@schlessera/brain-ui-server 0.13.1 → 0.14.0

package/README.md

@@ -11,13 +11,14 @@ pieces through `createApp()`.
 ## Usage
 
 ```ts
-import { createApp, cancelActiveTurn, closeDb } from "@schlessera/brain-ui-server";
+import { createApp } from "@schlessera/brain-ui-server";
 
 const app = createApp({
   staticRoot: "./client/dist",        // optional: serve a built SPA + fallback
   renderer,                           // optional: { renderPng, renderPdf }
   appName: "Brain UI",                // branding in status copy
-  dbPath: process.env.DB_PATH,        // session/passkey SQLite (default ./brain-ui.db)
+  // config: resolveServerConfig(env) // optional: explicit configuration;
+  //                                  // omitted = resolved from process.env once
 });
 
 export default {
@@ -27,9 +28,12 @@ export default {
 };
 ```
 
-One app per process: `createApp()` configures a process-wide host (WebSocket
-coordinator, SQLite handle, backend registry) — calling it twice with
-different options reconfigures the first app rather than creating a second.
+Apps are self-contained: each `createApp()` call builds its own WebSocket
+coordinator, SQLite handle and backend registry from its (resolved or
+injected) configuration, so two differently-configured apps coexist in one
+process. The returned handle carries `config`, `db`, `wsHost`,
+`isTurnActive()`, `cancelActiveTurns()` and `close()` for the deployment
+shell's lifecycle wiring.
 
 ## What it owns
 
@@ -58,13 +62,48 @@ different options reconfigures the first app rather than creating a second.
 
 ## Environment
 
-The package reads the same env contract the brain-ui deployment documents:
-`AUTH_MODE`, `BRAIN_UI_PASSWORD_HASH`, `COOKIE_SECRET`, `TRUST_PROXY`,
-`WEBAUTHN_*`, `BRAIN_PATH`, `DB_PATH`, `AGENT_BACKEND`,
-`BRAIN_UI_CLAUDE_PROFILES`, `BRAIN_UI_MODEL_DISCOVERY`,
-`BRAIN_UI_MODEL_TTL_HOURS`, `MAX_CONCURRENT_SESSIONS`, `DEEPGRAM_API_KEY`,
-`VOICE_*`, `NOMINATIM_*`, `ALLOWED_ORIGINS`. `createApp()` options win over
-env where both exist.
+Every variable this package reads, and what happens when it is unset.
+`createApp()` configuration wins over the environment where both exist.
+
+<!-- env:begin -->
+
+| Variable | What it controls | Unset |
+| --- | --- | --- |
+| `AGENT_BACKEND` | Primary agent backend: "claude" (default) or "pi". | claude |
+| `ALLOWED_ORIGINS` | Comma-separated cross-origin allowlist for a split client/API topology; empty means same-origin only. | (empty) |
+| `AUTH_MODE` | Authentication mode: password \| tailscale \| proxy \| none. Unset auto-detects (password when a hash is set, else tailscale). | (auto-detect) |
+| `BRAIN_PATH` | Path to the brain repo the server operates on. | $HOME/brain |
+| `BRAIN_UI_ALLOW_LOOPBACK_ORIGIN` | Set "1" to accept loopback Origins for WebAuthn regardless of Host (dev-only, for the vite proxy). | 0 |
+| `BRAIN_UI_ALLOW_PASSWORD` | Set "1" to keep password login enabled after a passkey exists for the RP (break-glass recovery). | 0 |
+| `BRAIN_UI_CLAUDE_DEFAULT_MODEL` | Model the built-in default Claude profile is pinned to. | claude-sonnet-4-6 |
+| `BRAIN_UI_CLAUDE_PROFILES` | JSON array of extra Anthropic-compatible inference profiles ({id,label,model?,baseUrl?,authTokenEnv?,apiKeyEnv?,modelAliases?}). | (none) |
+| `BRAIN_UI_DANGEROUSLY_DISABLE_AUTH` | Set "1" to allow AUTH_MODE=none on a non-loopback host. Every network peer gets full agent access. | 0 |
+| `BRAIN_UI_MODEL_DISCOVERY` | Model discovery against the Anthropic Models API; "0"/"off"/"false" disables. Defaults ON, except under a test runner (NODE_ENV=test) where it defaults OFF. | on (off under NODE_ENV=test) |
+| `BRAIN_UI_MODEL_TTL_HOURS` | How long a model-discovery result stays fresh, in hours. | 24 |
+| `BRAIN_UI_PASSWORD_HASH` | Bun.password argon2id hash of the shared password. | **required** — AUTH_MODE=password |
+| `CLAUDE_CODE_PATH` | Path to the Claude Code native binary handed to the Agent SDK. | /usr/local/bin/claude |
+| `COOKIE_SECRET` | Secret signing the session cookie. | **required** — AUTH_MODE=password |
+| `DB_PATH` | SQLite file for the UI's own database (sessions, passkeys, settings). | ./brain-ui.db |
+| `DEEPGRAM_API_KEY` | Deepgram API key for streaming ASR (short-lived tokens are minted from it). | **required** — VOICE_PROVIDER=deepgram (or any voice use without VOICE_PROVIDER=webspeech) |
+| `HOME` | Fallback anchor for the BRAIN_PATH default only. | /root |
+| `HOST` | Bind host; consulted by the auth validation to decide whether AUTH_MODE=none is loopback-safe. | (empty) |
+| `MAX_CONCURRENT_SESSIONS` | Cap on concurrently RUNNING agent sessions. | 3 |
+| `NODE_ENV` | Only consulted for test-runner detection: flips the model-discovery default to off under bun test. Never gates any security behavior. | (unset) |
+| `PROXY_AUTH_HEADER` | Header a fronting auth proxy sets for AUTH_MODE=proxy. | x-forwarded-user |
+| `SOURCE_COMMIT` | Git SHA reported by /api/status (baked at image build time). | dev |
+| `TRUST_PROXY` | Set "1" to trust x-forwarded-for/x-real-ip and the proxy auth header; only safe behind a trusted reverse proxy. | **required** — AUTH_MODE=proxy |
+| `TRUST_PROXY_HOPS` | How many trusted proxies front the app (x-forwarded-for parse depth). | 1 |
+| `VOICE_CACHE_DIR` | Directory holding the keyterm cache JSON. | $BRAIN_PATH/.brain-ui |
+| `VOICE_KEYTERM_LIMIT` | Maximum custom-vocabulary terms built from the brain database. | 500 |
+| `VOICE_PROVIDER` | Speech provider: "deepgram" or "webspeech" (opt-in only — Chromium streams audio to Google). Unset auto-detects deepgram when its key is present. | (auto-detect) |
+| `WEBAUTHN_ORIGINS` | Comma-separated extra origins allowed for WebAuthn ceremonies. | (empty) |
+| `WEBAUTHN_RP_ID` | Relying-party id override for proxies that rewrite Host. | (derived from the request origin) |
+| `WEBAUTHN_RP_NAME` | Relying-party display name shown by authenticators. | Brain UI |
+| `WEBAUTHN_USER_ID` | Stable WebAuthn user handle (wire contract — burned into every resident credential; max 64 bytes; never change it after the first passkey). | brain-ui-owner |
+| `WEBAUTHN_USER_NAME` | WebAuthn user name shown by authenticators. | owner |
+
+Generated from `packages/ui-server/src/config/env.ts` by `bun run env-docs`. Edit the descriptor, not this table.
+<!-- env:end -->
 
 Model discovery is on by default and needs no configuration beyond the Claude
 credential the agent already uses (`CLAUDE_CODE_OAUTH_TOKEN` or

package/dist/agent/backend.d.ts

@@ -1,45 +1,171 @@
-import { type ModelSource } from "@schlessera/brain-backend-claude";
+import type { AgentConfig } from "../config/env.js";
 import type { ProviderInfo } from "@schlessera/brain-ui-sdk";
 import type { AgentBackend, BackendCapabilities } from "@schlessera/brain-ui-sdk/server";
-/** Drop the memo so the next read reflects a refresh or a settings change. */
-export declare function invalidateProfiles(): void;
 /**
- * The Claude backend's discovery source, once the registry is built. Null when
- * discovery is disabled or the deployment runs a different backend.
+ * Backend registry for one app instance. Built by `createApp()` from the
+ * resolved configuration — no ambient environment and no module-level state,
+ * so two apps with different backend configuration coexist in one process and
+ * tests install fakes by constructing a registry, not by mutating a module.
+ *
+ * BOTH backend packages are optional peers loaded lazily (the same
+ * `createRequire` path): a deployment installs the one its AGENT_BACKEND
+ * names, and the other never has to be present — at runtime AND at
+ * type-check time (see the structural mirrors below).
+ *
+ * The old five hardcoded personal inference profiles are gone: the Claude
+ * backend ships the single "claude" default, and additional Anthropic-compatible
+ * endpoints are declared via the BRAIN_UI_CLAUDE_PROFILES env var (documented in
+ * .env.example) rather than in code.
  */
-export declare function getModelSource(): Promise<ModelSource | null>;
-/** All configured backends, with the default backend first. */
-export declare function getBackends(): Promise<AgentBackend[]>;
-/** Find a configured backend by its stable id. */
-export declare function getBackendById(id: string): Promise<AgentBackend | undefined>;
-/** The default backend used for new and legacy sessions. */
-export declare function getDefaultBackend(): Promise<AgentBackend>;
-/** The stable id of the default backend. */
-export declare function getDefaultBackendId(): Promise<string>;
-/** Resolve the backend that owns a globally unique profile id. */
-export declare function getBackendForProfile(profileId: string): Promise<AgentBackend | undefined>;
-/** Resolve a persisted backend id, falling back for legacy/unknown sessions. */
-export declare function getBackendForSession(backendId: string | null | undefined): Promise<AgentBackend>;
+/** Mirror of the Claude package's `InferenceProfileInput` (declarative shape). */
+export interface ClaudeProfileInput {
+    id: string;
+    label: string;
+    vendor?: string;
+    /** Model id. Undefined = the SDK/CLI default model. */
+    model?: string;
+    /** Anthropic-compatible endpoint. */
+    baseUrl?: string;
+    /** Name of the env var holding a bearer token. */
+    authTokenEnv?: string;
+    /** Name of the env var holding an x-api-key. */
+    apiKeyEnv?: string;
+    /** Remap the CLI's model-alias envs to `model`. Requires `model`. */
+    modelAliases?: boolean;
+    allowedTools?: string[];
+    /** Context window in tokens, when known. Presentation only. */
+    contextWindow?: number;
+    /** Where this profile came from. Presentation only. */
+    source?: "builtin" | "declared" | "discovered";
+}
+/** Mirror of the Claude package's resolved `InferenceProfile`. */
+export interface ClaudeProfile {
+    id: string;
+    label: string;
+    vendor?: string;
+    model?: string;
+    allowedTools?: string[];
+    contextWindow?: number;
+    source?: "builtin" | "declared" | "discovered";
+    /** Env vars that must be present (non-empty) for this profile to be usable. */
+    requiredEnvKeys: string[];
+    /** Environment overrides merged over the host environment. */
+    buildEnv: () => Record<string, string>;
+}
 /**
- * Every available profile, tagged with its owning backend id.
+ * The slice of the lazily-required Claude module this registry drives. The
+ * real module carries more (and looser-optional) options; assignability is
+ * asserted in tests/declaration-surface.test.ts.
+ */
+export interface ClaudeBackendModule {
+    createClaudeBackend: (options: {
+        brainPath: string;
+        claudeCodePath?: string;
+        profiles?: ClaudeProfile[] | (() => ClaudeProfile[]);
+    }) => AgentBackend;
+    createModelSource: (options: {
+        brainPath: string;
+        ttlMs?: number;
+        enabled?: boolean;
+    }) => ClaudeModelSource;
+    defineProfiles: (inputs: ClaudeProfileInput[]) => ClaudeProfile[];
+}
+/** Discovery source as the registry internals see it: the public slice + list(). */
+export interface ClaudeModelSource extends ModelDiscoverySource {
+    list: () => ClaudeProfileInput[];
+}
+/**
+ * Discovery freshness, as exposed on the public registry surface.
  *
- * Hidden profiles are omitted by default (this feeds the picker); the settings
- * screen passes `includeHidden` to render the full catalog.
+ * `list()` is omitted on purpose — it returns Claude profile inputs, only the
+ * registry internals consume it (see {@link ClaudeModelSource}), and exposing
+ * it would put those types on every consumer's plate for no reader.
  */
-export declare function listAllProviders(options?: {
-    includeHidden?: boolean;
-}): Promise<ProviderInfo[]>;
-/** Per-backend capability metadata exposed by the providers route. */
-export declare function getBackendsInfo(): Promise<Record<string, {
-    id: string;
-    capabilities: BackendCapabilities;
-}>>;
-/** @deprecated Use getDefaultBackend() or a routing-specific accessor. */
-export declare function getBackend(): Promise<AgentBackend>;
-/** Test seam: drop the cached registry so later access rebuilds from env. */
-export declare function resetBackendForTests(): void;
-/** Test seam: install one fake backend as the complete registry. */
-export declare function setBackendForTests(backend: AgentBackend): void;
-/** Test seam: install a complete fake registry with an explicit default. */
-export declare function setBackendsForTests(backends: AgentBackend[], defaultBackendId?: string): void;
+export interface ModelDiscoveryState {
+    enabled: boolean;
+    /** When discovery last succeeded; null when it never has. */
+    refreshedAt: number | null;
+    /** The cached result is older than the TTL (or absent). */
+    stale: boolean;
+    /** Last discovery failure, if the current list is served despite one. */
+    error?: string;
+}
+/** The slice of the Claude backend's discovery source the routes consume. */
+export interface ModelDiscoverySource {
+    state(): ModelDiscoveryState;
+    /** Refresh if stale. Awaits only when there is nothing cached to serve. */
+    ensureFresh(): Promise<void>;
+    /** Force a refresh regardless of TTL. Rejects on failure. */
+    refresh(): Promise<void>;
+}
+export interface BackendRegistryOptions {
+    /** Where the brain repo lives (handed to every backend). */
+    brainPath: string;
+    /** Resolved agent configuration (AGENT_BACKEND, profiles, discovery...). */
+    agent: AgentConfig;
+    /**
+     * Profile ids the user keeps out of the model picker (from the app's
+     * settings table). Presentation only — a hidden profile still resolves for
+     * sessions pinned to it. Defaults to "nothing hidden".
+     */
+    getHiddenModelIds?: () => string[];
+}
+export interface BackendRegistry {
+    /** All configured backends, with the default backend first. */
+    getBackends(): Promise<AgentBackend[]>;
+    /** Find a configured backend by its stable id. */
+    getBackendById(id: string): Promise<AgentBackend | undefined>;
+    /** The default backend used for new and legacy sessions. */
+    getDefaultBackend(): Promise<AgentBackend>;
+    /** The stable id of the default backend. */
+    getDefaultBackendId(): Promise<string>;
+    /** Resolve the backend that owns a globally unique profile id. */
+    getBackendForProfile(profileId: string): Promise<AgentBackend | undefined>;
+    /** Resolve a persisted backend id, falling back for legacy/unknown sessions. */
+    getBackendForSession(backendId: string | null | undefined): Promise<AgentBackend>;
+    /**
+     * Every available profile, tagged with its owning backend id. Hidden
+     * profiles are omitted by default (this feeds the picker); the settings
+     * screen passes `includeHidden` to render the full catalog.
+     */
+    listAllProviders(options?: {
+        includeHidden?: boolean;
+    }): Promise<ProviderInfo[]>;
+    /** Per-backend capability metadata exposed by the providers route. */
+    getBackendsInfo(): Promise<Record<string, {
+        id: string;
+        capabilities: BackendCapabilities;
+    }>>;
+    /**
+     * The Claude backend's discovery source, once the registry is built. Null
+     * when discovery is disabled or the deployment runs a different backend.
+     */
+    getModelSource(): Promise<ModelDiscoverySource | null>;
+    /** Drop the profile memo so the next read reflects a refresh or settings change. */
+    invalidateProfiles(): void;
+}
+/**
+ * Boot-time guard: the SELECTED backend's package must at least RESOLVE, so a
+ * broken install refuses to start instead of reporting healthy and failing
+ * every agent turn (the guarantee the old static import gave, restored without
+ * giving up the lazy load — `require.resolve` never executes the module, so
+ * the Agent SDK still loads on first use only). Called by `createApp()` next
+ * to the auth assertions; skipped when an explicit registry is injected.
+ *
+ * An unrecognized AGENT_BACKEND fails here too, for the same reason.
+ *
+ * The `resolve` parameter exists for tests (simulating an absent package);
+ * production callers pass nothing.
+ */
+export declare function assertBackendResolvable(agent: AgentConfig, resolve?: (specifier: string) => void): void;
+export declare function createBackendRegistry(options: BackendRegistryOptions): BackendRegistry;
+/**
+ * A registry over an explicit backend list — the seam tests (and embedders
+ * with their own backend wiring) use instead of mutating module state. Takes
+ * the same optional hidden-ids reader so visibility behavior matches
+ * production.
+ */
+export declare function createStaticBackendRegistry(backends: AgentBackend[], defaultBackendId?: string, options?: {
+    getHiddenModelIds?: () => string[];
+}): BackendRegistry;
 //# sourceMappingURL=backend.d.ts.map

package/dist/agent/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/agent/backend.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AA6FzC,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGlE;AAwHD,+DAA+D;AAC/D,wBAAsB,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3D;AAED,kDAAkD;AAClD,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAEnC;AAED,4DAA4D;AAC5D,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,CAAC,CAG/D;AAED,4CAA4C;AAC5C,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE3D;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAOnC;AAED,gFAAgF;AAChF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,YAAY,EAAE,CAAC,CAUzB;AAED,sEAAsE;AACtE,wBAAsB,eAAe,IAAI,OAAO,CAC9C,MAAM,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAClE,CAQA;AAED,0EAA0E;AAC1E,wBAAsB,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAExD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,IAAI,CAI3C;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAG9D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,EAAE,EACxB,gBAAgB,SAAwB,GACvC,IAAI,CAGN"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/agent/backend.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AA0BH,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,+EAA+E;IAC/E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;KACtD,KAAK,YAAY,CAAC;IACnB,iBAAiB,EAAE,CAAC,OAAO,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,KAAK,iBAAiB,CAAC;IACxB,cAAc,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;CACnE;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAkB,SAAQ,oBAAoB;IAC7D,IAAI,EAAE,MAAM,kBAAkB,EAAE,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,KAAK,IAAI,mBAAmB,CAAC;IAC7B,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,KAAK,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACvC,kDAAkD;IAClD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC9D,4DAA4D;IAC5D,iBAAiB,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,4CAA4C;IAC5C,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,kEAAkE;IAClE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC3E,gFAAgF;IAChF,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClF;;;;OAIG;IACH,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjF,sEAAsE;IACtE,eAAe,IAAI,OAAO,CACxB,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAClE,CAAC;IACF;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvD,oFAAoF;IACpF,kBAAkB,IAAI,IAAI,CAAC;CAC5B;AAmED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAE/B,GACA,IAAI,CASN;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CAuMjB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,YAAY,EAAE,EACxB,gBAAgB,SAAwB,EACxC,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAA;CAAO,GACnD,eAAe,CAOjB"}