miakapi 3.0.31 → 4.0.0-alpha.0

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 Mathieu Colmon
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,358 @@
+# MiakAPI
+
+MiakAPI is the typed SDK for running a trusted Bun/TypeScript coordinator and
+connecting a first-party browser application to a Miakapp home. A coordinator
+owns complete state, access, event, and function declarations for one
+integration. The isolated browser entry point exposes the authenticated user role
+without bundling server-runtime or coordinator-only dependencies.
+
+Version 4 is a complete replacement for the legacy callback-based MiakAPI 3
+client. It is currently an alpha while the Miakapp 4 stack is being completed.
+
+**Building a home with a coding agent?** Read
+[docs/agent-guide.md](docs/agent-guide.md) first. It covers the judgment the
+reference below does not: what the coordinator must authorize, why component
+requirements and coordinator grants intersect silently, and which failures must
+never be retried. Start from [`templates/home`](templates/home).
+
+## Coordinator requirements
+
+- Bun 1.2.23 or newer (primary coordinator runtime)
+- Node.js 22.9 or newer when running compatibility or migration tooling
+- A Miakapp Home Key or another approved short-lived access-token provider
+- A Miakapp relay implementing wire protocol 1.0
+
+The default `miakapi` entry point is server-side software. Do not ship
+coordinator credentials, Home Keys, or coordinator access-token providers to a
+browser or an untrusted plugin runtime.
+
+## Installation
+
+```sh
+bun add miakapi@next
+```
+
+Alpha releases use the `next` npm tag. The package is ESM-only and remains
+Node-compatible so runtime-specific migration adapters can reuse the same SDK.
+
+## Quick start
+
+```ts
+import {
+  ApplicationCallError,
+  EventDirection,
+  createCoordinator,
+  createHomeKeyAccessTokenProvider,
+} from 'miakapi';
+
+const homeKey = process.env.MIAKAPP_HOME_KEY;
+if (homeKey === undefined) throw new Error('MIAKAPP_HOME_KEY is required');
+
+const coordinator = createCoordinator({
+  name: 'home-assistant',
+  accessTokenProvider: createHomeKeyAccessTokenProvider({
+    exchangeEndpoint: 'https://control.miakapp.com/v1/access-tokens:exchange',
+    homeKey,
+  }),
+});
+
+coordinator.configure({
+  state: {
+    'climate.living_room.temperature': 20,
+  },
+  stateAccess: [{
+    userId: 'user-id',
+    patterns: ['climate.living_room.*'],
+  }],
+  events: [{
+    topic: 'climate.living_room.changed',
+    directions:
+      EventDirection.acceptFromUsers |
+      EventDirection.publishToUsers,
+  }],
+  eventAccess: [{
+    userId: 'user-id',
+    publish: ['climate.living_room.changed'],
+    subscribe: ['climate.living_room.changed'],
+  }],
+  functions: {
+    async 'climate.living_room.set_target'(call) {
+      if (typeof call.arguments !== 'number') {
+        throw new ApplicationCallError(2001, 'Target must be a number');
+      }
+      await call.emit({ phase: 'applying' });
+      return { accepted: true, target: call.arguments };
+    },
+  },
+});
+
+coordinator.subscribe(({ current, reason }) => {
+  console.log('Miakapp coordinator status:', current, reason?.kind);
+});
+
+const session = await coordinator.start();
+console.log('Ready in generation', session.generation);
+```
+
+A complete minimal Bun coordinator matching the Miakapp V4 staging browser is
+available in [`examples/synthetic-coordinator.ts`](examples/synthetic-coordinator.ts).
+It publishes a small home state and implements one real `lighting.toggle` call.
+Run it only in a trusted backend process:
+
+```sh
+bun run build
+bun run examples/synthetic-coordinator.ts
+```
+
+The examples import `miakapi` the way an application does, so they resolve
+through the package's own `exports` and need `dist` to exist. `bun run check`
+builds before it tests for the same reason.
+
+The process reads `MIAKAPP_HOME_KEY`,
+`MIAKAPP_CONTROL_PLANE_EXCHANGE_ENDPOINT`, and `MIAKAPP_OWNER_USER_ID` from its
+runtime environment. The Home Key is the only secret; the endpoint and Firebase
+user ID are identifiers. Never pass any of them as command-line arguments.
+
+The Home Key provider makes exactly one exchange request for each initial,
+reauthentication, or reconnect demand from the SDK. It sends the Home Key only
+to the configured HTTPS control-plane endpoint, rejects redirects and open or
+overlong responses, and returns only the relay URL, compact access token, and
+expiry to the coordinator core. It performs no independent retry; the
+coordinator's single bounded reconnect schedule remains authoritative.
+
+Keep the Home Key in the trusted coordinator backend. Do not place it in a web
+bundle, browser storage, logs, URLs, or relay configuration. Applications with a
+different approved credential store may continue to implement
+`AccessTokenProvider` directly.
+
+### Running a coordinator as a service
+
+[`examples/synthetic-coordinator-service.ts`](examples/synthetic-coordinator-service.ts)
+wraps the same coordinator in the shape a container platform expects: an HTTP
+listener that answers immediately, a `/healthz` probe that reports the live
+lifecycle status, graceful `SIGTERM` draining, and a non-zero exit when the
+coordinator stops without a shutdown signal so the platform restarts it.
+[`examples/deploy/Dockerfile`](examples/deploy/Dockerfile) builds it from the
+repository root.
+
+Run exactly one coordinator per home. Two coordinators sharing a Home Key take
+turns displacing each other on the relay; the reconnect schedule backs off so
+the fight stays cheap, but only one of them holds the home.
+
+`configure` supplies all five declaration slices as one desired snapshot. The
+coordinator becomes `ready` only after the relay acknowledges them in order. A
+later declaration call replaces its complete slice and temporarily returns the
+coordinator to `synchronizing` until atomic activation.
+
+## State, events, and calls
+
+State mutations are atomic and use acknowledged string paths:
+
+```ts
+await coordinator.state.set([
+  { path: 'climate.living_room.temperature', value: 21.5 },
+]);
+```
+
+Event publication returns a synchronous opaque ID and a transport-handoff
+promise. `sent` is not a delivery receipt; a later correlated relay rejection is
+reported through `coordinator.errors`.
+
+```ts
+const event = coordinator.events.publish(
+  'climate.living_room.changed',
+  { temperature: 21.5 },
+);
+await event.sent;
+
+coordinator.errors.subscribe((failure) => {
+  if (failure.correlation?.localId === event.localId) {
+    console.error('The relay rejected the event:', failure.kind);
+  }
+});
+```
+
+Outgoing calls expose acceptance, pull-bounded progress, and one terminal
+result:
+
+```ts
+const call = coordinator.calls.start({
+  function: 'lighting.scene.activate',
+  arguments: { scene: 'evening' },
+  timeoutMs: 10_000,
+  idempotencyKey: 'intent-018f',
+});
+
+await call.accepted;
+for await (const progress of call.stream) console.log(progress);
+const result = await call.result;
+```
+
+MiakAPI never retries state mutations, events, or calls. An idempotency key is
+passed to the callee but does not enable hidden retries.
+
+## Trusted browser client
+
+Use the isolated `miakapi/browser` entry point in the first-party Miakapp web
+application. It relies on the browser's native WebSocket implementation and does
+not expose coordinator declarations, Home Keys, or the Node.js `ws` transport.
+
+```ts
+import {
+  createBrowserClient,
+  createControlPlaneBrowserRelayCredentialProvider,
+} from 'miakapi/browser';
+
+const credentialProvider = createControlPlaneBrowserRelayCredentialProvider({
+  exchangeEndpoint: 'https://control.example.com/v1/user-relay-tokens:exchange',
+  async getFirebaseIdToken({ signal }) {
+    if (signal.aborted) throw signal.reason;
+    const user = firebaseAuth.currentUser;
+    if (user === null) throw new Error('The user is signed out');
+    return user.getIdToken();
+  },
+  async getAppCheckToken({ signal }) {
+    if (signal.aborted) throw signal.reason;
+    return (await getToken(firebaseAppCheck)).token;
+  },
+});
+
+const client = createBrowserClient({
+  homeId: 'my-home',
+  credentialProvider,
+});
+
+await client.start();
+
+const removeStateListener = client.state.subscribe((snapshot) => {
+  if (!snapshot.stale) renderHome(snapshot.values);
+});
+
+const removeHomeListener = client.home.subscribe((home) => {
+  renderAvailability(home.enrolled, home.coordinators, home.stale);
+});
+
+const call = client.calls.start({
+  function: 'lighting.scene.activate',
+  arguments: { scene: 'evening' },
+  timeoutMs: 10_000,
+  idempotencyKey: 'intent-018f',
+});
+await call.accepted;
+const result = await call.result;
+
+removeStateListener();
+removeHomeListener();
+await client.stop();
+```
+
+This replaces the earlier alpha browser options `relayUrl` and
+`idTokenProvider`. They are intentionally rejected: callers must not pair an
+independently selected relay with a source or access token.
+
+The credential provider is invoked for the initial connection, reauthentication,
+and reconnects. Its Firebase ID and App Check callbacks run only inside the
+trusted host and send those source tokens solely to the HTTPS control plane.
+MiakAPI never places them in a relay URL, WebSocket subprotocol, persistent
+browser storage, log, error, `HELLO`, or `REAUTH` frame.
+
+The control plane returns an up-to-five-minute Miakapp access token atomically
+with its authoritative relay URL. MiakAPI sends only that audience-bound token
+to the returned relay. If a renewal selects a different relay, the client marks
+the old session stale and closes it. Before any automatic replacement connection,
+including recovery from a transport or protocol failure, the client waits for the
+native transport close event. If closure is not confirmed within ten seconds, the
+client stops fail-closed instead of opening overlapping relay sockets. A routing
+handoff uses the already-issued credential; it does not expose the new token to
+the old relay or repeat the exchange. Stop and discard the client immediately
+when the Firebase user signs out or the selected home changes. Relay routing
+changes arrive through credentials and do not require mutating the client options.
+
+Audience binding limits credential replay; it does not encrypt home traffic from
+the selected relay. Users should still choose an operator they trust with the
+plaintext state and calls that transit through it.
+
+Browser state snapshots are defensive copies and become `stale` immediately
+when continuity is lost. Revision or dictionary mismatches trigger one
+fail-closed resynchronization request. Browser calls target the home's default
+coordinator by function name, have no progress stream, and are never replayed by
+the SDK. Incoming calls are rejected with an application error because this
+first user profile deliberately exposes no browser call handlers. An
+`outcome_unknown` failure means an effect may already have happened.
+
+Token acquisition, protocol welcome, bootstrap, and reauthentication each have
+bounded deadlines. The browser transport also caps individual frames, its
+outbound queue, and rolling inbound bytes and frame counts. A native WebSocket
+still materializes a complete message before JavaScript can reject it, so these
+limits are defense in depth rather than isolation from a malicious relay; a
+Worker boundary remains an option for a later hardened browser profile.
+
+## Failure outcomes
+
+Every `CoordinatorFailure` includes an `outcome`:
+
+- `not_dispatched`: local validation, offline gating, or an explicit relay
+  terminal proves the operation did not dispatch.
+- `sent`: an event frame reached the active transport; delivery is not implied.
+- `accepted`: a call was accepted before its terminal failure.
+- `applied`: a state mutation was acknowledged by the relay.
+- `outcome_unknown`: transport loss, deadline, or post-accept cancellation means
+  an external effect may already have happened.
+
+Treat `outcome_unknown` as uncertainty, never as rollback. MiakAPI does not turn
+an uncertain physical effect into a safe automatic retry.
+
+## Lifecycle and cleanup
+
+`start()` may be called once. `stop()` is idempotent and repeated calls return the
+same terminal promise. It aborts token and handler work, settles pending
+operations conservatively, removes listeners, and closes the owned socket.
+
+```ts
+await coordinator.stop({ deadlineMs: 5_000 });
+```
+
+`deadlineMs` bounds cleanup even when an injected dependency ignores its abort
+signal.
+
+Between `start()` and `stop()` the coordinator owns its own reconnect schedule:
+full jitter under a ceiling that doubles from one second up to thirty. The
+ceiling returns to one second only after a session has held for thirty seconds,
+so a session that is torn down as soon as it becomes `ready` keeps backing off
+instead of reconnecting in a tight loop.
+
+## Migration from MiakAPI 3
+
+MiakAPI 4 removes the legacy `Miakapi(home, id, secret)` constructor, Firestore
+lookup, mutable `home.variables`, UI callbacks, and notification helpers. Those
+APIs depended on the retired Miakapp 3 transport and are not emulated.
+
+Integrations now:
+
+1. obtain short-lived access material through an `AccessTokenProvider`;
+2. declare complete state, ACL, event, and function slices;
+3. wait for `start()` readiness before issuing effects;
+4. handle uncertainty explicitly through typed failures.
+
+For UI automation and agent-driven homes, use [miakapp.com](https://miakapp.com/)
+instead of building against the retired page-callback protocol.
+
+## Protocol and conformance
+
+The public TypeScript API and wire codec are pinned to the Miakapp-V3 coordinator
+contract at an immutable commit in [`contracts/miakapp-v3.json`](contracts/miakapp-v3.json).
+The external conformance subject runs the real SDK against a deterministic relay
+and must pass every scenario in the `sdk` profile.
+
+```sh
+bun install --frozen-lockfile
+bun run check
+```
+
+The check includes strict type checking, unit and adversarial tests, Node.js and
+browser-bundle smoke tests, canonical external conformance, and an npm package
+dry run.
+
+## License
+
+[ISC](LICENSE)

package/contracts/miakapp-v3.json

@@ -0,0 +1,6 @@
+{
+  "repository": "https://github.com/Miakapp/Miakapp-V3.git",
+  "commit": "b927789691dd8cdebc91b673853cdc6711fe057d",
+  "profile": "sdk",
+  "schema": "miakapp.coordinator-contract/1"
+}

package/dist/access-token-provider.d.ts

@@ -0,0 +1,8 @@
+import type { AccessTokenProvider } from './api.js';
+export interface HomeKeyAccessTokenProviderOptions {
+    readonly exchangeEndpoint: string;
+    readonly homeKey: string;
+    readonly fetch?: (input: string, init: RequestInit) => Promise<Response>;
+}
+export declare function createHomeKeyAccessTokenProvider(value: HomeKeyAccessTokenProviderOptions): AccessTokenProvider;
+//# sourceMappingURL=access-token-provider.d.ts.map

package/dist/access-token-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-provider.d.ts","sourceRoot":"","sources":["../src/access-token-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,UAAU,CAAC;AAgBlB,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1E;AAsGD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,iCAAiC,GACvC,mBAAmB,CA4DrB"}

package/dist/access-token-provider.js

@@ -0,0 +1,167 @@
+import { boundedResponseBody, boundedResponseString, cancelResponseBody, canonicalRelayUrl, parseResponseJson, } from './internal/control-plane-response.js';
+const MAXIMUM_ACCESS_TOKEN_BYTES = 8_192;
+const MAXIMUM_ACCESS_TOKEN_LIFETIME_MS = 330_000;
+const HOME_KEY = /^mhk1_([A-Za-z0-9_-]{22})_([A-Za-z0-9_-]{43})$/;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const COORDINATOR_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function exchangeFailure() {
+    throw new Error('Miakapp access-token exchange failed');
+}
+function exactRecord(value, required, optional) {
+    if (value === null || Array.isArray(value) || typeof value !== 'object')
+        return exchangeFailure();
+    const keys = Object.keys(value);
+    const allowed = new Set([...required, ...optional]);
+    if (required.some((key) => !Object.hasOwn(value, key))
+        || keys.some((key) => !allowed.has(key)))
+        return exchangeFailure();
+    return value;
+}
+function canonicalExchangeEndpoint(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 2_048) {
+        return exchangeFailure();
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return exchangeFailure();
+    }
+    if (parsed.protocol !== 'https:'
+        || parsed.username !== ''
+        || parsed.password !== ''
+        || parsed.search !== ''
+        || parsed.hash !== ''
+        || parsed.pathname !== '/v1/access-tokens:exchange'
+        || parsed.href !== value)
+        return exchangeFailure();
+    return value;
+}
+function decodeCanonicalBase64URL(value, bytes) {
+    if (!BASE64URL.test(value))
+        return false;
+    const decoded = Buffer.from(value, 'base64url');
+    return decoded.byteLength === bytes && decoded.toString('base64url') === value;
+}
+function validHomeKey(value) {
+    if (typeof value !== 'string')
+        return exchangeFailure();
+    const match = HOME_KEY.exec(value);
+    if (match === null
+        || match[1] === undefined
+        || match[2] === undefined
+        || !decodeCanonicalBase64URL(match[1], 16)
+        || !decodeCanonicalBase64URL(match[2], 32))
+        return exchangeFailure();
+    return { value, keyId: match[1] };
+}
+function accessTokenResponse(value, keyId, now) {
+    const response = exactRecord(value, [
+        'schema', 'access_token', 'token_type', 'expires_at_ms', 'relay_url', 'key',
+    ], []);
+    const key = exactRecord(response.key, ['id', 'label'], []);
+    const accessToken = boundedResponseString(response.access_token, 1, MAXIMUM_ACCESS_TOKEN_BYTES);
+    if (response.schema !== 'miakapp.access-token/1'
+        || response.token_type !== 'Bearer'
+        || accessToken.split('.').length !== 3
+        || !accessToken.split('.').every((segment) => BASE64URL.test(segment))
+        || key.id !== keyId)
+        return exchangeFailure();
+    boundedResponseString(key.label, 1, 64);
+    const expiresAtMs = response.expires_at_ms;
+    if (typeof expiresAtMs !== 'number'
+        || !Number.isSafeInteger(expiresAtMs)
+        || expiresAtMs <= now
+        || expiresAtMs > now + MAXIMUM_ACCESS_TOKEN_LIFETIME_MS)
+        return exchangeFailure();
+    return Object.freeze({
+        relayUrl: canonicalRelayUrl(response.relay_url),
+        token: accessToken,
+        expiresAtMs,
+    });
+}
+function validateTokenRequest(value) {
+    const request = exactRecord(value, ['coordinatorName', 'reason', 'signal'], ['relayHost']);
+    if (typeof request.coordinatorName !== 'string'
+        || !COORDINATOR_NAME.test(request.coordinatorName)
+        || (request.reason !== 'initial' && request.reason !== 'reauth' && request.reason !== 'reconnect')
+        || request.signal === null
+        || typeof request.signal !== 'object'
+        || !('aborted' in request.signal)
+        || !('addEventListener' in request.signal)
+        || (request.relayHost !== undefined
+            && (typeof request.relayHost !== 'string' || request.relayHost.length === 0 || request.relayHost.length > 255))) {
+        return exchangeFailure();
+    }
+}
+// createHomeKeyAccessTokenProvider maps the RFC 0004 Home Key exchange onto
+// MiakAPI's three-field access-token boundary. It performs exactly one request
+// per SDK demand and never exposes the Home Key to the WebSocket layer.
+export function createHomeKeyAccessTokenProvider(value) {
+    const options = exactRecord(value, ['exchangeEndpoint', 'homeKey'], ['fetch']);
+    const endpoint = canonicalExchangeEndpoint(options.exchangeEndpoint);
+    const homeKey = validHomeKey(options.homeKey);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    if (typeof fetcher !== 'function')
+        return exchangeFailure();
+    return Object.freeze({
+        async getAccessToken(request) {
+            validateTokenRequest(request);
+            let response;
+            try {
+                response = await fetcher(endpoint, {
+                    method: 'POST',
+                    headers: {
+                        accept: 'application/json',
+                        authorization: `Bearer ${homeKey.value}`,
+                        'content-type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        purpose: 'relay',
+                        role: 'coordinator',
+                        coordinator_name: request.coordinatorName,
+                        reason: request.reason,
+                    }),
+                    cache: 'no-store',
+                    credentials: 'omit',
+                    redirect: 'error',
+                    referrerPolicy: 'no-referrer',
+                    signal: request.signal,
+                });
+            }
+            catch {
+                if (request.signal.aborted)
+                    throw request.signal.reason;
+                return exchangeFailure();
+            }
+            try {
+                if (request.signal.aborted) {
+                    cancelResponseBody(response);
+                    throw request.signal.reason;
+                }
+                if (response.status !== 200) {
+                    cancelResponseBody(response);
+                    return exchangeFailure();
+                }
+                if (response.headers.get('cache-control') !== 'no-store'
+                    || response.headers.get('pragma') !== 'no-cache'
+                    || response.headers.get('referrer-policy') !== 'no-referrer'
+                    || response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json') {
+                    cancelResponseBody(response);
+                    return exchangeFailure();
+                }
+                const body = await boundedResponseBody(response, request.signal);
+                if (request.signal.aborted)
+                    throw request.signal.reason;
+                return accessTokenResponse(parseResponseJson(body), homeKey.keyId, Date.now());
+            }
+            catch {
+                if (request.signal.aborted)
+                    throw request.signal.reason;
+                return exchangeFailure();
+            }
+        },
+    });
+}
+//# sourceMappingURL=access-token-provider.js.map

package/dist/access-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-provider.js","sourceRoot":"","sources":["../src/access-token-provider.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,sCAAsC,CAAC;AAE9C,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,gCAAgC,GAAG,OAAO,CAAC;AACjD,MAAM,QAAQ,GAAG,gDAAgD,CAAC;AAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAQ7D,SAAS,eAAe;IACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,QAA2B,EAC3B,QAA2B;IAE3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,eAAe,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;WACjD,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,eAAe,EAAE,CAAC;IACrE,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC5E,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;WAC3B,MAAM,CAAC,QAAQ,KAAK,EAAE;WACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;WACtB,MAAM,CAAC,MAAM,KAAK,EAAE;WACpB,MAAM,CAAC,IAAI,KAAK,EAAE;WAClB,MAAM,CAAC,QAAQ,KAAK,4BAA4B;WAChD,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,eAAe,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,eAAe,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI;WACb,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;WACtB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;WACtB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;WACvC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAAE,OAAO,eAAe,EAAE,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAgB,EAAE,KAAa,EAAE,GAAW;IACvE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE;QAClC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK;KAC5E,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,wBAAwB;WAC3C,QAAQ,CAAC,UAAU,KAAK,QAAQ;WAChC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;WACnC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;WACnE,GAAG,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,eAAe,EAAE,CAAC;IAChD,qBAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC3C,IAAI,OAAO,WAAW,KAAK,QAAQ;WAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;WAClC,WAAW,IAAI,GAAG;WAClB,WAAW,GAAG,GAAG,GAAG,gCAAgC;QAAE,OAAO,eAAe,EAAE,CAAC;IACpF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,KAAK,EAAE,WAAW;QAClB,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,OAAO,GAAG,WAAW,CACzB,KAAK,EACL,CAAC,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACvC,CAAC,WAAW,CAAC,CACd,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;WAC1C,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;WAC/C,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;WAC/F,OAAO,CAAC,MAAM,KAAK,IAAI;WACvB,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;WAClC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;WAC9B,CAAC,CAAC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;WACvC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;eAC9B,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QACpH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,UAAU,gCAAgC,CAC9C,KAAwC;IAExC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,eAAe,EAAE,CAAC;IAE5D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,cAAc,CAAC,OAA2B;YAC9C,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;oBACjC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;wBACxC,cAAc,EAAE,kBAAkB;qBACnC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,aAAa;wBACnB,gBAAgB,EAAE,OAAO,CAAC,eAAe;wBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;oBACF,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,OAAO;oBACjB,cAAc,EAAE,aAAa;oBAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxD,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC3B,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBAC7B,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9B,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBAC7B,OAAO,eAAe,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU;uBACnD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,UAAU;uBAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,aAAa;uBACzD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;oBACzG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;oBAC7B,OAAO,eAAe,EAAE,CAAC;gBAC3B,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxD,OAAO,mBAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACxD,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}