@bjorntech/key-ferry 0.0.0-stage → 0.1.0

package/dist/varlock/manager.js

@@ -0,0 +1,425 @@
+import { constants as fsConstants } from "node:fs";
+import { access, mkdtemp, realpath, rm, stat, lstat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import { Duration, Effect, Layer, Scope, Semaphore } from "effect";
+import { ProjectKeyFerryManager, VarlockError, } from "../contracts.js";
+import { Process, ProcessLive, } from "../services/process.js";
+import { decodeSessionList, findOwnedSession, sanitizeSessionStatus, selectPlaceholderEnvironment, validateProxyWiring, } from "./protocol.js";
+const DEFAULT_COMMAND = ["varlock"];
+const DEFAULT_START_TIMEOUT = 30_000;
+const DEFAULT_COMMAND_TIMEOUT = 10_000;
+const DEFAULT_REFRESH_TIMEOUT = 30_000;
+const DEFAULT_POLL_INTERVAL = 100;
+const MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
+const MAX_TIMEOUT = 10 * 60_000;
+const safeError = (code, retryable) => new VarlockError({ code, retryable, message: `Varlock ${code.replaceAll("_", " ")}` });
+const fromProcessError = (error, code) => new VarlockError({
+    code,
+    retryable: error.code === "timeout" || error.code === "spawn-failed" || error.code === "io",
+    message: error.code === "timeout" ? "Varlock command timed out" : `Varlock command ${error.code}`,
+});
+function adapterOptions(options) {
+    const raw = options.adapter ?? {};
+    const command = raw.command === undefined ? [...DEFAULT_COMMAND] : raw.command;
+    const environmentKeys = raw.environmentKeys;
+    if (!Array.isArray(command) ||
+        command.length === 0 ||
+        command.length > 32 ||
+        command.some((v) => typeof v !== "string" || v.length === 0 || v.length > 1024 || v.includes("\0"))) {
+        throw safeError("invalid_config", false);
+    }
+    if (!Array.isArray(environmentKeys) ||
+        environmentKeys.length > 128 ||
+        environmentKeys.some((v) => typeof v !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(v) || v.length > 256)) {
+        throw safeError("invalid_config", false);
+    }
+    const numberOption = (name, fallback, min, max) => {
+        const value = raw[name];
+        if (value === undefined)
+            return fallback;
+        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max)
+            throw safeError("invalid_config", false);
+        return value;
+    };
+    const strict = raw.requireStrictEgress;
+    if (strict !== undefined && typeof strict !== "boolean")
+        throw safeError("invalid_config", false);
+    return {
+        command: [...command],
+        environmentKeys: [...environmentKeys],
+        startupTimeoutMs: numberOption("startupTimeoutMs", DEFAULT_START_TIMEOUT, 100, MAX_TIMEOUT),
+        commandTimeoutMs: numberOption("commandTimeoutMs", DEFAULT_COMMAND_TIMEOUT, 100, MAX_TIMEOUT),
+        reloadTimeoutMs: numberOption("reloadTimeoutMs", DEFAULT_REFRESH_TIMEOUT, 100, MAX_TIMEOUT),
+        pollIntervalMs: numberOption("pollIntervalMs", DEFAULT_POLL_INTERVAL, 10, 10_000),
+        requireStrictEgress: strict ?? true,
+    };
+}
+function safeProjectDirectory(value) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 16_384 ||
+        value.includes("\0"))
+        throw safeError("invalid_config", false);
+    return value;
+}
+function parseEnvironmentOutput(raw) {
+    if (Buffer.byteLength(raw, "utf8") > MAX_OUTPUT_BYTES)
+        throw safeError("protocol_error", false);
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw safeError("protocol_error", false);
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw safeError("protocol_error", false);
+    const result = Object.create(null);
+    const keys = Object.keys(value);
+    if (keys.length > 512)
+        throw safeError("protocol_error", false);
+    for (const key of keys) {
+        if (key === "__proto__" ||
+            key === "prototype" ||
+            key === "constructor" ||
+            !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) ||
+            key.length > 256)
+            throw safeError("protocol_error", false);
+        const item = value[key];
+        if (typeof item !== "string" || item.length > 16_384 || item.includes("\0"))
+            throw safeError("protocol_error", false);
+        result[key] = item;
+    }
+    return result;
+}
+function statusSnapshot(state, projectDirectory) {
+    let endpoint;
+    if (state.session) {
+        try {
+            endpoint = validateProxyWiring(state.session.env).proxyUrl;
+        }
+        catch {
+            endpoint = undefined;
+        }
+    }
+    return {
+        phase: state.phase,
+        projectDirectory: projectDirectory,
+        generation: state.generation,
+        ...(state.process ? { pid: state.process.pid } : {}),
+        ...(endpoint ? { endpoint } : {}),
+        ...(state.lastRefreshAt ? { lastRefreshAt: state.lastRefreshAt } : {}),
+        ...(state.error ? { error: state.error } : {}),
+    };
+}
+function commandParts(options, args) {
+    return { executable: options.command[0], args: [...options.command.slice(1), ...args] };
+}
+function runCommand(process, options, cwd, args, timeoutMs, environment) {
+    const parts = commandParts(options, args);
+    return process
+        .run({ ...parts, cwd, env: environment, maxBytes: MAX_OUTPUT_BYTES, timeoutMs })
+        .pipe(Effect.mapError((error) => fromProcessError(error, error.code === "timeout" ? "timeout" : "unavailable")), Effect.map(({ stdout, stderr }) => ({ stdout, stderr })));
+}
+function candidatesForOwner(records, pid, cwd) {
+    return records.filter((record) => record.ownerPid === pid && record.cwd === cwd && record.endedAt === undefined);
+}
+function requireRefreshProcess(state) {
+    if (!state.process || !state.session)
+        return Effect.fail(safeError("not_ready", true));
+    return Effect.void;
+}
+function prepareStart(state, healthCheck, snapshot) {
+    if (state.disposed)
+        return Effect.fail(safeError("disposed", false));
+    if (!state.process || !state.session)
+        return Effect.succeed(undefined);
+    return healthCheck().pipe(Effect.map(() => (state.phase === "ready" ? snapshot() : undefined)));
+}
+function requireRefreshSession(state) {
+    if (!state.process || !state.session)
+        return Effect.fail(safeError("not_ready", true));
+    return Effect.succeed(state.session);
+}
+function ensureRefreshReadiness({ state, healthCheck, start, }) {
+    return Effect.gen(function* () {
+        if (state.disposed)
+            return yield* Effect.fail(safeError("disposed", false));
+        yield* healthCheck();
+        if (!state.process || !state.session || state.phase !== "ready")
+            yield* start();
+        yield* requireRefreshProcess(state);
+    });
+}
+function completeRefreshHandshake(reload, readStatus, session, ownerPid, projectDirectory, readEnvironment) {
+    return Effect.gen(function* () {
+        yield* reload;
+        const records = yield* readStatus;
+        const next = findOwnedSession(records, {
+            ownerPid,
+            sessionUuid: session.uuid,
+            projectDirectory,
+        });
+        if (!next)
+            return yield* Effect.fail(safeError("refresh_failed", true));
+        const environment = yield* readEnvironment(next).pipe(Effect.mapError(() => safeError("refresh_failed", true)));
+        return { session: next, environment };
+    });
+}
+function validateRefreshCapability(state, session, requireStrictEgress, healthCheck, clearCapability) {
+    return Effect.gen(function* () {
+        yield* healthCheck();
+        if (!state.process || state.phase !== "ready")
+            return yield* Effect.fail(safeError("refresh_failed", true));
+        if (requireStrictEgress && session.egressMode !== "strict") {
+            const error = safeError("refresh_failed", false);
+            clearCapability("failed", error);
+            return yield* Effect.fail(error);
+        }
+    });
+}
+function validateStartupEgress(state, requireStrictEgress, session, handle, clearCapability) {
+    if (!requireStrictEgress || session.egressMode === "strict")
+        return Effect.void;
+    const error = safeError("invalid_config", false);
+    return handle.stop.pipe(Effect.catch(() => Effect.void), Effect.tap(() => Effect.sync(() => {
+        state.process = undefined;
+        clearCapability("failed", error);
+    })), Effect.flatMap(() => Effect.fail(error)));
+}
+function assertRegularCertificate(pathInfo) {
+    if (!pathInfo.isFile() || pathInfo.isSymbolicLink())
+        throw new Error("not a regular certificate");
+}
+function assertContainedCertificate(certDirectoryReal, resolved) {
+    const outside = relative(certDirectoryReal, resolved);
+    if (outside === ".." || outside.startsWith("../") || outside.includes("\0"))
+        throw new Error("certificate outside owned directory");
+}
+function assertOwnedCertificate(cert) {
+    if (!cert.isFile() ||
+        cert.uid !== globalThis.process.getuid?.() ||
+        (Number(cert.mode) & 0o022) !== 0)
+        throw new Error("certificate ownership or permissions invalid");
+}
+function rejectUnavailableEnvironment(state) {
+    if (state.phase === "failed" || state.phase === "degraded")
+        return Effect.fail(safeError("not_ready", true));
+    return Effect.void;
+}
+export function makeProjectKeyFerryManager(options, processLayer = ProcessLive) {
+    return Layer.effect(ProjectKeyFerryManager, Effect.gen(function* () {
+        const processService = yield* Process;
+        // Process.spawn is scoped. Capture the layer scope once and provide it
+        // to lazy starts so a handle remains alive until this manager layer is
+        // released, rather than being released at the end of ensureStarted.
+        const managerScope = yield* Scope.Scope;
+        const config = adapterOptions(options);
+        const requestedCwd = safeProjectDirectory(options.projectDirectory);
+        const cwd = yield* Effect.tryPromise({
+            try: async () => {
+                const canonical = await realpath(requestedCwd);
+                const info = await stat(canonical);
+                if (!info.isDirectory())
+                    throw new Error("project path is not a directory");
+                await access(canonical, fsConstants.R_OK | fsConstants.X_OK);
+                return canonical;
+            },
+            catch: () => safeError("invalid_config", false),
+        });
+        // The sidecar gets a stable snapshot, rather than inheriting a mutable
+        // host environment at each command. This is intentionally only for the
+        // trusted Varlock CLI boundary and is never copied into MCP config or
+        // returned by the manager.
+        const ambientEnvironment = Object.fromEntries(Object.entries(globalThis.process.env).filter((entry) => entry[1] !== undefined));
+        const certDirectory = yield* Effect.tryPromise({
+            try: () => mkdtemp(join(tmpdir(), "key-ferry-cert-")),
+            catch: () => safeError("start_failed", true),
+        });
+        const certDirectoryReal = yield* Effect.tryPromise({
+            try: () => realpath(certDirectory),
+            catch: () => safeError("start_failed", true),
+        });
+        const lock = yield* Semaphore.make(1);
+        const state = { phase: "stopped", generation: 0, disposed: false };
+        const clearCapability = (phase, error) => {
+            state.phase = phase;
+            state.environment = undefined;
+            state.session = undefined;
+            state.error = error;
+            state.generation += 1;
+        };
+        const healthCheck = () => {
+            if (!state.process)
+                return Effect.void;
+            return state.process.health.pipe(Effect.flatMap((health) => {
+                if (health.running)
+                    return Effect.void;
+                clearCapability("degraded", safeError("unavailable", true));
+                return Effect.void;
+            }));
+        };
+        const status = Effect.suspend(() => healthCheck()).pipe(Effect.asVoid, Effect.map(() => statusSnapshot(state, cwd)));
+        const waitForSession = (handle) => {
+            const deadline = Date.now() + config.startupTimeoutMs;
+            const poll = () => Effect.gen(function* () {
+                const output = yield* runCommand(processService, config, cwd, ["proxy", "status", "--format", "json"], config.commandTimeoutMs, ambientEnvironment);
+                const records = yield* Effect.try({
+                    try: () => decodeSessionList(output.stdout),
+                    catch: () => safeError("protocol_error", false),
+                });
+                const candidates = candidatesForOwner(records, handle.pid, cwd);
+                if (candidates.length === 1) {
+                    const candidate = candidates[0];
+                    const owned = findOwnedSession(records, {
+                        ownerPid: handle.pid,
+                        sessionUuid: candidate.uuid,
+                        projectDirectory: cwd,
+                    });
+                    if (owned)
+                        return owned;
+                }
+                if (Date.now() >= deadline)
+                    return yield* Effect.fail(safeError("timeout", true));
+                yield* Effect.sleep(Duration.millis(config.pollIntervalMs));
+                return yield* poll();
+            });
+            return poll();
+        };
+        const readEnvironment = (session) => runCommand(processService, config, cwd, ["proxy", "env", "--session", session.uuid, "--full", "--format", "json"], config.commandTimeoutMs, ambientEnvironment).pipe(Effect.flatMap(({ stdout }) => Effect.gen(function* () {
+            const decoded = yield* Effect.try({
+                try: () => {
+                    const full = parseEnvironmentOutput(stdout);
+                    const wiring = validateProxyWiring(full);
+                    const selected = selectPlaceholderEnvironment(full, session, config.environmentKeys);
+                    return { wiring, selected };
+                },
+                catch: () => safeError("protocol_error", false),
+            });
+            yield* Effect.tryPromise({
+                try: async () => {
+                    const original = await lstat(decoded.wiring.caPath);
+                    assertRegularCertificate(original);
+                    const resolved = await realpath(decoded.wiring.caPath);
+                    const cert = await stat(resolved);
+                    assertContainedCertificate(certDirectoryReal, resolved);
+                    // Varlock's CA certificate is public trust material and is
+                    // currently written 0644. Reject group/other *writes*, but
+                    // allow readable public certs. The directory remains
+                    // manager-owned and private; private keys are never
+                    // accepted through this path.
+                    assertOwnedCertificate(cert);
+                },
+                catch: () => safeError("protocol_error", false),
+            });
+            return { ...decoded.wiring.env, ...decoded.selected };
+        })));
+        const startInternal = () => Effect.gen(function* () {
+            const existing = yield* prepareStart(state, healthCheck, () => statusSnapshot(state, cwd));
+            if (existing)
+                return existing;
+            state.phase = "starting";
+            state.error = undefined;
+            const parts = commandParts(config, [
+                "proxy",
+                "start",
+                "--allow-reload",
+                "--cert-dir",
+                certDirectory,
+            ]);
+            const handle = yield* Effect.provideService(processService
+                .spawn({ ...parts, cwd, env: ambientEnvironment, terminateGraceMs: 500 })
+                .pipe(Effect.mapError((error) => fromProcessError(error, "start_failed"))), Scope.Scope, managerScope).pipe(Effect.catch((error) => Effect.gen(function* () {
+                clearCapability("failed", error);
+                return yield* Effect.fail(error);
+            })));
+            state.process = handle;
+            const result = yield* waitForSession(handle).pipe(Effect.flatMap((session) => readEnvironment(session).pipe(Effect.map((environment) => ({ session, environment })))), Effect.catch((error) => Effect.gen(function* () {
+                yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+                state.process = undefined;
+                clearCapability("failed", error);
+                return yield* Effect.fail(error);
+            })));
+            yield* validateStartupEgress(state, config.requireStrictEgress, result.session, handle, clearCapability);
+            state.session = result.session;
+            state.environment = result.environment;
+            state.phase = "ready";
+            state.error = undefined;
+            return statusSnapshot(state, cwd);
+        });
+        const exclusive = (effect) => lock.withPermit(effect);
+        const ensureStarted = exclusive(startInternal());
+        const environmentEffect = exclusive(Effect.gen(function* () {
+            yield* healthCheck();
+            yield* rejectUnavailableEnvironment(state);
+            if (state.phase !== "ready" || !state.environment) {
+                yield* startInternal();
+            }
+            if (!state.environment)
+                return yield* Effect.fail(safeError("not_ready", true));
+            return state.environment;
+        }));
+        const refresh = exclusive(Effect.gen(function* () {
+            yield* ensureRefreshReadiness({ state, healthCheck, start: startInternal });
+            const session = yield* requireRefreshSession(state);
+            const reload = runCommand(processService, config, cwd, ["proxy", "reload", "--session", session.uuid], config.reloadTimeoutMs, ambientEnvironment).pipe(Effect.mapError((error) => new VarlockError({
+                ...error,
+                code: error.code === "timeout" ? "timeout" : "refresh_failed",
+                message: error.message,
+            })));
+            const readStatus = runCommand(processService, config, cwd, ["proxy", "status", "--format", "json"], config.commandTimeoutMs, ambientEnvironment).pipe(Effect.flatMap(({ stdout }) => Effect.try({
+                try: () => decodeSessionList(stdout),
+                catch: () => safeError("protocol_error", false),
+            })));
+            const result = yield* completeRefreshHandshake(reload, readStatus, session, state.process.pid, cwd, readEnvironment);
+            yield* validateRefreshCapability(state, result.session, config.requireStrictEgress, healthCheck, clearCapability);
+            state.session = result.session;
+            state.environment = result.environment;
+            state.generation += 1;
+            state.lastRefreshAt = new Date().toISOString();
+            state.error = undefined;
+            return statusSnapshot(state, cwd);
+        })).pipe(Effect.catch((error) => Effect.gen(function* () {
+            if (error.code !== "disposed") {
+                const handle = state.process;
+                if (handle)
+                    yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+                state.process = undefined;
+                clearCapability("failed", error.code === "refresh_failed" ? error : safeError("refresh_failed", true));
+            }
+            return yield* Effect.fail(error.code === "disposed" ? error : safeError("refresh_failed", true));
+        })));
+        const dispose = lock.withPermit(Effect.gen(function* () {
+            if (state.disposed)
+                return;
+            state.disposed = true;
+            state.phase = "stopping";
+            const handle = state.process;
+            state.environment = undefined;
+            state.session = undefined;
+            if (handle)
+                yield* handle.stop.pipe(Effect.catch(() => Effect.void));
+            state.process = undefined;
+            state.phase = "stopped";
+            state.generation += 1;
+        }));
+        const service = {
+            status,
+            ensureStarted,
+            environment: environmentEffect,
+            refresh,
+            dispose,
+            withExclusive: (effect) => lock.withPermit(effect),
+        };
+        yield* Effect.addFinalizer(() => Effect.promise(() => rm(certDirectory, { recursive: true, force: true })));
+        // Finalizers run in reverse registration order, so stop the sidecar
+        // before removing the directory that contains its CA.
+        yield* Effect.addFinalizer(() => dispose);
+        return ProjectKeyFerryManager.of(service);
+    })).pipe(Layer.provide(processLayer));
+}
+export const projectKeyFerryManagerFactory = {
+    layer: (options) => makeProjectKeyFerryManager(options),
+};
+//# sourceMappingURL=manager.js.map

package/dist/varlock/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/varlock/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,sBAAsB,EAMtB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,WAAW,GAIZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,EAC5B,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAEvB,MAAM,eAAe,GAAG,CAAC,SAAS,CAAU,CAAC;AAC7C,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAuBhC,MAAM,SAAS,GAAG,CAChB,IAA2D,EAC3D,SAAkB,EACJ,EAAE,CAChB,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAEzF,MAAM,gBAAgB,GAAG,CACvB,KAAmB,EACnB,IAAmE,EACrD,EAAE,CAChB,IAAI,YAAY,CAAC;IACf,IAAI;IACJ,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;IAC3F,OAAO,EACL,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,IAAI,EAAE;CAC3F,CAAC,CAAC;AAEL,SAAS,cAAc,CAAC,OAAsC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC/E,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAC5C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,EAAE;QACnB,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACtF,EACD,CAAC;QACD,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;QAC/B,eAAe,CAAC,MAAM,GAAG,GAAG;QAC5B,eAAe,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CACtF,EACD,CAAC;QACD,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW,EAAU,EAAE;QACxF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG;YACzF,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAClG,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,OAAO,CAAa;QACjC,eAAe,EAAE,CAAC,GAAG,eAAe,CAAa;QACjD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,EAAE,WAAW,CAAC;QAC3F,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,GAAG,EAAE,WAAW,CAAC;QAC7F,eAAe,EAAE,YAAY,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,EAAE,WAAW,CAAC;QAC3F,cAAc,EAAE,YAAY,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,CAAC;QACjF,mBAAmB,EAAE,MAAM,IAAI,IAAI;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEpB,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,gBAAgB;QAAE,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAChG,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IACE,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,aAAa;YACrB,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;YACrC,GAAG,CAAC,MAAM,GAAG,GAAG;YAEhB,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzE,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB,EAAE,gBAAwB;IACnE,IAAI,QAA4B,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,gBAAgB,EAAE,gBAAkD;QACpE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,IAAuB;IACpE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CACjB,OAAuB,EACvB,OAAuB,EACvB,GAAW,EACX,IAAuB,EACvB,SAAiB,EACjB,WAA6C;IAE7C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO;SACX,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;SAC/E,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAC9E,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CACzD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAwC,EACxC,GAAW,EACX,GAAW;IAEX,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAC1F,CAAC;AACJ,CAAC;AAQD,SAAS,qBAAqB,CAAC,KAAmB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,KAAmB,EACnB,WAAoD,EACpD,QAA0B;IAE1B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAAC,EAC9B,KAAK,EACL,WAAW,EACX,KAAK,GACY;IACjB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;YAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAChF,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA4C,EAC5C,UAAwE,EACxE,OAA6B,EAC7B,QAAgB,EAChB,gBAAwB,EACxB,eAEqD;IAKrD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAmB,EACnB,OAA6B,EAC7B,mBAA4B,EAC5B,WAAoD,EACpD,eAA2E;IAE3E,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;YAC3C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,mBAAmB,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACjD,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAmB,EACnB,mBAA4B,EAC5B,OAA6B,EAC7B,MAAsB,EACtB,eAA2E;IAE3E,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAChF,MAAM,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CACrB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CACd,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACf,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CACH,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA2C;IAC3E,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,0BAA0B,CAAC,iBAAyB,EAAE,QAAgB;IAC7E,MAAM,OAAO,GAAG,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAsC;IACpE,IACE,CAAC,IAAI,CAAC,MAAM,EAAE;QACd,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;QAC1C,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAEjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAmB;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAsC,EACtC,eAAmD,WAAW;IAE9D,OAAO,KAAK,CAAC,MAAM,CACjB,sBAAsB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC;QACtC,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACnC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAC5E,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;SAChD,CAAC,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,2BAA2B;QAC3B,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC7D,CACF,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YAC7C,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;YACrD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACjD,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,KAAK,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAEjF,MAAM,eAAe,GAAG,CAAC,KAA0B,EAAE,KAAoB,EAAE,EAAE;YAC3E,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC;YAC9B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,GAAwB,EAAE;YAC5C,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;YACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;gBACvC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5D,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,MAAM,GAA8B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAChF,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAC7C,CAAC;QAEF,MAAM,cAAc,GAAG,CACrB,MAAsB,EAC6B,EAAE;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;YACtD,MAAM,IAAI,GAAG,GAAsD,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAC9B,cAAc,EACd,MAAM,EACN,GAAG,EACH,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EACvC,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,CACnB,CAAC;gBACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBAChC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;iBAChD,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;oBACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE;wBACtC,QAAQ,EAAE,MAAM,CAAC,GAAG;wBACpB,WAAW,EAAE,SAAS,CAAC,IAAI;wBAC3B,gBAAgB,EAAE,GAAG;qBACtB,CAAC,CAAC;oBACH,IAAI,KAAK;wBAAE,OAAO,KAAK,CAAC;gBAC1B,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClF,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;gBAC5D,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;YACL,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,eAAe,GAAG,CACtB,OAA6B,EACqB,EAAE,CACpD,UAAU,CACR,cAAc,EACd,MAAM,EACN,GAAG,EACH,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EACzE,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,CACnB,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAChC,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBACzC,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,IAAI,EACJ,OAAO,EACP,MAAM,CAAC,eAAe,CACvB,CAAC;oBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;gBAC9B,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;aAChD,CAAC,CAAC;YACH,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACpD,wBAAwB,CAAC,QAAQ,CAAC,CAAC;oBACnC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAClC,0BAA0B,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;oBACxD,2DAA2D;oBAC3D,2DAA2D;oBAC3D,qDAAqD;oBACrD,oDAAoD;oBACpD,8BAA8B;oBAC9B,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBACD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;aAChD,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC,CAAC,CACH,CACF,CAAC;QAEJ,MAAM,aAAa,GAAG,GAA4C,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAC5D,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAC3B,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;YACzB,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE;gBACjC,OAAO;gBACP,OAAO;gBACP,gBAAgB;gBAChB,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CACzC,cAAc;iBACX,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;iBACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,EAC5E,KAAK,CAAC,KAAK,EACX,YAAY,CACb,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC,CAAC,CACH,CACF,CAAC;YACF,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CACxD,CACF,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;gBAC1B,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC,CAAC,CACH,CACF,CAAC;YACF,KAAK,CAAC,CAAC,qBAAqB,CAC1B,KAAK,EACL,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,OAAO,EACd,MAAM,EACN,eAAe,CAChB,CAAC;YACF,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACvC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;YACtB,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEL,MAAM,SAAS,GAAG,CAAI,MAAsC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,SAAS,CACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAClD,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,SAAS,CACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,UAAU,CACvB,cAAc,EACd,MAAM,EACN,GAAG,EACH,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,eAAe,EACtB,kBAAkB,CACnB,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,YAAY,CAAC;gBACf,GAAG,KAAK;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;gBAC7D,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CACL,CACF,CAAC;YACF,MAAM,UAAU,GAAG,UAAU,CAC3B,cAAc,EACd,MAAM,EACN,GAAG,EACH,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EACvC,MAAM,CAAC,gBAAgB,EACvB,kBAAkB,CACnB,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,MAAM,CAAC,GAAG,CAAC;gBACT,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACpC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;aAChD,CAAC,CACH,CACF,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAC5C,MAAM,EACN,UAAU,EACV,OAAO,EACP,KAAK,CAAC,OAAQ,CAAC,GAAG,EAClB,GAAG,EACH,eAAe,CAChB,CAAC;YACF,KAAK,CAAC,CAAC,yBAAyB,CAC9B,KAAK,EACL,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,mBAAmB,EAC1B,WAAW,EACX,eAAe,CAChB,CAAC;YACF,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACvC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YACtB,KAAK,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,CAAC,IAAI,CACJ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC7B,IAAI,MAAM;oBAAE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;gBAC1B,eAAe,CACb,QAAQ,EACR,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CACtE,CAAC;QACJ,CAAC,CAAC,CACH,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO;YAC3B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC;YAC7B,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC;YAC9B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,IAAI,MAAM;gBAAE,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YACxB,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAkC;YAC7C,MAAM;YACN,aAAa;YACb,WAAW,EAAE,iBAAiB;YAC9B,OAAO;YACP,OAAO;YACP,aAAa,EAAE,CAAU,MAA8B,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;SACpF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAC1E,CAAC;QACF,oEAAoE;QACpE,sDAAsD;QACtD,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,sBAAsB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC;CACxD,CAAC"}

package/dist/varlock/protocol.d.ts

@@ -0,0 +1,67 @@
+/** Pure validation for the Varlock proxy CLI protocol.
+ *
+ * This module deliberately does not know about process.env, subprocesses, or
+ * Effect.  Treat every value passed to it as hostile CLI output.  In
+ * particular, a session record is not a proof of ownership until the caller
+ * supplies the PID, UUID, and project directory it created.
+ */
+export declare const PROTOCOL_LIMITS: {
+    readonly jsonBytes: number;
+    readonly sessions: 128;
+    readonly mapEntries: 512;
+    readonly stringBytes: number;
+    readonly envKeyLength: 256;
+};
+export interface VarlockSessionRecord {
+    readonly id: string;
+    readonly uuid: string;
+    readonly ownerPid: number;
+    readonly cwd: string;
+    readonly startedAt: string;
+    readonly updatedAt: string;
+    readonly endedAt?: string;
+    readonly egressMode: "permissive" | "strict";
+    readonly env: Readonly<Record<string, string>>;
+    readonly placeholderOverrides?: Readonly<Record<string, string>>;
+}
+export interface OwnedSessionIdentity {
+    readonly ownerPid: number;
+    readonly sessionUuid: string;
+    readonly projectDirectory: string;
+}
+export interface ProxyWiring {
+    readonly proxyUrl: string;
+    readonly caPath: string;
+    readonly env: Readonly<Record<string, string>>;
+}
+export interface SafeSessionStatus {
+    readonly id: string;
+    readonly uuid: string;
+    readonly ownerPid: number;
+    readonly cwd: string;
+    readonly startedAt: string;
+    readonly updatedAt: string;
+    readonly egressMode: "permissive" | "strict";
+    readonly proxyUrl: string;
+    readonly running: boolean;
+}
+export declare class VarlockProtocolError extends Error {
+    readonly code: "protocol_error";
+    constructor(message?: string);
+}
+/** Decode only the JSON array emitted by `varlock proxy status --format json`. */
+export declare function decodeSessionList(input: string): readonly VarlockSessionRecord[];
+/** Exact ownership match. No cwd-prefix or PID-only matching is accepted. */
+export declare function findOwnedSession(sessions: readonly VarlockSessionRecord[], identity: OwnedSessionIdentity): VarlockSessionRecord | undefined;
+/** Validate wiring without returning credentials or writing ambient env state. */
+export declare function validateProxyWiring(env: Readonly<Record<string, string>>): ProxyWiring;
+/**
+ * Select explicitly requested child keys. A key is safe only when the session
+ * record has an exact placeholder assignment and the full env contains that
+ * exact placeholder. Prefixes are intentionally not trusted. Keys absent from
+ * placeholderOverrides (including @proxy=passthrough values) are rejected.
+ */
+export declare function selectPlaceholderEnvironment(fullEnv: Readonly<Record<string, string>>, session: VarlockSessionRecord, requestedKeys: readonly string[]): Readonly<Record<string, string>>;
+/** Safe status allowlist; deliberately drops tokens, env maps, and placeholders. */
+export declare function sanitizeSessionStatus(session: VarlockSessionRecord, running: boolean): SafeSessionStatus;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/varlock/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/varlock/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC;AA8BX,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAE9B,OAAO,SAAsC;CAM1D;AAkFD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAKhF;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,QAAQ,EAAE,oBAAoB,GAC7B,oBAAoB,GAAG,SAAS,CAWlC;AAgCD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,WAAW,CAwCtF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkBlC;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,OAAO,GACf,iBAAiB,CAanB"}