@theford/runly 0.0.0-stage → 0.20.0

package/dist/drivers/preview.js

@@ -0,0 +1,605 @@
+/**
+ * Lease-scoped public preview publishers (decision 0027).
+ *
+ * Distinct from the substrate driver's `expose()` — that wires internal service
+ * URLs for remote substrates. Preview is an explicit, opt-in verb that publishes
+ * one service port to the internet for human inspection.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { appendFileSync, mkdirSync, existsSync, writeFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { BrokerError, now } from '../core/util.js';
+import { killGroupVerified } from '../daemon/supervisor.js';
+import { serviceTag, startTime } from '../core/procscan.js';
+import { stateRoot } from '../core/paths.js';
+import { tunnelBlock } from '../core/ports.js';
+const URL_RE = /https:\/\/[^\s]+trycloudflare\.com/;
+/** How long to wait for a quick tunnel to publish its URL before giving up. */
+const startTimeoutMs = () => {
+    const raw = Number(process.env.BACKLOT_PREVIEW_START_TIMEOUT_MS);
+    return Number.isFinite(raw) && raw > 0 ? raw : 45_000;
+};
+function cloudflaredBin() {
+    const override = process.env.BACKLOT_CLOUDFLARED?.trim();
+    if (override)
+        return override;
+    try {
+        return execFileSync('which', ['cloudflared'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return 'cloudflared';
+    }
+}
+function cloudflaredAvailable(bin) {
+    if (bin.includes('/') || bin.includes('\\'))
+        return existsSync(bin);
+    try {
+        execFileSync('which', [bin], { stdio: ['ignore', 'ignore', 'ignore'] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Kill a tunnel process this adapter spawned but is about to stop tracking.
+ *
+ * `spawnedStart` is the identity recorded at spawn, never re-read here: reading
+ * it now would hand `killGroupVerified` the start time of whatever holds that
+ * pid at this instant, so its pid-reuse guard could never disagree and a
+ * recycled pid would take our SIGTERM/SIGKILL. An already-exited child is the
+ * very case where the pid is free for reuse, so it returns before signalling.
+ *
+ * Returns the pid when it could NOT be confirmed dead. That is the one outcome
+ * worth saying out loud: no pid was ever returned, so no lease row records it
+ * and `pool gc` has nothing to reclaim it by — the caller must put it in the
+ * error it is about to throw, or a live public URL leaves no trace at all.
+ */
+async function abandon(proc, spawnedStart) {
+    const pid = proc.pid;
+    if (pid === undefined || proc.exitCode !== null)
+        return undefined;
+    try {
+        return (await killGroupVerified(pid, spawnedStart)) ? undefined : pid;
+    }
+    catch {
+        return pid;
+    }
+}
+/** Append the surviving pid to an error's detail, so the operator can find it. */
+function withSurvivor(err, pid) {
+    if (pid === undefined || !(err instanceof BrokerError))
+        return err;
+    const warning = `the preview process (pid ${pid}) could NOT be confirmed dead and was never recorded anywhere —` +
+        ` it may still be serving the preview URL; kill it by hand`;
+    return new BrokerError(err.klass, err.message, err.source, `${err.logExcerpt ? `${err.logExcerpt}\n` : ''}${warning}`);
+}
+class CloudflareQuickPublisher {
+    name = 'cloudflare-quick';
+    checkPrerequisite() {
+        const bin = cloudflaredBin();
+        if (!cloudflaredAvailable(bin)) {
+            throw new BrokerError('env-error', `preview requires cloudflared (Cloudflare quick tunnel) — install it and ensure it is on PATH, or set BACKLOT_CLOUDFLARED to its path`, 'preview');
+        }
+    }
+    async start(opts) {
+        this.checkPrerequisite();
+        const bin = cloudflaredBin();
+        mkdirSync(opts.logDir, { recursive: true });
+        const logPath = join(opts.logDir, `preview-${opts.service}.log`);
+        const tagName = `preview:${opts.service}`;
+        const proc = spawn(bin, ['tunnel', '--url', opts.localUrl], {
+            env: { ...process.env, ...serviceTag(opts.envId, tagName, stateRoot()) },
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: true,
+        });
+        const spawnedStart = proc.pid === undefined ? undefined : startTime(proc.pid);
+        let buf = '';
+        const sink = (d) => {
+            const s = d.toString();
+            buf = (buf + s).slice(-16_000);
+            try {
+                appendFileSync(logPath, s);
+            }
+            catch {
+                /* log dir gone */
+            }
+        };
+        proc.stdout?.on('data', sink);
+        proc.stderr?.on('data', sink);
+        let url;
+        try {
+            url = await new Promise((resolve, reject) => {
+                const deadline = now() + startTimeoutMs();
+                const poll = () => {
+                    const m = URL_RE.exec(buf);
+                    if (m)
+                        return resolve(m[0]);
+                    if (proc.exitCode !== null) {
+                        return reject(new BrokerError('env-error', `cloudflared exited before publishing a URL (exit ${proc.exitCode})`, 'preview', buf.slice(-2000)));
+                    }
+                    if (now() > deadline) {
+                        return reject(new BrokerError('env-error', 'timed out waiting for cloudflared to publish a preview URL', 'preview', buf.slice(-2000)));
+                    }
+                    setTimeout(poll, 100).unref();
+                };
+                proc.on('error', (err) => reject(new BrokerError('env-error', `failed to start cloudflared: ${err.message}`, 'preview')));
+                poll();
+            });
+        }
+        catch (err) {
+            // Giving up on the WAIT is not giving up on the PROCESS. A tunnel that
+            // was merely slow publishes its URL a second after the timeout, and with
+            // no pid returned there is no lease record, no `pool gc` entry and no
+            // `preview stop` that could ever name it — a public, unauthenticated URL
+            // serving until the host reboots.
+            throw withSurvivor(err, await abandon(proc, spawnedStart));
+        }
+        const pid = proc.pid;
+        if (!pid) {
+            throw withSurvivor(new BrokerError('env-error', 'cloudflared started without a pid', 'preview'), await abandon(proc, spawnedStart));
+        }
+        return { url, pid: { pid, startTime: spawnedStart } };
+    }
+    async stop(rec) {
+        return killGroupVerified(rec.pid, rec.startTime);
+    }
+}
+/**
+ * cloudflared prints this once a connection to the edge stands. A named tunnel
+ * has no URL to announce — we already know the hostname — so readiness is the
+ * only thing worth waiting for. Waiting for nothing and returning immediately
+ * would hand back a URL that 502s for the next few seconds, which reads as a
+ * broken service rather than a tunnel still dialling.
+ */
+const NAMED_READY_RE = /Registered tunnel connection/;
+/** Where `cloudflared tunnel login` left the certificate that authorises the zone. */
+function originCert() {
+    const override = process.env.TUNNEL_ORIGIN_CERT?.trim();
+    return override || join(homedir(), '.cloudflared', 'cert.pem');
+}
+/** Every dotted name in a line of cloudflared output, normalised for comparison. */
+function hostnamesIn(text) {
+    return (text.match(/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+\.?/gi) ?? []).map((h) => h.toLowerCase().replace(/\.$/, ''));
+}
+/**
+ * `route dns` reports success for a hostname that is NOT the one we asked for.
+ *
+ * An origin certificate authorises exactly one zone. Ask cloudflared to route a
+ * name outside it and it does not refuse — it treats the name as a label
+ * *inside* the certificate's zone, creates
+ * `backoffice-bcd.baustelle.dev.some-other.com`, prints `Added CNAME …` and
+ * exits 0. runly then hands back `https://backoffice-bcd.baustelle.dev`: an
+ * address that resolves nowhere, reported as a working preview.
+ *
+ * That happened on the first real setup, and it was caught by someone happening
+ * to run `dig` — which is not a control. The output names the record it really
+ * made, so compare it and refuse.
+ *
+ * Silence is not consent: cloudflared has printed several shapes of this line
+ * over the years ("Added CNAME x", "x is already configured to route to your
+ * tunnel"). If NO hostname can be found in the output at all, this passes rather
+ * than fails — refusing on an unrecognised-but-successful message would break
+ * publishing for a cloudflared whose wording we have not seen. The failure this
+ * guards is the one where a DIFFERENT name is stated plainly.
+ */
+function assertRouted(output, wanted) {
+    const seen = hostnamesIn(output);
+    if (seen.length === 0 || seen.includes(wanted))
+        return;
+    const swallowed = seen.find((h) => h.startsWith(`${wanted}.`));
+    const zone = swallowed?.slice(wanted.length + 1);
+    throw new BrokerError('env-error', zone
+        ? `cloudflared routed '${swallowed}' instead of '${wanted}' — the origin certificate authorises '${zone}', not the zone you asked for. Move ~/.cloudflared/cert.pem aside and run 'cloudflared tunnel login' for that zone.`
+        : `cloudflared reported routing '${seen.join(', ')}' when '${wanted}' was requested`, 'preview', output.slice(-2000));
+}
+/**
+ * One DNS label, from something a human wrote in a manifest.
+ *
+ * A hostname that Cloudflare rejects surfaces three steps later as a DNS error
+ * during `route dns`, long after the tunnel exists — so the bad character is
+ * caught here, where the name is still just a string.
+ */
+function label(raw) {
+    const cleaned = raw
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    if (!cleaned)
+        throw new BrokerError('work-error', `'${raw}' has no character a DNS label may contain`, 'preview');
+    return cleaned.slice(0, 63).replace(/-+$/g, '');
+}
+/**
+ * Run cloudflared and keep BOTH streams.
+ *
+ * `execFileSync` hands back stdout alone, and cloudflared says the thing that
+ * matters — which record it actually created — on **stderr**. A caller that
+ * only sees stdout gets an empty string and concludes nothing is wrong, which
+ * is precisely the failure `assertRouted` exists to catch. Machine-readable
+ * output (`--output json`) stays on stdout, so the two are kept apart rather
+ * than concatenated.
+ */
+function cf(bin, args, what) {
+    const res = spawnSync(bin, args, { encoding: 'utf8' });
+    if (res.error) {
+        throw new BrokerError('env-error', `${what} failed: ${res.error.message}`, 'preview');
+    }
+    if (res.status !== 0) {
+        throw new BrokerError('env-error', `${what} failed`, 'preview', String(res.stderr ?? '').slice(-2000));
+    }
+    return { out: String(res.stdout ?? ''), err: String(res.stderr ?? '') };
+}
+/**
+ * The tunnel's id, creating it on first use.
+ *
+ * Reused rather than recreated: the tunnel and its DNS record are what make the
+ * hostname stable across leases, which is the whole point of naming one. A
+ * tunnel per publish would churn objects in the operator's Cloudflare account
+ * every few minutes and leave the reaping of them as a second lifecycle to get
+ * right.
+ */
+function ensureTunnel(bin, name) {
+    const find = () => {
+        const raw = cf(bin, ['tunnel', 'list', '--output', 'json'], 'listing Cloudflare tunnels').out;
+        const rows = JSON.parse(raw || '[]');
+        if (!Array.isArray(rows))
+            return undefined;
+        const hit = rows.find((r) => r && typeof r === 'object' && r.name === name);
+        return hit ? String(hit.id ?? '') || undefined : undefined;
+    };
+    const existing = find();
+    if (existing)
+        return existing;
+    cf(bin, ['tunnel', 'create', name], `creating the Cloudflare tunnel '${name}'`);
+    const created = find();
+    if (!created) {
+        throw new BrokerError('env-error', `created the Cloudflare tunnel '${name}' but it is not in the tunnel list`, 'preview');
+    }
+    return created;
+}
+class CloudflareNamedPublisher {
+    name = 'cloudflare-named';
+    checkPrerequisite() {
+        const bin = cloudflaredBin();
+        if (!cloudflaredAvailable(bin)) {
+            throw new BrokerError('env-error', `preview requires cloudflared — install it and ensure it is on PATH, or set BACKLOT_CLOUDFLARED to its path`, 'preview');
+        }
+        const cert = originCert();
+        if (!existsSync(cert)) {
+            throw new BrokerError('env-error', `the '${this.name}' publisher needs a Cloudflare origin certificate at ${cert} — run 'cloudflared tunnel login' once, or point TUNNEL_ORIGIN_CERT at it`, 'preview');
+        }
+    }
+    async start(opts) {
+        this.checkPrerequisite();
+        const domain = opts.settings?.domain?.trim();
+        if (!domain) {
+            // work-error, not env-error: the machine is fine, the manifest is short a
+            // line. An env-error would send the operator hunting for a broken install.
+            throw new BrokerError('work-error', `the '${this.name}' publisher needs 'preview.domain' in the manifest (the zone to publish under, e.g. example.dev)`, 'preview');
+        }
+        // Unset prefix means the environment id, which is unique by construction —
+        // see PreviewSpec.prefix for why the manifest is the wrong place to make a
+        // pooled stack's hostnames distinct.
+        const prefix = label(opts.settings?.prefix?.trim() || opts.envId);
+        const hostname = `${label(`${opts.service}-${prefix}`)}.${domain}`;
+        const tunnelName = `backlot-${label(`${prefix}-${opts.service}`)}`;
+        const bin = cloudflaredBin();
+        const uuid = ensureTunnel(bin, tunnelName);
+        // `--overwrite-dns` because the record outlives the lease on purpose: the
+        // second publish of the same hostname must land on the same tunnel rather
+        // than fail on the record it left behind last time.
+        // cloudflared writes this line to stderr, so `cf` must hand both streams
+        // back or the check below would see an empty string and wave everything
+        // through — the exact failure it exists to catch.
+        const routed = cf(bin, ['tunnel', 'route', 'dns', '--overwrite-dns', tunnelName, hostname], `routing ${hostname} to '${tunnelName}'`);
+        assertRouted(`${routed.out}\n${routed.err}`, hostname);
+        mkdirSync(opts.logDir, { recursive: true });
+        const logPath = join(opts.logDir, `preview-${opts.service}.log`);
+        const cfgPath = join(opts.logDir, `preview-${opts.service}.tunnel.yml`);
+        // A catch-all is mandatory — cloudflared refuses to start without one.
+        writeFileSync(cfgPath, [
+            `tunnel: ${uuid}`,
+            `credentials-file: ${join(homedir(), '.cloudflared', `${uuid}.json`)}`,
+            'ingress:',
+            `  - hostname: ${hostname}`,
+            `    service: ${opts.localUrl}`,
+            '  - service: http_status:404',
+            '',
+        ].join('\n'));
+        const tagName = `preview:${opts.service}`;
+        const proc = spawn(bin, ['tunnel', '--config', cfgPath, 'run', tunnelName], {
+            env: { ...process.env, ...serviceTag(opts.envId, tagName, stateRoot()) },
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: true,
+        });
+        const spawnedStart = proc.pid === undefined ? undefined : startTime(proc.pid);
+        let buf = '';
+        const sink = (d) => {
+            const s = d.toString();
+            buf = (buf + s).slice(-16_000);
+            try {
+                appendFileSync(logPath, s);
+            }
+            catch {
+                /* log dir gone */
+            }
+        };
+        proc.stdout?.on('data', sink);
+        proc.stderr?.on('data', sink);
+        try {
+            await new Promise((resolve, reject) => {
+                const deadline = now() + startTimeoutMs();
+                const poll = () => {
+                    if (NAMED_READY_RE.test(buf))
+                        return resolve();
+                    if (proc.exitCode !== null) {
+                        return reject(new BrokerError('env-error', `cloudflared exited before the tunnel connected (exit ${proc.exitCode})`, 'preview', buf.slice(-2000)));
+                    }
+                    if (now() > deadline) {
+                        return reject(new BrokerError('env-error', `timed out waiting for the tunnel to '${hostname}' to connect`, 'preview', buf.slice(-2000)));
+                    }
+                    setTimeout(poll, 100).unref();
+                };
+                proc.on('error', (err) => reject(new BrokerError('env-error', `failed to start cloudflared: ${err.message}`, 'preview')));
+                poll();
+            });
+        }
+        catch (err) {
+            // Same reasoning as the quick publisher: giving up on the WAIT is not
+            // giving up on the PROCESS. A tunnel that merely connected slowly serves
+            // the hostname a second after the timeout, and with no pid returned there
+            // is nothing that could ever name it.
+            throw withSurvivor(err, await abandon(proc, spawnedStart));
+        }
+        const pid = proc.pid;
+        if (!pid) {
+            throw withSurvivor(new BrokerError('env-error', 'cloudflared started without a pid', 'preview'), await abandon(proc, spawnedStart));
+        }
+        return { url: `https://${hostname}`, pid: { pid, startTime: spawnedStart } };
+    }
+    /**
+     * Only the process goes. The tunnel and its DNS record stay, and that is the
+     * feature: the next publish of this service reaches the same address, which
+     * is the reason to name one at all. Until then the hostname answers with
+     * Cloudflare's "tunnel not running" page — a visible, correct answer, not a
+     * pointer at someone else's service.
+     */
+    async stop(rec) {
+        return killGroupVerified(rec.pid, rec.startTime);
+    }
+}
+/**
+ * `tailscale serve` prints this once the tailnet listener stands. Foreground
+ * serve has no other readiness signal, and the mapping it announces is live the
+ * moment the line is out.
+ */
+const TS_READY_RE = /Available within your tailnet|Available on the internet/;
+/**
+ * Auto-derived tailnet ports land in the TUNNEL block (decision 0033,
+ * 32000–32767 by default) unless `preview.https_port` or `--https-port` pins
+ * one. Until 0.14 they were 21000–21999, inside what is now the public block.
+ */
+function tailscaleBin() {
+    const override = process.env.BACKLOT_TAILSCALE?.trim();
+    if (override)
+        return override;
+    try {
+        return execFileSync('which', ['tailscale'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return 'tailscale';
+    }
+}
+function ts(bin, args, what) {
+    try {
+        return execFileSync(bin, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000 });
+    }
+    catch (err) {
+        const detail = err && typeof err === 'object' && 'stderr' in err ? String(err.stderr ?? '') : '';
+        throw new BrokerError('env-error', `${what} failed`, 'preview', detail.slice(-2000));
+    }
+}
+function tsJson(bin, args, what) {
+    const raw = ts(bin, args, what);
+    try {
+        const parsed = JSON.parse(raw || '{}');
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        throw new BrokerError('env-error', `${what} returned something that is not JSON`, 'preview', raw.slice(-2000));
+    }
+}
+/**
+ * Every HTTPS port this machine already serves on its tailnet name — the
+ * persistent (`--bg`) config and every live foreground session alike. A port
+ * taken by anyone, runly or a human with `tailscale serve`, is not ours to
+ * take over: tailscale would refuse the listener anyway, but only after the
+ * process had started, which reads as a broken tool rather than a busy port.
+ */
+export function tailnetPortsInUse(serveStatus) {
+    const used = new Set();
+    const addTcp = (cfg) => {
+        const tcp = cfg && typeof cfg === 'object' ? cfg.TCP : undefined;
+        if (!tcp || typeof tcp !== 'object')
+            return;
+        for (const k of Object.keys(tcp)) {
+            const n = Number(k);
+            if (Number.isInteger(n) && n > 0)
+                used.add(n);
+        }
+    };
+    addTcp(serveStatus);
+    const fg = serveStatus.Foreground;
+    if (fg && typeof fg === 'object')
+        for (const session of Object.values(fg))
+            addTcp(session);
+    return used;
+}
+/**
+ * The tailnet port for an environment's service when the manifest pins none.
+ *
+ * Derived, not allocated: the same environment and service land on the same
+ * port every time, so a re-publish after a rebind — or after `preview stop` —
+ * hands the reviewer the address they already have, which is what makes a
+ * tailnet name worth having. Ports are stable for an environment's lifetime
+ * (decision 0004), and so is this. A collision walks forward to the next free
+ * port inside the span; a full span is an env-error, not a silent reuse.
+ */
+export function deriveTailnetPort(envId, service, inUse) {
+    const { lo, hi } = tunnelBlock();
+    const span = hi - lo + 1;
+    const h = createHash('sha256').update(`${envId}\0${service}`).digest().readUInt32BE(0);
+    const start = h % span;
+    for (let i = 0; i < span; i++) {
+        const port = lo + ((start + i) % span);
+        if (!inUse.has(port))
+            return port;
+    }
+    throw new BrokerError('env-error', `every tailnet port in ${lo}-${hi} is already served on this machine — free some ('tailscale serve status') or pin preview.https_port`, 'preview');
+}
+/**
+ * Publishes on this machine's tailnet name through `tailscale serve`, in the
+ * FOREGROUND (decision 0031).
+ *
+ * Foreground is the whole design. A foreground serve config is a session of
+ * the `tailscale serve` process: tailscaled drops it the moment that process
+ * exits, however it exits — SIGTERM and SIGKILL alike (measured on tailscale
+ * 1.102). So the mapping lives exactly as long as a supervised, tagged child of
+ * the lease, and every reap path 0027 built for a tunnel process reaps the URL
+ * with it. `--bg` would write a persistent config that survives the process,
+ * the lease and a daemon crash, with nothing in the journal able to name it.
+ *
+ * It runs as the daemon's user, never through sudo. sudo with `use_pty` puts
+ * the command in its own process group, out of reach of the group kill, and
+ * `env_reset` strips the runly tags `pool gc` finds orphans by — a SIGKILLed
+ * sudo then leaves a live `tailscale serve` that nothing will ever reap. The
+ * operator therefore has to be allowed to drive serve: `tailscale set
+ * --operator=<user>`, once per machine.
+ */
+class TailscalePublisher {
+    name = 'tailscale';
+    checkPrerequisite() {
+        const bin = tailscaleBin();
+        if (!cloudflaredAvailable(bin)) {
+            throw new BrokerError('env-error', `the '${this.name}' preview publisher requires the tailscale CLI — install it and ensure it is on PATH, or set BACKLOT_TAILSCALE to its path`, 'preview');
+        }
+        this.self(bin);
+        const user = userInfo();
+        if (user.uid !== 0) {
+            const prefs = tsJson(bin, ['debug', 'prefs'], 'reading tailscale prefs');
+            const operator = typeof prefs.OperatorUser === 'string' ? prefs.OperatorUser : '';
+            if (operator !== user.username) {
+                throw new BrokerError('env-error', `the '${this.name}' publisher runs 'tailscale serve' as '${user.username}', which is not this machine's tailscale operator` +
+                    `${operator ? ` ('${operator}' is)` : ''} — run 'sudo tailscale set --operator=${user.username}' once. ` +
+                    `sudo per publish is not an option: it moves serve out of the process group and environment runly reaps by.`, 'preview');
+            }
+        }
+    }
+    /** This machine's tailnet name, refusing a tailscaled that could not serve HTTPS on it. */
+    self(bin) {
+        const status = tsJson(bin, ['status', '--json'], 'reading tailscale status');
+        const backend = typeof status.BackendState === 'string' ? status.BackendState : '';
+        if (backend !== 'Running') {
+            throw new BrokerError('env-error', `tailscale is not connected on this machine (state '${backend || 'unknown'}') — run 'tailscale up'`, 'preview');
+        }
+        const certDomains = Array.isArray(status.CertDomains) ? status.CertDomains.filter((d) => typeof d === 'string') : [];
+        const selfDns = status.Self?.DNSName;
+        const dns = typeof selfDns === 'string' ? selfDns.replace(/\.$/, '') : '';
+        if (!dns || certDomains.length === 0) {
+            throw new BrokerError('env-error', `this tailnet cannot issue HTTPS certificates for '${dns || 'this machine'}' — enable MagicDNS and HTTPS Certificates in the tailscale admin console (DNS page)`, 'preview');
+        }
+        return certDomains.includes(dns) ? dns : certDomains[0];
+    }
+    async start(opts) {
+        this.checkPrerequisite();
+        const bin = tailscaleBin();
+        const host = this.self(bin);
+        const inUse = tailnetPortsInUse(tsJson(bin, ['serve', 'status', '--json'], 'reading tailscale serve status'));
+        const pinned = opts.settings?.https_port;
+        if (pinned !== undefined && inUse.has(pinned)) {
+            // work-error, not env-error: nothing on this machine is broken — the
+            // manifest pinned a port another publication (or a human) already holds,
+            // and taking it over would silently repoint someone else's address.
+            throw new BrokerError('work-error', `tailnet port ${pinned} (preview.https_port) is already served on this machine — 'tailscale serve status' shows by what; unpin it to get a derived port, or free it`, 'preview');
+        }
+        const port = pinned ?? deriveTailnetPort(opts.envId, opts.service, inUse);
+        const url = `https://${host}${port === 443 ? '' : `:${port}`}`;
+        mkdirSync(opts.logDir, { recursive: true });
+        const logPath = join(opts.logDir, `preview-${opts.service}.log`);
+        const tagName = `preview:${opts.service}`;
+        const proc = spawn(bin, ['serve', `--https=${port}`, opts.localUrl], {
+            env: { ...process.env, ...serviceTag(opts.envId, tagName, stateRoot()) },
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: true,
+        });
+        const spawnedStart = proc.pid === undefined ? undefined : startTime(proc.pid);
+        let buf = '';
+        const sink = (d) => {
+            const s = d.toString();
+            buf = (buf + s).slice(-16_000);
+            try {
+                appendFileSync(logPath, s);
+            }
+            catch {
+                /* log dir gone */
+            }
+        };
+        proc.stdout?.on('data', sink);
+        proc.stderr?.on('data', sink);
+        try {
+            await new Promise((resolve, reject) => {
+                const deadline = now() + startTimeoutMs();
+                const poll = () => {
+                    if (TS_READY_RE.test(buf))
+                        return resolve();
+                    if (proc.exitCode !== null) {
+                        const denied = /access denied|permission denied/i.test(buf);
+                        return reject(new BrokerError('env-error', denied
+                            ? `tailscale refused to change the serve config for '${userInfo().username}' — run 'sudo tailscale set --operator=${userInfo().username}' once`
+                            : `tailscale serve exited before the tailnet listener stood (exit ${proc.exitCode})`, 'preview', buf.slice(-2000)));
+                    }
+                    if (now() > deadline) {
+                        return reject(new BrokerError('env-error', `timed out waiting for tailscale to serve ${url}`, 'preview', buf.slice(-2000)));
+                    }
+                    setTimeout(poll, 100).unref();
+                };
+                proc.on('error', (err) => reject(new BrokerError('env-error', `failed to start tailscale serve: ${err.message}`, 'preview')));
+                poll();
+            });
+        }
+        catch (err) {
+            // As for the tunnels: a serve that was merely slow stands a second after
+            // the timeout, and with no pid returned nothing could ever name it.
+            throw withSurvivor(err, await abandon(proc, spawnedStart));
+        }
+        const pid = proc.pid;
+        if (!pid) {
+            throw withSurvivor(new BrokerError('env-error', 'tailscale serve started without a pid', 'preview'), await abandon(proc, spawnedStart));
+        }
+        // A derived port depends on what else is served right now; a restart
+        // must ask for this one, not derive again.
+        return { url, pid: { pid, startTime: spawnedStart }, pinned: { https_port: port } };
+    }
+    /** The foreground session dies with the process, and the tailnet mapping with it. */
+    async stop(rec) {
+        return killGroupVerified(rec.pid, rec.startTime);
+    }
+}
+const publishers = {
+    'cloudflare-quick': new CloudflareQuickPublisher(),
+    'cloudflare-named': new CloudflareNamedPublisher(),
+    tailscale: new TailscalePublisher(),
+};
+export function resolvePreviewPublisher(name) {
+    const pub = publishers[name];
+    if (!pub) {
+        throw new BrokerError('work-error', `unknown preview publisher '${name}' (known: ${Object.keys(publishers).join(', ')})`, 'preview');
+    }
+    return pub;
+}
+/** Default publisher when the manifest and config do not name one. */
+export const DEFAULT_PREVIEW_PUBLISHER = 'cloudflare-quick';
+//# sourceMappingURL=preview.js.map

package/dist/drivers/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../src/drivers/preview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA8C/C,MAAM,MAAM,GAAG,oCAAoC,CAAC;AACpD,+EAA+E;AAC/E,MAAM,cAAc,GAAG,GAAW,EAAE;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC,CAAC;AAEF,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,OAAO,CAAC,IAAkB,EAAE,YAAgC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAY,EAAE,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;QAAE,OAAO,GAAG,CAAC;IACnE,MAAM,OAAO,GACX,4BAA4B,GAAG,iEAAiE;QAChG,2DAA2D,CAAC;IAC9D,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACzH,CAAC;AAED,MAAM,wBAAwB;IACnB,IAAI,GAAG,kBAAkB,CAAC;IAEnC,iBAAiB;QACf,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,sIAAsI,EACtI,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAA0E;QACpF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1D,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YACxE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvB,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAClD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,CAAC;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC3B,OAAO,MAAM,CACX,IAAI,WAAW,CAAC,WAAW,EAAE,oDAAoD,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAChI,CAAC;oBACJ,CAAC;oBACD,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBACrB,OAAO,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,4DAA4D,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACzI,CAAC;oBACD,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACvB,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,gCAAgC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAC/F,CAAC;gBACF,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,kCAAkC;YAClC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,YAAY,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,mCAAmC,EAAE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACtI,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD,sFAAsF;AACtF,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kDAAkD,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtF,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,MAAc;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,IAAI;QACF,CAAC,CAAC,uBAAuB,SAAS,iBAAiB,MAAM,0CAA0C,IAAI,qHAAqH;QAC5N,CAAC,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,MAAM,iBAAiB,EACtF,SAAS,EACT,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,OAAO,GAAG,GAAG;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,IAAI,GAAG,4CAA4C,EAAE,SAAS,CAAC,CAAC;IAClH,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,GAAG,IAAI,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,MAAM,IAAI,GAAG,GAAuB,EAAE;QACpC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC,GAAG,CAAC;QAC9F,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACpG,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAwB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAC;IACxB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,kCAAkC,IAAI,oCAAoC,EAAE,SAAS,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,wBAAwB;IACnB,IAAI,GAAG,kBAAkB,CAAC;IAEnC,iBAAiB;QACf,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,4GAA4G,EAC5G,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,QAAQ,IAAI,CAAC,IAAI,wDAAwD,IAAI,2EAA2E,EACxJ,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAMX;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0EAA0E;YAC1E,2EAA2E;YAC3E,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,QAAQ,IAAI,CAAC,IAAI,kGAAkG,EACnH,SAAS,CACV,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAEnE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,0EAA0E;QAC1E,oDAAoD;QACpD,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,WAAW,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC;QACtI,YAAY,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEvD,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,aAAa,CAAC,CAAC;QACxE,uEAAuE;QACvE,aAAa,CACX,OAAO,EACP;YACE,WAAW,IAAI,EAAE;YACjB,qBAAqB,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE;YACtE,UAAU;YACV,iBAAiB,QAAQ,EAAE;YAC3B,gBAAgB,IAAI,CAAC,QAAQ,EAAE;YAC/B,8BAA8B;YAC9B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QAEF,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE;YAC1E,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YACxE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvB,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC3B,OAAO,MAAM,CACX,IAAI,WAAW,CAAC,WAAW,EAAE,wDAAwD,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CACpI,CAAC;oBACJ,CAAC;oBACD,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBACrB,OAAO,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,wCAAwC,QAAQ,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3I,CAAC;oBACD,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,gCAAgC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC1H,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,YAAY,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,mCAAmC,EAAE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACtI,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,WAAW,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAGD;;;;GAIG;AACH,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAE9E;;;;GAIG;AAEH,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,IAAY;IACnD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAA4B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAChD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,GAAG,IAAI,sCAAsC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAoC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,WAAW,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC;IAClC,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,OAAe,EAAE,KAAkB;IAClF,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,yBAAyB,EAAE,IAAI,EAAE,qGAAqG,EACtI,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,kBAAkB;IACb,IAAI,GAAG,WAAW,CAAC;IAE5B,iBAAiB;QACf,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,QAAQ,IAAI,CAAC,IAAI,4HAA4H,EAC7I,SAAS,CACV,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,QAAQ,IAAI,CAAC,IAAI,0CAA0C,IAAI,CAAC,QAAQ,mDAAmD;oBACzH,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,yCAAyC,IAAI,CAAC,QAAQ,UAAU;oBACxG,4GAA4G,EAC9G,SAAS,CACV,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2FAA2F;IACnF,IAAI,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,sDAAsD,OAAO,IAAI,SAAS,yBAAyB,EACnG,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,MAAM,OAAO,GAAI,MAAM,CAAC,IAA0C,EAAE,OAAO,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,WAAW,CACnB,WAAW,EACX,qDAAqD,GAAG,IAAI,cAAc,sFAAsF,EAChK,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAY,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAMX;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,qEAAqE;YACrE,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,gBAAgB,MAAM,8IAA8I,EACpK,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,WAAW,IAAI,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAE/D,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACnE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YACxE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvB,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,GAAG,EAAE;oBAChB,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,OAAO,EAAE,CAAC;oBAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC3B,MAAM,MAAM,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC5D,OAAO,MAAM,CACX,IAAI,WAAW,CACb,WAAW,EACX,MAAM;4BACJ,CAAC,CAAC,qDAAqD,QAAQ,EAAE,CAAC,QAAQ,0CAA0C,QAAQ,EAAE,CAAC,QAAQ,QAAQ;4BAC/I,CAAC,CAAC,kEAAkE,IAAI,CAAC,QAAQ,GAAG,EACtF,SAAS,EACT,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CACjB,CACF,CAAC;oBACJ,CAAC;oBACD,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBACrB,OAAO,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,4CAA4C,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9H,CAAC;oBACD,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,oCAAoC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC9H,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,YAAY,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,uCAAuC,EAAE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1I,CAAC;QACD,qEAAqE;QACrE,2CAA2C;QAC3C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,UAAU,GAAqC;IACnD,kBAAkB,EAAE,IAAI,wBAAwB,EAAE;IAClD,kBAAkB,EAAE,IAAI,wBAAwB,EAAE;IAClD,SAAS,EAAE,IAAI,kBAAkB,EAAE;CACpC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,8BAA8B,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC"}