anyray-connect 0.11.39 → 0.11.40

package/dist/commands/agent.js

@@ -1,347 +0,0 @@
-/**
- * `anyray-connect agent <install|start|stop|status|uninstall>` — the
- * device-capture agent lifecycle (RFC 0002 / 0002a).
- *
- * This is Tier 2 capture: for apps `connect` can't redirect (ChatGPT desktop,
- * Claude desktop, Copilot, browsers) it installs a local intercepting proxy + a
- * device-trusted CA that MITMs ONLY the AI-domain allowlist and forwards to the
- * org gateway. Everything else is tunneled, never decrypted.
- *
- * Orchestration only — the real work lives in the modules (agentCa, agentTrust,
- * agentService, agentProxy). Best-effort + fail-open: a failed step is reported,
- * never left in a half-broken state that traps the machine offline.
- */
-import { platform } from 'node:os';
-import { loadProfile, saveProfile } from '../util/persist.js';
-import { bold, cyan, dim, fail, heading, info, ok, warn, } from '../util/log.js';
-import { caCertPath, DEFAULT_AGENT_PORT } from '../util/agentPaths.js';
-import { gatewayAllowlistHosts, AI_ALLOWLIST, } from '../util/agentAllowlist.js';
-import { ensureCa, removeCa, isOpensslAvailable } from '../util/agentCa.js';
-import { installTrust, uninstallTrust, enableSystemProxy, restoreSystemProxy, readProxyState, } from '../util/agentTrust.js';
-import { installAgentService, uninstallAgentService, probeAgentHealth, } from '../util/agentService.js';
-import { isSafeGatewayOrigin } from './agentProxy.js';
-const AGENT_HELP = `${bold('anyray-connect agent')} — capture AI usage from desktop & browser apps
-
-Installs a local intercepting proxy + a device-trusted CA that meters ONLY
-AI-provider domains (ChatGPT, Claude, Copilot, OpenAI, Anthropic) through your
-gateway. All other traffic is tunneled, never decrypted.
-
-${bold('Subcommands')}
-  install     Generate the device CA, trust it, install the proxy service, and
-              point the system proxy at it. Asks once for admin (CA trust).
-  status      Show whether the agent is running + which domains it intercepts.
-  stop        Pause: remove the system-proxy setting + the service (keeps the CA).
-  start       Resume a stopped agent.
-  uninstall   Full teardown: restore the system proxy, untrust + delete the CA,
-              remove the service.
-  repair      With sudo only: remove a legacy root-scoped install left by
-              versions 0.11.33–0.11.35. Does not install an agent.
-
-${bold('Notes')}
-  Run \`anyray-connect --enroll <link>\` (or a plain connect) FIRST so the agent
-  knows your gateway + identity. The gateway must allowlist the AI domains via
-  ANYRAY_CUSTOM_HOST_ALLOWLIST (see the agent docs).
-  Run lifecycle commands as your normal user. Use \`sudo ... agent repair\` only
-  to clean up a legacy root-scoped install.`;
-const printInterceptDomains = () => {
-    heading('Intercepted domains (only these are decrypted)');
-    for (const entry of AI_ALLOWLIST) {
-        const host = entry.suffix ? `${entry.host} (+ subdomains)` : entry.host;
-        info(`  ${cyan(host)} ${dim(`→ ${entry.app}`)}`);
-    }
-    info(dim('  Everything else is tunneled byte-for-byte, never decrypted.'));
-};
-const requireGateway = async () => {
-    const profile = await loadProfile();
-    if (!profile.gateway) {
-        fail('No gateway configured.');
-        info(dim('  Run `anyray-connect --enroll <link>` (or `anyray-connect <gateway-url>`) first,\n' +
-            '  so the agent knows where to meter and who you are.'));
-        return null;
-    }
-    // The agent forwards DECRYPTED prompts + the app's session token to the
-    // gateway — a plaintext remote gateway would leak both on the wire. Refuse it
-    // (unlike plain connect, which only warns) since a capture agent decrypts.
-    if (!isSafeGatewayOrigin(profile.gateway)) {
-        fail(`Refusing a plaintext gateway for capture: ${profile.gateway}`);
-        info(dim('  The agent forwards decrypted traffic + your session token — use an\n' +
-            '  https:// gateway (or a loopback address) so nothing crosses the network in the clear.'));
-        return null;
-    }
-    return profile.gateway;
-};
-/**
- * Install the service, point the system proxy at it, and confirm it answers.
- * The proxy is enabled ONLY once the service is installed, and reverted if the
- * daemon never comes up — so `install`/`start` can never leave the machine
- * pointed at a dead listener while reporting success (fail-open).
- */
-const bringUpProxy = async (port, gateway) => {
-    heading('Proxy service');
-    const svc = await installAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    if (!svc.ok) {
-        fail('  Could not install the agent service — not enabling the system proxy.');
-        return false;
-    }
-    heading('System proxy');
-    const proxied = await enableSystemProxy(port);
-    for (const m of proxied.messages)
-        info(`  ${m}`);
-    if (!proxied.ok) {
-        warn('  System proxy setup was incomplete — reverting it so you stay online.');
-        const restored = await restoreSystemProxy(port);
-        for (const m of restored.messages)
-            info(`  ${m}`);
-        await uninstallAgentService();
-        return false;
-    }
-    heading('Health');
-    let health = null;
-    for (let i = 0; i < 15 && !health; i++) {
-        health = await probeAgentHealth(port);
-        if (!health)
-            await sleep(400);
-    }
-    if (health) {
-        ok(`  Agent running on 127.0.0.1:${port} → ${gateway}.`);
-        return true;
-    }
-    // Never leave the system proxy pointing at a daemon that won't answer.
-    warn('  Agent did not come up — reverting the system proxy so you stay online.');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    await uninstallAgentService();
-    info(dim('  Check the service logs, then re-run `anyray-connect agent install`.'));
-    return false;
-};
-const preflight = () => {
-    if (platform() !== 'darwin') {
-        fail('The device-capture agent is macOS-only in this phase.');
-        info(dim('  Windows/Linux support is planned (RFC 0002a §7). On other platforms,\n' +
-            '  use `anyray-connect` to redirect the tools that support a base URL.'));
-        return false;
-    }
-    if (!isOpensslAvailable()) {
-        fail('`openssl` was not found on PATH — it is required to mint the device CA.');
-        return false;
-    }
-    return true;
-};
-const runInstall = async () => {
-    if (!preflight())
-        return 1;
-    const gateway = await requireGateway();
-    if (!gateway)
-        return 1;
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    info(bold('Installing the Anyray device-capture agent'));
-    printInterceptDomains();
-    // 1. Device CA.
-    heading('Device CA');
-    try {
-        await ensureCa();
-        ok(`  CA ready (${caCertPath()}).`);
-    }
-    catch (error) {
-        fail(`  Could not create the device CA: ${msg(error)}`);
-        return 1;
-    }
-    // 2. Trust the CA (the one admin prompt).
-    heading('Trusting the CA');
-    info(dim('  macOS will ask for your password once — trusting a root CA is deliberate.'));
-    const trust = await installTrust(caCertPath());
-    for (const m of trust.messages)
-        info(`  ${m}`);
-    if (!trust.ok) {
-        warn('  CA trust did not complete — intercepted apps will reject the proxy until it does.');
-    }
-    // 3. Bring up the service + system proxy (guarded: proxy only enabled behind a
-    // healthy daemon, reverted if it never answers).
-    const up = await bringUpProxy(port, gateway);
-    if (!up)
-        return 1;
-    await saveProfile({ ...profile, agentEnabled: true, agentPort: port });
-    info('\nUninstall any time: ' + cyan('anyray-connect agent uninstall'));
-    return 0;
-};
-const runStatus = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Anyray device-capture agent');
-    info(`  Gateway:  ${profile.gateway ? cyan(profile.gateway) : dim('(not configured)')}`);
-    info(`  Enabled:  ${profile.agentEnabled ? cyan('yes') : dim('no')}`);
-    const health = await probeAgentHealth(port);
-    if (health)
-        ok(`  Running on 127.0.0.1:${port}.`);
-    else
-        warn(`  Not responding on 127.0.0.1:${port}.`);
-    if (platform() === 'darwin') {
-        const proxy = readProxyState();
-        if (proxy) {
-            const on = proxy.secureEnabled || proxy.webEnabled;
-            info(`  System proxy (${proxy.service}): ${on
-                ? cyan(`${proxy.secureHost ?? proxy.webHost}:${proxy.securePort ?? proxy.webPort}`)
-                : dim('off')}`);
-        }
-    }
-    printInterceptDomains();
-    heading('Gateway requirement');
-    info(dim('  The gateway must allowlist these hosts (ANYRAY_CUSTOM_HOST_ALLOWLIST):\n' +
-        '    ' +
-        gatewayAllowlistHosts().join(',')));
-    return 0;
-};
-const runStop = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Stopping the agent');
-    // Restore the system proxy FIRST so the machine is never left pointing at a
-    // dead daemon (fail-open).
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    if (!restored.ok) {
-        fail('  Proxy restoration was incomplete — the agent was left running for safety.');
-        return 1;
-    }
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await saveProfile({ ...profile, agentEnabled: false });
-    ok('  Agent stopped (the device CA is kept — `agent start` to resume).');
-    return 0;
-};
-const runStart = async () => {
-    if (!preflight())
-        return 1;
-    const gateway = await requireGateway();
-    if (!gateway)
-        return 1;
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Starting the agent');
-    const up = await bringUpProxy(port, gateway);
-    if (!up)
-        return 1;
-    await saveProfile({ ...profile, agentEnabled: true, agentPort: port });
-    return 0;
-};
-const runUninstall = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Uninstalling the agent');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    if (!restored.ok) {
-        fail('  Proxy restoration was incomplete — no agent or CA state was removed.');
-        return 1;
-    }
-    const untrust = await uninstallTrust(caCertPath());
-    for (const m of untrust.messages)
-        info(`  ${m}`);
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await removeCa();
-    await saveProfile({ ...profile, agentEnabled: false, agentPort: undefined });
-    ok('  Removed the agent, restored the system proxy, and deleted the device CA.');
-    return 0;
-};
-const runRepair = async () => {
-    if (platform() !== 'darwin') {
-        fail('The legacy agent repair is macOS-only.');
-        return 1;
-    }
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Repairing a legacy root-scoped agent install');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    const untrust = await uninstallTrust(caCertPath());
-    for (const m of untrust.messages)
-        info(`  ${m}`);
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await removeCa();
-    await saveProfile({ ...profile, agentEnabled: false, agentPort: undefined });
-    if (!restored.ok || !untrust.ok || !svc.ok) {
-        fail('  Legacy cleanup was incomplete; fix the errors above and run repair again.');
-        return 1;
-    }
-    ok('  Removed legacy root-scoped agent state and disabled stale Anyray proxies.');
-    info(dim('  Reinstall as your normal user: anyray-connect agent install'));
-    return 0;
-};
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const msg = (error) => error instanceof Error ? error.message : String(error);
-/**
- * True when the CLI was launched via `sudo`. The capture agent is a strictly
- * PER-USER install — a LaunchAgent in the user's `gui/<uid>` domain, a CA
- * trusted in the login keychain, and the user's own network-service proxy — each
- * elevated through a macOS GUI auth prompt, never sudo. Under sudo
- * `process.getuid()` is 0 and `os.homedir()` is /var/root, so every artifact
- * would target root's domain and leave the real user session untouched: a `sudo
- * install` silently strands a stale daemon (the service lands in `gui/0`, which
- * has no Aqua session and never runs), and a `sudo stop`/`uninstall` can't
- * restore the user's proxy, trapping the machine offline. So the lifecycle
- * commands refuse every root context. `SUDO_UID` remains useful for diagnostics
- * and for identifying the legacy cleanup path.
- */
-export const isRunningUnderSudo = () => process.getuid?.() === 0 && !!process.env.SUDO_UID;
-export const isRunningAsRoot = () => process.getuid?.() === 0;
-const refuseRoot = (sub) => {
-    fail(`Run \`anyray-connect agent ${sub}\` as your normal user — not as root.`);
-    info(dim('  The capture agent is a per-user login service (a LaunchAgent, a\n' +
-        '  login-keychain CA, and your own network proxy). macOS prompts for your\n' +
-        "  password when it needs elevation; root instead puts everything in root's\n" +
-        '  domain and leaves your user session untouched.'));
-    info('  Re-run: ' + cyan(`anyray-connect agent ${sub}`));
-};
-/** Lifecycle subcommands that mutate per-user state and must never run as root. */
-const ROOT_GUARDED = new Set(['install', 'start', 'stop', 'uninstall']);
-export const shouldRefuseRootLifecycle = (sub) => ROOT_GUARDED.has(sub) && isRunningAsRoot();
-/** Entry point routed from cli.ts for the `agent` subcommand. */
-export const runAgent = async (argv) => {
-    const sub = argv[0];
-    if (sub && shouldRefuseRootLifecycle(sub)) {
-        refuseRoot(sub);
-        return 1;
-    }
-    if (sub === 'repair' && !isRunningAsRoot()) {
-        fail('`agent repair` is only for cleaning a legacy root-scoped install.');
-        info('  Use: ' + cyan('sudo anyray-connect agent repair'));
-        return 1;
-    }
-    switch (sub) {
-        case 'install':
-            return runInstall();
-        case 'status':
-            return runStatus();
-        case 'stop':
-            return runStop();
-        case 'start':
-            return runStart();
-        case 'uninstall':
-            return runUninstall();
-        case 'repair':
-            return runRepair();
-        case undefined:
-        case 'help':
-        case '--help':
-        case '-h':
-            info(AGENT_HELP);
-            return 0;
-        default:
-            fail(`unknown agent subcommand: ${sub}`);
-            info('\n' + AGENT_HELP);
-            return 1;
-    }
-};
-//# sourceMappingURL=agent.js.map

package/dist/commands/agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,EAEJ,EAAE,EACF,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC;;;;;;EAMhD,IAAI,CAAC,aAAa,CAAC;;;;;;;;;;;EAWnB,IAAI,CAAC,OAAO,CAAC;;;;;4CAK6B,CAAC;AAE7C,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;IACxD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CACF,GAAG,CACD,qFAAqF;YACnF,sDAAsD,CACzD,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,6CAA6C,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,CACF,GAAG,CACD,wEAAwE;YACtE,yFAAyF,CAC5F,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,IAAY,EACZ,OAAe,EACG,EAAE;IACpB,OAAO,CAAC,eAAe,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,qBAAqB,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,EAAE,CAAC,gCAAgC,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,GAAY,EAAE;IAC9B,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC9D,IAAI,CACF,GAAG,CACD,0EAA0E;YACxE,uEAAuE,CAC1E,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,IAAqB,EAAE;IAC7C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAErD,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC;IAExB,gBAAgB;IAChB,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,QAAQ,EAAE,CAAC;QACjB,EAAE,CAAC,eAAe,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,qCAAqC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0CAA0C;IAC1C,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC9F,CAAC;IAED,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAElB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACvC,IAAI,CAAC,eAAe,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,eAAe,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM;QAAE,EAAE,CAAC,0BAA0B,IAAI,GAAG,CAAC,CAAC;;QAC7C,IAAI,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAC;IAEpD,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;YACnD,IAAI,CACF,mBAAmB,KAAK,CAAC,OAAO,MAC9B,EAAE;gBACA,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnF,CAAC,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,qBAAqB,EAAE,CAAC;IAExB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC/B,IAAI,CACF,GAAG,CACD,4EAA4E;QAC1E,MAAM;QACN,qBAAqB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACpC,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;IAC1C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CACF,6EAA6E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,oEAAoE,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,IAAqB,EAAE;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;IAC/C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CACF,wEAAwE,CACzE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,4EAA4E,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IAC5C,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CACF,6EAA6E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,EAAE,CACA,6EAA6E,CAC9E,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAExC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAU,EAAE,CACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;AAEvE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAQ,EAAE;IACvC,IAAI,CAAC,8BAA8B,GAAG,uCAAuC,CAAC,CAAC;IAC/E,IAAI,CACF,GAAG,CACD,qEAAqE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,kDAAkD,CACrD,CACF,CAAC;IACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAW,EAAE,CAChE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAc,EAAmB,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,UAAU,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,OAAO,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,YAAY,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;QACX;YACE,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC,CAAC"}