@seanmars/tospec 0.14.1 → 0.14.2

package/dist/core/codex-metrics.js

@@ -0,0 +1,293 @@
+/**
+ * Codex skill duration metrics — a second, less precise source for the same
+ * report `skill-metrics.ts` builds from Claude Code transcripts.
+ *
+ * Codex keeps one session tree shared by every project
+ * (`<CODEX_HOME or ~/.codex>/sessions/<yyyy>/<mm>/<dd>/rollout-*.jsonl`),
+ * partitioned by date rather than by project, with the working directory
+ * recorded once per session (`type: "session_meta"`, `payload.cwd`) rather than
+ * encoded into a directory name. Project scoping therefore reads that field
+ * instead of resolving a path (see codex-metrics-source spec, "Codex sessions
+ * are scoped to a project by their recorded working directory").
+ *
+ * Codex transcripts carry nothing like Claude Code's `attributionSkill`. Every
+ * session's system prompt lists all installed skills identically whether or
+ * not any of them were used, so that listing carries no signal. The one event
+ * confirmed (against this project's own real `~/.codex` history) to correlate
+ * with a skill actually being used is a tool-call command whose text reads a
+ * path ending in `<skill-name>/SKILL.md` — the moment the agent pulls in that
+ * skill's instructions. Skill attribution here is therefore a heuristic, not a
+ * recorded fact, and undercounts by construction: a skill run that never
+ * re-reads its own instructions file is invisible to it.
+ */
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import fg from 'fast-glob';
+import { aggregateRuns, buildRuns, normalizeSkillName, DEFAULT_IDLE_GAP_MS, DEFAULT_SPLIT_GAP_MS, } from './skill-metrics.js';
+const CODEX_HOME_DIR_NAME = '.codex';
+/**
+ * Locates Codex's session tree. `CODEX_HOME` is honoured the same way
+ * `CLAUDE_CONFIG_DIR` is for Claude Code; without it the default is
+ * `~/.codex`. This is the directory to search, not a per-project one — Codex
+ * has no equivalent of Claude Code's per-project transcript directory.
+ */
+export function resolveCodexSessionsDir(options = {}) {
+    const env = options.env ?? process.env;
+    const home = env.CODEX_HOME
+        ? path.resolve(env.CODEX_HOME)
+        : path.join(options.homedir ?? os.homedir(), CODEX_HOME_DIR_NAME);
+    return path.join(home, 'sessions');
+}
+/**
+ * Whether a session's recorded working directory names the given project.
+ * `null` (no `session_meta` seen, or no `cwd` field) never matches — a session
+ * with nothing recorded cannot be attributed to any project.
+ */
+export function sessionBelongsToProject(cwd, rootPath) {
+    if (cwd === null)
+        return false;
+    const a = path.resolve(cwd);
+    const b = path.resolve(rootPath);
+    return process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+/**
+ * The working directory a record records, or null when it is not the kind of
+ * record that carries one. Shared by the full parse and the prefix probe so a
+ * single statement defines a session's cwd — the first `session_meta` whose
+ * `payload.cwd` is a string — and the probe can never disagree with the parse
+ * it exists to skip.
+ */
+function recordedCwd(record) {
+    if (record.type !== 'session_meta')
+        return null;
+    const cwd = record.payload?.cwd;
+    return typeof cwd === 'string' ? cwd : null;
+}
+/**
+ * Matches a tool-call command's text against a path ending in
+ * `<skill-name>/SKILL.md`, on either separator. This is the one signal
+ * confirmed to correlate with a skill actually being read, as opposed to
+ * merely appearing in the session's fixed skill-listing text (see the module
+ * docstring).
+ *
+ * `function_call` arguments are JSON-encoded twice — once as the tool-call
+ * argument string itself, once more for the outer transcript line — so a
+ * Windows path's single backslash separator survives as a doubled `\\` in the
+ * text this matches against. The separator class therefore matches one or
+ * more repetitions rather than exactly one.
+ */
+const SKILL_MD_READ_PATTERN = /([^\\/"]+)[\\/]+SKILL\.md/i;
+function extractSkillFromCommandText(text) {
+    const match = SKILL_MD_READ_PATTERN.exec(text);
+    return match ? match[1] : null;
+}
+/**
+ * Parses one Codex rollout `.jsonl` file into the recorded project directory
+ * plus a sorted, timestamped, skill-labelled entry list — the same shape
+ * `parseTranscript` produces for Claude Code, so `buildRuns`/`aggregateRuns`
+ * apply unchanged (design.md D3). Malformed lines are skipped rather than
+ * fatal, for the same reason Claude Code transcripts are: an append-only log
+ * that can be torn at the tail while a session is live.
+ *
+ * Only `function_call`/`custom_tool_call` entries are ever inspected for a
+ * `SKILL.md` read. Every other entry — including the one carrying the fixed
+ * skill-listing text every session opens with — is folded in unattributed
+ * (`skill: null`), exactly as an unattributed Claude Code entry is: it cannot
+ * end a run, but it is not evidence a skill became active either.
+ */
+export function parseCodexSession(text) {
+    let cwd = null;
+    const entries = [];
+    for (const line of text.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (typeof record.timestamp !== 'string')
+            continue;
+        const timeMs = Date.parse(record.timestamp);
+        if (Number.isNaN(timeMs))
+            continue;
+        const payload = record.payload;
+        if (cwd === null) {
+            const found = recordedCwd(record);
+            if (found !== null) {
+                cwd = found;
+                continue;
+            }
+        }
+        let skill = null;
+        if (record.type === 'response_item' &&
+            payload &&
+            (payload.type === 'function_call' || payload.type === 'custom_tool_call')) {
+            const commandText = (typeof payload.arguments === 'string' ? payload.arguments : '') +
+                (typeof payload.input === 'string' ? payload.input : '');
+            const found = extractSkillFromCommandText(commandText);
+            if (found)
+                skill = normalizeSkillName(found);
+        }
+        entries.push({ timeMs, skill });
+    }
+    entries.sort((a, b) => a.timeMs - b.timeMs);
+    return { cwd, entries };
+}
+// -----------------------------------------------------------------------------
+// IO: project scoping without reading whole sessions
+// -----------------------------------------------------------------------------
+/**
+ * Bytes read from a session when only its `cwd` is wanted.
+ *
+ * Codex writes `session_meta` as the very first line, but that line embeds the
+ * session's whole base-instructions text and so runs to ~20 KB. The probe has
+ * to be large enough to hold a *complete* line: a line cut by the read boundary
+ * fails `JSON.parse` and is indistinguishable from an absent one. 64 KiB clears
+ * the observed maximum several times over, and anything the probe cannot settle
+ * falls back to a full read — so an unusually long first line costs time, never
+ * correctness.
+ */
+const CWD_PROBE_BYTES = 64 * 1024;
+/** First recorded cwd in already-read text, stopping at the first one found. */
+function findRecordedCwd(text) {
+    for (const line of text.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = recordedCwd(record);
+        if (cwd !== null)
+            return cwd;
+    }
+    return null;
+}
+/**
+ * Reads just enough of a session to decide which project it belongs to.
+ *
+ * Every session in the shared Codex tree has to be classified, but only the
+ * matching ones are worth parsing, and on a real machine the tree is dominated
+ * by other projects: the history that motivated this held 716 MB of sessions of
+ * which one project owned 0.9 MB, and parsing all of it cost ~9 s of the
+ * command's startup. Because the deciding field sits on line 0, reading a prefix
+ * instead of the whole file makes the cost proportional to this project's share
+ * of Codex history rather than to all of it.
+ */
+async function probeSessionCwd(filePath) {
+    const handle = await fs.open(filePath, 'r');
+    try {
+        const buffer = Buffer.alloc(CWD_PROBE_BYTES);
+        const { bytesRead } = await handle.read(buffer, 0, CWD_PROBE_BYTES, 0);
+        const cwd = findRecordedCwd(buffer.subarray(0, bytesRead).toString('utf8'));
+        // A short read means the prefix was the entire file, so "no session_meta
+        // here" is the final answer rather than a reason to read it again.
+        return { cwd, conclusive: cwd !== null || bytesRead < CWD_PROBE_BYTES };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Finds and parses every Codex session belonging to one project.
+ *
+ * Shared by `collectCodexSkillMetrics` and the metrics server, which need
+ * exactly this and previously each carried their own copy of the walk — so the
+ * probe optimisation could otherwise have been applied to one and not the other.
+ */
+export async function scanCodexSessions(rootPath, options = {}) {
+    const sessionsDir = resolveCodexSessionsDir(options);
+    // fast-glob returns an empty list for a missing `cwd` rather than throwing,
+    // so existence has to be checked directly — otherwise "Codex never used on
+    // this machine" (available: false) would be indistinguishable from "used,
+    // but nothing here matches this project" (available: true, sessions: 0).
+    const stat = await fs.stat(sessionsDir).catch(() => null);
+    if (!stat)
+        return { sessionsDir, available: false, sessions: [] };
+    const filePaths = await fg('**/*.jsonl', { cwd: sessionsDir, absolute: true });
+    const sessions = [];
+    for (const filePath of filePaths) {
+        try {
+            const probe = await probeSessionCwd(filePath);
+            if (probe.conclusive && !sessionBelongsToProject(probe.cwd, rootPath))
+                continue;
+            // The probe only ever skips work; the full parse stays authoritative for
+            // every session that survives it.
+            const { cwd, entries } = parseCodexSession(await fs.readFile(filePath, 'utf8'));
+            if (!sessionBelongsToProject(cwd, rootPath))
+                continue;
+            sessions.push({ session: path.basename(filePath, '.jsonl'), entries });
+        }
+        catch {
+            // A session file can vanish between listing and read; skip it.
+            continue;
+        }
+    }
+    return { sessionsDir, available: true, sessions };
+}
+/**
+ * Derives skill timings from the `SKILL.md`-read heuristic over this project's
+ * Codex sessions — the Codex-flavoured equivalent of `collectSkillMetrics`.
+ * `scanCodexSessions` does the finding and scoping.
+ *
+ * A missing sessions directory is a reportable state (`available: false`), not
+ * an error, for the same reason it is for Claude Code: the project may simply
+ * never have been opened in Codex.
+ */
+export async function collectCodexSkillMetrics(rootPath, options = {}) {
+    const thresholds = {
+        idleGapMs: options.idleGapMs ?? DEFAULT_IDLE_GAP_MS,
+        splitGapMs: options.splitGapMs ?? DEFAULT_SPLIT_GAP_MS,
+    };
+    const scan = await scanCodexSessions(rootPath, options);
+    if (!scan.available) {
+        return {
+            source: {
+                transcriptDir: scan.sessionsDir,
+                available: false,
+                sessions: 0,
+                attributedSessions: 0,
+                firstSeen: null,
+                lastSeen: null,
+            },
+            thresholds,
+            skills: [],
+            runs: [],
+        };
+    }
+    let attributedSessions = 0;
+    const allRuns = [];
+    for (const { session, entries } of scan.sessions) {
+        const runs = buildRuns(entries, session, { ...thresholds, source: 'codex' });
+        if (runs.length > 0)
+            attributedSessions++;
+        for (const run of runs) {
+            if (options.sinceMs !== undefined && run.endMs < options.sinceMs)
+                continue;
+            allRuns.push(run);
+        }
+    }
+    allRuns.sort((a, b) => a.startMs - b.startMs);
+    const source = {
+        transcriptDir: scan.sessionsDir,
+        available: true,
+        sessions: scan.sessions.length,
+        attributedSessions,
+        firstSeen: allRuns.length > 0 ? new Date(allRuns[0].startMs).toISOString() : null,
+        lastSeen: allRuns.length > 0 ? new Date(Math.max(...allRuns.map((r) => r.endMs))).toISOString() : null,
+    };
+    return {
+        source,
+        thresholds,
+        skills: aggregateRuns(allRuns),
+        runs: allRuns,
+    };
+}
+//# sourceMappingURL=codex-metrics.js.map

package/dist/core/codex-metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-metrics.js","sourceRoot":"","sources":["../../src/core/codex-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,WAAW,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GAMrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAWrC;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAmC,EAAE;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAkB,EAAE,QAAgB;IAC1E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAuBD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,MAAsB;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;IAChC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAE3D,SAAS,2BAA2B,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAS;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,GAAG,KAAK,CAAC;gBACZ,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IACE,MAAM,CAAC,IAAI,KAAK,eAAe;YAC/B,OAAO;YACP,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,EACzE,CAAC;YACD,MAAM,WAAW,GACf,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK;gBAAE,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAYlC,gFAAgF;AAChF,SAAS,eAAe,CAAC,IAAY;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,yEAAyE;QACzE,mEAAmE;QACnE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,UAAmC,EAAE;IAErC,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAErD,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAElE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAEhF,yEAAyE;YACzE,kCAAkC;YAClC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAsB;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,mBAAmB;QACnD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,oBAAoB;KACvD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE;gBACN,aAAa,EAAE,IAAI,CAAC,WAAW;gBAC/B,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,CAAC;gBACX,kBAAkB,EAAE,CAAC;gBACrB,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACf;YACD,UAAU;YACV,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,kBAAkB,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO;gBAAE,SAAS;YAC3E,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAkB;QAC5B,aAAa,EAAE,IAAI,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC9B,kBAAkB;QAClB,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QACjF,QAAQ,EACN,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/F,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU;QACV,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC"}

package/dist/core/local-server.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Plumbing shared by every local web command (`dashboard`, `metrics`).
+ *
+ * Two of these are trust boundaries, and that is the reason this module exists
+ * rather than each command carrying its own copy: `isAllowedHostHeader` is a
+ * DNS-rebinding guard and `serveAsset` is a path-escape guard. A second
+ * implementation of either is a hole that survives fixing the first one.
+ *
+ * `serveAsset` takes its root directory as an argument — the commands serve
+ * different asset trees, and parameterising the directory is what lets one
+ * implementation serve both.
+ */
+import * as http from 'node:http';
+/** Hosts considered loopback for binding and Host-header checks. */
+export declare const LOOPBACK_HOSTS: Set<string>;
+export declare function sendJson(res: http.ServerResponse, status: number, payload: unknown): void;
+/**
+ * Absolute path to a shipped asset tree (`assets/<name>`), resolved relative to
+ * this module's own URL.
+ *
+ * The depth is load-bearing: compiled to `dist/core/`, two levels up is the
+ * package root, which is also what `dist/commands/` yields. Assets are shipped
+ * as package `files` and never compiled, so moving this module to a different
+ * depth would silently resolve outside the package. Every caller goes through
+ * here so that constraint has exactly one home.
+ */
+export declare function packageAssetsDir(name: string): string;
+/**
+ * Serves one file from `dir`. The requested name is confined to that directory:
+ * URL parsing already normalises `..`, but a resolved path outside `dir` is
+ * refused regardless, since this is the only thing standing between a crafted
+ * request and the rest of the filesystem.
+ */
+export declare function serveAsset(res: http.ServerResponse, dir: string, rawName: string): Promise<void>;
+/**
+ * DNS-rebinding guard: only requests whose Host header names loopback (or the
+ * explicitly bound non-loopback address) are served. A malicious page can make
+ * a victim's browser resolve an attacker domain to 127.0.0.1 and read the
+ * server's endpoints; the attacker domain in the Host header is what gives that
+ * away.
+ */
+export declare function isAllowedHostHeader(hostHeader: string | undefined, boundHost: string): boolean;
+/** Resolves once the server is listening, or rejects with the listen error. */
+export declare function listenOnce(server: http.Server, port: number, host: string): Promise<void>;
+/**
+ * Binds `basePort`, advancing to the next port on `EADDRINUSE` until one is
+ * free, and returns the port actually bound. Every local command wants the same
+ * rule — a predictable port you can keep in your head, that still yields rather
+ * than failing when something already holds it.
+ *
+ * `port: 0` is passed straight through: the OS picks a free port itself, so
+ * there is nothing to retry and incrementing from whatever it chose would be
+ * meaningless.
+ *
+ * The attempt bound is a backstop, not a policy: without it a machine that
+ * refuses every bind for some other reason would spin through 65k ports.
+ */
+export declare function listenFrom(server: http.Server, basePort: number, host: string, maxAttempts?: number): Promise<number>;
+/**
+ * Builds the platform command that opens `url` in the default browser.
+ * Pure (no side effects) so the platform branching is testable without
+ * launching anything.
+ */
+export declare function browserOpenCommand(url: string, platform?: NodeJS.Platform): string;
+/** Opens `url` in a browser; a failure only warns (the URL is already printed). */
+export declare function openBrowser(url: string): void;
+//# sourceMappingURL=local-server.d.ts.map

package/dist/core/local-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.d.ts","sourceRoot":"","sources":["../../src/core/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAYlC,oEAAoE;AACpE,eAAO,MAAM,cAAc,aAA6C,CAAC;AAMzE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAkBf;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ9F;AAMD,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAczF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,SAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAIR;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ7C"}

package/dist/core/local-server.js

@@ -0,0 +1,169 @@
+/**
+ * Plumbing shared by every local web command (`dashboard`, `metrics`).
+ *
+ * Two of these are trust boundaries, and that is the reason this module exists
+ * rather than each command carrying its own copy: `isAllowedHostHeader` is a
+ * DNS-rebinding guard and `serveAsset` is a path-escape guard. A second
+ * implementation of either is a hole that survives fixing the first one.
+ *
+ * `serveAsset` takes its root directory as an argument — the commands serve
+ * different asset trees, and parameterising the directory is what lets one
+ * implementation serve both.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { exec } from 'node:child_process';
+const ASSET_CONTENT_TYPES = {
+    '.html': 'text/html',
+    '.js': 'text/javascript',
+    '.css': 'text/css',
+};
+/** Hosts considered loopback for binding and Host-header checks. */
+export const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+// -----------------------------------------------------------------------------
+// Responses
+// -----------------------------------------------------------------------------
+export function sendJson(res, status, payload) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(payload));
+}
+/**
+ * Absolute path to a shipped asset tree (`assets/<name>`), resolved relative to
+ * this module's own URL.
+ *
+ * The depth is load-bearing: compiled to `dist/core/`, two levels up is the
+ * package root, which is also what `dist/commands/` yields. Assets are shipped
+ * as package `files` and never compiled, so moving this module to a different
+ * depth would silently resolve outside the package. Every caller goes through
+ * here so that constraint has exactly one home.
+ */
+export function packageAssetsDir(name) {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.join(here, '..', '..', 'assets', name);
+}
+/**
+ * Serves one file from `dir`. The requested name is confined to that directory:
+ * URL parsing already normalises `..`, but a resolved path outside `dir` is
+ * refused regardless, since this is the only thing standing between a crafted
+ * request and the rest of the filesystem.
+ */
+export async function serveAsset(res, dir, rawName) {
+    const name = decodeURIComponent(rawName);
+    const resolved = path.resolve(dir, name);
+    if (resolved !== dir && !resolved.startsWith(dir + path.sep)) {
+        return sendJson(res, 404, { error: 'not found' });
+    }
+    const type = ASSET_CONTENT_TYPES[path.extname(resolved)];
+    if (!type) {
+        return sendJson(res, 404, { error: 'not found' });
+    }
+    let content;
+    try {
+        content = await fs.readFile(resolved);
+    }
+    catch {
+        return sendJson(res, 404, { error: 'not found' });
+    }
+    res.writeHead(200, { 'content-type': `${type}; charset=utf-8` });
+    res.end(content);
+}
+// -----------------------------------------------------------------------------
+// Trust boundary
+// -----------------------------------------------------------------------------
+/**
+ * DNS-rebinding guard: only requests whose Host header names loopback (or the
+ * explicitly bound non-loopback address) are served. A malicious page can make
+ * a victim's browser resolve an attacker domain to 127.0.0.1 and read the
+ * server's endpoints; the attacker domain in the Host header is what gives that
+ * away.
+ */
+export function isAllowedHostHeader(hostHeader, boundHost) {
+    if (!hostHeader)
+        return false;
+    // Strip the port; IPv6 hosts arrive bracketed ([::1]:5620).
+    const match = hostHeader.match(/^(\[[^\]]+\]|[^:]+)(:\d+)?$/);
+    if (!match)
+        return false;
+    const name = match[1].toLowerCase().replace(/^\[|\]$/g, '');
+    if (LOOPBACK_HOSTS.has(name))
+        return true;
+    return name === boundHost.toLowerCase();
+}
+// -----------------------------------------------------------------------------
+// Lifecycle
+// -----------------------------------------------------------------------------
+/** Resolves once the server is listening, or rejects with the listen error. */
+export function listenOnce(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            server.removeListener('listening', onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            server.removeListener('error', onError);
+            resolve();
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+        server.listen(port, host);
+    });
+}
+/**
+ * Binds `basePort`, advancing to the next port on `EADDRINUSE` until one is
+ * free, and returns the port actually bound. Every local command wants the same
+ * rule — a predictable port you can keep in your head, that still yields rather
+ * than failing when something already holds it.
+ *
+ * `port: 0` is passed straight through: the OS picks a free port itself, so
+ * there is nothing to retry and incrementing from whatever it chose would be
+ * meaningless.
+ *
+ * The attempt bound is a backstop, not a policy: without it a machine that
+ * refuses every bind for some other reason would spin through 65k ports.
+ */
+export async function listenFrom(server, basePort, host, maxAttempts = 200) {
+    let port = basePort;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await listenOnce(server, port, host);
+            break;
+        }
+        catch (err) {
+            if (err.code === 'EADDRINUSE' && port !== 0 && attempt < maxAttempts) {
+                port++;
+                continue;
+            }
+            throw err;
+        }
+    }
+    // With `port: 0` the bound port is only knowable from the socket.
+    const address = server.address();
+    return typeof address === 'object' && address ? address.port : port;
+}
+// -----------------------------------------------------------------------------
+// Browser
+// -----------------------------------------------------------------------------
+/**
+ * Builds the platform command that opens `url` in the default browser.
+ * Pure (no side effects) so the platform branching is testable without
+ * launching anything.
+ */
+export function browserOpenCommand(url, platform = process.platform) {
+    if (platform === 'win32')
+        return `start "" "${url}"`;
+    if (platform === 'darwin')
+        return `open "${url}"`;
+    return `xdg-open "${url}"`;
+}
+/** Opens `url` in a browser; a failure only warns (the URL is already printed). */
+export function openBrowser(url) {
+    // `start` is a cmd builtin, so this must run through the shell (exec does).
+    // windowsHide keeps the transient cmd.exe from flashing a console window.
+    exec(browserOpenCommand(url), { windowsHide: true }, (err) => {
+        if (err) {
+            console.warn(`Could not open a browser automatically: ${err.message}`);
+        }
+    });
+}
+//# sourceMappingURL=local-server.js.map

package/dist/core/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/core/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,mBAAmB,GAA2B;IAClD,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,UAAU,QAAQ,CAAC,GAAwB,EAAE,MAAc,EAAE,OAAgB;IACjF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAwB,EACxB,GAAW,EACX,OAAe;IAEf,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA8B,EAAE,SAAiB;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,4DAA4D;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,MAAmB,EAAE,IAAY,EAAE,IAAY;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAmB,EACnB,QAAgB,EAChB,IAAY,EACZ,WAAW,GAAG,GAAG;IAEjB,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;gBAChG,IAAI,EAAE,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,aAAa,GAAG,GAAG,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,GAAG,GAAG,CAAC;IAClD,OAAO,aAAa,GAAG,GAAG,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3D,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}