humanish 0.15.3 → 0.17.0

package/dist/observer-serve.d.ts

@@ -0,0 +1,111 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PinnedDirectory } from "./observer.js";
+import type { ServeSessionStore } from "./observer-auth.js";
+import type { LibraryHistory } from "./observer-library.js";
+import { verifyRun } from "./run.js";
+export declare const SERVE_SCHEMA = "humanish.serve-result.v1";
+export type ServeMode = "loopback" | "capability-link" | "share-safe-open";
+export type ServeErrorCode = "HUMANISH_INVALID_PORT" | "HUMANISH_SERVE_INVALID_TTL" | "HUMANISH_SERVE_OPTION_CONFLICT" | "HUMANISH_SERVE_TUNNEL_REQUIRES_EXPOSE" | "HUMANISH_SERVE_EXPOSE_REQUIRES_ORIGIN" | "HUMANISH_SERVE_OPEN_REQUIRES_SAFE" | "HUMANISH_SERVE_TUNNEL_NOT_FOUND" | "HUMANISH_SERVE_TUNNEL_START_FAILED" | "HUMANISH_RUN_NOT_FOUND" | "HUMANISH_SERVE_RUN_NOT_SHAREABLE";
+export interface ServeResult {
+    schema: typeof SERVE_SCHEMA;
+    ok: boolean;
+    cwd: string;
+    mode: ServeMode;
+    safe: boolean;
+    host: "127.0.0.1";
+    port?: number;
+    url?: string;
+    capabilityUrl?: string;
+    publicUrl?: string;
+    publicCapabilityUrl?: string;
+    tunnel?: {
+        provider: "ngrok";
+        url: string;
+    };
+    ttlMinutes?: number;
+    runsListed: number;
+    shareReadyCount?: number;
+    entryRunId?: string;
+    opened?: boolean;
+    openCommand?: string;
+    warnings: string[];
+    error?: {
+        code: ServeErrorCode;
+        message: string;
+    };
+}
+export interface ServeControlPlane {
+    startRun?(request: {
+        labId: string;
+        dryRun: boolean;
+    }): Promise<{
+        accepted: boolean;
+        runId?: string;
+    }>;
+}
+export interface ShareSafetyAdmission {
+    admit(runId: string): Promise<boolean>;
+}
+export declare function createShareSafetyAdmission(cwd: string, options?: {
+    verifyImpl?: typeof verifyRun;
+    ttlMs?: number;
+    now?: () => number;
+}): ShareSafetyAdmission;
+export declare function buildServeSecurityHeaders(): Record<string, string>;
+export declare function hostAllowed(hostHeader: string | undefined, allowlist: ReadonlySet<string>): boolean;
+export declare function parsePublicOrigin(value: string): {
+    origin: string;
+    host: string;
+    scheme: "http" | "https";
+} | null;
+export interface ServeAuthContext {
+    tokenDigest: Buffer;
+    sessions: ServeSessionStore;
+    ttlSeconds: number;
+    publicScheme?: "http" | "https";
+}
+export interface ServeRequestHandlerOptions {
+    proofRoot: PinnedDirectory;
+    safe: boolean;
+    admit: (runId: string) => Promise<boolean>;
+    auth?: ServeAuthContext | null;
+    hostAllowlist: ReadonlySet<string>;
+    entryRunId?: string;
+    renderLibrary: (history: LibraryHistory) => string;
+    controlPlane?: ServeControlPlane;
+}
+export declare function createServeRequestHandler(options: ServeRequestHandlerOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+export interface ServeLibraryOptions {
+    port: number;
+    safe: boolean;
+    expose: boolean;
+    authMode: "link" | "none";
+    ttlMinutes: number;
+    publicOrigin?: string;
+    entryRunId?: string;
+    controlPlane?: ServeControlPlane;
+    verifyImpl?: typeof verifyRun;
+    now?: () => number;
+}
+export interface ServeLibraryServer {
+    url: string;
+    port: number;
+    mode: ServeMode;
+    capabilityToken?: string;
+    runsListed: number;
+    shareReadyCount?: number;
+    entryRunId?: string;
+    addPublicOrigin(origin: string): void;
+    close(): Promise<void>;
+}
+export type ServeLibraryStart = {
+    ok: true;
+    server: ServeLibraryServer;
+} | {
+    ok: false;
+    error: {
+        code: ServeErrorCode;
+        message: string;
+    };
+};
+export declare function serveObserverLibrary(cwdInput: string, options: ServeLibraryOptions): Promise<ServeLibraryStart>;

package/dist/observer-serve.js

@@ -0,0 +1,369 @@
+import { createServer } from "node:http";
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+import { buildHistoryIndex, matchRunRoute, pinDirectChildDirectory, pinDirectory, serveRunPath } from "./observer.js";
+import { buildSessionCookie, createServeSessionStore, mintServeToken, sha256Digest, verifyTokenDigest } from "./observer-auth.js";
+import { renderLibraryHtml } from "./observer-library.js";
+import { listRuns, verifyRun } from "./run.js";
+export const SERVE_SCHEMA = "humanish.serve-result.v1";
+export function createShareSafetyAdmission(cwd, options = {}) {
+    const verifyImpl = options.verifyImpl ?? verifyRun;
+    const now = options.now ?? (() => Date.now());
+    // verifyRun scans the ENTIRE run tree, but the cache key is run.json's stat
+    // identity, so an out-of-band edit to a scanned artifact that leaves run.json
+    // untouched would otherwise keep a stale share_ready verdict. A short TTL
+    // bounds that window: any mutation is re-scanned within ttlMs even when
+    // run.json never changes. Defense in depth on top of pre-persist redaction.
+    const ttlMs = options.ttlMs ?? 30_000;
+    const cache = new Map();
+    const bundleIdentity = async (runId) => {
+        try {
+            const stats = await lstat(path.join(cwd, ".humanish", "runs", runId, "run.json"), { bigint: true });
+            if (!stats.isFile()) {
+                return null;
+            }
+            return `${stats.dev}:${stats.ino}:${stats.mtimeNs}:${stats.size}`;
+        }
+        catch {
+            return null;
+        }
+    };
+    return {
+        async admit(runId) {
+            const identity = await bundleIdentity(runId);
+            if (!identity) {
+                cache.delete(runId);
+                return false;
+            }
+            const cached = cache.get(runId);
+            if (cached && cached.identity === identity && now() - cached.verifiedAt < ttlMs) {
+                return cached.admitted;
+            }
+            const admitted = verifyImpl(cwd, runId)
+                .then((verified) => verified.ok === true && verified.shareSafety.status === "share_ready")
+                .catch(() => false);
+            cache.set(runId, { identity, verifiedAt: now(), admitted });
+            return admitted;
+        }
+    };
+}
+export function buildServeSecurityHeaders() {
+    return {
+        "cache-control": "no-store",
+        "referrer-policy": "no-referrer",
+        "x-content-type-options": "nosniff",
+        "x-frame-options": "DENY",
+        "x-robots-tag": "noindex, nofollow"
+    };
+}
+export function hostAllowed(hostHeader, allowlist) {
+    return typeof hostHeader === "string" && allowlist.has(hostHeader.trim().toLowerCase());
+}
+export function parsePublicOrigin(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return null;
+    }
+    if ((parsed.pathname !== "/" && parsed.pathname !== "") || parsed.search || parsed.hash || !parsed.host) {
+        return null;
+    }
+    return {
+        origin: parsed.origin,
+        host: parsed.host.toLowerCase(),
+        scheme: parsed.protocol === "https:" ? "https" : "http"
+    };
+}
+const UNAUTHORIZED_BODY = "humanish serve: capability link required";
+export function createServeRequestHandler(options) {
+    return async (request, response) => {
+        try {
+            for (const [name, value] of Object.entries(buildServeSecurityHeaders())) {
+                response.setHeader(name, value);
+            }
+            const method = request.method ?? "GET";
+            if (method !== "GET" && method !== "HEAD") {
+                writeText(response, 405, "Method Not Allowed");
+                return;
+            }
+            if (!hostAllowed(request.headers.host, options.hostAllowlist)) {
+                writeText(response, 421, "Misdirected Request");
+                return;
+            }
+            const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+            if (options.auth) {
+                const mintMatch = url.pathname.match(/^\/_humanish\/auth\/([^/]+)$/);
+                if (mintMatch) {
+                    let candidate = "";
+                    try {
+                        candidate = decodeURIComponent(mintMatch[1] ?? "");
+                    }
+                    catch {
+                        candidate = "";
+                    }
+                    if (candidate && verifyTokenDigest(candidate, options.auth.tokenDigest)) {
+                        const { cookieValue } = options.auth.sessions.mint();
+                        const secure = options.auth.publicScheme === "https";
+                        response.setHeader("set-cookie", buildSessionCookie(cookieValue, { ttlSeconds: options.auth.ttlSeconds, secure }));
+                        response.writeHead(302, { location: "/" });
+                        response.end();
+                        return;
+                    }
+                    writeText(response, 401, UNAUTHORIZED_BODY);
+                    return;
+                }
+                // Every route below requires a valid session, regardless of source
+                // address: the tunnel agent connects from 127.0.0.1, so a loopback-peer
+                // trust shortcut would disable auth in exactly the deployment it protects.
+                if (!options.auth.sessions.validate(request.headers.cookie)) {
+                    writeText(response, 401, UNAUTHORIZED_BODY);
+                    return;
+                }
+            }
+            else if (url.pathname.startsWith("/_humanish/auth/")) {
+                writeText(response, 404, "Not found");
+                return;
+            }
+            if (url.pathname === "/_humanish/api" || url.pathname.startsWith("/_humanish/api/")) {
+                writeText(response, 501, `${JSON.stringify({
+                    error: {
+                        code: "HUMANISH_SERVE_CONTROL_PLANE_DISABLED",
+                        message: "control plane not enabled in this version"
+                    }
+                }, null, 2)}\n`, "application/json; charset=utf-8");
+                return;
+            }
+            if (url.pathname === "/") {
+                if (options.entryRunId) {
+                    response.writeHead(302, {
+                        location: `/_humanish/runs/${encodeURIComponent(options.entryRunId)}/observer/index.html`
+                    });
+                    response.end();
+                    return;
+                }
+                const history = await loadFilteredHistory(options);
+                writeText(response, 200, options.renderLibrary(history), "text/html; charset=utf-8");
+                return;
+            }
+            if (url.pathname === "/_humanish/history.json") {
+                const history = await loadFilteredHistory(options);
+                writeText(response, 200, JSON.stringify(history, null, 2), "application/json; charset=utf-8");
+                return;
+            }
+            if (url.pathname.startsWith("/_humanish/runs/")) {
+                const runRoute = matchRunRoute(url.pathname);
+                if (!runRoute) {
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                if (options.safe && !(await options.admit(runRoute.runId))) {
+                    // Byte-identical to the nonexistent-run 404: no existence oracle.
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                const targetRoot = await pinDirectChildDirectory(options.proofRoot, runRoute.runId);
+                if (!targetRoot) {
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                // The explicit empty runtimeStreamUrls keeps a future refactor from
+                // reintroducing auth-keyed stream injection on the serve surface.
+                await serveRunPath(targetRoot, runRoute.relativePath || "observer/index.html", response, []);
+                return;
+            }
+            writeText(response, 404, "Not found");
+        }
+        catch {
+            writeText(response, 500, "Observer request failed");
+        }
+    };
+}
+async function loadFilteredHistory(options) {
+    const history = await buildHistoryIndex(options.proofRoot);
+    if (!options.safe) {
+        return history;
+    }
+    const admissions = await Promise.all(history.runs.map(async (run) => ((await options.admit(run.runId)) === true ? run : null)));
+    const runs = admissions.filter((run) => run !== null);
+    const latestRunId = runs.some((run) => run.runId === history.latestRunId)
+        ? history.latestRunId
+        : runs[0]?.runId ?? null;
+    return { latestRunId, runs };
+}
+export async function serveObserverLibrary(cwdInput, options) {
+    const cwd = path.resolve(cwdInput);
+    const verifyImpl = options.verifyImpl ?? verifyRun;
+    let proofRoot;
+    try {
+        proofRoot = await pinDirectory(path.join(cwd, ".humanish", "runs"));
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: "HUMANISH_RUN_NOT_FOUND",
+                message: "No run library found under .humanish/runs. Run `humanish watch` to create the first run."
+            }
+        };
+    }
+    const admission = createShareSafetyAdmission(cwd, {
+        verifyImpl,
+        ...(options.now ? { now: options.now } : {})
+    });
+    const mode = options.expose
+        ? options.authMode === "link" ? "capability-link" : "share-safe-open"
+        : "loopback";
+    let entryRunId;
+    if (options.entryRunId) {
+        const resolved = options.entryRunId === "latest"
+            ? (await listRuns(cwd)).latest ?? null
+            : options.entryRunId;
+        const pinned = resolved ? await pinDirectChildDirectory(proofRoot, resolved) : null;
+        if (!resolved || !pinned) {
+            return {
+                ok: false,
+                error: { code: "HUMANISH_RUN_NOT_FOUND", message: `Run not found: ${options.entryRunId}` }
+            };
+        }
+        if (options.safe && !(await admission.admit(resolved))) {
+            const verified = await verifyImpl(cwd, resolved).catch(() => null);
+            const status = verified?.shareSafety.status ?? "unverifiable";
+            const reasons = verified?.shareSafety.reasons.map((reason) => reason.code).join(", ") || "VERIFY_FAILED";
+            return {
+                ok: false,
+                error: {
+                    code: "HUMANISH_SERVE_RUN_NOT_SHAREABLE",
+                    message: `Run ${resolved} is not share_ready (shareSafety: ${status}; reasons: ${reasons}); --safe refuses to serve it.`
+                }
+            };
+        }
+        entryRunId = resolved;
+    }
+    // Counts are computed over the UNCAPPED run list, not the 80-item history
+    // index: a capability link (non-safe) grants access to every run by direct
+    // URL, and share-safe modes admit every share_ready run per request, so a
+    // count capped at 80 would understate exactly what the exposure warning
+    // claims. runsListed feeds the operator's declared-friction warning.
+    const allRuns = (await listRuns(cwd)).runs;
+    let runsListed;
+    let shareReadyCount;
+    if (options.safe) {
+        const admitted = await Promise.all(allRuns.map((run) => admission.admit(run.runId)));
+        shareReadyCount = admitted.filter(Boolean).length;
+        runsListed = shareReadyCount;
+    }
+    else {
+        runsListed = allRuns.length;
+    }
+    const declaredOrigin = options.publicOrigin ? parsePublicOrigin(options.publicOrigin) : null;
+    let auth = null;
+    let capabilityToken;
+    if (options.expose && options.authMode === "link") {
+        capabilityToken = mintServeToken();
+        auth = {
+            tokenDigest: sha256Digest(capabilityToken),
+            sessions: createServeSessionStore({
+                ttlMs: options.ttlMinutes * 60_000,
+                ...(options.now ? { now: options.now } : {})
+            }),
+            ttlSeconds: options.ttlMinutes * 60,
+            ...(declaredOrigin ? { publicScheme: declaredOrigin.scheme } : {})
+        };
+    }
+    const hostAllowlist = new Set();
+    const handler = createServeRequestHandler({
+        proofRoot,
+        safe: options.safe,
+        admit: (runId) => admission.admit(runId),
+        auth,
+        hostAllowlist,
+        ...(entryRunId ? { entryRunId } : {}),
+        renderLibrary: (history) => renderLibraryHtml(history, {
+            mode,
+            safe: options.safe,
+            capabilities: { actions: false }
+        }),
+        ...(options.controlPlane ? { controlPlane: options.controlPlane } : {})
+    });
+    const server = createServer((request, response) => {
+        void handler(request, response);
+    });
+    const port = await listen(server, options.port);
+    hostAllowlist.add(`127.0.0.1:${port}`);
+    hostAllowlist.add(`localhost:${port}`);
+    hostAllowlist.add(`[::1]:${port}`);
+    if (declaredOrigin) {
+        hostAllowlist.add(declaredOrigin.host);
+    }
+    return {
+        ok: true,
+        server: {
+            url: `http://127.0.0.1:${port}/`,
+            port,
+            mode,
+            ...(capabilityToken ? { capabilityToken } : {}),
+            runsListed,
+            ...(shareReadyCount !== undefined ? { shareReadyCount } : {}),
+            ...(entryRunId ? { entryRunId } : {}),
+            // A tunnel's public origin is only known after the tunnel starts (post
+            // bind); this lets the caller declare it, extending the Host allowlist and
+            // — for an https origin like every ngrok tunnel — marking cookies Secure.
+            addPublicOrigin(origin) {
+                const parsed = parsePublicOrigin(origin);
+                if (!parsed) {
+                    return;
+                }
+                hostAllowlist.add(parsed.host);
+                if (auth) {
+                    auth.publicScheme = parsed.scheme;
+                }
+            },
+            close: async () => {
+                auth?.sessions.revokeAll();
+                const closed = closeServer(server);
+                // Keep-alive sockets would otherwise keep close() pending past the point
+                // the operator believes Ctrl-C tore the server down.
+                server.closeAllConnections?.();
+                await closed;
+            }
+        }
+    };
+}
+function writeText(response, status, body, contentType = "text/plain; charset=utf-8") {
+    response.writeHead(status, { "content-type": contentType });
+    response.end(body);
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        // The serve surface never binds beyond loopback; exposure only ever happens
+        // through a tunnel or proxy forwarding to this port.
+        server.listen(port, "127.0.0.1", () => {
+            server.off("error", reject);
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Serve library server did not bind to a TCP port."));
+                return;
+            }
+            resolve(address.port);
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}
+//# sourceMappingURL=observer-serve.js.map

package/dist/observer-serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observer-serve.js","sourceRoot":"","sources":["../src/observer-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAkDvD,MAAM,UAAU,0BAA0B,CACxC,GAAW,EACX,UAAiF,EAAE;IAEnF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgF,CAAC;IAEtG,MAAM,cAAc,GAAG,KAAK,EAAE,KAAa,EAA0B,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAa;YACvB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;gBAChF,OAAO,MAAM,CAAC,QAAQ,CAAC;YACzB,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;iBACpC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC;iBACzF,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;QACzB,cAAc,EAAE,mBAAmB;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE,SAA8B;IACxF,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KACxD,CAAC;AACJ,CAAC;AA0BD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AAErE,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;gBACxE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;YACvC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1C,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YAEzF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACrE,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,SAAS,GAAG,EAAE,CAAC;oBACnB,IAAI,CAAC;wBACH,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACrD,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS,GAAG,EAAE,CAAC;oBACjB,CAAC;oBACD,IAAI,SAAS,IAAI,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBACxE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACrD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC;wBACrD,QAAQ,CAAC,SAAS,CAChB,YAAY,EACZ,kBAAkB,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CACjF,CAAC;wBACF,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;wBAC3C,QAAQ,CAAC,GAAG,EAAE,CAAC;wBACf,OAAO;oBACT,CAAC;oBACD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,wEAAwE;gBACxE,2EAA2E;gBAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;oBAC5C,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpF,SAAS,CACP,QAAQ,EACR,GAAG,EACH,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChB,KAAK,EAAE;wBACL,IAAI,EAAE,uCAAuC;wBAC7C,OAAO,EAAE,2CAA2C;qBACrD;iBACF,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACf,iCAAiC,CAClC,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;wBACtB,QAAQ,EAAE,mBAAmB,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB;qBAC1F,CAAC,CAAC;oBACH,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACnD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACnD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC3D,kEAAkE;oBAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACpF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBACD,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,IAAI,qBAAqB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAmC;IACpE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC1F,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAyC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,WAAW,CAAC;QACvE,CAAC,CAAC,OAAO,CAAC,WAAW;QACrB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC3B,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AA+BD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,OAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IAEnD,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,0FAA0F;aACpG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,EAAE;QAChD,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAc,OAAO,CAAC,MAAM;QACpC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;QACrE,CAAC,CAAC,UAAU,CAAC;IAEf,IAAI,UAA8B,CAAC;IACnC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ;YAC9C,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI;YACtC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,kBAAkB,OAAO,CAAC,UAAU,EAAE,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,cAAc,CAAC;YAC9D,MAAM,OAAO,GAAG,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;YACzG,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,OAAO,QAAQ,qCAAqC,MAAM,cAAc,OAAO,gCAAgC;iBACzH;aACF,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAmC,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAClD,UAAU,GAAG,eAAe,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7F,IAAI,IAAI,GAA4B,IAAI,CAAC;IACzC,IAAI,eAAmC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAClD,eAAe,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,GAAG;YACL,WAAW,EAAE,YAAY,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,uBAAuB,CAAC;gBAChC,KAAK,EAAE,OAAO,CAAC,UAAU,GAAG,MAAM;gBAClC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC;YACF,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,EAAE;YACnC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,IAAI;QACJ,aAAa;QACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE;YACrD,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SACjC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,KAAK,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,GAAG,EAAE,oBAAoB,IAAI,GAAG;YAChC,IAAI;YACJ,IAAI;YACJ,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,UAAU;YACV,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,uEAAuE;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,eAAe,CAAC,MAAc;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnC,yEAAyE;gBACzE,qDAAqD;gBACrD,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,QAAwB,EACxB,MAAc,EACd,IAAY,EACZ,WAAW,GAAG,2BAA2B;IAEzC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/observer.d.ts

@@ -1,3 +1,4 @@
+import { type ServerResponse } from "node:http";
 export declare const OBSERVER_SCHEMA = "humanish.observer-result.v1";
 export interface ObserverResult {
     schema: typeof OBSERVER_SCHEMA;
@@ -36,9 +37,39 @@ export interface ObserverRuntimeStreamUrl {
     streamId: string;
     url: string;
 }
+/** internal: consumed by observer-serve */
+export interface PinnedDirectory {
+    readonly birthtimeNs: bigint;
+    readonly dev: bigint;
+    readonly ino: bigint;
+    readonly physicalPath: string;
+}
 export declare function attachObserverRuntimeStreamUrls(result: ObserverResult, streams: ObserverRuntimeStreamUrl[]): void;
 export declare function renderObserver(cwdInput: string, runInput: string, options?: ObserverOptions): Promise<ObserverResult>;
 export declare function serveObserver(result: ObserverResult, options?: ObserverServeOptions): Promise<ObserverServer>;
+/** internal: consumed by observer-serve */
+export declare function serveRunPath(runRoot: PinnedDirectory, relativePath: string, response: ServerResponse, runtimeStreamUrls?: ObserverRuntimeStreamUrl[]): Promise<void>;
+/** internal: consumed by observer-serve */
+export declare function buildHistoryIndex(proofRoot: PinnedDirectory): Promise<{
+    latestRunId: string | null;
+    runs: Array<{
+        runId: string;
+        createdAt: string | null;
+        mode: string | null;
+        href: string;
+        status: string;
+        streamCount: number;
+    }>;
+}>;
+/** internal: consumed by observer-serve */
+export declare function matchRunRoute(pathname: string): {
+    runId: string;
+    relativePath: string;
+} | null;
+/** internal: consumed by observer-serve */
+export declare function pinDirectory(directoryInput: string): Promise<PinnedDirectory>;
+/** internal: consumed by observer-serve */
+export declare function pinDirectChildDirectory(root: PinnedDirectory, name: string): Promise<PinnedDirectory | null>;
 export declare function openTarget(target: string): {
     opened: boolean;
     command?: string;

package/dist/observer.js

@@ -219,7 +219,8 @@ function renderObserverHtml(data) {
 </html>
 `;
 }
-async function serveRunPath(runRoot, relativePath, response, runtimeStreamUrls = []) {
+/** internal: consumed by observer-serve */
+export async function serveRunPath(runRoot, relativePath, response, runtimeStreamUrls = []) {
     const root = runRoot.physicalPath;
     const cleanedRelativePath = relativePath === "" ? "observer/index.html" : relativePath;
     const filePath = path.resolve(root, cleanedRelativePath);
@@ -309,7 +310,8 @@ function withRuntimeStreamUrls(data, runtimeStreamUrls) {
         })
     };
 }
-async function buildHistoryIndex(proofRoot) {
+/** internal: consumed by observer-serve */
+export async function buildHistoryIndex(proofRoot) {
     await assertPinnedDirectory(proofRoot);
     const physicalCwd = path.dirname(path.dirname(proofRoot.physicalPath));
     const listed = await listRuns(physicalCwd);
@@ -331,7 +333,8 @@ async function buildHistoryIndex(proofRoot) {
         runs
     };
 }
-function matchRunRoute(pathname) {
+/** internal: consumed by observer-serve */
+export function matchRunRoute(pathname) {
     const match = pathname.match(/^\/_humanish\/runs\/([^/]+)(?:\/(.*))?$/);
     if (!match)
         return null;
@@ -414,7 +417,8 @@ async function inspectContainedRegularFile(root, filePath) {
         return null;
     return fileIdentity;
 }
-async function pinDirectory(directoryInput) {
+/** internal: consumed by observer-serve */
+export async function pinDirectory(directoryInput) {
     const physicalPath = await realpath(path.resolve(directoryInput));
     const stats = await lstat(physicalPath, { bigint: true });
     if (stats.isSymbolicLink() || !stats.isDirectory()) {
@@ -422,7 +426,8 @@ async function pinDirectory(directoryInput) {
     }
     return Object.freeze({ birthtimeNs: stats.birthtimeNs, dev: stats.dev, ino: stats.ino, physicalPath });
 }
-async function pinDirectChildDirectory(root, name) {
+/** internal: consumed by observer-serve */
+export async function pinDirectChildDirectory(root, name) {
     if (!isSafeRunIdSegment(name))
         return null;
     try {