@cardelli/ambit 0.1.0

package/esm/src/discovery.js

@@ -0,0 +1,79 @@
+// =============================================================================
+// Discovery - Building Blocks for Router State
+// =============================================================================
+//
+// Three independent data sources, composed by callers:
+//
+//   1. listRouterApps / findRouterApp  (Fly REST API — which routers exist)
+//   2. getRouterMachineInfo            (Fly Machines API — is it running?)
+//   3. getRouterTailscaleInfo          (Tailscale API — is it reachable?)
+//
+// Each is a separate API call with a clear purpose.
+// Commands compose them into whatever view they need.
+//
+// =============================================================================
+import "../_dnt.polyfills.js";
+import { extractSubnet } from "./schemas/config.js";
+// =============================================================================
+// Constants
+// =============================================================================
+const ROUTER_APP_PREFIX = "ambit-";
+const DEFAULT_NETWORK = "default";
+// =============================================================================
+// 1. Which routers exist? (Fly REST API)
+// =============================================================================
+/** List all ambit apps on custom networks in an org. */
+export const listRouterApps = async (fly, org) => {
+    const apps = await fly.listAppsWithNetwork(org);
+    return apps
+        .filter((app) => app.name.startsWith(ROUTER_APP_PREFIX) &&
+        app.network !== DEFAULT_NETWORK)
+        .map((app) => ({
+        appName: app.name,
+        network: app.network,
+        org: app.organization?.slug ?? org,
+    }));
+};
+/** Find the router app for a specific network. */
+export const findRouterApp = async (fly, org, network) => {
+    const apps = await listRouterApps(fly, org);
+    return apps.find((a) => a.network === network) ?? null;
+};
+// =============================================================================
+// 2. What's the machine state? (Fly Machines API)
+// =============================================================================
+/** Get machine info for a router app. Returns null if no machines exist. */
+export const getRouterMachineInfo = async (fly, appName) => {
+    const machines = await fly.listMachines(appName);
+    const machine = machines[0];
+    if (!machine)
+        return null;
+    const privateIp = machine.private_ip;
+    const subnet = privateIp ? extractSubnet(privateIp) : undefined;
+    return {
+        region: machine.region,
+        state: machine.state,
+        privateIp,
+        subnet,
+    };
+};
+// =============================================================================
+// 3. What's the tailscale state? (Tailscale API)
+// =============================================================================
+/** Get tailscale device info for a router. Returns null if not found. */
+export const getRouterTailscaleInfo = async (tailscale, appName) => {
+    try {
+        const device = await tailscale.getDeviceByHostname(appName);
+        if (!device)
+            return null;
+        return {
+            ip: device.addresses[0],
+            online: device.online ?? false,
+            hostname: device.hostname,
+            tags: device.tags,
+        };
+    }
+    catch {
+        return null;
+    }
+};

package/esm/src/docker/router/Dockerfile

@@ -0,0 +1,43 @@
+# =============================================================================
+# ambit - Tailscale Subnet Router for Fly.io Custom Networks
+# =============================================================================
+
+FROM alpine:3.23.3
+
+ARG TAILSCALE_VERSION=1.94.1
+ARG COREDNS_VERSION=1.14.1
+ARG MICROSOCKS_VERSION=1.0.5
+
+RUN apk add --no-cache \
+    bash \
+    curl \
+    jq \
+    iptables \
+    ip6tables
+
+RUN curl -fsSL "https://pkgs.tailscale.com/stable/tailscale_${TAILSCALE_VERSION}_amd64.tgz" \
+    | tar -xzf - -C /usr/local/bin --strip-components=1 \
+    tailscale_${TAILSCALE_VERSION}_amd64/tailscale \
+    tailscale_${TAILSCALE_VERSION}_amd64/tailscaled
+
+RUN cd /tmp \
+    && curl -fsSL "https://github.com/coredns/coredns/releases/download/v${COREDNS_VERSION}/coredns_${COREDNS_VERSION}_linux_amd64.tgz" | tar -xzf - \
+    && mv coredns /usr/local/bin/coredns \
+    && chmod +x /usr/local/bin/coredns
+
+RUN apk add --no-cache gcc musl-dev make \
+    && cd /tmp \
+    && wget -q "https://github.com/rofl0r/microsocks/archive/refs/tags/v${MICROSOCKS_VERSION}.tar.gz" \
+    && tar xzf "v${MICROSOCKS_VERSION}.tar.gz" \
+    && cd "microsocks-${MICROSOCKS_VERSION}" \
+    && make \
+    && cp microsocks /usr/local/bin/ \
+    && cd / && rm -rf /tmp/microsocks* /tmp/v${MICROSOCKS_VERSION}.tar.gz \
+    && apk del gcc musl-dev make
+
+RUN mkdir -p /var/lib/tailscale /var/run/tailscale /etc/coredns
+
+COPY start.sh /start.sh
+RUN chmod +x /start.sh
+
+CMD ["/start.sh"]

package/esm/src/docker/router/fly.toml

@@ -0,0 +1,15 @@
+# ambit - Tailscale Subnet Router for Fly.io Custom Networks
+# App name is overridden at deploy time via -a flag
+
+app = "ambit"
+primary_region = "iad"
+
+[build]
+
+[[vm]]
+  size = "shared-cpu-1x"
+  memory = 512
+
+[[mounts]]
+  source = "tailscale_state"
+  destination = "/var/lib/tailscale"

package/esm/src/docker/router/start.sh

@@ -0,0 +1,146 @@
+#!/bin/bash
+set -e
+
+# =============================================================================
+# ambit - Self-Configuring Tailscale Subnet Router
+# =============================================================================
+# State is persisted to /var/lib/tailscale via Fly volume.
+# On first run: creates auth key (with tags), authenticates, approves routes.
+# On restart: reuses existing state, no new device created.
+# =============================================================================
+
+echo "Router: Enabling IP Forwarding"
+echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.conf
+echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.conf
+sysctl -p /etc/sysctl.conf
+
+echo "Router: Starting Tailscaled"
+/usr/local/bin/tailscaled \
+  --state=/var/lib/tailscale/tailscaled.state \
+  --socket=/var/run/tailscale/tailscaled.sock &
+
+# Wait for tailscaled to be ready
+sleep 3
+
+echo "Router: Extracting Fly.io Subnet"
+SUBNET=$(grep fly-local-6pn /etc/hosts | awk '{print $1}' | cut -d: -f1-3)::/48
+echo "Router: Subnet ${SUBNET}"
+
+if /usr/local/bin/tailscale status --json 2>/dev/null | jq -e '.BackendState == "Running"' > /dev/null 2>&1; then
+  echo "Router: Already Authenticated (Using Persisted State)"
+
+  /usr/local/bin/tailscale up \
+    --hostname="${FLY_APP_NAME:-ambit}" \
+    --advertise-routes="${SUBNET}"
+else
+  # First run - need to authenticate
+  if [ -n "${TAILSCALE_API_TOKEN}" ]; then
+    echo "Router: Creating Auth Key (First Run)"
+
+    TAGS_JSON="[]"
+    if [ -n "${TAILSCALE_TAGS}" ]; then
+      TAGS_JSON=$(echo "${TAILSCALE_TAGS}" | jq -R 'split(",")')
+    fi
+
+    AUTH_KEY_RESPONSE=$(curl -s -X POST \
+      -u "${TAILSCALE_API_TOKEN}:" \
+      -H "Content-Type: application/json" \
+      -d "$(jq -n \
+        --argjson tags "${TAGS_JSON}" \
+        '{
+          capabilities: { devices: { create: {
+            reusable: false,
+            ephemeral: false,
+            preauthorized: true,
+            tags: $tags
+          }}},
+          expirySeconds: 300
+        }' | jq 'if .capabilities.devices.create.tags == [] then .capabilities.devices.create |= del(.tags) else . end')" \
+      "https://api.tailscale.com/api/v2/tailnet/-/keys")
+
+    TAILSCALE_AUTHKEY=$(echo "${AUTH_KEY_RESPONSE}" | jq -r '.key')
+
+    if [ -z "${TAILSCALE_AUTHKEY}" ] || [ "${TAILSCALE_AUTHKEY}" = "null" ]; then
+      echo "Router: ERROR - Failed to Create Auth Key"
+      echo "${AUTH_KEY_RESPONSE}"
+      exit 1
+    fi
+
+    echo "Router: Auth Key Created"
+  elif [ -z "${TAILSCALE_AUTHKEY}" ]; then
+    echo "Router: ERROR - No TAILSCALE_API_TOKEN or TAILSCALE_AUTHKEY Provided"
+    exit 1
+  fi
+
+  echo "Router: Authenticating to Tailscale"
+  /usr/local/bin/tailscale up \
+    --authkey="${TAILSCALE_AUTHKEY}" \
+    --hostname="${FLY_APP_NAME:-ambit}" \
+    --advertise-routes="${SUBNET}"
+fi
+
+echo "Router: Getting Node Key"
+NODE_KEY=$(/usr/local/bin/tailscale status --json | jq -r '.Self.PublicKey')
+echo "Router: Node Key ${NODE_KEY}"
+
+# Self-approve routes if we have API access
+# This is a fallback — if the user has autoApprovers configured in their
+# Tailscale policy file, routes are approved automatically and this block
+# is a no-op (routes are already enabled).
+if [ -n "${TAILSCALE_API_TOKEN}" ]; then
+  echo "Router: Finding Device ID"
+
+  DEVICES_RESPONSE=$(curl -s \
+    -u "${TAILSCALE_API_TOKEN}:" \
+    "https://api.tailscale.com/api/v2/tailnet/-/devices")
+
+  DEVICE_ID=$(echo "${DEVICES_RESPONSE}" | jq -r ".devices[] | select(.nodeKey == \"${NODE_KEY}\") | .id")
+
+  if [ -n "${DEVICE_ID}" ] && [ "${DEVICE_ID}" != "null" ]; then
+    echo "Router: Device ID ${DEVICE_ID}"
+    echo "Router: Approving Subnet Routes"
+
+    curl -s -X POST \
+      -u "${TAILSCALE_API_TOKEN}:" \
+      -H "Content-Type: application/json" \
+      -d "{\"routes\": [\"${SUBNET}\"]}" \
+      "https://api.tailscale.com/api/v2/device/${DEVICE_ID}/routes" > /dev/null
+
+    echo "Router: Routes Approved"
+  else
+    echo "Router: WARNING - Could Not Find Device ID"
+    echo "Router: Routes May Need Manual Approval"
+  fi
+fi
+
+echo "Router: Fully Configured"
+
+# Start SOCKS5 proxy for bidirectional tailnet access
+PRIVATE_IP=$(grep fly-local-6pn /etc/hosts | awk '{print $1}')
+echo "Router: Starting SOCKS5 Proxy on [${PRIVATE_IP}]:1080"
+/usr/local/bin/microsocks -i "$PRIVATE_IP" -p 1080 &
+
+echo "Router: Starting DNS Proxy"
+
+# Generate Corefile for CoreDNS
+# Rewrites NETWORK_NAME TLD to .flycast before forwarding to Fly DNS.
+# .flycast resolves to the Flycast address (private_v6) which routes through
+# Fly Proxy — enabling autostart/autostop and load balancing. The Flycast IP
+# is within the network's /48 subnet so it's routable through the tailnet.
+if [ -n "${NETWORK_NAME}" ]; then
+  echo "Router: DNS Rewrite ${NETWORK_NAME} -> flycast"
+  cat > /etc/coredns/Corefile <<EOF
+.:53 {
+    rewrite name suffix .${NETWORK_NAME}. .flycast. answer auto
+    forward . fdaa::3
+}
+EOF
+else
+  cat > /etc/coredns/Corefile <<EOF
+.:53 {
+    forward . fdaa::3
+}
+EOF
+fi
+
+exec /usr/local/bin/coredns -conf /etc/coredns/Corefile

package/esm/src/guard.d.ts

@@ -0,0 +1,33 @@
+import type { FlyProvider } from "./providers/fly.js";
+export interface PreflightResult {
+    scanned: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export interface DeployAuditResult {
+    public_ips_released: number;
+    certs_removed: number;
+    flycast_allocations: Array<{
+        address: string;
+        network: string;
+    }>;
+    warnings: string[];
+}
+/**
+ * Throws if the app name targets an ambit infrastructure app.
+ * Workload apps must not start with the ambit- prefix.
+ */
+export declare function assertNotRouter(app: string): void;
+/**
+ * Pre-flight scan of fly.toml content for patterns that are dangerous
+ * or nonsensical on a Flycast-only deployment.
+ *
+ * Errors are fatal (refuse to deploy). Warnings are informational.
+ */
+export declare function scanFlyToml(tomlContent: string): PreflightResult;
+/**
+ * Post-deploy audit: enumerate IPs, release any public ones, inspect merged
+ * config, and verify Flycast allocation on the target network.
+ */
+export declare function auditDeploy(fly: FlyProvider, app: string, targetNetwork: string): Promise<DeployAuditResult>;
+//# sourceMappingURL=guard.d.ts.map

package/esm/src/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/src/guard.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOjD;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CAwDhE;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAwF5B"}

package/esm/src/guard.js

@@ -0,0 +1,148 @@
+// =============================================================================
+// Safety Guards - Protection Layer for Workload Deploys
+// =============================================================================
+//
+// Ported from ambit-mcp guard.ts, adapted to use CLI's FlyProvider.
+//
+//   - assertNotRouter: prevents operations on ambit-* infrastructure apps
+//   - scanFlyToml: pre-flight TOML scan for dangerous patterns
+//   - auditDeploy: post-deploy check that releases public IPs and reports
+//
+// =============================================================================
+import { parse as parseToml } from "../deps/jsr.io/@std/toml/1.0.11/mod.js";
+// =============================================================================
+// assertNotRouter
+// =============================================================================
+/**
+ * Throws if the app name targets an ambit infrastructure app.
+ * Workload apps must not start with the ambit- prefix.
+ */
+export function assertNotRouter(app) {
+    if (app.startsWith("ambit-")) {
+        throw new Error("Cannot deploy ambit infrastructure apps (ambit-* prefix). " +
+            "Use 'ambit create' to manage routers.");
+    }
+}
+// =============================================================================
+// scanFlyToml
+// =============================================================================
+/**
+ * Pre-flight scan of fly.toml content for patterns that are dangerous
+ * or nonsensical on a Flycast-only deployment.
+ *
+ * Errors are fatal (refuse to deploy). Warnings are informational.
+ */
+export function scanFlyToml(tomlContent) {
+    const result = {
+        scanned: true,
+        errors: [],
+        warnings: [],
+    };
+    let parsed;
+    try {
+        parsed = parseToml(tomlContent);
+    }
+    catch {
+        result.errors.push("Failed to parse fly.toml");
+        return result;
+    }
+    // Check http_service.force_https — nonsensical on Flycast
+    const httpService = parsed.http_service;
+    if (httpService?.force_https) {
+        result.errors.push("http_service.force_https is enabled. " +
+            "This implies public HTTPS which is incompatible with Flycast-only deployment.");
+    }
+    // Check [[services]] for TLS on 443 — dangerous if a public IP were ever added
+    const services = parsed.services;
+    if (Array.isArray(services)) {
+        result.warnings.push("fly.toml uses [[services]] blocks. Consider migrating to [http_service].");
+        for (const svc of services) {
+            const ports = svc.ports;
+            if (!Array.isArray(ports))
+                continue;
+            for (const port of ports) {
+                const handlers = port.handlers;
+                if (port.port === 443 &&
+                    Array.isArray(handlers) &&
+                    handlers.includes("tls")) {
+                    result.errors.push("Service has TLS handler on port 443. " +
+                        "This is designed for public HTTPS and incompatible with Flycast-only deployment.");
+                }
+            }
+        }
+    }
+    return result;
+}
+// =============================================================================
+// auditDeploy
+// =============================================================================
+/**
+ * Post-deploy audit: enumerate IPs, release any public ones, inspect merged
+ * config, and verify Flycast allocation on the target network.
+ */
+export async function auditDeploy(fly, app, targetNetwork) {
+    const result = {
+        public_ips_released: 0,
+        certs_removed: 0,
+        flycast_allocations: [],
+        warnings: [],
+    };
+    // Phase 1: Check and clean IPs — only keep Flycast on the target network
+    const ips = await fly.listIps(app);
+    for (const ip of ips) {
+        const ipNetwork = ip.Network?.Name || "default";
+        if (ip.Type === "private_v6" && ipNetwork === targetNetwork) {
+            // Flycast on the correct network — keep it
+            result.flycast_allocations.push({
+                address: ip.Address,
+                network: ipNetwork,
+            });
+        }
+        else if (ip.Type === "private_v6") {
+            // Flycast on wrong network (e.g. default from --flycast flag) — release
+            await fly.releaseIp(app, ip.Address);
+            result.warnings.push(`Released Flycast IP ${ip.Address} on wrong network '${ipNetwork}' (expected '${targetNetwork}')`);
+        }
+        else {
+            // Public IP — release immediately
+            await fly.releaseIp(app, ip.Address);
+            result.public_ips_released++;
+        }
+    }
+    // Phase 2: Remove auto-generated .fly.dev certs to keep the app fully private
+    const certs = await fly.listCerts(app);
+    for (const hostname of certs) {
+        await fly.removeCert(app, hostname);
+        result.certs_removed++;
+    }
+    // Phase 3: Inspect merged config for dangerous patterns
+    const config = await fly.getConfig(app);
+    if (config) {
+        const services = config.services;
+        if (Array.isArray(services) && services.length > 0) {
+            const hasTlsHandler = services.some((svc) => svc.ports?.some((p) => p.handlers?.includes("tls") && p.port === 443));
+            if (hasTlsHandler) {
+                result.warnings.push("Merged config has TLS handler on port 443. " +
+                    "Safe only because no public IPs are allocated.");
+            }
+        }
+        const httpService = config.http_service;
+        if (httpService?.force_https) {
+            result.warnings.push("http_service.force_https is enabled. Has no effect on Flycast.");
+        }
+    }
+    else {
+        result.warnings.push("Could not inspect merged config.");
+    }
+    // Phase 4: Verify Flycast allocation on target network
+    const hasTargetFlycast = result.flycast_allocations.some((a) => a.network === targetNetwork);
+    if (!hasTargetFlycast) {
+        // Allocate on the target network
+        await fly.allocateFlycastIp(app, targetNetwork);
+        result.flycast_allocations.push({
+            address: "(newly allocated)",
+            network: targetNetwork,
+        });
+    }
+    return result;
+}

package/esm/src/providers/fly.d.ts

@@ -0,0 +1,60 @@
+import "../../_dnt.polyfills.js";
+import { type FlyApp, type FlyAppInfo, type FlyIp, type FlyMachine } from "../schemas/fly.js";
+export type MachineSize = "shared-cpu-1x" | "shared-cpu-2x" | "shared-cpu-4x";
+export interface MachineConfig {
+    size: MachineSize;
+    memoryMb?: number;
+    region?: string;
+    autoStopSeconds?: number;
+}
+export declare const getSizeConfig: (size: MachineSize) => {
+    cpus: number;
+    memoryMb: number;
+};
+export interface MachineResult {
+    id: string;
+    state: string;
+    size: string;
+    region: string;
+    privateIp?: string;
+}
+export interface SafeDeployOptions {
+    image?: string;
+    config?: string;
+    region?: string;
+}
+export interface FlyProvider {
+    ensureInstalled(): Promise<void>;
+    ensureAuth(options?: {
+        interactive?: boolean;
+    }): Promise<string>;
+    listOrgs(): Promise<Record<string, string>>;
+    createApp(name: string, org: string, options?: {
+        network?: string;
+    }): Promise<void>;
+    deleteApp(name: string): Promise<void>;
+    listApps(org?: string): Promise<FlyApp[]>;
+    appExists(name: string): Promise<boolean>;
+    listMachines(app: string): Promise<FlyMachine[]>;
+    listMachinesMapped(app: string): Promise<MachineResult[]>;
+    createMachine(app: string, config: MachineConfig): Promise<MachineResult>;
+    destroyMachine(app: string, machineId: string): Promise<void>;
+    setSecrets(app: string, secrets: Record<string, string>, options?: {
+        stage?: boolean;
+    }): Promise<void>;
+    routerDeploy(app: string, dockerfilePath: string, config?: {
+        region?: string;
+    }): Promise<void>;
+    listIps(app: string): Promise<FlyIp[]>;
+    releaseIp(app: string, address: string): Promise<void>;
+    allocateFlycastIp(app: string, network: string): Promise<void>;
+    getConfig(app: string): Promise<Record<string, unknown> | null>;
+    deploySafe(app: string, options: SafeDeployOptions): Promise<void>;
+    listCerts(app: string): Promise<string[]>;
+    removeCert(app: string, hostname: string): Promise<void>;
+    getFlyToken(): Promise<string>;
+    listAppsWithNetwork(org: string): Promise<FlyAppInfo[]>;
+}
+export declare const createFlyProvider: () => FlyProvider;
+export declare const getRouterAppName: (network: string, randomSuffix: string) => string;
+//# sourceMappingURL=fly.d.ts.map

package/esm/src/providers/fly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../../src/src/providers/fly.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAajC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAMhB,MAAM,mBAAmB,CAAC;AAa3B,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,WAAW;IAC1B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAMD,eAAO,MAAM,iBAAiB,QAAO,WA+bpC,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC"}