@agentconnect.md/daemon 1.0.0-rc.22 → 1.0.0-rc.221

package/dist/gitcred-server-Dcsq6QJe.js

@@ -0,0 +1,236 @@
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:net";
+//#region src/cp/git-credential.ts
+/** Hand out only while more than this remains (nests under the CP's 15min floor). */
+const HANDOUT_MIN_MS = 600 * 1e3;
+var GitCredUnavailableError = class extends Error {
+	terminal;
+	constructor(message, terminal) {
+		super(message);
+		this.terminal = terminal;
+		this.name = "GitCredUnavailableError";
+	}
+};
+var GitCredentialCache = class {
+	deps;
+	entries = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Map();
+	/** Agents the CP told us to stop asking for (SCOPE_DENIED — moved/mode-off). */
+	denied = /* @__PURE__ */ new Set();
+	monoNow;
+	constructor(deps) {
+		this.deps = deps;
+		this.monoNow = deps.monoNow ?? (() => performance.now());
+	}
+	/** A live credential for the agent's workspace repo — cached, coalesced, or freshly pulled. */
+	async get(agentId, reason) {
+		if (this.denied.has(agentId)) throw new GitCredUnavailableError("control plane denied git credentials for this agent", true);
+		const cached = this.entries.get(agentId);
+		if (cached && cached.expiresAtMono - this.monoNow() > HANDOUT_MIN_MS) return cached;
+		let pending = this.inflight.get(agentId);
+		if (!pending) {
+			pending = this.fetch(agentId, reason).finally(() => this.inflight.delete(agentId));
+			this.inflight.set(agentId, pending);
+		}
+		try {
+			return await pending;
+		} catch (e) {
+			if (cached && cached.expiresAtMono > this.monoNow()) {
+				this.deps.log.warn(`gitcred: refresh failed for agent ${agentId} — serving cached token`);
+				return cached;
+			}
+			throw e;
+		}
+	}
+	/**
+	* Invalidate on rejection. Git calls the helper's `erase` with the failing
+	* credential when the remote refuses it (GitHub revokes instantly on
+	* uninstall/suspend) — matching on the presented password keeps a racing
+	* fresh grant from being wiped by a stale erase.
+	*/
+	invalidate(agentId, presentedPassword) {
+		const entry = this.entries.get(agentId);
+		if (!entry) return;
+		if (presentedPassword !== void 0 && entry.token !== presentedPassword) return;
+		this.entries.delete(agentId);
+	}
+	/** agent/remove: drop the orphaned bearer token with the agent dir. */
+	remove(agentId) {
+		this.entries.delete(agentId);
+		this.denied.delete(agentId);
+	}
+	async fetch(agentId, reason) {
+		let grant;
+		try {
+			grant = await this.deps.request({
+				agentId,
+				reason
+			});
+		} catch (e) {
+			if (e.code === "SCOPE_DENIED") {
+				this.denied.add(agentId);
+				this.entries.delete(agentId);
+				throw new GitCredUnavailableError(e.message, true);
+			}
+			throw new GitCredUnavailableError(e.message, false);
+		}
+		const entry = {
+			username: grant.username,
+			token: grant.token,
+			repoFullName: grant.repoFullName,
+			access: grant.access,
+			expiresAtMono: this.monoNow() + grant.ttlSec * 1e3
+		};
+		this.entries.set(agentId, entry);
+		return entry;
+	}
+	/** A replicated spec change may re-enable a previously denied agent. */
+	clearDenied(agentId) {
+		this.denied.delete(agentId);
+	}
+};
+//#endregion
+//#region src/cp/gitcred-server.ts
+/**
+* gitcred.sock — the local credential channel for agent-run git
+* (docs/designs/github-app-git-credentials.md §本地 helper 通道).
+*
+* A tiny newline-delimited-JSON server over a unix socket (0700 dir + 0600
+* socket, stale-socket cleanup — the `mcp/control-server.ts` pattern). The
+* `agentconnect git-credential` CLI subcommand connects per git invocation:
+*   { op: 'get',   agentId }            → { ok, username, password } | { ok:false, error }
+*   { op: 'erase', agentId, password? } → { ok: true }
+*
+* Trust model (design §信任模型 #1): same host + same OS user = ONE trust
+* domain. `agentId` here is routing, not authorization — any same-user process
+* can already read every workspace on this daemon. Tokens transit the socket
+* and helper stdout only; nothing lands on disk.
+*
+* Alongside the socket the daemon (re)writes two SECRET-FREE files per boot:
+* the shim `run/git-credential-helper.sh` (pins the current node + CLI path so
+* `.git/config` survives daemon upgrades) and per-agent gitconfig includes for
+* the session-env channel (see workspace/git-injection.ts).
+*/
+function gitcredSocketPath(root) {
+	return join(root, "run", "gitcred.sock");
+}
+function gitcredShimPath(root) {
+	return join(root, "run", "git-credential-helper.sh");
+}
+var GitCredServer = class {
+	cache;
+	path;
+	log;
+	server;
+	constructor(cache, path, log) {
+		this.cache = cache;
+		this.path = path;
+		this.log = log;
+	}
+	start() {
+		const dir = dirname(this.path);
+		mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			chmodSync(dir, 448);
+		} catch {}
+		rmSync(this.path, { force: true });
+		const server = createServer((sock) => this.serve(sock));
+		server.listen(this.path, () => {
+			try {
+				chmodSync(this.path, 384);
+			} catch {}
+			this.log.info(`gitcred: helper socket at ${this.path}`);
+		});
+		server.on("error", (e) => this.log.warn(`gitcred: socket error: ${e.message}`));
+		this.server = server;
+	}
+	stop() {
+		this.server?.close();
+		rmSync(this.path, { force: true });
+	}
+	serve(sock) {
+		let buf = "";
+		sock.on("data", (chunk) => {
+			buf += chunk.toString("utf8");
+			const nl = buf.indexOf("\n");
+			if (nl === -1) return;
+			const line = buf.slice(0, nl);
+			buf = buf.slice(nl + 1);
+			this.handle(line, sock);
+		});
+		sock.on("error", () => sock.destroy());
+	}
+	async handle(line, sock) {
+		const reply = (msg) => {
+			sock.write(JSON.stringify(msg) + "\n");
+			sock.end();
+		};
+		let req;
+		try {
+			req = JSON.parse(line);
+		} catch {
+			return reply({
+				ok: false,
+				error: "malformed request"
+			});
+		}
+		if (req.op === "erase") {
+			this.cache.invalidate(req.agentId, req.password);
+			return reply({ ok: true });
+		}
+		if (req.op !== "get" || typeof req.agentId !== "string") return reply({
+			ok: false,
+			error: "unsupported op"
+		});
+		try {
+			const cred = await this.cache.get(req.agentId, "helper");
+			return reply({
+				ok: true,
+				username: cred.username,
+				password: cred.token
+			});
+		} catch (e) {
+			return reply({
+				ok: false,
+				error: e instanceof GitCredUnavailableError ? e.message : `git credentials unavailable: ${e.message}`
+			});
+		}
+	}
+};
+/**
+* (Re)write the secret-free shim `.git/config` helper lines exec through. The
+* absolute node + CLI paths are re-pinned every daemon boot, so repo configs
+* keep working across upgrades/relocations. Quoted throughout — a home dir
+* with a space (macOS "/Users/John Smith/…") must not word-split.
+*/
+function writeGitcredShim(root, cliEntry) {
+	const shim = gitcredShimPath(root);
+	mkdirSync(dirname(shim), {
+		recursive: true,
+		mode: 448
+	});
+	const q = (v) => `'${v.replaceAll("'", "'\\''")}'`;
+	const argv = [q(process.execPath)];
+	if (cliEntry.endsWith(".ts")) {
+		const req = createRequire(import.meta.url);
+		argv.push(q(req.resolve("tsx/cli")));
+	}
+	argv.push(q(cliEntry));
+	writeFileSync(shim, [
+		"#!/bin/sh",
+		"# agentconnect git credential helper shim — regenerated on daemon start; NO secrets.",
+		`AGENTCONNECT_ROOT=${q(root)} \\`,
+		`  exec ${argv.join(" ")} git-credential "$@"`,
+		""
+	].join("\n"), { mode: 493 });
+	return shim;
+}
+//#endregion
+export { GitCredentialCache as i, gitcredSocketPath as n, writeGitcredShim as r, GitCredServer as t };
+
+//# sourceMappingURL=gitcred-server-Dcsq6QJe.js.map

package/dist/gitcred-server-Dcsq6QJe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitcred-server-Dcsq6QJe.js","names":[],"sources":["../src/cp/git-credential.ts","../src/cp/gitcred-server.ts"],"sourcesContent":["/**\n * GitCredentialCache — daemon-side memory for CP-minted git credentials\n * (docs/designs/github-app-git-credentials.md §daemon 侧).\n *\n * Tokens live ONLY here (and transiently on helper stdout pipes): never disk,\n * never argv, never a log line. Expiry is tracked on the MONOTONIC clock as\n * `receivedAt + ttlSec` — a skewed wall clock must never resurrect a dead\n * token (`expiresAt` in the grant is observability only).\n *\n * Threshold nesting: entries are handed out only while >10min remain (the CP\n * serves grants with ≥15min, so a fresh grant always clears this). Per-agent\n * in-flight coalescing (the `cloneInFlight` pattern) keeps a cold cache from\n * fanning N concurrent helper/pull/prefetch calls into N WS REQs.\n *\n * Degradation: outside READY the fetch fails fast (see CpClient.requestGitCred)\n * and an UNEXPIRED cached token keeps serving — CP downtime only breaks remote\n * git once the hour runs out.\n */\nimport type { GitCredGrant } from '@agentconnect.md/protocol'\n\n/** Hand out only while more than this remains (nests under the CP's 15min floor). */\nconst HANDOUT_MIN_MS = 10 * 60 * 1000\n\nexport class GitCredUnavailableError extends Error {\n  constructor(\n    message: string,\n    /** Terminal (SCOPE_DENIED): stop asking for this agent until config changes. */\n    readonly terminal: boolean\n  ) {\n    super(message)\n    this.name = 'GitCredUnavailableError'\n  }\n}\n\ninterface Entry {\n  username: string\n  token: string\n  repoFullName: string\n  access: 'read' | 'write'\n  /** Monotonic deadline (ms on the injected monotonic clock). */\n  expiresAtMono: number\n}\n\nexport interface GitCredentialCacheDeps {\n  /** D→C `gitcred/request` — throws WireError-shaped errors (`code`, `retryable`). */\n  request: (payload: {\n    agentId: string\n    reason?: 'clone' | 'fetch' | 'pull' | 'push' | 'helper'\n  }) => Promise<GitCredGrant>\n  log: { warn: (msg: string) => void }\n  /** Monotonic ms; injectable for tests. */\n  monoNow?: () => number\n}\n\nexport class GitCredentialCache {\n  private readonly entries = new Map<string, Entry>()\n  private readonly inflight = new Map<string, Promise<Entry>>()\n  /** Agents the CP told us to stop asking for (SCOPE_DENIED — moved/mode-off). */\n  private readonly denied = new Set<string>()\n  private readonly monoNow: () => number\n\n  constructor(private readonly deps: GitCredentialCacheDeps) {\n    this.monoNow = deps.monoNow ?? (() => performance.now())\n  }\n\n  /** A live credential for the agent's workspace repo — cached, coalesced, or freshly pulled. */\n  async get(agentId: string, reason: 'clone' | 'fetch' | 'pull' | 'push' | 'helper'): Promise<Entry> {\n    if (this.denied.has(agentId)) {\n      throw new GitCredUnavailableError('control plane denied git credentials for this agent', true)\n    }\n    const cached = this.entries.get(agentId)\n    if (cached && cached.expiresAtMono - this.monoNow() > HANDOUT_MIN_MS) return cached\n\n    let pending = this.inflight.get(agentId)\n    if (!pending) {\n      pending = this.fetch(agentId, reason).finally(() => this.inflight.delete(agentId))\n      this.inflight.set(agentId, pending)\n    }\n    try {\n      return await pending\n    } catch (e) {\n      // CP unreachable / transient: an UNEXPIRED cached token still serves.\n      if (cached && cached.expiresAtMono > this.monoNow()) {\n        this.deps.log.warn(`gitcred: refresh failed for agent ${agentId} — serving cached token`)\n        return cached\n      }\n      throw e\n    }\n  }\n\n  /**\n   * Invalidate on rejection. Git calls the helper's `erase` with the failing\n   * credential when the remote refuses it (GitHub revokes instantly on\n   * uninstall/suspend) — matching on the presented password keeps a racing\n   * fresh grant from being wiped by a stale erase.\n   */\n  invalidate(agentId: string, presentedPassword?: string): void {\n    const entry = this.entries.get(agentId)\n    if (!entry) return\n    if (presentedPassword !== undefined && entry.token !== presentedPassword) return\n    this.entries.delete(agentId)\n  }\n\n  /** agent/remove: drop the orphaned bearer token with the agent dir. */\n  remove(agentId: string): void {\n    this.entries.delete(agentId)\n    this.denied.delete(agentId)\n  }\n\n  private async fetch(agentId: string, reason: 'clone' | 'fetch' | 'pull' | 'push' | 'helper'): Promise<Entry> {\n    let grant: GitCredGrant\n    try {\n      grant = await this.deps.request({ agentId, reason })\n    } catch (e) {\n      const code = (e as { code?: string }).code\n      if (code === 'SCOPE_DENIED') {\n        // Terminal: the agent moved daemons or left github-app mode. Stop\n        // asking until the CP replicates a new spec (which clears the flag).\n        this.denied.add(agentId)\n        this.entries.delete(agentId)\n        throw new GitCredUnavailableError((e as Error).message, true)\n      }\n      throw new GitCredUnavailableError((e as Error).message, false)\n    }\n    const entry: Entry = {\n      username: grant.username,\n      token: grant.token,\n      repoFullName: grant.repoFullName,\n      access: grant.access,\n      expiresAtMono: this.monoNow() + grant.ttlSec * 1000\n    }\n    this.entries.set(agentId, entry)\n    return entry\n  }\n\n  /** A replicated spec change may re-enable a previously denied agent. */\n  clearDenied(agentId: string): void {\n    this.denied.delete(agentId)\n  }\n}\n","/**\n * gitcred.sock — the local credential channel for agent-run git\n * (docs/designs/github-app-git-credentials.md §本地 helper 通道).\n *\n * A tiny newline-delimited-JSON server over a unix socket (0700 dir + 0600\n * socket, stale-socket cleanup — the `mcp/control-server.ts` pattern). The\n * `agentconnect git-credential` CLI subcommand connects per git invocation:\n *   { op: 'get',   agentId }            → { ok, username, password } | { ok:false, error }\n *   { op: 'erase', agentId, password? } → { ok: true }\n *\n * Trust model (design §信任模型 #1): same host + same OS user = ONE trust\n * domain. `agentId` here is routing, not authorization — any same-user process\n * can already read every workspace on this daemon. Tokens transit the socket\n * and helper stdout only; nothing lands on disk.\n *\n * Alongside the socket the daemon (re)writes two SECRET-FREE files per boot:\n * the shim `run/git-credential-helper.sh` (pins the current node + CLI path so\n * `.git/config` survives daemon upgrades) and per-agent gitconfig includes for\n * the session-env channel (see workspace/git-injection.ts).\n */\nimport { createServer, type Server, type Socket } from 'node:net'\nimport { chmodSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport { dirname, join } from 'node:path'\nimport { GitCredentialCache, GitCredUnavailableError } from './git-credential.js'\n\nexport function gitcredSocketPath(root: string): string {\n  return join(root, 'run', 'gitcred.sock')\n}\n\nexport function gitcredShimPath(root: string): string {\n  return join(root, 'run', 'git-credential-helper.sh')\n}\n\ninterface GitCredIpcRequest {\n  op: 'get' | 'erase'\n  agentId: string\n  password?: string\n}\n\nexport class GitCredServer {\n  private server?: Server\n\n  constructor(\n    private readonly cache: GitCredentialCache,\n    private readonly path: string,\n    private readonly log: { info: (m: string) => void; warn: (m: string) => void }\n  ) {}\n\n  start(): void {\n    const dir = dirname(this.path)\n    mkdirSync(dir, { recursive: true, mode: 0o700 })\n    try {\n      chmodSync(dir, 0o700) // defeat a loose umask; best-effort on non-POSIX\n    } catch {\n      /* best-effort */\n    }\n    rmSync(this.path, { force: true }) // a stale socket from a crash makes listen() throw\n\n    const server = createServer((sock) => this.serve(sock))\n    server.listen(this.path, () => {\n      try {\n        chmodSync(this.path, 0o600)\n      } catch {\n        /* best-effort */\n      }\n      this.log.info(`gitcred: helper socket at ${this.path}`)\n    })\n    server.on('error', (e) => this.log.warn(`gitcred: socket error: ${e.message}`))\n    this.server = server\n  }\n\n  stop(): void {\n    this.server?.close()\n    rmSync(this.path, { force: true })\n  }\n\n  private serve(sock: Socket): void {\n    let buf = ''\n    sock.on('data', (chunk) => {\n      buf += chunk.toString('utf8')\n      const nl = buf.indexOf('\\n')\n      if (nl === -1) return\n      const line = buf.slice(0, nl)\n      buf = buf.slice(nl + 1)\n      void this.handle(line, sock)\n    })\n    sock.on('error', () => sock.destroy())\n  }\n\n  private async handle(line: string, sock: Socket): Promise<void> {\n    const reply = (msg: unknown) => {\n      sock.write(JSON.stringify(msg) + '\\n')\n      sock.end()\n    }\n    let req: GitCredIpcRequest\n    try {\n      req = JSON.parse(line) as GitCredIpcRequest\n    } catch {\n      return reply({ ok: false, error: 'malformed request' })\n    }\n    if (req.op === 'erase') {\n      // Git presents the rejected credential — GitHub revokes instantly on\n      // uninstall/suspend, and this is how the daemon cache learns.\n      this.cache.invalidate(req.agentId, req.password)\n      return reply({ ok: true })\n    }\n    if (req.op !== 'get' || typeof req.agentId !== 'string') {\n      return reply({ ok: false, error: 'unsupported op' })\n    }\n    try {\n      const cred = await this.cache.get(req.agentId, 'helper')\n      return reply({ ok: true, username: cred.username, password: cred.token })\n    } catch (e) {\n      const msg =\n        e instanceof GitCredUnavailableError ? e.message : `git credentials unavailable: ${(e as Error).message}`\n      return reply({ ok: false, error: msg })\n    }\n  }\n}\n\n/**\n * (Re)write the secret-free shim `.git/config` helper lines exec through. The\n * absolute node + CLI paths are re-pinned every daemon boot, so repo configs\n * keep working across upgrades/relocations. Quoted throughout — a home dir\n * with a space (macOS \"/Users/John Smith/…\") must not word-split.\n */\nexport function writeGitcredShim(root: string, cliEntry: string): string {\n  const shim = gitcredShimPath(root)\n  mkdirSync(dirname(shim), { recursive: true, mode: 0o700 })\n  const q = (v: string) => `'${v.replaceAll(\"'\", \"'\\\\''\")}'`\n  // Production runs the built dist (a .js entry node executes directly). A dev\n  // daemon runs under tsx with a .ts argv[1] — route the shim through the tsx\n  // CLI then, or plain `node entry.ts` would die resolving .js-suffixed imports.\n  const argv = [q(process.execPath)]\n  if (cliEntry.endsWith('.ts')) {\n    const req = createRequire(import.meta.url)\n    argv.push(q(req.resolve('tsx/cli')))\n  }\n  argv.push(q(cliEntry))\n  const body = [\n    '#!/bin/sh',\n    '# agentconnect git credential helper shim — regenerated on daemon start; NO secrets.',\n    `AGENTCONNECT_ROOT=${q(root)} \\\\`,\n    `  exec ${argv.join(' ')} git-credential \"$@\"`,\n    ''\n  ].join('\\n')\n  writeFileSync(shim, body, { mode: 0o755 })\n  return shim\n}\n"],"mappings":";;;;;;AAqBA,MAAM,iBAAiB,MAAU;AAEjC,IAAa,0BAAb,cAA6C,MAAM;CAItC;CAHX,YACE,SAEA,UACA;EACA,MAAM,OAAO;EAFJ,KAAA,WAAA;EAGT,KAAK,OAAO;CACd;AACF;AAsBA,IAAa,qBAAb,MAAgC;CAOD;CAN7B,0BAA2B,IAAI,IAAmB;CAClD,2BAA4B,IAAI,IAA4B;;CAE5D,yBAA0B,IAAI,IAAY;CAC1C;CAEA,YAAY,MAA+C;EAA9B,KAAA,OAAA;EAC3B,KAAK,UAAU,KAAK,kBAAkB,YAAY,IAAI;CACxD;;CAGA,MAAM,IAAI,SAAiB,QAAwE;EACjG,IAAI,KAAK,OAAO,IAAI,OAAO,GACzB,MAAM,IAAI,wBAAwB,uDAAuD,IAAI;EAE/F,MAAM,SAAS,KAAK,QAAQ,IAAI,OAAO;EACvC,IAAI,UAAU,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,OAAO;EAE7E,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO;EACvC,IAAI,CAAC,SAAS;GACZ,UAAU,KAAK,MAAM,SAAS,MAAM,CAAC,CAAC,cAAc,KAAK,SAAS,OAAO,OAAO,CAAC;GACjF,KAAK,SAAS,IAAI,SAAS,OAAO;EACpC;EACA,IAAI;GACF,OAAO,MAAM;EACf,SAAS,GAAG;GAEV,IAAI,UAAU,OAAO,gBAAgB,KAAK,QAAQ,GAAG;IACnD,KAAK,KAAK,IAAI,KAAK,qCAAqC,QAAQ,wBAAwB;IACxF,OAAO;GACT;GACA,MAAM;EACR;CACF;;;;;;;CAQA,WAAW,SAAiB,mBAAkC;EAC5D,MAAM,QAAQ,KAAK,QAAQ,IAAI,OAAO;EACtC,IAAI,CAAC,OAAO;EACZ,IAAI,sBAAsB,KAAA,KAAa,MAAM,UAAU,mBAAmB;EAC1E,KAAK,QAAQ,OAAO,OAAO;CAC7B;;CAGA,OAAO,SAAuB;EAC5B,KAAK,QAAQ,OAAO,OAAO;EAC3B,KAAK,OAAO,OAAO,OAAO;CAC5B;CAEA,MAAc,MAAM,SAAiB,QAAwE;EAC3G,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,KAAK,KAAK,QAAQ;IAAE;IAAS;GAAO,CAAC;EACrD,SAAS,GAAG;GAEV,IADc,EAAwB,SACzB,gBAAgB;IAG3B,KAAK,OAAO,IAAI,OAAO;IACvB,KAAK,QAAQ,OAAO,OAAO;IAC3B,MAAM,IAAI,wBAAyB,EAAY,SAAS,IAAI;GAC9D;GACA,MAAM,IAAI,wBAAyB,EAAY,SAAS,KAAK;EAC/D;EACA,MAAM,QAAe;GACnB,UAAU,MAAM;GAChB,OAAO,MAAM;GACb,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd,eAAe,KAAK,QAAQ,IAAI,MAAM,SAAS;EACjD;EACA,KAAK,QAAQ,IAAI,SAAS,KAAK;EAC/B,OAAO;CACT;;CAGA,YAAY,SAAuB;EACjC,KAAK,OAAO,OAAO,OAAO;CAC5B;AACF;;;;;;;;;;;;;;;;;;;;;;;ACjHA,SAAgB,kBAAkB,MAAsB;CACtD,OAAO,KAAK,MAAM,OAAO,cAAc;AACzC;AAEA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,KAAK,MAAM,OAAO,0BAA0B;AACrD;AAQA,IAAa,gBAAb,MAA2B;CAIN;CACA;CACA;CALnB;CAEA,YACE,OACA,MACA,KACA;EAHiB,KAAA,QAAA;EACA,KAAA,OAAA;EACA,KAAA,MAAA;CAChB;CAEH,QAAc;EACZ,MAAM,MAAM,QAAQ,KAAK,IAAI;EAC7B,UAAU,KAAK;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC/C,IAAI;GACF,UAAU,KAAK,GAAK;EACtB,QAAQ,CAER;EACA,OAAO,KAAK,MAAM,EAAE,OAAO,KAAK,CAAC;EAEjC,MAAM,SAAS,cAAc,SAAS,KAAK,MAAM,IAAI,CAAC;EACtD,OAAO,OAAO,KAAK,YAAY;GAC7B,IAAI;IACF,UAAU,KAAK,MAAM,GAAK;GAC5B,QAAQ,CAER;GACA,KAAK,IAAI,KAAK,6BAA6B,KAAK,MAAM;EACxD,CAAC;EACD,OAAO,GAAG,UAAU,MAAM,KAAK,IAAI,KAAK,0BAA0B,EAAE,SAAS,CAAC;EAC9E,KAAK,SAAS;CAChB;CAEA,OAAa;EACX,KAAK,QAAQ,MAAM;EACnB,OAAO,KAAK,MAAM,EAAE,OAAO,KAAK,CAAC;CACnC;CAEA,MAAc,MAAoB;EAChC,IAAI,MAAM;EACV,KAAK,GAAG,SAAS,UAAU;GACzB,OAAO,MAAM,SAAS,MAAM;GAC5B,MAAM,KAAK,IAAI,QAAQ,IAAI;GAC3B,IAAI,OAAO,IAAI;GACf,MAAM,OAAO,IAAI,MAAM,GAAG,EAAE;GAC5B,MAAM,IAAI,MAAM,KAAK,CAAC;GACtB,KAAU,OAAO,MAAM,IAAI;EAC7B,CAAC;EACD,KAAK,GAAG,eAAe,KAAK,QAAQ,CAAC;CACvC;CAEA,MAAc,OAAO,MAAc,MAA6B;EAC9D,MAAM,SAAS,QAAiB;GAC9B,KAAK,MAAM,KAAK,UAAU,GAAG,IAAI,IAAI;GACrC,KAAK,IAAI;EACX;EACA,IAAI;EACJ,IAAI;GACF,MAAM,KAAK,MAAM,IAAI;EACvB,QAAQ;GACN,OAAO,MAAM;IAAE,IAAI;IAAO,OAAO;GAAoB,CAAC;EACxD;EACA,IAAI,IAAI,OAAO,SAAS;GAGtB,KAAK,MAAM,WAAW,IAAI,SAAS,IAAI,QAAQ;GAC/C,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC;EAC3B;EACA,IAAI,IAAI,OAAO,SAAS,OAAO,IAAI,YAAY,UAC7C,OAAO,MAAM;GAAE,IAAI;GAAO,OAAO;EAAiB,CAAC;EAErD,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI,SAAS,QAAQ;GACvD,OAAO,MAAM;IAAE,IAAI;IAAM,UAAU,KAAK;IAAU,UAAU,KAAK;GAAM,CAAC;EAC1E,SAAS,GAAG;GAGV,OAAO,MAAM;IAAE,IAAI;IAAO,OADxB,aAAa,0BAA0B,EAAE,UAAU,gCAAiC,EAAY;GAC7D,CAAC;EACxC;CACF;AACF;;;;;;;AAQA,SAAgB,iBAAiB,MAAc,UAA0B;CACvE,MAAM,OAAO,gBAAgB,IAAI;CACjC,UAAU,QAAQ,IAAI,GAAG;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,KAAK,MAAc,IAAI,EAAE,WAAW,KAAK,OAAO,EAAE;CAIxD,MAAM,OAAO,CAAC,EAAE,QAAQ,QAAQ,CAAC;CACjC,IAAI,SAAS,SAAS,KAAK,GAAG;EAC5B,MAAM,MAAM,cAAc,OAAO,KAAK,GAAG;EACzC,KAAK,KAAK,EAAE,IAAI,QAAQ,SAAS,CAAC,CAAC;CACrC;CACA,KAAK,KAAK,EAAE,QAAQ,CAAC;CAQrB,cAAc,MAPD;EACX;EACA;EACA,qBAAqB,EAAE,IAAI,EAAE;EAC7B,UAAU,KAAK,KAAK,GAAG,EAAE;EACzB;CACF,CAAC,CAAC,KAAK,IACgB,GAAG,EAAE,MAAM,IAAM,CAAC;CACzC,OAAO;AACT"}