neotoma 0.23.1 → 0.24.0

package/README.md

@@ -69,7 +69,7 @@ Neotoma exposes roughly 60 MCP tools and about 100 REST endpoints, all backed by
 
 **Manage the entity lifecycle.** Merge duplicates, split an entity by predicate, soft-delete and restore, list potential duplicates, and run GDPR-oriented deletion. Merge and split are transactional and audited.
 
-**Control multi-agent access.** Every write is attributed to an agent identity (verified key thumbprint, JWT subject, or client name). Agent grants express least-privilege capabilities (which operations on which entity types). Optional hardware-attested authentication (Apple Secure Enclave, TPM 2.0, WebAuthn/FIDO2, YubiKey, Windows TBS) raises an agent's trust tier. Guest access tokens grant scoped read-back without full credentials.
+**Control multi-agent access.** Every write is attributed to an agent identity (verified key thumbprint, JWT subject, or client name), and agent grants express least-privilege capabilities (which operations on which entity types). This is what makes attribution and provenance answerable rather than asserted — it is infrastructure behind the guarantees above, not a feature to evaluate on its own. The mechanics, including optional hardware-attested authentication and guest access tokens, are documented in the [AAuth reference](https://neotoma.io/aauth).
 
 **Federate, sync, and intake.** Register peer instances and sync entities between them with configurable scope and conflict resolution (last-write-wins, source priority, or manual). Subscribe to entity or event changes over webhooks (HMAC-signed) or Server-Sent Events. Accept guest entity submissions, mirror GitHub issues into conversation threads, and mirror your data to deterministic, git-trackable canonical Markdown.
 
@@ -195,7 +195,7 @@ The "stays local" and privacy claims above apply to the local single-user mode.
 
 Neotoma is primarily for developers building and operating AI agents who need a persistent, deterministic, auditable memory layer shared across tools. The product ships as an MCP server and REST API with drop-in hook packages (Claude Code, Cursor, Codex, OpenCode), a Claude Agent SDK adapter, and TypeScript and Python clients. Its core value (versioned observations, deterministic snapshots, field-level provenance, idempotency, corrections-win) is memory-engine infrastructure for agent loops, not an end-user app.
 
-Two further audiences follow from the same code: individuals running a personal cross-assistant memory (the built-in types are personal-information shaped, and the single-user SQLite plus Inspector path serves one person across assistants), and operators of a shared or hosted instance (OAuth, hardware-attested agent identity, per-agent grants, guest submission, peer federation, and Docker or Fly deploy targets).
+Two further audiences follow from the same code: individuals running a personal cross-assistant memory (the built-in types are personal-information shaped, and the single-user SQLite plus Inspector path serves one person across assistants), and operators of a shared or hosted instance (OAuth, peer federation, and Docker or Fly deploy targets). The agent-identity and grants machinery is infrastructure supporting attribution and provenance for every audience, not a reason a particular audience adopts Neotoma.
 
 It is not aimed at casual note-taking, PKM/Obsidian-style human-driven knowledge bases, or users who need a fully hosted product with nothing running on their own machine — Neotoma is local-first by design, and that part is not a temporary state. Installation is: today it is npm and the CLI, and a guided installation is intended but not yet available. If today's install path is what stands between you and trying it, that is our problem to fix, not a sign you are the wrong user.
 

package/dist/actions.d.ts

@@ -1,8 +1,10 @@
 import express from "express";
+import { type StoreRelationshipCreated, type StoreRelationshipRefused } from "./services/store_relationships.js";
 import { type GuestIdentity } from "./services/access_policy.js";
 import { type AgentIdentity } from "./crypto/agent_identity.js";
 import { type NeotomaSandboxModeName } from "./services/sandbox_mode.js";
 import { OAuthKeySessionStore } from "./services/oauth_key_gate.js";
+import type { BoundIdentity } from "./services/oauth_key_gate.js";
 import { type StoreInterpretationInput } from "./shared/action_schemas.js";
 /** Exposed for the /me route and any other surface that needs the boot-time mode verdict. */
 export declare function getResolvedServerMode(): NeotomaSandboxModeName | null;
@@ -58,9 +60,14 @@ export declare function isTrustedProxyIP(ip: string, env?: NodeJS.ProcessEnv): b
  * connects to Node over loopback even for public internet callers. In
  * production, loopback alone is therefore not enough to grant local-dev auth.
  *
+ * X-Forwarded-For can only disqualify a caller, never qualify one: a loopback
+ * socket with an all-loopback forwarded chain is treated like a loopback
+ * socket with no forwarded header, so in production it is not local.
+ *
  * NEOTOMA_TRUSTED_PROXY_IPS: comma-separated list of IPs or IPv4 CIDRs whose
  * XFF entries are trusted and do not disqualify a loopback-socket request from
- * being considered local. Use this for tunnel setups where cloudflared (or
+ * being considered local. In production, a forwarded chain whose nearest hop
+ * is one of these addresses is treated as local. Use this for tunnel setups where cloudflared (or
  * similar) injects a non-loopback XFF entry that represents a controlled
  * internal hop, not a public internet caller.
  *
@@ -77,6 +84,20 @@ export declare function isTrustedProxyIP(ip: string, env?: NodeJS.ProcessEnv): b
  * entirely and remains valid for single-host deployments without a tunnel.
  */
 export declare function isLocalRequest(req: express.Request): boolean;
+export declare function isDevelopmentConnectionId(value: unknown): boolean;
+/**
+ * Whether a client-sent development connection id may be honoured for this
+ * request. Mirrors the conditions under which the /mcp gate assigns one
+ * itself, so sending the header never grants more than omitting it:
+ *
+ *   - development mode: encryption disabled, and `isLocalRequest`'s own
+ *     environment rule (non-production `NEOTOMA_ENV`, or the explicit
+ *     `NEOTOMA_TRUST_PROD_LOOPBACK=1` opt-in);
+ *   - a local caller by `isLocalRequest`: loopback socket address, and every
+ *     X-Forwarded-For hop loopback or a configured trusted proxy. Forwarded
+ *     headers can only disqualify a caller, never qualify one.
+ */
+export declare function developmentConnectionIdAllowed(req: express.Request): boolean;
 /** Exported for tests asserting the cookie maxAge and the server-side session
  *  expiry agree — the invariant setOAuthKeySessionCookie's docstring names. */
 export declare const oauthKeySessions: OAuthKeySessionStore;
@@ -120,8 +141,22 @@ export declare function resolveSignInSessionTtlMs(raw: string | undefined): numb
  * sign-in (#2005).
  */
 export declare function setOAuthKeySessionCookie(req: express.Request, res: express.Response, ttlMs?: number): string;
-/** Resolve the local-auth user_id a Google-verified session (if any) mapped to this request. */
+/**
+ * Resolve the GRAPH SCOPE user_id a Google-verified session (if any) mapped to
+ * this request — the user_id whose graph is read and written. Under
+ * shared-graph mode this is the shared owner, not the signer; use
+ * {@link getGoogleVerifiedIdentity} to learn who signed in (#2228).
+ */
 export declare function getGoogleVerifiedUserId(req: express.Request): string | undefined;
+/**
+ * Resolve the full identity bound to a Google-verified session: the graph being
+ * operated on plus, when shared-graph mode remapped the scope, the verified
+ * email and per-email user_id of the person who signed in (#2228).
+ *
+ * Session validity is enforced by the store, so an expired session resolves to
+ * undefined rather than a stale identity.
+ */
+export declare function getGoogleVerifiedIdentity(req: express.Request): BoundIdentity | undefined;
 /**
  * Derive the canonical `@authority` the AAuth profile requires (AAuth §10.3.1).
  * We trust explicit configuration first, then fall back to the host the
@@ -280,6 +315,7 @@ export declare function storeStructuredForApi(params: {
         identity_basis: string;
         identity_rule: string;
     }[] | undefined;
+    relationships_refused?: StoreRelationshipRefused[] | undefined;
     entities_created: number;
     observations_created: number;
     entities: {
@@ -307,11 +343,7 @@ export declare function storeStructuredForApi(params: {
         }[] | undefined;
         entity_snapshot_after: Record<string, unknown> | null;
     }[];
-    relationships_created: {
-        relationship_type: string;
-        source_entity_id: string;
-        target_entity_id: string;
-    }[];
+    relationships_created: StoreRelationshipCreated[];
     interpretation_id?: string | undefined;
     interpretation_source_id?: string | undefined;
     success: boolean;
@@ -319,9 +351,90 @@ export declare function storeStructuredForApi(params: {
     commit: boolean;
     source_id: string | null;
 }>;
+/**
+ * Resolve the host the HTTP listener should bind to.
+ *
+ * Defaults to loopback-only (`127.0.0.1`) so a self-hosted instance is never
+ * reachable from the LAN unless the operator explicitly opts in. Set
+ * `NEOTOMA_HTTP_HOST` (e.g. `0.0.0.0` for a Fly/Docker deployment fronted by
+ * its own auth, or a tunnel client) to bind elsewhere. This is the single
+ * source of truth for the bind host — `tryListen` passes this value straight
+ * to `app.listen`, and the boot-time sandbox-mode resolver below derives its
+ * `loopbackBindOnly` signal from the same value, so the two can no longer
+ * diverge the way they did prior to #<security-fix> (posture reported
+ * loopback while the socket was actually open on all interfaces).
+ */
+export declare function resolveHttpBindHost(env?: NodeJS.ProcessEnv): string;
+/** True when the given bind host resolves to a loopback-only address. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Try to bind on a port/host; resolves with server and port, or rejects on
+ * error (e.g. EADDRINUSE).
+ *
+ * This is the actual sink that opens the listening socket, and it is an
+ * exported entry point in its own right (not merely an internal helper of
+ * `startHTTPServer` below) — so the loopback-only default must live HERE,
+ * not only in the sibling caller. Before this fix, `startHTTPServer` was the
+ * only thing applying `resolveHttpBindHost()`'s safe default; a caller that
+ * invoked `tryListen` directly with a missing/empty host (or `undefined`
+ * coming through a loosely-typed call site) fell straight through to
+ * `app.listen`, which binds all interfaces when `host` is falsy. That
+ * reopened the exact all-interfaces exposure the loopback default exists to
+ * close, just via a different entry point. See #<security-fix>.
+ */
+export declare function tryListen(port: number, host?: string | null): Promise<{
+    server: ReturnType<express.Express["listen"]>;
+    port: number;
+}>;
 export declare function startHTTPServer(): Promise<{
     server: import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;
     port: number;
 } | undefined>;
+/**
+ * Handle an unhandled promise rejection, narrowly for the abandoned-read abort
+ * that crash-looped hosted Neotoma on 2026-09-23 (#2483).
+ *
+ * `guardAbandonedRead` (worker_file_database.ts) attaches a no-op `.catch()`
+ * to every read on the reader pool so a caller who is still listening keeps
+ * getting the real rejection while an abandoned one cannot become unhandled.
+ * That guard is provably complete for every read reachable through
+ * `WorkerStatement` — the prior investigation on #2483 traced every read path
+ * to it and found no fire-and-forget read outside the pattern — but the
+ * production trace shows an unhandled `WorkerDbAbortError` reaching here
+ * anyway, so some path derives a promise the guard never sees (`dispatchRead`,
+ * added by #2338, is the leading suspect per that investigation).
+ *
+ * Because the leaking path is unknown, this contains the SYMPTOM rather than
+ * the cause: log everything needed to find it, and let the process live,
+ * WITHOUT widening the class of error this applies to. `instanceof` (not a
+ * message-substring match) keeps the scope to exactly the one error type this
+ * incident is about — any other unhandled rejection falls through to `handler`
+ * unchanged and exits exactly as it does today. This is deliberately NOT a
+ * general `unhandledRejection` policy: a corrupt migration or an OOM must
+ * still crash the process, as the guard's own doc comment says.
+ *
+ * Returns true when it handled (and thus suppressed) the rejection, so the
+ * caller can decide whether to fall through to prior behavior — kept as a
+ * plain function, rather than registering its own `process.on` listener, so
+ * it composes with whatever the process already does for every other
+ * rejection instead of racing a second competing handler.
+ */
+export declare function handleAbandonedAbortRejection(reason: unknown): boolean;
+/**
+ * Registers the process-wide containment for the #2483 abandoned-abort
+ * crash: the `unhandledRejection` listener that suppresses an unhandled
+ * `WorkerDbAbortError` (delegating to `handleAbandonedAbortRejection`) and
+ * exits exactly as before for anything else, plus the raised stack trace
+ * limit that makes the resulting diagnostic useful.
+ *
+ * Pulled into its own exported function, called from exactly one production
+ * call site below, so a regression test can prove that call site is load
+ * bearing: deleting it (while leaving this function's body untouched) must
+ * turn the regression suite red, because nothing would register the
+ * listener a real boot of this module performs. A test that instead called
+ * this function directly would keep passing even if the production call
+ * site were deleted, which is the exact gap #2483's QA review found.
+ */
+export declare function installAbandonedAbortContainment(): void;
 export {};
 //# sourceMappingURL=actions.d.ts.map

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA4C9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AAyCpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA2zB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AAGD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAurDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,aAAqD,CAAC;AAEhG,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CA0BjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AAiHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAycD;;;;;;;;;;;;;;;;GAgBG;AAIH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAqpFD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAy/BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA8e3B;AAklHD,wBAAsB,eAAe;;;eA+QpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA2C9B,OAAO,EAIL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC9B,MAAM,mCAAmC,CAAC;AAS3C,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAiBrC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AAoDpC,OAAO,EAUL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAWlE,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA+CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA2zB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAmC1F;AAoGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA6D5D;AAcD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAG5E;AAwBD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,aAAa,GAAG,SAAS,CAGzF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AA80DD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,aAAqD,CAAC;AAEhG,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CA0BjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AAiHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAkkBD;;;;;;;;;;;;;;;;GAgBG;AAIH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAsuFD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBA6jCgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;;mBA3SV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBA5ZX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BAgZb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;;;;;;;GAosBxD;AAg8HD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGhF;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAgD1E;AAGD,wBAAsB,eAAe;;;eA8YpC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAiBtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAqCvD"}