homebridge-plugin-utils 1.34.0 → 2.0.0

package/dist/logclient/config.d.ts

@@ -0,0 +1,173 @@
+import type { Nullable } from "../util.ts";
+export declare const DEFAULT_CONFIG_FILENAME = ".hblog.json";
+/**
+ * The shape of the optional `~/.hblog.json` config file. Every field is optional; unknown keys in the file are ignored. The file deliberately carries no `otp` field - a
+ * one-time passcode is, by definition, single-use and time-bound, so it only ever comes from the `--otp` flag or the `HBLOG_OTP` environment variable, never from a
+ * persisted file.
+ *
+ * @property host     - The hostname or IP of the homebridge-config-ui-x server.
+ * @property password - The account password, for username/password authentication.
+ * @property port     - The TCP port the server listens on.
+ * @property tls      - Whether to use the secure (`https`/`wss`) schemes.
+ * @property token    - A pre-acquired bearer token, used verbatim.
+ * @property username - The account username, for username/password authentication.
+ *
+ * @category Log Client
+ */
+export interface HblogConfigFile {
+    readonly host?: string;
+    readonly password?: string;
+    readonly port?: number;
+    readonly tls?: boolean;
+    readonly token?: string;
+    readonly username?: string;
+}
+/**
+ * The environment-variable slice consulted by {@link resolveConnection}. The CLI reads these from `process.env` (`HBLOG_HOST`, `HBLOG_PORT`, `HBLOG_USER`, `HBLOG_PASS`,
+ * `HBLOG_TOKEN`, `HBLOG_OTP`) and passes them here as already-extracted values so the resolver itself touches no globals.
+ *
+ * @property host     - The `HBLOG_HOST` value.
+ * @property otp      - The `HBLOG_OTP` value (a one-time passcode).
+ * @property password - The `HBLOG_PASS` value.
+ * @property port     - The `HBLOG_PORT` value (still a string here; parsed during resolution).
+ * @property token    - The `HBLOG_TOKEN` value.
+ * @property username - The `HBLOG_USER` value.
+ *
+ * @category Log Client
+ */
+export interface HblogEnv {
+    readonly host?: string;
+    readonly otp?: string;
+    readonly password?: string;
+    readonly port?: string;
+    readonly token?: string;
+    readonly username?: string;
+}
+/**
+ * The command-line connection flags consulted by {@link resolveConnection}. These are the parsed `--host`, `--port`, `--tls`, `--user`, `--pass`, `--token`, and `--otp`
+ * values. They take the highest precedence in the merge.
+ *
+ * @property host     - The `--host` value.
+ * @property otp      - The `--otp` value.
+ * @property password - The `--pass` value.
+ * @property port     - The `--port` value (already parsed to a number by the flag parser, or omitted).
+ * @property tls      - The `--tls` value.
+ * @property token    - The `--token` value.
+ * @property username - The `--user` value.
+ *
+ * @category Log Client
+ */
+export interface HblogConnectionFlags {
+    readonly host?: string;
+    readonly otp?: string;
+    readonly password?: string;
+    readonly port?: number;
+    readonly tls?: boolean;
+    readonly token?: string;
+    readonly username?: string;
+}
+/**
+ * The fully-resolved connection produced by {@link resolveConnection}: the connection target plus the credential material the CLI uses to build a
+ * {@link logclient/types!LogClientCredentials | LogClientCredentials} discriminated union. `host`, `port`, and `tls` always carry a concrete value (defaults applied);
+ * the credential fields are {@link Nullable} because none, some, or all of them may have been supplied across the three sources.
+ *
+ * @property host     - The resolved hostname or IP.
+ * @property otp      - The resolved one-time passcode, or `null` when none was supplied.
+ * @property password - The resolved password, or `null` when none was supplied.
+ * @property port     - The resolved TCP port.
+ * @property tls      - The resolved TLS flag.
+ * @property token    - The resolved bearer token, or `null` when none was supplied.
+ * @property username - The resolved username, or `null` when none was supplied.
+ *
+ * @category Log Client
+ */
+export interface ResolvedConnection {
+    readonly host: string;
+    readonly otp: Nullable<string>;
+    readonly password: Nullable<string>;
+    readonly port: number;
+    readonly tls: boolean;
+    readonly token: Nullable<string>;
+    readonly username: Nullable<string>;
+}
+/**
+ * Options accepted by {@link loadConfigFile}: the injectable filesystem and warning seams. All default to the real Node implementations / a `process.stderr` writer, so a
+ * caller (the CLI) can omit them in production and a test can supply doubles.
+ *
+ * @property readFile - Reads the file's UTF-8 text. Defaults to `node:fs/promises` `readFile`. A rejection whose `code` is `ENOENT` is treated as "file absent."
+ * @property stat     - Stats the file for its permission mode. Defaults to `node:fs/promises` `stat`. Used only for the group/other-readable security warning.
+ * @property warn     - Sink for the single one-line security warning. Defaults to a `process.stderr` writer. Injected so a test asserts the warning without capturing
+ *                      real stderr.
+ *
+ * @category Log Client
+ */
+export interface LoadConfigFileOptions {
+    readonly readFile?: (path: string) => Promise<string>;
+    readonly stat?: (path: string) => Promise<{
+        readonly mode: number;
+    }>;
+    readonly warn?: (message: string) => void;
+}
+/**
+ * Load and parse the optional `~/.hblog.json` config file.
+ *
+ * The file is optional: when it does not exist (ENOENT) this resolves to `undefined` silently. Every other failure is thrown as a clear, actionable error naming the
+ * path: a non-ENOENT read failure (a permission or I/O fault), a file that cannot be parsed as JSON, or a file whose top-level value is not a JSON object. Recognized
+ * keys ({@link HblogConfigFile}) are picked out by type (a wrong-typed field is ignored, not coerced); any unknown key is ignored. As a security courtesy, if the file's
+ * permissions allow group or other access (`mode & 0o077`), a single one-line warning recommending `chmod 600` is emitted through the `warn` seam, because the file may
+ * store a password or a long-lived token in plaintext.
+ *
+ * @param path    - The absolute path of the config file to load (the CLI resolves `~/.hblog.json`, or honors `HBLOG_CONFIG`).
+ * @param options - The injectable filesystem and warning seams. See {@link LoadConfigFileOptions}.
+ *
+ * @returns The parsed {@link HblogConfigFile}, or `undefined` when the file is absent (ENOENT).
+ *
+ * @throws `Error` when the file exists but cannot be read (a non-ENOENT read failure), contains malformed JSON, or whose top-level value is not a JSON object.
+ *
+ * @category Log Client
+ */
+export declare function loadConfigFile(path: string, options?: LoadConfigFileOptions): Promise<HblogConfigFile | undefined>;
+/**
+ * Resolve the absolute path of the config file to load.
+ *
+ * The `HBLOG_CONFIG` environment variable overrides everything when set to a non-empty value (handy for tests and non-standard layouts); otherwise the default
+ * {@link DEFAULT_CONFIG_FILENAME} (`.hblog.json`) under the supplied home directory is used. Home-dir only - there is no project-local config file, so a config carrying
+ * a password or token is never tempting to commit alongside a plugin's source. The join uses a single forward slash, which both POSIX and Windows accept in a path passed
+ * to `readFile`, so no `node:path` import is needed on this hot setup path.
+ *
+ * @param sources         - The path inputs.
+ * @param sources.env     - The environment map; only `HBLOG_CONFIG` is consulted.
+ * @param sources.homedir - The user's home directory, the anchor for the default config-file path.
+ *
+ * @returns The absolute path to load the config file from.
+ *
+ * @category Log Client
+ */
+export declare function resolveConfigPath(sources: {
+    env: NodeJS.ProcessEnv;
+    homedir: string;
+}): string;
+/**
+ * Resolve the three configuration sources into a single {@link ResolvedConnection}, applying the precedence flags > environment > file > defaults.
+ *
+ * This is a PURE function: it reads only its arguments and allocates only the result, performing no I/O. The caller is responsible for having loaded the file (via
+ * {@link loadConfigFile}), extracted the environment slice, and parsed the flags. `host`, `port`, and `tls` always resolve to a concrete value (their defaults are
+ * `localhost`, `8581`, and `false`); the credential fields resolve to `null` when no source supplied them, leaving the CLI to decide which
+ * {@link logclient/types!LogClientCredentials | LogClientCredentials} arm the resolved material implies. The `port` from the environment is a string, so it is
+ * parsed here; a non-numeric `HBLOG_PORT` is ignored (falls through to the next source) rather than producing a `NaN` port.
+ *
+ * @param sources       - The three configuration sources.
+ * @param sources.env   - The environment slice. See {@link HblogEnv}.
+ * @param sources.file  - The loaded config file, or `undefined` when absent. See {@link HblogConfigFile}.
+ * @param sources.flags - The parsed command-line flags. See {@link HblogConnectionFlags}.
+ *
+ * @returns The fully-resolved connection.
+ *
+ * @category Log Client
+ */
+export declare function resolveConnection(sources: {
+    env: HblogEnv;
+    file: HblogConfigFile | undefined;
+    flags: HblogConnectionFlags;
+}): ResolvedConnection;
+//# sourceMappingURL=config.d.ts.map

package/dist/logclient/config.js

@@ -0,0 +1,199 @@
+/* Copyright(C) 2017-2026, HJD (https://github.com/hjdhjd). All rights reserved.
+ *
+ * logclient/config.ts: CLI-layer config-file loading and pure connection resolution for the hblog tool.
+ */
+/**
+ * CLI-layer configuration for the `hblog` tool: loading the optional `~/.hblog.json` file and the pure merge of file / environment / flags into a connection.
+ *
+ * This module lives at the CLI layer on purpose: the engine ({@link logclient/client!HomebridgeLogClient | HomebridgeLogClient} and its transports) never reads the
+ * user's home directory or any config file - all file I/O stays here, behind injectable seams, so the engine is portable and side-effect-free. This module exports the
+ * following pieces:
+ *
+ * - {@link resolveConfigPath} - resolve the absolute config-file path, honoring the `HBLOG_CONFIG` environment override over the home-directory default
+ *   ({@link DEFAULT_CONFIG_FILENAME}).
+ * - {@link loadConfigFile} - read and parse the optional `~/.hblog.json`. A missing file resolves to `undefined` silently (the file is optional); a malformed file raises
+ *   a clear, actionable error; unknown keys are ignored; and a file whose permissions are group/other-readable triggers a single one-line warning recommending `chmod
+ *   600`, because the file may carry a password or a long-lived token in plaintext. The `readFile`, `stat`, and `warn` seams are injected so the loader is unit-tested
+ *   without touching the real filesystem.
+ * - {@link resolveConnection} - a PURE merge of the configuration sources into one resolved connection, applying the precedence flags > environment > file > defaults.
+ *   It performs no I/O of its own; the caller supplies the already-loaded file, the environment slice, and the parsed flags.
+ *
+ * @module
+ */
+import { DEFAULT_HOST, DEFAULT_PORT } from "./settings.js";
+import { formatErrorMessage } from "../util.js";
+// The default path of the optional config file, relative to the user's home directory. Home-dir only (no project-local file) so a config carrying a password or token is
+// never tempting to commit alongside a plugin's source. The CLI resolves this against the real home directory; the `HBLOG_CONFIG` environment variable overrides it.
+export const DEFAULT_CONFIG_FILENAME = ".hblog.json";
+// The permission mask that flags a config file as too permissive: any group or other read/write/execute bit set. A file carrying a plaintext credential should be owner-
+// only (mode 600); when any of these bits is present we warn once and recommend `chmod 600`. We mask the raw `mode` (which carries file-type bits in its high bits) with
+// this so only the group/other permission triplet is consulted.
+const GROUP_OTHER_MASK = 0o077;
+// The default `readFile` seam: read the file as UTF-8 text via `node:fs/promises`. Imported lazily inside the default so a caller that always injects its own seam pays
+// no `node:fs/promises` import cost, and the engine-adjacent module stays free of an unconditional Node filesystem dependency at load time.
+async function defaultReadFile(path) {
+    const { readFile } = await import("node:fs/promises");
+    return readFile(path, "utf8");
+}
+// The default `stat` seam: stat the file via `node:fs/promises`, narrowing to just the `mode` field the permission check needs. Lazily imported for the same reason as
+// the read seam.
+async function defaultStat(path) {
+    const { stat } = await import("node:fs/promises");
+    const stats = await stat(path);
+    return { mode: stats.mode };
+}
+// Test whether a thrown filesystem error denotes a missing file. Node's `readFile`/`stat` reject with an error carrying `code: "ENOENT"` when the path does not exist;
+// that is the silent "no config file" case rather than a failure. We read `code` defensively off an unknown error shape.
+function isFileNotFound(error) {
+    return (typeof error === "object") && (error !== null) && ("code" in error) && (error.code === "ENOENT");
+}
+// Narrow an unknown parsed JSON value to a plain record (a JSON object) so individual fields can be read without unsafe member access. An array is excluded: a config
+// file whose top level is an array (or any non-object) is malformed, so it must not be treated as a record.
+function isRecord(value) {
+    return (typeof value === "object") && (value !== null) && !Array.isArray(value);
+}
+// Read one optional string field off the parsed config record. A present non-string value is ignored (treated as absent) rather than coerced, so a malformed field type
+// degrades to "unset" rather than smuggling a number/boolean into a string slot.
+function readString(record, key) {
+    const value = record[key];
+    return (typeof value === "string") ? value : undefined;
+}
+// Read the named optional numeric field off the parsed config record. A present non-number value is ignored (treated as absent) rather than coerced.
+function readNumber(record, key) {
+    const value = record[key];
+    return (typeof value === "number") ? value : undefined;
+}
+// Read the named optional boolean field off the parsed config record. A present non-boolean value is ignored (treated as absent) rather than coerced.
+function readBoolean(record, key) {
+    const value = record[key];
+    return (typeof value === "boolean") ? value : undefined;
+}
+/**
+ * Load and parse the optional `~/.hblog.json` config file.
+ *
+ * The file is optional: when it does not exist (ENOENT) this resolves to `undefined` silently. Every other failure is thrown as a clear, actionable error naming the
+ * path: a non-ENOENT read failure (a permission or I/O fault), a file that cannot be parsed as JSON, or a file whose top-level value is not a JSON object. Recognized
+ * keys ({@link HblogConfigFile}) are picked out by type (a wrong-typed field is ignored, not coerced); any unknown key is ignored. As a security courtesy, if the file's
+ * permissions allow group or other access (`mode & 0o077`), a single one-line warning recommending `chmod 600` is emitted through the `warn` seam, because the file may
+ * store a password or a long-lived token in plaintext.
+ *
+ * @param path    - The absolute path of the config file to load (the CLI resolves `~/.hblog.json`, or honors `HBLOG_CONFIG`).
+ * @param options - The injectable filesystem and warning seams. See {@link LoadConfigFileOptions}.
+ *
+ * @returns The parsed {@link HblogConfigFile}, or `undefined` when the file is absent (ENOENT).
+ *
+ * @throws `Error` when the file exists but cannot be read (a non-ENOENT read failure), contains malformed JSON, or whose top-level value is not a JSON object.
+ *
+ * @category Log Client
+ */
+export async function loadConfigFile(path, options = {}) {
+    const readFile = options.readFile ?? defaultReadFile;
+    const stat = options.stat ?? defaultStat;
+    const warn = options.warn ?? ((message) => { process.stderr.write(message + "\n"); });
+    let text;
+    try {
+        text = await readFile(path);
+    }
+    catch (error) {
+        // A missing file is the silent, expected "no config" case; any other read failure (a permission error, an I/O fault) is a genuine problem the user should see.
+        if (isFileNotFound(error)) {
+            return undefined;
+        }
+        throw new Error("Unable to read the config file " + path + ": " + formatErrorMessage(error) + ".");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error("The config file " + path + " is not valid JSON: " + formatErrorMessage(error) + ". Fix the file or remove it.");
+    }
+    if (!isRecord(parsed)) {
+        throw new Error("The config file " + path + " must contain a JSON object. Fix the file or remove it.");
+    }
+    // Stat the file for its permission mode and warn once if it is group/other-readable. A stat failure here is non-fatal: the file parsed fine, so we skip the security
+    // courtesy rather than fail the load over an inability to read permissions (e.g., on a filesystem that does not report a meaningful mode).
+    try {
+        const stats = await stat(path);
+        if ((stats.mode & GROUP_OTHER_MASK) !== 0) {
+            warn("Warning: the config file " + path + " is readable by other users; it may contain credentials. Run `chmod 600 " + path + "` to restrict it to your account.");
+        }
+    }
+    catch {
+        // Permissions could not be determined; skip the security warning rather than fail an otherwise-valid load.
+    }
+    // Pick out the recognized keys by type; unknown keys and wrong-typed values are ignored. Building a fresh object (rather than returning `parsed`) keeps the result
+    // exactly the declared shape and drops any extraneous keys the file carried.
+    return {
+        host: readString(parsed, "host"),
+        password: readString(parsed, "password"),
+        port: readNumber(parsed, "port"),
+        tls: readBoolean(parsed, "tls"),
+        token: readString(parsed, "token"),
+        username: readString(parsed, "username")
+    };
+}
+/**
+ * Resolve the absolute path of the config file to load.
+ *
+ * The `HBLOG_CONFIG` environment variable overrides everything when set to a non-empty value (handy for tests and non-standard layouts); otherwise the default
+ * {@link DEFAULT_CONFIG_FILENAME} (`.hblog.json`) under the supplied home directory is used. Home-dir only - there is no project-local config file, so a config carrying
+ * a password or token is never tempting to commit alongside a plugin's source. The join uses a single forward slash, which both POSIX and Windows accept in a path passed
+ * to `readFile`, so no `node:path` import is needed on this hot setup path.
+ *
+ * @param sources         - The path inputs.
+ * @param sources.env     - The environment map; only `HBLOG_CONFIG` is consulted.
+ * @param sources.homedir - The user's home directory, the anchor for the default config-file path.
+ *
+ * @returns The absolute path to load the config file from.
+ *
+ * @category Log Client
+ */
+export function resolveConfigPath(sources) {
+    const override = sources.env["HBLOG_CONFIG"];
+    if ((override !== undefined) && (override.length > 0)) {
+        return override;
+    }
+    return sources.homedir.replace(/[/\\]+$/, "") + "/" + DEFAULT_CONFIG_FILENAME;
+}
+// Resolve one optional string across the three sources in precedence order (flags > env > file), returning `null` when none supplied. The first defined value wins; an
+// empty string is a defined value (the user explicitly passed it) so it is honored rather than skipped.
+function pickString(flag, env, file) {
+    return flag ?? env ?? file ?? null;
+}
+/**
+ * Resolve the three configuration sources into a single {@link ResolvedConnection}, applying the precedence flags > environment > file > defaults.
+ *
+ * This is a PURE function: it reads only its arguments and allocates only the result, performing no I/O. The caller is responsible for having loaded the file (via
+ * {@link loadConfigFile}), extracted the environment slice, and parsed the flags. `host`, `port`, and `tls` always resolve to a concrete value (their defaults are
+ * `localhost`, `8581`, and `false`); the credential fields resolve to `null` when no source supplied them, leaving the CLI to decide which
+ * {@link logclient/types!LogClientCredentials | LogClientCredentials} arm the resolved material implies. The `port` from the environment is a string, so it is
+ * parsed here; a non-numeric `HBLOG_PORT` is ignored (falls through to the next source) rather than producing a `NaN` port.
+ *
+ * @param sources       - The three configuration sources.
+ * @param sources.env   - The environment slice. See {@link HblogEnv}.
+ * @param sources.file  - The loaded config file, or `undefined` when absent. See {@link HblogConfigFile}.
+ * @param sources.flags - The parsed command-line flags. See {@link HblogConnectionFlags}.
+ *
+ * @returns The fully-resolved connection.
+ *
+ * @category Log Client
+ */
+export function resolveConnection(sources) {
+    const { env, file, flags } = sources;
+    // Parse the environment port from its string form. A non-numeric value is discarded so it does not mask a lower-precedence source with a `NaN`; an integer parse is
+    // used since a port is a whole number.
+    const envPort = (env.port !== undefined) ? Number.parseInt(env.port, 10) : undefined;
+    const envPortValid = (envPort !== undefined) && Number.isFinite(envPort);
+    return {
+        host: flags.host ?? env.host ?? file?.host ?? DEFAULT_HOST,
+        // A one-time passcode is single-use and time-bound, so the config file deliberately never persists one; the file source here is intentionally `undefined`.
+        otp: pickString(flags.otp, env.otp, undefined),
+        password: pickString(flags.password, env.password, file?.password),
+        port: flags.port ?? (envPortValid ? envPort : undefined) ?? file?.port ?? DEFAULT_PORT,
+        tls: flags.tls ?? file?.tls ?? false,
+        token: pickString(flags.token, env.token, file?.token),
+        username: pickString(flags.username, env.username, file?.username)
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/logclient/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/logclient/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,yKAAyK;AACzK,qKAAqK;AACrK,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,yKAAyK;AACzK,yKAAyK;AACzK,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAsH/B,wKAAwK;AACxK,4IAA4I;AAC5I,KAAK,UAAU,eAAe,CAAC,IAAY;IAEzC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEtD,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,uKAAuK;AACvK,iBAAiB;AACjB,KAAK,UAAU,WAAW,CAAC,IAAY;IAErC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAElD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,uKAAuK;AACvK,yHAAyH;AACzH,SAAS,cAAc,CAAC,KAAc;IAEpC,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,sKAAsK;AACtK,4GAA4G;AAC5G,SAAS,QAAQ,CAAC,KAAc;IAE9B,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,wKAAwK;AACxK,iFAAiF;AACjF,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAE9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAE1B,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,qJAAqJ;AACrJ,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAE9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAE1B,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,sJAAsJ;AACtJ,SAAS,WAAW,CAAC,MAA+B,EAAE,GAAW;IAE/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAE1B,OAAO,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,UAAiC,EAAE;IAEpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QAEH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAM,KAAc,EAAE,CAAC;QAEvB,+JAA+J;QAC/J,IAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAEzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,IAAI,GAAG,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QAEH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAM,KAAc,EAAE,CAAC;QAEvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,GAAG,sBAAsB,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,8BAA8B,CAAC,CAAC;IACnI,CAAC;IAED,IAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAErB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,GAAG,yDAAyD,CAAC,CAAC;IACzG,CAAC;IAED,qKAAqK;IACrK,2IAA2I;IAC3I,IAAI,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAG,CAAC,KAAK,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAEzC,IAAI,CAAC,2BAA2B,GAAG,IAAI,GAAG,0EAA0E,GAAG,IAAI,GAAG,mCAAmC,CAAC,CAAC;QACrK,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAEP,2GAA2G;IAC7G,CAAC;IAED,mKAAmK;IACnK,6EAA6E;IAC7E,OAAO;QAEL,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QAChC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC;QACxC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QAChC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;QAC/B,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAClC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoD;IAEpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAE7C,IAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAErD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,uBAAuB,CAAC;AAChF,CAAC;AAED,uKAAuK;AACvK,wGAAwG;AACxG,SAAS,UAAU,CAAC,IAAwB,EAAE,GAAuB,EAAE,IAAwB;IAE7F,OAAO,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0F;IAE1H,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAErC,oKAAoK;IACpK,uCAAuC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzE,OAAO;QAEL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,YAAY;QAC1D,2JAA2J;QAC3J,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;QAC9C,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,YAAY;QACtF,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,KAAK;QACpC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;QACtD,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;KACnE,CAAC;AACJ,CAAC"}

package/dist/logclient/endpoints.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The connection target shared by every URL builder in this module.
+ *
+ * @property host - The hostname or IP address of the homebridge-config-ui-x server.
+ * @property port - The TCP port the server listens on.
+ * @property tls  - When `true`, URLs use the secure scheme (`https`/`wss`); when `false` or omitted, the plaintext scheme (`http`/`ws`).
+ *
+ * @category Log Client
+ */
+export interface EndpointTarget {
+    readonly host: string;
+    readonly port: number;
+    readonly tls?: boolean;
+}
+/**
+ * Build the HTTP(S) base URL (scheme + authority, no trailing slash) for the REST and auth endpoints.
+ *
+ * The returned string is the origin only - callers append the specific API path. We construct it through the platform `URL` so host and port are normalized and
+ * encoded consistently, then read `URL.origin`, which yields the scheme + authority with no trailing slash, so callers can concatenate a leading-slash path without
+ * producing a double slash.
+ *
+ * @param target - The connection target. See {@link EndpointTarget}.
+ *
+ * @returns The origin, e.g. `https://localhost:8581`, with no trailing slash.
+ *
+ * @category Log Client
+ */
+export declare function httpBaseUrl(target: EndpointTarget): string;
+/**
+ * The connection target plus the raw handshake token, used to build the WebSocket connect URL.
+ *
+ * @property token - The raw JWT, passed verbatim in the query string. The server's WebSocket guard reads `client.handshake.query.token` with no `Bearer` prefix and no
+ *                   fallback, so the token must be the bare JWT.
+ *
+ * @category Log Client
+ */
+export interface SocketTarget extends EndpointTarget {
+    readonly token: string;
+}
+/**
+ * Build the WebSocket connect URL for the live-log Socket.IO stream.
+ *
+ * The URL carries the Engine.IO version, the WebSocket transport selector, and the raw token in its query string; the server's handshake guard authenticates from that
+ * token alone. We build through the platform `URL` and `searchParams` so the token is percent-encoded correctly (a JWT contains `.` and may carry `-`/`_` from base64url,
+ * which are URL-safe, but routing through `searchParams` keeps encoding correct regardless of token shape).
+ *
+ * @param target - The connection target plus the raw token. See {@link SocketTarget}.
+ *
+ * @returns The full `ws(s)://host:port/socket.io/?EIO=4&transport=websocket&token=<rawjwt>` connect URL.
+ *
+ * @category Log Client
+ */
+export declare function socketUrl(target: SocketTarget): string;
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/logclient/endpoints.js

@@ -0,0 +1,73 @@
+/* Copyright(C) 2017-2026, HJD (https://github.com/hjdhjd). All rights reserved.
+ *
+ * logclient/endpoints.ts: Authority and URL construction for the Homebridge UI log client.
+ */
+/**
+ * Single authority for constructing the URLs the log client connects to.
+ *
+ * Every transport (`auth.ts`, `rest.ts`, `socket.ts`) applies the same TLS-to-scheme mapping (http/https for REST and auth, ws/wss for the socket) and authority assembly
+ * over the same host + port. Routing that derivation through one module keeps the mapping and assembly in exactly one place, so a change to how URLs are built propagates
+ * everywhere rather than being re-derived (and potentially diverging) at each call site. The functions are pure string builders with no I/O.
+ *
+ * @module
+ */
+import { SOCKET_PATH } from "./settings.js";
+// Format a host for inclusion in a URL authority, bracketing a bare IPv6 literal as the URL syntax requires. A literal IPv6 address contains colons, which collide with
+// the host:port separator, so the URL grammar requires it to be wrapped in square brackets (`[::1]:8581`). A hostname or IPv4 address passes through unchanged. We
+// detect an IPv6 literal by the presence of a colon and the absence of existing brackets, which is sufficient because no hostname or IPv4 address contains a colon.
+function formatHost(host) {
+    if (host.includes(":") && !host.startsWith("[")) {
+        return "[" + host + "]";
+    }
+    return host;
+}
+// Build the scheme + authority origin for a target under a given scheme. We assemble the authority string by hand (bracketing IPv6) and construct a `URL` from the
+// complete string so the platform validates and normalizes it in one pass - rather than mutating an empty `URL`'s `hostname`, whose setter silently rejects a bare IPv6
+// literal. The `URL.origin` is the scheme + authority with no trailing slash; `httpBaseUrl` exposes that origin string for downstream path concatenation, while
+// `socketUrl` keeps the `URL` object and configures it further via `pathname`/`searchParams`.
+function originFor(scheme, target) {
+    return new URL(scheme + "://" + formatHost(target.host) + ":" + target.port.toString());
+}
+/**
+ * Build the HTTP(S) base URL (scheme + authority, no trailing slash) for the REST and auth endpoints.
+ *
+ * The returned string is the origin only - callers append the specific API path. We construct it through the platform `URL` so host and port are normalized and
+ * encoded consistently, then read `URL.origin`, which yields the scheme + authority with no trailing slash, so callers can concatenate a leading-slash path without
+ * producing a double slash.
+ *
+ * @param target - The connection target. See {@link EndpointTarget}.
+ *
+ * @returns The origin, e.g. `https://localhost:8581`, with no trailing slash.
+ *
+ * @category Log Client
+ */
+export function httpBaseUrl(target) {
+    // The scheme follows the TLS flag: `https` when secure, `http` otherwise. `URL.origin` yields the scheme + authority with no path - exactly the trailing-slash-free
+    // base callers want to append a leading-slash path to.
+    return originFor(target.tls === true ? "https" : "http", target).origin;
+}
+/**
+ * Build the WebSocket connect URL for the live-log Socket.IO stream.
+ *
+ * The URL carries the Engine.IO version, the WebSocket transport selector, and the raw token in its query string; the server's handshake guard authenticates from that
+ * token alone. We build through the platform `URL` and `searchParams` so the token is percent-encoded correctly (a JWT contains `.` and may carry `-`/`_` from base64url,
+ * which are URL-safe, but routing through `searchParams` keeps encoding correct regardless of token shape).
+ *
+ * @param target - The connection target plus the raw token. See {@link SocketTarget}.
+ *
+ * @returns The full `ws(s)://host:port/socket.io/?EIO=4&transport=websocket&token=<rawjwt>` connect URL.
+ *
+ * @category Log Client
+ */
+export function socketUrl(target) {
+    // The WebSocket schemes mirror the HTTP schemes: `wss` for TLS, `ws` otherwise. We start from the validated origin, then set the Socket.IO mount path and the standard
+    // Engine.IO query parameters; the server requires `EIO=4` and the `websocket` transport for a raw WebSocket connection. Routing the token through `searchParams`
+    // percent-encodes it correctly regardless of its character set.
+    const url = originFor(target.tls === true ? "wss" : "ws", target);
+    url.pathname = SOCKET_PATH;
+    url.searchParams.set("EIO", "4");
+    url.searchParams.set("transport", "websocket");
+    url.searchParams.set("token", target.token);
+    return url.toString();
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/logclient/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/logclient/endpoints.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,wKAAwK;AACxK,mKAAmK;AACnK,oKAAoK;AACpK,SAAS,UAAU,CAAC,IAAY;IAE9B,IAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAE/C,OAAO,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mKAAmK;AACnK,wKAAwK;AACxK,gKAAgK;AAChK,8FAA8F;AAC9F,SAAS,SAAS,CAAC,MAAc,EAAE,MAAsB;IAEvD,OAAO,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1F,CAAC;AAkBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAAsB;IAEhD,oKAAoK;IACpK,uDAAuD;IACvD,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,MAAoB;IAE5C,uKAAuK;IACvK,iKAAiK;IACjK,gEAAgE;IAChE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAElE,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC3B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/logclient/filter.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pure {@link LogRecord} filter construction.
+ *
+ * {@link createLogFilter} compiles a set of optional criteria - a substring/regex grep, a level allow-list, a plugin allow-list - into a single predicate a consumer
+ * folds over any record stream. The module is deliberately I/O-free and warning-free: it owns matching logic only. The orchestration layer is responsible for the
+ * user-facing "a level filter is active but no record carried a level" advisory (a level filter is only meaningful when the Homebridge process emits ANSI color), which
+ * is a policy concern that does not belong in a pure predicate.
+ *
+ * An empty criteria set compiles to a pass-all predicate, so a consumer can always build a filter and apply it unconditionally rather than branching on "are any filters
+ * active." Multiple criteria combine with AND - a record must satisfy every active criterion to pass.
+ *
+ * @module
+ */
+import type { LogLevel, LogRecord } from "./types.ts";
+/**
+ * The filter criteria. Every field is optional; an omitted field imposes no constraint, and an all-omitted object yields a pass-all predicate.
+ *
+ * @property grep    - A regular expression tested against the record's ANSI-stripped `message`. A record passes the grep criterion when its message matches.
+ * @property levels  - An allow-list of severity levels. A record passes when its `level` is in the list. A record whose `level` is `null` never satisfies a non-empty
+ *                     level allow-list, since an unknown severity cannot be affirmatively matched against a requested one.
+ * @property plugins - An allow-list of plugin names, matched case-insensitively against the record's `plugin`. A record whose `plugin` is `null` never satisfies a
+ *                     non-empty plugin allow-list.
+ *
+ * @category Log Client
+ */
+export interface LogFilterCriteria {
+    readonly grep?: RegExp;
+    readonly levels?: readonly LogLevel[];
+    readonly plugins?: readonly string[];
+}
+/**
+ * Compile filter criteria into a single predicate over {@link LogRecord}.
+ *
+ * The returned predicate evaluates each active criterion and returns `true` only when all of them pass (logical AND). Criteria are normalized once at construction - the
+ * plugin allow-list is lower-cased into a `Set` for O(1) case-insensitive membership, and the level allow-list into a `Set` - so the per-record hot path does no
+ * repeated allocation or case folding. An all-omitted (or all-empty) criteria object compiles to a predicate that always returns `true`.
+ *
+ * @param criteria - The filter criteria. See {@link LogFilterCriteria}.
+ *
+ * @returns A predicate that returns `true` when a record satisfies every active criterion.
+ *
+ * @category Log Client
+ */
+export declare function createLogFilter(criteria?: LogFilterCriteria): (record: LogRecord) => boolean;
+//# sourceMappingURL=filter.d.ts.map

package/dist/logclient/filter.js

@@ -0,0 +1,51 @@
+/* Copyright(C) 2017-2026, HJD (https://github.com/hjdhjd). All rights reserved.
+ *
+ * logclient/filter.ts: Pure predicate builder for filtering parsed log records.
+ */
+/**
+ * Compile filter criteria into a single predicate over {@link LogRecord}.
+ *
+ * The returned predicate evaluates each active criterion and returns `true` only when all of them pass (logical AND). Criteria are normalized once at construction - the
+ * plugin allow-list is lower-cased into a `Set` for O(1) case-insensitive membership, and the level allow-list into a `Set` - so the per-record hot path does no
+ * repeated allocation or case folding. An all-omitted (or all-empty) criteria object compiles to a predicate that always returns `true`.
+ *
+ * @param criteria - The filter criteria. See {@link LogFilterCriteria}.
+ *
+ * @returns A predicate that returns `true` when a record satisfies every active criterion.
+ *
+ * @category Log Client
+ */
+export function createLogFilter(criteria = {}) {
+    const { grep, levels, plugins } = criteria;
+    // Normalize the allow-lists once. We lower-case plugin names into a `Set` so per-record plugin matching is a single case-insensitive `Set.has`, and we treat an empty
+    // array the same as an omitted field (no constraint) by leaving the corresponding `Set` undefined.
+    const levelSet = (levels !== undefined) && (levels.length > 0) ? new Set(levels) : undefined;
+    const pluginSet = (plugins !== undefined) && (plugins.length > 0) ? new Set(plugins.map((plugin) => plugin.toLowerCase())) : undefined;
+    return (record) => {
+        // Grep: a record fails when an active pattern does not match its message. We test against the ANSI-stripped `message` so a color escape never interferes with the
+        // user's pattern. The caller may hand us a `/g`- or `/y`-flagged RegExp whose `.test()` is stateful (it advances `lastIndex` between calls); we reset `lastIndex`
+        // to 0 before each test so the predicate is order-independent and a stateful flag cannot cause it to skip a matching record.
+        if (grep !== undefined) {
+            grep.lastIndex = 0;
+            if (!grep.test(record.message)) {
+                return false;
+            }
+        }
+        // Level allow-list: a record fails when its level is null (no severity known) or is absent from the allow-list. A null level cannot affirmatively match a requested
+        // level, so it is excluded rather than passed.
+        if (levelSet !== undefined) {
+            if ((record.level === null) || !levelSet.has(record.level)) {
+                return false;
+            }
+        }
+        // Plugin allow-list: a record fails when its plugin is null or, case-insensitively, absent from the allow-list.
+        if (pluginSet !== undefined) {
+            if ((record.plugin === null) || !pluginSet.has(record.plugin.toLowerCase())) {
+                return false;
+            }
+        }
+        // Every active criterion passed (or none were active), so the record is admitted.
+        return true;
+    };
+}
+//# sourceMappingURL=filter.js.map

package/dist/logclient/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../src/logclient/filter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmCH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B,EAAE;IAE9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAE3C,sKAAsK;IACtK,mGAAmG;IACnG,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAW,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,SAAS,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/I,OAAO,CAAC,MAAiB,EAAW,EAAE;QAEpC,kKAAkK;QAClK,kKAAkK;QAClK,6HAA6H;QAC7H,IAAG,IAAI,KAAK,SAAS,EAAE,CAAC;YAEtB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;YAEnB,IAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAE9B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,oKAAoK;QACpK,+CAA+C;QAC/C,IAAG,QAAQ,KAAK,SAAS,EAAE,CAAC;YAE1B,IAAG,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAE1D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,gHAAgH;QAChH,IAAG,SAAS,KAAK,SAAS,EAAE,CAAC;YAE3B,IAAG,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAE3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,kFAAkF;QAClF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}