wotann 0.5.0

package/dist/desktop/companion-server.d.ts

@@ -0,0 +1,494 @@
+/**
+ * Companion Server — secure WebSocket bridge between WOTANN Desktop and iOS app.
+ *
+ * ARCHITECTURE:
+ * - Desktop runs a local WebSocket server (TLS encrypted)
+ * - iOS app connects via WebSocket with mutual authentication
+ * - Pairing uses QR code or manual PIN entry
+ * - All communication is end-to-end encrypted (AES-256-GCM)
+ *
+ * SECURITY MODEL:
+ * 1. First pairing: Desktop generates QR code with one-time PIN + public key
+ * 2. iOS scans QR → sends public key + PIN to server
+ * 3. Server verifies PIN → establishes shared secret via ECDH
+ * 4. All subsequent messages encrypted with derived key
+ * 5. Session tokens with expiry for reconnection without re-pairing
+ *
+ * FEATURES EXPOSED TO iOS:
+ * - Send prompts (text + voice recordings)
+ * - Receive streaming responses
+ * - View conversation history (synced)
+ * - Trigger autonomous tasks
+ * - Receive push notifications on completion
+ * - File sharing (photos from iOS → WOTANN context)
+ * - Quick actions (enhance, arena, cost check)
+ *
+ * PROTOCOL: JSON-RPC over WebSocket
+ * - Client → Server: { method, params, id }
+ * - Server → Client: { result?, error?, id } or { method: "stream", params }
+ */
+import type { CompanionDevice, PairingSession } from "./types.js";
+import { ConversationSyncHandler, MobileVoiceHandler, TaskMonitorHandler, QuickActionHandler, FileShareHandler, PushNotificationHandler, WidgetDataHandler, LiveActivityHandler } from "../mobile/ios-app.js";
+import { SecureAuthManager } from "../mobile/secure-auth.js";
+import type { HapticPattern } from "../mobile/haptic-feedback.js";
+export interface CompanionServerConfig {
+    readonly port: number;
+    readonly host: string;
+    readonly maxDevices: number;
+    readonly sessionTimeoutMs: number;
+    readonly enableTLS: boolean;
+    readonly certPath?: string;
+    readonly keyPath?: string;
+}
+export interface CompanionMessage {
+    readonly method: string;
+    readonly params: Record<string, unknown>;
+    readonly id: string | number;
+}
+export interface CompanionResponse {
+    readonly result?: unknown;
+    readonly error?: {
+        code: number;
+        message: string;
+    };
+    readonly id: string | number;
+}
+/**
+ * GA-11: stream events use a discriminator method name so iOS RPCClient
+ * subscriptions on `stream.text`, `stream.done`, and `stream.error` (the
+ * three topics ChatViewModel.swift attaches) can route by method without
+ * peeking at `params.type`. This was a dead-letter gap before GA-11 — iOS
+ * subscribed to those three method-name topics but daemon emitted a single
+ * `method:"stream"` notification. The discriminated method names are now
+ * the wire identifier; `params.type` is retained for back-compat with any
+ * client still inspecting it.
+ *
+ * Discriminator:
+ *   - chunk.type === "text"     → method: "stream.text"
+ *   - chunk.type === "done"     → method: "stream.done"
+ *   - chunk.type === "error"    → method: "stream.error"
+ *   - chunk.type === "thinking" → method: "stream.thinking"
+ *   - chunk.type === "tool_use" → method: "stream.tool_use"
+ */
+export type StreamMethodName = "stream.text" | "stream.done" | "stream.error" | "stream.thinking" | "stream.tool_use";
+export interface StreamEvent {
+    readonly method: StreamMethodName;
+    readonly params: {
+        readonly type: "text" | "thinking" | "tool_use" | "done" | "error";
+        readonly content: string;
+        readonly sessionId: string;
+        readonly conversationId?: string;
+        readonly tokensUsed?: number;
+        readonly cost?: number;
+        readonly toolName?: string;
+        readonly toolInput?: Record<string, unknown>;
+        readonly message?: string;
+        readonly haptic?: HapticPattern | null;
+        readonly confidence?: number;
+        readonly language?: string;
+        readonly provider?: string;
+        readonly model?: string;
+    };
+}
+/**
+ * GA-11 helper — translate a streaming chunk type into the discriminated
+ * method name iOS subscribes to. Single source of truth so additions or
+ * renames stay in lockstep across every emit site.
+ */
+export declare function streamMethodForChunkType(chunkType: "text" | "thinking" | "tool_use" | "done" | "error"): StreamMethodName;
+interface BridgeRPCResponse {
+    readonly jsonrpc: "2.0";
+    readonly result?: unknown;
+    readonly error?: {
+        code: number;
+        message: string;
+    };
+    readonly id: string | number | null;
+}
+interface BridgeRPCStreamEvent {
+    readonly jsonrpc: "2.0";
+    readonly method: StreamMethodName;
+    readonly params: {
+        readonly type: "text" | "thinking" | "tool_use" | "done" | "error";
+        readonly content: string;
+        readonly sessionId: string;
+        readonly provider?: string;
+        readonly model?: string;
+        readonly tokensUsed?: number;
+        readonly toolName?: string;
+        readonly toolInput?: Record<string, unknown>;
+    };
+}
+interface BridgeRPCHandler {
+    handleMessage(raw: string): Promise<BridgeRPCResponse | AsyncGenerator<BridgeRPCStreamEvent>>;
+}
+export type CompanionRPCMethod = "pair" | "pair.local" | "unpair" | "query" | "enhance" | "cancel" | "history" | "status" | "cost" | "autonomous" | "autonomous.status" | "autonomous.cancel" | "autonomous.proof" | "voice" | "voice.tts" | "file" | "file.get" | "command" | "sync" | "sync.messages" | "sync.send" | "push.register" | "push.preferences" | "widget.context" | "widget.task" | "widget.cost" | "widget.actions" | "live.start" | "live.update" | "live.end" | "arena" | "memory.search" | "context" | "next-task" | "ping" | "council" | "skills" | "agents" | "sync.fork" | "mode" | "providers" | "screen.stream" | "screen.capture" | "screen.input" | "screen.keyboard" | "approve";
+export declare class PairingManager {
+    private readonly devices;
+    private readonly pendingPairings;
+    private readonly sessions;
+    private readonly maxDevices;
+    private readonly secureAuth;
+    private readonly persistence;
+    constructor(maxDevices?: number, persistPath?: string);
+    private upsertDeviceSession;
+    /**
+     * Generate a pairing request with a one-time PIN.
+     * Returns a PIN and request ID for QR code generation.
+     */
+    generatePairingRequest(): {
+        pin: string;
+        requestId: string;
+        expiresAt: string;
+        publicKey: string;
+    };
+    /**
+     * Complete pairing from iOS device.
+     * Verifies PIN via SecureAuthManager's real ECDH exchange and registers the device.
+     */
+    completePairing(requestId: string, pin: string, deviceName: string, deviceId: string, devicePublicKey?: string): {
+        success: boolean;
+        sessionId?: string;
+        error?: string;
+    };
+    /**
+     * Complete a local-network (Bonjour/manual) pairing.
+     *
+     * SECURITY (SB-1): Previously this method accepted any deviceName/deviceId
+     * with no authentication and minted a 24-hour auth token — a trivial LAN
+     * takeover. Any process on the same network could call `pair.local` with
+     * arbitrary parameters and obtain a token.
+     *
+     * The fixed flow requires the caller to first obtain a `requestId`/`pin`
+     * pair from `generatePairingRequest()` (the same pending-request store the
+     * QR-code `pair` flow uses) and present BOTH the requestId AND the PIN.
+     * The PIN is verified via crypto.timingSafeEqual to defeat timing leaks.
+     *
+     * Without these two values local pairing is rejected. The pre-shared PIN
+     * is broadcast out-of-band via Bonjour TXT records or shown in the desktop
+     * UI for manual entry — same channel as the QR pair flow.
+     */
+    completeLocalPairing(requestId: string, pin: string, deviceName: string, deviceId: string): {
+        success: boolean;
+        sessionId?: string;
+        error?: string;
+    };
+    /**
+     * Remove a paired device.
+     */
+    unpairDevice(deviceId: string): boolean;
+    /**
+     * Get all paired devices.
+     */
+    getPairedDevices(): readonly CompanionDevice[];
+    /**
+     * Get active sessions.
+     */
+    getActiveSessions(): readonly PairingSession[];
+    endSession(sessionId: string): boolean;
+    /**
+     * Validate a session token.
+     */
+    validateSession(sessionId: string): PairingSession | null;
+    /**
+     * Update device last-seen timestamp.
+     */
+    touchDevice(deviceId: string): void;
+    /**
+     * Generate QR code data for pairing.
+     * Format: wotann://pair?id=<requestId>&pin=<pin>&host=<host>&port=<port>
+     */
+    generateQRData(requestId: string, pin: string, host: string, port: number): string;
+}
+export declare class CompanionRPCHandler {
+    private readonly handlers;
+    /**
+     * Register a handler for an RPC method.
+     */
+    register(method: string, handler: RPCHandler): void;
+    has(method: string): boolean;
+    /**
+     * Process an incoming RPC message.
+     */
+    handle(message: CompanionMessage): Promise<CompanionResponse>;
+    /**
+     * List registered methods.
+     */
+    getMethods(): readonly string[];
+}
+type RPCHandler = (params: Record<string, unknown>) => Promise<unknown>;
+export interface AuthTokenRecord {
+    readonly token: string;
+    readonly sessionId: string;
+    readonly deviceId: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+/**
+ * Methods that DO NOT require an authToken. These are either bootstrapping
+ * (to obtain a token in the first place), health-check, or the ECDH key
+ * exchange that establishes an encrypted channel before pairing.
+ */
+export declare const AUTH_EXEMPT_METHODS: ReadonlySet<string>;
+export declare class AuthTokenStore {
+    private readonly tokens;
+    private readonly sessionTimeoutMs;
+    constructor(sessionTimeoutMs?: number);
+    /**
+     * Issue a new 32-byte (64 hex char) random token for the given session/device.
+     * Returns the token string. The caller should embed it in the pairing response
+     * so the client can include it on all subsequent RPC calls.
+     */
+    issue(sessionId: string, deviceId: string): string;
+    /**
+     * Validate a token. Returns the associated record if valid and unexpired,
+     * otherwise null. Expired tokens are evicted from the store on access.
+     */
+    validate(token: string | undefined | null): AuthTokenRecord | null;
+    /** Revoke a specific token (e.g. on unpair). */
+    revoke(token: string): boolean;
+    /** Revoke all tokens for a given device (e.g. on unpair by deviceId). */
+    revokeForDevice(deviceId: string): number;
+    /** For tests / observability: snapshot of active tokens (never expose in real responses). */
+    size(): number;
+}
+/**
+ * requireAuth — shared helper for auth-gated RPC methods.
+ *
+ * Extracts `authToken` from the params object, validates it against the given
+ * token store, and throws a standardized error when the token is missing or
+ * invalid. The RPC handler framework converts thrown errors into a well-formed
+ * JSON-RPC error response, which translates to `{ ok: false, error: "unauthorized" }`
+ * at the client.
+ *
+ * Returns the validated record so downstream handlers can use the deviceId or
+ * sessionId bound to the token.
+ */
+export declare function requireAuth(params: Record<string, unknown>, store: AuthTokenStore): AuthTokenRecord;
+export declare class CompanionServer {
+    private readonly config;
+    private readonly pairingManager;
+    private readonly rpcHandler;
+    private readonly secureAuth;
+    private readonly conversationSync;
+    private readonly mobileVoice;
+    private taskMonitor;
+    private readonly quickAction;
+    private readonly fileShare;
+    private readonly pushNotification;
+    private readonly widgetData;
+    private readonly liveActivity;
+    private httpServer;
+    private wsServer;
+    private readonly connectedClients;
+    private running;
+    private runtime;
+    private bridgeRpcHandler;
+    /** Per-device AES-256 symmetric keys derived from ECDH key exchange. */
+    private readonly deviceEncryptionKeys;
+    /** Session auth tokens — issued on successful pairing, required on all other RPC calls. */
+    private readonly authTokens;
+    /**
+     * SECURITY (SB-1): Per-WS-client source IP, captured at HTTP upgrade.
+     * Used by the pair.local handler to apply per-source-IP rate limiting.
+     * WeakMap so entries are GC'd when the ws client is dropped.
+     */
+    private readonly clientAddresses;
+    /**
+     * SECURITY (SB-1): Per-source-IP pair.local attempt timestamps (ms epoch),
+     * pruned to the last 60s window on each lookup. Per-instance state (QB#7);
+     * a separate CompanionServer instance gets its own limiter, so test
+     * harnesses and parallel daemons do not share quota.
+     */
+    private readonly pairLocalAttempts;
+    /** Per-instance audit log for pair.local attempts (success + failure). */
+    private readonly pairLocalAuditLog;
+    /**
+     * SECURITY (SB-4): Per-instance audit log for WebSocket Origin-check
+     * decisions (CSWSH protection). Bounded to 256 entries. QB#7: per-instance
+     * (not module-global) so concurrent test daemons do not share state.
+     */
+    private readonly wsOriginAuditLog;
+    constructor(config?: Partial<CompanionServerConfig>);
+    /**
+     * Start the companion server with a real WebSocket server.
+     * Creates an HTTP server and attaches WebSocket handling via the `ws` package.
+     * Incoming WebSocket messages are parsed as JSON-RPC and dispatched through
+     * the RPC handler. Responses include haptic pattern metadata for iOS clients.
+     */
+    start(): {
+        port: number;
+        host: string;
+    };
+    /**
+     * Advertise the companion server as a Bonjour/mDNS service (_wotann._tcp)
+     * so the iOS app can discover it via BonjourDiscovery.
+     *
+     * H-29: previously macOS-only via `dns-sd`. iOS↔Desktop pairing silently
+     * died on Linux hosts because Avahi (the Linux mDNS responder) was never
+     * attempted. Now:
+     *   - macOS: dns-sd (built-in, zero deps)
+     *   - Linux: avahi-publish-service (from avahi-utils)
+     *   - Windows / no advertiser available: skip with a clear warning;
+     *     manual pairing via PIN still works (no crash).
+     *
+     * Both `dns-sd` and `avahi-publish-service` block in the foreground while
+     * the service is registered, so we spawn detached and unref.
+     */
+    private advertiseBonjourService;
+    stop(): void;
+    isRunning(): boolean;
+    /**
+     * Set the WotannRuntime instance for real query routing.
+     * When set, RPC handlers like `sync.send` and `enhance` call the real runtime.
+     *
+     * Session-10 audit fix: TaskMonitorHandler was constructed at line 606 with
+     * no `executeTask` callback, so iOS autonomous tasks dispatched via iOS
+     * Autopilot/Workshop/CarPlay stayed `status:"running"` forever (iOS call
+     * was non-blocking and no producer ever wrote a completion). We now bind
+     * a real `executeTask` callback that streams through the runtime's query
+     * pipeline — tasks resolve with { success, result } when the underlying
+     * stream ends, or { success:false, result:"error…" } on exception.
+     */
+    setRuntime(runtime: import("../core/runtime.js").WotannRuntime): void;
+    setBridgeRPCHandler(handler: BridgeRPCHandler): void;
+    /**
+     * Get the attached runtime (null if not connected).
+     */
+    getRuntime(): import("../core/runtime.js").WotannRuntime | null;
+    getPairingManager(): PairingManager;
+    getRPCHandler(): CompanionRPCHandler;
+    private getAdvertisedHost;
+    /**
+     * Generate a pairing QR code for iOS app connection.
+     */
+    generatePairingQR(): {
+        qrData: string;
+        pin: string;
+        expiresAt: string;
+        host: string;
+        port: number;
+    };
+    getConversationSync(): ConversationSyncHandler;
+    getMobileVoice(): MobileVoiceHandler;
+    getTaskMonitor(): TaskMonitorHandler;
+    getQuickAction(): QuickActionHandler;
+    getFileShare(): FileShareHandler;
+    getPushNotification(): PushNotificationHandler;
+    getWidgetData(): WidgetDataHandler;
+    getLiveActivity(): LiveActivityHandler;
+    getSecureAuth(): SecureAuthManager;
+    /** Access to the auth-token store (used by tests and admin endpoints). */
+    getAuthTokens(): AuthTokenStore;
+    /** Store a derived AES-256 key for a device after successful ECDH exchange. */
+    storeDeviceEncryptionKey(deviceId: string, key: Buffer): void;
+    /** Retrieve the encryption key for a device. Returns undefined if no key exchange has occurred. */
+    getDeviceEncryptionKey(deviceId: string): Buffer | undefined;
+    /**
+     * SECURITY (SB-1): per-source-IP rate limiter for `pair.local`.
+     * Allows up to PAIR_LOCAL_MAX_PER_WINDOW attempts per source IP per
+     * PAIR_LOCAL_WINDOW_MS. Returns true when the attempt is admitted (and
+     * records the timestamp); false when the source has exhausted its quota.
+     *
+     * Per-instance state (QB#7); two CompanionServer instances do not share
+     * quota. Pruning happens lazily on lookup so a long-idle source's history
+     * is reaped without a background timer.
+     */
+    private static readonly PAIR_LOCAL_MAX_PER_WINDOW;
+    private static readonly PAIR_LOCAL_WINDOW_MS;
+    private checkPairLocalRateLimit;
+    /**
+     * SECURITY (SB-1): record a pair.local attempt to the per-instance audit log.
+     * Bounded to the most recent 256 entries to defeat memory exhaustion.
+     */
+    private logPairLocalAttempt;
+    /**
+     * Read-only view of the pair.local audit log (for tests and observability).
+     */
+    getPairLocalAuditLog(): ReadonlyArray<{
+        readonly ts: number;
+        readonly sourceIp: string;
+        readonly deviceId: string;
+        readonly outcome: "ok" | "rate_limited" | "invalid_pin" | "expired" | "missing_args";
+    }>;
+    /**
+     * SECURITY (SB-4): record a WebSocket Origin-check decision to the
+     * per-instance CSWSH audit log. Bounded to 256 entries. Surfaces all
+     * rejections to the operator console via warn (QB#6) so a sudden burst
+     * of cross-origin attempts is visible without parsing the audit log.
+     */
+    private logWsOriginAttempt;
+    /**
+     * Read-only view of the WebSocket Origin-check audit log (for tests and
+     * observability). Each entry records a single upgrade-attempt decision.
+     */
+    getWsOriginAuditLog(): ReadonlyArray<{
+        readonly ts: number;
+        readonly origin: string;
+        readonly sourceIp: string;
+        readonly outcome: "accepted" | "rejected_cross_origin";
+    }>;
+    /**
+     * SECURITY (SB-1): handle pair.local with PIN verification, per-IP rate
+     * limiting, and audit logging. The previous implementation was an
+     * unauthenticated LAN takeover vector — any process on the network could
+     * mint a 24-hour auth token by calling pair.local with arbitrary device
+     * params. The fixed flow requires a pre-shared PIN issued by
+     * generatePairingRequest() (same store as the QR code `pair` flow).
+     */
+    private handlePairLocal;
+    /**
+     * Handle an incoming WebSocket message: parse JSON-RPC, dispatch through
+     * RPC handler, and send the response back with haptic pattern metadata.
+     */
+    private handleWebSocketMessage;
+    private handleBridgeRPC;
+    private isBridgeStream;
+    private translateBridgeStreamEvent;
+    private sendRPCResponse;
+    private sendStreamEvent;
+    private handleChatSend;
+    /**
+     * Map RPC method outcomes to haptic trigger names for iOS feedback.
+     */
+    private resolveHapticTrigger;
+    /**
+     * Broadcast a haptic event to all connected iOS clients.
+     *
+     * Wave 4-AA: per-client send wrapped in try/catch — one bad socket
+     * (closed mid-broadcast, backpressure error, etc.) must not abort the
+     * loop and starve every other connected client. Mirrors the same
+     * resilience pattern already present in broadcastNotification.
+     */
+    broadcastHaptic(trigger: string): void;
+    /**
+     * Broadcast a stream event to all connected clients.
+     *
+     * Wave 4-AA: per-client send wrapped in try/catch — see broadcastHaptic.
+     */
+    broadcastStreamEvent(event: StreamEvent): void;
+    /**
+     * Broadcast a JSON-RPC notification (topic-string `method`) to every
+     * connected WebSocket client. This is the entrypoint used by the
+     * `companion-bridge` (see `src/session/dispatch/companion-bridge.ts`)
+     * to translate UnifiedDispatchPlane events into the iOS-subscribed
+     * topics: `approvals.notify`, `creations.updated`, `cursor.stream`,
+     * `live.activity`, `delivery`, `computer.session.events`, etc.
+     *
+     * Per-client send failures are swallowed so a single bad socket does
+     * not poison the broadcast (matches the behavior of broadcastHaptic /
+     * broadcastStreamEvent).
+     */
+    broadcastNotification(notification: {
+        readonly jsonrpc: "2.0";
+        readonly method: string;
+        readonly params: Readonly<Record<string, unknown>>;
+    }): void;
+    private registerDefaultHandlers;
+}
+/**
+ * Generate a secure session fingerprint for device verification.
+ */
+export declare function generateSessionFingerprint(deviceId: string, timestamp: string): string;
+export {};
+//# sourceMappingURL=companion-server.d.ts.map

package/dist/desktop/companion-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-server.d.ts","sourceRoot":"","sources":["../../src/desktop/companion-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+BH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAI7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;QACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,GAC7D,gBAAgB,CAalB;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAKxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;QACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,UAAU,gBAAgB;IACxB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC;CAC/F;AAED,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,OAAO,GACP,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,GACT,MAAM,GACN,eAAe,GACf,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,aAAa,GACb,UAAU,GACV,OAAO,GACP,eAAe,GACf,SAAS,GACT,WAAW,GACX,MAAM,GAEN,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,MAAM,GACN,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,SAAS,CAAC;AAId,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAS/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;gBAEvC,UAAU,GAAE,MAAU,EAAE,WAAW,CAAC,EAAE,MAAM;IAqBxD,OAAO,CAAC,mBAAmB;IAuC3B;;;OAGG;IACH,sBAAsB,IAAI;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;IAqBD;;;OAGG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,eAAe,CAAC,EAAE,MAAM,GACvB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAgD3D;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IA+C3D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAavC;;OAEG;IACH,gBAAgB,IAAI,SAAS,eAAe,EAAE;IAI9C;;OAEG;IACH,iBAAiB,IAAI,SAAS,cAAc,EAAE;IAI9C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAYtC;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIzD;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAWnC;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;CAGnF;AAID,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAE/D;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAInD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5B;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAuBnE;;OAEG;IACH,UAAU,IAAI,SAAS,MAAM,EAAE;CAGhC;AAED,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AASxE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAKlD,CAAC;AAEH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAE9B,gBAAgB,GAAE,MAAyB;IAIvD;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAalD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,eAAe,GAAG,IAAI;IAWlE,gDAAgD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9B,yEAAyE;IACzE,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAWzC,6FAA6F;IAC7F,IAAI,IAAI,MAAM;CAGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,cAAc,GACpB,eAAe,CASjB;AAID,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA2B;IAC5D,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAA2D;IAC1E,OAAO,CAAC,gBAAgB,CAAiC;IACzD,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IACtE,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAK1B;IACR;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAKzB;gBAEI,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC;IAmEnD;;;;;OAKG;IACH,KAAK,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAiMvC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,uBAAuB;IAyE/B,IAAI,IAAI,IAAI;IA+BZ,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,oBAAoB,EAAE,aAAa,GAAG,IAAI;IAmBrE,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAIpD;;OAEG;IACH,UAAU,IAAI,OAAO,oBAAoB,EAAE,aAAa,GAAG,IAAI;IAI/D,iBAAiB,IAAI,cAAc;IAInC,aAAa,IAAI,mBAAmB;IAIpC,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,iBAAiB,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd;IAOD,mBAAmB,IAAI,uBAAuB;IAG9C,cAAc,IAAI,kBAAkB;IAGpC,cAAc,IAAI,kBAAkB;IAGpC,cAAc,IAAI,kBAAkB;IAGpC,YAAY,IAAI,gBAAgB;IAGhC,mBAAmB,IAAI,uBAAuB;IAG9C,aAAa,IAAI,iBAAiB;IAGlC,eAAe,IAAI,mBAAmB;IAGtC,aAAa,IAAI,iBAAiB;IAIlC,0EAA0E;IAC1E,aAAa,IAAI,cAAc;IAI/B,+EAA+E;IAC/E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7D,mGAAmG;IACnG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI5D;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAEtD,OAAO,CAAC,uBAAuB;IAgB/B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;OAEG;IACH,oBAAoB,IAAI,aAAa,CAAC;QACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;KACtF,CAAC;IAIF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;;OAGG;IACH,mBAAmB,IAAI,aAAa,CAAC;QACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,uBAAuB,CAAC;KACxD,CAAC;IAIF;;;;;;;OAOG;YACW,eAAe;IA2D7B;;;OAGG;YACW,sBAAsB;YAkEtB,eAAe;IAkD7B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,0BAA0B;IAgBlC,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,eAAe;YAIT,cAAc;IA+F5B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;OAOG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAoBtC;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAY9C;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,YAAY,EAAE;QAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACpD,GAAG,IAAI;IAWR,OAAO,CAAC,uBAAuB;CAo1BhC;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAKtF"}