@codyswann/lisa 4.71.3 → 4.71.5

package/all/copy-overwrite/scripts/lib/npm-update-classifier-cache.mjs

@@ -0,0 +1,94 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** One invocation reuses authenticated code bytes, never mutable provider authorization. */
+import { required, OBJECT } from "./npm-update-contract.mjs";
+
+/** Fresh owner selection and regular-file reads precede every cached use. */
+function currentBinding(config, owner, read, members) {
+  const selected = owner();
+  return {
+    root: selected.root,
+    source: selected.source,
+    version: selected.metadata.version,
+    signerDigest: config.automationProvenance?.signerDigest,
+    bytes: read(selected.root, members),
+  };
+}
+
+/** A cached import URL cannot authorize changed files or a replacement owner. */
+function assertBinding(expected, actual) {
+  required(
+    ["root", "source", "version", "signerDigest"].every(
+      field => expected[field] === actual[field]
+    ) &&
+      expected.bytes.length === actual.bytes.length &&
+      expected.bytes.every((bytes, index) => bytes.equals(actual.bytes[index])),
+    "authenticated classifier identity or bytes changed"
+  );
+}
+
+/** A sibling awaiting the same import may have invalidated its URL meanwhile. */
+function assertUsable(poisoned, ...roots) {
+  required(
+    roots.every(root => !poisoned.has(root)),
+    "authenticated classifier import lifetime is uncertain"
+  );
+}
+
+/** Each factory owns its inaccessible cache; another caller cannot preseed this instance. */
+export function classifierMemo(owner, read, members) {
+  const entries = new WeakMap();
+  const poisoned = new Set();
+  const fixed = [...members];
+  return async (config, authenticate) => {
+    const current = currentBinding(config, owner, read, fixed);
+    assertUsable(poisoned, current.root);
+    // Without a source pin, the original qualifier must observe current HEAD each time.
+    if (
+      current.source &&
+      (typeof current.signerDigest !== "string" ||
+        !OBJECT.test(current.signerDigest))
+    ) {
+      const imported = await authenticate();
+      const observed = currentBinding(config, owner, read, fixed);
+      assertUsable(poisoned, current.root, imported.root, observed.root);
+      return imported.verdict;
+    }
+    let entry = entries.get(config);
+    if (entry) assertBinding(entry.binding, current);
+    else {
+      entry = {
+        binding: {
+          ...current,
+          bytes: current.bytes.map(bytes => Buffer.from(bytes)),
+        },
+        promise: Promise.resolve().then(authenticate),
+      };
+      entries.set(config, entry);
+      const pending = entry;
+      pending.promise.catch(() => {
+        if (entries.get(config) === pending) entries.delete(config);
+      });
+    }
+    const imported = await entry.promise;
+    let observed;
+    try {
+      // Authentication/import may yield; detect changes during that interval too.
+      observed = currentBinding(config, owner, read, fixed);
+      assertBinding(entry.binding, observed);
+      required(
+        imported.root === entry.binding.root,
+        "classifier import owner changed"
+      );
+      assertUsable(poisoned, entry.binding.root, imported.root, observed.root);
+    } catch (error) {
+      // ESM caches this URL: restoring files or another config cannot requalify it.
+      poisoned.add(entry.binding.root);
+      poisoned.add(imported.root);
+      if (observed) poisoned.add(observed.root);
+      throw error;
+    }
+    return imported.verdict;
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -46,6 +46,7 @@ const PRODUCER = [
   "cancellation",
   "cancellation-proof",
   "checkpoint",
+  "classifier-cache",
   "contract",
   "controller-broker",
   "controller-factory",

package/all/copy-overwrite/scripts/lib/npm-update-helper.mjs

@@ -8,6 +8,7 @@ import { join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, lstatSync, realpathSync } from "node:fs";
 import { required, VERSION, OBJECT } from "./npm-update-contract.mjs";
+import { classifierMemo } from "./npm-update-classifier-cache.mjs";
 import {
   readBytes,
   runProcess,
@@ -33,6 +34,7 @@ import {
 } from "./npm-update-helper-graph.mjs";
 
 const PACKAGE = "@codyswann/lisa";
+const classifier = classifierMemo(helperOwner, helperBytes, MEMBERS);
 
 /** Native package resolution supports both upstream and actual emitted managed layouts. */
 export function helperOwner() {
@@ -277,7 +279,7 @@ export async function qualifiedControllerGraph(cwd, config, entries) {
 }
 
 /** No canonical package code is imported until independent authority qualifies its fixed graph. */
-export async function canonicalClassifier(config) {
+async function authenticatedClassifier(config) {
   const owner = await qualifiedHelperFiles(config, MEMBERS);
   required(
     classifierGraphMatches(MEMBERS.map(member => owner.bytes.get(member))),
@@ -288,5 +290,10 @@ export async function canonicalClassifier(config) {
     typeof module.humanGateVerdict === "function",
     "canonical hold classifier is unavailable"
   );
-  return module.humanGateVerdict;
+  return { root: owner.root, verdict: module.humanGateVerdict };
+}
+
+/** Current bytes must still match the independently authenticated imported closure. */
+export function canonicalClassifier(config) {
+  return classifier(config, () => authenticatedClassifier(config));
 }

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -527,6 +527,94 @@ follow_names=""
 follow_count=0
 follow_bytes=0
 followed_text=""
+followed_rm_text=""
+# Generated from the canonical reviewed supervisor, never from a host manifest.
+# Regenerate through scripts/generate-scratch-supervisor-profile.mjs.
+readonly SCRATCH_SUPERVISOR_SHA256='6fdec1ad0441d7636dc6749c44a23167baf7b75004f156b8a7d4ce1c18c790b7'
+readonly SCRATCH_SUPERVISOR_CLEANUP_COUNT='7'
+
+# An authenticated public supervisor owns its fixed cleanup sites. Its original
+# source remains visible to every other policy; its actual payload is followed.
+follow_supervisor() {
+  local token="$1" depth="$2" statement="$3" path="" profile="" payload="" rm_source="" original=""
+  case "$token" in *lisa-scratch-run.sh) ;; *) return 1 ;; esac
+  follow_locate "$token" || follow_refuse "$token" "supervisor source could not be resolved"
+  path="$follow_located"
+  profile="$(python3 - "$path" "$SCRATCH_SUPERVISOR_SHA256" "$statement" "$token" "$SCRATCH_SUPERVISOR_CLEANUP_COUNT" <<'PY'
+import hashlib
+import json
+import os
+import re
+import shlex
+import stat
+import sys
+
+path, digest, statement, operand, expected_count = sys.argv[1:]
+def refuse():
+    sys.exit(2)
+
+try:
+    info = os.lstat(path)
+    if not stat.S_ISREG(info.st_mode) or info.st_size > 262144:
+        refuse()
+    raw = open(path, 'rb').read(262145)
+    if len(raw) != info.st_size or not re.fullmatch(r'[0-9a-f]{64}', digest):
+        refuse()
+    if hashlib.sha256(raw).hexdigest() != digest:
+        refuse()
+    tokens = shlex.split(statement)
+    indices = [index for index, token in enumerate(tokens) if token == operand]
+    if len(indices) != 1 or '$' in operand or '`' in operand:
+        refuse()
+    index = indices[0]
+    if index < 1 or tokens[index - 1] not in ('sh', 'bash', '/bin/sh', '/bin/bash'):
+        refuse()
+    prefix = tokens[:index - 1]
+    if prefix[:1] == ['env']:
+        prefix = prefix[1:]
+    assignments = {}
+    for token in prefix:
+        if '=' not in token or re.search(r'[$`\r\n]', token):
+            refuse()
+        key, value = token.split('=', 1)
+        if key not in ('LISA_SCRATCH_BASE', 'LISA_SCRATCH_TRACE', 'TMPDIR') or key in assignments:
+            refuse()
+        assignments[key] = value
+    # Match actual shell :- precedence, including inherited and
+    # explicitly empty values. TMPDIR cannot override a nonempty inherited base.
+    effective = dict(os.environ, **assignments)
+    base = effective.get('LISA_SCRATCH_BASE') or effective.get('TMPDIR') or '/tmp'
+    if not base or not os.path.isabs(base) or re.search(r'[$`\r\n]', base):
+        refuse()
+    real_base = os.path.realpath(base)
+    roots = ['/tmp', '/var/tmp', os.environ.get('TMPDIR', '/tmp')]
+    if not any(os.path.commonpath([real_base, os.path.realpath(root)]) == os.path.realpath(root) for root in roots if root and os.path.isabs(root)):
+        refuse()
+    args = tokens[index + 1:]
+    if len(args) < 4 or args[0] != '--suite' or args[2] != '--':
+        refuse()
+    if not re.fullmatch(r'[A-Za-z0-9._-]{1,64}', args[1]):
+        refuse()
+    payload = args[3:]
+    if not payload[0] or payload[0].startswith('-') or any(re.search(r'[$`\x00\r\n]', value) for value in payload):
+        refuse()
+    source = raw.decode('utf8')
+    cleaned, count = re.subn(r'(?m)^(\s*)rm -rf "(\$_quarantine|\$_root|\$_entry|\$LISA_SCRATCH_ROOT)"', r'\1:', source)
+    if not re.fullmatch(r'[1-9][0-9]*', expected_count) or count != int(expected_count):
+        refuse()
+    print(json.dumps({'source': cleaned, 'original': source, 'payload': shlex.join(payload)}))
+except (OSError, UnicodeError, ValueError):
+    refuse()
+PY
+)" || follow_refuse "$path" "supervisor source or public entry authority could not be authenticated"
+  rm_source="$(printf '%s' "$profile" | jq -er '.source')" || follow_refuse "$path" "invalid supervisor profile"
+  original="$(printf '%s' "$profile" | jq -er '.original')" || follow_refuse "$path" "invalid supervisor source"
+  payload="$(printf '%s' "$profile" | jq -er '.payload')" || follow_refuse "$path" "invalid supervisor payload"
+  follow_take "$path" "$depth" "$rm_source" "$original"
+  [ "$depth" -lt "$FOLLOW_MAX_DEPTH" ] || follow_refuse "$path" "supervisor payload exceeds inspection depth"
+  follow_scan "$payload" "$((depth + 1))"
+  return 0
+}
 
 FOLLOW_GUIDANCE="This command EXECUTES a file. These guards classify shell text, so the script an
 invocation runs is read and scanned as part of the command — a destructive line
@@ -813,7 +901,7 @@ follow_locate() {
 # executes, to a bounded depth. Full-line comments are dropped: a commented line
 # is never executed, so scanning it can only manufacture a false refusal.
 follow_take() {
-  local path="$1" depth="$2" size="" content=""
+  local path="$1" depth="$2" size="" content="" rm_content="${3-}"
   case "$follow_paths" in
     *$'\n'"$path"$'\n'*) return 0 ;;
   esac
@@ -833,10 +921,22 @@ follow_take() {
   if [ "$follow_bytes" -gt "$FOLLOW_MAX_TOTAL_BYTES" ]; then
     follow_refuse "$path" "the files this command executes total more than the ${FOLLOW_MAX_TOTAL_BYTES}-byte inspection budget"
   fi
-  content="$(LC_ALL=C tr -d '\000' <"$path" | sed 's/^[[:space:]]*#.*$//')" \
-    || follow_refuse "$path" "it could not be read"
+  if [ "$#" -eq 4 ]; then
+    # Scan the same complete bytes whose digest was authenticated, not a
+    # second file read that could pair changed source with the cleanup view.
+    content="$(printf '%s' "$4" | sed 's/^[[:space:]]*#.*$//')" || follow_refuse "$path" "authenticated source could not be read"
+  else
+    content="$(LC_ALL=C tr -d '\000' <"$path" | sed 's/^[[:space:]]*#.*$//')" \
+      || follow_refuse "$path" "it could not be read"
+  fi
   follow_names="$follow_names $path"
   followed_text="$followed_text"$'\n'"$content"
+  if [ "$#" -lt 3 ]; then
+    rm_content="$content"
+  else
+    rm_content="$(printf '%s' "$rm_content" | sed 's/^[[:space:]]*#.*$//')" || follow_refuse "$path" "supervisor cleanup view could not be read"
+  fi
+  followed_rm_text="$followed_rm_text"$'\n'"$rm_content"
   if [ "$depth" -lt "$FOLLOW_MAX_DEPTH" ]; then
     # A `cd` inside the followed script governs what THAT script goes on to
     # execute, and nothing after it in the command that ran the script — the
@@ -855,6 +955,11 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
+  # Entry authority belongs to each invocation, not the file-read cache. Only
+  # follow_supervisor may admit the exact public interpreter/argv profile.
+  case "$token" in
+    *lisa-scratch-run.sh) follow_refuse "$token" "supervisor requires its authenticated public interpreter entry" ;;
+  esac
   if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
@@ -888,6 +993,9 @@ follow_direct() {
     return 0
   fi
   path="$follow_located"
+  case "$path" in
+    *lisa-scratch-run.sh) follow_refuse "$path" "supervisor requires its authenticated public interpreter entry" ;;
+  esac
   IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
   while [ "$k" -lt "${#raw}" ]; do
     char="${raw:k:1}"
@@ -1219,7 +1327,9 @@ follow_scan() {
         fi
         follow_unwrap "${toks[j]}"
         tj="$follow_unwrapped"
-        follow_target "$tj" "$depth"
+        if ! follow_supervisor "$tj" "$depth" "$stmt"; then
+          follow_target "$tj" "$depth"
+        fi
         cmd_pos=0
         i=$((j + 1))
         continue
@@ -1248,6 +1358,7 @@ follow_scan() {
 }
 
 follow_scan "$command_for_guards" 0
+rm_command_for_guards="$command_for_guards"$'\n'"$followed_rm_text"
 if [ -n "$follow_names" ]; then
   command_for_guards="$command_for_guards"$'\n'"$followed_text"
   # A refusal must say WHERE the match is. Without this the operator reads
@@ -1266,6 +1377,8 @@ fi
 # `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
+rm_normalized_command_str="$(printf '%s' "$rm_command_for_guards" \
+  | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
 # matches / matches_cs run an ERE against the guarded command text. matches is
 # case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
@@ -1570,7 +1683,7 @@ rm_assignment_value() {
   # small lexer below preserves quoted right-hand sides such as V="/tmp/x"
   # while excluding an argument such as echo "V=/tmp/x". Any ambiguity fails
   # closed.
-  RM_ASSIGNMENT_NAME="$name" RM_ASSIGNMENT_COMMAND="$normalized_command_str" \
+  RM_ASSIGNMENT_NAME="$name" RM_ASSIGNMENT_COMMAND="$rm_normalized_command_str" \
     RM_ASSIGNMENT_STATEMENT="$rm_assignment_stmt" \
     python3 - <<'PY'
 import os
@@ -1769,7 +1882,7 @@ classify_rm_target() {
 # process substitution cannot deny anything either — it ends that subshell, not
 # this hook.
 rm_segments_status=0
-rm_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+rm_segments="$(printf '%s' "$rm_normalized_command_str" | tr '&|;' '\n' \
   | grep -Ei -- "$RM_CMD"'([[:space:]]|$)')" || rm_segments_status=$?
 case "$rm_segments_status" in
   0 | 1) ;;
@@ -2281,9 +2394,10 @@ git_segments="$(printf '%s' "$normalized_command_str" \
     -e 's/[0-9]*>&[0-9-]*/>/g' \
     -e 's/[0-9]*<&[0-9-]*/</g' \
     -e 's/||/;/g' \
-  | tr '&;' '\n')" || git_segments_status=$?
+  | tr '&;' '\n' \
+  | grep -E -- "$RM_RF_CLUSTER|$RM_RF_SPLIT")" || git_segments_status=$?
 case "$git_segments_status" in
-  0) ;;
+  0 | 1) ;;
   *) scan_failed "$git_segments_status" ;;
 esac
 while IFS= read -r git_stmt; do

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -280,6 +280,14 @@
       "dynamicImports": [],
       "children": []
     },
+    "lib/npm-update-classifier-cache.mjs": {
+      "sha256": "92272e40617ca9d620ff47e3ffe07a0e5bc1a3949d139752aa2675398ab49f9b",
+      "staticImports": [
+        "lib/npm-update-contract.mjs"
+      ],
+      "dynamicImports": [],
+      "children": []
+    },
     "lib/npm-update-contract.mjs": {
       "sha256": "6905dd9d5747702ab502b66bcb38b6d4dcb30127f02466d29b3905f53c27981d",
       "staticImports": [
@@ -472,14 +480,15 @@
       "children": []
     },
     "lib/npm-update-helper-inventory.mjs": {
-      "sha256": "33ab2fcba24552a378a75314fe021b25ae6862a6e3c7c4f6b83250f9749264bb",
+      "sha256": "3561c20458d74eff34650d6b4366f4f03ed4e7825ae886ea78394f63f98a18bb",
       "staticImports": [],
       "dynamicImports": [],
       "children": []
     },
     "lib/npm-update-helper.mjs": {
-      "sha256": "f4012383184237aa0a7ca21847864fdcc2241f94fd3d2cd6d82a6345763e5824",
+      "sha256": "41e5a37769ec3737829ed1948d0a1442792b25d120f0fb4f4b5e424a50f34705",
       "staticImports": [
+        "lib/npm-update-classifier-cache.mjs",
         "lib/npm-update-contract.mjs",
         "lib/npm-update-helper-graph.mjs",
         "lib/npm-update-helper-inventory.mjs",
@@ -1076,7 +1085,7 @@
       ]
     },
     "lisa-scratch-run.sh": {
-      "sha256": "ef3c38f8d1d2f48ba265e21f841310d25142228dac57b0a5742c7d902113ca9a",
+      "sha256": "6fdec1ad0441d7636dc6749c44a23167baf7b75004f156b8a7d4ce1c18c790b7",
       "staticImports": [],
       "dynamicImports": [],
       "children": []

package/dist/cli/hook-refresh-files.d.ts

@@ -0,0 +1,86 @@
+/** Confine refresh IO and rollback to held native file identities. */
+import { type BigIntStats } from "node:fs";
+import { type FileHandle } from "node:fs/promises";
+/** Retained object; pathname replacement never supplies write authority. */
+export interface Pin {
+    readonly filename: string;
+    readonly handle: FileHandle;
+    readonly identity: BigIntStats;
+}
+/**
+ * Require the pathname still selects its retained object.
+ * @param pin - Original native object.
+ */
+export declare function checkPath(pin: Pin): Promise<void>;
+/**
+ * Read a bounded regular descriptor, detecting growth or torn observations.
+ * @param pin - Retained file.
+ * @returns Complete bytes.
+ */
+export declare function bytes(pin: Pin): Promise<Buffer>;
+/** Bounded original bytes and acknowledged writes on one retained destination. */
+export declare class HookPair {
+    readonly source: Pin;
+    readonly host: Pin;
+    readonly sourceBytes: Buffer;
+    readonly hostBytes: Buffer;
+    private expected;
+    private expectedMode;
+    /**
+     * Keep source and destination authority for one operation.
+     * @param source - Read-only package descriptor.
+     * @param host - Original writable host descriptor.
+     * @param sourceBytes - Authenticated release bytes.
+     * @param hostBytes - Bounded original backup.
+     */
+    constructor(source: Pin, host: Pin, sourceBytes: Buffer, hostBytes: Buffer);
+    /**
+     * Write only the held inode; verify each acknowledged write before truncation.
+     * @param content - Complete replacement or backup bytes.
+     */
+    write(content: Buffer): Promise<void>;
+    /** Reject shared inodes or concurrent bytes before any further mutation. */
+    private assertOwnWrites;
+    /**
+     * Change permissions only on the retained inode containing our writes.
+     * @param mode - Original authenticated source or backup permissions.
+     */
+    chmod(mode: number): Promise<void>;
+    /** Restore only this original inode while it contains our acknowledged writes. */
+    restore(): Promise<void>;
+}
+/** Operation-local native resources and error accumulation, always finally-closed. */
+export declare class HookFiles {
+    private readonly pins;
+    private readonly changed;
+    private readonly failures;
+    /**
+     * Retain a no-follow object before subsequent validation can fail.
+     * @param filename - Confined absolute path.
+     * @param flags - Native access flags.
+     * @returns Original object.
+     */
+    retain(filename: string, flags: number): Promise<Pin>;
+    /**
+     * Hold every closed directory component including the resolved root.
+     * @param root - Canonical package or host root.
+     * @param relative - Closed directory suffix.
+     * @returns Pinned ancestors.
+     */
+    directories(root: string, relative: string): Promise<Pin[]>;
+    /**
+     * Register a backup immediately before the first possible write.
+     * @param pair - Original descriptor and bytes.
+     */
+    mark(pair: HookPair): void;
+    /**
+     * Preserve the original failure and attempt every descriptor-bound rollback.
+     * @param original - Original refresh failure.
+     */
+    rollback(original: unknown): Promise<void>;
+    /** Close every retained handle even after preflight, write or rollback errors. */
+    close(): Promise<void>;
+    /** Surface all native failures, preserving the original error object first. */
+    assertSuccess(): void;
+}
+//# sourceMappingURL=hook-refresh-files.d.ts.map

package/dist/cli/hook-refresh-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-refresh-files.d.ts","sourceRoot":"","sources":["../../src/cli/hook-refresh-files.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKhE,4EAA4E;AAC5E,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAChC;AAYD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvD;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BrD;AAED,kFAAkF;AAClF,qBAAa,QAAQ;IAYjB,QAAQ,CAAC,MAAM,EAAE,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAd5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAS;IAE7B;;;;;;OAMG;gBAEQ,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,GAAG,EACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM;IAM5B;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B3C,4EAA4E;YAC9D,eAAe;IAY7B;;;OAGG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,kFAAkF;IAC5E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAO/B;AAED,sFAAsF;AACtF,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAE1C;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAe3D;;;;;OAKG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAqBjE;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI;IAI1B;;;OAGG;IACG,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD,kFAAkF;IAC5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B,+EAA+E;IAC/E,aAAa,IAAI,IAAI;CAQtB"}