@0xmaxma/claude-gateway 1.3.24 → 1.3.31

package/README.md

@@ -293,6 +293,52 @@ Controls the Claude subprocess backend for all non-app agents.
 
 This setting is hot-reloadable — new sessions pick it up without a restart.
 
+### `gateway.selfHealing.autoRecover`
+
+Opt-in self-healing for the turn-trace watchdog (Epic #195). When a turn stalls, the gateway always detects it, logs a scrubbed incident, and notifies the affected chat. This flag additionally controls whether the gateway may *act* on a stall.
+
+| Value | Behaviour |
+|-------|-----------|
+| `false` *(default)* | Detection + incident logging + notification only — no automatic action |
+| `true` | The watchdog may run a whitelisted recovery for a stalled turn: a keystroke into the TUI (esc / enter / arrow / menu selection), a session restart, a reversible safe-mode fallback to the headless backend, and — after a successful unblock — a guarded resend of the last message (only if the turn produced no output, so it is never double-submitted) |
+
+Recovery actions are clamped to a per-stage whitelist and a per-turn budget, and any local triage treats the on-screen text as untrusted data validated against a closed schema. Safe-mode auto-fallback on a hard PTY failure is independent of this flag (it is always reversible and never presses keys). In-memory only — a gateway restart re-reads your real config.
+
+```json
+{
+  "gateway": {
+    "selfHealing": {
+      "autoRecover": true
+    }
+  }
+}
+```
+
+### `gateway.bind`
+
+Network interface the HTTP/WebSocket server binds to. Defaults to `127.0.0.1` (localhost-only), so the dashboard and API are **not** exposed to the local network out of the box. Set to `0.0.0.0` to listen on all interfaces (for example when a containerized reverse proxy needs to reach the gateway). The `GATEWAY_BIND` environment variable, when set, takes precedence over this field.
+
+```json
+{
+  "gateway": {
+    "bind": "127.0.0.1"
+  }
+}
+```
+
+> **⚠️ Upgrade note:** the default bind changed from `0.0.0.0` to `127.0.0.1` (configVersion 1.0.13). To avoid silently cutting off external access, the config migrator is **behavior-preserving**: whenever it upgrades a config that never set `gateway.bind`, it pins `bind` to `0.0.0.0` and logs a one-time warning, so a deployment that was reachable from another host stays reachable. This applies to *any* upgraded config with no `bind` key — including one already stamped `1.0.13` that never received a bind (an earlier version gated this on `< 1.0.13` and left such configs stuck on the `127.0.0.1` default). New installs (no prior config, so no migration runs) keep the secure `127.0.0.1` default. If you *want* localhost-only after upgrading, set `gateway.bind` to `127.0.0.1` explicitly (or the `GATEWAY_BIND` env var).
+
+### Terminal Viewer — interactive terminal mode
+
+The dashboard's **Terminal Viewer** opens read-only (a live mirror of the PTY). A toggle in the top-right of the viewer switches it into an **interactive terminal**: keystrokes typed into the panel — printable characters, Enter, arrows, Ctrl-combos, Esc — are streamed into the live PTY, and the panel title changes to reflect the active mode. This is a per-browser client-side choice (Issue #201); there is no server config flag to enable it.
+
+Because interactive mode turns a read-only view into a remote-write surface, access is protected upstream rather than by a feature flag:
+
+- **Authentication** — the WebSocket requires a valid dashboard ticket or API key.
+- **`gateway.bind`** — the gateway binds to `127.0.0.1` (localhost) by default, so the dashboard is not reachable from the network out of the box. Expose a non-loopback bind (`0.0.0.0`) **only** behind a trusted authenticating reverse proxy.
+
+Inbound frames are always bounded (text-only, size-capped) and are dropped for headless sessions (no PTY).
+
 ### `gateway.api.keys`
 
 Each key has a `key` string (supports `${ENV_VAR}` interpolation), an optional `description`, and an `agents` field — either an array of agent IDs or `"*"` for full access. Keys support both `Authorization: Bearer` and `X-Api-Key` headers.
@@ -485,7 +531,7 @@ The gateway proxies `/app/:name/:portName/*` to the app containers. Two env vars
 
 | Env var | Default | Description |
 |---------|---------|-------------|
-| `GATEWAY_BIND` | `0.0.0.0` | Gateway HTTP listen address. Must be `0.0.0.0` (default) when a **containerized** reverse proxy (Caddy, nginx in Docker) needs to reach the gateway. Set to `127.0.0.1` only if using a **host-network** proxy (Traefik on host) — loopback is not reachable across container boundaries. |
+| `GATEWAY_BIND` | `127.0.0.1` | Gateway HTTP listen address. Overrides the `gateway.bind` config field when set. Defaults to localhost-only; set to `0.0.0.0` when a **containerized** reverse proxy (Caddy, nginx in Docker) needs to reach the gateway across container boundaries. A **host-network** proxy (Traefik on host) can keep the localhost default. |
 | `DOCKER_HOST` | _(system default)_ | Docker socket/TCP address. When set to `tcp://host:port` (e.g. DinD), the gateway automatically uses the host extracted from `DOCKER_HOST` to proxy to app containers instead of `127.0.0.1`. |
 
 Example Caddyfile for apps behind Caddy in Docker:
@@ -733,20 +779,28 @@ When the config schema changes (new fields added in `config.template.json`), the
 
 ## Pairing New Users
 
-1. Set `dmPolicy` to `pairing` in `access.json`:
-   ```json
-   { "dmPolicy": "pairing" }
-   ```
-2. Ask the user to DM the bot — they receive a 6-character pairing code
-3. Approve it:
+New agents default to `dmPolicy: "allowlist"` with the orthogonal `pairing`
+toggle **on**, so pairing works out of the box — no setup needed.
+
+1. Ask the user to DM the bot — they receive a 6-character pairing code
+2. Approve it:
    ```bash
-   npm run pair -- --agent=alfred --code=abc123
+   npm run pair -- --agent=alfred --code=abc123 --channel=discord
    ```
-4. The bot confirms pairing within 5 seconds
-5. Lock down after everyone is paired:
-   ```bash
-   npm run pair -- --agent=alfred --policy=allowlist
+   (omit `--channel` or use `--channel=telegram` for Telegram)
+3. The bot confirms pairing within 5 seconds
+4. Lock down after everyone is paired (optional) — turn the pairing toggle off
+   so unknown senders are dropped silently (the base policy is already
+   `allowlist`):
    ```
+   /gateway:discord-access dm-pairing off     # Discord
+   /telegram:access pairing off               # Telegram
+   ```
+
+`pairing` is an **orthogonal on/off toggle**, not a `dmPolicy` value: the base
+policy stays `open` | `allowlist` | `disabled`, and pairing layers on top of
+`allowlist`. A legacy `access.json` with `"dmPolicy": "pairing"` is migrated
+automatically on read to `{ dmPolicy: "allowlist", pairing: true }`.
 
 To manage channels (add/remove Telegram or Discord) on an existing agent:
 ```bash
@@ -755,78 +809,135 @@ make update-agent   # choose "Manage channels"
 
 ---
 
+## Channel Conditions & Limitations
+
+Each channel gates inbound messages in two tiers — **DM/1:1** and **group** — and
+each has platform-level conditions that must be met *before* the gateway ever
+sees a message. If those aren't met the bot looks online but stays silent.
+
+| Channel | Scope | Message reaches the bot when… | Access gate | Answers in group when… |
+|---------|-------|-------------------------------|-------------|------------------------|
+| **Telegram** | DM | always (long-polling) | `dmPolicy` + `pairing` → `allowFrom` | — |
+| | Group | bot is **Admin**, or **Privacy Mode is OFF** + re-added; otherwise only `/cmd`, @mentions, replies | `groupPolicy` + `groupAllowlist` | `requireMention` false, or @mentioned/replied |
+| **Discord** | DM | **Message Content Intent** enabled | `dmPolicy` + `pairing` → `allowFrom` | — |
+| | Guild | **Message Content Intent** + **View Channel** + **Read Message History** | `groupPolicy` + `guildAllowlist` (+ optional `channelAllowlist`/`roleAllowlist`) | `requireMention` false, or @mentioned/replied |
+| **LINE** | 1:1 | webhook delivered (valid signature) | `dmPolicy` | — |
+| | Group/Room | webhook delivered + bot is a member | `groupPolicy` + `groupAllowlist` | `requireMention` false, or **native** @mention |
+
+**Telegram limits**
+- Exactly one process may poll a bot token — a second poller causes `409 Conflict`.
+- Bot **commands are DM-only**; in groups they're silently dropped.
+- Group **Privacy Mode is ON by default** — see [Telegram Groups](#telegram-groups). Admin status bypasses it; a Privacy-Mode change only applies after the bot is removed and re-added.
+- Pairing codes: DM knocks reply the code privately; group knocks post the code in the group (needs a message that actually reaches the bot, i.e. Admin/Privacy-off).
+
+**Discord limits**
+- **MESSAGE CONTENT INTENT** is a privileged intent — without it message text arrives empty, so the bot can neither answer nor pair. Enable it in the Developer Portal.
+- The bot needs channel permissions **View Channel**, **Read Message History**, **Send Messages** (+ **Create Public Threads** / **Send Messages in Threads** if `DISCORD_AUTO_THREAD=true`).
+- `channelAllowlist` / `roleAllowlist` are backend-only filters (no web UI) applied after the guild gate.
+
+**LINE limits**
+- Inbound arrives via the Express **webhook**, not polling; the signature is verified over the **exact raw bytes**. Front it with the bun CORS proxy (see `/tunnel`) — never point cloudflared straight at the gateway, or chunked bodies break the signature and webhooks are dropped.
+- Group/room `requireMention` uses LINE's **native mention** only (`mention.mentionees[].isSelf`). Typing the bot's name as plain text does **not** count, and `@All` does **not** count as a bot mention.
+- Delivery is **reply-token-first (free) → push fallback (metered)**. The single-use reply token lives only ~1 min; after that, replies consume the OA's monthly push quota.
+- Max **5 message objects** per reply/push request (the gateway auto-chunks to fit).
+
+---
+
 ## Telegram Groups
 
-The bot can respond in Telegram groups and supergroups. Groups must be registered before the bot will respond.
+The bot can respond in Telegram groups and supergroups. A group must be in the
+agent's `groupAllowlist` before the bot will answer there.
+
+### Delivery gotcha: Privacy Mode (read this first)
 
-**Step 1 — Add the bot to the group as Admin**
+Telegram bots ship with **Privacy Mode ON** (`getMe` returns
+`can_read_all_group_messages: false`). A privacy-mode bot only *receives*, inside
+a group:
 
-Add your bot to the group and **promote it to Admin**. Without admin rights, Telegram does not deliver group messages to the bot — it will appear online but never respond.
+- messages that start with `/` (commands),
+- messages that @mention the bot's username, and
+- replies to the bot's own messages.
 
-Minimum required admin permission: **"Read Messages"** (or any admin role — even the most restricted works).
+Everything else is filtered by Telegram **before it reaches the gateway** — the
+bot looks online but never sees the message, so it can neither answer nor mint a
+pairing code. On top of that, bot commands (`/start`, `/status`, …) are
+**DM-only**: the receiver silently drops them in groups so pairing codes can't
+leak to other members. Net effect in a default-privacy group: a plain message is
+invisible and a command is dropped, so nothing happens.
 
-**Step 2 — Get the group ID**
+Do one of these so the bot actually receives group messages:
 
-Forward any message from the group to [@userinfobot](https://t.me/userinfobot). It will reply with the chat ID — a negative number like `-1001234567890`.
+- **Promote the bot to Admin in the group (easiest).** An admin bot receives
+  every message regardless of Privacy Mode — no BotFather change, no re-add. Any
+  admin role works, even the most restricted.
+- **Disable Privacy Mode**, then **remove and re-add the bot** to the group (the
+  new setting only applies on re-join): [@BotFather](https://t.me/BotFather) →
+  `/setprivacy` → pick the bot → **Disable**.
+
+### Register the group
+
+Once the bot can receive group messages, add the group to `groupAllowlist` one of
+two ways.
+
+**Option A — pairing code (recommended).** With `groupPolicy: "allowlist"` and
+`pairing: true` (both defaults), send any message in the group. The bot replies
+with a 6-character code. Approve it from a gateway agent session:
 
-Alternatively, send a message in the group and visit:
 ```
-https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates
+/telegram:access pair <code>
 ```
-Look for `"chat":{"id": ...}` in the result.
 
-**Step 3 — Register the group**
+That adds the group id to `groupAllowlist` (the code also lands in the agent's
+`pending` as a `"kind": "group"` entry).
 
-Edit the agent's `access.json` directly:
+**Option B — edit `access.json` directly.** Get the group id by forwarding any
+group message to [@userinfobot](https://t.me/userinfobot) — a negative number
+like `-1001234567890` — then edit:
 
 ```
 ~/.claude-gateway/agents/<your-agent-id>/workspace/.telegram-state/access.json
 ```
 
-Add the group under `"groups"`:
-
 ```json
 {
   "dmPolicy": "allowlist",
+  "pairing": true,
   "allowFrom": ["..."],
-  "groups": {
-    "-1001234567890": {
-      "requireMention": true,
-      "allowFrom": []
-    }
-  }
+  "groupPolicy": "allowlist",
+  "groupAllowlist": ["-1001234567890"],
+  "requireMention": true
 }
 ```
 
-Set `"requireMention": false` if you want the bot to respond to all messages without needing an @mention.
-To restrict to specific members only, add their Telegram user IDs to `"allowFrom"`.
+`access.json` is re-read on every inbound message — changes take effect
+immediately, no restart.
 
-**Step 4 — Start chatting**
+### Mention gate
 
-@mention the bot in the group (or reply to one of its messages). Changes to `access.json` take effect immediately — no restart needed.
+`requireMention` is a single top-level boolean (default `true`):
 
-**Managing groups**
+- `true` — the bot answers in an allowlisted group only when @mentioned or
+  replied to. This relies on Telegram delivering the @mention; if the bot ignores
+  mentions, make it an Admin (see above).
+- `false` — the bot answers **every** message in an allowlisted group. This only
+  does anything if the bot can *see* every message, i.e. you also promoted it to
+  Admin or disabled Privacy Mode.
 
-Edit `access.json` to add or remove entries from the `"groups"` object. The gateway re-reads the file on every inbound message.
+Toggle it with `/telegram:access group mention <on|off>`.
 
-> **Note:** `/telegram:access` skill is available when running inside a gateway agent session (TELEGRAM_STATE_DIR is set automatically). For standalone terminal use, edit `access.json` directly as shown above.
-
-**Optional — Let the bot read all messages (disable Privacy Mode)**
-
-By default, Telegram bots in groups only receive messages that start with `/` or directly @mention the bot. If you want the bot to respond to every message without an @mention (and have set `"requireMention": false` in `access.json`), you also need to disable Privacy Mode at the bot level:
-
-1. Open [@BotFather](https://t.me/BotFather)
-2. Send `/setprivacy`
-3. Select your bot
-4. Choose **Disable**
-
-This is a bot-level setting — it applies to all groups the bot joins. If @mention-only is fine, skip this step and keep `"requireMention": true`.
+> **Legacy schema note:** older docs showed a per-group `"groups": { "<id>": {…} }`
+> map. That form is still accepted and auto-migrated on read to the flat
+> `groupAllowlist` + top-level `requireMention` shown above, but new setups should
+> use the flat schema. A per-group member restriction from the old schema is
+> preserved under `legacyGroupAllowFrom`; there is no command to edit it.
 
 ---
 
 ## Telegram Commands
 
-Once paired, the following bot commands are available in a private chat:
+Bot commands are **DM-only** — sent in a group they are silently ignored (this
+keeps pairing codes and session state from leaking to other members). Once
+paired, the following commands are available in a private chat:
 
 **Session management**
 
@@ -905,6 +1016,17 @@ npm run typecheck
 - Ensure no other process is polling the same bot token (causes 409 Conflict)
 - Only `TelegramReceiver` polls Telegram — MCP session subprocesses run in `SEND_ONLY` mode (no polling)
 
+**Bot silent in a Telegram group**
+- The group must be in `groupAllowlist` — see [Telegram Groups](#telegram-groups). An empty `pending` after messaging usually means the message never reached the bot.
+- Most common cause: **Privacy Mode** (default ON). A non-admin bot only receives commands, @mentions, and replies in groups — a plain message needed to mint the pairing code is filtered by Telegram. Promote the bot to Admin, or disable Privacy Mode in BotFather and re-add it.
+- `/start` and other commands are dropped in groups by design — use a normal message (or an @mention) to trigger the pairing code.
+- If `requireMention: true`, the bot only answers when @mentioned or replied to.
+
+**Bot silent in a Discord server (guild)**
+- Enable the **MESSAGE CONTENT INTENT** in the Discord Developer Portal (Bot settings) — without it the bot receives events but empty message text, so it can't respond or pair.
+- The guild must be in `guildAllowlist` (`groupPolicy: allowlist`), and the bot needs **View Channel** + **Read Message History** in that channel.
+- If `requireMention: true`, the bot only answers when @mentioned or replied to.
+
 **Session loses memory after restart**
 - History is persisted in `~/.claude-gateway/agents/<id>/sessions/<chat_id>.jsonl`
 - If the file is missing, the session starts fresh (no error)

package/config.template.json

@@ -10,10 +10,11 @@
       "claude.dangerouslySkipPermissions"
     ]
   },
-  "configVersion": "1.0.11",
+  "configVersion": "1.0.14",
   "gateway": {
     "logDir": "~/.claude-gateway/logs",
     "timezone": "Asia/Bangkok",
+    "bind": "127.0.0.1",
     "models": [
       { "id": "claude-fable-5[1m]",        "label": "Fable 5 (1M)",     "alias": "fable[1m]",   "contextWindow": 1000000 },
       { "id": "claude-opus-4-8[1m]",       "label": "Opus 4.8 (1M)",    "alias": "opus[1m]",    "contextWindow": 1000000 },
@@ -44,7 +45,10 @@
       "cleanupHour": 0,
       "cleanupTimezone": "UTC"
     },
-    "headless": true
+    "headless": true,
+    "selfHealing": {
+      "autoRecover": false
+    }
   },
   "agents": [
     {

package/dist/agent/incident-store.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Incident store (Epic #195, Phase 2).
+ *
+ * Persists turn-trace stall incidents as on-disk bundles under
+ * `<dir>/<id>/`, deduplicates repeats by fingerprint within a rolling window,
+ * escalates according to the pure rules in incident.ts, and prunes old bundles.
+ *
+ * All IO is funnelled through an injected `fs` and `now()` so the store is
+ * fully unit-testable against an in-memory filesystem (no real disk, no real
+ * clock). The pure decision logic (fingerprint, escalation, scrub, digest)
+ * lives in incident.ts; this file only orchestrates it and touches disk.
+ *
+ * A bundle is captured BEFORE any recovery mutates state (Phase 3 recovery runs
+ * after record() returns), so evidence reflects the wedged turn, not its
+ * aftermath. Every text artifact is scrubbed on the way in.
+ */
+import type { TurnIncident, TurnIncidentEvidence } from './turn-trace';
+import { type EscalationConfig, type EscalationDecision, type EscalationLevel, type IncidentManifest, type DigestSummary, type RecoveryOutcome } from './incident';
+/** Minimal filesystem surface the store needs. Node's `fs` satisfies it. */
+export interface IncidentFsApi {
+    mkdirSync(path: string, opts: {
+        recursive: boolean;
+    }): void;
+    writeFileSync(path: string, data: string): void;
+    readFileSync(path: string, enc: 'utf8'): string;
+    existsSync(path: string): boolean;
+    readdirSync(path: string): string[];
+    rmSync(path: string, opts: {
+        recursive: boolean;
+        force: boolean;
+    }): void;
+}
+export interface IncidentStoreDeps {
+    /** Base directory for incident bundles (e.g. ~/.claude-gateway/incidents). */
+    dir: string;
+    fs: IncidentFsApi;
+    /** Clock injection — epoch ms. */
+    now: () => number;
+    /** Transport name recorded on each incident ('telegram' | 'discord' | ...). */
+    channel: string;
+    /** Gateway version, recorded for context (not part of the fingerprint). */
+    gatewayVersion: string;
+    /** Lazily resolves the Claude CLI version (part of the fingerprint). */
+    getCliVersion: () => string;
+    /** Retention: bundles whose lastAt is older than this are pruned (ms). */
+    retentionMs?: number;
+    /** Retention: hard cap on bundle count (oldest pruned first). */
+    maxIncidents?: number;
+    /** Escalation thresholds. */
+    escalation?: EscalationConfig;
+    /** Max occurrence samples retained per incident. */
+    maxSamples?: number;
+}
+/** Outcome of recording one stall occurrence. */
+export interface RecordResult {
+    id: string;
+    fingerprint: string;
+    occurrences: number;
+    escalation: EscalationDecision;
+    /** True when this created a fresh bundle (vs. folding into an existing one). */
+    isNew: boolean;
+    manifest: IncidentManifest;
+}
+export interface IncidentStore {
+    record(incident: TurnIncident, evidence?: TurnIncidentEvidence): RecordResult;
+    /** Load a manifest by id, or null if absent/corrupt. */
+    get(id: string): IncidentManifest | null;
+    /** Record that the user was notified at a level (dedupes re-notifying). */
+    markNotified(id: string, level: EscalationLevel, at?: number): void;
+    /**
+     * Append a recovery outcome to an incident bundle (Phase 3b). The runner
+     * executes recovery and returns the outcome; the receiver persists it here so
+     * the bundle records what was attempted and whether it worked. Capped like
+     * samples so a flapping stall cannot grow the manifest unbounded.
+     */
+    appendRecovery(id: string, outcome: RecoveryOutcome): void;
+    /** Link a filed GitHub issue to an incident fingerprint. */
+    linkIssue(id: string, issueNumber: number): void;
+    /** Mark an incident resolved (stops it folding new occurrences). */
+    resolve(id: string): void;
+    /** Prune bundles past retention / over the count cap. Returns pruned ids. */
+    prune(): string[];
+    /** Digest summary over the last `sinceMs`. */
+    digest(sinceMs: number): DigestSummary;
+    /** All manifests currently on disk (unsorted). */
+    list(): IncidentManifest[];
+}
+export declare function createIncidentStore(deps: IncidentStoreDeps): IncidentStore;
+//# sourceMappingURL=incident-store.d.ts.map

package/dist/agent/incident-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-store.d.ts","sourceRoot":"","sources":["../../src/agent/incident-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAErB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAA;AAEnB,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACjC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACnC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CACzE;AAED,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAA;IACX,EAAE,EAAE,aAAa,CAAA;IACjB,kCAAkC;IAClC,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,aAAa,EAAE,MAAM,MAAM,CAAA;IAC3B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,gFAAgF;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAOD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,YAAY,CAAA;IAC7E,wDAAwD;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAA;IACxC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnE;;;;;OAKG;IACH,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;IAC1D,4DAA4D;IAC5D,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAChD,oEAAoE;IACpE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,6EAA6E;IAC7E,KAAK,IAAI,MAAM,EAAE,CAAA;IACjB,8CAA8C;IAC9C,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAA;IACtC,kDAAkD;IAClD,IAAI,IAAI,gBAAgB,EAAE,CAAA;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAsS1E"}