smol-symphony 0.2.0 → 0.3.1

package/dist/shell/interp/acp-ws-conn.js

@@ -0,0 +1,320 @@
+// FCIS rewrite — per-connection `/acp` WebSocket lifecycle (shell adapter).
+//
+// The authenticated byte stream handed to the runner (AcpWsByteStream) plus the handshake +
+// frame pump for one upgraded socket (AcpWsConnection). Extracted from acp-ws.ts; both are
+// pure socket lifecycle over the RFC-6455 codec in acp-ws-frames.ts — no domain decisions.
+//
+// Streaming scar tissue (issue 135): each decoded frame payload forwards straight through AS
+// IT ARRIVES — NEVER full-buffer, NEVER a Gondolin onResponse hook on this path.
+import { Duplex } from 'node:stream';
+import { OP_BIN, OP_CLOSE, OP_PING, OP_PONG, OP_TEXT, MAX_FRAME_BYTES, FrameTooLargeError, closeFrame, controlFrame, decodeFrames, encodeFrame, parseAuthToken, parseControlType, } from './acp-ws-frames.js';
+const PROTO = 1; // wire version echoed in the {type:'ready',proto} handshake.
+// Cap the unauthenticated decode buffer (mirrors the raw bridge's header cap).
+const MAX_PREAUTH_BYTES = 64 * 1024;
+/**
+ * The authenticated ACP byte stream handed to the runner. Read side emits inbound WS frame
+ * payloads (driven by {@link AcpWsConnection}); write side encodes outbound ACP bytes as
+ * binary WS frames. AcpClient consumes it exactly as it consumed the raw net.Socket.
+ */
+class AcpWsByteStream extends Duplex {
+    socket;
+    eofPushed = false;
+    // True while the socket is paused because push() returned false (REAL backpressure on the
+    // SOURCE, not accumulation). Cleared the moment Node calls _read() — i.e. the consumer
+    // wants more. Never buffers a whole frame/turn before forwarding (issue-135).
+    sourcePaused = false;
+    constructor(socket) {
+        super();
+        this.socket = socket;
+    }
+    _read() {
+        if (this.sourcePaused) {
+            this.sourcePaused = false;
+            try {
+                if (!this.socket.destroyed)
+                    this.socket.resume();
+            }
+            catch {
+                /* idempotent */
+            }
+        }
+    }
+    _write(chunk, enc, cb) {
+        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, enc);
+        try {
+            this.socket.write(encodeFrame(OP_BIN, buf), cb);
+        }
+        catch (err) {
+            cb(err);
+        }
+    }
+    _final(cb) {
+        // Half-close: AcpClient ended its write side. Send a courteous close frame.
+        try {
+            this.socket.write(closeFrame(1000));
+        }
+        catch {
+            /* best-effort */
+        }
+        cb();
+    }
+    _destroy(err, cb) {
+        try {
+            if (!this.socket.destroyed)
+                this.socket.destroy();
+        }
+        catch {
+            /* idempotent */
+        }
+        cb(err);
+    }
+    /** Forward a decoded inbound frame payload (incremental, no buffering). Honors push() */
+    /** backpressure by pausing the source socket; _read() resumes it. */
+    deliver(payload) {
+        if (this.eofPushed || this.destroyed || payload.length === 0)
+            return;
+        let wantMore;
+        try {
+            wantMore = this.push(payload);
+        }
+        catch {
+            return; // reader gone
+        }
+        if (!wantMore && !this.sourcePaused) {
+            this.sourcePaused = true;
+            try {
+                if (!this.socket.destroyed)
+                    this.socket.pause();
+            }
+            catch {
+                /* idempotent */
+            }
+        }
+    }
+    /** Signal inbound EOF (guest closed write side / socket ended). Idempotent. */
+    inboundEof() {
+        if (this.eofPushed)
+            return;
+        this.eofPushed = true;
+        try {
+            this.push(null);
+        }
+        catch {
+            /* already ended */
+        }
+    }
+}
+/**
+ * Per-connection handshake + frame pump for one upgraded `/acp` socket. The FIRST frame must
+ * be {type:'auth',token}. On a match it builds the {@link AcpWsByteStream} + resolves the
+ * registration via tryAccept; on mismatch/timeout/pre-auth close it closes 1008.
+ */
+export class AcpWsConnection {
+    socket;
+    tryAccept;
+    heartbeatIntervalMs;
+    heartbeatTimeoutMs;
+    log;
+    state = { chunks: [], size: 0 };
+    authed = false;
+    settled = false;
+    stream = null;
+    authDeadline;
+    // Heartbeat armed ONLY post-auth (pre-auth is reaped by the auth deadline). The watchdog is
+    // independent of ACP frames, so a long silent tool call never trips it; ANY inbound traffic
+    // refreshes liveness. Both timers cleared on every teardown path.
+    pingTimer = null;
+    lastPongAt = 0;
+    constructor(socket, head, 
+    // Constant-time token lookup + registration resolve. On a match the registry calls
+    // buildStream() (exactly once) and resolves the registration; returns false on no match
+    // WITHOUT building (so the reject path can flush a clean 1008 before teardown).
+    tryAccept, authTimeoutMs, heartbeatIntervalMs, heartbeatTimeoutMs, log) {
+        this.socket = socket;
+        this.tryAccept = tryAccept;
+        this.heartbeatIntervalMs = heartbeatIntervalMs;
+        this.heartbeatTimeoutMs = heartbeatTimeoutMs;
+        this.log = log;
+        this.authDeadline = setTimeout(() => this.fail('auth timeout'), authTimeoutMs);
+        socket.on('data', (chunk) => this.onData(chunk));
+        socket.on('error', () => this.onSocketGone());
+        socket.on('close', () => this.onSocketGone());
+        if (head.length > 0)
+            this.onData(head);
+    }
+    onData(chunk) {
+        let frames;
+        try {
+            frames = decodeFrames(chunk, this.state);
+        }
+        catch (err) {
+            // Oversized frame/carry-over is a fault → tear down. Post-auth this surfaces as a
+            // transport close on the Duplex (classified transport_error by the runner).
+            if (err instanceof FrameTooLargeError)
+                return this.failTransport('frame too large');
+            throw err;
+        }
+        if (!this.authed && this.state.size > MAX_PREAUTH_BYTES) {
+            this.fail('pre-auth buffer too large');
+            return;
+        }
+        if (this.authed && frames.length > 0)
+            this.lastPongAt = Date.now();
+        for (const f of frames) {
+            if (this.authed)
+                this.handlePostAuthFrame(f);
+            else
+                this.handlePreAuthFrame(f);
+        }
+    }
+    handlePreAuthFrame(f) {
+        if (f.opcode === OP_CLOSE)
+            return this.fail('closed before auth');
+        if (f.opcode === OP_PING || f.opcode === OP_PONG)
+            return; // ignore control pre-auth
+        const token = parseAuthToken(f.payload);
+        if (token === null)
+            return this.reject1008();
+        // Stream built ONLY on a token match (inside tryAccept), so a mismatch leaves the socket
+        // untouched and reject1008 can flush a clean 1008 before teardown.
+        let built = null;
+        const matched = this.tryAccept(token, () => {
+            built = new AcpWsByteStream(this.socket);
+            return built;
+        });
+        if (!matched)
+            return this.reject1008();
+        clearTimeout(this.authDeadline);
+        this.authed = true;
+        this.settled = true;
+        this.stream = built;
+        // Positive "bearer accepted; about to relay" signal BEFORE any ACP byte flows. Then arm
+        // the heartbeat.
+        this.safeWrite(controlFrame({ type: 'ready', proto: PROTO }));
+        this.startHeartbeat();
+    }
+    handlePostAuthFrame(f) {
+        switch (f.opcode) {
+            case OP_PING:
+                return this.safeWrite(encodeFrame(OP_PONG, f.payload)); // WS-protocol ping → echo PONG.
+            case OP_PONG:
+                return; // liveness already refreshed in onData.
+            case OP_CLOSE:
+                this.stream?.inboundEof();
+                return this.endSocket();
+            case OP_TEXT: {
+                // Post-auth TEXT is an application-level JSON control (ping/pong), NOT ACP bytes (the
+                // guest sends ACP as BINARY). Unrecognized text falls through as opaque ACP bytes.
+                const ctrl = parseControlType(f.payload);
+                if (ctrl === 'ping')
+                    return this.safeWrite(controlFrame({ type: 'pong', t: Date.now() }));
+                if (ctrl === 'pong')
+                    return;
+                return this.stream?.deliver(f.payload);
+            }
+            default:
+                // binary / continuation — opaque ACP bytes; forward straight through (no buffering).
+                this.stream?.deliver(f.payload);
+        }
+    }
+    // Ping every interval; tear down if no inbound traffic for the dead-peer threshold.
+    startHeartbeat() {
+        this.lastPongAt = Date.now();
+        this.pingTimer = setInterval(() => {
+            if (Date.now() - this.lastPongAt > this.heartbeatTimeoutMs) {
+                this.failTransport('heartbeat timeout');
+                return;
+            }
+            this.safeWrite(controlFrame({ type: 'ping', t: Date.now() }));
+        }, this.heartbeatIntervalMs);
+        if (typeof this.pingTimer.unref === 'function')
+            this.pingTimer.unref();
+    }
+    stopHeartbeat() {
+        if (this.pingTimer) {
+            clearInterval(this.pingTimer);
+            this.pingTimer = null;
+        }
+    }
+    // Tear down a post-auth socket on a transport fault (heartbeat timeout / oversized frame).
+    // Ends inbound so the runner's handleTransportClose fires → in-flight session/prompt
+    // rejects → classified transport_error (feeds isTransportError + the circuit breaker).
+    failTransport(reason) {
+        if (this.settled && this.stream === null)
+            return;
+        this.settled = true;
+        this.stopHeartbeat();
+        clearTimeout(this.authDeadline);
+        this.log.emit('warn', 'acp ws transport fault', { remote: this.remote(), reason });
+        if (this.stream) {
+            this.stream.inboundEof();
+            if (!this.stream.destroyed)
+                this.stream.destroy(new Error(`acp ws transport error: ${reason}`));
+        }
+        this.destroySocket();
+    }
+    onSocketGone() {
+        clearTimeout(this.authDeadline);
+        this.stopHeartbeat();
+        if (this.stream) {
+            this.stream.inboundEof();
+            if (!this.stream.destroyed)
+                this.stream.destroy();
+        }
+        this.settled = true;
+    }
+    reject1008() {
+        if (this.settled)
+            return;
+        this.settled = true;
+        this.log.emit('warn', 'acp ws rejected connection', { remote: this.remote() });
+        this.safeWrite(closeFrame(1008));
+        this.endSocket();
+    }
+    fail(reason) {
+        if (this.settled)
+            return;
+        this.settled = true;
+        clearTimeout(this.authDeadline);
+        this.stopHeartbeat();
+        this.log.emit('warn', 'acp ws rejected connection', { remote: this.remote(), reason });
+        this.destroySocket();
+    }
+    remote() {
+        return `${this.socket.remoteAddress}:${this.socket.remotePort}`;
+    }
+    destroySocket() {
+        try {
+            this.socket.destroy();
+        }
+        catch {
+            /* idempotent */
+        }
+    }
+    safeWrite(buf) {
+        try {
+            this.socket.write(buf);
+        }
+        catch {
+            /* socket may be gone */
+        }
+    }
+    endSocket() {
+        this.stopHeartbeat();
+        try {
+            this.socket.end();
+        }
+        catch {
+            /* idempotent */
+        }
+        // Backstop: destroy after a short grace so a peer that never completes the close can't
+        // hang HTTP-server shutdown.
+        const t = setTimeout(() => {
+            if (!this.socket.destroyed)
+                this.destroySocket();
+        }, 1_000);
+        if (typeof t.unref === 'function')
+            t.unref();
+    }
+}
+//# sourceMappingURL=acp-ws-conn.js.map

package/dist/shell/interp/acp-ws-conn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acp-ws-conn.js","sourceRoot":"","sources":["../../../src/shell/interp/acp-ws-conn.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,4FAA4F;AAC5F,2FAA2F;AAC3F,2FAA2F;AAC3F,EAAE;AACF,6FAA6F;AAC7F,iFAAiF;AAEjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EACL,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,EACP,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,6DAA6D;AAC9E,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,eAAgB,SAAQ,MAAM;IAML;IALrB,SAAS,GAAG,KAAK,CAAC;IAC1B,0FAA0F;IAC1F,uFAAuF;IACvF,8EAA8E;IACtE,YAAY,GAAG,KAAK,CAAC;IAC7B,YAA6B,MAAc;QACzC,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAAQ;IAE3C,CAAC;IACD,KAAK;QACH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAsB,EAAE,GAAmB,EAAE,EAAgC;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAY,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAgC;QACrC,4EAA4E;QAC5E,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,EAAE,EAAE,CAAC;IACP,CAAC;IACD,QAAQ,CAAC,GAAiB,EAAE,EAAgC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;IACD,yFAAyF;IACzF,qEAAqE;IACrE,OAAO,CAAC,OAAe;QACrB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrE,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,cAAc;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,UAAU;QACR,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAaP;IAKA;IAEA;IACA;IACA;IArBF,KAAK,GAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACtD,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAA2B,IAAI,CAAC;IAC7B,YAAY,CAAgC;IAC7D,4FAA4F;IAC5F,4FAA4F;IAC5F,kEAAkE;IAC1D,SAAS,GAA0C,IAAI,CAAC;IACxD,UAAU,GAAG,CAAC,CAAC;IAEvB,YACmB,MAAc,EAC/B,IAAY;IACZ,mFAAmF;IACnF,wFAAwF;IACxF,gFAAgF;IAC/D,SAAgE,EACjF,aAAqB,EACJ,mBAA2B,EAC3B,kBAA0B,EAC1B,GAAY;QATZ,WAAM,GAAN,MAAM,CAAQ;QAKd,cAAS,GAAT,SAAS,CAAuD;QAEhE,wBAAmB,GAAnB,mBAAmB,CAAQ;QAC3B,uBAAkB,GAAlB,kBAAkB,CAAQ;QAC1B,QAAG,GAAH,GAAG,CAAS;QAE7B,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC;QAC/E,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kFAAkF;YAClF,4EAA4E;YAC5E,IAAI,GAAG,YAAY,kBAAkB;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;YACpF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;;gBACxC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,CAAe;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,0BAA0B;QACpF,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7C,yFAAyF;QACzF,mEAAmE;QACnE,IAAI,KAAK,GAA2B,IAAI,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;YACzC,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,wFAAwF;QACxF,iBAAiB;QACjB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,mBAAmB,CAAC,CAAe;QACzC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gCAAgC;YAC1F,KAAK,OAAO;gBACV,OAAO,CAAC,wCAAwC;YAClD,KAAK,QAAQ;gBACX,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,sFAAsF;gBACtF,mFAAmF;gBACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,IAAI,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC1F,IAAI,IAAI,KAAK,MAAM;oBAAE,OAAO;gBAC5B,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YACD;gBACE,qFAAqF;gBACrF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,oFAAoF;IAC5E,cAAc;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC3D,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7B,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzE,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,qFAAqF;IACrF,uFAAuF;IAC/E,aAAa,CAAC,MAAc;QAClC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,YAAY;QAClB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAEO,IAAI,CAAC,MAAc;QACzB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,MAAM;QACZ,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClE,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QACD,uFAAuF;QACvF,6BAA6B;QAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnD,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/shell/interp/acp-ws-frames.js

@@ -0,0 +1,159 @@
+// FCIS rewrite — RFC-6455 WebSocket frame codec for the `/acp` transport (shell adapter).
+//
+// Pure wire mechanics extracted from acp-ws.ts: frame encode/decode, masking, the
+// Sec-WebSocket-Accept hash, and the small JSON control/auth-frame parsers. No socket
+// lifecycle and no domain decisions live here — just byte-level framing shared by the
+// per-connection pump (acp-ws-conn.ts).
+import { createHash } from 'node:crypto';
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11'; // RFC 6455 Sec-WebSocket-Accept SHA-1.
+export const OP_TEXT = 0x1;
+export const OP_BIN = 0x2;
+export const OP_CLOSE = 0x8;
+export const OP_PING = 0x9;
+export const OP_PONG = 0xa;
+// Post-auth cap on a single frame's declared length AND on undecoded carry-over; exceeding
+// it is a fault → tear the socket down rather than grow memory unbounded.
+export const MAX_FRAME_BYTES = 16 * 1024 * 1024;
+export class FrameTooLargeError extends Error {
+}
+// Parse a frame header: payload length + the offset where the payload begins (past the
+// extended length and, for client→server frames, the 4-byte mask key). null when `b` does
+// not yet hold the full header.
+function readFrameHeader(b) {
+    if (b.length < 2)
+        return null;
+    const masked = (b[1] & 0x80) !== 0;
+    let len = b[1] & 0x7f;
+    let off = 2;
+    if (len === 126) {
+        if (b.length < off + 2)
+            return null;
+        len = b.readUInt16BE(off);
+        off += 2;
+    }
+    else if (len === 127) {
+        if (b.length < off + 8)
+            return null;
+        len = Number(b.readBigUInt64BE(off));
+        off += 8;
+    }
+    if (masked) {
+        if (b.length < off + 4)
+            return null;
+        off += 4; // skip the mask key; its bytes sit at [off-4, off)
+    }
+    return { len, off, masked };
+}
+// Decode the single frame at the head of `b`, or null when `b` does not hold it fully.
+// Client→server frames are masked (RFC 6455); unmask into a fresh buffer.
+function decodeOneFrame(b) {
+    const hdr = readFrameHeader(b);
+    if (!hdr)
+        return null;
+    const { len, off, masked } = hdr;
+    if (b.length < off + len)
+        return null;
+    let payload = b.subarray(off, off + len);
+    if (masked) {
+        const mask = b.subarray(off - 4, off);
+        const u = Buffer.allocUnsafe(len);
+        for (let i = 0; i < len; i++)
+            u[i] = payload[i] ^ mask[i & 3];
+        payload = u;
+    }
+    return { opcode: b[0] & 0x0f, payload, consumed: off + len };
+}
+// Decode as many whole frames as the buffered bytes contain, leaving any partial trailing
+// frame buffered in `state`. Concat-free in the common case (one read holds whole frames).
+export function decodeFrames(buf, state) {
+    const out = [];
+    if (buf.length > 0) {
+        state.chunks.push(buf);
+        state.size += buf.length;
+    }
+    if (state.size > MAX_FRAME_BYTES)
+        throw new FrameTooLargeError('ws frame carry-over too large');
+    if (state.size === 0)
+        return out;
+    let b = state.chunks.length === 1 ? state.chunks[0] : Buffer.concat(state.chunks, state.size);
+    for (;;) {
+        // Cap on the DECLARED length before allocating its unmask buffer, so a header claiming a
+        // huge length fails fast rather than after a giant allocation.
+        const hdr = readFrameHeader(b);
+        if (hdr && hdr.len > MAX_FRAME_BYTES)
+            throw new FrameTooLargeError('ws frame too large');
+        const f = decodeOneFrame(b);
+        if (f === null)
+            break;
+        out.push({ opcode: f.opcode, payload: f.payload });
+        b = b.subarray(f.consumed);
+    }
+    if (b.length > 0) {
+        state.chunks = [b];
+        state.size = b.length;
+    }
+    else {
+        state.chunks = [];
+        state.size = 0;
+    }
+    return out;
+}
+// Encode one server→client frame (FIN set, unmasked — server frames are never masked).
+export function encodeFrame(opcode, payload) {
+    const len = payload.length;
+    let header;
+    if (len < 126) {
+        header = Buffer.from([0x80 | opcode, len]);
+    }
+    else if (len < 65536) {
+        header = Buffer.alloc(4);
+        header[0] = 0x80 | opcode;
+        header[1] = 126;
+        header.writeUInt16BE(len, 2);
+    }
+    else {
+        header = Buffer.alloc(10);
+        header[0] = 0x80 | opcode;
+        header[1] = 127;
+        header.writeBigUInt64BE(BigInt(len), 2);
+    }
+    return Buffer.concat([header, payload]);
+}
+export function closeFrame(code) {
+    const p = Buffer.alloc(2);
+    p.writeUInt16BE(code, 0);
+    return encodeFrame(OP_CLOSE, p);
+}
+// Encode a small JSON CONTROL message as a TEXT frame (ACP bytes ride BINARY frames, so the
+// guest distinguishes the ready/heartbeat handshake from opaque ACP bytes by opcode).
+export function controlFrame(msg) {
+    return encodeFrame(OP_TEXT, Buffer.from(JSON.stringify(msg), 'utf8'));
+}
+// Parse a guest→host TEXT frame as a ping/pong control message, else null (forward as opaque).
+export function parseControlType(payload) {
+    try {
+        const msg = JSON.parse(payload.toString('utf8'));
+        if (msg && (msg.type === 'ping' || msg.type === 'pong'))
+            return msg.type;
+    }
+    catch {
+        /* not JSON control → opaque ACP text */
+    }
+    return null;
+}
+export function computeAccept(key) {
+    return createHash('sha1').update(key + WS_GUID).digest('base64');
+}
+// Parse a {type:'auth',token} first-message frame → token string, or null.
+export function parseAuthToken(payload) {
+    try {
+        const msg = JSON.parse(payload.toString('utf8'));
+        if (msg && msg.type === 'auth' && typeof msg.token === 'string')
+            return msg.token;
+    }
+    catch {
+        /* not JSON → not an auth frame */
+    }
+    return null;
+}
+//# sourceMappingURL=acp-ws-frames.js.map

package/dist/shell/interp/acp-ws-frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acp-ws-frames.js","sourceRoot":"","sources":["../../../src/shell/interp/acp-ws-frames.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,kFAAkF;AAClF,sFAAsF;AACtF,sFAAsF;AACtF,wCAAwC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,GAAG,sCAAsC,CAAC,CAAC,uCAAuC;AAC/F,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC;AAC1B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,2FAA2F;AAC3F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAYhD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,uFAAuF;AACvF,0FAA0F;AAC1F,gCAAgC;AAChC,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1B,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;SAAM,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,GAAG,IAAI,CAAC,CAAC,CAAC,mDAAmD;IAC/D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,uFAAuF;AACvF,0EAA0E;AAC1E,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;AAChE,CAAC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAAkB;IAC1D,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEjC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/F,SAAS,CAAC;QACR,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,eAAe;YAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAc,CAAC;IACnB,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAChB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QAChB,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,4FAA4F;AAC5F,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,GAA4B;IACvD,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB,CAAC;QACvE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwC,CAAC;QACxF,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}