aicodeman 1.41.0 → 1.41.1

package/dist/html-view-capabilities.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview Capability tokens for rendering a local HTML file.
+ *
+ * `file-raw` never serves HTML as HTML: a page rendered from Codeman's own origin
+ * could read the Codeman document and drive the agent-spawning API. So an HTML
+ * file is rendered from `/html-view/:cap/*` instead, with a `Content-Security-
+ * Policy: sandbox` header that puts the document in an OPAQUE origin no matter how
+ * it is opened (iframe or top-level tab). That opaque origin is also why the route
+ * cannot authenticate on the session cookie: its subresource requests are
+ * cross-site, so the `SameSite=lax` cookie is never attached (the same reason the
+ * web-tab proxy uses capabilities, see webview-capabilities.ts).
+ *
+ * A capability is minted by an authenticated `POST /api/sessions/:id/html-view` and
+ * grants exactly one thing: GET access to the files in ONE directory (the HTML
+ * file's own), so a page's relative `style.css` / `chart.js` / images resolve.
+ *
+ * - 192 bits of `randomBytes` entropy, base64url.
+ * - Held in memory only. A restart invalidates every outstanding capability.
+ * - Rolling TTL, revoked on logout, admin logout and user deletion (`revokeOwner`).
+ */
+/** URL prefix the rendered files are served under. */
+export declare const HTML_VIEW_PREFIX = "/html-view";
+export interface HtmlViewCapabilityRecord {
+    /** Realpath of the directory the capability serves. */
+    rootDir: string;
+    /** Username that minted it (multi-user); undefined in single-user mode. */
+    owner?: string;
+    /**
+     * Whether the directory lies outside the minting session's workspace (admitted
+     * under the attachment guard). Recorded so the serving route can refuse it the
+     * moment workspace confinement is switched on, as the attachment routes do.
+     */
+    outsideWorkspace: boolean;
+    createdAt: number;
+}
+export declare class HtmlViewCapabilityStore {
+    private readonly capabilities;
+    /** Reverse index so re-opening a page reuses its capability instead of leaking one per click. */
+    private readonly byRoot;
+    constructor(ttlMs?: number);
+    /** Mint (or reuse) a capability for a directory. Returns the token. */
+    mint(rootDir: string, owner?: string, outsideWorkspace?: boolean): string;
+    /** Resolve a capability, refreshing its TTL. Returns undefined when unknown or expired. */
+    resolve(token: string): HtmlViewCapabilityRecord | undefined;
+    /** Revoke every capability bound to an identity (logout, admin logout, user deletion). */
+    revokeOwner(owner: string | undefined): number;
+    get size(): number;
+    dispose(): void;
+}
+/** The capability token in an `/html-view/<cap>/...` path, or null. */
+export declare function capabilityFromHtmlViewPath(pathname: string): string | null;
+/** Process-wide store, shared by the routes and the auth middleware (see webviewCapabilities). */
+export declare const htmlViewCapabilities: HtmlViewCapabilityStore;
+//# sourceMappingURL=html-view-capabilities.d.ts.map

package/dist/html-view-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-view-capabilities.d.ts","sourceRoot":"","sources":["../src/html-view-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuD;IACpF,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAExC,KAAK,GAAE,MAAkC;IAWrD,uEAAuE;IACvE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,MAAM;IAgBvE,2FAA2F;IAC3F,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IAK5D,0FAA0F;IAC1F,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAa9C,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,IAAI,IAAI;CAIhB;AAMD,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1E;AAED,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,yBAAgC,CAAC"}

package/dist/html-view-capabilities.js

@@ -0,0 +1,103 @@
+/**
+ * @fileoverview Capability tokens for rendering a local HTML file.
+ *
+ * `file-raw` never serves HTML as HTML: a page rendered from Codeman's own origin
+ * could read the Codeman document and drive the agent-spawning API. So an HTML
+ * file is rendered from `/html-view/:cap/*` instead, with a `Content-Security-
+ * Policy: sandbox` header that puts the document in an OPAQUE origin no matter how
+ * it is opened (iframe or top-level tab). That opaque origin is also why the route
+ * cannot authenticate on the session cookie: its subresource requests are
+ * cross-site, so the `SameSite=lax` cookie is never attached (the same reason the
+ * web-tab proxy uses capabilities, see webview-capabilities.ts).
+ *
+ * A capability is minted by an authenticated `POST /api/sessions/:id/html-view` and
+ * grants exactly one thing: GET access to the files in ONE directory (the HTML
+ * file's own), so a page's relative `style.css` / `chart.js` / images resolve.
+ *
+ * - 192 bits of `randomBytes` entropy, base64url.
+ * - Held in memory only. A restart invalidates every outstanding capability.
+ * - Rolling TTL, revoked on logout, admin logout and user deletion (`revokeOwner`).
+ */
+import { randomBytes } from 'node:crypto';
+import { StaleExpirationMap } from './utils/index.js';
+import { MAX_WEBVIEW_CAPABILITIES, WEBVIEW_CAPABILITY_TTL_MS } from './config/webview-limits.js';
+/** URL prefix the rendered files are served under. */
+export const HTML_VIEW_PREFIX = '/html-view';
+export class HtmlViewCapabilityStore {
+    capabilities;
+    /** Reverse index so re-opening a page reuses its capability instead of leaking one per click. */
+    byRoot = new Map();
+    constructor(ttlMs = WEBVIEW_CAPABILITY_TTL_MS) {
+        this.capabilities = new StaleExpirationMap({
+            ttlMs,
+            refreshOnGet: true,
+            onExpire: (token, record) => {
+                const key = rootKey(record.rootDir, record.owner, record.outsideWorkspace);
+                if (this.byRoot.get(key) === token)
+                    this.byRoot.delete(key);
+            },
+        });
+    }
+    /** Mint (or reuse) a capability for a directory. Returns the token. */
+    mint(rootDir, owner, outsideWorkspace = false) {
+        // The flag is part of the key: an out-of-workspace mint must never reuse a
+        // capability recorded as in-workspace, which confinement would not stop.
+        const key = rootKey(rootDir, owner, outsideWorkspace);
+        const existing = this.byRoot.get(key);
+        if (existing && this.capabilities.get(existing))
+            return existing;
+        if (existing)
+            this.byRoot.delete(key);
+        if (this.capabilities.size >= MAX_WEBVIEW_CAPABILITIES)
+            this.capabilities.cleanup();
+        const token = randomBytes(24).toString('base64url');
+        this.capabilities.set(token, { rootDir, owner, outsideWorkspace, createdAt: Date.now() });
+        this.byRoot.set(key, token);
+        return token;
+    }
+    /** Resolve a capability, refreshing its TTL. Returns undefined when unknown or expired. */
+    resolve(token) {
+        if (!token)
+            return undefined;
+        return this.capabilities.get(token);
+    }
+    /** Revoke every capability bound to an identity (logout, admin logout, user deletion). */
+    revokeOwner(owner) {
+        let revoked = 0;
+        for (const [key, token] of [...this.byRoot]) {
+            const record = this.capabilities.peek(token);
+            if (!record || record.owner === owner) {
+                this.capabilities.delete(token);
+                this.byRoot.delete(key);
+                if (record)
+                    revoked++;
+            }
+        }
+        return revoked;
+    }
+    get size() {
+        return this.capabilities.size;
+    }
+    dispose() {
+        this.capabilities.dispose();
+        this.byRoot.clear();
+    }
+}
+function rootKey(rootDir, owner, outsideWorkspace) {
+    return `${owner ?? ''}\0${outsideWorkspace ? 'out' : 'in'}\0${rootDir}`;
+}
+/** The capability token in an `/html-view/<cap>/...` path, or null. */
+export function capabilityFromHtmlViewPath(pathname) {
+    if (typeof pathname !== 'string')
+        return null;
+    const prefix = `${HTML_VIEW_PREFIX}/`;
+    if (!pathname.startsWith(prefix))
+        return null;
+    const rest = pathname.slice(prefix.length);
+    const slash = rest.indexOf('/');
+    const cap = slash === -1 ? rest : rest.slice(0, slash);
+    return /^[A-Za-z0-9_-]{16,128}$/.test(cap) ? cap : null;
+}
+/** Process-wide store, shared by the routes and the auth middleware (see webviewCapabilities). */
+export const htmlViewCapabilities = new HtmlViewCapabilityStore();
+//# sourceMappingURL=html-view-capabilities.js.map

package/dist/html-view-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-view-capabilities.js","sourceRoot":"","sources":["../src/html-view-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEjG,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAgB7C,MAAM,OAAO,uBAAuB;IACjB,YAAY,CAAuD;IACpF,iGAAiG;IAChF,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,QAAgB,yBAAyB;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAmC;YAC3E,KAAK;YACL,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC3E,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,OAAe,EAAE,KAAc,EAAE,gBAAgB,GAAG,KAAK;QAC5D,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACjE,IAAI,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,wBAAwB;YAAE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAEpF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2FAA2F;IAC3F,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAC1F,WAAW,CAAC,KAAyB;QACnC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,MAAM;oBAAE,OAAO,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,KAAyB,EAAE,gBAAyB;IACpF,OAAO,GAAG,KAAK,IAAI,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,gBAAgB,GAAG,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,uBAAuB,EAAE,CAAC"}

package/dist/mcp-server.d.ts

@@ -0,0 +1,114 @@
+import { type AgentContext, type ApiRequest } from './cli-agent.js';
+/** Revisions served with per-request `_meta` (no handshake). */
+export declare const MODERN_PROTOCOL_VERSIONS: readonly ["2026-07-28"];
+/** Revisions served after an `initialize` handshake, newest first. */
+export declare const LEGACY_PROTOCOL_VERSIONS: readonly ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+/** JSON-RPC error codes this server emits. */
+export declare const RPC_ERROR: {
+    readonly parse: -32700;
+    readonly invalidRequest: -32600;
+    readonly methodNotFound: -32601;
+    readonly invalidParams: -32602;
+    readonly internal: -32603;
+    readonly unsupportedProtocolVersion: -32022;
+};
+/** Default wait: under Codex's 60 s MCP tool timeout, so a default call never gets cut off. */
+export declare const DEFAULT_WAIT_MS = 45000;
+/** The server's own ceiling for one wait (`MAX_WAIT_MS` in config/agent-wait.ts). */
+export declare const MAX_WAIT_MS = 600000;
+/** Cap on text handed back to the model, so one read cannot flood its context. */
+export declare const MAX_OUTPUT_CHARS = 40000;
+export interface McpConfig {
+    /** Codeman server URL; undefined = not configured, and every tool says how to fix it. */
+    apiUrl?: string;
+    /** Why the URL given was refused, when one was given. */
+    urlError?: string;
+    /** This process's own session, when it runs inside a Codeman pane. */
+    selfId?: string;
+    auth?: AgentContext['auth'];
+    /** `--allow-any-session`: prompt, interrupt and delete sessions this server did not start. */
+    allowAnySession: boolean;
+    version: string;
+}
+/**
+ * Resolve the configuration from flags and the environment. Never guesses a URL: only
+ * `--url` or `CODEMAN_API_URL` set one. A session id counts only inside a Codeman pane
+ * (`CODEMAN_MUX=1`); a desktop client's environment has no session of its own.
+ */
+export declare function resolveMcpConfig(options: {
+    url?: string;
+    allowAnySession?: boolean;
+    version: string;
+}, env?: NodeJS.ProcessEnv, envFile?: () => Record<string, string>): McpConfig;
+export interface ToolDefinition {
+    name: string;
+    title: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    annotations: {
+        readOnlyHint: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint: boolean;
+    };
+}
+/**
+ * The tools, in a fixed order (the spec asks for deterministic `tools/list` output, which
+ * also keeps a client's prompt cache warm). `modes` are the run modes start_session
+ * offers, from the CLI registry.
+ */
+export declare function buildToolDefinitions(modes: readonly string[]): ToolDefinition[];
+/** Run modes start_session offers: every enabled registry entry, in registry order. */
+export declare function registryModes(): string[];
+export interface ToolResult {
+    text: string;
+    structured?: Record<string, unknown>;
+    isError?: boolean;
+}
+/** A refusal or failure the model can act on: becomes an `isError` result, never a JSON-RPC error. */
+export declare class ToolError extends Error {
+}
+export interface ToolRunnerDeps {
+    config: McpConfig;
+    request: ApiRequest;
+    /** Ids of sessions this process started: the default allowlist for prompting and deleting. */
+    started: Set<string>;
+    /** Exactly-once tag for this process's input (`seq` is the clock, kept strictly increasing). */
+    clientId: string;
+    now?: () => number;
+}
+export declare function createToolRunner(deps: ToolRunnerDeps): {
+    has(name: string): boolean;
+    run(name: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<ToolResult>;
+};
+export interface McpServerOptions {
+    config: McpConfig;
+    /** One JSON-RPC message out (a line on stdout in production). */
+    write: (message: Record<string, unknown>) => void;
+    log?: (line: string) => void;
+    request?: ApiRequest;
+    /** Run modes start_session offers; defaults to the registry's enabled entries. */
+    modes?: readonly string[];
+    now?: () => number;
+}
+/**
+ * The protocol core, transport-free so tests drive it message by message. Requests run
+ * concurrently (a long wait must not hold up a list), each answered once, by id.
+ */
+export declare function createMcpServer(options: McpServerOptions): {
+    /** One stdin line. Resolves when that message is fully handled. */
+    handleLine(line: string): Promise<void>;
+    /** Stop: abort every in-flight call and write nothing more. */
+    close(): void;
+    inflightCount(): number;
+};
+/**
+ * Serve MCP on this process's stdin/stdout until stdin closes (the client's shutdown
+ * signal), then abort whatever is still in flight.
+ */
+export declare function runMcpStdio(config: McpConfig, io?: {
+    stdin: NodeJS.ReadableStream;
+    stdout: NodeJS.WritableStream;
+    stderr: NodeJS.WritableStream;
+}): Promise<void>;
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/mcp-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAmCA,OAAO,EAUL,KAAK,YAAY,EACjB,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AASxB,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,yBAA0B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,mEAAoE,CAAC;AAM1G,8CAA8C;AAC9C,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,+FAA+F;AAC/F,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,qFAAqF;AACrF,eAAO,MAAM,WAAW,SAAU,CAAC;AACnC,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAwBvC,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5B,8FAA8F;IAC9F,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACrE,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAsB,GACzD,SAAS,CAuBX;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,EAAE;QACX,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAeD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAwK/E;AAED,uFAAuF;AACvF,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAIxC;AAMD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,sGAAsG;AACtG,qBAAa,SAAU,SAAQ,KAAK;CAAG;AAWvC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA0ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc;cAgXvC,MAAM,GAAG,OAAO;cAGV,MAAM,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;EASpG;AAeD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,SAAS,CAAC;IAClB,iEAAiE;IACjE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAClD,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,kFAAkF;IAClF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB;IAuIrD,mEAAmE;qBAC5C,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC7C,+DAA+D;aACtD,IAAI;qBAKI,MAAM;EAI1B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,SAAS,EACjB,EAAE,GAAE;IAAE,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAA;CAAY,GAC3G,OAAO,CAAC,IAAI,CAAC,CAkBf"}