@rryando/arcs 3.10.0 → 4.0.0

package/dist/web-server/claude-runner.js

@@ -0,0 +1,599 @@
+/**
+ * Headless `claude -p` run lifecycle (T001 of the session-panel async-runs plan).
+ *
+ * Owns everything between "the web route decided to run a job" and a finished
+ * run record: spawn, streaming stdout capture, timeout escalation, NDJSON event
+ * parsing, exit mapping, per-write-target concurrency serialization and
+ * ARCS_HOOK_* env scrubbing. The route supplies argv/cwd and this module never
+ * decides what the child *does* — but it does own the child's OUTPUT CONTRACT:
+ * every run is normalized onto `--output-format stream-json
+ * --include-partial-messages --verbose` (see withStreamJsonArgv), so stdout is
+ * always the newline-delimited event stream the reader below understands. When
+ * the caller supplies an `eventLog` target, that stream is ALSO persisted
+ * verbatim to the run's own event log before the reader parses a byte of it
+ * (see run-event-log.ts) — the log is the durable record, parsing is a consumer.
+ * The route's post-run write-back (transcript mirror + metadata.run finalization)
+ * plugs in as the per-job `onSettled` callback, invoked after the child exits.
+ *
+ * Injectable `spawnImpl` + `binary` keep tests free of real children; the
+ * default impl is plain node child_process `spawn` with `stdio:
+ * ["ignore","pipe","pipe"]`. Every child-side failure resolves to an outcome
+ * record — this module never throws on spawn/exit/timeout paths.
+ */
+import { spawn } from "node:child_process";
+import { openRunEventLog } from "./run-event-log.js";
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000; // 10 min
+const DEFAULT_KILL_GRACE_MS = 5_000;
+/**
+ * Bound on the *raw* stdout tail kept as the last-resort reply for a child that
+ * emits no usable events. It no longer truncates real replies — those are
+ * assembled from whole event lines as they arrive.
+ */
+export const STDOUT_CAP = 1024 * 1024; // 1 MB
+export const STDERR_CAP = 4 * 1024; // 4 KB
+/**
+ * Ceiling on a single *unterminated* line the NDJSON reader will buffer — a
+ * memory guard against a child that never emits a newline, not a reply cap. It
+ * sits well above any single claude event (one message cannot approach 8 MB), so
+ * a long reply split across chunks still reassembles whole.
+ */
+export const MAX_EVENT_LINE = 8 * STDOUT_CAP; // 8 MB
+/**
+ * Output contract the runner forces onto every child. `--include-partial-messages`
+ * is what makes first-token timing observable at all, and claude >= 2.x refuses
+ * both companions in print mode: "--include-partial-messages requires --print and
+ * --output-format=stream-json" and "When using --print, --output-format=stream-json
+ * requires --verbose" — both exit 1 at flag validation, before any network call.
+ * The three therefore travel together and are never split.
+ */
+const STREAM_JSON_ARGV = [
+    "--output-format",
+    "stream-json",
+    "--include-partial-messages",
+    "--verbose",
+];
+/** Keys never forwarded to the child env — the hook handshake must not leak. */
+const ENV_SCRUB_KEYS = ["ARCS_HOOK_TOKEN", "ARCS_HOOK_SLUG", "ARCS_HOOK_URL"];
+/**
+ * Rewrites caller argv onto the runner's output contract: drops any
+ * `--output-format <v>` / `--output-format=<v>` the caller chose (routes still
+ * build plain `--output-format json`) plus any duplicate stream companions, then
+ * appends STREAM_JSON_ARGV. Everything else — `-p`, the prompt, `--resume`,
+ * `--session-id` — passes through untouched and in order.
+ */
+export function withStreamJsonArgv(argv) {
+    const rest = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--output-format") {
+            i += 1; // drop the flag together with its value
+            continue;
+        }
+        if (arg.startsWith("--output-format="))
+            continue;
+        if (arg === "--include-partial-messages" || arg === "--verbose")
+            continue;
+        rest.push(arg);
+    }
+    return [...rest, ...STREAM_JSON_ARGV];
+}
+/** writeTargetKey → live child. Module-level: shared across all web routes. */
+const liveRuns = new Map();
+/**
+ * Atomically claims the slot for a write-target key. Returns a typed refusal
+ * when a live run already holds it. Synchronous and called immediately after
+ * spawn (no await in between), so two overlapping requests cannot both win.
+ */
+export function beginRun(writeTargetKey, child) {
+    if (liveRuns.has(writeTargetKey)) {
+        return {
+            ok: false,
+            reason: "ALREADY_RUNNING",
+            message: `a claude run for "${writeTargetKey}" is already in progress`,
+        };
+    }
+    const startedAt = Date.now();
+    liveRuns.set(writeTargetKey, { child, startedAt });
+    return { ok: true, startedAt };
+}
+/** Releases the slot for a write-target key (idempotent). */
+export function endRun(writeTargetKey) {
+    liveRuns.delete(writeTargetKey);
+}
+/** Read-only liveness probe for the same slot (routes / UI status). */
+export function isRunLive(writeTargetKey) {
+    return liveRuns.has(writeTargetKey);
+}
+/**
+ * Pid of the child currently holding a write-target's slot.
+ *
+ * `undefined` means no live run (the spawn threw, or the slot was refused);
+ * `null` means a live run whose child never reported a pid (an async spawn
+ * failure — node reports ENOENT on the `error` event, not at spawn).
+ *
+ * Exists so the run route can persist the child's pid on the session's run
+ * claim: `runClaudeJob` spawns synchronously (nothing is awaited before
+ * `beginRun`), so a caller that reads this immediately after calling it —
+ * before its own first await — sees the pid of the child it just started.
+ * Read-only: it cannot start, stop or observe anything else about the run.
+ */
+export function liveRunPid(writeTargetKey) {
+    const live = liveRuns.get(writeTargetKey);
+    if (live === undefined)
+        return undefined;
+    return live.child.pid ?? null;
+}
+// ---------------------------------------------------------------------------
+// runClaudeJob
+// ---------------------------------------------------------------------------
+export async function runClaudeJob(input, options = {}) {
+    const { argv, cwd, writeTargetKey } = input;
+    const spawnImpl = options.spawnImpl ?? spawn;
+    const binary = options.binary ?? "claude";
+    const killGraceMs = options.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
+    const env = input.env ?? process.env;
+    const timeoutMs = resolveTimeoutMs(input.timeoutMs, env);
+    const startedAt = Date.now();
+    const fail = (outcome, error) => ({
+        pid: null,
+        startedAt,
+        endedAt: Date.now(),
+        outcome,
+        error,
+    });
+    let child;
+    try {
+        // NOTE: no "--cwd" flag — claude >= 2.x rejects it; the working directory
+        // rides spawn options only.
+        child = spawnImpl(binary, withStreamJsonArgv(argv), {
+            cwd,
+            env: scrubEnv(env),
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (err) {
+        // Some spawn failures surface synchronously (fake impls, odd platforms).
+        return writeBack(input, fail("error", spawnErrorMessage(err, binary)));
+    }
+    const begin = beginRun(writeTargetKey, child);
+    if (!begin.ok) {
+        // A live run holds the slot — drop the freshly spawned child immediately.
+        // Attach a no-op error listener first: the refused child has no other
+        // listeners, so a spawn failure surfacing on it would otherwise crash.
+        child.on("error", () => { });
+        safeKill(child, "SIGKILL");
+        return writeBack(input, fail("error", begin.message));
+    }
+    const record = { pid: child.pid ?? null, startedAt, outcome: "success" };
+    try {
+        const settled = await settleRun(child, {
+            timeoutMs,
+            killGraceMs,
+            binary,
+            ...(input.eventLog !== undefined && { eventLog: input.eventLog }),
+        });
+        record.endedAt = settled.endedAt;
+        record.outcome = settled.outcome;
+        if (settled.error !== undefined)
+            record.error = settled.error;
+        if (settled.replyText !== undefined) {
+            record.replyText = settled.replyText;
+            record.replyChars = settled.replyText.length;
+        }
+        // Streamed observations survive every outcome — a timed-out run that spoke
+        // before the kill still carries its TTFT number.
+        if (settled.firstTokenAt !== undefined)
+            record.firstTokenAt = settled.firstTokenAt;
+        if (settled.skippedLines !== undefined)
+            record.skippedLines = settled.skippedLines;
+        if (settled.eventLogLines !== undefined)
+            record.eventLogLines = settled.eventLogLines;
+        if (settled.eventLogTruncated !== undefined) {
+            record.eventLogTruncated = settled.eventLogTruncated;
+        }
+        if (settled.eventLogError !== undefined)
+            record.eventLogError = settled.eventLogError;
+    }
+    catch (err) {
+        // Never throw on child-side failures — every path resolves to a record.
+        record.outcome = "error";
+        record.error = `runner failed: ${String(err)}`;
+    }
+    finally {
+        endRun(writeTargetKey);
+    }
+    return writeBack(input, record);
+}
+/**
+ * Fires the route-registered write-back (onSettled) against the settled record.
+ * Runs after endRun so the concurrency slot frees before the write-back's store
+ * work begins. Every record-producing path funnels through here — including
+ * sync spawn failures and refused overlaps — so the route can mirror the
+ * runtime transcript and finalize metadata.run regardless of outcome. Callback
+ * errors are swallowed: the write-back is best-effort and never changes the
+ * returned record.
+ */
+async function writeBack(input, record) {
+    if (input.onSettled === undefined)
+        return record;
+    try {
+        await input.onSettled(record);
+    }
+    catch {
+        // Write-back failure is a swallowed no-op — the run itself already settled.
+    }
+    return record;
+}
+function settleRun(child, ctx) {
+    return new Promise((resolve) => {
+        const stdout = makeStreamReader({ rawCap: STDOUT_CAP, lineCap: MAX_EVENT_LINE });
+        const stderr = makeTailBuffer(STDERR_CAP);
+        // Opened before any listener attaches, so the file exists even for a child
+        // that never writes a byte — an error or timeout run still leaves a log.
+        const events = openRunEventLog(ctx.eventLog);
+        let settled = false;
+        let timedOut = false;
+        let termTimer = null;
+        let killTimer = null;
+        const clearTimers = () => {
+            if (termTimer)
+                clearTimeout(termTimer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            termTimer = null;
+            killTimer = null;
+        };
+        // Every settle path — error, close, timeout — carries whatever the stream
+        // already observed, so these two never depend on how the run ended.
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimers();
+            child.removeAllListeners();
+            child.stdout?.removeAllListeners();
+            child.stderr?.removeAllListeners();
+            // The log closes on EVERY settle path — error, close and timeout — so the
+            // durable record of what the child said outlives how the run ended.
+            events.flush();
+            const log = events.close();
+            const seen = stdout.snapshot();
+            resolve({
+                ...result,
+                ...(seen.firstTokenAt !== undefined && { firstTokenAt: seen.firstTokenAt }),
+                ...(seen.skippedLines > 0 && { skippedLines: seen.skippedLines }),
+                ...(ctx.eventLog !== undefined && { eventLogLines: log.lines }),
+                // Only when it engaged. A log that hit its cap and one from a silent
+                // child both report zero lines, so the count alone cannot tell them
+                // apart — this flag is the difference, and dropping it here is what
+                // made the cap invisible to every consumer of the record.
+                ...(log.truncated && { eventLogTruncated: true }),
+                ...(log.error !== undefined && { eventLogError: log.error }),
+            });
+        };
+        termTimer = setTimeout(() => {
+            timedOut = true;
+            safeKill(child, "SIGTERM");
+            killTimer = setTimeout(() => {
+                safeKill(child, "SIGKILL");
+            }, ctx.killGraceMs);
+        }, ctx.timeoutMs);
+        child.stdout?.on("data", (chunk) => {
+            // DURABLE FIRST. The raw bytes hit disk synchronously here, before the
+            // reader below is given a chance to parse them — the log is the source of
+            // truth and the reader is a consumer, so a line the reader cannot use (or
+            // a process that dies on the very next statement) still leaves the line
+            // on disk. Never throws: openRunEventLog reports failures instead.
+            events.push(chunk);
+            stdout.push(String(chunk));
+        });
+        child.stderr?.on("data", (chunk) => stderr.push(String(chunk)));
+        child.on("error", (err) => {
+            settle({
+                endedAt: Date.now(),
+                outcome: "error",
+                error: spawnErrorMessage(err, ctx.binary),
+            });
+        });
+        // Resolve on `close` (after stdio drained) rather than `exit` so the reader
+        // sees the complete output. `close` also fires after a failed spawn.
+        child.on("close", (code, signal) => {
+            // A final line that never got its newline is still a line.
+            stdout.flush();
+            settle(mapExit({
+                code,
+                signal: signal ?? null,
+                timedOut,
+                stdout: stdout.snapshot(),
+                stderr,
+                timeoutMs: ctx.timeoutMs,
+            }));
+        });
+    });
+}
+function mapExit(input) {
+    const endedAt = Date.now();
+    if (input.timedOut) {
+        return {
+            endedAt,
+            outcome: "timeout",
+            error: `claude run timed out after ${input.timeoutMs}ms (SIGTERM, then SIGKILL)`,
+        };
+    }
+    if (input.code === 0) {
+        const { result } = input.stdout;
+        if (result?.isError) {
+            return {
+                endedAt,
+                outcome: "error",
+                error: result.text?.trim() || "claude reported an error (is_error)",
+            };
+        }
+        return { endedAt, outcome: "success", replyText: replyFrom(input.stdout) };
+    }
+    if (input.signal) {
+        return {
+            endedAt,
+            outcome: "error",
+            error: `claude run was terminated by signal ${input.signal}`,
+        };
+    }
+    const stderrTail = input.stderr.text().trim();
+    return {
+        endedAt,
+        outcome: "error",
+        error: stderrTail || `claude exited with status ${input.code}`,
+    };
+}
+/**
+ * Reply precedence, most authoritative first: the terminal `result` event's own
+ * text (verbatim, never trimmed — the model owns its whitespace), then the
+ * assembled text of the completed assistant messages, then the raw stdout tail
+ * for a child that spoke no events at all. Only the last one is STDOUT_CAP-bound.
+ */
+function replyFrom(stream) {
+    if (typeof stream.result?.text === "string")
+        return stream.result.text;
+    const assistant = stream.assistantText.trim();
+    if (assistant)
+        return assistant;
+    return stream.rawTail.trim();
+}
+/**
+ * The ceiling a run will actually be killed at: an explicit override first,
+ * then ARCS_CLAUDE_RUN_TIMEOUT_MS, then the 10-minute default.
+ *
+ * Exported because the run route has to persist the resulting DEADLINE with the
+ * session's run claim (a claim is only proof of life until the child is killed),
+ * and a second copy of this precedence in the route would silently drift from
+ * the one the timer here is armed with.
+ */
+export function resolveTimeoutMs(timeoutMs, env = process.env) {
+    if (typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0) {
+        return timeoutMs;
+    }
+    const raw = env.ARCS_CLAUDE_RUN_TIMEOUT_MS;
+    if (raw) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isInteger(parsed) && parsed > 0)
+            return parsed;
+    }
+    return DEFAULT_TIMEOUT_MS;
+}
+/** process.env minus the ARCS_HOOK_* handshake keys (the explicit 3-key
+ *  denylist above — not a prefix wildcard scrub). */
+function scrubEnv(env) {
+    const childEnv = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value === undefined)
+            continue;
+        if (ENV_SCRUB_KEYS.includes(key))
+            continue;
+        childEnv[key] = value;
+    }
+    return childEnv;
+}
+function spawnErrorMessage(err, binary) {
+    const code = err?.code;
+    if (code === "ENOENT")
+        return "claude not found on PATH";
+    return `failed to spawn ${binary}: ${String(err)}`;
+}
+function safeKill(child, signal) {
+    try {
+        child.kill(signal);
+    }
+    catch {
+        // Child already exited — nothing to signal.
+    }
+}
+/**
+ * Accumulates output keeping only the most recent `limit` characters, dropping
+ * overflow from the head. Used so a runaway child cannot balloon memory while
+ * the important (tail) output survives.
+ *
+ * SHORTCUT: caps count UTF-16 code units, not bytes; upgrade to
+ * Buffer.byteLength accounting when non-ASCII payloads sit at the cap boundary.
+ */
+function makeTailBuffer(limit) {
+    const chunks = [];
+    let size = 0;
+    return {
+        push(chunk) {
+            if (chunk.length === 0)
+                return;
+            chunks.push(chunk);
+            size += chunk.length;
+            while (size > limit && chunks.length > 1) {
+                size -= chunks[0].length;
+                chunks.shift();
+            }
+            if (size > limit) {
+                // Single chunk larger than the cap — keep its tail.
+                const overflow = size - limit;
+                chunks[0] = chunks[0].slice(overflow);
+                size -= overflow;
+            }
+        },
+        text() {
+            return chunks.join("");
+        },
+    };
+}
+/** Event types the reader knows; anything else is ignored (and counted). */
+const KNOWN_EVENT_TYPES = new Set(["result", "assistant", "user", "system", "stream_event"]);
+/**
+ * Line-oriented reader over `--output-format stream-json` stdout.
+ *
+ * Tolerant by construction, because the wire schema is claude's to change:
+ * unknown event types are ignored rather than fatal, unparsable lines are
+ * skipped and counted, and no shape assumption is made beyond "JSON object with
+ * a string `type`". It never throws — a reader that can fail a run would make
+ * every future claude release a potential outage.
+ *
+ * Chunk boundaries are irrelevant: a chunk that ends mid-JSON leaves the partial
+ * line buffered until its newline arrives, and one line split across ten chunks
+ * parses exactly once. Because complete lines are consumed as they arrive, the
+ * reply is never truncated by either cap — `rawCap` bounds only the unused raw
+ * fallback tail, and `lineCap` only a single *unterminated* line (a runaway
+ * child with no newlines), which is then dropped along with the rest of it.
+ */
+function makeStreamReader(caps) {
+    const { rawCap, lineCap } = caps;
+    const raw = makeTailBuffer(rawCap);
+    const state = { assistantText: "", rawTail: "", skippedLines: 0 };
+    let pending = "";
+    let dropping = false;
+    const consumeLine = (line) => {
+        // Tolerate CRLF: the trailing \r is not part of the JSON.
+        const text = (line.endsWith("\r") ? line.slice(0, -1) : line).trim();
+        if (text === "")
+            return; // blank separator lines are normal, not drift
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            state.skippedLines += 1;
+            return;
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            state.skippedLines += 1;
+            return;
+        }
+        applyEvent(value, state);
+    };
+    return {
+        push(chunk) {
+            raw.push(chunk);
+            const parts = (pending + chunk).split("\n");
+            // The last part has not met its newline yet — it stays buffered, which is
+            // exactly how a chunk that ends mid-JSON survives to be parsed once.
+            pending = parts.pop() ?? "";
+            for (const line of parts) {
+                // The tail of an over-cap line ends here; the next line is clean again.
+                if (dropping)
+                    dropping = false;
+                else
+                    consumeLine(line);
+            }
+            if (dropping) {
+                pending = "";
+            }
+            else if (pending.length > lineCap) {
+                // One line longer than the cap with no newline in sight — drop it (and
+                // the rest of it) so a runaway child cannot balloon memory.
+                state.skippedLines += 1;
+                dropping = true;
+                pending = "";
+            }
+        },
+        flush() {
+            if (!dropping && pending !== "")
+                consumeLine(pending);
+            pending = "";
+            dropping = false;
+        },
+        snapshot() {
+            return { ...state, rawTail: raw.text() };
+        },
+    };
+}
+/**
+ * Folds one decoded event into the snapshot. Every branch is defensive about
+ * field types — a `result` without a string `result`, an `assistant` without
+ * content, a `stream_event` with a shape we have never seen are all survivable.
+ */
+function applyEvent(event, state) {
+    const type = typeof event.type === "string" ? event.type : "";
+    if (type === "result" || (!KNOWN_EVENT_TYPES.has(type) && isLegacyEnvelope(event))) {
+        // The legacy single-object `--output-format json` envelope has no `type`;
+        // an older or wrapped claude still settles the same way.
+        state.result = {
+            isError: event.is_error === true,
+            ...(typeof event.result === "string" && { text: event.result }),
+        };
+        return;
+    }
+    if (type === "assistant") {
+        const text = assistantMessageText(event.message);
+        if (text !== "") {
+            state.assistantText += text;
+            markFirstToken(state);
+        }
+        return;
+    }
+    if (type === "stream_event") {
+        // Partial deltas are the earliest possible content signal — this is the
+        // line `--include-partial-messages` exists to deliver, and where TTFT is
+        // actually measured. Their text is NOT accumulated: the completed
+        // `assistant` message repeats it, and double-counting would duplicate the
+        // fallback reply.
+        if (partialText(event.event) !== "")
+            markFirstToken(state);
+        return;
+    }
+    // `user`, `system` and friends carry no reply text — known, so not drift.
+    if (!KNOWN_EVENT_TYPES.has(type))
+        state.skippedLines += 1;
+}
+/** The pre-stream `{is_error?, result?}` object, recognized by shape alone. */
+function isLegacyEnvelope(event) {
+    return typeof event.is_error === "boolean" || typeof event.result === "string";
+}
+function markFirstToken(state) {
+    if (state.firstTokenAt === undefined)
+        state.firstTokenAt = Date.now();
+}
+/** Text blocks of a completed assistant message, tolerant of string content. */
+function assistantMessageText(message) {
+    const content = readField(message, "content");
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    let text = "";
+    for (const block of content) {
+        if (readField(block, "type") !== "text")
+            continue;
+        const blockText = readField(block, "text");
+        if (typeof blockText === "string")
+            text += blockText;
+    }
+    return text;
+}
+/** Text carried by a partial-message event (`content_block_delta` and kin). */
+function partialText(inner) {
+    for (const key of ["delta", "content_block"]) {
+        const text = readField(readField(inner, key), "text");
+        if (typeof text === "string" && text !== "")
+            return text;
+    }
+    return "";
+}
+function readField(node, key) {
+    if (typeof node !== "object" || node === null)
+        return undefined;
+    return node[key];
+}
+//# sourceMappingURL=claude-runner.js.map

package/dist/web-server/claude-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-runner.js","sourceRoot":"","sources":["../../src/web-server/claude-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAwC,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAyG7E,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AACpD,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO;AAC3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO;AAErD;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;IACvB,iBAAiB;IACjB,aAAa;IACb,4BAA4B;IAC5B,WAAW;CACZ,CAAC;AAEF,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,CAAC,IAAI,CAAC,CAAC,CAAC,wCAAwC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,SAAS;QACjD,IAAI,GAAG,KAAK,4BAA4B,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QAC1E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC;AACxC,CAAC;AAeD,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,cAAsB,EAAE,KAAmB;IAClE,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,qBAAqB,cAAc,0BAA0B;SACvE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,MAAM,CAAC,cAAsB;IAC3C,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,cAAsB;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,cAAsB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAqB,EACrB,UAA+B,EAAE;IAEjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAE,KAAa,EAAmB,EAAE,CAAC,CAAC;QACrE,GAAG,EAAE,IAAI;QACT,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;QACnB,OAAO;QACP,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,0EAA0E;QAC1E,4BAA4B;QAC5B,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAClD,GAAG;YACH,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;YAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3B,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE;YACrC,SAAS;YACT,WAAW;YACX,MAAM;YACN,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACjC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACrC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/C,CAAC;QACD,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACnF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACnF,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QACtF,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CAAC,KAAqB,EAAE,MAAuB;IACrE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAyBD,SAAS,SAAS,CAAC,KAAmB,EAAE,GAAkB;IACxD,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAA0B,IAAI,CAAC;QAC5C,IAAI,SAAS,GAA0B,IAAI,CAAC;QAE5C,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;QAEF,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAQ,EAAE;YAC5C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC3B,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACnC,0EAA0E;YAC1E,oEAAoE;YACpE,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC;gBACN,GAAG,MAAM;gBACT,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBACjE,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/D,qEAAqE;gBACrE,oEAAoE;gBACpE,oEAAoE;gBACpE,0DAA0D;gBAC1D,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;gBACjD,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3B,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7B,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEjF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC/B,MAAM,CAAC;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;gBACnB,OAAO,EAAE,OAAO;gBAChB,KAAK,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qEAAqE;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,2DAA2D;YAC3D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CACJ,OAAO,CAAC;gBACN,IAAI;gBACJ,MAAM,EAAE,MAAM,IAAI,IAAI;gBACtB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,KAOhB;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO;YACL,OAAO;YACP,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,8BAA8B,KAAK,CAAC,SAAS,4BAA4B;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;QAChC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,OAAO;gBAChB,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,qCAAqC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACL,OAAO;YACP,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,uCAAuC,KAAK,CAAC,MAAM,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO;QACL,OAAO;QACP,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,UAAU,IAAI,6BAA6B,KAAK,CAAC,IAAI,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,MAAsB;IACvC,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA6B,EAC7B,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAC5D,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;qDACqD;AACrD,SAAS,QAAQ,CAAC,GAAsB;IACtC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;IACzD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,0BAA0B,CAAC;IACzD,OAAO,mBAAmB,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,MAAsB;IAC3D,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAWD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,OAAO,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzB,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,oDAAoD;gBACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC;gBAC9B,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,IAAI,QAAQ,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AA2BD,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,IAAyC;IACjE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAmB,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAClF,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,IAAY,EAAQ,EAAE;QACzC,0DAA0D;QAC1D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,8CAA8C;QACvE,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAgC,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,0EAA0E;YAC1E,qEAAqE;YACrE,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,IAAI,QAAQ;oBAAE,QAAQ,GAAG,KAAK,CAAC;;oBAC1B,WAAW,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBACpC,uEAAuE;gBACvE,4DAA4D;gBAC5D,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;gBACxB,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,EAAE;gBAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,QAAQ;YACN,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAA8B,EAAE,KAAqB;IACvE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACnF,0EAA0E;QAC1E,yDAAyD;QACzD,KAAK,CAAC,MAAM,GAAG;YACb,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;YAChC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAChE,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;YAC5B,cAAc,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,wEAAwE;QACxE,yEAAyE;QACzE,kEAAkE;QAClE,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAA8B;IACtD,OAAO,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,KAAqB;IAC3C,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,MAAM;YAAE,SAAS;QAClD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,IAAI,IAAI,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,KAAc;IACjC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAW;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/web-server/hook-auth.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Bearer-token gate for `/api/hook/*`.
+ *
+ * Layered on top of (never instead of) the global loopback-only
+ * `secureLocalRequest`: loopback proves the caller is on this machine, the
+ * token proves it is this project's installed hook script. Browser-facing
+ * routes stay token-free — only the hook endpoint carries a shared secret,
+ * because only it is called by something that is not the ARCS web UI.
+ */
+import type { MiddlewareHandler } from "hono";
+export declare const requireHookToken: MiddlewareHandler;
+//# sourceMappingURL=hook-auth.d.ts.map

package/dist/web-server/hook-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-auth.d.ts","sourceRoot":"","sources":["../../src/web-server/hook-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAY9C,eAAO,MAAM,gBAAgB,EAAE,iBAmB9B,CAAC"}