lastlight 0.16.0 → 0.16.2

package/deploy/sandbox-entrypoint.sh

@@ -1,93 +0,0 @@
-#!/usr/bin/env bash
-# Sandbox container entrypoint — runs as root after volumes are mounted.
-# Used only when LASTLIGHT_SANDBOX=docker (the gondolin sandbox runs in
-# process and doesn't go through this script). Fixes permissions, writes
-# AGENTS.md, sets up git identity, then drops to the agent user via gosu.
-set -euo pipefail
-
-AGENT_HOME="/home/agent"
-WORKSPACE="$AGENT_HOME/workspace"
-# LASTLIGHT_WORKSPACE and LASTLIGHT_GIT_CREDENTIALS are set as image-level
-# ENV in sandbox.Dockerfile so they're visible to every `docker exec` call
-# the harness makes (not just the entrypoint's PID-1 tree). They show up in
-# this shell's env via that mechanism; no export needed here.
-
-# ── Fix workspace ownership (bind-mounts may be root-owned on macOS) ──
-chown -R agent:agent "$WORKSPACE" 2>/dev/null || true
-chown agent:agent "$AGENT_HOME"
-
-# Ensure ~/.config exists and is agent-owned before any root-side mkdir
-# below claims it (some tools write here at startup).
-mkdir -p "$AGENT_HOME/.config"
-chown agent:agent "$AGENT_HOME/.config"
-
-# ── Shared package-manager cache (issue #107) ──
-# /cache is a Docker named volume shared across every sandbox so npm / pnpm /
-# yarn reuse already-downloaded tarballs. A freshly-created volume is root-owned,
-# and a cache seeded by an older image (when `agent` had a different UID) leaves
-# children owned by the wrong UID — which blocks npm/pnpm/yarn writes (e.g.
-# /cache/npm/_logs). Self-heal: if the subdir OR any immediate child isn't
-# agent-owned, chown -R it. The recursive pass runs only when something is
-# actually wrong, so a warm, correctly-owned cache stays cheap.
-if [ -d /cache ]; then
-  for sub in npm pnpm yarn uv; do
-    mkdir -p "/cache/$sub"
-    if [ -n "$(find "/cache/$sub" -maxdepth 1 ! -user agent -print -quit 2>/dev/null)" ]; then
-      chown -R agent:agent "/cache/$sub" 2>/dev/null || true
-    fi
-  done
-fi
-
-# ── App PEM: keep shared copy unreadable by the agent by default ──
-if [ -f /data/secrets/app.pem ]; then
-  chmod 600 /data/secrets/app.pem 2>/dev/null || true
-fi
-
-# Optionally materialize an agent-readable PEM for high-trust runs only.
-# The harness forwards GITHUB_APP_PRIVATE_KEY_PATH into the sandbox env so
-# any tool inside that needs the App key can find it.
-if [ "${ALLOW_APP_PEM:-0}" = "1" ] && [ -f /data/secrets/app.pem ]; then
-  cp /data/secrets/app.pem "$AGENT_HOME/.config/app.pem"
-  chown agent:agent "$AGENT_HOME/.config/app.pem"
-  chmod 600 "$AGENT_HOME/.config/app.pem"
-  export GITHUB_APP_PRIVATE_KEY_PATH="$AGENT_HOME/.config/app.pem"
-else
-  export GITHUB_APP_PRIVATE_KEY_PATH=""
-fi
-
-# ── AGENTS.md — agentic-pi auto-loads this from cwd as the agent's
-# system context (same convention as CLAUDE.md). ──
-if [ ! -f "$WORKSPACE/AGENTS.md" ]; then
-  cat /app/agent-context/*.md > "$WORKSPACE/AGENTS.md" 2>/dev/null || true
-fi
-chown agent:agent "$WORKSPACE/AGENTS.md" 2>/dev/null || true
-
-# ── Git identity and auth (system-wide so it applies regardless of exec user) ──
-git config --system user.name "last-light[bot]"
-git config --system user.email "last-light[bot]@users.noreply.github.com"
-
-if [ -n "${GIT_TOKEN:-}" ]; then
-  # Reject tokens containing characters that would break the URL line in
-  # the credentials file (newline, '@', ':', '/', whitespace). Real GitHub
-  # tokens are alphanumeric + underscore — the wider charset here is
-  # defensive against future format changes.
-  if ! printf %s "$GIT_TOKEN" | grep -Eq '^[A-Za-z0-9_-]+$'; then
-    echo "ERROR: GIT_TOKEN contains characters outside [A-Za-z0-9_-]; refusing to write credentials file" >&2
-    exit 1
-  fi
-  # Write the file as the agent user (mode 600) so the helper can read it
-  # after the entrypoint drops privileges. Path is set by us above; the
-  # `store --file=<path>` value goes into git's config as argv-split (no
-  # shell), so the only constraint is no-whitespace in the path.
-  install -m 600 -o agent -g agent /dev/null "$LASTLIGHT_GIT_CREDENTIALS"
-  printf 'https://x-access-token:%s@github.com\n' "$GIT_TOKEN" > "$LASTLIGHT_GIT_CREDENTIALS"
-  chown agent:agent "$LASTLIGHT_GIT_CREDENTIALS"
-  git config --system credential.helper "store --file=$LASTLIGHT_GIT_CREDENTIALS"
-fi
-
-# ── Sentinel for harness waitForReady() ──
-touch "$WORKSPACE/.ready"
-chown agent:agent "$WORKSPACE/.ready"
-
-# ── Drop to agent user ──
-exec gosu agent "$@"

package/dist/admin/auth.d.ts

@@ -1,51 +0,0 @@
-import type { Context, Next } from "hono";
-/**
- * Grace window past `exp` in which a token can still be *refreshed* (but not
- * used to authenticate a normal request). Lets an active user whose token
- * lapsed briefly slide their session forward via the refresh route instead of
- * being bounced back through a full login. Beyond this, they must re-login.
- */
-export declare const REFRESH_GRACE_SECONDS: number;
-export declare function createToken(secret: string, method?: "password" | "slack" | "github"): string;
-export declare function verifyToken(token: string, secret: string): boolean;
-/**
- * Like `verifyToken`, but also accepts a token that expired within the last
- * `REFRESH_GRACE_SECONDS`. Used ONLY by the refresh route so a briefly-lapsed
- * session can be renewed. The signature must still be valid (we minted it), so
- * this can't be forged.
- */
-export declare function verifyTokenForRefresh(token: string, secret: string): boolean;
-export interface TokenPayload {
-    exp: number;
-    method?: "password" | "slack" | "github";
-}
-/**
- * Decode a token's payload WITHOUT verifying its signature or expiry — used to
- * carry the login `method` across a refresh. Callers that need authenticity
- * must still gate on `verifyToken` (the refresh route runs behind
- * `authMiddleware`, which does exactly that). Returns null if unparseable.
- */
-export declare function decodeToken(token: string): TokenPayload | null;
-/**
- * Whether any login method is configured — an admin password OR a working OAuth
- * provider. The single source of truth for "is auth on", shared by the admin
- * dashboard and the `/api/*` trigger routes so they can't drift. The GitHub
- * gate, like the OAuth route, also requires an allowed-org to be set.
- */
-export declare function authIsEnabled(opts: {
-    adminPassword?: string;
-    slackOAuthClientId?: string;
-    slackOAuthClientSecret?: string;
-    githubOAuthClientId?: string;
-    githubOAuthClientSecret?: string;
-    githubAllowedOrg?: string;
-}): boolean;
-/**
- * Gate the admin API. `enabled` should be true when ANY login method is
- * configured — an admin password OR a working OAuth provider. Gating only on
- * the password (the old behaviour) left the dashboard fully open whenever the
- * password was cleared, even with Slack/GitHub OAuth set up.
- */
-export declare function authMiddleware(enabled: boolean, secret: string): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
-    error: string;
-}, 401, "json">)>;

package/dist/admin/auth.js

@@ -1,121 +0,0 @@
-import crypto from "node:crypto";
-const TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 days
-/**
- * Grace window past `exp` in which a token can still be *refreshed* (but not
- * used to authenticate a normal request). Lets an active user whose token
- * lapsed briefly slide their session forward via the refresh route instead of
- * being bounced back through a full login. Beyond this, they must re-login.
- */
-export const REFRESH_GRACE_SECONDS = 60 * 60 * 24 * 7; // 7 days
-export function createToken(secret, method) {
-    const payload = { exp: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS };
-    if (method)
-        payload.method = method;
-    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-    const sig = crypto.createHmac("sha256", secret).update(payloadB64).digest("base64url");
-    return `${payloadB64}.${sig}`;
-}
-/**
- * Verify the HMAC signature and return the decoded payload, or null if the
- * signature is invalid / the payload is unparseable. Does NOT check expiry —
- * that's the caller's job (strict for auth, lenient for refresh).
- */
-function verifySignature(token, secret) {
-    const parts = token.split(".");
-    if (parts.length !== 2)
-        return null;
-    const [payloadB64, sig] = parts;
-    const expectedSig = crypto.createHmac("sha256", secret).update(payloadB64).digest("base64url");
-    if (expectedSig.length !== sig.length ||
-        !crypto.timingSafeEqual(Buffer.from(expectedSig), Buffer.from(sig))) {
-        return null;
-    }
-    return decodeToken(token);
-}
-export function verifyToken(token, secret) {
-    const payload = verifySignature(token, secret);
-    if (!payload)
-        return false;
-    return Math.floor(Date.now() / 1000) < payload.exp;
-}
-/**
- * Like `verifyToken`, but also accepts a token that expired within the last
- * `REFRESH_GRACE_SECONDS`. Used ONLY by the refresh route so a briefly-lapsed
- * session can be renewed. The signature must still be valid (we minted it), so
- * this can't be forged.
- */
-export function verifyTokenForRefresh(token, secret) {
-    const payload = verifySignature(token, secret);
-    if (!payload)
-        return false;
-    return Math.floor(Date.now() / 1000) < payload.exp + REFRESH_GRACE_SECONDS;
-}
-/**
- * Decode a token's payload WITHOUT verifying its signature or expiry — used to
- * carry the login `method` across a refresh. Callers that need authenticity
- * must still gate on `verifyToken` (the refresh route runs behind
- * `authMiddleware`, which does exactly that). Returns null if unparseable.
- */
-export function decodeToken(token) {
-    const parts = token.split(".");
-    if (parts.length !== 2)
-        return null;
-    try {
-        const payload = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-        if (typeof payload.exp !== "number")
-            return null;
-        const method = payload.method;
-        return {
-            exp: payload.exp,
-            method: method === "password" || method === "slack" || method === "github" ? method : undefined,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Whether any login method is configured — an admin password OR a working OAuth
- * provider. The single source of truth for "is auth on", shared by the admin
- * dashboard and the `/api/*` trigger routes so they can't drift. The GitHub
- * gate, like the OAuth route, also requires an allowed-org to be set.
- */
-export function authIsEnabled(opts) {
-    const slack = Boolean(opts.slackOAuthClientId && opts.slackOAuthClientSecret);
-    const github = Boolean(opts.githubOAuthClientId && opts.githubOAuthClientSecret && opts.githubAllowedOrg);
-    return Boolean(opts.adminPassword) || slack || github;
-}
-/**
- * Gate the admin API. `enabled` should be true when ANY login method is
- * configured — an admin password OR a working OAuth provider. Gating only on
- * the password (the old behaviour) left the dashboard fully open whenever the
- * password was cleared, even with Slack/GitHub OAuth set up.
- */
-export function authMiddleware(enabled, secret) {
-    return async (c, next) => {
-        if (!enabled)
-            return next();
-        const path = new URL(c.req.url).pathname;
-        // Let login + health + OAuth routes through
-        if (path.endsWith("/login") ||
-            path.endsWith("/token/refresh") ||
-            path.endsWith("/health") ||
-            path.endsWith("/auth-required") ||
-            path.endsWith("/oauth/slack/authorize") ||
-            path.endsWith("/oauth/slack/callback") ||
-            path.endsWith("/oauth/github/authorize") ||
-            path.endsWith("/oauth/github/callback")) {
-            return next();
-        }
-        const header = c.req.header("Authorization");
-        let token = header?.startsWith("Bearer ") ? header.slice(7) : undefined;
-        // EventSource can't set headers — allow token via query param
-        if (!token)
-            token = c.req.query("token") ?? undefined;
-        if (!token || !verifyToken(token, secret)) {
-            return c.json({ error: "unauthorized" }, 401);
-        }
-        return next();
-    };
-}
-//# sourceMappingURL=auth.js.map

package/dist/admin/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/admin/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;AAEhE,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAwC;IAClF,MAAM,OAAO,GAAqC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC7G,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAyB,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IACE,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACjC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,qBAAqB,CAAC;AAC7E,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EACJ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1G,OAAO,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC7D,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,4CAA4C;QAC5C,IACE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACvC,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,8DAA8D;QAC9D,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEtD,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/chat-session-reader.d.ts

@@ -1,39 +0,0 @@
-import type { StateDb } from "../state/db.js";
-import { SessionLog, type JsonlMessage } from "../session-log.js";
-import type { SessionSource, SessionMeta } from "./sessions.js";
-/**
- * DB-backed chat-session reader. Drop-in replacement for SessionReader on
- * the chat path: same public surface (`mountSessionRoutes` works against it
- * unchanged), but listing comes from the executions table grouped by Slack
- * thread, and message reads target the single jsonl file owned by that
- * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
- * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
- * sidechain files from other in-process Agent SDK runs.
- *
- * Conceptual mapping:
- * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
- *                         messaging_sessions.agent_session_id
- */
-export declare class ChatSessionReader implements SessionSource {
-    private db;
-    private sessionLog;
-    constructor(db: StateDb, sessionsHomeDir: string);
-    constructor(db: StateDb, sessionLog: SessionLog);
-    /** All chat thread ids (= Slack threads) that have at least one chat execution. */
-    listSessionIds(): string[];
-    exists(id: string): boolean;
-    getSessionMeta(id: string): Promise<SessionMeta | null>;
-    read(id: string): Promise<Array<{
-        index: number;
-        msg: JsonlMessage;
-    }>>;
-    /**
-     * Resolve a thread id to its on-disk Agent SDK jsonl. Returns null if
-     * the thread has no agent_session_id yet (pre-resume) or the jsonl file
-     * doesn't exist on disk (deleted, rotated, or written by a different
-     * Agent SDK installation).
-     */
-    getFilePath(id: string): string | null;
-    normalizeRawLine(raw: Record<string, unknown>): JsonlMessage[];
-}

package/dist/admin/chat-session-reader.js

@@ -1,84 +0,0 @@
-import { CHAT_PROJECT_SLUG, SessionLog, } from "../session-log.js";
-/**
- * DB-backed chat-session reader. Drop-in replacement for SessionReader on
- * the chat path: same public surface (`mountSessionRoutes` works against it
- * unchanged), but listing comes from the executions table grouped by Slack
- * thread, and message reads target the single jsonl file owned by that
- * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
- * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
- * sidechain files from other in-process Agent SDK runs.
- *
- * Conceptual mapping:
- * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
- *                         messaging_sessions.agent_session_id
- */
-export class ChatSessionReader {
-    db;
-    sessionLog;
-    constructor(db, sessionsHomeDirOrLog) {
-        this.db = db;
-        this.sessionLog = typeof sessionsHomeDirOrLog === "string"
-            ? new SessionLog(sessionsHomeDirOrLog)
-            : sessionsHomeDirOrLog;
-    }
-    /** All chat thread ids (= Slack threads) that have at least one chat execution. */
-    listSessionIds() {
-        // Soft cap at 500 — anything older than that almost certainly won't be
-        // surfaced after the dashboard's per-tab filters anyway.
-        return this.db.executions.listChatThreads(500).map((t) => t.triggerId);
-    }
-    exists(id) {
-        return this.db.executions.getChatThread(id) !== null;
-    }
-    async getSessionMeta(id) {
-        const t = this.db.executions.getChatThread(id);
-        if (!t)
-            return null;
-        const startedAt = new Date(t.firstStartedAt).getTime() / 1000;
-        const lastMessageAt = new Date(t.lastActivityAt).getTime() / 1000;
-        // sessionType "chat" lets the dashboard SessionFilters show a chat
-        // chip and gives the user a meaningful label.
-        return {
-            id,
-            source: "chat",
-            sessionType: "chat",
-            model: null,
-            started_at: Number.isNaN(startedAt) ? Date.now() / 1000 : startedAt,
-            last_message_at: Number.isNaN(lastMessageAt) ? null : lastMessageAt,
-            message_count: t.turnCount,
-            tool_call_count: 0,
-            conversation_message_count: t.turnCount,
-            last_assistant_content: t.lastAssistantContent,
-            agentIds: [],
-            platform: t.platform,
-        };
-    }
-    async read(id) {
-        const thread = this.db.executions.getChatThread(id);
-        if (!thread?.agentSessionId)
-            return [];
-        return this.sessionLog.readNormalizedSession("chat", thread.agentSessionId, {
-            includeAgents: false,
-            skipEmptySystem: true,
-        });
-    }
-    /**
-     * Resolve a thread id to its on-disk Agent SDK jsonl. Returns null if
-     * the thread has no agent_session_id yet (pre-resume) or the jsonl file
-     * doesn't exist on disk (deleted, rotated, or written by a different
-     * Agent SDK installation).
-     */
-    getFilePath(id) {
-        const thread = this.db.executions.getChatThread(id);
-        if (!thread || !thread.agentSessionId)
-            return null;
-        return this.sessionLog.pathForProject(CHAT_PROJECT_SLUG, thread.agentSessionId, {
-            requireExists: true,
-        });
-    }
-    normalizeRawLine(raw) {
-        return this.sessionLog.normalizeLine(raw);
-    }
-}
-//# sourceMappingURL=chat-session-reader.js.map

package/dist/admin/chat-session-reader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chat-session-reader.js","sourceRoot":"","sources":["../../src/admin/chat-session-reader.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,UAAU,GAEX,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAU;IACZ,UAAU,CAAa;IAI/B,YAAY,EAAW,EAAE,oBAAyC;QAChE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,GAAG,OAAO,oBAAoB,KAAK,QAAQ;YACxD,CAAC,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC;YACtC,CAAC,CAAC,oBAAoB,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,cAAc;QACZ,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,mEAAmE;QACnE,8CAA8C;QAC9C,OAAO;YACL,EAAE;YACF,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YACnE,aAAa,EAAE,CAAC,CAAC,SAAS;YAC1B,eAAe,EAAE,CAAC;YAClB,0BAA0B,EAAE,CAAC,CAAC,SAAS;YACvC,sBAAsB,EAAE,CAAC,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE;YAC1E,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,EAAU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE;YAC9E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,GAA4B;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/admin/docker.d.ts

@@ -1,61 +0,0 @@
-export interface ContainerInfo {
-    id: string;
-    name: string;
-    status: string;
-    created: string;
-    taskId: string | null;
-    image: string;
-}
-export interface ContainerStats {
-    name: string;
-    cpuPercent: number;
-    memUsageBytes: number;
-    memLimitBytes: number;
-    memPercent: number;
-}
-export declare function killContainer(containerName: string): Promise<void>;
-/**
- * Snapshot CPU/memory for every container whose name starts with `lastlight-`
- * (the agent itself plus any active sandboxes). Uses `docker stats --no-stream`
- * so each call is one read of cgroup counters — slower than a metadata lookup
- * but still ~sub-second on a small fleet.
- */
-export declare function getContainerStats(): Promise<ContainerStats[]>;
-export declare function listRunningContainers(): Promise<ContainerInfo[]>;
-export interface ServerContainer {
-    name: string;
-    /** Short label derived from the compose name: lastlight-<service>-<n>. */
-    service: string;
-    status: string;
-    image: string;
-}
-/**
- * Every `lastlight-*` container (the agent plus the egress sidecars,
- * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
- * by the server-logs endpoints so an operator can read the harness/docker logs
- * over the admin API instead of SSHing to the host.
- */
-export declare function listServerContainers(): Promise<ServerContainer[]>;
-/**
- * Resolve a requested container (by full name OR short service label) to a real
- * `lastlight-*` container name, validated against the live list. Returns null
- * if nothing matches — callers reject the request, so an arbitrary container
- * name can never reach `docker logs`. With no request, defaults to the agent.
- */
-export declare function resolveServerContainer(requested?: string): Promise<string | null>;
-/**
- * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
- * lets us interleave the container's stdout and stderr (captured on separate
- * fds) back into chronological order — RFC3339 prefixes sort lexically.
- */
-export declare function getContainerLogs(name: string, opts?: {
-    tail?: number;
-    since?: string;
-}): Promise<string[]>;
-/**
- * Follow `docker logs -f` for a container, invoking `onLine` per line from both
- * stdout and stderr. Returns a stop function that kills the child process.
- */
-export declare function streamContainerLogs(name: string, opts: {
-    tail?: number;
-}, onLine: (line: string) => void): () => void;

package/dist/admin/docker.js

@@ -1,187 +0,0 @@
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-const exec = promisify(execFile);
-export async function killContainer(containerName) {
-    await exec("docker", ["rm", "-f", containerName]);
-}
-/**
- * Snapshot CPU/memory for every container whose name starts with `lastlight-`
- * (the agent itself plus any active sandboxes). Uses `docker stats --no-stream`
- * so each call is one read of cgroup counters — slower than a metadata lookup
- * but still ~sub-second on a small fleet.
- */
-export async function getContainerStats() {
-    try {
-        const { stdout } = await exec("docker", [
-            "stats",
-            "--no-stream",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout
-            .trim()
-            .split("\n")
-            .map((line) => JSON.parse(line))
-            .filter((c) => (c.Name ?? "").startsWith("lastlight"))
-            .map((c) => {
-            const name = c.Name ?? "";
-            const cpuPercent = parsePercent(c.CPUPerc);
-            const memPercent = parsePercent(c.MemPerc);
-            const [usage, limit] = parseMemUsage(c.MemUsage);
-            return {
-                name,
-                cpuPercent,
-                memUsageBytes: usage,
-                memLimitBytes: limit,
-                memPercent,
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-function parsePercent(raw) {
-    if (!raw)
-        return 0;
-    const n = parseFloat(raw.replace("%", "").trim());
-    return Number.isFinite(n) ? n : 0;
-}
-// Docker formats memory like "123.4MiB / 7.7GiB" — convert each side to bytes.
-function parseMemUsage(raw) {
-    if (!raw)
-        return [0, 0];
-    const parts = raw.split("/").map((p) => p.trim());
-    return [parseSize(parts[0] ?? ""), parseSize(parts[1] ?? "")];
-}
-function parseSize(raw) {
-    const m = raw.match(/^([\d.]+)\s*([KMGT]?i?B)$/i);
-    if (!m)
-        return 0;
-    const value = parseFloat(m[1]);
-    const unit = m[2].toLowerCase();
-    const multipliers = {
-        b: 1,
-        kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12,
-        kib: 1024, mib: 1024 ** 2, gib: 1024 ** 3, tib: 1024 ** 4,
-    };
-    return value * (multipliers[unit] ?? 1);
-}
-export async function listRunningContainers() {
-    try {
-        const { stdout } = await exec("docker", [
-            "ps",
-            "--filter", "name=lastlight-sandbox",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout
-            .trim()
-            .split("\n")
-            .map((line) => {
-            const c = JSON.parse(line);
-            const name = c.Names ?? c.Name ?? "";
-            // Parse taskId from: lastlight-sandbox-{taskId}-{uuid}
-            const match = name.match(/^lastlight-sandbox-(.+?)-[a-f0-9]{8}$/);
-            return {
-                id: c.ID ?? "",
-                name,
-                status: c.Status ?? "",
-                created: c.CreatedAt ?? c.RunningFor ?? "",
-                taskId: match?.[1] ?? null,
-                image: c.Image ?? "",
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Every `lastlight-*` container (the agent plus the egress sidecars,
- * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
- * by the server-logs endpoints so an operator can read the harness/docker logs
- * over the admin API instead of SSHing to the host.
- */
-export async function listServerContainers() {
-    try {
-        const { stdout } = await exec("docker", [
-            "ps", "-a",
-            "--filter", "name=lastlight-",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout.trim().split("\n").map((line) => {
-            const c = JSON.parse(line);
-            const name = c.Names ?? c.Name ?? "";
-            return {
-                name,
-                service: name.replace(/^lastlight-/, "").replace(/-\d+$/, ""),
-                status: c.Status ?? "",
-                image: c.Image ?? "",
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Resolve a requested container (by full name OR short service label) to a real
- * `lastlight-*` container name, validated against the live list. Returns null
- * if nothing matches — callers reject the request, so an arbitrary container
- * name can never reach `docker logs`. With no request, defaults to the agent.
- */
-export async function resolveServerContainer(requested) {
-    const containers = await listServerContainers();
-    if (requested) {
-        const hit = containers.find((c) => c.name === requested || c.service === requested);
-        return hit?.name ?? null;
-    }
-    const agent = containers.find((c) => c.service === "agent" || c.name.includes("-agent-"));
-    return agent?.name ?? containers[0]?.name ?? null;
-}
-/**
- * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
- * lets us interleave the container's stdout and stderr (captured on separate
- * fds) back into chronological order — RFC3339 prefixes sort lexically.
- */
-export async function getContainerLogs(name, opts = {}) {
-    const args = ["logs", "--timestamps", "--tail", String(opts.tail ?? 200)];
-    if (opts.since)
-        args.push("--since", opts.since);
-    args.push(name);
-    const { stdout, stderr } = await exec("docker", args, { maxBuffer: 32 * 1024 * 1024 });
-    const lines = [
-        ...(stdout ? stdout.split("\n") : []),
-        ...(stderr ? stderr.split("\n") : []),
-    ].filter((l) => l.length > 0);
-    lines.sort((a, b) => a.slice(0, 30).localeCompare(b.slice(0, 30)));
-    return lines;
-}
-/**
- * Follow `docker logs -f` for a container, invoking `onLine` per line from both
- * stdout and stderr. Returns a stop function that kills the child process.
- */
-export function streamContainerLogs(name, opts, onLine) {
-    const child = spawn("docker", [
-        "logs", "-f", "--timestamps", "--tail", String(opts.tail ?? 200), name,
-    ]);
-    const handle = (buf) => {
-        for (const line of buf.toString().split("\n"))
-            if (line)
-                onLine(line);
-    };
-    child.stdout?.on("data", handle);
-    child.stderr?.on("data", handle);
-    return () => {
-        try {
-            child.kill("SIGKILL");
-        }
-        catch { /* already dead */ }
-    };
-}
-//# sourceMappingURL=docker.js.map

package/dist/admin/docker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/admin/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmBjC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB;IACvD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,OAAO;YACP,aAAa;YACb,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE9B,OAAO,MAAM;aACV,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;aACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO;gBACL,IAAI;gBACJ,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;gBACpB,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,WAAW,GAA2B;QAC1C,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI;QACnC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC;KAC1D,CAAC;IACF,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,IAAI;YACJ,UAAU,EAAE,wBAAwB;YACpC,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE9B,OAAO,MAAM;aACV,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,uDAAuD;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAClE,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;gBACd,IAAI;gBACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;gBAC1C,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aACrB,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aACrB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAkB;IAC7D,MAAM,UAAU,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QACpF,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,OAA0C,EAAE;IAE5C,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,IAAuB,EACvB,MAA8B;IAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI;KACvE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;QAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}