@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/dist/src/ga/proxy-guard.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Loopback proxy guard for the OpenCode 2 (GA 2.0.22) bridge.
+ *
+ * The GA adapter rewrites native Google model requests to a plugin-owned
+ * bridge at `http://127.0.0.1:<port>`. The host sends that rewritten request
+ * with its own `fetch`, which reads proxy settings from the environment. If
+ * the host would send the bridge request to a proxy, the request either fails
+ * or leaks the bridge traffic to a third party, so the adapter must refuse the
+ * request before rewriting it and tell the user how to exclude loopback.
+ *
+ * This module is a pure decision over an environment snapshot. It never reads
+ * or writes `process.env` by itself, never opens a socket, and never falls back
+ * to Google's public endpoint: the caller passes the environment and the bridge
+ * URL, and either rewrites (decision `ok: true`) or stops the request with the
+ * returned error (decision `ok: false`).
+ *
+ * The rules mirror what the pinned host does for a plain-HTTP URL, as measured
+ * on the GA 2.0.22 binary (Bun 1.4.2, revision 744846f8) and read from that Bun
+ * revision's `ProxySettings::from_env` / `no_proxy_matches`:
+ *
+ * - Proxy selection: `http_proxy` when its raw value is non-empty, otherwise
+ *   `HTTP_PROXY`. The selection happens on the raw value; only afterwards is a
+ *   selected value of exactly `""` or `''` (two quote characters) treated as
+ *   "no proxy". So a lowercase `http_proxy=""` suppresses `HTTP_PROXY`, while a
+ *   genuinely empty `http_proxy=` falls through to `HTTP_PROXY`.
+ * - `HTTPS_PROXY`, `https_proxy`, `ALL_PROXY` and `all_proxy` do not apply to
+ *   an `http:` URL and are ignored.
+ * - Exclusion selection: `no_proxy` when its raw value is non-empty, otherwise
+ *   `NO_PROXY`, with the same raw-before-quote-stripping rule. The two lists
+ *   are never merged.
+ * - The selected list is split on commas only; each entry is trimmed.
+ * - Only these exact spellings are read (`env.get(b"http_proxy")` and so on in
+ *   the pinned source). A key with any other capitalisation, such as
+ *   `Http_Proxy`, is ignored like any other unrelated variable.
+ *
+ * The guard is deliberately narrower than the host: it only treats an entry as
+ * excluding the bridge when it is one of the loopback forms measured as direct
+ * (`*`, `127.0.0.1`, `127.0.0.1:<bridge port>`). Anything else fails closed.
+ * The measured rows are test evidence, not a shipped allowlist of
+ * configurations.
+ */
+/** The exclusion the README documents and every guard error names. */
+export declare const DOCUMENTED_LOOPBACK_EXCLUSION: "NO_PROXY=127.0.0.1";
+/** An environment snapshot; `undefined` means the variable is unset. */
+export type LoopbackProxyEnv = Readonly<Record<string, string | undefined>>;
+export type ProxyVariableName = 'http_proxy' | 'HTTP_PROXY';
+export type ExclusionVariableName = 'no_proxy' | 'NO_PROXY';
+/**
+ * Why a configuration was refused. The letters follow the guard contract:
+ * (a) a proxy applies and no entry excludes the bridge;
+ * (c) the proxy that applies is not an absolute http(s) URL;
+ * (d) the exclusion list names loopback, but only in a form the host does not
+ *     treat as direct (or that was never measured as direct).
+ * The contract's trigger (b), a conflict without recorded precedence, has no
+ * case here. The host reads only the exact lowercase and uppercase names, and
+ * every conflict between those has a measured winner: lowercase when its raw
+ * value is non-empty.
+ */
+export type LoopbackProxyGuardTrigger = 'a-no-loopback-exclusion' | 'c-proxy-not-url' | 'd-loopback-entry-not-direct';
+/** The loopback exclusion form that let the bridge request go direct. */
+export type LoopbackDirectForm = 'wildcard' | 'loopback-host' | 'loopback-host-port';
+export type LoopbackProxyAllowed = {
+    readonly ok: true;
+    readonly route: 'direct';
+    /** No proxy applies to an `http:` URL. */
+    readonly basis: 'no-proxy-selected';
+    /**
+     * The proxy variable the host selected when its value was the quoted
+     * empty string (`""` or `''`), or `null` when neither variable was set.
+     */
+    readonly proxyVariable: ProxyVariableName | null;
+} | {
+    readonly ok: true;
+    readonly route: 'direct';
+    /** A proxy applies, but the selected exclusion list covers the bridge. */
+    readonly basis: 'excluded';
+    readonly proxyVariable: ProxyVariableName;
+    readonly exclusionVariable: ExclusionVariableName;
+    readonly directForm: LoopbackDirectForm;
+};
+export type LoopbackProxyRefused = {
+    readonly ok: false;
+    readonly trigger: LoopbackProxyGuardTrigger;
+    /** The proxy variable involved, when one was selected. Never its value. */
+    readonly proxyVariable: ProxyVariableName | null;
+    /** The exclusion variable the host would consult, when one was selected. */
+    readonly exclusionVariable: ExclusionVariableName | null;
+    /** User-facing text. Contains no environment values. */
+    readonly message: string;
+};
+export type LoopbackProxyDecision = LoopbackProxyAllowed | LoopbackProxyRefused;
+export type LoopbackProxyGuardInput = {
+    /** Environment snapshot the host's `fetch` will read. Never modified. */
+    readonly env: LoopbackProxyEnv;
+    /** The rewritten bridge URL; must be `http://127.0.0.1:<port>...`. */
+    readonly target: string | URL;
+};
+/** Thrown by {@link assertLoopbackProxyGuard} when the decision is a refusal. */
+export declare class LoopbackProxyGuardError extends Error {
+    readonly name = "LoopbackProxyGuardError";
+    readonly trigger: LoopbackProxyGuardTrigger;
+    readonly documentedLoopbackExclusion: "NO_PROXY=127.0.0.1";
+    readonly decision: LoopbackProxyRefused;
+    constructor(decision: LoopbackProxyRefused);
+}
+/**
+ * Allow the bridge request when no HTTP proxy applies, or the selected
+ * exclusion list contains `*`, `127.0.0.1`, or that host with the bridge port.
+ * Reject suffix spellings even when OpenCode accepts them, so the exclusion
+ * stays explicit. No I/O or writes occur. Invalid bridge targets throw
+ * `TypeError`.
+ */
+export declare function evaluateLoopbackProxyGuard(input: LoopbackProxyGuardInput): LoopbackProxyDecision;
+/**
+ * Assertion form for host-hook wiring: returns the allowed decision, or throws
+ * {@link LoopbackProxyGuardError} so the hook can stop the request before any
+ * rewrite.
+ */
+export declare function assertLoopbackProxyGuard(input: LoopbackProxyGuardInput): LoopbackProxyAllowed;
+//# sourceMappingURL=proxy-guard.d.ts.map

package/dist/src/ga/proxy-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-guard.d.ts","sourceRoot":"","sources":["../../../src/ga/proxy-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,EAAG,oBAA6B,CAAA;AAK1E,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAE3E,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,YAAY,CAAA;AAC3D,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,yBAAyB,GACjC,yBAAyB,GACzB,iBAAiB,GACjB,6BAA6B,CAAA;AAEjC,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,eAAe,GACf,oBAAoB,CAAA;AAExB,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACjD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAA;IACzC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAA;IACjD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;CACxC,CAAA;AAEL,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,GAAG,IAAI,CAAA;IACxD,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG,oBAAoB,CAAA;AAE/E,MAAM,MAAM,uBAAuB,GAAG;IACpC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAA;CAC9B,CAAA;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAkB,IAAI,6BAA4B;IAClD,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,2BAA2B,uBAAgC;IACpE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;gBAE3B,QAAQ,EAAE,oBAAoB;CAK3C;AAuKD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,uBAAuB,GAC7B,qBAAqB,CAyDvB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,oBAAoB,CAItB"}

package/dist/src/ga/proxy-guard.js

@@ -0,0 +1,269 @@
+/**
+ * Loopback proxy guard for the OpenCode 2 (GA 2.0.22) bridge.
+ *
+ * The GA adapter rewrites native Google model requests to a plugin-owned
+ * bridge at `http://127.0.0.1:<port>`. The host sends that rewritten request
+ * with its own `fetch`, which reads proxy settings from the environment. If
+ * the host would send the bridge request to a proxy, the request either fails
+ * or leaks the bridge traffic to a third party, so the adapter must refuse the
+ * request before rewriting it and tell the user how to exclude loopback.
+ *
+ * This module is a pure decision over an environment snapshot. It never reads
+ * or writes `process.env` by itself, never opens a socket, and never falls back
+ * to Google's public endpoint: the caller passes the environment and the bridge
+ * URL, and either rewrites (decision `ok: true`) or stops the request with the
+ * returned error (decision `ok: false`).
+ *
+ * The rules mirror what the pinned host does for a plain-HTTP URL, as measured
+ * on the GA 2.0.22 binary (Bun 1.4.2, revision 744846f8) and read from that Bun
+ * revision's `ProxySettings::from_env` / `no_proxy_matches`:
+ *
+ * - Proxy selection: `http_proxy` when its raw value is non-empty, otherwise
+ *   `HTTP_PROXY`. The selection happens on the raw value; only afterwards is a
+ *   selected value of exactly `""` or `''` (two quote characters) treated as
+ *   "no proxy". So a lowercase `http_proxy=""` suppresses `HTTP_PROXY`, while a
+ *   genuinely empty `http_proxy=` falls through to `HTTP_PROXY`.
+ * - `HTTPS_PROXY`, `https_proxy`, `ALL_PROXY` and `all_proxy` do not apply to
+ *   an `http:` URL and are ignored.
+ * - Exclusion selection: `no_proxy` when its raw value is non-empty, otherwise
+ *   `NO_PROXY`, with the same raw-before-quote-stripping rule. The two lists
+ *   are never merged.
+ * - The selected list is split on commas only; each entry is trimmed.
+ * - Only these exact spellings are read (`env.get(b"http_proxy")` and so on in
+ *   the pinned source). A key with any other capitalisation, such as
+ *   `Http_Proxy`, is ignored like any other unrelated variable.
+ *
+ * The guard is deliberately narrower than the host: it only treats an entry as
+ * excluding the bridge when it is one of the loopback forms measured as direct
+ * (`*`, `127.0.0.1`, `127.0.0.1:<bridge port>`). Anything else fails closed.
+ * The measured rows are test evidence, not a shipped allowlist of
+ * configurations.
+ */
+/** The exclusion the README documents and every guard error names. */
+export const DOCUMENTED_LOOPBACK_EXCLUSION = 'NO_PROXY=127.0.0.1';
+/** Only the hostname the bridge listens on; the guard covers nothing else. */
+const BRIDGE_HOSTNAME = '127.0.0.1';
+/** Thrown by {@link assertLoopbackProxyGuard} when the decision is a refusal. */
+export class LoopbackProxyGuardError extends Error {
+    name = 'LoopbackProxyGuardError';
+    trigger;
+    documentedLoopbackExclusion = DOCUMENTED_LOOPBACK_EXCLUSION;
+    decision;
+    constructor(decision) {
+        super(decision.message);
+        this.trigger = decision.trigger;
+        this.decision = decision;
+    }
+}
+/**
+ * OpenCode sends the rewritten bridge request, so the guard must match its
+ * pinned Linux/Bun variable selection. A non-empty raw lowercase value wins
+ * before quoted-empty handling; reversing that order can select an uppercase
+ * proxy that OpenCode would ignore, or trust an exclusion it would ignore.
+ */
+function selectLowerThenUpper(env, lower, upper) {
+    const lowerRaw = env[lower];
+    if (lowerRaw !== undefined && lowerRaw !== '')
+        return { name: lower, raw: lowerRaw };
+    const upperRaw = env[upper];
+    if (upperRaw !== undefined)
+        return { name: upper, raw: upperRaw };
+    return null;
+}
+/** Empty, or exactly two double quotes, or exactly two single quotes. */
+function isEmptyish(raw) {
+    return raw === '' || raw === '""' || raw === "''";
+}
+/**
+ * Accept only absolute HTTP(S) proxy URLs with a host and no surrounding
+ * whitespace. Reject other forms rather than guess how to interpret them.
+ */
+function isSupportedProxyUrl(raw) {
+    if (raw.trim() !== raw)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return false;
+    return parsed.hostname !== '';
+}
+/**
+ * The guard trims ASCII spaces around exclusion entries. It rejects entries
+ * padded with other whitespace, even if a host implementation accepts them.
+ */
+function trimEntry(entry) {
+    let start = 0;
+    let end = entry.length;
+    while (start < end && entry.charCodeAt(start) === 0x20)
+        start++;
+    while (end > start && entry.charCodeAt(end - 1) === 0x20)
+        end--;
+    return entry.slice(start, end);
+}
+/**
+ * The guard's direct forms: `*`, `127.0.0.1` and `127.0.0.1:<bridge port>`,
+ * each measured as sending the bridge request direct.
+ *
+ * Conservative policy: the host also matches label suffixes after stripping
+ * one leading dot, and the measurements show `0.0.1` and `.0.0.1` going direct
+ * too. The guard still refuses those spellings, and every other suffix form,
+ * on purpose. General suffix matching would accept unmeasured spellings such
+ * as `1` or `.127.0.0.1`. Refusing them only costs an error that asks for
+ * NO_PROXY=127.0.0.1. It never changes where the host routes a request.
+ */
+function directFormOf(entry, bridgePort) {
+    if (entry === '*')
+        return 'wildcard';
+    if (entry === BRIDGE_HOSTNAME)
+        return 'loopback-host';
+    if (entry === `${BRIDGE_HOSTNAME}:${bridgePort}`)
+        return 'loopback-host-port';
+    return null;
+}
+/**
+ * Whether an entry looks like an attempt to exclude loopback. Used only to
+ * pick between triggers (a) and (d) for the error text; both refuse.
+ */
+function looksLikeLoopback(entry) {
+    const folded = entry.toLowerCase();
+    if (folded.includes('localhost'))
+        return true;
+    if (folded.includes('::1'))
+        return true;
+    if (folded.includes('127.'))
+        return true;
+    if (folded.startsWith('['))
+        return true;
+    // Label suffixes of 127.0.0.1 ("1", "0.1", "0.0.1", optionally dotted).
+    const undotted = folded.startsWith('.') ? folded.slice(1) : folded;
+    return undotted !== '' && `.${BRIDGE_HOSTNAME}`.endsWith(`.${undotted}`);
+}
+function exclusionAdvice(exclusionVariable) {
+    if (exclusionVariable === 'no_proxy') {
+        return (`Set ${DOCUMENTED_LOOPBACK_EXCLUSION}. Because no_proxy is set and takes precedence ` +
+            'over NO_PROXY, also add 127.0.0.1 as its own comma-separated entry in no_proxy ' +
+            '(or unset no_proxy), then restart OpenCode.');
+    }
+    return (`Set ${DOCUMENTED_LOOPBACK_EXCLUSION} (or add 127.0.0.1 as its own comma-separated ` +
+        'entry to an existing NO_PROXY list), then restart OpenCode.');
+}
+function refuse(trigger, proxyVariable, exclusionVariable) {
+    const lead = 'Antigravity stopped this request before sending it: the OpenCode host would route the ' +
+        "plugin's local bridge request (http://127.0.0.1) through an HTTP proxy, or the proxy " +
+        'settings cannot be checked safely.';
+    let detail;
+    switch (trigger) {
+        case 'a-no-loopback-exclusion':
+            detail = `${proxyVariable} is set and no proxy exclusion covers 127.0.0.1.`;
+            break;
+        case 'd-loopback-entry-not-direct':
+            detail =
+                `${proxyVariable} is set, but ${exclusionVariable} has no explicit loopback exclusion ` +
+                    'accepted by the guard. Use 127.0.0.1, optionally with the exact bridge port, or *.';
+            break;
+        case 'c-proxy-not-url':
+            detail =
+                `${proxyVariable} is not an absolute http:// or https:// URL; fix or unset it. ` +
+                    'Loopback must also stay excluded from the proxy.';
+            break;
+    }
+    return {
+        ok: false,
+        trigger,
+        proxyVariable,
+        exclusionVariable,
+        message: `${lead} ${detail} ${exclusionAdvice(exclusionVariable)}`,
+    };
+}
+const BRIDGE_TARGET_PATTERN = /^http:\/\/127\.0\.0\.1:([1-9][0-9]{0,4})(?:[/?#]|$)/;
+/**
+ * Validate the bridge URL and return its port as written. A target that is
+ * not `http://127.0.0.1:<port>` is a caller bug, not a user configuration
+ * problem, so it throws instead of returning a refusal. The port must survive
+ * URL normalisation: `:80` is the http default and disappears from the host
+ * the request is sent with, so a `127.0.0.1:80` exclusion would not match it.
+ */
+function bridgePortOf(target) {
+    const href = typeof target === 'string' ? target : target.href;
+    const port = BRIDGE_TARGET_PATTERN.exec(href)?.[1];
+    if (port !== undefined && Number(port) <= 65535) {
+        const parsed = new URL(href);
+        if (parsed.hostname === BRIDGE_HOSTNAME && parsed.port === port)
+            return port;
+    }
+    throw new TypeError('loopback proxy guard only evaluates http://127.0.0.1:<port> bridge URLs');
+}
+/**
+ * Allow the bridge request when no HTTP proxy applies, or the selected
+ * exclusion list contains `*`, `127.0.0.1`, or that host with the bridge port.
+ * Reject suffix spellings even when OpenCode accepts them, so the exclusion
+ * stays explicit. No I/O or writes occur. Invalid bridge targets throw
+ * `TypeError`.
+ */
+export function evaluateLoopbackProxyGuard(input) {
+    const bridgePort = bridgePortOf(input.target);
+    const env = input.env;
+    const proxy = selectLowerThenUpper(env, 'http_proxy', 'HTTP_PROXY');
+    if (proxy === null)
+        return {
+            ok: true,
+            route: 'direct',
+            basis: 'no-proxy-selected',
+            proxyVariable: null,
+        };
+    if (isEmptyish(proxy.raw)) {
+        return {
+            ok: true,
+            route: 'direct',
+            basis: 'no-proxy-selected',
+            proxyVariable: proxy.name,
+        };
+    }
+    // The variable the host consults, even when its value turns out to be empty:
+    // a quoted-empty no_proxy still shadows NO_PROXY, and the advice must say so.
+    const exclusion = selectLowerThenUpper(env, 'no_proxy', 'NO_PROXY');
+    const exclusionVariable = exclusion?.name ?? null;
+    if (!isSupportedProxyUrl(proxy.raw)) {
+        return refuse('c-proxy-not-url', proxy.name, exclusionVariable);
+    }
+    if (exclusion === null || isEmptyish(exclusion.raw)) {
+        return refuse('a-no-loopback-exclusion', proxy.name, exclusionVariable);
+    }
+    let loopbackAttempt = false;
+    for (const item of exclusion.raw.split(',')) {
+        const entry = trimEntry(item);
+        if (entry === '')
+            continue;
+        const form = directFormOf(entry, bridgePort);
+        if (form !== null) {
+            return {
+                ok: true,
+                route: 'direct',
+                basis: 'excluded',
+                proxyVariable: proxy.name,
+                exclusionVariable: exclusion.name,
+                directForm: form,
+            };
+        }
+        if (looksLikeLoopback(entry))
+            loopbackAttempt = true;
+    }
+    return refuse(loopbackAttempt ? 'd-loopback-entry-not-direct' : 'a-no-loopback-exclusion', proxy.name, exclusionVariable);
+}
+/**
+ * Assertion form for host-hook wiring: returns the allowed decision, or throws
+ * {@link LoopbackProxyGuardError} so the hook can stop the request before any
+ * rewrite.
+ */
+export function assertLoopbackProxyGuard(input) {
+    const decision = evaluateLoopbackProxyGuard(input);
+    if (!decision.ok)
+        throw new LoopbackProxyGuardError(decision);
+    return decision;
+}
+//# sourceMappingURL=proxy-guard.js.map

package/dist/src/ga/proxy-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-guard.js","sourceRoot":"","sources":["../../../src/ga/proxy-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAA6B,CAAA;AAE1E,8EAA8E;AAC9E,MAAM,eAAe,GAAG,WAAW,CAAA;AAwEnC,iFAAiF;AACjF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC9B,IAAI,GAAG,yBAAyB,CAAA;IACzC,OAAO,CAA2B;IAClC,2BAA2B,GAAG,6BAA6B,CAAA;IAC3D,QAAQ,CAAsB;IAEvC,YAAY,QAA8B;QACxC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAOD;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,GAAqB,EACrB,KAAY,EACZ,KAAY;IAEZ,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;IACjE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7E,OAAO,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,EAAE,CAAA;IAC/D,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,UAAkB;IAElB,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,UAAU,CAAA;IACpC,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,eAAe,CAAA;IACrD,IAAI,KAAK,KAAK,GAAG,eAAe,IAAI,UAAU,EAAE;QAAE,OAAO,oBAAoB,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAClE,OAAO,QAAQ,KAAK,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,eAAe,CACtB,iBAA+C;IAE/C,IAAI,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,CACL,OAAO,6BAA6B,iDAAiD;YACrF,iFAAiF;YACjF,6CAA6C,CAC9C,CAAA;IACH,CAAC;IACD,OAAO,CACL,OAAO,6BAA6B,gDAAgD;QACpF,6DAA6D,CAC9D,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CACb,OAAkC,EAClC,aAAuC,EACvC,iBAA+C;IAE/C,MAAM,IAAI,GACR,wFAAwF;QACxF,uFAAuF;QACvF,oCAAoC,CAAA;IACtC,IAAI,MAAc,CAAA;IAClB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,yBAAyB;YAC5B,MAAM,GAAG,GAAG,aAAa,kDAAkD,CAAA;YAC3E,MAAK;QACP,KAAK,6BAA6B;YAChC,MAAM;gBACJ,GAAG,aAAa,gBAAgB,iBAAiB,sCAAsC;oBACvF,oFAAoF,CAAA;YACtF,MAAK;QACP,KAAK,iBAAiB;YACpB,MAAM;gBACJ,GAAG,aAAa,gEAAgE;oBAChF,kDAAkD,CAAA;YACpD,MAAK;IACT,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO;QACP,aAAa;QACb,iBAAiB;QACjB,OAAO,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,EAAE;KACnE,CAAA;AACH,CAAC;AAED,MAAM,qBAAqB,GACzB,qDAAqD,CAAA;AAEvD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAA8B;IAE9B,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IAErB,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAA;IACH,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;IACnE,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,IAAI,CAAA;IAEjD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,yBAAyB,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,eAAe,GAAG,KAAK,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,UAAU;gBACjB,aAAa,EAAE,KAAK,CAAC,IAAI;gBACzB,iBAAiB,EAAE,SAAS,CAAC,IAAI;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAA;QACH,CAAC;QACD,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,eAAe,GAAG,IAAI,CAAA;IACtD,CAAC;IAED,OAAO,MAAM,CACX,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,yBAAyB,EAC3E,KAAK,CAAC,IAAI,EACV,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA8B;IAE9B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC7D,OAAO,QAAQ,CAAA;AACjB,CAAC"}