@alneas/eaos-server 0.1.0 → 0.2.0

package/docs/guide.md

@@ -46,3 +46,47 @@ The host supplies verified identity and current lifecycle/resource authorization
 Code installation, database/infrastructure application and tenant activation are separate operations. Import/build/test/install do not perform production migrations or infrastructure updates. Before registry publication, build and test checksum-pinned tarballs in isolated consumers instead of linking sibling source.
 
 See [live entitlements](entitlements.md), [database boundaries](db/docs/guide.md), [lifecycle](lifecycle/docs/guide.md) and [storage](storage/docs/guide.md).
+
+
+## Shared model execution
+
+`@alneas/eaos-server/execution/chat` owns generic chat orchestration and
+`@alneas/eaos-server/execution/tool-agent` owns bounded read-tool orchestration
+and unexecuted write handoffs. Appkit Core 0.2.0 owns HTTP/SSE and Action execution.
+Hosts retain model endpoints, credentials, tool registration, live permission,
+model bindings, budgets and durable accounting. Domain prompts, extraction schemas,
+account mappings and the proposal/approval/save composition belong to plugins.
+
+The built-in LiteLLM worker uses this same chat API with the existing endpoint,
+model and fetch options. `litellmHeaders` supplies Host credentials; `chat` supplies
+shared policies and adapters. Injected executors still run first. Goose/Hermes remain
+process adapters. Worker text output limits remain distinct from serialized stream
+event limits. Optional `runTask` cancellation applies to built-in chat; existing
+process and injected-executor cancellation contracts are unchanged.
+
+LiteLLM requests SSE (`stream: true`). A custom JSON-only endpoint must supply a
+compatible `AIChatAdapter` or an injected executor; no parallel provider parser is
+provided. A configured model registry requires explicit `modelAdapters` bindings
+for its model IDs. Host parameters cannot replace `model`, `messages`, `tools` or
+`stream`. Unknown usage is passed to the existing accounting port for reconciliation;
+Appkit's OpenAI-compatible adapter does not expose provider SSE token-usage fields.
+This integration does not estimate them or silently record zero.
+
+```typescript
+import { createChatClient, type ChatClientOptions } from '@alneas/eaos-server/execution/chat';
+import { createToolAgent, type ToolAgentOptions } from '@alneas/eaos-server/execution/tool-agent';
+
+export function connectChat(options: ChatClientOptions) {
+  return createChatClient(options);
+}
+
+export function connectReadAgent(options: ToolAgentOptions) {
+  return createToolAgent(options);
+}
+```
+
+Read-tool descriptors and retained tool results are reauthorized before model
+disclosure. Write requests remain handoffs to the existing Action/Proposal approval
+path. Provider errors, incomplete streams, cancellation, policy revocation and
+oversized output reject before an authorized response is returned. A transport
+fixture integration test is distinct from a live model/provider acceptance test.

package/docs/index.md

@@ -12,6 +12,8 @@ tags: ["eaos","explanation"]
 
 # Server execution and persistence
 
+[![TypeScript](https://img.shields.io/badge/TypeScript-3178C6?style=flat&logo=typescript&logoColor=white)](https://www.typescriptlang.org/docs/) [![Node.js minimum 24](https://img.shields.io/badge/Node.js-%3E%3D24-339933?style=flat&logo=nodedotjs&logoColor=white)](https://nodejs.org/en/about/previous-releases) [![Hono](https://img.shields.io/badge/Hono-E36002?style=flat&logo=hono&logoColor=white)](https://hono.dev/docs/)
+
 ## Elevator Pitch
 
 Host developers use Server to compose HTTP/MCP, lifecycle and durable data services.
@@ -29,14 +31,14 @@ Shared implementations keep authorization, CAS, audit and Outbox consistent. The
 
 ## Quickstart
 
-Registry installation requires a published release. During pre-publication development, install the checksum-pinned tarballs produced by the workspace build instead of assuming these names exist in a registry.
+This checkout prepares version 0.2.0; version 0.1.0 is already published. Until 0.2.0 is published, install the checksum-pinned candidate tarball. The command below applies after that release.
 
 ### Public import
 
 Use Node.js 24 or later and the required Appkit Core 0.2.0 peer. The canonicalization example is pure and needs no database connection or credentials. Server execution later requires host-owned identity, authorization and persistence bindings. The subpath is an import target, not a separately installed package.
 
 ```bash
-bun add @alneas/eaos-server @alneas/appkit-core@0.2.0
+bun add @alneas/eaos-server@0.2.0 @alneas/appkit-core@0.2.0
 ```
 
 ```typescript
@@ -51,3 +53,5 @@ console.log(canonical({ format: 1, operation: 'inspect' }))
 - [Architecture and boundaries](guide.md)
 - [API reference](api.md)
 - [EAOS composition](https://tech-docs.alneas.com/eaos-workspace/architecture/)
+
+Questions and issue reports in English are welcome in [GitHub Issues](https://github.com/dataarthub/eaos/issues). Private vulnerability reports can use [GitHub private reporting](https://github.com/dataarthub/eaos/security/advisories/new).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alneas/eaos-server",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "license": "MIT",
   "description": "EAOS server public package",
@@ -296,19 +296,28 @@
     "./plugin-sdk": {
       "types": "./dist/plugin-sdk.d.ts",
       "import": "./dist/plugin-sdk.js"
+    },
+    "./execution/chat": {
+      "types": "./dist/execution/chat.d.ts",
+      "import": "./dist/execution/chat.js"
+    },
+    "./execution/tool-agent": {
+      "types": "./dist/execution/tool-agent.d.ts",
+      "import": "./dist/execution/tool-agent.js"
     }
   },
   "files": [
     "dist",
     "docs",
     "README.md",
+    "README.ja.md",
     "LICENSE",
     "CHANGELOG.md",
     "README.ja.md"
   ],
   "scripts": {
     "build": "tsup",
-    "test": "bun test"
+    "test": "node ../../scripts/run-source-tests.mjs"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -325,7 +334,7 @@
     "@alneas/appkit-core": "0.2.0"
   },
   "dependencies": {
-    "@alneas/eaos-core": "^0.1.0",
+    "@alneas/eaos-core": "^0.2.0",
     "semver": "^7.8.5",
     "hono": "^4.13.13",
     "ajv": "^8.20.0",

package/dist/chunk-THYUY5ZZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/agentic/autonomous-worker.ts"],"sourcesContent":["import { defaultRuntimePlacementPolicy, McpGatekeeper, type AgentRuntimeResourcePolicy } from '@alneas/eaos-core'\nimport { ServerAgentExecutionError, type ServerAgentExecutor, type ServerAgentTaskRequest, type ServerAgentTaskResult, type ServerAgentWorkerType } from './types'\nimport { randomUUID } from 'node:crypto'\nimport { createCommandAgentExecutor, validateAgentRuntimePolicy } from './executor'\n\n/**\n * Trusted gatekeeper, runtime endpoints/adapters, and execution limits for {@link ServerAutonomousWorker}.\n */\nexport interface ServerWorkerOptions {\n  /** Host security/approval policies; defaults to a new McpGatekeeper. */\n  gatekeeper?: McpGatekeeper\n  /** Trusted executable path; defaults to GOOSE_BIN_PATH or goose. */\n  gooseBinaryPath?: string\n  /** Trusted executable path; defaults to HERMES_AGENT_BIN_PATH or hermes. */\n  hermesAgentBinaryPath?: string\n  /** Host LiteLLM base URL; defaults to LITELLM_ENDPOINT or http://localhost:4000/v1. */\n  litellmEndpoint?: string\n  /** Host model identifier; defaults to LITELLM_MODEL and is required for built-in LiteLLM execution. */\n  litellmModel?: string\n  /** Combined command output/string result ceiling, safe integer 1–10000000; defaults to 1000000. */\n  maxOutputChars?: number\n  /** Framework default is safe for the ARM agent host. Host adapters may tighten it. */\n  runtimePolicy?: AgentRuntimeResourcePolicy\n  /** Built-in Goose/Hermes execution is permitted only on the AI placement. */\n  runtimeRole?: ServerRuntimeRole\n  /** Host fetch implementation for built-in LiteLLM; defaults to global fetch. */\n  fetch?: typeof fetch\n  /** Host/plugin adapters for coding agents and other external runtimes. */\n  executors?: Partial<Record<ServerAgentWorkerType, ServerAgentExecutor>>\n}\n\n/**\n * Host placement role controlling whether built-in Goose/Hermes processes may run locally.\n * @see ServerAutonomousWorker.\n */\nexport type ServerRuntimeRole = 'edge' | 'application-worker' | 'ai'\n\nfunction inferRuntimeRole(): ServerRuntimeRole {\n  const configured = process.env.EAOS_RUNTIME_ROLE\n  if (configured === 'edge' || configured === 'application-worker' || configured === 'ai') return configured\n  // The supported three-host topology places the AI runtime on the ARM host.\n  // Unknown x64 hosts therefore fail closed as application-worker hosts.\n  return process.arch === 'arm64' ? 'ai' : 'application-worker'\n}\n\n/**\n * Admits and executes host agent tasks through a gatekeeper and bounded runtime adapters.\n * @remarks This class runs only when runTask is called; it installs no scheduler. The host authenticates tenant/user claims before admission. Framework-managed tasks share a per-instance concurrency counter; injected executors own scheduling and are exempt from it. Built-in Goose/Hermes require the ai role and Node process/systemd support. Queue persistence, approvals, retries, and side-effect idempotency belong to the host.\n * @example\n * ```typescript\n * import { ServerAutonomousWorker, type ServerWorkerOptions } from \"@alneas/eaos-server/agentic/autonomous-worker\";\n * export function worker(options: ServerWorkerOptions) { return new ServerAutonomousWorker(options); }\n * ```\n */\nexport class ServerAutonomousWorker {\n  private gatekeeper: McpGatekeeper\n  private goosePath: string\n  private hermesAgentPath: string\n  private litellmUrl: string\n  private litellmModel?: string\n  private maxOutputChars: number\n  private runtimePolicy: AgentRuntimeResourcePolicy\n  private runtimeRole: ServerRuntimeRole\n  private activeTasks = 0\n  private fetchImpl: typeof fetch\n  private executors: Partial<Record<ServerAgentWorkerType, ServerAgentExecutor>>\n\n  /**\n   * Captures runtime settings and validates resource policy, role, and output ceiling.\n   * @param options - Trusted host configuration; omitted gatekeeper uses a new McpGatekeeper and runtime role uses EAOS_RUNTIME_ROLE, then ai on arm64 or application-worker otherwise.\n   * @throws Invalid resource policy, role, or output limit.\n   */\n  constructor(options?: ServerWorkerOptions) {\n    this.gatekeeper = options?.gatekeeper || new McpGatekeeper()\n    this.goosePath = options?.gooseBinaryPath || process.env.GOOSE_BIN_PATH || 'goose'\n    this.hermesAgentPath = options?.hermesAgentBinaryPath || process.env.HERMES_AGENT_BIN_PATH || 'hermes'\n    this.litellmUrl = options?.litellmEndpoint || process.env.LITELLM_ENDPOINT || 'http://localhost:4000/v1'\n    this.litellmModel = options?.litellmModel || process.env.LITELLM_MODEL\n    this.maxOutputChars = options?.maxOutputChars ?? 1_000_000\n    this.runtimePolicy = validateAgentRuntimePolicy(options?.runtimePolicy || defaultRuntimePlacementPolicy().ai.agentRuntime)\n    this.runtimeRole = options?.runtimeRole || inferRuntimeRole()\n    if (!['edge', 'application-worker', 'ai'].includes(this.runtimeRole)) throw new Error('Invalid agent runtime role')\n    this.fetchImpl = options?.fetch || fetch\n    this.executors = options?.executors || {}\n    if (!Number.isSafeInteger(this.maxOutputChars) || this.maxOutputChars < 1 || this.maxOutputChars > 10_000_000) throw new Error('Invalid worker output limit')\n  }\n\n  /**\n   * Checks task limits and gatekeeper policy before dispatching one runtime attempt.\n   * @param request - Verified task identity and instructions; required strings must be nonblank, title at most 500 characters, instructions at most 1000000, and timeout a safe integer 1–3600000 milliseconds when provided.\n   * @returns COMPLETED text output, PENDING_APPROVAL ticket data without execution, or FAILED data with error and optional classification/retry advice. Duration is measured in wall-clock milliseconds.\n   * @throws Can reject a throwing gatekeeper or malformed gatekeeper interaction before dispatch; runtime execution errors are normally returned as FAILED data.\n   * @remarks Gatekeeper receives fixed agent/server_bot roles rather than request user roles. Approval tickets are generated but not persisted here. The configured framework policy overrides request.runtimePolicy before execution. Injected executors and built-in LiteLLM outputs are bounded by maxOutputChars; LiteLLM response bodies are parsed before text length is checked.\n   * @example\n   * ```typescript\n   * import { ServerAutonomousWorker, type ServerWorkerOptions } from \"@alneas/eaos-server/agentic/autonomous-worker\";\n   * import type { ServerAgentTaskRequest } from \"@alneas/eaos-server/agentic/types\";\n   * export async function execute(options: ServerWorkerOptions, request: ServerAgentTaskRequest) {\n   *   return new ServerAutonomousWorker(options).runTask(request);\n   * }\n   * ```\n   */\n  async runTask(request: ServerAgentTaskRequest): Promise<ServerAgentTaskResult> {\n    const startTime = Date.now()\n\n    if (!request || [request.id, request.tenantId, request.userId, request.title, request.instructions].some(value => typeof value !== 'string' || !value.trim())) {\n      return { taskId: typeof request?.id === 'string' ? request.id : 'unknown', status: 'FAILED', error: 'Invalid agent task request', durationMs: Date.now() - startTime }\n    }\n    if (request.instructions.length > 1_000_000 || request.title.length > 500 || request.timeoutMs !== undefined && (!Number.isSafeInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > 3_600_000)) {\n      return { taskId: request.id, status: 'FAILED', error: 'Agent task exceeds configured limits', durationMs: Date.now() - startTime }\n    }\n\n    // 1. Evaluate security and gatekeeper policies\n    const policy = this.gatekeeper.validateCall({\n      toolName: `server_agent_${request.workerType}`,\n      userRoles: ['agent', 'server_bot'],\n      tenantId: request.tenantId,\n    })\n\n    if (!policy.allowed) {\n      return {\n        taskId: request.id,\n        status: 'FAILED',\n        error: `Task execution blocked by security policy: ${policy.reason}`,\n        riskLevel: policy.riskLevel,\n        durationMs: Date.now() - startTime,\n      }\n    }\n\n    if (policy.requireHumanApproval) {\n      return {\n        taskId: request.id,\n        status: 'PENDING_APPROVAL',\n        approvalTicketId: randomUUID(),\n        approvalLevel: policy.approvalLevel,\n        riskLevel: policy.riskLevel,\n        durationMs: Date.now() - startTime,\n      }\n    }\n\n    // Explicitly injected executors are host-owned adapters and may implement\n    // their own queue/scheduler. The framework-managed Goose/Hermes path is\n    // bounded by the default policy so a forgotten host setting cannot create\n    // unbounded local agent concurrency.\n    const frameworkManaged = !this.executors[request.workerType]\n    if (frameworkManaged && (request.workerType === 'goose' || request.workerType === 'hermes_agent') && this.runtimeRole !== 'ai') {\n      return {\n        taskId: request.id,\n        status: 'FAILED',\n        error: `Built-in ${request.workerType} execution is restricted to the AI runtime placement`,\n        failureCode: 'AGENT_UNAVAILABLE',\n        retryable: true,\n        durationMs: Date.now() - startTime,\n      }\n    }\n    if (frameworkManaged && this.activeTasks >= this.runtimePolicy.maxConcurrent) {\n      return {\n        taskId: request.id,\n        status: 'FAILED',\n        error: 'Agent runtime concurrency limit reached',\n        failureCode: 'AGENT_UNAVAILABLE',\n        retryable: true,\n        durationMs: Date.now() - startTime,\n      }\n    }\n\n    // 2. Dispatch according to worker type\n    if (frameworkManaged) this.activeTasks += 1\n    try {\n      const output = await this.execute({ ...structuredClone(request), runtimePolicy: structuredClone(this.runtimePolicy) })\n      return {\n        taskId: request.id,\n        status: 'COMPLETED',\n        output,\n        durationMs: Date.now() - startTime,\n      }\n    } catch (err) {\n      return {\n        taskId: request.id,\n        status: 'FAILED',\n        error: (err as Error).message,\n        ...(err instanceof ServerAgentExecutionError ? { failureCode: err.failureCode, retryable: err.retryable } : {}),\n        durationMs: Date.now() - startTime,\n      }\n    } finally {\n      if (frameworkManaged) this.activeTasks -= 1\n    }\n  }\n\n  private async execute(request: ServerAgentTaskRequest): Promise<string> {\n    const injected = this.executors[request.workerType]\n    if (injected) return this.boundOutput(await injected(structuredClone(request)))\n    if (request.workerType === 'goose') return this.executeHeadlessGoose(request)\n    if (request.workerType === 'hermes_agent') return this.executeHeadlessHermesAgent(request)\n    if (request.workerType === 'litellm') return this.executeLiteLlm(request)\n    throw new Error(`No executor configured for worker type '${request.workerType}'`)\n  }\n\n  /**\n   * Execute Goose in headless batch mode\n   */\n  private async executeHeadlessGoose(request: ServerAgentTaskRequest): Promise<string> {\n    return createCommandAgentExecutor({\n      command: this.goosePath,\n      buildArgs: task => ['run', '--text', task.instructions],\n      includeProcessEnv: true,\n      maxOutputChars: this.maxOutputChars,\n      sandbox: { mode: 'auto', policy: this.runtimePolicy },\n    })(request)\n  }\n\n  /**\n   * Execute NousResearch Hermes Agent in headless mode (-z / non-interactive)\n   * Hermes Agent provides persistent cross-session memory and self-improving skill extraction.\n   */\n  private async executeHeadlessHermesAgent(request: ServerAgentTaskRequest): Promise<string> {\n    return createCommandAgentExecutor({\n      command: this.hermesAgentPath,\n      buildArgs: task => ['run', '-z', task.instructions],\n      includeProcessEnv: true,\n      maxOutputChars: this.maxOutputChars,\n      sandbox: { mode: 'auto', policy: this.runtimePolicy },\n    })(request)\n  }\n\n  /**\n   * Execute a host-selected model through LiteLLM.\n   */\n  private async executeLiteLlm(request: ServerAgentTaskRequest): Promise<string> {\n    if (!this.litellmModel) throw new Error('LiteLLM model is not configured')\n    const endpoint = new URL(this.litellmUrl)\n    if (!['http:', 'https:'].includes(endpoint.protocol)) throw new Error('Invalid LiteLLM endpoint')\n    endpoint.pathname = `${endpoint.pathname.replace(/\\/$/, '')}/chat/completions`\n    const response = await this.fetchImpl(endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        model: this.litellmModel,\n        messages: [{ role: 'user', content: request.instructions }],\n        metadata: { tenantId: request.tenantId, taskId: request.id },\n      }),\n      signal: AbortSignal.timeout(request.timeoutMs ?? 60_000),\n      redirect: 'error',\n    })\n    if (!response.ok) throw new Error(`LiteLLM request failed (${response.status})`)\n    const body = await response.json() as { choices?: Array<{ message?: { content?: unknown } }> }\n    const output = body.choices?.[0]?.message?.content\n    if (typeof output !== 'string') throw new Error('LiteLLM returned no assistant content')\n    return this.boundOutput(output)\n  }\n\n  private boundOutput(output: string): string {\n    if (output.length > this.maxOutputChars) throw new Error('Agent output exceeds configured limit')\n    return output\n  }\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,+BAA+B,qBAAsD;AAE9F,SAAS,kBAAkB;AAmC3B,SAAS,mBAAsC;AAC7C,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,eAAe,UAAU,eAAe,wBAAwB,eAAe,KAAM,QAAO;AAGhG,SAAO,QAAQ,SAAS,UAAU,OAAO;AAC3C;AAWO,IAAM,yBAAN,MAA6B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,YAAY,SAA+B;AACzC,SAAK,aAAa,SAAS,cAAc,IAAI,cAAc;AAC3D,SAAK,YAAY,SAAS,mBAAmB,QAAQ,IAAI,kBAAkB;AAC3E,SAAK,kBAAkB,SAAS,yBAAyB,QAAQ,IAAI,yBAAyB;AAC9F,SAAK,aAAa,SAAS,mBAAmB,QAAQ,IAAI,oBAAoB;AAC9E,SAAK,eAAe,SAAS,gBAAgB,QAAQ,IAAI;AACzD,SAAK,iBAAiB,SAAS,kBAAkB;AACjD,SAAK,gBAAgB,2BAA2B,SAAS,iBAAiB,8BAA8B,EAAE,GAAG,YAAY;AACzH,SAAK,cAAc,SAAS,eAAe,iBAAiB;AAC5D,QAAI,CAAC,CAAC,QAAQ,sBAAsB,IAAI,EAAE,SAAS,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AAClH,SAAK,YAAY,SAAS,SAAS;AACnC,SAAK,YAAY,SAAS,aAAa,CAAC;AACxC,QAAI,CAAC,OAAO,cAAc,KAAK,cAAc,KAAK,KAAK,iBAAiB,KAAK,KAAK,iBAAiB,IAAY,OAAM,IAAI,MAAM,6BAA6B;AAAA,EAC9J;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,QAAQ,SAAiE;AAC7E,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,EAAE,KAAK,WAAS,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,CAAC,GAAG;AAC7J,aAAO,EAAE,QAAQ,OAAO,SAAS,OAAO,WAAW,QAAQ,KAAK,WAAW,QAAQ,UAAU,OAAO,8BAA8B,YAAY,KAAK,IAAI,IAAI,UAAU;AAAA,IACvK;AACA,QAAI,QAAQ,aAAa,SAAS,OAAa,QAAQ,MAAM,SAAS,OAAO,QAAQ,cAAc,WAAc,CAAC,OAAO,cAAc,QAAQ,SAAS,KAAK,QAAQ,YAAY,KAAK,QAAQ,YAAY,OAAY;AACpN,aAAO,EAAE,QAAQ,QAAQ,IAAI,QAAQ,UAAU,OAAO,wCAAwC,YAAY,KAAK,IAAI,IAAI,UAAU;AAAA,IACnI;AAGA,UAAM,SAAS,KAAK,WAAW,aAAa;AAAA,MAC1C,UAAU,gBAAgB,QAAQ,UAAU;AAAA,MAC5C,WAAW,CAAC,SAAS,YAAY;AAAA,MACjC,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,OAAO,8CAA8C,OAAO,MAAM;AAAA,QAClE,WAAW,OAAO;AAAA,QAClB,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,OAAO,sBAAsB;AAC/B,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,kBAAkB,WAAW;AAAA,QAC7B,eAAe,OAAO;AAAA,QACtB,WAAW,OAAO;AAAA,QAClB,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF;AAMA,UAAM,mBAAmB,CAAC,KAAK,UAAU,QAAQ,UAAU;AAC3D,QAAI,qBAAqB,QAAQ,eAAe,WAAW,QAAQ,eAAe,mBAAmB,KAAK,gBAAgB,MAAM;AAC9H,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,OAAO,YAAY,QAAQ,UAAU;AAAA,QACrC,aAAa;AAAA,QACb,WAAW;AAAA,QACX,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,QAAI,oBAAoB,KAAK,eAAe,KAAK,cAAc,eAAe;AAC5E,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb,WAAW;AAAA,QACX,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF;AAGA,QAAI,iBAAkB,MAAK,eAAe;AAC1C,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,QAAQ,EAAE,GAAG,gBAAgB,OAAO,GAAG,eAAe,gBAAgB,KAAK,aAAa,EAAE,CAAC;AACrH,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,OAAQ,IAAc;AAAA,QACtB,GAAI,eAAe,4BAA4B,EAAE,aAAa,IAAI,aAAa,WAAW,IAAI,UAAU,IAAI,CAAC;AAAA,QAC7G,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,UAAI,iBAAkB,MAAK,eAAe;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,SAAkD;AACtE,UAAM,WAAW,KAAK,UAAU,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO,KAAK,YAAY,MAAM,SAAS,gBAAgB,OAAO,CAAC,CAAC;AAC9E,QAAI,QAAQ,eAAe,QAAS,QAAO,KAAK,qBAAqB,OAAO;AAC5E,QAAI,QAAQ,eAAe,eAAgB,QAAO,KAAK,2BAA2B,OAAO;AACzF,QAAI,QAAQ,eAAe,UAAW,QAAO,KAAK,eAAe,OAAO;AACxE,UAAM,IAAI,MAAM,2CAA2C,QAAQ,UAAU,GAAG;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBAAqB,SAAkD;AACnF,WAAO,2BAA2B;AAAA,MAChC,SAAS,KAAK;AAAA,MACd,WAAW,UAAQ,CAAC,OAAO,UAAU,KAAK,YAAY;AAAA,MACtD,mBAAmB;AAAA,MACnB,gBAAgB,KAAK;AAAA,MACrB,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,cAAc;AAAA,IACtD,CAAC,EAAE,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,2BAA2B,SAAkD;AACzF,WAAO,2BAA2B;AAAA,MAChC,SAAS,KAAK;AAAA,MACd,WAAW,UAAQ,CAAC,OAAO,MAAM,KAAK,YAAY;AAAA,MAClD,mBAAmB;AAAA,MACnB,gBAAgB,KAAK;AAAA,MACrB,SAAS,EAAE,MAAM,QAAQ,QAAQ,KAAK,cAAc;AAAA,IACtD,CAAC,EAAE,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAe,SAAkD;AAC7E,QAAI,CAAC,KAAK,aAAc,OAAM,IAAI,MAAM,iCAAiC;AACzE,UAAM,WAAW,IAAI,IAAI,KAAK,UAAU;AACxC,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,0BAA0B;AAChG,aAAS,WAAW,GAAG,SAAS,SAAS,QAAQ,OAAO,EAAE,CAAC;AAC3D,UAAM,WAAW,MAAM,KAAK,UAAU,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,KAAK;AAAA,QACZ,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,aAAa,CAAC;AAAA,QAC1D,UAAU,EAAE,UAAU,QAAQ,UAAU,QAAQ,QAAQ,GAAG;AAAA,MAC7D,CAAC;AAAA,MACD,QAAQ,YAAY,QAAQ,QAAQ,aAAa,GAAM;AAAA,MACvD,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,2BAA2B,SAAS,MAAM,GAAG;AAC/E,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,SAAS,KAAK,UAAU,CAAC,GAAG,SAAS;AAC3C,QAAI,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACvF,WAAO,KAAK,YAAY,MAAM;AAAA,EAChC;AAAA,EAEQ,YAAY,QAAwB;AAC1C,QAAI,OAAO,SAAS,KAAK,eAAgB,OAAM,IAAI,MAAM,uCAAuC;AAChG,WAAO;AAAA,EACT;AACF;","names":[]}