harnery 0.40.0 → 0.41.0

package/dist/lib/pace/pace.js

@@ -0,0 +1,313 @@
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+/**
+ * Human-pace gate for page loads.
+ *
+ * Every Harnery surface that loads a web page (`browse`, `browse-ai`, `fetch`,
+ * and the headed browse-session verbs) reserves a slot here before the request
+ * goes out. Consecutive loads against the same registrable site are spaced by
+ * a random gap inside `[minMs, maxMs]`, the way a person reads one page before
+ * opening the next. Loads against different sites do not wait on each other.
+ * Loopback, private-network, single-label, and reserved-suffix hosts are exempt
+ * so local development and page QA keep running at machine speed.
+ *
+ * The ledger is a small machine-local JSON file (`~/.cache/harnery/pace.json`)
+ * shared by every process, so separate `harn fetch` calls in a shell loop are
+ * paced the same as one long `harn browse` session. A caller reserves the next
+ * slot before it sleeps, so concurrent processes queue behind each other
+ * instead of all firing at once.
+ *
+ * The gate is on by default. `HARNERY_PACE=off` disables it machine-wide and
+ * each command carries `--no-pace` for a single run.
+ */
+export const DEFAULT_PACE_MIN_MS = 3_000;
+export const DEFAULT_PACE_MAX_MS = 9_000;
+export const DEFAULT_PACE_LEDGER = resolve(homedir(), ".cache", "harnery", "pace.json");
+/** Entries idle this long drop out of the ledger on the next write. */
+const LEDGER_RETENTION_MS = 60 * 60 * 1_000;
+/** A lock older than this belongs to a dead process and is reclaimed. */
+const LOCK_STALE_MS = 5_000;
+/** Total time a reservation waits for the ledger lock before proceeding anyway. */
+const LOCK_WAIT_MS = 500;
+const LOCK_POLL_MS = 5;
+const OFF_VALUES = new Set(["off", "0", "false", "no", "none"]);
+/**
+ * Resolve the pace policy from the environment.
+ *
+ * - `HARNERY_PACE`: `off` (or `0`, `false`, `no`) disables the gate. Unset or
+ *   `human` keeps the default.
+ * - `HARNERY_PACE_MIN_MS` / `HARNERY_PACE_MAX_MS`: gap bounds in ms. Both must
+ *   be non-negative integers with min <= max.
+ * - `HARNERY_PACE_EXEMPT`: comma-separated host suffixes that never wait.
+ * - `HARNERY_PACE_LEDGER`: ledger path override.
+ */
+export function pacePolicyFromEnv(env = process.env) {
+    const mode = env.HARNERY_PACE?.trim().toLowerCase();
+    if (mode && mode !== "human" && !OFF_VALUES.has(mode)) {
+        throw new Error(`HARNERY_PACE must be "human" or "off" (got "${env.HARNERY_PACE}").`);
+    }
+    const minMs = readMs(env, "HARNERY_PACE_MIN_MS", DEFAULT_PACE_MIN_MS);
+    const maxMs = readMs(env, "HARNERY_PACE_MAX_MS", DEFAULT_PACE_MAX_MS);
+    if (minMs > maxMs) {
+        throw new Error(`HARNERY_PACE_MIN_MS (${minMs}) must not exceed HARNERY_PACE_MAX_MS (${maxMs}).`);
+    }
+    const exemptSuffixes = (env.HARNERY_PACE_EXEMPT ?? "")
+        .split(",")
+        .map((s) => normalizeHost(s))
+        .filter((s) => s !== null);
+    return {
+        enabled: !(mode && OFF_VALUES.has(mode)),
+        minMs,
+        maxMs,
+        exemptSuffixes,
+        ledgerPath: env.HARNERY_PACE_LEDGER?.trim() || DEFAULT_PACE_LEDGER,
+    };
+}
+function readMs(env, name, fallback) {
+    const raw = env[name]?.trim();
+    if (!raw)
+        return fallback;
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`${name} must be a non-negative integer number of milliseconds (got "${raw}").`);
+    }
+    return Number.parseInt(raw, 10);
+}
+/**
+ * Public suffixes that take two labels, so the registrable site is three
+ * labels deep (`news.bbc.co.uk` -> `bbc.co.uk`). A short curated list is
+ * enough here: the gate only needs sibling hosts of one site to share a key,
+ * and a miss degrades to per-hostname pacing, never to no pacing.
+ */
+const TWO_LABEL_SUFFIXES = new Set([
+    "co.uk",
+    "org.uk",
+    "ac.uk",
+    "gov.uk",
+    "com.au",
+    "net.au",
+    "org.au",
+    "co.nz",
+    "co.jp",
+    "co.kr",
+    "co.in",
+    "co.za",
+    "com.br",
+    "com.mx",
+    "com.ar",
+    "com.cn",
+    "com.tw",
+    "com.sg",
+    "com.tr",
+]);
+/** Reserved or local-only suffixes that are never paced. */
+const EXEMPT_SUFFIXES = ["localhost", "local", "test", "internal", "example", "invalid"];
+function normalizeHost(raw) {
+    const host = raw.trim().toLowerCase().replace(/\.+$/, "");
+    return host ? host : null;
+}
+function hasSuffix(host, suffix) {
+    return host === suffix || host.endsWith(`.${suffix}`);
+}
+function isExemptIpv4(host) {
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    if (!m)
+        return false;
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    return (a === 127 ||
+        a === 10 ||
+        a === 0 ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        (a === 169 && b === 254));
+}
+function isExemptIpv6(host) {
+    const h = host.replace(/^\[|\]$/g, "");
+    return h === "::1" || h === "::" || /^f[cd]/.test(h) || /^fe[89ab]/.test(h);
+}
+/**
+ * Registrable site a URL belongs to for pacing purposes, or `null` when the
+ * URL is exempt: a non-HTTP scheme, a loopback or private address, a
+ * single-label or reserved-suffix host, or a configured exemption.
+ */
+export function paceSiteKey(url, exemptSuffixes = []) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+    const host = normalizeHost(parsed.hostname);
+    if (!host)
+        return null;
+    if (host.startsWith("[") || host.includes(":"))
+        return isExemptIpv6(host) ? null : host;
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host))
+        return isExemptIpv4(host) ? null : host;
+    for (const suffix of EXEMPT_SUFFIXES)
+        if (hasSuffix(host, suffix))
+            return null;
+    for (const suffix of exemptSuffixes)
+        if (hasSuffix(host, suffix))
+            return null;
+    const labels = host.split(".");
+    if (labels.length < 2)
+        return null;
+    const lastTwo = labels.slice(-2).join(".");
+    if (labels.length >= 3 && TWO_LABEL_SUFFIXES.has(lastTwo))
+        return labels.slice(-3).join(".");
+    return lastTwo;
+}
+/** Block the current thread for `ms`. Used by clients that drive a child process synchronously. */
+export function sleepSync(ms) {
+    if (ms <= 0)
+        return;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export class PaceGate {
+    policy;
+    now;
+    random;
+    onWait;
+    constructor(policy, deps = {}) {
+        this.policy = policy;
+        this.now = deps.now ?? Date.now;
+        this.random = deps.random ?? Math.random;
+        this.onWait = deps.onWait;
+    }
+    /** A gate that never waits, for callers that opted out. */
+    static disabled() {
+        return new PaceGate({ ...pacePolicyFromEnv({}), enabled: false });
+    }
+    /**
+     * Reserve the next slot for `url` without sleeping. Returns how long the
+     * caller should wait before loading, or `null` when the URL is exempt or the
+     * gate is disabled. The reservation is recorded even when the wait is zero,
+     * so the next load of the same site owes a gap.
+     */
+    reserve(url) {
+        if (!this.policy.enabled)
+            return null;
+        const site = paceSiteKey(url, this.policy.exemptSuffixes);
+        if (!site)
+            return null;
+        const now = this.now();
+        const gap = this.policy.minMs + this.random() * (this.policy.maxMs - this.policy.minMs);
+        let readyAt = now;
+        withLedgerLock(this.policy.ledgerPath, this.now, () => {
+            const ledger = readLedger(this.policy.ledgerPath);
+            readyAt = Math.max(now, ledger.sites[site]?.nextAllowedAt ?? 0);
+            for (const [key, entry] of Object.entries(ledger.sites)) {
+                if (entry.nextAllowedAt < now - LEDGER_RETENTION_MS)
+                    delete ledger.sites[key];
+            }
+            ledger.sites[site] = { nextAllowedAt: Math.round(readyAt + gap), lastAt: readyAt };
+            writeLedger(this.policy.ledgerPath, ledger);
+        });
+        const wait = { site, waitMs: Math.max(0, Math.round(readyAt - now)) };
+        this.onWait?.(wait);
+        return wait;
+    }
+    /** Reserve a slot and wait it out asynchronously. */
+    async before(url) {
+        const wait = this.reserve(url);
+        if (wait && wait.waitMs > 0) {
+            await new Promise((done) => setTimeout(done, wait.waitMs));
+        }
+        return wait;
+    }
+    /** Reserve a slot and block the thread for it. For `spawnSync`-driven clients. */
+    beforeSync(url) {
+        const wait = this.reserve(url);
+        if (wait && wait.waitMs > 0)
+            sleepSync(wait.waitMs);
+        return wait;
+    }
+}
+/**
+ * Gate for a CLI command run. `null` when the run passed `--no-pace`;
+ * otherwise the environment policy, with every non-zero wait reported through
+ * `log` so the operator can see why a load took longer.
+ */
+export function commandPaceGate(optedIn, log) {
+    if (!optedIn)
+        return null;
+    return new PaceGate(pacePolicyFromEnv(), {
+        onWait: (wait) => {
+            if (wait.waitMs > 0)
+                log(describePaceWait(wait));
+        },
+    });
+}
+/** Describe a wait for a human-facing log line. */
+export function describePaceWait(wait) {
+    const seconds = (wait.waitMs / 1_000).toFixed(1);
+    return `paced ${seconds}s before ${wait.site} (human pace; --no-pace or HARNERY_PACE=off skips)`;
+}
+function readLedger(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed && parsed.version === 1 && parsed.sites && typeof parsed.sites === "object") {
+            const sites = {};
+            for (const [key, entry] of Object.entries(parsed.sites)) {
+                if (entry &&
+                    typeof entry.nextAllowedAt === "number" &&
+                    Number.isFinite(entry.nextAllowedAt) &&
+                    typeof entry.lastAt === "number" &&
+                    Number.isFinite(entry.lastAt)) {
+                    sites[key] = { nextAllowedAt: entry.nextAllowedAt, lastAt: entry.lastAt };
+                }
+            }
+            return { version: 1, sites };
+        }
+    }
+    catch {
+        // Missing or corrupt ledger: start fresh. A lost ledger costs one unpaced
+        // load per site, never a crash.
+    }
+    return { version: 1, sites: {} };
+}
+function writeLedger(path, ledger) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(ledger)}\n`, { mode: 0o600 });
+    renameSync(tmp, path);
+}
+/**
+ * Serialize ledger read-modify-write across processes with an exclusive lock
+ * file. The lock is best-effort: a stale lock from a dead process is reclaimed,
+ * and a caller that cannot get the lock within `LOCK_WAIT_MS` proceeds without
+ * it rather than blocking a page load on a bookkeeping file.
+ */
+function withLedgerLock(path, now, fn) {
+    const lockPath = `${path}.lock`;
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const start = now();
+    let held = false;
+    while (!held && now() - start < LOCK_WAIT_MS) {
+        try {
+            closeSync(openSync(lockPath, "wx", 0o600));
+            held = true;
+        }
+        catch {
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
+                    rmSync(lockPath, { force: true });
+            }
+            catch {
+                // Lock vanished between the failed open and the stat; retry.
+            }
+            sleepSync(LOCK_POLL_MS);
+        }
+    }
+    try {
+        fn();
+    }
+    finally {
+        if (held)
+            rmSync(lockPath, { force: true });
+    }
+}

package/dist/lib/tunnel/forward-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Headers the tunnel gate sends to the upstream after the Host rewrite.
+ *
+ * The gate replaces Host so PHP (and other vhost-routed servers) see the
+ * configured review host. Callers that compare Origin to Host then fail,
+ * because the browser still sends the public tunnel hostname. Copy that
+ * original Host into X-Forwarded-Host, overwriting any client-supplied
+ * value, so the upstream can recover the hostname the browser used.
+ */
+export declare function applyUpstreamHeaders(headers: Headers, vhost: string): void;
+//# sourceMappingURL=forward-headers.d.ts.map

package/dist/lib/tunnel/forward-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-headers.d.ts","sourceRoot":"","sources":["../../../src/lib/tunnel/forward-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAM1E"}

package/dist/lib/tunnel/forward-headers.js

@@ -0,0 +1,17 @@
+/**
+ * Headers the tunnel gate sends to the upstream after the Host rewrite.
+ *
+ * The gate replaces Host so PHP (and other vhost-routed servers) see the
+ * configured review host. Callers that compare Origin to Host then fail,
+ * because the browser still sends the public tunnel hostname. Copy that
+ * original Host into X-Forwarded-Host, overwriting any client-supplied
+ * value, so the upstream can recover the hostname the browser used.
+ */
+export function applyUpstreamHeaders(headers, vhost) {
+    const originalHost = headers.get("host") ?? "";
+    headers.set("host", vhost);
+    if (originalHost)
+        headers.set("x-forwarded-host", originalHost);
+    headers.set("accept-encoding", "identity");
+    headers.delete("connection");
+}

package/dist/lib/tunnel/gate.js

@@ -1,14 +1,16 @@
 // Reverse-proxy worker spawned by `tunnel up`. Listens on 127.0.0.1:<port>
 // and forwards HTTP + WebSocket requests to an upstream with a Host header
-// rewrite and Content-Encoding stripped (Bun's fetch auto-decompresses the
-// body but retains the encoding header, which breaks browser decoding
-// downstream). Cloudflare provider mode checks CF-Connecting-IP against an
-// allowlist; trusted local proxy mode lets the local exposer own access.
+// rewrite, the original Host copied to X-Forwarded-Host, and Content-Encoding
+// stripped (Bun's fetch auto-decompresses the body but retains the encoding
+// header, which breaks browser decoding downstream). Cloudflare provider mode
+// checks CF-Connecting-IP against an allowlist; trusted local proxy mode lets
+// the local exposer own access.
 //
 // Runs detached, outside the CLI command framework; no command context is
 // available; stdout/stderr is captured into .cache/tunnel/gate.log by the
 // spawner.
 import { renderTunnelErrorPage } from "./error-page";
+import { applyUpstreamHeaders } from "./forward-headers";
 // `--port`/`--name` are also passed on argv (not just env) so the gate's port
 // and instance name show up in its process command line. That's what lets
 // `tunnel down` scope its stray-process sweep to a single instance via
@@ -78,15 +80,15 @@ const server = Bun.serve({
             }
         }
         if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
-            if (server.upgrade(req, { data: { path: url.pathname + url.search } })) {
+            if (server.upgrade(req, {
+                data: { path: url.pathname + url.search, originalHost: req.headers.get("host") ?? "" },
+            })) {
                 return undefined;
             }
             return new Response("WS upgrade failed\n", { status: 500 });
         }
         const headers = new Headers(req.headers);
-        headers.set("host", VHOST);
-        headers.set("accept-encoding", "identity");
-        headers.delete("connection");
+        applyUpstreamHeaders(headers, VHOST);
         const init = {
             method: req.method,
             headers,
@@ -135,11 +137,14 @@ const server = Bun.serve({
     },
     websocket: {
         open(ws) {
-            const { path } = ws.data;
+            const { path, originalHost } = ws.data;
             // Bun's WebSocket constructor accepts a `headers` option at runtime
             // even though the standard lib.dom.d.ts WebSocket type doesn't.
             const upstream = new WebSocket(UPSTREAM_WS + path, {
-                headers: { host: VHOST },
+                headers: {
+                    host: VHOST,
+                    ...(originalHost ? { "x-forwarded-host": originalHost } : {}),
+                },
             });
             upstream.binaryType = "arraybuffer";
             ws.upstream = upstream;

package/dist/lib/webview/index.d.ts

@@ -0,0 +1,2 @@
+export { type BunWebViewRuntime, buildWebViewBackend, parseWebViewTypeStep, parseWebViewViewport, type RunWebViewOptions, runWebView, type WebViewBackend, type WebViewConsoleEvent, type WebViewResult, type WebViewTypeStep, WebViewUnavailableError, } from "./webview.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/webview/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/webview/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/lib/webview/index.js

@@ -0,0 +1 @@
+export { buildWebViewBackend, parseWebViewTypeStep, parseWebViewViewport, runWebView, WebViewUnavailableError, } from "./webview.js";

package/dist/lib/webview/webview.d.ts

@@ -0,0 +1,116 @@
+import { PaceGate } from "../pace/index.js";
+export type WebViewBackend = "auto" | "chrome" | "webkit";
+type WebViewConsoleHandler = (type: string, ...args: unknown[]) => void;
+interface WebViewBackendOptions {
+    type: "chrome";
+    url: false;
+    path?: string;
+    argv?: string[];
+}
+interface WebViewConstructorOptions {
+    width: number;
+    height: number;
+    backend?: "webkit" | WebViewBackendOptions;
+    console?: WebViewConsoleHandler;
+    dataStore?: "ephemeral" | {
+        directory: string;
+    };
+}
+interface WebViewLike {
+    readonly url: string;
+    readonly title: string;
+    readonly loading: boolean;
+    onNavigated: ((url: string, title: string) => void) | null;
+    onNavigationFailed: ((error: Error) => void) | null;
+    navigate(url: string): Promise<void>;
+    evaluate(script: string): Promise<unknown>;
+    screenshot(options: {
+        format: "png";
+        encoding: "buffer";
+    }): Promise<Blob | Buffer | string | {
+        name: string;
+        size: number;
+    }>;
+    click(selector: string, options?: {
+        timeout?: number;
+    }): Promise<void>;
+    type(text: string): Promise<void>;
+    press(key: string): Promise<void>;
+    scrollTo(selector: string, options?: {
+        block?: "start" | "center" | "end" | "nearest";
+        timeout?: number;
+    }): Promise<void>;
+    close(): void;
+}
+export interface BunWebViewRuntime {
+    version?: string;
+    WebView: new (options: WebViewConstructorOptions) => WebViewLike;
+}
+export interface WebViewTypeStep {
+    selector: string;
+    text: string;
+}
+export interface RunWebViewOptions {
+    /** Explicit UA, "auto", or "native"; Chrome uses the shared store by default. */
+    userAgent?: string;
+    backend?: WebViewBackend;
+    viewport?: {
+        width: number;
+        height: number;
+    };
+    profileDir?: string;
+    chromePath?: string;
+    browserArgs?: string[];
+    timeoutMs?: number;
+    waitFor?: string;
+    typeSteps?: WebViewTypeStep[];
+    clicks?: string[];
+    presses?: string[];
+    evaluate?: string;
+    settleMs?: number;
+    screenshotPath?: string;
+    captureHtml?: boolean;
+    platform?: NodeJS.Platform;
+    runtime?: BunWebViewRuntime;
+    /**
+     * Human-pace gate applied before the load. Unset resolves the default from
+     * the `HARNERY_PACE*` environment; `null` disables pacing for this run.
+     */
+    pace?: PaceGate | null;
+}
+export interface WebViewConsoleEvent {
+    type: string;
+    args: unknown[];
+}
+export interface WebViewResult {
+    backend: "chrome" | "webkit";
+    runtimeVersion: string | null;
+    url: string;
+    title: string;
+    text: string;
+    html?: string;
+    evaluation?: unknown;
+    screenshotPath?: string;
+    consoleEvents: WebViewConsoleEvent[];
+    elapsedMs: number;
+}
+export declare class WebViewUnavailableError extends Error {
+    readonly code = "webview_unavailable";
+    constructor(message: string);
+}
+export declare function parseWebViewViewport(value: string): {
+    width: number;
+    height: number;
+};
+export declare function parseWebViewTypeStep(value: string): WebViewTypeStep;
+export declare function buildWebViewBackend(backend: WebViewBackend, options: {
+    platform: NodeJS.Platform;
+    chromePath?: string;
+    browserArgs?: string[];
+}): {
+    backend?: "webkit" | WebViewBackendOptions;
+    resolved: "chrome" | "webkit";
+};
+export declare function runWebView(url: string, options?: RunWebViewOptions): Promise<WebViewResult>;
+export {};
+//# sourceMappingURL=webview.d.ts.map

package/dist/lib/webview/webview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webview.d.ts","sourceRoot":"","sources":["../../../src/lib/webview/webview.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,QAAQ,EAAqB,MAAM,kBAAkB,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,KAAK,qBAAqB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAExE,UAAU,qBAAqB;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,KAAK,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,QAAQ,GAAG,qBAAqB,CAAC;IAC3C,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,SAAS,CAAC,EAAE,WAAW,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3D,kBAAkB,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,UAAU,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,KAAK,CAAC;QACd,QAAQ,EAAE,QAAQ,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;QAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,OAAO,EAAE,yBAAyB,KAAK,WAAW,CAAC;CAClE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,yBAAyB;gBAE1B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAWA;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAUnE;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GACA;IACD,OAAO,CAAC,EAAE,QAAQ,GAAG,qBAAqB,CAAC;IAC3C,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CA8BA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,CAAC,CA+GxB"}