@aitne/daemon 0.1.0

package/dist/services/delegated-task-runtime.d.ts

@@ -0,0 +1,346 @@
+import { type ValidateFunction } from "ajv";
+import { type BackendId, type IntegrationKey } from "@aitne/shared";
+import type { DelegatedToolCost } from "../core/agent-core.js";
+/**
+ * DELEGATED-TASK-MODE-DESIGN.md §5 / §6 / §7 — shared helpers for the
+ * per-backend `runDelegatedTask` implementations. Centralising the prompt
+ * template, allowedTools resolver, destructive list, and Ajv-based
+ * extraction keeps Claude / Gemini paths from drifting on the safety- and
+ * format-critical pieces.
+ *
+ * Cores own:
+ *   - subprocess spawn + stream consumption
+ *   - cost / usage extraction
+ *   - per-backend allowedTools wiring (SDK vs admin TOML)
+ *
+ * This module owns:
+ *   - the system prompt template
+ *   - the schema-size + remote-$ref guards
+ *   - the Ajv validator + retry-eligibility rule (write-class lockout)
+ *   - the result-extraction (fence stripping + parse) pipeline
+ */
+/**
+ * §4.1 task-mode invocation parameters. Hard caps are enforced at the
+ * route boundary against {@link DELEGATED_TASK_HARD_CAPS}; defaults are
+ * filled by the route from `config.delegatedTaskDefault*` if the request
+ * omitted them. By the time params reach this layer, every numeric field
+ * is a concrete number that has passed the validation guards in §4.1.
+ */
+export interface DelegatedTaskParams {
+    integrationKey: IntegrationKey;
+    task: string;
+    outputSchema: Record<string, unknown>;
+    /** Effective max tool calls (clamped to hard cap before this point). */
+    maxToolCalls: number;
+    /** Effective max budget USD (clamped to hard cap before this point). */
+    maxBudgetUsd: number;
+    /** Effective wall-clock timeout ms (clamped to hard cap before this point). */
+    timeoutMs: number;
+    allowDestructive: boolean;
+    /** Resolved model id for the delegated backend (light or heavy tier). */
+    modelId: string;
+    /** Pre-materialized session workdir; cleaned up by the invoker. */
+    sessionDir: string;
+    /** Combined caller / wall-clock abort signal. */
+    abortSignal?: AbortSignal;
+    /** Optional callback the core invokes once per `tool_use` event. */
+    onToolStep?: (step: DelegatedTaskToolStep) => void;
+}
+/**
+ * §11.1 — one entry per `tool_use` / `tool_result` pair. Cores emit these
+ * via `onToolStep` so the invoker can persist a `delegated_task.tool_step`
+ * row without forking the cost-attribution logic.
+ */
+export interface DelegatedTaskToolStep {
+    toolName: string;
+    /** Stringified args (or `null` if unavailable). Args are not hashed here
+     *  — the invoker hashes them before persistence. */
+    toolArgs: unknown;
+    /** Wall-clock duration from `tool_use` to its paired `tool_result`. */
+    durationMs: number;
+    /** "ok" | "error" — connector-reported. Error messages flow via tool-result
+     *  text, not a separate field. */
+    status: "ok" | "error";
+    /** §11.1 — per-call cost where reliably attributable; null otherwise.
+     *  Aggregate truth lives in the header row. */
+    costUsd: number | null;
+    tokensInput: number | null;
+    tokensOutput: number | null;
+}
+export type DelegatedTaskErrorClass = "subprocess_crashed" | "timeout" | "auth_error" | "tool_failed" | "tool_unavailable" | "parse_error" | "schema_violation" | "policy_violation" | "post_write_format_failure" | "loop_aborted" | "budget_exhausted";
+export type DelegatedTaskResult = {
+    ok: true;
+    /** Schema-validated parsed object. */
+    result: unknown;
+    /** True iff the subprocess emitted `{needsConfirmation: true, ...}`. */
+    needsConfirmation: boolean;
+    confirmationPlan: string | null;
+    cost: DelegatedToolCost;
+    trace: DelegatedTaskToolStep[];
+    /** Did the daemon issue the §6.2 single retry? Drives `detail.retried`. */
+    retried: boolean;
+} | {
+    ok: false;
+    errorClass: DelegatedTaskErrorClass;
+    message: string;
+    /** Raw assistant text when the failure was extraction / validation. */
+    raw?: string;
+    cost: DelegatedToolCost;
+    trace: DelegatedTaskToolStep[];
+    retried: boolean;
+};
+/**
+ * §6.4 — JSON Schema with remote `$ref` rejected for security. Local
+ * `#/definitions/*` refs are still allowed; we only reject the http(s)
+ * variant that would let a caller force the validator into a network
+ * fetch (Ajv would error out anyway, but we fail earlier with a clean
+ * error class).
+ */
+export type SchemaCheckResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "too_large" | "remote_ref" | "invalid";
+    message: string;
+};
+/**
+ * Validate the inlined `outputSchema` payload before it touches the
+ * subprocess prompt. Returns `ok: true` only when:
+ *   - serialised UTF-8 size <= {@link DELEGATED_TASK_HARD_CAPS.maxSchemaBytes}
+ *   - no remote `$ref` (`http://` / `https://`)
+ *   - the schema compiles under Ajv Draft-07
+ */
+export declare function checkOutputSchema(schema: unknown): SchemaCheckResult;
+/**
+ * Compile a schema into a reusable Ajv validator. Callers (the route
+ * handler + the runtime extractor) share the validator across the
+ * potential single retry without paying compile twice.
+ */
+export declare function compileSchema(schema: Record<string, unknown>): ValidateFunction;
+/**
+ * §5.1 — render the subprocess system prompt. Inputs:
+ *
+ *   - `task`: caller's natural-language description
+ *   - `outputSchema`: pre-validated by {@link checkOutputSchema}
+ *   - `allowedToolPatterns`: bullet list rendered into the prompt; each
+ *     entry is the namespaced tool name (Claude / Gemini) the SDK or
+ *     admin policy will allow.
+ *   - `destructiveToolNamespaced`: bare destructive set (already
+ *     intersected with the integration's `destructiveTools`); used for
+ *     prose disclosure when `allowDestructive: false`.
+ */
+export declare function buildTaskPrompt(args: {
+    task: string;
+    outputSchema: Record<string, unknown>;
+    allowedToolPatterns: readonly string[];
+    destructiveToolNamespaced: readonly string[];
+    maxToolCalls: number;
+    timeoutMs: number;
+    maxBudgetUsd: number;
+    allowDestructive: boolean;
+}): string;
+/**
+ * §5.2 — resolve the namespaced tool list for a given integration +
+ * delegated backend. Output is the union of every tool in
+ * `connector.capabilityTools` (i.e. every tool the descriptor knows about),
+ * minus the destructive set when `allowDestructive: false`. Caller
+ * subtracts `state.deniedTools` (already glob-expanded) on top.
+ *
+ * The output is ready to feed directly into:
+ *   - Claude SDK `allowedTools`
+ *   - Gemini admin TOML `[[rule]] toolName = "<exact>" decision = "allow"`
+ */
+export declare function resolveAllowedToolPatterns(args: {
+    integrationKey: IntegrationKey;
+    delegatedBackend: BackendId;
+    allowDestructive: boolean;
+    /** Glob-expanded user denylist (bare tool names). */
+    deniedTools: readonly string[];
+}): string[];
+/**
+ * §7.2 — concrete destructive tool names (namespaced) for an integration.
+ * Used by Claude path to remove from `allowedTools` (when
+ * `allowDestructive: false`) AND to emit defense-in-depth `disallowedTools`
+ * entries. Used by Gemini path to emit priority-998 deny rules.
+ */
+export declare function resolveDestructiveToolPatterns(integrationKey: IntegrationKey, delegatedBackend: BackendId): string[];
+/**
+ * §6.2 / §7.4 — true iff the bare tool name (post-namespace, post-Notion
+ * descriptor prefix strip) looks like a read-only operation. Used by the
+ * cores to flip `writeClassToolFired` on every non-read `tool_use` event.
+ *
+ * Notion connectors embed a `notion-` / `notion_` descriptor prefix in
+ * the bare name (`notion-search`, `notion_create_pages`); strip that
+ * prefix before matching the verb regex. Gmail / Calendar bare names do
+ * not have such a prefix and pass through unchanged.
+ */
+export declare function isReadOnlyBareToolName(bare: string): boolean;
+/**
+ * DELEGATED-TASK-MODE-DESIGN.md §4.2 / §6.2 — derive the write-class set
+ * from a Phase 2 `/api/delegated/run` caller's `allowedTools`. The caller
+ * supplies fully-qualified tool patterns (validated against
+ * `MCP_PATTERN_REGEX`), and we have no integration descriptor to consult,
+ * so we apply the same verb-prefix heuristic the Phase 1 path uses, but
+ * scanned across each `_` / `.`-separated segment of the pattern.
+ *
+ * Bias: false-positive (reversible) on the *write-class* side — any
+ * pattern that doesn't surface a recognized read-only verb at a segment
+ * boundary is treated as write-class. Mirror of {@link isReadOnlyBareToolName}'s
+ * stance: false positives cost a missed retry; false negatives would
+ * re-execute a write tool on retry and break §7.4's at-most-once
+ * invariant. Bias toward false-positive write-class.
+ *
+ * Segments are split by `.` and `_` only (not `-`). Hyphens are common
+ * in server names (e.g. `search-server` for a server that does *not*
+ * itself perform searches), and splitting on `-` would falsely tag
+ * `mcp_search-server_send` as read-only. Single-word verbs that happen
+ * to appear inside a hyphenated server identifier therefore stay invisible
+ * to this scan — the safer direction for the retry guard.
+ *
+ * Glob (`*`-suffix) entries are conservatively classified as write-class
+ * because the surface they cover is unknown at request time. Callers
+ * who want the §6.2 retry to fire on read-only tasks should pin exact
+ * tool names with a recognizable verb suffix.
+ */
+export declare function resolveRunWriteClassToolPatterns(allowedTools: readonly string[]): string[];
+/**
+ * §6.2 / §7.4 — namespaced tools that should flip `writeClassToolFired`.
+ * Computed as `allCapabilityTools \ readOnlyTools` for the connector. A
+ * superset of `destructiveTools`: every destructive tool is write-class,
+ * but the reverse is not true (`create_draft`, `update_draft`,
+ * `respond_to_event`, etc. are write-class but reversible).
+ *
+ * Returned unconditionally — the caller passes it to the core regardless
+ * of `allowDestructive`. When `allowDestructive: false`, the destructive
+ * subset is already removed from `allowedTools`, so those entries in the
+ * write-class set will simply never be invoked. Keeping the unconditional
+ * superset makes the behavior symmetric: any tool the model actually
+ * calls that mutates state flips the flag.
+ */
+export declare function resolveWriteClassToolPatterns(integrationKey: IntegrationKey, delegatedBackend: BackendId): string[];
+export type ExtractResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    errorClass: "parse_error" | "schema_violation";
+    message: string;
+    raw: string;
+};
+/**
+ * §6.1 — strip code fences, parse JSON, validate with the pre-compiled
+ * Ajv validator. Caller handles the §6.2 retry decision separately.
+ */
+export declare function extractAndValidateResult(rawText: string, validator: ValidateFunction): ExtractResult;
+/**
+ * §7.2 — when `allowDestructive: false`, the prompt instructs the
+ * subprocess to emit `{needsConfirmation: true, confirmationPlan: "..."}`
+ * INSTEAD of the schema-shaped result. This helper detects that envelope
+ * before schema validation runs (the envelope won't match the user's
+ * schema, so naive validation would surface it as a `schema_violation`).
+ *
+ * Returns the envelope on match, or `null` to fall through to schema
+ * validation.
+ */
+export declare function detectConfirmationEnvelope(parsed: unknown): {
+    plan: string;
+} | null;
+/**
+ * §5.1 prompt failure-mode envelopes — `{error: "tool_unavailable" | ...}`.
+ * Detected after JSON parse and before schema validation so they classify
+ * as the right error class instead of `schema_violation`.
+ */
+export declare function detectErrorEnvelope(parsed: unknown): null | {
+    errorClass: "tool_unavailable" | "tool_failed" | "budget_exhausted";
+    message: string;
+};
+/**
+ * §6.2 — build the single-retry follow-up message. Only fires when the
+ * caller has confirmed no destructive or write-class tool ran during the
+ * task (the invoker tracks this via `state.writeClassToolFired`).
+ */
+export declare function buildRetryFollowup(args: {
+    errorClass: "parse_error" | "schema_violation";
+    message: string;
+}): string;
+/**
+ * Sum a list of step-level costs into the running task header total.
+ * Used by the invoker when the per-step costs are reliably attributable
+ * (single-tool turns); otherwise the header total comes from the
+ * subprocess's terminal usage event and steps record `null`.
+ */
+export declare function sumTraceCosts(trace: readonly DelegatedTaskToolStep[]): {
+    costUsd: number;
+    tokensInput: number;
+    tokensOutput: number;
+};
+/**
+ * §11.1 — hash tool args for telemetry without leaking their contents.
+ * Mirrors `delegated-backend-invoker.ts:hashArgs`.
+ */
+export declare function hashTaskArgs(args: unknown): string;
+/**
+ * DELEGATED-TASK-MODE-DESIGN.md §13 Phase 3.1 — Claude SDK structured-output
+ * envelope. The SDK's `outputFormat: { type: 'json_schema', schema }` makes
+ * the model emit a `structured_output` field on `SDKResultSuccess`, which
+ * the SDK has already validated against the schema (with internal retries).
+ * Cores call `wrapForStructuredOutput` to derive the schema variant they
+ * pass to the SDK.
+ *
+ * Design decision (post-review): pass the **user's schema verbatim**, not
+ * a `oneOf` wrapper that admits the §7.2 confirmation envelope and §5.1
+ * error envelopes. Rationale:
+ *   - The Anthropic structured-output validator is stricter than local
+ *     Ajv. Top-level `oneOf` is unverified to land — if the API rejects
+ *     the schema, every Claude task fails with a 400 before the model
+ *     runs. Empirically this is hard to test without spending real budget,
+ *     so we pick the conservative shape that we know is widely accepted
+ *     (a top-level object schema).
+ *   - When the model wants to emit a confirmation/error envelope, the
+ *     SDK's structured-output retries fail (envelope shape doesn't satisfy
+ *     the user's narrow schema). The SDK then surfaces
+ *     `error_max_structured_output_retries`. Critically, the assistant
+ *     text emissions captured during those retries are still in
+ *     `rawAssistantText`, where the existing text-extract chain
+ *     (`detectConfirmationEnvelope` / `detectErrorEnvelope`) routes them
+ *     correctly. The Claude core does NOT short-circuit on
+ *     `error_max_structured_output_retries` for that reason — it falls
+ *     through to text emission.
+ *   - So Phase 3.1 wins on the success path (zero retries when the model
+ *     happily emits a schema-conforming object) and gracefully degrades
+ *     to text-extract on the rare ambiguous-shape paths.
+ *
+ * `prepareStructuredOutputSchema` therefore returns the user schema
+ * **unmodified** — the function exists so that future shape changes
+ * (e.g. wrapping in a top-level `type: "object"` if the API turns out to
+ * require one) have a single chokepoint to live in. Callers that opt out
+ * of structured output simply pass `undefined`.
+ */
+export declare function prepareStructuredOutputSchema(userSchema: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Backwards-compat alias. Earlier Phase 3.1 drafts used this name and
+ * returned a `oneOf` wrapper; current implementation just returns the
+ * user schema verbatim. Tests and (eventual) external callers can
+ * continue to use this name.
+ */
+export declare const wrapSchemaForStructuredOutput: typeof prepareStructuredOutputSchema;
+/**
+ * §13 Phase 3.1 — classify a `structured_output` value the Claude SDK
+ * already validated against the user's schema. We still:
+ *   1. Detect the §7.2 confirmation envelope and §5.1 error envelopes —
+ *      with the verbatim-schema design these never arrive via
+ *      structured_output (they don't match the user's narrow schema, so
+ *      the SDK exhausts retries and falls back to text). This branch is
+ *      defensive: if a future SDK release admits envelope-shaped output
+ *      via a wrapper schema we haven't tried yet, we still classify it
+ *      correctly.
+ *   2. Re-validate against the user's schema. The SDK has already
+ *      validated, but we treat its `structured_output` as untrusted in
+ *      case of API/version drift.
+ */
+export declare function classifyStructuredOutput(parsed: unknown, validator: ValidateFunction): ExtractResult | {
+    ok: true;
+    value: unknown;
+    envelope: "confirmation" | "error" | "result";
+};
+//# sourceMappingURL=delegated-task-runtime.d.ts.map

package/dist/services/delegated-task-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-task-runtime.d.ts","sourceRoot":"","sources":["../../src/services/delegated-task-runtime.ts"],"names":[],"mappings":"AACA,OAAY,EAAE,KAAK,gBAAgB,EAAwB,MAAM,KAAK,CAAC;AACvE,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AAIH;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;wDACoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB;sCACkC;IAClC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB;mDAC+C;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,SAAS,GACT,YAAY,GACZ,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,kBAAkB,GAClB,kBAAkB,GAClB,2BAA2B,GAC3B,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,MAAM,mBAAmB,GAC3B;IACA,EAAE,EAAE,IAAI,CAAC;IACT,sCAAsC;IACtC,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;CAClB,GACC;IACA,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,EAAE,uBAAuB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAIJ;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,OAAO,GACd,iBAAiB,CAqDnB;AAmBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAI/E;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,MAAM,CA4ET;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,EAAE,SAAS,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC,GAAG,MAAM,EAAE,CAeX;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,cAAc,EAC9B,gBAAgB,EAAE,SAAS,GAC1B,MAAM,EAAE,CAEV;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,EAAE,CAOV;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,cAAc,EAC9B,gBAAgB,EAAE,SAAS,GAC1B,MAAM,EAAE,CAkBV;AAID,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC5B;IACA,EAAE,EAAE,KAAK,CAAC;IACV,UAAU,EAAE,aAAa,GAAG,kBAAkB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEJ;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,gBAAgB,GAC1B,aAAa,CAoCf;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,GACd;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUzB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,GAEb,IAAI,GACJ;IACA,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAAG,kBAAkB,CAAC;IACpE,OAAO,EAAE,MAAM,CAAC;CACjB,CAqBF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,UAAU,EAAE,aAAa,GAAG,kBAAkB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAUA;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CASlD;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,sCAAgC,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,gBAAgB,GAC1B,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,CAqB7F"}