parasor 0.1.0

package/server/ws/terminal.d.ts

@@ -0,0 +1,69 @@
+import type { WSMessageReceive } from "hono/ws";
+import type { TerminalTraceRecorder } from "../debug/terminal-trace-recorder.js";
+import type { PtyHost } from "../pty/host.js";
+export interface TerminalWs {
+    readyState: number;
+    send: (data: string | ArrayBuffer | Uint8Array<ArrayBuffer>) => void;
+    close: (code?: number, reason?: string) => void;
+    /**
+     * The underlying `ws` WebSocket (`@hono/node-ws` `WSContext.raw`), exposing
+     * the per-socket send-buffer depth used for server-side backpressure. Optional
+     * so transports that do not surface it degrade to no backpressure.
+     */
+    raw?: {
+        bufferedAmount: number;
+    };
+}
+export interface TerminalRelayState {
+    initialized: boolean;
+    /** Set after a successful binary attach so input/resize/refresh
+     *  arriving as JSON envelopes can still be handled (back-compat). */
+    binaryAttached: boolean;
+    malformedFrameCount: number;
+    /**
+     * Last `console.warn` for a malformed frame, monotonic ms. Throttles
+     * R6 logging so a misbehaving client floods stderr at most once per
+     * `MALFORMED_WARN_RATE_LIMIT_MS` while still tripping the cumulative
+     * close at threshold (32).
+     */
+    lastMalformedWarnAt: number;
+    /**
+     * Attach fencing fence. Captured from the host's attach result and handed
+     * back on detachClient so a stale onClose firing after a fresh attach
+     * (same `clientId`) cannot wipe the new listener -- the host compares
+     * this against its current entry's stamp and skips the delete on
+     * mismatch.
+     */
+    attachToken?: number;
+    /**
+     * Two independent reasons the relay may want this client's PTY output paused:
+     * the client's own render-buffer backpressure (`flow-pause`/`flow-resume`) and
+     * the server's send-buffer backpressure. The host exposes a single
+     * `flowPaused` bit per client, so the relay ANDs the two here (see
+     * {@link syncPtyFlow}) -- the PTY resumes only when *neither* reason is active.
+     * Tracking them separately stops one loop's resume from clobbering the other's
+     * still-active pause.
+     */
+    clientPaused: boolean;
+    serverPaused: boolean;
+    /** Active drain poll while {@link serverPaused}; unref'd so it never holds the process. */
+    drainTimer?: ReturnType<typeof setInterval>;
+}
+export declare function setupTerminalRelay(ws: TerminalWs, sessionId: string, clientId: string, ptyManager: PtyHost, traceRecorder?: TerminalTraceRecorder): void;
+export declare function cleanupTerminalRelay(ws: object, sessionId: string, clientId: string, ptyManager: PtyHost, traceRecorder?: TerminalTraceRecorder): void;
+export declare function handleTerminalMessage(ws: TerminalWs, sessionId: string, clientId: string, ptyManager: PtyHost, event: MessageEvent<WSMessageReceive>, traceRecorder?: TerminalTraceRecorder): Promise<void>;
+/**
+ * Per-message relay context. Bundles the fixed identifiers and collaborators a
+ * handler needs so each handler stays within the params budget and reads as
+ * `(ctx, payload)`. Built once per inbound message in
+ * {@link handleTerminalMessageUnsafe}.
+ */
+export interface RelayContext {
+    ws: TerminalWs;
+    state: TerminalRelayState;
+    sessionId: string;
+    clientId: string;
+    ptyManager: PtyHost;
+    traceRecorder?: TerminalTraceRecorder;
+}
+//# sourceMappingURL=terminal.d.ts.map

package/server/ws/terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../src/ws/terminal.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAI9C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACrE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB;yEACqE;IACrE,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CAC7C;AA4CD,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,EACnB,aAAa,CAAC,EAAE,qBAAqB,GACpC,IAAI,CA2BN;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,EACnB,aAAa,CAAC,EAAE,qBAAqB,GACpC,IAAI,CA4BN;AAyCD,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,EACnB,KAAK,EAAE,YAAY,CAAC,gBAAgB,CAAC,EACrC,aAAa,CAAC,EAAE,qBAAqB,GACpC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,UAAU,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC"}

package/server/ws/terminal.js

@@ -0,0 +1,311 @@
+import { decodeBinaryFrame, MALFORMED_FRAME_CLOSE_THRESHOLD, } from "@parasor/shared";
+import { attachClient } from "./terminal-attach.js";
+import { syncPtyFlow } from "./terminal-flow.js";
+/** Minimum gap between malformed-frame warn emits (R6 rate-limit). */
+const MALFORMED_WARN_RATE_LIMIT_MS = 5_000;
+const wsState = new WeakMap();
+/*
+ * PTY generation gate: never trust a wire-supplied `generation: 0` once the server
+ * knows the session has a real generation. The in-process / daemon write
+ * gate treats 0 as a "no gating" sentinel for INTERNAL callers (pre-init
+ * queued input that runs before any spawn has set a generation). A
+ * malicious or buggy WS client could send `generation: 0` indefinitely
+ * to bypass the auto-resume input gate and contaminate the new shell
+ * with stale terminal-reply bytes. Translate wire 0 into the server's
+ * authoritative current generation so the gate stays effective; only
+ * fall back to `undefined` (the internal sentinel) when the session
+ * itself has never been observed at any non-zero generation.
+ *
+ * PTY generation gate: validate the wire value before trusting it. The
+ * binary frame parser writes the gen via `>>> 0` (uint32 truncation), so
+ * a JSON client that sends `generation: 4294967296` lands as 0 and would
+ * otherwise be coerced to the live gen -- silently bypassing the gate.
+ * Reject anything that is not a uint32-shaped safe integer; the caller
+ * treats the result as "drop frame" via `WIRE_GENERATION_REJECT`.
+ */
+const WIRE_GENERATION_REJECT = -1;
+function coerceWireGeneration(wire, ptyManager, sessionId) {
+    if (wire !== undefined) {
+        if (!Number.isSafeInteger(wire) || wire < 0 || wire > 0xff_ff_ff_ff) {
+            return WIRE_GENERATION_REJECT;
+        }
+        if (wire > 0)
+            return wire;
+    }
+    const known = ptyManager.get(sessionId)?.generation ?? 0;
+    return known > 0 ? known : undefined;
+}
+export function setupTerminalRelay(ws, sessionId, clientId, ptyManager, traceRecorder) {
+    const session = ptyManager.get(sessionId);
+    if (!session) {
+        traceRecorder?.record("ws-close", { code: 1008, reason: "Session not found", phase: "setup" }, { sessionId, clientId });
+        ws.close(1008, "Session not found");
+        return;
+    }
+    // Ended sessions are not rejected here -- initClient may auto-resume
+    // them (shell/claude + graceful end). If auto-resume declines, the
+    // init-frame handler below closes the socket with "Session unavailable".
+    wsState.set(ws, {
+        initialized: false,
+        binaryAttached: false,
+        malformedFrameCount: 0,
+        lastMalformedWarnAt: 0,
+        clientPaused: false,
+        serverPaused: false,
+    });
+    traceRecorder?.record("ws-setup", { state: session.state }, { sessionId, clientId });
+}
+export function cleanupTerminalRelay(ws, sessionId, clientId, ptyManager, traceRecorder) {
+    const state = wsState.get(ws);
+    if (state?.drainTimer) {
+        clearInterval(state.drainTimer);
+        state.drainTimer = undefined;
+    }
+    // Attach fencing: skip detach entirely when no attach has been minted for
+    // this WS -- calling detachClient(..., undefined) degrades to an
+    // unconditional delete on the host and would evict a sibling WS that
+    // has already taken over the same `clientId`.
+    if (state?.attachToken === undefined) {
+        traceRecorder?.record("ws-cleanup-skip", {
+            hasState: !!state,
+            initialized: !!state?.initialized,
+            binaryAttached: !!state?.binaryAttached,
+        }, { sessionId, clientId });
+        return;
+    }
+    ptyManager.detachClient(sessionId, clientId, state.attachToken);
+    traceRecorder?.record("ws-cleanup", { attachToken: state.attachToken }, { sessionId, clientId });
+}
+/**
+ * : malformed binary frames are dropped without
+ * disconnecting on the first occurrence. Each WS accumulates a counter;
+ * crossing `MALFORMED_FRAME_CLOSE_THRESHOLD` (32) closes the socket with
+ * 1008 policy violation. This shapes the attack surface from "single
+ * crafted frame crashes the server" into "abusive client gets cut off
+ * after 32 strikes".
+ *
+ * Logging policy (by design): emit at most one `console.warn` per
+ * `MALFORMED_WARN_RATE_LIMIT_MS` window per WS. Production-visible by
+ * default -- silent dropping was the original failure mode that hid
+ * malformed-frame attacks during the v1 review.
+ */
+function noteMalformedFrame(ws, state, reason, traceRecorder, ids = {}) {
+    state.malformedFrameCount += 1;
+    traceRecorder?.record("malformed-frame", { reason, count: state.malformedFrameCount }, ids);
+    const now = Date.now();
+    if (now - state.lastMalformedWarnAt >= MALFORMED_WARN_RATE_LIMIT_MS) {
+        state.lastMalformedWarnAt = now;
+        // eslint-disable-next-line no-console
+        console.warn(`[terminal] malformed binary frame (${state.malformedFrameCount}/${MALFORMED_FRAME_CLOSE_THRESHOLD}): ${reason}`);
+    }
+    if (state.malformedFrameCount >= MALFORMED_FRAME_CLOSE_THRESHOLD) {
+        ws.close(1008, "binary frame validation");
+    }
+}
+export async function handleTerminalMessage(ws, sessionId, clientId, ptyManager, event, traceRecorder) {
+    try {
+        await handleTerminalMessageUnsafe(ws, sessionId, clientId, ptyManager, event, traceRecorder);
+    }
+    catch (err) {
+        // A daemon-mode PTY host can disappear independently of the HTTP server.
+        // Treat that as a terminal socket failure, not a process-level crash.
+        // The browser will reconnect; the event socket remains available.
+        // eslint-disable-next-line no-console
+        console.warn(`[terminal] PTY host unavailable for session=${sessionId.slice(0, 8)}: ${err.message}`);
+        traceRecorder?.record("ws-close", {
+            code: 1012,
+            reason: "PTY host unavailable",
+            errorName: err instanceof Error ? err.name : "unknown",
+            errorMessage: err instanceof Error ? err.message : undefined,
+        }, { sessionId, clientId });
+        if (ws.readyState === 1)
+            ws.close(1012, "PTY host unavailable");
+    }
+}
+/**
+ * Thin dispatcher: classify the inbound frame (binary fast-path vs JSON
+ * envelope, pre-init vs post-init) and hand off to the matching handler. No
+ * relay logic lives here -- it only routes.
+ */
+async function handleTerminalMessageUnsafe(ws, sessionId, clientId, ptyManager, event, traceRecorder) {
+    const state = wsState.get(ws);
+    if (!state)
+        return;
+    const ctx = {
+        ws,
+        state,
+        sessionId,
+        clientId,
+        ptyManager,
+        traceRecorder,
+    };
+    traceRecorder?.recordLazy("ws-message", () => ({
+        wire: typeof event.data === "string" ? "json" : "binary",
+        byteLength: typeof event.data === "string"
+            ? Buffer.byteLength(event.data, "utf8")
+            : event.data instanceof Uint8Array
+                ? event.data.byteLength
+                : event.data.byteLength,
+        initialized: state.initialized,
+    }), { sessionId, clientId });
+    // Binary frame fast-path. Once the client has attached with binary
+    // capabilities, INPUT / RESIZE / REFRESH arrive as `[prefix][payload]`.
+    // (`init` itself stays JSON because capability negotiation is JSON.)
+    if (typeof event.data !== "string") {
+        handleBinaryFrame(ctx, event.data);
+        return;
+    }
+    let msg;
+    try {
+        msg = JSON.parse(event.data);
+    }
+    catch {
+        // Ignore malformed messages -- never write raw data to PTY.
+        return;
+    }
+    // The init frame MUST arrive first. It carries the viewport dims that
+    // the PTY is spawned with (or resized to, for a reconnect). Any other
+    // first frame closes the WS -- the client is buggy.
+    if (!state.initialized) {
+        await handleInitFrame(ctx, msg);
+        return;
+    }
+    handleJsonCommand(ctx, msg);
+}
+/**
+ * Binary fast-path dispatch: validate the framed `[prefix][payload]` and apply
+ * INPUT / RESIZE / REFRESH / flow-control. Premature or malformed frames are
+ * counted (and eventually close the socket) rather than throwing.
+ */
+function handleBinaryFrame(ctx, data) {
+    const { ws, state, sessionId, clientId, ptyManager, traceRecorder } = ctx;
+    if (!state.binaryAttached) {
+        // Stray binary frame before init/attach -- count as malformed but
+        // keep the WS open until the threshold trips.
+        noteMalformedFrame(ws, state, "binary before init", traceRecorder, {
+            sessionId,
+            clientId,
+        });
+        return;
+    }
+    const buf = data instanceof Uint8Array ? data : new Uint8Array(data);
+    const decoded = decodeBinaryFrame(buf);
+    if (!decoded.ok) {
+        noteMalformedFrame(ws, state, decoded.reason, traceRecorder, {
+            sessionId,
+            clientId,
+        });
+        return;
+    }
+    const frame = decoded.frame;
+    if (frame.kind === "input") {
+        const gen = coerceWireGeneration(frame.generation, ptyManager, sessionId);
+        if (gen === WIRE_GENERATION_REJECT) {
+            noteMalformedFrame(ws, state, "input gen out of range", traceRecorder, {
+                sessionId,
+                clientId,
+            });
+            return;
+        }
+        traceRecorder?.recordLazy("pty-write", () => ({
+            wire: "binary",
+            dataLength: frame.data.byteLength,
+            generation: gen,
+        }), { sessionId, clientId });
+        ptyManager.write(sessionId, Buffer.from(frame.data).toString("utf8"), gen);
+    }
+    else if (frame.kind === "resize") {
+        traceRecorder?.record("pty-resize", { cols: frame.cols, rows: frame.rows }, { sessionId, clientId });
+        ptyManager.resize(sessionId, frame.cols, frame.rows);
+    }
+    else if (frame.kind === "refresh") {
+        traceRecorder?.record("pty-refresh", {}, { sessionId, clientId });
+        ptyManager.refresh(sessionId);
+    }
+    else if (frame.kind === "flow-pause") {
+        traceRecorder?.record("pty-flow", { state: "pause" }, { sessionId, clientId });
+        state.clientPaused = true;
+        syncPtyFlow(state, sessionId, clientId, ptyManager);
+    }
+    else if (frame.kind === "flow-resume") {
+        traceRecorder?.record("pty-flow", { state: "resume" }, { sessionId, clientId });
+        state.clientPaused = false;
+        syncPtyFlow(state, sessionId, clientId, ptyManager);
+    }
+    else {
+        // server-only frame received from client -> malformed
+        noteMalformedFrame(ws, state, `client sent prefix 0x${buf[0]?.toString(16)}`, traceRecorder, { sessionId, clientId });
+    }
+}
+/**
+ * First-frame handler: enforce that `init` arrives first, then attach the
+ * client via the binary or legacy path depending on declared capabilities.
+ */
+async function handleInitFrame(ctx, msg) {
+    const { ws, state, sessionId, clientId, traceRecorder } = ctx;
+    if (msg.type !== "init") {
+        ws.close(1008, "init expected");
+        traceRecorder?.record("ws-close", { code: 1008, reason: "init expected" }, { sessionId, clientId });
+        return;
+    }
+    state.initialized = true;
+    traceRecorder?.record("ws-init", {
+        cols: msg.cols,
+        rows: msg.rows,
+        binary: !!msg.capabilities?.binary,
+        chunkedReplay: !!msg.capabilities?.chunkedReplay,
+        hasLastSeen: !!msg.capabilities?.lastSeen,
+    }, { sessionId, clientId });
+    await attachClient(ctx, msg);
+}
+/**
+ * Post-init JSON command dispatch: INPUT / RESIZE / REFRESH / flow-control for
+ * clients that did not negotiate the binary frame path.
+ */
+function handleJsonCommand(ctx, msg) {
+    const { ws, state, sessionId, clientId, ptyManager, traceRecorder } = ctx;
+    if (msg.type === "input") {
+        if (process.env.PARASOR_INPUT_DEBUG === "1") {
+            if (msg.data.length <= 10) {
+                // eslint-disable-next-line no-console
+                console.error(`[input] session=${sessionId.slice(0, 8)} client=${clientId.slice(0, 8)} bytes=${JSON.stringify(msg.data)}`);
+            }
+        }
+        const gen = coerceWireGeneration(msg.generation, ptyManager, sessionId);
+        if (gen === WIRE_GENERATION_REJECT) {
+            // Out-of-range JSON gen is a malformed-frame signal even though the
+            // envelope itself parsed; flag and drop instead of writing.
+            noteMalformedFrame(ws, state, "input gen out of range", traceRecorder, {
+                sessionId,
+                clientId,
+            });
+            return;
+        }
+        traceRecorder?.recordLazy("pty-write", () => ({
+            wire: "json",
+            dataLength: msg.data.length,
+            byteLength: Buffer.byteLength(msg.data, "utf8"),
+            generation: gen,
+        }), { sessionId, clientId });
+        ptyManager.write(sessionId, msg.data, gen);
+    }
+    else if (msg.type === "resize") {
+        traceRecorder?.record("pty-resize", { cols: msg.cols, rows: msg.rows }, { sessionId, clientId });
+        ptyManager.resize(sessionId, msg.cols, msg.rows);
+    }
+    else if (msg.type === "refresh") {
+        traceRecorder?.record("pty-refresh", {}, { sessionId, clientId });
+        ptyManager.refresh(sessionId);
+    }
+    else if (msg.type === "flow-pause") {
+        traceRecorder?.record("pty-flow", { state: "pause" }, { sessionId, clientId });
+        state.clientPaused = true;
+        syncPtyFlow(state, sessionId, clientId, ptyManager);
+    }
+    else if (msg.type === "flow-resume") {
+        traceRecorder?.record("pty-flow", { state: "resume" }, { sessionId, clientId });
+        state.clientPaused = false;
+        syncPtyFlow(state, sessionId, clientId, ptyManager);
+    }
+}
+//# sourceMappingURL=terminal.js.map

package/server/ws/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../src/ws/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,+BAA+B,GAEhC,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkDjD,sEAAsE;AACtE,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAA8B,CAAC;AAE1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAU,CAAC;AAG3C,SAAS,oBAAoB,CAC3B,IAAwB,EACxB,UAAmB,EACnB,SAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;YACpE,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;IACzD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,UAAmB,EACnB,aAAqC;IAErC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAC3D,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,qEAAqE;IACrE,mEAAmE;IACnE,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;QACd,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,YAAY,EAAE,KAAK;QACnB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxB,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,SAAiB,EACjB,QAAgB,EAChB,UAAmB,EACnB,aAAqC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;QACtB,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChC,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,0EAA0E;IAC1E,iEAAiE;IACjE,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,aAAa,EAAE,MAAM,CACnB,iBAAiB,EACjB;YACE,QAAQ,EAAE,CAAC,CAAC,KAAK;YACjB,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW;YACjC,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,cAAc;SACxC,EACD,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,OAAO;IACT,CAAC;IACD,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAChE,aAAa,EAAE,MAAM,CACnB,YAAY,EACZ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAClC,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CACzB,EAAc,EACd,KAAyB,EACzB,MAAc,EACd,aAAqC,EACrC,MAAiD,EAAE;IAEnD,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,MAAM,CACnB,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAC5C,GAAG,CACJ,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,KAAK,CAAC,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;QACpE,KAAK,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAChC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,sCAAsC,KAAK,CAAC,mBAAmB,IAAI,+BAA+B,MAAM,MAAM,EAAE,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,IAAI,+BAA+B,EAAE,CAAC;QACjE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,UAAmB,EACnB,KAAqC,EACrC,aAAqC;IAErC,IAAI,CAAC;QACH,MAAM,2BAA2B,CAC/B,EAAE,EACF,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,aAAa,CACd,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,+CAA+C,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAClG,CAAC;QACF,aAAa,EAAE,MAAM,CACnB,UAAU,EACV;YACE,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACtD,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC7D,EACD,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAiBD;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,EAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,UAAmB,EACnB,KAAqC,EACrC,aAAqC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,GAAG,GAAiB;QACxB,EAAE;QACF,KAAK;QACL,SAAS;QACT,QAAQ;QACR,UAAU;QACV,aAAa;KACd,CAAC;IAEF,aAAa,EAAE,UAAU,CACvB,YAAY,EACZ,GAAG,EAAE,CAAC,CAAC;QACL,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACxD,UAAU,EACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC5B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY,UAAU;gBAChC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU;gBACvB,CAAC,CAAE,KAAK,CAAC,IAAwB,CAAC,UAAU;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,EACF,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;IAEF,mEAAmE;IACnE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAiB,EACjB,IAAuC;IAEvC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,kEAAkE;QAClE,8CAA8C;QAC9C,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE;YACjE,SAAS;YACT,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GACP,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAuB,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE;YAC3D,SAAS;YACT,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE;gBACrE,SAAS;gBACT,QAAQ;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,aAAa,EAAE,UAAU,CACvB,WAAW,EACX,GAAG,EAAE,CAAC,CAAC;YACL,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,UAAU,EAAE,GAAG;SAChB,CAAC,EACF,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,aAAa,EAAE,MAAM,CACnB,YAAY,EACZ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EACtC,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvC,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QAC1B,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACxC,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,kBAAkB,CAChB,EAAE,EACF,KAAK,EACL,wBAAwB,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAC9C,aAAa,EACb,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAiB,EACjB,GAA4B;IAE5B,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAChC,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,EACvC,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,CACnB,SAAS,EACT;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM;QAClC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa;QAChD,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ;KAC1C,EACD,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;IAEF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACxB,GAAiB,EACjB,GAA4B;IAE5B,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CACX,mBAAmB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,oEAAoE;YACpE,4DAA4D;YAC5D,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE;gBACrE,SAAS;gBACT,QAAQ;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,aAAa,EAAE,UAAU,CACvB,WAAW,EACX,GAAG,EAAE,CAAC,CAAC;YACL,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;YAC/C,UAAU,EAAE,GAAG;SAChB,CAAC,EACF,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,CACnB,YAAY,EACZ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAClC,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrC,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QAC1B,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtC,aAAa,EAAE,MAAM,CACnB,UAAU,EACV,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,EAAE,SAAS,EAAE,QAAQ,EAAE,CACxB,CAAC;QACF,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}