@elizaos/agent 2.0.0-alpha.520 → 2.0.0-alpha.521

package/packages/app-core/src/security/agent-vault-id.d.ts

@@ -1,14 +0,0 @@
-import type { SecureStoreSecretKind } from "./platform-secure-store";
-/** Fixed Keychain / Secret Service “service” identifier (see docs/guides/platform-secure-store.md). */
-export declare const ELIZA_AGENT_VAULT_SERVICE = "ai.elizaos.agent.vault";
-/**
- * Canonical state directory for this process (same semantics as `ELIZA_STATE_DIR` default).
- * Uses `realpathSync` when the path exists so symlinks normalize consistently.
- */
-export declare function resolveCanonicalStateDir(): string;
-/**
- * Opaque vault id for OS secret stores: `mldy1-` + first 16 chars of base64url(sha256(canonicalStateDir)).
- */
-export declare function deriveAgentVaultId(canonicalStateDir?: string): string;
-export declare function keychainAccountForSecretKind(vaultId: string, kind: SecureStoreSecretKind): string;
-//# sourceMappingURL=agent-vault-id.d.ts.map

package/packages/app-core/src/security/agent-vault-id.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-vault-id.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/security/agent-vault-id.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,uGAAuG;AACvG,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CASjD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,iBAAiB,SAA6B,GAC7C,MAAM,CAIR;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,qBAAqB,GAC1B,MAAM,CAER"}

package/packages/app-core/src/security/agent-vault-id.js

@@ -1,32 +0,0 @@
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-/** Fixed Keychain / Secret Service “service” identifier (see docs/guides/platform-secure-store.md). */
-export const ELIZA_AGENT_VAULT_SERVICE = "ai.elizaos.agent.vault";
-/**
- * Canonical state directory for this process (same semantics as `ELIZA_STATE_DIR` default).
- * Uses `realpathSync` when the path exists so symlinks normalize consistently.
- */
-export function resolveCanonicalStateDir() {
-    const raw = process.env.ELIZA_STATE_DIR?.trim();
-    const base = raw && raw.length > 0 ? raw : path.join(os.homedir(), ".eliza");
-    const resolved = path.resolve(base);
-    try {
-        return fs.realpathSync(resolved);
-    }
-    catch {
-        return resolved;
-    }
-}
-/**
- * Opaque vault id for OS secret stores: `mldy1-` + first 16 chars of base64url(sha256(canonicalStateDir)).
- */
-export function deriveAgentVaultId(canonicalStateDir = resolveCanonicalStateDir()) {
-    const hash = createHash("sha256").update(canonicalStateDir, "utf8").digest();
-    const token = Buffer.from(hash).toString("base64url").slice(0, 16);
-    return `mldy1-${token}`;
-}
-export function keychainAccountForSecretKind(vaultId, kind) {
-    return `${vaultId}:${kind}`;
-}

package/packages/app-core/src/security/platform-secure-store-node.d.ts

@@ -1,15 +0,0 @@
-import type { PlatformSecureStore } from "./platform-secure-store";
-/**
- * Node-side factory: macOS Keychain, Linux `secret-tool`, or unavailable placeholder.
- * Windows Credential Manager is not wired yet (`none`).
- */
-export declare function createNodePlatformSecureStore(): PlatformSecureStore;
-/**
- * Opt in: `ELIZA_WALLET_OS_STORE=1` / `true` / `on` / `yes`.
- *
- * Defaults to **off** until the macOS argv exposure is resolved via
- * Security.framework / Bun FFI. Users who accept the risk can enable
- * explicitly.
- */
-export declare function isWalletOsStoreReadEnabled(): boolean;
-//# sourceMappingURL=platform-secure-store-node.d.ts.map

package/packages/app-core/src/security/platform-secure-store-node.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-secure-store-node.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/security/platform-secure-store-node.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,yBAAyB,CAAC;AAiUjC;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,mBAAmB,CAQnE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAGpD"}

package/packages/app-core/src/security/platform-secure-store-node.js

@@ -1,296 +0,0 @@
-import { execFile, spawn } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { promisify } from "node:util";
-import { ELIZA_AGENT_VAULT_SERVICE, keychainAccountForSecretKind, } from "./agent-vault-id";
-const execFileAsync = promisify(execFile);
-function isDarwin() {
-    return process.platform === "darwin";
-}
-function isLinux() {
-    return process.platform === "linux";
-}
-/**
- * Write a password to the macOS Keychain via stdin to avoid argv exposure.
- * The `security add-generic-password` command reads from stdin when `-w`
- * is the last argument with no value. It prompts twice (password + retype),
- * so we write the value twice separated by a newline.
- */
-function keychainSetViaStdin(args, password) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("security", args, {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let stderr = "";
-        child.stderr.setEncoding("utf8");
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", reject);
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolve();
-                return;
-            }
-            reject(Object.assign(new Error(stderr.trim() || `security exited ${code}`), {
-                stderr,
-                code,
-            }));
-        });
-        // Swallow EPIPE if security exits before reading stdin (e.g. arg error).
-        // Without this, Node emits an unhandled error and may crash the process.
-        child.stdin.on("error", () => { });
-        // Write password twice (password + retype) then close stdin
-        child.stdin.write(`${password}\n${password}\n`, () => {
-            child.stdin.end();
-        });
-    });
-}
-function secretToolStoreWithStdin(args, secretLine) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("secret-tool", args, {
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let stderr = "";
-        child.stderr.setEncoding("utf8");
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", reject);
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolve();
-                return;
-            }
-            reject(Object.assign(new Error(stderr.trim() || `secret-tool exited ${code}`), {
-                stderr,
-                code,
-            }));
-        });
-        const line = secretLine.endsWith("\n") ? secretLine : `${secretLine}\n`;
-        child.stdin.write(line, "utf8");
-        child.stdin.end();
-    });
-}
-/**
- * Check if `secret-tool` is available on PATH without spawning a shell.
- * Iterates PATH entries directly and checks for the executable.
- */
-async function secretToolOnPath() {
-    if (process.platform === "win32")
-        return false;
-    const pathEnv = process.env.PATH ?? "";
-    for (const dir of pathEnv.split(path.delimiter)) {
-        if (!dir)
-            continue;
-        const candidate = path.join(dir, "secret-tool");
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            // not in this dir
-        }
-    }
-    return false;
-}
-function macErrReason(stderr, code) {
-    const s = stderr.toLowerCase();
-    if (s.includes("could not be found") ||
-        s.includes("the specified item could not be found")) {
-        return { ok: false, reason: "not_found" };
-    }
-    if (s.includes("user canceled") || s.includes("user cancelled")) {
-        return { ok: false, reason: "denied" };
-    }
-    return {
-        ok: false,
-        reason: code === 44 || code === 45 ? "denied" : "error",
-        message: stderr.trim().slice(0, 300),
-    };
-}
-class MacOSKeychainPlatformSecureStore {
-    backend = "macos_keychain";
-    async isAvailable() {
-        try {
-            await execFileAsync("security", ["-h"], { encoding: "utf8" });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    async get(vaultId, kind) {
-        const account = keychainAccountForSecretKind(vaultId, kind);
-        try {
-            const { stdout, stderr: _stderr } = await execFileAsync("security", [
-                "find-generic-password",
-                "-s",
-                ELIZA_AGENT_VAULT_SERVICE,
-                "-a",
-                account,
-                "-w",
-            ], { encoding: "utf8" });
-            const value = stdout.trim();
-            if (!value) {
-                return { ok: false, reason: "not_found" };
-            }
-            return { ok: true, value };
-        }
-        catch (err) {
-            const e = err;
-            return macErrReason(String(e.stderr ?? err), e.code ?? null);
-        }
-    }
-    async set(vaultId, kind, value) {
-        const account = keychainAccountForSecretKind(vaultId, kind);
-        try {
-            // Pass password via stdin instead of argv to avoid exposure via `ps`.
-            // The `-w` flag (last, with no value) triggers stdin read mode.
-            await keychainSetViaStdin([
-                "add-generic-password",
-                "-s",
-                ELIZA_AGENT_VAULT_SERVICE,
-                "-a",
-                account,
-                "-U",
-                "-w",
-            ], value);
-            return { ok: true };
-        }
-        catch (err) {
-            const stderr = String(err.stderr ?? err);
-            return {
-                ok: false,
-                reason: "error",
-                message: stderr.trim().slice(0, 300),
-            };
-        }
-    }
-    async delete(vaultId, kind) {
-        const account = keychainAccountForSecretKind(vaultId, kind);
-        try {
-            await execFileAsync("security", [
-                "delete-generic-password",
-                "-s",
-                ELIZA_AGENT_VAULT_SERVICE,
-                "-a",
-                account,
-            ]);
-        }
-        catch {
-            // ignore — item may not exist
-        }
-    }
-}
-/** Linux: `secret-tool` from libsecret (GNOME Keyring / KWallet Secret Service). */
-class LinuxSecretToolPlatformSecureStore {
-    backend = "linux_secret_service";
-    async isAvailable() {
-        return secretToolOnPath();
-    }
-    account(vaultId, kind) {
-        return keychainAccountForSecretKind(vaultId, kind);
-    }
-    async get(vaultId, kind) {
-        const account = this.account(vaultId, kind);
-        try {
-            const { stdout } = await execFileAsync("secret-tool", ["lookup", "service", ELIZA_AGENT_VAULT_SERVICE, "account", account], { encoding: "utf8" });
-            const value = stdout.trim();
-            if (!value)
-                return { ok: false, reason: "not_found" };
-            return { ok: true, value };
-        }
-        catch (err) {
-            const e = err;
-            const stderr = String(e.stderr ?? "");
-            if (e.code === 1 || stderr.includes("not found")) {
-                return { ok: false, reason: "not_found" };
-            }
-            return {
-                ok: false,
-                reason: "error",
-                message: stderr.trim().slice(0, 300),
-            };
-        }
-    }
-    async set(vaultId, kind, value) {
-        const account = this.account(vaultId, kind);
-        try {
-            await secretToolStoreWithStdin([
-                "store",
-                "--label=Eliza agent wallet",
-                "service",
-                ELIZA_AGENT_VAULT_SERVICE,
-                "account",
-                account,
-            ], value);
-            return { ok: true };
-        }
-        catch (err) {
-            const e = err;
-            return {
-                ok: false,
-                reason: "error",
-                message: String(e.stderr ?? err)
-                    .trim()
-                    .slice(0, 300),
-            };
-        }
-    }
-    async delete(vaultId, kind) {
-        const account = this.account(vaultId, kind);
-        try {
-            await execFileAsync("secret-tool", [
-                "clear",
-                "service",
-                ELIZA_AGENT_VAULT_SERVICE,
-                "account",
-                account,
-            ]);
-        }
-        catch {
-            // ignore
-        }
-    }
-}
-class NonePlatformSecureStore {
-    backend;
-    constructor(backend = "none") {
-        this.backend = backend;
-    }
-    async isAvailable() {
-        return false;
-    }
-    async get() {
-        return { ok: false, reason: "unavailable" };
-    }
-    async set() {
-        return { ok: false, reason: "unavailable" };
-    }
-    async delete() { }
-}
-/**
- * Node-side factory: macOS Keychain, Linux `secret-tool`, or unavailable placeholder.
- * Windows Credential Manager is not wired yet (`none`).
- */
-export function createNodePlatformSecureStore() {
-    if (isDarwin()) {
-        return new MacOSKeychainPlatformSecureStore();
-    }
-    if (isLinux()) {
-        return new LinuxSecretToolPlatformSecureStore();
-    }
-    return new NonePlatformSecureStore();
-}
-/**
- * Opt in: `ELIZA_WALLET_OS_STORE=1` / `true` / `on` / `yes`.
- *
- * Defaults to **off** until the macOS argv exposure is resolved via
- * Security.framework / Bun FFI. Users who accept the risk can enable
- * explicitly.
- */
-export function isWalletOsStoreReadEnabled() {
-    const raw = process.env.ELIZA_WALLET_OS_STORE?.trim().toLowerCase();
-    return raw === "1" || raw === "true" || raw === "on" || raw === "yes";
-}

package/packages/app-core/src/security/platform-secure-store.d.ts

@@ -1,47 +0,0 @@
-/**
- * Cross-platform OS secret store — **contract only** (no native bindings here).
- *
- * **Spec:** [Platform secure store (design)](../../../../docs/guides/platform-secure-store.md)
- *
- * Implementations live per runtime (e.g. Electrobun main process, Node CLI with
- * native addons). Wallet and other callers depend on this interface + shared
- * `vaultId` / `secretKind` conventions.
- */
-/** Logical secret slot within a vault (one state profile). */
-export type SecureStoreSecretKind = "wallet.evm_private_key" | "wallet.solana_private_key" | "steward.api_url" | "steward.agent_id" | "steward.agent_token";
-export type SecureStoreUnavailableReason = "not_found" | "denied" | "unavailable" | "error";
-export type SecureStoreGetResult = {
-    ok: true;
-    value: string;
-} | {
-    ok: false;
-    reason: SecureStoreUnavailableReason;
-    message?: string;
-};
-export type SecureStoreSetResult = {
-    ok: true;
-} | {
-    ok: false;
-    reason: SecureStoreUnavailableReason;
-    message?: string;
-};
-/**
- * Which native API backs this implementation (for diagnostics and support).
- */
-export type PlatformSecureStoreBackend = "macos_keychain" | "windows_credential_manager" | "linux_secret_service"
-/** Encrypted file or DPAPI-like blob under state dir — only after explicit consent. */
- | "file_encrypted_fallback"
-/** Legacy / tests: no OS integration. */
- | "none";
-/**
- * Platform-provided secret storage scoped by `vaultId` (see design doc for derivation).
- */
-export interface PlatformSecureStore {
-    readonly backend: PlatformSecureStoreBackend;
-    get(vaultId: string, kind: SecureStoreSecretKind): Promise<SecureStoreGetResult>;
-    set(vaultId: string, kind: SecureStoreSecretKind, value: string): Promise<SecureStoreSetResult>;
-    delete(vaultId: string, kind: SecureStoreSecretKind): Promise<void>;
-    /** True if the backend can run on this host right now (e.g. Secret Service up). */
-    isAvailable(): Promise<boolean>;
-}
-//# sourceMappingURL=platform-secure-store.d.ts.map

package/packages/app-core/src/security/platform-secure-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-secure-store.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/security/platform-secure-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAC7B,wBAAwB,GACxB,2BAA2B,GAC3B,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,4BAA4B,GACpC,WAAW,GACX,QAAQ,GACR,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,4BAA4B,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,4BAA4B,GAC5B,sBAAsB;AACxB,uFAAuF;GACrF,yBAAyB;AAC3B,yCAAyC;GACvC,MAAM,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAE7C,GAAG,CACD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,GAAG,CACD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,mFAAmF;IACnF,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC"}

package/packages/app-core/src/security/platform-secure-store.js

@@ -1,10 +0,0 @@
-/**
- * Cross-platform OS secret store — **contract only** (no native bindings here).
- *
- * **Spec:** [Platform secure store (design)](../../../../docs/guides/platform-secure-store.md)
- *
- * Implementations live per runtime (e.g. Electrobun main process, Node CLI with
- * native addons). Wallet and other callers depend on this interface + shared
- * `vaultId` / `secretKind` conventions.
- */
-export {};

package/packages/app-core/src/services/account-pool.d.ts

@@ -1,98 +0,0 @@
-/**
- * Multi-account selection brain.
- *
- * Owns the runtime decision "which `LinkedAccountConfig` should serve this
- * request?" given a strategy (priority / round-robin / least-used /
- * quota-aware), session affinity, and per-account health state.
- *
- * The pool never reads OAuth credentials directly — callers resolve them
- * via `getAccessToken(providerId, accountId)` from `@elizaos/agent` once
- * the pool returns an account. Health, priority, and usage live in this
- * layer; the OAuth blob lives under `~/.eliza/auth/` (see WS1's
- * `account-storage.ts`).
- *
- * Persistence: the pool layers rich metadata (priority, enabled, health,
- * usage) on top of WS1's credential records. The metadata is written to
- * `<ELIZA_HOME>/auth/_pool-metadata.json` atomically so it survives
- * process restarts and is independent of WS3's eventual `milady.json`
- * field — when WS3 lands its CRUD API on top of `LinkedAccountsConfig`
- * we can swap `createDefaultAccountPool()`'s deps without touching the
- * pool itself.
- */
-import type { LinkedAccountConfig, LinkedAccountProviderId, LinkedAccountsConfig } from "@elizaos/shared";
-export type Strategy = "priority" | "round-robin" | "least-used" | "quota-aware";
-export type PoolProviderId = LinkedAccountProviderId | "anthropic-api" | "openai-api";
-export interface AccountPoolDeps {
-    /** Read the current `LinkedAccountsConfig` (live). */
-    readAccounts: () => Record<string, LinkedAccountConfig>;
-    /** Persist a single account's mutated fields. */
-    writeAccount: (account: LinkedAccountConfig) => Promise<void>;
-    /** Remove the metadata overlay for an account. */
-    deleteAccount?: (providerId: PoolProviderId, accountId: string) => Promise<void>;
-}
-export interface SelectInput {
-    providerId: PoolProviderId;
-    /** Stable session key for affinity (e.g. agent id + run id). */
-    sessionKey?: string;
-    /** Defaults to `"priority"`. */
-    strategy?: Strategy;
-    /** Explicit pool; defaults to all enabled accounts for `providerId`. */
-    accountIds?: string[];
-    /** Account IDs to skip (e.g. just-failed accounts). */
-    exclude?: string[];
-}
-export declare class AccountPool {
-    private readonly deps;
-    private readonly affinity;
-    private readonly roundRobinCursor;
-    constructor(deps: AccountPoolDeps);
-    select(input: SelectInput): Promise<LinkedAccountConfig | null>;
-    private filterEligible;
-    private applyStrategy;
-    list(providerId?: PoolProviderId): LinkedAccountConfig[];
-    get(accountId: string): LinkedAccountConfig | null;
-    upsert(account: LinkedAccountConfig): Promise<void>;
-    deleteMetadata(providerId: PoolProviderId, accountId: string): Promise<void>;
-    recordCall(accountId: string, result: {
-        tokens?: number;
-        latencyMs?: number;
-        ok: boolean;
-        errorCode?: string;
-        model?: string;
-    }): Promise<void>;
-    refreshUsage(accountId: string, accessToken: string, opts?: {
-        codexAccountId?: string;
-        fetch?: typeof fetch;
-    }): Promise<void>;
-    markRateLimited(accountId: string, untilMs: number, detail?: string): Promise<void>;
-    markNeedsReauth(accountId: string, detail?: string): Promise<void>;
-    markInvalid(accountId: string, detail?: string): Promise<void>;
-    markHealthy(accountId: string): Promise<void>;
-    /**
-     * Re-probe accounts whose `health` is non-OK and whose `healthDetail.until`
-     * has passed (or is absent). Used by background sweepers to recover
-     * temporarily flagged accounts. We don't load access tokens here — the
-     * caller probes via `refreshUsage` separately.
-     */
-    reprobeFlagged(): Promise<string[]>;
-}
-/**
- * Module-level singleton for the default pool wired against WS1's
- * `account-storage` and the pool-owned metadata file. Plugins / runtime
- * resolvers should import `getDefaultAccountPool()` rather than building
- * a new pool. WS3 may later swap the default deps to read/write the
- * `LinkedAccountsConfig` field directly out of `milady.json`; consumers
- * keep the same accessor.
- */
-export declare function getDefaultAccountPool(): AccountPool;
-/**
- * @deprecated kept for compatibility with the WS2 spec naming. Use
- * {@link getDefaultAccountPool}.
- */
-export declare function createDefaultAccountPool(): AccountPool;
-/**
- * Resets the cached singleton. Test-only.
- */
-export declare function __resetDefaultAccountPoolForTests(): void;
-export type { LinkedAccountsConfig };
-//# sourceMappingURL=account-pool.d.ts.map

package/packages/app-core/src/services/account-pool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/services/account-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH,OAAO,KAAK,EACV,mBAAmB,EAGnB,uBAAuB,EACvB,oBAAoB,EAErB,MAAM,iBAAiB,CAAC;AAOzB,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,aAAa,CAAC;AAElB,MAAM,MAAM,cAAc,GACtB,uBAAuB,GACvB,eAAe,GACf,YAAY,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,YAAY,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,iDAAiD;IACjD,YAAY,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,kDAAkD;IAClD,aAAa,CAAC,EAAE,CACd,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,CAAC;IAC3B,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAWD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;gBAE1D,IAAI,EAAE,eAAe;IAM3B,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA+BrE,OAAO,CAAC,cAAc;IA6BtB,OAAO,CAAC,aAAa;IAoCrB,IAAI,CAAC,UAAU,CAAC,EAAE,cAAc,GAAG,mBAAmB,EAAE;IAMxD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAI5C,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,cAAc,CAClB,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAOV,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,EAAE,EAAE,OAAO,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,OAAO,CAAC,IAAI,CAAC;IAWV,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;KAAE,GACvD,OAAO,CAAC,IAAI,CAAC;IA2BV,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAkBV,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9D,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnD;;;;;OAKG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAc1C;AAgPD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,CAYnD;AAyED;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,WAAW,CAEtD;AAED;;GAEG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAED,YAAY,EAAE,oBAAoB,EAAE,CAAC"}