@nacre.work/core 0.34.0 → 0.35.0

package/dist/notifications.d.ts

@@ -0,0 +1,134 @@
+import { type Message } from './mail.js';
+/**
+ * Notifications and alert rules. docs/mcp-admin.md, "Notifications".
+ *
+ * The bounds, the one validation both ends run, and the two messages the
+ * worker sends. In the core rather than beside the API's other messages
+ * because the worker sends these and cannot import the API — and
+ * `packages/api/src/messages.ts` lists them with the rest, so the preview and
+ * anything else reasoning about the set still sees one list.
+ *
+ * ## Who can receive one
+ *
+ * A recipient is a **user id** in the caller's own organization, active, and
+ * nothing else. There is no field for an address anywhere: the tools take an
+ * address only to *find a person*, the outbox stores ids, and the worker reads
+ * the address from `users` at the moment of sending, scoped to the
+ * notification's organization. T35 is the refusal at the first step; the
+ * second and third are why the first is not the only thing standing.
+ *
+ * ## Why a notification carries no links
+ *
+ * The body is somebody's prose sent from this installation's own address, to
+ * everybody in an organization if the agent asked for that — which is the
+ * exact shape of a phishing message, and on a surface whose threat model is an
+ * instruction planted in a document. A person applies every one, and reads it
+ * first; a person also reads a message saying their password expired and
+ * linking somewhere convincing. So a URL in either part is refused, with the
+ * reason, and the only link in a message this installation sends is one the
+ * installation built from its own configuration.
+ */
+/** Explicit recipients on one notification or one rule. "Every org_admin" is a flag, not a list. */
+export declare const NOTIFY_MAX_RECIPIENTS = 20;
+export declare const NOTIFY_SUBJECT_MAX = 200;
+export declare const NOTIFY_BODY_MAX = 4000;
+/**
+ * Notifications queued per organization in any hour, agents and rules together.
+ *
+ * A constant rather than a variable: it is the bound on how loud one tenant's
+ * agent can be through the installation's relay, and an operator who wants a
+ * louder one is asking for something nobody has argued for. Thirty is a
+ * person's inbox having a bad hour, not a mailing list.
+ */
+export declare const NOTIFY_PER_HOUR = 30;
+/** What an alert rule can watch. Each is answered from what the database already records. */
+export declare const ALERT_KINDS: {
+    readonly skill_by_agent: {
+        readonly counts: false;
+        readonly layered: true;
+        readonly summary: "a skill version written by an agent";
+    };
+    readonly skill_scripts: {
+        readonly counts: false;
+        readonly layered: true;
+        readonly summary: "a skill version that adds scripts";
+    };
+    readonly admin_connection: {
+        readonly counts: false;
+        readonly layered: false;
+        readonly summary: "an administrative connection approved";
+    };
+    readonly denial_spike: {
+        readonly counts: true;
+        readonly layered: false;
+        readonly summary: "one person or service account denied at least the threshold within the window";
+    };
+    readonly documents_failed: {
+        readonly counts: true;
+        readonly layered: true;
+        readonly summary: "at least the threshold of documents failing to index within the window";
+    };
+};
+export type AlertKind = keyof typeof ALERT_KINDS;
+export declare const isAlertKind: (value: unknown) => value is AlertKind;
+/** The window a counting rule takes, in minutes. */
+export declare const ALERT_WINDOW: {
+    readonly min: 5;
+    readonly max: 1440;
+    readonly default: 60;
+};
+/** The sentence a rule is read as, from what it stores. */
+export declare function ruleSentence(rule: {
+    readonly kind: AlertKind;
+    readonly layerSlug: string | null;
+    readonly threshold: number | null;
+    readonly windowMinutes: number | null;
+}): string;
+/**
+ * A subject and a body, or the sentence saying why not.
+ *
+ * Both ends ask it: the tool when it proposes, so the person is never shown
+ * something that would be refused, and the apply, because a stored proposal is
+ * not trusted for having been checked ten minutes ago.
+ */
+export declare function notificationText(subject: unknown, body: unknown): {
+    readonly subject: string;
+    readonly body: string;
+} | {
+    readonly refused: string;
+};
+/**
+ * A name somebody outside the organization chose — an application's registered
+ * name — made safe to put in a message's text: one line, bounded, and broken
+ * where a mail client would otherwise turn it into a link. The rule above, for
+ * the one string in an alert that this installation did not write.
+ */
+export declare function plainName(value: string): string;
+/** What a stored notification says about where it came from, for the message's last line. */
+export type NotificationOrigin = {
+    readonly source: 'agent';
+    /** The person who applied it. */
+    readonly appliedBy: string;
+    /** The application the administrative connection was approved for. */
+    readonly application: string;
+} | {
+    readonly source: 'rule';
+    /** What the rule watches, as `ruleSentence` says it. */
+    readonly when: string;
+    /** Who created the rule, by address, or null where they are gone. */
+    readonly ruleBy: string | null;
+};
+/**
+ * A notification, in the brand, to one address.
+ *
+ * The body is the stored text, a paragraph per blank-line-separated block. The
+ * last line says where it came from — an agent, through which application, and
+ * who applied it; or which rule — because a message from this installation's
+ * address that an agent wrote has to say so, or it borrows trust it was not
+ * given. The one link is to the access log, built from configuration.
+ */
+export declare function notificationMessage(to: string, consoleBase: string, stored: {
+    readonly subject: string;
+    readonly body: string;
+}, origin: NotificationOrigin): Message;
+//# sourceMappingURL=notifications.d.ts.map

package/dist/notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,oGAAoG;AACpG,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAEvC,eAAO,MAAM,kBAAkB,MAAM,CAAA;AACrC,eAAO,MAAM,eAAe,OAAO,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,KAAK,CAAA;AAEjC,6FAA6F;AAC7F,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Bd,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,WAAW,CAAA;AAEhD,eAAO,MAAM,WAAW,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,SACiC,CAAA;AAEvF,oDAAoD;AACpD,eAAO,MAAM,YAAY;;;;CAA8C,CAAA;AAEvE,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC,GAAG,MAAM,CAcT;AAWD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,OAAO,GACZ;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAqBpF;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B,CAAA;AAEL;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC3D,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAmBT"}

package/dist/notifications.js

@@ -0,0 +1,172 @@
+import { consoleUrl, message } from './mail.js';
+/**
+ * Notifications and alert rules. docs/mcp-admin.md, "Notifications".
+ *
+ * The bounds, the one validation both ends run, and the two messages the
+ * worker sends. In the core rather than beside the API's other messages
+ * because the worker sends these and cannot import the API — and
+ * `packages/api/src/messages.ts` lists them with the rest, so the preview and
+ * anything else reasoning about the set still sees one list.
+ *
+ * ## Who can receive one
+ *
+ * A recipient is a **user id** in the caller's own organization, active, and
+ * nothing else. There is no field for an address anywhere: the tools take an
+ * address only to *find a person*, the outbox stores ids, and the worker reads
+ * the address from `users` at the moment of sending, scoped to the
+ * notification's organization. T35 is the refusal at the first step; the
+ * second and third are why the first is not the only thing standing.
+ *
+ * ## Why a notification carries no links
+ *
+ * The body is somebody's prose sent from this installation's own address, to
+ * everybody in an organization if the agent asked for that — which is the
+ * exact shape of a phishing message, and on a surface whose threat model is an
+ * instruction planted in a document. A person applies every one, and reads it
+ * first; a person also reads a message saying their password expired and
+ * linking somewhere convincing. So a URL in either part is refused, with the
+ * reason, and the only link in a message this installation sends is one the
+ * installation built from its own configuration.
+ */
+/** Explicit recipients on one notification or one rule. "Every org_admin" is a flag, not a list. */
+export const NOTIFY_MAX_RECIPIENTS = 20;
+export const NOTIFY_SUBJECT_MAX = 200;
+export const NOTIFY_BODY_MAX = 4000;
+/**
+ * Notifications queued per organization in any hour, agents and rules together.
+ *
+ * A constant rather than a variable: it is the bound on how loud one tenant's
+ * agent can be through the installation's relay, and an operator who wants a
+ * louder one is asking for something nobody has argued for. Thirty is a
+ * person's inbox having a bad hour, not a mailing list.
+ */
+export const NOTIFY_PER_HOUR = 30;
+/** What an alert rule can watch. Each is answered from what the database already records. */
+export const ALERT_KINDS = {
+    skill_by_agent: {
+        counts: false,
+        layered: true,
+        summary: 'a skill version written by an agent',
+    },
+    skill_scripts: {
+        counts: false,
+        layered: true,
+        summary: 'a skill version that adds scripts',
+    },
+    admin_connection: {
+        counts: false,
+        layered: false,
+        summary: 'an administrative connection approved',
+    },
+    denial_spike: {
+        counts: true,
+        layered: false,
+        summary: 'one person or service account denied at least the threshold within the window',
+    },
+    documents_failed: {
+        counts: true,
+        layered: true,
+        summary: 'at least the threshold of documents failing to index within the window',
+    },
+};
+export const isAlertKind = (value) => typeof value === 'string' && Object.prototype.hasOwnProperty.call(ALERT_KINDS, value);
+/** The window a counting rule takes, in minutes. */
+export const ALERT_WINDOW = { min: 5, max: 1440, default: 60 };
+/** The sentence a rule is read as, from what it stores. */
+export function ruleSentence(rule) {
+    const where = rule.layerSlug === null ? '' : ` in the layer ${rule.layerSlug}`;
+    switch (rule.kind) {
+        case 'skill_by_agent':
+            return `an agent writes a skill version${where === '' ? '' : where.replace(' in ', ' for ')}`;
+        case 'skill_scripts':
+            return `a skill version adds scripts${where === '' ? '' : where.replace(' in ', ' for ')}`;
+        case 'admin_connection':
+            return 'somebody approves an administrative connection';
+        case 'denial_spike':
+            return `one person or service account is denied ${String(rule.threshold)} or more times within ${String(rule.windowMinutes)} minutes`;
+        case 'documents_failed':
+            return `${String(rule.threshold)} or more documents fail to index within ${String(rule.windowMinutes)} minutes${where}`;
+    }
+}
+/**
+ * A URL, or something a mail client would turn into one: a scheme, `www.`, or
+ * a dotted name followed by a path. A bare `example.com` is not refused,
+ * because `contract.pdf` is the same shape and over-refusing prose is how a
+ * check gets worked around; with no scheme and no path it is the weakest of
+ * the three, and the person reads the message before it goes.
+ */
+const LINKISH = /\b(?:https?|ftp|mailto|javascript|data|file):|\bwww\.[a-z0-9-]+\.|\b[a-z0-9-]+(?:\.[a-z0-9-]+)+\//iu;
+/**
+ * A subject and a body, or the sentence saying why not.
+ *
+ * Both ends ask it: the tool when it proposes, so the person is never shown
+ * something that would be refused, and the apply, because a stored proposal is
+ * not trusted for having been checked ten minutes ago.
+ */
+export function notificationText(subject, body) {
+    if (typeof subject !== 'string' || subject.trim() === '')
+        return { refused: "'subject' is required." };
+    if (typeof body !== 'string' || body.trim() === '')
+        return { refused: "'body' is required." };
+    const s = subject.trim();
+    // Line endings normalised before the length and character checks, so a body
+    // written on Windows is not refused for the carriage returns in it.
+    const b = body.replace(/\r\n?/gu, '\n').trim();
+    if (s.length > NOTIFY_SUBJECT_MAX)
+        return { refused: `The subject is at most ${String(NOTIFY_SUBJECT_MAX)} characters.` };
+    if (b.length > NOTIFY_BODY_MAX)
+        return { refused: `The body is at most ${String(NOTIFY_BODY_MAX)} characters.` };
+    // eslint-disable-next-line no-control-regex -- refusing control characters is the point
+    if (/[\u0000-\u001f\u007f]/u.test(s))
+        return { refused: 'The subject is one line of plain text.' };
+    // eslint-disable-next-line no-control-regex -- the same, with newline and tab allowed
+    if (/[\u0000-\u0008\u000b-\u001f\u007f]/u.test(b))
+        return { refused: 'The body is plain text: no control characters.' };
+    if (LINKISH.test(s) || LINKISH.test(b)) {
+        return {
+            refused: 'A notification carries no links. It is sent from this installation\'s own address, so a link in it is ' +
+                'one people have every reason to trust — name the layer, document or screen instead.',
+        };
+    }
+    return { subject: s, body: b };
+}
+/**
+ * A name somebody outside the organization chose — an application's registered
+ * name — made safe to put in a message's text: one line, bounded, and broken
+ * where a mail client would otherwise turn it into a link. The rule above, for
+ * the one string in an alert that this installation did not write.
+ */
+export function plainName(value) {
+    // eslint-disable-next-line no-control-regex -- control characters are what is being removed
+    const line = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, 80);
+    return LINKISH.test(line) ? line.replace(/([.:/@])/gu, '$1 ').replace(/\s+/gu, ' ').trim() : line;
+}
+/**
+ * A notification, in the brand, to one address.
+ *
+ * The body is the stored text, a paragraph per blank-line-separated block. The
+ * last line says where it came from — an agent, through which application, and
+ * who applied it; or which rule — because a message from this installation's
+ * address that an agent wrote has to say so, or it borrows trust it was not
+ * given. The one link is to the access log, built from configuration.
+ */
+export function notificationMessage(to, consoleBase, stored, origin) {
+    const paragraphs = stored.body
+        .split(/\n\s*\n/u)
+        .map((p) => p.trim())
+        .filter((p) => p !== '')
+        .map((text) => ({ kind: 'say', text }));
+    const provenance = origin.source === 'agent'
+        ? `An agent wrote this through the administrative connection of the application "${origin.application}", and ${origin.appliedBy} ` +
+            'read it and approved sending it. Nobody outside your organization can be sent one.'
+        : `An alert rule your organization keeps sent this: it emails whenever ${origin.when}` +
+            `${origin.ruleBy === null ? '' : `, and ${origin.ruleBy} set it up`}. An administrator can remove it.`;
+    // Prefixed both ways, so the subject line alone says this is the
+    // installation speaking and which kind of message it is.
+    return message(to, `${origin.source === 'rule' ? 'Nacre alert' : 'Nacre'}: ${stored.subject}`, [
+        ...paragraphs,
+        { kind: 'link', url: consoleUrl(consoleBase, '#/audit'), label: 'Open the access log' },
+        { kind: 'caution', text: provenance },
+    ]);
+}
+//# sourceMappingURL=notifications.js.map

package/dist/notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../notifications.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAgB,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAA;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE;QACd,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,qCAAqC;KAC/C;IACD,aAAa,EAAE;QACb,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,mCAAmC;KAC7C;IACD,gBAAgB,EAAE;QAChB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,uCAAuC;KACjD;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,+EAA+E;KACzF;IACD,gBAAgB,EAAE;QAChB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,wEAAwE;KAClF;CACO,CAAA;AAIV,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAc,EAAsB,EAAE,CAChE,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;AAEvF,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAW,CAAA;AAEvE,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAK5B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,CAAA;IAC9E,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;QAC/F,KAAK,eAAe;YAClB,OAAO,+BAA+B,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;QAC5F,KAAK,kBAAkB;YACrB,OAAO,gDAAgD,CAAA;QACzD,KAAK,cAAc;YACjB,OAAO,2CAA2C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAA;QACvI,KAAK,kBAAkB;YACrB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,KAAK,EAAE,CAAA;IAC3H,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,qGAAqG,CAAA;AAErH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgB,EAChB,IAAa;IAEb,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACtG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAC7F,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IACxB,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,MAAM,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAA;IACzH,IAAI,CAAC,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,CAAA;IAChH,wFAAwF;IACxF,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAA;IAClG,sFAAsF;IACtF,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAA;IACvH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,OAAO,EACL,wGAAwG;gBACxG,qFAAqF;SACxF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,4FAA4F;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrG,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACnG,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,WAAmB,EACnB,MAA2D,EAC3D,MAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI;SAC3B,KAAK,CAAC,UAAU,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,OAAO;QACvB,CAAC,CAAC,iFAAiF,MAAM,CAAC,WAAW,UAAU,MAAM,CAAC,SAAS,GAAG;YAChI,oFAAoF;QACtF,CAAC,CAAC,uEAAuE,MAAM,CAAC,IAAI,EAAE;YACpF,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,YAAY,mCAAmC,CAAA;IAC5G,iEAAiE;IACjE,yDAAyD;IACzD,OAAO,OAAO,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE;QAC7F,GAAG,UAAU;QACb,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE;QACvF,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;KACtC,CAAC,CAAA;AACJ,CAAC"}