@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/lib/app-deployment-service.js

@@ -0,0 +1,282 @@
+/**
+ * Serving a mini app from a hidden URL, with no login.
+ *
+ * Two audiences, kept apart on purpose. The **owner** deploys and withdraws
+ * the link through their authenticated session, and is the only one who ever
+ * sees the token. The **visitor** presents the token and gets exactly two
+ * things: the app's released snapshot, and a short-lived session token that
+ * may run that release and nothing else.
+ *
+ * Every failure a visitor can reach answers the same way — 404, "This app is
+ * not available" — whether the token was never minted, was revoked, names an
+ * app that has since been deleted, or names one that has published nothing.
+ * Distinguishing them would turn the hidden URL into an oracle for guessing
+ * the rest of them.
+ *
+ * The whole surface is production-only (`isAppDeploymentEnabled`). A local
+ * install already answers loopback as user "1" without credentials, so there
+ * a "no login needed" link is a second door onto an open house; production is
+ * where auth is enforced, where asset bytes come back as signed URLs a
+ * logged-out browser can load, and where the app's spend budget is what
+ * stands between a shared link and the owner's provider bill.
+ */
+import { operationTarget } from "@nodetool-ai/app-runtime";
+import { Application, ApplicationDeployment, getApplicationBudget, hasFiniteBudgetLimit, releasedApplicationRelease } from "@nodetool-ai/models";
+import { APP_DEPLOYMENT_SESSION_TTL_SECONDS, isAppDeploymentEnabled } from "@nodetool-ai/protocol";
+import { applicationDeployment, applicationReleaseResponse, publicApplication, publicApplicationSession } from "@nodetool-ai/protocol/api-schemas/applications.js";
+import { mintAppSessionToken } from "@nodetool-ai/auth";
+import { ZodError } from "zod";
+import { ApiErrorCode } from "../error-codes.js";
+import { throwApiError } from "../trpc/error-formatter.js";
+import { loadOwnedApplication } from "./applications-service.js";
+import { resolvePublicAppStaticAssetLocators } from "./public-app-assets.js";
+/** Whether this server offers public app deployments at all. */
+export function appDeploymentsEnabled(env = process.env) {
+    return isAppDeploymentEnabled(env["NODETOOL_ENV"]);
+}
+/** The one answer a visitor gets for every way a link can fail. */
+function notAvailable() {
+    throwApiError(ApiErrorCode.NOT_FOUND, "This app is not available");
+}
+/** A corrupt release is unavailable to a visitor, not a validation oracle. */
+function parsePublicRelease(release) {
+    try {
+        return applicationReleaseResponse.parse(release);
+    }
+    catch (error) {
+        if (error instanceof ZodError)
+            notAvailable();
+        throw error;
+    }
+}
+/**
+ * Refuse the whole surface outside production, for the owner as well as the
+ * visitor. A deploy that silently succeeded locally would hand the owner a URL
+ * that stops working the moment it matters.
+ */
+function requireEnabled() {
+    if (!appDeploymentsEnabled()) {
+        throwApiError(ApiErrorCode.FORBIDDEN, "Deploying an app to a public URL is only available on nodetool.ai");
+    }
+}
+const PUBLIC_BUDGET_REQUIRED = "Public app runs require a finite invocation or USD budget. Configure one before deploying.";
+/**
+ * Why a release cannot be served over a public link, or null when it can.
+ *
+ * A public visitor reaches exactly two things: the release payload and the
+ * websocket. Everything else — the tRPC library, the script store, the asset
+ * routes — is refused at the door, on purpose. A workflow operation is fine:
+ * the release carries its pinned graph, so nothing has to be fetched. A script
+ * operation is not: its body lives behind an authenticated call the visitor
+ * cannot make, and a run that silently did nothing would be worse than a
+ * refusal.
+ */
+export function releaseBlockedReason(release) {
+    const documentBlocked = publicReleaseDocumentBlockedReason(release.document);
+    if (documentBlocked)
+        return documentBlocked;
+    const unpinned = release.document.operations.filter((operation) => {
+        const pinned = release.workflows.find((entry) => entry.workflowId === operation.workflowId);
+        return !pinned?.graph;
+    });
+    if (unpinned.length > 0) {
+        // A snapshot published before releases pinned graphs. A draft run falls
+        // back to the live workflow; a public run must not, because "the live
+        // workflow" is the owner's editable graph and nobody chose to publish it.
+        return "This released version predates pinned graphs. Publish it again to deploy it.";
+    }
+    return null;
+}
+/** Document-level restrictions shared by draft publish and released rollback. */
+export function publicReleaseDocumentBlockedReason(document) {
+    const scripted = document.operations.filter((operation) => operationTarget(operation).kind === "script");
+    if (scripted.length > 0) {
+        return (`A public link cannot run a script operation (${scripted
+            .map((operation) => operation.name || operation.id)
+            .join(", ")}). Move the step into a workflow and publish again.`);
+    }
+    if (document.resources.length > 0) {
+        // A resource binding reads the owner's own library — their assets,
+        // timelines, storyboards, sketches. Serving that to whoever has the link
+        // is not what deploying an app means, and the session cannot make the
+        // call anyway, so the widget would sit empty.
+        return ("A public link cannot open your asset library. Remove the resource " +
+            "bindings and publish again.");
+    }
+    return null;
+}
+/** Return the reason a candidate cannot replace a live public release. */
+export async function publicReleasePreflight(applicationId, candidate) {
+    const blocked = "workflows" in candidate
+        ? releaseBlockedReason(candidate)
+        : publicReleaseDocumentBlockedReason(candidate.document);
+    if (blocked) {
+        if (blocked.includes("script operation")) {
+            return "This app has a live public link. Script operations cannot be published to that audience.";
+        }
+        if (blocked.includes("asset library")) {
+            return "This app has a live public link. Resource bindings cannot be published to that audience.";
+        }
+        return blocked;
+    }
+    return hasFiniteBudgetLimit(await getApplicationBudget(applicationId))
+        ? null
+        : "This app has a live public link. Configure a finite budget before publishing again.";
+}
+const toResponse = (deployment, blockedReason) => applicationDeployment.parse({
+    applicationId: deployment.application_id,
+    token: deployment.token,
+    createdAt: deployment.created_at,
+    revokedAt: deployment.revoked_at,
+    blockedReason
+});
+/** What the app's link would serve right now, and why it might serve nothing. */
+async function currentBlockedReason(applicationId, userId) {
+    const release = await releasedApplicationRelease(applicationId, userId);
+    if (!release)
+        return "This app has no released version to serve.";
+    const releaseBlocked = releaseBlockedReason(applicationReleaseResponse.parse(release));
+    if (releaseBlocked)
+        return releaseBlocked;
+    return hasFiniteBudgetLimit(await getApplicationBudget(applicationId))
+        ? null
+        : PUBLIC_BUDGET_REQUIRED;
+}
+/** The app's live deployment, or null when it has none. Owner only. */
+export async function getApplicationDeployment(userId, applicationId) {
+    requireEnabled();
+    await loadOwnedApplication(userId, applicationId);
+    const deployment = await ApplicationDeployment.findLive(applicationId);
+    if (!deployment)
+        return null;
+    return toResponse(deployment, await currentBlockedReason(applicationId, userId));
+}
+/**
+ * Deploy the app, returning the link — the one already out there when it has
+ * one, so re-deploying never invalidates a URL somebody pasted somewhere.
+ *
+ * An app with nothing released is refused rather than deployed dark: the
+ * public page serves the release, so a deployment without one is a link that
+ * resolves to nothing, and the owner should hear that now instead of from
+ * whoever they sent it to.
+ */
+export async function deployApplication(userId, applicationId) {
+    requireEnabled();
+    const app = await loadOwnedApplication(userId, applicationId);
+    const release = await releasedApplicationRelease(applicationId, userId);
+    if (!release) {
+        throwApiError(ApiErrorCode.INVALID_INPUT, "Publish a version of this app before deploying it");
+    }
+    // A release the public runtime cannot execute is refused now rather than
+    // deployed dark: the owner is here, and whoever they would have sent the
+    // link to is not.
+    const blocked = releaseBlockedReason(applicationReleaseResponse.parse(release));
+    if (blocked)
+        throwApiError(ApiErrorCode.INVALID_INPUT, blocked);
+    if (!hasFiniteBudgetLimit(await getApplicationBudget(applicationId))) {
+        throwApiError(ApiErrorCode.INVALID_INPUT, PUBLIC_BUDGET_REQUIRED);
+    }
+    const deployment = await ApplicationDeployment.ensure({
+        applicationId: app.id,
+        userId
+    });
+    return toResponse(deployment, null);
+}
+/**
+ * Withdraw the link. Sessions already minted keep running until they expire —
+ * they are signed, not stored — so this stops new visitors rather than
+ * interrupting one mid-run.
+ */
+export async function undeployApplication(userId, applicationId) {
+    requireEnabled();
+    await loadOwnedApplication(userId, applicationId);
+    await ApplicationDeployment.revokeAllLive(applicationId);
+    return { ok: true };
+}
+/**
+ * The deployment behind a token, with its app and current release, or the
+ * single 404 every failure shares.
+ *
+ * The release is read fresh on every request rather than pinned to the
+ * deployment: publishing a new version is how an owner updates a deployed app,
+ * and a link that kept serving the version that was current when it was minted
+ * would make publish a no-op for exactly the audience it was published for.
+ */
+async function resolveDeployment(token) {
+    // The visitor gets the same 404 for a server that does not offer
+    // deployments as for a token that was never minted. `requireEnabled`'s
+    // explanation is for the owner, who is asking about their own app; telling
+    // a stranger which servers have the surface turned off tells them where to
+    // go looking for links.
+    if (!appDeploymentsEnabled())
+        notAvailable();
+    const deployment = await ApplicationDeployment.findLiveByToken(token);
+    if (!deployment)
+        notAvailable();
+    const application = await Application.findById(deployment.application_id);
+    // The deployment cascades with its app, so a missing app here means a
+    // database that lost the cascade rather than a normal state — either way the
+    // link serves nothing.
+    if (!application || application.user_id !== deployment.user_id) {
+        notAvailable();
+    }
+    const release = await releasedApplicationRelease(deployment.application_id, deployment.user_id);
+    if (!release)
+        notAvailable();
+    // A version published after the link was minted can be one the public
+    // runtime cannot execute. The link stops serving rather than serving
+    // something that half-works; the owner sees why in `blockedReason`, and the
+    // visitor gets the same 404 every other failure gives them.
+    if (releaseBlockedReason(parsePublicRelease(release)) ||
+        !hasFiniteBudgetLimit(await getApplicationBudget(deployment.application_id))) {
+        notAvailable();
+    }
+    return { deployment, application, release };
+}
+/** What the public page renders: the app's identity and the release to run. */
+export async function getPublicApplication(token) {
+    const { application, release } = await resolveDeployment(token);
+    try {
+        const publicRelease = parsePublicRelease(release);
+        const document = {
+            ...publicRelease.document,
+            ui: await resolvePublicAppStaticAssetLocators(publicRelease.document.ui, application.user_id),
+            variables: await resolvePublicAppStaticAssetLocators(publicRelease.document.variables, application.user_id)
+        };
+        return publicApplication.parse({
+            id: application.id,
+            name: application.name,
+            description: application.description,
+            release: { ...publicRelease, document }
+        });
+    }
+    catch (error) {
+        if (error instanceof ZodError)
+            notAvailable();
+        throw error;
+    }
+}
+/**
+ * Mint the credential the public page runs on.
+ *
+ * It authenticates as the app's owner — their graphs, their keys, their
+ * budget — and carries the application id, which is what every consumer
+ * narrows on. Nothing about the visitor is recorded: a session is derived
+ * from the deployment and the clock, so it needs no row and revoking the
+ * deployment is the only state there is to change.
+ */
+export async function createPublicApplicationSession(token, signingKey) {
+    const { deployment, release } = await resolveDeployment(token);
+    const minted = mintAppSessionToken(signingKey, {
+        userId: deployment.user_id,
+        applicationId: deployment.application_id,
+        version: release.version
+    }, APP_DEPLOYMENT_SESSION_TTL_SECONDS);
+    return publicApplicationSession.parse({
+        token: minted.token,
+        expiresAt: minted.expiresAt,
+        applicationId: deployment.application_id,
+        version: release.version
+    });
+}
+//# sourceMappingURL=app-deployment-service.js.map

package/dist/lib/app-deployment-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-deployment-service.js","sourceRoot":"","sources":["../../src/lib/app-deployment-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,wBAAwB,EAKzB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAE7E,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY;IACnB,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CACzB,OAA4E;IAE5E,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ;YAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,aAAa,CACX,YAAY,CAAC,SAAS,EACtB,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,GAC1B,4FAA4F,CAAC;AAS/F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmC;IAEnC,MAAM,eAAe,GAAG,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CACrD,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,OAAO,8EAA8E,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAA+B;IAE/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CACzC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,QAAQ,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,gDAAgD,QAAQ;aACrD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,qDAAqD,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,8CAA8C;QAC9C,OAAO,CACL,oEAAoE;YACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,SAEuC;IAEvC,MAAM,OAAO,GACX,WAAW,IAAI,SAAS;QACtB,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,kCAAkC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,0FAA0F,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO,0FAA0F,CAAC;QACpG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qFAAqF,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,UAAiC,EACjC,aAA4B,EACC,EAAE,CAC/B,qBAAqB,CAAC,KAAK,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC,cAAc;IACxC,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,SAAS,EAAE,UAAU,CAAC,UAAU;IAChC,SAAS,EAAE,UAAU,CAAC,UAAU;IAChC,aAAa;CACd,CAAC,CAAC;AAEL,iFAAiF;AACjF,KAAK,UAAU,oBAAoB,CACjC,aAAqB,EACrB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,4CAA4C,CAAC;IAClE,MAAM,cAAc,GAAG,oBAAoB,CACzC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,sBAAsB,CAAC;AAC7B,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,UAAU,CACf,UAAU,EACV,MAAM,oBAAoB,CAAC,aAAa,EAAE,MAAM,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,aAAa,CACX,YAAY,CAAC,aAAa,EAC1B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,kBAAkB;IAClB,MAAM,OAAO,GAAG,oBAAoB,CAClC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,IAAI,OAAO;QAAE,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC;QACpD,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,MAAM;KACP,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,qBAAqB,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAK5C,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,wBAAwB;IACxB,IAAI,CAAC,qBAAqB,EAAE;QAAE,YAAY,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU;QAAE,YAAY,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1E,sEAAsE;IACtE,6EAA6E;IAC7E,uBAAuB;IACvB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,OAAO,CACnB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,YAAY,EAAE,CAAC;IAC7B,sEAAsE;IACtE,qEAAqE;IACrE,4EAA4E;IAC5E,4DAA4D;IAC5D,IACE,oBAAoB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,oBAAoB,CACnB,MAAM,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,CACtD,EACD,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG;YACf,GAAG,aAAa,CAAC,QAAQ;YACzB,EAAE,EAAE,MAAM,mCAAmC,CAC3C,aAAa,CAAC,QAAQ,CAAC,EAAE,EACzB,WAAW,CAAC,OAAO,CACpB;YACD,SAAS,EAAE,MAAM,mCAAmC,CAClD,aAAa,CAAC,QAAQ,CAAC,SAAS,EAChC,WAAW,CAAC,OAAO,CACpB;SACF,CAAC;QACF,OAAO,iBAAiB,CAAC,KAAK,CAAC;YAC7B,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ;YAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAa,EACb,UAA2B;IAE3B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,mBAAmB,CAChC,UAAU,EACV;QACE,MAAM,EAAE,UAAU,CAAC,OAAO;QAC1B,aAAa,EAAE,UAAU,CAAC,cAAc;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,EACD,kCAAkC,CACnC,CAAC;IACF,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,UAAU,CAAC,cAAc;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC"}