openmeld 0.3.231 → 0.3.232

package/dist/entry-DIjUKIep.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"entry-DIjUKIep.js","names":[],"sources":["../src/local-service/execution-host/identity.ts","../src/local-service/execution-host/ownership.ts","../src/local-service/execution-host/entry.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceExecutionHostIdentity } from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n} from \"../../config/auth-session\";\nimport { resolveBaseUrl } from \"../../config/base-url\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldRootDir } from \"../../config/paths\";\nimport { readProcessStartIdentity } from \"../../system/process-identity\";\nimport { ExecutionHostError } from \"./channel\";\n\nexport async function validateExecutionHostIdentity(\n  identity: ServiceExecutionHostIdentity\n) {\n  if (\n    process.ppid !== identity.parentPid ||\n    (process.platform !== \"win32\" &&\n      readProcessStartIdentity(process.ppid) !==\n        identity.parentProcessStartedAt) ||\n    resolve(resolveOpenMeldRootDir()) !== resolve(identity.stateRoot)\n  ) {\n    throw new ExecutionHostError(\n      \"host.identity_mismatch\",\n      \"The Host's parent or installation changed.\"\n    );\n  }\n  const [auth, contract, gateway] = await Promise.all([\n    getAuthSessionState(),\n    readDaemonServiceContract(),\n    resolveBaseUrl(),\n  ]);\n  const session = auth.session;\n  if (\n    auth.state !== \"valid\" ||\n    !session ||\n    !contract ||\n    session.user?.id !== identity.ownerUserId ||\n    buildStoredAuthSessionIdentity(session) !== identity.sessionIdentity ||\n    session.authBaseUrl !== identity.authBaseUrl ||\n    gateway !== identity.gatewayBaseUrl ||\n    contract.gatewayUrl !== identity.gatewayBaseUrl ||\n    contract.ownerUserId !== identity.ownerUserId ||\n    contract.deviceId !== identity.deviceId ||\n    contract.lane !== identity.lane ||\n    contract.generation !== identity.serviceContractGeneration\n  ) {\n    throw new ExecutionHostError(\n      \"host.identity_mismatch\",\n      \"The Host's account, device or Service generation changed.\"\n    );\n  }\n  return { session, contract };\n}\n","import { execFile } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { serviceExecutionHostOwnerSchema } from \"@openmeld/schemas\";\nimport { z } from \"zod/v4\";\nimport { acquireLock, releaseLock } from \"../../config/lock\";\nimport { systemDir } from \"../../config/paths\";\nimport { ExecutionHostError } from \"./channel\";\n\nconst run = promisify(execFile);\nconst WINDOWS_BOOT_EVENT = /^\\d+:\\d+$/;\nconst DECIMAL = /^\\d+$/;\n\nexport async function readExecutionHostBootIdentity(): Promise<string | null> {\n  try {\n    return await readBootIdentity();\n  } catch {\n    // Fresh/quiescent starts do not require reboot evidence. Unknown evidence\n    // can never clear an unsafe previous owner, and is not another boot.\n    console.warn(\n      \"[openmeld.execution_host.boot_unknown] Automatic recovery of unconfirmed work requires operating-system restart evidence.\"\n    );\n    return null;\n  }\n}\n\nasync function readBootIdentity(): Promise<string | null> {\n  if (process.platform === \"linux\") {\n    const id = z\n      .uuid()\n      .parse(\n        (await readFile(\"/proc/sys/kernel/random/boot_id\", \"utf8\")).trim()\n      );\n    return `linux:${id.toLowerCase()}`;\n  }\n  let stdout = \"\";\n  if (process.platform === \"darwin\") {\n    // XNU's immutable boot-session UUID, not its clock-adjustable boot time.\n    ({ stdout } = await run(\n      \"/usr/sbin/sysctl\",\n      [\"-n\", \"kern.bootsessionuuid\"],\n      {\n        timeout: 5000,\n      }\n    ));\n    return `darwin:${z.uuid().parse(stdout.trim()).toLowerCase()}`;\n  }\n  if (process.platform === \"win32\") {\n    ({ stdout } = await run(\n      \"powershell.exe\",\n      [\n        \"-NoProfile\",\n        \"-NonInteractive\",\n        \"-Command\",\n        \"$ErrorActionPreference='Stop'; $e=Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='Microsoft-Windows-Kernel-General';Id=12} -MaxEvents 1; if($null -eq $e.RecordId -or $null -eq $e.TimeCreated){throw 'Boot event unavailable'}; [Console]::WriteLine(([string]$e.RecordId)+':'+([string]$e.TimeCreated.ToUniversalTime().Ticks))\",\n      ],\n      { timeout: 5000, windowsHide: true }\n    ));\n    if (!WINDOWS_BOOT_EVENT.test(stdout.trim())) {\n      throw new Error(\"Invalid Windows boot event\");\n    }\n    return `win32:${stdout.trim()}`;\n  }\n  return null;\n}\n\nfunction confirmsNewBoot(\n  previous: string | null,\n  current: string | null\n): boolean {\n  if (!(previous && current) || previous === current) {\n    return false;\n  }\n  const [priorSource, priorId, priorTime] = previous.split(\":\");\n  const [source, id, time] = current.split(\":\");\n  if (source !== priorSource) {\n    return false;\n  }\n  if (source === \"linux\" || source === \"darwin\") {\n    return (\n      z.uuid().safeParse(id).success && z.uuid().safeParse(priorId).success\n    );\n  }\n  // Kernel-General 12 records OS startup, not EventLog-service restarts or\n  // wall-clock corrections. Require a later retained event in both fields;\n  // missing/cleared/rotated evidence cannot authorize replacing unknown work.\n  if (\n    source !== \"win32\" ||\n    !id ||\n    !time ||\n    !priorId ||\n    !priorTime ||\n    ![id, time, priorId, priorTime].every((value) => DECIMAL.test(value))\n  ) {\n    return false;\n  }\n  return BigInt(id) > BigInt(priorId) && BigInt(time) > BigInt(priorTime);\n}\n\nexport async function acquireExecutionHostOwnership(input: {\n  hostInstanceId: string;\n  ownerUserId: string;\n  deviceId: string;\n  lane: \"prod\" | \"dev-local\" | \"canary\";\n  stateRoot: string;\n  bootIdentity: string | null;\n}) {\n  const lock = await acquireLock({\n    openMeldProfileId: \"service-execution-host\",\n    key: \"process-owner\",\n    pathResolution: { env: { ...process.env, OPENMELD_HOME: input.stateRoot } },\n    meta: {\n      hostInstanceId: input.hostInstanceId,\n      ownerUserId: input.ownerUserId,\n    },\n  });\n  const path = join(\n    systemDir({ env: { OPENMELD_HOME: input.stateRoot } }),\n    \"execution-host-owner.json\"\n  );\n  try {\n    const previous = readOwner(path);\n    if (\n      previous &&\n      !previous.localQuiescent &&\n      !confirmsNewBoot(previous.bootIdentity, input.bootIdentity)\n    ) {\n      throw new ExecutionHostError(\n        \"host.previous_work_unconfirmed\",\n        \"The previous execution host ended before its local work was confirmed stopped. Restart this Computer, then check its connection. If restart evidence is unavailable, inspect the retained Host diagnostics before recovery. Existing results remain saved; no task will be restarted automatically.\"\n      );\n    }\n    let owner = serviceExecutionHostOwnerSchema.parse({\n      schema: \"service-execution-host-owner-v1\",\n      hostInstanceId: input.hostInstanceId,\n      ownerUserId: input.ownerUserId,\n      deviceId: input.deviceId,\n      lane: input.lane,\n      pid: process.pid,\n      bootIdentity: input.bootIdentity,\n      localQuiescent: true,\n    });\n    persist(owner);\n    function persist(next: typeof owner) {\n      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n      const temporary = `${path}.${randomUUID()}.tmp`;\n      writeFileSync(temporary, JSON.stringify(next), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(temporary, path);\n    }\n    return {\n      observeLocalQuiescence(quiescent: boolean) {\n        if (owner.localQuiescent === quiescent) {\n          return;\n        }\n        const next = { ...owner, localQuiescent: quiescent };\n        // The unsafe transition is durable before any provider operation. A\n        // failed write refuses that operation rather than weakening the fence.\n        persist(next);\n        owner = next;\n      },\n      release: () => releaseLock(lock),\n    };\n  } catch (error) {\n    await releaseLock(lock);\n    throw error;\n  }\n}\n\nfunction readOwner(path: string) {\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return null;\n    }\n    throw error;\n  }\n  const parsed = serviceExecutionHostOwnerSchema.safeParse(JSON.parse(raw));\n  if (!parsed.success) {\n    throw new ExecutionHostError(\n      \"host.owner_corrupt\",\n      \"The Host ownership record cannot be verified. Preserve it for diagnostics; automatic replacement is refused.\"\n    );\n  }\n  return parsed.data;\n}\n","import {\n  type ServiceExecutionHostIdentity,\n  serviceExecutionHostMethods,\n} from \"@openmeld/schemas\";\nimport {\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { resolveRuntimeContext } from \"../../runtime/context\";\nimport { createPresenter } from \"../../runtime/presenter/index\";\nimport { ensureDaemonRuntimePaths } from \"../state/daemon-device-id\";\nimport {\n  ExecutionHostError,\n  type ExecutionHostHandlers,\n  serveExecutionHost,\n} from \"./channel\";\nimport { validateExecutionHostIdentity } from \"./identity\";\nimport {\n  acquireExecutionHostOwnership,\n  readExecutionHostBootIdentity,\n} from \"./ownership\";\nimport { parentExecutionHostChannel } from \"./process-channel\";\n\n// This entry has no public listener and accepts no executable/path override.\n// The inherited pipe, parent incarnation and current Service account are all\n// required before the provider graph or any local runtime state is opened.\nexport function runExecutionHost(hostInstanceId: string): Promise<void> {\n  const channel = parentExecutionHostChannel();\n  const done = Promise.withResolvers<void>();\n  let runtime: Awaited<\n    ReturnType<typeof import(\"./runtime\").createExecutionHostRuntime>\n  > | null = null;\n  let ownership: Awaited<\n    ReturnType<typeof acquireExecutionHostOwnership>\n  > | null = null;\n  let session: StoredAuthSession | null = null;\n  let acceptedIdentity: ServiceExecutionHostIdentity | null = null;\n  let initializing: Promise<void> | null = null;\n  let closing: Promise<void> | null = null;\n  let disconnected = false;\n\n  const close = (): Promise<void> => {\n    if (!closing) {\n      closing = (async () => {\n        try {\n          await initializing;\n          if (runtime && session) {\n            const currentRuntime = runtime;\n            await withAdmittedServiceSession(session, () =>\n              currentRuntime.closeAfterConnectorLoss()\n            );\n          }\n        } finally {\n          await ownership?.release();\n          server.dispose();\n          if (process.connected) {\n            process.disconnect();\n          }\n        }\n      })();\n      closing.then(\n        () => done.resolve(),\n        (error) => done.reject(error)\n      );\n    }\n    return closing;\n  };\n\n  const handlers = {\n    initialize: async (identity: ServiceExecutionHostIdentity) => {\n      if (\n        acceptedIdentity &&\n        JSON.stringify(acceptedIdentity) !== JSON.stringify(identity)\n      ) {\n        throw new ExecutionHostError(\n          \"host.identity_mismatch\",\n          \"This Host is already assigned to a different Service incarnation.\"\n        );\n      }\n      if (!initializing) {\n        acceptedIdentity = identity;\n        initializing = (async () => {\n          const verified = await validateExecutionHostIdentity(identity);\n          if (disconnected) {\n            throw new ExecutionHostError(\n              \"host.disconnected\",\n              \"The supervising Service left before Host initialization.\"\n            );\n          }\n          const verifiedOwnership = await acquireExecutionHostOwnership({\n            ...identity,\n            hostInstanceId,\n            bootIdentity: await readExecutionHostBootIdentity(),\n          });\n          ownership = verifiedOwnership;\n          session = verified.session;\n          await withAdmittedServiceSession(session, async () => {\n            const { createExecutionHostRuntime, createExecutionHostResources } =\n              await import(\"./runtime\");\n            const runtimePaths = await ensureDaemonRuntimePaths();\n            const presenter = createPresenter(\n              await resolveRuntimeContext({ view: \"agent\" })\n            );\n            runtime = await createExecutionHostRuntime({\n              resources: await createExecutionHostResources({\n                runtimePaths,\n                presenter,\n              }),\n              hostInstanceId,\n              identity,\n              runtimePaths,\n              serviceBundleId: verified.contract.bundleId,\n              profileOwnerName: verified.session.user?.name ?? null,\n              presenter,\n              emit: (event) => {\n                if (!disconnected) {\n                  server.emit(event);\n                }\n              },\n              onWorkStateChange: (quiescent) =>\n                verifiedOwnership.observeLocalQuiescence(quiescent),\n            });\n          });\n        })();\n      }\n      await initializing;\n      if (!runtime || disconnected) {\n        throw new ExecutionHostError(\n          \"host.disconnected\",\n          \"The execution Host is not available.\"\n        );\n      }\n      return runtime.snapshot();\n    },\n  } as ExecutionHostHandlers;\n\n  // Each concrete method is still decoded by the shared method table at both\n  // ends; the forwarding bridge cannot select a new account or mutate identity.\n  for (const method of Object.keys(serviceExecutionHostMethods) as Array<\n    keyof ExecutionHostHandlers\n  >) {\n    if (method === \"initialize\") {\n      continue;\n    }\n    const target = handlers as unknown as Record<\n      string,\n      (payload: unknown) => Promise<unknown>\n    >;\n    target[method] = async (payload) => {\n      if (!(runtime && session) || disconnected) {\n        throw new ExecutionHostError(\n          \"host.not_initialized\",\n          \"Initialize this Host through its supervising Service first.\"\n        );\n      }\n      const invoke = runtime.handlers[method] as (value: unknown) => unknown;\n      return await withAdmittedServiceSession(\n        session,\n        async () => await invoke(payload)\n      );\n    };\n  }\n\n  const server = serveExecutionHost({\n    channel,\n    hostInstanceId,\n    handlers,\n    onFailure: (error) => {\n      console.error(\"[openmeld.execution_host.channel_failed]\", error);\n      disconnected = true;\n      close().catch(() => undefined);\n    },\n    onDisconnect: () => {\n      disconnected = true;\n      close().catch(() => undefined);\n    },\n  });\n  return done.promise;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYA,eAAsB,8BACpB,UACA;CACA,IACE,QAAQ,SAAS,SAAS,aACzB,QAAQ,aAAa,WACpB,yBAAyB,QAAQ,IAAI,MACnC,SAAS,0BACb,QAAQ,uBAAuB,CAAC,MAAM,QAAQ,SAAS,SAAS,GAEhE,MAAM,IAAI,mBACR,0BACA,4CACF;CAEF,MAAM,CAAC,MAAM,UAAU,WAAW,MAAM,QAAQ,IAAI;EAClD,oBAAoB;EACpB,0BAA0B;EAC1B,eAAe;CACjB,CAAC;CACD,MAAM,UAAU,KAAK;CACrB,IACE,KAAK,UAAU,WACf,CAAC,WACD,CAAC,YACD,QAAQ,MAAM,OAAO,SAAS,eAC9B,+BAA+B,OAAO,MAAM,SAAS,mBACrD,QAAQ,gBAAgB,SAAS,eACjC,YAAY,SAAS,kBACrB,SAAS,eAAe,SAAS,kBACjC,SAAS,gBAAgB,SAAS,eAClC,SAAS,aAAa,SAAS,YAC/B,SAAS,SAAS,SAAS,QAC3B,SAAS,eAAe,SAAS,2BAEjC,MAAM,IAAI,mBACR,0BACA,2DACF;CAEF,OAAO;EAAE;EAAS;CAAS;AAC7B;;;ACzCA,MAAM,MAAM,UAAU,QAAQ;AAC9B,MAAM,qBAAqB;AAC3B,MAAM,UAAU;AAEhB,eAAsB,gCAAwD;CAC5E,IAAI;EACF,OAAO,MAAM,iBAAiB;CAChC,QAAQ;EAGN,QAAQ,KACN,2HACF;EACA,OAAO;CACT;AACF;AAEA,eAAe,mBAA2C;CACxD,IAAI,QAAQ,aAAa,SAMvB,OAAO,SALI,EACR,KAAK,CAAC,CACN,OACE,MAAM,SAAS,mCAAmC,MAAM,EAAA,CAAG,KAAK,CAEpD,CAAC,CAAC,YAAY;CAEjC,IAAI,SAAS;CACb,IAAI,QAAQ,aAAa,UAAU;EAEjC,CAAC,CAAE,UAAW,MAAM,IAClB,oBACA,CAAC,MAAM,sBAAsB,GAC7B,EACE,SAAS,IACX,CACF;EACA,OAAO,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY;CAC7D;CACA,IAAI,QAAQ,aAAa,SAAS;EAChC,CAAC,CAAE,UAAW,MAAM,IAClB,kBACA;GACE;GACA;GACA;GACA;EACF,GACA;GAAE,SAAS;GAAM,aAAa;EAAK,CACrC;EACA,IAAI,CAAC,mBAAmB,KAAK,OAAO,KAAK,CAAC,GACxC,MAAM,IAAI,MAAM,4BAA4B;EAE9C,OAAO,SAAS,OAAO,KAAK;CAC9B;CACA,OAAO;AACT;AAEA,SAAS,gBACP,UACA,SACS;CACT,IAAI,EAAE,YAAY,YAAY,aAAa,SACzC,OAAO;CAET,MAAM,CAAC,aAAa,SAAS,aAAa,SAAS,MAAM,GAAG;CAC5D,MAAM,CAAC,QAAQ,IAAI,QAAQ,QAAQ,MAAM,GAAG;CAC5C,IAAI,WAAW,aACb,OAAO;CAET,IAAI,WAAW,WAAW,WAAW,UACnC,OACE,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC;CAMlE,IACE,WAAW,WACX,CAAC,MACD,CAAC,QACD,CAAC,WACD,CAAC,aACD,CAAC;EAAC;EAAI;EAAM;EAAS;CAAS,CAAC,CAAC,OAAO,UAAU,QAAQ,KAAK,KAAK,CAAC,GAEpE,OAAO;CAET,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,KAAK,OAAO,IAAI,IAAI,OAAO,SAAS;AACxE;AAEA,eAAsB,8BAA8B,OAOjD;CACD,MAAM,OAAO,MAAM,YAAY;EAC7B,mBAAmB;EACnB,KAAK;EACL,gBAAgB,EAAE,KAAK;GAAE,GAAG,QAAQ;GAAK,eAAe,MAAM;EAAU,EAAE;EAC1E,MAAM;GACJ,gBAAgB,MAAM;GACtB,aAAa,MAAM;EACrB;CACF,CAAC;CACD,MAAM,OAAO,KACX,UAAU,EAAE,KAAK,EAAE,eAAe,MAAM,UAAU,EAAE,CAAC,GACrD,2BACF;CACA,IAAI;EACF,MAAM,WAAW,UAAU,IAAI;EAC/B,IACE,YACA,CAAC,SAAS,kBACV,CAAC,gBAAgB,SAAS,cAAc,MAAM,YAAY,GAE1D,MAAM,IAAI,mBACR,kCACA,qSACF;EAEF,IAAI,QAAQ,gCAAgC,MAAM;GAChD,QAAQ;GACR,gBAAgB,MAAM;GACtB,aAAa,MAAM;GACnB,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,KAAK,QAAQ;GACb,cAAc,MAAM;GACpB,gBAAgB;EAClB,CAAC;EACD,QAAQ,KAAK;EACb,SAAS,QAAQ,MAAoB;GACnC,UAAU,QAAQ,IAAI,GAAG;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GACzD,MAAM,YAAY,GAAG,KAAK,GAAG,WAAW,EAAE;GAC1C,cAAc,WAAW,KAAK,UAAU,IAAI,GAAG;IAC7C,MAAM;IACN,MAAM;GACR,CAAC;GACD,WAAW,WAAW,IAAI;EAC5B;EACA,OAAO;GACL,uBAAuB,WAAoB;IACzC,IAAI,MAAM,mBAAmB,WAC3B;IAEF,MAAM,OAAO;KAAE,GAAG;KAAO,gBAAgB;IAAU;IAGnD,QAAQ,IAAI;IACZ,QAAQ;GACV;GACA,eAAe,YAAY,IAAI;EACjC;CACF,SAAS,OAAO;EACd,MAAM,YAAY,IAAI;EACtB,MAAM;CACR;AACF;AAEA,SAAS,UAAU,MAAc;CAC/B,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,MAAM,MAAM;CACjC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAC5C,OAAO;EAET,MAAM;CACR;CACA,MAAM,SAAS,gCAAgC,UAAU,KAAK,MAAM,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,mBACR,sBACA,8GACF;CAEF,OAAO,OAAO;AAChB;;;ACtKA,SAAgB,iBAAiB,gBAAuC;CACtE,MAAM,UAAU,2BAA2B;CAC3C,MAAM,OAAO,QAAQ,cAAoB;CACzC,IAAI,UAEO;CACX,IAAI,YAEO;CACX,IAAI,UAAoC;CACxC,IAAI,mBAAwD;CAC5D,IAAI,eAAqC;CACzC,IAAI,UAAgC;CACpC,IAAI,eAAe;CAEnB,MAAM,cAA6B;EACjC,IAAI,CAAC,SAAS;GACZ,WAAW,YAAY;IACrB,IAAI;KACF,MAAM;KACN,IAAI,WAAW,SAAS;MACtB,MAAM,iBAAiB;MACvB,MAAM,2BAA2B,eAC/B,eAAe,wBAAwB,CACzC;KACF;IACF,UAAU;KACR,MAAM,WAAW,QAAQ;KACzB,OAAO,QAAQ;KACf,IAAI,QAAQ,WACV,QAAQ,WAAW;IAEvB;GACF,EAAA,CAAG;GACH,QAAQ,WACA,KAAK,QAAQ,IAClB,UAAU,KAAK,OAAO,KAAK,CAC9B;EACF;EACA,OAAO;CACT;CAEA,MAAM,WAAW,EACf,YAAY,OAAO,aAA2C;EAC5D,IACE,oBACA,KAAK,UAAU,gBAAgB,MAAM,KAAK,UAAU,QAAQ,GAE5D,MAAM,IAAI,mBACR,0BACA,mEACF;EAEF,IAAI,CAAC,cAAc;GACjB,mBAAmB;GACnB,gBAAgB,YAAY;IAC1B,MAAM,WAAW,MAAM,8BAA8B,QAAQ;IAC7D,IAAI,cACF,MAAM,IAAI,mBACR,qBACA,0DACF;IAEF,MAAM,oBAAoB,MAAM,8BAA8B;KAC5D,GAAG;KACH;KACA,cAAc,MAAM,8BAA8B;IACpD,CAAC;IACD,YAAY;IACZ,UAAU,SAAS;IACnB,MAAM,2BAA2B,SAAS,YAAY;KACpD,MAAM,EAAE,4BAA4B,iCAClC,MAAM,OAAO;KACf,MAAM,eAAe,MAAM,yBAAyB;KACpD,MAAM,YAAY,gBAChB,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC,CAC/C;KACA,UAAU,MAAM,2BAA2B;MACzC,WAAW,MAAM,6BAA6B;OAC5C;OACA;MACF,CAAC;MACD;MACA;MACA;MACA,iBAAiB,SAAS,SAAS;MACnC,kBAAkB,SAAS,QAAQ,MAAM,QAAQ;MACjD;MACA,OAAO,UAAU;OACf,IAAI,CAAC,cACH,OAAO,KAAK,KAAK;MAErB;MACA,oBAAoB,cAClB,kBAAkB,uBAAuB,SAAS;KACtD,CAAC;IACH,CAAC;GACH,EAAA,CAAG;EACL;EACA,MAAM;EACN,IAAI,CAAC,WAAW,cACd,MAAM,IAAI,mBACR,qBACA,sCACF;EAEF,OAAO,QAAQ,SAAS;CAC1B,EACF;CAIA,KAAK,MAAM,UAAU,OAAO,KAAK,2BAA2B,GAEzD;EACD,IAAI,WAAW,cACb;EAEF,MAAM,SAAS;EAIf,OAAO,UAAU,OAAO,YAAY;GAClC,IAAI,EAAE,WAAW,YAAY,cAC3B,MAAM,IAAI,mBACR,wBACA,6DACF;GAEF,MAAM,SAAS,QAAQ,SAAS;GAChC,OAAO,MAAM,2BACX,SACA,YAAY,MAAM,OAAO,OAAO,CAClC;EACF;CACF;CAEA,MAAM,SAAS,mBAAmB;EAChC;EACA;EACA;EACA,YAAY,UAAU;GACpB,QAAQ,MAAM,4CAA4C,KAAK;GAC/D,eAAe;GACf,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC/B;EACA,oBAAoB;GAClB,eAAe;GACf,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC/B;CACF,CAAC;CACD,OAAO,KAAK;AACd"}