@mainwp/control 1.0.0

package/dist/core/http-client.d.ts

@@ -0,0 +1,111 @@
+/**
+ * HTTP Client for mainwpcontrol
+ *
+ * Single abstraction for all API traffic.
+ * INVARIANT: All HTTP requests MUST go through this module.
+ */
+/**
+ * Request options
+ */
+export interface RequestOptions {
+    headers?: Record<string, string> | undefined;
+    timeout?: number | undefined;
+    signal?: AbortSignal | undefined;
+}
+/**
+ * HTTP client configuration
+ */
+export interface HttpClientConfig {
+    baseUrl: string;
+    username: string;
+    appPassword: string;
+    skipSSLVerification?: boolean | undefined;
+    timeout?: number | undefined;
+    maxResponseSize?: number | undefined;
+    allowInsecureHttp?: boolean | undefined;
+}
+/**
+ * Response wrapper with typed JSON parsing
+ */
+export interface HttpResponse<T = unknown> {
+    status: number;
+    statusText: string;
+    headers: Headers;
+    data: T;
+}
+/**
+ * HTTP client class
+ */
+export declare class HttpClient {
+    private readonly baseUrl;
+    private readonly baseOrigin;
+    private readonly authHeader;
+    private readonly timeout;
+    private readonly maxResponseSize;
+    private readonly skipSSLVerification;
+    private readonly dispatcher;
+    /** Maximum redirects to follow (same-origin only) */
+    private static readonly MAX_REDIRECTS;
+    constructor(config: HttpClientConfig);
+    /**
+     * Make a GET request
+     */
+    get<T = unknown>(path: string, options?: RequestOptions): Promise<HttpResponse<T>>;
+    /**
+     * Make a POST request
+     */
+    post<T = unknown>(path: string, body?: unknown, options?: RequestOptions): Promise<HttpResponse<T>>;
+    /**
+     * Make a DELETE request
+     */
+    delete<T = unknown>(path: string, options?: RequestOptions): Promise<HttpResponse<T>>;
+    /**
+     * Core request method
+     */
+    private request;
+    /**
+     * Check if status code is a redirect
+     */
+    private isRedirect;
+    /**
+     * Handle HTTP redirects securely
+     *
+     * SECURITY: Only follows same-origin redirects to prevent credential leakage.
+     * Cross-origin redirects are rejected with an error.
+     */
+    private handleRedirect;
+    /**
+     * Build full URL from path
+     */
+    private buildUrl;
+    /**
+     * Build request headers
+     */
+    private buildHeaders;
+    /**
+     * Handle HTTP error status codes
+     */
+    private handleHttpError;
+    /** Error code → typed error mappings */
+    private static readonly ERROR_CODE_MAP;
+    /** Known MainWPCTL error names that should pass through unchanged */
+    private static readonly KNOWN_ERROR_NAMES;
+    /**
+     * Normalize errors to MainWPCTLError types
+     */
+    private normalizeError;
+    /**
+     * Extract error code from an error or its cause chain
+     * (e.g., fetch wraps ECONNREFUSED in TypeError.cause)
+     */
+    private extractErrorCode;
+    /**
+     * Sanitize error data to prevent credential leaks
+     */
+    private sanitizeErrorData;
+}
+/**
+ * Create an HTTP client from configuration
+ */
+export declare function createHttpClient(config: HttpClientConfig): HttpClient;
+//# sourceMappingURL=http-client.d.ts.map

package/dist/core/http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/core/http-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,CAAC,CAAC;CACT;AAUD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;gBAE/B,MAAM,EAAE,gBAAgB;IA8CpC;;OAEG;IACG,GAAG,CAAC,CAAC,GAAG,OAAO,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAI3B;;OAEG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAI3B;;OAEG;IACG,MAAM,CAAC,CAAC,GAAG,OAAO,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAI3B;;OAEG;YACW,OAAO;IAyGrB;;OAEG;IACH,OAAO,CAAC,UAAU;IAIlB;;;;;OAKG;YACW,cAAc;IAiD5B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAehB;;OAEG;IACH,OAAO,CAAC,YAAY;IAUpB;;OAEG;IACH,OAAO,CAAC,eAAe;IA6CvB,wCAAwC;IACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAqBpC;IAEF,qEAAqE;IACrE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAEtC;IAEH;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAuB1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAErE"}

package/dist/core/http-client.js

@@ -0,0 +1,329 @@
+/**
+ * HTTP Client for mainwpcontrol
+ *
+ * Single abstraction for all API traffic.
+ * INVARIANT: All HTTP requests MUST go through this module.
+ */
+import { createRequire } from 'node:module';
+import { Agent } from 'undici';
+import { NetworkError, TLSError, APIError, AuthError } from '../utils/errors.js';
+const require = createRequire(import.meta.url);
+const { version: PKG_VERSION } = require('../../package.json');
+/**
+ * Default configuration values
+ */
+const DEFAULTS = {
+    timeout: 30000, // 30 seconds
+    maxResponseSize: 10 * 1024 * 1024, // 10 MB
+};
+/**
+ * HTTP client class
+ */
+export class HttpClient {
+    baseUrl;
+    baseOrigin;
+    authHeader;
+    timeout;
+    maxResponseSize;
+    skipSSLVerification;
+    dispatcher;
+    /** Maximum redirects to follow (same-origin only) */
+    static MAX_REDIRECTS = 10;
+    constructor(config) {
+        // Normalize base URL (remove trailing slash)
+        this.baseUrl = config.baseUrl.replace(/\/+$/, '');
+        // Extract origin for redirect validation
+        const parsedUrl = new URL(this.baseUrl);
+        this.baseOrigin = parsedUrl.origin;
+        // Create Basic auth header
+        const credentials = Buffer.from(`${config.username}:${config.appPassword}`).toString('base64');
+        this.authHeader = `Basic ${credentials}`;
+        this.timeout = config.timeout ?? DEFAULTS.timeout;
+        this.maxResponseSize = config.maxResponseSize ?? DEFAULTS.maxResponseSize;
+        this.skipSSLVerification = config.skipSSLVerification ?? false;
+        // SECURITY: Enforce HTTPS by default
+        if (this.baseUrl.startsWith('http://')) {
+            const allowHttp = config.allowInsecureHttp || process.env['MAINWP_ALLOW_HTTP'] === '1';
+            if (!allowHttp) {
+                throw new TLSError('Dashboard URL uses insecure HTTP. HTTPS is required by default.', undefined, 'Switch to HTTPS, or set allowInsecureHttp in settings / MAINWP_ALLOW_HTTP=1 env var to override');
+            }
+            console.error('Warning: Dashboard URL uses HTTP. Credentials are sent unencrypted. ' +
+                'Consider switching to HTTPS.');
+        }
+        // Configure undici Agent for SSL verification control
+        if (this.skipSSLVerification) {
+            console.error('Warning: SSL verification is disabled for this profile. ' +
+                'Connection is vulnerable to interception.');
+            this.dispatcher = new Agent({
+                connect: {
+                    rejectUnauthorized: false,
+                },
+            });
+        }
+    }
+    /**
+     * Make a GET request
+     */
+    async get(path, options) {
+        return this.request('GET', path, undefined, options);
+    }
+    /**
+     * Make a POST request
+     */
+    async post(path, body, options) {
+        return this.request('POST', path, body, options);
+    }
+    /**
+     * Make a DELETE request
+     */
+    async delete(path, options) {
+        return this.request('DELETE', path, undefined, options);
+    }
+    /**
+     * Core request method
+     */
+    async request(method, path, body, options, redirectCount = 0) {
+        const url = this.buildUrl(path);
+        const headers = this.buildHeaders(options?.headers);
+        // Create abort controller for timeout
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), options?.timeout ?? this.timeout);
+        // Combine user signal with timeout signal
+        const effectiveSignal = options?.signal
+            ? AbortSignal.any([options.signal, controller.signal])
+            : controller.signal;
+        try {
+            const fetchOptions = {
+                method,
+                headers,
+                signal: effectiveSignal,
+                // SECURITY: Disable auto-redirect to prevent auth header leakage to cross-origin
+                redirect: 'manual',
+            };
+            if (body !== undefined) {
+                fetchOptions.body = JSON.stringify(body);
+            }
+            // Use undici dispatcher for SSL verification control
+            if (this.dispatcher) {
+                // Cast needed due to type mismatch between undici and Node.js fetch types
+                fetchOptions.dispatcher = this.dispatcher;
+            }
+            const response = await fetch(url, fetchOptions);
+            clearTimeout(timeoutId);
+            // SECURITY: Handle redirects manually - only follow same-origin
+            if (this.isRedirect(response.status)) {
+                return this.handleRedirect(response, method, body, options, redirectCount);
+            }
+            // Check response size via Content-Length header (pre-read guard)
+            const contentLength = response.headers.get('content-length');
+            const parsedContentLength = contentLength ? parseInt(contentLength, 10) : NaN;
+            if (!isNaN(parsedContentLength) && parsedContentLength > this.maxResponseSize) {
+                throw new NetworkError(`Response too large: ${parsedContentLength} bytes`, undefined, 'Response is too large. Check the Dashboard logs or try a simpler query');
+            }
+            // Parse response
+            const text = await response.text();
+            // Post-read body length check (only when Content-Length was absent or unparseable)
+            if (isNaN(parsedContentLength) && text.length > this.maxResponseSize) {
+                throw new NetworkError(`Response too large: ${text.length} bytes`, undefined, 'Response is too large. Check the Dashboard logs or try a simpler query');
+            }
+            let data;
+            try {
+                // SECURITY: Strip __proto__ and constructor keys to prevent prototype
+                // pollution from untrusted API responses
+                data = text ? JSON.parse(text, (key, value) => {
+                    if (key === '__proto__' || key === 'constructor') {
+                        return undefined;
+                    }
+                    return value;
+                }) : {};
+            }
+            catch {
+                // If not JSON, wrap as string
+                data = text;
+            }
+            // Handle HTTP errors
+            if (!response.ok) {
+                this.handleHttpError(response.status, data);
+            }
+            return {
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+                data,
+            };
+        }
+        catch (error) {
+            clearTimeout(timeoutId);
+            throw this.normalizeError(error);
+        }
+    }
+    /**
+     * Check if status code is a redirect
+     */
+    isRedirect(status) {
+        return status >= 300 && status < 400;
+    }
+    /**
+     * Handle HTTP redirects securely
+     *
+     * SECURITY: Only follows same-origin redirects to prevent credential leakage.
+     * Cross-origin redirects are rejected with an error.
+     */
+    async handleRedirect(response, method, body, options, redirectCount) {
+        if (redirectCount >= HttpClient.MAX_REDIRECTS) {
+            throw new NetworkError('Too many redirects', undefined, 'The Dashboard is redirecting too many times. Check the server configuration.');
+        }
+        const location = response.headers.get('location');
+        if (!location) {
+            throw new NetworkError(`Redirect response (${response.status}) missing Location header`, undefined, 'The server sent an invalid redirect response');
+        }
+        // Resolve relative URLs against the current base
+        let redirectUrl;
+        try {
+            redirectUrl = new URL(location, this.baseUrl);
+        }
+        catch {
+            throw new NetworkError(`Invalid redirect URL: ${location}`, undefined, 'The server sent an invalid redirect location');
+        }
+        // SECURITY: Only follow same-origin redirects
+        if (redirectUrl.origin !== this.baseOrigin) {
+            throw new NetworkError(`Cross-origin redirect blocked: ${this.baseOrigin} → ${redirectUrl.origin}`, undefined, 'The Dashboard is redirecting to a different domain. This may indicate a security issue or misconfiguration.');
+        }
+        // Follow same-origin redirect (pass full URL to preserve path)
+        return this.request(method, redirectUrl.href, body, options, redirectCount + 1);
+    }
+    /**
+     * Build full URL from path
+     */
+    buildUrl(path) {
+        // If path is already a full URL, validate same-origin
+        if (path.startsWith('http://') || path.startsWith('https://')) {
+            const parsedUrl = new URL(path);
+            if (parsedUrl.origin !== this.baseOrigin) {
+                throw new NetworkError(`Request URL origin mismatch: ${parsedUrl.origin} !== ${this.baseOrigin}`);
+            }
+            return path;
+        }
+        // Ensure path starts with /
+        const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+        return `${this.baseUrl}${normalizedPath}`;
+    }
+    /**
+     * Build request headers
+     */
+    buildHeaders(custom) {
+        return {
+            Authorization: this.authHeader,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+            'User-Agent': `mainwpcontrol/${PKG_VERSION}`,
+            ...custom,
+        };
+    }
+    /**
+     * Handle HTTP error status codes
+     */
+    handleHttpError(status, data) {
+        // Sanitize error data (remove any potential credential leaks)
+        const sanitizedData = this.sanitizeErrorData(data);
+        switch (status) {
+            case 401:
+                throw new AuthError('Authentication failed. Check your credentials.', sanitizedData, 'Run `mainwpcontrol login` to update your credentials');
+            case 403:
+                throw new AuthError('Access denied. Insufficient permissions.', sanitizedData, 'Verify your user has the required permissions in WordPress');
+            case 404:
+                throw new APIError('NOT_FOUND', 'Resource not found', status, sanitizedData);
+            case 422:
+                throw new APIError('VALIDATION_ERROR', 'Validation failed', status, sanitizedData);
+            case 429:
+                throw new APIError('RATE_LIMITED', 'Too many requests', status, sanitizedData, 'Wait a few minutes before retrying');
+            case 500:
+            case 502:
+            case 503:
+            case 504:
+                throw new APIError('SERVER_ERROR', 'Server error', status, sanitizedData, 'Check the Dashboard logs or try again later');
+            default:
+                throw new APIError('HTTP_ERROR', `HTTP ${status}`, status, sanitizedData);
+        }
+    }
+    /** Error code → typed error mappings */
+    static ERROR_CODE_MAP = {
+        ECONNREFUSED: () => new NetworkError('Connection refused. Is the Dashboard running?', undefined, 'Verify the Dashboard is running and the URL is correct'),
+        ENOTFOUND: () => new NetworkError('Host not found. Check the Dashboard URL.', undefined, 'Check the Dashboard URL in your profile with `mainwpcontrol config show`'),
+        CERT_HAS_EXPIRED: () => new TLSError('SSL certificate error. Use --skip-ssl-verify if needed.', undefined, 'Use --skip-ssl-verify flag if using self-signed certificates (not recommended for production)'),
+        UNABLE_TO_VERIFY_LEAF_SIGNATURE: () => new TLSError('SSL certificate error. Use --skip-ssl-verify if needed.', undefined, 'Use --skip-ssl-verify flag if using self-signed certificates (not recommended for production)'),
+    };
+    /** Known MainWPCTL error names that should pass through unchanged */
+    static KNOWN_ERROR_NAMES = new Set([
+        'NetworkError', 'TLSError', 'APIError', 'AuthError',
+    ]);
+    /**
+     * Normalize errors to MainWPCTLError types
+     */
+    normalizeError(error) {
+        if (!(error instanceof Error)) {
+            return new NetworkError(String(error));
+        }
+        if (error.name === 'AbortError') {
+            return new NetworkError('Request timed out', undefined, 'Increase timeout with --timeout flag or check network connection');
+        }
+        const errorCode = this.extractErrorCode(error);
+        const mapped = errorCode ? HttpClient.ERROR_CODE_MAP[errorCode] : undefined;
+        if (mapped)
+            return mapped();
+        if (HttpClient.KNOWN_ERROR_NAMES.has(error.name)) {
+            return error;
+        }
+        return new NetworkError(String(error));
+    }
+    /**
+     * Extract error code from an error or its cause chain
+     * (e.g., fetch wraps ECONNREFUSED in TypeError.cause)
+     */
+    extractErrorCode(error) {
+        // Check the error itself
+        if ('code' in error && typeof error.code === 'string') {
+            return error.code;
+        }
+        // Check the cause chain (Node.js fetch wraps errors in TypeError)
+        const cause = error.cause;
+        if (cause instanceof Error) {
+            return this.extractErrorCode(cause);
+        }
+        return undefined;
+    }
+    /**
+     * Sanitize error data to prevent credential leaks
+     */
+    sanitizeErrorData(data) {
+        if (typeof data !== 'object' || data === null)
+            return data;
+        if (Array.isArray(data))
+            return data.map(item => this.sanitizeErrorData(item));
+        const sanitized = {};
+        // Substring matching catches camelCase, snake_case, and header variants
+        // (e.g., accessToken, private_key, set-cookie, refreshToken)
+        const sensitiveSubstrings = [
+            'password', 'token', 'secret', 'authorization', 'cookie',
+            'apikey', 'api_key', 'bearer', 'credential', 'private_key',
+            'signing_key',
+        ];
+        for (const [key, value] of Object.entries(data)) {
+            const keyLower = key.toLowerCase();
+            if (sensitiveSubstrings.some(s => keyLower.includes(s))) {
+                sanitized[key] = '[REDACTED]';
+            }
+            else {
+                sanitized[key] = this.sanitizeErrorData(value);
+            }
+        }
+        return sanitized;
+    }
+}
+/**
+ * Create an HTTP client from configuration
+ */
+export function createHttpClient(config) {
+    return new HttpClient(config);
+}
+//# sourceMappingURL=http-client.js.map

package/dist/core/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../src/core/http-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AAkCtF;;GAEG;AACH,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,KAAK,EAAE,aAAa;IAC7B,eAAe,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,eAAe,CAAS;IACxB,mBAAmB,CAAU;IAC7B,UAAU,CAAoB;IAE/C,qDAAqD;IAC7C,MAAM,CAAU,aAAa,GAAG,EAAE,CAAC;IAE3C,YAAY,MAAwB;QAClC,6CAA6C;QAC7C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAElD,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC;QAEnC,2BAA2B;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/F,IAAI,CAAC,UAAU,GAAG,SAAS,WAAW,EAAE,CAAC;QAEzC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;QAClD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QAC1E,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,IAAI,KAAK,CAAC;QAE/D,qCAAqC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;YACvF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,QAAQ,CAChB,iEAAiE,EACjE,SAAS,EACT,iGAAiG,CAClG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,KAAK,CACX,sEAAsE;gBACtE,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CACX,0DAA0D;gBAC1D,2CAA2C,CAC5C,CAAC;YACF,IAAI,CAAC,UAAU,GAAG,IAAI,KAAK,CAAC;gBAC1B,OAAO,EAAE;oBACP,kBAAkB,EAAE,KAAK;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAwB,EACxB,aAAa,GAAG,CAAC;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpD,sCAAsC;QACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAC1B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CACjC,CAAC;QAEF,0CAA0C;QAC1C,MAAM,eAAe,GAAG,OAAO,EAAE,MAAM;YACrC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,YAAY,GAAgB;gBAChC,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,eAAe;gBACvB,iFAAiF;gBACjF,QAAQ,EAAE,QAAQ;aACnB,CAAC;YAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAED,qDAAqD;YACrD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,0EAA0E;gBACzE,YAAwC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACzE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEhD,YAAY,CAAC,SAAS,CAAC,CAAC;YAExB,gEAAgE;YAChE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,cAAc,CAAI,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAChF,CAAC;YAED,iEAAiE;YACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,mBAAmB,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC9E,MAAM,IAAI,YAAY,CACpB,uBAAuB,mBAAmB,QAAQ,EAClD,SAAS,EACT,wEAAwE,CACzE,CAAC;YACJ,CAAC;YAED,iBAAiB;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,mFAAmF;YACnF,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrE,MAAM,IAAI,YAAY,CACpB,uBAAuB,IAAI,CAAC,MAAM,QAAQ,EAC1C,SAAS,EACT,wEAAwE,CACzE,CAAC;YACJ,CAAC;YAED,IAAI,IAAO,CAAC;YACZ,IAAI,CAAC;gBACH,sEAAsE;gBACtE,yCAAyC;gBACzC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;wBACjD,OAAO,SAAS,CAAC;oBACnB,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;gBAC9B,IAAI,GAAG,IAAoB,CAAC;YAC9B,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAC1B,QAAkB,EAClB,MAAc,EACd,IAAa,EACb,OAAmC,EACnC,aAAqB;QAErB,IAAI,aAAa,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,SAAS,EACT,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CACpB,sBAAsB,QAAQ,CAAC,MAAM,2BAA2B,EAChE,SAAS,EACT,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,yBAAyB,QAAQ,EAAE,EACnC,SAAS,EACT,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CACpB,kCAAkC,IAAI,CAAC,UAAU,MAAM,WAAW,CAAC,MAAM,EAAE,EAC3E,SAAS,EACT,6GAA6G,CAC9G,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,IAAY;QAC3B,sDAAsD;QACtD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,IAAI,YAAY,CAAC,gCAAgC,SAAS,CAAC,MAAM,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAA+B;QAClD,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,iBAAiB,WAAW,EAAE;YAC5C,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,MAAc,EAAE,IAAa;QACnD,8DAA8D;QAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEnD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,MAAM,IAAI,SAAS,CACjB,gDAAgD,EAChD,aAAa,EACb,sDAAsD,CACvD,CAAC;YACJ,KAAK,GAAG;gBACN,MAAM,IAAI,SAAS,CACjB,0CAA0C,EAC1C,aAAa,EACb,4DAA4D,CAC7D,CAAC;YACJ,KAAK,GAAG;gBACN,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC/E,KAAK,GAAG;gBACN,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YACrF,KAAK,GAAG;gBACN,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,mBAAmB,EACnB,MAAM,EACN,aAAa,EACb,oCAAoC,CACrC,CAAC;YACJ,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACN,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,cAAc,EACd,MAAM,EACN,aAAa,EACb,6CAA6C,CAC9C,CAAC;YACJ;gBACE,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,wCAAwC;IAChC,MAAM,CAAU,cAAc,GAAgC;QACpE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAClC,+CAA+C,EAC/C,SAAS,EACT,wDAAwD,CACzD;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAC/B,0CAA0C,EAC1C,SAAS,EACT,0EAA0E,CAC3E;QACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAClC,yDAAyD,EACzD,SAAS,EACT,+FAA+F,CAChG;QACD,+BAA+B,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CACjD,yDAAyD,EACzD,SAAS,EACT,+FAA+F,CAChG;KACF,CAAC;IAEF,qEAAqE;IAC7D,MAAM,CAAU,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAClD,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;KACpD,CAAC,CAAC;IAEH;;OAEG;IACK,cAAc,CAAC,KAAc;QACnC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,IAAI,YAAY,CACrB,mBAAmB,EACnB,SAAS,EACT,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,MAAM;YAAE,OAAO,MAAM,EAAE,CAAC;QAE5B,IAAI,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAC,KAAY;QACnC,yBAAyB;QACzB,IAAI,MAAM,IAAI,KAAK,IAAI,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAQ,KAA+B,CAAC,IAAI,CAAC;QAC/C,CAAC;QACD,kEAAkE;QAClE,MAAM,KAAK,GAAI,KAAmC,CAAC,KAAK,CAAC;QACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,IAAa;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,mBAAmB,GAAG;YAC1B,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ;YACxD,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa;YAC1D,aAAa;SACd,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;;AAGH;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/core/safety-controller.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Safety Controller for mainwpcontrol
+ *
+ * Enforces the destructive action protocol defined in PLAN.md:
+ * - Safety check happens BEFORE any network call
+ * - dry_run and confirm are mutually exclusive
+ * - Destructive abilities require preview first
+ *
+ * INVARIANT: AI is the primary interaction surface, NOT the execution authority.
+ */
+import type { Ability, ExecutionResult } from './abilities-executor.js';
+/**
+ * Preview result from dry_run execution
+ */
+export interface PreviewResult {
+    /** Items that would be affected */
+    affected: unknown[];
+    /** Summary of changes */
+    summary: string;
+    /** Whether approval is required to execute */
+    requiresApproval: boolean;
+    /** The ability being previewed */
+    abilityName: string;
+    /** Original input parameters */
+    input: Record<string, unknown>;
+}
+/**
+ * Safety classification for an ability
+ */
+export interface SafetyClassification {
+    /** Whether this ability is destructive */
+    isDestructive: boolean;
+    /** Whether this ability is read-only */
+    isReadOnly: boolean;
+    /** Whether this ability is idempotent */
+    isIdempotent: boolean;
+    /** Whether safety flow is required */
+    requiresSafetyFlow: boolean;
+}
+/**
+ * Execution intent from user
+ */
+export type ExecutionIntent = {
+    mode: 'preview';
+} | {
+    mode: 'execute';
+} | {
+    mode: 'auto';
+};
+export declare class SafetyController {
+    /**
+     * Classify an ability's safety requirements
+     *
+     * Safety classification derives ONLY from ability annotations.
+     * No heuristics are permitted.
+     */
+    classify(ability: Ability): SafetyClassification;
+    /**
+     * Known-destructive ability name patterns.
+     * These abilities require the safety flow regardless of API-reported annotations.
+     */
+    private static readonly DESTRUCTIVE_PATTERNS;
+    private isKnownDestructivePattern;
+    /**
+     * Validate annotation fields and resolve contradictions.
+     *
+     * - Non-boolean values fall back to safe defaults.
+     * - Contradictory annotations (destructive + readonly) → warn and treat as destructive.
+     */
+    private validateAnnotations;
+    /**
+     * Check if an ability requires the safety flow
+     */
+    requiresSafetyFlow(ability: Ability): boolean;
+    /**
+     * Validate execution flags BEFORE any network call
+     *
+     * @throws MutualExclusionError if dry_run and confirm are both true
+     * @throws InputError if destructive ability has neither flag
+     */
+    validateExecutionFlags(ability: Ability, dryRun?: boolean, confirm?: boolean): void;
+    /**
+     * Determine execution intent from flags
+     */
+    determineIntent(dryRun?: boolean, confirm?: boolean): ExecutionIntent;
+    /**
+     * Check if execution should proceed directly (without preview)
+     *
+     * Returns true for:
+     * - Read-only abilities
+     * - Explicit confirm flag
+     * - Non-destructive abilities
+     */
+    shouldExecuteDirectly(ability: Ability, dryRun?: boolean, confirm?: boolean): boolean;
+    /**
+     * Format a preview result from API response
+     */
+    formatPreviewResult(ability: Ability, input: Record<string, unknown>, apiResult: ExecutionResult): PreviewResult;
+    /**
+     * Extract affected items from API preview response
+     */
+    private extractAffectedItems;
+    /** Ability name keywords → past-tense action verbs */
+    private static readonly ACTION_VERBS;
+    /**
+     * Generate human-readable preview summary
+     */
+    private generatePreviewSummary;
+}
+/**
+ * Get the safety controller singleton
+ */
+export declare function getSafetyController(): SafetyController;
+//# sourceMappingURL=safety-controller.d.ts.map

package/dist/core/safety-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-controller.d.ts","sourceRoot":"","sources":["../../src/core/safety-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAsB,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG5F;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,aAAa,EAAE,OAAO,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,yCAAyC;IACzC,YAAY,EAAE,OAAO,CAAC;IACtB,sCAAsC;IACtC,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBrB,qBAAa,gBAAgB;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,oBAAoB;IAoBhD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAQ1C;IAEF,OAAO,CAAC,yBAAyB;IAIjC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;OAEG;IACH,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO;IAI7C;;;;;OAKG;IACH,sBAAsB,CACpB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,IAAI;IAuBP;;OAEG;IACH,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,eAAe;IAUrE;;;;;;;OAOG;IACH,qBAAqB,CACnB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO;IA2BV;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,eAAe,GACzB,aAAa;IAchB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA2B5B,sDAAsD;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIlC;IAEF;;OAEG;IACH,OAAO,CAAC,sBAAsB;CAU/B;AAOD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CAKtD"}