@cuna_labs/cli 0.1.0

package/dist/local-actions/broker.js

@@ -0,0 +1,400 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { LOCAL_ACTION_PROTOCOL_VERSION, MAX_LOCAL_ACTION_ARGUMENT_BYTES, MAX_LOCAL_ACTION_FUTURE_SKEW_MS, MAX_LOCAL_ACTION_HISTORY, MAX_LOCAL_ACTION_QUEUE, MAX_LOCAL_ACTION_REPLAY_ENTRIES, MAX_LOCAL_ACTION_TTL_MS, sameLocalActionIdentity, } from "./contracts.js";
+import { LocalActionPolicyEvaluator } from "./policy.js";
+import { providerAllowsLocalAction } from "./providers.js";
+import { validateLocalActionArguments, validateLocalActionResult } from "./schemas.js";
+const TERMINAL_STATES = new Set([
+    "succeeded", "failed", "denied", "expired", "cancelled",
+]);
+const IDENTIFIER = /^[A-Za-z0-9._:@/-]{1,256}$/u;
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+export class LocalActionBroker {
+    #policy;
+    #clock;
+    #maximumQueuedRequests;
+    #onChange;
+    #isIdentityLive;
+    #onObserverError;
+    #requests = new Map();
+    #queue = [];
+    #nonces = new Map();
+    #nonceExpiry = new Map();
+    #terminalOrder = [];
+    constructor(options) {
+        const maximum = options.maximumQueuedRequests ?? MAX_LOCAL_ACTION_QUEUE;
+        if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > MAX_LOCAL_ACTION_QUEUE) {
+            throw new RangeError(`Local action queue must contain 1 through ${MAX_LOCAL_ACTION_QUEUE} requests.`);
+        }
+        this.#policy = options.policy ?? new LocalActionPolicyEvaluator();
+        this.#clock = options.clock ?? Date.now;
+        this.#maximumQueuedRequests = maximum;
+        this.#onChange = options.onChange;
+        this.#isIdentityLive = options.isIdentityLive;
+        this.#onObserverError = options.onObserverError;
+    }
+    submit(request) {
+        const now = this.#clock();
+        this.#prune(now);
+        validateRequest(request, now);
+        this.#assertLive(request.identity, request.id);
+        const existing = this.#requests.get(request.id);
+        if (existing !== undefined) {
+            if (sameRequest(existing.request, request))
+                return existing;
+            throw new LocalActionBrokerError("duplicate_request", request.id);
+        }
+        if (!providerAllowsLocalAction(request.provider, request.kind)) {
+            throw new LocalActionBrokerError("provider_action_unavailable", request.id);
+        }
+        try {
+            validateLocalActionArguments(request);
+        }
+        catch {
+            throw new LocalActionBrokerError("invalid_request", request.id);
+        }
+        const nonceKey = `${identityKey(request.identity)}:${request.nonce}`;
+        const priorNonceRequest = this.#nonces.get(nonceKey);
+        if (priorNonceRequest !== undefined) {
+            throw new LocalActionBrokerError("replayed_nonce", request.id);
+        }
+        if (this.#nonces.size >= MAX_LOCAL_ACTION_REPLAY_ENTRIES) {
+            throw new LocalActionBrokerError("replay_registry_full", request.id);
+        }
+        if (this.#queue.length >= this.#maximumQueuedRequests)
+            throw new LocalActionBrokerError("queue_full", request.id);
+        const immutableRequest = immutableCopy(request);
+        this.#nonces.set(nonceKey, request.id);
+        this.#nonceExpiry.set(nonceKey, request.expiresAt);
+        let snapshot = freezeSnapshot(immutableRequest, "validated");
+        this.#requests.set(request.id, snapshot);
+        this.#emit(snapshot);
+        const initialPolicy = this.#policy.evaluate(immutableRequest, this.#clock());
+        if (initialPolicy.decision === "deny") {
+            return this.#finish(request.id, "denied", initialPolicy, "denied_by_policy");
+        }
+        this.#queue.push(request.id);
+        return this.#queue[0] === request.id ? this.#activateHead() ?? snapshot : snapshot;
+    }
+    current() {
+        this.expire();
+        return this.#activateHead();
+    }
+    get(requestId) {
+        return this.#requests.get(requestId);
+    }
+    decide(requestId, allow, grantedScope = null) {
+        const snapshot = this.#requireState(requestId, "pending_user");
+        if (this.#queue[0] !== requestId)
+            throw new LocalActionBrokerError("illegal_transition", requestId);
+        this.#assertLive(snapshot.request.identity, requestId);
+        const now = this.#clock();
+        if (now >= snapshot.request.expiresAt)
+            return this.#finish(requestId, "expired", undefined, "request_expired");
+        if (allow && grantedScope !== null && grantedScope !== snapshot.request.requestedScope) {
+            throw new LocalActionBrokerError("scope_widening", requestId);
+        }
+        const policy = Object.freeze({
+            requestId,
+            decision: allow ? "allow_once" : "deny",
+            grantedScope: allow ? snapshot.request.requestedScope : null,
+            policySource: "interactive_user",
+            decidedAt: now,
+        });
+        if (!allow)
+            return this.#finish(requestId, "denied", policy, "denied_by_user");
+        return this.#transition(requestId, "executing", policy);
+    }
+    awaitingRemoteCompletion(requestId) {
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        if (this.#clock() >= snapshot.request.expiresAt)
+            return this.#finish(requestId, "expired", undefined, "request_expired");
+        this.#assertLive(snapshot.request.identity, requestId);
+        return this.#transition(requestId, "awaiting_remote_completion");
+    }
+    complete(requestId, identity, status, safeData, safeReason) {
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        if (!sameLocalActionIdentity(snapshot.request.identity, identity)) {
+            throw new LocalActionBrokerError("identity_mismatch", requestId);
+        }
+        if (TERMINAL_STATES.has(snapshot.state))
+            return snapshot;
+        if (this.#clock() >= snapshot.request.expiresAt)
+            return this.#finish(requestId, "expired", undefined, "request_expired");
+        this.#assertLive(identity, requestId);
+        if ((status !== "succeeded" && status !== "failed" && status !== "cancelled") ||
+            (status !== "cancelled" && snapshot.state !== "executing" && snapshot.state !== "awaiting_remote_completion")) {
+            throw new LocalActionBrokerError("illegal_transition", requestId);
+        }
+        if (safeData !== undefined && Buffer.byteLength(canonicalJson(safeData), "utf8") > MAX_LOCAL_ACTION_ARGUMENT_BYTES) {
+            throw new LocalActionBrokerError("invalid_result", requestId);
+        }
+        try {
+            validateLocalActionResult(snapshot.request, status, safeData, safeReason);
+        }
+        catch {
+            throw new LocalActionBrokerError("invalid_result", requestId);
+        }
+        const immutableSafeData = safeData === undefined ? undefined : deepFreezeJson(safeData);
+        const result = Object.freeze({
+            version: LOCAL_ACTION_PROTOCOL_VERSION,
+            requestId,
+            kind: snapshot.request.kind,
+            identity: snapshot.request.identity,
+            status,
+            ...(immutableSafeData === undefined ? {} : { safeData: immutableSafeData }),
+            ...(safeReason === undefined ? {} : { safeReason }),
+            completedAt: this.#clock(),
+        });
+        const next = freezeSnapshot(snapshot.request, status, snapshot.decision, result);
+        this.#requests.set(requestId, next);
+        this.#dequeue(requestId);
+        this.#recordTerminal(requestId);
+        this.#emit(next);
+        this.#activateHead();
+        return next;
+    }
+    cancelBinding(identity, reason = "terminal_binding_changed") {
+        const cancelled = [];
+        for (const snapshot of this.#requests.values()) {
+            if (!TERMINAL_STATES.has(snapshot.state) && sameLocalActionIdentity(snapshot.request.identity, identity)) {
+                cancelled.push(this.#finish(snapshot.request.id, "cancelled", undefined, reason));
+            }
+        }
+        return Object.freeze(cancelled);
+    }
+    cancelStaleForIdentity(identity, reason = "terminal_binding_changed") {
+        const cancelled = [];
+        for (const snapshot of this.#requests.values()) {
+            const candidate = snapshot.request.identity;
+            if (!TERMINAL_STATES.has(snapshot.state) &&
+                candidate.agentSessionId === identity.agentSessionId &&
+                !sameLocalActionIdentity(candidate, identity)) {
+                cancelled.push(this.#finish(snapshot.request.id, "cancelled", undefined, reason));
+            }
+        }
+        return Object.freeze(cancelled);
+    }
+    expire() {
+        const now = this.#clock();
+        const expired = [];
+        for (const snapshot of this.#requests.values()) {
+            if (!TERMINAL_STATES.has(snapshot.state) && now >= snapshot.request.expiresAt) {
+                expired.push(this.#finish(snapshot.request.id, "expired", undefined, "request_expired"));
+            }
+        }
+        return Object.freeze(expired);
+    }
+    #transition(requestId, state, decision) {
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        const allowed = state === "executing"
+            ? new Set(["pending_user", "validated"])
+            : new Set(["executing"]);
+        if (!allowed.has(snapshot.state))
+            throw new LocalActionBrokerError("illegal_transition", requestId);
+        const next = freezeSnapshot(snapshot.request, state, decision ?? snapshot.decision);
+        this.#requests.set(requestId, next);
+        this.#emit(next);
+        return next;
+    }
+    #activateHead() {
+        const requestId = this.#queue[0];
+        if (requestId === undefined)
+            return undefined;
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        if (snapshot.state !== "validated")
+            return snapshot;
+        if (!this.#isIdentityLive(snapshot.request.identity)) {
+            this.#finish(requestId, "cancelled", undefined, "stale_identity");
+            const nextId = this.#queue[0];
+            return nextId === undefined ? undefined : this.#requests.get(nextId);
+        }
+        const policy = this.#policy.evaluate(snapshot.request, this.#clock());
+        if (policy.decision === "deny") {
+            this.#finish(requestId, "denied", policy, "denied_by_policy");
+            return this.#activateHead();
+        }
+        const next = freezeSnapshot(snapshot.request, policy.decision === "ask" ? "pending_user" : "executing", policy);
+        this.#requests.set(requestId, next);
+        this.#emit(next);
+        return next;
+    }
+    #finish(requestId, status, decision, safeReason) {
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        if (TERMINAL_STATES.has(snapshot.state))
+            return snapshot;
+        const result = Object.freeze({
+            version: LOCAL_ACTION_PROTOCOL_VERSION,
+            requestId,
+            kind: snapshot.request.kind,
+            identity: snapshot.request.identity,
+            status,
+            ...(safeReason === undefined ? {} : { safeReason }),
+            completedAt: this.#clock(),
+        });
+        const next = freezeSnapshot(snapshot.request, status, decision ?? snapshot.decision, result);
+        this.#requests.set(requestId, next);
+        this.#dequeue(requestId);
+        this.#recordTerminal(requestId);
+        this.#emit(next);
+        this.#activateHead();
+        return next;
+    }
+    #requireState(requestId, state) {
+        const snapshot = this.#requests.get(requestId);
+        if (snapshot === undefined)
+            throw new LocalActionBrokerError("unknown_request", requestId);
+        if (snapshot.state !== state)
+            throw new LocalActionBrokerError("illegal_transition", requestId);
+        return snapshot;
+    }
+    #dequeue(requestId) {
+        const index = this.#queue.indexOf(requestId);
+        if (index >= 0)
+            this.#queue.splice(index, 1);
+    }
+    #emit(snapshot) {
+        try {
+            this.#onChange?.(snapshot);
+        }
+        catch (error) {
+            try {
+                this.#onObserverError?.(error);
+            }
+            catch { /* observers never own broker state */ }
+        }
+    }
+    #assertLive(identity, requestId) {
+        if (!this.#isIdentityLive(identity))
+            throw new LocalActionBrokerError("stale_identity", requestId);
+    }
+    #recordTerminal(requestId) {
+        this.#terminalOrder.push(requestId);
+        while (this.#terminalOrder.length > MAX_LOCAL_ACTION_HISTORY) {
+            const evicted = this.#terminalOrder.shift();
+            if (evicted !== undefined)
+                this.#requests.delete(evicted);
+        }
+    }
+    #prune(now) {
+        for (const [key, expiresAt] of this.#nonceExpiry) {
+            if (expiresAt <= now) {
+                this.#nonceExpiry.delete(key);
+                this.#nonces.delete(key);
+            }
+        }
+    }
+}
+export class LocalActionBrokerError extends Error {
+    code;
+    requestId;
+    constructor(code, requestId) {
+        super(`Local action ${requestId} failed: ${code}.`);
+        this.code = code;
+        this.requestId = requestId;
+        this.name = "LocalActionBrokerError";
+    }
+}
+export function digestLocalActionArguments(value) {
+    return `sha256:${createHash("sha256").update(canonicalJson(value)).digest("hex")}`;
+}
+export function validateRequest(request, now = Date.now()) {
+    if (!plainObject(request) || !plainObject(request.identity) || !plainObject(request.arguments) ||
+        !exactObjectKeys(request, ["version", "id", "identity", "provider", "kind", "arguments", "argumentsDigest", "requestedScope", "createdAt", "expiresAt", "nonce"]) ||
+        !exactObjectKeys(request.identity, ["userId", "deviceId", "machineId", "workspaceBindingId", "workspaceBindingGeneration", "agentSessionId", "processEpoch", "fencingGeneration"])) {
+        throw new LocalActionBrokerError("invalid_request", typeof request?.id === "string" ? request.id : "unknown");
+    }
+    const encoded = canonicalJson(request.arguments);
+    const actualDigest = digestLocalActionArguments(request.arguments);
+    const expected = Buffer.from(request.argumentsDigest);
+    const actual = Buffer.from(actualDigest);
+    if (request.version !== LOCAL_ACTION_PROTOCOL_VERSION ||
+        !IDENTIFIER.test(request.id) ||
+        !IDENTIFIER.test(request.identity.userId) ||
+        !IDENTIFIER.test(request.identity.deviceId) ||
+        !IDENTIFIER.test(request.identity.machineId) ||
+        (request.identity.workspaceBindingId !== null && !IDENTIFIER.test(request.identity.workspaceBindingId)) ||
+        !IDENTIFIER.test(request.identity.agentSessionId) ||
+        !IDENTIFIER.test(request.identity.processEpoch) ||
+        !Number.isSafeInteger(request.identity.fencingGeneration) ||
+        request.identity.fencingGeneration < 1 ||
+        !IDENTIFIER.test(request.requestedScope) ||
+        !IDENTIFIER.test(request.nonce) ||
+        !Number.isSafeInteger(request.createdAt) ||
+        !Number.isSafeInteger(request.expiresAt) ||
+        request.expiresAt <= request.createdAt ||
+        request.expiresAt <= now ||
+        request.createdAt > now + MAX_LOCAL_ACTION_FUTURE_SKEW_MS ||
+        request.expiresAt - request.createdAt > MAX_LOCAL_ACTION_TTL_MS ||
+        (request.identity.workspaceBindingId === null) !== (request.identity.workspaceBindingGeneration === null) ||
+        (request.identity.workspaceBindingGeneration !== null &&
+            (!Number.isSafeInteger(request.identity.workspaceBindingGeneration) || request.identity.workspaceBindingGeneration < 1)) ||
+        Buffer.byteLength(encoded, "utf8") > MAX_LOCAL_ACTION_ARGUMENT_BYTES ||
+        !DIGEST.test(request.argumentsDigest) ||
+        expected.byteLength !== actual.byteLength ||
+        !timingSafeEqual(expected, actual)) {
+        throw new LocalActionBrokerError("invalid_request", request.id);
+    }
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new TypeError("Local action arguments must contain finite numbers.");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+    if (typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    throw new TypeError("Local action arguments must be JSON values.");
+}
+function immutableCopy(request) {
+    const copy = structuredClone(request);
+    return Object.freeze({
+        ...copy,
+        identity: Object.freeze({ ...copy.identity }),
+        arguments: deepFreezeJson(copy.arguments),
+    });
+}
+function deepFreezeJson(value) {
+    if (value !== null && typeof value === "object") {
+        for (const child of Object.values(value))
+            deepFreezeJson(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function sameRequest(left, right) {
+    return left.id === right.id && left.kind === right.kind && left.provider === right.provider &&
+        left.argumentsDigest === right.argumentsDigest && left.nonce === right.nonce &&
+        left.requestedScope === right.requestedScope && left.createdAt === right.createdAt &&
+        left.expiresAt === right.expiresAt && sameLocalActionIdentity(left.identity, right.identity);
+}
+function identityKey(identity) {
+    return createHash("sha256").update(canonicalJson(identity)).digest("hex");
+}
+function exactObjectKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
+function plainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function freezeSnapshot(request, state, decision, result) {
+    return Object.freeze({ request, state, ...(decision === undefined ? {} : { decision }), ...(result === undefined ? {} : { result }) });
+}
+//# sourceMappingURL=broker.js.map

package/dist/local-actions/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/local-actions/broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EAQvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEvF,MAAM,eAAe,GAAkC,IAAI,GAAG,CAAC;IAC7D,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW;CACxD,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAYxC,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAA6B;IACpC,MAAM,CAAe;IACrB,sBAAsB,CAAS;IAC/B,SAAS,CAAwD;IACjE,eAAe,CAAoD;IACnE,gBAAgB,CAAyC;IACzD,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACnD,MAAM,GAAa,EAAE,CAAC;IACtB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,cAAc,GAAa,EAAE,CAAC;IAEvC,YAAY,OAAiC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,qBAAqB,IAAI,sBAAsB,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;YACtF,MAAM,IAAI,UAAU,CAAC,6CAA6C,sBAAsB,YAAY,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAClE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;QACxC,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,OAA2B;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC5D,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC;YACH,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrE,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,+BAA+B,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,sBAAsB;YAAE,MAAM,IAAI,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClH,MAAM,gBAAgB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,QAAQ,GAAG,cAAc,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,IAAI,aAAa,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,KAAc,EAAE,eAA8B,IAAI;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QACpG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC/G,IAAI,KAAK,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACvF,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAmB,MAAM,CAAC,MAAM,CAAC;YAC3C,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;YACvC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;YAC5D,YAAY,EAAE,kBAAkB;YAChC,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACzH,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACnE,CAAC;IAED,QAAQ,CACN,SAAiB,EACjB,QAAoC,EACpC,MAAmC,EACnC,QAAwC,EACxC,UAAkC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACzH,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,WAAW,CAAC;YAC3E,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,4BAA4B,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAG,+BAA+B,EAAE,CAAC;YACnH,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC;YACH,yBAAyB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxF,MAAM,MAAM,GAAsB,MAAM,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,6BAA6B;YACtC,SAAS;YACT,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;YAC3B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;YACnC,MAAM;YACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YAC3E,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,QAAoC,EAAE,SAAgC,0BAA0B;QAC5G,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,sBAAsB,CAAC,QAAoC,EAAE,SAAgC,0BAA0B;QACrH,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;gBACpD,CAAC,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,KAAiD,EAAE,QAAyB;QACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,KAAK,KAAK,WAAW;YACnC,CAAC,CAAC,IAAI,GAAG,CAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC,CAAC,IAAI,GAAG,CAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,SAAiB,EACjB,MAAmC,EACnC,QAAyB,EACzB,UAAkC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzD,MAAM,MAAM,GAAsB,MAAM,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,6BAA6B;YACtC,SAAS;YACT,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;YAC3B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;YACnC,MAAM;YACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,KAAuB;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,SAAiB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAA6B;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAoC,EAAE,SAAiB;QACjE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,IAAkQ,EAClQ,SAAiB;QAE1B,KAAK,CAAC,gBAAgB,SAAS,YAAY,IAAI,GAAG,CAAC,CAAC;QAH3C,SAAI,GAAJ,IAAI,CAA8P;QAClQ,cAAS,GAAT,SAAS,CAAQ;QAG1B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAwC;IAExC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3E,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5F,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACjK,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACrL,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,IACE,OAAO,CAAC,OAAO,KAAK,6BAA6B;QACjD,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACvG,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjD,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/C,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACzD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,GAAG,CAAC;QACtC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QACxC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACtC,OAAO,CAAC,SAAS,IAAI,GAAG;QACxB,OAAO,CAAC,SAAS,GAAG,GAAG,GAAG,+BAA+B;QACzD,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,uBAAuB;QAC/D,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,KAAK,IAAI,CAAC;QACzG,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,KAAK,IAAI;YACnD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC;QAC1H,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,+BAA+B;QACpE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QACrC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QACzC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,OAA2B;IAChD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7C,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAI,KAAQ;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,KAAyB;IACtE,OAAO,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACzF,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC5E,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClF,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,WAAW,CAAC,QAAoC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,QAA2B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CACrB,OAA2B,EAC3B,KAAuB,EACvB,QAAyB,EACzB,MAA0B;IAE1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACzI,CAAC"}

package/dist/local-actions/browser-action.d.ts

@@ -0,0 +1,78 @@
+export type BrowserActionProvider = "claude-code" | "codex";
+export type BrowserActionState = "detected" | "pending_permission" | "approved" | "opening" | "awaiting_callback" | "completed" | "denied" | "expired" | "failed";
+interface LocalBrowserActionRequestBase {
+    readonly id: string;
+    readonly agentSessionId: string;
+    readonly processEpoch: string;
+    readonly fencingGeneration: number;
+    readonly url: string;
+    readonly origin: string;
+    readonly nonce: string;
+    readonly detectedAt: number;
+    readonly expiresAt: number;
+    readonly state: "pending_permission";
+}
+export interface LocalBrowserOpenActionRequest extends LocalBrowserActionRequestBase {
+    readonly type: "browser.open";
+    readonly provider: BrowserActionProvider;
+}
+/** Codex's established device-code transport keeps its two-field contract. */
+export interface LocalCodexDeviceActionRequest extends LocalBrowserActionRequestBase {
+    readonly type: "auth.device.present";
+    readonly provider: "codex";
+    readonly userCode: string;
+}
+export type LocalBrowserActionRequest = LocalBrowserOpenActionRequest | LocalCodexDeviceActionRequest;
+export interface BrowserActionDetectorOptions {
+    /** Only providers whose supported fallback is a PTY browser URL belong here. */
+    readonly provider: BrowserActionProvider;
+    readonly agentSessionId: string;
+    readonly processEpoch: string;
+    readonly fencingGeneration: number;
+    readonly clock?: () => number;
+    readonly id?: () => string;
+    readonly nonce?: () => string;
+    readonly ttlMs?: number;
+    /** Copy-only admission does not authorize opening a browser. */
+    readonly copyOnly?: boolean;
+}
+export interface ProviderOAuthPasteGuardResult {
+    /** Bytes which must be forwarded in order. Blocked paste bytes are omitted. */
+    readonly forward: readonly Uint8Array[];
+    /** True when this push completed and suppressed an admitted provider URL paste. */
+    readonly blocked: boolean;
+}
+/**
+ * A byte-preserving guard for the provider's hidden authorization-code prompt.
+ *
+ * It buffers only a complete bracketed paste, so a URL split across stdin
+ * chunks cannot leak partially before it is classified. Opaque input is
+ * returned byte-for-byte (including its bracketed-paste markers). The result
+ * deliberately carries no rejected value, URL, or diagnostic text.
+ */
+export declare class ProviderOAuthPasteGuard {
+    #private;
+    constructor(request: LocalBrowserOpenActionRequest);
+    push(bytes: Uint8Array): ProviderOAuthPasteGuardResult;
+    /** Drop any partial paste when its exact terminal binding is no longer valid. */
+    reset(): void;
+    get hasPendingPrefix(): boolean;
+    /** Release only marker bytes; retain recognition so a late URL cannot leak. */
+    releasePendingPrefix(): Uint8Array;
+    /** Commit a complete pasted provider code as opaque bytes plus exactly one CR. */
+    beginCodeCapture(): void;
+}
+/**
+ * Turns Claude/Codex's established PTY browser fallback into a typed local
+ * request. OpenCode is deliberately excluded: its TUI text is output only;
+ * a future private sidecar must use the RTP1 `auth.device.present` envelope.
+ * Detection cannot execute anything and the full URL is never logged.
+ */
+export declare class ProviderBrowserActionDetector {
+    #private;
+    constructor(options: BrowserActionDetectorOptions);
+    push(bytes: Uint8Array): readonly LocalBrowserActionRequest[];
+}
+export declare function admitProviderAuthUrl(provider: BrowserActionProvider, raw: string): URL | undefined;
+export {};
+//# sourceMappingURL=browser-action.d.ts.map

package/dist/local-actions/browser-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-action.d.ts","sourceRoot":"","sources":["../../src/local-actions/browser-action.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,OAAO,CAAC;AAC5D,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,oBAAoB,GACpB,UAAU,GACV,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AAEb,UAAU,6BAA6B;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;CACtC;AAED,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B;IAClF,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED,8EAA8E;AAC9E,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B;IAClF,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,yBAAyB,GACjC,6BAA6B,GAC7B,6BAA6B,CAAC;AAElC,MAAM,WAAW,4BAA4B;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAUD,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;;gBAYtB,OAAO,EAAE,6BAA6B;IAkBlD,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,6BAA6B;IAmFtD,iFAAiF;IACjF,KAAK,IAAI,IAAI;IASb,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,+EAA+E;IAC/E,oBAAoB,IAAI,UAAU;IAMlC,kFAAkF;IAClF,gBAAgB,IAAI,IAAI;CAgBzB;AAiCD;;;;;GAKG;AACH,qBAAa,6BAA6B;;gBAO5B,OAAO,EAAE,4BAA4B;IAiBjD,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,yBAAyB,EAAE;CAqC9D;AAMD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,CAelG"}