name`}],keyword:/\b(?:Abort|About|Add|Admit|Admitted|All|Arguments|As|Assumptions|Axiom|Axioms|Back|BackTo|Backtrace|BinOp|BinOpSpec|BinRel|Bind|Blacklist|Canonical|Case|Cd|Check|Class|Classes|Close|CoFixpoint|CoInductive|Coercion|Coercions|Collection|Combined|Compute|Conjecture|Conjectures|Constant|Constants|Constraint|Constructors|Context|Corollary|Create|CstOp|Custom|Cut|Debug|Declare|Defined|Definition|Delimit|Dependencies|Dependent|Derive|Diffs|Drop|Elimination|End|Entry|Equality|Eval|Example|Existential|Existentials|Existing|Export|Extern|Extraction|Fact|Fail|Field|File|Firstorder|Fixpoint|Flags|Focus|From|Funclass|Function|Functional|GC|Generalizable|Goal|Grab|Grammar|Graph|Guarded|Haskell|Heap|Hide|Hint|HintDb|Hints|Hypotheses|Hypothesis|IF|Identity|Immediate|Implicit|Implicits|Import|Include|Induction|Inductive|Infix|Info|Initial|InjTyp|Inline|Inspect|Instance|Instances|Intro|Intros|Inversion|Inversion_clear|JSON|Language|Left|Lemma|Let|Lia|Libraries|Library|Load|LoadPath|Locate|Ltac|Ltac2|ML|Match|Method|Minimality|Module|Modules|Morphism|Next|NoInline|Notation|Number|OCaml|Obligation|Obligations|Opaque|Open|Optimize|Parameter|Parameters|Parametric|Path|Paths|Prenex|Preterm|Primitive|Print|Profile|Projections|Proof|Prop|PropBinOp|PropOp|PropUOp|Property|Proposition|Pwd|Qed|Quit|Rec|Record|Recursive|Redirect|Reduction|Register|Relation|Remark|Remove|Require|Reserved|Reset|Resolve|Restart|Rewrite|Right|Ring|Rings|SProp|Saturate|Save|Scheme|Scope|Scopes|Search|SearchHead|SearchPattern|SearchRewrite|Section|Separate|Set|Setoid|Show|Signatures|Solve|Solver|Sort|Sortclass|Sorted|Spec|Step|Strategies|Strategy|String|Structure|SubClass|Subgraph|SuchThat|Tactic|Term|TestCompile|Theorem|Time|Timeout|To|Transparent|Type|Typeclasses|Types|Typing|UnOp|UnOpSpec|Undelimit|Undo|Unfocus|Unfocused|Unfold|Universe|Universes|Unshelve|Variable|Variables|Variant|Verbose|View|Visibility|Zify|_|apply|as|at|by|cofix|else|end|exists|exists2|fix|for|forall|fun|if|in|let|match|measure|move|removed|return|struct|then|using|wf|where|with)\b/,number:/\b(?:0x[a-f0-9][a-f0-9_]*(?:\.[a-f0-9_]+)?(?:p[+-]?\d[\d_]*)?|\d[\d_]*(?:\.[\d_]+)?(?:e[+-]?\d[\d_]*)?)\b/i,punct:{pattern:/@\{|\{\||\[=|:>/,alias:`punctuation`},operator:/\/\\|\\\/|\.{2,3}|:{1,2}=|\*\*|[-=]>|<(?:->?|[+:=>]|<:)|>(?:=|->)|\|[-|]?|[-!%&*+/<=>?@^~']/,punctuation:/\.\(|`\(|@\{|`\{|\{\||\[=|:>|[:.,;(){}\[\]]/}})(e)}V.displayName=`ruby`,V.aliases=[`rb`];function V(e){e.register(S),(function(e){e.languages.ruby=e.languages.extend(`clike`,{comment:{pattern:/#.*|^=begin\s[\s\S]*?^=end/m,greedy:!0},"class-name":{pattern:/(\b(?:class|module)\s+|\bcatch\s+\()[\w.\\]+|\b[A-Z_]\w*(?=\s*\.\s*new\b)/,lookbehind:!0,inside:{punctuation:/[.\\]/}},keyword:/\b(?:BEGIN|END|alias|and|begin|break|case|class|def|define_method|defined|do|each|else|elsif|end|ensure|extend|for|if|in|include|module|new|next|nil|not|or|prepend|private|protected|public|raise|redo|require|rescue|retry|return|self|super|then|throw|undef|unless|until|when|while|yield)\b/,operator:/\.{2,3}|&\.|===||[!=]?~|(?:&&|\|\||<<|>>|\*\*|[+\-*/%<>!^&|=])=?|[?:]/,punctuation:/[(){}[\].,;]/}),e.languages.insertBefore(`ruby`,`operator`,{"double-colon":{pattern:/::/,alias:`punctuation`}});var t={pattern:/((?:^|[^\\])(?:\\{2})*)#\{(?:[^{}]|\{[^{}]*\})*\}/,lookbehind:!0,inside:{content:{pattern:/^(#\{)[\s\S]+(?=\}$)/,lookbehind:!0,inside:e.languages.ruby},delimiter:{pattern:/^#\{|\}$/,alias:`punctuation`}}};delete e.languages.ruby.function;var n=`(?:`+[`([^a-zA-Z0-9\\s{(\\[<=])(?:(?!\\1)[^\\\\]|\\\\[\\s\\S])*\\1`,`\\((?:[^()\\\\]|\\\\[\\s\\S]|\\((?:[^()\\\\]|\\\\[\\s\\S])*\\))*\\)`,`\\{(?:[^{}\\\\]|\\\\[\\s\\S]|\\{(?:[^{}\\\\]|\\\\[\\s\\S])*\\})*\\}`,`\\[(?:[^\\[\\]\\\\]|\\\\[\\s\\S]|\\[(?:[^\\[\\]\\\\]|\\\\[\\s\\S])*\\])*\\]`,`<(?:[^<>\\\\]|\\\\[\\s\\S]|<(?:[^<>\\\\]|\\\\[\\s\\S])*>)*>`].join(`|`)+`)`,r=`(?:"(?:\\\\.|[^"\\\\\\r\\n])*"|(?:\\b[a-zA-Z_]\\w*|[^\\s\\0-\\x7F]+)[?!]?|\\$.)`;e.languages.insertBefore(`ruby`,`keyword`,{"regex-literal":[{pattern:RegExp(`%r`+n+`[egimnosux]{0,6}`),greedy:!0,inside:{interpolation:t,regex:/[\s\S]+/}},{pattern:/(^|[^/])\/(?!\/)(?:\[[^\r\n\]]+\]|\\.|[^[/\\\r\n])+\/[egimnosux]{0,6}(?=\s*(?:$|[\r\n,.;})#]))/,lookbehind:!0,greedy:!0,inside:{interpolation:t,regex:/[\s\S]+/}}],variable:/[@$]+[a-zA-Z_]\w*(?:[?!]|\b)/,symbol:[{pattern:RegExp(`(^|[^:]):`+r),lookbehind:!0,greedy:!0},{pattern:RegExp(`([\\r\\n{(,][ \\t]*)`+r+`(?=:(?!:))`),lookbehind:!0,greedy:!0}],"method-definition":{pattern:/(\bdef\s+)\w+(?:\s*\.\s*\w+)?/,lookbehind:!0,inside:{function:/\b\w+$/,keyword:/^self\b/,"class-name":/^\w+/,punctuation:/\./}}}),e.languages.insertBefore(`ruby`,`string`,{"string-literal":[{pattern:RegExp(`%[qQiIwWs]?`+n),greedy:!0,inside:{interpolation:t,string:/[\s\S]+/}},{pattern:/("|')(?:#\{[^}]+\}|#(?!\{)|\\(?:\r\n|[\s\S])|(?!\1)[^\\#\r\n])*\1/,greedy:!0,inside:{interpolation:t,string:/[\s\S]+/}},{pattern:/<<[-~]?([a-z_]\w*)[\r\n](?:.*[\r\n])*?[\t ]*\1/i,alias:`heredoc-string`,greedy:!0,inside:{delimiter:{pattern:/^<<[-~]?[a-z_]\w*|\b[a-z_]\w*$/i,inside:{symbol:/\b\w+/,punctuation:/^<<[-~]?/}},interpolation:t,string:/[\s\S]+/}},{pattern:/<<[-~]?'([a-z_]\w*)'[\r\n](?:.*[\r\n])*?[\t ]*\1/i,alias:`heredoc-string`,greedy:!0,inside:{delimiter:{pattern:/^<<[-~]?'[a-z_]\w*'|\b[a-z_]\w*$/i,inside:{symbol:/\b\w+/,punctuation:/^<<[-~]?'|'$/}},string:/[\s\S]+/}}],"command-literal":[{pattern:RegExp(`%x`+n),greedy:!0,inside:{interpolation:t,command:{pattern:/[\s\S]+/,alias:`string`}}},{pattern:/`(?:#\{[^}]+\}|#(?!\{)|\\(?:\r\n|[\s\S])|[^\\`#\r\n])*`/,greedy:!0,inside:{interpolation:t,command:{pattern:/[\s\S]+/,alias:`string`}}}]}),delete e.languages.ruby.string,e.languages.insertBefore(`ruby`,`number`,{builtin:/\b(?:Array|Bignum|Binding|Class|Continuation|Dir|Exception|FalseClass|File|Fixnum|Float|Hash|IO|Integer|MatchData|Method|Module|NilClass|Numeric|Object|Proc|Range|Regexp|Stat|String|Struct|Symbol|TMS|Thread|ThreadGroup|Time|TrueClass)\b/,constant:/\b[A-Z][A-Z0-9_]*(?:[?!]|\b)/}),e.languages.rb=e.languages.ruby})(e)}Le.displayName=`crystal`,Le.aliases=[];function Le(e){e.register(V),(function(e){e.languages.crystal=e.languages.extend(`ruby`,{keyword:[/\b(?:__DIR__|__END_LINE__|__FILE__|__LINE__|abstract|alias|annotation|as|asm|begin|break|case|class|def|do|else|elsif|end|ensure|enum|extend|for|fun|if|ifdef|include|instance_sizeof|lib|macro|module|next|of|out|pointerof|private|protected|ptr|require|rescue|return|select|self|sizeof|struct|super|then|type|typeof|undef|uninitialized|union|unless|until|when|while|with|yield)\b/,{pattern:/(\.\s*)(?:is_a|responds_to)\?/,lookbehind:!0}],number:/\b(?:0b[01_]*[01]|0o[0-7_]*[0-7]|0x[\da-fA-F_]*[\da-fA-F]|(?:\d(?:[\d_]*\d)?)(?:\.[\d_]*\d)?(?:[eE][+-]?[\d_]*\d)?)(?:_(?:[uif](?:8|16|32|64))?)?\b/,operator:[/->/,e.languages.ruby.operator],punctuation:/[(){}[\].,;\\]/}),e.languages.insertBefore(`crystal`,`string-literal`,{attribute:{pattern:/@\[.*?\]/,inside:{delimiter:{pattern:/^@\[|\]$/,alias:`punctuation`},attribute:{pattern:/^(\s*)\w+/,lookbehind:!0,alias:`class-name`},args:{pattern:/\S(?:[\s\S]*\S)?/,inside:e.languages.crystal}}},expansion:{pattern:/\{(?:\{.*?\}|%.*?%)\}/,inside:{content:{pattern:/^(\{.)[\s\S]+(?=.\}$)/,lookbehind:!0,inside:e.languages.crystal},delimiter:{pattern:/^\{[\{%]|[\}%]\}$/,alias:`operator`}}},char:{pattern:/'(?:[^\\\r\n]{1,2}|\\(?:.|u(?:[A-Fa-f0-9]{1,4}|\{[A-Fa-f0-9]{1,6}\})))'/,greedy:!0}})})(e)}Re.displayName=`cshtml`,Re.aliases=[`razor`];function Re(e){e.register(z),e.register(B),(function(e){var t=`\\/(?![/*])|\\/\\/.*[\\r\\n]|\\/\\*[^*]*(?:\\*(?!\\/)[^*]*)*\\*\\/`,n=`@(?!")|"(?:[^\\r\\n\\\\"]|\\\\.)*"|@"(?:[^\\\\"]|""|\\\\[\\s\\S])*"(?!")|'(?:(?:[^\\r\\n'\\\\]|\\\\.|\\\\[Uux][\\da-fA-F]{1,8})'|(?=[^\\\\](?!')))`;function r(e,r){for(var i=0;i/g,function(){return`(?:`+e+`)`});return e.replace(//g,`[^\\s\\S]`).replace(//g,`(?:`+n+`)`).replace(//g,`(?:`+t+`)`)}var i=r(`\\((?:[^()'"@/]|||)*\\)`,2),a=r(`\\[(?:[^\\[\\]'"@/]|||)*\\]`,1),o=r(`\\{(?:[^{}'"@/]|||)*\\}`,2),s=r(`<(?:[^<>'"@/]||)*>`,1),c=`@(?:await\\b\\s*)?(?:(?!await\\b)\\w+\\b|`+i+`)(?:[?!]?\\.\\w+\\b|(?:`+s+`)?`+i+`|`+a+`)*(?![?!\\.(\\[]|<(?!\\/))`,l=`(?:"[^"@]*"|'[^'@]*'|[^\\s'"@>=]+(?=[\\s>])|["'][^"'@]*(?:(?:`+(`@(?![\\w()])|`+c)+`)[^"'@]*)+["'])`,u=`(?:\\s(?:\\s*[^\\s>\\/=]+(?:\\s*=\\s*|(?=[\\s/>])))+)?`.replace(//,l),d=`(?!\\d)[^\\s>\\/=$<%]+`+u+`\\s*\\/?>`,f=`\\B@?(?:<([a-zA-Z][\\w:]*)`+u+`\\s*>(?:`+(`[^<]|<\\/?(?!\\1\\b)`+d+`|`+r(`<\\1`+u+`\\s*>(?:`+(`[^<]|<\\/?(?!\\1\\b)`+d+`|`)+`)*<\\/\\1\\s*>`,2))+`)*<\\/\\1\\s*>|<`+d+`)`;e.languages.cshtml=e.languages.extend(`markup`,{});var p={pattern:/\S[\s\S]*/,alias:`language-csharp`,inside:e.languages.insertBefore(`csharp`,`string`,{html:{pattern:RegExp(f),greedy:!0,inside:e.languages.cshtml}},{csharp:e.languages.extend(`csharp`,{})})},m={pattern:RegExp(`(^|[^@])`+c),lookbehind:!0,greedy:!0,alias:`variable`,inside:{keyword:/^@/,csharp:p}};e.languages.cshtml.tag.pattern=RegExp(`<\\/?`+d),e.languages.cshtml.tag.inside[`attr-value`].pattern=RegExp(`=\\s*`+l),e.languages.insertBefore(`inside`,`punctuation`,{value:m},e.languages.cshtml.tag.inside[`attr-value`]),e.languages.insertBefore(`cshtml`,`prolog`,{"razor-comment":{pattern:/@\*[\s\S]*?\*@/,greedy:!0,alias:`comment`},block:{pattern:RegExp(`(^|[^@])@(?:`+[o,`(?:code|functions)\\s*`+o,`(?:for|foreach|lock|switch|using|while)\\s*`+i+`\\s*`+o,`do\\s*`+o+`\\s*while\\s*`+i+`(?:\\s*;)?`,`try\\s*`+o+`\\s*catch\\s*`+i+`\\s*`+o+`\\s*finally\\s*`+o,`if\\s*`+i+`\\s*`+o+`(?:\\s*else(?:\\s+if\\s*`+i+`)?\\s*`+o+`)*`,`helper\\s+\\w+\\s*`+i+`\\s*`+o].join(`|`)+`)`),lookbehind:!0,greedy:!0,inside:{keyword:/^@\w*/,csharp:p}},directive:{pattern:/^([ \t]*)@(?:addTagHelper|attribute|implements|inherits|inject|layout|model|namespace|page|preservewhitespace|removeTagHelper|section|tagHelperPrefix|using)(?=\s).*/m,lookbehind:!0,greedy:!0,inside:{keyword:/^@\w+/,csharp:p}},value:m,"delegate-operator":{pattern:/(^|[^@])@(?=<)/,lookbehind:!0,alias:`operator`}}),e.languages.razor=e.languages.cshtml})(e)}ze.displayName=`csp`,ze.aliases=[];function ze(e){(function(e){function t(e){return RegExp(`([ \\t])(?:`+e+`)(?=[\\s;]|$)`,`i`)}e.languages.csp={directive:{pattern:/(^|[\s;])(?:base-uri|block-all-mixed-content|(?:child|connect|default|font|frame|img|manifest|media|object|prefetch|script|style|worker)-src|disown-opener|form-action|frame-(?:ancestors|options)|input-protection(?:-(?:clip|selectors))?|navigate-to|plugin-types|policy-uri|referrer|reflected-xss|report-(?:to|uri)|require-sri-for|sandbox|(?:script|style)-src-(?:attr|elem)|upgrade-insecure-requests)(?=[\s;]|$)/i,lookbehind:!0,alias:`property`},scheme:{pattern:t(`[a-z][a-z0-9.+-]*:`),lookbehind:!0},none:{pattern:t(`'none'`),lookbehind:!0,alias:`keyword`},nonce:{pattern:t(`'nonce-[-+/\\w=]+'`),lookbehind:!0,alias:`number`},hash:{pattern:t(`'sha(?:256|384|512)-[-+/\\w=]+'`),lookbehind:!0,alias:`number`},host:{pattern:t(`[a-z][a-z0-9.+-]*:\\/\\/[^\\s;,']*|\\*[^\\s;,']*|[a-z0-9-]+(?:\\.[a-z0-9-]+)+(?::[\\d*]+)?(?:\\/[^\\s;,']*)?`),lookbehind:!0,alias:`url`,inside:{important:/\*/}},keyword:[{pattern:t(`'unsafe-[a-z-]+'`),lookbehind:!0,alias:`unsafe`},{pattern:t(`'[a-z-]+'`),lookbehind:!0,alias:`safe`}],punctuation:/;/}})(e)}H.displayName=`css`,H.aliases=[];function H(e){(function(e){var t=/(?:"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n])*')/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:RegExp(`@[\\w-](?:[^;{\\s"']|\\s+(?!\\s)|`+t.source+`)*?(?:;|(?=\\s*\\{))`),inside:{rule:/^@[\w-]+/,"selector-function-argument":{pattern:/(\bselector\s*\(\s*(?![\s)]))(?:[^()\s]|\s+(?![\s)])|\((?:[^()]|\([^()]*\))*\))+(?=\s*\))/,lookbehind:!0,alias:`selector`},keyword:{pattern:/(^|[^\w-])(?:and|not|only|or)(?![\w-])/,lookbehind:!0}}},url:{pattern:RegExp(`\\burl\\((?:`+t.source+`|(?:[^\\\\\\r\\n()"']|\\\\[\\s\\S])*)\\)`,`i`),greedy:!0,inside:{function:/^url/i,punctuation:/^\(|\)$/,string:{pattern:RegExp(`^`+t.source+`$`),alias:`url`}}},selector:{pattern:RegExp(`(^|[{}\\s])[^{}\\s](?:[^{};"'\\s]|\\s+(?![\\s{])|`+t.source+`)*(?=\\s*\\{)`),lookbehind:!0},string:{pattern:t,greedy:!0},property:{pattern:/(^|[^-\w\xA0-\uFFFF])(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*(?=\s*:)/i,lookbehind:!0},important:/!important\b/i,function:{pattern:/(^|[^-a-z0-9])[-a-z0-9]+(?=\()/i,lookbehind:!0},punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined(`style`,`css`),n.tag.addAttribute(`style`,`css`))})(e)}Be.displayName=`css-extras`,Be.aliases=[];function Be(e){e.register(H),(function(e){var t=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,n;e.languages.css.selector={pattern:e.languages.css.selector.pattern,lookbehind:!0,inside:n={"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-\w]+/,id:/#[-\w]+/,attribute:{pattern:RegExp(`\\[(?:[^[\\]"']|`+t.source+`)*\\]`),greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:`keyword`},namespace:{pattern:/^(\s*)(?:(?!\s)[-*\w\xA0-\uFFFF])*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},"attr-name":{pattern:/^(\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+/,lookbehind:!0},"attr-value":[t,{pattern:/(=\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],combinator:/>|\+|~|\|\|/,punctuation:/[(),]/}},e.languages.css.atrule.inside[`selector-function-argument`].inside=n,e.languages.insertBefore(`css`,`property`,{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*/i,lookbehind:!0}});var r={pattern:/(\b\d+)(?:%|[a-z]+(?![\w-]))/,lookbehind:!0},i={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0};e.languages.insertBefore(`css`,`function`,{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:{pattern:/\B#[\da-f]{3,8}\b/i,alias:`color`},color:[{pattern:/(^|[^\w-])(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|RebeccaPurple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)(?![\w-])/i,lookbehind:!0},{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:r,number:i,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:r,number:i})})(e)}Ve.displayName=`csv`,Ve.aliases=[];function Ve(e){e.languages.csv={value:/[^\r\n,"]+|"(?:[^"]|"")*"(?!")/,punctuation:/,/}}He.displayName=`cue`,He.aliases=[];function He(e){(function(e){var t=`(?:`+`"""(?:[^\\\\"]|"(?!""\\2)|)*"""|'''(?:[^\\\\']|'(?!''\\2)|)*'''|"(?:[^\\\\\\r\\n"]|"(?!\\2)|)*"|'(?:[^\\\\\\r\\n']|'(?!\\2)|)*'`.replace(//g,`\\\\(?:(?!\\2)|\\2(?:[^()\\r\\n]|\\([^()]*\\)))`)+`)`;e.languages.cue={comment:{pattern:/\/\/.*/,greedy:!0},"string-literal":{pattern:RegExp(`(^|[^#"'\\\\])(#*)`+t+`(?!["'])\\2`),lookbehind:!0,greedy:!0,inside:{escape:{pattern:/(?=[\s\S]*["'](#*)$)\\\1(?:U[a-fA-F0-9]{1,8}|u[a-fA-F0-9]{1,4}|x[a-fA-F0-9]{1,2}|\d{2,3}|[^(])/,greedy:!0,alias:`string`},interpolation:{pattern:/(?=[\s\S]*["'](#*)$)\\\1\([^()]*\)/,greedy:!0,inside:{punctuation:/^\\#*\(|\)$/,expression:{pattern:/[\s\S]+/,inside:null}}},string:/[\s\S]+/}},keyword:{pattern:/(^|[^\w$])(?:for|if|import|in|let|null|package)(?![\w$])/,lookbehind:!0},boolean:{pattern:/(^|[^\w$])(?:false|true)(?![\w$])/,lookbehind:!0},builtin:{pattern:/(^|[^\w$])(?:bool|bytes|float|float(?:32|64)|u?int(?:8|16|32|64|128)?|number|rune|string)(?![\w$])/,lookbehind:!0},attribute:{pattern:/@[\w$]+(?=\s*\()/,alias:`function`},function:{pattern:/(^|[^\w$])[a-z_$][\w$]*(?=\s*\()/i,lookbehind:!0},number:{pattern:/(^|[^\w$.])(?:0b[01]+(?:_[01]+)*|0o[0-7]+(?:_[0-7]+)*|0[xX][0-9A-Fa-f]+(?:_[0-9A-Fa-f]+)*|(?:\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\.\d+(?:_\d+)*)(?:[eE][+-]?\d+(?:_\d+)*)?(?:[KMGTP]i?)?)(?![\w$])/,lookbehind:!0},operator:/\.{3}|_\|_|&&?|\|\|?|[=!]~|[<>=!]=?|[+\-*/?]/,punctuation:/[()[\]{},.:]/},e.languages.cue[`string-literal`].inside.interpolation.inside.expression.inside=e.languages.cue})(e)}Ue.displayName=`cypher`,Ue.aliases=[];function Ue(e){e.languages.cypher={comment:/\/\/.*/,string:{pattern:/"(?:[^"\\\r\n]|\\.)*"|'(?:[^'\\\r\n]|\\.)*'/,greedy:!0},"class-name":{pattern:/(:\s*)(?:\w+|`(?:[^`\\\r\n])*`)(?=\s*[{):])/,lookbehind:!0,greedy:!0},relationship:{pattern:/(-\[\s*(?:\w+\s*|`(?:[^`\\\r\n])*`\s*)?:\s*|\|\s*:\s*)(?:\w+|`(?:[^`\\\r\n])*`)/,lookbehind:!0,greedy:!0,alias:`property`},identifier:{pattern:/`(?:[^`\\\r\n])*`/,greedy:!0},variable:/\$\w+/,keyword:/\b(?:ADD|ALL|AND|AS|ASC|ASCENDING|ASSERT|BY|CALL|CASE|COMMIT|CONSTRAINT|CONTAINS|CREATE|CSV|DELETE|DESC|DESCENDING|DETACH|DISTINCT|DO|DROP|ELSE|END|ENDS|EXISTS|FOR|FOREACH|IN|INDEX|IS|JOIN|KEY|LIMIT|LOAD|MANDATORY|MATCH|MERGE|NODE|NOT|OF|ON|OPTIONAL|OR|ORDER(?=\s+BY)|PERIODIC|REMOVE|REQUIRE|RETURN|SCALAR|SCAN|SET|SKIP|START|STARTS|THEN|UNION|UNIQUE|UNWIND|USING|WHEN|WHERE|WITH|XOR|YIELD)\b/i,function:/\b\w+\b(?=\s*\()/,boolean:/\b(?:false|null|true)\b/i,number:/\b(?:0x[\da-fA-F]+|\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)\b/,operator:/:|<--?|--?>?|<>|=~?|[<>]=?|[+*/%^|]|\.\.\.?/,punctuation:/[()[\]{},;.]/}}We.displayName=`d`,We.aliases=[];function We(e){e.register(S),e.languages.d=e.languages.extend(`clike`,{comment:[{pattern:/^\s*#!.+/,greedy:!0},{pattern:RegExp(`(^|[^\\\\])(?:`+[`\\/\\+(?:\\/\\+(?:[^+]|\\+(?!\\/))*\\+\\/|(?!\\/\\+)[\\s\\S])*?\\+\\/`,`\\/\\/.*`,`\\/\\*[\\s\\S]*?\\*\\/`].join(`|`)+`)`),lookbehind:!0,greedy:!0}],string:[{pattern:RegExp([`\\b[rx]"(?:\\\\[\\s\\S]|[^\\\\"])*"[cwd]?`,`\\bq"(?:\\[[\\s\\S]*?\\]|\\([\\s\\S]*?\\)|<[\\s\\S]*?>|\\{[\\s\\S]*?\\})"`,`\\bq"((?!\\d)\\w+)$[\\s\\S]*?^\\1"`,`\\bq"(.)[\\s\\S]*?\\2"`,'(["`])(?:\\\\[\\s\\S]|(?!\\3)[^\\\\])*\\3[cwd]?'].join(`|`),`m`),greedy:!0},{pattern:/\bq\{(?:\{[^{}]*\}|[^{}])*\}/,greedy:!0,alias:`token-string`}],keyword:/\$|\b(?:__(?:(?:DATE|EOF|FILE|FUNCTION|LINE|MODULE|PRETTY_FUNCTION|TIMESTAMP|TIME|VENDOR|VERSION)__|gshared|parameters|traits|vector)|abstract|alias|align|asm|assert|auto|body|bool|break|byte|case|cast|catch|cdouble|cent|cfloat|char|class|const|continue|creal|dchar|debug|default|delegate|delete|deprecated|do|double|dstring|else|enum|export|extern|false|final|finally|float|for|foreach|foreach_reverse|function|goto|idouble|if|ifloat|immutable|import|inout|int|interface|invariant|ireal|lazy|long|macro|mixin|module|new|nothrow|null|out|override|package|pragma|private|protected|ptrdiff_t|public|pure|real|ref|return|scope|shared|short|size_t|static|string|struct|super|switch|synchronized|template|this|throw|true|try|typedef|typeid|typeof|ubyte|ucent|uint|ulong|union|unittest|ushort|version|void|volatile|wchar|while|with|wstring)\b/,number:[/\b0x\.?[a-f\d_]+(?:(?!\.\.)\.[a-f\d_]*)?(?:p[+-]?[a-f\d_]+)?[ulfi]{0,4}/i,{pattern:/((?:\.\.)?)(?:\b0b\.?|\b|\.)\d[\d_]*(?:(?!\.\.)\.[\d_]*)?(?:e[+-]?\d[\d_]*)?[ulfi]{0,4}/i,lookbehind:!0}],operator:/\|[|=]?|&[&=]?|\+[+=]?|-[-=]?|\.?\.\.|=[>=]?|!(?:i[ns]\b|<>?=?|>=?|=)?|\bi[ns]\b|(?:<[<>]?|>>?>?|\^\^|[*\/%^~])=?/}),e.languages.insertBefore(`d`,`string`,{char:/'(?:\\(?:\W|\w+)|[^\\])'/}),e.languages.insertBefore(`d`,`keyword`,{property:/\B@\w*/}),e.languages.insertBefore(`d`,`function`,{register:{pattern:/\b(?:[ABCD][LHX]|E?(?:BP|DI|SI|SP)|[BS]PL|[ECSDGF]S|CR[0234]|[DS]IL|DR[012367]|E[ABCD]X|X?MM[0-7]|R(?:1[0-5]|[89])[BWD]?|R[ABCD]X|R[BS]P|R[DS]I|TR[3-7]|XMM(?:1[0-5]|[89])|YMM(?:1[0-5]|\d))\b|\bST(?:\([0-7]\)|\b)/,alias:`variable`}})}Ge.displayName=`dart`,Ge.aliases=[];function Ge(e){e.register(S),(function(e){var t=[/\b(?:async|sync|yield)\*/,/\b(?:abstract|assert|async|await|break|case|catch|class|const|continue|covariant|default|deferred|do|dynamic|else|enum|export|extends|extension|external|factory|final|finally|for|get|hide|if|implements|import|in|interface|library|mixin|new|null|on|operator|part|rethrow|return|set|show|static|super|switch|sync|this|throw|try|typedef|var|void|while|with|yield)\b/],n=`(^|[^\\w.])(?:[a-z]\\w*\\s*\\.\\s*)*(?:[A-Z]\\w*\\s*\\.\\s*)*`,r={pattern:RegExp(n+`[A-Z](?:[\\d_A-Z]*[a-z]\\w*)?\\b`),lookbehind:!0,inside:{namespace:{pattern:/^[a-z]\w*(?:\s*\.\s*[a-z]\w*)*(?:\s*\.)?/,inside:{punctuation:/\./}}}};e.languages.dart=e.languages.extend(`clike`,{"class-name":[r,{pattern:RegExp(n+`[A-Z]\\w*(?=\\s+\\w+\\s*[;,=()])`),lookbehind:!0,inside:r.inside}],keyword:t,operator:/\bis!|\b(?:as|is)\b|\+\+|--|&&|\|\||<<=?|>>=?|~(?:\/=?)?|[+\-*\/%&^|=!<>]=?|\?/}),e.languages.insertBefore(`dart`,`string`,{"string-literal":{pattern:/r?(?:("""|''')[\s\S]*?\1|(["'])(?:\\.|(?!\2)[^\\\r\n])*\2(?!\2))/,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$(?:\w+|\{(?:[^{}]|\{[^{}]*\})*\})/,lookbehind:!0,inside:{punctuation:/^\$\{?|\}$/,expression:{pattern:/[\s\S]+/,inside:e.languages.dart}}},string:/[\s\S]+/}},string:void 0}),e.languages.insertBefore(`dart`,`class-name`,{metadata:{pattern:/@\w+/,alias:`function`}}),e.languages.insertBefore(`dart`,`class-name`,{generics:{pattern:/<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<[\w\s,.&?]*>)*>)*>)*>/,inside:{"class-name":r,keyword:t,punctuation:/[<>(),.:]/,operator:/[?&|]/}}})})(e)}Ke.displayName=`dataweave`,Ke.aliases=[];function Ke(e){(function(e){e.languages.dataweave={url:/\b[A-Za-z]+:\/\/[\w/:.?=&-]+|\burn:[\w:.?=&-]+/,property:{pattern:/(?:\b\w+#)?(?:"(?:\\.|[^\\"\r\n])*"|\b\w+)(?=\s*[:@])/,greedy:!0},string:{pattern:/(["'`])(?:\\[\s\S]|(?!\1)[^\\])*\1/,greedy:!0},"mime-type":/\b(?:application|audio|image|multipart|text|video)\/[\w+-]+/,date:{pattern:/\|[\w:+-]+\|/,greedy:!0},comment:[{pattern:/(^|[^\\])\/\*[\s\S]*?(?:\*\/|$)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],regex:{pattern:/\/(?:[^\\\/\r\n]|\\[^\r\n])+\//,greedy:!0},keyword:/\b(?:and|as|at|case|do|else|fun|if|input|is|match|not|ns|null|or|output|type|unless|update|using|var)\b/,function:/\b[A-Z_]\w*(?=\s*\()/i,number:/-?\b\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,punctuation:/[{}[\];(),.:@]/,operator:/<<|>>|->|[<>~=]=?|!=|--?-?|\+\+?|!|\?/,boolean:/\b(?:false|true)\b/}})(e)}qe.displayName=`dax`,qe.aliases=[];function qe(e){e.languages.dax={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/).*)/,lookbehind:!0},"data-field":{pattern:/'(?:[^']|'')*'(?!')(?:\[[ \w\xA0-\uFFFF]+\])?|\w+\[[ \w\xA0-\uFFFF]+\]/,alias:`symbol`},measure:{pattern:/\[[ \w\xA0-\uFFFF]+\]/,alias:`constant`},string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},function:/\b(?:ABS|ACOS|ACOSH|ACOT|ACOTH|ADDCOLUMNS|ADDMISSINGITEMS|ALL|ALLCROSSFILTERED|ALLEXCEPT|ALLNOBLANKROW|ALLSELECTED|AND|APPROXIMATEDISTINCTCOUNT|ASIN|ASINH|ATAN|ATANH|AVERAGE|AVERAGEA|AVERAGEX|BETA\.DIST|BETA\.INV|BLANK|CALCULATE|CALCULATETABLE|CALENDAR|CALENDARAUTO|CEILING|CHISQ\.DIST|CHISQ\.DIST\.RT|CHISQ\.INV|CHISQ\.INV\.RT|CLOSINGBALANCEMONTH|CLOSINGBALANCEQUARTER|CLOSINGBALANCEYEAR|COALESCE|COMBIN|COMBINA|COMBINEVALUES|CONCATENATE|CONCATENATEX|CONFIDENCE\.NORM|CONFIDENCE\.T|CONTAINS|CONTAINSROW|CONTAINSSTRING|CONTAINSSTRINGEXACT|CONVERT|COS|COSH|COT|COTH|COUNT|COUNTA|COUNTAX|COUNTBLANK|COUNTROWS|COUNTX|CROSSFILTER|CROSSJOIN|CURRENCY|CURRENTGROUP|CUSTOMDATA|DATATABLE|DATE|DATEADD|DATEDIFF|DATESBETWEEN|DATESINPERIOD|DATESMTD|DATESQTD|DATESYTD|DATEVALUE|DAY|DEGREES|DETAILROWS|DISTINCT|DISTINCTCOUNT|DISTINCTCOUNTNOBLANK|DIVIDE|EARLIER|EARLIEST|EDATE|ENDOFMONTH|ENDOFQUARTER|ENDOFYEAR|EOMONTH|ERROR|EVEN|EXACT|EXCEPT|EXP|EXPON\.DIST|FACT|FALSE|FILTER|FILTERS|FIND|FIRSTDATE|FIRSTNONBLANK|FIRSTNONBLANKVALUE|FIXED|FLOOR|FORMAT|GCD|GENERATE|GENERATEALL|GENERATESERIES|GEOMEAN|GEOMEANX|GROUPBY|HASONEFILTER|HASONEVALUE|HOUR|IF|IF\.EAGER|IFERROR|IGNORE|INT|INTERSECT|ISBLANK|ISCROSSFILTERED|ISEMPTY|ISERROR|ISEVEN|ISFILTERED|ISINSCOPE|ISLOGICAL|ISNONTEXT|ISNUMBER|ISO\.CEILING|ISODD|ISONORAFTER|ISSELECTEDMEASURE|ISSUBTOTAL|ISTEXT|KEEPFILTERS|KEYWORDMATCH|LASTDATE|LASTNONBLANK|LASTNONBLANKVALUE|LCM|LEFT|LEN|LN|LOG|LOG10|LOOKUPVALUE|LOWER|MAX|MAXA|MAXX|MEDIAN|MEDIANX|MID|MIN|MINA|MINUTE|MINX|MOD|MONTH|MROUND|NATURALINNERJOIN|NATURALLEFTOUTERJOIN|NEXTDAY|NEXTMONTH|NEXTQUARTER|NEXTYEAR|NONVISUAL|NORM\.DIST|NORM\.INV|NORM\.S\.DIST|NORM\.S\.INV|NOT|NOW|ODD|OPENINGBALANCEMONTH|OPENINGBALANCEQUARTER|OPENINGBALANCEYEAR|OR|PARALLELPERIOD|PATH|PATHCONTAINS|PATHITEM|PATHITEMREVERSE|PATHLENGTH|PERCENTILE\.EXC|PERCENTILE\.INC|PERCENTILEX\.EXC|PERCENTILEX\.INC|PERMUT|PI|POISSON\.DIST|POWER|PREVIOUSDAY|PREVIOUSMONTH|PREVIOUSQUARTER|PREVIOUSYEAR|PRODUCT|PRODUCTX|QUARTER|QUOTIENT|RADIANS|RAND|RANDBETWEEN|RANK\.EQ|RANKX|RELATED|RELATEDTABLE|REMOVEFILTERS|REPLACE|REPT|RIGHT|ROLLUP|ROLLUPADDISSUBTOTAL|ROLLUPGROUP|ROLLUPISSUBTOTAL|ROUND|ROUNDDOWN|ROUNDUP|ROW|SAMEPERIODLASTYEAR|SAMPLE|SEARCH|SECOND|SELECTCOLUMNS|SELECTEDMEASURE|SELECTEDMEASUREFORMATSTRING|SELECTEDMEASURENAME|SELECTEDVALUE|SIGN|SIN|SINH|SQRT|SQRTPI|STARTOFMONTH|STARTOFQUARTER|STARTOFYEAR|STDEV\.P|STDEV\.S|STDEVX\.P|STDEVX\.S|SUBSTITUTE|SUBSTITUTEWITHINDEX|SUM|SUMMARIZE|SUMMARIZECOLUMNS|SUMX|SWITCH|T\.DIST|T\.DIST\.2T|T\.DIST\.RT|T\.INV|T\.INV\.2T|TAN|TANH|TIME|TIMEVALUE|TODAY|TOPN|TOPNPERLEVEL|TOPNSKIP|TOTALMTD|TOTALQTD|TOTALYTD|TREATAS|TRIM|TRUE|TRUNC|UNICHAR|UNICODE|UNION|UPPER|USERELATIONSHIP|USERNAME|USEROBJECTID|USERPRINCIPALNAME|UTCNOW|UTCTODAY|VALUE|VALUES|VAR\.P|VAR\.S|VARX\.P|VARX\.S|WEEKDAY|WEEKNUM|XIRR|XNPV|YEAR|YEARFRAC)(?=\s*\()/i,keyword:/\b(?:DEFINE|EVALUATE|MEASURE|ORDER\s+BY|RETURN|VAR|START\s+AT|ASC|DESC)\b/i,boolean:{pattern:/\b(?:FALSE|NULL|TRUE)\b/i,alias:`constant`},number:/\b\d+(?:\.\d*)?|\B\.\d+\b/,operator:/:=|[-+*\/=^]|&&?|\|\||<(?:=>?|<|>)?|>[>=]?|\b(?:IN|NOT)\b/i,punctuation:/[;\[\](){}`,.]/}}Je.displayName=`dhall`,Je.aliases=[];function Je(e){e.languages.dhall={comment:/--.*|\{-(?:[^-{]|-(?!\})|\{(?!-)|\{-(?:[^-{]|-(?!\})|\{(?!-))*-\})*-\}/,string:{pattern:/"(?:[^"\\]|\\.)*"|''(?:[^']|'(?!')|'''|''\$\{)*''(?!'|\$)/,greedy:!0,inside:{interpolation:{pattern:/\$\{[^{}]*\}/,inside:{expression:{pattern:/(^\$\{)[\s\S]+(?=\}$)/,lookbehind:!0,alias:`language-dhall`,inside:null},punctuation:/\$\{|\}/}}}},label:{pattern:/`[^`]*`/,greedy:!0},url:{pattern:/\bhttps?:\/\/[\w.:%!$&'*+;=@~-]+(?:\/[\w.:%!$&'*+;=@~-]*)*(?:\?[/?\w.:%!$&'*+;=@~-]*)?/,greedy:!0},env:{pattern:/\benv:(?:(?!\d)\w+|"(?:[^"\\=]|\\.)*")/,greedy:!0,inside:{function:/^env/,operator:/^:/,variable:/[\s\S]+/}},hash:{pattern:/\bsha256:[\da-fA-F]{64}\b/,inside:{function:/sha256/,operator:/:/,number:/[\da-fA-F]{64}/}},keyword:/\b(?:as|assert|else|forall|if|in|let|merge|missing|then|toMap|using|with)\b|\u2200/,builtin:/\b(?:None|Some)\b/,boolean:/\b(?:False|True)\b/,number:/\bNaN\b|-?\bInfinity\b|[+-]?\b(?:0x[\da-fA-F]+|\d+(?:\.\d+)?(?:e[+-]?\d+)?)\b/,operator:/\/\\|\/\/\\\\|&&|\|\||===|[!=]=|\/\/|->|\+\+|::|[+*#@=:?<>|\\\u2227\u2a53\u2261\u2afd\u03bb\u2192]/,punctuation:/\.\.|[{}\[\](),./]/,"class-name":/\b[A-Z]\w*\b/},e.languages.dhall.string.inside.interpolation.inside.expression.inside=e.languages.dhall}Ye.displayName=`diff`,Ye.aliases=[];function Ye(e){(function(e){e.languages.diff={coord:[/^(?:\*{3}|-{3}|\+{3}).*$/m,/^@@.*@@$/m,/^\d.*$/m]};var t={"deleted-sign":`-`,"deleted-arrow":`<`,"inserted-sign":`+`,"inserted-arrow":`>`,unchanged:` `,diff:`!`};Object.keys(t).forEach(function(n){var r=t[n],i=[];/^\w+$/.test(n)||i.push(/\w+/.exec(n)[0]),n===`diff`&&i.push(`bold`),e.languages.diff[n]={pattern:RegExp(`^(?:[`+r+`].*(?:\r
?|
|(?![\\s\\S])))+`,`m`),alias:i,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(n)[0]}}}}),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})})(e)}U.displayName=`markup-templating`,U.aliases=[];function U(e){e.register(B),(function(e){function t(e,t){return`___`+e.toUpperCase()+t+`___`}Object.defineProperties(e.languages[`markup-templating`]={},{buildPlaceholders:{value:function(n,r,i,a){if(n.language===r){var o=n.tokenStack=[];n.code=n.code.replace(i,function(e){if(typeof a==`function`&&!a(e))return e;for(var i=o.length,s;n.code.indexOf(s=t(r,i))!==-1;)++i;return o[i]=e,s}),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language!==r||!n.tokenStack)return;n.grammar=e.languages[r];var i=0,a=Object.keys(n.tokenStack);function o(s){for(var c=0;c=a.length);c++){var l=s[c];if(typeof l==`string`||l.content&&typeof l.content==`string`){var u=a[i],d=n.tokenStack[u],f=typeof l==`string`?l:l.content,p=t(r,u),m=f.indexOf(p);if(m>-1){++i;var h=f.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),`language-`+r,d),_=f.substring(m+p.length),v=[];h&&v.push.apply(v,o([h])),v.push(g),_&&v.push.apply(v,o([_])),typeof l==`string`?s.splice.apply(s,[c,1].concat(v)):l.content=v}}else l.content&&o(l.content)}return s}o(n.tokens)}}})})(e)}Xe.displayName=`django`,Xe.aliases=[`jinja2`];function Xe(e){e.register(U),(function(e){e.languages.django={comment:/^\{#[\s\S]*?#\}$/,tag:{pattern:/(^\{%[+-]?\s*)\w+/,lookbehind:!0,alias:`keyword`},delimiter:{pattern:/^\{[{%][+-]?|[+-]?[}%]\}$/,alias:`punctuation`},string:{pattern:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,greedy:!0},filter:{pattern:/(\|)\w+/,lookbehind:!0,alias:`function`},test:{pattern:/(\bis\s+(?:not\s+)?)(?!not\b)\w+/,lookbehind:!0,alias:`function`},function:/\b[a-z_]\w+(?=\s*\()/i,keyword:/\b(?:and|as|by|else|for|if|import|in|is|loop|not|or|recursive|with|without)\b/,operator:/[-+%=]=?|!=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,number:/\b\d+(?:\.\d+)?\b/,boolean:/[Ff]alse|[Nn]one|[Tt]rue/,variable:/\b\w+\b/,punctuation:/[{}[\](),.:;]/};var t=/\{\{[\s\S]*?\}\}|\{%[\s\S]*?%\}|\{#[\s\S]*?#\}/g,n=e.languages[`markup-templating`];e.hooks.add(`before-tokenize`,function(e){n.buildPlaceholders(e,`django`,t)}),e.hooks.add(`after-tokenize`,function(e){n.tokenizePlaceholders(e,`django`)}),e.languages.jinja2=e.languages.django,e.hooks.add(`before-tokenize`,function(e){n.buildPlaceholders(e,`jinja2`,t)}),e.hooks.add(`after-tokenize`,function(e){n.tokenizePlaceholders(e,`jinja2`)})})(e)}Ze.displayName=`dns-zone-file`,Ze.aliases=[`dns-zone`];function Ze(e){e.languages[`dns-zone-file`]={comment:/;.*/,string:{pattern:/"(?:\\.|[^"\\\r\n])*"/,greedy:!0},variable:[{pattern:/(^\$ORIGIN[ \t]+)\S+/m,lookbehind:!0},{pattern:/(^|\s)@(?=\s|$)/,lookbehind:!0}],keyword:/^\$(?:INCLUDE|ORIGIN|TTL)(?=\s|$)/m,class:{pattern:/(^|\s)(?:CH|CS|HS|IN)(?=\s|$)/,lookbehind:!0,alias:`keyword`},type:{pattern:/(^|\s)(?:A|A6|AAAA|AFSDB|APL|ATMA|CAA|CDNSKEY|CDS|CERT|CNAME|DHCID|DLV|DNAME|DNSKEY|DS|EID|GID|GPOS|HINFO|HIP|IPSECKEY|ISDN|KEY|KX|LOC|MAILA|MAILB|MB|MD|MF|MG|MINFO|MR|MX|NAPTR|NB|NBSTAT|NIMLOC|NINFO|NS|NSAP|NSAP-PTR|NSEC|NSEC3|NSEC3PARAM|NULL|NXT|OPENPGPKEY|PTR|PX|RKEY|RP|RRSIG|RT|SIG|SINK|SMIMEA|SOA|SPF|SRV|SSHFP|TA|TKEY|TLSA|TSIG|TXT|UID|UINFO|UNSPEC|URI|WKS|X25)(?=\s|$)/,lookbehind:!0,alias:`keyword`},punctuation:/[()]/},e.languages[`dns-zone`]=e.languages[`dns-zone-file`]}Qe.displayName=`docker`,Qe.aliases=[`dockerfile`];function Qe(e){(function(e){var t=`\\\\[\\r\\n](?:\\s|\\\\[\\r\\n]|#.*(?!.))*(?![\\s#]|\\\\[\\r\\n])`,n=`(?:[ \\t]+(?![ \\t])(?:)?|)`.replace(//g,function(){return t}),r=`"(?:[^"\\\\\\r\\n]|\\\\(?:\\r\\n|[\\s\\S]))*"|'(?:[^'\\\\\\r\\n]|\\\\(?:\\r\\n|[\\s\\S]))*'`,i=`--[\\w-]+=(?:|(?!["'])(?:[^\\s\\\\]|\\\\.)+)`.replace(//g,function(){return r}),a={pattern:RegExp(r),greedy:!0},o={pattern:/(^[ \t]*)#.*/m,lookbehind:!0,greedy:!0};function s(e,t){return e=e.replace(//g,function(){return i}).replace(//g,function(){return n}),RegExp(e,t)}e.languages.docker={instruction:{pattern:/(^[ \t]*)(?:ADD|ARG|CMD|COPY|ENTRYPOINT|ENV|EXPOSE|FROM|HEALTHCHECK|LABEL|MAINTAINER|ONBUILD|RUN|SHELL|STOPSIGNAL|USER|VOLUME|WORKDIR)(?=\s)(?:\\.|[^\r\n\\])*(?:\\$(?:\s|#.*$)*(?![\s#])(?:\\.|[^\r\n\\])*)*/im,lookbehind:!0,greedy:!0,inside:{options:{pattern:s(`(^(?:ONBUILD)?\\w+)(?:)*`,`i`),lookbehind:!0,greedy:!0,inside:{property:{pattern:/(^|\s)--[\w-]+/,lookbehind:!0},string:[a,{pattern:/(=)(?!["'])(?:[^\s\\]|\\.)+/,lookbehind:!0}],operator:/\\$/m,punctuation:/=/}},keyword:[{pattern:s(`(^(?:ONBUILD)?HEALTHCHECK(?:)*)(?:CMD|NONE)\\b`,`i`),lookbehind:!0,greedy:!0},{pattern:s(`(^(?:ONBUILD)?FROM(?:)*(?!--)[^ \\t\\\\]+)AS`,`i`),lookbehind:!0,greedy:!0},{pattern:s(`(^ONBUILD)\\w+`,`i`),lookbehind:!0,greedy:!0},{pattern:/^\w+/,greedy:!0}],comment:o,string:a,variable:/\$(?:\w+|\{[^{}"'\\]*\})/,operator:/\\$/m}},comment:o},e.languages.dockerfile=e.languages.docker})(e)}$e.displayName=`dot`,$e.aliases=[`gv`];function $e(e){(function(e){var t=`(?:`+[`[a-zA-Z_\\x80-\\uFFFF][\\w\\x80-\\uFFFF]*`,`-?(?:\\.\\d+|\\d+(?:\\.\\d*)?)`,`"[^"\\\\]*(?:\\\\[\\s\\S][^"\\\\]*)*"`,`<(?:[^<>]|(?!)*>`].join(`|`)+`)`,n={markup:{pattern:/(^<)[\s\S]+(?=>$)/,lookbehind:!0,alias:[`language-markup`,`language-html`,`language-xml`],inside:e.languages.markup}};function r(e,n){return RegExp(e.replace(//g,function(){return t}),n)}e.languages.dot={comment:{pattern:/\/\/.*|\/\*[\s\S]*?\*\/|^#.*/m,greedy:!0},"graph-name":{pattern:r(`(\\b(?:digraph|graph|subgraph)[ \\t\\r\\n]+)`,`i`),lookbehind:!0,greedy:!0,alias:`class-name`,inside:n},"attr-value":{pattern:r(`(=[ \\t\\r\\n]*)`),lookbehind:!0,greedy:!0,inside:n},"attr-name":{pattern:r(`([\\[;, \\t\\r\\n])(?=[ \\t\\r\\n]*=)`),lookbehind:!0,greedy:!0,inside:n},keyword:/\b(?:digraph|edge|graph|node|strict|subgraph)\b/i,"compass-point":{pattern:/(:[ \t\r\n]*)(?:[ewc_]|[ns][ew]?)(?![\w\x80-\uFFFF])/,lookbehind:!0,alias:`builtin`},node:{pattern:r(`(^|[^-.\\w\\x80-\\uFFFF\\\\])`),lookbehind:!0,greedy:!0,inside:n},operator:/[=:]|-[->]/,punctuation:/[\[\]{};,]/},e.languages.gv=e.languages.dot})(e)}et.displayName=`ebnf`,et.aliases=[];function et(e){e.languages.ebnf={comment:/\(\*[\s\S]*?\*\)/,string:{pattern:/"[^"\r\n]*"|'[^'\r\n]*'/,greedy:!0},special:{pattern:/\?[^?\r\n]*\?/,greedy:!0,alias:`class-name`},definition:{pattern:/^([\t ]*)[a-z]\w*(?:[ \t]+[a-z]\w*)*(?=\s*=)/im,lookbehind:!0,alias:[`rule`,`keyword`]},rule:/\b[a-z]\w*(?:[ \t]+[a-z]\w*)*\b/i,punctuation:/\([:/]|[:/]\)|[.,;()[\]{}]/,operator:/[-=|*/!]/}}tt.displayName=`editorconfig`,tt.aliases=[];function tt(e){e.languages.editorconfig={comment:/[;#].*/,section:{pattern:/(^[ \t]*)\[.+\]/m,lookbehind:!0,alias:`selector`,inside:{regex:/\\\\[\[\]{},!?.*]/,operator:/[!?]|\.\.|\*{1,2}/,punctuation:/[\[\]{},]/}},key:{pattern:/(^[ \t]*)[^\s=]+(?=[ \t]*=)/m,lookbehind:!0,alias:`attr-name`},value:{pattern:/=.*/,alias:`attr-value`,inside:{punctuation:/^=/}}}}nt.displayName=`eiffel`,nt.aliases=[];function nt(e){e.languages.eiffel={comment:/--.*/,string:[{pattern:/"([^[]*)\[[\s\S]*?\]\1"/,greedy:!0},{pattern:/"([^{]*)\{[\s\S]*?\}\1"/,greedy:!0},{pattern:/"(?:%(?:(?!\n)\s)*\n\s*%|%\S|[^%"\r\n])*"/,greedy:!0}],char:/'(?:%.|[^%'\r\n])+'/,keyword:/\b(?:across|agent|alias|all|and|as|assign|attached|attribute|check|class|convert|create|Current|debug|deferred|detachable|do|else|elseif|end|ensure|expanded|export|external|feature|from|frozen|if|implies|inherit|inspect|invariant|like|local|loop|not|note|obsolete|old|once|or|Precursor|redefine|rename|require|rescue|Result|retry|select|separate|some|then|undefine|until|variant|Void|when|xor)\b/i,boolean:/\b(?:False|True)\b/i,"class-name":/\b[A-Z][\dA-Z_]*\b/,number:[/\b0[xcb][\da-f](?:_*[\da-f])*\b/i,/(?:\b\d(?:_*\d)*)?\.(?:(?:\d(?:_*\d)*)?e[+-]?)?\d(?:_*\d)*\b|\b\d(?:_*\d)*\b\.?/i],punctuation:/:=|<<|>>|\(\||\|\)|->|\.(?=\w)|[{}[\];(),:?]/,operator:/\\\\|\|\.\.\||\.\.|\/[~\/=]?|[><]=?|[-+*^=~]/}}rt.displayName=`ejs`,rt.aliases=[`eta`];function rt(e){e.register(C),e.register(U),(function(e){e.languages.ejs={delimiter:{pattern:/^<%[-_=]?|[-_]?%>$/,alias:`punctuation`},comment:/^#[\s\S]*/,"language-javascript":{pattern:/[\s\S]+/,inside:e.languages.javascript}},e.hooks.add(`before-tokenize`,function(t){e.languages[`markup-templating`].buildPlaceholders(t,`ejs`,/<%(?!%)[\s\S]+?%>/g)}),e.hooks.add(`after-tokenize`,function(t){e.languages[`markup-templating`].tokenizePlaceholders(t,`ejs`)}),e.languages.eta=e.languages.ejs})(e)}it.displayName=`elixir`,it.aliases=[];function it(e){e.languages.elixir={doc:{pattern:/@(?:doc|moduledoc)\s+(?:("""|''')[\s\S]*?\1|("|')(?:\\(?:\r\n|[\s\S])|(?!\2)[^\\\r\n])*\2)/,inside:{attribute:/^@\w+/,string:/['"][\s\S]+/}},comment:{pattern:/#.*/,greedy:!0},regex:{pattern:/~[rR](?:("""|''')(?:\\[\s\S]|(?!\1)[^\\])+\1|([\/|"'])(?:\\.|(?!\2)[^\\\r\n])+\2|\((?:\\.|[^\\)\r\n])+\)|\[(?:\\.|[^\\\]\r\n])+\]|\{(?:\\.|[^\\}\r\n])+\}|<(?:\\.|[^\\>\r\n])+>)[uismxfr]*/,greedy:!0},string:[{pattern:/~[cCsSwW](?:("""|''')(?:\\[\s\S]|(?!\1)[^\\])+\1|([\/|"'])(?:\\.|(?!\2)[^\\\r\n])+\2|\((?:\\.|[^\\)\r\n])+\)|\[(?:\\.|[^\\\]\r\n])+\]|\{(?:\\.|#\{[^}]+\}|#(?!\{)|[^#\\}\r\n])+\}|<(?:\\.|[^\\>\r\n])+>)[csa]?/,greedy:!0,inside:{}},{pattern:/("""|''')[\s\S]*?\1/,greedy:!0,inside:{}},{pattern:/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0,inside:{}}],atom:{pattern:/(^|[^:]):\w+/,lookbehind:!0,alias:`symbol`},module:{pattern:/\b[A-Z]\w*\b/,alias:`class-name`},"attr-name":/\b\w+\??:(?!:)/,argument:{pattern:/(^|[^&])&\d+/,lookbehind:!0,alias:`variable`},attribute:{pattern:/@\w+/,alias:`variable`},function:/\b[_a-zA-Z]\w*[?!]?(?:(?=\s*(?:\.\s*)?\()|(?=\/\d))/,number:/\b(?:0[box][a-f\d_]+|\d[\d_]*)(?:\.[\d_]+)?(?:e[+-]?[\d_]+)?\b/i,keyword:/\b(?:after|alias|and|case|catch|cond|def(?:callback|delegate|exception|impl|macro|module|n|np|p|protocol|struct)?|do|else|end|fn|for|if|import|not|or|quote|raise|require|rescue|try|unless|unquote|use|when)\b/,boolean:/\b(?:false|nil|true)\b/,operator:[/\bin\b|&&?|\|[|>]?|\\\\|::|\.\.\.?|\+\+?|-[->]?|<[-=>]|>=|!==?|\B!|=(?:==?|[>~])?|[*\/^]/,{pattern:/([^<])<(?!<)/,lookbehind:!0},{pattern:/([^>])>(?!>)/,lookbehind:!0}],punctuation:/<<|>>|[.,%\[\]{}()]/},e.languages.elixir.string.forEach(function(t){t.inside={interpolation:{pattern:/#\{[^}]+\}/,inside:{delimiter:{pattern:/^#\{|\}$/,alias:`punctuation`},rest:e.languages.elixir}}}})}at.displayName=`elm`,at.aliases=[];function at(e){e.languages.elm={comment:/--.*|\{-[\s\S]*?-\}/,char:{pattern:/'(?:[^\\'\r\n]|\\(?:[abfnrtv\\']|\d+|x[0-9a-fA-F]+|u\{[0-9a-fA-F]+\}))'/,greedy:!0},string:[{pattern:/"""[\s\S]*?"""/,greedy:!0},{pattern:/"(?:[^\\"\r\n]|\\.)*"/,greedy:!0}],"import-statement":{pattern:/(^[\t ]*)import\s+[A-Z]\w*(?:\.[A-Z]\w*)*(?:\s+as\s+(?:[A-Z]\w*)(?:\.[A-Z]\w*)*)?(?:\s+exposing\s+)?/m,lookbehind:!0,inside:{keyword:/\b(?:as|exposing|import)\b/}},keyword:/\b(?:alias|as|case|else|exposing|if|in|infixl|infixr|let|module|of|then|type)\b/,builtin:/\b(?:abs|acos|always|asin|atan|atan2|ceiling|clamp|compare|cos|curry|degrees|e|flip|floor|fromPolar|identity|isInfinite|isNaN|logBase|max|min|negate|never|not|pi|radians|rem|round|sin|sqrt|tan|toFloat|toPolar|toString|truncate|turns|uncurry|xor)\b/,number:/\b(?:\d+(?:\.\d+)?(?:e[+-]?\d+)?|0x[0-9a-f]+)\b/i,operator:/\s\.\s|[+\-/*=.$<>:&|^?%#@~!]{2,}|[+\-/*=$<>:&|^?%#@~!]/,hvariable:/\b(?:[A-Z]\w*\.)*[a-z]\w*\b/,constant:/\b(?:[A-Z]\w*\.)*[A-Z]\w*\b/,punctuation:/[{}[\]|(),.:]/}}ot.displayName=`erb`,ot.aliases=[];function ot(e){e.register(U),e.register(V),(function(e){e.languages.erb={delimiter:{pattern:/^(\s*)<%=?|%>(?=\s*$)/,lookbehind:!0,alias:`punctuation`},ruby:{pattern:/\s*\S[\s\S]*/,alias:`language-ruby`,inside:e.languages.ruby}},e.hooks.add(`before-tokenize`,function(t){e.languages[`markup-templating`].buildPlaceholders(t,`erb`,/<%=?(?:[^\r\n]|[\r\n](?!=begin)|[\r\n]=begin\s(?:[^\r\n]|[\r\n](?!=end))*[\r\n]=end)+?%>/g)}),e.hooks.add(`after-tokenize`,function(t){e.languages[`markup-templating`].tokenizePlaceholders(t,`erb`)})})(e)}st.displayName=`erlang`,st.aliases=[];function st(e){e.languages.erlang={comment:/%.+/,string:{pattern:/"(?:\\.|[^\\"\r\n])*"/,greedy:!0},"quoted-function":{pattern:/'(?:\\.|[^\\'\r\n])+'(?=\()/,alias:`function`},"quoted-atom":{pattern:/'(?:\\.|[^\\'\r\n])+'/,alias:`atom`},boolean:/\b(?:false|true)\b/,keyword:/\b(?:after|begin|case|catch|end|fun|if|of|receive|try|when)\b/,number:[/\$\\?./,/\b\d+#[a-z0-9]+/i,/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?/i],function:/\b[a-z][\w@]*(?=\()/,variable:{pattern:/(^|[^@])(?:\b|\?)[A-Z_][\w@]*/,lookbehind:!0},operator:[/[=\/<>:]=|=[:\/]=|\+\+?|--?|[=*\/!]|\b(?:and|andalso|band|bnot|bor|bsl|bsr|bxor|div|not|or|orelse|rem|xor)\b/,{pattern:/(^|[^<])<(?!<)/,lookbehind:!0},{pattern:/(^|[^>])>(?!>)/,lookbehind:!0}],atom:/\b[a-z][\w@]*/,punctuation:/[()[\]{}:;,.#|]|<<|>>/}}ct.displayName=`lua`,ct.aliases=[];function ct(e){e.languages.lua={comment:/^#!.+|--(?:\[(=*)\[[\s\S]*?\]\1\]|.*)/m,string:{pattern:/(["'])(?:(?!\1)[^\\\r\n]|\\z(?:\r\n|\s)|\\(?:\r\n|[^z]))*\1|\[(=*)\[[\s\S]*?\]\2\]/,greedy:!0},number:/\b0x[a-f\d]+(?:\.[a-f\d]*)?(?:p[+-]?\d+)?\b|\b\d+(?:\.\B|(?:\.\d*)?(?:e[+-]?\d+)?\b)|\B\.\d+(?:e[+-]?\d+)?\b/i,keyword:/\b(?:and|break|do|else|elseif|end|false|for|function|goto|if|in|local|nil|not|or|repeat|return|then|true|until|while)\b/,function:/(?!\d)\w+(?=\s*(?:[({]))/,operator:[/[-+*%^&|#]|\/\/?|<[<=]?|>[>=]?|[=~]=?/,{pattern:/(^|[^.])\.\.(?!\.)/,lookbehind:!0}],punctuation:/[\[\](){},;]|\.+|:+/}}lt.displayName=`etlua`,lt.aliases=[];function lt(e){e.register(ct),e.register(U),(function(e){e.languages.etlua={delimiter:{pattern:/^<%[-=]?|-?%>$/,alias:`punctuation`},"language-lua":{pattern:/[\s\S]+/,inside:e.languages.lua}},e.hooks.add(`before-tokenize`,function(t){e.languages[`markup-templating`].buildPlaceholders(t,`etlua`,/<%[\s\S]+?%>/g)}),e.hooks.add(`after-tokenize`,function(t){e.languages[`markup-templating`].tokenizePlaceholders(t,`etlua`)})})(e)}ut.displayName=`excel-formula`,ut.aliases=[`xls`,`xlsx`];function ut(e){e.languages[`excel-formula`]={comment:{pattern:/(\bN\(\s*)"(?:[^"]|"")*"(?=\s*\))/i,lookbehind:!0,greedy:!0},string:{pattern:/"(?:[^"]|"")*"(?!")/,greedy:!0},reference:{pattern:/(?:'[^']*'|(?:[^\s()[\]{}<>*?"';,$&]*\[[^^\s()[\]{}<>*?"']+\])?\w+)!/,greedy:!0,alias:`string`,inside:{operator:/!$/,punctuation:/'/,sheet:{pattern:/[^[\]]+$/,alias:`function`},file:{pattern:/\[[^[\]]+\]$/,inside:{punctuation:/[[\]]/}},path:/[\s\S]+/}},"function-name":{pattern:/\b[A-Z]\w*(?=\()/i,alias:`builtin`},range:{pattern:/\$?\b(?:[A-Z]+\$?\d+:\$?[A-Z]+\$?\d+|[A-Z]+:\$?[A-Z]+|\d+:\$?\d+)\b/i,alias:`selector`,inside:{operator:/:/,cell:/\$?[A-Z]+\$?\d+/i,column:/\$?[A-Z]+/i,row:/\$?\d+/}},cell:{pattern:/\b[A-Z]+\d+\b|\$[A-Za-z]+\$?\d+\b|\b[A-Za-z]+\$\d+\b/,alias:`selector`},number:/(?:\b\d+(?:\.\d+)?|\B\.\d+)(?:e[+-]?\d+)?\b/i,boolean:/\b(?:FALSE|TRUE)\b/i,operator:/[-+*/^%=&,]|<[=>]?|>=?/,punctuation:/[[\]();{}|]/},e.languages.xlsx=e.languages.xls=e.languages[`excel-formula`]}dt.displayName=`factor`,dt.aliases=[];function dt(e){(function(e){var t={function:/\b(?:BUGS?|FIX(?:MES?)?|NOTES?|TODOS?|XX+|HACKS?|WARN(?:ING)?|\?{2,}|!{2,})\b/},n={number:/\\[^\s']|%\w/},r={comment:[{pattern:/(^|\s)(?:! .*|!$)/,lookbehind:!0,inside:t},{pattern:/(^|\s)\/\*\s[\s\S]*?\*\/(?=\s|$)/,lookbehind:!0,greedy:!0,inside:t},{pattern:/(^|\s)!\[(={0,6})\[\s[\s\S]*?\]\2\](?=\s|$)/,lookbehind:!0,greedy:!0,inside:t}],number:[{pattern:/(^|\s)[+-]?\d+(?=\s|$)/,lookbehind:!0},{pattern:/(^|\s)[+-]?0(?:b[01]+|o[0-7]+|d\d+|x[\dA-F]+)(?=\s|$)/i,lookbehind:!0},{pattern:/(^|\s)[+-]?\d+\/\d+\.?(?=\s|$)/,lookbehind:!0},{pattern:/(^|\s)\+?\d+\+\d+\/\d+(?=\s|$)/,lookbehind:!0},{pattern:/(^|\s)-\d+-\d+\/\d+(?=\s|$)/,lookbehind:!0},{pattern:/(^|\s)[+-]?(?:\d*\.\d+|\d+\.\d*|\d+)(?:e[+-]?\d+)?(?=\s|$)/i,lookbehind:!0},{pattern:/(^|\s)NAN:\s+[\da-fA-F]+(?=\s|$)/,lookbehind:!0},{pattern:/(^|\s)[+-]?0(?:b1\.[01]*|o1\.[0-7]*|d1\.\d*|x1\.[\dA-F]*)p\d+(?=\s|$)/i,lookbehind:!0}],regexp:{pattern:/(^|\s)R\/\s(?:\\\S|[^\\/])*\/(?:[idmsr]*|[idmsr]+-[idmsr]+)(?=\s|$)/,lookbehind:!0,alias:`number`,inside:{variable:/\\\S/,keyword:/[+?*\[\]^$(){}.|]/,operator:{pattern:/(\/)[idmsr]+(?:-[idmsr]+)?/,lookbehind:!0}}},boolean:{pattern:/(^|\s)[tf](?=\s|$)/,lookbehind:!0},"custom-string":{pattern:/(^|\s)[A-Z0-9\-]+"\s(?:\\\S|[^"\\])*"/,lookbehind:!0,greedy:!0,alias:`string`,inside:{number:/\\\S|%\w|\//}},"multiline-string":[{pattern:/(^|\s)STRING:\s+\S+(?:\n|\r\n).*(?:\n|\r\n)\s*;(?=\s|$)/,lookbehind:!0,greedy:!0,alias:`string`,inside:{number:n.number,"semicolon-or-setlocal":{pattern:/([\r\n][ \t]*);(?=\s|$)/,lookbehind:!0,alias:`function`}}},{pattern:/(^|\s)HEREDOC:\s+\S+(?:\n|\r\n).*(?:\n|\r\n)\s*\S+(?=\s|$)/,lookbehind:!0,greedy:!0,alias:`string`,inside:n},{pattern:/(^|\s)\[(={0,6})\[\s[\s\S]*?\]\2\](?=\s|$)/,lookbehind:!0,greedy:!0,alias:`string`,inside:n}],"special-using":{pattern:/(^|\s)USING:(?:\s\S+)*(?=\s+;(?:\s|$))/,lookbehind:!0,alias:`function`,inside:{string:{pattern:/(\s)[^:\s]+/,lookbehind:!0}}},"stack-effect-delimiter":[{pattern:/(^|\s)(?:call|eval|execute)?\((?=\s)/,lookbehind:!0,alias:`operator`},{pattern:/(\s)--(?=\s)/,lookbehind:!0,alias:`operator`},{pattern:/(\s)\)(?=\s|$)/,lookbehind:!0,alias:`operator`}],combinators:{pattern:null,lookbehind:!0,alias:`keyword`},"kernel-builtin":{pattern:null,lookbehind:!0,alias:`variable`},"sequences-builtin":{pattern:null,lookbehind:!0,alias:`variable`},"math-builtin":{pattern:null,lookbehind:!0,alias:`variable`},"constructor-word":{pattern:/(^|\s)<(?!=+>|-+>)\S+>(?=\s|$)/,lookbehind:!0,alias:`keyword`},"other-builtin-syntax":{pattern:null,lookbehind:!0,alias:`operator`},"conventionally-named-word":{pattern:/(^|\s)(?!")(?:(?:change|new|set|with)-\S+|\$\S+|>[^>\s]+|[^:>\s]+>|[^>\s]+>[^>\s]+|\+[^+\s]+\+|[^?\s]+\?|\?[^?\s]+|[^>\s]+>>|>>[^>\s]+|[^<\s]+<<|\([^()\s]+\)|[^!\s]+!|[^*\s]\S*\*|[^.\s]\S*\.)(?=\s|$)/,lookbehind:!0,alias:`keyword`},"colon-syntax":{pattern:/(^|\s)(?:[A-Z0-9\-]+#?)?:{1,2}\s+(?:;\S+|(?!;)\S+)(?=\s|$)/,lookbehind:!0,greedy:!0,alias:`function`},"semicolon-or-setlocal":{pattern:/(\s)(?:;|:>)(?=\s|$)/,lookbehind:!0,alias:`function`},"curly-brace-literal-delimiter":[{pattern:/(^|\s)[a-z]*\{(?=\s)/i,lookbehind:!0,alias:`operator`},{pattern:/(\s)\}(?=\s|$)/,lookbehind:!0,alias:`operator`}],"quotation-delimiter":[{pattern:/(^|\s)\[(?=\s)/,lookbehind:!0,alias:`operator`},{pattern:/(\s)\](?=\s|$)/,lookbehind:!0,alias:`operator`}],"normal-word":{pattern:/(^|\s)[^"\s]\S*(?=\s|$)/,lookbehind:!0},string:{pattern:/"(?:\\\S|[^"\\])*"/,greedy:!0,inside:n}},i=function(e){return(e+``).replace(/([.?*+\^$\[\]\\(){}|\-])/g,`\\$1`)},a=function(e){return RegExp(`(^|\\s)(?:`+e.map(i).join(`|`)+`)(?=\\s|$)`)},o={"kernel-builtin":`or.2nipd.4drop.tuck.wrapper.nip.wrapper?.callstack>array.die.dupd.callstack.callstack?.3dup.hashcode.pick.4nip.build.>boolean.nipd.clone.5nip.eq?.?.=.swapd.2over.clear.2dup.get-retainstack.not.tuple?.dup.3nipd.call.-rotd.object.drop.assert=.assert?.-rot.execute.boa.get-callstack.curried?.3drop.pickd.overd.over.roll.3nip.swap.and.2nip.rotd.throw.(clone).hashcode*.spin.reach.4dup.equal?.get-datastack.assert.2drop..boolean?.identity-hashcode.identity-tuple?.null.composed?.new.5drop.rot.-roll.xor.identity-tuple.boolean`.split(`.`),"other-builtin-syntax":"=======.recursive.flushable.>>.<<<<<<.M\\.B.PRIVATE>.\\.======.final.inline.delimiter.deprecated.>>>>>.<<<<<<<.parse-complex.malformed-complex.read-only.>>>>>>>.call-next-method.<<.foldable.$.$[.${".split(`.`),"sequences-builtin":`member-eq?.mismatch.append.assert-sequence=.longer.repetition.clone-like.3sequence.assert-sequence?.last-index-from.reversed.index-from.cut*.pad-tail.join-as.remove-eq!.concat-as.but-last.snip.nths.nth.sequence.longest.slice?..remove-nth.tail-slice.empty?.tail*.member?.virtual-sequence?.set-length.drop-prefix.iota.unclip.bounds-error?.unclip-last-slice.non-negative-integer-expected.non-negative-integer-expected?.midpoint@.longer?.?set-nth.?first.rest-slice.prepend-as.prepend.fourth.sift.subseq-start.new-sequence.?last.like.first4.1sequence.reverse.slice.virtual@.repetition?.set-last.index.4sequence.max-length.set-second.immutable-sequence.first2.first3.supremum.unclip-slice.suffix!.insert-nth.tail.3append.short.suffix.concat.flip.immutable?.reverse!.2sequence.sum.delete-all.indices.snip-slice..check-slice.sequence?.head.append-as.halves.sequence=.collapse-slice.?second.slice-error?.product.bounds-check?.bounds-check.immutable.virtual-exemplar.harvest.remove.pad-head.last.set-fourth.cartesian-product.remove-eq.shorten.shorter.reversed?.shorter?.shortest.head-slice.pop*.tail-slice*.but-last-slice.iota?.append!.cut-slice.new-resizable.head-slice*.sequence-hashcode.pop.set-nth.?nth.second.join.immutable-sequence?..3append-as.virtual-sequence.subseq?.remove-nth!.length.last-index.lengthen.assert-sequence.copy.move.third.first.tail?.set-first.prefix.bounds-error..exchange.surround.cut.min-length.set-third.push-all.head?.subseq-start-from.delete-slice.rest.sum-lengths.head*.infimum.remove!.glue.slice-error.subseq.push.replace-slice.subseq-as.unclip-last`.split(`.`),"math-builtin":`number=.next-power-of-2.?1+.fp-special?.imaginary-part.float>bits.number?.fp-infinity?.bignum?.fp-snan?.denominator.gcd.*.+.fp-bitwise=.-.u>=./.>=.bitand.power-of-2?.log2-expects-positive.neg?.<.log2.>.integer?.number.bits>double.2/.zero?.bits>float.float?.shift.ratio?.rect>.even?.ratio.fp-sign.bitnot.>fixnum.complex?./i.integer>fixnum./f.sgn.>bignum.next-float.u<.u>.mod.recip.rational.>float.2^.integer.fixnum?.neg.fixnum.sq.bignum.>rect.bit?.fp-qnan?.simple-gcd.complex..real.>fraction.double>bits.bitor.rem.fp-nan-payload.real-part.log2-expects-positive?.prev-float.align.unordered?.float.fp-nan?.abs.bitxor.integer>fixnum-strict.u<=.odd?.<=./mod.>integer.real?.rational?.numerator`.split(`.`)};Object.keys(o).forEach(function(e){r[e].pattern=a(o[e])});var s=`2bi.while.2tri.bi*.4dip.both?.same?.tri@.curry.prepose.3bi.?if.tri*.2keep.3keep.curried.2keepd.when.2bi*.2tri*.4keep.bi@.keepdd.do.unless*.tri-curry.if*.loop.bi-curry*.when*.2bi@.2tri@.with.2with.either?.bi.until.3dip.3curry.tri-curry*.tri-curry@.bi-curry.keepd.compose.2dip.if.3tri.unless.tuple.keep.2curry.tri.most.while*.dip.composed.bi-curry@.find-last-from.trim-head-slice.map-as.each-from.none?.trim-tail.partition.if-empty.accumulate*.reject!.find-from.accumulate-as.collector-for-as.reject.map.map-sum.accumulate!.2each-from.follow.supremum-by.map!.unless-empty.collector.padding.reduce-index.replicate-as.infimum-by.trim-tail-slice.count.find-index.filter.accumulate*!.reject-as.map-integers.map-find.reduce.selector.interleave.2map.filter-as.binary-reduce.map-index-as.find.produce.filter!.replicate.cartesian-map.cartesian-each.find-index-from.map-find-last.3map-as.3map.find-last.selector-as.2map-as.2map-reduce.accumulate.each.each-index.accumulate*-as.when-empty.all?.collector-as.push-either.new-like.collector-for.2selector.push-if.2all?.map-reduce.3each.any?.trim-slice.2reduce.change-nth.produce-as.2each.trim.trim-head.cartesian-find.map-index.if-zero.each-integer.unless-zero.(find-integer).when-zero.find-last-integer.(all-integers?).times.(each-integer).find-integer.all-integers?.unless-negative.if-positive.when-positive.when-negative.unless-positive.if-negative.case.2cleave.cond>quot.case>quot.3cleave.wrong-values.to-fixed-point.alist>quot.cond.cleave.call-effect.recursive-hashcode.spread.deep-spread>quot.2||.0||.n||.0&&.2&&.3||.1||.1&&.n&&.3&&.smart-unless*.keep-inputs.reduce-outputs.smart-when*.cleave>array.smart-with.smart-apply.smart-if.inputs/outputs.output>sequence-n.map-outputs.map-reduce-outputs.dropping.output>array.smart-map-reduce.smart-2map-reduce.output>array-n.nullary.inputsequence`.split(`.`);r.combinators.pattern=a(s),e.languages.factor=r})(e)}ft.displayName=`false`,ft.aliases=[];function ft(e){(function(e){e.languages.false={comment:{pattern:/\{[^}]*\}/},string:{pattern:/"[^"]*"/,greedy:!0},"character-code":{pattern:/'(?:[^\r]|\r\n?)/,alias:`number`},"assembler-code":{pattern:/\d+`/,alias:`important`},number:/\d+/,operator:/[-!#$%&'*+,./:;=>?@\\^_`|~ßø]/,punctuation:/\[|\]/,variable:/[a-z]/,"non-standard":{pattern:/[()!=]=?|[-+*/%]|\b(?:in|is)\b/}),delete e.languages[`firestore-security-rules`][`class-name`],e.languages.insertBefore(`firestore-security-rules`,`keyword`,{path:{pattern:/(^|[\s(),])(?:\/(?:[\w\xA0-\uFFFF]+|\{[\w\xA0-\uFFFF]+(?:=\*\*)?\}|\$\([\w\xA0-\uFFFF.]+\)))+/,lookbehind:!0,greedy:!0,inside:{variable:{pattern:/\{[\w\xA0-\uFFFF]+(?:=\*\*)?\}|\$\([\w\xA0-\uFFFF.]+\)/,inside:{operator:/=/,keyword:/\*\*/,punctuation:/[.$(){}]/}},punctuation:/\//}},method:{pattern:/(\ballow\s+)[a-z]+(?:\s*,\s*[a-z]+)*(?=\s*[:;])/,lookbehind:!0,alias:`builtin`,inside:{punctuation:/,/}}})}mt.displayName=`flow`,mt.aliases=[];function mt(e){e.register(C),(function(e){e.languages.flow=e.languages.extend(`javascript`,{}),e.languages.insertBefore(`flow`,`keyword`,{type:[{pattern:/\b(?:[Bb]oolean|Function|[Nn]umber|[Ss]tring|[Ss]ymbol|any|mixed|null|void)\b/,alias:`class-name`}]}),e.languages.flow[`function-variable`].pattern=/(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*=\s*(?:function\b|(?:\([^()]*\)(?:\s*:\s*\w+)?|(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/i,delete e.languages.flow.parameter,e.languages.insertBefore(`flow`,`operator`,{"flow-punctuation":{pattern:/\{\||\|\}/,alias:`punctuation`}}),Array.isArray(e.languages.flow.keyword)||(e.languages.flow.keyword=[e.languages.flow.keyword]),e.languages.flow.keyword.unshift({pattern:/(^|[^$]\b)(?:Class|declare|opaque|type)\b(?!\$)/,lookbehind:!0},{pattern:/(^|[^$]\B)\$(?:Diff|Enum|Exact|Keys|ObjMap|PropertyType|Record|Shape|Subtype|Supertype|await)\b(?!\$)/,lookbehind:!0})})(e)}ht.displayName=`fortran`,ht.aliases=[];function ht(e){e.languages.fortran={"quoted-number":{pattern:/[BOZ](['"])[A-F0-9]+\1/i,alias:`number`},string:{pattern:/(?:\b\w+_)?(['"])(?:\1\1|&(?:\r\n?|\n)(?:[ \t]*!.*(?:\r\n?|\n)|(?![ \t]*!))|(?!\1).)*(?:\1|&)/,inside:{comment:{pattern:/(&(?:\r\n?|\n)\s*)!.*/,lookbehind:!0}}},comment:{pattern:/!.*/,greedy:!0},boolean:/\.(?:FALSE|TRUE)\.(?:_\w+)?/i,number:/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[ED][+-]?\d+)?(?:_\w+)?/i,keyword:[/\b(?:CHARACTER|COMPLEX|DOUBLE ?PRECISION|INTEGER|LOGICAL|REAL)\b/i,/\b(?:END ?)?(?:BLOCK ?DATA|DO|FILE|FORALL|FUNCTION|IF|INTERFACE|MODULE(?! PROCEDURE)|PROGRAM|SELECT|SUBROUTINE|TYPE|WHERE)\b/i,/\b(?:ALLOCATABLE|ALLOCATE|BACKSPACE|CALL|CASE|CLOSE|COMMON|CONTAINS|CONTINUE|CYCLE|DATA|DEALLOCATE|DIMENSION|DO|END|EQUIVALENCE|EXIT|EXTERNAL|FORMAT|GO ?TO|IMPLICIT(?: NONE)?|INQUIRE|INTENT|INTRINSIC|MODULE PROCEDURE|NAMELIST|NULLIFY|OPEN|OPTIONAL|PARAMETER|POINTER|PRINT|PRIVATE|PUBLIC|READ|RETURN|REWIND|SAVE|SELECT|STOP|TARGET|WHILE|WRITE)\b/i,/\b(?:ASSIGNMENT|DEFAULT|ELEMENTAL|ELSE|ELSEIF|ELSEWHERE|ENTRY|IN|INCLUDE|INOUT|KIND|NULL|ONLY|OPERATOR|OUT|PURE|RECURSIVE|RESULT|SEQUENCE|STAT|THEN|USE)\b/i],operator:[/\*\*|\/\/|=>|[=\/]=|[<>]=?|::|[+\-*=%]|\.[A-Z]+\./i,{pattern:/(^|(?!\().)\/(?!\))/,lookbehind:!0}],punctuation:/\(\/|\/\)|[(),;:&]/}}gt.displayName=`fsharp`,gt.aliases=[];function gt(e){e.register(S),e.languages.fsharp=e.languages.extend(`clike`,{comment:[{pattern:/(^|[^\\])\(\*(?!\))[\s\S]*?\*\)/,lookbehind:!0,greedy:!0},{pattern:/(^|[^\\:])\/\/.*/,lookbehind:!0,greedy:!0}],string:{pattern:/(?:"""[\s\S]*?"""|@"(?:""|[^"])*"|"(?:\\[\s\S]|[^\\"])*")B?/,greedy:!0},"class-name":{pattern:/(\b(?:exception|inherit|interface|new|of|type)\s+|\w\s*:\s*|\s:\??>\s*)[.\w]+\b(?:\s*(?:->|\*)\s*[.\w]+\b)*(?!\s*[:.])/,lookbehind:!0,inside:{operator:/->|\*/,punctuation:/\./}},keyword:/\b(?:let|return|use|yield)(?:!\B|\b)|\b(?:abstract|and|as|asr|assert|atomic|base|begin|break|checked|class|component|const|constraint|constructor|continue|default|delegate|do|done|downcast|downto|eager|elif|else|end|event|exception|extern|external|false|finally|fixed|for|fun|function|functor|global|if|in|include|inherit|inline|interface|internal|land|lazy|lor|lsl|lsr|lxor|match|member|method|mixin|mod|module|mutable|namespace|new|not|null|object|of|open|or|override|parallel|private|process|protected|public|pure|rec|sealed|select|sig|static|struct|tailcall|then|to|trait|true|try|type|upcast|val|virtual|void|volatile|when|while|with)\b/,number:[/\b0x[\da-fA-F]+(?:LF|lf|un)?\b/,/\b0b[01]+(?:uy|y)?\b/,/(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[fm]|e[+-]?\d+)?\b/i,/\b\d+(?:[IlLsy]|UL|u[lsy]?)?\b/],operator:/([<>~&^])\1\1|([*.:<>&])\2|<-|->|[!=:]=|?|\??(?:<=|>=|<>|[-+*/%=<>])\??|[!?^&]|~[+~-]|:>|:\?>?/}),e.languages.insertBefore(`fsharp`,`keyword`,{preprocessor:{pattern:/(^[\t ]*)#.*/m,lookbehind:!0,alias:`property`,inside:{directive:{pattern:/(^#)\b(?:else|endif|if|light|line|nowarn)\b/,lookbehind:!0,alias:`keyword`}}}}),e.languages.insertBefore(`fsharp`,`punctuation`,{"computation-expression":{pattern:/\b[_a-z]\w*(?=\s*\{)/i,alias:`keyword`}}),e.languages.insertBefore(`fsharp`,`string`,{annotation:{pattern:/\[<.+?>\]/,greedy:!0,inside:{punctuation:/^\[<|>\]$/,"class-name":{pattern:/^\w+$|(^|;\s*)[A-Z]\w*(?=\()/,lookbehind:!0},"annotation-content":{pattern:/[\s\S]+/,inside:e.languages.fsharp}}},char:{pattern:/'(?:[^\\']|\\(?:.|\d{3}|x[a-fA-F\d]{2}|u[a-fA-F\d]{4}|U[a-fA-F\d]{8}))'B?/,greedy:!0}})}_t.displayName=`ftl`,_t.aliases=[];function _t(e){e.register(U),(function(e){for(var t=`[^<()"']|\\((?:)*\\)|<(?!#--)|<#--(?:[^-]|-(?!->))*-->|"(?:[^\\\\"]|\\\\.)*"|'(?:[^\\\\']|\\\\.)*'`,n=0;n<2;n++)t=t.replace(//g,function(){return t});t=t.replace(//g,`[^\\s\\S]`);var r={comment:/<#--[\s\S]*?-->/,string:[{pattern:/\br("|')(?:(?!\1)[^\\]|\\.)*\1/,greedy:!0},{pattern:RegExp(`("|')(?:(?!\\1|\\$\\{)[^\\\\]|\\\\.|\\$\\{(?:(?!\\})(?:))*\\})*\\1`.replace(//g,function(){return t})),greedy:!0,inside:{interpolation:{pattern:RegExp(`((?:^|[^\\\\])(?:\\\\\\\\)*)\\$\\{(?:(?!\\})(?:))*\\}`.replace(//g,function(){return t})),lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`},rest:null}}}}],keyword:/\b(?:as)\b/,boolean:/\b(?:false|true)\b/,"builtin-function":{pattern:/((?:^|[^?])\?\s*)\w+/,lookbehind:!0,alias:`function`},function:/\b\w+(?=\s*\()/,number:/\b\d+(?:\.\d+)?\b/,operator:/\.\.[<*!]?|->|--|\+\+|&&|\|\||\?{1,2}|[-+*/%!=<>]=?|\b(?:gt|gte|lt|lte)\b/,punctuation:/[,;.:()[\]{}]/};r.string[1].inside.interpolation.inside.rest=r,e.languages.ftl={"ftl-comment":{pattern:/^<#--[\s\S]*/,alias:`comment`},"ftl-directive":{pattern:/^<[\s\S]+>$/,inside:{directive:{pattern:/(^<\/?)[#@][a-z]\w*/i,lookbehind:!0,alias:`keyword`},punctuation:/^<\/?|\/?>$/,content:{pattern:/\s*\S[\s\S]*/,alias:`ftl`,inside:r}}},"ftl-interpolation":{pattern:/^\$\{[\s\S]*\}$/,inside:{punctuation:/^\$\{|\}$/,content:{pattern:/\s*\S[\s\S]*/,alias:`ftl`,inside:r}}}},e.hooks.add(`before-tokenize`,function(n){var r=RegExp(`<#--[\\s\\S]*?-->|<\\/?[#@][a-zA-Z](?:)*?>|\\$\\{(?:)*?\\}`.replace(//g,function(){return t}),`gi`);e.languages[`markup-templating`].buildPlaceholders(n,`ftl`,r)}),e.hooks.add(`after-tokenize`,function(t){e.languages[`markup-templating`].tokenizePlaceholders(t,`ftl`)})})(e)}vt.displayName=`gap`,vt.aliases=[];function vt(e){e.languages.gap={shell:{pattern:/^gap>[\s\S]*?(?=^gap>|$(?![\s\S]))/m,greedy:!0,inside:{gap:{pattern:/^(gap>).+(?:(?:\r(?:\n|(?!\n))|\n)>.*)*/,lookbehind:!0,inside:null},punctuation:/^gap>/}},comment:{pattern:/#.*/,greedy:!0},string:{pattern:/(^|[^\\'"])(?:'(?:[^\r\n\\']|\\.){1,10}'|"(?:[^\r\n\\"]|\\.)*"(?!")|"""[\s\S]*?""")/,lookbehind:!0,greedy:!0,inside:{continuation:{pattern:/([\r\n])>/,lookbehind:!0,alias:`punctuation`}}},keyword:/\b(?:Assert|Info|IsBound|QUIT|TryNextMethod|Unbind|and|atomic|break|continue|do|elif|else|end|fi|for|function|if|in|local|mod|not|od|or|quit|readonly|readwrite|rec|repeat|return|then|until|while)\b/,boolean:/\b(?:false|true)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:{pattern:/(^|[^\w.]|\.\.)(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?(?:_[a-z]?)?(?=$|[^\w.]|\.\.)/,lookbehind:!0},continuation:{pattern:/([\r\n])>/,lookbehind:!0,alias:`punctuation`},operator:/->|[-+*/^~=!]|<>|[<>]=?|:=|\.\./,punctuation:/[()[\]{},;.:]/},e.languages.gap.shell.inside.gap.inside=e.languages.gap}yt.displayName=`gcode`,yt.aliases=[];function yt(e){e.languages.gcode={comment:/;.*|\B\(.*?\)\B/,string:{pattern:/"(?:""|[^"])*"/,greedy:!0},keyword:/\b[GM]\d+(?:\.\d+)?\b/,property:/\b[A-Z]/,checksum:{pattern:/(\*)\d+/,lookbehind:!0,alias:`number`},punctuation:/[:*]/}}bt.displayName=`gdscript`,bt.aliases=[];function bt(e){e.languages.gdscript={comment:/#.*/,string:{pattern:/@?(?:("|')(?:(?!\1)[^\n\\]|\\[\s\S])*\1(?!"|')|"""(?:[^\\]|\\[\s\S])*?""")/,greedy:!0},"class-name":{pattern:/(^(?:class|class_name|extends)[ \t]+|^export\([ \t]*|\bas[ \t]+|(?:\b(?:const|var)[ \t]|[,(])[ \t]*\w+[ \t]*:[ \t]*|->[ \t]*)[a-zA-Z_]\w*/m,lookbehind:!0},keyword:/\b(?:and|as|assert|break|breakpoint|class|class_name|const|continue|elif|else|enum|export|extends|for|func|if|in|is|master|mastersync|match|not|null|onready|or|pass|preload|puppet|puppetsync|remote|remotesync|return|self|setget|signal|static|tool|var|while|yield)\b/,function:/\b[a-z_]\w*(?=[ \t]*\()/i,variable:/\$\w+/,number:[/\b0b[01_]+\b|\b0x[\da-fA-F_]+\b|(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.[\d_]+)(?:e[+-]?[\d_]+)?\b/,/\b(?:INF|NAN|PI|TAU)\b/],constant:/\b[A-Z][A-Z_\d]*\b/,boolean:/\b(?:false|true)\b/,operator:/->|:=|&&|\|\||<<|>>|[-+*/%&|!<>=]=?|[~^]/,punctuation:/[.:,;()[\]{}]/}}xt.displayName=`gedcom`,xt.aliases=[];function xt(e){e.languages.gedcom={"line-value":{pattern:/(^[\t ]*\d+ +(?:@\w[\w!"$%&'()*+,\-./:;<=>?[\\\]^`{|}~\x80-\xfe #]*@ +)?\w+ ).+/m,lookbehind:!0,inside:{pointer:{pattern:/^@\w[\w!"$%&'()*+,\-./:;<=>?[\\\]^`{|}~\x80-\xfe #]*@$/,alias:`variable`}}},record:{pattern:/(^[\t ]*\d+ +(?:@\w[\w!"$%&'()*+,\-./:;<=>?[\\\]^`{|}~\x80-\xfe #]*@ +)?)\w+/m,lookbehind:!0,alias:`tag`},level:{pattern:/(^[\t ]*)\d+/m,lookbehind:!0,alias:`number`},pointer:{pattern:/@\w[\w!"$%&'()*+,\-./:;<=>?[\\\]^`{|}~\x80-\xfe #]*@/,alias:`variable`}}}St.displayName=`gettext`,St.aliases=[`po`];function St(e){e.languages.gettext={comment:[{pattern:/# .*/,greedy:!0,alias:`translator-comment`},{pattern:/#\..*/,greedy:!0,alias:`extracted-comment`},{pattern:/#:.*/,greedy:!0,alias:`reference-comment`},{pattern:/#,.*/,greedy:!0,alias:`flag-comment`},{pattern:/#\|.*/,greedy:!0,alias:`previously-untranslated-comment`},{pattern:/#.*/,greedy:!0}],string:{pattern:/(^|[^\\])"(?:[^"\\]|\\.)*"/,lookbehind:!0,greedy:!0},keyword:/^msg(?:ctxt|id|id_plural|str)\b/m,number:/\b\d+\b/,punctuation:/[\[\]]/},e.languages.po=e.languages.gettext}Ct.displayName=`gherkin`,Ct.aliases=[];function Ct(e){(function(e){var t=`(?:\\r?\\n|\\r)[ \\t]*\\|.+\\|(?:(?!\\|).)*`;e.languages.gherkin={pystring:{pattern:/("""|''')[\s\S]+?\1/,alias:`string`},comment:{pattern:/(^[ \t]*)#.*/m,lookbehind:!0},tag:{pattern:/(^[ \t]*)@\S*/m,lookbehind:!0},feature:{pattern:/((?:^|\r?\n|\r)[ \t]*)(?:Ability|Ahoy matey!|Arwedd|Aspekt|Besigheid Behoefte|Business Need|Caracteristica|Característica|Egenskab|Egenskap|Eiginleiki|Feature|Fīča|Fitur|Fonctionnalité|Fonksyonalite|Funcionalidade|Funcionalitat|Functionalitate|Funcţionalitate|Funcționalitate|Functionaliteit|Fungsi|Funkcia|Funkcija|Funkcionalitāte|Funkcionalnost|Funkcja|Funksie|Funktionalität|Funktionalitéit|Funzionalità|Hwaet|Hwæt|Jellemző|Karakteristik|Lastnost|Mak|Mogucnost|laH|Mogućnost|Moznosti|Možnosti|OH HAI|Omadus|Ominaisuus|Osobina|Özellik|Potrzeba biznesowa|perbogh|poQbogh malja'|Požadavek|Požiadavka|Pretty much|Qap|Qu'meH 'ut|Savybė|Tính năng|Trajto|Vermoë|Vlastnosť|Właściwość|Značilnost|Δυνατότητα|Λειτουργία|Могућност|Мөмкинлек|Особина|Свойство|Үзенчәлеклелек|Функционал|Функционалност|Функция|Функціонал|תכונה|خاصية|خصوصیت|صلاحیت|کاروبار کی ضرورت|وِیژگی|रूप लेख|ਖਾਸੀਅਤ|ਨਕਸ਼ ਨੁਹਾਰ|ਮੁਹਾਂਦਰਾ|గుణము|ಹೆಚ್ಚಳ|ความต้องการทางธุรกิจ|ความสามารถ|โครงหลัก|기능|フィーチャ|功能|機能):(?:[^:\r\n]+(?:\r?\n|\r|$))*/,lookbehind:!0,inside:{important:{pattern:/(:)[^\r\n]+/,lookbehind:!0},keyword:/[^:\r\n]+:/}},scenario:{pattern:/(^[ \t]*)(?:Abstract Scenario|Abstrakt Scenario|Achtergrond|Aer|Ær|Agtergrond|All y'all|Antecedentes|Antecedents|Atburðarás|Atburðarásir|Awww, look mate|B4|Background|Baggrund|Bakgrund|Bakgrunn|Bakgrunnur|Beispiele|Beispiller|Bối cảnh|Cefndir|Cenario|Cenário|Cenario de Fundo|Cenário de Fundo|Cenarios|Cenários|Contesto|Context|Contexte|Contexto|Conto|Contoh|Contone|Dæmi|Dasar|Dead men tell no tales|Delineacao do Cenario|Delineação do Cenário|Dis is what went down|Dữ liệu|Dyagram Senaryo|Dyagram senaryo|Egzanp|Ejemplos|Eksempler|Ekzemploj|Enghreifftiau|Esbozo do escenario|Escenari|Escenario|Esempi|Esquema de l'escenari|Esquema del escenario|Esquema do Cenario|Esquema do Cenário|EXAMPLZ|Examples|Exempel|Exemple|Exemples|Exemplos|First off|Fono|Forgatókönyv|Forgatókönyv vázlat|Fundo|Geçmiş|Grundlage|Hannergrond|ghantoH|Háttér|Heave to|Istorik|Juhtumid|Keadaan|Khung kịch bản|Khung tình huống|Kịch bản|Koncept|Konsep skenario|Kontèks|Kontekst|Kontekstas|Konteksts|Kontext|Konturo de la scenaro|Latar Belakang|lut chovnatlh|lut|lutmey|Lýsing Atburðarásar|Lýsing Dæma|MISHUN SRSLY|MISHUN|Menggariskan Senario|mo'|Náčrt Scenára|Náčrt Scénáře|Náčrt Scenáru|Oris scenarija|Örnekler|Osnova|Osnova Scenára|Osnova scénáře|Osnutek|Ozadje|Paraugs|Pavyzdžiai|Példák|Piemēri|Plan du scénario|Plan du Scénario|Plan Senaryo|Plan senaryo|Plang vum Szenario|Pozadí|Pozadie|Pozadina|Príklady|Příklady|Primer|Primeri|Primjeri|Przykłady|Raamstsenaarium|Reckon it's like|Rerefons|Scenár|Scénář|Scenarie|Scenarij|Scenarijai|Scenarijaus šablonas|Scenariji|Scenārijs|Scenārijs pēc parauga|Scenarijus|Scenario|Scénario|Scenario Amlinellol|Scenario Outline|Scenario Template|Scenariomal|Scenariomall|Scenarios|Scenariu|Scenariusz|Scenaro|Schema dello scenario|Se ðe|Se the|Se þe|Senario|Senaryo Deskripsyon|Senaryo deskripsyon|Senaryo|Senaryo taslağı|Shiver me timbers|Situācija|Situai|Situasie Uiteensetting|Situasie|Skenario konsep|Skenario|Skica|Structura scenariu|Structură scenariu|Struktura scenarija|Stsenaarium|Swa hwaer swa|Swa|Swa hwær swa|Szablon scenariusza|Szenario|Szenariogrundriss|Tapaukset|Tapaus|Tapausaihio|Taust|Tausta|Template Keadaan|Template Senario|Template Situai|The thing of it is|Tình huống|Variantai|Voorbeelde|Voorbeelden|Wharrimean is|Yo-ho-ho|You'll wanna|Założenia|Παραδείγματα|Περιγραφή Σεναρίου|Σενάρια|Σενάριο|Υπόβαθρο|Кереш|Контекст|Концепт|Мисаллар|Мисоллар|Основа|Передумова|Позадина|Предистория|Предыстория|Приклади|Пример|Примери|Примеры|Рамка на сценарий|Скица|Структура сценарија|Структура сценария|Структура сценарію|Сценарий|Сценарий структураси|Сценарийның төзелеше|Сценарији|Сценарио|Сценарій|Тарих|Үрнәкләр|דוגמאות|רקע|תבנית תרחיש|תרחיש|الخلفية|الگوی سناریو|امثلة|پس منظر|زمینه|سناریو|سيناريو|سيناريو مخطط|مثالیں|منظر نامے کا خاکہ|منظرنامہ|نمونه ها|उदाहरण|परिदृश्य|परिदृश्य रूपरेखा|पृष्ठभूमि|ਉਦਾਹਰਨਾਂ|ਪਟਕਥਾ|ਪਟਕਥਾ ਢਾਂਚਾ|ਪਟਕਥਾ ਰੂਪ ਰੇਖਾ|ਪਿਛੋਕੜ|ఉదాహరణలు|కథనం|నేపథ్యం|సన్నివేశం|ಉದಾಹರಣೆಗಳು|ಕಥಾಸಾರಾಂಶ|ವಿವರಣೆ|ಹಿನ್ನೆಲೆ|โครงสร้างของเหตุการณ์|ชุดของตัวอย่าง|ชุดของเหตุการณ์|แนวคิด|สรุปเหตุการณ์|เหตุการณ์|배경|시나리오|시나리오 개요|예|サンプル|シナリオ|シナリオアウトライン|シナリオテンプレ|シナリオテンプレート|テンプレ|例|例子|剧本|剧本大纲|劇本|劇本大綱|场景|场景大纲|場景|場景大綱|背景):[^:\r\n]*/m,lookbehind:!0,inside:{important:{pattern:/(:)[^\r\n]*/,lookbehind:!0},keyword:/[^:\r\n]+:/}},"table-body":{pattern:RegExp(`(`+t+`)(?:`+t+`)+`),lookbehind:!0,inside:{outline:{pattern:/<[^>]+>/,alias:`variable`},td:{pattern:/\s*[^\s|][^|]*/,alias:`string`},punctuation:/\|/}},"table-head":{pattern:RegExp(t),inside:{th:{pattern:/\s*[^\s|][^|]*/,alias:`variable`},punctuation:/\|/}},atrule:{pattern:/(^[ \t]+)(?:'a|'ach|'ej|7|a|A také|A taktiež|A tiež|A zároveň|Aber|Ac|Adott|Akkor|Ak|Aleshores|Ale|Ali|Allora|Alors|Als|Ama|Amennyiben|Amikor|Ampak|an|AN|Ananging|And y'all|And|Angenommen|Anrhegedig a|An|Apabila|Atès|Atesa|Atunci|Avast!|Aye|A|awer|Bagi|Banjur|Bet|Biết|Blimey!|Buh|But at the end of the day I reckon|But y'all|But|BUT|Cal|Când|Cand|Cando|Ce|Cuando|Če|Ða ðe|Ða|Dadas|Dada|Dados|Dado|DaH ghu' bejlu'|dann|Dann|Dano|Dan|Dar|Dat fiind|Data|Date fiind|Date|Dati fiind|Dati|Daţi fiind|Dați fiind|DEN|Dato|De|Den youse gotta|Dengan|Diberi|Diyelim ki|Donada|Donat|Donitaĵo|Do|Dun|Duota|Ðurh|Eeldades|Ef|Eğer ki|Entao|Então|Entón|E|En|Entonces|Epi|És|Etant donnée|Etant donné|Et|Étant données|Étant donnée|Étant donné|Etant données|Etant donnés|Étant donnés|Fakat|Gangway!|Gdy|Gegeben seien|Gegeben sei|Gegeven|Gegewe|ghu' noblu'|Gitt|Given y'all|Given|Givet|Givun|Ha|Cho|I CAN HAZ|In|Ir|It's just unbelievable|I|Ja|Jeśli|Jeżeli|Kad|Kada|Kadar|Kai|Kaj|Když|Keď|Kemudian|Ketika|Khi|Kiedy|Ko|Kuid|Kui|Kun|Lan|latlh|Le sa a|Let go and haul|Le|Lè sa a|Lè|Logo|Lorsqu'<|Lorsque|mä|Maar|Mais|Mając|Ma|Majd|Maka|Manawa|Mas|Men|Menawa|Mutta|Nalika|Nalikaning|Nanging|Når|När|Nato|Nhưng|Niin|Njuk|O zaman|Och|Og|Oletetaan|Ond|Onda|Oraz|Pak|Pero|Però|Podano|Pokiaľ|Pokud|Potem|Potom|Privzeto|Pryd|Quan|Quand|Quando|qaSDI'|Så|Sed|Se|Siis|Sipoze ke|Sipoze Ke|Sipoze|Si|Şi|Și|Soit|Stel|Tada|Tad|Takrat|Tak|Tapi|Ter|Tetapi|Tha the|Tha|Then y'all|Then|Thì|Thurh|Toda|Too right|Un|Und|ugeholl|Và|vaj|Vendar|Ve|wann|Wanneer|WEN|Wenn|When y'all|When|Wtedy|Wun|Y'know|Yeah nah|Yna|Youse know like when|Youse know when youse got|Y|Za predpokladu|Za předpokladu|Zadan|Zadani|Zadano|Zadate|Zadato|Zakładając|Zaradi|Zatati|Þa þe|Þa|Þá|Þegar|Þurh|Αλλά|Δεδομένου|Και|Όταν|Τότε|А також|Агар|Але|Али|Аммо|А|Әгәр|Әйтик|Әмма|Бирок|Ва|Вә|Дадено|Дано|Допустим|Если|Задате|Задати|Задато|И|І|К тому же|Када|Кад|Когато|Когда|Коли|Ләкин|Лекин|Нәтиҗәдә|Нехай|Но|Онда|Припустимо, що|Припустимо|Пусть|Также|Та|Тогда|Тоді|То|Унда|Һәм|Якщо|אבל|אזי|אז|בהינתן|וגם|כאשר|آنگاه|اذاً|اگر|اما|اور|با فرض|بالفرض|بفرض|پھر|تب|ثم|جب|عندما|فرض کیا|لكن|لیکن|متى|هنگامی|و|अगर|और|कदा|किन्तु|चूंकि|जब|तथा|तदा|तब|परन्तु|पर|यदि|ਅਤੇ|ਜਦੋਂ|ਜਿਵੇਂ ਕਿ|ਜੇਕਰ|ਤਦ|ਪਰ|అప్పుడు|ఈ పరిస్థితిలో|కాని|చెప్పబడినది|మరియు|ಆದರೆ|ನಂತರ|ನೀಡಿದ|ಮತ್ತು|ಸ್ಥಿತಿಯನ್ನು|กำหนดให้|ดังนั้น|แต่|เมื่อ|และ|그러면<|그리고<|단<|만약<|만일<|먼저<|조건<|하지만<|かつ<|しかし<|ただし<|ならば<|もし<|並且<|但し<|但是<|假如<|假定<|假設<|假设<|前提<|同时<|同時<|并且<|当<|當<|而且<|那么<|那麼<)(?=[ \t])/m,lookbehind:!0},string:{pattern:/"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'/,inside:{outline:{pattern:/<[^>]+>/,alias:`variable`}}},outline:{pattern:/<[^>]+>/,alias:`variable`}}})(e)}wt.displayName=`git`,wt.aliases=[];function wt(e){e.languages.git={comment:/^#.*/m,deleted:/^[-–].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/}},coord:/^@@.*@@$/m,"commit-sha1":/^commit \w{40}$/m}}Tt.displayName=`glsl`,Tt.aliases=[];function Tt(e){e.register(F),e.languages.glsl=e.languages.extend(`c`,{keyword:/\b(?:active|asm|atomic_uint|attribute|[ibdu]?vec[234]|bool|break|buffer|case|cast|centroid|class|coherent|common|const|continue|d?mat[234](?:x[234])?|default|discard|do|double|else|enum|extern|external|false|filter|fixed|flat|float|for|fvec[234]|goto|half|highp|hvec[234]|[iu]?sampler2DMS(?:Array)?|[iu]?sampler2DRect|[iu]?samplerBuffer|[iu]?samplerCube|[iu]?samplerCubeArray|[iu]?sampler[123]D|[iu]?sampler[12]DArray|[iu]?image2DMS(?:Array)?|[iu]?image2DRect|[iu]?imageBuffer|[iu]?imageCube|[iu]?imageCubeArray|[iu]?image[123]D|[iu]?image[12]DArray|if|in|inline|inout|input|int|interface|invariant|layout|long|lowp|mediump|namespace|noinline|noperspective|out|output|partition|patch|precise|precision|public|readonly|resource|restrict|return|sample|sampler[12]DArrayShadow|sampler[12]DShadow|sampler2DRectShadow|sampler3DRect|samplerCubeArrayShadow|samplerCubeShadow|shared|short|sizeof|smooth|static|struct|subroutine|superp|switch|template|this|true|typedef|uint|uniform|union|unsigned|using|varying|void|volatile|while|writeonly)\b/})}Et.displayName=`gml`,Et.aliases=[`gamemakerlanguage`];function Et(e){e.register(S),e.languages.gamemakerlanguage=e.languages.gml=e.languages.extend(`clike`,{keyword:/\b(?:break|case|continue|default|do|else|enum|exit|for|globalvar|if|repeat|return|switch|until|var|while)\b/,number:/(?:\b0x[\da-f]+|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?)[ulf]{0,4}/i,operator:/--|\+\+|[-+%/=]=?|!=|\*\*?=?|<[<=>]?|>[=>]?|&&?|\^\^?|\|\|?|~|\b(?:and|at|not|or|with|xor)\b/,constant:/\b(?:GM_build_date|GM_version|action_(?:continue|restart|reverse|stop)|all|gamespeed_(?:fps|microseconds)|global|local|noone|other|pi|pointer_(?:invalid|null)|self|timezone_(?:local|utc)|undefined|ev_(?:create|destroy|step|alarm|keyboard|mouse|collision|other|draw|draw_(?:begin|end|post|pre)|keypress|keyrelease|trigger|(?:left|middle|no|right)_button|(?:left|middle|right)_press|(?:left|middle|right)_release|mouse_(?:enter|leave|wheel_down|wheel_up)|global_(?:left|middle|right)_button|global_(?:left|middle|right)_press|global_(?:left|middle|right)_release|joystick(?:1|2)_(?:button1|button2|button3|button4|button5|button6|button7|button8|down|left|right|up)|outside|boundary|game_start|game_end|room_start|room_end|no_more_lives|animation_end|end_of_path|no_more_health|user\d|gui|gui_begin|gui_end|step_(?:begin|end|normal))|vk_(?:alt|anykey|backspace|control|delete|down|end|enter|escape|home|insert|left|nokey|pagedown|pageup|pause|printscreen|return|right|shift|space|tab|up|f\d|numpad\d|add|decimal|divide|lalt|lcontrol|lshift|multiply|ralt|rcontrol|rshift|subtract)|achievement_(?:filter_(?:all_players|favorites_only|friends_only)|friends_info|info|leaderboard_info|our_info|pic_loaded|show_(?:achievement|bank|friend_picker|leaderboard|profile|purchase_prompt|ui)|type_challenge|type_score_challenge)|asset_(?:font|object|path|room|script|shader|sound|sprite|tiles|timeline|unknown)|audio_(?:3d|falloff_(?:exponent_distance|exponent_distance_clamped|inverse_distance|inverse_distance_clamped|linear_distance|linear_distance_clamped|none)|mono|new_system|old_system|stereo)|bm_(?:add|complex|dest_alpha|dest_color|dest_colour|inv_dest_alpha|inv_dest_color|inv_dest_colour|inv_src_alpha|inv_src_color|inv_src_colour|max|normal|one|src_alpha|src_alpha_sat|src_color|src_colour|subtract|zero)|browser_(?:chrome|firefox|ie|ie_mobile|not_a_browser|opera|safari|safari_mobile|tizen|unknown|windows_store)|buffer_(?:bool|f16|f32|f64|fast|fixed|generalerror|grow|invalidtype|network|outofbounds|outofspace|s16|s32|s8|seek_end|seek_relative|seek_start|string|text|u16|u32|u64|u8|vbuffer|wrap)|c_(?:aqua|black|blue|dkgray|fuchsia|gray|green|lime|ltgray|maroon|navy|olive|orange|purple|red|silver|teal|white|yellow)|cmpfunc_(?:always|equal|greater|greaterequal|less|lessequal|never|notequal)|cr_(?:appstart|arrow|beam|cross|default|drag|handpoint|hourglass|none|size_all|size_nesw|size_ns|size_nwse|size_we|uparrow)|cull_(?:clockwise|counterclockwise|noculling)|device_(?:emulator|tablet)|device_ios_(?:ipad|ipad_retina|iphone|iphone5|iphone6|iphone6plus|iphone_retina|unknown)|display_(?:landscape|landscape_flipped|portrait|portrait_flipped)|dll_(?:cdecl|cdel|stdcall)|ds_type_(?:grid|list|map|priority|queue|stack)|ef_(?:cloud|ellipse|explosion|firework|flare|rain|ring|smoke|smokeup|snow|spark|star)|fa_(?:archive|bottom|center|directory|hidden|left|middle|readonly|right|sysfile|top|volumeid)|fb_login_(?:default|fallback_to_webview|forcing_safari|forcing_webview|no_fallback_to_webview|use_system_account)|iap_(?:available|canceled|ev_consume|ev_product|ev_purchase|ev_restore|ev_storeload|failed|purchased|refunded|status_available|status_loading|status_processing|status_restoring|status_unavailable|status_uninitialised|storeload_failed|storeload_ok|unavailable)|leaderboard_type_(?:number|time_mins_secs)|lighttype_(?:dir|point)|matrix_(?:projection|view|world)|mb_(?:any|left|middle|none|right)|network_(?:config_(?:connect_timeout|disable_reliable_udp|enable_reliable_udp|use_non_blocking_socket)|socket_(?:bluetooth|tcp|udp)|type_(?:connect|data|disconnect|non_blocking_connect))|of_challenge_(?:lose|tie|win)|os_(?:android|ios|linux|macosx|ps3|ps4|psvita|unknown|uwp|win32|win8native|windows|winphone|xboxone)|phy_debug_render_(?:aabb|collision_pairs|coms|core_shapes|joints|obb|shapes)|phy_joint_(?:anchor_1_x|anchor_1_y|anchor_2_x|anchor_2_y|angle|angle_limits|damping_ratio|frequency|length_1|length_2|lower_angle_limit|max_force|max_length|max_motor_force|max_motor_torque|max_torque|motor_force|motor_speed|motor_torque|reaction_force_x|reaction_force_y|reaction_torque|speed|translation|upper_angle_limit)|phy_particle_data_flag_(?:category|color|colour|position|typeflags|velocity)|phy_particle_flag_(?:colormixing|colourmixing|elastic|powder|spring|tensile|viscous|wall|water|zombie)|phy_particle_group_flag_(?:rigid|solid)|pr_(?:linelist|linestrip|pointlist|trianglefan|trianglelist|trianglestrip)|ps_(?:distr|shape)_(?:diamond|ellipse|gaussian|invgaussian|line|linear|rectangle)|pt_shape_(?:circle|cloud|disk|explosion|flare|line|pixel|ring|smoke|snow|spark|sphere|square|star)|ty_(?:real|string)|gp_(?:face\d|axislh|axislv|axisrh|axisrv|padd|padl|padr|padu|select|shoulderl|shoulderlb|shoulderr|shoulderrb|start|stickl|stickr)|lb_disp_(?:none|numeric|time_ms|time_sec)|lb_sort_(?:ascending|descending|none)|ov_(?:achievements|community|friends|gamegroup|players|settings)|ugc_(?:filetype_(?:community|microtrans)|list_(?:Favorited|Followed|Published|Subscribed|UsedOrPlayed|VotedDown|VotedOn|VotedUp|WillVoteLater)|match_(?:AllGuides|Artwork|Collections|ControllerBindings|IntegratedGuides|Items|Items_Mtx|Items_ReadyToUse|Screenshots|UsableInGame|Videos|WebGuides)|query_(?:AcceptedForGameRankedByAcceptanceDate|CreatedByFriendsRankedByPublicationDate|FavoritedByFriendsRankedByPublicationDate|NotYetRated)|query_RankedBy(?:NumTimesReported|PublicationDate|TextSearch|TotalVotesAsc|Trend|Vote|VotesUp)|result_success|sortorder_CreationOrder(?:Asc|Desc)|sortorder_(?:ForModeration|LastUpdatedDesc|SubscriptionDateDesc|TitleAsc|VoteScoreDesc)|visibility_(?:friends_only|private|public))|vertex_usage_(?:binormal|blendindices|blendweight|color|colour|depth|fog|normal|position|psize|sample|tangent|texcoord|textcoord)|vertex_type_(?:float\d|color|colour|ubyte4)|input_type|layerelementtype_(?:background|instance|oldtilemap|particlesystem|sprite|tile|tilemap|undefined)|se_(?:chorus|compressor|echo|equalizer|flanger|gargle|none|reverb)|text_type|tile_(?:flip|index_mask|mirror|rotate)|(?:obj|rm|scr|spr)\w+)\b/,variable:/\b(?:alarm|application_surface|async_load|background_(?:alpha|blend|color|colour|foreground|height|hspeed|htiled|index|showcolor|showcolour|visible|vspeed|vtiled|width|x|xscale|y|yscale)|bbox_(?:bottom|left|right|top)|browser_(?:height|width)|caption_(?:health|lives|score)|current_(?:day|hour|minute|month|second|time|weekday|year)|cursor_sprite|debug_mode|delta_time|direction|display_aa|error_(?:last|occurred)|event_(?:action|number|object|type)|fps|fps_real|friction|game_(?:display|project|save)_(?:id|name)|gamemaker_(?:pro|registered|version)|gravity|gravity_direction|(?:h|v)speed|health|iap_data|id|image_(?:alpha|angle|blend|depth|index|number|speed|xscale|yscale)|instance_(?:count|id)|keyboard_(?:key|lastchar|lastkey|string)|layer|lives|mask_index|mouse_(?:button|lastbutton|x|y)|object_index|os_(?:browser|device|type|version)|path_(?:endaction|index|orientation|position|positionprevious|scale|speed)|persistent|phy_(?:rotation|(?:col_normal|collision|com|linear_velocity|position|speed)_(?:x|y)|angular_(?:damping|velocity)|position_(?:x|y)previous|speed|linear_damping|bullet|fixed_rotation|active|mass|inertia|dynamic|kinematic|sleeping|collision_points)|pointer_(?:invalid|null)|room|room_(?:caption|first|height|last|persistent|speed|width)|score|secure_mode|show_(?:health|lives|score)|solid|speed|sprite_(?:height|index|width|xoffset|yoffset)|temp_directory|timeline_(?:index|loop|position|running|speed)|transition_(?:color|kind|steps)|undefined|view_(?:angle|current|enabled|(?:h|v)(?:border|speed)|(?:h|w|x|y)port|(?:h|w|x|y)view|object|surface_id|visible)|visible|webgl_enabled|working_directory|(?:x|y)(?:previous|start)|x|y|argument(?:_relitive|_count|\d)|argument|global|local|other|self)\b/})}Dt.displayName=`gn`,Dt.aliases=[`gni`];function Dt(e){e.languages.gn={comment:{pattern:/#.*/,greedy:!0},"string-literal":{pattern:/(^|[^\\"])"(?:[^\r\n"\\]|\\.)*"/,lookbehind:!0,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$(?:\{[\s\S]*?\}|[a-zA-Z_]\w*|0x[a-fA-F0-9]{2})/,lookbehind:!0,inside:{number:/^\$0x[\s\S]{2}$/,variable:/^\$\w+$/,"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:`punctuation`},expression:{pattern:/[\s\S]+/,inside:null}}},string:/[\s\S]+/}},keyword:/\b(?:else|if)\b/,boolean:/\b(?:false|true)\b/,"builtin-function":{pattern:/\b(?:assert|defined|foreach|import|pool|print|template|tool|toolchain)(?=\s*\()/i,alias:`keyword`},function:/\b[a-z_]\w*(?=\s*\()/i,constant:/\b(?:current_cpu|current_os|current_toolchain|default_toolchain|host_cpu|host_os|root_build_dir|root_gen_dir|root_out_dir|target_cpu|target_gen_dir|target_os|target_out_dir)\b/,number:/-?\b\d+\b/,operator:/[-+!=<>]=?|&&|\|\|/,punctuation:/[(){}[\],.]/},e.languages.gn[`string-literal`].inside.interpolation.inside.expression.inside=e.languages.gn,e.languages.gni=e.languages.gn}Ot.displayName=`go-module`,Ot.aliases=[`go-mod`];function Ot(e){e.languages[`go-mod`]=e.languages[`go-module`]={comment:{pattern:/\/\/.*/,greedy:!0},version:{pattern:/(^|[\s()[\],])v\d+\.\d+\.\d+(?:[+-][-+.\w]*)?(?![^\s()[\],])/,lookbehind:!0,alias:`number`},"go-version":{pattern:/((?:^|\s)go\s+)\d+(?:\.\d+){1,2}/,lookbehind:!0,alias:`number`},keyword:{pattern:/^([ \t]*)(?:exclude|go|module|replace|require|retract)\b/m,lookbehind:!0},operator:/=>/,punctuation:/[()[\],]/}}kt.displayName=`go`,kt.aliases=[];function kt(e){e.register(S),e.languages.go=e.languages.extend(`clike`,{string:{pattern:/(^|[^\\])"(?:\\.|[^"\\\r\n])*"|`[^`]*`/,lookbehind:!0,greedy:!0},keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,boolean:/\b(?:_|false|iota|nil|true)\b/,number:[/\b0(?:b[01_]+|o[0-7_]+)i?\b/i,/\b0x(?:[a-f\d_]+(?:\.[a-f\d_]*)?|\.[a-f\d_]+)(?:p[+-]?\d+(?:_\d+)*)?i?(?!\w)/i,/(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.\d[\d_]*)(?:e[+-]?[\d_]+)?i?(?!\w)/i],operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,builtin:/\b(?:append|bool|byte|cap|close|complex|complex(?:64|128)|copy|delete|error|float(?:32|64)|u?int(?:8|16|32|64)?|imag|len|make|new|panic|print(?:ln)?|real|recover|rune|string|uintptr)\b/}),e.languages.insertBefore(`go`,`string`,{char:{pattern:/'(?:\\.|[^'\\\r\n]){0,10}'/,greedy:!0}}),delete e.languages.go[`class-name`]}At.displayName=`gradle`,At.aliases=[];function At(e){e.register(S),(function(e){var t={pattern:/((?:^|[^\\$])(?:\\{2})*)\$(?:\w+|\{[^{}]*\})/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{?|\}$/,alias:`punctuation`},expression:{pattern:/[\s\S]+/,inside:null}}};e.languages.gradle=e.languages.extend(`clike`,{string:{pattern:/'''(?:[^\\]|\\[\s\S])*?'''|'(?:\\.|[^\\'\r\n])*'/,greedy:!0},keyword:/\b(?:apply|def|dependencies|else|if|implementation|import|plugin|plugins|project|repositories|repository|sourceSets|tasks|val)\b/,number:/\b(?:0b[01_]+|0x[\da-f_]+(?:\.[\da-f_p\-]+)?|[\d_]+(?:\.[\d_]+)?(?:e[+-]?\d+)?)[glidf]?\b/i,operator:{pattern:/(^|[^.])(?:~|==?~?|\?[.:]?|\*(?:[.=]|\*=?)?|\.[@&]|\.\.<|\.\.(?!\.)|-[-=>]?|\+[+=]?|!=?|<(?:<=?|=>?)?|>(?:>>?=?|=)?|&[&=]?|\|[|=]?|\/=?|\^=?|%=?)/,lookbehind:!0},punctuation:/\.+|[{}[\];(),:$]/}),e.languages.insertBefore(`gradle`,`string`,{shebang:{pattern:/#!.+/,alias:`comment`,greedy:!0},"interpolation-string":{pattern:/"""(?:[^\\]|\\[\s\S])*?"""|(["/])(?:\\.|(?!\1)[^\\\r\n])*\1|\$\/(?:[^/$]|\$(?:[/$]|(?![/$]))|\/(?!\$))*\/\$/,greedy:!0,inside:{interpolation:t,string:/[\s\S]+/}}}),e.languages.insertBefore(`gradle`,`punctuation`,{"spock-block":/\b(?:and|cleanup|expect|given|setup|then|when|where):/}),e.languages.insertBefore(`gradle`,`function`,{annotation:{pattern:/(^|[^.])@\w+/,lookbehind:!0,alias:`punctuation`}}),t.inside.expression.inside=e.languages.gradle})(e)}jt.displayName=`graphql`,jt.aliases=[];function jt(e){e.languages.graphql={comment:/#.*/,description:{pattern:/(?:"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*")(?=\s*[a-z_])/i,greedy:!0,alias:`string`,inside:{"language-markdown":{pattern:/(^"(?:"")?)(?!\1)[\s\S]+(?=\1$)/,lookbehind:!0,inside:e.languages.markdown}}},string:{pattern:/"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*"/,greedy:!0},number:/(?:\B-|\b)\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,boolean:/\b(?:false|true)\b/,variable:/\$[a-z_]\w*/i,directive:{pattern:/@[a-z_]\w*/i,alias:`function`},"attr-name":{pattern:/\b[a-z_]\w*(?=\s*(?:\((?:[^()"]|"(?:\\.|[^\\"\r\n])*")*\))?:)/i,greedy:!0},"atom-input":{pattern:/\b[A-Z]\w*Input\b/,alias:`class-name`},scalar:/\b(?:Boolean|Float|ID|Int|String)\b/,constant:/\b[A-Z][A-Z_\d]*\b/,"class-name":{pattern:/(\b(?:enum|implements|interface|on|scalar|type|union)\s+|&\s*|:\s*|\[)[A-Z_]\w*/,lookbehind:!0},fragment:{pattern:/(\bfragment\s+|\.{3}\s*(?!on\b))[a-zA-Z_]\w*/,lookbehind:!0,alias:`function`},"definition-mutation":{pattern:/(\bmutation\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:`function`},"definition-query":{pattern:/(\bquery\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:`function`},keyword:/\b(?:directive|enum|extend|fragment|implements|input|interface|mutation|on|query|repeatable|scalar|schema|subscription|type|union)\b/,operator:/[!=|&]|\.{3}/,"property-query":/\w+(?=\s*\()/,object:/\w+(?=\s*\{)/,punctuation:/[!(){}\[\]:=,]/,property:/\w+/},e.hooks.add(`after-tokenize`,function(e){if(e.language!==`graphql`)return;var t=e.tokens.filter(function(e){return typeof e!=`string`&&e.type!==`comment`&&e.type!==`scalar`}),n=0;function r(e){return t[n+e]}function i(e,t){t||=0;for(var n=0;n0)){var d=a(/^\{$/,/^\}$/);if(d===-1)continue;for(var f=n;f 
- 
