@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/terminal/ws-upgrade-handler.js

@@ -0,0 +1,518 @@
+/*
+ * ws-upgrade-handler.ts — embedded-terminal WebSocket upgrade body.
+ *
+ * Extracted from `terminal/routes.ts` in iterate-2026-05-27-ws-upgrade-
+ * handler-split (ADR-103 retirement candidate #1). Owns the post-upgrade
+ * lifecycle for the WS attach contract:
+ *
+ *   - replay-only branch for done/launch_failed tasks
+ *   - live branch with:
+ *       * atomic ptyManager.attach() returning {role, hadPriorWriter}
+ *       * new-plain `awaiting_external_start → active` flip (AC-4)
+ *       * subscribeForConnection (onData, onBackpressure, onPromoteToWriter)
+ *       * sync `ready` envelope (auto-launch handshake timing — Spec 76)
+ *       * async replay IIFE: pauseForConn → live-mirror-first / disk-fallback
+ *         resolveReplaySnapshot → flushLiveBuffer → resumeForConn
+ *   - per-message writer-role gating via getRole (non-mutating)
+ *   - snapshot-on-detach via atomic detachAndCount (ADR-092)
+ *
+ * --- PROTECTED DEEP MODULE (see ADR-103 §Retirement Plan) -----------------
+ *
+ * ADR-103's deep-module argument names this file as the cohesive unit
+ * worth protecting: three shared locks (writer-slot, pause-refcount,
+ * attach-count), one onData broadcast, one backpressure budget. The
+ * argument applies to the WS body AS A WHOLE — splitting it further
+ * across more files is the exact failure mode ADR-101 calls out
+ * ("moving complexity outward"). Do NOT add unrelated terminal helpers
+ * (HTTP-only logic, spawn-env factory, image-paste utilities, …) to
+ * this module. If a helper genuinely belongs to the WS body alone,
+ * keep it private here; otherwise route it through `routes.ts` or a
+ * dedicated neutral module like `terminal-reset.ts`.
+ */
+import { buildReplaySnapshotEnvelope, tryReadSnapshot as tryReadSnapshotShared, } from "./replay-snapshot.js";
+import { deriveTerminalReset } from "./terminal-reset.js";
+import { startWsHeartbeat } from "./ws-heartbeat.js";
+import { createResyncGate } from "./resync-gate.js";
+export function isWSInbound(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const o = v;
+    if (o.type === "data" && typeof o.payload === "string")
+        return true;
+    if (o.type === "resize" && typeof o.cols === "number" && typeof o.rows === "number") {
+        return true;
+    }
+    if (o.type === "redraw")
+        return true;
+    if (o.type === "resync")
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Private helpers (formerly factory-closure helpers inside routes.ts).
+// Moved here as one cohesive unit per external plan review HIGH #2 so
+// import order + initialization stay coupled to the WS body.
+// ---------------------------------------------------------------------------
+const tryReadSnapshot = (snapshotStore, taskId, expectedTerminalVersion) => tryReadSnapshotShared(snapshotStore, taskId, expectedTerminalVersion);
+// ADR-092 — replay resolution: LIVE mirror wins over disk snapshot.
+const resolveReplaySnapshot = async (ctx) => {
+    const live = await ctx.ptyManager.serializeMirrorIfLive(ctx.taskId);
+    if (live)
+        return live;
+    return tryReadSnapshot(ctx.snapshotStore, ctx.taskId, ctx.expectedTerminalVersion);
+};
+// ADR-089 — single-envelope replay emit. Backpressure stays trivial
+// because the entire snapshot is one WS frame.
+const sendReplaySnapshot = (ws, rec) => {
+    try {
+        ws.send(JSON.stringify(buildReplaySnapshotEnvelope(rec)));
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+// ---------------------------------------------------------------------------
+// buildWsHandlers — entry point for the WS body.
+// ---------------------------------------------------------------------------
+/**
+ * Build the Hono WS handler object (`onOpen`, `onMessage`, `onClose`,
+ * `onError`) for the embedded-terminal WS upgrade.
+ *
+ * Precondition: `ctx` is a `ValidatedWsUpgradeContext` — all
+ * reject-the-upgrade validations passed in `routes.ts`. Failures
+ * raised inside the returned handlers degrade to WS disconnects, NOT
+ * HTTP upgrade rejections (see type doc).
+ *
+ * Dispatches between two branches:
+ *   - **replay-only** (`task.state === "done" || task.state === "launch_failed"`):
+ *     no pty is spawned. The WS sends a `ready` envelope, emits the
+ *     stored cell-state snapshot if available, then closes cleanly.
+ *   - **live** (anything else): the WS owns a live shell. The full
+ *     ADR-068-A1 / ADR-087 / ADR-092 lifecycle applies.
+ */
+export function buildWsHandlers(ctx) {
+    const isReplayOnly = ctx.task.state === "done" || ctx.task.state === "launch_failed";
+    if (isReplayOnly) {
+        return buildReplayOnlyHandlers(ctx);
+    }
+    return buildLiveHandlers(ctx);
+}
+// ---------------------------------------------------------------------------
+// Replay-only branch (done / launch_failed tasks).
+// ---------------------------------------------------------------------------
+function buildReplayOnlyHandlers(ctx) {
+    const { taskId, trustedCwd, scrollbackStore, retentionDays, scrollbackDirHint } = ctx;
+    return {
+        onOpen(_evt, ws) {
+            void (async () => {
+                let scrollbackBytes = 0;
+                if (scrollbackStore && !scrollbackStore.disabled) {
+                    try {
+                        scrollbackBytes = await scrollbackStore.bytes(taskId);
+                    }
+                    catch { /* fall through with 0 */ }
+                }
+                try {
+                    ws.send(JSON.stringify({
+                        type: "ready",
+                        role: "reader",
+                        shellKind: null,
+                        cwd: trustedCwd,
+                        replayOnly: true,
+                        // ADR-104 — replay-only tasks (done / launch_failed)
+                        // never carry a reset banner: no pty is spawned and
+                        // Resume is not applicable in a terminal state.
+                        terminalReset: false,
+                        // fix-resume-guard-survives-reload — replay-only
+                        // tasks spawn no pty; there is nothing to reuse.
+                        ptyReused: false,
+                        scrollbackBytes,
+                        retentionDays,
+                        scrollbackDir: scrollbackDirHint,
+                    }));
+                }
+                catch { /* ignore */ }
+                // Iterate C (ADR-087) — snapshot is the sole replay path.
+                // When `tryReadSnapshot` returns null (missing snapshot,
+                // version mismatch, or headlessMirrorEnabled=false), the
+                // client receives no replay history — by design, per the
+                // plan-of-record trade-off. The legacy chunked-replay
+                // emission has been retired.
+                const snap = await tryReadSnapshot(ctx.snapshotStore, taskId, ctx.expectedTerminalVersion);
+                if (snap) {
+                    sendReplaySnapshot(ws, snap);
+                }
+                // Close cleanly — no live shell to keep open.
+                try {
+                    ws.close?.(1000);
+                }
+                catch { /* ignore */ }
+            })();
+        },
+        // No onMessage / onClose / onError needed — there is no
+        // pty to detach from. The runtime tolerates omitted handlers.
+    };
+}
+// ---------------------------------------------------------------------------
+// Live branch (pty-backed tasks).
+// ---------------------------------------------------------------------------
+function buildLiveHandlers(ctx) {
+    const { taskId, task, trustedCwd, store, scrollbackStore, retentionDays, scrollbackDirHint } = ctx;
+    // ADR-104 — capture pty-existence on the synchronous line
+    // IMMEDIATELY before spawn(). Race-free: there is no `await`
+    // between this probe and spawn(), and Node is single-threaded,
+    // so no concurrent WS attach can create the pty in between.
+    const ptyExistedBeforeAttach = ctx.ptyManager.get(taskId) !== undefined;
+    // D02/F02 — with NO live pty, resolve the disk snapshot BEFORE spawn()
+    // (its fresh empty mirror would else shadow it). Live pty → resolve in the
+    // IIFE (ADR-092 live-first / Guard 2a; spawn idempotent keeps the mirror).
+    const preSpawnReplay = ptyExistedBeforeAttach ? null : resolveReplaySnapshot(ctx);
+    // Ensure-or-create the pty against the realpath-validated cwd.
+    // ptyManager.spawn(): `shell` is a whitelisted binary NAME (ADR-067 allowlist +
+    // loopback Origin gate), not child_process({shell:true}). Semgrep false positive.
+    // nosemgrep: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
+    const meta = ctx.ptyManager.spawn(taskId, {
+        cwd: trustedCwd,
+        shell: ctx.resolveShell(),
+    });
+    // ADR-104 — true when this attach freshly re-created the pty
+    // after a prior Claude session was lost (server restart / crash).
+    const terminalReset = deriveTerminalReset(ptyExistedBeforeAttach, task.firstJsonlObservedAt);
+    // Per-connection identity is the WSContext (re-used in attach/detach).
+    // We build it inline to keep references stable across handlers.
+    const connToken = { taskId, t: Date.now() };
+    /*
+     * Replay gate. While a snapshot write is in flight, live pty output is BUFFERED
+     * instead of sent, then flushed once the snapshot has been emitted.
+     *
+     * Hoisted to the handler scope (it was local to `onOpen`) so the mid-session
+     * `resync` path reuses this EXACT sequence rather than a second, subtly different
+     * one. That matters: output produced while the snapshot serializes would
+     * otherwise be sent BEFORE the snapshot and then wiped by the client's
+     * `term.reset()` — the repair would itself lose the bytes it exists to restore.
+     */
+    const liveBuffer = [];
+    let replayDone = false;
+    /*
+     * True while SOME snapshot-emit sequence owns the gate. Initialised `true`
+     * because the attach replay is guaranteed to run and can only start after
+     * `onOpen` — a `resync` arriving in between would otherwise find the gate free
+     * and interleave with it.
+     *
+     * `resyncGate` alone is not enough: it serializes resync against resync, not
+     * against the ATTACH replay, and both share `liveBuffer`/`replayDone`. Whichever
+     * finished first would set `replayDone = true`, so live output would stream
+     * straight to the client while the other's snapshot was still resolving — and
+     * the client's `term.reset()` would then erase it. That is precisely the
+     * ordering invariant this iterate exists to protect (external review, HIGH).
+     *
+     * A resync that arrives during the attach replay is DROPPED rather than queued,
+     * and that is correct rather than merely convenient: the attach is already
+     * emitting a full grid, which is exactly what the resync would have asked for.
+     * If a drop lands after that snapshot was serialized, the episode-END notice
+     * arrives once the gate is free and the client asks again.
+     */
+    let replayBusy = true;
+    const sendData = (ws, data) => {
+        try {
+            ws.send(JSON.stringify({ type: "data", payload: data }));
+        }
+        catch { /* socket may be mid-close */ }
+    };
+    const flushLiveBuffer = (ws) => {
+        for (const data of liveBuffer)
+            sendData(ws, data);
+        liveBuffer.length = 0;
+    };
+    const resyncGate = createResyncGate();
+    /**
+     * Serve a client-requested full-grid resync. Mirrors the attach sequence
+     * deliberately — hold the gate, pause this conn, resolve live-mirror-first
+     * (ADR-092), emit ONE `replay_snapshot`, flush buffered output, resume — because
+     * that ordering is exactly what stops the repair from dropping bytes. Throttled
+     * by `resyncGate`; a denied request is dropped, and the episode-END backpressure
+     * notice guarantees the client gets another chance after the last drop.
+     */
+    const performResync = async (ws) => {
+        // Never interleave with the attach replay (or another resync) — see replayBusy.
+        if (replayBusy)
+            return;
+        if (!resyncGate.tryAcquire())
+            return;
+        replayBusy = true;
+        replayDone = false;
+        try {
+            ctx.ptyManager.pauseForConn(taskId, connToken);
+            const snap = await resolveReplaySnapshot(ctx);
+            if (snap)
+                sendReplaySnapshot(ws, snap);
+        }
+        catch (err) {
+            // eslint-disable-next-line no-console
+            console.warn(`[terminal] resync failed for ${taskId}: ${err.message}`);
+        }
+        finally {
+            flushLiveBuffer(ws);
+            replayDone = true;
+            replayBusy = false;
+            ctx.ptyManager.resumeForConn(taskId, connToken);
+            resyncGate.release();
+        }
+    };
+    return {
+        onOpen(_evt, ws) {
+            startWsHeartbeat(ws); // reap a dead socket → free a pinned writer slot (read-only false-blocker, iterate-2026-05-31)
+            // `hadPriorWriter` = atomic snapshot in attach() (iterate
+            // 2026-05-27-fix-pty-reused-prewarm-race); feeds ready.ptyReused
+            // so the guard arms only on real reload/multi-tab, not prewarm.
+            // `ptyExistedBeforeAttach` still drives ADR-104 terminalReset.
+            const { role, hadPriorWriter } = ctx.ptyManager.attach(taskId, connToken);
+            // Iterate v0.8.5 AC-4 — new-plain (`/api/external/launch`
+            // with actionId === "new-plain") tasks never write a JSONL
+            // until the user types their first message inside Claude
+            // (per known_issues.md "Awaiting-launch state — expected
+            // latency band"). The transcript-poll-driven state machine
+            // can therefore never flip these tasks out of
+            // `awaiting_external_start`, even though Claude is plainly
+            // reachable in the embedded terminal — confusing UX.
+            //
+            // Pty-up is the operator's mental model of "active" for
+            // new-plain. When the WS upgrade succeeds and the task is
+            // in `awaiting_external_start` AND was launched as
+            // new-plain, flip it to `active` immediately. The
+            // transcript-poll path remains authoritative for all other
+            // actionIds (slash-command launches; resume; fork) — they
+            // write JSONL at first prompt and the existing
+            // !firstJsonlObservedAt branch handles them.
+            if (task.state === "awaiting_external_start" &&
+                task.actionId === "new-plain") {
+                store.patch(taskId, { state: "active" });
+                // Don't set firstJsonlObservedAt — pty-up is not the
+                // same evidence as JSONL-on-disk; the existing
+                // transcript-poll transition will set the timestamp
+                // correctly when the user actually types something.
+                void store.persist();
+            }
+            // ADR-068-A1 replay flow (post-ADR-087 / Iterate C):
+            //   1. Subscribe with a liveBuffer so we don't miss live output
+            //      while the snapshot read + send happens.
+            //   2. Pause pty (avoids OOM on slow xterm-render under
+            //      backgrounded-tab conditions — Decision #15).
+            //   3. Send `ready` envelope.
+            //   4. Emit a single `replay_snapshot` envelope when a usable
+            //      snapshot exists; otherwise emit no replay history
+            //      (blank terminal with live shell — the chunked
+            //      replay_start/chunk/separator/end fallback was retired).
+            //   5. Flush liveBuffer + flip replayDone.
+            //   6. Resume pty.
+            // The replay gate (liveBuffer / replayDone / flushLiveBuffer) lives in the
+            // handler scope so `resync` reuses it — see its declaration above.
+            ctx.ptyManager.subscribeForConnection(taskId, connToken, {
+                onData: (data) => {
+                    if (replayDone)
+                        sendData(ws, data);
+                    else
+                        liveBuffer.push(data);
+                },
+                // Forward the WHOLE notice. Destructuring `droppedBytes` here silently
+                // stripped every cumulative field (`droppedChunks`, `totalDroppedBytes`,
+                // `episode`, `episodeEnded`) so AC-2's countability never crossed the
+                // boundary — the client's tolerant parsing then masked it as zeroes.
+                // Guard: `ws-backpressure-envelope.test.ts`.
+                onBackpressure: (info) => {
+                    try {
+                        ws.send(JSON.stringify({ type: "backpressure", ...info }));
+                    }
+                    catch { /* ignore */ }
+                },
+                // Fired when the previous writer detaches and we get
+                // promoted (closes the StrictMode double-mount race).
+                onPromoteToWriter: () => {
+                    try {
+                        ws.send(JSON.stringify({ type: "writer-promoted" }));
+                    }
+                    catch { /* ignore */ }
+                },
+            });
+            // Iterate v0.8.2 AC-8/AC-9: ready envelope stays SYNC to
+            // preserve the auto-launch handshake timing (Spec 76
+            // regressed when ready was moved into the async IIFE).
+            // scrollbackBytes is initialised to 0 here; the precise
+            // value is computed inside the IIFE and emitted via a
+            // follow-up `scrollback-meta` envelope so the disclosure
+            // footer can update once the bytes() probe resolves.
+            try {
+                ws.send(JSON.stringify({
+                    type: "ready",
+                    role,
+                    shellKind: meta.shellKind,
+                    cwd: meta.cwd,
+                    replayOnly: false,
+                    // ADR-104 — drives the EmbeddedTerminal reset banner.
+                    terminalReset,
+                    // `true` iff a writer attached BEFORE this WS upgrade
+                    // (iterate-2026-05-27-fix-pty-reused-prewarm-race —
+                    // refined from `ptyExistedBeforeAttach`; prewarm-only
+                    // ptys now correctly emit `false`).
+                    ptyReused: hadPriorWriter,
+                    scrollbackBytes: 0,
+                    retentionDays,
+                    scrollbackDir: scrollbackDirHint,
+                }));
+                // External code-review F8: also emit an explicit
+                // `second-attach` envelope so reader-role consumers can
+                // surface a UX banner before the first input attempt.
+                if (role === "reader") {
+                    ws.send(JSON.stringify({ type: "second-attach" }));
+                }
+            }
+            catch { /* ignore */ }
+            // Iterate C (ADR-087) — snapshot is the sole replay path.
+            // ADR-086's "skip replay for new-plain" branch is gone:
+            // cell-state snapshots have no byte-stream corruption, and
+            // there is no chunked path to skip. ADR-068-A1's per-conn
+            // pause stake (pauseForConn / resumeForConn) is preserved
+            // so multi-tab attach still serializes the replay write
+            // cleanly with live pty output.
+            void (async () => {
+                try {
+                    ctx.ptyManager.pauseForConn(taskId, connToken);
+                    let scrollbackBytes = 0;
+                    if (scrollbackStore && !scrollbackStore.disabled) {
+                        try {
+                            scrollbackBytes = await scrollbackStore.bytes(taskId);
+                        }
+                        catch { /* fall through with 0 */ }
+                    }
+                    // Privacy disclosure footer still receives the byte
+                    // count — even though no chunked replay is emitted,
+                    // the on-disk file may exist and the user has a
+                    // "Clear history" button surfaced from this number.
+                    try {
+                        ws.send(JSON.stringify({
+                            type: "scrollback-meta",
+                            scrollbackBytes,
+                        }));
+                    }
+                    catch { /* ignore */ }
+                    // ADR-092 live-first / disk-fallback (resolveReplaySnapshot).
+                    // D02/F02 — a no-live-pty attach was already resolved BEFORE spawn
+                    // (preSpawnReplay) so the fresh empty mirror cannot shadow the disk
+                    // snapshot; a live pty resolves here exactly as before.
+                    const snap = await (preSpawnReplay ?? resolveReplaySnapshot(ctx));
+                    if (snap) {
+                        sendReplaySnapshot(ws, snap);
+                    }
+                    flushLiveBuffer(ws);
+                    replayDone = true;
+                }
+                catch (err) {
+                    // eslint-disable-next-line no-console
+                    console.warn(`[terminal] replay failed for ${taskId}: ${err.message}`);
+                    flushLiveBuffer(ws);
+                    replayDone = true;
+                }
+                finally {
+                    // Release the shared replay gate only now — a `resync` that arrived
+                    // mid-attach must not have interleaved with this sequence.
+                    replayBusy = false;
+                    ctx.ptyManager.resumeForConn(taskId, connToken);
+                }
+            })();
+        },
+        onMessage(evt, ws) {
+            const raw = typeof evt.data === "string" ? evt.data : "";
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                return;
+            }
+            // App-level liveness ping (iterate-2026-06-18). Answered BEFORE the
+            // role gate so READERS stay alive too. The client uses the pong to
+            // detect a silently half/full-open socket (OS sleep / Tailscale
+            // partition) that never fires a `close` event, then reconnects.
+            // Distinct from the server's own protocol-level ping/pong heartbeat
+            // (ws-heartbeat.ts) — that frees the server slot; this wakes the client.
+            if (parsed &&
+                typeof parsed === "object" &&
+                parsed.type === "ping") {
+                try {
+                    ws.send(JSON.stringify({ type: "pong" }));
+                }
+                catch {
+                    /* ignore */
+                }
+                return;
+            }
+            // Answered BEFORE the writer gate, like `ping`: it never WRITES to the pty, and
+            // gating it on the writer slot would leave every READER permanently smeared by a
+            // drop. It does briefly PAUSE the shared pty while serializing — hence the throttle.
+            if (parsed &&
+                typeof parsed === "object" &&
+                parsed.type === "resync") {
+                void performResync(ws);
+                return;
+            }
+            if (!isWSInbound(parsed))
+                return;
+            // External code-review F6: use the non-mutating getRole()
+            // here so re-evaluating the writer gate on every inbound
+            // message can NOT silently flip the original writer to
+            // reader. attach() is idempotent for same-conn since the
+            // F6 fix, but getRole() is the cheaper + safer entrypoint.
+            const actualRole = ctx.ptyManager.getRole(taskId, connToken);
+            if (actualRole !== "writer") {
+                try {
+                    ws.send(JSON.stringify({ type: "read_only" }));
+                }
+                catch { /* ignore */ }
+                return;
+            }
+            if (parsed.type === "data") {
+                ctx.ptyManager.write(taskId, parsed.payload);
+            }
+            else if (parsed.type === "redraw") {
+                // Writer-gated by the role check above — a reader must never poke the
+                // pty. See WSMessageRedraw for why this cannot be a no-op `resize`.
+                ctx.ptyManager.forceRedraw(taskId);
+            }
+            else if (parsed.type === "resize") {
+                ctx.ptyManager.resize(taskId, parsed.cols, parsed.rows);
+            }
+        },
+        onClose() {
+            // ADR-092 (Iterate E) — snapshot-on-detach resilience.
+            // `detachAndCount` performs the detach + post-state read
+            // as a single atomic observation (external code review
+            // OpenAI HIGH #1 — split-step "check count → detach →
+            // check count" was vulnerable to a concurrent attach
+            // landing between the two reads). Only when the
+            // post-detach count is 0 do we flush the mirror to disk
+            // so a future re-attach (or server restart) finds a
+            // usable snapshot via `tryReadSnapshot`. The pty stays
+            // alive; only persistence fires here. Fire-and-forget
+            // — never block the WS close handshake.
+            const { remainingAttachCount } = ctx.ptyManager.detachAndCount(taskId, connToken);
+            if (remainingAttachCount === 0) {
+                // flushMirrorSnapshot wraps its async body in try/catch
+                // internally — no rejection escapes (per Gemini LOW #3
+                // / OpenAI MED #4: ensures no unhandled rejection noise
+                // from this fire-and-forget call). SnapshotStore.write
+                // is per-task PQueue-serialized (snapshot-store.ts —
+                // Iterate B MEDIUM-1) so overlapping calls cannot
+                // corrupt the file.
+                void ctx.ptyManager.flushMirrorSnapshot(taskId);
+            }
+        },
+        onError() {
+            const { remainingAttachCount } = ctx.ptyManager.detachAndCount(taskId, connToken);
+            if (remainingAttachCount === 0) {
+                void ctx.ptyManager.flushMirrorSnapshot(taskId);
+            }
+        },
+    };
+}
+//# sourceMappingURL=ws-upgrade-handler.js.map

package/server/dist/terminal/ws-upgrade-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-handler.js","sourceRoot":"","sources":["../../src/terminal/ws-upgrade-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAWH,OAAO,EACL,2BAA2B,EAC3B,eAAe,IAAI,qBAAqB,GACzC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8CpD,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AA4CD,8EAA8E;AAC9E,uEAAuE;AACvE,sEAAsE;AACtE,6DAA6D;AAC7D,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CACtB,aAAwC,EACxC,MAAc,EACd,uBAA2C,EACX,EAAE,CAClC,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAExE,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,KAAK,EACjC,GAA8B,EACE,EAAE;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,eAAe,CACpB,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,uBAAuB,CAC5B,CAAC;AACJ,CAAC,CAAC;AAEF,oEAAoE;AACpE,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG,CACzB,EAA6B,EAC7B,GAAmB,EACV,EAAE;IACX,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA8B;IAE9B,MAAM,YAAY,GAChB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe,CAAC;IAElE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,SAAS,uBAAuB,CAC9B,GAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC;IACtF,OAAO;QACL,MAAM,CAAC,IAAI,EAAE,EAAE;YACb,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,eAAe,GAAG,CAAC,CAAC;gBACxB,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;oBACjD,IAAI,CAAC;wBACH,eAAe,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACxD,CAAC;oBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBACvC,CAAC;gBACD,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,QAAQ;wBACd,SAAS,EAAE,IAAI;wBACf,GAAG,EAAE,UAAU;wBACf,UAAU,EAAE,IAAI;wBAChB,qDAAqD;wBACrD,oDAAoD;wBACpD,gDAAgD;wBAChD,aAAa,EAAE,KAAK;wBACpB,iDAAiD;wBACjD,iDAAiD;wBACjD,SAAS,EAAE,KAAK;wBAChB,eAAe;wBACf,aAAa;wBACb,aAAa,EAAE,iBAAiB;qBACjC,CAAC,CACH,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACxB,0DAA0D;gBAC1D,yDAAyD;gBACzD,yDAAyD;gBACzD,yDAAyD;gBACzD,sDAAsD;gBACtD,6BAA6B;gBAC7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,CAAC,aAAa,EACjB,MAAM,EACN,GAAG,CAAC,uBAAuB,CAC5B,CAAC;gBACF,IAAI,IAAI,EAAE,CAAC;oBACT,kBAAkB,CAChB,EAAyD,EACzD,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,8CAA8C;gBAC9C,IAAI,CAAC;oBACF,EAAqD,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,wDAAwD;QACxD,8DAA8D;KAC/D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,GAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC;IAEnG,0DAA0D;IAC1D,6DAA6D;IAC7D,+DAA+D;IAC/D,4DAA4D;IAC5D,MAAM,sBAAsB,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,cAAc,GAClB,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7D,+DAA+D;IAC/D,gFAAgF;IAChF,kFAAkF;IAClF,8EAA8E;IAC9E,MAAM,IAAI,GAAkB,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;QACvD,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE;KAC1B,CAAC,CAAC;IACH,6DAA6D;IAC7D,kEAAkE;IAClE,MAAM,aAAa,GAAG,mBAAmB,CACvC,sBAAsB,EACtB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;IAEF,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAW,CAAC;IAErD;;;;;;;;;OASG;IACH,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,CAAC,EAA6B,EAAE,IAAY,EAAQ,EAAE;QACrE,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,EAA6B,EAAQ,EAAE;QAC9D,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IAEtC;;;;;;;OAOG;IACH,MAAM,aAAa,GAAG,KAAK,EAAE,EAA6B,EAAiB,EAAE;QAC3E,gFAAgF;QAChF,IAAI,UAAU;YAAE,OAAO;QACvB,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YAAE,OAAO;QACrC,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,IAAI;gBAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,gCAAgC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CACpE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,EAAE,CAAC,CAAC;YACpB,UAAU,GAAG,IAAI,CAAC;YAClB,UAAU,GAAG,KAAK,CAAC;YACnB,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,IAAI,EAAE,EAAE;YACb,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,+FAA+F;YACrH,0DAA0D;YAC1D,iEAAiE;YACjE,gEAAgE;YAChE,+DAA+D;YAC/D,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE1E,0DAA0D;YAC1D,2DAA2D;YAC3D,yDAAyD;YACzD,yDAAyD;YACzD,2DAA2D;YAC3D,8CAA8C;YAC9C,2DAA2D;YAC3D,qDAAqD;YACrD,EAAE;YACF,wDAAwD;YACxD,0DAA0D;YAC1D,mDAAmD;YACnD,kDAAkD;YAClD,2DAA2D;YAC3D,0DAA0D;YAC1D,+CAA+C;YAC/C,6CAA6C;YAC7C,IACE,IAAI,CAAC,KAAK,KAAK,yBAAyB;gBACxC,IAAI,CAAC,QAAQ,KAAK,WAAW,EAC7B,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzC,qDAAqD;gBACrD,+CAA+C;gBAC/C,oDAAoD;gBACpD,oDAAoD;gBACpD,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAED,qDAAqD;YACrD,gEAAgE;YAChE,+CAA+C;YAC/C,wDAAwD;YACxD,oDAAoD;YACpD,8BAA8B;YAC9B,8DAA8D;YAC9D,yDAAyD;YACzD,qDAAqD;YACrD,+DAA+D;YAC/D,2CAA2C;YAC3C,mBAAmB;YACnB,2EAA2E;YAC3E,mEAAmE;YACnE,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE;gBACvD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;oBACf,IAAI,UAAU;wBAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;wBAC9B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;gBACD,uEAAuE;gBACvE,yEAAyE;gBACzE,sEAAsE;gBACtE,qEAAqE;gBACrE,6CAA6C;gBAC7C,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;oBACvB,IAAI,CAAC;wBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC7D,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC1B,CAAC;gBACD,qDAAqD;gBACrD,sDAAsD;gBACtD,iBAAiB,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC;wBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;oBACvD,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC1B,CAAC;aACF,CAAC,CAAC;YAEH,yDAAyD;YACzD,qDAAqD;YACrD,uDAAuD;YACvD,wDAAwD;YACxD,sDAAsD;YACtD,yDAAyD;YACzD,qDAAqD;YACrD,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,OAAO;oBACb,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,UAAU,EAAE,KAAK;oBACjB,sDAAsD;oBACtD,aAAa;oBACb,sDAAsD;oBACtD,oDAAoD;oBACpD,sDAAsD;oBACtD,oCAAoC;oBACpC,SAAS,EAAE,cAAc;oBACzB,eAAe,EAAE,CAAC;oBAClB,aAAa;oBACb,aAAa,EAAE,iBAAiB;iBACjC,CAAC,CACH,CAAC;gBACF,iDAAiD;gBACjD,wDAAwD;gBACxD,sDAAsD;gBACtD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAExB,0DAA0D;YAC1D,wDAAwD;YACxD,2DAA2D;YAC3D,0DAA0D;YAC1D,0DAA0D;YAC1D,wDAAwD;YACxD,gCAAgC;YAChC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC/C,IAAI,eAAe,GAAG,CAAC,CAAC;oBACxB,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;wBACjD,IAAI,CAAC;4BACH,eAAe,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACxD,CAAC;wBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;oBACvC,CAAC;oBACD,oDAAoD;oBACpD,oDAAoD;oBACpD,gDAAgD;oBAChD,oDAAoD;oBACpD,IAAI,CAAC;wBACH,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,IAAI,EAAE,iBAAiB;4BACvB,eAAe;yBAChB,CAAC,CACH,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;oBACxB,8DAA8D;oBAC9D,mEAAmE;oBACnE,oEAAoE;oBACpE,wDAAwD;oBACxD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClE,IAAI,IAAI,EAAE,CAAC;wBACT,kBAAkB,CAChB,EAAyD,EACzD,IAAI,CACL,CAAC;oBACJ,CAAC;oBACD,eAAe,CAAC,EAAE,CAAC,CAAC;oBACpB,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,sCAAsC;oBACtC,OAAO,CAAC,IAAI,CACV,gCAAgC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CACpE,CAAC;oBACF,eAAe,CAAC,EAAE,CAAC,CAAC;oBACpB,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;wBAAS,CAAC;oBACT,oEAAoE;oBACpE,2DAA2D;oBAC3D,UAAU,GAAG,KAAK,CAAC;oBACnB,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,gEAAgE;YAChE,oEAAoE;YACpE,yEAAyE;YACzE,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBACzB,MAA6B,CAAC,IAAI,KAAK,MAAM,EAC9C,CAAC;gBACD,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,OAAO;YACT,CAAC;YACD,gFAAgF;YAChF,iFAAiF;YACjF,qFAAqF;YACrF,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBACzB,MAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;gBACD,KAAK,aAAa,CAAC,EAAE,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO;YACjC,0DAA0D;YAC1D,yDAAyD;YACzD,uDAAuD;YACvD,yDAAyD;YACzD,2DAA2D;YAC3D,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,sEAAsE;gBACtE,oEAAoE;gBACpE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO;YACL,uDAAuD;YACvD,yDAAyD;YACzD,uDAAuD;YACvD,sDAAsD;YACtD,qDAAqD;YACrD,gDAAgD;YAChD,wDAAwD;YACxD,oDAAoD;YACpD,uDAAuD;YACvD,sDAAsD;YACtD,wCAAwC;YACxC,MAAM,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,cAAc,CAC5D,MAAM,EACN,SAAS,CACV,CAAC;YACF,IAAI,oBAAoB,KAAK,CAAC,EAAE,CAAC;gBAC/B,wDAAwD;gBACxD,uDAAuD;gBACvD,wDAAwD;gBACxD,uDAAuD;gBACvD,qDAAqD;gBACrD,kDAAkD;gBAClD,oBAAoB;gBACpB,KAAK,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,cAAc,CAC5D,MAAM,EACN,SAAS,CACV,CAAC;YACF,IAAI,oBAAoB,KAAK,CAAC,EAAE,CAAC;gBAC/B,KAAK,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/server/dist/types/action-schema.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Allowlist regex for `cli_flag` and `cli_flag_map` values. Validated at
+ * load time in `validateActionsSchema`. The `@` form is reserved for the
+ * positional `@<file>` shipwright-build argument (value_separator: "none").
+ *
+ * Matches: --foo, --foo-bar, -x, @
+ * Rejects: --foo=bar, "; rm -rf /", flags with whitespace, empty string.
+ */
+export declare const CLI_FLAG_PATTERN: RegExp;
+/**
+ * Allowlist regex for ParamSchema.name (used as object key in POST body).
+ */
+export declare const PARAM_NAME_PATTERN: RegExp;
+export type ParamType = "boolean" | "enum" | "string";
+export type ValueSeparator = "space" | "equals" | "none";
+export interface ParamSchema {
+    /** Internal key — kebab-case, matches PARAM_NAME_PATTERN. Eindeutig pro Schema-Block. */
+    name: string;
+    /** UI label shown in the modal. */
+    label: string;
+    /** Param type controls UI render and resolution rules. */
+    type: ParamType;
+    /**
+     * Single CLI flag emitted when the value is truthy. Mutually exclusive
+     * with `cli_flag_map`. Must match CLI_FLAG_PATTERN.
+     */
+    cli_flag?: string;
+    /**
+     * Per-enum-value flag map. Used when different enum values map to
+     * different flags (e.g. deploy.target: prod -> "--prod"). Map values
+     * must match CLI_FLAG_PATTERN; missing keys mean "skip emission" for
+     * that enum value (no empty strings allowed).
+     */
+    cli_flag_map?: Record<string, string>;
+    /** Allowed enum values (required when type === "enum"). */
+    enum?: string[];
+    /**
+     * Default value. Server applies this during resolution when the POST
+     * body is missing the key OR sends an empty/whitespace value.
+     * Validated against type/pattern/enum at load time.
+     */
+    default?: string | boolean;
+    /** UI placeholder for string inputs. */
+    placeholder?: string;
+    /** Optional helper text rendered under the field. */
+    helpText?: string;
+    /** How the value is joined to the flag. Default: "space". */
+    value_separator?: ValueSeparator;
+    /**
+     * Regex string used to validate string values. Compiled defensively
+     * with try/catch in the loader; malformed patterns reject at load time.
+     */
+    pattern?: string;
+    /**
+     * When true: client disables Copy until the value is set; server
+     * returns 400 if missing/empty.
+     */
+    required?: boolean;
+    /**
+     * Sensitive value (token/password). UI renders password input; preview
+     * shows fixed-length mask; server logs redact the value.
+     */
+    sensitive?: boolean;
+}
+export interface ResolvedParam {
+    /** Guaranteed non-empty after resolution. Comes from cli_flag or cli_flag_map[value]. */
+    cli_flag: string;
+    /** Present for string/enum values; absent for boolean flags. */
+    value?: string;
+    /** How to join cli_flag and value when rendering. */
+    separator: ValueSeparator;
+    /** Marker forwarded to logging layers; substituter ignores. */
+    sensitive?: boolean;
+}
+//# sourceMappingURL=action-schema.d.ts.map

package/server/dist/types/action-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-schema.d.ts","sourceRoot":"","sources":["../../src/types/action-schema.ts"],"names":[],"mappings":"AAmBA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAA6B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAEtD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,SAAS,EAAE,cAAc,CAAC;IAC1B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/server/dist/types/action-schema.js

@@ -0,0 +1,32 @@
+/*
+ * Action parameter schema (canonical definition).
+ *
+ * iterate/launch-cli-parameters § 1 — Schema-Modul Layout.
+ *
+ * Server is the canonical source for ParamSchema/ResolvedParam. The
+ * client maintains a structural-subset RenderableParamSchema in
+ * client/src/types/action-schema.ts; a sync test prevents drift
+ * (client/src/test/action-schema-sync.test.ts).
+ *
+ * Cross-bundle imports (server -> client) are intentionally avoided:
+ * webui has no monorepo root + no path aliasing between workspaces.
+ *
+ * Security boundary:
+ *   The cli_flag allowlist regex is the actual injection guard for
+ *   user-overridable .shipwright-webui/actions.json. Per-shell escaping in
+ *   actions-substitute.ts is the second layer for user-supplied VALUES.
+ */
+/**
+ * Allowlist regex for `cli_flag` and `cli_flag_map` values. Validated at
+ * load time in `validateActionsSchema`. The `@` form is reserved for the
+ * positional `@<file>` shipwright-build argument (value_separator: "none").
+ *
+ * Matches: --foo, --foo-bar, -x, @
+ * Rejects: --foo=bar, "; rm -rf /", flags with whitespace, empty string.
+ */
+export const CLI_FLAG_PATTERN = /^(--?[a-z][a-z0-9-]*|@)$/;
+/**
+ * Allowlist regex for ParamSchema.name (used as object key in POST body).
+ */
+export const PARAM_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+//# sourceMappingURL=action-schema.js.map

package/server/dist/types/action-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-schema.js","sourceRoot":"","sources":["../../src/types/action-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC"}