aicodeman 1.3.5 → 1.4.1

package/dist/docker-hosts.d.ts

@@ -0,0 +1,264 @@
+/**
+ * @fileoverview Docker cases: storage, pure command-arg builders, and daemon probes.
+ *
+ * Docker mode is a LOCATION OVERLAY on cases (not a 6th SessionMode), the direct
+ * analog of the remote-SSH feature in `remote-hosts.ts`. Instead of a local tmux
+ * pane running `ssh host` into a durable remote tmux server, a local tmux pane
+ * runs `docker exec -it` into a durable IN-CONTAINER tmux server. The container is
+ * scoped to the CASE (`codeman-case-<name>`), so multiple sessions can `docker
+ * exec` into the same long-lived container.
+ *
+ * This module mirrors `remote-hosts.ts`:
+ *  - JSON storage for hosts (`docker-hosts.json`) and cases (`docker-cases.json`)
+ *  - `toSessionDocker()` (mirror of `toSessionRemote`)
+ *  - `buildDockerBaseArgs()` / `buildDockerCreateArgs()` (mirror of `buildSshConnectionArgs`)
+ *  - `checkDockerAvailable()` / `checkDockerTmuxAvailable()` (mirror of `checkRemoteTmuxAvailable`)
+ *
+ * The launch/kill command orchestration (`buildDockerLaunchCommand`,
+ * `buildDockerKillCommand`, `dockerTmuxSessionName`) lives in `tmux-manager.ts`,
+ * mirroring where `buildRemoteLaunchCommand` lives.
+ *
+ * @module docker-hosts
+ */
+import type { DockerCase, DockerEngine, DockerHost, DockerResourceLimits, SessionDocker, SessionMode } from './types.js';
+/** Locally-built base image (see scripts/build-agent-image.mjs). */
+export declare const DEFAULT_AGENT_IMAGE = "codeman/agent:base";
+/** HOME inside the base image (the `agent` user). Cred mounts + hook-secret land under it. */
+export declare const CONTAINER_HOME = "/home/agent";
+/** Sensible resource defaults (all overridable per host). */
+export declare const DEFAULT_DOCKER_RESOURCES: DockerResourceLimits;
+export declare function dockerHostsPath(configDir: string): string;
+export declare function dockerCasesPath(configDir: string): string;
+export declare function readDockerHosts(configDir: string): Promise<DockerHost[]>;
+export declare function writeDockerHosts(configDir: string, hosts: DockerHost[]): Promise<void>;
+export declare function readDockerCases(configDir: string): Promise<DockerCase[]>;
+export declare function writeDockerCases(configDir: string, cases: DockerCase[]): Promise<void>;
+/** Per-case container name. Mirrors how remote derives a stable name from the case. */
+export declare function dockerContainerName(caseName: string): string;
+/** Default pane command per CLI mode (mirror of defaultRemoteCommandForMode). */
+export declare function defaultDockerCommandForMode(mode: SessionMode): string;
+/** `container:/workdir` display string (mirror of remoteDisplayPath's `user@host:path`). */
+export declare function dockerDisplayPath(docker: Pick<SessionDocker, 'containerName' | 'containerWorkdir'> | {
+    container: string;
+    path: string;
+}): string;
+/**
+ * The host-callback gateway alias is ENGINE-SPECIFIC: Docker exposes the host as
+ * `host.docker.internal`, Podman as `host.containers.internal`. Both are added to
+ * the host-guard allowlist so a mixed fleet keeps working.
+ */
+export declare function hostGatewayAlias(engine: DockerEngine): string;
+/**
+ * Rewrite the server's own `CODEMAN_API_URL` to a container-reachable one by
+ * swapping ONLY the hostname for the engine's host-gateway alias, preserving
+ * scheme AND port (prod is HTTPS on 3000, so hardcoding http://…:3000 breaks
+ * every hook). Falls back to `https://<alias>:3000` when the input is absent or
+ * unparseable.
+ */
+export declare function containerApiUrl(processApiUrl: string | undefined, engine: DockerEngine): string;
+/**
+ * Stable hash of the drift-relevant `docker create` inputs, stored on the
+ * container as the `codeman.confighash` label. On launch, a mismatch between the
+ * desired hash and the running container's label triggers the recreate-on-drift
+ * prompt (host config edits actually take effect).
+ */
+export declare function dockerConfigHash(docker: Pick<SessionDocker, 'engine' | 'image' | 'containerWorkdir' | 'network' | 'networkName' | 'resources' | 'gpus' | 'mountCredentials' | 'extraCreateArgs'>): string;
+/**
+ * Build the flattened per-session Docker metadata from a host profile + a case,
+ * resolving every default (mirror of toSessionRemote). The `configHash` is
+ * computed last over the resolved values.
+ */
+export declare function toSessionDocker(host: DockerHost, dockerCase: DockerCase): SessionDocker;
+/**
+ * POSIX single-quote shell-escaping (end-quote, escaped-quote, restart-quote).
+ * Mirror of the helper in remote-hosts.ts / tmux-manager.ts. Every dynamic value
+ * interpolated into the outer `bash -c "..."` launch layer is escaped through
+ * this so a path with spaces stays a single shell token. Operator-entered fields
+ * are ALSO schema-rejected for `$`/backtick (NO_SHELL_META) as defense in depth.
+ */
+export declare function shellescape(str: string): string;
+/** A resolved bind mount (source existence already checked by the caller). */
+export interface DockerMount {
+    src: string;
+    dst: string;
+    readonly?: boolean;
+}
+/**
+ * Resolved, IO-free context for buildDockerCreateArgs. The caller (tmux-manager)
+ * resolves the environment-dependent bits (host uid, existing cred mounts, the
+ * derived api url, Desktop detection) so this builder stays pure and unit-testable.
+ */
+export interface DockerCreateContext {
+    docker: SessionDocker;
+    /** Codeman session id (only the first 8 chars are used, for the codeman.session label). */
+    sessionId: string;
+    /** CODEMAN_INSTANCE ('' for prod) — scopes the boot reaper so a beta never reaps prod. */
+    instance: string;
+    /** Pre-resolved uid/userns tokens: ['--user','1000:0'] | ['--userns','keep-id'] | []. */
+    userArgs: string[];
+    /** Existing host credential bind mounts (convenient mode). Empty in sealed mode. */
+    credentialMounts: DockerMount[];
+    /** Extra bind mounts (e.g. the read-only hook-secret file). */
+    extraMounts: DockerMount[];
+    /** Create-time env (NON-secret, committed-safe): HOME, TERM, COLORTERM, CODEMAN_API_URL, CODEMAN_HOOK_SECRET_FILE. */
+    envCreate: Record<string, string>;
+    /** Whether to add `--add-host <alias>:host-gateway` (skipped on Docker Desktop, where the alias is native). */
+    addHostGateway: boolean;
+    /** Engine host-gateway alias (host.docker.internal / host.containers.internal). */
+    gatewayAlias: string;
+}
+/**
+ * Engine prefix tokens shared by every docker invocation (mirror of
+ * buildSshConnectionArgs). Returns e.g. ['docker'] or ['podman','--context','ctx'].
+ */
+export declare function buildDockerBaseArgs(docker: Pick<SessionDocker, 'engine' | 'context' | 'daemonHost'>): string[];
+/**
+ * Build the `docker create` token list (from `create` through the `sleep
+ * infinity` CMD) for a long-lived, hardened, per-case container. PURE: every
+ * dynamic value is shellescaped; the caller joins with spaces into the launch
+ * string. Security invariants baked in: --cap-drop ALL, --security-opt
+ * no-new-privileges, --pids-limit, --memory==--memory-swap, --init,
+ * --pull=never, --restart no, NEVER --privileged, NEVER the docker socket.
+ */
+export declare function buildDockerCreateArgs(ctx: DockerCreateContext): string[];
+/**
+ * PURE argv for building the agent base image locally (the programmatic mirror of
+ * scripts/build-agent-image.mjs): `build -f <dockerfile> -t <image> [--no-cache]
+ * <contextDir>`. Kept pure + unit-testable; the caller prepends the engine binary.
+ */
+export declare function agentImageBuildArgs(dockerfile: string, image: string, contextDir: string, noCache?: boolean): string[];
+/** Container Claude config dir (created gid-0 writable in the image). */
+export declare const CONTAINER_CLAUDE_DIR = "/home/agent/.claude";
+/** In-container path of the seeded (writable) `~/.claude.json`. */
+export declare const CLAUDE_JSON_HOME = "/home/agent/.claude.json";
+/** In-container path of the read-only host-seeded `~/.claude.json` (copied into HOME at launch). */
+export declare const CLAUDE_JSON_SEED = "/home/agent/.codeman/claude.seed.json";
+/**
+ * PURE: merge the host `~/.claude.json` into a config that makes an
+ * already-authenticated Claude skip its INTERACTIVE onboarding inside the container
+ * (the host file itself lacks these flags — the host install is grandfathered, so a
+ * verbatim copy still triggers the theme picker + login wizard + folder-trust
+ * prompt). Forces `hasCompletedOnboarding`, a `theme` (so the theme picker is
+ * skipped), and marks the workspace project trusted + onboarded. Auth still comes
+ * from the copied `oauthAccount` + the dir-mounted `~/.claude/.credentials.json`.
+ */
+export declare function buildSeamlessClaudeConfig(hostConfig: Record<string, unknown>, workspacePath: string, theme?: string): Record<string, unknown>;
+/**
+ * Resolve the read-only seed mount for `~/.claude.json`. Reads the host file, merges
+ * in the seamless-onboarding flags + workspace trust (buildSeamlessClaudeConfig),
+ * writes the result to a per-container seed file under `~/.codeman/docker-seeds/`,
+ * and returns its mount. The launch chain copies it to `~/.claude.json` inside HOME
+ * once — giving Claude a NORMAL writable, already-onboarded config (no atomic-rename
+ * EBUSY, no re-auth, no theme/trust prompts). Falls back to the RAW host file when
+ * parse/write fails (auth still works; the wizard may show). Returns null when the
+ * host has no `~/.claude.json`. IO; under VITEST returns the raw mount (no write).
+ */
+export declare function resolveClaudeJsonSeedMount(home?: string, containerName?: string, workspacePath?: string): DockerMount | null;
+/** A file (or dir, when `recursive`) copied into the container HOME once at launch
+ *  (`[ -e to ] || cp [-a] from to`). */
+export interface DockerSeedCopy {
+    from: string;
+    to: string;
+    /** `cp -a` for whole-directory credential seeds (gemini/gcloud/opencode). */
+    recursive?: boolean;
+}
+export interface DockerClaudeArtifacts {
+    /** Bind mounts to add: the shared `projects/` transcripts (RW) + read-only seed files. */
+    mounts: DockerMount[];
+    /** Files copied into the container's writable HOME/.claude (+ HOME/.claude.json) at launch. */
+    seedCopies: DockerSeedCopy[];
+}
+/**
+ * Resolve the ISOLATED Claude artifacts for a docker session (replaces the old
+ * whole-`~/.claude` RW mount that polluted the host). Shares ONLY what must cross
+ * the boundary and seeds the rest as writable copies:
+ *  - `~/.claude/projects` → RW dir mount (transcripts: host watchers + `--resume`).
+ *  - `~/.claude.json` → merged onboarding seed, copied to HOME (no re-auth/wizard).
+ *  - `~/.claude/.credentials.json` + `~/.claude/settings.json` → read-only seeds
+ *    copied into the container's own `~/.claude` (token + global prefs carry in;
+ *    the container refreshes its own copy and never writes back to the host).
+ * Everything else Claude writes (backups, tasks, teams, session-env, history) stays
+ * container-local. IO (reads host files, writes the merged `.claude.json` seed).
+ */
+export declare function resolveDockerClaudeArtifacts(home: string, containerName: string, workspacePath: string): DockerClaudeArtifacts;
+/**
+ * Resolve the ISOLATED codex/gemini/gcloud/opencode artifacts (replaces the old
+ * whole-dir RW mounts that let each in-container CLI write its refreshed tokens +
+ * session state back into the host). Every path is existsSync-gated (on most hosts
+ * only a subset exists). Pure-ish IO (no writes; just existence checks + mount specs).
+ */
+export declare function resolveDockerCredentialArtifacts(home?: string): DockerClaudeArtifacts;
+export interface DockerAvailability {
+    ok: boolean;
+    engine: DockerEngine;
+    rootless: boolean;
+    isDesktop: boolean;
+    cgroupV2: boolean;
+    /** Best-effort: are --memory/--cpus/--pids-limit actually enforced on this engine? */
+    capsEnforced: boolean;
+    error?: string;
+}
+/**
+ * Probe the container engine: server up, cgroup version, rootless, Desktop, and
+ * whether resource caps are enforceable. Auto-detects docker then podman when no
+ * engine is given. No-op canned value under VITEST.
+ */
+export declare function checkDockerAvailable(engine?: DockerEngine): Promise<DockerAvailability>;
+/** Is the base image present locally? (never triggers an auto-pull). */
+export declare function checkDockerImagePresent(engine: DockerEngine, image: string): Promise<boolean>;
+export interface EnsureImageResult {
+    ok: boolean;
+    /** true when this call actually ran a build (vs. the image already existing). */
+    built: boolean;
+    alreadyPresent: boolean;
+    error?: string;
+}
+/**
+ * Ensure the agent base image exists, BUILDING it locally on first use so a missing
+ * image is never a hard blocker (decision: "build locally on first use",
+ * docs/docker-cases-plan.md). Idempotent, concurrency-safe (one build per
+ * engine:image shared by concurrent callers), and a no-op under VITEST. Only the
+ * DEFAULT image is auto-built — we can never build a user's custom ref, and the
+ * `--pull=never` invariant forbids pulling. `onProgress` receives build output
+ * lines for SSE surfacing.
+ */
+export declare function ensureAgentBaseImage(engine: DockerEngine, image: string, opts?: {
+    onProgress?: (line: string) => void;
+    noCache?: boolean;
+}): Promise<EnsureImageResult>;
+export interface DockerTmuxCheckResult {
+    ok: boolean;
+    tmuxPath?: string;
+    /** Distinguishes "image missing" (build it) from "tmux missing in image" (rebuild it). */
+    imageMissing?: boolean;
+    error?: string;
+}
+/**
+ * Verify the base image is present AND contains tmux (a HARD prerequisite: the
+ * in-container tmux is what makes reconnect durable). Never triggers a pull
+ * (`--pull=never`). No-op under VITEST. Mirror of checkRemoteTmuxAvailable.
+ */
+export declare function checkDockerTmuxAvailable(docker: Pick<SessionDocker, 'engine' | 'image'>): Promise<DockerTmuxCheckResult>;
+/**
+ * Resolve the host's IP on the default docker bridge (the address a container
+ * reaches as `host.docker.internal`), so the server can bind a hooks-only listener
+ * there and in-container hooks can call back. Defaults to the conventional
+ * 172.17.0.1 when the inspect fails but docker is up; null when docker is absent.
+ * No-op canned value under VITEST.
+ */
+export declare function detectDockerBridgeGateway(engine?: DockerEngine): Promise<string | null>;
+/**
+ * Instance-scoped boot reaper: `docker rm -f` any MANAGED container that belongs
+ * to THIS instance (by the `codeman.instance` label) but whose case is no longer
+ * in `docker-cases.json`. The instance scoping is what stops a beta from reaping
+ * prod's containers (the cross-instance hazard). No-op under VITEST. Best-effort.
+ */
+export declare function reapOrphanedDockerContainers(configDir: string, instance: string, engine?: DockerEngine): Promise<string[]>;
+/**
+ * Read the IN-CONTAINER Claude CLI version (`docker exec <container> claude
+ * --version`). Feeds Session.cliVersion for docker sessions (the LOCAL claude
+ * would report the wrong version and disable trackpad wheel-forwarding, #154).
+ * Returns undefined on any failure. No-op under VITEST.
+ */
+export declare function probeDockerCliVersion(docker: Pick<SessionDocker, 'engine' | 'containerName'>, mode: SessionMode): Promise<string | undefined>;
+//# sourceMappingURL=docker-hosts.d.ts.map

package/dist/docker-hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-hosts.d.ts","sourceRoot":"","sources":["../src/docker-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,UAAU,EAEV,oBAAoB,EACpB,aAAa,EACb,WAAW,EACZ,MAAM,YAAY,CAAC;AAUpB,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAO5C,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,EAAE,oBAKtC,CAAC;AAIF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzD;AAiBD,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE9E;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5F;AAID,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAUrE;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtG,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAW/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CACV,aAAa,EACX,QAAQ,GACR,OAAO,GACP,kBAAkB,GAClB,SAAS,GACT,aAAa,GACb,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,iBAAiB,CACpB,GACA,MAAM,CAaR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,aAAa,CAyBvF;AAID;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAID,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oFAAoF;IACpF,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAChC,+DAA+D;IAC/D,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,sHAAsH;IACtH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,+GAA+G;IAC/G,cAAc,EAAE,OAAO,CAAC;IACxB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC,GAAG,MAAM,EAAE,CAK9G;AAyBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAmExE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,MAAM,EAAE,CAEpH;AAID,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,wBAA8B,CAAC;AAChE,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,6BAAmC,CAAC;AACjE,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,0CAAgD,CAAC;AAQ9E;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,aAAa,EAAE,MAAM,EACrB,KAAK,SAAS,GACb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,MAAkB,EACxB,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,GACrB,WAAW,GAAG,IAAI,CAgBpB;AAED;wCACwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,+FAA+F;IAC/F,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAkCvB;AA8BD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,GAAE,MAAkB,GAAG,qBAAqB,CAgChG;AAID,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqCD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyB7F;AAED,wEAAwE;AACxE,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUnG;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AA2CD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,GAAE,YAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcvG;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,YAAuB,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAyCnB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,eAAe,CAAC,EACvD,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa7B"}