harnery 0.36.0 → 0.38.0

package/dist/lib/browser/qa-run-contracts.js

@@ -0,0 +1,361 @@
+// Contracts for the qa-run matrix runner: one JSON job in, one JSON result
+// out, with the coverage-merge and verdict rules as pure functions.
+//
+// The runner executes a whole page-QA matrix (planner, deterministic gates,
+// interactions, critique, snapshot) in one process so the driving agent stops
+// paying a model turn per browser command. These contracts are frozen first so
+// the orchestrator, its tests, and downstream consumers build against the same
+// shape.
+//
+// Two rules are load-bearing and enforced here, not in prose:
+//   - A job may WIDEN coverage beyond the planner's manifest but can never
+//     narrow it below the manifest (mergeCoverage is a union that keeps
+//     manifest order first).
+//   - A job must not carry credentials. Authentication is referenced through
+//     existing browser profiles and cookie stores; validation refuses
+//     secret-shaped fields before any browser or model work starts.
+//
+// Toolkit tier: this module must not import src/core (layering check).
+import { createHash } from "node:crypto";
+export const QA_RUN_JOB_SCHEMA_VERSION = 1;
+export const QA_RUN_RESULT_SCHEMA_VERSION = 4;
+/** Runner stages in execution order. `last_completed_stage` names the last
+ * one that finished without contributing a blocker. */
+export const QA_RUN_STAGES = [
+    "plan",
+    "gates",
+    "interactions",
+    "capture",
+    "critique",
+    "snapshot",
+];
+export const QA_RUN_STATUS_SCHEMA_VERSION = 1;
+// ---------------------------------------------------------------------------
+// Job validation
+// ---------------------------------------------------------------------------
+/** Field names that indicate an embedded credential. Matched on any object
+ * key anywhere in the job, case-insensitively. */
+const SECRET_KEY_PATTERN = /(password|passwd|secret|token|api[-_]?key|authorization|cookie|credential|bearer)/i;
+/** Value shapes that indicate an embedded credential even under an innocent
+ * key: explicit auth headers and long unbroken high-entropy-looking blobs. */
+const SECRET_VALUE_PATTERNS = [/\bBearer\s+[\w.~+/=-]{16,}/i, /\bBasic\s+[A-Za-z0-9+/=]{16,}/];
+function scanForSecrets(value, path, errors) {
+    if (typeof value === "string") {
+        for (const pattern of SECRET_VALUE_PATTERNS) {
+            if (pattern.test(value)) {
+                errors.push(`${path}: value looks like a credential — reference a browser profile or cookie store instead`);
+                return;
+            }
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, i) => {
+            scanForSecrets(item, `${path}[${i}]`, errors);
+        });
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (SECRET_KEY_PATTERN.test(key)) {
+                errors.push(`${path}.${key}: secret-bearing field names are refused — reference a browser profile or cookie store instead`);
+                continue;
+            }
+            scanForSecrets(child, `${path}.${key}`, errors);
+        }
+    }
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+/**
+ * Validate an untrusted job document. Structural errors and secret-bearing
+ * fields are all reported at once so a caller can fix the job in one pass.
+ * Validation is deliberately strict: an underspecified job fails here, before
+ * any browser or model process starts.
+ */
+export function validateQaRunJob(value) {
+    const errors = [];
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { ok: false, errors: ["job must be a JSON object"] };
+    }
+    const job = value;
+    if (job.schema_version !== QA_RUN_JOB_SCHEMA_VERSION) {
+        errors.push(`schema_version must be ${QA_RUN_JOB_SCHEMA_VERSION}`);
+    }
+    if (typeof job.target !== "string" || job.target.length === 0) {
+        errors.push("target is required (URL, file path, or route)");
+    }
+    if (job.mode !== "signoff" && job.mode !== "review") {
+        errors.push('mode must be "signoff" or "review"');
+    }
+    const ids = new Set();
+    if (job.contexts !== undefined) {
+        if (!Array.isArray(job.contexts)) {
+            errors.push("contexts must be an array");
+        }
+        else {
+            job.contexts.forEach((ctx, i) => {
+                const c = ctx;
+                if (typeof c?.id !== "string" || c.id.length === 0)
+                    errors.push(`contexts[${i}].id is required`);
+                else if (ids.has(c.id))
+                    errors.push(`contexts[${i}].id duplicates "${c.id}"`);
+                else
+                    ids.add(c.id);
+                if (typeof c?.viewport !== "string" || c.viewport.length === 0) {
+                    errors.push(`contexts[${i}].viewport is required`);
+                }
+                if (c?.theme !== "light" && c?.theme !== "dark") {
+                    errors.push(`contexts[${i}].theme must be "light" or "dark"`);
+                }
+                if (typeof c?.state !== "string" || c.state.length === 0) {
+                    errors.push(`contexts[${i}].state is required ("default" for the plain page)`);
+                }
+                if (c?.args !== undefined && !isStringArray(c.args)) {
+                    errors.push(`contexts[${i}].args must be an argument array (never a shell string)`);
+                }
+            });
+        }
+    }
+    if (job.checks !== undefined) {
+        if (!Array.isArray(job.checks)) {
+            errors.push("checks must be an array");
+        }
+        else {
+            const checkIds = new Set();
+            job.checks.forEach((check, i) => {
+                const c = check;
+                if (typeof c?.id !== "string" || c.id.length === 0)
+                    errors.push(`checks[${i}].id is required`);
+                else if (checkIds.has(c.id))
+                    errors.push(`checks[${i}].id duplicates "${c.id}"`);
+                else
+                    checkIds.add(c.id);
+                if (!isStringArray(c?.args) || c.args.length === 0) {
+                    errors.push(`checks[${i}].args must be a non-empty argument array (never a shell string)`);
+                }
+                if (c?.contexts !== undefined && !isStringArray(c.contexts)) {
+                    errors.push(`checks[${i}].contexts must be an array of context IDs`);
+                }
+            });
+        }
+    }
+    if (job.interaction_states !== undefined) {
+        if (!Array.isArray(job.interaction_states)) {
+            errors.push("interaction_states must be an array");
+        }
+        else {
+            job.interaction_states.forEach((state, i) => {
+                const s = state;
+                if (typeof s?.name !== "string" || s.name.length === 0) {
+                    errors.push(`interaction_states[${i}].name is required`);
+                }
+                if (!isStringArray(s?.setup) || s.setup.length === 0) {
+                    errors.push(`interaction_states[${i}].setup must be a non-empty argument array`);
+                }
+                if (!isStringArray(s?.assertions) || s.assertions.length === 0) {
+                    errors.push(`interaction_states[${i}].assertions must name at least one outcome assertion — a click without a proven outcome is not a gate`);
+                }
+            });
+        }
+    }
+    if (job.policy !== undefined) {
+        const p = job.policy;
+        if (p?.command_concurrency !== undefined) {
+            const n = p.command_concurrency;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 1 || n > 8) {
+                errors.push("policy.command_concurrency must be an integer between 1 and 8");
+            }
+        }
+        if (p?.command_timeout_ms !== undefined) {
+            const n = p.command_timeout_ms;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 1000) {
+                errors.push("policy.command_timeout_ms must be an integer ≥ 1000");
+            }
+        }
+        if (p?.run_deadline_ms !== undefined) {
+            const n = p.run_deadline_ms;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 10_000) {
+                errors.push("policy.run_deadline_ms must be an integer ≥ 10000");
+            }
+        }
+        if (p?.critique_max_tiles !== undefined) {
+            const n = p.critique_max_tiles;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 1 || n > 200) {
+                errors.push("policy.critique_max_tiles must be an integer between 1 and 200");
+            }
+        }
+        if (p?.critique_pool !== undefined) {
+            const n = p.critique_pool;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 1 || n > 16) {
+                errors.push("policy.critique_pool must be an integer between 1 and 16");
+            }
+        }
+        if (p?.review_pack_retention_minutes !== undefined) {
+            const n = p.review_pack_retention_minutes;
+            if (typeof n !== "number" || !Number.isInteger(n) || n < 1 || n > 43_200) {
+                errors.push("policy.review_pack_retention_minutes must be an integer between 1 and 43200");
+            }
+        }
+    }
+    scanForSecrets(job, "job", errors);
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, job: value };
+}
+// ---------------------------------------------------------------------------
+// Coverage merge — widen-only
+// ---------------------------------------------------------------------------
+export function contextIdFor(context) {
+    return `${context.viewport}-${context.theme}-${context.state}`;
+}
+/**
+ * Merge planner-manifest coverage with the job's extra contexts. The manifest
+ * is the floor: its contexts always run, in manifest order, and a job can only
+ * append. The union construction makes narrowing impossible by design; the
+ * returned list is what the runner executes and what the result reports.
+ */
+export function mergeCoverage(manifest, job) {
+    const merged = manifest.contexts.map((context) => ({
+        id: contextIdFor(context),
+        viewport: context.viewport,
+        theme: context.theme,
+        state: context.state,
+    }));
+    const seen = new Set(merged.map((context) => context.id));
+    for (const context of job.contexts ?? []) {
+        const canonical = contextIdFor(context);
+        if (seen.has(canonical) || seen.has(context.id))
+            continue;
+        seen.add(canonical);
+        seen.add(context.id);
+        merged.push(context);
+    }
+    return merged;
+}
+// ---------------------------------------------------------------------------
+// Verdict — fail-closed
+// ---------------------------------------------------------------------------
+/**
+ * Compute the terminal verdict from completed evidence. The rules are the
+ * existing page-QA signoff contract, fail-closed:
+ *   - any blocker → incomplete (a blocker is a fact the run could not
+ *     establish, so a defect cannot be ruled out);
+ *   - any failed or unknown command/critique outcome → failed when the check
+ *     completed and found a defect, incomplete when the outcome is unknown;
+ *   - signoff mode additionally requires the snapshot to have been saved.
+ * `passed` is only reachable when every input proves out.
+ */
+// ---------------------------------------------------------------------------
+// Run identity: job digest + evidence assessment
+// ---------------------------------------------------------------------------
+/** Recursively key-sort plain objects so the digest is stable under key
+ * order. Arrays keep their order — it is semantically meaningful (contexts,
+ * argv arrays). */
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === "object") {
+        const record = value;
+        const sorted = {};
+        for (const key of Object.keys(record).sort())
+            sorted[key] = canonicalize(record[key]);
+        return sorted;
+    }
+    return value;
+}
+/** SHA-256 hex digest over the effective validated job (after the CLI merges
+ * its authoritative `target` and `mode`). `policy` is excluded: concurrency,
+ * timeout, and metered-critique knobs change how the run executes, not what
+ * it proves, and CLI flags mutate them after the job file is read — including
+ * them would make the same job file verify differently across invocations. */
+export function computeJobDigest(job) {
+    const { policy: _policy, ...identityBearing } = job;
+    return createHash("sha256")
+        .update(JSON.stringify(canonicalize(identityBearing)))
+        .digest("hex");
+}
+/**
+ * Assess whether a result document is fresh evidence for the invocation the
+ * caller has in mind. Fail-closed: a document without a verifiable identity
+ * block (schema v1 or foreign JSON) is stale by definition, and every
+ * expectation mismatch is reported, not just the first.
+ */
+export function assessQaRunEvidence(document, expectations = {}) {
+    const reasons = [];
+    if (!document || typeof document !== "object" || Array.isArray(document)) {
+        return { fresh: false, reasons: ["document is not a result object"] };
+    }
+    const result = document;
+    if (result.schema_version !== QA_RUN_RESULT_SCHEMA_VERSION) {
+        return {
+            fresh: false,
+            reasons: [
+                `schema_version is ${JSON.stringify(result.schema_version)}, not ` +
+                    `${QA_RUN_RESULT_SCHEMA_VERSION} — pre-identity results carry nothing to verify`,
+            ],
+        };
+    }
+    const run = result.run;
+    if (!run ||
+        typeof run.run_id !== "string" ||
+        typeof run.started_at !== "string" ||
+        typeof run.completed_at !== "string" ||
+        typeof run.job_digest !== "string") {
+        return { fresh: false, reasons: ["result carries no complete run-identity block"] };
+    }
+    if (expectations.run_id !== undefined && run.run_id !== expectations.run_id) {
+        reasons.push(`run_id ${run.run_id} is not the expected ${expectations.run_id}`);
+    }
+    if (expectations.job_digest !== undefined && run.job_digest !== expectations.job_digest) {
+        reasons.push("job_digest does not match the expected job definition");
+    }
+    if (expectations.tested_revision !== undefined) {
+        if (run.revision_source === "unknown" || run.tested_revision === undefined) {
+            reasons.push(`a revision expectation was given but the run recorded revision_source "unknown"`);
+        }
+        else if (run.tested_revision !== expectations.tested_revision) {
+            reasons.push(`tested_revision ${run.tested_revision} is not the expected ${expectations.tested_revision}`);
+        }
+    }
+    if (expectations.not_started_before !== undefined) {
+        if (Date.parse(run.started_at) < Date.parse(expectations.not_started_before)) {
+            reasons.push(`run started ${run.started_at}, before the freshness floor ${expectations.not_started_before}`);
+        }
+    }
+    if (expectations.max_age_ms !== undefined) {
+        const now = expectations.now !== undefined ? Date.parse(expectations.now) : Date.now();
+        const age = now - Date.parse(run.completed_at);
+        if (Number.isNaN(age) || age > expectations.max_age_ms) {
+            reasons.push(`run completed ${run.completed_at}, older than the ${expectations.max_age_ms}ms maximum age`);
+        }
+    }
+    if (expectations.found_in_dir !== undefined && run.out_dir !== expectations.found_in_dir) {
+        reasons.push(`result was found in ${expectations.found_in_dir} but records out_dir ${run.out_dir} — ` +
+            "a moved or copied result is not evidence for its new location");
+    }
+    return {
+        fresh: reasons.length === 0,
+        reasons,
+        run: run,
+        ...(result.verdict !== undefined ? { verdict: result.verdict } : {}),
+    };
+}
+export function computeVerdict(input) {
+    const failed = input.commands.some((command) => command.outcome === "failed") ||
+        input.critique.some((entry) => entry.outcome === "failed");
+    if (failed)
+        return "failed";
+    // Hand-recorded evidence can prove a defect but never its absence: nothing
+    // re-executable ran, so a manual result stops at incomplete by contract.
+    if (input.evidenceSource === "manual")
+        return "incomplete";
+    const unknown = input.commands.some((command) => command.outcome === "unknown") ||
+        input.critique.some((entry) => entry.outcome === "unknown");
+    if (input.blockers.length > 0 || unknown)
+        return "incomplete";
+    if (input.mode === "signoff" && !input.snapshotSaved)
+        return "incomplete";
+    return "passed";
+}

package/dist/lib/browser/qa-run.d.ts

@@ -0,0 +1,141 @@
+import { type CritiqueProvider } from "./critique.js";
+import { type QaRunJob, type QaRunResult } from "./qa-run-contracts.js";
+import { type QaSnapshotStoreOptions } from "./qa-snapshot.js";
+/** Set on the runner's own environment before the host's critique provider is
+ * loaded for the judge stage, unless the job permits metered critique: the
+ * provider must stay on subscription-backed headless harnesses and surface
+ * exhaustion instead of falling back to a metered API. */
+export declare const QA_RUN_HEADLESS_ONLY_ENV = "HARNERY_CRITIQUE_HEADLESS_ONLY";
+/** Result document written into the run's output directory. */
+export declare const QA_RUN_RESULT_FILENAME = "page-qa-result.json";
+/** Pointer document written into the parent output directory after every
+ * run, naming the newest run's directory and verdict. Consumers resolve the
+ * current result through this pointer instead of guessing at loose files. */
+export declare const QA_RUN_LATEST_FILENAME = "latest.json";
+export interface QaRunLatestPointerInput {
+    run_id: string;
+    dir: string;
+    completed_at: string;
+    verdict: QaRunResult["verdict"];
+}
+/**
+ * Publish the parent directory's latest-result pointer without allowing an
+ * older completion to replace a newer one. Both runner and manual evidence
+ * use this writer so every producer preserves the same ordering invariant.
+ */
+export declare function writeLatestPointer(outParent: string, input: QaRunLatestPointerInput): string;
+/** Live status document beside the result (QaRunStatusDocument): written at
+ * start, every stage boundary, and on a heartbeat timer, so a disconnected
+ * client can tell a running job from a dead one without guessing. */
+export declare const QA_RUN_STATUS_FILENAME = "run-status.json";
+/** The effective validated job, written into the run directory so a
+ * reconnecting client can re-derive the job digest (`qa-verify --job`). */
+export declare const QA_RUN_JOB_FILENAME = "job.json";
+export interface QaRunExecOptions {
+    /** Hard per-command timeout in milliseconds. */
+    timeoutMs: number;
+    /** Complete child environment (already layered by the runner). */
+    env: NodeJS.ProcessEnv;
+}
+export interface QaRunExecResult {
+    /** Process exit code; null when the command never completed normally. */
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    /** Spawn failure / timeout / signal description. Presence means the
+     * command's outcome cannot be trusted. */
+    error?: string;
+}
+/** Injectable child-process executor. `argv[0]` is the executable. */
+export type QaRunExec = (argv: string[], options: QaRunExecOptions) => Promise<QaRunExecResult>;
+/** Grace between the timeout's SIGTERM and the follow-up SIGKILL. A child
+ * that catches SIGTERM (Bun installs a handler by default) gets this long to
+ * exit before the kill is made non-negotiable. */
+export declare const QA_RUN_KILL_GRACE_MS = 5000;
+/** Default executor: spawn with argv arrays only (never a shell string),
+ * closed stdin, bounded output buffers, and the policy timeout.
+ *
+ * Timeout enforcement is escalated and group-wide, via `spawn` rather than
+ * `execFile` for two live-verified reasons. First, a child that catches
+ * SIGTERM while awaiting its own grandchildren turns a single polite kill
+ * into an unbounded wait (a critique command outlived its 120s cap by 10x).
+ * Second, `execFile` resolves only when the child's stdio closes, and an
+ * orphaned grandchild inheriting the pipe keeps it open after the child is
+ * dead — so even a delivered kill did not settle the call. The child is
+ * therefore spawned detached into its own process group; at the deadline the
+ * whole group gets SIGTERM, then SIGKILL after a grace, and the result
+ * settles on exit with whatever output drained, never waiting on a pipe an
+ * orphan still holds. A timed-out command reports an error even if the child
+ * then exits 0 — a result produced after the deadline cannot be trusted. */
+export declare const defaultQaRunExec: QaRunExec;
+export interface QaRunMatrixOptions {
+    /** A validated job (see validateQaRunJob — the runner trusts its shape). */
+    job: QaRunJob;
+    /** PARENT directory for run output. Every invocation creates its own
+     * `run-<run_id>/` beneath it for artifacts and the result document, and
+     * maintains `latest.json` in the parent — a reused parent can therefore
+     * never present an older run's result as the current one. */
+    outParent: string;
+    /** argv prefix that reaches the host CLI's browse command, e.g.
+     * `[process.execPath, cliScript, "browse"]`. */
+    browseArgv: string[];
+    /** Injectable executor (tests). Default: execFile via defaultQaRunExec. */
+    exec?: QaRunExec;
+    /** Extra child-environment overrides layered over process.env. */
+    childEnv?: NodeJS.ProcessEnv;
+    /** Progress callback for human-facing per-stage lines. */
+    onLog?: (message: string) => void;
+    /** Run ID override (tests). Default: crypto.randomUUID(). */
+    runId?: string;
+    /** Working-tree revision probe supplied by the caller (the CLI probes git
+     * once). Ignored when the job itself pins tested_revision. */
+    revisionProbe?: {
+        tested_revision?: string;
+        worktree_dirty?: boolean;
+    };
+    /** Machine-wide admission gate. When present the runner acquires a slot
+     * before any browser work, records the wait as wall_time_ms.queue (never
+     * part of total), and finalizes an incomplete result with an "admission"
+     * blocker when acquisition fails — the evidence trail survives a full
+     * queue. The returned function releases the slot; the runner calls it at
+     * finalize, and a crashed runner's slot is reclaimed by dead-PID pruning. */
+    admission?: {
+        resource: string;
+        acquire: (onWait: (message: string) => void) => Promise<() => void>;
+        /** Snapshot of the other holders of the resource, sampled alongside host
+         * pressure so an incomplete run names what it was competing with. */
+        holders?: () => Array<{
+            label: string;
+            pid: number;
+        }>;
+    };
+    /** Host-injected vision call for the judge stage. The judge runs in this
+     * process over the pack on disk, after every capture browser has closed. */
+    critiqueProvider?: CritiqueProvider;
+    /** Lazy alternative to `critiqueProvider`; called once, after the
+     * headless-only environment has been applied. */
+    critiqueProviderLoader?: () => Promise<CritiqueProvider | undefined>;
+    /** QA snapshot store override (tests, host-managed cache locations). */
+    snapshotStore?: QaSnapshotStoreOptions;
+    /** Renders the command a reader can run to judge the pack later; shown in
+     * the pack's review.md when the judge did not run. */
+    reviewPackJudgeCommand?: (packDir: string) => string;
+    /** True when the run writes into the managed artifact store: the pack's
+     * manifest then says `managed: true` and the expiry sweep may delete it
+     * once `policy.review_pack_retention_minutes` (default 90) have passed
+     * since the judge finished. A pack under an explicit out dir stays
+     * unmanaged and is never deleted automatically. */
+    reviewPackManaged?: boolean;
+}
+/**
+ * Execute the whole QA matrix for one validated job and return the result
+ * (also written to `<outDir>/page-qa-result.json`). Stages: plan →
+ * deterministic gates (bounded pool) → interactions (serial) → capture (each
+ * context rendered once into the run's page review pack through the same
+ * pool, browser closed) → critique (one in-process pool of vision calls over
+ * every tile of every context, no browser open) → snapshot (persisted from
+ * the pack's files in signoff). The verdict is computeVerdict over
+ * everything recorded — fail-closed.
+ */
+export declare function runQaMatrix(options: QaRunMatrixOptions): Promise<QaRunResult>;
+//# sourceMappingURL=qa-run.d.ts.map

package/dist/lib/browser/qa-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qa-run.d.ts","sourceRoot":"","sources":["../../../src/lib/browser/qa-run.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,gBAAgB,EAA2B,MAAM,eAAe,CAAC;AAqB/E,OAAO,EAaL,KAAK,QAAQ,EACb,KAAK,WAAW,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,sBAAsB,EAAkB,MAAM,kBAAkB,CAAC;AAE/E;;;0DAG0D;AAC1D,eAAO,MAAM,wBAAwB,mCAAmC,CAAC;AAEzE,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;6EAE6E;AAC7E,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,MAAM,CA4B5F;AAED;;qEAEqE;AACrE,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;2EAC2E;AAC3E,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAsB9C,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;8CAC0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sEAAsE;AACtE,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhG;;kDAEkD;AAClD,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAO1C;;;;;;;;;;;;;;4EAc4E;AAC5E,eAAO,MAAM,gBAAgB,EAAE,SAiH3B,CAAC;AAEL,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,GAAG,EAAE,QAAQ,CAAC;IACd;;;iEAG6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB;oDACgD;IAChD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;kEAC8D;IAC9D,aAAa,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACvE;;;;;iFAK6E;IAC7E,SAAS,CAAC,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACpE;6EACqE;QACrE,OAAO,CAAC,EAAE,MAAM,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACvD,CAAC;IACF;gFAC4E;IAC5E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;qDACiD;IACjD,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACrE,wEAAwE;IACxE,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;0DACsD;IACtD,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD;;;;uDAImD;IACnD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAiKD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAo6BnF"}