@gate-forge/pack-playwright 0.7.1 → 0.8.0

package/dist/discovery/prepare-barrier.d.ts

@@ -0,0 +1,522 @@
+/**
+ * The GLOBAL native preparation freeze barrier (contract: "ONE native
+ * process, ONE GLOBAL prepared snapshot").
+ *
+ * Why this exists. A Playwright config's prerequisite (`setup`) projects
+ * produce their artifacts — the saved `playwright/.auth/user.json` of the
+ * standard auth pattern above all — WHILE the behavioral projects are
+ * already scheduled to run. Gateforge's candidate freeze, on the other
+ * hand, is taken BEFORE the runner starts, so a run whose setup writes
+ * generated bytes into the workspace always ends with a candidate tree
+ * that no longer equals the frozen one, and no receipt is ever sealed.
+ * That is the honest failure this module removes — not by excluding the
+ * generated bytes (that would weaken every binding), but by taking ONE
+ * prepared snapshot AFTER the whole prerequisite stage and BEFORE any
+ * body project, and then demanding the workspace stay exactly that.
+ *
+ * The shape of the barrier, and why each part exists:
+ *
+ * - ONE controller project. The engine adds a project of its own that
+ *   depends on the FULL upstream prerequisite closure of the planned
+ *   graph, and gives every non-prerequisite planned project that
+ *   controller as its FIRST dependency (its own captured edges follow,
+ *   unchanged, in their emitted order). Prerequisites keep their edges
+ *   exactly as captured. The runner's own phase scheduler then orders
+ *   prerequisite → controller → body inside ONE process, with the
+ *   runner's real dependency semantics — not a second process, not a flag.
+ * - The controller is a real Playwright test, because the environment
+ *   leak it has to undo happens in WORKERS: the native scheduler unions
+ *   every dependency worker's produced environment into its dependents
+ *   (`runner/tasks.js`), so merely emitting an empty controller project
+ *   would hand each body the whole preparation environment.
+ * - A REQUEST/RELEASE handshake. The controller writes a request naming
+ *   the exact run, invocation and per-invocation nonce; the trusted CLI
+ *   — the only process holding supervisor credentials — validates every
+ *   prerequisite identity against the authenticated witness execution
+ *   trace, freezes, and answers with a SIGNED release. A request that
+ *   never comes, an unsigned release, a release for another
+ *   run/invocation/nonce, and a release whose bound controller spec
+ *   bytes no longer hash to what the CLI pinned are all refusals, and a
+ *   controller that never receives a valid release fails its own bounded
+ *   wait instead of letting the bodies run unfrozen.
+ * - An ephemeral Ed25519 signature. A release is a file, and a file at
+ *   this boundary is forgeable by any code running as the same user. The
+ *   private key is minted per invocation and never leaves the CLI
+ *   process — never a child environment, never a file; the controller
+ *   receives only the public key. Same-UID modify/restore or in-process
+ *   tampering stays OUTSIDE this boundary (this is not a filesystem
+ *   sandbox); what the signature closes is an ordinary control-file
+ *   forgery and any replay of an older or different release.
+ *
+ * Honesty boundary (repeated on purpose): this is a CONTROL barrier, not
+ * a physical one. It orders one native process, proves the prerequisites
+ * really passed under supervision, and proves the workspace did not move
+ * between the freeze and the seal. It does not make the source read-only.
+ */
+import { type KeyObject } from 'node:crypto';
+import type { ProjectScope } from './trusted-config.js';
+/** The engine-owned controller project name (never a candidate project). */
+export declare const FREEZE_CONTROLLER_PROJECT = "gateforge-freeze";
+/**
+ * Directory (inside the excluded run-state dir) holding the barrier's
+ * handshake DOCUMENTS — the controller's request, the CLI's signed
+ * release and its refusal document. They are evidence about the run,
+ * not test-shaped files, so they stay where the CLI pins and seals
+ * them.
+ *
+ * The generated controller SPEC is deliberately NOT here: a `.mjs` spec
+ * file inside the repository is a file a consumer's own Playwright
+ * configuration can collect (see {@link FREEZE_CONTROL_SPEC_FILE}).
+ */
+export declare const FREEZE_CONTROL_DIR = "native-freeze";
+/**
+ * The generated controller spec: the ONE worker that performs the handshake.
+ *
+ * Plain ESM JavaScript under an `.mjs` name, deliberately. The runner
+ * decides a file's module kind from its extension first and only then from
+ * the nearest `package.json` `type`, and a consumer repository may sit
+ * under EITHER: a CommonJS/default root would have this spec `require`d,
+ * which turns its ESM imports into `require()` of a `file:` URL and fails
+ * to load at all. `.mjs` fixes the module kind on the file itself, so the
+ * controller's imports resolve as real ESM imports whatever the
+ * consumer's root package says — no manifest inspection, no install
+ * restriction, and no candidate module ever loaded by the CLI. The
+ * consequence is that the generated bytes must stay plain JavaScript:
+ * nothing TypeScript-only may reappear in the template below.
+ *
+ * WHERE the file is written follows from what it IS: a parseable test
+ * file. Inside the repository it is a candidate the consumer's own
+ * runner collects — a config at the repo root with no restricting
+ * `testDir` enumerates every parseable file below it, so an engine spec
+ * parked in the run-state subtree was still enumerated as a consumer
+ * case, by the engine's own `--list` and by the owner's `npx playwright
+ * test` alike. It is therefore written into a private per-run directory
+ * OUTSIDE the repository ({@link FreezeControl.specDir}) and removed
+ * once the run no longer reads it.
+ */
+export declare const FREEZE_CONTROL_SPEC_FILE = "freeze-controller.spec.mjs";
+/** The controller's request document (written by the controller worker). */
+export declare const FREEZE_REQUEST_FILE = "freeze-request.json";
+/** The CLI's signed release document (read by the controller worker). */
+export declare const FREEZE_RELEASE_FILE = "freeze-release.json";
+/**
+ * The trusted CLI's REFUSAL document (read by the controller worker).
+ *
+ * The handshake needs a failure channel as well as a success one, or a
+ * permanent refusal turns into a bounded-but-slow timeout: the trusted
+ * side answers "your prerequisite sealed as failed", and the controller
+ * should stop waiting the moment it hears that, not poll to its own long
+ * bound. This file is FAILURE ONLY. Nothing here can ever unblock a body
+ * project — only a correctly signed `FREEZE_RELEASE_FILE` does — so a
+ * controller that trusts this document can only ever fail earlier, never
+ * proceed. A forged refusal therefore costs a run its barrier, which the
+ * signing already guarantees; a missing one costs nothing.
+ */
+export declare const FREEZE_REFUSAL_FILE = "freeze-refusal.json";
+/**
+ * Environment names the runner itself owns in every worker process, and
+ * which the projection must therefore never touch.
+ *
+ * The reason is structural, read from the runner itself:
+ * `worker/workerMain.js` assigns `TEST_WORKER_INDEX` and
+ * `TEST_PARALLEL_INDEX` AFTER the process booted, and
+ * `runner/workerHost.js` spreads `FORCE_COLOR` and `DEBUG_COLORS` into
+ * every worker's environment at spawn. `lib/common/process.js` computes
+ * the produced-environment diff against the worker's OWN boot
+ * environment, so all four names appear in a produced diff without any
+ * prerequisite having written them — a subtraction reset that touched
+ * them would report a deletion the bodies then inherit.
+ *
+ * The reset set is otherwise derived BY SUBTRACTION — every key in the
+ * controller's environment or in the trusted baseline, minus these four.
+ * That is equivalent to a positively-owned namespace ONLY under the
+ * invariant below, and the invariant is the real risk: nothing in the
+ * run pins it, so a future change that starts injecting environment into
+ * workers beyond these names would be silently projected away rather
+ * than reported.
+ *
+ * Gateforge injects nothing into worker environment beyond the runner
+ * child's own baseline: `buildRunnerChildEnv` refuses run-state paths
+ * and signing material, and the freeze control reaches the controller
+ * inlined in its generated spec rather than through the environment.
+ * Under that invariant the worker's environment is the baseline, plus
+ * preparation-written keys, plus these four names — so the reset set is
+ * exactly the baseline keys a prerequisite overrode (restored) and the
+ * keys a prerequisite introduced (deleted), whatever they are named.
+ */
+export declare const FREEZE_ENV_EXEMPT: readonly string[];
+/** One armed freeze barrier (paths, identities and the pinned spec bytes). */
+export interface FreezeControl {
+    /** Engine-owned controller project name. */
+    project: string;
+    /** The run identity (bound into request AND release). */
+    runId: string;
+    /** The invocation identity (bound into request AND release). */
+    invocationId: string;
+    /** Per-invocation random nonce; an old release can never match it. */
+    nonce: string;
+    /**
+     * Absolute path of the state-directory control directory: the request,
+     * release and refusal documents. NEVER the spec — see
+     * {@link FreezeControl.specDir}.
+     */
+    controlDir: string;
+    /**
+     * Absolute, symlink-RESOLVED path of the private per-run directory that
+     * holds the generated controller spec.
+     *
+     * It is a fresh `mkdtemp` directory under the host temporary
+     * directory, outside the repository, so no consumer enumeration can
+     * collect the spec and nothing this run generates can end up among the
+     * candidate's own bytes. `realpath` matters because a temporary
+     * directory is commonly a symlink (`/tmp` → `/private/tmp`): the
+     * runner reports the spec under the `testDir` it was handed and the
+     * reporter compares resolved paths, so both sides must name the same
+     * physical file. It is owner-only and holds nothing but the spec, and
+     * the CLI removes it ({@link removeFreezeSpecDir}) once the run has
+     * read the spec for the last time.
+     */
+    specDir: string;
+    /** Absolute path of the generated controller spec (inside `specDir`). */
+    specPath: string;
+    /** Absolute path of the request document. */
+    requestPath: string;
+    /** Absolute path of the release document. */
+    releasePath: string;
+    /**
+     * Absolute path of the selected install's CommonJS test module
+     * (`@playwright/test`'s package root, or `playwright/test`) that the
+     * runner this run uses, resolved from the install this run actually
+     * spawns. The generated controller is an ES module and this module is
+     * CommonJS, so it is bound through the module's default export — the
+     * ordinary interop for a CommonJS module, and the same file every
+     * body in this run executes against.
+     */
+    testModulePath: string;
+    /** Absolute engine module the controller imports its primitives from. */
+    barrierModulePath: string;
+    /** Absolute path of the CLI's REFUSAL document (failure channel only). */
+    refusalPath: string;
+    /** Base64 raw SPKI Ed25519 PUBLIC key (the private key never leaves the CLI). */
+    releasePublicKey: string;
+    /** How long the controller waits for a valid release before failing. */
+    timeoutMs: number;
+    /**
+     * The trusted runner MAIN/child environment BEFORE any project worker
+     * ran — the exact baseline every body worker must be projected back to.
+     * It is the child's OWN allowlisted environment, never the CLI's ambient
+     * environment and never anything secret: the worker it describes already
+     * runs with these very values.
+     */
+    baseEnv: Readonly<Record<string, string>>;
+    /** Environment names the projection must never touch. */
+    exemptEnv: readonly string[];
+}
+/** What the CLI hands the pack to arm one barrier. */
+export interface FreezeArmInput {
+    /** The run identity. */
+    runId: string;
+    /** The invocation identity. */
+    invocationId: string;
+    /** Per-invocation random nonce. */
+    nonce: string;
+    /**
+     * Absolute run-state dir. The barrier's handshake DOCUMENTS live in
+     * its excluded subtree; the generated spec does not (it is written
+     * outside the repository).
+     */
+    stateDir: string;
+    /** Absolute path of the selected install's CommonJS test module. */
+    testModulePath: string;
+    /** Base64 raw SPKI Ed25519 public key for the release signature. */
+    releasePublicKey: string;
+    /** The trusted runner child's baseline environment. */
+    baseEnv: Readonly<Record<string, string>>;
+    /** How long the controller waits for a valid release. */
+    timeoutMs: number;
+}
+/** The armed barrier plus the sha256 of the exact spec bytes written. */
+export interface ArmedFreezeControl {
+    control: FreezeControl;
+    /** sha256 hex of the controller spec file the CLI pinned in memory. */
+    specDigest: string;
+}
+/** The signed release payload (exactly what the signature covers). */
+export interface FreezeReleasePayload {
+    schemaVersion: 1;
+    project: string;
+    runId: string;
+    invocationId: string;
+    nonce: string;
+    /** The prepared candidate tree the freeze produced. */
+    preparedTreeId: string;
+    /** sha256 of the controller spec bytes the CLI pinned before the run. */
+    specDigest: string;
+    /** ISO timestamp of the freeze (diagnostic; inside the signature). */
+    sealedAt: string;
+}
+/** The signed release document the CLI writes and the controller reads. */
+export interface FreezeReleaseDocument {
+    schemaVersion: 1;
+    payload: FreezeReleasePayload;
+    /** Base64 Ed25519 signature over `canonicalFreezeJson(payload)`. */
+    signature: string;
+}
+/** One controller request (written by the controller worker). */
+export interface FreezeRequest {
+    schemaVersion: 1;
+    project: string;
+    runId: string;
+    invocationId: string;
+    nonce: string;
+    /** ISO timestamp the controller asked (diagnostic). */
+    requestedAt: string;
+}
+/**
+ * Deterministic canonical JSON: object keys sorted, no insignificant
+ * whitespace. The CLI signs exactly these bytes and the controller
+ * verifies exactly these bytes, so neither side may depend on a property
+ * order or a serializer default.
+ *
+ * @param value: any JSON-compatible value.
+ *
+ * @returns
+ *   string: the canonical form.
+ */
+export declare function canonicalFreezeJson(value: unknown): string;
+/** One ephemeral per-invocation Ed25519 release-signing key pair. */
+export interface FreezeSigningKeyPair {
+    /** The public key object (verification only). */
+    publicKey: KeyObject;
+    /** The same public key as base64 raw SPKI, for the control data. */
+    publicKeyBase64: string;
+    /** The private key — CLI memory only, never a file or an environment. */
+    privateKey: KeyObject;
+}
+/**
+ * Mints one ephemeral Ed25519 key pair for the release signature. The
+ * private key is returned to the CLI and NEVER written anywhere: not the
+ * trusted config, not the run state, not a child environment.
+ *
+ * @returns
+ *   FreezeSigningKeyPair: the pair, with the public key already
+ *   base64-encoded as raw SPKI.
+ */
+export declare function mintFreezeSigningKeyPair(): FreezeSigningKeyPair;
+/**
+ * Signs one release payload with the invocation's ephemeral private key.
+ *
+ * @param privateKey: the ephemeral key (CLI memory only).
+ * @param payload: the payload to sign.
+ *
+ * @returns
+ *   FreezeReleaseDocument: the document the controller verifies.
+ */
+export declare function signFreezeRelease(privateKey: KeyObject, payload: FreezeReleasePayload): FreezeReleaseDocument;
+/**
+ * Verifies one release document against the pinned public key and the
+ * exact identities the controller itself was armed with.
+ *
+ * A release passes only when ALL of these hold: the document shape, the
+ * Ed25519 signature under the pinned key, the controller project name, the
+ * run, the invocation, the per-invocation nonce, and the sha256 of the
+ * controller's OWN current spec bytes. The last check is what makes a
+ * replaced control file detectable rather than trusted.
+ *
+ * @param document: the parsed release document.
+ * @param publicKeyBase64: the pinned base64 raw SPKI public key.
+ * @param expected: the identities and spec digest the controller was armed with.
+ *
+ * @returns
+ *   {ok: true, payload} | {ok: false, reason}: the verified payload, or the
+ *   single plain reason the release was refused.
+ */
+export declare function verifyFreezeRelease(document: unknown, publicKeyBase64: string, expected: {
+    project: string;
+    runId: string;
+    invocationId: string;
+    nonce: string;
+    specDigest: string;
+}): {
+    ok: true;
+    payload: FreezeReleasePayload;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * What ONE baseline projection changed, reported by name.
+ *
+ * Both lists are sorted; their ORDER is a diagnostic convenience, not a
+ * contract — the contract is their membership.
+ */
+export interface BaselineEnvProjection {
+    /** Names the trusted baseline OWNS, given their baseline value back. */
+    restored: string[];
+    /** Names the trusted baseline never owned, removed from the worker. */
+    deleted: string[];
+}
+/**
+ * Projects one worker environment back to the trusted baseline the runner
+ * child started with.
+ *
+ * The native scheduler unions every dependency worker's produced
+ * environment into its dependents, so a body worker inherits whatever a
+ * prerequisite worker assigned — including a deleted key, which the
+ * scheduler carries as `undefined` and Node then simply omits from the
+ * child. This restores exactly that difference: every name the trusted
+ * baseline OWNS goes back to its own value, and every name the baseline
+ * never owned is removed. The keys Playwright's own worker bootstrap
+ * writes ({@link FREEZE_ENV_EXEMPT}) are left alone — they are the
+ * runner's, not a prerequisite's.
+ *
+ * Both sides are read by OWN membership, never through an inherited
+ * lookup, because the names at stake are ordinary environment names the
+ * runner itself spawns workers with: `constructor`, `toString` and
+ * `__proto__` are each a property every plain object inherits, so a
+ * baseline read as `base[key]` reports those as owned values of `Object`,
+ * `Object.prototype.toString` and `Object.prototype` itself and hands
+ * the body worker that instead of deleting what a prerequisite
+ * introduced. No prefix restriction avoids that, and none is acceptable.
+ *
+ * The restore side is therefore a `defineProperty`, not an assignment:
+ * on an ordinary object an assignment to `__proto__` does not create an
+ * own key at all — the inherited accessor swallows it — so a baseline
+ * name a prerequisite deleted could never be put back.
+ *
+ * @param current: the controller worker's own environment (mutated in place).
+ * @param base: the trusted runner child's baseline environment.
+ * @param exempt: names the projection must not touch.
+ *
+ * @returns
+ *   BaselineEnvProjection: what the projection changed, sorted, for the
+ *   controller's own diagnostic.
+ */
+export declare function projectBaselineEnv(current: Record<string, string | undefined>, base: Readonly<Record<string, string>>, exempt?: readonly string[]): BaselineEnvProjection;
+/**
+ * Resolves the engine barrier module the generated controller imports.
+ * Absolute and pack-relative for the same reason the trusted reporter
+ * entry is: a generated worker spec must load an ENGINE file by absolute
+ * path, never a candidate-relative one. Resolves from both the `src/` and
+ * the `dist/` layout.
+ *
+ * @param fromModule: module URL to resolve the pack from (default: this file).
+ *
+ * @returns
+ *   string: absolute `<pack>/dist|src/discovery/prepare-barrier.js` path.
+ */
+export declare function barrierModulePath(fromModule?: string): string;
+/**
+ * The controller worker's own bytes.
+ *
+ * The generated spec imports the ENGINE barrier module by absolute path so
+ * the canonical payload form, the signature verification and the
+ * environment projection are ONE implementation on both sides — never a
+ * second copy that can drift from the one the CLI signed.
+ *
+ * The armed control reaches the worker as a JSON document bound through
+ * `JSON.parse`, never as an object literal inlined in these bytes: the
+ * baseline is a map of ordinary environment NAMES, so a name like
+ * `__proto__` has to arrive as an own key, and a value has to arrive
+ * escaped. `JSON.parse` is the one binding that gives both — it creates
+ * data properties — while a literal would be re-read by the JavaScript
+ * parser: a backtick or a `${` in a value would end the literal, and
+ * `__proto__:` in a literal is a PROTOTYPE assignment, not a key.
+ *
+ * @param control: the armed control (paths and pinned identities).
+ *
+ * @returns
+ *   string: the generated plain-ESM JavaScript source of the controller spec.
+ */
+export declare function freezeControllerSpecSource(control: FreezeControl): string;
+/**
+ * Writes the controller spec and returns the armed barrier plus the sha256
+ * of the exact bytes written. The spec is GENERATED engine code and the
+ * only worker that performs the handshake, and its bytes are pinned in
+ * CLI memory for the whole run; because it is a parseable test file it is
+ * written OUTSIDE the repository, into a private per-run directory
+ * ({@link FreezeControl.specDir}), while the handshake documents stay in
+ * the excluded run-state subtree.
+ *
+ * @param input: the identities, paths, public key and baseline environment.
+ *
+ * @returns
+ *   ArmedFreezeControl: the control (with absolute paths) and its spec digest.
+ */
+export declare function armFreezeControl(input: FreezeArmInput): ArmedFreezeControl;
+/**
+ * Removes the private per-run directory holding the generated controller
+ * spec, and with it the generated engine file itself.
+ *
+ * The CLI calls this once the spec has been read for the LAST time — the
+ * final pinned-digest check — and on every path that never reaches that
+ * check, so no generated spec outlives the run that produced it and no
+ * consumer enumeration can ever see one. Idempotent: a second call, or a
+ * call for a directory something else already removed, removes nothing.
+ *
+ * @param control: the armed control.
+ */
+export declare function removeFreezeSpecDir(control: FreezeControl): void;
+/**
+ * Writes the trusted side's REFUSAL document for one handshake. It is
+ * failure-only by construction: no code path in the controller treats
+ * its presence as permission to continue, so a refusal can only shorten a
+ * wait, never satisfy one.
+ *
+ * @param control: the armed control.
+ * @param reason: the plain refusal text the controller surfaces.
+ */
+export declare function writeFreezeRefusal(control: FreezeControl, reason: string): void;
+/**
+ * Reads the controller's request document, or null when it is absent or
+ * unusable. An absent request is ordinary (the controller has not asked
+ * yet); a MALFORMED one is a refusal the trusted side reports.
+ *
+ * @param path: absolute request document path.
+ *
+ * @returns
+ *   FreezeRequest | null: the parsed request, or null.
+ */
+export declare function readFreezeRequest(path: string): FreezeRequest | null;
+/**
+ * Rewrites the planned project scopes into the freeze-aware shape the
+ * synthesized config emits.
+ *
+ * The rules, in the order they matter:
+ *
+ * - The engine's controller project is appended as one more scope. It
+   collects its generated spec from its OWN `testDir` — the private
+   per-run directory outside the repository the spec was written into,
+   which the consumer's own configuration can never collect — and
+   depends on the FULL upstream prerequisite closure the trusted CLI
+   classified, so the runner's own scheduler runs every prerequisite,
+   then the controller, then any body.
+ * - A PREREQUISITE keeps its captured edges exactly as they were. Its
+   rows are the native cases that must execute genuinely and exactly
+   once, and re-ordering them would change what the run proves.
+ * - Every other project gets the controller as its FIRST dependency,
+   followed by its own captured edges in their original emitted order.
+   Placement is not an ordering statement — the runner's phase scheduler
+   is topological (`runner/tasks.js`: a project joins the earliest phase
+   in which every dependency is already processed), so a body runs after
+   the controller either way. Placement IS an environment-merge
+   statement: a project's extra environment is the union over
+   `project.deps` in emitted order (`tasks.js:341-347`), later entries
+   winning, so where the controller lands decides what a body starts
+   with. FIRST is the contract's placement, emitted explicitly rather
+   than by inserting into a sorted array (a sort would move the
+   controller behind any prerequisite that sorts before it);
+   `trusted-config.ts` re-asserts it when it emits the final list. Whether
+   FIRST or LAST is what the environment projection actually needs is
+   under live measurement by the native environment probe; this is the
+   contract's ordering until that measurement says otherwise.
+ * @param control: the armed controller (its project name, dir and spec).
+ * @param scopes: the planned project scopes, unchanged in every other way.
+ * @param prerequisiteProjects: the CLI's upstream-closure classification.
+ *
+ * @returns
+ *   ProjectScope[]: the scopes to synthesize — the planned scopes in
+ *   place, plus the controller appended.
+ */
+export declare function freezeProjectScopes(control: FreezeControl, scopes: readonly ProjectScope[], prerequisiteProjects: readonly string[]): ProjectScope[];
+//# sourceMappingURL=prepare-barrier.d.ts.map

package/dist/discovery/prepare-barrier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-barrier.d.ts","sourceRoot":"","sources":["../../src/discovery/prepare-barrier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAkE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAkB7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAK9C,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,yDAAyD;IACzD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,CAAC,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQ1D;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,SAAS,EAAE,SAAS,CAAC;IACrB,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,UAAU,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,IAAI,oBAAoB,CAQ/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CAG7G;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GACA;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgD7E;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtC,MAAM,GAAE,SAAS,MAAM,EAAsB,GAC5C,qBAAqB,CAkCvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,GAAE,MAAwB,GAAG,MAAM,CAE9E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAwHzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,kBAAkB,CAmE1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAa/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAqCpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,oBAAoB,EAAE,SAAS,MAAM,EAAE,GACtC,YAAY,EAAE,CA2BhB"}