@aitne/daemon 0.1.0

package/dist/core/backends/auth-health-monitor.d.ts

@@ -0,0 +1,373 @@
+import type Database from "better-sqlite3";
+import type { BackendId } from "@aitne/shared";
+import type { AuthCheckResult, AuthStatus, IAgentCore } from "../agent-core.js";
+import type { AuthTelemetry } from "./auth-telemetry.js";
+/**
+ * NotificationManager category for probe-failure DMs. Must be a member
+ * of NotificationManager's `SAFETY_CATEGORIES` array so that the DM
+ * bypasses quiet-hours + rate-limit gates at the NotificationManager
+ * layer (AuthHealthMonitor.shouldNotify owns the application-level
+ * policy). Exported so the index.ts wiring and the constant definition
+ * stay in sync — a rename that breaks the invariant will surface as a
+ * compile error rather than a silent runtime regression. See B2 fix.
+ */
+export declare const AUTH_PROBE_NOTIFICATION_CATEGORY: "error";
+/**
+ * AuthHealthMonitor — detection, DB-cache persistence, and proactive
+ * notification for the auth health design (Phase 1–4 scope). See
+ * `docs/design/09-safety-cost.md` §9.5.
+ *
+ * **Phase 1–3 (minimal v1, 2026-04-10)**:
+ *   - DB-cache read / persist of AuthCheckResult
+ *   - `/auth status` rendering
+ *   - reactive-path DB update helpers (free functions, used by BackendRouter)
+ *   - 60-day keepalive reminder sweep
+ *   - startup reconcile of lost `recovering` sessions
+ *
+ * **Phase 4 (2026-04-11)**:
+ *   - `checkAll()` hourly probe — iterates enabled backends, runs
+ *     `checkAuthDetailed()`, persists each result, and decides whether to
+ *     send a proactive DM.
+ *   - Grace period + escalation (§3.2 / §3.3 of the design spec).
+ *     Notifications hold for PROACTIVE_GRACE_PERIOD_MIN after first
+ *     detection, then fire once, then escalate on ESCALATION_STEPS_MIN
+ *     with quiet-hours suppression. A 3-day escalation sharpens the tone.
+ *   - Reactive / proactive separation (§3.4, §5.3) — this class never
+ *     notifies on reactive failures. `recordReactiveAuthFailure` stamps
+ *     `auth_first_expired_at`, which seeds the next proactive tick's
+ *     grace period.
+ *   - Per-invocation dedupe (§3.5 / §5.3.1) — a single `checkAll()` tick
+ *     sends at most one DM that aggregates all failing backends.
+ *
+ * **Phase 3.3 (2026-04-11)**:
+ *   - `readCachedAuthStatus()` pre-flight check in BackendRouter.execute().
+ *     Strategy A: the `auth_last_verified_at` column tracks the last time
+ *     we had authoritative info about a backend's auth state.
+ *     When the cached status is `expired`/`missing` and the verification is
+ *     fresh (within 10 min), the router skips main and routes directly to
+ *     fallback — saving a doomed subprocess. Stale cache falls through to
+ *     main to allow self-heal after manual re-auth.
+ *
+ * Still out of scope (later phases):
+ *   - Phase 5/6: `startRecovery()` for Codex/Gemini (interactive CLI
+ *     subprocesses) — `reconcilePendingRecoveries` is wired up in
+ *     anticipation of this.
+ */
+export interface AuthHealthState {
+    status: AuthStatus | "recovering" | "unknown";
+    detail: string | null;
+    checkedAt: Date | null;
+    firstExpiredAt: Date | null;
+    notifiedAt: Date | null;
+    notificationCount: number;
+    lastSuccessAt: Date | null;
+    lastVerifiedAt: Date | null;
+    keepaliveNotifiedAt: Date | null;
+}
+/**
+ * Notification sink used by both the keepalive sweep and the Phase 4
+ * proactive probe. The `kind` tag lets the daemon wiring map each
+ * message to a distinct `notification_type` (e.g.
+ * `auth.keepalive_reminder` vs `auth.probe_failure`) so dashboards can
+ * filter / rate-limit them separately. Undefined → treated as
+ * `keepalive` for backwards-compat with existing callers.
+ */
+export interface AuthHealthNotifier {
+    send(message: string, options?: {
+        kind?: "keepalive" | "probe_failure" | "recovery";
+    }): Promise<void>;
+}
+export interface AuthHealthMonitorOptions {
+    /** Optional DM sink used for keepalive reminders AND the Phase 4 probe. */
+    notifier?: AuthHealthNotifier;
+    /** Days of inactivity before a keepalive reminder is emitted (default 60). */
+    keepaliveThresholdDays?: number;
+    /** Dedupe window for keepalive reminders (default 30 days). */
+    keepaliveDedupeDays?: number;
+    /** Clock override for deterministic tests. */
+    now?: () => Date;
+    /**
+     * Injected morning-routine gate — returning `true` causes `checkAll()`
+     * to short-circuit without probing. Mirrors the existing hourly-check
+     * gate (§3.2 of the design doc) so probe DMs never collide with the
+     * morning routine. In production, index.ts wires this to
+     * `dispatcher.isMorningRoutineActive()`. Tests may pass a fake.
+     */
+    isMorningRoutineActive?: () => boolean;
+    /**
+     * Injected quiet-hours predicate — returning `true` causes `checkAll()`
+     * to persist probe results to the DB cache but suppress the
+     * notification tail (§3.2 / §3.3). Initial grace-period notifications
+     * respect quiet hours; reactive failures do not (they never flow
+     * through this class). In production, wired to
+     * `notificationManager.isQuietHours()`.
+     */
+    isQuietHours?: () => boolean;
+    /**
+     * Phase 4 kill switch — when `true`, `checkAll()` is a no-op. Mirrors
+     * the `authProbeDisabled` config field so callers can disable the
+     * probe without touching the scheduler wiring. In production, wired
+     * via the runtime config so a dashboard PATCH can toggle it live.
+     */
+    probeDisabled?: () => boolean;
+}
+export declare const FIRST_EXPIRED_CASE_SQL = "\n  auth_first_expired_at = CASE\n    WHEN auth_status = 'ok' THEN @now\n    ELSE COALESCE(auth_first_expired_at, @now)\n  END\n";
+/**
+ * Write the detail text for a FAILED auth check. Both `auth_detail`
+ * and `last_error` receive the same redacted value so that dashboards
+ * reading either column see a consistent failure message. `null`
+ * detail clears both columns.
+ *
+ * This is the ONLY supported way for production code to mutate
+ * `auth_detail` / `last_error`. The companion CI check
+ * `scripts/check-redaction-coverage.sh` (roadmap §9.2) fails if any
+ * other non-test file contains a raw `auth_detail = ?` /
+ * `last_error = ?` assignment, so a future contributor adding a new
+ * write site can't accidentally bypass redaction.
+ */
+export declare function writeAuthFailureDetail(db: Database.Database, backendId: BackendId, detail: string | null): void;
+/**
+ * Write the detail text for a SUCCESSFUL auth check. Only `auth_detail`
+ * receives the text — informational ok-state strings like
+ * "Server-verified at HH:MM UTC" or "refresh_token within grace period"
+ * are preserved so the dashboard continues to show them. `last_error` is
+ * ALWAYS cleared because a passing check has no error, regardless of the
+ * informational detail.
+ *
+ * Like `writeAuthFailureDetail`, this is the only supported production
+ * write path for these columns (roadmap §9.2).
+ */
+export declare function writeAuthOkDetail(db: Database.Database, backendId: BackendId, detail: string | null): void;
+/**
+ * Pre-flight result returned by `readCachedAuthStatus`. `shouldSkip` is
+ * `true` when the router should bypass the main backend and fall directly
+ * to the fallback.
+ */
+export interface CachedAuthResult {
+    status: AuthHealthState["status"];
+    shouldSkip: boolean;
+}
+/**
+ * Pre-flight auth cache read — Phase 3.3 (Strategy A). Reads the
+ * backend's `auth_status` and `auth_last_verified_at` from the DB cache
+ * and decides whether the router should skip main.
+ *
+ * Decision matrix:
+ *   - `recovering`                          → always skip (subprocess owns the row)
+ *   - `expired`/`missing` + fresh cache     → skip (save a doomed subprocess)
+ *   - `expired`/`missing` + stale cache     → don't skip (user may have re-authed)
+ *   - `ok` / `unknown` / any other          → don't skip
+ *   - DB error                              → don't skip (fail-open)
+ *
+ * "Fresh" means `auth_last_verified_at` is within `freshnessMs` of now.
+ *
+ * Free function so BackendRouter can import it without holding an
+ * AuthHealthMonitor instance (same pattern as `recordReactiveAuth*`).
+ */
+export declare function readCachedAuthStatus(db: Database.Database, backendId: BackendId, freshnessMs?: number, now?: Date): CachedAuthResult;
+/**
+ * Reactive-path helper: called from BackendRouter when an execute()
+ * surfaces a BackendDecisiveFailure("auth"). Writes the failure into
+ * the DB cache so `/auth status` reflects the real-time state. Kept as
+ * a free function so BackendRouter doesn't need to construct an
+ * AuthHealthMonitor.
+ *
+ * Never clobbers a `recovering` row — an in-progress recovery session
+ * takes precedence over a concurrent runtime failure. The subprocess
+ * handling the recovery owns the row until it transitions back to
+ * `ok` or `expired` on completion.
+ *
+ * Redaction of the detail string is handled by `writeAuthFailureDetail`,
+ * not inline here, so that upstream 4xx bodies echoing `Bearer
+ * sk-ant-...` fragments cannot leak into the DB through any future
+ * caller that forgets to redact manually (roadmap §9.2).
+ *
+ * Structured as a transaction so the main status UPDATE and the
+ * subsequent `writeAuthFailureDetail` commit atomically — a crash
+ * between the two must not leave a row with `auth_status = 'expired'`
+ * and a stale `auth_detail` from a prior unrelated failure.
+ */
+export declare function recordReactiveAuthFailure(db: Database.Database, backendId: BackendId, detail: string, telemetry?: AuthTelemetry, now?: Date): void;
+/**
+ * Reactive-path self-heal helper: called from BackendRouter when an
+ * execute() succeeds. Bumps `auth_last_success_at` (so the 60-day
+ * keepalive sweep tracks real usage, not just manual dashboard clicks)
+ * and transitions expired/missing rows back to ok (so the DB cache
+ * reflects the reality of a working backend without waiting for a
+ * manual dashboard "Check auth" button press).
+ *
+ * A successful execute is authoritative — it proves the CLI held
+ * working credentials at some point in the last few seconds. Never
+ * clobbers a `recovering` row for the same reason as
+ * recordReactiveAuthFailure: the recovering subprocess owns the row.
+ */
+export declare function recordReactiveAuthSuccess(db: Database.Database, backendId: BackendId, telemetry?: AuthTelemetry, now?: Date): void;
+export declare class AuthHealthMonitor {
+    private readonly db;
+    private readonly cores;
+    private readonly telemetry;
+    private readonly keepaliveThresholdDays;
+    private readonly keepaliveDedupeDays;
+    private readonly notifier;
+    private readonly now;
+    private readonly isMorningRoutineActiveFn;
+    private readonly isQuietHoursFn;
+    private readonly probeDisabledFn;
+    /**
+     * Promise returned from the currently in-flight `checkAll()` call, or
+     * `null` when no tick is running. Used as a single-owner guard so
+     * overlapping cron ticks (e.g. a slow probe still running when the
+     * next hour fires) serialize without queueing stacks of probes. The
+     * field is set atomically before any `await` to avoid the
+     * microtask-scheduling race that bit `Dispatcher.hourlyCheckInProgress`
+     * pre-C1 fix (see `dispatcher.ts`).
+     */
+    private checkAllInFlight;
+    constructor(db: Database.Database, cores: Partial<Record<BackendId, IAgentCore>>, telemetry: AuthTelemetry, options?: AuthHealthMonitorOptions);
+    /** Read current DB state for a backend, or null when no row exists. */
+    loadState(backendId: BackendId): AuthHealthState | null;
+    /**
+     * Persist the result of an AuthCheckResult (from `checkAuthDetailed()`) to
+     * the DB. Handles the transitions described in the design doc:
+     *
+     *   ok → ok           : update `auth_last_success_at`
+     *   non-ok → ok       : clear first_expired/notified/notification_count + record self-heal
+     *   ok → non-ok       : set first_expired_at (once)
+     *   non-ok → non-ok   : keep first_expired_at, update detail
+     *
+     * `first_expired_at` management uses `FIRST_EXPIRED_CASE_SQL` — the
+     * same fragment reused by `recordReactiveAuthFailure` — so both paths
+     * share a single source of truth (roadmap §2.2). `auth_detail` /
+     * `last_error` writes go through the `writeAuth*Detail` helpers
+     * (roadmap §9.2), and main UPDATE + detail UPDATE run in a
+     * transaction to keep the two in lockstep.
+     */
+    persistCheckResult(backendId: BackendId, result: AuthCheckResult): void;
+    /**
+     * **Phase 4 hourly probe** — design doc §3.1–§3.5.
+     *
+     * Probe every enabled backend with a registered core, persist each
+     * result to the DB cache, and decide whether to send a **single**
+     * aggregated proactive DM listing all failing backends.
+     *
+     * Invariants (see the class-level comment for the full list):
+     * 1. Reactive and proactive notification paths are strictly separated.
+     *    `recordReactiveAuthFailure` stamps `auth_first_expired_at`, which
+     *    seeds the grace period; the next proactive tick reads that
+     *    timestamp, waits PROACTIVE_GRACE_PERIOD_MIN, then (optionally)
+     *    sends one DM through this method.
+     * 2. Probe results are persisted through `persistCheckResult` even
+     *    when notifications are suppressed (quiet hours, missing
+     *    notifier, disabled kill switch). This keeps the `/auth status`
+     *    endpoint and the keepalive sweep consistent with reality.
+     * 3. `checkAll()` never starts a recovery subprocess. Recovery is
+     *    strictly user-initiated (§3 design principle). A backend row
+     *    currently in `auth_status = 'recovering'` is skipped entirely —
+     *    the recovering subprocess owns the row until it writes back.
+     * 4. One DM per tick. Even if three backends are expired and past
+     *    their escalation threshold, a single batched message is sent.
+     *    This is enforced structurally (buildNotificationMessage returns
+     *    one string for a list) rather than via dedupe state.
+     *
+     * Gates applied in order:
+     *   - probeDisabled? → no-op
+     *   - in-flight dedupe (single-owner promise) → return the existing tick
+     *   - isMorningRoutineActive? → skip entire probe
+     *   - per-backend `recovering` skip
+     *
+     * Quiet hours only suppress the **notification tail** — the DB is
+     * still updated. This is deliberate: a user checking the dashboard
+     * during quiet hours should see the real state, not stale ok.
+     */
+    checkAll(): Promise<void>;
+    private runCheckAll;
+    /**
+     * Read the set of `enabled = 1` backend ids. Wrapped for defensive
+     * DB error handling (consistent with the rest of checkAll — a
+     * locked / broken DB should degrade gracefully, not crash the
+     * hourly cron handler). On read failure we return an empty set,
+     * effectively skipping the tick entirely.
+     */
+    private readEnabledBackendIds;
+    /**
+     * Notification decision per design spec §3.3 `shouldNotify`. Pure
+     * function of `(current result, prev state, now, quietHours)` so it
+     * is trivially unit-testable.
+     *
+     * Rules:
+     *   - ok result → never notify (caller already filtered, but kept
+     *     defensive so `shouldNotify` can be called in isolation).
+     *   - prev.status is "ok" or "unknown" or null → first observation,
+     *     defer to the next tick. `persistCheckResult` has already
+     *     stamped `auth_first_expired_at` at this point, so the next
+     *     tick will see it and start the grace period countdown.
+     *   - prev.firstExpiredAt is null (defensive) → defer.
+     *   - no prior notification (notifiedAt == null) → notify iff the
+     *     grace period has elapsed. This is the "1st DM" path. **Quiet
+     *     hours DO NOT suppress this initial DM** — design spec §3.3
+     *     intentionally bypasses quiet hours for the first notification
+     *     so that an auth failure is surfaced to the user as close to
+     *     real time as possible. The user would rather get a late-night
+     *     DM about broken auth than discover it the next morning mid-
+     *     workflow.
+     *   - prior notification exists → check escalation step. **Escalation
+     *     DMs DO respect quiet hours** (the design spec calls these
+     *     "quiet reminder"); a 6h / 24h reminder can safely wait until
+     *     quiet hours end because the user has already been told once.
+     *
+     * Note: because NotificationManager has its own quiet-hours gate,
+     * the wiring in `index.ts` passes `category: "error"` for probe
+     * failure DMs so that the lower layer does NOT silently drop the
+     * 1st DM. Without that bypass, shouldNotify returning true during
+     * quiet hours would send the DM to a sink that silently discards
+     * it AND incorrectly advances our escalation bookkeeping.
+     */
+    private shouldNotify;
+    private hasEscalationElapsed;
+    /**
+     * Build the proactive DM text per design spec §3.4. A single message
+     * lists every failing backend with its detail and an actionable
+     * recovery command. Tone sharpens once any failing backend has been
+     * expired for `URGENT_TONE_DAYS` days — matching the design's
+     * "3 days elapsed" escalation row.
+     *
+     * The `/auth fix <backend>` flows referenced in the design spec
+     * arrive in Phase 5 + 6; for Phase 4 the message surfaces the
+     * direct CLI command (`codex login` / `gemini`) so the user can
+     * recover without waiting for dispatcher support.
+     */
+    private buildNotificationMessage;
+    /**
+     * Daemon startup hook: if a backend row is stuck in `recovering` (e.g.
+     * from a previous crash), reset it to `expired` so the user is re-notified
+     * instead of waiting up to an hour for the next probe.
+     *
+     * **Forward-compat note (roadmap §2.3)**: in v1 no production code path
+     * writes `auth_status = 'recovering'`, so this function matches zero
+     * rows in practice. It is kept wired up at daemon startup because
+     * Phase 5 (Codex device auth) and Phase 6 (Gemini code relay) will
+     * introduce `AuthRecovery.initiate*Auth` calls that DO set
+     * `recovering`, at which point a daemon crash mid-recovery leaves a
+     * stuck row that this function must clean up. Deleting the function
+     * in v1 and re-adding it for Phase 5/6 would generate churn without
+     * benefit — treat it as a hook that is intentionally dormant until
+     * the recovery subprocesses land.
+     */
+    reconcilePendingRecoveries(): number;
+    /** Return the list of backend ids whose cached state is expired or missing. */
+    listExpiredBackends(): BackendId[];
+    /** Render a user-facing `/auth status` summary. */
+    renderStatusSummary(): string;
+    /**
+     * Keepalive sweep: for every ENABLED backend whose `auth_last_success_at`
+     * is older than `keepaliveThresholdDays`, send a reminder DM — unless a
+     * reminder was already sent within `keepaliveDedupeDays`.
+     *
+     * Each backend is processed in its own try/catch so a single notifier
+     * failure does not abort the sweep for the remaining backends and leave
+     * them without their `auth_keepalive_notified_at` stamp (which would
+     * cause next sweep to re-send the same reminder to everyone).
+     */
+    runKeepaliveSweep(): Promise<BackendId[]>;
+}
+//# sourceMappingURL=auth-health-monitor.d.ts.map

package/dist/core/backends/auth-health-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-health-monitor.d.ts","sourceRoot":"","sources":["../../../src/core/backends/auth-health-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAG,OAAgB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,IAAI,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,UAAU,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;CAC/B;AA0ED,eAAO,MAAM,sBAAsB,qIAKlC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAKN;AAQD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,SAAS,EACpB,WAAW,GAAE,MAAuC,EACpD,GAAG,GAAE,IAAiB,GACrB,gBAAgB,CAuClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,aAAa,EACzB,GAAG,GAAE,IAAiB,GACrB,IAAI,CAyCN;AAoCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,SAAS,EACpB,SAAS,CAAC,EAAE,aAAa,EACzB,GAAG,GAAE,IAAiB,GACrB,IAAI,CAsDN;AAED,qBAAa,iBAAiB;IAoB1B,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IArB5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA8B;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8B;IAC9D;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB,CAA8B;gBAGnC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,EAC7C,SAAS,EAAE,aAAa,EACzC,OAAO,GAAE,wBAA6B;IAYxC,uEAAuE;IACvE,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,GAAG,IAAI;IAoBvD;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAChB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,eAAe,GACtB,IAAI;IAgEP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAyBjB,WAAW;IA0KzB;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAkB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,oBAAoB;IAc5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IAqChC;;;;;;;;;;;;;;;OAeG;IACH,0BAA0B,IAAI,MAAM;IAapC,+EAA+E;IAC/E,mBAAmB,IAAI,SAAS,EAAE;IAWlC,mDAAmD;IACnD,mBAAmB,IAAI,MAAM;IAY7B;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;CAwEhD"}