mewkit 1.15.0 → 1.16.0

package/dist/local-web/atomic-write.js

@@ -0,0 +1,69 @@
+/**
+ * Crash-safe same-directory atomic write.
+ *
+ * Behavior extracted verbatim from the plan writer's atomic-write: write to a
+ * same-directory temp file, then `renameSync` (atomic on POSIX because tmp and
+ * target share a filesystem). A single Windows EPERM retry covers the case where
+ * the target is briefly locked. `try/finally` unlinks the temp on any throw, so
+ * a failed write never leaves an orphan. The temp prefix is dotted so orphaned
+ * temps never match a caller's content-file glob.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+const TMP_PREFIX = ".local-web-tmp-";
+const ORPHAN_AGE_MS = 5 * 60 * 1000; // 5 minutes
+/** Write `content` to `targetPath` atomically via a same-directory temp file. */
+export function atomicWriteFileSync(targetPath, content) {
+    const dir = path.dirname(targetPath);
+    const tmpPath = path.join(dir, `${TMP_PREFIX}${crypto.randomBytes(6).toString("hex")}`);
+    fs.writeFileSync(tmpPath, content, "utf-8");
+    try {
+        try {
+            fs.renameSync(tmpPath, targetPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code === "EPERM") {
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+                fs.renameSync(tmpPath, targetPath);
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmpPath);
+        }
+        catch {
+            // best-effort cleanup; surface the original error
+        }
+        throw err;
+    }
+}
+/** Remove `TMP_PREFIX` temps older than the orphan age in `dir` (best-effort). */
+export function cleanOrphanedTmps(dir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    const now = Date.now();
+    for (const name of entries) {
+        if (!name.startsWith(TMP_PREFIX))
+            continue;
+        const full = path.join(dir, name);
+        try {
+            if (now - fs.statSync(full).mtimeMs > ORPHAN_AGE_MS)
+                fs.unlinkSync(full);
+        }
+        catch {
+            // entry may be gone or inaccessible — skip
+        }
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/local-web/atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/local-web/atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEjD,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAAe;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC;QACJ,IAAI,CAAC;YACJ,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,kDAAkD;QACnD,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACJ,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,aAAa;gBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACR,2CAA2C;QAC5C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/local-web/constants.d.ts

@@ -0,0 +1,13 @@
+/**
+ * local-web shared constants.
+ *
+ * The loopback bind host is the single security anchor for every primitive in
+ * this layer: the server binds it, and the Host/Origin guards build their
+ * allowlists from it. Keeping one constant avoids drift between "what we bind"
+ * and "what we allow".
+ */
+/** Loopback interface — the server binds here and guards allow only this + localhost. */
+export declare const LOOPBACK_HOST = "127.0.0.1";
+/** Grace period for in-flight connections to drain on server stop. */
+export declare const CLOSE_GRACE_MS = 5000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/local-web/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/local-web/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yFAAyF;AACzF,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,cAAc,OAAQ,CAAC"}

package/dist/local-web/constants.js

@@ -0,0 +1,13 @@
+/**
+ * local-web shared constants.
+ *
+ * The loopback bind host is the single security anchor for every primitive in
+ * this layer: the server binds it, and the Host/Origin guards build their
+ * allowlists from it. Keeping one constant avoids drift between "what we bind"
+ * and "what we allow".
+ */
+/** Loopback interface — the server binds here and guards allow only this + localhost. */
+export const LOOPBACK_HOST = "127.0.0.1";
+/** Grace period for in-flight connections to drain on server stop. */
+export const CLOSE_GRACE_MS = 5_000;
+//# sourceMappingURL=constants.js.map

package/dist/local-web/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/local-web/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC"}

package/dist/local-web/etag.d.ts

@@ -0,0 +1,19 @@
+/**
+ * SHA-256 ETag + optimistic-concurrency (409-stale) helper.
+ *
+ * CONSOLIDATES the two prior sources: the standalone per-file SHA-256 ETag
+ * (64-char lowercase hex of the file's bytes) and the write pipeline's 409-stale
+ * check (`current !== provided ⇒ stale`). One canonical implementation drives
+ * both a caller computing an ETag to hand out and a caller comparing a
+ * client-supplied ETag before a write. Missing file ⇒ null (caller decides).
+ */
+/** 64-char lowercase hex SHA-256 of `content`. */
+export declare function computeEtag(content: Buffer | string): string;
+/** SHA-256 ETag of a file's bytes, or null if it cannot be read. */
+export declare function etagFromFile(filePath: string): string | null;
+/**
+ * True when a client-supplied ETag no longer matches the current one — the
+ * optimistic-concurrency condition a write route answers with HTTP 409.
+ */
+export declare function isStaleEtag(currentEtag: string, providedEtag: string): boolean;
+//# sourceMappingURL=etag.d.ts.map

package/dist/local-web/etag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../../src/local-web/etag.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,kDAAkD;AAClD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE9E"}

package/dist/local-web/etag.js

@@ -0,0 +1,32 @@
+/**
+ * SHA-256 ETag + optimistic-concurrency (409-stale) helper.
+ *
+ * CONSOLIDATES the two prior sources: the standalone per-file SHA-256 ETag
+ * (64-char lowercase hex of the file's bytes) and the write pipeline's 409-stale
+ * check (`current !== provided ⇒ stale`). One canonical implementation drives
+ * both a caller computing an ETag to hand out and a caller comparing a
+ * client-supplied ETag before a write. Missing file ⇒ null (caller decides).
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+/** 64-char lowercase hex SHA-256 of `content`. */
+export function computeEtag(content) {
+    return crypto.createHash("sha256").update(content).digest("hex");
+}
+/** SHA-256 ETag of a file's bytes, or null if it cannot be read. */
+export function etagFromFile(filePath) {
+    try {
+        return computeEtag(fs.readFileSync(filePath));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when a client-supplied ETag no longer matches the current one — the
+ * optimistic-concurrency condition a write route answers with HTTP 409.
+ */
+export function isStaleEtag(currentEtag, providedEtag) {
+    return currentEtag !== providedEtag;
+}
+//# sourceMappingURL=etag.js.map

package/dist/local-web/etag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.js","sourceRoot":"","sources":["../../src/local-web/etag.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,OAAwB;IACnD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,IAAI,CAAC;QACJ,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,YAAoB;IACpE,OAAO,WAAW,KAAK,YAAY,CAAC;AACrC,CAAC"}

package/dist/local-web/host-guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Host header guard — defense against DNS rebinding.
+ *
+ * Behavior extracted verbatim from the loopback server's private host check:
+ * a request is allowed only when its `Host` header is the loopback/localhost
+ * authority (with or without the bound port). The `Host` header may arrive
+ * mixed-case from proxies, so this uses a Set of exact expected values plus the
+ * bare-host fallback — it does NOT lowercase (that is the Origin guard's job).
+ */
+/** True when `host` is an allowed loopback authority for `port`. Missing host ⇒ false. */
+export declare function isHostAllowed(host: string | undefined, port: number): boolean;
+//# sourceMappingURL=host-guard.d.ts.map

package/dist/local-web/host-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-guard.d.ts","sourceRoot":"","sources":["../../src/local-web/host-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAI7E"}

package/dist/local-web/host-guard.js

@@ -0,0 +1,18 @@
+/**
+ * Host header guard — defense against DNS rebinding.
+ *
+ * Behavior extracted verbatim from the loopback server's private host check:
+ * a request is allowed only when its `Host` header is the loopback/localhost
+ * authority (with or without the bound port). The `Host` header may arrive
+ * mixed-case from proxies, so this uses a Set of exact expected values plus the
+ * bare-host fallback — it does NOT lowercase (that is the Origin guard's job).
+ */
+import { LOOPBACK_HOST } from "./constants.js";
+/** True when `host` is an allowed loopback authority for `port`. Missing host ⇒ false. */
+export function isHostAllowed(host, port) {
+    if (!host)
+        return false;
+    const expected = new Set([`${LOOPBACK_HOST}:${port}`, `localhost:${port}`]);
+    return expected.has(host) || host === LOOPBACK_HOST || host === "localhost";
+}
+//# sourceMappingURL=host-guard.js.map

package/dist/local-web/host-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-guard.js","sourceRoot":"","sources":["../../src/local-web/host-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,IAAwB,EAAE,IAAY;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,IAAI,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW,CAAC;AAC7E,CAAC"}

package/dist/local-web/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * local-web — domain-neutral loopback web primitives.
+ *
+ * Extracted (Phase 2) from the prior local-server implementation so the Visual
+ * Plan studio (and any future loopback tool) reuses ONE audited copy of the security- and
+ * concurrency-sensitive code: loopback server lifecycle, Host/Origin guards,
+ * bounded body reading, realpath containment, atomic writes, SHA-256 ETags,
+ * traversal-guarded static serving, and cross-platform browser open.
+ *
+ * Dependency direction is product-domain → local-web only; this layer imports
+ * nothing product-specific.
+ */
+export { LOOPBACK_HOST, CLOSE_GRACE_MS } from "./constants.js";
+export { isHostAllowed } from "./host-guard.js";
+export { isOriginAllowed } from "./origin-guard.js";
+export { bufferBody, BodyError } from "./request-body.js";
+export { safeRealpath, isContainedPath, resolveContained } from "./path-boundary.js";
+export { atomicWriteFileSync, cleanOrphanedTmps } from "./atomic-write.js";
+export { computeEtag, etagFromFile, isStaleEtag } from "./etag.js";
+export { serveStatic } from "./static-handler.js";
+export { openBrowser } from "./open-browser.js";
+export { LocalServer, type LocalServerOptions, type RequestHandler } from "./local-server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/local-web/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/local-web/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/local-web/index.js

@@ -0,0 +1,23 @@
+/**
+ * local-web — domain-neutral loopback web primitives.
+ *
+ * Extracted (Phase 2) from the prior local-server implementation so the Visual
+ * Plan studio (and any future loopback tool) reuses ONE audited copy of the security- and
+ * concurrency-sensitive code: loopback server lifecycle, Host/Origin guards,
+ * bounded body reading, realpath containment, atomic writes, SHA-256 ETags,
+ * traversal-guarded static serving, and cross-platform browser open.
+ *
+ * Dependency direction is product-domain → local-web only; this layer imports
+ * nothing product-specific.
+ */
+export { LOOPBACK_HOST, CLOSE_GRACE_MS } from "./constants.js";
+export { isHostAllowed } from "./host-guard.js";
+export { isOriginAllowed } from "./origin-guard.js";
+export { bufferBody, BodyError } from "./request-body.js";
+export { safeRealpath, isContainedPath, resolveContained } from "./path-boundary.js";
+export { atomicWriteFileSync, cleanOrphanedTmps } from "./atomic-write.js";
+export { computeEtag, etagFromFile, isStaleEtag } from "./etag.js";
+export { serveStatic } from "./static-handler.js";
+export { openBrowser } from "./open-browser.js";
+export { LocalServer } from "./local-server.js";
+//# sourceMappingURL=index.js.map

package/dist/local-web/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/local-web/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAgD,MAAM,mBAAmB,CAAC"}

package/dist/local-web/local-server.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Loopback HTTP server lifecycle — 127.0.0.1 bind + Host guard + port fallback.
+ *
+ * Server lifecycle ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts).
+ * License Apache-2.0 — see the repository NOTICE file.
+ *
+ * Domain-neutral: it owns ONLY binding, the DNS-rebinding Host guard, port
+ * fallback, and graceful shutdown. All routing is delegated to the injected
+ * `handler` — this layer has no knowledge of any product's routes or payloads.
+ * A request whose `Host` header fails the guard gets 403 before the handler
+ * ever sees it.
+ */
+import * as http from "node:http";
+export type RequestHandler = (req: http.IncomingMessage, res: http.ServerResponse) => void;
+export interface LocalServerOptions {
+    /** Fixed port, or 0/undefined for a random free port. A busy fixed port falls back to random. */
+    port?: number;
+    /** Routes every Host-allowed request. */
+    handler: RequestHandler;
+    /** Emit a one-line note to stderr on port fallback. */
+    verbose?: boolean;
+}
+export declare class LocalServer {
+    private server;
+    private actualPort;
+    private readonly opts;
+    constructor(opts: LocalServerOptions);
+    get port(): number;
+    get url(): string;
+    /** Bind the server and return its URL. Falls back to a random port if the fixed one is busy. */
+    start(): Promise<string>;
+    /** Gracefully close, allowing in-flight connections a bounded grace period. */
+    stop(): Promise<void>;
+    private listen;
+    private route;
+}
+//# sourceMappingURL=local-server.d.ts.map

package/dist/local-web/local-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.d.ts","sourceRoot":"","sources":["../../src/local-web/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IAClC,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,OAAO,EAAE,cAAc,CAAC;IACxB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,WAAW;IACvB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAE9B,IAAI,EAAE,kBAAkB;IAIpC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,gGAAgG;IAC1F,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAgB9B,+EAA+E;IACzE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,KAAK;CAQb"}

package/dist/local-web/local-server.js

@@ -0,0 +1,85 @@
+/**
+ * Loopback HTTP server lifecycle — 127.0.0.1 bind + Host guard + port fallback.
+ *
+ * Server lifecycle ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts).
+ * License Apache-2.0 — see the repository NOTICE file.
+ *
+ * Domain-neutral: it owns ONLY binding, the DNS-rebinding Host guard, port
+ * fallback, and graceful shutdown. All routing is delegated to the injected
+ * `handler` — this layer has no knowledge of any product's routes or payloads.
+ * A request whose `Host` header fails the guard gets 403 before the handler
+ * ever sees it.
+ */
+import * as http from "node:http";
+import { LOOPBACK_HOST, CLOSE_GRACE_MS } from "./constants.js";
+import { isHostAllowed } from "./host-guard.js";
+export class LocalServer {
+    server = null;
+    actualPort = 0;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    get port() {
+        return this.actualPort;
+    }
+    get url() {
+        return `http://${LOOPBACK_HOST}:${this.actualPort}`;
+    }
+    /** Bind the server and return its URL. Falls back to a random port if the fixed one is busy. */
+    async start() {
+        const desiredPort = this.opts.port ?? 0;
+        try {
+            await this.listen(desiredPort);
+        }
+        catch (err) {
+            const e = err;
+            if (desiredPort !== 0 && (e.code === "EADDRINUSE" || e.code === "EACCES")) {
+                if (this.opts.verbose)
+                    process.stderr.write(`[local-web] port ${desiredPort} unavailable (${e.code}); falling back to random\n`);
+                await this.listen(0);
+            }
+            else {
+                throw err;
+            }
+        }
+        return this.url;
+    }
+    /** Gracefully close, allowing in-flight connections a bounded grace period. */
+    async stop() {
+        if (!this.server)
+            return;
+        const srv = this.server;
+        this.server = null;
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(), CLOSE_GRACE_MS);
+            if (typeof timer.unref === "function")
+                timer.unref();
+            srv.close(() => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    }
+    listen(port) {
+        return new Promise((resolve, reject) => {
+            const server = http.createServer((req, res) => this.route(req, res));
+            server.on("error", reject); // caller distinguishes EADDRINUSE/EACCES for fallback
+            server.listen(port, LOOPBACK_HOST, () => {
+                this.server = server;
+                const addr = server.address();
+                this.actualPort = typeof addr === "object" && addr ? addr.port : port;
+                resolve();
+            });
+        });
+    }
+    route(req, res) {
+        if (!isHostAllowed(req.headers.host, this.actualPort)) {
+            res.writeHead(403, { "Content-Type": "text/plain" });
+            res.end("Forbidden");
+            return;
+        }
+        this.opts.handler(req, res);
+    }
+}
+//# sourceMappingURL=local-server.js.map

package/dist/local-web/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/local-web/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAahD,MAAM,OAAO,WAAW;IACf,MAAM,GAAuB,IAAI,CAAC;IAClC,UAAU,GAAG,CAAC,CAAC;IACN,IAAI,CAAqB;IAE1C,YAAY,IAAwB;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,IAAI,GAAG;QACN,OAAO,UAAU,aAAa,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IACrD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK;QACV,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,WAAW,iBAAiB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBACjI,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,IAAY;QAC1B,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,sDAAsD;YAClF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;gBACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtE,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAyB,EAAE,GAAwB;QAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;CACD"}

package/dist/local-web/open-browser.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Cross-platform browser launcher with no runtime deps.
+ *
+ * Ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts).
+ * License Apache-2.0 — see the repository NOTICE file.
+ *
+ * macOS/Linux use execFile (no shell). Windows requires `start` (a shell
+ * builtin), so it execs a shell — but ONLY with our own URL, never user input.
+ */
+/** Open `url` in the platform default browser. `onError` receives any launch error. */
+export declare function openBrowser(url: string, onError?: (err: Error) => void): void;
+//# sourceMappingURL=open-browser.d.ts.map

package/dist/local-web/open-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/local-web/open-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAa7E"}

package/dist/{orchviz/open-url.js → local-web/open-browser.js}

@@ -1,14 +1,15 @@
 /**
- * openURL — cross-platform browser launcher with no runtime deps.
+ * Cross-platform browser launcher with no runtime deps.
  *
  * Ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts).
- * License Apache-2.0 (see ../NOTICE).
+ * License Apache-2.0 — see the repository NOTICE file.
  *
- * macOS/Linux use execFile (no shell). Windows requires `start` (shell builtin),
- * so we exec but ONLY with our own printed URL — never user input (RT2 #3).
+ * macOS/Linux use execFile (no shell). Windows requires `start` (a shell
+ * builtin), so it execs a shell — but ONLY with our own URL, never user input.
  */
 import { exec, execFile } from "node:child_process";
-export function openURL(url, onError) {
+/** Open `url` in the platform default browser. `onError` receives any launch error. */
+export function openBrowser(url, onError) {
     const cb = (err) => {
         if (err && onError)
             onError(err);
@@ -17,12 +18,12 @@ export function openURL(url, onError) {
         execFile("open", [url], cb);
     }
     else if (process.platform === "win32") {
-        // `start` is a shell builtin; empty title arg is required to avoid
-        // `start "URL"` being parsed as a window title.
+        // `start` is a shell builtin; the empty title arg stops `start "URL"`
+        // from being parsed as a window title.
         exec(`start "" "${url}"`, cb);
     }
     else {
         execFile("xdg-open", [url], cb);
     }
 }
-//# sourceMappingURL=open-url.js.map
+//# sourceMappingURL=open-browser.js.map

package/dist/local-web/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/local-web/open-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEpD,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAA8B;IACtE,MAAM,EAAE,GAAG,CAAC,GAAiB,EAAQ,EAAE;QACtC,IAAI,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzC,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACP,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;AACF,CAAC"}

package/dist/local-web/origin-guard.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Origin header guard — exact-match allowlist for cross-origin write requests.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline: case-insensitive
+ * EXACT equality against the two allowed origins. No prefix-match, no contains,
+ * no regex. Distinct from the Host guard — the `Origin` header is always
+ * lowercase per the browser spec, so this lowercases and compares exact strings.
+ */
+/** True when `origin` is exactly the loopback or localhost origin for `port`. */
+export declare function isOriginAllowed(origin: string, port: number): boolean;
+//# sourceMappingURL=origin-guard.d.ts.map

package/dist/local-web/origin-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-guard.d.ts","sourceRoot":"","sources":["../../src/local-web/origin-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrE"}

package/dist/local-web/origin-guard.js

@@ -0,0 +1,15 @@
+/**
+ * Origin header guard — exact-match allowlist for cross-origin write requests.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline: case-insensitive
+ * EXACT equality against the two allowed origins. No prefix-match, no contains,
+ * no regex. Distinct from the Host guard — the `Origin` header is always
+ * lowercase per the browser spec, so this lowercases and compares exact strings.
+ */
+import { LOOPBACK_HOST } from "./constants.js";
+/** True when `origin` is exactly the loopback or localhost origin for `port`. */
+export function isOriginAllowed(origin, port) {
+    const lower = origin.toLowerCase();
+    return lower === `http://${LOOPBACK_HOST}:${port}` || lower === `http://localhost:${port}`;
+}
+//# sourceMappingURL=origin-guard.js.map

package/dist/local-web/origin-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-guard.js","sourceRoot":"","sources":["../../src/local-web/origin-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,KAAK,KAAK,UAAU,aAAa,IAAI,IAAI,EAAE,IAAI,KAAK,KAAK,oBAAoB,IAAI,EAAE,CAAC;AAC5F,CAAC"}

package/dist/local-web/path-boundary.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Realpath-based path containment — fail-closed.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline's boundary
+ * checks: `safeRealpath` resolves symlinks and returns null on ANY error (the
+ * caller MUST treat null as denied), and `isContainedPath` verifies a resolved
+ * child sits at or strictly inside a resolved parent. Together they stop a
+ * symlinked entry from redirecting reads/writes outside an allowed root.
+ */
+/** Resolve `p` to a realpath, or null on any failure (fail-closed). */
+export declare function safeRealpath(p: string): string | null;
+/** True when `childRealpath` is `parentRealpath` itself or strictly inside it. */
+export declare function isContainedPath(childRealpath: string, parentRealpath: string): boolean;
+/**
+ * Resolve `child` and verify it is contained within `parent` (already-resolved
+ * or resolvable). Returns the child's realpath on success, or null when either
+ * realpath fails or containment is violated.
+ */
+export declare function resolveContained(parent: string, child: string): string | null;
+//# sourceMappingURL=path-boundary.d.ts.map

package/dist/local-web/path-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary.d.ts","sourceRoot":"","sources":["../../src/local-web/path-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMrD;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7E"}

package/dist/local-web/path-boundary.js

@@ -0,0 +1,39 @@
+/**
+ * Realpath-based path containment — fail-closed.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline's boundary
+ * checks: `safeRealpath` resolves symlinks and returns null on ANY error (the
+ * caller MUST treat null as denied), and `isContainedPath` verifies a resolved
+ * child sits at or strictly inside a resolved parent. Together they stop a
+ * symlinked entry from redirecting reads/writes outside an allowed root.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+/** Resolve `p` to a realpath, or null on any failure (fail-closed). */
+export function safeRealpath(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+/** True when `childRealpath` is `parentRealpath` itself or strictly inside it. */
+export function isContainedPath(childRealpath, parentRealpath) {
+    return childRealpath === parentRealpath || childRealpath.startsWith(parentRealpath + path.sep);
+}
+/**
+ * Resolve `child` and verify it is contained within `parent` (already-resolved
+ * or resolvable). Returns the child's realpath on success, or null when either
+ * realpath fails or containment is violated.
+ */
+export function resolveContained(parent, child) {
+    const parentReal = safeRealpath(parent);
+    if (!parentReal)
+        return null;
+    const childReal = safeRealpath(child);
+    if (!childReal)
+        return null;
+    return isContainedPath(childReal, parentReal) ? childReal : null;
+}
+//# sourceMappingURL=path-boundary.js.map

package/dist/local-web/path-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary.js","sourceRoot":"","sources":["../../src/local-web/path-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,CAAS;IACrC,IAAI,CAAC;QACJ,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,cAAsB;IAC5E,OAAO,aAAa,KAAK,cAAc,IAAI,aAAa,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAAa;IAC7D,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC"}

package/dist/local-web/request-body.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Bounded request-body reader with a socket timeout.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline: collect the body
+ * up to `capBytes`, destroying the socket and rejecting with `BodyError(413)` on
+ * overflow or `BodyError(408)` on timeout. The cap + timeout are the DoS guard
+ * for any POST/PATCH route; the consumer supplies both (the write pipeline uses
+ * a 4096-byte cap).
+ */
+import type { IncomingMessage } from "node:http";
+/** Carries the HTTP status + a short tag for a body-read failure. */
+export declare class BodyError extends Error {
+    readonly status: number;
+    readonly tag: string;
+    constructor(status: number, tag: string);
+}
+/**
+ * Collect the full request body up to `capBytes`. Destroys the socket if the
+ * body exceeds the cap OR if `timeoutMs` elapses first. Rejects with
+ * `BodyError(413,"body-too-large")` on overflow, `BodyError(408,"request-timeout")`
+ * on timeout.
+ */
+export declare function bufferBody(req: IncomingMessage, capBytes: number, timeoutMs: number): Promise<Buffer>;
+//# sourceMappingURL=request-body.d.ts.map

package/dist/local-web/request-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.d.ts","sourceRoot":"","sources":["../../src/local-web/request-body.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,qEAAqE;AACrE,qBAAa,SAAU,SAAQ,KAAK;aAElB,MAAM,EAAE,MAAM;aACd,GAAG,EAAE,MAAM;gBADX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM;CAK5B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAwCrG"}