botmux 3.15.0 → 3.16.0

package/dist/dashboard/preview-proxy.js

@@ -0,0 +1,543 @@
+import { PREVIEW_CONTENT_SEGMENT, PREVIEW_ROUTE_PREFIX, isPreviewLoopbackHost, isPreviewPort, safeSessionPreviewTarget, sessionPreviewContentPath, sessionPreviewPath, } from '../core/session-preview.js';
+import { requestLiteralLoopback } from '../core/loopback-target.js';
+import { PREVIEW_CONTENT_CAPABILITY_PATTERN } from './preview-content-capability.js';
+/** Dev servers commonly cold-compile their first response for 3–30 seconds.
+ * This bounds only the pre-header phase and is cleared once headers arrive. */
+export const PREVIEW_UPSTREAM_RESPONSE_TIMEOUT_MS = 45_000;
+const MAX_WEBSOCKET_REJECTION_BYTES = 64 * 1024;
+/**
+ * P1-2：一个 upgrade 请求收到非 101 回应时，那是一次**拒绝**，不是长连接。
+ *
+ * 代理把这段 body 攒完才写回浏览器（只有 `end` 才落笔），所以一个永不结束的
+ * 「拒绝」会同时钉死上游 socket 和浏览器 socket，而浏览器一个字节都收不到。
+ * 因此这条路必须两道时限都有：读完整段拒绝的**总时限**，以及静默多久算死的
+ * **idle 时限**——只有 idle 时限时，上游每 N 秒滴一个字节就能永久续命。
+ */
+export const PREVIEW_UPGRADE_REJECTION_TIMEOUT_MS = 15_000;
+export const PREVIEW_UPGRADE_REJECTION_IDLE_TIMEOUT_MS = 10_000;
+/**
+ * Sandbox flags forced onto every proxied preview document.
+ *
+ * `allow-same-origin` is deliberately absent: without it the document is an
+ * opaque origin, which is the whole point. It cannot read the dashboard DOM,
+ * cannot attach dashboard cookies to any request (an opaque origin has a null
+ * site-for-cookies, so even SameSite=Lax credentials stay home), and cannot
+ * touch same-origin storage. The same list is applied twice on purpose:
+ *
+ *   • as the iframe `sandbox` attribute in the guard shell, and
+ *   • as a `Content-Security-Policy: sandbox …` response header here,
+ *
+ * so agent-controlled HTML is opaque even when it is reached *without* the
+ * shell — a lured top-level navigation to a preview URL must not hand the
+ * agent a usable dashboard origin either.
+ *
+ * `allow-top-navigation` is absent so a preview can never navigate the
+ * dashboard away, and `allow-popups-to-escape-sandbox` is absent so popups
+ * the preview opens inherit the same opaque origin.
+ */
+export const PREVIEW_SANDBOX_TOKENS = 'allow-scripts allow-forms allow-popups';
+const PREVIEW_SANDBOX_CSP = `sandbox ${PREVIEW_SANDBOX_TOKENS}`;
+function safeDecodeSessionId(raw) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!decoded || decoded.length > 512 || /[\\/\0]/.test(decoded))
+        return undefined;
+    return decoded;
+}
+export function parseSessionPreviewRequest(url) {
+    if (url.pathname !== PREVIEW_ROUTE_PREFIX && !url.pathname.startsWith(`${PREVIEW_ROUTE_PREFIX}/`)) {
+        return { matched: false };
+    }
+    if (url.searchParams.has('t')) {
+        return { matched: true, ok: false, error: 'query_token_forbidden' };
+    }
+    const afterPrefix = url.pathname.slice(PREVIEW_ROUTE_PREFIX.length + 1);
+    const slash = afterPrefix.indexOf('/');
+    const rawSessionId = slash >= 0 ? afterPrefix.slice(0, slash) : afterPrefix;
+    const sessionId = safeDecodeSessionId(rawSessionId);
+    if (!sessionId)
+        return { matched: true, ok: false, error: 'invalid_preview_path' };
+    let rest = slash >= 0 ? afterPrefix.slice(slash) : '/';
+    let basePath = sessionPreviewPath(sessionId);
+    let contentCapability = null;
+    const contentPrefix = `/${PREVIEW_CONTENT_SEGMENT}/`;
+    if (rest === `/${PREVIEW_CONTENT_SEGMENT}` || rest.startsWith(contentPrefix)) {
+        // The reserved segment must be followed by a capability; a bare segment is
+        // a malformed URL rather than an unauthenticated one.
+        if (!rest.startsWith(contentPrefix)) {
+            return { matched: true, ok: false, error: 'invalid_preview_path' };
+        }
+        const afterSegment = rest.slice(contentPrefix.length);
+        const capabilitySlash = afterSegment.indexOf('/');
+        const capability = capabilitySlash >= 0 ? afterSegment.slice(0, capabilitySlash) : afterSegment;
+        if (!PREVIEW_CONTENT_CAPABILITY_PATTERN.test(capability)) {
+            return { matched: true, ok: false, error: 'invalid_preview_path' };
+        }
+        contentCapability = capability;
+        basePath = sessionPreviewContentPath(sessionId, capability);
+        rest = capabilitySlash >= 0 ? afterSegment.slice(capabilitySlash) : '/';
+    }
+    return {
+        matched: true,
+        ok: true,
+        sessionId,
+        upstreamPath: `${rest || '/'}${url.search}`,
+        basePath,
+        contentCapability,
+    };
+}
+function targetAuthority(target) {
+    return target.host === '::1' ? `[::1]:${target.port}` : `${target.host}:${target.port}`;
+}
+function targetOrigin(target) {
+    return `http://${targetAuthority(target)}`;
+}
+function isSensitiveRequestHeader(name) {
+    const lower = name.toLowerCase();
+    return lower === 'cookie'
+        || lower === 'authorization'
+        || lower === 'proxy-authorization'
+        || lower === 'referer'
+        || lower === 'forwarded'
+        || lower.startsWith('x-forwarded-')
+        || lower.startsWith('x-botmux-');
+}
+const HOP_BY_HOP_HEADERS = new Set([
+    'connection',
+    'proxy-connection',
+    'keep-alive',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+function connectionNominatedHeaders(value) {
+    const values = Array.isArray(value) ? value : value ? [value] : [];
+    return new Set(values.flatMap(item => item.split(',')).map(item => item.trim().toLowerCase()).filter(Boolean));
+}
+/** Never forward dashboard/browser credentials into agent-controlled preview
+ * servers. Host and Origin are rewritten to the literal loopback target so
+ * common dev servers can still perform their normal origin checks. */
+export function previewRequestHeaders(headers, target, options = {}) {
+    const out = {};
+    const nominated = connectionNominatedHeaders(headers.connection);
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (value === undefined || isSensitiveRequestHeader(name)
+            || HOP_BY_HOP_HEADERS.has(lower) || nominated.has(lower))
+            continue;
+        out[name] = value;
+    }
+    out.host = targetAuthority(target);
+    if (headers.origin !== undefined)
+        out.origin = targetOrigin(target);
+    if (options.upgrade && typeof headers.upgrade === 'string' && headers.upgrade) {
+        out.connection = 'Upgrade';
+        out.upgrade = headers.upgrade;
+    }
+    return out;
+}
+function localRedirectPath(location, target, basePath) {
+    // `basePath` already encodes whether this stream is the sandboxed content
+    // path or a bare preview path, so a rewritten redirect can never escape the
+    // mode it started in — in particular an app-issued `Location: /` cannot
+    // bounce the sandboxed frame back onto the outer guard shell.
+    if (location.startsWith('/'))
+        return `${basePath.slice(0, -1)}${location}`;
+    try {
+        const parsed = new URL(location);
+        const localHosts = new Set([
+            target.host,
+            target.host === '::1' ? '[::1]' : target.host,
+            'localhost',
+            '127.0.0.1',
+            '[::1]',
+        ]);
+        const effectivePort = parsed.port
+            || (parsed.protocol === 'http:' || parsed.protocol === 'ws:' ? '80' : '443');
+        if (['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol)
+            && localHosts.has(parsed.hostname)
+            && effectivePort === String(target.port)) {
+            return `${basePath.slice(0, -1)}${parsed.pathname}${parsed.search}${parsed.hash}`;
+        }
+        return location;
+    }
+    catch {
+        // Relative Location values are already scoped under the current preview path.
+    }
+    // Relative redirects resolve against the current preview prefix client-side.
+    return location;
+}
+/** CORS headers that let the opaque-origin document read its OWN dev server.
+ *
+ * Making the preview an opaque origin also makes every `fetch`/XHR it aims at
+ * its own dev server a cross-origin request, which would break essentially
+ * every real SPA. Echoing `null` back is safe precisely because the origin is
+ * not the credential here: the path-scoped capability is, and a request from
+ * any *real* web origin is refused with `preview_origin_forbidden` before it
+ * ever gets this far. Credentials are deliberately never allowed — an opaque
+ * origin has none to send, and `ACAO: null` plus credentials is the classic
+ * CORS footgun. */
+function applyOpaqueCors(out) {
+    out['access-control-allow-origin'] = 'null';
+    out['access-control-expose-headers'] = '*';
+    const vary = out.vary;
+    out.vary = vary === undefined
+        ? 'Origin'
+        : `${Array.isArray(vary) ? vary.join(', ') : String(vary)}, Origin`;
+}
+function previewResponseHeaders(headers, target, basePath, opaqueRequest) {
+    const out = {};
+    const nominated = connectionNominatedHeaders(headers.connection);
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        // A local app must not set/clear cookies or storage on the dashboard origin.
+        if (lower === 'set-cookie' || lower === 'clear-site-data'
+            || HOP_BY_HOP_HEADERS.has(lower) || nominated.has(lower))
+            continue;
+        // The dashboard decides the CORS answer for its own origin boundary; an
+        // app-supplied one would otherwise be duplicated or widened.
+        if (lower.startsWith('access-control-'))
+            continue;
+        if (lower === 'location' && typeof value === 'string') {
+            out[name] = localRedirectPath(value, target, basePath);
+            continue;
+        }
+        if (value !== undefined)
+            out[name] = value;
+    }
+    out['cache-control'] = 'no-store';
+    out['referrer-policy'] = 'no-referrer';
+    // Append rather than replace: multiple CSP headers intersect, so an app that
+    // ships its own policy keeps it AND gets the sandbox. Replacing would let an
+    // agent-chosen policy decide how strict the dashboard's boundary is.
+    const upstreamCsp = out['content-security-policy'];
+    out['content-security-policy'] = upstreamCsp === undefined
+        ? PREVIEW_SANDBOX_CSP
+        : [...(Array.isArray(upstreamCsp) ? upstreamCsp : [String(upstreamCsp)]), PREVIEW_SANDBOX_CSP];
+    if (opaqueRequest)
+        applyOpaqueCors(out);
+    return out;
+}
+function jsonError(res, status, error) {
+    res.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        'cache-control': 'no-store',
+    });
+    res.end(JSON.stringify({ ok: false, error }));
+}
+function socketError(socket, status, error) {
+    if (socket.destroyed)
+        return;
+    const body = JSON.stringify({ ok: false, error });
+    const reason = status === 400 ? 'Bad Request'
+        : status === 401 ? 'Unauthorized'
+            : status === 403 ? 'Forbidden'
+                : status === 404 ? 'Not Found'
+                    : status === 409 ? 'Conflict'
+                        : status === 501 ? 'Not Implemented'
+                            : status === 503 ? 'Service Unavailable'
+                                : 'Bad Gateway';
+    socket.end([
+        `HTTP/1.1 ${status} ${reason}`,
+        'content-type: application/json; charset=utf-8',
+        'cache-control: no-store',
+        'connection: close',
+        `content-length: ${Buffer.byteLength(body)}`,
+        '',
+        body,
+    ].join('\r\n'));
+}
+export function createSessionPreviewProxy(options) {
+    const authorizeAndResolve = (req, parsed) => {
+        if (parsed.contentCapability !== null) {
+            // Requests issued *by* the opaque-origin document carry `Origin: null`
+            // (fetch/WebSocket) or no Origin at all (navigations, no-cors
+            // subresources). A real web origin presenting a leaked capability is an
+            // attacker replaying it from a page context, so refuse it outright.
+            const origin = req.headers.origin;
+            if (origin !== undefined && origin !== 'null') {
+                return { ok: false, status: 403, error: 'preview_origin_forbidden' };
+            }
+            if (!options.verifyContentCapability(parsed.contentCapability, parsed.sessionId)) {
+                return { ok: false, status: 401, error: 'preview_capability_invalid' };
+            }
+        }
+        else if (!options.authenticated(req)) {
+            return { ok: false, status: 401, error: 'authentication_required' };
+        }
+        const resolution = options.resolve(parsed.sessionId);
+        if (!resolution.ok)
+            return resolution;
+        if (!isPreviewLoopbackHost(resolution.target.host)) {
+            return { ok: false, status: 403, error: 'remote_host_forbidden' };
+        }
+        if (!isPreviewPort(resolution.target.port)) {
+            return { ok: false, status: 409, error: 'invalid_preview_target' };
+        }
+        const target = safeSessionPreviewTarget(resolution.target);
+        if (!target)
+            return { ok: false, status: 409, error: 'invalid_preview_target' };
+        return { ok: true, target };
+    };
+    const handleHttp = async (req, res, url) => {
+        const parsed = parseSessionPreviewRequest(url);
+        if (!parsed.matched)
+            return false;
+        if (!parsed.ok) {
+            jsonError(res, 400, parsed.error);
+            return true;
+        }
+        const resolved = authorizeAndResolve(req, parsed);
+        if (!resolved.ok) {
+            jsonError(res, resolved.status, resolved.error);
+            return true;
+        }
+        const target = resolved.target;
+        const opaqueRequest = parsed.contentCapability !== null && req.headers.origin === 'null';
+        // Answer the preflight here rather than forwarding it: the capability in
+        // the path is what authorises this stream, so a dev server that never
+        // implemented OPTIONS must not be the reason its own SPA cannot call it.
+        if (opaqueRequest && req.method === 'OPTIONS' && req.headers['access-control-request-method'] !== undefined) {
+            const preflight = {
+                'access-control-allow-methods': '*',
+                'access-control-allow-headers': typeof req.headers['access-control-request-headers'] === 'string'
+                    ? req.headers['access-control-request-headers']
+                    : '*',
+                'access-control-max-age': '600',
+                'cache-control': 'no-store',
+                'referrer-policy': 'no-referrer',
+                'content-length': '0',
+            };
+            applyOpaqueCors(preflight);
+            res.writeHead(204, preflight);
+            res.end();
+            return true;
+        }
+        const upstream = requestLiteralLoopback(target, {
+            method: req.method,
+            path: parsed.upstreamPath,
+            headers: previewRequestHeaders(req.headers, target),
+        }, (up) => {
+            // The timeout bounds the connect/header phase, not long-running preview
+            // responses such as SSE. Once headers arrive, ordinary HTTP semantics win.
+            upstream.setTimeout(0);
+            // P1-8：上游 headers 到了才登记——此刻才确定这是一条真的在流的响应（预览页
+            // 常见的 SSE / 长轮询都在这条路上）。短响应会立刻 close 并自行注销。
+            // P1-4：登记在**我们自己写 headers 之前**，于是「重查存活 → 登记」是一个同步
+            // 动作；拨号期间被撤销的流在这里被拒，浏览器一个字节的预览内容都拿不到。
+            const bound = options.bindStream?.(req, { sessionId: parsed.sessionId, contentCapability: parsed.contentCapability, target }, () => { upstream.destroy(); res.destroy(); });
+            if (bound === false) {
+                upstream.destroy();
+                jsonError(res, 403, 'authentication_revoked');
+                return;
+            }
+            res.writeHead(up.statusCode ?? 502, previewResponseHeaders(up.headers, target, parsed.basePath, opaqueRequest));
+            // P1-2：浏览器断开时除了注销，还要把上游一起收掉。`bound` 只是索引里的注销
+            // 闭包（一次 `Set.delete`），而 `up.pipe(res)` 在 dest 关闭时走的是 unpipe，
+            // **不会 destroy source**——两者都不关 socket。于是标签页一关，这条上游就永远
+            // 挂着：注销之后再没有任何撤销扫描能碰到它，也没有任何超时会回收它（headers
+            // 一到就把 45s 的前置超时拆掉了）。预览页常见的 SSE / 长轮询于是每关一次页面
+            // 漏一个 FD，且没有任何并发配额兜底。
+            res.on('close', () => {
+                bound?.();
+                // 正常收尾（响应已写完）时上游本就该自己结束，不必多此一举；只有客户端提前
+                // 断开才需要主动销毁。`ClientRequest.destroy()` 可重入，重复调用无副作用。
+                if (!res.writableEnded)
+                    upstream.destroy();
+            });
+            up.pipe(res);
+        });
+        let failed = false;
+        const fail = () => {
+            if (failed)
+                return;
+            failed = true;
+            if (!res.headersSent)
+                jsonError(res, 502, 'preview_unreachable');
+            else
+                res.end();
+        };
+        upstream.setTimeout(PREVIEW_UPSTREAM_RESPONSE_TIMEOUT_MS, () => upstream.destroy());
+        upstream.on('error', fail);
+        req.on('aborted', () => upstream.destroy());
+        req.pipe(upstream);
+        return true;
+    };
+    const handleUpgrade = (req, clientSocket, head) => {
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://localhost');
+        }
+        catch {
+            return false;
+        }
+        const parsed = parseSessionPreviewRequest(url);
+        if (!parsed.matched)
+            return false;
+        // Attach before validation/dial so a browser disconnect on every claimed
+        // 400/401/404/502 path is handled instead of becoming an uncaught process
+        // `error` event.
+        let upstreamRequest;
+        let bridgedSocket;
+        clientSocket.on('error', () => {
+            upstreamRequest?.destroy();
+            bridgedSocket?.destroy();
+            if (!clientSocket.destroyed)
+                clientSocket.destroy();
+        });
+        if (!parsed.ok) {
+            socketError(clientSocket, 400, parsed.error);
+            return true;
+        }
+        const resolved = authorizeAndResolve(req, parsed);
+        if (!resolved.ok) {
+            socketError(clientSocket, resolved.status, resolved.error);
+            return true;
+        }
+        const target = resolved.target;
+        let responded = false;
+        const upstream = requestLiteralLoopback(target, {
+            method: req.method,
+            path: parsed.upstreamPath,
+            headers: previewRequestHeaders(req.headers, target, { upgrade: true }),
+        });
+        upstreamRequest = upstream;
+        upstream.setTimeout(PREVIEW_UPSTREAM_RESPONSE_TIMEOUT_MS, () => upstream.destroy());
+        upstream.on('upgrade', (upRes, upstreamSocket, upstreamHead) => {
+            responded = true;
+            bridgedSocket = upstreamSocket;
+            upstream.setTimeout(0);
+            upstreamSocket.setTimeout(0);
+            // P1-8：预览 WebSocket 是最典型的「握手一次、流很久」——登出后不主动关，
+            // 它就一直把 agent 页面的内容送给已经登出的浏览器。
+            // P1-4：登记必须发生在转发 101 **之前**。授权是拨号前那一刻的快照，dev
+            // server 的握手可以慢到 45 秒；这段窗口里发生的登出扫描看不到这条还没入索引
+            // 的 socket，先回 101 再补登记就等于把它挂到一个已死的认证会话上。
+            const bound = options.bindStream?.(req, { sessionId: parsed.sessionId, contentCapability: parsed.contentCapability, target }, () => { upstreamSocket.destroy(); clientSocket.destroy(); });
+            if (bound === false) {
+                upstreamSocket.destroy();
+                socketError(clientSocket, 403, 'authentication_revoked');
+                return;
+            }
+            const unbind = bound ?? null;
+            const lines = [`HTTP/1.1 ${upRes.statusCode ?? 101} ${upRes.statusMessage ?? 'Switching Protocols'}`];
+            const raw = upRes.rawHeaders;
+            for (let i = 0; i + 1 < raw.length; i += 2) {
+                const name = raw[i].toLowerCase();
+                if (name === 'set-cookie' || name === 'clear-site-data')
+                    continue;
+                lines.push(`${raw[i]}: ${raw[i + 1]}`);
+            }
+            lines.push('', '');
+            clientSocket.write(lines.join('\r\n'));
+            if (upstreamHead.length)
+                clientSocket.write(upstreamHead);
+            if (head.length)
+                upstreamSocket.write(head);
+            upstreamSocket.pipe(clientSocket);
+            clientSocket.pipe(upstreamSocket);
+            const cleanup = () => {
+                unbind?.();
+                upstreamSocket.destroy();
+                clientSocket.destroy();
+            };
+            upstreamSocket.on('error', cleanup);
+            upstreamSocket.on('close', () => { unbind?.(); clientSocket.destroy(); });
+            clientSocket.on('close', () => { unbind?.(); upstreamSocket.destroy(); });
+        });
+        upstream.on('response', (upRes) => {
+            responded = true;
+            // P1-2：不要无条件 `setTimeout(0)`。这不是一条长响应，而是一段等着被读完的
+            // 拒绝说明；清掉唯一那道计时器后，一个不结束 body 的上游就能把两条 socket
+            // 一起挂死（浏览器还收不到任何字节，因为 body 只在 'end' 时才写回）。
+            let settled = false;
+            let totalTimer;
+            const disarm = () => {
+                settled = true;
+                if (totalTimer)
+                    clearTimeout(totalTimer);
+                totalTimer = undefined;
+            };
+            const abandon = () => {
+                if (settled)
+                    return;
+                disarm();
+                upRes.destroy();
+                upstream.destroy();
+                clientSocket.destroy();
+            };
+            upstream.setTimeout(PREVIEW_UPGRADE_REJECTION_IDLE_TIMEOUT_MS, abandon);
+            totalTimer = setTimeout(abandon, PREVIEW_UPGRADE_REJECTION_TIMEOUT_MS);
+            totalTimer.unref?.();
+            // 客户端先走时同样要回收上游：这条路上没有 pipe，只有攒 body，没人替我们关。
+            // 升级请求的 socket 被 http server 摘掉 data 监听后是暂停态，且 http server
+            // 建的 socket 是 allowHalfOpen——不 `resume()` 就收不到 FIN，收到了也不会自动
+            // 关。升级已经被拒，客户端 FIN 就等于它走了，没有后半程要等。
+            clientSocket.on('close', abandon);
+            clientSocket.on('end', abandon);
+            clientSocket.resume();
+            const bodyChunks = [];
+            let bodyBytes = 0;
+            upRes.on('data', chunk => {
+                if (settled)
+                    return;
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                bodyBytes += buffer.byteLength;
+                if (bodyBytes > MAX_WEBSOCKET_REJECTION_BYTES) {
+                    abandon();
+                    return;
+                }
+                bodyChunks.push(buffer);
+            });
+            upRes.on('end', () => {
+                if (settled)
+                    return;
+                disarm();
+                upstream.setTimeout(0);
+                const body = Buffer.concat(bodyChunks);
+                const lines = [
+                    `HTTP/1.1 ${upRes.statusCode ?? 502} ${upRes.statusMessage ?? 'Bad Gateway'}`,
+                    'connection: close',
+                    'cache-control: no-store',
+                    `content-length: ${body.byteLength}`,
+                ];
+                for (const [name, value] of Object.entries(upRes.headers)) {
+                    const lower = name.toLowerCase();
+                    if (value === undefined
+                        || lower === 'connection'
+                        || lower === 'content-length'
+                        || lower === 'transfer-encoding'
+                        || lower === 'set-cookie'
+                        || lower === 'clear-site-data'
+                        || lower === 'cache-control')
+                        continue;
+                    const values = Array.isArray(value) ? value : [value];
+                    for (const item of values)
+                        lines.push(`${name}: ${item}`);
+                }
+                lines.push('', '');
+                clientSocket.write(lines.join('\r\n'));
+                if (body.length)
+                    clientSocket.write(body);
+                clientSocket.end();
+            });
+            upRes.on('error', () => { disarm(); clientSocket.destroy(); });
+        });
+        upstream.on('error', () => {
+            if (!responded)
+                socketError(clientSocket, 502, 'preview_unreachable');
+            else
+                clientSocket.destroy();
+        });
+        upstream.end();
+        return true;
+    };
+    return { handleHttp, handleUpgrade };
+}
+//# sourceMappingURL=preview-proxy.js.map

package/dist/dashboard/preview-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-proxy.js","sourceRoot":"","sources":["../../src/dashboard/preview-proxy.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,kCAAkC,EAAE,MAAM,iCAAiC,CAAC;AAGrF;+EAC+E;AAC/E,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAC3D,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAC3D,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAC/E,MAAM,mBAAmB,GAAG,WAAW,sBAAsB,EAAE,CAAC;AAoEhE,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACtE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAQ;IACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5E,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACnF,IAAI,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,IAAI,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,uBAAuB,GAAG,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,uBAAuB,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7E,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAChG,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QACrE,CAAC;QACD,iBAAiB,GAAG,UAAU,CAAC;QAC/B,QAAQ,GAAG,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,GAAG,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,IAAI;QACR,SAAS;QACT,YAAY,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE;QAC3C,QAAQ;QACR,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAA4B;IACnD,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,MAA4B;IAChD,OAAO,UAAU,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,KAAK,QAAQ;WACpB,KAAK,KAAK,eAAe;WACzB,KAAK,KAAK,qBAAqB;WAC/B,KAAK,KAAK,SAAS;WACnB,KAAK,KAAK,WAAW;WACrB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;WAChC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,0BAA0B,CAAC,KAAoC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACjH,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,MAA4B,EAC5B,UAAiC,EAAE;IAEnC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC;eACpD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9E,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;QAC3B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,MAA4B,EAC5B,QAAgB;IAEhB,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;YACzB,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;YAC7C,WAAW;YACX,WAAW;YACX,OAAO;SACR,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI;eAC5B,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/E,IACE,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;eACzD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC/B,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EACxC,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;IACD,6EAA6E;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;mBASmB;AACnB,SAAS,eAAe,CAAC,GAAwB;IAC/C,GAAG,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC;IAC5C,GAAG,CAAC,+BAA+B,CAAC,GAAG,GAAG,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,GAAG,CAAC,IAAI,GAAG,IAAI,KAAK,SAAS;QAC3B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA4B,EAC5B,MAA4B,EAC5B,QAAgB,EAChB,aAAsB;IAEtB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,6EAA6E;QAC7E,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,iBAAiB;eACpD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IACD,GAAG,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC;IAClC,GAAG,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC;IACvC,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,WAAW,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAClD,GAAyC,CAAC,yBAAyB,CAAC,GAAG,WAAW,KAAK,SAAS;QAC/F,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACjG,IAAI,aAAa;QAAE,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAa;IACnE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;IAChE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa;QAC3C,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc;YACjC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW;gBAC9B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW;oBAC9B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU;wBAC7B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB;4BACpC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB;gCACxC,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC;QACT,YAAY,MAAM,IAAI,MAAM,EAAE;QAC9B,+CAA+C;QAC/C,yBAAyB;QACzB,mBAAmB;QACnB,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QAC5C,EAAE;QACF,IAAI;KACL,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAI3E,MAAM,mBAAmB,GAAG,CAC1B,GAAoB,EACpB,MAA+D,EAGhB,EAAE;QACjD,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACtC,uEAAuE;YACvE,8DAA8D;YAC9D,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAoB,EAAE;QACjG,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACzF,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5G,MAAM,SAAS,GAAwB;gBACrC,8BAA8B,EAAE,GAAG;gBACnC,8BAA8B,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,KAAK,QAAQ;oBAC/F,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC;oBAC/C,CAAC,CAAC,GAAG;gBACP,wBAAwB,EAAE,KAAK;gBAC/B,eAAe,EAAE,UAAU;gBAC3B,iBAAiB,EAAE,aAAa;gBAChC,gBAAgB,EAAE,GAAG;aACtB,CAAC;YACF,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE;YAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;SACpD,EAAE,CAAC,EAAE,EAAE,EAAE;YACR,wEAAwE;YACxE,2EAA2E;YAC3E,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvB,8CAA8C;YAC9C,2CAA2C;YAC3C,kDAAkD;YAClD,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAChC,GAAG,EACH,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,EACpF,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAC7C,CAAC;YACF,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CACX,EAAE,CAAC,UAAU,IAAI,GAAG,EACpB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAC3E,CAAC;YACF,6CAA6C;YAC7C,6DAA6D;YAC7D,sDAAsD;YACtD,2CAA2C;YAC3C,8CAA8C;YAC9C,sBAAsB;YACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,KAAK,EAAE,EAAE,CAAC;gBACV,uCAAuC;gBACvC,oDAAoD;gBACpD,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;;gBAC5D,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,oCAAoC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,YAAoB,EAAE,IAAY,EAAW,EAAE;QAC1F,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACvB,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,yEAAyE;QACzE,0EAA0E;QAC1E,iBAAiB;QACjB,IAAI,eAAsE,CAAC;QAC3E,IAAI,aAAiC,CAAC;QACtC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC5B,eAAe,EAAE,OAAO,EAAE,CAAC;YAC3B,aAAa,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,CAAC,SAAS;gBAAE,YAAY,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE;YAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,eAAe,GAAG,QAAQ,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,oCAAoC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE;YAC7D,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,GAAG,cAAc,CAAC;YAC/B,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvB,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,8CAA8C;YAC9C,+BAA+B;YAC/B,6CAA6C;YAC7C,6CAA6C;YAC7C,yCAAyC;YACzC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAChC,GAAG,EACH,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,EACpF,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAC5D,CAAC;YACF,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,cAAc,CAAC,OAAO,EAAE,CAAC;gBACzB,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC;YAC7B,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,qBAAqB,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,iBAAiB;oBAAE,SAAS;gBAClE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,IAAI,YAAY,CAAC,MAAM;gBAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM;gBAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,MAAM,EAAE,EAAE,CAAC;gBACX,cAAc,CAAC,OAAO,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,SAAS,GAAG,IAAI,CAAC;YACjB,iDAAiD;YACjD,6CAA6C;YAC7C,2CAA2C;YAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAqD,CAAC;YAC1D,MAAM,MAAM,GAAG,GAAS,EAAE;gBACxB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzC,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,EAAE,CAAC;gBACT,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,yCAAyC,EAAE,OAAO,CAAC,CAAC;YACxE,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YACvE,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,6CAA6C;YAC7C,2DAA2D;YAC3D,4DAA4D;YAC5D,mCAAmC;YACnC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChC,YAAY,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACvB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnE,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;gBAC/B,IAAI,SAAS,GAAG,6BAA6B,EAAE,CAAC;oBAC9C,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACnB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,EAAE,CAAC;gBACT,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG;oBACZ,YAAY,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,EAAE;oBAC7E,mBAAmB;oBACnB,yBAAyB;oBACzB,mBAAmB,IAAI,CAAC,UAAU,EAAE;iBACrC,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjC,IACE,KAAK,KAAK,SAAS;2BAChB,KAAK,KAAK,YAAY;2BACtB,KAAK,KAAK,gBAAgB;2BAC1B,KAAK,KAAK,mBAAmB;2BAC7B,KAAK,KAAK,YAAY;2BACtB,KAAK,KAAK,iBAAiB;2BAC3B,KAAK,KAAK,eAAe;wBAC5B,SAAS;oBACX,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACtD,KAAK,MAAM,IAAI,IAAI,MAAM;wBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvC,IAAI,IAAI,CAAC,MAAM;oBAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,YAAY,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;;gBACjE,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC"}

package/dist/dashboard/public-redact.d.ts

@@ -14,6 +14,29 @@ export declare function redactGroupsForPublic(chats: unknown[]): unknown[];
  *  mutates the input. Name / timing / status fields are preserved so the
  *  read-only schedules view still renders. */
 export declare function redactSchedulesForPublic(schedules: unknown[]): unknown[];
+/** Who is receiving the session board.
+ *  - `management` — the local Dashboard owner cookie: full row, no projection.
+ *  - `workbench`  — an authenticated Feishu H5 / platform Workbench identity:
+ *                   display fields restored, bearer write credential still gone.
+ *  - `anonymous`  — a tokenless `publicReadOnly` visitor: full redaction. */
+export type SessionBoardAudience = 'management' | 'workbench' | 'anonymous';
+/** Map the two authentication facts dashboard.ts already computes per request
+ *  onto an audience. Exported so the judgement itself is unit-testable:
+ *  dashboard.ts starts an HTTP listener on import and cannot be loaded from a
+ *  test, which is how the H5 board silently regressed to the anonymous
+ *  projection in the first place. */
+export declare function sessionBoardAudienceFor(identity: {
+    /** Holds the local Dashboard management cookie (`legacy-dashboard`). */
+    legacyAuthed: boolean;
+    /** Holds an authenticated Feishu H5 or `platform-dashboard` identity. */
+    workbenchIdentity: boolean;
+}): SessionBoardAudience;
+/** Single entry point for `GET /api/sessions`. Never mutates the input, so the
+ *  aggregator's own rows stay intact for other audiences on the next request. */
+export declare function projectSessionsForAudience(sessions: unknown[], audience: SessionBoardAudience): unknown[];
+/** Single entry point for the `/events` SSE relay — same rule as the REST list,
+ *  or the REST-side projection would be trivially bypassed by subscribing. */
+export declare function projectSessionEventForAudience(type: string, body: unknown, audience: SessionBoardAudience): unknown;
 /** Branch names often carry issue/customer identifiers. `riffAccessUrl` is the
  * Riff AIO Sandbox **write** capability — a bearer URL whose unique subdomain is
  * itself the credential (riff-backend.ts:hashUrlForLog), so an anonymous read-only

package/dist/dashboard/public-redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-redact.d.ts","sourceRoot":"","sources":["../../src/dashboard/public-redact.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;yBASyB;AACzB,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAoBjE;AAED;;;8CAG8C;AAC9C,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAOxE;AA8BD;;;;;;;yCAOyC;AACzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAGtE;AAED,4EAA4E;AAC5E,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAkBhF;AAED;yBACyB;AACzB,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAKlE"}
+{"version":3,"file":"public-redact.d.ts","sourceRoot":"","sources":["../../src/dashboard/public-redact.ts"],"names":[],"mappings":"AA4BA;;;;;;;;;yBASyB;AACzB,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAoBjE;AAED;;;8CAG8C;AAC9C,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAOxE;AA2CD;;;;6EAI6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,CAAC;AAE5E;;;;qCAIqC;AACrC,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE;IAChD,wEAAwE;IACxE,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,oBAAoB,CAGvB;AAsDD;iFACiF;AACjF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,EAAE,CAIX;AAED;8EAC8E;AAC9E,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAIT;AAED;;;;;;;yCAOyC;AACzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAEtE;AAED,4EAA4E;AAC5E,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAEhF;AAED;yBACyB;AACzB,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAKlE"}