@adonis-agora/durable 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/src/dashboard/define_config.js

@@ -1,132 +1,38 @@
-import { timingSafeEqual } from 'node:crypto';
-import { resolveDashboardAuth, } from './auth.js';
+import { normalizeConsoleDecision, resolveConsoleAuthorize, } from './console_authorize.js';
 /**
  * Collapse an {@link AuthorizeResult} into a decision. Only `true` or an object with
- * `allowed === true` allows: anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a
- * missing value — denies. (A decision OBJECT is truthy, so a `!result` check would wave
- * `{ allowed: false }` through; this is why the guard never tests the raw value.)
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial carrying the redirect
+ * target; anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value —
+ * denies with `403`.
  */
 export function normalizeAuthorizeResult(result) {
-    if (result === true)
-        return { allowed: true };
-    if (typeof result === 'object' &&
-        result !== null &&
-        result.allowed === true) {
-        return { allowed: true };
-    }
-    const reason = typeof result === 'object' && result !== null
-        ? result.reason
-        : undefined;
-    return { allowed: false, reason: reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden' };
+    return normalizeConsoleDecision(result);
 }
-/**
- * Whether the process is running in production. Mirrors how AdonisJS reads the
- * environment without taking a hard dependency on its env service. No longer an
- * AUTH decision input (the guard fails closed everywhere) — used only for
- * cookie hardening defaults.
- */
-export function isProduction() {
-    return (process.env.NODE_ENV ?? '').toLowerCase() === 'production';
-}
-/**
- * Extract a bearer token from an `Authorization: Bearer <token>` header, a
- * `token` query-string param, or an `x-durable-token` header — whichever is
- * present. Returns `undefined` when none is supplied.
- */
-function readToken(ctx) {
-    const header = ctx.request.header('authorization');
-    if (header) {
-        const match = /^Bearer\s+(.+)$/i.exec(header);
-        if (match?.[1])
-            return match[1].trim();
-    }
-    const xHeader = ctx.request.header('x-durable-token');
-    if (xHeader)
-        return xHeader.trim();
-    // The query-string channel exists ONLY because EventSource (the SSE live-tail) cannot set
-    // headers. Restricted to read methods: a `?token=` that authorized POSTs turned any leaked/logged
-    // URL (access logs, Referer, browser history) into a destructive-capable magic link.
-    const method = ctx.request.method().toUpperCase();
-    if (method === 'GET' || method === 'HEAD') {
-        const qs = ctx.request.qs().token;
-        if (typeof qs === 'string' && qs.length > 0)
-            return qs;
-    }
-    return undefined;
-}
-/**
- * Compare two secrets in constant time (guarding for equal byte-length first,
- * since {@link timingSafeEqual} throws on a length mismatch). Returns `false`
- * for any length difference, otherwise the timing-safe equality — so the token
- * check leaks neither a match nor the token's length via response time.
- */
-function secretsMatch(a, b) {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length)
-        return false;
-    return timingSafeEqual(bufA, bufB);
-}
-/**
- * The default guard: FAIL CLOSED in every environment — require a bearer token equal to
- * `DURABLE_DASHBOARD_TOKEN`, denying everything when that env var is unset. There is no
- * NODE_ENV branch anymore: "not production" is exactly the set of deployments (dev boxes,
- * staging, misspelled envs) that used to ship an open console. Opt out explicitly with
- * `allowUnauthenticated: true`, or configure `dashboardAuth`/your own `authorize`.
- */
-export function defaultAuthorize(ctx) {
-    const expected = process.env.DURABLE_DASHBOARD_TOKEN;
-    if (!expected)
-        return false;
-    const provided = readToken(ctx);
-    if (provided === undefined)
-        return false;
-    // Constant-time compare to remove the timing side-channel from the token check.
-    return secretsMatch(provided, expected);
-}
-/** The explicit `allowUnauthenticated: true` guard — allow everything, by conscious opt-in only. */
-const allowAll = () => true;
-let warnedOpenDashboard = false;
+/** The warning logged once at boot when `authorize` is omitted. */
+export const NO_AUTHORIZE_WARNING = '[@adonis-agora/durable] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/durable_dashboard.ts.';
+const allowAll = async () => ({ allowed: true });
+const denyAll = async () => ({ allowed: false, reason: 'forbidden' });
 /** Apply defaults to a partial config, producing a fully-resolved one. */
-export function resolveConfig(config = {}) {
+export function resolveConfig(config = {}, options = {}) {
     const rawPath = config.path ?? '/durable';
     // Normalize: ensure a single leading slash and no trailing slash (root stays '/').
     const trimmed = `/${rawPath.replace(/^\/+/, '').replace(/\/+$/, '')}`;
-    // Default guard resolution, in order:
-    //  1. a host `authorize` hook wins;
-    //  2. `dashboardAuth` configured -> the session guard IS the gate (the default token guard would
-    //     otherwise 403 every login flow that never set DURABLE_DASHBOARD_TOKEN);
-    //  3. `allowUnauthenticated: true` -> consciously open (warned once at resolve time);
-    //  4. else the fail-closed token guard.
-    const hasDashboardAuth = config.dashboardAuth !== undefined;
+    const authorizeConfigured = config.authorize !== undefined;
     let authorize;
-    if (config.authorize) {
-        authorize = config.authorize;
-    }
-    else if (hasDashboardAuth) {
-        authorize = allowAll;
-    }
-    else if (config.allowUnauthenticated === true) {
-        if (!warnedOpenDashboard) {
-            warnedOpenDashboard = true;
-            console.warn('[durable_dashboard] allowUnauthenticated: true — the console (including destructive ' +
-                'endpoints) is served with NO authentication. Never ship this to a reachable network.');
-        }
-        authorize = allowAll;
-    }
-    else {
-        authorize = defaultAuthorize;
-    }
+    if (config.authorize !== undefined)
+        authorize = resolveConsoleAuthorize(config.authorize);
+    else
+        authorize = options.inProduction === false ? allowAll : denyAll;
     return {
         enabled: config.enabled ?? true,
         path: trimmed === '/' ? '' : trimmed,
         authorize,
-        // Validate + resolve now so a misconfigured secret/login fails closed at boot,
-        // not on the first login attempt. `null` when `dashboardAuth` is omitted.
-        dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
+        authorizeConfigured,
         accessDenied: config.accessDenied ?? null,
         audit: config.audit ?? null,
         redact: config.redact ?? null,
+        viewer: config.viewer ?? null,
+        signOut: config.signOut ?? null,
     };
 }
 /** Identity helper giving `config/durable_dashboard.ts` full type-checking. */

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAiDnB;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAA4B,CAAC,OAAO,KAAK,IAAI,EAC9C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACpG,CAAC;AA+GD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,0FAA0F;IAC1F,kGAAkG;IAClG,qFAAqF;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,oGAAoG;AACpG,MAAM,QAAQ,GAAkB,GAAG,EAAE,CAAC,IAAI,CAAC;AAE3C,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAM,GAA2B,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,sCAAsC;IACtC,oCAAoC;IACpC,iGAAiG;IACjG,8EAA8E;IAC9E,sFAAsF;IACtF,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;IAC5D,IAAI,SAAwB,CAAC;IAC7B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,sFAAsF;gBACpF,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAqChC;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAoHD,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAC/B,sLAAsL,CAAC;AAEzL,MAAM,QAAQ,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACvE,MAAM,OAAO,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAW5F,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,MAAM,GAA2B,EAAE,EACnC,OAAO,GAAyB,EAAE;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IAC3D,IAAI,SAA+B,CAAC;IACpC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;;QACrF,SAAS,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,mBAAmB;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/dashboard/dev_tools.d.ts

@@ -0,0 +1,102 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { ConsoleDecision } from './console_authorize.js';
+import { type Deps } from './handlers.js';
+/** The container binding the dev-tools hub lives at. */
+export declare const DEV_TOOLS_BINDING = "agora.devTools";
+/** The hub a lib registers its developer tools into. */
+export interface DevToolsHub {
+    readonly version: 1;
+    register(lib: DevToolsLib): void;
+}
+/** One lib's tools and the gate that decides who may use them. */
+export interface DevToolsLib {
+    lib: string;
+    title: string;
+    authorize(ctx: HttpContext): Promise<DevToolsDecision>;
+    tools: DevTool[];
+}
+/** What a lib's `authorize` answers: the console decision. */
+export type DevToolsDecision = ConsoleDecision;
+/** One developer tool. */
+export interface DevTool {
+    name: string;
+    kind: 'read' | 'action';
+    description: string;
+    input: DevToolInputSchema;
+    destructive?: boolean;
+    available?(): boolean | Promise<boolean>;
+    run(input: Record<string, unknown>, call: DevToolCall): Promise<unknown>;
+}
+/** What a tool's `run` receives besides its input. */
+export interface DevToolCall {
+    ctx: HttpContext;
+    caller: DevToolsCaller;
+    limits: {
+        maxRows: number;
+        maxBytes: number;
+    };
+}
+/** Who is calling. Never a token value. */
+export interface DevToolsCaller {
+    id: string;
+    via: 'token' | 'session' | 'open';
+}
+/** One property of a {@link DevToolInputSchema}. */
+export interface DevToolInputProperty {
+    type: 'string' | 'number' | 'integer' | 'boolean' | 'array';
+    description?: string;
+    enum?: readonly string[];
+    items?: {
+        type: 'string';
+    };
+    minimum?: number;
+    maximum?: number;
+}
+/** An object of scalar / enum / array-of-string properties. */
+export interface DevToolInputSchema {
+    type: 'object';
+    properties: Record<string, DevToolInputProperty>;
+    required?: string[];
+}
+/** One console action performed through a dev tool, for the console's audit sink. */
+export interface DevToolAuditEntry {
+    /** `mcp:<caller id>`. */
+    actor: string;
+    /** The tool name, e.g. `durable_cancel_run`. */
+    tool: string;
+    /** The run id or schedule key the action targets. */
+    target: string;
+}
+/** What {@link durableDevTools} needs from the console. */
+export interface DurableDevToolsOptions {
+    /**
+     * The console's read/control port, resolved per call (the same `Deps` the console routes use), for
+     * the MCP request's context when there is one (so the console's tenant scope applies).
+     */
+    deps: (ctx?: HttpContext) => Promise<Deps>;
+    /** Records an action (retry, cancel, …) before it runs, like a console POST. */
+    audit?: (entry: DevToolAuditEntry) => void;
+    /** The fleet compatibility panel's body, when the console can build it (`GET /api/compat`). */
+    compat?: () => Promise<unknown>;
+}
+/** A blob field (run input/output/error, a step's input/output/error) is cut to this many bytes. */
+export declare const DEV_TOOL_FIELD_BYTES: number;
+/** Cut one value to {@link DEV_TOOL_FIELD_BYTES} of JSON, ending with `…(truncated, N bytes)`. */
+export declare function truncateBlob(value: unknown, maxBytes?: number): unknown;
+/**
+ * The durable console's developer tools: the same handlers (and so the same `redact` hooks) the
+ * console's JSON API runs, under `durable_*` names. Reads are listed by default; the actions (retry,
+ * cancel, continue, signal, schedule control) only when the app opts in on the dev endpoint.
+ */
+export declare function durableDevTools(options: DurableDevToolsOptions): DevTool[];
+/**
+ * Register the durable console's tools into the app's dev-tools hub, when one is bound (the app
+ * registered `@adonis-agora/agent/mcp_provider`). Returns whether it registered.
+ */
+export declare function registerDurableDevTools(container: {
+    hasBinding(binding: string): boolean;
+    make(binding: string): Promise<unknown>;
+}, options: DurableDevToolsOptions & {
+    authorize: (ctx: HttpContext) => Promise<DevToolsDecision>;
+}): Promise<boolean>;
+//# sourceMappingURL=dev_tools.d.ts.map

package/dist/src/dashboard/dev_tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev_tools.d.ts","sourceRoot":"","sources":["../../../src/dashboard/dev_tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAKL,KAAK,IAAI,EAYV,MAAM,eAAe,CAAC;AASvB,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvD,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAE/C,0BAA0B;AAC1B,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC3C,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAMD,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,QAAW,CAAC;AA6E7C,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAuB,GAAG,OAAO,CAUrF;AAgCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,EAAE,CAgX1E;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE;IACT,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC,EACD,OAAO,EAAE,sBAAsB,GAAG;IAAE,SAAS,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAAE,GAC/F,OAAO,CAAC,OAAO,CAAC,CAWlB"}