@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.5

package/api/server-auth.js

@@ -0,0 +1,504 @@
+/**
+ * Auth, security, and WebSocket authorization helpers extracted from server.ts.
+ */
+import crypto from "node:crypto";
+import { isIP } from "node:net";
+import path from "node:path";
+import { logger, sendJsonError } from "@elizaos/core";
+import { isCloudProvisionedContainer, resolveApiSecurityConfig, resolveApiToken, setApiToken, } from "@elizaos/shared";
+import { BLOCKED_ENV_KEYS } from "./plugin-discovery-helpers.js";
+// ---------------------------------------------------------------------------
+// Auth token extraction
+// ---------------------------------------------------------------------------
+export function extractAuthToken(req) {
+    const rawAuth = typeof req.headers.authorization === "string"
+        ? req.headers.authorization
+        : "";
+    const auth = rawAuth.length > 8192 ? rawAuth.slice(0, 8192).trim() : rawAuth.trim();
+    if (auth &&
+        auth.length >= 7 &&
+        auth.slice(0, 7).toLowerCase() === "bearer ") {
+        const token = auth.slice(7).trim();
+        if (token)
+            return token;
+    }
+    const header = (typeof req.headers["x-eliza-token"] === "string" &&
+        req.headers["x-eliza-token"]) ||
+        (typeof req.headers["x-eliza-token"] === "string" &&
+            req.headers["x-eliza-token"]) ||
+        (typeof req.headers["x-api-key"] === "string" && req.headers["x-api-key"]);
+    if (typeof header === "string" && header.trim())
+        return header.trim();
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Token / API auth helpers
+// ---------------------------------------------------------------------------
+export function tokenMatches(expected, provided) {
+    const a = Buffer.from(expected, "utf8");
+    const b = Buffer.from(provided, "utf8");
+    if (a.length !== b.length)
+        return false;
+    return crypto.timingSafeEqual(a, b);
+}
+export function getConfiguredApiToken() {
+    return resolveApiToken(process.env) ?? undefined;
+}
+function firstHeaderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return null;
+}
+const CLIENT_IP_PROXY_HEADERS = new Set([
+    "forwarded",
+    "forwarded-for",
+    "x-forwarded",
+    "x-forwarded-for",
+    "x-original-forwarded-for",
+    "x-real-ip",
+    "x-client-ip",
+    "x-forwarded-client-ip",
+    "x-cluster-client-ip",
+    "cf-connecting-ip",
+    "true-client-ip",
+    "fastly-client-ip",
+    "x-appengine-user-ip",
+    "x-azure-clientip",
+]);
+function headerValues(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === "string");
+    }
+    return [];
+}
+function isClientIpProxyHeaderName(name) {
+    const normalized = name.toLowerCase();
+    return (CLIENT_IP_PROXY_HEADERS.has(normalized) ||
+        normalized.endsWith("-client-ip") ||
+        normalized.endsWith("-connecting-ip") ||
+        normalized.endsWith("-real-ip"));
+}
+function extractForwardedForCandidates(raw) {
+    const candidates = [];
+    const pattern = /(?:^|[;,])\s*for=(?:"([^"]*)"|([^;,]*))/gi;
+    for (const match of raw.matchAll(pattern)) {
+        candidates.push(match[1] ?? match[2] ?? "");
+    }
+    return candidates;
+}
+function extractProxyClientAddressCandidates(headerName, raw) {
+    if (headerName === "forwarded") {
+        return extractForwardedForCandidates(raw);
+    }
+    const forwardedCandidates = raw.toLowerCase().includes("for=")
+        ? extractForwardedForCandidates(raw)
+        : [];
+    if (forwardedCandidates.length > 0)
+        return forwardedCandidates;
+    return raw.split(",");
+}
+function stripMatchingQuotes(value) {
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function isNeutralProxyClientAddress(raw) {
+    const normalized = stripMatchingQuotes(raw).trim().toLowerCase();
+    return (!normalized ||
+        normalized === "unknown" ||
+        normalized === "null" ||
+        normalized.startsWith("_"));
+}
+function normalizeProxyClientIp(raw) {
+    let normalized = stripMatchingQuotes(raw).trim();
+    if (!normalized)
+        return null;
+    if (normalized.startsWith("[")) {
+        const close = normalized.indexOf("]");
+        if (close > 0) {
+            normalized = normalized.slice(1, close);
+        }
+    }
+    else {
+        const ipv4HostPort = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)$/.exec(normalized);
+        if (ipv4HostPort?.[1]) {
+            normalized = ipv4HostPort[1];
+        }
+    }
+    const zoneIndex = normalized.indexOf("%");
+    if (zoneIndex >= 0) {
+        normalized = normalized.slice(0, zoneIndex);
+    }
+    normalized = normalized.trim().toLowerCase();
+    return isIP(normalized) ? normalized : null;
+}
+function isLoopbackProxyClientIp(ip) {
+    const normalized = ip.trim().toLowerCase();
+    return (normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized.startsWith("127.") ||
+        normalized.startsWith("::ffff:127.") ||
+        normalized.startsWith("::ffff:0:127."));
+}
+function proxyClientHeaderBlocksLocalTrust(headers) {
+    for (const [rawName, rawValue] of Object.entries(headers)) {
+        const headerName = rawName.toLowerCase();
+        if (!isClientIpProxyHeaderName(headerName))
+            continue;
+        for (const value of headerValues(rawValue)) {
+            for (const candidate of extractProxyClientAddressCandidates(headerName, value)) {
+                if (isNeutralProxyClientAddress(candidate))
+                    continue;
+                const ip = normalizeProxyClientIp(candidate);
+                if (!ip || !isLoopbackProxyClientIp(ip))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1" ||
+        normalized === "::ffff:0:127.0.0.1");
+}
+export function isLoopbackBindHost(host) {
+    let normalized = host.trim().toLowerCase();
+    if (!normalized)
+        return true;
+    // Allow users to provide full URLs by mistake (e.g. http://localhost:2138)
+    if (normalized.startsWith("http://") || normalized.startsWith("https://")) {
+        try {
+            const parsed = new URL(normalized);
+            normalized = parsed.hostname.toLowerCase();
+        }
+        catch {
+            // Fall through and parse as raw host value.
+        }
+    }
+    // [::1]:2138 -> ::1
+    const bracketedIpv6 = /^\[([^\]]+)\](?::\d+)?$/.exec(normalized);
+    if (bracketedIpv6?.[1]) {
+        normalized = bracketedIpv6[1];
+    }
+    else {
+        // localhost:2138 -> localhost, 127.0.0.1:2138 -> 127.0.0.1
+        const singleColonHostPort = /^([^:]+):(\d+)$/.exec(normalized);
+        if (singleColonHostPort?.[1]) {
+            normalized = singleColonHostPort[1];
+        }
+    }
+    normalized = normalized.replace(/^\[|\]$/g, "");
+    if (!normalized)
+        return true;
+    if (normalized === "localhost" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1") {
+        return true;
+    }
+    if (normalized.startsWith("127."))
+        return true;
+    return false;
+}
+function isTrustedLocalOrigin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return true;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol === "file:" ||
+            parsed.protocol === "app:" ||
+            parsed.protocol === "tauri:" ||
+            parsed.protocol === "capacitor:" ||
+            parsed.protocol === "capacitor-electron:" ||
+            parsed.protocol === "electrobun:") {
+            return true;
+        }
+        return isLoopbackBindHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isTrustedLocalRequest(req) {
+    if (isCloudProvisionedContainer())
+        return false;
+    if (!isLoopbackRemoteAddress(req.socket.remoteAddress))
+        return false;
+    if (proxyClientHeaderBlocksLocalTrust(req.headers))
+        return false;
+    const host = firstHeaderValue(req.headers.host);
+    if (host && !isLoopbackBindHost(host))
+        return false;
+    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
+    if (secFetchSite === "cross-site")
+        return false;
+    const origin = firstHeaderValue(req.headers.origin);
+    if (origin && !isTrustedLocalOrigin(origin))
+        return false;
+    const referer = firstHeaderValue(req.headers.referer);
+    if (!origin && referer && !isTrustedLocalOrigin(referer))
+        return false;
+    return true;
+}
+export function ensureApiTokenForBindHost(host) {
+    if (resolveApiSecurityConfig(process.env).disableAutoApiToken) {
+        return;
+    }
+    const token = getConfiguredApiToken();
+    if (token)
+        return;
+    const cloudProvisioned = isCloudProvisionedContainer();
+    if (!cloudProvisioned && isLoopbackBindHost(host))
+        return;
+    const generated = crypto.randomBytes(32).toString("hex");
+    setApiToken(process.env, generated);
+    if (cloudProvisioned) {
+        logger.warn("[eliza-api] Steward-managed cloud container started without ELIZA_API_TOKEN; generated a temporary inbound API token for this process.");
+    }
+    else {
+        logger.warn(`[eliza-api] ELIZA_API_BIND=${host} is non-loopback and ELIZA_API_TOKEN is unset.`);
+    }
+    const tokenFingerprint = `${generated.slice(0, 4)}...${generated.slice(-4)}`;
+    logger.warn(`[eliza-api] Generated temporary API token (${tokenFingerprint}) for this process. Set ELIZA_API_TOKEN explicitly to override.`);
+}
+export function isAuthorized(req) {
+    if (isTrustedLocalRequest(req))
+        return true;
+    const expected = getConfiguredApiToken();
+    if (!expected)
+        return false;
+    const provided = extractAuthToken(req);
+    if (!provided)
+        return false;
+    return tokenMatches(expected, provided);
+}
+export function resolvePluginConfigMutationRejections(pluginParams, config) {
+    const allowedParamKeys = new Set(pluginParams.map((p) => p.key.toUpperCase().trim()));
+    const rejections = [];
+    for (const key of Object.keys(config)) {
+        const normalized = key.toUpperCase().trim();
+        if (!allowedParamKeys.has(normalized)) {
+            rejections.push({
+                field: key,
+                message: `${key} is not a declared config key for this plugin`,
+            });
+            continue;
+        }
+        if (BLOCKED_ENV_KEYS.has(normalized)) {
+            rejections.push({
+                field: key,
+                message: `${key} is blocked for security reasons`,
+            });
+        }
+    }
+    return rejections;
+}
+export function resolveWalletExportRejection(req, body) {
+    if (!body.confirm) {
+        return {
+            status: 403,
+            reason: 'Export requires explicit confirmation. Send { "confirm": true } in the request body.',
+        };
+    }
+    const expected = process.env.ELIZA_WALLET_EXPORT_TOKEN?.trim();
+    if (!expected) {
+        return {
+            status: 403,
+            reason: "Wallet export is disabled. Set ELIZA_WALLET_EXPORT_TOKEN to enable secure exports.",
+        };
+    }
+    const headerToken = typeof req.headers["x-eliza-export-token"] === "string"
+        ? req.headers["x-eliza-export-token"].trim()
+        : "";
+    const bodyToken = typeof body.exportToken === "string" ? body.exportToken.trim() : "";
+    const provided = headerToken || bodyToken;
+    if (!provided) {
+        return {
+            status: 401,
+            reason: "Missing export token. Provide X-Eliza-Export-Token header or exportToken in request body.",
+        };
+    }
+    if (!tokenMatches(expected, provided)) {
+        return { status: 401, reason: "Invalid export token." };
+    }
+    return null;
+}
+export function resolveTerminalRunRejection(req, body) {
+    const expected = process.env.ELIZA_TERMINAL_RUN_TOKEN?.trim();
+    const apiTokenEnabled = Boolean(getConfiguredApiToken());
+    // Compatibility mode: local loopback sessions without API token keep
+    // existing behavior unless an explicit terminal token is configured.
+    if (!expected && !apiTokenEnabled) {
+        return null;
+    }
+    if (!expected) {
+        return {
+            status: 403,
+            reason: "Terminal run is disabled for token-authenticated API sessions. Set ELIZA_TERMINAL_RUN_TOKEN to enable command execution.",
+        };
+    }
+    const headerToken = typeof req.headers["x-eliza-terminal-token"] === "string"
+        ? req.headers["x-eliza-terminal-token"].trim()
+        : "";
+    const bodyToken = typeof body.terminalToken === "string" ? body.terminalToken.trim() : "";
+    const provided = headerToken || bodyToken;
+    if (!provided) {
+        return {
+            status: 401,
+            reason: "Missing terminal token. Provide X-Eliza-Terminal-Token header or terminalToken in request body.",
+        };
+    }
+    if (!tokenMatches(expected, provided)) {
+        return {
+            status: 401,
+            reason: "Invalid terminal token.",
+        };
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// WebSocket auth helpers
+// ---------------------------------------------------------------------------
+export function extractWsQueryToken(url) {
+    const allowQueryToken = process.env.ELIZA_ALLOW_WS_QUERY_TOKEN === "1";
+    if (!allowQueryToken)
+        return null;
+    const token = url.searchParams.get("token") ??
+        url.searchParams.get("apiKey") ??
+        url.searchParams.get("api_key");
+    return token?.trim() || null;
+}
+export function hasWsQueryToken(url) {
+    return (url.searchParams.has("token") ||
+        url.searchParams.has("apiKey") ||
+        url.searchParams.has("api_key"));
+}
+export function extractWebSocketHandshakeToken(request, url) {
+    const headerToken = extractAuthToken(request);
+    if (headerToken)
+        return headerToken;
+    return extractWsQueryToken(url);
+}
+export function isWebSocketAuthorized(request, url) {
+    const expected = getConfiguredApiToken();
+    if (!expected)
+        return !isCloudProvisionedContainer();
+    const handshakeToken = extractWebSocketHandshakeToken(request, url);
+    if (!handshakeToken)
+        return false;
+    return tokenMatches(expected, handshakeToken);
+}
+export function resolveWebSocketUpgradeRejection(req, wsUrl, resolveCorsOrigin = () => null) {
+    if (wsUrl.pathname !== "/ws") {
+        return { status: 404, reason: "Not found" };
+    }
+    const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+    const allowedOrigin = resolveCorsOrigin(origin);
+    if (origin && !allowedOrigin) {
+        return { status: 403, reason: "Origin not allowed" };
+    }
+    const expected = getConfiguredApiToken();
+    if (!expected) {
+        return isCloudProvisionedContainer()
+            ? { status: 401, reason: "Unauthorized" }
+            : null;
+    }
+    // Note: we used to reject upgrades when a query token was present but
+    // ELIZA_ALLOW_WS_QUERY_TOKEN was not "1". That veto was actively harmful —
+    // browsers cannot set Authorization on `new WebSocket(url)`, so SPAs have no
+    // option but to pass the token in the URL. extractWsQueryToken() already
+    // returns null when the flag is off, so handshakeToken simply falls through
+    // to header-or-null and the post-open `{type:"auth"}` fallback covers
+    // self-hosted setups behind header-aware upstream proxies.
+    const handshakeToken = extractWebSocketHandshakeToken(req, wsUrl);
+    if (handshakeToken && !tokenMatches(expected, handshakeToken)) {
+        return { status: 401, reason: "Unauthorized" };
+    }
+    // Cloud containers must authenticate at the handshake level because there is
+    // no trusted upstream proxy handling auth for the WebSocket path.
+    if (!handshakeToken && isCloudProvisionedContainer()) {
+        return { status: 401, reason: "Unauthorized" };
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// State dir safety check
+// ---------------------------------------------------------------------------
+const RESET_STATE_ALLOWED_SEGMENTS = new Set(["eliza"]);
+function hasAllowedResetSegment(resolvedState) {
+    return resolvedState
+        .split(path.sep)
+        .some((segment) => RESET_STATE_ALLOWED_SEGMENTS.has(segment.trim().toLowerCase()));
+}
+export function isSafeResetStateDir(resolvedState, homeDir) {
+    const normalizedState = path.resolve(resolvedState);
+    const normalizedHome = path.resolve(homeDir);
+    const parsedRoot = path.parse(normalizedState).root;
+    if (normalizedState === parsedRoot)
+        return false;
+    if (normalizedState === normalizedHome)
+        return false;
+    const relativeToHome = path.relative(normalizedHome, normalizedState);
+    const isUnderHome = relativeToHome.length > 0 &&
+        !relativeToHome.startsWith("..") &&
+        !path.isAbsolute(relativeToHome);
+    if (!isUnderHome)
+        return false;
+    return hasAllowedResetSegment(normalizedState);
+}
+export async function persistConversationRoomTitle(runtime, conversation) {
+    if (!runtime)
+        return false;
+    const room = await runtime.getRoom(conversation.roomId);
+    if (!room)
+        return false;
+    if (room.name === conversation.title)
+        return false;
+    const adapter = runtime.adapter;
+    if (typeof adapter.updateRoom !== "function")
+        return false;
+    await adapter.updateRoom({ ...room, name: conversation.title });
+    return true;
+}
+// ---------------------------------------------------------------------------
+// WebSocket rejection & path decoding
+// ---------------------------------------------------------------------------
+export function rejectWebSocketUpgrade(socket, statusCode, message) {
+    const statusText = statusCode === 401
+        ? "Unauthorized"
+        : statusCode === 403
+            ? "Forbidden"
+            : statusCode === 404
+                ? "Not Found"
+                : "Bad Request";
+    const body = `${message}\n`;
+    socket.write(`HTTP/1.1 ${statusCode} ${statusText}\r\n` +
+        "Connection: close\r\n" +
+        "Content-Type: text/plain; charset=utf-8\r\n" +
+        `Content-Length: ${Buffer.byteLength(body)}\r\n` +
+        "\r\n" +
+        body, () => socket.end());
+}
+export function decodePathComponent(raw, res, fieldName) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        sendJsonError(res, `Invalid ${fieldName}: malformed URL encoding`, 400);
+        return null;
+    }
+}

package/api/server-autonomy-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-autonomy-helpers.d.ts","sourceRoot":"","sources":["../../src/api/server-autonomy-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMnE;AAED,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/api/server-helpers-auth.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Auth, CORS, pairing, terminal, and WebSocket auth helpers extracted from server.ts.
+ */
+import type http from "node:http";
+export declare const CORS_ALLOWED_HEADERS: string;
+export declare function isAllowedHost(req: http.IncomingMessage): boolean;
+export declare function resolveCorsOrigin(origin?: string): string | null;
+export declare function applyCors(req: http.IncomingMessage, res: http.ServerResponse, pathname: string): boolean;
+export declare function getConfiguredApiToken(): string | undefined;
+export declare function extractAuthToken(req: http.IncomingMessage): string | null;
+export type WaifuChatRole = "admin" | "user" | "guest";
+export type WaifuChatWorldRole = "OWNER" | "USER" | "GUEST";
+export declare function waifuChatRoleToWorldRole(role: WaifuChatRole): WaifuChatWorldRole;
+export interface WaifuChatAccess {
+    role: WaifuChatRole;
+    walletAddress: string;
+    tokenAddress?: string;
+    chainId?: number;
+    cloudAgentId?: string;
+    balanceTokens?: number | null;
+}
+export declare function resolveWaifuChatAccessToken(token: string | null | undefined, nowSeconds?: number): WaifuChatAccess | null;
+export declare function resolveWaifuChatAccess(req: http.IncomingMessage): WaifuChatAccess | null;
+export declare function isWaifuChatAuthorized(req: http.IncomingMessage, method: string, pathname: string): boolean;
+export declare function isTrustedLocalRequest(req: http.IncomingMessage): boolean;
+/**
+ * True when the request carries a valid `X-Server-Token` matching the
+ * configured `AGENT_SERVER_SHARED_SECRET`. When the secret is unset this always
+ * returns false, so the header carries no authority and there is no regression
+ * for deployments that never configure it.
+ */
+export declare function isServerTokenAuthorized(req: http.IncomingMessage): boolean;
+export declare function isAuthorized(req: http.IncomingMessage): boolean;
+export declare function ensureApiTokenForBindHost(host: string): void;
+export declare function pairingEnabled(): boolean;
+export declare function normalizePairingCode(code: string): string;
+export declare function ensurePairingCode(): string | null;
+export declare function rateLimitPairing(ip: string | null): boolean;
+export declare function getPairingExpiresAt(): number;
+export declare function clearPairing(): void;
+export declare function normalizeWsClientId(value: unknown): string | null;
+export declare function resolveTerminalRunClientId(req: Pick<http.IncomingMessage, "headers">, body: {
+    clientId?: unknown;
+} | null | undefined): string | null;
+export declare function isSharedTerminalClientId(clientId: string): boolean;
+interface TerminalRunRequestBody {
+    terminalToken?: string;
+}
+export interface TerminalRunRejection {
+    status: 401 | 403;
+    reason: string;
+}
+export declare function resolveTerminalRunRejection(req: http.IncomingMessage, body: TerminalRunRequestBody): TerminalRunRejection | null;
+export declare function isWebSocketAuthorized(request: http.IncomingMessage, url: URL): boolean;
+export interface WebSocketUpgradeRejection {
+    status: 401 | 403 | 404;
+    reason: string;
+}
+export declare function resolveWebSocketUpgradeRejection(req: http.IncomingMessage, wsUrl: URL): WebSocketUpgradeRejection | null;
+export declare function rejectWebSocketUpgrade(socket: import("node:stream").Duplex, statusCode: number, message: string): void;
+export {};
+//# sourceMappingURL=server-helpers-auth.d.ts.map

package/api/server-helpers-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-helpers-auth.d.ts","sourceRoot":"","sources":["../../src/api/server-helpers-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAyBlC,eAAO,MAAM,oBAAoB,QAoBrB,CAAC;AAcb,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CA0ChE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA+BhE;AAqCD,wBAAgB,SAAS,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAsCT;AAaD,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAkCD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CA8BzE;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AACvD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5D,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,aAAa,GAClB,kBAAkB,CAIpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AA0CD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,UAAU,SAAgC,GACzC,eAAe,GAAG,IAAI,CAiFxB;AAED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,CAAC,eAAe,GACxB,eAAe,GAAG,IAAI,CAExB;AAsBD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAsLD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CA0BxE;AA6BD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAM1E;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAY/D;AA2CD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiC5D;AAeD,wBAAgB,cAAc,IAAI,OAAO,CAKxC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAUD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAWjD;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAe3D;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAGnC;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMjE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,MAAM,GAAG,IAAI,CAMf;AAOD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AA0BD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,GACT,yBAAyB,GAAG,IAAI,CAuClC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN"}