@iflow-mcp/jkheadley-instar 0.26.2

package/dist/security/ManifestIntegrity.js

@@ -0,0 +1,159 @@
+/**
+ * ManifestIntegrity — HMAC-SHA256 signing and verification for capability-manifest.json.
+ *
+ * Uses a machine-local secret stored in .instar/state/.manifest-key (generated once at
+ * `instar init`, never transmitted, added to .gitignore).
+ *
+ * On every write: compute HMAC over all entries, store as `_hmac` field.
+ * On every read: verify HMAC before trusting data.
+ * On verification failure: log warning, trigger alert, fall back to rescan.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+const KEY_FILENAME = '.manifest-key';
+const KEY_LENGTH = 32; // 256-bit key
+export class ManifestIntegrity {
+    stateDir;
+    keyPath;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+        this.keyPath = path.join(stateDir, KEY_FILENAME);
+    }
+    /**
+     * Generate a new signing key if one doesn't exist.
+     * Called during `instar init`.
+     * Returns true if a new key was generated, false if one already existed.
+     */
+    ensureKey() {
+        if (fs.existsSync(this.keyPath)) {
+            return false;
+        }
+        const key = crypto.randomBytes(KEY_LENGTH).toString('hex');
+        fs.mkdirSync(path.dirname(this.keyPath), { recursive: true });
+        fs.writeFileSync(this.keyPath, key, { mode: 0o600 });
+        return true;
+    }
+    /**
+     * Read the signing key. Returns null if no key exists.
+     */
+    getKey() {
+        if (!fs.existsSync(this.keyPath)) {
+            return null;
+        }
+        return fs.readFileSync(this.keyPath, 'utf-8').trim();
+    }
+    /**
+     * Deterministic JSON serialization with sorted keys at all levels.
+     */
+    static sortedStringify(obj) {
+        if (obj === null || typeof obj !== 'object') {
+            return JSON.stringify(obj);
+        }
+        if (Array.isArray(obj)) {
+            return '[' + obj.map(item => ManifestIntegrity.sortedStringify(item)).join(',') + ']';
+        }
+        const sortedKeys = Object.keys(obj).sort();
+        const pairs = sortedKeys.map(key => JSON.stringify(key) + ':' + ManifestIntegrity.sortedStringify(obj[key]));
+        return '{' + pairs.join(',') + '}';
+    }
+    /**
+     * Compute HMAC-SHA256 over the manifest entries (excluding the _hmac field itself).
+     */
+    computeHmac(manifest) {
+        const key = this.getKey();
+        if (!key) {
+            throw new Error('No manifest signing key found. Run `instar init` to generate one.');
+        }
+        // Create a deterministic serialization of everything except _hmac
+        const { _hmac, ...rest } = manifest;
+        const payload = ManifestIntegrity.sortedStringify(rest);
+        return crypto.createHmac('sha256', key).update(payload).digest('hex');
+    }
+    /**
+     * Sign a manifest object. Adds `_hmac` field in-place and returns it.
+     */
+    sign(manifest) {
+        const hmac = this.computeHmac(manifest);
+        return { ...manifest, _hmac: hmac };
+    }
+    /**
+     * Verify a signed manifest. Returns true if the HMAC matches.
+     */
+    verify(manifest) {
+        const key = this.getKey();
+        if (!key) {
+            // No key = can't verify. This happens on first run before init.
+            return true;
+        }
+        const storedHmac = manifest._hmac;
+        if (!storedHmac || typeof storedHmac !== 'string') {
+            // No HMAC present = unsigned manifest (pre-upgrade or first creation)
+            return false;
+        }
+        const computed = this.computeHmac(manifest);
+        // Constant-time comparison to prevent timing attacks
+        return crypto.timingSafeEqual(Buffer.from(computed, 'hex'), Buffer.from(storedHmac, 'hex'));
+    }
+    /**
+     * Read and verify a manifest file. Returns the parsed manifest and verification status.
+     */
+    readAndVerify(manifestPath) {
+        if (!fs.existsSync(manifestPath)) {
+            return { manifest: null, verified: false, error: 'File not found' };
+        }
+        try {
+            const content = fs.readFileSync(manifestPath, 'utf-8');
+            const manifest = JSON.parse(content);
+            const verified = this.verify(manifest);
+            return { manifest, verified };
+        }
+        catch (err) {
+            return {
+                manifest: null,
+                verified: false,
+                error: `Parse error: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
+    /**
+     * Write a signed manifest to disk. Signs before writing.
+     */
+    writeAndSign(manifestPath, manifest) {
+        const signed = this.sign(manifest);
+        fs.writeFileSync(manifestPath, JSON.stringify(signed, null, 2));
+    }
+    /**
+     * Check if a signing key exists.
+     */
+    hasKey() {
+        return fs.existsSync(this.keyPath);
+    }
+    /**
+     * Rotate the signing key. Generates a new key, re-signs the manifest file if it exists.
+     * Returns the path to the old key backup.
+     */
+    rotateKey(manifestPath) {
+        const oldKey = this.getKey();
+        const backupPath = oldKey ? `${this.keyPath}.bak.${Date.now()}` : null;
+        if (oldKey && backupPath) {
+            fs.writeFileSync(backupPath, oldKey, { mode: 0o600 });
+        }
+        // Generate new key
+        const newKey = crypto.randomBytes(KEY_LENGTH).toString('hex');
+        fs.writeFileSync(this.keyPath, newKey, { mode: 0o600 });
+        // Re-sign the manifest if it exists
+        if (manifestPath && fs.existsSync(manifestPath)) {
+            try {
+                const content = fs.readFileSync(manifestPath, 'utf-8');
+                const manifest = JSON.parse(content);
+                this.writeAndSign(manifestPath, manifest);
+            }
+            catch {
+                // If re-signing fails, the manifest will fail verification and trigger rescan
+            }
+        }
+        return backupPath;
+    }
+}
+//# sourceMappingURL=ManifestIntegrity.js.map

package/dist/security/ManifestIntegrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManifestIntegrity.js","sourceRoot":"","sources":["../../src/security/ManifestIntegrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,YAAY,GAAG,eAAe,CAAC;AACrC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,cAAc;AAUrC,MAAM,OAAO,iBAAiB;IACpB,QAAQ,CAAS;IACjB,OAAO,CAAS;IAExB,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,MAAM;QACZ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,eAAe,CAAC,GAAY;QACzC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACxF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAC1B,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAC5G,CAAC;QACF,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAiC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,kEAAkE;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;QACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAExD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,IAAI,CAAoC,QAAW;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAiC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,gEAAgE;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,sEAAsE;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,qDAAqD;QACrD,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC5B,MAAM,CAAC,IAAI,CAAC,UAAoB,EAAE,KAAK,CAAC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,YAAoB;QAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAA8C,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,YAAoB,EAAE,QAAiC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,YAAqB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvE,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;YACzB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,oCAAoC;QACpC,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,8EAA8E;YAChF,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/server/AgentServer.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Agent Server — HTTP server wrapping Express.
+ *
+ * Provides health checks, session management, job triggering,
+ * and event querying over a simple REST API.
+ *
+ * Also serves the dashboard UI at /dashboard and handles
+ * WebSocket connections for real-time terminal streaming.
+ */
+import { type Express } from 'express';
+import type { SessionManager } from '../core/SessionManager.js';
+import type { StateManager } from '../core/StateManager.js';
+import type { JobScheduler } from '../scheduler/JobScheduler.js';
+import type { TelegramAdapter } from '../messaging/TelegramAdapter.js';
+import type { MessageRouter } from '../messaging/MessageRouter.js';
+import type { InstarConfig } from '../core/types.js';
+import type { RelationshipManager } from '../core/RelationshipManager.js';
+import type { FeedbackManager } from '../core/FeedbackManager.js';
+import type { DispatchManager } from '../core/DispatchManager.js';
+import type { UpdateChecker } from '../core/UpdateChecker.js';
+import type { AutoUpdater } from '../core/AutoUpdater.js';
+import type { AutoDispatcher } from '../core/AutoDispatcher.js';
+import type { QuotaTracker } from '../monitoring/QuotaTracker.js';
+import type { TelegraphService } from '../publishing/TelegraphService.js';
+import type { PrivateViewer } from '../publishing/PrivateViewer.js';
+import type { TunnelManager } from '../tunnel/TunnelManager.js';
+import type { EvolutionManager } from '../core/EvolutionManager.js';
+import type { SessionWatchdog } from '../monitoring/SessionWatchdog.js';
+import type { StallTriageNurse } from '../monitoring/StallTriageNurse.js';
+import type { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
+import type { TopicMemory } from '../memory/TopicMemory.js';
+import type { FeedbackAnomalyDetector } from '../monitoring/FeedbackAnomalyDetector.js';
+export declare class AgentServer {
+    private app;
+    private server;
+    private wsManager;
+    private config;
+    private startTime;
+    private sessionManager;
+    private state;
+    private hookEventReceiver?;
+    private routeContext;
+    constructor(options: {
+        config: InstarConfig;
+        sessionManager: SessionManager;
+        state: StateManager;
+        scheduler?: JobScheduler;
+        telegram?: TelegramAdapter;
+        relationships?: RelationshipManager;
+        feedback?: FeedbackManager;
+        dispatches?: DispatchManager;
+        updateChecker?: UpdateChecker;
+        autoUpdater?: AutoUpdater;
+        autoDispatcher?: AutoDispatcher;
+        quotaTracker?: QuotaTracker;
+        publisher?: TelegraphService;
+        viewer?: PrivateViewer;
+        tunnel?: TunnelManager;
+        evolution?: EvolutionManager;
+        watchdog?: SessionWatchdog;
+        triageNurse?: StallTriageNurse;
+        topicMemory?: TopicMemory;
+        feedbackAnomalyDetector?: FeedbackAnomalyDetector;
+        projectMapper?: import('../core/ProjectMapper.js').ProjectMapper;
+        coherenceGate?: import('../core/ScopeVerifier.js').ScopeVerifier;
+        contextHierarchy?: import('../core/ContextHierarchy.js').ContextHierarchy;
+        canonicalState?: import('../core/CanonicalState.js').CanonicalState;
+        operationGate?: import('../core/ExternalOperationGate.js').ExternalOperationGate;
+        sentinel?: import('../core/MessageSentinel.js').MessageSentinel;
+        adaptiveTrust?: import('../core/AdaptiveTrust.js').AdaptiveTrust;
+        memoryMonitor?: import('../monitoring/MemoryPressureMonitor.js').MemoryPressureMonitor;
+        orphanReaper?: import('../monitoring/OrphanProcessReaper.js').OrphanProcessReaper;
+        coherenceMonitor?: import('../monitoring/CoherenceMonitor.js').CoherenceMonitor;
+        commitmentTracker?: import('../monitoring/CommitmentTracker.js').CommitmentTracker;
+        semanticMemory?: import('../memory/SemanticMemory.js').SemanticMemory;
+        activitySentinel?: import('../monitoring/SessionActivitySentinel.js').SessionActivitySentinel;
+        workingMemory?: import('../memory/WorkingMemoryAssembler.js').WorkingMemoryAssembler;
+        quotaManager?: import('../monitoring/QuotaManager.js').QuotaManager;
+        messageRouter?: MessageRouter;
+        summarySentinel?: import('../messaging/SessionSummarySentinel.js').SessionSummarySentinel;
+        spawnManager?: import('../messaging/SpawnRequestManager.js').SpawnRequestManager;
+        systemReviewer?: import('../monitoring/SystemReviewer.js').SystemReviewer;
+        capabilityMapper?: import('../core/CapabilityMapper.js').CapabilityMapper;
+        selfKnowledgeTree?: import('../knowledge/SelfKnowledgeTree.js').SelfKnowledgeTree;
+        coverageAuditor?: import('../knowledge/CoverageAuditor.js').CoverageAuditor;
+        topicResumeMap?: import('../core/TopicResumeMap.js').TopicResumeMap;
+        autonomyManager?: import('../core/AutonomyProfileManager.js').AutonomyProfileManager;
+        trustElevationTracker?: import('../core/TrustElevationTracker.js').TrustElevationTracker;
+        autonomousEvolution?: import('../core/AutonomousEvolution.js').AutonomousEvolution;
+        coordinator?: MultiMachineCoordinator;
+        localSigningKeyPem?: string;
+        whatsapp?: import('../messaging/WhatsAppAdapter.js').WhatsAppAdapter;
+        slack?: import('../messaging/slack/SlackAdapter.js').SlackAdapter;
+        whatsappBusinessBackend?: import('../messaging/backends/BusinessApiBackend.js').BusinessApiBackend;
+        messageBridge?: import('../messaging/shared/MessageBridge.js').MessageBridge;
+        hookEventReceiver?: import('../monitoring/HookEventReceiver.js').HookEventReceiver;
+        worktreeMonitor?: import('../monitoring/WorktreeMonitor.js').WorktreeMonitor;
+        subagentTracker?: import('../monitoring/SubagentTracker.js').SubagentTracker;
+        instructionsVerifier?: import('../monitoring/InstructionsVerifier.js').InstructionsVerifier;
+        threadlineRouter?: import('../threadline/ThreadlineRouter.js').ThreadlineRouter;
+        handshakeManager?: import('../threadline/HandshakeManager.js').HandshakeManager;
+        threadlineRelayClient?: import('../threadline/client/ThreadlineClient.js').ThreadlineClient;
+        listenerManager?: import('../threadline/ListenerSessionManager.js').ListenerSessionManager;
+        responseReviewGate?: import('../core/CoherenceGate.js').CoherenceGate;
+        telemetryHeartbeat?: import('../monitoring/TelemetryHeartbeat.js').TelemetryHeartbeat;
+        pasteManager?: import('../paste/PasteManager.js').PasteManager;
+        soulManager?: import('../core/SoulManager.js').SoulManager;
+        featureRegistry?: import('../core/FeatureRegistry.js').FeatureRegistry;
+        discoveryEvaluator?: import('../core/DiscoveryEvaluator.js').DiscoveryEvaluator;
+        liveConfig?: {
+            set(path: string, value: unknown): void;
+        };
+    });
+    /**
+     * Resolve the dashboard directory.
+     * In dev: ../../../dashboard (relative to src/server/)
+     * In dist (published): ../../dashboard (relative to dist/server/)
+     */
+    private resolveDashboardDir;
+    /**
+     * Start the HTTP server.
+     */
+    start(): Promise<void>;
+    /**
+     * Stop the HTTP server gracefully.
+     * Closes keep-alive connections after a timeout to prevent hanging.
+     */
+    stop(): Promise<void>;
+    /**
+     * Expose the Express app for testing with supertest.
+     */
+    getApp(): Express;
+}
+//# sourceMappingURL=AgentServer.d.ts.map

package/dist/server/AgentServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AgentServer.d.ts","sourceRoot":"","sources":["../../src/server/AgentServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAM7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAQxF,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,SAAS,CAAO;IACxB,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,iBAAiB,CAAC,CAAiE;IAC3F,OAAO,CAAC,YAAY,CAAuF;gBAE/F,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY,CAAC;QACrB,cAAc,EAAE,cAAc,CAAC;QAC/B,KAAK,EAAE,YAAY,CAAC;QACpB,SAAS,CAAC,EAAE,YAAY,CAAC;QACzB,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,aAAa,CAAC,EAAE,mBAAmB,CAAC;QACpC,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,SAAS,CAAC,EAAE,gBAAgB,CAAC;QAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,SAAS,CAAC,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,WAAW,CAAC,EAAE,gBAAgB,CAAC;QAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;QAClD,aAAa,CAAC,EAAE,OAAO,0BAA0B,EAAE,aAAa,CAAC;QACjE,aAAa,CAAC,EAAE,OAAO,0BAA0B,EAAE,aAAa,CAAC;QACjE,gBAAgB,CAAC,EAAE,OAAO,6BAA6B,EAAE,gBAAgB,CAAC;QAC1E,cAAc,CAAC,EAAE,OAAO,2BAA2B,EAAE,cAAc,CAAC;QACpE,aAAa,CAAC,EAAE,OAAO,kCAAkC,EAAE,qBAAqB,CAAC;QACjF,QAAQ,CAAC,EAAE,OAAO,4BAA4B,EAAE,eAAe,CAAC;QAChE,aAAa,CAAC,EAAE,OAAO,0BAA0B,EAAE,aAAa,CAAC;QACjE,aAAa,CAAC,EAAE,OAAO,wCAAwC,EAAE,qBAAqB,CAAC;QACvF,YAAY,CAAC,EAAE,OAAO,sCAAsC,EAAE,mBAAmB,CAAC;QAClF,gBAAgB,CAAC,EAAE,OAAO,mCAAmC,EAAE,gBAAgB,CAAC;QAChF,iBAAiB,CAAC,EAAE,OAAO,oCAAoC,EAAE,iBAAiB,CAAC;QACnF,cAAc,CAAC,EAAE,OAAO,6BAA6B,EAAE,cAAc,CAAC;QACtE,gBAAgB,CAAC,EAAE,OAAO,0CAA0C,EAAE,uBAAuB,CAAC;QAC9F,aAAa,CAAC,EAAE,OAAO,qCAAqC,EAAE,sBAAsB,CAAC;QACrF,YAAY,CAAC,EAAE,OAAO,+BAA+B,EAAE,YAAY,CAAC;QACpE,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,eAAe,CAAC,EAAE,OAAO,wCAAwC,EAAE,sBAAsB,CAAC;QAC1F,YAAY,CAAC,EAAE,OAAO,qCAAqC,EAAE,mBAAmB,CAAC;QACjF,cAAc,CAAC,EAAE,OAAO,iCAAiC,EAAE,cAAc,CAAC;QAC1E,gBAAgB,CAAC,EAAE,OAAO,6BAA6B,EAAE,gBAAgB,CAAC;QAC1E,iBAAiB,CAAC,EAAE,OAAO,mCAAmC,EAAE,iBAAiB,CAAC;QAClF,eAAe,CAAC,EAAE,OAAO,iCAAiC,EAAE,eAAe,CAAC;QAC5E,cAAc,CAAC,EAAE,OAAO,2BAA2B,EAAE,cAAc,CAAC;QACpE,eAAe,CAAC,EAAE,OAAO,mCAAmC,EAAE,sBAAsB,CAAC;QACrF,qBAAqB,CAAC,EAAE,OAAO,kCAAkC,EAAE,qBAAqB,CAAC;QACzF,mBAAmB,CAAC,EAAE,OAAO,gCAAgC,EAAE,mBAAmB,CAAC;QACnF,WAAW,CAAC,EAAE,uBAAuB,CAAC;QACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,EAAE,OAAO,iCAAiC,EAAE,eAAe,CAAC;QACrE,KAAK,CAAC,EAAE,OAAO,oCAAoC,EAAE,YAAY,CAAC;QAClE,uBAAuB,CAAC,EAAE,OAAO,6CAA6C,EAAE,kBAAkB,CAAC;QACnG,aAAa,CAAC,EAAE,OAAO,sCAAsC,EAAE,aAAa,CAAC;QAC7E,iBAAiB,CAAC,EAAE,OAAO,oCAAoC,EAAE,iBAAiB,CAAC;QACnF,eAAe,CAAC,EAAE,OAAO,kCAAkC,EAAE,eAAe,CAAC;QAC7E,eAAe,CAAC,EAAE,OAAO,kCAAkC,EAAE,eAAe,CAAC;QAC7E,oBAAoB,CAAC,EAAE,OAAO,uCAAuC,EAAE,oBAAoB,CAAC;QAC5F,gBAAgB,CAAC,EAAE,OAAO,mCAAmC,EAAE,gBAAgB,CAAC;QAChF,gBAAgB,CAAC,EAAE,OAAO,mCAAmC,EAAE,gBAAgB,CAAC;QAChF,qBAAqB,CAAC,EAAE,OAAO,0CAA0C,EAAE,gBAAgB,CAAC;QAC5F,eAAe,CAAC,EAAE,OAAO,yCAAyC,EAAE,sBAAsB,CAAC;QAC3F,kBAAkB,CAAC,EAAE,OAAO,0BAA0B,EAAE,aAAa,CAAC;QACtE,kBAAkB,CAAC,EAAE,OAAO,qCAAqC,EAAE,kBAAkB,CAAC;QACtF,YAAY,CAAC,EAAE,OAAO,0BAA0B,EAAE,YAAY,CAAC;QAC/D,WAAW,CAAC,EAAE,OAAO,wBAAwB,EAAE,WAAW,CAAC;QAC3D,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,eAAe,CAAC;QACvE,kBAAkB,CAAC,EAAE,OAAO,+BAA+B,EAAE,kBAAkB,CAAC;QAChF,UAAU,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;SAAE,CAAC;KAC1D;IAyMD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC3B;;OAEG;IACH,MAAM,IAAI,OAAO;CAGlB"}

package/dist/server/AgentServer.js

@@ -0,0 +1,307 @@
+/**
+ * Agent Server — HTTP server wrapping Express.
+ *
+ * Provides health checks, session management, job triggering,
+ * and event querying over a simple REST API.
+ *
+ * Also serves the dashboard UI at /dashboard and handles
+ * WebSocket connections for real-time terminal streaming.
+ */
+import express from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { createRoutes } from './routes.js';
+import { createFileRoutes } from './fileRoutes.js';
+import { mountWhatsAppWebhooks } from '../messaging/backends/WhatsAppWebhookRoutes.js';
+import { createMachineRoutes } from './machineRoutes.js';
+import { corsMiddleware, authMiddleware, requestTimeout, errorHandler, dashboardSecurityHeaders } from './middleware.js';
+import { WebSocketManager } from './WebSocketManager.js';
+export class AgentServer {
+    app;
+    server = null;
+    wsManager = null;
+    config;
+    startTime;
+    sessionManager;
+    state;
+    hookEventReceiver;
+    routeContext = null;
+    constructor(options) {
+        this.config = options.config;
+        this.startTime = new Date();
+        this.sessionManager = options.sessionManager;
+        this.state = options.state;
+        this.hookEventReceiver = options.hookEventReceiver ?? undefined;
+        this.app = express();
+        // Middleware
+        this.app.use(express.json({ limit: '12mb' }));
+        this.app.use(corsMiddleware);
+        // Dashboard security headers — set before static serving so they apply to all dashboard responses
+        this.app.use(dashboardSecurityHeaders);
+        // Dashboard static files — served BEFORE auth middleware so the page loads
+        // without a token. Auth happens via WebSocket/API calls from the page itself.
+        const dashboardDir = this.resolveDashboardDir();
+        this.app.get('/dashboard', (_req, res) => {
+            res.sendFile(path.join(dashboardDir, 'index.html'));
+        });
+        this.app.use('/dashboard', express.static(dashboardDir));
+        // PIN-based dashboard unlock — exchanges a short PIN for the auth token.
+        // Placed before auth middleware so the dashboard can call it without a token.
+        // Route is registered unconditionally so it works even when dashboardPin is
+        // generated after AgentServer construction (first-boot timing issue).
+        // Config values are checked at request time via this.config which may be
+        // updated by LiveConfig/PostUpdateMigrator after construction.
+        const pinAttempts = new Map();
+        const MAX_ATTEMPTS = 5;
+        const WINDOW_MS = 5 * 60 * 1000; // 5-minute window
+        const configRef = this.config;
+        this.app.post('/dashboard/unlock', (req, res) => {
+            if (!configRef.dashboardPin || !configRef.authToken) {
+                res.status(503).json({ error: 'PIN authentication not yet available. Try again shortly.' });
+                return;
+            }
+            const ip = req.ip || req.socket.remoteAddress || 'unknown';
+            // Rate limit by IP
+            const now = Date.now();
+            let entry = pinAttempts.get(ip);
+            if (entry && now > entry.resetAt) {
+                pinAttempts.delete(ip);
+                entry = undefined;
+            }
+            if (entry && entry.count >= MAX_ATTEMPTS) {
+                res.status(429).json({ error: 'Too many attempts. Try again later.' });
+                return;
+            }
+            const { pin } = req.body;
+            if (!pin || typeof pin !== 'string') {
+                res.status(400).json({ error: 'Missing PIN' });
+                return;
+            }
+            const ha = createHash('sha256').update(pin).digest();
+            const hb = createHash('sha256').update(configRef.dashboardPin).digest();
+            if (!timingSafeEqual(ha, hb)) {
+                // Track failed attempt
+                if (!entry) {
+                    entry = { count: 0, resetAt: now + WINDOW_MS };
+                    pinAttempts.set(ip, entry);
+                }
+                entry.count++;
+                const remaining = MAX_ATTEMPTS - entry.count;
+                res.status(403).json({
+                    error: 'Incorrect PIN',
+                    attemptsRemaining: remaining,
+                });
+                return;
+            }
+            // PIN correct — return the auth token
+            res.json({ token: configRef.authToken });
+        });
+        // Machine-to-machine routes — mounted BEFORE auth middleware because they use
+        // their own machineAuth scheme (Ed25519 signatures, not bearer tokens).
+        if (options.coordinator?.enabled) {
+            const coord = options.coordinator;
+            const machineRoutes = createMachineRoutes({
+                identityManager: coord.managers.identityManager,
+                heartbeatManager: coord.managers.heartbeatManager,
+                securityLog: coord.managers.securityLog,
+                authDeps: {
+                    identityManager: coord.managers.identityManager,
+                    nonceStore: coord.managers.nonceStore,
+                    securityLog: coord.managers.securityLog,
+                    localMachineId: coord.identity.machineId,
+                },
+                localMachineId: coord.identity.machineId,
+                localSigningKeyPem: options.localSigningKeyPem ?? '',
+                onDemote: () => coord.demoteToStandby('Remote heartbeat: another machine took over'),
+                onPromote: () => coord.promoteToAwake('Remote handoff: awake machine handed off to us'),
+                onHandoffRequest: async () => ({
+                    ready: true,
+                    state: { jobs: [], sessions: [] },
+                }),
+                messageRouter: options.messageRouter ?? null,
+            });
+            this.app.use(machineRoutes);
+        }
+        // WhatsApp Business API webhook routes — mounted BEFORE auth middleware because
+        // Meta's webhook verification sends GET requests without Bearer tokens.
+        if (options.whatsappBusinessBackend) {
+            // Import is at top of file — mountWhatsAppWebhooks is synchronous
+            mountWhatsAppWebhooks({
+                app: this.app,
+                backend: options.whatsappBusinessBackend,
+            });
+        }
+        this.app.use(authMiddleware(options.config.authToken));
+        this.app.use(requestTimeout(options.config.requestTimeoutMs));
+        // Routes
+        const routeCtx = {
+            config: options.config,
+            sessionManager: options.sessionManager,
+            state: options.state,
+            scheduler: options.scheduler ?? null,
+            telegram: options.telegram ?? null,
+            relationships: options.relationships ?? null,
+            feedback: options.feedback ?? null,
+            dispatches: options.dispatches ?? null,
+            updateChecker: options.updateChecker ?? null,
+            autoUpdater: options.autoUpdater ?? null,
+            autoDispatcher: options.autoDispatcher ?? null,
+            quotaTracker: options.quotaTracker ?? null,
+            publisher: options.publisher ?? null,
+            viewer: options.viewer ?? null,
+            tunnel: options.tunnel ?? null,
+            evolution: options.evolution ?? null,
+            watchdog: options.watchdog ?? null,
+            triageNurse: options.triageNurse ?? null,
+            topicMemory: options.topicMemory ?? null,
+            feedbackAnomalyDetector: options.feedbackAnomalyDetector ?? null,
+            projectMapper: options.projectMapper ?? null,
+            coherenceGate: options.coherenceGate ?? null,
+            contextHierarchy: options.contextHierarchy ?? null,
+            canonicalState: options.canonicalState ?? null,
+            operationGate: options.operationGate ?? null,
+            sentinel: options.sentinel ?? null,
+            adaptiveTrust: options.adaptiveTrust ?? null,
+            memoryMonitor: options.memoryMonitor ?? null,
+            orphanReaper: options.orphanReaper ?? null,
+            coherenceMonitor: options.coherenceMonitor ?? null,
+            commitmentTracker: options.commitmentTracker ?? null,
+            semanticMemory: options.semanticMemory ?? null,
+            activitySentinel: options.activitySentinel ?? null,
+            workingMemory: options.workingMemory ?? null,
+            quotaManager: options.quotaManager ?? null,
+            messageRouter: options.messageRouter ?? null,
+            summarySentinel: options.summarySentinel ?? null,
+            spawnManager: options.spawnManager ?? null,
+            systemReviewer: options.systemReviewer ?? null,
+            capabilityMapper: options.capabilityMapper ?? null,
+            selfKnowledgeTree: options.selfKnowledgeTree ?? null,
+            coverageAuditor: options.coverageAuditor ?? null,
+            topicResumeMap: options.topicResumeMap ?? null,
+            autonomyManager: options.autonomyManager ?? null,
+            trustElevationTracker: options.trustElevationTracker ?? null,
+            autonomousEvolution: options.autonomousEvolution ?? null,
+            whatsapp: options.whatsapp ?? null,
+            slack: options.slack ?? null,
+            messageBridge: options.messageBridge ?? null,
+            hookEventReceiver: options.hookEventReceiver ?? null,
+            worktreeMonitor: options.worktreeMonitor ?? null,
+            subagentTracker: options.subagentTracker ?? null,
+            instructionsVerifier: options.instructionsVerifier ?? null,
+            threadlineRouter: options.threadlineRouter ?? null,
+            handshakeManager: options.handshakeManager ?? null,
+            threadlineRelayClient: options.threadlineRelayClient ?? null,
+            listenerManager: options.listenerManager ?? null,
+            responseReviewGate: options.responseReviewGate ?? null,
+            telemetryHeartbeat: options.telemetryHeartbeat ?? null,
+            pasteManager: options.pasteManager ?? null,
+            wsManager: null, // Set after WebSocket manager is initialized
+            soulManager: options.soulManager ?? null,
+            featureRegistry: options.featureRegistry ?? null,
+            discoveryEvaluator: options.discoveryEvaluator ?? null,
+            startTime: this.startTime,
+        };
+        this.routeContext = routeCtx;
+        const routes = createRoutes(routeCtx);
+        this.app.use(routes);
+        // File viewer routes (after auth middleware)
+        const fileRoutes = createFileRoutes({ config: options.config, liveConfig: options.liveConfig });
+        this.app.use(fileRoutes);
+        // Error handler (must be last)
+        this.app.use(errorHandler);
+    }
+    /**
+     * Resolve the dashboard directory.
+     * In dev: ../../../dashboard (relative to src/server/)
+     * In dist (published): ../../dashboard (relative to dist/server/)
+     */
+    resolveDashboardDir() {
+        const thisDir = path.dirname(fileURLToPath(import.meta.url));
+        // Try dist layout first (package root/dashboard)
+        const fromDist = path.resolve(thisDir, '..', '..', 'dashboard');
+        // Try dev layout (src/server -> project root/dashboard)
+        const fromSrc = path.resolve(thisDir, '..', '..', '..', 'dashboard');
+        if (fs.existsSync(fromDist))
+            return fromDist;
+        if (fs.existsSync(fromSrc))
+            return fromSrc;
+        return fromDist;
+    }
+    /**
+     * Start the HTTP server.
+     */
+    async start() {
+        return new Promise((resolve, reject) => {
+            const host = this.config.host || '127.0.0.1';
+            this.server = this.app.listen(this.config.port, host, () => {
+                console.log(`[instar] Server listening on ${host}:${this.config.port}`);
+                console.log(`[instar] Dashboard: http://${host}:${this.config.port}/dashboard`);
+                // Initialize WebSocket manager after server is listening
+                this.wsManager = new WebSocketManager({
+                    server: this.server,
+                    sessionManager: this.sessionManager,
+                    state: this.state,
+                    authToken: this.config.authToken,
+                    instarDir: this.config.stateDir,
+                    hookEventReceiver: this.hookEventReceiver,
+                });
+                // Update route context with WebSocket manager (deferred — created after routes)
+                if (this.routeContext) {
+                    this.routeContext.wsManager = this.wsManager;
+                }
+                resolve();
+            });
+            this.server.on('error', (err) => {
+                if (err.code === 'EADDRINUSE') {
+                    reject(new Error(`Port ${this.config.port} is already in use. Is another instar server running?`));
+                }
+                else {
+                    reject(err);
+                }
+            });
+        });
+    }
+    /**
+     * Stop the HTTP server gracefully.
+     * Closes keep-alive connections after a timeout to prevent hanging.
+     */
+    async stop() {
+        // Shutdown WebSocket manager first
+        if (this.wsManager) {
+            this.wsManager.shutdown();
+            this.wsManager = null;
+        }
+        return new Promise((resolve) => {
+            if (!this.server) {
+                resolve();
+                return;
+            }
+            let resolved = false;
+            const done = () => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(forceTimer);
+                this.server = null;
+                resolve();
+            };
+            // Force-close after 5 seconds if graceful close hangs (keep-alive connections)
+            const forceTimer = setTimeout(() => {
+                console.log('[instar] Force-closing server (keep-alive timeout)');
+                this.server?.closeAllConnections?.();
+                done();
+            }, 5000);
+            forceTimer.unref(); // Don't prevent process exit during shutdown
+            this.server.close(() => done());
+        });
+    }
+    /**
+     * Expose the Express app for testing with supertest.
+     */
+    getApp() {
+        return this.app;
+    }
+}
+//# sourceMappingURL=AgentServer.js.map

package/dist/server/AgentServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AgentServer.js","sourceRoot":"","sources":["../../src/server/AgentServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,OAAsD,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuBzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACzH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,OAAO,WAAW;IACd,GAAG,CAAU;IACb,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAA4B,IAAI,CAAC;IAC1C,MAAM,CAAe;IACrB,SAAS,CAAO;IAChB,cAAc,CAAiB;IAC/B,KAAK,CAAe;IACpB,iBAAiB,CAAkE;IACnF,YAAY,GAAkF,IAAI,CAAC;IAE3G,YAAY,OAoEX;QACC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;QAErB,aAAa;QACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE7B,kGAAkG;QAClG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACvC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAEzD,yEAAyE;QACzE,8EAA8E;QAC9E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;QAC1E,MAAM,YAAY,GAAG,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,kBAAkB;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;YACjE,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,CAAC;gBAC5F,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;YAE3D,mBAAmB;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACjC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YACD,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC7B,uBAAuB;gBACvB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC;oBAC/C,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7B,CAAC;gBACD,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,SAAS;iBAC7B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,sCAAsC;YACtC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,8EAA8E;QAC9E,wEAAwE;QACxE,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;YAClC,MAAM,aAAa,GAAG,mBAAmB,CAAC;gBACxC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;gBAC/C,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;gBACjD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;gBACvC,QAAQ,EAAE;oBACR,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;oBAC/C,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;oBACrC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;oBACvC,cAAc,EAAE,KAAK,CAAC,QAAS,CAAC,SAAS;iBAC1C;gBACD,cAAc,EAAE,KAAK,CAAC,QAAS,CAAC,SAAS;gBACzC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE;gBACpD,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,6CAA6C,CAAC;gBACpF,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,gDAAgD,CAAC;gBACvF,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC7B,KAAK,EAAE,IAAI;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAClC,CAAC;gBACF,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;QAED,gFAAgF;QAChF,wEAAwE;QACxE,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,kEAAkE;YAClE,qBAAqB,CAAC;gBACpB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,OAAO,CAAC,uBAAuB;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE9D,SAAS;QACT,MAAM,QAAQ,GAAG;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;YAChE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;YACpD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;YACpD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,IAAI;YAC5D,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI;YACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;YACpD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;YAC1D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,IAAI;YAC5D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACtD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACtD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YAC1C,SAAS,EAAE,IAAI,EAAE,6CAA6C;YAC9D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACtD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAErB,6CAA6C;QAC7C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEzB,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACK,mBAAmB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAChE,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACrE,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBACzD,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC;gBAEhF,yDAAyD;gBACzD,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC;oBACpC,MAAM,EAAE,IAAI,CAAC,MAAO;oBACpB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;iBAC1C,CAAC,CAAC;gBAEH,gFAAgF;gBAChF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACtB,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC/C,CAAC;gBAED,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBACrD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,uDAAuD,CAAC,CAAC,CAAC;gBACrG,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,mCAAmC;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YAEF,+EAA+E;YAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;gBAClE,IAAI,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;gBACrC,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,6CAA6C;YAEjE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF"}