@tinyviber/a2h 0.1.0

package/dist/server/server.js

@@ -0,0 +1,510 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAssetsDir = findAssetsDir;
+exports.createA2hServer = createA2hServer;
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const node_path_1 = require("node:path");
+const boundary_1 = require("../security/boundary");
+const safeRead_1 = require("../util/safeRead");
+// ---------------------------------------------------------------------------
+// The local server.
+//
+// Security posture (this is a local-first tool, so the threat model is "the
+// workspace content is untrusted, and so is every other page the human has
+// open in a browser"):
+//
+//   * The server binds to 127.0.0.1 by default.
+//   * Repository content is never executed. Markdown HTML is escaped, code is
+//     sent as text, and raw file serving is restricted to *inline-safe image
+//     types only* — so a `.html` or `.js` file in the workspace can never be
+//     served as an executable same-origin document.
+//   * Sensitive files and symlinks are never served as bytes.
+//   * Actions can only reference ids declared in the workspace manifest, and
+//     go through the ActionEngine's confirmation boundary.
+//
+// The last point is the one that grows teeth later. Today the executor is a
+// mock, so the worst a forged request achieves is a simulated run in someone
+// else's tab. The moment a real provider is registered behind `/api/action`,
+// this endpoint *is* a local control API, and the browser is the delivery
+// mechanism. So the mutation guard is built now, while it is still cheap:
+//
+//   * Host must name this machine. A hostile page can point a name it controls
+//     at 127.0.0.1 (DNS rebinding) and the browser will happily treat us as
+//     same-origin; requiring the Host header to be local breaks that.
+//   * Content-Type must be application/json, which forces a cross-origin
+//     caller into a preflight we never answer.
+//   * A session token, minted per process and handed out only to the page we
+//     serve, must be presented. A cross-origin page cannot read it.
+//
+// Any one of the three is bypassable in isolation; together they are not.
+// ---------------------------------------------------------------------------
+/** Hostnames a request to this server may legitimately carry. */
+const LOCAL_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1']);
+/** A bind address that means "listen everywhere" — the host check is skipped. */
+const WILDCARD_HOSTS = new Set(['0.0.0.0', '::', '']);
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.bmp': 'image/bmp',
+    '.ico': 'image/x-icon',
+    '.avif': 'image/avif',
+    '.tif': 'image/tiff',
+    '.tiff': 'image/tiff',
+    '.woff2': 'font/woff2',
+    '.map': 'application/json; charset=utf-8',
+};
+/**
+ * Types that may be served from a workspace path. Images are safe to inline:
+ * none of them can execute script in the document context. SVG is allowed but
+ * always carries a restrictive CSP. Everything else (html, js, css, svg-as-doc,
+ * json, and all binaries) is refused.
+ */
+const INLINE_SAFE_EXTS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.webp', '.bmp', '.ico', '.avif', '.tif', '.tiff', '.svg',
+]);
+const ASSET_EXTS = new Set(['.html', '.css', '.js', '.mjs', '.svg', '.png', '.json', '.map', '.woff2']);
+// Restrictive CSP: no external scripts/images/connections, no inline script.
+const PAGE_CSP = "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; " +
+    "script-src 'self'; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'";
+const SVG_CSP = "default-src 'none'; style-src 'unsafe-inline'";
+const MAX_ACTION_BODY_BYTES = 64 * 1024;
+/** How long the session token is, in bytes, before hex encoding. */
+const TOKEN_BYTES = 24;
+/** Methods that change something. Every one of them goes through the guard. */
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+function findAssetsDir() {
+    // Compiled layout: dist/server/server.js -> dist/renderer/assets
+    return (0, node_path_1.join)(__dirname, '..', 'renderer', 'assets');
+}
+function createA2hServer(options) {
+    const { workspace } = options;
+    const host = options.host ?? '127.0.0.1';
+    const assetsDir = (0, node_path_1.resolve)(options.assetsDir ?? findAssetsDir());
+    // Minted once per process. Not persisted: restarting the server invalidates
+    // every tab, which is the right trade for a token that only ever needs to
+    // outlive a browsing session.
+    const sessionToken = options.sessionToken ?? (0, node_crypto_1.randomBytes)(TOKEN_BYTES).toString('hex');
+    const hostCheckEnabled = !WILDCARD_HOSTS.has(host);
+    const shell = buildShell(assetsDir, sessionToken);
+    // SSE subscribers for watch mode and action results.
+    const subscribers = new Set();
+    function broadcast(event) {
+        for (const res of subscribers) {
+            try {
+                res.write(`data: ${event}\n\n`);
+            }
+            catch {
+                subscribers.delete(res);
+            }
+        }
+    }
+    const server = (0, node_http_1.createServer)((req, res) => {
+        void handle(req, res).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+            else
+                res.end();
+        });
+    });
+    async function handle(req, res) {
+        setBaseHeaders(res);
+        if (hostCheckEnabled && !isLocalHostname(req.headers.host, host)) {
+            sendJson(res, 403, { error: 'unexpected host' });
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        const pathname = url.pathname;
+        if (pathname.startsWith('/api/')) {
+            await handleApi(req, res, pathname, url);
+            return;
+        }
+        serveStatic(res, assetsDir, pathname, shell);
+    }
+    async function handleApi(req, res, pathname, url) {
+        const method = req.method ?? 'GET';
+        // One guard, applied to every mutating request that will ever exist here,
+        // rather than a check bolted onto `/api/action` that the next endpoint
+        // forgets to copy.
+        if (MUTATING_METHODS.has(method)) {
+            const refusal = guardMutation(req, hostCheckEnabled ? host : undefined);
+            if (refusal) {
+                sendJson(res, refusal.status, { error: refusal.error });
+                return;
+            }
+        }
+        // Canonical name for the view payload. `/api/ir` is kept as an alias: it
+        // was the original spelling, and the body is a presentation, not the IR.
+        if (method === 'GET' && (pathname === '/api/presentation' || pathname === '/api/ir')) {
+            sendJson(res, 200, workspace.presentation);
+            return;
+        }
+        if (method === 'GET' && pathname === '/api/artifact') {
+            const rel = url.searchParams.get('path') ?? '';
+            const mode = url.searchParams.get('mode') === 'full' ? 'full' : 'tail';
+            const payload = workspace.renderPayload(rel, mode);
+            if (!payload) {
+                sendJson(res, 404, { error: 'artifact not found' });
+                return;
+            }
+            sendJson(res, 200, payload);
+            return;
+        }
+        if (method === 'GET' && pathname === '/api/file') {
+            serveFile(res, workspace, url.searchParams.get('path') ?? '');
+            return;
+        }
+        if (pathname === '/api/action') {
+            await handleAction(req, res);
+            return;
+        }
+        // Same-origin only, and `no-store` — this is the one response that must
+        // never end up in a shared cache.
+        if (method === 'GET' && pathname === '/api/session') {
+            res.setHeader('Cache-Control', 'no-store');
+            sendJson(res, 200, { token: sessionToken });
+            return;
+        }
+        if (method === 'GET' && pathname === '/api/events') {
+            subscribeSse(req, res, subscribers);
+            return;
+        }
+        if (method === 'GET' && pathname === '/api/health') {
+            sendJson(res, 200, {
+                ok: true,
+                version: workspace.version,
+                semantics: workspace.presentation.semantics,
+                simulatedActions: workspace.presentation.simulatedActions,
+                providers: workspace.registry.executors.map((e) => e.id),
+                tasks: workspace.presentation.tasks.length,
+                artifacts: workspace.presentation.stats.artifacts,
+                secured: hostCheckEnabled,
+            });
+            return;
+        }
+        sendJson(res, 404, { error: 'unknown endpoint' });
+    }
+    /**
+     * The mutation guard. Returns a refusal, or undefined to proceed.
+     *
+     * The token comparison is constant-time; the length pre-check exists because
+     * `timingSafeEqual` throws on a length mismatch rather than returning false.
+     */
+    function guardMutation(req, bindingHost) {
+        if (bindingHost && !isLocalOrigin(req.headers.origin, bindingHost)) {
+            return { status: 403, error: 'cross-origin request refused' };
+        }
+        const contentType = String(req.headers['content-type'] ?? '').toLowerCase();
+        if (!contentType.startsWith('application/json')) {
+            return { status: 415, error: 'content-type must be application/json' };
+        }
+        const supplied = req.headers['x-a2h-token'];
+        if (typeof supplied !== 'string' || supplied.length !== sessionToken.length) {
+            return { status: 403, error: 'missing or invalid session token' };
+        }
+        if (!(0, node_crypto_1.timingSafeEqual)(Buffer.from(supplied), Buffer.from(sessionToken))) {
+            return { status: 403, error: 'missing or invalid session token' };
+        }
+        return undefined;
+    }
+    async function handleAction(req, res) {
+        if (req.method !== 'POST') {
+            res.setHeader('Allow', 'POST');
+            sendJson(res, 405, { error: 'method not allowed' });
+            return;
+        }
+        let body;
+        try {
+            body = await readBody(req, MAX_ACTION_BODY_BYTES);
+        }
+        catch (err) {
+            sendJson(res, 413, { error: err.message });
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body || '{}');
+        }
+        catch {
+            sendJson(res, 400, { error: 'body must be JSON' });
+            return;
+        }
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            sendJson(res, 400, { error: 'body must be a JSON object' });
+            return;
+        }
+        const record = parsed;
+        const id = typeof record.id === 'string' ? record.id : '';
+        if (!id) {
+            sendJson(res, 400, { error: 'missing action id' });
+            return;
+        }
+        const result = await workspace.engine.execute({
+            id,
+            params: typeof record.params === 'object' && record.params !== null && !Array.isArray(record.params)
+                ? record.params
+                : undefined,
+            confirm: record.confirm === true,
+        }, workspace.declaredActions());
+        if (result.ok) {
+            broadcast('action');
+            sendJson(res, 200, result);
+            return;
+        }
+        const status = result.error === 'unknown_action' ? 404
+            : result.error === 'confirmation_required' ? 409
+                : result.error === 'missing_params' ? 400
+                    : 400;
+        sendJson(res, status, result);
+    }
+    return { server, broadcast, host };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function setBaseHeaders(res) {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+}
+/**
+ * Extracts a hostname from either a `Host` header (`127.0.0.1:5173`) or an
+ * `Origin` header (`http://127.0.0.1:5173`). Brackets around an IPv6 literal
+ * are stripped so `[::1]` and `::1` compare equal.
+ */
+function hostnameOf(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = new URL(value.includes('://') ? value : `http://${value}`);
+        return parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Whether a `Host` header names this machine.
+ *
+ * A missing Host is allowed rather than refused: HTTP/1.0 clients and
+ * non-browser tooling do not send one, and the token — not this check — is
+ * what actually authorises a mutation.
+ */
+function isLocalHostname(hostHeader, bindingHost) {
+    const name = hostnameOf(hostHeader);
+    if (name === undefined)
+        return true;
+    return LOCAL_HOSTNAMES.has(name) || name === bindingHost.toLowerCase();
+}
+/**
+ * Whether an `Origin` header names this machine. A missing Origin means the
+ * request did not come from a browser page, so there is no cross-origin
+ * confusion to prevent; `"null"` (sandboxed iframes, some redirects) is not
+ * local and is refused.
+ */
+function isLocalOrigin(origin, bindingHost) {
+    if (origin === undefined || origin === '')
+        return true;
+    const name = hostnameOf(origin);
+    if (name === undefined)
+        return false;
+    return LOCAL_HOSTNAMES.has(name) || name === bindingHost.toLowerCase();
+}
+function sendJson(res, status, body) {
+    const json = JSON.stringify(body);
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Length', Buffer.byteLength(json));
+    res.end(json);
+}
+function readBody(req, maxBytes) {
+    return new Promise((resolvePromise, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                reject(new Error('request body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolvePromise(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', (err) => reject(err));
+    });
+}
+/**
+ * Serves raw bytes for a workspace file, subject to a strict allowlist. Only
+ * files the scanner knows about, that are not sensitive and not symlinks, and
+ * whose type cannot execute in the document context, are served.
+ */
+function serveFile(res, workspace, rel) {
+    if (!rel) {
+        sendJson(res, 400, { error: 'missing path' });
+        return;
+    }
+    // The scanner's view of the workspace is the allowlist.
+    const entry = workspace.getFile(rel);
+    if (!entry) {
+        sendJson(res, 404, { error: 'not found' });
+        return;
+    }
+    if (entry.sensitive) {
+        sendJson(res, 403, { error: 'sensitive file' });
+        return;
+    }
+    if (entry.isSymlink) {
+        sendJson(res, 403, { error: 'symlink not served' });
+        return;
+    }
+    const ext = (0, node_path_1.extname)(rel).toLowerCase();
+    if (!INLINE_SAFE_EXTS.has(ext)) {
+        sendJson(res, 403, { error: `type ${ext || '(none)'} is not served inline` });
+        return;
+    }
+    // Re-validate containment on the real path (defence in depth).
+    const real = (0, boundary_1.resolveRealPath)(workspace.rootDir, rel);
+    if (real === null) {
+        sendJson(res, 404, { error: 'not found' });
+        return;
+    }
+    // Opened the same way as every other read in A2H, then handed to the stream
+    // as a descriptor: the bytes come from the file we checked, not from
+    // whatever the path resolves to a moment later.
+    let fd;
+    try {
+        fd = (0, safeRead_1.openNoFollow)(real);
+    }
+    catch {
+        sendJson(res, 404, { error: 'not found' });
+        return;
+    }
+    let size;
+    try {
+        size = (0, node_fs_1.fstatSync)(fd).size;
+    }
+    catch {
+        (0, node_fs_1.closeSync)(fd);
+        sendJson(res, 404, { error: 'not found' });
+        return;
+    }
+    res.statusCode = 200;
+    res.setHeader('Content-Type', CONTENT_TYPES[ext] ?? 'application/octet-stream');
+    res.setHeader('Content-Length', size);
+    res.setHeader('Content-Disposition', 'inline');
+    if (ext === '.svg')
+        res.setHeader('Content-Security-Policy', SVG_CSP);
+    const stream = (0, node_fs_1.createReadStream)(real, { fd });
+    stream.on('error', () => {
+        if (!res.headersSent) {
+            res.statusCode = 500;
+            res.end();
+        }
+        else {
+            res.end();
+        }
+    });
+    stream.pipe(res);
+}
+function subscribeSse(req, res, subscribers) {
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache, no-transform');
+    res.setHeader('Connection', 'keep-alive');
+    res.write('retry: 1000\n\n');
+    subscribers.add(res);
+    req.on('close', () => subscribers.delete(res));
+}
+/**
+ * Static assets for the viewer itself. Only known asset extensions are served,
+ * and the resolved path must stay inside the assets directory, so a crafted
+ * URL cannot read anything else on disk.
+ *
+ * `shell` is index.html with the session token injected; it is served in place
+ * of the file on disk so the token never has to be written anywhere.
+ */
+function serveStatic(res, assetsDir, pathname, shell) {
+    let rel = pathname === '/' ? '/index.html' : pathname;
+    rel = rel.replace(/\/+/g, '/');
+    const ext = (0, node_path_1.extname)(rel).toLowerCase();
+    if (ASSET_EXTS.has(ext)) {
+        const candidate = (0, node_path_1.resolve)(assetsDir, `.${rel}`);
+        if ((0, boundary_1.isWithin)(assetsDir, candidate) && (0, node_fs_1.existsSync)(candidate)) {
+            let isFile = false;
+            try {
+                isFile = (0, node_fs_1.statSync)(candidate).isFile();
+            }
+            catch {
+                isFile = false;
+            }
+            if (isFile) {
+                if (rel === '/index.html' && shell) {
+                    sendShell(res, shell);
+                    return;
+                }
+                res.statusCode = 200;
+                res.setHeader('Content-Type', CONTENT_TYPES[ext] ?? 'application/octet-stream');
+                if (rel === '/index.html')
+                    res.setHeader('Content-Security-Policy', PAGE_CSP);
+                const stream = (0, node_fs_1.createReadStream)(candidate);
+                stream.on('error', () => res.end());
+                stream.pipe(res);
+                return;
+            }
+        }
+    }
+    // SPA fallback: unknown paths get the shell so client-side routes work.
+    if (shell) {
+        sendShell(res, shell);
+        return;
+    }
+    res.statusCode = 404;
+    res.end('a2h renderer assets missing — run the build first');
+}
+function sendShell(res, shell) {
+    res.statusCode = 200;
+    res.setHeader('Content-Type', CONTENT_TYPES['.html']);
+    res.setHeader('Content-Security-Policy', PAGE_CSP);
+    // The document carries a per-process token; caching it would hand a stale
+    // one to the next tab.
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Length', shell.length);
+    res.end(shell);
+}
+const TOKEN_META = /<meta\s+name="a2h-token"\s+content="[^"]*"\s*\/?>/i;
+/**
+ * index.html with this process's session token in it.
+ *
+ * The page needs the token to mutate anything, and the only source of truth
+ * for it is this process. Injecting at serve time keeps the token out of the
+ * build output, out of git, and out of any on-disk copy of the shell.
+ */
+function buildShell(assetsDir, token) {
+    const file = (0, node_path_1.join)(assetsDir, 'index.html');
+    if (!(0, node_fs_1.existsSync)(file))
+        return undefined;
+    try {
+        const html = (0, node_fs_1.readFileSync)(file, 'utf8');
+        const meta = `<meta name="a2h-token" content="${token}" />`;
+        const withToken = TOKEN_META.test(html)
+            ? html.replace(TOKEN_META, meta)
+            : html.replace(/<\/head>/i, `  ${meta}\n</head>`);
+        return Buffer.from(withToken, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/server/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":";;AAwGA,sCAGC;AAED,0CA2NC;AAxUD,qCAAqG;AACrG,6CAA2D;AAC3D,yCAAoF;AACpF,yCAAmD;AAEnD,mDAAiE;AACjE,+CAAgD;AAEhD,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,uBAAuB;AACvB,EAAE;AACF,gDAAgD;AAChD,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,oDAAoD;AACpD,8DAA8D;AAC9D,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,+CAA+C;AAC/C,6EAA6E;AAC7E,oEAAoE;AACpE,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnE,iFAAiF;AACjF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtD,MAAM,aAAa,GAA2B;IAC5C,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,yBAAyB;IACjC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAC3F,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExG,6EAA6E;AAC7E,MAAM,QAAQ,GACZ,8EAA8E;IAC9E,4FAA4F,CAAC;AAE/F,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAEhE,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,oEAAoE;AACpE,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAWrE,SAAgB,aAAa;IAC3B,iEAAiE;IACjE,OAAO,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,eAAe,CAAC,OAAsB;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,SAAS,IAAI,aAAa,EAAE,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,0EAA0E;IAC1E,8BAA8B;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAA,yBAAW,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAElD,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,SAAS,SAAS,CAAC,KAAa;QAC9B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;;gBACjE,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,cAAc,CAAC,GAAG,CAAC,CAAC;QAEpB,IAAI,gBAAgB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,GAAQ;QAER,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,0EAA0E;QAC1E,uEAAuE;QACvE,mBAAmB;QACnB,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;YACrF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjD,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,kCAAkC;QAClC,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,SAAS;gBAC3C,gBAAgB,EAAE,SAAS,CAAC,YAAY,CAAC,gBAAgB;gBACzD,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM;gBAC1C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS;gBACjD,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,SAAS,aAAa,CACpB,GAAoB,EACpB,WAA+B;QAE/B,IAAI,WAAW,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACpE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,EAAE;YACF,MAAM,EACJ,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1F,CAAC,CAAE,MAAM,CAAC,MAAiC;gBAC3C,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;SACjC,EACD,SAAS,CAAC,eAAe,EAAE,CAC5B,CAAC;QAEF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG;YACrC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,uBAAuB,CAAC,CAAC,CAAC,GAAG;gBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG;oBACvC,CAAC,CAAC,GAAG,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAA8B,EAAE,WAAmB;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAA0B,EAAE,WAAmB;IACpE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB,EAAE,QAAgB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAmB,EAAE,SAAoB,EAAE,GAAW;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,wDAAwD;IACxD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI,QAAQ,uBAAuB,EAAE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,IAAA,0BAAe,EAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,gDAAgD;IAChD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAA,uBAAY,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAChF,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,MAAM;QAAE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,GAAmB,EACnB,WAAgC;IAEhC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACzD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7B,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,GAAmB,EACnB,SAAiB,EACjB,QAAgB,EAChB,KAAyB;IAEzB,IAAI,GAAG,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE/B,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,IAAA,mBAAQ,EAAC,SAAS,EAAE,SAAS,CAAC,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAA,kBAAQ,EAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK,EAAE,CAAC;oBACnC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACtB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;gBAChF,IAAI,GAAG,KAAK,aAAa;oBAAE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;gBAC9E,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,SAAS,CAAC,CAAC;gBAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,KAAK,EAAE,CAAC;QACV,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,KAAa;IACnD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,OAAO,CAAE,CAAC,CAAC;IACvD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IACnD,0EAA0E;IAC1E,uBAAuB;IACvB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,GAAG,oDAAoD,CAAC;AAExE;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa;IAClD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,mCAAmC,KAAK,MAAM,CAAC;QAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,WAAW,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/server/workspace.d.ts

@@ -0,0 +1,53 @@
+import type { ArtifactPayload, ArtifactView, FileEntry, Presentation, SemanticIR } from '../types';
+import { scanWorkspace } from '../scanner/scan';
+import { type ResolvedSemantics } from '../semantics/resolve';
+import { ActionEngine } from '../actions/engine';
+import type { ProviderRegistry } from '../providers/types';
+export interface WorkspaceOptions {
+    rootDir: string;
+    registry?: ProviderRegistry;
+    now?: () => Date;
+}
+export declare class Workspace {
+    rootDir: string;
+    scan: ReturnType<typeof scanWorkspace>;
+    semantics: ResolvedSemantics;
+    ir: SemanticIR;
+    readonly engine: ActionEngine;
+    readonly registry: ProviderRegistry;
+    /** What is on disk, before any action the human took this session. */
+    private base;
+    private filesByPath;
+    private viewsByPath;
+    private nodesByPath;
+    private knownImages;
+    /**
+     * The single route from a producer-authored path to bytes. Rebuilt on every
+     * scan, so it always describes the tree we last looked at.
+     */
+    private reader;
+    /** Incremented on every (re)scan; used as the change signal for watch. */
+    version: number;
+    /**
+     * The presentation the UI sees: disk-derived structure with this session's
+     * action state (run records, task status, audit trail) overlaid. Computed on
+     * read so an action result is visible without a rescan.
+     */
+    get presentation(): Presentation;
+    constructor(options: WorkspaceOptions | string);
+    rescan(): void;
+    fileUrl(relPath: string): string;
+    getFile(path: string): FileEntry | undefined;
+    getView(path: string): ArtifactView | undefined;
+    /** The action registry as published to the client (the execution allowlist). */
+    declaredActions(): import("../types").ActionView[];
+    renderPayload(path: string, mode?: 'tail' | 'full'): ArtifactPayload | undefined;
+    private blockContext;
+    private rebuild;
+    /**
+     * Overlays state produced by executed actions on top of the disk-derived
+     * presentation: new runs, task status changes, and the session audit trail.
+     */
+    private applyRuntimeState;
+}
+//# sourceMappingURL=workspace.d.ts.map

package/dist/server/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/server/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EAEZ,SAAS,EACT,YAAY,EACZ,UAAU,EAEX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAMhD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAU3D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,SAAS;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;IACvC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,EAAE,EAAE,UAAU,CAAC;IACf,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,sEAAsE;IACtE,OAAO,CAAC,IAAI,CAAe;IAE3B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,WAAW,CAAwC;IAC3D,OAAO,CAAC,WAAW,CAAwC;IAC3D,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAkB;IAEhC,0EAA0E;IAC1E,OAAO,SAAK;IAEZ;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;gBAEW,OAAO,EAAE,gBAAgB,GAAG,MAAM;IAoD9C,MAAM,IAAI,IAAI;IAKd,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIhC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI5C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAI/C,gFAAgF;IAChF,eAAe;IAIf,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,SAAS;IAiChF,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,OAAO;IA8Cf;;;OAGG;IACH,OAAO,CAAC,iBAAiB;CAwB1B"}