@byollm/server 0.1.0-alpha.1 → 0.1.0-alpha.100

package/supabase/migrations/20260809000000_byollm_runner.sql

@@ -33,6 +33,9 @@ create table byollm_runners (
   platform         text not null check (platform in ('darwin', 'linux', 'win32')),
   daemon_version   text not null,
   capabilities     jsonb not null default '[]'::jsonb,
+  -- byollm_009 §5: the device's pinned public identity. What a later
+  -- signature verifies against — a runner id names a machine, this proves it.
+  device           jsonb not null,
   paused           boolean not null default false,
   -- Set once. A revoked runner never un-revokes.
   revoked_at       timestamptz,
@@ -63,6 +66,9 @@ create table byollm_pairings (
   platform         text not null,
   daemon_version   text not null,
   capabilities     jsonb not null default '[]'::jsonb,
+  -- Presented at pair start, so the user approves a *machine* rather than a
+  -- code any machine could redeem. Copied onto the runner at approval.
+  device           jsonb not null,
   expires_at       timestamptz not null,
   created_at       timestamptz not null default now()
 );
@@ -77,7 +83,13 @@ create index byollm_pairings_expiry_idx on byollm_pairings (expires_at);
 create table byollm_jobs (
   id             uuid primary key default gen_random_uuid(),
   kind           text not null,
-  payload        jsonb not null,
+  -- The work, sealed to the site's own key (byollm_009 §10). The database
+  -- holds ciphertext; the application opens it, because the application is
+  -- the endpoint. Backups, replicas and anyone with read access see this.
+  envelope       jsonb not null,
+  -- Bucketed at enqueue, where the plaintext was.
+  size_class     text not null default 'small'
+                   check (size_class in ('small','medium','large','unbounded')),
   audience       byollm_audience not null default 'self',
   owner          uuid not null references auth.users (id) on delete cascade,
   -- Server-side restriction on which runner owners may take a `named` job.
@@ -85,6 +97,10 @@ create table byollm_jobs (
   audience_allow uuid[] ,
   depends_on     uuid[] not null default '{}',
   state          byollm_job_state not null default 'queued',
+  -- Identifies this *grant*, not just its holder. A runner can claim, release
+  -- and re-claim the same job; without an id per grant a replayed release
+  -- lands on a later lease and returns a job to the queue mid-execution.
+  lease_id       uuid,
   lease_runner   uuid references byollm_runners (id) on delete set null,
   lease_expires_at timestamptz,
   -- When the job became claimable. THE TTL CLOCK STARTS HERE, not at
@@ -182,6 +198,7 @@ begin
   --    lease reclaim exists to provide.
   update byollm_jobs
      set state            = 'queued',
+         lease_id         = null,
          lease_runner     = null,
          lease_expires_at = null,
          claimable_at     = now(),
@@ -196,6 +213,7 @@ begin
   --    past its absolute deadline.
   update byollm_jobs
      set state        = 'expired',
+         lease_id = null,
          lease_runner = null,
          lease_expires_at = null,
          updated_at   = now()
@@ -273,6 +291,7 @@ begin
   )
   update byollm_jobs j
      set state            = 'claimed',
+         lease_id         = gen_random_uuid(),
          lease_runner     = p_runner_id,
          lease_expires_at = now() + (p_lease_ms || ' milliseconds')::interval,
          attempts         = j.attempts + 1,
@@ -437,9 +456,9 @@ begin
   end if;
 
   insert into byollm_runners (owner, token_hash, label, platform,
-                              daemon_version, capabilities)
+                              daemon_version, capabilities, device)
   values (v_owner, p_token_hash, v_pairing.label, v_pairing.platform,
-          v_pairing.daemon_version, v_pairing.capabilities)
+          v_pairing.daemon_version, v_pairing.capabilities, v_pairing.device)
   returning * into v_runner;
 
   update byollm_pairings

package/supabase/migrations/20260819000000_drop_runner_token.sql

@@ -0,0 +1,87 @@
+-- The bearer token nobody used — cloud_008 §2.4, finding 37.
+--
+-- `byollm_runners.token_hash` held the SHA-256 of a token minted at pairing,
+-- returned to the daemon, written to its pairings file, and then **never
+-- sent, never looked up and never compared**. The only reader was
+-- `getRunnerByTokenHash`, which both store adapters implemented and nothing
+-- called except a test asserting it returns null.
+--
+-- That is not dead wire in the ordinary sense. It was a *secret*: minted,
+-- transmitted once, and written to two disks at rest for no purpose. A
+-- credential with no consumer cannot be used correctly and can still leak,
+-- which makes it strictly a liability.
+--
+-- `REQUESTS_SIGNED_NOT_BEARER` was the rule the whole time and was enforced
+-- the whole time: every authenticated call is signed by the device's pinned
+-- identity key, and `C016` proves an endpoint refuses a bearer token. This
+-- drops the thing the MUST is named after.
+--
+-- `byollm_pairings.runner_token_once` stays and now carries a marker rather
+-- than a secret. It is the deliver-once flag — a replayed device code must
+-- get nothing — a real property that was riding on the token's nullability.
+-- Renaming a column and changing the code that reads it in one step is how a
+-- rollback strands rows, so the rename waits for a later release.
+
+alter table byollm_runners drop column if exists token_hash;
+
+-- The browser-facing approval path takes one fewer argument. Replaced with
+-- the old signature dropped rather than left beside it: two functions with
+-- one name is how a caller ends up invoking the one nobody maintains.
+--
+-- Everything else is unchanged from the original, deliberately — the owner
+-- still comes from `auth.uid()` because a daemon can never assert who it is,
+-- which is the whole reason pairing is interactive.
+drop function if exists byollm_approve_pairing(text, text);
+
+create or replace function byollm_approve_pairing(
+  p_user_code text
+)
+returns byollm_runners
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_pairing byollm_pairings;
+  v_runner  byollm_runners;
+  v_owner   uuid := (select auth.uid());
+begin
+  if v_owner is null then
+    raise exception 'approving a pairing requires an authenticated user';
+  end if;
+
+  select * into v_pairing from byollm_pairings
+   where user_code = p_user_code for update;
+
+  if v_pairing is null then
+    raise exception 'unknown pairing code';
+  end if;
+  if v_pairing.expires_at <= now() then
+    raise exception 'pairing code has expired';
+  end if;
+  if v_pairing.state <> 'pending' then
+    raise exception 'pairing is already %', v_pairing.state;
+  end if;
+
+  insert into byollm_runners (owner, label, platform,
+                              daemon_version, capabilities, device)
+  values (v_owner, v_pairing.label, v_pairing.platform,
+          v_pairing.daemon_version, v_pairing.capabilities, v_pairing.device)
+  returning * into v_runner;
+
+  -- The marker, not a token: this is what makes a replayed device code get
+  -- nothing. The service-role path in `supabase/index.ts` writes the same
+  -- value, and the two approval doors have to agree — a field set by one and
+  -- not the other produces a runner that is correct through one and broken
+  -- through the other.
+  update byollm_pairings
+     set state = 'approved',
+         owner = v_owner,
+         runner_id = v_runner.id,
+         runner_token_once = 'pending-collection'
+   where device_code_hash = v_pairing.device_code_hash;
+
+  return v_runner;
+end;
+$$;
+

package/supabase/migrations/20260819010000_completed_by_lease_id.sql

@@ -0,0 +1,25 @@
+-- Which grant recorded a result — cloud_008 §3.6.
+--
+-- `complete` now checks terminal state **before** the holder, so
+-- `RESULT_IDEMPOTENT` is enforced by the branch named after it rather than as
+-- a side effect of the lease being nulled on success. Answering a replay
+-- correctly means knowing which grant recorded the result, and `lease_id` is
+-- cleared at completion by design: "who holds this" and "who finished this"
+-- are different questions with different lifetimes.
+--
+-- ## Why this is its own file
+--
+-- It was first appended to `20260819000000_drop_runner_token.sql`, which had
+-- already shipped in alpha.19. An applied migration is immutable — that is the
+-- whole reason a migrations folder can be trusted — and the fact that this one
+-- is only days old and probably applied nowhere does not make editing it a
+-- different act. The rule is worth more than the tidiness.
+--
+-- ## Nullable, and not backfilled
+--
+-- Rows completed before this migration have no recorded grant, so a replay of
+-- one of them is answered as a plain refusal rather than as a duplicate. That
+-- is the safe direction: it withholds a reassurance rather than inventing one,
+-- and the daemons that produced those rows stopped retrying long ago.
+alter table byollm_jobs
+  add column if not exists completed_by_lease_id text;

package/supabase/migrations/20260821000000_rename_collected.sql

@@ -0,0 +1,91 @@
+-- The deliver-once flag stops pretending to be a token — cloud_008 §2.4a.
+--
+-- `20260819000000_drop_runner_token` removed the bearer credential and left
+-- `byollm_pairings.runner_token_once` carrying a marker string, with the
+-- reason written down: *"Renaming a column and changing the code that reads
+-- it in one step is how a rollback strands rows, so the rename waits for a
+-- later release."*
+--
+-- This is that release. The rename lands with the code that reads it, in one
+-- step, because the transitional shape exists to protect a party who has not
+-- agreed to change — and pre-1.0, with one deployment and one operator, that
+-- party is us. Carrying a column named after a secret it no longer holds is
+-- a comment that has to be re-read by everybody who meets it.
+--
+-- The property is unchanged and is the reason the column survives at all: a
+-- replayed device code must get nothing, or a code left in a shell history is
+-- a second pairing. That was riding on a token's nullability, which was one
+-- field doing two jobs — and only one of them load-bearing.
+
+alter table byollm_pairings
+  rename column runner_token_once to collected_at;
+
+-- A timestamp rather than a marker string. `'pending-collection'` was the
+-- shape a nulled token left behind; what the flag actually records is *when*
+-- the approval was handed over, which is worth having when somebody asks why
+-- a pairing did not complete.
+alter table byollm_pairings
+  alter column collected_at type timestamptz
+  using case when collected_at is null then now() else null end;
+
+comment on column byollm_pairings.collected_at is
+  'When the approval was collected. Null until then — a replayed device code '
+  'gets nothing. cloud_008 §2.4a; this was runner_token_once.';
+
+-- The approval function moves with the column it writes. Recreated whole
+-- rather than patched, because two functions with one name is how a caller
+-- ends up invoking the one nobody maintains — the argument the migration
+-- before this one made when it replaced the old signature.
+
+create or replace function byollm_approve_pairing(
+  p_user_code text
+)
+returns byollm_runners
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_pairing byollm_pairings;
+  v_runner  byollm_runners;
+  v_owner   uuid := (select auth.uid());
+begin
+  if v_owner is null then
+    raise exception 'approving a pairing requires an authenticated user';
+  end if;
+
+  select * into v_pairing from byollm_pairings
+   where user_code = p_user_code for update;
+
+  if v_pairing is null then
+    raise exception 'unknown pairing code';
+  end if;
+  if v_pairing.expires_at <= now() then
+    raise exception 'pairing code has expired';
+  end if;
+  if v_pairing.state <> 'pending' then
+    raise exception 'pairing is already %', v_pairing.state;
+  end if;
+
+  insert into byollm_runners (owner, label, platform,
+                              daemon_version, capabilities, device)
+  values (v_owner, v_pairing.label, v_pairing.platform,
+          v_pairing.daemon_version, v_pairing.capabilities, v_pairing.device)
+  returning * into v_runner;
+
+  -- The marker, not a token: this is what makes a replayed device code get
+  -- nothing. The service-role path in `supabase/index.ts` writes the same
+  -- value, and the two approval doors have to agree — a field set by one and
+  -- not the other produces a runner that is correct through one and broken
+  -- through the other.
+  update byollm_pairings
+     set state = 'approved',
+         owner = v_owner,
+         runner_id = v_runner.id,
+         collected_at = null
+   where device_code_hash = v_pairing.device_code_hash;
+
+  return v_runner;
+end;
+$$;
+

package/supabase/migrations/20260824000000_one_vocabulary.sql

@@ -0,0 +1,109 @@
+-- One sharing vocabulary, in the database too — byollm_016.
+--
+-- `private | team | public` replaced `self | named | public` everywhere else
+-- in this release. The enums did not move with it, and the gap was invisible
+-- to `pnpm run verify`: the TypeScript compiled, the unit suites passed
+-- against the in-memory store, and only the freeze gate — which runs the same
+-- code against real Postgres — refused the insert with `invalid input value
+-- for enum byollm_audience: "private"`. A schema is not typechecked by the
+-- language that talks to it.
+--
+-- Values are renamed rather than the enums recreated. `alter type ... rename
+-- value` keeps every existing row's identity: the label changes, the stored
+-- value does not move, and nothing has to be rewritten or backfilled. A
+-- drop-and-recreate would need every column that uses the type dropped first,
+-- which is how a rename turns into data loss.
+--
+-- Landing in one step, with the code that reads it, for the reason
+-- `20260821000000_rename_collected` gives: transitional shapes exist to
+-- protect a party who has not agreed to change, and pre-1.0 that party is us.
+
+alter type byollm_audience rename value 'self' to 'private';
+alter type byollm_audience rename value 'named' to 'team';
+
+alter type byollm_offer_scope rename value 'self' to 'private';
+alter type byollm_offer_scope rename value 'named' to 'team';
+
+-- The column default is stored as a reference to the value, not as its text,
+-- so the rename already carried it. Restated anyway: a default that reads
+-- `'self'` in a dump nobody re-ran is exactly the kind of thing that gets
+-- copied into the next schema.
+alter table byollm_jobs
+  alter column audience set default 'private';
+
+comment on column byollm_jobs.audience is
+  'Who this job may run for: private (the owner alone), team (the owner and '
+  'the named allowlist), public (anyone). byollm_016; these were self/named.';
+
+-- Recreated whole rather than patched — two functions with one name is how a
+-- caller ends up invoking the one nobody maintains. The logic is unchanged;
+-- only the vocabulary moves.
+create or replace function byollm_audience_admits(
+  p_job          byollm_jobs,
+  p_runner_id    uuid,
+  p_runner_owner uuid,
+  p_capabilities jsonb
+)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = public
+as $$
+declare
+  v_cap jsonb;
+  v_scope text;
+  v_backend text;
+  v_same_owner boolean := (p_job.owner = p_runner_owner);
+begin
+  select value into v_cap
+    from jsonb_array_elements(p_capabilities)
+   where value ->> 'kind' = p_job.kind
+   limit 1;
+
+  if v_cap is null then
+    return false;
+  end if;
+
+  v_scope   := v_cap ->> 'offerScope';
+  v_backend := v_cap ->> 'backendId';
+
+  -- Side 1: does the job's audience admit this runner's owner?
+  if p_job.audience = 'private' and not v_same_owner then
+    return false;
+  end if;
+  if p_job.audience = 'team'
+     and not v_same_owner
+     and p_job.audience_allow is not null
+     and not (p_runner_owner = any (p_job.audience_allow)) then
+    return false;
+  end if;
+
+  -- A daemon always runs its own owner's work.
+  if v_same_owner then
+    return true;
+  end if;
+
+  -- The subscription self-lock. Applied here regardless of the scope the
+  -- daemon advertised: a widened scope on a subscription backend is refused,
+  -- not obeyed (SUBSCRIPTION_SELF_LOCK).
+  if v_backend = 'claude-cli' then
+    return false;
+  end if;
+
+  -- Side 2: does the backend's offer scope admit the job's owner?
+  if v_scope = 'private' then
+    return false;
+  end if;
+  if v_scope = 'team' then
+    -- The server cannot verify a remote daemon's local allowlist and must not
+    -- pretend to. It offers the job; the daemon refuses if its own list says
+    -- no, and the refusal is remembered in refused_by. In this build that
+    -- allowlist is the *only* enforcement — there is no central roster yet.
+    return true;
+  end if;
+  return v_scope = 'public';
+end;
+$$;
+
+revoke all on function byollm_audience_admits(byollm_jobs, uuid, uuid, jsonb) from public;

package/supabase/migrations/20260825000000_job_service.sql

@@ -0,0 +1,20 @@
+-- A job may name which service should answer it — byollm_016 Phase B.
+--
+-- Nullable with no default, and the null means something specific: this job
+-- named nothing, so the device owner's default answers. That is every job
+-- enqueued before this column existed, which is why there is no backfill —
+-- the absent value already says the right thing about them.
+--
+-- A *key* rather than a value. It holds a name from the device owner's own
+-- config, so it means nothing off that machine and resolves through their
+-- config or resolves nowhere. No model, no base URL, no flags: the amended
+-- NO_PAYLOAD_ROUTING permits selection and forbids description, and a column
+-- that could hold `claude-opus-5` would be the wrong shape for that rule.
+
+alter table byollm_jobs
+  add column if not exists service text;
+
+comment on column byollm_jobs.service is
+  'Which of the device owner''s advertised services should answer. Null means '
+  'their default. A key from their config, never a model or URL — byollm_016 '
+  'Phase B, byollm_009 Amendment D.';

package/supabase/migrations/20260827000000_job_purpose.sql

@@ -0,0 +1,36 @@
+-- A job names one of the *site's* declared purposes — byollm_016 Amendment L.
+--
+-- This replaces `service`, added two days ago, which named one of the device
+-- owner's advertised services. That was safe because it was a key rather than
+-- a value — a name from somebody's own config, meaningless off their machine.
+-- Amendment L goes further: a site does not name the owner's things at all.
+-- It declares purposes of its own, each person maps those purposes to their
+-- own services on the consent screen, and a control plane joins the two when
+-- it signs a grant.
+--
+-- So the vocabulary that crossed the boundary no longer does. The refusal
+-- machinery that existed to stop a site probing service names — one collapsed
+-- reason for "no such service" and "not offered to you" — retires with it,
+-- because a name that never crosses cannot be enumerated across.
+--
+-- Renamed rather than dropped-and-added: the column's *shape* is unchanged
+-- (nullable text, no default, null meaning "nothing named") and a rename
+-- keeps every row's identity, its grants and its policies. What changes is
+-- whose namespace the string belongs to.
+--
+-- **The values are not migrated, and that is deliberate.** Any row still
+-- holding a service name holds a name from the wrong namespace: it is one of
+-- the device owner's services, and this column now means one of the site's
+-- purposes. There is no mapping between them that this migration could know.
+-- Pre-1.0, nothing has shipped with either, and a null here reads as "named
+-- nothing" — which is the truth about a job enqueued before purposes existed.
+
+alter table byollm_jobs
+  rename column service to purpose;
+
+update byollm_jobs set purpose = null where purpose is not null;
+
+comment on column byollm_jobs.purpose is
+  'Which of the enqueuing site''s declared purposes this job serves. Null '
+  'means it named none. A key in the site''s own namespace — never a service, '
+  'model or URL — byollm_016 Amendment L.';

package/dist/chunk-7RKXFPBZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/delivery.ts"],"sourcesContent":["import type { DeliveredResult } from \"@byollm/protocol\";\n\n/** Why a wait ended without a result. */\nexport class NoRunnerAvailableError extends Error {\n  override readonly name = \"NoRunnerAvailableError\";\n  constructor(\n    readonly jobId: string,\n    readonly reason: string,\n  ) {\n    super(\n      `no runner is available to execute job ${jobId} (${reason}). ` +\n        `Fall back to a hosted model, or prompt the user to start their runner.`,\n    );\n  }\n}\n\n/** The wait exceeded its timeout while a runner was still plausibly working. */\nexport class ResultTimeoutError extends Error {\n  override readonly name = \"ResultTimeoutError\";\n  constructor(\n    readonly jobId: string,\n    readonly timeoutMs: number,\n  ) {\n    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);\n  }\n}\n\nexport interface WaitOptions {\n  /** Give up after this long. Default 5 minutes. */\n  readonly timeoutMs?: number;\n  /**\n   * Called instead of throwing when no runner can take the job. Return a\n   * substitute result (a hosted-model answer, say) and the wait resolves with\n   * it; return nothing and {@link NoRunnerAvailableError} is thrown.\n   */\n  readonly onNoRunner?: (\n    reason: string,\n  ) => DeliveredResult | undefined | Promise<DeliveredResult | undefined>;\n  /** Abort the wait. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * How an app learns a job finished.\n *\n * byollm_003 Rev 1 is explicit that this is a *channel* — webhook, Realtime\n * subscription, or poll — and never an implied in-request `await`. The\n * polling implementation below is the portable default; the Supabase adapter\n * substitutes Realtime for the same interface.\n */\nexport interface ResultDelivery {\n  waitFor(jobId: string, options?: WaitOptions): Promise<DeliveredResult>;\n}\n\nexport interface PollingDeliveryDeps {\n  /** Current state of the job, or null if unknown. */\n  readonly read: (jobId: string) => Promise<DeliveredResult | null>;\n  /** Whether a runner could still take this job. */\n  readonly availability: (\n    jobId: string,\n  ) => Promise<{ available: boolean; reason?: string; blocked: boolean }>;\n  readonly sleep?: (ms: number) => Promise<void>;\n  /**\n   * Injectable clock. It must advance in step with {@link sleep}: a test that\n   * stubs one and not the other gets a loop whose grace window never elapses.\n   */\n  readonly now?: () => number;\n  /**\n   * How long a sustained no-runner signal must persist before it is believed.\n   * Defaults to {@link NO_RUNNER_GRACE_MS}.\n   */\n  readonly graceMs?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\nconst POLL_INTERVAL_MS = 500;\n/**\n * How long to let a job sit with no available runner before giving up.\n *\n * Not zero: a daemon restarting, or one whose heartbeat is momentarily late,\n * would otherwise fail every job in flight. The signal has to be sustained\n * before it is believed.\n */\nconst NO_RUNNER_GRACE_MS = 10_000;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The portable delivery channel: poll the store until the job is terminal.\n *\n * Correct everywhere and adequate for most apps. An adapter with a push\n * channel should replace it — see the Supabase adapter's Realtime delivery.\n */\nexport class PollingDelivery implements ResultDelivery {\n  readonly #deps: PollingDeliveryDeps;\n\n  constructor(deps: PollingDeliveryDeps) {\n    this.#deps = deps;\n  }\n\n  async waitFor(\n    jobId: string,\n    options: WaitOptions = {},\n  ): Promise<DeliveredResult> {\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const sleep = this.#deps.sleep ?? defaultSleep;\n    const now = this.#deps.now ?? Date.now;\n    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;\n    const started = now();\n    let noRunnerSince: number | null = null;\n\n    for (;;) {\n      options.signal?.throwIfAborted();\n\n      const current = await this.#deps.read(jobId);\n      if (current && isTerminalState(current.state)) return current;\n\n      const availability = await this.#deps.availability(jobId);\n      if (availability.available || availability.blocked) {\n        // `blocked` means the job is waiting on a dependency, which is not the\n        // same event as \"nobody can run this\" ({@link MUSTS.NO_RUNNER_SIGNAL}).\n        noRunnerSince = null;\n      } else {\n        noRunnerSince ??= now();\n        if (now() - noRunnerSince >= graceMs) {\n          const reason = availability.reason ?? \"no-runner-online\";\n          const substitute = await options.onNoRunner?.(reason);\n          if (substitute) return substitute;\n          throw new NoRunnerAvailableError(jobId, reason);\n        }\n      }\n\n      if (now() - started >= timeoutMs) {\n        throw new ResultTimeoutError(jobId, timeoutMs);\n      }\n      await sleep(POLL_INTERVAL_MS);\n    }\n  }\n}\n\nfunction isTerminalState(state: string): boolean {\n  return (\n    state === \"ok\" ||\n    state === \"error\" ||\n    state === \"canceled\" ||\n    state === \"expired\"\n  );\n}\n"],"mappings":";AAGO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAEhD,YACW,OACA,QACT;AACA;AAAA,MACE,yCAAyC,KAAK,KAAK,MAAM;AAAA,IAE3D;AANS;AACA;AAAA,EAMX;AAAA,EAPW;AAAA,EACA;AAAA,EAHO,OAAO;AAU3B;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACW,OACA,WACT;AACA,UAAM,OAAO,KAAK,0BAA0B,OAAO,SAAS,CAAC,IAAI;AAHxD;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAAA,EAHO,OAAO;AAO3B;AAiDA,IAAM,qBAAqB,IAAI;AAC/B,IAAM,mBAAmB;AAQzB,IAAM,qBAAqB;AAE3B,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAQ3C,IAAM,kBAAN,MAAgD;AAAA,EAC5C;AAAA,EAET,YAAY,MAA2B;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QACJ,OACA,UAAuB,CAAC,GACE;AAC1B,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,UAAM,MAAM,KAAK,MAAM,OAAO,KAAK;AACnC,UAAM,UAAU,KAAK,MAAM,WAAW;AACtC,UAAM,UAAU,IAAI;AACpB,QAAI,gBAA+B;AAEnC,eAAS;AACP,cAAQ,QAAQ,eAAe;AAE/B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAC3C,UAAI,WAAW,gBAAgB,QAAQ,KAAK,EAAG,QAAO;AAEtD,YAAM,eAAe,MAAM,KAAK,MAAM,aAAa,KAAK;AACxD,UAAI,aAAa,aAAa,aAAa,SAAS;AAGlD,wBAAgB;AAAA,MAClB,OAAO;AACL,0BAAkB,IAAI;AACtB,YAAI,IAAI,IAAI,iBAAiB,SAAS;AACpC,gBAAM,SAAS,aAAa,UAAU;AACtC,gBAAM,aAAa,MAAM,QAAQ,aAAa,MAAM;AACpD,cAAI,WAAY,QAAO;AACvB,gBAAM,IAAI,uBAAuB,OAAO,MAAM;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,IAAI,IAAI,WAAW,WAAW;AAChC,cAAM,IAAI,mBAAmB,OAAO,SAAS;AAAA,MAC/C;AACA,YAAM,MAAM,gBAAgB;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SACE,UAAU,QACV,UAAU,WACV,UAAU,cACV,UAAU;AAEd;","names":[]}