botmux 3.3.0 → 3.4.0

package/dist/core/device-isolation-activation.d.ts

@@ -0,0 +1,56 @@
+export declare const DEVICE_ISOLATION_ACTIVATION_VERSION: 1;
+export declare const DEVICE_ISOLATION_FREEZE_LEASE_MS = 30000;
+export interface DeviceIsolationFreezeLease {
+    activationVersion: typeof DEVICE_ISOLATION_ACTIVATION_VERSION;
+    leaseId: string;
+    nonce: string;
+    inventoryGeneration: string;
+    acquiredAt: number;
+    expiresAt: number;
+}
+export declare function currentDeviceIsolationFreezeLease(now?: number): DeviceIsolationFreezeLease | null;
+export type AcquireDeviceIsolationFreezeResult = {
+    ok: true;
+    lease: DeviceIsolationFreezeLease;
+    reused: boolean;
+} | {
+    ok: false;
+    reason: 'busy';
+};
+export declare function acquireDeviceIsolationFreeze(input: {
+    nonce: string;
+    inventoryGeneration: string;
+    now?: number;
+    leaseMs?: number;
+    leaseIdFactory?: () => string;
+}): AcquireDeviceIsolationFreezeResult;
+export declare function requireDeviceIsolationFreeze(input: {
+    nonce: string;
+    leaseId: string;
+    now?: number;
+}): DeviceIsolationFreezeLease | null;
+/**
+ * Bind the post-freeze inventory to the lease. Prepare must acquire the spawn
+ * barrier before it looks at sessions; otherwise a worker can appear between
+ * inventory and freeze. Only the holder may replace the provisional value.
+ */
+export declare function bindDeviceIsolationFreezeInventoryGeneration(input: {
+    nonce: string;
+    leaseId: string;
+    inventoryGeneration: string;
+    now?: number;
+}): DeviceIsolationFreezeLease | null;
+export declare function releaseDeviceIsolationFreeze(input: {
+    nonce: string;
+    leaseId: string;
+    now?: number;
+}): boolean;
+/**
+ * Queue only the first spawn request for a logical session. Later turns are
+ * already retained by the session's normal pending-input machinery; replaying
+ * multiple fork requests would instead kill and replace the first new worker.
+ */
+export declare function deferWorkerSpawnDuringDeviceIsolation(sessionId: string, callback: () => void, now?: number): boolean;
+/** Test-only reset; production callers release through the lease protocol. */
+export declare function resetDeviceIsolationActivationForTest(): void;
+//# sourceMappingURL=device-isolation-activation.d.ts.map

package/dist/core/device-isolation-activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-isolation-activation.d.ts","sourceRoot":"","sources":["../../src/core/device-isolation-activation.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAC9D,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,EAAE,OAAO,mCAAmC,CAAC;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAyBD,wBAAgB,iCAAiC,CAC/C,GAAG,SAAa,GACf,0BAA0B,GAAG,IAAI,CAGnC;AAED,MAAM,MAAM,kCAAkC,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,0BAA0B,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B,GAAG,kCAAkC,CAuBrC;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,0BAA0B,GAAG,IAAI,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,0BAA0B,GAAG,IAAI,CAIpC;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAMV;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,IAAI,EACpB,GAAG,SAAa,GACf,OAAO,CAIT;AAED,8EAA8E;AAC9E,wBAAgB,qCAAqC,IAAI,IAAI,CAI5D"}

package/dist/core/device-isolation-activation.js

@@ -0,0 +1,110 @@
+/**
+ * Short-lived daemon barrier used while a host enables device credentials.
+ *
+ * The barrier is deliberately process-local: the host CLI acquires one lease
+ * from every online botmux daemon before it writes the one-way marker. While a
+ * lease is held, forkWorker queues at most one cold spawn per logical session;
+ * existing workers are inventoried and torn down by the authenticated daemon
+ * IPC route. A bounded lease prevents a crashed host CLI from wedging a daemon
+ * forever. No device secret is written until every daemon has committed and
+ * released its lease.
+ */
+import { randomUUID } from 'node:crypto';
+export const DEVICE_ISOLATION_ACTIVATION_VERSION = 1;
+export const DEVICE_ISOLATION_FREEZE_LEASE_MS = 30_000;
+let lease = null;
+let expiryTimer = null;
+const deferredSpawns = new Map();
+function clearExpiryTimer() {
+    if (!expiryTimer)
+        return;
+    clearTimeout(expiryTimer);
+    expiryTimer = null;
+}
+function flushDeferredSpawns() {
+    const callbacks = [...deferredSpawns.values()];
+    deferredSpawns.clear();
+    for (const callback of callbacks)
+        setImmediate(callback);
+}
+function expireIfNeeded(now = Date.now()) {
+    if (!lease || lease.expiresAt > now)
+        return;
+    lease = null;
+    clearExpiryTimer();
+    flushDeferredSpawns();
+}
+export function currentDeviceIsolationFreezeLease(now = Date.now()) {
+    expireIfNeeded(now);
+    return lease ? { ...lease } : null;
+}
+export function acquireDeviceIsolationFreeze(input) {
+    const now = input.now ?? Date.now();
+    expireIfNeeded(now);
+    if (lease) {
+        if (lease.nonce !== input.nonce)
+            return { ok: false, reason: 'busy' };
+        return { ok: true, lease: { ...lease }, reused: true };
+    }
+    const leaseMs = input.leaseMs ?? DEVICE_ISOLATION_FREEZE_LEASE_MS;
+    if (!Number.isSafeInteger(leaseMs) || leaseMs < 1_000 || leaseMs > 120_000) {
+        throw new Error('invalid device-isolation freeze lease');
+    }
+    lease = {
+        activationVersion: DEVICE_ISOLATION_ACTIVATION_VERSION,
+        leaseId: (input.leaseIdFactory ?? randomUUID)(),
+        nonce: input.nonce,
+        inventoryGeneration: input.inventoryGeneration,
+        acquiredAt: now,
+        expiresAt: now + leaseMs,
+    };
+    clearExpiryTimer();
+    expiryTimer = setTimeout(() => expireIfNeeded(), leaseMs + 1);
+    expiryTimer.unref?.();
+    return { ok: true, lease: { ...lease }, reused: false };
+}
+export function requireDeviceIsolationFreeze(input) {
+    const current = currentDeviceIsolationFreezeLease(input.now);
+    if (!current || current.nonce !== input.nonce || current.leaseId !== input.leaseId) {
+        return null;
+    }
+    return current;
+}
+/**
+ * Bind the post-freeze inventory to the lease. Prepare must acquire the spawn
+ * barrier before it looks at sessions; otherwise a worker can appear between
+ * inventory and freeze. Only the holder may replace the provisional value.
+ */
+export function bindDeviceIsolationFreezeInventoryGeneration(input) {
+    if (!requireDeviceIsolationFreeze(input) || !lease)
+        return null;
+    lease.inventoryGeneration = input.inventoryGeneration;
+    return { ...lease };
+}
+export function releaseDeviceIsolationFreeze(input) {
+    if (!requireDeviceIsolationFreeze(input))
+        return false;
+    lease = null;
+    clearExpiryTimer();
+    flushDeferredSpawns();
+    return true;
+}
+/**
+ * Queue only the first spawn request for a logical session. Later turns are
+ * already retained by the session's normal pending-input machinery; replaying
+ * multiple fork requests would instead kill and replace the first new worker.
+ */
+export function deferWorkerSpawnDuringDeviceIsolation(sessionId, callback, now = Date.now()) {
+    if (!currentDeviceIsolationFreezeLease(now))
+        return false;
+    if (!deferredSpawns.has(sessionId))
+        deferredSpawns.set(sessionId, callback);
+    return true;
+}
+/** Test-only reset; production callers release through the lease protocol. */
+export function resetDeviceIsolationActivationForTest() {
+    lease = null;
+    clearExpiryTimer();
+    deferredSpawns.clear();
+}
+//# sourceMappingURL=device-isolation-activation.js.map

package/dist/core/device-isolation-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-isolation-activation.js","sourceRoot":"","sources":["../../src/core/device-isolation-activation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAU,CAAC;AAC9D,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAWvD,IAAI,KAAK,GAAsC,IAAI,CAAC;AACpD,IAAI,WAAW,GAA0B,IAAI,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AAErD,SAAS,gBAAgB;IACvB,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,SAAS,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO;IAC5C,KAAK,GAAG,IAAI,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,mBAAmB,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAMD,MAAM,UAAU,4BAA4B,CAAC,KAM5C;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,gCAAgC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,KAAK,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,GAAG;QACN,iBAAiB,EAAE,mCAAmC;QACtD,OAAO,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,UAAU,CAAC,EAAE;QAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG,GAAG,OAAO;KACzB,CAAC;IACF,gBAAgB,EAAE,CAAC;IACnB,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;IACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAAC,KAK5D;IACC,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAChE,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACtD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAI5C;IACC,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,KAAK,GAAG,IAAI,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,mBAAmB,EAAE,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CACnD,SAAiB,EACjB,QAAoB,EACpB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qCAAqC;IACnD,KAAK,GAAG,IAAI,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/core/device-isolation-daemon.d.ts

@@ -0,0 +1,84 @@
+import type { BackendType, SessionProbe } from '../adapters/backend/types.js';
+import type { DaemonSession } from './types.js';
+export declare const DEVICE_ISOLATION_PREPARE_PATH = "/api/device-isolation/activation/prepare";
+export declare const DEVICE_ISOLATION_COMMIT_PATH = "/api/device-isolation/activation/commit";
+export declare const DEVICE_ISOLATION_RELEASE_PATH = "/api/device-isolation/activation/release";
+type LocalPersistentBackend = 'tmux' | 'herdr' | 'zellij';
+type InventoryBackend = BackendType | 'unknown';
+type ProcessIdentity = {
+    pid: number;
+    procStart: string;
+};
+export type DeviceIsolationBlocker = 'adopted_session' | 'unknown_backend' | 'unattested_worker' | 'stale_attestation' | 'process_identity_unavailable' | 'backend_probe_unknown' | 'backend_inconsistent';
+export interface DeviceIsolationRuntimeSession {
+    sessionId: string;
+    adopted: boolean;
+    /** Backend stamped by daemon-owned state, if this session predates no stamp. */
+    frozenBackend?: BackendType;
+    workerPresent: boolean;
+    workerGeneration?: number;
+    worker?: ProcessIdentity;
+    attestation?: {
+        backendType: BackendType;
+        credentialIsolated: boolean;
+        cli?: ProcessIdentity;
+        workerGeneration?: number;
+    };
+    /** Opaque production handle. It is deliberately excluded from generation. */
+    source?: DaemonSession;
+}
+export interface DeviceIsolationInventoryEntry {
+    sessionId: string;
+    backendType: InventoryBackend;
+    disposition: 'blocked' | 'owned_local' | 'safe_remote' | 'quiescent';
+    credentialIsolated?: boolean;
+    worker?: ProcessIdentity;
+    cli?: ProcessIdentity;
+    workerGeneration?: number;
+    persistent?: {
+        backendType: LocalPersistentBackend;
+        name: string;
+        probe: SessionProbe;
+    };
+    blocker?: DeviceIsolationBlocker;
+}
+export interface DeviceIsolationInventory {
+    generation: string;
+    entries: DeviceIsolationInventoryEntry[];
+    blockers: Array<{
+        sessionId: string;
+        blocker: DeviceIsolationBlocker;
+    }>;
+}
+export interface DeviceIsolationDaemonIdentity {
+    larkAppId: string;
+    bootInstanceId: string;
+}
+export interface DeviceIsolationDaemonDependencies {
+    now: () => number;
+    listSessions: () => DeviceIsolationRuntimeSession[];
+    processStart: (pid: number) => string | undefined;
+    processExists: (pid: number) => boolean;
+    signalProcess: (pid: number, signal: NodeJS.Signals) => void;
+    probePersistent: (backendType: LocalPersistentBackend, name: string) => SessionProbe;
+    killPersistent: (backendType: LocalPersistentBackend, name: string) => void;
+    closeWorker: (session: DeviceIsolationRuntimeSession) => void;
+    readMarker: () => string | null;
+    sleep: (ms: number) => Promise<void>;
+    dataDir: () => string;
+}
+export type DeviceIsolationDaemonResult = {
+    status: 200 | 409 | 423 | 503;
+    body: Record<string, unknown>;
+};
+export declare function buildDeviceIsolationInventory(): DeviceIsolationInventory;
+export declare function setDeviceIsolationDaemonIdentity(identity: DeviceIsolationDaemonIdentity | null): void;
+export declare function prepareDeviceIsolationActivation(body: unknown): DeviceIsolationDaemonResult;
+export declare function commitDeviceIsolationActivation(body: unknown): Promise<DeviceIsolationDaemonResult>;
+export declare function releaseDeviceIsolationActivation(body: unknown): DeviceIsolationDaemonResult;
+/** Test seams keep process and backend destruction out of unit tests. */
+export declare function setDeviceIsolationDaemonDependenciesForTest(overrides: Partial<DeviceIsolationDaemonDependencies> | null): void;
+export declare function resetDeviceIsolationDaemonForTest(): void;
+export declare function logDeviceIsolationActivationError(error: unknown): void;
+export {};
+//# sourceMappingURL=device-isolation-daemon.d.ts.map

package/dist/core/device-isolation-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-isolation-daemon.d.ts","sourceRoot":"","sources":["../../src/core/device-isolation-daemon.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAmB9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,eAAO,MAAM,6BAA6B,6CAA6C,CAAC;AACxF,eAAO,MAAM,4BAA4B,4CAA4C,CAAC;AACtF,eAAO,MAAM,6BAA6B,6CAA6C,CAAC;AAExF,KAAK,sBAAsB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC1D,KAAK,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;AAChD,KAAK,eAAe,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,8BAA8B,GAC9B,uBAAuB,GACvB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,WAAW,CAAC;QACzB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,GAAG,CAAC,EAAE,eAAe,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,6EAA6E;IAC7E,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,WAAW,CAAC;IACrE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,GAAG,CAAC,EAAE,eAAe,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE;QACX,WAAW,EAAE,sBAAsB,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,YAAY,CAAC;KACrB,CAAC;IACF,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,6BAA6B,EAAE,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAClD,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC7D,eAAe,EAAE,CAAC,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC;IACrF,cAAc,EAAE,CAAC,WAAW,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,WAAW,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,IAAI,CAAC;IAC9D,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AA4MF,wBAAgB,6BAA6B,IAAI,wBAAwB,CAWxE;AA4LD,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,6BAA6B,GAAG,IAAI,GAC7C,IAAI,CAIN;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,OAAO,GAAG,2BAA2B,CAmE3F;AAED,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAsDzG;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,OAAO,GAAG,2BAA2B,CAoD3F;AAED,yEAAyE;AACzE,wBAAgB,2CAA2C,CACzD,SAAS,EAAE,OAAO,CAAC,iCAAiC,CAAC,GAAG,IAAI,GAC3D,IAAI,CAEN;AAED,wBAAgB,iCAAiC,IAAI,IAAI,CAIxD;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtE"}