@wenathlan/devthink 1.1.16 → 2.0.2

package/hardening.d.ts

@@ -0,0 +1,81 @@
+import type { policyevaluation, redactregion, scanverdict } from "./types.js";
+/** Masks the secret shaped key value pairs of one free form log text: a summary a step, a body or a console line embedded stays masked when its key matches a masked shape, because a log field the families gained since the masking audit never leaks its typed value through the text the audit trail keeps. */
+export declare function masklogtext(input: {
+    text: string;
+    shapes: string[];
+}): {
+    text: string;
+    maskedkeys: string[];
+    reason: string;
+};
+/** Gates the local signature check option of the virus scanning hook: a scanner configured with a local signature list answers its verdict on the device before any remote endpoint fires, and a digest that matches a local signature flags the file while a digest that matches nothing leaves the verdict to the configured hook. */
+export declare function localscangate(input: {
+    hook?: {
+        scanner: string;
+        localsignatures?: string[];
+    };
+    digest?: string;
+}): {
+    verdict: scanverdict;
+    reason: string;
+};
+/** Builds the visible confirmation banner of the escape hatch: one record the surfaces render after the key press, because a halt of every native call at once deserves a confirmation the user sees and the audit trail keeps. */
+export declare function hatchbannerof(input: {
+    halted: number;
+    at: number;
+}): {
+    title: string;
+    explanation: string;
+    halted: number;
+    at: number;
+};
+/** Decides the review mode pause on a new domain: a navigation step that lands on a domain the profile workspace never recorded pauses the run with the explanatory card instead of dispatching silently, because a new domain is a new trust boundary the review walks the user through. */
+export declare function newdomainpausecard(input: {
+    origin: string;
+    knownorigins: string[];
+    kind: string;
+}): {
+    pause: boolean;
+    card: {
+        title: string;
+        explanation: string;
+        origin: string;
+    };
+    reason: string;
+};
+/** Selects every stored key that carries the trace of one run: the per run keys the families write end with the run id, so the purge of a run deletes every key that names it and no key survives with the run's data. */
+export declare function runtracekeys(input: {
+    runid: string;
+    keys: string[];
+}): {
+    keys: string[];
+    kept: string[];
+    reason: string;
+};
+/** Gates the key rotation entry point of the encrypted sync path: the rotation needs both the current passphrase and the next one, and a rotation that reuses the same passphrase rekeys nothing. */
+export declare function syncrotationgate(input: {
+    current?: string;
+    next?: string;
+}): policyevaluation;
+/** Verifies the client signature of the local stdio bridge: the platform verifier answers when the platform allows signature verification, a presented signature that fails refuses the bridge, and a platform without a verifier keeps the bridge running unverified while the record says so. */
+export declare function stdioclientsignaturegate(input: {
+    platformverifier?: (host: string, signature: string) => boolean;
+    host: string;
+    signature?: string;
+}): {
+    verified: boolean;
+    allowed: boolean;
+    reason: string;
+};
+/** Masks and redacts one transparency export payload: the shape masking covers every typed field of the report while the redact regions of the origin mark the capture derived entries, so an export the transparency page issues leaves with the same masking and redaction the captures carry. */
+export declare function transparencyexportmask(input: {
+    report: Record<string, unknown>;
+    shapes: string[];
+    regions: redactregion[];
+}): {
+    payload: Record<string, unknown>;
+    maskedfields: string[];
+    redactedregions: number;
+    reason: string;
+};
+//# sourceMappingURL=hardening.d.ts.map

package/hardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.d.ts","sourceRoot":"","sources":["../hardening.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9E,mTAAmT;AACnT,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAyBA;AAED,wUAAwU;AACxU,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACjH,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,CAsBA;AAED,mOAAmO;AACnO,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ,CAOA;AAED,6RAA6R;AAC7R,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACnG,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB,CAgBA;AAED,0NAA0N;AAC1N,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAcA;AAED,qMAAqM;AACrM,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAkB7F;AAED,mSAAmS;AACnS,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmB1D;AAED,oSAAoS;AACpS,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAexG"}

package/hardening.js

@@ -0,0 +1,188 @@
+/*! devthink 2.0.2 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/devthink */
+
+// security.ts
+var maskmarker = "[redacted]";
+function fieldshapekind(name) {
+  const lowered = name.toLowerCase();
+  if (lowered.includes("password") || lowered.includes("passwd") || lowered.includes("pwd") || lowered.includes("passphrase"))
+    return "password";
+  if (lowered.includes("token") || lowered.includes("apikey") || lowered.includes("api_key") || lowered.includes("auth") || lowered.includes("bearer"))
+    return "token";
+  if (lowered.includes("card") || lowered.includes("cvc") || lowered.includes("cvv") || lowered.includes("expiry") || lowered.includes("pan"))
+    return "card";
+  if (lowered.includes("secret")) return "secret";
+  return void 0;
+}
+function maskingfield(name, shapes) {
+  if (fieldshapekind(name) !== void 0) return true;
+  const lowered = name.toLowerCase();
+  return shapes.some((shape) => shape !== "" && lowered.includes(shape));
+}
+function maskvalue(value) {
+  return value === "" ? "" : maskmarker;
+}
+function maskfield(input) {
+  return maskingfield(input.name, input.shapes) ? maskvalue(input.value) : input.value;
+}
+function maskrecord(record, shapes) {
+  const masked = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (typeof value === "string") {
+      const sibling = record.name;
+      masked[key] = key === "value" && typeof sibling === "string" ? maskfield({ name: sibling, value, shapes }) : maskfield({ name: key, value, shapes });
+    } else if (Array.isArray(value))
+      masked[key] = value.map(
+        (item) => Boolean(item) && typeof item === "object" && !Array.isArray(item) ? maskrecord(item, shapes) : item
+      );
+    else if (Boolean(value) && typeof value === "object")
+      masked[key] = maskrecord(value, shapes);
+    else masked[key] = value;
+  }
+  return masked;
+}
+function maskexport(record, shapes) {
+  return maskrecord(record, shapes);
+}
+
+// hardening.ts
+function masklogtext(input) {
+  const maskedkeys = [];
+  let text = input.text;
+  const patterns = [
+    [/(\w+)\s*:\s*"((?:[^"\\]|\\.)*)"/g, (match) => `${match[1]}: "${maskvalue(match[2] ?? "")}"`],
+    [/(\w+)\s*=\s*([^\s&;]+)/g, (match) => `${match[1]}=${maskvalue(match[2] ?? "")}`],
+    [/(\w+)\s*:\s*([^\s,;]+)/g, (match) => `${match[1]}: ${maskvalue(match[2] ?? "")}`]
+  ];
+  for (const [pattern, rewrite] of patterns) {
+    text = text.replace(pattern, (full, key, ...rest) => {
+      if (!maskingfield(String(key), input.shapes)) return full;
+      maskedkeys.push(String(key));
+      return rewrite([full, String(key), String(rest[0] ?? "")]);
+    });
+  }
+  const unique = [...new Set(maskedkeys)];
+  return {
+    text,
+    maskedkeys: unique,
+    reason: unique.length === 0 ? "The log text carries no secret shaped key value pair; the masking pass changed nothing." : `The masking pass covered the log field${unique.length === 1 ? "" : "s"} ${unique.join(", ")} the text carried since the audit; the typed values answer the redaction marker.`
+  };
+}
+function localscangate(input) {
+  const signatures = input.hook?.localsignatures ?? [];
+  if (signatures.length === 0)
+    return {
+      verdict: "pending",
+      reason: "The scanning hook carries no local signature list; the verdict stays with the configured scanner endpoint and the file holds."
+    };
+  if (input.digest === void 0 || input.digest.trim() === "")
+    return {
+      verdict: "pending",
+      reason: `The local signature check of ${input.hook?.scanner ?? "the scanning hook"} needs the file digest; a digest nobody computed flags nothing.`
+    };
+  if (signatures.includes(input.digest))
+    return {
+      verdict: "flagged",
+      reason: `The local signature list of ${input.hook?.scanner} matched the file digest; the quarantine deletes the file and no remote endpoint ever fires.`
+    };
+  return {
+    verdict: "pending",
+    reason: `The local signature list of ${input.hook?.scanner} matched no signature; the verdict falls back to the configured scanner endpoint and the file holds.`
+  };
+}
+function hatchbannerof(input) {
+  return {
+    title: `Escape hatch: ${input.halted} in flight call${input.halted === 1 ? "" : "s"} halted`,
+    explanation: `The escape hatch key stopped every native call in one press at ${new Date(input.at).toISOString()}; the transport detached until you reattach and the halt stays recorded in the audit trail.`,
+    halted: input.halted,
+    at: input.at
+  };
+}
+function newdomainpausecard(input) {
+  if (input.knownorigins.includes(input.origin))
+    return {
+      pause: false,
+      card: { title: "", explanation: "", origin: input.origin },
+      reason: `The domain ${input.origin} sits inside the recorded origins; the review mode runs the ${input.kind} step without the new domain pause.`
+    };
+  return {
+    pause: true,
+    card: {
+      title: `New domain: ${input.origin}`,
+      explanation: `The ${input.kind} step targets a domain the profile workspace never recorded. The run pauses here so you can review the new trust boundary: the safedefaults profile applied reads only, every sensitive class stays denied, and the next explicit grant opens the domain the same way the first one did.`,
+      origin: input.origin
+    },
+    reason: `The review mode paused the ${input.kind} step on the new domain ${input.origin} with the explanatory card; the run resumes after the domain review.`
+  };
+}
+function runtracekeys(input) {
+  if (input.runid.trim() === "")
+    throw new Error("The run trace purge names its run; a nameless run trace purges nothing.");
+  const runid = input.runid.trim();
+  const keys = input.keys.filter((key) => key === runid || key.endsWith(runid));
+  const kept = input.keys.filter((key) => !keys.includes(key));
+  return {
+    keys,
+    kept,
+    reason: keys.length === 0 ? `No stored key carries the trace of the run ${runid}; the run trace purge deletes nothing.` : `The run trace purge deletes ${keys.length} stored key${keys.length === 1 ? "" : "s"} carrying the trace of the run ${runid} \u2014 ${keys.join(", ")} \u2014 while ${kept.length} key${kept.length === 1 ? "" : "s"} of other runs survive.`
+  };
+}
+function syncrotationgate(input) {
+  if ((input.current ?? "").trim() === "" || (input.next ?? "").trim() === "")
+    return {
+      allowed: false,
+      reason: "The key rotation names both the current passphrase and the next one; a rotation without either passphrase never rekeys because no key ever defaults in code."
+    };
+  if (input.current === input.next)
+    return {
+      allowed: false,
+      reason: "The key rotation needs a next passphrase that differs from the current one; rotating onto the same key rekeys nothing."
+    };
+  return {
+    allowed: true,
+    reason: "The key rotation entry point opens with both passphrases present; the derived key rekeys the sync payloads while the passphrases never persist."
+  };
+}
+function stdioclientsignaturegate(input) {
+  if (input.signature === void 0 || input.platformverifier === void 0)
+    return {
+      verified: false,
+      allowed: true,
+      reason: "The platform carries no signature verifier the bridge can call; the local stdio bridge stays unverified while the record marks it."
+    };
+  if (!input.platformverifier(input.host, input.signature))
+    return {
+      verified: false,
+      allowed: false,
+      reason: `The client signature of the ${input.host} bridge failed the platform verification; the local stdio bridge refuses the client and no frame relays.`
+    };
+  return {
+    verified: true,
+    allowed: true,
+    reason: `The platform verifier confirmed the client signature of the ${input.host} bridge; the local stdio bridge relays its frames under the verified client.`
+  };
+}
+function transparencyexportmask(input) {
+  const payload = maskexport(input.report, input.shapes);
+  const maskedfields = Object.keys(input.report).filter((key) => maskingfield(key, input.shapes));
+  if (input.regions.length > 0 && Array.isArray(payload.captures))
+    payload.captures = payload.captures.map(
+      (entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry) ? { ...entry, redacted: true, redactedregions: input.regions.length } : entry
+    );
+  return {
+    payload,
+    maskedfields,
+    redactedregions: input.regions.length,
+    reason: `The transparency export left with the masking pass over ${maskedfields.length} shaped field${maskedfields.length === 1 ? "" : "s"} and ${input.regions.length} redact region${input.regions.length === 1 ? "" : "s"} covering its capture derived entries; the raw values stay behind the redaction marker.`
+  };
+}
+export {
+  hatchbannerof,
+  localscangate,
+  masklogtext,
+  newdomainpausecard,
+  runtracekeys,
+  stdioclientsignaturegate,
+  syncrotationgate,
+  transparencyexportmask
+};
+//# sourceMappingURL=hardening.js.map

package/headless.d.ts

@@ -0,0 +1,114 @@
+/** The headless library entry of the 1.1.80 family: the library runtime without a browser extension, so a host opens the run handle over a plan, a state source and a policy and drives the read only replay against recorded page state fixtures; the 1.1.81 library modes stamp the entry so it reports the bundle it runs from. */
+export { bundlestamp } from "./runtime.js";
+import type { consentprovider, flowrungate, flowrunrequest, headlessevent, headlessfixture, headlessfixtureoutcome, headlesssession, immutablelogentry, jsonrpcframe, libraryrunhandle, planfile, planfilestep, planprogress, storedrunlog, toolstep } from "./types.js";
+import type { memoryadapter } from "./memory.js";
+import { sessionmemory } from "./memory.js";
+/** Executes one read only step against one recorded page state fixture: the fixture consent gate grades the kind against the fixture grants, the read only vocabulary with a recorded projection executes against the observation, and every other kind reports unsupported with the reason a fixture cannot satisfy it. */
+export declare function headlessfixturestep(fixture: headlessfixture, step: planfilestep): headlessfixtureoutcome;
+/** Records the headless outcomes through the same progress model the live runs record: every step records its step mark and its outcome, so a headless replay renders on the progress surfaces a live run renders on. */
+export declare function headlessprogress(input: {
+    progress: planprogress | undefined;
+    planid: string;
+    step: planfilestep;
+    outcome: headlessfixtureoutcome;
+    now: number;
+}): planprogress;
+/**
+ * Headless library logic of the 1.1.67 family.
+ * The library drives a remote browser with no chrome surface: a headless session opens on one origin behind the same consent gates, every gate wait routes to the consent provider the host implements (a terminal prompt in the cli, a callback anywhere else), denydefault refuses whatever no provider resolves, the remote session attaches through the same json rpc protocol the extension speaks, and the plan, run, session and memory entry points expose the whole engine to hosts.
+ * The audit reader verifies the chain it reads, the policy engine validates for external callers and the typed run subscription emits every step, gate and run event — with telemetry off by default and forever unless the host opts in.
+ */
+/** Opens one headless session: the origin it addresses, the consent provider that resolves its gates and the telemetry marker that stays off by default. */
+export declare function openheadlesssession(input: {
+    origin: string;
+    provider?: consentprovider;
+    now: number;
+    hostoptin?: boolean;
+}): headlesssession;
+/** Resolves one gate wait through the consent provider: an attached provider resolves the gate with its own human, an absent provider refuses under denydefault, and every resolution counts on the session. */
+export declare function headlessgatewait(input: {
+    session: headlesssession;
+    gate: flowrungate;
+    provider?: consentprovider;
+}): Promise<{
+    session: headlesssession;
+    resolution: "approve" | "refuse";
+    reason: string;
+}>;
+/** Closes one headless session: a closed session resolves no further gate and drives no further step. */
+export declare function closeheadlesssession(session: headlesssession): headlesssession;
+/** Builds the initialize frame of one remote session attach: the same json rpc protocol the extension speaks carries the protocol version, the runtime and the origin the session drives. */
+export declare function remoteattachframes(input: {
+    id: number | string;
+    session: headlesssession;
+    runtime: string;
+}): {
+    initialize: jsonrpcframe;
+    ready: jsonrpcframe;
+};
+/** Validates one step of an external caller with the same policy engine the extension runs: the validation refuses what the extension refuses, with no browser attached. */
+export declare function headlesspolicyvalidate(step: toolstep, origin: string): {
+    allowed: boolean;
+    reason?: string;
+};
+/** Reads the audit chain of one stored run log with its verification: the reader returns the verified entries or the reason the chain broke, exactly the way the extension reads its own audit. */
+export declare function headlessauditread(log: storedrunlog): Promise<{
+    ok: boolean;
+    entries: immutablelogentry[];
+    reason: string;
+}>;
+/** Opens the memory entry point over one adapter: the headless host drives the same sessionmemory the extension drives, so the profile store format and the lock protocol stay one. */
+export declare function headlessmemory(adapter: memoryadapter): sessionmemory;
+/** Builds the plan entry point of one plan file: the workflow proposal the headless run executes, validated the same way the extension validates it. */
+export declare function headlessplan(file: planfile, grants: string[]): {
+    version: string;
+    workflow: {
+        name: string;
+        origins: string[];
+        steps: Array<Record<string, unknown>>;
+    };
+};
+/** Reads the run entry point descriptor of one headless run: the request, the plan file and the provider the host attached, so the flowrun pipeline runs headless without any chrome surface. */
+export declare function headlessrun(input: {
+    request: flowrunrequest;
+    file: planfile;
+    provider?: consentprovider;
+}): {
+    request: flowrunrequest;
+    file: planfile;
+    provider?: consentprovider;
+};
+/** Reads the session entry point view of one headless session for the host surfaces: the identity, origin, state and the gates it resolved. */
+export declare function headlesssessionview(session: headlesssession): {
+    id: string;
+    origin: string;
+    state: string;
+    gatesresolved: number;
+    telemetry: boolean;
+};
+/** Creates one typed run subscription: the host handler receives every step, gate and run event, and the subscription keeps its own event list for replay. */
+export declare function headlesssubscribe(handler: (event: headlessevent) => void): {
+    emit(event: headlessevent): void;
+    events(): headlessevent[];
+};
+/** Reads the telemetry posture of the library: off by default, on only under the host opt in, so a bundle that reports by default refuses. */
+export declare function headlesstelemetryposture(hostoptin: boolean): {
+    telemetry: boolean;
+    reason: string;
+};
+/** The library entry point of the 1.1.80 family: one plan, one state source and one policy open a run handle whose progress records through the same progress model the live runs use, with the pause and cancel controls the extension surface offers — the state source resolves the recorded fixture of an origin and the policy narrows the fixture grants to the grants the host attached. */
+export declare function openlibraryrun(input: {
+    plan: planfile;
+    statesource: (origin: string) => headlessfixture | undefined;
+    policy?: {
+        grants?: string[];
+    };
+    now: number;
+}): {
+    handle(): libraryrunhandle;
+    step(step: planfilestep, now: number): headlessfixtureoutcome;
+    pause(now: number): void;
+    resume(now: number): void;
+    cancel(reason: string, now: number): void;
+};
+//# sourceMappingURL=headless.d.ts.map

package/headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../headless.ts"],"names":[],"mappings":"AACA,sUAAsU;AACtU,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,KAAK,EACV,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,YAAY,EAEZ,YAAY,EACZ,QAAQ,EACT,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,EAAY,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,4TAA4T;AAC5T,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,GAAG,sBAAsB,CAsExG;AAED,yNAAyN;AACzN,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,sBAAsB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,YAAY,CAWf;AAED;;;;GAIG;AAEH,4JAA4J;AAC5J,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,eAAe,CAiBlB;AAED,gNAAgN;AAChN,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1F;AAED,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAE9E;AAED,6LAA6L;AAC7L,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAC7G,UAAU,EAAE,YAAY,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;CACrB,CAUA;AAED,4KAA4K;AAC5K,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAE5G;AAED,mMAAmM;AACnM,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAExE;AAED,uLAAuL;AACvL,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAEpE;AAED,wJAAwJ;AACxJ,wBAAgB,YAAY,CAC1B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,GACf;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAA;CAAE,CAqB3G;AAED,iMAAiM;AACjM,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG;IAC3G,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAMA;AAED,+IAA+I;AAC/I,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;CACpB,CAQA;AAED,8JAA8J;AAC9J,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG;IAC1E,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,IAAI,aAAa,EAAE,CAAC;CAC3B,CAWA;AAED,8IAA8I;AAC9I,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGnG;AAED,mYAAmY;AACnY,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb,GAAG;IACF,MAAM,IAAI,gBAAgB,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAAC;IAC9D,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C,CA2DA"}