chat-recall 0.5.5 → 0.5.7

package/dist/tick-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tick-queue.js","sourceRoot":"","sources":["../src/tick-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAeH,MAAM,OAAO,SAAS;IAMS;IALrB,OAAO,GAAc,EAAE,CAAC;IACxB,OAAO,GAAoB,IAAI,CAAC;IACxC,+DAA+D;IACvD,KAAK,GAAG,IAAI,GAAG,EAAY,CAAC;IAEpC,YAA6B,OAAsB,EAAE;QAAxB,SAAI,GAAJ,IAAI,CAAoB;IAAG,CAAC;IAEzD,yEAAyE;IACzE,IAAI,MAAM,KAAsB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnD;;;OAGG;IACH,OAAO,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAwB;QAChE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,yEAAyE;YACzE,4EAA4E;YAC5E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAG,YAAY;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;aACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,YAAY,EAAE,EAAE;CACR,CAAC"}

package/dist/transport-safety.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Refuse to ship a transcript over a connection anyone can read.
+ *
+ * ── The hole this closes ─────────────────────────────────────────────────
+ * TLS to the hosted service was never in doubt — valid cert, HSTS for a year,
+ * plain HTTP redirected. But NOTHING in the collector required it. A user who
+ * typed `chat-recall login http://recall.mycompany.com` got exactly what they
+ * asked for: every transcript on the machine, in cleartext, over the open
+ * internet, with no warning at any point. `isLocalHost()` existed to relax
+ * upload pacing for LAN targets, not to gate the scheme, so a public host over
+ * plain HTTP passed every check.
+ *
+ * The payload makes this worse than a generic cleartext warning deserves. A sync
+ * body carries whole transcripts: source code, file paths, and — despite
+ * client-side redaction being good — whatever the detectors did not recognise as
+ * a secret. This is the single highest-value thing the product ever puts on a
+ * wire.
+ *
+ * ── Where the line is ────────────────────────────────────────────────────
+ * Plain HTTP is fine to a host only YOU can reach, and that is the whole
+ * exception. Loopback, mDNS/`.lan` names, RFC1918, IPv6 loopback and ULA, and
+ * the CGNAT range Tailscale hands out — a self-hoster on any of those has no
+ * public path to intercept. Everything else needs TLS.
+ *
+ * `CHAT_RECALL_ALLOW_INSECURE_HTTP=1` overrides it, for the real case this
+ * would otherwise break: a corporate host reached through a VPN whose name and
+ * address both look public. That is a deliberate, per-machine decision, which is
+ * exactly the bar an override like this should meet.
+ */
+/** Hosts only reachable from the user's own machine or network. */
+export declare function isPrivateHost(serverUrl: string): boolean;
+/** Explicit, per-machine opt-out for a VPN-reached host that looks public. */
+export declare function insecureHttpAllowed(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Why this target must not be used, or null when it is safe.
+ *
+ * Pure, so both the login gate and the sync-time gate can share one rule and a
+ * test can pin it without a network.
+ */
+export declare function transportRisk(serverUrl: string, env?: NodeJS.ProcessEnv): string | null;
+/** Throwing form, for the login path. */
+export declare function assertTransportSafe(serverUrl: string, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=transport-safety.d.ts.map

package/dist/transport-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-safety.d.ts","sourceRoot":"","sources":["../src/transport-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAgBxD;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAGjF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,yCAAyC;AACzC,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAGjG"}

package/dist/transport-safety.js

@@ -0,0 +1,100 @@
+/**
+ * Refuse to ship a transcript over a connection anyone can read.
+ *
+ * ── The hole this closes ─────────────────────────────────────────────────
+ * TLS to the hosted service was never in doubt — valid cert, HSTS for a year,
+ * plain HTTP redirected. But NOTHING in the collector required it. A user who
+ * typed `chat-recall login http://recall.mycompany.com` got exactly what they
+ * asked for: every transcript on the machine, in cleartext, over the open
+ * internet, with no warning at any point. `isLocalHost()` existed to relax
+ * upload pacing for LAN targets, not to gate the scheme, so a public host over
+ * plain HTTP passed every check.
+ *
+ * The payload makes this worse than a generic cleartext warning deserves. A sync
+ * body carries whole transcripts: source code, file paths, and — despite
+ * client-side redaction being good — whatever the detectors did not recognise as
+ * a secret. This is the single highest-value thing the product ever puts on a
+ * wire.
+ *
+ * ── Where the line is ────────────────────────────────────────────────────
+ * Plain HTTP is fine to a host only YOU can reach, and that is the whole
+ * exception. Loopback, mDNS/`.lan` names, RFC1918, IPv6 loopback and ULA, and
+ * the CGNAT range Tailscale hands out — a self-hoster on any of those has no
+ * public path to intercept. Everything else needs TLS.
+ *
+ * `CHAT_RECALL_ALLOW_INSECURE_HTTP=1` overrides it, for the real case this
+ * would otherwise break: a corporate host reached through a VPN whose name and
+ * address both look public. That is a deliberate, per-machine decision, which is
+ * exactly the bar an override like this should meet.
+ */
+/** Hosts only reachable from the user's own machine or network. */
+export function isPrivateHost(serverUrl) {
+    let host = '';
+    try {
+        host = new URL(serverUrl).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    // IPv6 arrives bracket-stripped from URL.hostname.
+    if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '0.0.0.0')
+        return true;
+    if (host.endsWith('.local') || host.endsWith('.lan') || host.endsWith('.internal'))
+        return true;
+    if (/^10\./.test(host))
+        return true; // 10.0.0.0/8
+    if (/^192\.168\./.test(host))
+        return true; // 192.168.0.0/16
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(host))
+        return true; // 172.16.0.0/12
+    if (/^127\./.test(host))
+        return true; // loopback/8
+    // 100.64.0.0/10 — CGNAT, and what Tailscale assigns. A self-hoster reaching
+    // their box over a tailnet is on a private path by construction.
+    if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(host))
+        return true;
+    if (/^f[cd][0-9a-f]{2}:/.test(host))
+        return true; // IPv6 ULA fc00::/7
+    if (/^fe80:/.test(host))
+        return true; // IPv6 link-local
+    return false;
+}
+/** Explicit, per-machine opt-out for a VPN-reached host that looks public. */
+export function insecureHttpAllowed(env = process.env) {
+    const v = (env.CHAT_RECALL_ALLOW_INSECURE_HTTP || '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes';
+}
+/**
+ * Why this target must not be used, or null when it is safe.
+ *
+ * Pure, so both the login gate and the sync-time gate can share one rule and a
+ * test can pin it without a network.
+ */
+export function transportRisk(serverUrl, env = process.env) {
+    let url;
+    try {
+        url = new URL(serverUrl);
+    }
+    catch {
+        return `not a valid server URL: ${serverUrl}`;
+    }
+    if (url.protocol === 'https:')
+        return null;
+    if (url.protocol !== 'http:')
+        return `unsupported scheme '${url.protocol}' — use https://`;
+    if (isPrivateHost(serverUrl))
+        return null; // your own network
+    if (insecureHttpAllowed(env))
+        return null; // deliberate override
+    return `refusing to sync to ${url.host} over plain HTTP — your transcripts, `
+        + 'file paths and any secret the redactor did not catch would cross the '
+        + `internet in cleartext. Use https://${url.host} instead. If this host is `
+        + 'only reachable through a VPN, set CHAT_RECALL_ALLOW_INSECURE_HTTP=1.';
+}
+/** Throwing form, for the login path. */
+export function assertTransportSafe(serverUrl, env = process.env) {
+    const risk = transportRisk(serverUrl, env);
+    if (risk)
+        throw new Error(risk);
+}
+//# sourceMappingURL=transport-safety.js.map

package/dist/transport-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-safety.js","sourceRoot":"","sources":["../src/transport-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACjF,mDAAmD;IACnD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAA8B,aAAa;IAC/E,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAwB,iBAAiB;IACnF,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAS,gBAAgB;IAClF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAA6B,aAAa;IAC/E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,oBAAoB;IACtF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAA6B,kBAAkB;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,2BAA2B,SAAS,EAAE,CAAC;IAAC,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,uBAAuB,GAAG,CAAC,QAAQ,kBAAkB,CAAC;IAC3F,IAAI,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,CAAU,mBAAmB;IACvE,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAU,sBAAsB;IAC1E,OAAO,uBAAuB,GAAG,CAAC,IAAI,uCAAuC;UACzE,uEAAuE;UACvE,sCAAsC,GAAG,CAAC,IAAI,4BAA4B;UAC1E,sEAAsE,CAAC;AAC7E,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/verify-repair.js

@@ -35,7 +35,7 @@ export function forceFullResync(server, sessionIds) {
     let cleared = 0;
     for (const key of Object.keys(data)) {
         // Ledger keys are prefixed ids for non-Claude tools; match either form.
-        const bare = key.replace(/^(opencode_|gemini_|codex_|agy_)/, '');
+        const bare = key.replace(/^(opencode_|gemini_|codex_|agy_|cursor_)/, '');
         if (!wanted.has(key) && !wanted.has(bare))
             continue;
         const row = data[key];

package/dist/verify-repair.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-repair.js","sourceRoot":"","sources":["../src/verify-repair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEpF;qEACqE;AACrE,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAAoB;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC;YAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvF,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,cAAc;QAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,sBAAsB;QACvC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,4DAA4D;QAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,sDAAsD;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC;QAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"verify-repair.js","sourceRoot":"","sources":["../src/verify-repair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEpF;qEACqE;AACrE,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAAoB;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC;YAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvF,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,cAAc;QAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,sBAAsB;QACvC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,4DAA4D;QAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAM,sDAAsD;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC;QAAE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC"}