@ait-co/debug-console 0.1.1

package/dist/index.d.cts

@@ -0,0 +1,470 @@
+//#region ../internal-protocol/src/debug-host.d.ts
+/**
+ * Host allowlist predicates — the one part of the activation gate that BOTH
+ * sides of the device↔host protocol evaluate.
+ *
+ * The device evaluates them inside the runtime gate (`@ait-co/debug-console`'s
+ * `gate.ts`, Layer B1). The daemon evaluates the same predicate when it decides
+ * whether a CDP target's URL is allowed to be driven (`@ait-co/debugger`'s
+ * `debug-server.ts`). Before the split those two call sites shared one module
+ * by reaching from the daemon into the in-app tree — a reverse edge that would
+ * have dragged the browser bundle into the daemon's graph once the two surfaces
+ * became separate packages. Extracting the 5 predicates here removes the edge
+ * without duplicating the rule.
+ *
+ * This module is intentionally dependency-free (no Node, no DOM — only
+ * `String#endsWith` and one regex) so it inlines into both bundles. There is no
+ * barrel index in this package: each consumer imports the one subpath it needs,
+ * and its bundler inlines the handful of statements at build time. Nothing here
+ * survives as a runtime cross-package import.
+ *
+ * SECRET-HANDLING: a hostname is an input, never an output. These functions
+ * return booleans only — no predicate may grow to log or return the hostname,
+ * a relay URL, or a tunnel host.
+ */
+/**
+ * Returns whether `hostname` is a `*.private-apps.tossmini.com` subdomain —
+ * the host reserved for dogfood / private mini-app entries.
+ *
+ * The match is an exact suffix check, not a substring `.includes()`: a
+ * substring test would also accept an attacker-controlled host like
+ * `private-apps.tossmini.com.evil.example`, which ends in `.example`, not in
+ * `.tossmini.com`. Requiring the string to END with the suffix closes that.
+ * The leading `.` in the suffix also forces a real subdomain label, so a bare
+ * `private-apps.tossmini.com` (no mini-app subdomain) does not match.
+ */
+declare function isPrivateAppsHost(hostname: string): boolean;
+/**
+ * Returns whether `hostname` is any `*.tossmini.com` subdomain — the host
+ * family mini-app pages are served from. Includes the 2.x
+ * `*.private-apps.tossmini.com` dogfood hosts and the 3.0 unified serving
+ * hosts.
+ *
+ * Same exact-suffix `endsWith` check as {@link isPrivateAppsHost} — never a
+ * substring `.includes()`, which would accept `x.tossmini.com.evil.example`.
+ */
+declare function isTossminiHost(hostname: string): boolean;
+/**
+ * Returns whether `hostname` is a Cloudflare quick-tunnel host — the env 2
+ * (PWA) entry.
+ *
+ * Env 2 serves the local dev server through a `*.trycloudflare.com` quick
+ * tunnel. It has no production runtime: the SDK is the devtools mock and the
+ * page is the developer's own dev build. The host safety net (which stops a
+ * dogfood build that lands on a production host from attaching) has nothing to
+ * protect against here — but the remaining gate layers (opt-in, relay URL,
+ * TOTP) still apply, so a leaked tunnel URL is still blocked.
+ *
+ * Same exact-suffix `endsWith` check as {@link isPrivateAppsHost} — never a
+ * substring `.includes()`, which would accept
+ * `evil.trycloudflare.com.example.com`.
+ */
+declare function isTrycloudflareHost(hostname: string): boolean;
+//#endregion
+//#region src/gate.d.ts
+/** Shape returned when the gate allows attachment. */
+interface GateResultAttach {
+  readonly attach: true;
+  /** The validated `wss:` relay URL from the `relay` query param. */
+  readonly relayUrl: string;
+  /** The deployment ID extracted from the `_deploymentId` query param. */
+  readonly deploymentId: string;
+}
+/** Shape returned when the gate blocks attachment, with a reason code. */
+interface GateResultBlocked {
+  readonly attach: false;
+  /**
+   * - `'host'`          Layer B1: `hostname` is not a `*.private-apps.tossmini.com` host.
+   * - `'entry'`         Layer B2: `_deploymentId` param is absent or empty.
+   * - `'opt-in'`        Layer C1: `debug=1` param is absent.
+   * - `'invalid-relay'` Layer C2: `relay` param is absent, empty, or not a `wss:` URL.
+   * - `'auth'`          Layer C3: TOTP `at=` code is absent, invalid, or expired
+   *                     (only when a `verifyTotpCode` predicate is injected).
+   *
+   * There is no `'build'` reason: Layer A is enforced by the consumer's
+   * `if (__DEBUG_BUILD__)` guard, not by this function.
+   *
+   * SECRET-HANDLING: `'auth'` is the only value surfaced for auth failures —
+   * no code value, expected value, or secret fragment is ever exposed.
+   */
+  readonly reason: 'host' | 'entry' | 'opt-in' | 'invalid-relay' | 'auth';
+}
+type GateResult = GateResultAttach | GateResultBlocked;
+/**
+ * Input for {@link evaluateDebugGate}.
+ *
+ * All fields are explicit so the function is trivially testable without
+ * touching `window`.
+ */
+interface GateInput {
+  /**
+   * The host the page is served from — `window.location.hostname`.
+   *
+   * This is the Layer B1 security signal. Why hostname and not the entry
+   * scheme: the Toss SDK normalises `intoss-private://` to `intoss://` in
+   * `getSchemeUri()`, and `getOperationalEnvironment()` / `getWebViewType()`
+   * return the same value (`"toss"` / `"partner"`) for both dogfood and
+   * production entries — none of them distinguish a dogfood entry. The host
+   * does: a dogfood / private-apps entry is served from
+   * `*.private-apps.tossmini.com`, a production entry is not. This was
+   * confirmed live over CDP against mini-app 31146 (see spec open question 2).
+   */
+  readonly hostname: string;
+  /**
+   * The URL search params to inspect for gate signals (Layers B2 and C).
+   *
+   * Prefer `URLSearchParams` so callers can pass `new URLSearchParams(location.search)`
+   * without coupling the pure function to `window`.
+   */
+  readonly searchParams: URLSearchParams;
+  /**
+   * Optional TOTP code verifier for Layer C3 auth gate.
+   *
+   * When provided, `evaluateDebugGate` reads the `at` query param and passes
+   * it to this predicate. Return `true` to allow, `false` to block with
+   * `reason: 'auth'`.
+   *
+   * Inject via the consumer's build define, e.g.:
+   * ```ts
+   * // dogfood build entry — consumer's build injects __DEBUG_TOTP_SECRET__
+   * declare const __DEBUG_TOTP_SECRET__: string | undefined;
+   * const verifyTotpCode = typeof __DEBUG_TOTP_SECRET__ !== 'undefined'
+   *   ? (code: string) => verifyTotp(__DEBUG_TOTP_SECRET__, code)
+   *   : undefined;
+   * maybeAttach(evaluateDebugGate({ ...params, verifyTotpCode }));
+   * ```
+   *
+   * Security note: this predicate is a black-box from the gate's perspective.
+   * The gate only surfaces pass/fail and the `'auth'` reason code — no code
+   * value or secret fragment is ever logged or returned.
+   *
+   * When `undefined` (TOTP disabled), `at=` is silently ignored and the gate
+   * proceeds to ATTACH if all other layers pass.
+   */
+  readonly verifyTotpCode?: (code: string) => boolean;
+}
+/**
+ * Pure function that evaluates the runtime debug activation layers (B and C).
+ *
+ * Has no side effects. The input is explicit. Returns a discriminated union
+ * so callers can pattern-match on `result.attach`.
+ *
+ * Layer A (build-time) is intentionally not evaluated here — see the file-level
+ * comment. By the time this function runs, the consumer's `if (__DEBUG_BUILD__)`
+ * guard has already passed; this function only decides B and C.
+ *
+ * @example
+ * ```ts
+ * const result = evaluateDebugGate({
+ *   hostname: window.location.hostname,
+ *   searchParams: new URLSearchParams(window.location.search),
+ * });
+ * if (result.attach) {
+ *   // Proceed to load Chii client
+ * }
+ * ```
+ */
+declare function evaluateDebugGate(input: GateInput): GateResult;
+//#endregion
+//#region src/attach.d.ts
+/**
+ * Converts a validated `wss:` relay URL into the Chii `target.js` script URL.
+ *
+ * Scheme is mapped `wss:` → `https:`. Host and port are preserved.
+ * Pathname is set to `/target.js` (or `/at/<code>/target.js` when a TOTP code
+ * is given) regardless of the relay path. Query params and hash from the
+ * relay URL are dropped — the target script URL is a static asset path on the
+ * same host.
+ *
+ * TOTP path-prefix transport (issue #466): chii's stock `target.js` derives
+ * its WS endpoint from the script `src` (`scriptEl.src.replace('target.js',
+ * '')`), so embedding the current TOTP code in the script URL *path* is the
+ * only way the phone-side WS upgrade can carry it — both the script fetch and
+ * the derived `wss://<host>/at/<code>/target/<id>` dial inherit the prefix,
+ * and the relay verifies + strips it before chii parses the URL. The
+ * `window.ChiiServerUrl` + query alternative does NOT work: chii appends
+ * `target/<id>` to the serverUrl string, which would land after a `?`.
+ *
+ * SECRET-HANDLING: `atCode` rides only inside the returned URL (the intended
+ * transport — same exposure grade as the daemon client's `at=` query). It is
+ * never logged here.
+ *
+ * @example
+ * deriveTargetScriptUrl('wss://abc.trycloudflare.com/relay')
+ * // → 'https://abc.trycloudflare.com/target.js'
+ *
+ * deriveTargetScriptUrl('wss://h.example.com:9100/', '123456')
+ * // → 'https://h.example.com:9100/at/123456/target.js'
+ *
+ * @param relayUrl - Validated `wss:` relay URL from the gate result.
+ * @param atCode - Current TOTP code from the page URL's `at` query param, or
+ *   `null`/`undefined`/`''` to keep the legacy un-prefixed URL.
+ */
+declare function deriveTargetScriptUrl(relayUrl: string, atCode?: string | null): string;
+declare global {
+  interface Window {
+    /**
+     * Set once {@link installRelayWsObserver} has wrapped `window.WebSocket`
+     * (#730). The bare CDP-injected indicator (`buildIndicatorExpression`)
+     * checks this flag to decide whether it can piggy-back on the
+     * `ait:relay-ws-state` CustomEvent this module broadcasts, instead of
+     * installing a second competing `Proxy` on `window.WebSocket`.
+     */
+    __ait_relay_ws_observed?: boolean;
+  }
+}
+/**
+ * Idempotent, non-throwing teardown of the in-app debug surface (issue #748).
+ *
+ * Removes every debug-surface element WE injected and restores the one side
+ * effect WE applied:
+ *   1. The CDP-injected `#__ait_debug_indicator` badge (the persistent
+ *      "Debugger Disconnected" element). Its live heartbeat/pending-call timer
+ *      (#749) is stopped first via the badge controller's `stop()` so no 1 Hz
+ *      interval leaks past detach; `buildIndicatorExpression` also
+ *      self-dismisses the node — this is the in-app hard guarantee, idempotent,
+ *      a no-op if it is already gone.
+ *   2. The eruda in-page console (floating button + any open panel).
+ *   3. The native-bridge call observer (#749) — its `callAsyncMethod` /
+ *      `postMessage` / emitter wraps are restored and `window.__ait_bridge` is
+ *      removed, so nothing we wrapped survives the run's end.
+ *   4. keepAwake — forced on at attach; restored here so a run that ends
+ *      WITHOUT a page unload does not leave the screen pinned awake (the
+ *      existing `beforeunload` restore only covers the unload path).
+ *
+ * Deliberately NOT touched: the `window.WebSocket` observer proxy (kept so the
+ * #478 post-4401 fail-fast survives; it is non-blocking and never absorbs
+ * input), and any NATIVE overlay (out of our layer — see the block comment
+ * above and issue #748 hypothesis (a)).
+ *
+ * Never throws into the host app — every step is individually guarded.
+ * Exported for unit tests and for a consumer that wants to force a clean detach.
+ */
+declare function detachDebugSurface(): void;
+/**
+ * Self-report the mini-app's webViewType to the parent launcher shell, ONCE
+ * (#580).
+ *
+ * The mini-app's type is the build constant `__WEB_VIEW_TYPE__`, injected by
+ * the devtools unplugin from `granite.config.ts`'s `webViewProps.type`. The
+ * launcher (env-2 PWA) is cross-origin and cannot read it directly, so the
+ * framed page posts it to `window.parent`; the launcher switches to game mode
+ * automatically (no manual `?navBarType=game` URL edit).
+ *
+ * Defensive by construction — must NEVER break attach:
+ *  - `__WEB_VIEW_TYPE__` is a CONSUMER-build define; it does not exist in
+ *    devtools' own build or where the unplugin did not inject it. The `typeof`
+ *    guard avoids a ReferenceError; an absent constant is a silent no-op.
+ *  - Only posts when inside an iframe (`window.parent !== window`) — a
+ *    top-level load has no launcher shell to receive the message.
+ *  - The SDK's deprecated `'external'` alias of `partner` (web-framework 2.6.1)
+ *    is mapped to `'partner'`; the launcher only emulates `partner` | `game`.
+ *  - Wrapped in try/catch so any postMessage/iframe edge case is swallowed.
+ *
+ * SECRET-HANDLING: the payload carries ONLY the webViewType enum — no host,
+ * relay URL, code, or secret.
+ */
+declare function reportWebViewType(): void;
+/**
+ * Evaluates the 3-layer debug gate and, if the gate passes, injects the Chii
+ * `target.js` script into `document.head`.
+ *
+ * Idempotent — calling more than once is safe. The second call is a no-op if
+ * a script with the same `src` is already present in the document, and the
+ * module-level `attached` flag prevents redundant DOM queries after the first
+ * successful injection.
+ *
+ * Safe to call even if `document` is somehow unavailable (defensive boundary
+ * guard — in practice this always runs in a real WebView).
+ *
+ * **keepAwake side effect**: on a successful attach, `setScreenAwakeMode({
+ * enabled: true })` is called so the phone screen stays awake during the debug
+ * session. A `beforeunload` handler restores normal sleep on page unload.
+ * Opt out by adding `noKeepAwake=1` to the page URL query string — the check
+ * reads `window.location.search` directly, consistent with other guards in
+ * this file.
+ *
+ * @param gateResult - Optional pre-evaluated gate result for testability.
+ *   Defaults to `checkDebugGate()` which reads the current page URL. Passing a
+ *   custom value avoids the need to manipulate `window.location` in tests.
+ */
+declare function maybeAttach(gateResult?: GateResult): void;
+//#endregion
+//#region ../internal-protocol/src/bridge-observer-state.d.ts
+/**
+ * The `window.__ait_bridge` snapshot shape and the event/global names the
+ * device publishes it under.
+ *
+ * The device (`@ait-co/debug-console`) writes the snapshot; the daemon
+ * (`@ait-co/debugger`) reads it back field-by-field from inside a CDP
+ * `Runtime.evaluate` source string it assembles as text. There is therefore no
+ * compile-time link between writer and reader — the daemon's use of the
+ * interface is type-only (erased entirely) and its use of the name constants is
+ * string interpolation. Keeping both in one module is what makes a rename a
+ * compile error on the writing side and a single edit on the reading side,
+ * instead of a silent no-op badge.
+ *
+ * SECRET-HANDLING: the snapshot holds API METHOD NAMES + timestamps + a
+ * correlation id ONLY. It must never grow fields for call arguments, results,
+ * relay URLs, or auth codes.
+ */
+/** Name of the API being called (never its arguments). */
+interface BridgePendingCall {
+  method: string;
+  /** `Date.now()` epoch ms when the call was dispatched. */
+  startedAt: number;
+}
+/** The most-recent bridge activity — API name + wall-clock + settle status. */
+interface BridgeLastCall {
+  method: string;
+  /** `Date.now()` epoch ms of the start or settle that produced this record. */
+  at: number;
+  status: 'pending' | 'resolved' | 'rejected';
+}
+/**
+ * The snapshot exposed on `window.__ait_bridge`. `pending` is keyed by
+ * correlation id so a settle is an O(1) delete; the indicator reads
+ * `Object.values(pending)` and computes each call's live elapsed itself.
+ */
+interface BridgeObserverState {
+  pending: Record<string, BridgePendingCall>;
+  last: BridgeLastCall | null;
+}
+/**
+ * CustomEvent fired (no detail) on every bridge-call start/settle so the
+ * indicator badge re-renders promptly. SECRET-HANDLING: carries no detail
+ * payload at all — the badge reads the enum-only snapshot on receipt.
+ */
+declare const BRIDGE_CALL_EVENT = "ait:bridge-call";
+//#endregion
+//#region src/bridge-observer.d.ts
+declare global {
+  interface Window {
+    /**
+     * Read-only bridge-call snapshot published by {@link installBridgeObserver}
+     * (#749). The CDP-injected indicator badge reads this to render the pending
+     * native-call list + last-call stamp. Absent when no debug attach ran or in
+     * a context with no observable bridge (env 2 mock). SECRET-HANDLING: holds
+     * API names + timings only — never arguments or results.
+     */
+    __ait_bridge?: BridgeObserverState | undefined;
+    /**
+     * 3.0-line native bridge (`@apps-in-toss/webview-bridge`
+     * `injectNativeBridge`). `callAsyncMethod` is the single async dispatcher
+     * the observer wraps.
+     */
+    __appsInTossNativeBridge?: {
+      callAsyncMethod?: (name: string, params?: unknown) => unknown;
+      [key: string]: unknown;
+    };
+    /** 2.x-line native call transport (`ReactNativeWebView.postMessage`). */
+    ReactNativeWebView?: {
+      postMessage?: (message: string) => void;
+      [key: string]: unknown;
+    };
+    /** 2.x-line native→JS settle emitter (`@apps-in-toss/bridge-core`). */
+    __GRANITE_NATIVE_EMITTER?: {
+      emit?: (event: string, args?: unknown) => void;
+      [key: string]: unknown;
+    };
+  }
+}
+/**
+ * Installs the native-bridge call observer (#749). Idempotent per page
+ * lifecycle. Called by {@link maybeAttach} after the gate passes (debug builds
+ * only). Prefers the 3.0 single-dispatcher wrap; falls back to the universal
+ * 2.x postMessage-start + emitter-settle pair. A context with no observable
+ * bridge (env 2 mock) leaves `window.__ait_bridge` as an empty snapshot — the
+ * badge then shows the heartbeat only, which is correct.
+ *
+ * Never throws into the host app — a wrapped hook that somehow fails is caught
+ * and the original behavior is always preserved.
+ */
+declare function installBridgeObserver(): void;
+/**
+ * Restores every wrapped bridge hook and removes `window.__ait_bridge` (#749).
+ * Idempotent; safe to call when nothing was installed. Wired into
+ * {@link detachDebugSurface} (#748) so no bridge wrap survives a run's end.
+ */
+declare function uninstallBridgeObserver(): void;
+//#endregion
+//#region src/eruda-overlay.d.ts
+/**
+ * In-app eruda console overlay for the debug attach flow.
+ *
+ * Spec: docs/superpowers/specs/2026-05-18-in-app-debug-mcp.md
+ *
+ * This module mounts the eruda in-page console (https://github.com/liriliri/eruda)
+ * on the phone screen when a debug session attaches. It is the mobile-only
+ * counterpart to the Chii `target.js` injection in {@link attach.ts}: Chii is a
+ * REMOTE CDP transport (phone → relay → PC DevTools frontend), whereas eruda is
+ * a LOCAL in-page view — a floating button + console/network/DOM/storage panels
+ * rendered directly on the phone, with no relay or second device. The two are
+ * orthogonal and coexist (eruda opens no WebSocket, mounts into its own
+ * `#eruda` shadow host — it cannot collide with the relay WS or the Chii DOM).
+ *
+ * Build-time absence (the security contract): this module lives in the
+ * `@ait-co/debug-console` graph. A consumer wraps its
+ * `import('@ait-co/debug-console')` call site in `if (__DEBUG_BUILD__) { … }`;
+ * a release build folds that constant to `false` and dead-code-eliminates the
+ * whole module — so eruda (and its dynamic `import('eruda')` chunk) is simply
+ * absent from release bundles, exactly like the Chii target.js injection. The
+ * `import('eruda')` here is a dynamic import precisely so the bundler emits it
+ * as a separate chunk that the dead branch never pulls in.
+ *
+ * Runtime gate: `mountEruda()` is called only from `maybeAttach()` AFTER the
+ * full Layer B/C gate has passed (`gateResult.attach === true`) — host
+ * allowlist, `debug=1`, relay URL, and TOTP. So eruda inherits the same
+ * four-layer defence as the Chii injection, byte-for-byte, with no eruda-
+ * specific gate of its own.
+ *
+ * SECRET-HANDLING: this module reads no secret, TOTP code, relay URL, or host
+ * value, and logs none. eruda observes only the page it is mounted on.
+ */
+/**
+ * Mounts the eruda in-page console once.
+ *
+ * Idempotent: repeated calls after a successful mount are no-ops, mirroring the
+ * `attached` guard in {@link attach.ts}. Fail-silent: if the dynamic import or
+ * `eruda.init()` throws (eruda absent, or a runtime that rejects it), the Chii
+ * debug session is unaffected — eruda is an additive convenience, not a
+ * dependency of the relay path.
+ *
+ * `eruda.init()` mounts eruda's own floating entry button on the phone screen;
+ * tapping it opens the console. We do not add a separate button.
+ */
+declare function mountEruda(): Promise<void>;
+/**
+ * Unmounts the eruda in-page console (#748 graceful detach).
+ *
+ * Calls `eruda.destroy()`, which removes eruda's floating entry button, any
+ * open panel, and its `#eruda` shadow host — returning the phone screen to a
+ * clean, non-debug state when a debug session ends. After a successful unmount
+ * the guard is reset so a later {@link mountEruda} (a fresh attach) can
+ * re-mount.
+ *
+ * Idempotent: a call when eruda was never mounted (or already unmounted) is a
+ * no-op. Fail-silent: a `destroy()` throw is swallowed — teardown must never
+ * throw into the host app.
+ */
+declare function unmountEruda(): void;
+//#endregion
+//#region src/index.d.ts
+/**
+ * Evaluates the runtime debug activation layers (B and C) against the current
+ * page URL.
+ *
+ * Returns the gate result. Callers can check `result.attach` to decide whether
+ * to proceed with debug surface attachment.
+ *
+ * This function reads `window.location` only — both the hostname (Layer B1
+ * host allowlist) and the search params (Layers B2 and C). Layer A
+ * (build-time) is enforced by the consumer's `if (__DEBUG_BUILD__)` guard
+ * around the import site, not here — see the file-level comment. Consumers
+ * call this with no arguments, so the Layer B1 host check is picked up with
+ * no change at the call site.
+ */
+declare function checkDebugGate(): GateResult;
+//#endregion
+export { BRIDGE_CALL_EVENT, type BridgeLastCall, type BridgeObserverState, type BridgePendingCall, type GateInput, type GateResult, type GateResultAttach, type GateResultBlocked, checkDebugGate, deriveTargetScriptUrl, detachDebugSurface, evaluateDebugGate, installBridgeObserver, isPrivateAppsHost, isTossminiHost, isTrycloudflareHost, maybeAttach, mountEruda, reportWebViewType, uninstallBridgeObserver, unmountEruda };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../internal-protocol/src/debug-host.ts","../src/gate.ts","../src/attach.ts","../../internal-protocol/src/bridge-observer-state.ts","../src/bridge-observer.ts","../src/eruda-overlay.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DgB,kBAAkB;;;;;;;;;;iBAalB,eAAe;;;;;;;;;;;;;;;;iBAmBf,oBAAoB;;;;UCkBnB;WACN;;WAEA;;WAEA;;;UAIM;WACN;;;;;;;;;;;;;;;WAeA;;KAGC,aAAa,mBAAmB;;;;;;;UAQ3B;;;;;;;;;;;;;WAaN;;;;;;;WAQA,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;WA0Bd,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;iBAwBb,kBAAkB,OAAO,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC9JrC,sBAAsB,kBAAkB;QA6FhD;YACI;;;;;;;;IAQR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4MY;;;;;;;;;;;;;;;;;;;;;;;;iBAwKA;;;;;;;;;;;;;;;;;;;;;;;;iBA4CA,YAAY,aAAY;;;;;;;;;;;;;;;;;;;;;UC9iBvB;EACf;;EAEA;;;UAIe;EACf;;EAEA;EACA;;;;;;;UAQe;EACf,SAAS,eAAe;EACxB,MAAM;;;;;;;cAQK;;;QCoBL;YACI;;;;;;;;IAQR,eAAe;;;;;;IAMf;MACE,mBAAmB,cAAc;OAChC;;;IAGH;MACE,eAAe;OACd;;;IAGH;MACE,QAAQ,eAAe;OACtB;;;;;;;;;;;;;;;iBAsHS;;;;;;iBAoFA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBClPM,cAAc;;;;;;;;;;;;;;iBAgCpB;;;;;;;;;;;;;;;;;iBCxBA,kBAAkB"}