@decibelsystems/tools 2.2.0-beta.0 → 3.1.0

package/dist/pty/boundary.d.ts

@@ -0,0 +1,39 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+/** Constant-time compare that does not leak length through an early return. */
+export declare function timingSafeTokenCompare(provided: string, expected: string): boolean;
+/**
+ * The socket peer is genuinely on this machine. Checks the real socket address,
+ * not a spoofable header.
+ *
+ * An EMPTY remoteAddress is rejected. A real TCP loopback connection always
+ * presents 127.0.0.1 or ::1; empty arises only from a destroyed or odd socket,
+ * and treating it as local is how a closed socket becomes an authorised one.
+ */
+export declare function isLoopbackPeer(req: IncomingMessage): boolean;
+/**
+ * The Origin is one we allow, compared as a whole origin — never by prefix,
+ * because `https://hq.example.com.evil.com` defeats a startsWith.
+ *
+ * A missing Origin is REFUSED rather than allowed. Non-browser clients omit it
+ * and would otherwise skip the only check that distinguishes the HQ page from
+ * any other page the user has open.
+ */
+export declare function isAllowedOrigin(origin: string | undefined, allowed: string[]): boolean;
+/** The bearer presented in an Authorization header, or '' when there is none. */
+export declare function presentedBearer(req: IncomingMessage): string;
+/** Headers a signed (paired) request carries; see src/pty/pairing.ts. */
+export declare const PAIRING_HEADERS: string[];
+/**
+ * Answer a CORS preflight for an allowlisted origin, including the Private
+ * Network Access header.
+ *
+ * Without Access-Control-Allow-Private-Network, a page on https cannot reach
+ * this daemon at all in current Chromium — the request fails before any of our
+ * own auth runs, and it fails in a way that looks like the daemon is down.
+ * The header is only asserted when it was actually requested; sending it
+ * unconditionally advertises a capability on every preflight.
+ *
+ * Returns true when it handled the request.
+ */
+export declare function respondToPnaPreflight(req: IncomingMessage, res: ServerResponse, allowedOrigins: string[], extraHeaders?: string[]): boolean;
+//# sourceMappingURL=boundary.d.ts.map

package/dist/pty/boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../../src/pty/boundary.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAG5D,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQlF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAgBtF;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAG5D;AAED,yEAAyE;AACzE,eAAO,MAAM,eAAe,UAAwE,CAAC;AAErG;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,GAAE,MAAM,EAAO,GAC1B,OAAO,CAsBT"}

package/dist/pty/boundary.js

@@ -0,0 +1,100 @@
+// ============================================================================
+// HTTP trust boundary — the checks every local-only route shares
+// ============================================================================
+// Graduated from the ADR-0012 T3 attach probe (a88c533), which carried a second
+// copy of what httpServer.ts already did. One copy now, imported by both, so the
+// loopback and origin rules cannot drift between the REST surface and the
+// session/attach surface.
+// ============================================================================
+import { timingSafeEqual } from 'crypto';
+/** Constant-time compare that does not leak length through an early return. */
+export function timingSafeTokenCompare(provided, expected) {
+    const a = Buffer.from(provided, 'utf-8');
+    const b = Buffer.from(expected, 'utf-8');
+    if (a.length !== b.length) {
+        timingSafeEqual(a, a);
+        return false;
+    }
+    return timingSafeEqual(a, b);
+}
+/**
+ * The socket peer is genuinely on this machine. Checks the real socket address,
+ * not a spoofable header.
+ *
+ * An EMPTY remoteAddress is rejected. A real TCP loopback connection always
+ * presents 127.0.0.1 or ::1; empty arises only from a destroyed or odd socket,
+ * and treating it as local is how a closed socket becomes an authorised one.
+ */
+export function isLoopbackPeer(req) {
+    const peer = (req.socket.remoteAddress || '').replace('::ffff:', '');
+    return peer === '127.0.0.1' || peer === '::1';
+}
+/**
+ * The Origin is one we allow, compared as a whole origin — never by prefix,
+ * because `https://hq.example.com.evil.com` defeats a startsWith.
+ *
+ * A missing Origin is REFUSED rather than allowed. Non-browser clients omit it
+ * and would otherwise skip the only check that distinguishes the HQ page from
+ * any other page the user has open.
+ */
+export function isAllowedOrigin(origin, allowed) {
+    if (!origin)
+        return false;
+    try {
+        const parsed = new URL(origin);
+        const normalised = `${parsed.protocol}//${parsed.host}`;
+        return allowed.some((a) => {
+            try {
+                const p = new URL(a);
+                return normalised === `${p.protocol}//${p.host}`;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/** The bearer presented in an Authorization header, or '' when there is none. */
+export function presentedBearer(req) {
+    const auth = (req.headers.authorization || '');
+    return auth.startsWith('Bearer ') ? auth.slice(7) : '';
+}
+/** Headers a signed (paired) request carries; see src/pty/pairing.ts. */
+export const PAIRING_HEADERS = ['X-Pairing-Id', 'X-Pairing-Nonce', 'X-Pairing-Iat', 'X-Pairing-Sig'];
+/**
+ * Answer a CORS preflight for an allowlisted origin, including the Private
+ * Network Access header.
+ *
+ * Without Access-Control-Allow-Private-Network, a page on https cannot reach
+ * this daemon at all in current Chromium — the request fails before any of our
+ * own auth runs, and it fails in a way that looks like the daemon is down.
+ * The header is only asserted when it was actually requested; sending it
+ * unconditionally advertises a capability on every preflight.
+ *
+ * Returns true when it handled the request.
+ */
+export function respondToPnaPreflight(req, res, allowedOrigins, extraHeaders = []) {
+    if (req.method !== 'OPTIONS')
+        return false;
+    const origin = req.headers.origin;
+    if (!isAllowedOrigin(origin, allowedOrigins)) {
+        res.writeHead(403).end();
+        return true;
+    }
+    const headers = {
+        'Access-Control-Allow-Origin': origin,
+        'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+        'Access-Control-Allow-Headers': [...new Set(['Content-Type', 'Authorization', ...PAIRING_HEADERS, ...extraHeaders])].join(', '),
+        'Access-Control-Max-Age': '600',
+        Vary: 'Origin',
+    };
+    if (req.headers['access-control-request-private-network'] === 'true') {
+        headers['Access-Control-Allow-Private-Network'] = 'true';
+    }
+    res.writeHead(204, headers).end();
+    return true;
+}
+//# sourceMappingURL=boundary.js.map

package/dist/pty/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../../src/pty/boundary.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,iEAAiE;AACjE,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,0BAA0B;AAC1B,+EAA+E;AAG/E,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,QAAgB;IACvE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B,EAAE,OAAiB;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrB,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAW,CAAC;IACzD,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;AAErG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB,EACpB,GAAmB,EACnB,cAAwB,EACxB,eAAyB,EAAE;IAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC;IACxD,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,6BAA6B,EAAE,MAAO;QACtC,8BAA8B,EAAE,4BAA4B;QAC5D,8BAA8B,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/H,wBAAwB,EAAE,KAAK;QAC/B,IAAI,EAAE,QAAQ;KACf,CAAC;IACF,IAAI,GAAG,CAAC,OAAO,CAAC,wCAAwC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrE,OAAO,CAAC,sCAAsC,CAAC,GAAG,MAAM,CAAC;IAC3D,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/pty/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class SessionError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/pty/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pty/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAIlB"}

package/dist/pty/errors.js

@@ -0,0 +1,12 @@
+// Errors for the hosted-session surface. Status and code travel with the error
+// so every route maps it the same way.
+export class SessionError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/pty/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pty/errors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;IAI9B,CAAC;CACF"}

package/dist/pty/fleet.d.ts

@@ -0,0 +1,159 @@
+import { type LaunchProfile } from './launchProfile.js';
+import { type SpawnResult, type StrictProject } from './sessions.js';
+export declare const SWEEP_MS = 30000;
+/** The fields read from a ~/.claude/sessions/<pid>.json. */
+export interface SessionFile {
+    pid: number;
+    sessionId: string;
+    cwd: string;
+    procStart: string;
+    kind?: string;
+    entrypoint?: string;
+    name?: string;
+    nameSource?: string;
+}
+export interface Span {
+    from: string;
+    to: string;
+}
+export interface LedgerRow {
+    project_id: string;
+    cwd: string;
+    name?: string;
+    name_source?: string;
+    kind: string;
+    entrypoint: string;
+    first_seen: string;
+    last_seen: string;
+    spans: Span[];
+}
+export interface Ledger {
+    version: 1;
+    sessions: Record<string, LedgerRow>;
+    /** Work-period start (iso) → when it was restored. */
+    restored_periods: Record<string, string>;
+}
+export interface FleetRow {
+    claude_session_id: string;
+    project_id: string;
+    cwd: string;
+    name?: string;
+    first_seen: string;
+    last_seen: string;
+    period: 'closed' | 'open';
+    live: boolean;
+    default_selected: boolean;
+}
+export interface LastFleet {
+    status: 'ok' | 'unavailable';
+    reason?: string;
+    period_gap_hours: number;
+    closed_period?: {
+        start: string;
+        end: string;
+        restored_at?: string;
+    };
+    open_period?: {
+        start: string;
+    };
+    sessions: FleetRow[];
+}
+export type RestoreStatus = 'restored' | 'needs_attention' | 'skipped_live' | 'failed';
+export interface RestoreRow {
+    claude_session_id: string;
+    project_id?: string;
+    status: RestoreStatus;
+    session_key?: string;
+    attach_argv?: string[];
+    code?: string;
+    error?: string;
+}
+export interface FleetDeps {
+    sessionsDir?: () => string;
+    fleetDir?: () => string;
+    projects?: () => StrictProject[];
+    /** pid → `ps -o lstart` in UTC / C locale, for the pids still running. */
+    procStarts?: (pids: number[]) => Promise<Map<number, string>>;
+    spawn?: (projectId: string, resume: string, cwd: string) => Promise<SpawnResult>;
+    profile?: () => LaunchProfile;
+    now?: () => number;
+    stagger?: (ms: number) => Promise<void>;
+}
+export declare function defaultSessionsDir(): string;
+export declare function defaultFleetDir(): string;
+/**
+ * Every `<pid>.json` in the directory. A file that does not parse is skipped
+ * (Claude may be mid-write). A file that parses but lacks sessionId, cwd,
+ * procStart or pid is shape drift: reported, never guessed around.
+ */
+export declare function readSessionFiles(dir: string): {
+    files: SessionFile[];
+    drift?: string;
+};
+/** `ps` start times for the pids still running, as procStart writes them. */
+export declare function psProcStarts(pids: number[]): Promise<Map<number, string>>;
+interface Cluster {
+    start: number;
+    end: number;
+    live: boolean;
+    ids: Set<string>;
+}
+/**
+ * Merge every row's spans into work periods: a gap longer than gapMs with
+ * nothing seen splits them. A live row's last span runs to now and marks its
+ * period live.
+ */
+export declare function workPeriods(ledger: Ledger, live: Set<string>, gapMs: number, now: number): Cluster[];
+export declare class Fleet {
+    private ledger;
+    private live;
+    private status;
+    private reason?;
+    private lastPersist;
+    private dirty;
+    private sweeping;
+    private recentlyRestored;
+    private d;
+    constructor(deps?: FleetDeps);
+    private ledgerPath;
+    private load;
+    /** Write the ledger atomically (tmp + rename). */
+    persist(): void;
+    /** One sweep. Concurrent callers share the one in flight. */
+    sweep(): Promise<void>;
+    private doSweep;
+    /** Mark the fleet unavailable from outside (the start-up contract check). */
+    markUnavailable(reason: string): void;
+    liveIds(): Set<string>;
+    private gapHours;
+    /** GET /sessions/last-fleet. Computed at read time from the ledger. */
+    lastFleet(): LastFleet;
+    /**
+     * POST /sessions/restore. With no ids, the default-selected rows. Sweeps
+     * first, so "live" is current rather than up to 30 s old.
+     */
+    restore(sessionIds?: unknown): Promise<{
+        results: RestoreRow[];
+    }>;
+    private restoreIds;
+    /**
+     * restore_on_start (D5). Only when nothing is live (a daemon restarted
+     * mid-day must not drop yesterday's sessions on top of today's), and each
+     * closed period at most once: restored_at is written BEFORE spawning, so a
+     * daemon that crash-loops does not restore again.
+     */
+    restoreOnStart(): Promise<RestoreRow[] | null>;
+}
+export declare function fleet(): Fleet;
+/** Test seam. */
+export declare function _setFleet(f: Fleet | null): void;
+/**
+ * The start-up contract check: `claude agents --json` is the documented view
+ * of the same live set. A session it lists that the files do not is drift.
+ * When claude itself cannot be run, the files stay authoritative.
+ */
+export declare function agentsContractCheck(f: Fleet): void;
+/** Start the 30 s sweep. Returns a stop function that flushes the ledger. */
+export declare function startFleetSweep(): () => void;
+export {};
+//# sourceMappingURL=fleet.d.ts.map

package/dist/pty/fleet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/pty/fleet.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,QAAQ,QAAS,CAAC;AAe/B,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,IAAI,GAAG,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,WAAW,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,QAAQ,EAAE,QAAQ,EAAE,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEvF,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,aAAa,EAAE,CAAC;IACjC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,CAAC,EAAE,MAAM,aAAa,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAQD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BtF;AAID,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAczE;AAMD,UAAU,OAAO;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAqBpG;AAqBD,qBAAa,KAAK;IAChB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,CAAC,CAAsB;gBAEnB,IAAI,GAAE,SAAc;IAahC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,IAAI;IAwBZ,kDAAkD;IAClD,OAAO,IAAI,IAAI;IAYf,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAOR,OAAO;IA2ErB,6EAA6E;IAC7E,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKrC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC;IAItB,OAAO,CAAC,QAAQ;IAQhB,uEAAuE;IACvE,SAAS,IAAI,SAAS;IAoDtB;;;OAGG;IACG,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;YAczD,UAAU;IA2CxB;;;;;OAKG;IACG,cAAc,IAAI,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC;CAkBrD;AAOD,wBAAgB,KAAK,IAAI,KAAK,CAE7B;AACD,iBAAiB;AACjB,wBAAgB,SAAS,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,IAAI,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAwBlD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,MAAM,IAAI,CAyB5C"}