@pellux/goodvibes-sdk 0.18.13 → 0.18.15

package/dist/_internal/platform/daemon/control-plane.js

@@ -0,0 +1,402 @@
+import { authenticateOperatorRequest, authenticateOperatorToken, extractOperatorAuthToken, isOperatorAdmin, } from '@pellux/goodvibes-sdk/platform/security/http-auth';
+import { extractForwardedClientIp } from '../runtime/network/index.js';
+import { resolveGatewayPathTemplate } from './helpers.js';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+import { buildMissingScopeBody, resolveAuthenticatedPrincipal, } from '@pellux/goodvibes-sdk/platform/daemon/http-policy';
+export class DaemonControlPlaneHelper {
+    context;
+    constructor(context) {
+        this.context = context;
+    }
+    trustProxyEnabled() {
+        return this.context.trustProxyEnabled();
+    }
+    extractAuthToken(req) {
+        return extractOperatorAuthToken(req);
+    }
+    checkAuth(req) {
+        return authenticateOperatorRequest(req, {
+            sharedToken: this.context.authToken(),
+            userAuth: this.context.userAuth,
+        }) !== null;
+    }
+    requireAuthenticatedSession(req) {
+        const authenticated = authenticateOperatorRequest(req, {
+            sharedToken: this.context.authToken(),
+            userAuth: this.context.userAuth,
+        });
+        if (!authenticated || authenticated.kind !== 'session')
+            return null;
+        return {
+            username: authenticated.username,
+            roles: authenticated.roles,
+        };
+    }
+    requireAdmin(req) {
+        const authenticated = authenticateOperatorRequest(req, {
+            sharedToken: this.context.authToken(),
+            userAuth: this.context.userAuth,
+        });
+        if (!authenticated)
+            return Response.json({ error: 'Unauthorized' }, { status: 401 });
+        if (!isOperatorAdmin(authenticated)) {
+            return Response.json({ error: 'Admin role required' }, { status: 403 });
+        }
+        return null;
+    }
+    async requireRemotePeer(req, scope) {
+        const token = this.extractAuthToken(req);
+        const auth = await this.context.distributedRuntime.authenticatePeerToken(token, extractForwardedClientIp(req, this.trustProxyEnabled()));
+        if (!auth) {
+            return Response.json({ error: 'Unauthorized remote peer' }, { status: 401 });
+        }
+        if (scope && !auth.token.scopes.includes(scope)) {
+            return Response.json({ error: `Remote peer token missing required scope: ${scope}` }, { status: 403 });
+        }
+        return auth;
+    }
+    describeAuthenticatedPrincipal(token) {
+        const authenticated = authenticateOperatorToken(token, {
+            sharedToken: this.context.authToken(),
+            userAuth: this.context.userAuth,
+        });
+        if (!authenticated)
+            return null;
+        if (authenticated.kind === 'shared-token') {
+            return {
+                principalId: 'shared-token',
+                principalKind: 'token',
+                admin: true,
+                scopes: this.getGrantedGatewayScopes(true),
+            };
+        }
+        const admin = authenticated.roles.includes('admin');
+        return {
+            principalId: authenticated.username,
+            principalKind: 'user',
+            admin,
+            scopes: this.getGrantedGatewayScopes(admin),
+        };
+    }
+    getGrantedGatewayScopes(includeWrite) {
+        const scopes = new Set(this.context.gatewayMethods.getAllScopes({ includeWrite }));
+        scopes.add('read:events');
+        scopes.add('read:control-plane');
+        scopes.add('read:telemetry');
+        if (includeWrite)
+            scopes.add('read:telemetry-sensitive');
+        if (includeWrite)
+            scopes.add('write:control-plane');
+        return [...scopes].sort();
+    }
+    validateGatewayInvocation(descriptor, context) {
+        if (descriptor.invokable === false) {
+            return {
+                status: 400,
+                ok: false,
+                body: {
+                    error: `Gateway method is cataloged but not invokable through method dispatch: ${descriptor.id}`,
+                },
+            };
+        }
+        if (descriptor.access === 'public') {
+            return null;
+        }
+        if (descriptor.access === 'admin' && !context?.admin) {
+            return {
+                status: 403,
+                ok: false,
+                body: { error: `Gateway method requires admin access: ${descriptor.id}` },
+            };
+        }
+        if (descriptor.access === 'remote-peer' && context?.principalKind !== 'remote-peer') {
+            return {
+                status: 403,
+                ok: false,
+                body: { error: `Gateway method requires a remote-peer principal: ${descriptor.id}` },
+            };
+        }
+        const body = buildMissingScopeBody(descriptor.id, descriptor.scopes, context?.scopes);
+        if (body) {
+            return {
+                status: 403,
+                ok: false,
+                body,
+            };
+        }
+        return null;
+    }
+    tryUpgradeControlPlaneWebSocket(req, server) {
+        const url = new URL(req.url);
+        if (url.pathname !== '/api/control-plane/ws' || req.method !== 'GET') {
+            return null;
+        }
+        const token = this.extractAuthToken(req);
+        const principal = resolveAuthenticatedPrincipal(req, this);
+        if (token && !principal) {
+            return Response.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        const rawDomains = url.searchParams.get('domains');
+        const domains = (rawDomains ? rawDomains.split(',').map((value) => value.trim()).filter(Boolean) : []);
+        const requestedKind = url.searchParams.get('clientKind');
+        const clientKind = requestedKind === 'tui'
+            || requestedKind === 'web'
+            || requestedKind === 'slack'
+            || requestedKind === 'discord'
+            || requestedKind === 'ntfy'
+            || requestedKind === 'daemon'
+            || requestedKind === 'webhook'
+            ? requestedKind
+            : 'web';
+        const upgraded = server.upgrade(req, {
+            data: {
+                channel: 'control-plane',
+                authToken: token,
+                principalId: principal?.principalId ?? null,
+                principalKind: principal?.principalKind ?? null,
+                scopes: principal?.scopes ?? [],
+                admin: principal?.admin ?? false,
+                domains,
+                clientKind,
+                remoteAddress: extractForwardedClientIp(req, this.trustProxyEnabled()),
+                authenticated: Boolean(principal),
+            },
+        });
+        return upgraded ? 'upgraded' : Response.json({ error: 'WebSocket upgrade failed' }, { status: 400 });
+    }
+    handleControlPlaneWebSocketOpen(ws) {
+        const connection = this.context.controlPlaneGateway.openWebSocketClient({
+            clientKind: ws.data.clientKind,
+            transport: 'ws',
+            domains: ws.data.authenticated ? ws.data.domains : [],
+            ...(ws.data.principalId ? { principalId: ws.data.principalId } : {}),
+            ...(ws.data.principalKind ? { principalKind: ws.data.principalKind } : {}),
+            ...(ws.data.scopes.length > 0 ? { scopes: ws.data.scopes } : {}),
+            remoteAddress: ws.data.remoteAddress,
+        }, (event, payload) => {
+            ws.send(JSON.stringify({ type: 'event', event, payload }));
+        });
+        ws.data.clientId = connection.clientId;
+    }
+    async handleControlPlaneWebSocketMessage(ws, message) {
+        const clientId = ws.data.clientId;
+        if (!clientId)
+            return;
+        const text = typeof message === 'string'
+            ? message
+            : message instanceof Uint8Array
+                ? new TextDecoder().decode(message)
+                : message instanceof ArrayBuffer
+                    ? new TextDecoder().decode(new Uint8Array(message))
+                    : Buffer.from(message).toString('utf8');
+        let frame;
+        try {
+            frame = JSON.parse(text);
+        }
+        catch {
+            ws.send(JSON.stringify({ type: 'error', error: 'Invalid JSON frame' }));
+            return;
+        }
+        this.context.controlPlaneGateway.touchWebSocketClient(clientId, {
+            lastFrameType: typeof frame.type === 'string' ? frame.type : 'unknown',
+        });
+        if (frame.type === 'ping') {
+            ws.send(JSON.stringify({ type: 'pong', ts: Date.now() }));
+            return;
+        }
+        if (frame.type === 'auth') {
+            const token = typeof frame.token === 'string' ? frame.token : ws.data.authToken;
+            const principal = this.describeAuthenticatedPrincipal(token);
+            if (!principal) {
+                ws.send(JSON.stringify({ type: 'auth', ok: false, error: 'Unauthorized' }));
+                return;
+            }
+            this.context.controlPlaneGateway.authenticateClient(clientId, {
+                principalId: principal.principalId,
+                principalKind: principal.principalKind,
+                scopes: principal.scopes,
+                ...(typeof frame.label === 'string' ? { label: frame.label } : {}),
+                ...(Array.isArray(frame.capabilities) ? { capabilities: frame.capabilities.filter((value) => typeof value === 'string') } : {}),
+            });
+            if (Array.isArray(frame.domains)) {
+                this.context.controlPlaneGateway.subscribeWebSocketClient(clientId, frame.domains.filter((value) => typeof value === 'string'));
+            }
+            ws.data.authToken = token;
+            ws.data.principalId = principal.principalId;
+            ws.data.principalKind = principal.principalKind;
+            ws.data.scopes = principal.scopes;
+            ws.data.admin = principal.admin;
+            ws.data.authenticated = true;
+            ws.send(JSON.stringify({ type: 'auth', ok: true, clientId, principalId: principal.principalId }));
+            return;
+        }
+        if (frame.type === 'subscribe') {
+            if (!ws.data.authenticated) {
+                ws.send(JSON.stringify({ type: 'error', error: 'Authenticate before subscribing' }));
+                return;
+            }
+            const domains = Array.isArray(frame.domains)
+                ? frame.domains.filter((value) => typeof value === 'string')
+                : [];
+            this.context.controlPlaneGateway.subscribeWebSocketClient(clientId, domains);
+            ws.send(JSON.stringify({ type: 'subscribed', clientId, domains }));
+            return;
+        }
+        if (frame.type === 'unsubscribe') {
+            const domains = Array.isArray(frame.domains)
+                ? frame.domains.filter((value) => typeof value === 'string')
+                : undefined;
+            this.context.controlPlaneGateway.unsubscribeWebSocketClient(clientId, domains);
+            ws.send(JSON.stringify({ type: 'unsubscribed', clientId, domains: domains ?? [] }));
+            return;
+        }
+        if (frame.type === 'call') {
+            if (!ws.data.authenticated || !ws.data.principalId || !ws.data.principalKind) {
+                ws.send(JSON.stringify({ type: 'error', error: 'Authenticate before invoking methods' }));
+                return;
+            }
+            const id = typeof frame.id === 'string' ? frame.id : `call-${Date.now()}`;
+            const methodId = typeof frame.methodId === 'string' ? frame.methodId : undefined;
+            const response = methodId
+                ? await this.invokeGatewayMethodCall({
+                    authToken: ws.data.authToken,
+                    methodId,
+                    query: typeof frame.query === 'object' && frame.query !== null ? frame.query : undefined,
+                    body: frame.body,
+                    context: {
+                        principalId: ws.data.principalId,
+                        principalKind: ws.data.principalKind,
+                        admin: ws.data.admin,
+                        scopes: ws.data.scopes,
+                        clientKind: ws.data.clientKind,
+                    },
+                })
+                : await this.invokeWebSocketControlPlaneCall({
+                    authToken: ws.data.authToken,
+                    method: typeof frame.method === 'string' ? frame.method.toUpperCase() : 'GET',
+                    path: typeof frame.path === 'string' ? frame.path : '/api/control-plane',
+                    query: typeof frame.query === 'object' && frame.query !== null ? frame.query : undefined,
+                    body: frame.body,
+                    context: {
+                        principalKind: ws.data.principalKind,
+                        admin: ws.data.admin,
+                        scopes: ws.data.scopes,
+                    },
+                });
+            ws.send(JSON.stringify({
+                type: 'response',
+                id,
+                ok: response.ok,
+                status: response.status,
+                body: response.body,
+            }));
+            return;
+        }
+        ws.send(JSON.stringify({ type: 'error', error: 'Unsupported frame type' }));
+    }
+    handleControlPlaneWebSocketClose(ws) {
+        if (!ws.data.clientId)
+            return;
+        this.context.controlPlaneGateway.closeWebSocketClient(ws.data.clientId, 'socket-closed');
+    }
+    async invokeWebSocketControlPlaneCall(input) {
+        const matchedDescriptor = this.context.gatewayMethods.findByHttpBinding(input.method, input.path);
+        if (matchedDescriptor) {
+            const denied = this.validateGatewayInvocation(matchedDescriptor, input.context);
+            if (denied)
+                return denied;
+        }
+        const url = new URL(`http://${this.context.host}:${this.context.port}${input.path.startsWith('/') ? input.path : `/${input.path}`}`);
+        for (const [key, value] of Object.entries(input.query ?? {})) {
+            if (value === undefined || value === null)
+                continue;
+            url.searchParams.set(key, String(value));
+        }
+        const request = new Request(url.toString(), {
+            method: input.method,
+            headers: {
+                Authorization: `Bearer ${input.authToken}`,
+                ...(input.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+            },
+            ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),
+        });
+        const response = await this.context.dispatchApiRoutes(request) ?? Response.json({ error: 'Not found' }, { status: 404 });
+        const raw = await response.text();
+        let body = raw;
+        if (raw.length > 0) {
+            try {
+                body = JSON.parse(raw);
+            }
+            catch {
+                body = raw;
+            }
+        }
+        else {
+            body = null;
+        }
+        return {
+            status: response.status,
+            ok: response.ok,
+            body,
+        };
+    }
+    async invokeGatewayMethodCall(input) {
+        const descriptor = this.context.gatewayMethods.get(input.methodId);
+        if (!descriptor) {
+            return { status: 404, ok: false, body: { error: `Unknown gateway method: ${input.methodId}` } };
+        }
+        const denied = this.validateGatewayInvocation(descriptor, input.context);
+        if (denied)
+            return denied;
+        if (this.context.gatewayMethods.hasHandler(input.methodId)) {
+            try {
+                const body = await this.context.gatewayMethods.invoke(input.methodId, {
+                    body: input.body,
+                    query: input.query,
+                    context: {
+                        authToken: input.authToken,
+                        principalId: input.context?.principalId,
+                        principalKind: input.context?.principalKind,
+                        admin: input.context?.admin,
+                        scopes: input.context?.scopes,
+                        clientKind: input.context?.clientKind,
+                    },
+                });
+                return { status: 200, ok: true, body };
+            }
+            catch (error) {
+                return {
+                    status: 500,
+                    ok: false,
+                    body: { error: summarizeError(error) },
+                };
+            }
+        }
+        if (!descriptor.http) {
+            return { status: 501, ok: false, body: { error: `Gateway method is not invokable: ${input.methodId}` } };
+        }
+        const resolvedPath = resolveGatewayPathTemplate(descriptor.http.path, input.query, input.body);
+        if (!resolvedPath.path) {
+            return {
+                status: 400,
+                ok: false,
+                body: {
+                    error: `Missing path parameter${resolvedPath.missing.length === 1 ? '' : 's'} for ${input.methodId}: ${resolvedPath.missing.join(', ')}`,
+                    missing: [...resolvedPath.missing],
+                },
+            };
+        }
+        return this.invokeWebSocketControlPlaneCall({
+            authToken: input.authToken,
+            method: descriptor.http.method,
+            path: resolvedPath.path,
+            query: input.query,
+            body: descriptor.http.method === 'GET' || descriptor.http.method === 'DELETE' ? undefined : input.body,
+            context: {
+                principalKind: input.context?.principalKind,
+                admin: input.context?.admin,
+                scopes: input.context?.scopes,
+            },
+        });
+    }
+}

package/dist/_internal/platform/daemon/facade-composition.d.ts

@@ -0,0 +1,127 @@
+import { AgentManager } from '../tools/agent/index.js';
+import { ConfigManager } from '../config/manager.js';
+import { ServiceRegistry } from '../config/service-registry.js';
+import { UserAuthManager } from '@pellux/goodvibes-sdk/platform/security/user-auth';
+import { AutomationDeliveryManager, AutomationManager } from '../automation/index.js';
+import { ApprovalBroker, ControlPlaneGateway, SharedSessionBroker } from '../control-plane/index.js';
+import { GatewayMethodCatalog } from '../control-plane/index.js';
+import { BuiltinChannelRuntime, ChannelReplyPipeline, ChannelProviderRuntimeManager, ChannelPluginRegistry, ChannelPolicyManager, RouteBindingManager, SurfaceRegistry } from '../channels/index.js';
+import { RuntimeEventBus } from '../runtime/events/index.js';
+import { PlatformServiceManager } from './service-manager.js';
+import { WatcherRegistry } from '../watchers/index.js';
+import { type DistributedPeerAuth } from '../runtime/remote/index.js';
+import { KnowledgeGraphqlService, KnowledgeService } from '../knowledge/index.js';
+import type { IntegrationHelperService } from '../runtime/integration/helpers.js';
+import { DaemonControlPlaneHelper } from './control-plane.js';
+import { DaemonSurfaceDeliveryHelper } from './surface-delivery.js';
+import { DaemonSurfaceActionHelper } from './surface-actions.js';
+import { DaemonTransportEventsHelper } from './transport-events.js';
+import { DaemonHttpRouter } from './http/router.js';
+import { type RuntimeServices } from '../runtime/services.js';
+import type { DaemonConfig, PendingSurfaceReply } from './types.js';
+import type { ResolvedInboundTlsContext } from '../runtime/network/index.js';
+type JsonBody = Record<string, unknown>;
+export interface ResolvedDaemonFacadeRuntime {
+    readonly configManager: ConfigManager;
+    readonly runtimeServices: RuntimeServices;
+    readonly integrationHelpers: IntegrationHelperService;
+    readonly port: number;
+    readonly host: string;
+    readonly agentManager: AgentManager;
+    readonly userAuth: UserAuthManager;
+    readonly automationManager: AutomationManager;
+    readonly runtimeBus: RuntimeEventBus;
+    readonly runtimeStore: RuntimeServices['runtimeStore'];
+    readonly runtimeDispatch: RuntimeServices['runtimeDispatch'];
+    readonly controlPlaneGateway: ControlPlaneGateway;
+    readonly gatewayMethods: GatewayMethodCatalog;
+    readonly sessionBroker: SharedSessionBroker;
+    readonly approvalBroker: ApprovalBroker;
+    readonly routeBindings: RouteBindingManager;
+    readonly deliveryManager: AutomationDeliveryManager;
+    readonly surfaceRegistry: SurfaceRegistry;
+    readonly channelPolicy: ChannelPolicyManager;
+    readonly channelPlugins: ChannelPluginRegistry;
+    readonly watcherRegistry: WatcherRegistry;
+    readonly platformServiceManager: PlatformServiceManager;
+    readonly distributedRuntime: RuntimeServices['distributedRuntime'];
+    readonly voiceService: RuntimeServices['voiceService'];
+    readonly webSearchService: RuntimeServices['webSearchService'];
+    readonly knowledgeService: KnowledgeService;
+    readonly knowledgeGraphqlService: KnowledgeGraphqlService;
+    readonly mediaProviders: RuntimeServices['mediaProviders'];
+    readonly multimodalService: RuntimeServices['multimodalService'];
+    readonly artifactStore: RuntimeServices['artifactStore'];
+    readonly serviceRegistry: ServiceRegistry;
+    readonly serveFactory: typeof Bun.serve;
+    readonly githubWebhookSecret: string | null;
+}
+export declare function resolveDaemonFacadeRuntime(config: DaemonConfig, fallbackConfigManager?: ConfigManager): ResolvedDaemonFacadeRuntime;
+export interface DaemonFacadeCollaborators {
+    readonly channelReplyPipeline: ChannelReplyPipeline;
+    readonly controlPlaneHelper: DaemonControlPlaneHelper;
+    readonly surfaceDeliveryHelper: DaemonSurfaceDeliveryHelper;
+    readonly surfaceActionHelper: DaemonSurfaceActionHelper;
+    readonly transportEventsHelper: DaemonTransportEventsHelper;
+    readonly httpRouter: DaemonHttpRouter;
+    readonly providerRuntime: ChannelProviderRuntimeManager;
+    readonly builtinChannels: BuiltinChannelRuntime;
+}
+export interface CreateDaemonFacadeCollaboratorsOptions {
+    readonly runtime: ResolvedDaemonFacadeRuntime;
+    readonly pendingSurfaceReplies: Map<string, PendingSurfaceReply>;
+    readonly authToken: () => string | null;
+    readonly trustProxyEnabled: () => boolean;
+    readonly dispatchApiRoutes: (req: Request) => Promise<Response | null>;
+    readonly parseJsonBody: (req: Request) => Promise<JsonBody | Response>;
+    readonly requireAuthenticatedSession: (req: Request) => {
+        username: string;
+        roles: readonly string[];
+    } | null;
+    readonly trySpawnAgent: (input: Parameters<AgentManager['spawn']>[0], logLabel?: string, sessionId?: string) => import('../tools/agent/index.js').AgentRecord | Response;
+    readonly checkAuth: (req: Request) => boolean;
+    readonly extractAuthToken: (req: Request) => string;
+    readonly requireAdmin: (req: Request) => Response | null;
+    readonly requireRemotePeer: (req: Request, scope?: string) => Promise<DistributedPeerAuth | Response>;
+    readonly describeAuthenticatedPrincipal: (token: string) => {
+        principalId: string;
+        principalKind: 'user' | 'bot' | 'service' | 'token';
+        admin: boolean;
+        scopes: readonly string[];
+    } | null;
+    readonly invokeGatewayMethodCall: (input: {
+        readonly authToken: string;
+        readonly methodId: string;
+        readonly query?: Record<string, unknown>;
+        readonly body?: unknown;
+        readonly context?: {
+            readonly principalId?: string;
+            readonly principalKind?: 'user' | 'bot' | 'service' | 'token' | 'remote-peer';
+            readonly admin?: boolean;
+            readonly scopes?: readonly string[];
+            readonly clientKind?: string;
+        };
+    }) => Promise<{
+        status: number;
+        ok: boolean;
+        body: unknown;
+    }>;
+    readonly syncSpawnedAgentTask: (record: import('../tools/agent/index.js').AgentRecord, sessionId?: string) => void;
+    readonly syncFinishedAgentTask: (record: import('../tools/agent/index.js').AgentRecord) => void;
+    readonly surfaceDeliveryEnabled: (surface: 'slack' | 'discord' | 'ntfy' | 'webhook' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix') => boolean;
+    readonly signWebhookPayload: (body: string, secret: string) => string;
+    readonly handleApprovalAction: (approvalId: string, action: 'claim' | 'approve' | 'deny' | 'cancel', req: Request) => Promise<Response>;
+    readonly tlsState: () => ResolvedInboundTlsContext | null;
+}
+export declare function createDaemonFacadeCollaborators(options: CreateDaemonFacadeCollaboratorsOptions): DaemonFacadeCollaborators;
+export declare function configureDaemonSessionContinuation(options: {
+    readonly sessionBroker: SharedSessionBroker;
+    readonly trySpawnAgent: (input: Parameters<AgentManager['spawn']>[0], logLabel?: string, sessionId?: string) => import('../tools/agent/index.js').AgentRecord | Response;
+    readonly queueSurfaceReplyFromBinding: (binding: import('@pellux/goodvibes-sdk/platform/automation/routes').AutomationRouteBinding | undefined, input: {
+        readonly agentId: string;
+        readonly task: string;
+        readonly sessionId?: string;
+    }) => void;
+}): void;
+export {};
+//# sourceMappingURL=facade-composition.d.ts.map

package/dist/_internal/platform/daemon/facade-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade-composition.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/facade-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACpF,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IACvD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD,QAAQ,CAAC,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;IACnE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC3D,QAAQ,CAAC,iBAAiB,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IACzD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,EACpB,qBAAqB,CAAC,EAAE,aAAa,GACpC,2BAA2B,CA6F7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;CACjD;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACvE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9G,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,yBAAyB,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzK,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACpD,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,CAAC;IACtG,QAAQ,CAAC,8BAA8B,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK;QAC1D,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;QACpD,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE;QACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;YACjB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;YAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,yBAAyB,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnH,QAAQ,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,yBAAyB,EAAE,WAAW,KAAK,IAAI,CAAC;IAChG,QAAQ,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,KAAK,OAAO,CAAC;IACxN,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACtE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxI,QAAQ,CAAC,QAAQ,EAAE,MAAM,yBAAyB,GAAG,IAAI,CAAC;CAC3D;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,sCAAsC,GAC9C,yBAAyB,CA8I3B;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,yBAAyB,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzK,QAAQ,CAAC,4BAA4B,EAAE,CAAC,OAAO,EAAE,OAAO,kDAAkD,EAAE,sBAAsB,GAAG,SAAS,EAAE,KAAK,EAAE;QACrJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,KAAK,IAAI,CAAC;CACZ,GAAG,IAAI,CAoBP"}