smol-symphony 0.2.0 → 0.3.0

package/dist/agent/credential-extractors.js

@@ -1,342 +0,0 @@
-// Host-side credential primitives: pull the live access token out of each
-// adapter's on-host credential file, drive a host-side refresh, and mint the
-// short-lived GitHub→Copilot token. These are the "extractor" half of the old
-// `credential-proxy.ts` — the transport (the per-dispatch HTTP proxy that
-// terminated sentinels and forwarded to upstream) is gone; under Gondolin the
-// real token is substituted at egress by `createHttpHooks` in
-// `credential-secrets.ts`, which builds on exactly these helpers.
-//
-// The "only the host refreshes" invariant lives here too: `extractCodexToken`
-// NEVER reads `tokens.refresh_token`, and `defaultClaudeRefresher` triggers
-// Anthropic's own client (`claude -p`) rather than implementing OAuth — the
-// refresh token never leaves the host and never reaches the guest.
-import { request as httpsRequest } from 'node:https';
-import { mkdir } from 'node:fs/promises';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-/**
- * Default claude refresher: spawn `claude -p "ok"` and resolve when it exits.
- * Claude Code's own OAuth path detects the stale access token, refreshes against
- * Anthropic, and atomically writes the rotated tuple back to
- * `~/.claude/.credentials.json`. Symphony never implements OAuth — Anthropic's
- * own client does.
- */
-export function defaultClaudeRefresher() {
-    return () => new Promise((resolve, reject) => {
-        const p = spawn('claude', ['-p', 'ok'], { stdio: 'ignore' });
-        p.once('error', reject);
-        p.once('exit', (code) => {
-            if (code === 0)
-                return resolve();
-            reject(new Error(`claude -p exited with code ${code ?? '<null>'}`));
-        });
-    });
-}
-/**
- * Pull `accessToken` and `expiresAt` out of the claude credentials JSON. The
- * shape `claude` writes is `{ claudeAiOauth: { accessToken, expiresAt, ... } }`,
- * but we tolerate flat top-level fields too for forward compatibility.
- */
-export function extractClaudeToken(parsed) {
-    if (!parsed || typeof parsed !== 'object')
-        return null;
-    const root = parsed;
-    const oauth = root['claudeAiOauth'];
-    const candidate = oauth && typeof oauth === 'object' && !Array.isArray(oauth) ? oauth : root;
-    const accessToken = candidate['accessToken'];
-    if (typeof accessToken !== 'string' || accessToken.length === 0)
-        return null;
-    const expiresAtMs = coerceExpiresAtMs(candidate['expiresAt']);
-    return { accessToken, expiresAtMs };
-}
-/**
- * Pull the access token out of the codex `~/.codex/auth.json`. Two flavours live
- * there (docs/research/codex-proxy-accept-matrix.md §1): a ChatGPT-OAuth
- * `tokens.access_token` and an API-key `OPENAI_API_KEY`. We prefer the OAuth
- * access token, then fall back to the API key. The `tokens.refresh_token` is
- * NEVER read — it stays host-side so an in-VM agent cannot rotate (and thereby
- * invalidate) the host's credential. `expiresAtMs` is null on purpose: codex
- * tokens are long-lived (~8 days) and credential-secrets re-reads on demand
- * rather than driving a refresh (research Q3 option c).
- */
-export function extractCodexToken(parsed) {
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-        return null;
-    const root = parsed;
-    const tokens = codexTokensObject(root);
-    if (tokens !== null) {
-        const oauth = nonEmptyString(tokens['access_token']);
-        if (oauth !== null) {
-            // ChatGPT-OAuth subscription credential → ChatGPT-backend route. The
-            // account id (when present) becomes the `chatgpt-account-id` header, but
-            // routing keys on `chatgptOAuth`: this token is ALWAYS rejected by the
-            // platform API, with or without the account id.
-            return {
-                accessToken: oauth,
-                expiresAtMs: null,
-                chatgptOAuth: true,
-                chatgptAccountId: nonEmptyString(tokens['account_id']),
-            };
-        }
-    }
-    // API-key credential: forward to the platform API (api.openai.com/v1) unchanged.
-    const apiKey = nonEmptyString(root['OPENAI_API_KEY']);
-    return apiKey === null ? null : { accessToken: apiKey, expiresAtMs: null };
-}
-/** The ChatGPT-OAuth `tokens` bundle from auth.json, or null when absent/malformed. */
-function codexTokensObject(root) {
-    const tokens = root['tokens'];
-    if (!tokens || typeof tokens !== 'object' || Array.isArray(tokens))
-        return null;
-    return tokens;
-}
-function nonEmptyString(v) {
-    return typeof v === 'string' && v.length > 0 ? v : null;
-}
-/** Read `OPENAI_API_KEY` from the host environment as a codex credential fallback. */
-export function codexEnvFallback() {
-    const key = process.env['OPENAI_API_KEY'];
-    if (typeof key === 'string' && key.length > 0)
-        return { accessToken: key, expiresAtMs: null };
-    return null;
-}
-function coerceExpiresAtMs(value) {
-    if (typeof value === 'number' && Number.isFinite(value))
-        return value;
-    if (typeof value === 'string') {
-        const n = Number(value);
-        if (Number.isFinite(n))
-            return n;
-        const parsedDate = Date.parse(value);
-        if (Number.isFinite(parsedDate))
-            return parsedDate;
-    }
-    return null;
-}
-/**
- * Default cross-process lock: spawn `flock(1)` holding an exclusive lock on
- * `lockPath`. The child shell prints `READY\n` on stdout once the kernel has
- * granted the lock, then blocks on stdin via `exec cat`. Release closes the
- * child's stdin: cat reads EOF, exits, the kernel releases the flock(2) lock
- * automatically when the file descriptor is closed.
- *
- * The kernel guarantees we need from this lock:
- *   - mutual exclusion: only one holder at a time across processes;
- *   - automatic release on holder death (no stale-lock / PID-liveness
- *     heuristics);
- *   - ownership safety: a peer cannot delete our live lock (no lockfile to
- *     unlink — only a kernel-managed lock on the open FD).
- */
-export function defaultFlockAcquire(lockPath) {
-    return async (timeoutMs) => {
-        await mkdir(path.dirname(lockPath), { recursive: true });
-        return spawnFlockHolder(lockPath, timeoutMs);
-    };
-}
-async function spawnFlockHolder(lockPath, timeoutMs) {
-    // `flock -x -o lockfile sh -c '...'`: blocks until the kernel grants LOCK_EX
-    // on the lockfile, then exec's the shell. The shell prints READY, then
-    // `exec cat` replaces the shell with cat which blocks on stdin (closing
-    // our pipe to it tells cat to exit, which lets flock's parent reap and
-    // exit, which closes the FD and releases the kernel lock).
-    //
-    // `-o` makes flock close the lock-holding FD in the child process before
-    // exec'ing the command, so the lock is held by *only* the flock parent.
-    // Without `-o` the child would inherit the FD and could leak the lock past
-    // the parent's death if the parent is killed before the child exits.
-    const child = spawn('flock', ['-x', '-o', lockPath, 'sh', '-c', 'echo READY; exec cat'], {
-        stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    try {
-        await waitForFlockReady(child, timeoutMs);
-    }
-    catch (err) {
-        // We never saw READY: either flock is still waiting on the kernel lock
-        // (timeout case) or the child crashed before acquire. Kill it hard so the
-        // kernel never grants us a lock we won't release.
-        try {
-            child.kill('SIGKILL');
-        }
-        catch { /* ignore */ }
-        throw err;
-    }
-    return makeFlockRelease(child);
-}
-function waitForFlockReady(child, timeoutMs) {
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let stdoutBuf = '';
-        let stderrBuf = '';
-        const timer = setTimeout(() => {
-            if (settled)
-                return;
-            settled = true;
-            reject(new Error('credential proxy: refresh lock acquire timeout'));
-        }, timeoutMs);
-        const settle = (err) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            if (err)
-                reject(err);
-            else
-                resolve();
-        };
-        child.stdout?.on('data', (chunk) => {
-            stdoutBuf += chunk.toString('utf8');
-            if (stdoutBuf.includes('READY'))
-                settle(null);
-        });
-        child.stderr?.on('data', (chunk) => { stderrBuf += chunk.toString('utf8'); });
-        child.once('error', (err) => settle(err));
-        child.once('exit', (code, signal) => {
-            settle(new Error(`flock exited before ready (code=${code}, signal=${signal}, stderr=${stderrBuf.trim()})`));
-        });
-    });
-}
-function makeFlockRelease(child) {
-    let released = false;
-    return async () => {
-        if (released)
-            return;
-        released = true;
-        try {
-            child.stdin?.end();
-        }
-        catch { /* ignore */ }
-        if (child.exitCode !== null || child.signalCode !== null)
-            return;
-        // Belt: if `cat` somehow doesn't exit on EOF, SIGTERM it after a delay so
-        // we don't leak the kernel lock indefinitely.
-        const sigtermTimer = setTimeout(() => {
-            try {
-                child.kill('SIGTERM');
-            }
-            catch { /* ignore */ }
-        }, 2_000);
-        await new Promise((resolve) => child.once('exit', () => resolve()));
-        clearTimeout(sigtermTimer);
-    };
-}
-// ---------------------------------------------------------------------------
-// opencode / GitHub Copilot token exchange (issue 130).
-//
-// opencode's auth.json holds a DURABLE GitHub OAuth token that
-// `api.githubcopilot.com` does NOT accept. It must be exchanged host-side for a
-// short-lived (~30 min) Copilot token at
-// `api.github.com/copilot_internal/v2/token`, which then becomes the bearer.
-// The durable GitHub OAuth token never becomes the bearer and never enters the
-// guest. See docs/research/opencode-copilot-accept-matrix.md.
-// Used by `credential-secrets` for its `allowedHosts` + the `api.github.com`
-// path-allowlist guard.
-export const COPILOT_EXCHANGE_HOST = 'api.github.com';
-export const COPILOT_EXCHANGE_PATH = '/copilot_internal/v2/token';
-export const COPILOT_INFERENCE_HOST = 'api.githubcopilot.com';
-// A VS Code Copilot Chat identity. The in-VM `@ai-sdk/openai-compatible` client
-// sends none of these, so the host supplies the full set real-world Copilot
-// proxies (ericc-ch/copilot-api, litellm) send — the "safer choice" over
-// opencode's own minimal set per docs/research/opencode-copilot-accept-matrix.md.
-// Pinned version values DRIFT (GitHub rolls editor/plugin versions forward); these
-// reflect a recent VS Code Copilot Chat release and are DOC-DERIVED.
-const COPILOT_EDITOR_VERSION = 'vscode/1.95.0';
-const COPILOT_PLUGIN_VERSION = 'copilot-chat/0.26.7';
-const COPILOT_USER_AGENT = 'GitHubCopilotChat/0.26.7';
-const COPILOT_GH_API_VERSION = '2025-04-01';
-/**
- * GitHub Copilot inference headers `api.githubcopilot.com/chat/completions`
- * expects. DOC-DERIVED (docs/research/opencode-copilot-accept-matrix.md).
- * `copilot-integration-id: vscode-chat` is the load-bearing one — GitHub rejects
- * an unrecognised value; the editor/user-agent headers identify the "editor" to
- * Copilot's telemetry and widen the model allowlist. Lowercase keys (HTTP
- * headers are case-insensitive and inbound headers are normalised to lowercase,
- * so these merge cleanly over the inbound set).
- */
-export const COPILOT_EGRESS_HEADERS = {
-    'copilot-integration-id': 'vscode-chat',
-    'editor-version': COPILOT_EDITOR_VERSION,
-    'editor-plugin-version': COPILOT_PLUGIN_VERSION,
-    'user-agent': COPILOT_USER_AGENT,
-    'openai-intent': 'conversation-panel',
-    'x-github-api-version': COPILOT_GH_API_VERSION,
-};
-/**
- * Headers for the GitHub→Copilot token exchange (api.github.com). The editor +
- * user-agent identity is sent, but NOT `copilot-integration-id` — real clients
- * (ericc-ch/copilot-api `githubHeaders()`) omit it on the exchange call (it
- * belongs on the inference call). The GitHub OAuth token is added as
- * `Authorization: token <…>` at request time.
- */
-const COPILOT_EXCHANGE_HEADERS = {
-    accept: 'application/json',
-    'editor-version': COPILOT_EDITOR_VERSION,
-    'editor-plugin-version': COPILOT_PLUGIN_VERSION,
-    'user-agent': COPILOT_USER_AGENT,
-    'x-github-api-version': COPILOT_GH_API_VERSION,
-};
-/**
- * Default GitHub→Copilot token exchange: `GET api.github.com/copilot_internal/v2/token`
- * with `Authorization: token <gho_…>` (GitHub's classic-token scheme, NOT
- * Bearer) and the editor headers. Parses `{ token, expires_at }` — `expires_at`
- * is unix SECONDS, converted to ms. DOC-DERIVED request/response shape.
- */
-export function defaultCopilotExchange() {
-    return (githubToken) => new Promise((resolve, reject) => {
-        const opts = {
-            method: 'GET',
-            hostname: COPILOT_EXCHANGE_HOST,
-            path: COPILOT_EXCHANGE_PATH,
-            headers: {
-                // GitHub's classic-token scheme (`token <…>`), NOT Bearer.
-                authorization: `token ${githubToken}`,
-                ...COPILOT_EXCHANGE_HEADERS,
-            },
-        };
-        const req = httpsRequest(opts, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('end', () => {
-                const status = res.statusCode ?? 0;
-                const text = Buffer.concat(chunks).toString('utf8');
-                if (status < 200 || status >= 300) {
-                    reject(new Error(`copilot token exchange failed: HTTP ${status}`));
-                    return;
-                }
-                resolve(parseCopilotExchangeResponse(text));
-            });
-        });
-        req.once('error', reject);
-        req.end();
-    });
-}
-/** Parse the copilot_internal/v2/token response into a TokenInfo. */
-function parseCopilotExchangeResponse(text) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch (err) {
-        throw new Error(`copilot token exchange: malformed JSON (${err.message})`);
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('copilot token exchange: response is not an object');
-    }
-    const root = parsed;
-    const token = root['token'];
-    if (typeof token !== 'string' || token.length === 0) {
-        throw new Error('copilot token exchange: response missing "token"');
-    }
-    return { accessToken: token, expiresAtMs: coerceCopilotExpiry(root['expires_at']) };
-}
-/** Copilot `expires_at` is unix SECONDS; convert to ms (null when absent/odd). */
-function coerceCopilotExpiry(value) {
-    if (typeof value === 'number' && Number.isFinite(value))
-        return value * 1000;
-    if (typeof value === 'string') {
-        const n = Number(value);
-        if (Number.isFinite(n))
-            return n * 1000;
-    }
-    return null;
-}
-//# sourceMappingURL=credential-extractors.js.map

package/dist/agent/credential-extractors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-extractors.js","sourceRoot":"","sources":["../../src/agent/credential-extractors.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,8DAA8D;AAC9D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,mEAAmE;AAEnE,OAAO,EAAE,OAAO,IAAI,YAAY,EAA8C,MAAM,YAAY,CAAC;AACjG,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAyC7B;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACpC,MAAM,SAAS,GACb,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,WAAW,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACL,WAAW,EAAE,KAAK;gBAClB,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,IAAI;gBAClB,gBAAgB,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;aACvD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,iFAAiF;IACjF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,KAAK,EAAE,SAAiB,EAAE,EAAE;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IACjE,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,2DAA2D;IAC3D,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,CAAC,EAAE;QACvF,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,kDAAkD;QAClD,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAmB,EAAE,SAAiB;IAC/D,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;QACtE,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAQ,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAClC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,YAAY,MAAM,YAAY,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACjE,0EAA0E;QAC1E,8CAA8C;QAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1E,YAAY,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,+DAA+D;AAC/D,gFAAgF;AAChF,yCAAyC;AACzC,6EAA6E;AAC7E,+EAA+E;AAC/E,8DAA8D;AAE9D,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,gFAAgF;AAChF,4EAA4E;AAC5E,yEAAyE;AACzE,kFAAkF;AAClF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAC/C,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AACrD,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,wBAAwB,EAAE,aAAa;IACvC,gBAAgB,EAAE,sBAAsB;IACxC,uBAAuB,EAAE,sBAAsB;IAC/C,YAAY,EAAE,kBAAkB;IAChC,eAAe,EAAE,oBAAoB;IACrC,sBAAsB,EAAE,sBAAsB;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAA2B;IACvD,MAAM,EAAE,kBAAkB;IAC1B,gBAAgB,EAAE,sBAAsB;IACxC,uBAAuB,EAAE,sBAAsB;IAC/C,YAAY,EAAE,kBAAkB;IAChC,sBAAsB,EAAE,sBAAsB;CAC/C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,WAAW,EAAE,EAAE,CACrB,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzC,MAAM,IAAI,GAAwB;YAChC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,qBAAqB;YAC/B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE;gBACP,2DAA2D;gBAC3D,aAAa,EAAE,SAAS,WAAW,EAAE;gBACrC,GAAG,wBAAwB;aAC5B;SACF,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAClC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,qEAAqE;AACrE,SAAS,4BAA4B,CAAC,IAAY;IAChD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2CAA4C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}