smol-symphony 0.2.0 → 0.3.1

package/dist/agent/credential-ticker.js

@@ -1,57 +0,0 @@
-// Host-side OAuth ticker — periodically drives a credential refresh so the
-// on-demand fallback isn't the only thing keeping the host access token fresh
-// during long idle windows.
-//
-// Under the Gondolin secret-substitution model the work is delegated to the
-// credential registry's `refreshAll()` (which fans `refreshAdapter` over every
-// live adapter); the registry's per-adapter refresh carries the shared flock +
-// single-flight, so concurrent ticks + a per-VM proactive `expiresAt` tick
-// collapse into a single host-side refresh.
-//
-// Lifecycle:
-//   start() — install the interval timer. Idempotent.
-//   stop()  — clear the timer. Idempotent.
-import { log } from '../logging.js';
-export class CredentialTicker {
-    timer = null;
-    stopped = false;
-    intervalMs;
-    refreshAll;
-    constructor(opts) {
-        this.intervalMs = opts.intervalMs;
-        this.refreshAll = opts.refreshAll;
-    }
-    start() {
-        if (this.timer || this.stopped)
-            return;
-        if (this.intervalMs <= 0) {
-            log.info('credential ticker disabled (interval_ms <= 0)');
-            return;
-        }
-        this.timer = setInterval(() => void this.tick(), this.intervalMs);
-        // Don't prevent process shutdown on the ticker — the lifecycle is owned
-        // by `stop()` below, but if a future code path drops the reference, we
-        // shouldn't keep the event loop alive.
-        if (typeof this.timer.unref === 'function')
-            this.timer.unref();
-        log.info('credential ticker started', { interval_ms: this.intervalMs });
-    }
-    stop() {
-        this.stopped = true;
-        if (this.timer) {
-            clearInterval(this.timer);
-            this.timer = null;
-        }
-    }
-    async tick() {
-        if (this.stopped)
-            return;
-        try {
-            await this.refreshAll();
-        }
-        catch (err) {
-            log.warn('credential ticker: refresh failed', { error: err.message });
-        }
-    }
-}
-//# sourceMappingURL=credential-ticker.js.map

package/dist/agent/credential-ticker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-ticker.js","sourceRoot":"","sources":["../../src/agent/credential-ticker.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,8EAA8E;AAC9E,4BAA4B;AAC5B,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA4C;AAC5C,EAAE;AACF,aAAa;AACb,sDAAsD;AACtD,2CAA2C;AAE3C,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAapC,MAAM,OAAO,gBAAgB;IACnB,KAAK,GAA0B,IAAI,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC;IACP,UAAU,CAAS;IACnB,UAAU,CAAsB;IAEjD,YAAY,IAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACvC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,wEAAwE;QACxE,uEAAuE;QACvE,uCAAuC;QACvC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF"}

package/dist/agent/gondolin-creds-staging.js

@@ -1,356 +0,0 @@
-// Per-adapter Gondolin fake-native-credential staging (design §3.3).
-//
-// This is the credential-MODEL half of the Gondolin backend — NOT the old proxy
-// model. There is no proxy server and no base-URL injection: the in-VM client
-// dials its REAL upstream (claude→api.anthropic.com, codex→chatgpt.com backend,
-// opencode→api.githubcopilot.com) in its NATIVE mode, with a token-shaped
-// PLACEHOLDER as its bearer. Gondolin substitutes the real access token into the
-// outbound request at egress (TLS-MITM) per the per-VM `secretManager`; the real
-// refresh/durable token NEVER enters the guest (the invariant).
-//
-// Given an adapter id + the placeholder value (from `createHttpHooks().env`) +
-// identity inputs, this module builds the set of FAKE native credential FILES to
-// stage into the guest (guest path + JSON content), each holding ONLY
-// placeholders (plus, for codex, the non-secret `account_id` read from the host
-// auth.json), and the guest ENV additions (the placeholder bearer keyed by the
-// secret name) for a client that reads its bearer from env rather than a file.
-//
-// CRITICAL — placeholder identity: Gondolin substitutes the secret by EXACT
-// string match in the outbound `Authorization` header (design §2). So the bearer
-// the guest sends MUST equal the placeholder Gondolin holds. We therefore use the
-// placeholder from `createHttpHooks().env[secretName]` VERBATIM as the staged
-// file's bearer field (claude `claudeAiOauth.accessToken`, codex
-// `tokens.access_token`). For codex that placeholder is ALREADY JWT-shaped with a
-// far-future `exp` (see `credential-secrets.ts` `codexPlaceholder`/
-// `assemblePlaceholderJwt`), so codex's native mode never refreshes it.
-//
-// Pure-ish: the only IO is reading the host `~/.codex/auth.json` to copy the
-// non-secret `account_id` (codex) and the host `~/.claude.json` to copy the
-// non-secret oauthAccount identity (claude). Both are injected via `hostReaders`
-// so tests pass fakes — no real creds, no FS.
-//
-// INVARIANT (precise — codex review): the host `~/.codex/auth.json` DOES contain
-// real tokens, so the default reader parses a file whose bytes include them (the
-// host process already holds these tokens — `credential-secrets.ts` reads the same
-// file for the access token, so this is no new host-side exposure). What this
-// module guarantees is that it **extracts and EMITS only non-secret identity +
-// metadata** (codex `account_id` / `auth_mode` / `last_refresh`, claude
-// oauthAccount UUIDs — all read by an allowlist of known non-secret keys) — a real
-// access/refresh token (or a real `OPENAI_API_KEY`) is never returned to the
-// caller, never written into a staged file, and never put in the guest env. The
-// guest-facing invariant (no real token in the VM) holds.
-//
-// LIVE: the runner (`runner.ts`) and `gondolin-dispatch.ts` consume this on the
-// dispatch path. The runtime (non-credential) files still flow through
-// `adapters.ts`' `stage*` helpers.
-//
-// The fake-creds shapes are the ones the spike VERIFIED end-to-end (B5 claude,
-// C7 codex) — see `spike/gondolin/tests/{b5-claude-real,c7-codex-real}.mjs` and
-// `docs/research/gondolin-sandbox-migration.md` §3.3.
-import os from 'node:os';
-import path from 'node:path';
-import { log } from '../logging.js';
-import { buildOpencodeConfig, OPENCODE_CONFIG_GUEST_PATH } from './adapters.js';
-// ---------------------------------------------------------------------------
-// Constants.
-// ---------------------------------------------------------------------------
-// Guest paths the fake native creds land at (the VM runs as root). These mirror
-// the runner's `stageAdapterExtras` guest paths (runner.ts) so a client finds its
-// creds in exactly the place its native mode looks.
-const CLAUDE_CREDENTIALS_GUEST_PATH = '/root/.claude/.credentials.json';
-const CLAUDE_CONFIG_GUEST_PATH = '/root/.claude.json';
-const CODEX_AUTH_GUEST_PATH = '/root/.codex/auth.json';
-const CRED_FILE_MODE = 0o600;
-// Far-future expiry (2100-01-01T00:00:00Z, ms since epoch) so the claude client
-// never proactively refreshes the placeholder (a refresh attempt would be
-// egress-blocked and is pure waste). Matches the spike's `4102444800000`. (codex's
-// far-future `exp` lives inside its JWT placeholder, set in credential-secrets.ts.)
-const FAR_FUTURE_MS = 4_102_444_800_000;
-// A junk refresh token: token-SHAPED but explicitly never a real token. The guest
-// has nothing to rotate (the real refresh token stays host-side, layer 1).
-const JUNK_REFRESH = 'JUNK-PLACEHOLDER-REFRESH-not-a-real-token';
-// ---------------------------------------------------------------------------
-// Builders per adapter.
-// ---------------------------------------------------------------------------
-/**
- * Build the fake native creds + env additions for `adapterId`. The placeholder
- * (a fake, token-shaped value) is what the guest sees as its bearer; Gondolin
- * substitutes the real token at egress. The returned `env` is always the
- * single-entry `{ [secretName]: placeholder }` so a client reading its bearer
- * from env (not a file) still gets the placeholder.
- */
-export async function buildGondolinFakeCreds(adapterId, input) {
-    const env = { [input.secretName]: input.placeholder };
-    const readers = input.hostReaders ?? defaultHostIdentityReaders();
-    switch (adapterId) {
-        case 'claude':
-            return { files: await buildClaudeFiles(input.placeholder, readers), env };
-        case 'codex':
-            return { files: await buildCodexFiles(input.placeholder, readers), env };
-        case 'opencode':
-            return { files: buildOpencodeFiles(input.opencodeModel ?? null), env };
-    }
-}
-/**
- * claude fake `~/.claude/.credentials.json` = `{ claudeAiOauth: { accessToken:
- * <placeholder>, refreshToken: <junk>, expiresAt: <far future ms> } }` (spike B5).
- * Far-future expiry ⇒ no proactive refresh. ALSO stage the scrubbed
- * `~/.claude.json` identity (oauthAccount UUIDs only — the real accountUuid /
- * organizationUuid are identifiers, NOT secrets) when the host provides one;
- * absent identity is non-fatal (best-effort, matching `stageClaudeIdentity`).
- */
-async function buildClaudeFiles(placeholder, readers) {
-    const credsContent = JSON.stringify({
-        claudeAiOauth: {
-            accessToken: placeholder,
-            refreshToken: JUNK_REFRESH,
-            expiresAt: FAR_FUTURE_MS,
-        },
-    });
-    const files = [credFile(CLAUDE_CREDENTIALS_GUEST_PATH, credsContent)];
-    const identity = await safeReadClaudeIdentity(readers);
-    if (identity !== null) {
-        const configContent = JSON.stringify({
-            hasCompletedOnboarding: true,
-            oauthAccount: identity,
-            projects: {},
-        });
-        files.push(credFile(CLAUDE_CONFIG_GUEST_PATH, configContent));
-    }
-    return files;
-}
-/**
- * codex fake `~/.codex/auth.json`, shaped to be COMPLETE for codex 0.135.
- *
- * GO-LIVE FINDING (2026-05-30, the real root cause; the earlier "post-101 WS
- * drop" was a red herring): codex 0.135's local auth manager runs a COMPLETENESS
- * check on auth.json BEFORE it will send the `Authorization` bearer. A too-minimal
- * `{ tokens: { access_token, id_token, refresh_token, account_id } }` is judged
- * "credentials incomplete" — so codex sends NO bearer at all → unauthenticated →
- * 401 → a blocked refresh → turn refusal. With a COMPLETE auth.json the WS Upgrade
- * gets a clean 101 through Gondolin and the turn completes. The proven-working
- * shape (spike C7, VERIFIED) carries the non-secret top-level completeness fields
- * `auth_mode` + `last_refresh` (and `OPENAI_API_KEY: null`) alongside the tokens
- * block.
- *
- * SAFETY-FIRST: we do NOT spread the host auth.json into the staged file (that
- * would leak a real token if any secret field were missed). Instead we read ONLY
- * an ALLOWLIST of non-secret metadata via the injected reader and BUILD a fresh
- * object from scratch:
- *   - top level: `OPENAI_API_KEY: null` (the OAuth tokens block is the live cred,
- *     never an apikey) + the non-secret `auth_mode` + `last_refresh` when known;
- *   - `tokens`: the JWT-shaped `placeholder` as both `access_token` (codex's
- *     bearer; Gondolin substitutes the real token at egress) and `id_token`, a
- *     JUNK `refresh_token` (the guest has nothing real to rotate), and the
- *     non-secret `account_id` (the `chatgpt-account-id` routing identifier).
- * The placeholder's far-future JWT `exp` (baked in by `credential-secrets.ts`)
- * keeps codex from proactively refreshing. The real access/id/refresh token never
- * enters this object.
- */
-async function buildCodexFiles(placeholder, readers) {
-    const meta = await safeReadCodexMetadata(readers);
-    // Re-validate at this STAGING chokepoint (codex review, HIGH). `HostIdentityReaders`
-    // is an injectable boundary, so even though the default reader already guards via
-    // `extractCodexMetadata`, a custom/buggy/hostile reader could hand us a non-UUID
-    // `accountId` (or an out-of-allowlist `authMode`/`lastRefresh`). The same shared
-    // guards run again here so a token-shaped value is OMITTED from the staged
-    // auth.json regardless of which reader produced it (defense-in-depth).
-    const accountId = validAccountId(meta?.accountId ?? null);
-    const authMode = validAuthMode(meta?.authMode ?? null);
-    const lastRefresh = validLastRefresh(meta?.lastRefresh ?? null);
-    const tokens = {
-        access_token: placeholder,
-        id_token: placeholder,
-        refresh_token: JUNK_REFRESH,
-        ...(accountId !== null ? { account_id: accountId } : {}),
-    };
-    // Top-level non-secret completeness fields. `OPENAI_API_KEY: null` mirrors the
-    // host (codex stores the OAuth tokens block, NOT an api key); `auth_mode` /
-    // `last_refresh` are the markers codex 0.135's completeness check requires (see
-    // the doc comment). All are non-secret; absent/invalid ⇒ omitted (best-effort).
-    const auth = {
-        OPENAI_API_KEY: null,
-        ...(authMode !== null ? { auth_mode: authMode } : {}),
-        tokens,
-        ...(lastRefresh !== null ? { last_refresh: lastRefresh } : {}),
-    };
-    return [credFile(CODEX_AUTH_GUEST_PATH, JSON.stringify(auth))];
-}
-/**
- * opencode reuses the existing custom-provider config (`buildOpencodeConfig`):
- * `apiKey: {env:OPENCODE_PROXY_TOKEN}`. The placeholder bearer is delivered via
- * the env additions (the `{env:…}` interpolation reads it), so the config file
- * itself holds no token — only the provider declaration + model.
- */
-function buildOpencodeFiles(model) {
-    return [credFile(OPENCODE_CONFIG_GUEST_PATH, buildOpencodeConfig(model))];
-}
-// ---------------------------------------------------------------------------
-// Helpers.
-// ---------------------------------------------------------------------------
-function credFile(guestPath, content) {
-    return { guestPath, content, mode: CRED_FILE_MODE };
-}
-async function safeReadClaudeIdentity(readers) {
-    try {
-        return await readers.readClaudeIdentity();
-    }
-    catch (err) {
-        log.warn('gondolin-creds-staging: claude identity read failed (non-fatal)', {
-            error: err.message,
-        });
-        return null;
-    }
-}
-async function safeReadCodexMetadata(readers) {
-    try {
-        return await readers.readCodexMetadata();
-    }
-    catch (err) {
-        log.warn('gondolin-creds-staging: codex metadata read failed (non-fatal)', {
-            error: err.message,
-        });
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// Default host identity readers (real FS; parse host creds but emit only identity).
-// ---------------------------------------------------------------------------
-/**
- * Default readers backed by the host filesystem. Each parses the host file and
- * returns ONLY the non-secret identity/metadata — the claude oauthAccount UUIDs,
- * the codex `account_id`, and the codex completeness metadata (account_id /
- * auth_mode / last_refresh, allowlisted). The codex auth.json's bytes also contain
- * real tokens; they are parsed-then-discarded and never returned/emitted (module
- * header invariant). A missing/malformed file yields null.
- */
-export function defaultHostIdentityReaders() {
-    const readCodexAuth = () => readHostJson(path.join(os.homedir(), '.codex', 'auth.json'));
-    return {
-        readClaudeIdentity: async () => extractClaudeIdentity(await readHostJson(path.join(os.homedir(), '.claude.json'))),
-        readCodexAccountId: async () => extractCodexAccountId(await readCodexAuth()),
-        readCodexMetadata: async () => extractCodexMetadata(await readCodexAuth()),
-    };
-}
-async function readHostJson(p) {
-    const { readFile } = await import('node:fs/promises');
-    let raw;
-    try {
-        raw = await readFile(p, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Pure: pull ONLY the non-secret oauthAccount UUIDs out of a parsed `~/.claude.json`.
- * Mirrors `adapters.ts` `extractOauthAccountIdentity` — no token, no device/session
- * id, no local config.
- */
-export function extractClaudeIdentity(parsed) {
-    const acct = pickObject(parsed, 'oauthAccount');
-    if (acct === null)
-        return null;
-    const accountUuid = pickString(acct, 'accountUuid');
-    const organizationUuid = pickString(acct, 'organizationUuid');
-    if (accountUuid === null || organizationUuid === null)
-        return null;
-    return { accountUuid, organizationUuid };
-}
-/**
- * Pure: pull ONLY the non-secret `account_id` out of a parsed `~/.codex/auth.json`
- * `tokens` block. The parsed object also holds the real access/refresh tokens (the
- * caller parsed the whole file), but this function reads + returns ONLY `account_id`
- * — the tokens are never returned or emitted.
- *
- * SAFETY-CRITICAL (codex review, HIGH): this value flows (via `symphony.ts` →
- * `buildAdapterCredentialSpecs({ codexAccountId })` → `codexPlaceholder` →
- * `assemblePlaceholderJwt`) into the placeholder JWT's `chatgpt_account_id` claim,
- * and that JWT IS the guest's staged `tokens.access_token` BEARER. So we validate
- * the value through the SHARED {@link validAccountId} UUID guard here: a hostile /
- * malformed `account_id` (a token / `sk-…` / JWT string) is NOT a UUID → returns
- * null → the claim is OMITTED from the bearer (the SAFE failure), never embedded.
- */
-export function extractCodexAccountId(parsed) {
-    const tokens = pickObject(parsed, 'tokens');
-    if (tokens === null)
-        return null;
-    return validAccountId(pickString(tokens, 'account_id'));
-}
-/**
- * Pure: pull ONLY the allowlisted NON-SECRET codex completeness metadata out of a
- * parsed `~/.codex/auth.json`. SAFETY-CRITICAL: this reads three explicit
- * non-secret keys by name (`tokens.account_id`, top-level `auth_mode`,
- * `last_refresh`) and NEVER touches `tokens.access_token` / `tokens.id_token` /
- * `tokens.refresh_token` / a real `OPENAI_API_KEY` — even though the parsed object
- * holds them. Returns null only when the file is entirely missing/unparseable
- * (parsed === null); a present-but-sparse auth.json yields a struct with null
- * fields (each omitted downstream). The non-null fields are pure identity /
- * metadata that codex 0.135 needs to consider the staged creds complete.
- */
-export function extractCodexMetadata(parsed) {
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-        return null;
-    const top = parsed;
-    const tokens = pickObject(parsed, 'tokens');
-    // Strict format guards (codex review, HIGH): account_id flows into the placeholder
-    // JWT payload → the guest BEARER, so a hostile/malformed host auth.json must not be
-    // able to smuggle a token-shaped value through it. Real tokens (JWT/`sk-…`/refresh)
-    // don't match a UUID / a known auth_mode / an ISO-timestamp shape, so on a mismatch
-    // we OMIT the field — codex may then judge creds incomplete (the SAFE failure)
-    // rather than us staging a real-looking value into a bearer/metadata slot.
-    return {
-        accountId: validAccountId(tokens !== null ? pickString(tokens, 'account_id') : null),
-        authMode: validAuthMode(pickString(top, 'auth_mode')),
-        lastRefresh: validLastRefresh(pickString(top, 'last_refresh')),
-    };
-}
-/** A ChatGPT account_id is a UUID; a real token (JWT/`sk-…`/refresh) never matches this. */
-const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-/** codex auth modes are a tiny closed set. */
-const KNOWN_AUTH_MODES = new Set(['chatgpt', 'apikey']);
-/** `last_refresh` is an ISO-8601 timestamp: digits + `-:.TZ+`, bounded length. */
-const ISO_TIMESTAMP_RE = /^[0-9T:.Z+-]{1,40}$/;
-/**
- * SHARED account_id guard (codex review, HIGH). The `account_id` is a non-secret
- * UUID routing identifier; a real token (JWT / `sk-…` / refresh) NEVER matches a
- * UUID. Both account_id flows MUST validate through THIS one definition so a
- * hostile/malformed host `~/.codex/auth.json` cannot smuggle a token-shaped value
- * into either sink:
- *   1. the placeholder JWT's `https://api.openai.com/auth.chatgpt_account_id`
- *      claim — which becomes the guest BEARER (`credential-secrets.ts`
- *      `assemblePlaceholderJwt` imports this); and
- *   2. the staged `~/.codex/auth.json` `tokens.account_id` metadata
- *      (`extractCodexMetadata`, below).
- * On a non-UUID value we return null so the field is OMITTED from BOTH sinks (the
- * JWT stays well-formed; codex may then prompt — the SAFE failure) rather than
- * embed a real-looking value.
- */
-export function validAccountId(v) {
-    return v !== null && UUID_RE.test(v) ? v : null;
-}
-function validAuthMode(v) {
-    return v !== null && KNOWN_AUTH_MODES.has(v) ? v : null;
-}
-function validLastRefresh(v) {
-    return v !== null && ISO_TIMESTAMP_RE.test(v) ? v : null;
-}
-function pickObject(value, key) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return null;
-    const v = value[key];
-    if (!v || typeof v !== 'object' || Array.isArray(v))
-        return null;
-    return v;
-}
-function pickString(obj, key) {
-    const v = obj[key];
-    return typeof v === 'string' && v.length > 0 ? v : null;
-}
-//# sourceMappingURL=gondolin-creds-staging.js.map

package/dist/agent/gondolin-creds-staging.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-creds-staging.js","sourceRoot":"","sources":["../../src/agent/gondolin-creds-staging.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,iFAAiF;AACjF,iFAAiF;AACjF,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,iEAAiE;AACjE,kFAAkF;AAClF,oEAAoE;AACpE,wEAAwE;AACxE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,iFAAiF;AACjF,8CAA8C;AAC9C,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,mFAAmF;AACnF,6EAA6E;AAC7E,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,sDAAsD;AAEtD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AA2BhF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,gFAAgF;AAChF,kFAAkF;AAClF,oDAAoD;AACpD,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AACxE,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,gFAAgF;AAChF,0EAA0E;AAC1E,mFAAmF;AACnF,oFAAoF;AACpF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,kFAAkF;AAClF,2EAA2E;AAC3E,MAAM,YAAY,GAAG,2CAA2C,CAAC;AAmEjE,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAuB,EACvB,KAAyB;IAEzB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC;IAClE,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5E,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;QAC3E,KAAK,UAAU;YACb,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,OAA4B;IAE5B,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,aAAa,EAAE;YACb,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,aAAa;SACzB;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAoB,CAAC,QAAQ,CAAC,6BAA6B,EAAE,YAAY,CAAC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;YACnC,sBAAsB,EAAE,IAAI;YAC5B,YAAY,EAAE,QAAQ;YACtB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,OAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,qFAAqF;IACrF,kFAAkF;IAClF,iFAAiF;IACjF,iFAAiF;IACjF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAA4B;QACtC,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,IAAI,GAA4B;QACpC,cAAc,EAAE,IAAI;QACpB,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAA4B;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE;YAC1E,KAAK,EAAG,GAAa,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAA4B;IAC/D,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,gEAAgE,EAAE;YACzE,KAAK,EAAG,GAAa,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAC7B,qBAAqB,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACpF,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,aAAa,EAAE,CAAC;QAC5E,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,MAAM,aAAa,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAS;IACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,+EAA+E;IAC/E,2EAA2E;IAC3E,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrD,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAChG,8CAA8C;AAC9C,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7E,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,CAAgB;IAC7C,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AACD,SAAS,aAAa,CAAC,CAAgB;IACrC,OAAO,CAAC,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AACD,SAAS,gBAAgB,CAAC,CAAgB;IACxC,OAAO,CAAC,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,GAAW;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B,EAAE,GAAW;IAC3D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC"}