pi-harness-runtime 1.1.395 → 1.1.397

package/packages/logging/dist/sensitive-keys.js

@@ -0,0 +1,39 @@
+/**
+ * Keys that never leave the machine.
+ *
+ * A key name is a strong hint about its content: "prompt", "output" or
+ * "transcript" carry private text, "path" and "url" carry the shape of the
+ * user's workspace. The list is shared by the client side classifier and the
+ * server side sanitizer, so both sides agree on what is private.
+ */
+export const LOCAL_ONLY_FIELD_KEYS = [
+    "prompt",
+    "response",
+    "message",
+    "content",
+    "transcript",
+    "output",
+    "stdout",
+    "stderr",
+    "command",
+    "text",
+    "body",
+    "payload",
+    "code",
+    "diff",
+    "file",
+    "path",
+    "url",
+    "uri",
+    "email",
+    "user",
+    "chat",
+    "question",
+    "answer",
+];
+/** True when the key is one that must not be shipped. */
+export function isLocalOnlyFieldKey(key) {
+    const lower = key.toLowerCase();
+    return LOCAL_ONLY_FIELD_KEYS.some((needle) => lower.includes(needle));
+}
+//# sourceMappingURL=sensitive-keys.js.map

package/packages/logging/dist/sensitive-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.js","sourceRoot":"","sources":["../src/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,UAAU;IACV,SAAS;IACT,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;CACR,CAAC;AAEF,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/packages/logging/dist/server/credentials.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Scoped ingest credentials.
+ *
+ * The tenant is derived from the credential, never from the request body:
+ * a client cannot claim a tenant it does not own.
+ *
+ * Two credential shapes are supported:
+ *
+ *   1. A credential store (`log-ingest-credentials.json`) with one entry per
+ *      installation. Tokens are stored as SHA-256 hashes, so the file is safe
+ *      to keep in the key directory and a token can be revoked by removing
+ *      or revoking its entry.
+ *   2. A single shared token (`LOG_INGEST_TOKEN` or the
+ *      `log-ingest-token.txt` key file) for a single-tenant deployment. It
+ *      maps to the tenant `LOG_INGEST_TENANT` (default `default`).
+ *
+ * When neither is configured the store is NOT configured: the ingest
+ * endpoint then refuses every write (fail closed) instead of accepting
+ * anonymous batches.
+ */
+export interface LogCredential {
+    /** Stable id of the credential (safe to log). */
+    id: string;
+    /** The tenant this credential may write for. */
+    tenantId: string;
+    /** Human readable label, e.g. "laptop". */
+    label?: string;
+    /** Allowed scopes, e.g. ["logs:write", "logs:read"]. */
+    scopes: string[];
+    /** SHA-256 hash of the token, prefixed with the algorithm. */
+    tokenHash: string;
+    createdAt: string;
+    /** Set when the credential was revoked. */
+    revokedAt?: string | null;
+}
+export interface CredentialFile {
+    credentials: LogCredential[];
+}
+export interface AuthenticatedCredential {
+    credentialId: string;
+    tenantId: string;
+    scopes: string[];
+    /** True when the credential came from the shared token. */
+    shared: boolean;
+}
+export interface LogCredentialStoreOptions {
+    /** Path of the credential store file. */
+    path?: string;
+    /** Environment used for the shared token. */
+    env?: Record<string, string | undefined>;
+    /** Directory holding the key files. */
+    keysDir?: string;
+}
+export declare const DEFAULT_TENANT_ID = "default";
+export declare const LOG_WRITE_SCOPE = "logs:write";
+export declare const LOG_READ_SCOPE = "logs:read";
+/** Hash a token the way the store does. */
+export declare function hashToken(token: string): string;
+export declare class LogCredentialStore {
+    private readonly credentials;
+    private readonly shared;
+    private constructor();
+    /**
+     * Load the store from the credential file and the shared token.
+     *
+     * A malformed credential file is ignored (and reported through
+     * `loadErrors`), never fatal: the endpoint then fails closed.
+     */
+    static load(options?: LogCredentialStoreOptions): LogCredentialStore;
+    /** True when at least one usable credential exists. */
+    get configured(): boolean;
+    /** The credentials without their token hashes. */
+    list(): Omit<LogCredential, "tokenHash">[];
+    /**
+     * Authenticate a presented token.
+     *
+     * Returns null when the token is missing, unknown or revoked.
+     */
+    authenticate(token: string | undefined): AuthenticatedCredential | null;
+}
+/**
+ * Extract the bearer token from an Authorization header.
+ */
+export declare function readBearerToken(header: string | undefined): string | undefined;
+//# sourceMappingURL=credentials.d.ts.map

package/packages/logging/dist/server/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/server/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,MAAM,WAAW,aAAa;IAC7B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACzC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAmBD,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;IAEzE,OAAO,eAGN;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAsCvE;IAED,uDAAuD;IACvD,IAAI,UAAU,IAAI,OAAO,CAKxB;IAED,kDAAkD;IAClD,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAEzC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,uBAAuB,GAAG,IAAI,CAyBtE;CACD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI9E"}

package/packages/logging/dist/server/credentials.js

@@ -0,0 +1,147 @@
+/**
+ * Scoped ingest credentials.
+ *
+ * The tenant is derived from the credential, never from the request body:
+ * a client cannot claim a tenant it does not own.
+ *
+ * Two credential shapes are supported:
+ *
+ *   1. A credential store (`log-ingest-credentials.json`) with one entry per
+ *      installation. Tokens are stored as SHA-256 hashes, so the file is safe
+ *      to keep in the key directory and a token can be revoked by removing
+ *      or revoking its entry.
+ *   2. A single shared token (`LOG_INGEST_TOKEN` or the
+ *      `log-ingest-token.txt` key file) for a single-tenant deployment. It
+ *      maps to the tenant `LOG_INGEST_TENANT` (default `default`).
+ *
+ * When neither is configured the store is NOT configured: the ingest
+ * endpoint then refuses every write (fail closed) instead of accepting
+ * anonymous batches.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULT_TENANT_ID = "default";
+export const LOG_WRITE_SCOPE = "logs:write";
+export const LOG_READ_SCOPE = "logs:read";
+/** Hash a token the way the store does. */
+export function hashToken(token) {
+    return `sha256:${createHash("sha256").update(token, "utf8").digest("hex")}`;
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function readFileTrimmed(path) {
+    try {
+        if (!existsSync(path))
+            return undefined;
+        const value = readFileSync(path, "utf8").trim();
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export class LogCredentialStore {
+    credentials;
+    shared;
+    constructor(credentials, shared) {
+        this.credentials = credentials;
+        this.shared = shared;
+    }
+    /**
+     * Load the store from the credential file and the shared token.
+     *
+     * A malformed credential file is ignored (and reported through
+     * `loadErrors`), never fatal: the endpoint then fails closed.
+     */
+    static load(options = {}) {
+        const env = options.env ?? process.env;
+        const keysDir = options.keysDir ?? join(homedir(), ".pi-harness-runtime", "keys");
+        const path = options.path ?? join(keysDir, "log-ingest-credentials.json");
+        const credentials = [];
+        try {
+            if (existsSync(path)) {
+                const parsed = JSON.parse(readFileSync(path, "utf8"));
+                if (Array.isArray(parsed?.credentials)) {
+                    for (const entry of parsed.credentials) {
+                        if (entry &&
+                            typeof entry.id === "string" &&
+                            typeof entry.tenantId === "string" &&
+                            typeof entry.tokenHash === "string") {
+                            credentials.push({
+                                ...entry,
+                                scopes: Array.isArray(entry.scopes) ? entry.scopes : [LOG_WRITE_SCOPE],
+                                createdAt: entry.createdAt ?? new Date(0).toISOString(),
+                                revokedAt: entry.revokedAt ?? null,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            // A broken file must not open the door: the store stays unconfigured.
+        }
+        const sharedToken = env.LOG_INGEST_TOKEN ?? readFileTrimmed(join(keysDir, "log-ingest-token.txt"));
+        const shared = sharedToken
+            ? { token: sharedToken, tenantId: env.LOG_INGEST_TENANT ?? DEFAULT_TENANT_ID }
+            : undefined;
+        return new LogCredentialStore(credentials, shared);
+    }
+    /** True when at least one usable credential exists. */
+    get configured() {
+        return (this.shared !== undefined ||
+            this.credentials.some((credential) => !credential.revokedAt));
+    }
+    /** The credentials without their token hashes. */
+    list() {
+        return this.credentials.map(({ tokenHash: _tokenHash, ...rest }) => rest);
+    }
+    /**
+     * Authenticate a presented token.
+     *
+     * Returns null when the token is missing, unknown or revoked.
+     */
+    authenticate(token) {
+        if (!token)
+            return null;
+        if (this.shared && safeEqual(hashToken(token), hashToken(this.shared.token))) {
+            return {
+                credentialId: "shared",
+                tenantId: this.shared.tenantId,
+                scopes: [LOG_WRITE_SCOPE, LOG_READ_SCOPE],
+                shared: true,
+            };
+        }
+        const presented = hashToken(token);
+        for (const credential of this.credentials) {
+            if (credential.revokedAt)
+                continue;
+            if (!safeEqual(presented, credential.tokenHash))
+                continue;
+            return {
+                credentialId: credential.id,
+                tenantId: credential.tenantId,
+                scopes: credential.scopes,
+                shared: false,
+            };
+        }
+        return null;
+    }
+}
+/**
+ * Extract the bearer token from an Authorization header.
+ */
+export function readBearerToken(header) {
+    if (!header)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : undefined;
+}
+//# sourceMappingURL=credentials.js.map

package/packages/logging/dist/server/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/server/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuCjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,OAAO,kBAAkB;IACb,WAAW,CAAkB;IAC7B,MAAM,CAAkD;IAEzE,YAAoB,WAA4B,EAAE,MAA4C;QAC7F,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,GAA8B,EAAE;QAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAoB,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;gBACxE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;oBACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;wBACxC,IACC,KAAK;4BACL,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;4BAC5B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;4BAClC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAClC,CAAC;4BACF,WAAW,CAAC,IAAI,CAAC;gCAChB,GAAG,KAAK;gCACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;gCACtE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gCACvD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;6BAClC,CAAC,CAAC;wBACJ,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;QACvE,CAAC;QAED,MAAM,WAAW,GAChB,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,WAAW;YACzB,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,EAAE;YAC9E,CAAC,CAAC,SAAS,CAAC;QAEb,OAAO,IAAI,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,uDAAuD;IACvD,IAAI,UAAU;QACb,OAAO,CACN,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5D,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO;gBACN,YAAY,EAAE,QAAQ;gBACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,MAAM,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;gBACzC,MAAM,EAAE,IAAI;aACZ,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,SAAS;gBAAE,SAAS;YACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC1D,OAAO;gBACN,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,MAAM,EAAE,KAAK;aACb,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC"}

package/packages/logging/dist/server/http.d.ts

@@ -0,0 +1,36 @@
+/**
+ * HTTP surface of the log service.
+ *
+ * The handlers live here (not in the server script) so the whole request
+ * path - authentication, size limits, validation, durable acceptance - can
+ * be tested over a real socket.
+ *
+ * Routes:
+ *   POST /api/logs         accept a batch (202 after the durable write)
+ *   POST /api/logs/query   read-only, tenant scoped metadata query
+ *   GET  /api/logs/health  queue depth, oldest pending age, failure count
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { LogIndexStore } from "./index-store.js";
+import type { LogOutbox } from "./outbox.js";
+import type { LogIngestService } from "./service.js";
+export interface LogHttpOptions {
+    service: LogIngestService;
+    outbox: LogOutbox;
+    index: LogIndexStore;
+    /** Largest accepted ingest body. Default 2 MB. */
+    maxBodyBytes?: number;
+    /** Largest accepted query body. Default 64 KB. */
+    maxQueryBytes?: number;
+    /**
+     * Directory for a human readable copy of the accepted batches
+     * (`logs-<day>.ndjson`). Optional.
+     */
+    localCopyDir?: string;
+}
+export type LogHttpHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/**
+ * Build the HTTP handler for the log routes.
+ */
+export declare function createLogHttpHandler(options: LogHttpOptions): LogHttpHandler;
+//# sourceMappingURL=http.d.ts.map

package/packages/logging/dist/server/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAoC1F;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CA8F5E"}

package/packages/logging/dist/server/http.js

@@ -0,0 +1,139 @@
+/**
+ * HTTP surface of the log service.
+ *
+ * The handlers live here (not in the server script) so the whole request
+ * path - authentication, size limits, validation, durable acceptance - can
+ * be tested over a real socket.
+ *
+ * Routes:
+ *   POST /api/logs         accept a batch (202 after the durable write)
+ *   POST /api/logs/query   read-only, tenant scoped metadata query
+ *   GET  /api/logs/health  queue depth, oldest pending age, failure count
+ */
+import { appendFileSync, existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { readBearerToken } from "./credentials.js";
+function sendJson(res, status, body) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+async function readBody(req, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > maxBytes)
+            return null;
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Write a human readable copy of the accepted records next to the other
+ * server logs. Best effort: a failing copy never affects the request.
+ */
+function writeLocalCopy(dir, payload) {
+    if (!dir)
+        return;
+    const records = payload.records;
+    if (!Array.isArray(records) || records.length === 0)
+        return;
+    try {
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const day = new Date().toISOString().slice(0, 10);
+        const file = join(dir, `logs-${day}.ndjson`);
+        appendFileSync(file, `${records.map((record) => JSON.stringify(record)).join("\n")}\n`);
+    }
+    catch {
+        // The copy is a convenience, not a requirement.
+    }
+}
+/**
+ * Build the HTTP handler for the log routes.
+ */
+export function createLogHttpHandler(options) {
+    const maxBodyBytes = options.maxBodyBytes ?? 2 * 1024 * 1024;
+    const maxQueryBytes = options.maxQueryBytes ?? 64 * 1024;
+    return async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const token = readBearerToken(req.headers.authorization);
+        if (url.pathname === "/api/logs" && req.method === "POST") {
+            // Fail closed: without a credential the endpoint does not exist.
+            if (!options.service.configured) {
+                sendJson(res, 503, { error: "log ingest is not configured", code: "ingest_unconfigured" });
+                return;
+            }
+            if (!options.service.authenticate(token)) {
+                sendJson(res, 401, { error: "unauthorized", code: "unauthorized" });
+                return;
+            }
+            const raw = await readBody(req, maxBodyBytes);
+            if (!raw) {
+                sendJson(res, 413, { error: "payload too large", code: "payload_too_large" });
+                return;
+            }
+            let payload;
+            try {
+                payload = JSON.parse(raw.toString());
+            }
+            catch {
+                sendJson(res, 400, { error: "invalid json", code: "invalid_json" });
+                return;
+            }
+            const result = options.service.ingest(payload, token);
+            sendJson(res, result.status, result.body);
+            if (result.status === 202)
+                writeLocalCopy(options.localCopyDir, payload);
+            return;
+        }
+        if (url.pathname === "/api/logs/query" && req.method === "POST") {
+            if (!options.service.configured) {
+                sendJson(res, 503, { error: "log ingest is not configured", code: "ingest_unconfigured" });
+                return;
+            }
+            const raw = await readBody(req, maxQueryBytes);
+            if (!raw) {
+                sendJson(res, 413, { error: "payload too large", code: "payload_too_large" });
+                return;
+            }
+            let params = {};
+            if (raw.length > 0) {
+                try {
+                    params = JSON.parse(raw.toString());
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid json", code: "invalid_json" });
+                    return;
+                }
+            }
+            const result = options.service.query({
+                installationId: params.installationId,
+                sessionId: params.sessionId,
+                since: params.since,
+                until: params.until,
+                levels: params.levels,
+                source: params.source,
+                event: params.event,
+                limit: params.limit,
+                cursor: params.cursor,
+            }, token);
+            sendJson(res, result.status, result.body);
+            return;
+        }
+        if (url.pathname === "/api/logs/health" && req.method === "GET") {
+            if (!options.service.configured) {
+                sendJson(res, 503, { configured: false });
+                return;
+            }
+            if (!options.service.authenticate(token)) {
+                sendJson(res, 401, { error: "unauthorized", code: "unauthorized" });
+                return;
+            }
+            sendJson(res, 200, { configured: true, outbox: options.outbox.stats() });
+            return;
+        }
+        sendJson(res, 404, { error: "not found" });
+    };
+}
+//# sourceMappingURL=http.js.map

package/packages/logging/dist/server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAsBnD,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACnE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAuB,EAAE,OAAgB;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5D,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;QAC7C,cAAc,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACR,gDAAgD;IACjD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,CAAC;IAEzD,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEzD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3D,iEAAiE;YACjE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACR,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC9E,OAAO;YACR,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACR,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC9E,OAAO;YACR,CAAC;YAED,IAAI,MAAM,GAA4B,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAA4B,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACR,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBACpE,OAAO;gBACR,CAAC;YACF,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CACnC;gBACC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,EACD,KAAK,CACL,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO;QACR,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACR,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACpE,OAAO;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO;QACR,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;AACH,CAAC"}

package/packages/logging/dist/server/index-store.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Metadata index for the log query service.
+ *
+ * R2 is an archive, not a search API, so the server keeps a small metadata
+ * index next to it: tenant, machine, session, timestamp, severity,
+ * source/event, batch id and the object key of the archived batch.
+ *
+ * The index deliberately holds NO message text. Prompts, responses and
+ * command output never enter it, and an agent asking "which errors happened
+ * in this session" gets metadata, not content.
+ *
+ * Storage is one NDJSON file per tenant and day:
+ *
+ *   <dir>/<tenant>/2026-10-24.ndjson
+ *
+ * The index is tenant scoped by construction: every query is filtered by the
+ * tenant of the authenticated caller, and the tenant of the request body is
+ * never used.
+ */
+import type { LogLevel } from "../types.js";
+import { type OutboxBatch } from "./outbox.js";
+export interface LogIndexEntry {
+    tenantId: string;
+    installationId: string;
+    sessionId?: string;
+    ts: string;
+    level: LogLevel;
+    source: string;
+    event: string;
+    batchId: string;
+    /** Object key of the archived batch, when it was uploaded. */
+    r2Key?: string;
+}
+export interface LogQueryParams {
+    /** Tenant of the authenticated caller. Required. */
+    tenantId: string;
+    installationId?: string;
+    sessionId?: string;
+    /** ISO timestamp, inclusive lower bound. */
+    since?: string;
+    /** ISO timestamp, exclusive upper bound. */
+    until?: string;
+    levels?: LogLevel[];
+    source?: string;
+    event?: string;
+    /** Maximum number of entries. Default 100, hard maximum 500. */
+    limit?: number;
+    /** Opaque cursor of the previous page. */
+    cursor?: string;
+}
+export interface LogQueryResult {
+    entries: LogIndexEntry[];
+    /** Cursor of the next page, when there is one. */
+    nextCursor?: string;
+    hasMore: boolean;
+    /** Number of day files that were read. */
+    scannedFiles: number;
+    /** True when the scan hit its day budget. */
+    truncated: boolean;
+}
+export interface LogIndexStoreOptions {
+    dir: string;
+    /** Days a query may scan back. Default 7, hard maximum 31. */
+    maxScanDays?: number;
+    /** Entries per page by default. */
+    defaultLimit?: number;
+    /** Hard maximum of entries per page. */
+    maxLimit?: number;
+}
+export declare class LogIndexStore {
+    private readonly dir;
+    private readonly maxScanDays;
+    private readonly defaultLimit;
+    private readonly maxLimit;
+    constructor(options: LogIndexStoreOptions);
+    /**
+     * Index the metadata of a batch.
+     *
+     * Returns the number of entries that were written. The write is best
+     * effort: a failing index must not lose the batch itself.
+     */
+    append(batch: OutboxBatch, r2Key?: string): number;
+    /**
+     * Query the index for one tenant.
+     *
+     * The result is bounded by the page limit and by the day budget, and the
+     * caller is always a tenant: there is no way to query another tenant
+     * because the tenant comes from the parameter, which the server fills
+     * from the authenticated credential.
+     */
+    query(params: LogQueryParams): LogQueryResult;
+    private matches;
+    private dayRange;
+}
+//# sourceMappingURL=index-store.d.ts.map

package/packages/logging/dist/server/index-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-store.d.ts","sourceRoot":"","sources":["../../src/server/index-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAkBD,qBAAa,aAAa;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,OAAO,EAAE,oBAAoB,EAKxC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA6BjD;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAsD5C;IAED,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,QAAQ;CAoBhB"}