dsh-zen-remote 1.0.0

package/lib/index.js

@@ -0,0 +1,310 @@
+/**
+ * dsh-mobile-nav, node half.
+ *
+ * Was an empty apply (pure client UI plugin) until S7. It now owns ONE host
+ * route: the phone composer's attachment upload. The official file picker
+ * opens on the machine running DSH, which is useless from a phone, and the
+ * public client API has no upload verb at all — the only public browser->host
+ * byte channel is `session.prompt([{type:'image',…}])`, which is images only
+ * and lands as a sent message rather than a file on disk. So a non-image
+ * attachment needs a route of its own, and that route belongs here rather
+ * than in the gateway half of this plugin: the gateway authenticates and forwards
+ * verbatim, it does not know what a session or a workspace is.
+ *
+ * The browser half still ships via exports["./client"], discovered through
+ * the package.json dsh.client declaration.
+ */
+import { lstat, mkdir, open, realpath, rm } from 'node:fs/promises';
+import { basename, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+/** Exact route the phone composer POSTs one file body to. */
+export const UPLOAD_ROUTE = '/_dsh/mobile-nav/upload';
+/** Workspace-relative directory uploads land in (also the `@` prefix the composer inserts). */
+export const UPLOAD_DIR = '.dsh-uploads';
+/** Body cap when the plugin row sets no `maxUploadBytes`. */
+export const DEFAULT_MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
+/** Longest filename, in bytes, that survives sanitization (ext4/APFS leaf limit is 255). */
+const MAX_NAME_BYTES = 180;
+/** Distinct leaf names tried before a collision is given up on. */
+const MAX_COLLISION_TRIES = 100;
+/**
+ * One rejection carrying the status the client should see.
+ *
+ * Fields are assigned in the body rather than declared as constructor
+ * parameter properties: `scripts/check-upload-endpoint.mjs` imports this
+ * module through Node's strip-only type stripping, which rejects that syntax.
+ */
+class UploadError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'UploadError';
+        this.status = status;
+        this.code = code;
+    }
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isErrnoCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+function responseJson(res, status, body) {
+    const bytes = Buffer.from(JSON.stringify(body));
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Content-Length', String(bytes.length));
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+    res.writeHead(status);
+    res.end(bytes);
+}
+/**
+ * Accept a state-changing request only from this DSH Web application's origin.
+ *
+ * The gateway half rewrites `Origin`/`Host` to the upstream origin
+ * before forwarding (lan-gate-server.cjs `cleanHeaders`), so a phone request
+ * that already cleared the pairing wall presents here as same-origin; a
+ * request with neither header falls back to the Fetch metadata.
+ * @param req - the inbound request.
+ * @returns true when the request may mutate the workspace.
+ */
+export function sameOriginPost(req) {
+    const fetchSite = req.headers['sec-fetch-site'];
+    if (fetchSite === 'cross-site')
+        return false;
+    const origin = req.headers.origin;
+    if (origin === undefined)
+        return fetchSite === 'same-origin' || fetchSite === 'same-site' || fetchSite === 'none';
+    const host = req.headers.host;
+    if (host === undefined)
+        return false;
+    try {
+        const parsed = new URL(origin);
+        return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.host === host;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reject a resolved path that is not rooted below the expected directory.
+ * @param root - the directory the target must stay inside.
+ * @param target - the resolved candidate path.
+ * @throws when the target escapes the root.
+ */
+export function ensurePathInside(root, target) {
+    const rel = relative(root, target);
+    if (rel !== '' && (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))) {
+        throw new UploadError(400, 'path-escape', `resolved upload path escapes its workspace root: ${target}`);
+    }
+}
+/**
+ * Convert an untrusted browser label into one portable leaf filename.
+ *
+ * Everything that could steer the write out of the upload directory is gone
+ * after this: only the basename survives (so `../../etc/passwd` becomes
+ * `passwd`), separators and control characters become `_`, leading dots are
+ * dropped, and the Windows reserved device names are prefixed. Whitespace
+ * folds to `_` rather than being kept: the client appends the result to the
+ * composer draft as an `@path` mention, and a mention with a space in it is
+ * broken for the agent reading it, not just for the chip parser. Length is
+ * capped in BYTES because the label arrives as UTF-8.
+ * @param raw - browser-supplied filename.
+ * @returns a single safe leaf name, never empty.
+ */
+export function safeUploadName(raw) {
+    const leaf = basename(raw.replaceAll('\\', '/')).normalize('NFC');
+    let cleaned = leaf
+        .replace(/[<>:"|?*\u0000-\u001f/\\]/gu, '_')
+        .replace(/\s+/gu, '_')
+        .replace(/^\.+/u, '')
+        .trim()
+        .replace(/[. ]+$/u, '');
+    if (/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(cleaned))
+        cleaned = `_${cleaned}`;
+    const candidate = cleaned === '' ? 'upload.bin' : cleaned;
+    if (Buffer.byteLength(candidate) <= MAX_NAME_BYTES)
+        return candidate;
+    const extension = extname(candidate).slice(0, 20);
+    const budget = Math.max(1, MAX_NAME_BYTES - Buffer.byteLength(extension));
+    let stem = candidate.slice(0, Math.max(1, candidate.length - extension.length));
+    while (Buffer.byteLength(stem) > budget)
+        stem = stem.slice(0, -1);
+    return `${stem}${extension}`;
+}
+function singleQuery(url, key) {
+    const values = url.searchParams.getAll(key);
+    const value = values[0];
+    if (values.length !== 1 || value === undefined || value === '') {
+        throw new UploadError(400, 'bad-request', `${key} is required exactly once`);
+    }
+    return value;
+}
+/** Create the directory if absent, then prove it is a real directory inside the workspace. */
+async function ensureManagedDirectory(workspace, path) {
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!isErrnoCode(error, 'EEXIST'))
+            throw error;
+    }
+    const entry = await lstat(path);
+    // A symlink here would be the one way a prior workspace write could still
+    // redirect the bytes elsewhere — realpath alone would happily follow it.
+    if (entry.isSymbolicLink()) {
+        throw new UploadError(400, 'path-escape', `upload directory is a symbolic link: ${path}`);
+    }
+    if (!entry.isDirectory())
+        throw new UploadError(400, 'path-escape', `upload path is not a directory: ${path}`);
+    const canonical = await realpath(path);
+    ensurePathInside(workspace, canonical);
+    return canonical;
+}
+/**
+ * Resolve (and create) the upload directory of one live session.
+ * @param ctx - host context carrying the sessions service.
+ * @param sessionId - the session whose workspace receives the file.
+ * @returns the canonical and visible upload directories.
+ * @throws 404 when no live session has that id.
+ */
+async function sessionUploadRoot(ctx, sessionId) {
+    const session = ctx.sessions.get(sessionId);
+    if (session === undefined)
+        throw new UploadError(404, 'session-not-found', `live Session not found: ${sessionId}`);
+    const cwd = session.header.cwd;
+    if (cwd === undefined || !isAbsolute(cwd)) {
+        throw new UploadError(404, 'session-not-found', `Session has no absolute workspace: ${sessionId}`);
+    }
+    const visibleWorkspace = resolve(cwd);
+    const workspace = await realpath(visibleWorkspace);
+    const visibleRoot = join(visibleWorkspace, UPLOAD_DIR);
+    const writeRoot = await ensureManagedDirectory(workspace, visibleRoot);
+    return { writeRoot, visibleRoot };
+}
+/**
+ * Claim one not-yet-existing leaf name, suffixing `-1`, `-2`, … on collision.
+ * `wx` makes the claim atomic, so two concurrent uploads of the same name
+ * cannot both win the same path.
+ */
+async function openUnique(directory, filename) {
+    const extension = extname(filename);
+    const stem = filename.slice(0, filename.length - extension.length) || 'upload';
+    for (let n = 0; n < MAX_COLLISION_TRIES; n += 1) {
+        const path = join(directory, n === 0 ? `${stem}${extension}` : `${stem}-${n}${extension}`);
+        ensurePathInside(directory, path);
+        try {
+            return { handle: await open(path, 'wx', 0o600), path };
+        }
+        catch (error) {
+            if (!isErrnoCode(error, 'EEXIST'))
+                throw error;
+        }
+    }
+    throw new UploadError(409, 'name-taken', `too many files named like ${filename}`);
+}
+/**
+ * Stream the request body onto disk under a running byte cap.
+ * @param req - the request whose body is the file.
+ * @param directory - canonical upload directory.
+ * @param filename - sanitized leaf name.
+ * @param maxBytes - hard cap; exceeding it aborts and unlinks.
+ * @returns the absolute path written and its byte count.
+ */
+async function writeUpload(req, directory, filename, maxBytes) {
+    const declared = req.headers['content-length'];
+    const expected = declared === undefined ? undefined : Number(declared);
+    if (expected !== undefined && (!Number.isSafeInteger(expected) || expected < 0)) {
+        throw new UploadError(400, 'bad-request', 'Content-Length is not a byte count');
+    }
+    // Reject the oversized upload before a single byte is read, so the phone
+    // gets its 413 without spending the whole body on the radio.
+    if (expected !== undefined && expected > maxBytes) {
+        throw new UploadError(413, 'too-large', `upload exceeds the ${maxBytes}-byte limit`);
+    }
+    const { handle, path } = await openUnique(directory, filename);
+    let received = 0;
+    try {
+        for await (const chunk of req) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            received += bytes.length;
+            // Chunked bodies declare no length, so the cap must also hold here.
+            if (received > maxBytes)
+                throw new UploadError(413, 'too-large', `upload exceeds the ${maxBytes}-byte limit`);
+            await handle.write(bytes);
+        }
+        if (expected !== undefined && received !== expected) {
+            throw new UploadError(400, 'truncated', `upload body size mismatch: expected ${expected}, received ${received}`);
+        }
+        await handle.close();
+        return { path, bytes: received };
+    }
+    catch (error) {
+        await handle.close().catch(() => { });
+        await rm(path, { force: true }).catch(() => { });
+        throw error;
+    }
+}
+/**
+ * Handle one `POST {@link UPLOAD_ROUTE}?session=<id>&name=<file>` request.
+ *
+ * Exported so an integration check can drive it with a plain node:http server
+ * and a fake sessions service instead of booting a harness.
+ * @param ctx - host context carrying the sessions service and logger.
+ * @param maxBytes - body cap.
+ * @param req - inbound request; its body is the raw file.
+ * @param res - the response this call owns end to end.
+ */
+export async function handleUpload(ctx, maxBytes, req, res) {
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use POST' } });
+        return;
+    }
+    if (!sameOriginPost(req)) {
+        const error = { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' };
+        responseJson(res, 403, { ok: false, error });
+        return;
+    }
+    try {
+        const url = new URL(req.url ?? UPLOAD_ROUTE, 'http://dsh.internal');
+        const sessionId = singleQuery(url, 'session');
+        const filename = safeUploadName(singleQuery(url, 'name'));
+        const root = await sessionUploadRoot(ctx, sessionId);
+        const written = await writeUpload(req, root.writeRoot, filename, maxBytes);
+        const leaf = basename(written.path);
+        responseJson(res, 201, {
+            ok: true,
+            relPath: `${UPLOAD_DIR}/${leaf}`,
+            absolutePath: join(root.visibleRoot, leaf),
+            filename: leaf,
+            bytes: written.bytes,
+        });
+    }
+    catch (error) {
+        const status = error instanceof UploadError ? error.status : 400;
+        const code = error instanceof UploadError ? error.code : 'upload-rejected';
+        ctx.logger.warn('dsh-mobile-nav upload rejected: %s', message(error));
+        responseJson(res, status, { ok: false, error: { code, message: message(error) } });
+    }
+}
+/**
+ * Host half: mount the upload route wherever a webServer and live sessions
+ * exist. Both are injected INSIDE apply rather than declared as a top-level
+ * `inject`, so the plugin row still loads (and the browser half still ships)
+ * in a composition without them — Electron carries no webServer.
+ * @param ctx - host plugin context.
+ * @param config - optional body cap override.
+ */
+export function apply(ctx, config = {}) {
+    const maxBytes = config.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+    ctx.inject(['webServer', 'sessions'], (webCtx) => {
+        webCtx.effect(() => webCtx.webServer.register({
+            kind: 'exact',
+            path: UPLOAD_ROUTE,
+            handler: (req, res) => handleUpload(webCtx, maxBytes, req, res),
+        }), 'dsh-mobile-nav: upload route');
+    });
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAGnE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAKvF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAA;AAErD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAA;AAExC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAExD,4FAA4F;AAC5F,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAQ/B;;;;;;GAMG;AACH,MAAM,WAAY,SAAQ,KAAK;IACpB,MAAM,CAAQ;IACd,IAAI,CAAQ;IAErB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAA;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;IAChE,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;IAClD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,4CAA4C,CAAC,CAAA;IACtF,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACrB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/C,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,MAAM,CAAA;IACjH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9B,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,oDAAoD,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACjE,IAAI,OAAO,GAAG,IAAI;SACf,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACzB,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7F,MAAM,SAAS,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAA;IACzD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,cAAc;QAAE,OAAO,SAAS,CAAA;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACzE,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ,EAAE,GAAW;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,GAAG,2BAA2B,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,IAAY;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAA;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,wCAAwC,IAAI,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,mCAAmC,IAAI,EAAE,CAAC,CAAA;IAC9G,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,SAAS,CAAA;AAClB,CAAC;AASD;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,SAAiB;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAkB,CAAC,CAAA;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,SAAS,EAAE,CAAC,CAAA;IAClH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,mBAAmB,EAAE,sCAAsC,SAAS,EAAE,CAAC,CAAA;IACpG,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACtE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,QAAgB;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAA;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,CAAA;QAC1F,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAA;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAA;QAChD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,6BAA6B,QAAQ,EAAE,CAAC,CAAA;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CACxB,GAAoB,EACpB,SAAiB,EACjB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,oCAAoC,CAAC,CAAA;IACjF,CAAC;IACD,yEAAyE;IACzE,6DAA6D;IAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,sBAAsB,QAAQ,aAAa,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC9D,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;YAC/E,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;YACxB,oEAAoE;YACpE,IAAI,QAAQ,GAAG,QAAQ;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,sBAAsB,QAAQ,aAAa,CAAC,CAAA;YAC7G,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,uCAAuC,QAAQ,cAAc,QAAQ,EAAE,CAAC,CAAA;QAClH,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/C,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAY,EACZ,QAAgB,EAChB,GAAoB,EACpB,GAAmB;IAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAA;QAC9G,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,EAAE,qBAAqB,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,GAAG,UAAU,IAAI,IAAI,EAAE;YAChC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC1C,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAChE,MAAM,IAAI,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAC1E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACrE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAA;IAClE,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5C,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC;SAChE,CAAC,EAAE,8BAA8B,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC"}