@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/agent-workspace.js

@@ -0,0 +1,353 @@
+/**
+ * #3153 P1: a read-only look at an agent's working directory, for the web's Files / Changes side panel.
+ *
+ * - **Scope:** only the agent's configured `working_directory` (realpath). Every path is resolved and must stay under
+ *   it. A symlink is listed but never followed (its target is neither read nor described). `..`, absolute paths, NUL
+ *   and device or FIFO files are refused. AgEnD's own state directory is never shown, even inside the folder.
+ * - **Secrets:** a fixed deny-list by name (`.env*`, keys, certificates, credential and secret files, `.git`, `.ssh`,
+ *   …). Such a file is listed as hidden; its contents are never read or sent, and its diff is left out.
+ * - **Limits:**
+ *   - a file over 1 MiB is not read;
+ *   - the diff stops at 2 MiB or 500 files;
+ *   - a directory lists at most 1,000 entries;
+ *   - git runs with a timeout and a byte cap.
+ *   Every cut is said, never silent.
+ * - **git:** only read-only commands (`status`, `diff`, `ls-files`, `check-ignore`, `rev-parse`), never a pager, with
+ *   `GIT_OPTIONAL_LOCKS=0` (no index refresh), and with fsmonitor, external diff and textconv switched off. Nothing in
+ *   the folder is executed by this module, and nothing is written.
+ *
+ * Callers (web-api.ts) decide who may ask: the fleet's local admin session only.
+ */
+import { execFile } from "./child-process.js";
+import { constants as fsConstants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import { basename, extname, isAbsolute, join, resolve, sep } from "node:path";
+export const WORKSPACE_LIMITS = Object.freeze({
+    fileBytes: 1024 * 1024,
+    diffBytes: 2 * 1024 * 1024,
+    diffFiles: 500,
+    /** One file's share of the diff: a bigger one is listed as "too large to show" (the others still fit). */
+    fileDiffBytes: 256 * 1024,
+    dirEntries: 1000,
+    untrackedDiffFiles: 50,
+    gitTimeoutMs: 10_000,
+});
+const IMAGE_TYPES = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
+const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+/** Names whose contents never leave the machine through this view (fixed in P1, #3153). Lowercase compare. */
+const HIDDEN_DIRS = new Set([".git", ".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure", ".config", ".agend", ".claude", ".codex", ".kiro"]);
+const HIDDEN_FILES = new Set([".npmrc", ".netrc", ".pypirc", ".git-credentials", ".pgpass", "credentials", "credentials.json", "auth.json", "secrets.json",
+    "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "known_hosts", "authorized_keys", ".htpasswd",
+    // Fable on #3158: tool credentials and shell histories (a history holds whatever was typed, tokens included).
+    ".envrc", ".vault-token", ".s3cfg", ".boto", "kubeconfig", ".kubeconfig", "terraform.tfstate", "terraform.tfstate.backup"]);
+/** Whether a path (relative, `/`-separated) is hidden: any part a hidden directory, or its name a secret-looking file. */
+export function isHiddenPath(rel) {
+    const parts = rel.split("/").filter(Boolean);
+    for (const p of parts.slice(0, -1))
+        if (HIDDEN_DIRS.has(p.toLowerCase()))
+            return true;
+    const name = (parts[parts.length - 1] ?? "").toLowerCase();
+    if (HIDDEN_DIRS.has(name) || HIDDEN_FILES.has(name))
+        return true;
+    if (/^\.env(?:$|[.-])/.test(name) || /^id_(?:rsa|dsa|ecdsa|ed25519)/.test(name))
+        return true;
+    if (/\.(?:pem|key|p12|p8|pfx|jks|keystore|kdbx|asc|gpg|ppk|token|env|tfvars|tfstate)$/.test(name) || /\.tfstate\./.test(name))
+        return true;
+    if (/^service[-_]?account.*\.json$/.test(name) || /^\.[a-z0-9]*_?history$/.test(name) || /^\.?kubeconfig(?:[.-]|$)/.test(name))
+        return true;
+    if (/(?:^|[._-])(?:secret|secrets|credential|credentials|password|passwords|private[-_]?key)(?:[._-]|$)/.test(name))
+        return true;
+    return false;
+}
+export class WorkspaceError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+const under = (path, root) => path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+/** The agent's folder (realpath) and AgEnD's state directory, when it is inside the folder. */
+export async function workspaceRoot(workingDirectory, agendHome) {
+    if (typeof workingDirectory !== "string" || !isAbsolute(workingDirectory))
+        throw new WorkspaceError("not_a_directory");
+    let root;
+    try {
+        root = await realpath(workingDirectory);
+    }
+    catch {
+        throw new WorkspaceError("not_found");
+    }
+    const st = await lstat(root).catch(() => null);
+    if (!st || !st.isDirectory())
+        throw new WorkspaceError("not_a_directory");
+    let state = null;
+    try {
+        const s = await realpath(agendHome);
+        if (under(s, root))
+            state = s;
+    }
+    catch { /* no state directory */ }
+    return { root, state };
+}
+/**
+ * A request's relative path → its place under the root, refused when it is not plainly inside: no absolute path, no
+ * `..`, no NUL or control characters; and no part of it (or the place itself, via realpath) outside the root or in
+ * AgEnD's state. `allowRoot`: the empty path is the root itself (a directory listing).
+ */
+export async function placeOf(ws, rel, allowRoot = false) {
+    if (typeof rel !== "string" || rel.length > 4096 || /[\u0000-\u001f\u007f\\]/.test(rel))
+        throw new WorkspaceError("invalid");
+    if (rel === "" || rel === "/") {
+        if (allowRoot)
+            return { abs: ws.root, rel: "" };
+        throw new WorkspaceError("invalid");
+    }
+    if (isAbsolute(rel) || rel.startsWith("/"))
+        throw new WorkspaceError("outside");
+    const clean = rel.replace(/\/+$/g, "");
+    if (clean.split("/").some((p) => p === "" || p === "." || p === ".."))
+        throw new WorkspaceError("outside");
+    const abs = resolve(ws.root, clean);
+    if (!under(abs, ws.root))
+        throw new WorkspaceError("outside");
+    // Every parent must be a real directory under the root (a symlinked directory is never walked through).
+    let at = ws.root;
+    for (const part of clean.split("/").slice(0, -1)) {
+        at = join(at, part);
+        const st = await lstat(at).catch(() => null);
+        if (!st)
+            throw new WorkspaceError("not_found");
+        if (st.isSymbolicLink())
+            throw new WorkspaceError("symlink");
+        if (!st.isDirectory())
+            throw new WorkspaceError("not_a_directory");
+    }
+    if (ws.state && under(abs, ws.state))
+        throw new WorkspaceError("hidden");
+    return { abs, rel: clean };
+}
+// ── git ──
+function git(root, args, maxBytes) {
+    return new Promise((done) => {
+        const child = execFile("git", ["-C", root, "-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", "-c", "core.pager=cat",
+            "-c", "diff.external=", "-c", "color.ui=false", ...args], { encoding: "buffer", timeout: WORKSPACE_LIMITS.gitTimeoutMs, maxBuffer: maxBytes, windowsHide: true,
+            env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", LC_ALL: "C" } }, (err, stdout) => {
+            const out = Buffer.isBuffer(stdout) ? stdout : Buffer.alloc(0);
+            const e = err;
+            if (e && e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+                done({ ok: true, out, cut: true });
+                return;
+            }
+            // `git diff --no-index` answers 1 when the files differ: that is its success.
+            done({ ok: !e || e.code === 1, out, cut: false });
+        });
+        child.stdin?.end();
+    });
+}
+async function isRepo(root) {
+    const r = await git(root, ["rev-parse", "--is-inside-work-tree"], 4096);
+    return r.ok && r.out.toString("utf8").trim() === "true";
+}
+/**
+ * Changes: git status plus the diff of everything uncommitted against HEAD (staged and unstaged together, P1), and the
+ * untracked files git does not ignore, as additions. Hidden files are listed without their diff.
+ */
+export async function workspaceChanges(ws) {
+    if (!(await isRepo(ws.root)))
+        return { repo: false, branch: null, files: [], patch: "", cut: { files: false, bytes: false }, hiddenCount: 0 };
+    const branchR = await git(ws.root, ["rev-parse", "--abbrev-ref", "HEAD"], 4096);
+    const branch = branchR.ok ? branchR.out.toString("utf8").trim() || null : null;
+    const hasHead = (await git(ws.root, ["rev-parse", "--verify", "-q", "HEAD"], 4096)).out.length > 0;
+    const base = hasHead ? "HEAD" : EMPTY_TREE;
+    const status = await git(ws.root, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--no-renames"], 4 * 1024 * 1024);
+    const files = [];
+    const entries = status.out.toString("utf8").split("\u0000").filter(Boolean);
+    let cutFiles = false;
+    for (const e of entries) {
+        if (files.length >= WORKSPACE_LIMITS.diffFiles) {
+            cutFiles = true;
+            break;
+        }
+        const code = e.slice(0, 2), path = e.slice(3);
+        if (!path || (ws.state && under(resolve(ws.root, path), ws.state)))
+            continue;
+        const untracked = code === "??";
+        files.push({ path, status: untracked ? "untracked" : code.includes("D") ? "deleted" : code.includes("A") ? "added" : "modified",
+            adds: null, dels: null, binary: false, hidden: isHiddenPath(path), untracked });
+    }
+    // Line counts for tracked changes (numstat: "-\t-" is binary).
+    const numstat = await git(ws.root, ["diff", base, "--numstat", "-z", "--no-renames", "--no-ext-diff", "--no-textconv"], 4 * 1024 * 1024);
+    const counts = new Map();
+    for (const row of numstat.out.toString("utf8").split("\u0000").filter(Boolean)) {
+        const m = /^(-|\d+)\t(-|\d+)\t(.*)$/s.exec(row);
+        if (m)
+            counts.set(m[3], { adds: m[1] === "-" ? null : Number(m[1]), dels: m[2] === "-" ? null : Number(m[2]), binary: m[1] === "-" });
+    }
+    for (const f of files) {
+        const c = counts.get(f.path);
+        if (c)
+            Object.assign(f, c);
+    }
+    // The patch: tracked changes (hidden paths excluded by pathspec), then untracked text files as additions.
+    const visibleTracked = files.filter((f) => !f.untracked && !f.hidden).map((f) => f.path);
+    // Each file's section is kept only within its own share and the whole budget: one huge file never starves the rest.
+    let patch = "", cutBytes = false;
+    const byPath = new Map(files.map((f) => [f.path, f]));
+    const take = (section, f) => {
+        const n = Buffer.byteLength(section);
+        if (n > WORKSPACE_LIMITS.fileDiffBytes) {
+            if (f)
+                f.tooLarge = true;
+            return;
+        }
+        if (Buffer.byteLength(patch) + n > WORKSPACE_LIMITS.diffBytes) {
+            cutBytes = true;
+            if (f)
+                f.tooLarge = true;
+            return;
+        }
+        patch += section;
+    };
+    if (visibleTracked.length) {
+        const r = await git(ws.root, ["diff", base, "--no-color", "--no-ext-diff", "--no-textconv", "--no-renames", "-U3", "--", ...visibleTracked.map((p) => `:(literal)${p}`)], 16 * 1024 * 1024);
+        if (r.cut)
+            cutBytes = true;
+        for (const section of r.out.toString("utf8").split(/(?=^diff --git )/m).filter(Boolean)) {
+            const m = /^diff --git a\/(.*?) b\//.exec(section);
+            take(section, m ? byPath.get(m[1]) : undefined);
+        }
+    }
+    let untrackedShown = 0;
+    for (const f of files) {
+        if (!f.untracked || f.hidden)
+            continue;
+        if (untrackedShown >= WORKSPACE_LIMITS.untrackedDiffFiles) {
+            cutFiles = true;
+            break;
+        }
+        const abs = resolve(ws.root, f.path);
+        const st = await lstat(abs).catch(() => null);
+        if (!st || !st.isFile())
+            continue; // a link or a special file: listed, no diff
+        if (st.size > WORKSPACE_LIMITS.fileDiffBytes) {
+            f.tooLarge = true;
+            continue;
+        }
+        const r = await git(ws.root, ["diff", "--no-index", "--no-color", "--no-ext-diff", "--no-textconv", "--", "/dev/null", f.path], WORKSPACE_LIMITS.fileDiffBytes * 2);
+        const text = r.out.toString("utf8");
+        if (/^Binary files /m.test(text)) {
+            f.binary = true;
+            continue;
+        }
+        f.adds = (text.match(/^\+(?!\+\+)/gm) ?? []).length;
+        f.dels = 0;
+        take(text, f);
+        untrackedShown++;
+    }
+    return { repo: true, branch, files, patch, cut: { files: cutFiles, bytes: cutBytes }, hiddenCount: files.filter((f) => f.hidden).length };
+}
+/** One directory's entries (directories first, then names), gitignored ones left out in a repository. */
+export async function workspaceList(ws, rel) {
+    const place = await placeOf(ws, rel ?? "", true);
+    const st = await lstat(place.abs).catch(() => null);
+    if (!st)
+        throw new WorkspaceError("not_found");
+    if (st.isSymbolicLink())
+        throw new WorkspaceError("symlink");
+    if (!st.isDirectory())
+        throw new WorkspaceError("not_a_directory");
+    if (place.rel && isHiddenPath(place.rel))
+        throw new WorkspaceError("hidden");
+    const names = (await readdir(place.abs)).sort();
+    let ignored = new Set();
+    if (await isRepo(ws.root)) {
+        const candidates = names.map((n) => (place.rel ? `${place.rel}/${n}` : n));
+        if (candidates.length) {
+            const r = await new Promise((done) => {
+                const child = execFile("git", ["-C", ws.root, "-c", "core.fsmonitor=false", "check-ignore", "-z", "--stdin"], { encoding: "buffer", timeout: WORKSPACE_LIMITS.gitTimeoutMs, maxBuffer: 4 * 1024 * 1024, env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_CONFIG_NOSYSTEM: "1", LC_ALL: "C" } }, (_err, out) => done(Buffer.isBuffer(out) ? out : Buffer.alloc(0)));
+                child.stdin?.end(candidates.join("\u0000") + "\u0000");
+            });
+            ignored = new Set(r.toString("utf8").split("\u0000").filter(Boolean));
+        }
+    }
+    const entries = [];
+    let cut = false;
+    for (const name of names) {
+        const childRel = place.rel ? `${place.rel}/${name}` : name;
+        if (ignored.has(childRel))
+            continue;
+        const abs = join(place.abs, name);
+        if (ws.state && under(abs, ws.state))
+            continue;
+        if (entries.length >= WORKSPACE_LIMITS.dirEntries) {
+            cut = true;
+            break;
+        }
+        const s = await lstat(abs).catch(() => null);
+        if (!s)
+            continue;
+        const type = s.isSymbolicLink() ? "symlink" : s.isDirectory() ? "dir" : s.isFile() ? "file" : "other";
+        entries.push({ name, type, size: type === "file" ? s.size : null, hidden: isHiddenPath(childRel) });
+    }
+    entries.sort((a, b) => (a.type === "dir") === (b.type === "dir") ? (a.name < b.name ? -1 : a.name > b.name ? 1 : 0) : a.type === "dir" ? -1 : 1);
+    return { path: place.rel, entries, cut };
+}
+/** Open a regular file under the root without following a symlink (O_NOFOLLOW), never waiting on a FIFO (O_NONBLOCK). */
+async function openPlain(ws, rel) {
+    const place = await placeOf(ws, rel);
+    if (isHiddenPath(place.rel))
+        throw new WorkspaceError("hidden");
+    const st = await lstat(place.abs).catch(() => null);
+    if (!st)
+        throw new WorkspaceError("not_found");
+    if (st.isSymbolicLink())
+        throw new WorkspaceError("symlink");
+    if (!st.isFile())
+        throw new WorkspaceError("not_a_file");
+    const fh = await open(place.abs, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK | fsConstants.O_NOCTTY).catch(() => { throw new WorkspaceError("not_a_file"); });
+    const fst = await fh.stat();
+    if (!fst.isFile() || fst.ino !== st.ino || fst.dev !== st.dev) {
+        await fh.close();
+        throw new WorkspaceError("not_a_file");
+    }
+    return { place, fh, size: fst.size };
+}
+/** A file as the viewer shows it: text (UTF-8, up to 1 MiB), an image (served raw by `workspaceImage`), or why not. */
+export async function workspaceFile(ws, rel) {
+    const { place, fh, size } = await openPlain(ws, rel);
+    try {
+        const mime = IMAGE_TYPES[extname(place.rel).toLowerCase()];
+        if (mime)
+            return { kind: size > WORKSPACE_LIMITS.fileBytes * 8 ? "too_large" : "image", path: place.rel, size, ...(size > WORKSPACE_LIMITS.fileBytes * 8 ? {} : { mime }) };
+        if (size > WORKSPACE_LIMITS.fileBytes)
+            return { kind: "too_large", path: place.rel, size };
+        const buf = Buffer.alloc(size);
+        const { bytesRead } = await fh.read(buf, 0, size, 0);
+        const bytes = buf.subarray(0, bytesRead);
+        if (bytes.subarray(0, 8192).includes(0))
+            return { kind: "binary", path: place.rel, size };
+        const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+        return { kind: "text", path: place.rel, size, text };
+    }
+    finally {
+        await fh.close();
+    }
+}
+/** An image's bytes for the viewer's <img> (a known image extension only, at most 8 MiB). */
+export async function workspaceImage(ws, rel) {
+    const { place, fh, size } = await openPlain(ws, rel);
+    try {
+        const mime = IMAGE_TYPES[extname(place.rel).toLowerCase()];
+        if (!mime || size > WORKSPACE_LIMITS.fileBytes * 8)
+            throw new WorkspaceError("not_a_file");
+        const buf = Buffer.alloc(size);
+        const { bytesRead } = await fh.read(buf, 0, size, 0);
+        return { mime, bytes: buf.subarray(0, bytesRead) };
+    }
+    finally {
+        await fh.close();
+    }
+}
+export const workspaceName = (rel) => basename(rel);
+//# sourceMappingURL=agent-workspace.js.map

package/dist/agent-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-workspace.js","sourceRoot":"","sources":["../src/agent-workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,IAAI,GAAG,IAAI;IACtB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC1B,SAAS,EAAE,GAAG;IACd,0GAA0G;IAC1G,aAAa,EAAE,GAAG,GAAG,IAAI;IACzB,UAAU,EAAE,IAAI;IAChB,kBAAkB,EAAE,EAAE;IACtB,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AACH,MAAM,WAAW,GAA2B,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAC7J,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,8GAA8G;AAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc;IACxJ,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW;IAC3F,8GAA8G;IAC9G,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC9H,0HAA0H;AAC1H,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3I,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5I,IAAI,oGAAoG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAAwB,IAAI;IAAzB,YAAqB,IAAsB;QAAI,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAtC,IAAI;IAAmC,CAAC;CAAE;AAE3G,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAGvH,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,gBAAwB,EAAE,SAAiB;IAC7E,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACvH,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IACjG,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAC9G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAiB,EAAE,GAAY,EAAE,SAAS,GAAG,KAAK;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7H,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QAAC,IAAI,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACxH,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9D,wGAAwG;IACxG,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,YAAY;AAEZ,SAAS,GAAG,CAAC,IAAY,EAAE,IAAuB,EAAE,QAAgB;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB;YAChI,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,EAC1D,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;YAClG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EACrJ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,GAA0D,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxG,8EAA8E;YAC9E,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAK,CAAwB,CAAC,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;AAC1D,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAiB;IACtD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC9I,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,uBAAuB,EAAE,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAChI,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7E,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC7H,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACzI,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyE,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACpF,0GAA0G;IAC1G,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,oHAAoH;IACpH,IAAI,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,CAA8B,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QACrH,KAAK,IAAI,OAAO,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5L,IAAI,CAAC,CAAC,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvC,IAAI,cAAc,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,SAAS,CAA0C,4CAA4C;QACxH,IAAI,EAAE,CAAC,IAAI,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC;YAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;QACpK,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5I,CAAC;AAKD,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAiB,EAAE,GAAY;IACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,IAAI,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,EAC1G,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EACnL,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/C,IAAI,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjJ,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AASD,yHAAyH;AACzH,KAAK,UAAU,SAAS,CAAC,EAAiB,EAAE,GAAY;IACtD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzL,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;IAC5H,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAiB,EAAE,GAAY;IACjE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAmB,CAAC;QAC7L,IAAI,IAAI,GAAG,gBAAgB,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjC,CAAC;AACD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAiB,EAAE,GAAY;IAClE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,gBAAgB,CAAC,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;IACrD,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC"}

package/dist/auth-api.d.ts

@@ -4,6 +4,7 @@ import { type SessionRecord, type SessionTier, type WebSessionStore } from "./we
 import { type WebPeer } from "./authority/web-authority.js";
 import type { GuestLoginCodes, LoginCodeOwner, LoginCodeRecipient, WebLoginCodes } from "./web-login.js";
 import { type ReturningDevice } from "./web-returning-device.js";
+import { type DeviceLoginRequests } from "./web-device-login.js";
 export declare const LOGIN_REFUSED_MESSAGE = "That code did not work \u2014 it may be wrong, expired or already used. Ask for a new one with /web.";
 export declare const LOGIN_PAUSED_MESSAGE = "Too many wrong codes \u2014 sign-in is paused for a few minutes.";
 export interface AuthApiContext {
@@ -101,6 +102,25 @@ export interface AuthApiContext {
     } | {
         kind: "refused";
     }>;
+    /**
+     * Refs #3061 (P2a): the requests of device-code sign-in (web-device-login.ts). With `isWebOnlyFleet()`, what makes
+     * `/auth/device-login*` exist: a fleet with a chat connection, web authorization off, or the public link, answers 404 there.
+     */
+    readonly webDeviceLogins?: DeviceLoginRequests | null;
+    /**
+     * Refs #3061: device-code sign-in is open right now — a web-only fleet with web authorization on (with it off no one
+     * can approve, so nothing is offered). Asked again after the body is read. Absent: not open.
+     */
+    deviceLoginAvailable?(): boolean;
+    /** Refs #3061 (P2b): `web.login_qr` — the sign-in page may draw the QR code of the approve link beside the code. Absent: no. */
+    loginQrEnabled?(): boolean;
+    /**
+     * Refs #3061 (P2b): may this request's admin session end ANOTHER session (`DELETE /auth/sessions/<handle>` of someone
+     * else's, or `DELETE /auth/sessions`)? A web-only fleet answers yes only for its verified owner: a session a one-time
+     * code or a device approval made is not one, and could otherwise sign the owner out. Ending one's own is never asked.
+     * Absent: yes, as it always was (a fleet with a chat connection, and any caller that does not set it).
+     */
+    mayEndOtherSessions?(req: IncomingMessage): boolean;
 }
 export declare const CODE_REQUEST_REFUSED_MESSAGE = "A new code could not be sent. Ask for one with /web.";
 /** True for a name `/assets/` serves. The public link's manifest asks this too: one list, not two. */
@@ -127,6 +147,11 @@ export declare function bypassesWebGate(req: {
         view_access?: string;
     } | undefined;
 } | null | undefined, isViewRead: (path: string) => boolean): boolean;
+/**
+ * AgEnD Hub P1: one public, inert asset by its /assets/ name — what a Hub's own listener serves of the app's static
+ * closure. It reads no cookie, session or request header. Returns false when there is no such asset.
+ */
+export declare function servePublicAsset(res: ServerResponse, name: string): boolean;
 /**
  * The sign-in page. Also what a browser navigation gets from a gated page it has no cookie for. #2910 D5: on a web-only
  * fleet (`webOnly`) its <body> says so, and the page's words lead with `agend web --code` (there is no /web to send).
@@ -134,6 +159,8 @@ export declare function bypassesWebGate(req: {
 export declare function serveSigninPage(res: ServerResponse, status?: number, opts?: {
     webOnly?: boolean;
     outside?: boolean;
+    deviceLogin?: boolean;
+    loginQr?: boolean;
 }): void;
 /**
  * What a guest's browser gets for a page it cannot open (#2399 smoke: the gate's bare JSON before): "members" for a page