@braedonsaunders/appkit-desk 0.7.0 → 0.9.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@braedonsaunders/appkit-desk",
-  "version": "0.7.0",
-  "description": "Per-agent Debian microVMs under Cloud Hypervisor — headless machines with an on-demand screen, a framed vsock guest-agent protocol, leases with idle suspend and a bounded queue, and load-bearing handover masking behind consumer-supplied policy and recording ports.",
+  "version": "0.9.0",
+  "description": "Per-agent Debian microVMs on Linux and macOS, with a framed guest-agent protocol, leases, snapshots, and governed networking.",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "exports": {

package/plan.d.ts

@@ -5,6 +5,23 @@ export declare const DEFAULT_RUNTIME_DIR = "/run/appkit-desk";
 export declare const DEFAULT_MEMORY_MB = 384;
 export declare const DEFAULT_VCPUS = 2;
 export declare const DEFAULT_KERNEL_CMDLINE = "root=/dev/vda rw quiet";
+/**
+ * Where a Cloud Hypervisor desk looks for `virtiofsd` when `virtiofsdPath` is
+ * not set and it is not on `PATH`: Debian's and Fedora's package location.
+ */
+export declare const DEFAULT_VIRTIOFSD_PATH = "/usr/libexec/virtiofsd";
+export declare const DEFAULT_VIRTIOFSD_SANDBOX: DeskVirtiofsdSandbox;
+/**
+ * The guest network Virtualization.framework desks get from the helper's NAT:
+ * the same addresses QEMU's user networking uses, so they are unsurprising in
+ * a guest. Nothing outside the helper ever sees them.
+ */
+export declare const DEFAULT_VZ_GUEST_ADDRESS = "10.0.2.15";
+export declare const DEFAULT_VZ_GATEWAY_ADDRESS = "10.0.2.2";
+export declare const DEFAULT_VZ_PREFIX_LENGTH = 24;
+export declare const DEFAULT_VZ_DNS: readonly string[];
+/** Virtualization.framework always gives the guest vsock context ID 3. */
+export declare const VZ_GUEST_CID = 3;
 /**
  * Every failure this package raises. The `name` is annotated as `string`
  * rather than left to infer its literal so a subclass can narrow the meaning
@@ -20,9 +37,59 @@ export interface DeskLauncherIdentity {
     /** Host/container GID used to invoke the VMM and image tooling. */
     gid: number;
 }
+/**
+ * Which hypervisor a plan is for: Cloud Hypervisor over KVM on Linux, or
+ * Apple's Virtualization.framework through the `appkit-desk-vz` helper on an
+ * Apple silicon Mac.
+ */
+export type DeskHypervisor = 'cloud-hypervisor' | 'virtualization';
+/**
+ * The guest network of a Virtualization.framework desk. The helper runs a
+ * userspace NAT: the guest reaches the public internet and nothing else unless
+ * `allowLan` is set — no RFC 1918 space, link-local, CGNAT, or the Mac itself.
+ */
+export interface DeskGuestNetworkOptions {
+    /** Let the guest reach the Mac's LAN, link-local and CGNAT space, and the Mac. */
+    allowLan?: boolean;
+    /** The address the helper's DHCP server leases the guest. */
+    guestAddress?: string;
+    /** The helper's own address on the link: the guest's router. */
+    gatewayAddress?: string;
+    prefixLength?: number;
+    /** Resolvers the guest is handed; the first also answers DNS sent to the gateway. */
+    dns?: readonly string[];
+}
+/**
+ * A host directory shared into the guest over virtio-fs. The guest mounts it
+ * with `mount -t virtiofs <tag> <dir>`.
+ */
+export interface DeskShare {
+    /** 1–36 lowercase letters, digits, or hyphens, starting with a letter or digit; unique per desk. */
+    tag: string;
+    /** Absolute path of an existing host directory. */
+    path: string;
+    /**
+     * Refuse every write from the guest. Enforced by the host's file server, so
+     * a guest cannot lift it by remounting the share read-write.
+     */
+    readOnly: boolean;
+}
+/**
+ * How `virtiofsd` confines itself to the shared directory. `namespace` (its
+ * own default) pivots into the directory inside new mount, PID and network
+ * namespaces, which needs CAP_SYS_ADMIN when run as root and unprivileged user
+ * namespaces otherwise. `chroot` only chroots, which needs root and suits a
+ * container that may not create namespaces. Both stop symlinks from escaping
+ * the share; running unconfined is not offered.
+ */
+export type DeskVirtiofsdSandbox = 'namespace' | 'chroot';
 export interface DeskLaunchPlanOptions {
     deskId: string;
+    /** Defaults to `cloud-hypervisor`. */
+    hypervisor?: DeskHypervisor;
+    /** Cloud Hypervisor only: the VMM binary. */
     vmmPath?: string;
+    /** Cloud Hypervisor only: the KVM device. */
     kvmPath?: string;
     qemuImgPath?: string;
     /** Absolute path of the kernel image the microVM boots. */
@@ -40,14 +107,40 @@ export interface DeskLaunchPlanOptions {
     overlayPath: string;
     memoryMb?: number;
     vcpus?: number;
-    /** Guest vsock context ID; must be unique among resident desks. */
+    /**
+     * Guest vsock context ID; must be unique among resident desks. Cloud
+     * Hypervisor only — a Virtualization.framework guest is always CID 3, and
+     * its vsock is private to its helper.
+     */
     vsockCid: number;
-    /** Directory holding the vsock and API control sockets. */
+    /**
+     * Directory holding the desk's control sockets. Defaults to
+     * `/run/appkit-desk` for Cloud Hypervisor and `<os tmpdir>/appkit-desk` for
+     * Virtualization.framework.
+     */
     runtimeDir?: string;
-    /** Host TAP device name; derived from the CID when omitted. */
+    /** Cloud Hypervisor only: host TAP device name; derived from the CID when omitted. */
     tapDevice?: string;
-    /** Guest MAC address; derived from the CID when omitted. */
+    /**
+     * Guest MAC address. Derived from the CID for Cloud Hypervisor, and from the
+     * desk ID for Virtualization.framework, whose restore needs the same NIC.
+     */
     macAddress?: string;
+    /** Virtualization.framework only: the helper's NAT network and fence. */
+    guestNetwork?: DeskGuestNetworkOptions;
+    /**
+     * Host directories shared into the guest. Restoring a snapshot requires the
+     * same shares the desk was parked with; see the backends.
+     */
+    shares?: readonly DeskShare[];
+    /**
+     * Cloud Hypervisor only: the `virtiofsd` binary (1.13 or later) that serves
+     * each share. Defaults to the first `virtiofsd` on `PATH`, then
+     * `/usr/libexec/virtiofsd`. Not needed, and not looked for, without shares.
+     */
+    virtiofsdPath?: string;
+    /** Cloud Hypervisor only: defaults to `namespace`. */
+    virtiofsdSandbox?: DeskVirtiofsdSandbox;
     kernelCmdline?: string;
     launcherIdentity?: DeskLauncherIdentity;
     /**
@@ -67,17 +160,9 @@ export interface DeskLaunchPlanOptions {
      */
     restore?: boolean;
 }
-/**
- * The complete Cloud Hypervisor invocation as inspectable data. Nothing here
- * has been spawned: tests, audit logs, and readiness screens can assert on the
- * exact argv a desk would boot with.
- */
-export interface DeskLaunchPlan {
+/** What every plan carries, whichever hypervisor runs it. */
+export interface DeskLaunchPlanBase {
     deskId: string;
-    vmm: {
-        command: string;
-        args: string[];
-    };
     overlay: {
         path: string;
         basePath: string;
@@ -87,22 +172,22 @@ export interface DeskLaunchPlan {
             args: string[];
         } | null;
     };
+    /**
+     * The host Unix socket the guest's vsock is reached through, with Cloud
+     * Hypervisor's hybrid-vsock preamble: write `CONNECT <port>\n`, read
+     * `OK <n>\n`, then the stream is the guest connection.
+     */
     vsock: {
         cid: number;
         socketPath: string;
     };
-    api: {
-        socketPath: string;
-    };
-    tap: {
-        device: string;
-        mac: string;
-    };
     /** Where a memory snapshot of this desk is written, and read back from. */
     snapshot: {
         dir: string;
         restoring: boolean;
     };
+    /** Host directories shared into the guest, in the order they were given. */
+    shares: readonly DeskShare[];
     memoryMb: number;
     vcpus: number;
     kernelPath: string;
@@ -112,27 +197,103 @@ export interface DeskLaunchPlan {
     launcherIdentity?: DeskLauncherIdentity;
 }
 /**
- * Whether this host can run desks at all: Linux, a usable `/dev/kvm`, and the
- * Cloud Hypervisor binary. All three checks are injectable and the answer is
- * fail-closed — a host missing any of them gets no desk capability rather
- * than a degraded one.
+ * The complete Cloud Hypervisor invocation as inspectable data. Nothing here
+ * has been spawned: tests, audit logs, and readiness screens can assert on the
+ * exact argv a desk would boot with.
+ */
+export interface CloudHypervisorLaunchPlan extends DeskLaunchPlanBase {
+    hypervisor: 'cloud-hypervisor';
+    vmm: {
+        command: string;
+        args: string[];
+    };
+    api: {
+        socketPath: string;
+    };
+    tap: {
+        device: string;
+        mac: string;
+    };
+    /**
+     * Each share with the `virtiofsd` that serves it. Every daemon must be
+     * listening on its socket before the VMM starts, for a boot and for a
+     * restore alike.
+     */
+    shares: readonly CloudHypervisorShare[];
+}
+export interface CloudHypervisorShare extends DeskShare {
+    /** The vhost-user socket the daemon listens on and the VMM connects to. */
+    socketPath: string;
+    daemon: {
+        command: string;
+        args: string[];
+    };
+}
+/**
+ * A Virtualization.framework desk as inspectable data: what the helper is
+ * asked to boot. The helper path belongs to the backend, not the plan.
+ */
+export interface VirtualizationLaunchPlan extends DeskLaunchPlanBase {
+    hypervisor: 'virtualization';
+    /**
+     * The host Unix socket guest TCP ports are reached through, with the same
+     * preamble as `vsock`: `CONNECT <tcp port>\n` answered by `OK <n>\n` once
+     * the guest accepts, or a close with nothing written when it refuses.
+     */
+    ports: {
+        socketPath: string;
+    };
+    network: {
+        mac: string;
+        allowLan: boolean;
+        guestAddress: string;
+        gatewayAddress: string;
+        prefixLength: number;
+        dns: string[];
+    };
+}
+export type DeskLaunchPlan = CloudHypervisorLaunchPlan | VirtualizationLaunchPlan;
+/**
+ * Whether this host can run desks at all. On Linux: a usable `/dev/kvm` and
+ * the Cloud Hypervisor binary. On macOS: Apple silicon, macOS 14 or later (the
+ * first with Virtualization.framework save and restore), and an existing
+ * `appkit-desk-vz` helper at `helperPath`. Signature and entitlement are checked
+ * by macOS on execution, not by this probe. Every check is injectable and the
+ * answer is fail-closed — a host missing any of them gets no desk capability
+ * rather than a degraded one.
  */
 export declare function isDeskSupported(options?: {
     platform?: NodeJS.Platform;
     kvmPath?: string;
     vmmPath?: string;
+    /** macOS: the signed `appkit-desk-vz` helper. Required there. */
+    helperPath?: string;
+    arch?: string;
+    /** The kernel release, as `os.release()` reports it. */
+    osRelease?: string;
     pathExists?: (path: string) => boolean;
 }): boolean;
 /** Validate a desk identifier, which is used in socket paths and device names. */
 export declare function cleanDeskId(value: string): string;
+export interface DeskLaunchPlanDependencies {
+    pathExists?: (path: string) => boolean;
+    deviceExists?: (path: string) => boolean;
+    /** Whether a path is an existing directory; checked for every share. */
+    isDirectory?: (path: string) => boolean;
+    /** Searched for `virtiofsd` when `virtiofsdPath` is not set; defaults to `process.env.PATH`. */
+    searchPath?: string;
+}
 /**
- * Build the deterministic Cloud Hypervisor launch plan without spawning
- * anything. Fail closed: a missing `/dev/kvm`, VMM binary, kernel, base image,
+ * Build the deterministic launch plan without spawning anything. Fail closed:
+ * a missing `/dev/kvm` or VMM binary (Cloud Hypervisor), kernel, base image,
  * or overlay directory throws instead of producing a plan that cannot boot.
  */
-export declare function buildDeskLaunchPlan(options: DeskLaunchPlanOptions, dependencies?: {
-    pathExists?: (path: string) => boolean;
-    deviceExists?: (path: string) => boolean;
-}): DeskLaunchPlan;
+export declare function buildDeskLaunchPlan(options: DeskLaunchPlanOptions & {
+    hypervisor: 'virtualization';
+}, dependencies?: DeskLaunchPlanDependencies): VirtualizationLaunchPlan;
+export declare function buildDeskLaunchPlan(options: DeskLaunchPlanOptions & {
+    hypervisor?: 'cloud-hypervisor';
+}, dependencies?: DeskLaunchPlanDependencies): CloudHypervisorLaunchPlan;
+export declare function buildDeskLaunchPlan(options: DeskLaunchPlanOptions, dependencies?: DeskLaunchPlanDependencies): DeskLaunchPlan;
 export declare function cleanLauncherIdentity(identity: DeskLauncherIdentity | undefined): DeskLauncherIdentity | undefined;
 //# sourceMappingURL=plan.d.ts.map

package/plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAC3D,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAC1C,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AACxD,eAAO,MAAM,mBAAmB,qBAAqB,CAAA;AACrD,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,eAAO,MAAM,aAAa,IAAI,CAAA;AAC9B,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAS9D;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,EAAE,MAAM,CAAc;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACxC,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,4EAA4E;QAC5E,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,GAAG,IAAI,CAAA;KACnD,CAAA;IACD,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,2EAA2E;IAC3E,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAA;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAClC,GAAG,OAAO,CAQf;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,qBAAqB,EAC9B,YAAY,GAAE;IACZ,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC,GACL,cAAc,CAsIhB;AAoCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,GACzC,oBAAoB,GAAG,SAAS,CAUlC"}
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAC3D,eAAO,MAAM,gBAAgB,aAAa,CAAA;AAC1C,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AACxD,eAAO,MAAM,mBAAmB,qBAAqB,CAAA;AACrD,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,eAAO,MAAM,aAAa,IAAI,CAAA;AAC9B,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D;;;GAGG;AACH,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D,eAAO,MAAM,yBAAyB,EAAE,oBAAkC,CAAA;AAC1E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,cAAc,CAAA;AACnD,eAAO,MAAM,0BAA0B,aAAa,CAAA;AACpD,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAC1C,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAA2B,CAAA;AACvE,0EAA0E;AAC1E,eAAO,MAAM,YAAY,IAAI,CAAA;AAiB7B;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,EAAE,MAAM,CAAc;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,gBAAgB,CAAA;AAElE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,oGAAoG;IACpG,GAAG,EAAE,MAAM,CAAA;IACX,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEzD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,sCAAsC;IACtC,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,uBAAuB,CAAA;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,4EAA4E;QAC5E,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,GAAG,IAAI,CAAA;KACnD,CAAA;IACD;;;;OAIG;IACH,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,2EAA2E;IAC3E,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAA;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,UAAU,EAAE,kBAAkB,CAAA;IAC9B,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACxC,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC;;;;OAIG;IACH,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,oBAAqB,SAAQ,SAAS;IACrD,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,UAAU,EAAE,gBAAgB,CAAA;IAC5B;;;;OAIG;IACH,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7B,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,OAAO,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,YAAY,EAAE,MAAM,CAAA;QACpB,GAAG,EAAE,MAAM,EAAE,CAAA;KACd,CAAA;CACF;AAED,MAAM,MAAM,cAAc,GAAG,yBAAyB,GAAG,wBAAwB,CAAA;AAEjF;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CAClC,GAAG,OAAO,CAmBf;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IACxC,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IACvC,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,qBAAqB,GAAG;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,EACjE,YAAY,CAAC,EAAE,0BAA0B,GACxC,wBAAwB,CAAA;AAC3B,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,qBAAqB,GAAG;IAAE,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAAE,EACpE,YAAY,CAAC,EAAE,0BAA0B,GACxC,yBAAyB,CAAA;AAC5B,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,qBAAqB,EAC9B,YAAY,CAAC,EAAE,0BAA0B,GACxC,cAAc,CAAA;AAkdjB,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,GACzC,oBAAoB,GAAG,SAAS,CAUlC"}