@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/lib/provider-timeout.js

@@ -0,0 +1,70 @@
+// Per-provider HTTP timeout overrides (issue #547, reworked from PR #509).
+//
+// PROVIDER_TIMEOUT_<PLATFORM>=<milliseconds> overrides the platform's built-in
+// chat timeout (e.g. PROVIDER_TIMEOUT_NVIDIA=300000). 0 disables the timeout
+// entirely. Values are read when the provider is constructed — for the built-in
+// platforms that means process start, so a change requires a restart.
+//
+// PROVIDER_STREAM_STALL_TIMEOUT_MS is the streaming counterpart for the
+// mid-stream inactivity watchdog (issue #553): how long an SSE stream may go
+// without a single byte before the gateway gives up on it.
+// PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM> (issue #584) overrides it for one
+// platform; precedence is per-platform > global > built-in default (90s).
+//
+// The stall watchdog does NOT bound time-to-first-byte: the FIRST read of a
+// stream gets a grace budget derived from the platform's chat timeout (the
+// PROVIDER_TIMEOUT_<PLATFORM> knob above), floored at the stall budget — see
+// BaseProvider.readSseStream. Before #584 the stall budget also bounded the
+// first byte, which killed healthy long prefills (NVIDIA NIM sends SSE headers
+// instantly, then prefills 100k-token prompts for minutes) at 90s.
+const warned = new Set();
+function warnOnce(name, message) {
+    if (warned.has(name))
+        return;
+    warned.add(name);
+    console.warn(message);
+}
+function parseTimeoutEnv(name, defaultMs) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === '')
+        return defaultMs;
+    const parsed = Number(raw.trim());
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        warnOnce(name, `[config] Ignoring ${name}="${raw}": expected a non-negative integer of milliseconds (0 disables the timeout). Using the default ${defaultMs}ms.`);
+        return defaultMs;
+    }
+    if (parsed > 0 && parsed < 1000) {
+        warnOnce(name, `[config] ${name}=${parsed}ms is under a second; nearly every request to this provider will abort. Was this meant to be seconds?`);
+    }
+    return parsed;
+}
+export function providerTimeoutEnvName(platform) {
+    return `PROVIDER_TIMEOUT_${platform.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
+}
+/** Effective chat timeout for a platform: the PROVIDER_TIMEOUT_<PLATFORM> env
+ * override when set and valid, else the built-in default. Returns 0 to mean
+ * "no timeout" — callers must skip their abort timer for 0, never schedule
+ * setTimeout(0). */
+export function providerTimeoutMs(platform, defaultMs) {
+    return parseTimeoutEnv(providerTimeoutEnvName(platform), defaultMs);
+}
+export const DEFAULT_STREAM_STALL_TIMEOUT_MS = 90_000;
+export function streamStallTimeoutEnvName(platform) {
+    return `PROVIDER_STREAM_STALL_TIMEOUT_${platform.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
+}
+/** Effective mid-stream inactivity timeout, 0 disables. Resolved per call so
+ * tests can vary the env. Precedence (#584): the per-platform
+ * PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM> when a platform is given and the
+ * var is set and valid, else the global PROVIDER_STREAM_STALL_TIMEOUT_MS,
+ * else the built-in 90s default. */
+export function streamStallTimeoutMs(platform) {
+    const globalMs = parseTimeoutEnv('PROVIDER_STREAM_STALL_TIMEOUT_MS', DEFAULT_STREAM_STALL_TIMEOUT_MS);
+    if (!platform)
+        return globalMs;
+    return parseTimeoutEnv(streamStallTimeoutEnvName(platform), globalMs);
+}
+/** Test hook: forget which malformed values have already been warned about. */
+export function resetTimeoutWarnings() {
+    warned.clear();
+}
+//# sourceMappingURL=provider-timeout.js.map

package/dist/lib/provider-timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-timeout.js","sourceRoot":"","sources":["../../src/lib/provider-timeout.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,2DAA2D;AAC3D,6EAA6E;AAC7E,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,mEAAmE;AAEnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjC,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,IAAI,KAAK,GAAG,kGAAkG,SAAS,KAAK,CAAC,CAAC;QAClK,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,MAAM,uGAAuG,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,oBAAoB,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;oBAGoB;AACpB,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACnE,OAAO,eAAe,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,iCAAiC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;oCAIoC;AACpC,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,kCAAkC,EAAE,+BAA+B,CAAC,CAAC;IACtG,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,OAAO,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/lib/proxy.d.ts

@@ -0,0 +1,180 @@
+import type { ProxyMode } from '@srouter/shared/types.js';
+/** Run `fn` with a per-key proxy override in effect; empty URL = global proxy. */
+export declare function withKeyProxy<T>(proxyUrl: string | undefined, fn: () => T): T;
+/** Every proxy scheme the app accepts. Shared with the settings validator. */
+export declare const PROXY_SCHEMES: readonly string[];
+export declare const PROXY_MODES: readonly ProxyMode[];
+export declare const FETCH_RELAY_TARGET_HEADER = "fetch-relay-target";
+export declare const FETCH_RELAY_AUTH_HEADER = "fetch-relay-authorization";
+/** True for a hostname that cannot leave the local machine. `new URL()` keeps
+ *  the brackets on an IPv6 literal, hence both spellings of ::1. */
+export declare function isLoopbackRelayHostname(hostname: string): boolean;
+/** Why a URL cannot serve as a Fetch Relay endpoint, or undefined when it can.
+ *  Shared by the settings validator and the boot-time env guard so the
+ *  dashboard and a headless install agree on what a usable relay looks like. */
+export declare function fetchRelayUrlError(url: string): string | undefined;
+/** True when the URL names a SOCKS scheme (so it needs SocksProxyAgent, not undici). */
+export declare function isSocksProxyUrl(url: string): boolean;
+/**
+ * Give a scheme-less `host:port` proxy an `http://` scheme. Windows Internet
+ * Options and macOS `scutil --proxy` both store the proxy that way, and so do
+ * plenty of hand-written HTTPS_PROXY values; `new URL('127.0.0.1:7890')`
+ * throws, so without this the proxy was logged as invalid and every request
+ * silently went direct (#1373).
+ */
+export declare function normalizeProxyUrl(url: string): string;
+/**
+ * Read the OS-wide proxy configuration. Synchronous and best-effort: never
+ * throws, returns '' when the platform is unsupported or the command fails.
+ *
+ * - macOS: `scutil --proxy` (System Settings → Network → Proxies)
+ * - Windows: Internet Options registry (ProxyEnable + ProxyServer)
+ * - Linux: GNOME gsettings (the most common desktop), manual mode only
+ */
+export declare function detectSystemProxy(): {
+    url: string;
+    source: string;
+};
+/** Parse `scutil --proxy` output: HTTPEnable/HTTPProxy/HTTPPort first, then SOCKS. */
+export declare function parseScutilProxy(out: string): {
+    url: string;
+    source: string;
+};
+/** Parse Windows registry output; ProxyServer may be "host:port" or "http=…;https=…". */
+export declare function parseRegProxy(enableOut: string, serverOut: string): {
+    url: string;
+    source: string;
+};
+/** Called once at startup (after initDb) and on PUT /api/settings/proxy. */
+export declare function applyProxyUrl(dbValue: string): void;
+/**
+ * Hydrate the process-wide proxy state from the settings table.
+ *
+ * The standalone server does this in index.ts after initDb; the desktop
+ * embedder (desktop/src/server-host.ts) builds the app without index.ts and
+ * must call this itself — otherwise the URL saved by PUT /api/settings/proxy
+ * sits in the DB but the process starts with an empty proxy and every
+ * outbound request goes direct until the user re-saves the setting (#949).
+ * Safe to call more than once; it is idempotent.
+ */
+export declare function restoreProxySettings(): void;
+export declare function getProxyUrl(): string;
+/** Set how the global proxy URL is used. An explicit PROXY_MODE wins. A legacy
+ * PROXY_URL (or an ambient standard proxy variable) without PROXY_MODE always
+ * stays a forward proxy, regardless of a saved dashboard mode. */
+export declare function applyProxyMode(dbValue: string): void;
+export declare function getProxyMode(): ProxyMode;
+/** Set the bearer token used only to authenticate srouter to a Fetch Relay.
+ * The environment wins so headless deployments never expose or overwrite it
+ * through the dashboard. This token is separate from the provider's
+ * Authorization header, which is preserved for the upstream request. */
+export declare function applyFetchRelayToken(dbValue: string): void;
+export declare function getFetchRelayToken(): string;
+/** Encrypt the dashboard-saved Relay credential at rest. The environment form
+ * never enters the database. */
+export declare function encodeFetchRelayToken(value: string): string;
+/** Toggle the proxy on/off without losing the URL. */
+export declare function applyProxyEnabled(enabled: boolean): void;
+export declare function isProxyEnabled(): boolean;
+/** Set which platforms bypass the proxy. Comma-separated string from DB. */
+export declare function applyProxyBypass(platformsCsv: string): void;
+export declare function getProxyBypassPlatforms(): string[];
+/** The NO_PROXY rules currently in effect (parsed from the env at apply time). */
+export declare function getNoProxyRules(): string[];
+/**
+ * Request kinds recognised in AbortError messages. Mirrors the values
+ * written to `requests.request_type` so the abort message and the row
+ * column agree on terminology.
+ */
+export type ProxyRequestType = 'chat' | 'embedding' | 'image' | 'video' | 'audio' | 'transcription' | 'unknown';
+/**
+ * Format the `<platform>, <type>, <timeout>s` tag. Exposed for testing and
+ * for callers that want to log the tag without re-throwing. Falls back
+ * gracefully when fields are missing: unknown platform → 'unknown',
+ * unknown type → 'unknown', no timeout → omit the trailing ', <N>s'.
+ */
+export declare function describeAbort(platform: string | undefined, type: ProxyRequestType, timeoutMs: number | undefined): string;
+/**
+ * undici reports every connection that never opened as a bare "fetch failed"
+ * and keeps the reason (ENOTFOUND, ECONNREFUSED, a certificate error) in
+ * `err.cause`, which never reached the attempt trail, the logs or the client.
+ * A DNS failure, a dead proxy and TLS-intercepting antivirus all looked the
+ * same (#1373). Append the cause code and the upstream host so the message
+ * says which it was. "fetch failed" stays as the prefix, which the
+ * retry classifier matches on.
+ */
+export declare function describeFetchFailure(err: unknown, url: string, platform?: string): void;
+/**
+ * DNS `lookup` override for the SOCKS fallback path: hand back the hostname it
+ * was asked to resolve, unchanged.
+ *
+ * socks-proxy-agent resolves the DESTINATION locally for the `socks5://` and
+ * `socks4://` schemes (`shouldLookup`) and sends the proxy a bare IP; only
+ * `socks5h://`/`socks4a://` pass the name through. That local resolution is
+ * what breaks rule-based proxy clients (Clash and friends), which match routing
+ * rules on the domain and have nothing to match once the name is gone — and on
+ * a DNS-poisoned network it resolves to the poisoned address as well.
+ *
+ * `http.request` forwards this to the agent as `opts.lookup`, so echoing the
+ * hostname makes every SOCKS scheme reach the proxy with the domain intact,
+ * i.e. behave like its `h`/`a` variant. The agent only forwards the "address"
+ * as the SOCKS destination host — it never inspects the address family, so the
+ * `4` is a placeholder the callback signature requires.
+ */
+export declare function socksHostnameLookup(hostname: string, _options: unknown, callback: (err: null, address: string, family: number) => void): void;
+export declare function proxyFetch(url: string, init?: RequestInit, platform?: string, requestType?: ProxyRequestType, timeoutMs?: number): Promise<Response>;
+/**
+ * Returns true when the proxy is configured AND enabled. Used by the dashboard
+ * to show the "Active" badge. Intentionally does NOT construct a dispatcher (so
+ * it never triggers the lazy undici import) — "configured + enabled" is exactly
+ * what the badge means.
+ */
+export declare function isProxyActive(): boolean;
+/** Force-rebuild the outbound connection pools on the next request. Called on
+ *  sleep/wake recovery to drop pooled TCP connections that died while the
+ *  host was suspended (undici keeps them warm and would hand a dead socket
+ *  to the first post-wake request). */
+export declare function flushProxyCache(): void;
+export interface ProxyProbeResult {
+    ok: boolean;
+    latencyMs: number;
+    status?: number;
+    error?: string;
+    /** The URL the probe actually called, so the dashboard can say what it
+     *  reached rather than leaving the operator to guess. */
+    target?: string;
+}
+/**
+ * Where the probe goes when the caller names no target and no provider key
+ * can supply one.
+ *
+ * Deliberately NOT an AI vendor. The probe answers "can this proxy reach the
+ * internet", and pointing it at a third party the install may never use makes
+ * the test lie in both directions: a gateway that never calls that vendor now
+ * calls it on every Test, and a network that blocks it reports a working proxy
+ * as broken. `/cdn-cgi/trace` is a plain-text reachability endpoint with no
+ * account, no rate limit and no regional AI-vendor blocking.
+ */
+export declare const DEFAULT_PROXY_PROBE_TARGET = "https://www.cloudflare.com/cdn-cgi/trace";
+/**
+ * Test whether a proxy URL can actually route traffic (#863). Backs the
+ * Settings → Outbound proxy "Test" button so an operator can verify a draft
+ * value BEFORE saving it.
+ *
+ * `proxyUrl` empty → falls back to the saved global proxy URL (getProxyUrl);
+ * when neither is set the probe runs direct, so the button is still useful
+ * before any proxy has been configured.
+ *
+ * The probe target is supplied by the caller and should be an endpoint this
+ * install genuinely uses — the /models route of a provider the operator holds
+ * an enabled key for. Any HTTP response, even a 401/403 without a key, proves
+ * the proxy route works; only a network-level failure (DNS, connect, timeout)
+ * counts as a proxy failure.
+ */
+export declare function probeProxyUrl(proxyUrl: string | undefined, options?: {
+    targetUrl?: string;
+    timeoutMs?: number;
+    mode?: ProxyMode;
+    relayToken?: string;
+}): Promise<ProxyProbeResult>;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/lib/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/lib/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAS1D,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE5E;AA8BD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAA0C,CAAC;AACtF,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA+B,CAAC;AAC5E,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAC9D,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAOnE;oEACoE;AACpE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;gFAEgF;AAChF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUlE;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIpD;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD;AAuBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwBnE;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAe7E;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoBnG;AAkGD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;kEAEkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAKpD;AAED,wBAAgB,YAAY,IAAI,SAAS,CAExC;AAED;;;wEAGwE;AACxE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;gCACgC;AAChC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG3D;AAcD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGxD;AAED,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAU3D;AAED,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED,kFAAkF;AAClF,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAgFD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,eAAe,GAAG,SAAS,CAAC;AAyBhH;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAQR;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAgBvF;AA4BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAC7D,IAAI,CAEN;AA8ID,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,GAAE,gBAA4B,EACzC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAoCnB;AA0HD;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAGvC;AAED;;;uCAGuC;AACvC,wBAAgB,eAAe,IAAI,IAAI,CAuBtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6DACyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,6CAA6C,CAAC;AAErF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9F,OAAO,CAAC,gBAAgB,CAAC,CAmD3B"}