@trillboards/edge-sdk 0.2.20 → 0.2.24

package/dist/index.js

@@ -3,7 +3,7 @@
 // Install: npm install @trillboards/edge-sdk
 // Run: npx trillboards-edge start --config trillboards.config.json
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CropViewProvider = exports.SharedFrameSource = exports.isCloudEscalationEnabled = exports.CloudEscalationPolicy = exports.motionSignature = exports.downscaleRgbaToGrey = exports.decodeGreyFrame = exports.isChangeCandidate = exports.SceneChangeDetector = exports.MotionGate = exports.DEFAULT_CANDIDATE_TTL_MS = exports.VlmCandidateBuffer = exports.VlmAdmissionGate = exports.shouldAttemptRecorderAddressRecovery = exports.rewriteStreamHost = exports.normalizeMacAddress = exports.lookupMacAddress = exports.RecorderAddressRecovery = exports.resolveFeeds = exports.classifyRtspFailureClass = exports.buildTiledCameras = exports.buildSensingLoops = exports.CloudSensingManager = exports.defaultHttpPoster = exports.AudienceAnalyzeClient = exports.runDiagnose = exports.runInit = exports.CommandRouter = exports.resolveConfig = exports.loadConfig = exports.EdgeAgent = void 0;
+exports.CropViewProvider = exports.SharedFrameSource = exports.isCloudEscalationEnabled = exports.CloudEscalationPolicy = exports.motionSignature = exports.downscaleRgbaToGrey = exports.decodeGreyFrame = exports.isChangeCandidate = exports.SceneChangeDetector = exports.MotionGate = exports.DEFAULT_CANDIDATE_TTL_MS = exports.VlmCandidateBuffer = exports.VlmAdmissionGate = exports.shouldAttemptRecorderAddressRecovery = exports.rewriteStreamHost = exports.normalizeMacAddress = exports.lookupMacAddress = exports.RecorderAddressRecovery = exports.resolveFeeds = exports.classifyRtspFailureClass = exports.buildTiledCameras = exports.buildSensingLoops = exports.CloudSensingManager = exports.defaultHttpPoster = exports.AudienceAnalyzeClient = exports.LOCAL_NETWORK_DENIED_SUMMARY = exports.LOCAL_NETWORK_DENIED_SUGGESTION = exports.decideLocalNetworkVerdict = exports.probeLocalNetworkAccess = exports.describeProxy = exports.resolveProxyForUrl = exports.describeTrustAnchors = exports.resolveTrustAnchors = exports.isTrustFailure = exports.formatTransportFailure = exports.classifyTransportError = exports.TransportFailure = exports.EnterpriseHttpsAgent = exports.resetEnterpriseNetworkCaches = exports.diagnoseTransportError = exports.getEnterpriseAgent = exports.describeNetworkPosture = exports.installEnterpriseNetworking = exports.runDiagnose = exports.runInit = exports.CommandRouter = exports.resolveConfig = exports.loadConfig = exports.EdgeAgent = void 0;
 var EdgeAgent_1 = require("./EdgeAgent");
 Object.defineProperty(exports, "EdgeAgent", { enumerable: true, get: function () { return EdgeAgent_1.EdgeAgent; } });
 var config_1 = require("./config");
@@ -15,6 +15,34 @@ var init_1 = require("./init");
 Object.defineProperty(exports, "runInit", { enumerable: true, get: function () { return init_1.runInit; } });
 var diagnose_1 = require("./diagnose");
 Object.defineProperty(exports, "runDiagnose", { enumerable: true, get: function () { return diagnose_1.runDiagnose; } });
+// Enterprise networking: the machine's TLS trust store + the machine's proxy.
+// Exported so an embedder that does not run our CLI can install the same
+// posture, and so the failure classification is reusable rather than re-derived.
+var enterpriseNetwork_1 = require("./enterpriseNetwork");
+Object.defineProperty(exports, "installEnterpriseNetworking", { enumerable: true, get: function () { return enterpriseNetwork_1.installEnterpriseNetworking; } });
+Object.defineProperty(exports, "describeNetworkPosture", { enumerable: true, get: function () { return enterpriseNetwork_1.describeNetworkPosture; } });
+Object.defineProperty(exports, "getEnterpriseAgent", { enumerable: true, get: function () { return enterpriseNetwork_1.getEnterpriseAgent; } });
+Object.defineProperty(exports, "diagnoseTransportError", { enumerable: true, get: function () { return enterpriseNetwork_1.diagnoseTransportError; } });
+Object.defineProperty(exports, "resetEnterpriseNetworkCaches", { enumerable: true, get: function () { return enterpriseNetwork_1.resetEnterpriseNetworkCaches; } });
+Object.defineProperty(exports, "EnterpriseHttpsAgent", { enumerable: true, get: function () { return enterpriseNetwork_1.EnterpriseHttpsAgent; } });
+var transportFailure_1 = require("./transportFailure");
+Object.defineProperty(exports, "TransportFailure", { enumerable: true, get: function () { return transportFailure_1.TransportFailure; } });
+Object.defineProperty(exports, "classifyTransportError", { enumerable: true, get: function () { return transportFailure_1.classifyTransportError; } });
+Object.defineProperty(exports, "formatTransportFailure", { enumerable: true, get: function () { return transportFailure_1.formatTransportFailure; } });
+Object.defineProperty(exports, "isTrustFailure", { enumerable: true, get: function () { return transportFailure_1.isTrustFailure; } });
+var enterpriseTrust_1 = require("./enterpriseTrust");
+Object.defineProperty(exports, "resolveTrustAnchors", { enumerable: true, get: function () { return enterpriseTrust_1.resolveTrustAnchors; } });
+Object.defineProperty(exports, "describeTrustAnchors", { enumerable: true, get: function () { return enterpriseTrust_1.describeTrustAnchors; } });
+var enterpriseProxy_1 = require("./enterpriseProxy");
+Object.defineProperty(exports, "resolveProxyForUrl", { enumerable: true, get: function () { return enterpriseProxy_1.resolveProxyForUrl; } });
+Object.defineProperty(exports, "describeProxy", { enumerable: true, get: function () { return enterpriseProxy_1.describeProxy; } });
+// macOS Local Network (TCC) detection — why a LAN camera can be unreachable
+// for a reason that has nothing to do with the camera.
+var localNetworkAccess_1 = require("./localNetworkAccess");
+Object.defineProperty(exports, "probeLocalNetworkAccess", { enumerable: true, get: function () { return localNetworkAccess_1.probeLocalNetworkAccess; } });
+Object.defineProperty(exports, "decideLocalNetworkVerdict", { enumerable: true, get: function () { return localNetworkAccess_1.decideLocalNetworkVerdict; } });
+Object.defineProperty(exports, "LOCAL_NETWORK_DENIED_SUGGESTION", { enumerable: true, get: function () { return localNetworkAccess_1.LOCAL_NETWORK_DENIED_SUGGESTION; } });
+Object.defineProperty(exports, "LOCAL_NETWORK_DENIED_SUMMARY", { enumerable: true, get: function () { return localNetworkAccess_1.LOCAL_NETWORK_DENIED_SUMMARY; } });
 // Cloud-sensing mode: RTSP frame → cloud-VLM POST (no local ONNX), multi-channel.
 var AudienceAnalyzeClient_1 = require("./AudienceAnalyzeClient");
 Object.defineProperty(exports, "AudienceAnalyzeClient", { enumerable: true, get: function () { return AudienceAnalyzeClient_1.AudienceAnalyzeClient; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,gEAAgE;AAChE,6CAA6C;AAC7C,mEAAmE;;;AAEnE,yCAAwC;AAA/B,sGAAA,SAAS,OAAA;AAElB,mCAAqD;AAA5C,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AAEtB,+BAAiC;AAAxB,+FAAA,OAAO,OAAA;AAChB,uCAAyC;AAAhC,uGAAA,WAAW,OAAA;AAGpB,kFAAkF;AAClF,iEAAmF;AAA1E,8HAAA,qBAAqB,OAAA;AAAE,0HAAA,iBAAiB,OAAA;AAWjD,6DAM+B;AAL7B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,mHAAA,YAAY,OAAA;AAEd,qEAMmC;AALjC,kIAAA,uBAAuB,OAAA;AACvB,2HAAA,gBAAgB,OAAA;AAChB,8HAAA,mBAAmB,OAAA;AACnB,4HAAA,iBAAiB,OAAA;AACjB,+IAAA,oCAAoC,OAAA;AAStC,+DAA+D;AAC/D,6EAA6E;AAC7E,uBAAuB;AACvB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AAMzB,wEAAwE;AACxE,sEAAsE;AACtE,2DAAoF;AAA3E,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AAQrD,6DAO+B;AAN7B,iHAAA,UAAU,OAAA;AACV,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,sHAAA,eAAe,OAAA;AACf,0HAAA,mBAAmB,OAAA;AACnB,sHAAA,eAAe,OAAA;AAajB,sEAAsE;AACtE,8EAA8E;AAC9E,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,+CAA0D;AAAjD,wHAAA,wBAAwB,OAAA;AASjC,+EAA+E;AAC/E,mEAAmE;AACnE,+CAAqE;AAA5D,iHAAA,iBAAiB,OAAA;AAAE,gHAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,gEAAgE;AAChE,6CAA6C;AAC7C,mEAAmE;;;AAEnE,yCAAwC;AAA/B,sGAAA,SAAS,OAAA;AAElB,mCAAqD;AAA5C,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AAEtB,+BAAiC;AAAxB,+FAAA,OAAO,OAAA;AAChB,uCAAyC;AAAhC,uGAAA,WAAW,OAAA;AAGpB,8EAA8E;AAC9E,yEAAyE;AACzE,iFAAiF;AACjF,yDAO6B;AAN3B,gIAAA,2BAA2B,OAAA;AAC3B,2HAAA,sBAAsB,OAAA;AACtB,uHAAA,kBAAkB,OAAA;AAClB,2HAAA,sBAAsB,OAAA;AACtB,iIAAA,4BAA4B,OAAA;AAC5B,yHAAA,oBAAoB,OAAA;AAGtB,uDAK4B;AAJ1B,oHAAA,gBAAgB,OAAA;AAChB,0HAAA,sBAAsB,OAAA;AACtB,0HAAA,sBAAsB,OAAA;AACtB,kHAAA,cAAc,OAAA;AAGhB,qDAA8E;AAArE,sHAAA,mBAAmB,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAElD,qDAAsE;AAA7D,qHAAA,kBAAkB,OAAA;AAAE,gHAAA,aAAa,OAAA;AAE1C,4EAA4E;AAC5E,uDAAuD;AACvD,2DAK8B;AAJ5B,6HAAA,uBAAuB,OAAA;AACvB,+HAAA,yBAAyB,OAAA;AACzB,qIAAA,+BAA+B,OAAA;AAC/B,kIAAA,4BAA4B,OAAA;AAS9B,kFAAkF;AAClF,iEAAmF;AAA1E,8HAAA,qBAAqB,OAAA;AAAE,0HAAA,iBAAiB,OAAA;AAWjD,6DAM+B;AAL7B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,mHAAA,YAAY,OAAA;AAEd,qEAMmC;AALjC,kIAAA,uBAAuB,OAAA;AACvB,2HAAA,gBAAgB,OAAA;AAChB,8HAAA,mBAAmB,OAAA;AACnB,4HAAA,iBAAiB,OAAA;AACjB,+IAAA,oCAAoC,OAAA;AAStC,+DAA+D;AAC/D,6EAA6E;AAC7E,uBAAuB;AACvB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AAMzB,wEAAwE;AACxE,sEAAsE;AACtE,2DAAoF;AAA3E,wHAAA,kBAAkB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AAQrD,6DAO+B;AAN7B,iHAAA,UAAU,OAAA;AACV,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,sHAAA,eAAe,OAAA;AACf,0HAAA,mBAAmB,OAAA;AACnB,sHAAA,eAAe,OAAA;AAajB,sEAAsE;AACtE,8EAA8E;AAC9E,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,+CAA0D;AAAjD,wHAAA,wBAAwB,OAAA;AASjC,+EAA+E;AAC/E,mEAAmE;AACnE,+CAAqE;AAA5D,iHAAA,iBAAiB,OAAA;AAAE,gHAAA,gBAAgB,OAAA"}

package/dist/localNetworkAccess.d.ts

@@ -0,0 +1,166 @@
+/**
+ * macOS **Local Network** (TCC) access detection.
+ *
+ * ## Why this file exists
+ *
+ * On macOS 15+ every process that talks to a private-IP LAN host is gated by
+ * the *Local Network* privacy grant. The connector's whole camera surface is
+ * LAN traffic — ONVIF WS-Discovery multicast, the subnet TCP sweep, and RTSP
+ * frame capture — so a missing grant takes every camera offline at once.
+ *
+ * The failure it produces is not silence, it is **misattribution**: ffmpeg
+ * reports "no route to host", `classifyRtspFailureClass` maps that to
+ * `rtsp_unreachable`, and the portal tells the operator to check that their
+ * camera and connector are on the same network. They are. The fix is a
+ * checkbox in System Settings that nobody was told to tick.
+ *
+ * ## What macOS actually exposes — measured, not assumed
+ *
+ * Measured on macOS 26.5.2 (arm64) on 2026-08-14:
+ *
+ * - The grant is **not readable**. `kTCCServiceLocalNetwork` does not exist in
+ *   `tccd`'s service table (positive control: `kTCCServiceCamera` is present),
+ *   there is no row in either TCC.db, and `tccutil` cannot address it. The
+ *   decision is owned by `nehelper` (`com.apple.network.localnetworkdecision`)
+ *   and is not exposed to a client process by any public or file-level means.
+ *   **So the state must be inferred from behaviour.**
+ *
+ * - Denial has a sharp, specific signature. The *same* binary, same machine,
+ *   same network, same minute, differing only in who launched it:
+ *
+ *   | operation                        | LAN allowed          | LAN denied           |
+ *   |----------------------------------|----------------------|----------------------|
+ *   | `sendto` 239.255.255.250:3702    | sent                 | **EHOSTUNREACH, 0 ms** |
+ *   | `connect` gateway:80 (host up)   | connected, 4 ms      | **EHOSTUNREACH, 1 ms** |
+ *   | `connect` gateway:9 (port shut)  | ECONNREFUSED, 1005 ms| **EHOSTUNREACH, 0 ms** |
+ *   | `connect` 192.168.0.222 (no host)| timeout, 3004 ms     | timeout, 3193 ms     |
+ *   | `connect` 127.0.0.1 (loopback)   | connected            | connected            |
+ *
+ * Two things in that table are the entire design:
+ *
+ * 1. **The absent host times out in BOTH states.** A probe that only tries the
+ *    camera can never tell "denied" from "the NVR is off", because they look
+ *    identical. That is precisely the bug, so a probe that reproduces it is
+ *    worthless.
+ *
+ * 2. **Multicast `sendto` is the clean discriminator.** An empty network
+ *    segment still *accepts* a multicast send — nothing answers, but the send
+ *    succeeds. Only the TCC gate makes `sendto` itself fail. And an immediate
+ *    `EHOSTUNREACH` toward an address on the machine's own directly-connected
+ *    subnet cannot come from routing: the kernel has a connected route there by
+ *    construction, and a missing host shows up as an ARP timeout instead.
+ *
+ * Loopback is deliberately only a control, never evidence: it is never gated,
+ * so it succeeds in both states and separates nothing.
+ *
+ * ## Why NOT the default gateway
+ *
+ * The obvious probe — `route -n get default` — is wrong, and measurably so.
+ * On the test machine the default route is a Tailscale `utun` interface, and
+ * under a denied grant that endpoint answered `ECONNREFUSED` in the same run
+ * where the real LAN returned `EHOSTUNREACH`. A VPN default route is not a LAN
+ * host and is not gated, so probing it reports "the LAN is fine" every time and
+ * sends the operator straight back to debugging the recorder. Probe targets are
+ * therefore derived from the machine's **own directly-connected IPv4 subnets**
+ * via `os.networkInterfaces()`, never from the default route.
+ *
+ * ## Failing safe
+ *
+ * Every ambiguous outcome resolves to `unknown`, never to `denied`. Positive
+ * evidence that the LAN is reachable (a completed connect, or an RST) vetoes a
+ * denial verdict outright. Claiming a permission problem that isn't there sends
+ * the operator to the wrong place just as surely as the bug this replaces.
+ */
+import * as os from 'os';
+export type LocalNetworkVerdict = 
+/** Proven reachable: something on the local subnet answered (accept or RST). */
+'granted'
+/** Proven blocked above the routing layer: the TCC grant is missing. */
+ | 'denied'
+/** Not assessable — no LAN, all targets silent, or contradictory evidence. */
+ | 'unknown'
+/** Platform has no Local Network gate at all (everything except darwin). */
+ | 'not_applicable';
+export interface LocalNetworkProbeEvidence {
+    /** `sendto` to the WS-Discovery group: did the kernel accept the datagram? */
+    multicastSend: 'sent' | 'blocked' | 'error' | 'skipped';
+    /** errno from the multicast attempt, when it failed. */
+    multicastErrorCode?: string;
+    /** Any same-subnet TCP target that accepted or actively refused us. */
+    reachableTarget?: string;
+    /** Any same-subnet TCP target that failed instantly with a blocked errno. */
+    blockedTarget?: string;
+    /** Same-subnet TCP targets that simply went silent (absent host, or empty LAN). */
+    silentTargets: string[];
+    /** Loopback control — sockets working at all. Never used as LAN evidence. */
+    loopbackUsable: boolean;
+    /** Directly-connected IPv4 subnets discovered from the interface list. */
+    subnets: string[];
+}
+export interface LocalNetworkProbeResult {
+    verdict: LocalNetworkVerdict;
+    /** One line, safe to log and to show support. */
+    reason: string;
+    evidence: LocalNetworkProbeEvidence;
+}
+export interface LocalNetworkProbeOptions {
+    /**
+     * Extra LAN hosts to probe — normally the configured camera/recorder hosts.
+     * Only those on a directly-connected subnet are used; a routed host tells us
+     * nothing, because a routed destination legitimately has no connected route.
+     */
+    extraHosts?: string[];
+    /** Per-target TCP timeout. */
+    tcpTimeoutMs?: number;
+    /** Injection seam for tests. */
+    platform?: NodeJS.Platform;
+    /** Injection seam for tests. */
+    networkInterfaces?: () => NodeJS.Dict<os.NetworkInterfaceInfo[]>;
+    /**
+     * Injection seam. Exists so the `denied` branch can be driven end to end from
+     * the socket outcomes actually recorded on a blocked Mac — the OS state that
+     * produces them cannot be re-induced on demand (see the header table).
+     */
+    tcpProbeImpl?: (host: string, port: number, timeoutMs: number) => Promise<TcpProbeOutcome>;
+    /** Injection seam — see `tcpProbeImpl`. */
+    multicastProbeImpl?: (interfaceAddress?: string) => Promise<MulticastProbeOutcome>;
+}
+export interface TcpProbeOutcome {
+    target: string;
+    outcome: 'reachable' | 'blocked' | 'silent';
+    code?: string;
+    elapsedMs: number;
+}
+export interface MulticastProbeOutcome {
+    result: 'sent' | 'blocked' | 'error';
+    code?: string;
+}
+/**
+ * Decide whether this process can reach the local network.
+ *
+ * Never throws, never rejects. Ambiguity always resolves toward `unknown`.
+ */
+export declare function probeLocalNetworkAccess(options?: LocalNetworkProbeOptions): Promise<LocalNetworkProbeResult>;
+/**
+ * The verdict rule, isolated from all I/O.
+ *
+ * Split out so it can be driven from the socket outcomes *recorded on a Mac
+ * that was actually blocked*. The OS-level denial could not be re-induced on
+ * demand after it cleared, so replaying the measured evidence through this
+ * exact function is the only way the `denied` branch gets tested against real
+ * data rather than against an invented signature.
+ */
+export declare function decideLocalNetworkVerdict(evidence: LocalNetworkProbeEvidence): {
+    verdict: LocalNetworkVerdict;
+    reason: string;
+};
+/**
+ * The operator-facing instruction for a denied grant.
+ *
+ * Names the pane and says plainly that a human has to be at the machine, because
+ * the one thing that cannot be automated here is the only thing that fixes it.
+ */
+export declare const LOCAL_NETWORK_DENIED_SUGGESTION: string;
+/** Same message, one line, for a log or a health beacon. */
+export declare const LOCAL_NETWORK_DENIED_SUMMARY: string;
+//# sourceMappingURL=localNetworkAccess.d.ts.map

package/dist/localNetworkAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localNetworkAccess.d.ts","sourceRoot":"","sources":["../src/localNetworkAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAIH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAuBzB,MAAM,MAAM,mBAAmB;AAC7B,gFAAgF;AAC9E,SAAS;AACX,wEAAwE;GACtE,QAAQ;AACV,8EAA8E;GAC5E,SAAS;AACX,4EAA4E;GAC1E,gBAAgB,CAAC;AAErB,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACxD,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,yBAAyB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,gCAAgC;IAChC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACjE;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3F,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAgPD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,uBAAuB,CAAC,CAoElC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,yBAAyB,GAClC;IAAE,OAAO,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoDlD;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,QAGoB,CAAC;AAEjE,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,QAEiB,CAAC"}