@deepseek-harness-tui/dsh-tui 0.14.1 → 0.16.0

package/lib/types/dsh-adapter/plugin-guard.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The host layer this application's composition is stacked on: it provides the
+ * services the TUI cannot start without, and it carries the manager row that
+ * owns every patch write. Removing or disabling it is the indirect form of
+ * self-destruction.
+ */
+export declare const HOST_BUNDLE = "@deepseek-ai/dsh-base";
+/**
+ * The bundles gate 2 refuses to `remove` / `disable`: the one providing this
+ * application, then the host layer it runs on — display order.
+ *
+ * The first entry is imported rather than spelled again, so the package this
+ * application is cannot drift from its own name. The list stays short on
+ * purpose: it is the *core*, and every host layer row stays a legitimate thing
+ * for a person to switch off (`/plugin disable tool-web` is a supported form).
+ * `verify-plugin-guard.ts` pins the exact length, so widening the core is a
+ * deliberate change somebody has to explain.
+ */
+export declare const CORE_BUNDLES: readonly ["@deepseek-harness-tui/dsh-tui", "@deepseek-ai/dsh-base"];
+/**
+ * The module-name prefix of the rows this application itself provides. A row
+ * whose module is this package, or a subpath of it, is what draws the UI a
+ * person is looking at; disabling it from that UI is the row-level suicide.
+ *
+ * This is half of the row rule, and the smaller half. Measured on a real
+ * profile (2026-10-14, `dsh --profile dsh-tui --dump-config`): this bundle's
+ * patch inserts **17** rows, and **8** of them load a first-party
+ * `@deepseek-ai/*` module — the composition's own storage, workspace,
+ * code-runtime, agent-presets, cordis-host-runner and webserver seams. Only one
+ * of those eight (`@deepseek-ai/dsh-host-webserver`) is on the host's own
+ * protected list, and it is the only reason the host reports this bundle as
+ * locked at all. The other seven rows are reported as perfectly addressable, so
+ * a module-name rule cannot see them: {@link PluginGuardTarget} carries
+ * `ownRow` for those, read from the same snapshot as everything else.
+ */
+export declare const CORE_ROW_PREFIX = "@deepseek-harness-tui/dsh-tui";
+/** The three lifecycle actions a person can ask for. */
+export type PluginGuardAction = 'remove' | 'enable' | 'disable';
+/**
+ * One target, reduced to what the decision reads. Both shapes are structural:
+ * the caller passes what the host reported (a `BundleInfo` / `PluginInfo`),
+ * and a regression can pass a literal.
+ */
+export type PluginGuardTarget = {
+    readonly kind: 'bundle';
+    readonly name: string;
+    readonly removable: boolean;
+    /**
+     * The host already locked this bundle (`management-required` /
+     * unaddressable). Present means the host refuses both directions, so this
+     * predicate refuses without naming a rule of its own.
+     */
+    readonly readOnlyReason?: string | undefined;
+} | {
+    readonly kind: 'row';
+    readonly entryId: string;
+    readonly moduleName: string;
+    /** The patch row this entry is addressable as; absent means unaddressable. */
+    readonly patchId?: string | undefined;
+    /**
+     * Whether this application's own patch inserts the row: `patchId` is one of
+     * the rows {@link CORE_BUNDLES}[0] reports. The caller reads it off the same
+     * snapshot it resolved the target from, because a row of ours may load a
+     * first-party module and so carry no name this predicate could recognize —
+     * see {@link CORE_ROW_PREFIX}. Absent means "not known to be ours", which
+     * leaves the module-name rule as the only one that applies.
+     */
+    readonly ownRow?: boolean | undefined;
+    /** As on a bundle: the host's own lock, reported rather than re-derived. */
+    readonly readOnlyReason?: string | undefined;
+};
+/**
+ * Why gate 2 refused. Every value is a statement about *this* application, so
+ * the caller can turn it into a reason line and a repair hint.
+ */
+export type PluginGuardRefusal = 
+/** The host locked the target; neither direction is ours to take. */
+'service-locked'
+/** The target bundle provides this application. */
+ | 'app-bundle'
+/** The target bundle is the host layer this application is stacked on. */
+ | 'host-bundle'
+/** The host reports the bundle as not removable (installed by the launcher). */
+ | 'not-removable'
+/** A single row is never removed on its own; it goes with its bundle. */
+ | 'row-not-removable'
+/**
+ * The row is this application's own: either its module is this package's, or
+ * this application's patch inserts it. Disabling it takes part of the
+ * interface down with it.
+ */
+ | 'app-row';
+export type PluginGuardVerdict = {
+    readonly kind: 'refused';
+    readonly reason: PluginGuardRefusal;
+} | {
+    readonly kind: 'allowed';
+};
+/**
+ * Decide one action against one target. Refusals are checked before anything
+ * else can allow: the first matching rule wins, and the shape of the function
+ * is fail-closed throughout — an unrecognized target is a bundle only when it
+ * says so, and every branch that is not an explicit refusal is not an
+ * authorization either.
+ *
+ * `enable` is deliberately absent from the core rules. Gate 2 stops a person
+ * from killing the application they are using; switching a composition layer
+ * or a row back on is the *repair* for having killed it — refusing that would
+ * seal off the only in-UI way back from a profile somebody edited by hand.
+ * The host's own lock is the exception that proves the rule: it refuses both
+ * directions there, and this predicate reports that as `service-locked`
+ * instead of pretending it could go either way.
+ */
+export declare function pluginGuardVerdict(target: PluginGuardTarget, action: PluginGuardAction): PluginGuardVerdict;
+//# sourceMappingURL=plugin-guard.d.ts.map

package/lib/types/dsh-adapter/plugin-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin-guard.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0BAA0B,CAAA;AAElD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,qEAA8C,CAAA;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,kCAAsB,CAAA;AAElD,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE/D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC7C,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC7C,CAAA;AAEH;;;GAGG;AACH,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE,gBAAgB;AAClB,mDAAmD;GACjD,YAAY;AACd,0EAA0E;GACxE,aAAa;AACf,gFAAgF;GAC9E,eAAe;AACjB,yEAAyE;GACvE,mBAAmB;AACrB;;;;GAIG;GACD,SAAS,CAAA;AAEb,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAOhC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,kBAAkB,CAe3G"}

package/lib/types/dsh-adapter/plugin-guard.js

@@ -0,0 +1,108 @@
+/**
+ * Gate 2: what this application refuses to change in its own profile, and why
+ * (Stage C-5).
+ *
+ * The host's plugin manager protects a hardcoded list of first-party module
+ * names, plus the bundle that inserted the manager itself. This package is
+ * neither: its rows are named `@deepseek-harness-tui/dsh-tui` and friends, so
+ * the host reports them as perfectly addressable and will switch them off on
+ * request — `/plugin disable dsh-tui` would take the running TUI layer down
+ * mid-session. The manager's own `stop-profile` guard does not stand in the
+ * way either: it only throws when no HMR service is mounted, and this profile
+ * runs `patchReload: live`. So this predicate is the only line that holds.
+ *
+ * Three properties are deliberate:
+ *
+ * - **It is pure.** No `ctx`, no service call, no file read — the caller reads
+ *   one `listBundles()` / `listPlugins()` snapshot and hands the record in. A
+ *   guard that had to ask the world would be as fallible as the world.
+ * - **It never reads HMR.** The refusal has to hold on the `live` path (the one
+ *   the host's own guard misses), so the question "is hot reload on?" must not
+ *   be able to change the answer. `verify-plugin-guard.ts` asserts this on the
+ *   source text, because a promise in a comment is not a fact.
+ * - **Refusal is not greying out.** A refusal carries the rule it broke, and
+ *   the caller prints it as a reason line and makes no service call at all
+ *   (the `plugins-manage-refused-*` family).
+ *
+ * What gate 2 does *not* do: authorize. An `allowed` verdict means this
+ * predicate has no objection, not that the action proceeds without asking —
+ * confirmation is the flow's decision: every enable or removal asks, as does
+ * disabling a host-layer row.
+ */
+import { COMPOSITION_PACKAGE } from './plugin-declaration.js';
+/**
+ * The host layer this application's composition is stacked on: it provides the
+ * services the TUI cannot start without, and it carries the manager row that
+ * owns every patch write. Removing or disabling it is the indirect form of
+ * self-destruction.
+ */
+export const HOST_BUNDLE = '@deepseek-ai/dsh-base';
+/**
+ * The bundles gate 2 refuses to `remove` / `disable`: the one providing this
+ * application, then the host layer it runs on — display order.
+ *
+ * The first entry is imported rather than spelled again, so the package this
+ * application is cannot drift from its own name. The list stays short on
+ * purpose: it is the *core*, and every host layer row stays a legitimate thing
+ * for a person to switch off (`/plugin disable tool-web` is a supported form).
+ * `verify-plugin-guard.ts` pins the exact length, so widening the core is a
+ * deliberate change somebody has to explain.
+ */
+export const CORE_BUNDLES = [COMPOSITION_PACKAGE, HOST_BUNDLE];
+/**
+ * The module-name prefix of the rows this application itself provides. A row
+ * whose module is this package, or a subpath of it, is what draws the UI a
+ * person is looking at; disabling it from that UI is the row-level suicide.
+ *
+ * This is half of the row rule, and the smaller half. Measured on a real
+ * profile (2026-10-14, `dsh --profile dsh-tui --dump-config`): this bundle's
+ * patch inserts **17** rows, and **8** of them load a first-party
+ * `@deepseek-ai/*` module — the composition's own storage, workspace,
+ * code-runtime, agent-presets, cordis-host-runner and webserver seams. Only one
+ * of those eight (`@deepseek-ai/dsh-host-webserver`) is on the host's own
+ * protected list, and it is the only reason the host reports this bundle as
+ * locked at all. The other seven rows are reported as perfectly addressable, so
+ * a module-name rule cannot see them: {@link PluginGuardTarget} carries
+ * `ownRow` for those, read from the same snapshot as everything else.
+ */
+export const CORE_ROW_PREFIX = COMPOSITION_PACKAGE;
+/** Whether a module name is this package's, or a subpath of it. */
+function isCoreRowModule(moduleName) {
+    return moduleName === CORE_ROW_PREFIX || moduleName.startsWith(`${CORE_ROW_PREFIX}/`);
+}
+/**
+ * Decide one action against one target. Refusals are checked before anything
+ * else can allow: the first matching rule wins, and the shape of the function
+ * is fail-closed throughout — an unrecognized target is a bundle only when it
+ * says so, and every branch that is not an explicit refusal is not an
+ * authorization either.
+ *
+ * `enable` is deliberately absent from the core rules. Gate 2 stops a person
+ * from killing the application they are using; switching a composition layer
+ * or a row back on is the *repair* for having killed it — refusing that would
+ * seal off the only in-UI way back from a profile somebody edited by hand.
+ * The host's own lock is the exception that proves the rule: it refuses both
+ * directions there, and this predicate reports that as `service-locked`
+ * instead of pretending it could go either way.
+ */
+export function pluginGuardVerdict(target, action) {
+    if (target.readOnlyReason !== undefined)
+        return { kind: 'refused', reason: 'service-locked' };
+    if (target.kind === 'bundle') {
+        if (action !== 'enable') {
+            if (target.name === CORE_BUNDLES[0])
+                return { kind: 'refused', reason: 'app-bundle' };
+            if (target.name === CORE_BUNDLES[1])
+                return { kind: 'refused', reason: 'host-bundle' };
+        }
+        if (action === 'remove' && !target.removable)
+            return { kind: 'refused', reason: 'not-removable' };
+        return { kind: 'allowed' };
+    }
+    if (action === 'remove')
+        return { kind: 'refused', reason: 'row-not-removable' };
+    if (action === 'disable' && (target.ownRow === true || isCoreRowModule(target.moduleName))) {
+        return { kind: 'refused', reason: 'app-row' };
+    }
+    return { kind: 'allowed' };
+}

package/lib/types/dsh-adapter/plugin-host.d.ts

@@ -40,6 +40,7 @@ import type { HostDescriptor } from '../adapter/standard/types.js';
 import { type HostDescriptorBuild } from '../adapter/standard/descriptor.js';
 import { type DecisionRegistrationOptions } from './decision-guard.js';
 import { type VerifiedComponentIdentity } from './component-identity.js';
+import { type BackendAdmissionProbe } from './backend-registry.js';
 /** Caller-safe grant facade exposed through `ctx.tuiPluginHost.grants`.
  * Unlike the internal full-parameter GrantStore, this facade derives the
  * principal from the calling activation and never accepts a caller-supplied
@@ -79,6 +80,11 @@ export interface TuiPluginHost {
     selfCheck(): string[];
     /** Read-only DecisionEvents feature probe (host/driver diagnostics). */
     probeDecisionEvents(): readonly string[];
+    /** Read-only backend admission probe (host/driver diagnostics): whether the
+     *  `Backend` contribution family's admission machine is mounted and answers
+     *  for a third-party declaration. This is the evidence the host descriptor
+     *  publishes `tui.dsh/v1alpha1#Backend` on (W-2). */
+    probeBackendAdmission(): BackendAdmissionProbe;
 }
 declare module '@deepseek-ai/cordis' {
     interface Context {
@@ -96,10 +102,15 @@ export declare class TuiPluginHostRuntime extends Service implements TuiPluginHo
     /** Read-only DecisionEvents feature probe. Returns only the event names
      * whose guard is installed in this composition. */
     probeDecisionEvents(): readonly string[];
+    /** Read-only backend admission probe. Read-only and side-effect free: it
+     * exercises the family validator and the host's admission facts on a
+     * synthetic declaration and reports the verdict, so the descriptor never
+     * claims the `Backend` coordinate off a mere mounted service row. */
+    probeBackendAdmission(): BackendAdmissionProbe;
     constructor(ctx: Context);
     /** @internal Start the Kernel after the whole plugin-host row (including
-     * sibling storage/observer services) is mounted. Called from `apply()`; not
-     * part of the public plugin surface. */
+     * sibling storage/observer services) is mounted. Triggered only by the
+     * constructor's deferred effect. */
     startKernelRuntime(): void;
     private assertEffect;
     /**

package/lib/types/dsh-adapter/plugin-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-host.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAclE,OAAO,EAA4E,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAMtJ,OAAO,EAML,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAML,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAKhC;;;;;wCAKwC;AACxC,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC/C,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CAC7E;AAED;;qBAEqB;AACrB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,cAAc,IAAI,cAAc,CAAA;IAChC,QAAQ,IAAI,mBAAmB,CAAA;IAC/B,iBAAiB,CACf,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,OAAO,CAAA;IAChB,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAC9E,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IACtG,SAAS,IAAI,MAAM,EAAE,CAAA;IACrB,wEAAwE;IACxE,mBAAmB,IAAI,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,OAAQ,YAAW,aAAa;;IACxE,uEAAuE;IACvE,IAAI,YAAY,IAAI,MAAM,CAA2C;IACrE;gEAC4D;IAC5D,IAAI,MAAM,IAAI,eAAe,CA6B5B;IAED;uDACmD;IACnD,mBAAmB,IAAI,SAAS,MAAM,EAAE;gBAK5B,GAAG,EAAE,OAAO;IAyDxB;;4CAEwC;IACxC,kBAAkB,IAAI,IAAI;IA+D1B,OAAO,CAAC,YAAY;IAKpB;;;OAGG;IACH,cAAc,IAAI,cAAc;IAKhC,2EAA2E;IAC3E,QAAQ,IAAI,mBAAmB;IAK/B,OAAO,CAAC,KAAK;IAeb,OAAO,CAAC,WAAW;IA6EnB;;;OAGG;IACH,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,yBAAyB;IAa5B;;yEAEqE;IACrE,aAAa,CACX,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,EACxD,KAAK,CAAC,EAAE,MAAM,GACb,yBAAyB;IA0D5B;;;;;;OAMG;IACH,iBAAiB,CACf,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,GACxC,MAAM,OAAO;IAoDhB;;;;;;;;;;;MAWE;IACF,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAC9E,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAmMtG;;;;OAIG;IACH,SAAS,IAAI,MAAM,EAAE;CAMtB;AAqBD;8EAC8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AA2BD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,yBAAyB,CAAA;CAC7B;AAED;;mEAEmE;AACnE,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,yBAAyB,CAAA;CAC7B;AAED;sFACsF;AACtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,IAAI,0BAA0B,GAAG,SAAS,CAAA;IAChD,WAAW,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAA;CACnD;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GACxD,+BAA+B,GAAG,SAAS,CAmB7C;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GACxD,oBAAoB,GAAG,SAAS,CAUlC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAUrH;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,wDAiBtF;AA0BD,eAAO,MAAM,IAAI,wBAAwB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAiBxC"}
+{"version":3,"file":"plugin-host.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAclE,OAAO,EAA4E,KAAK,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAMtJ,OAAO,EAML,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAML,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAGzF;;;;;wCAKwC;AACxC,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC/C,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CAC7E;AAED;;qBAEqB;AACrB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,cAAc,IAAI,cAAc,CAAA;IAChC,QAAQ,IAAI,mBAAmB,CAAA;IAC/B,iBAAiB,CACf,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,MAAM,OAAO,CAAA;IAChB,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IAC9E,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAAA;IACtG,SAAS,IAAI,MAAM,EAAE,CAAA;IACrB,wEAAwE;IACxE,mBAAmB,IAAI,SAAS,MAAM,EAAE,CAAA;IACxC;;;yDAGqD;IACrD,qBAAqB,IAAI,qBAAqB,CAAA;CAC/C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,OAAQ,YAAW,aAAa;;IACxE,uEAAuE;IACvE,IAAI,YAAY,IAAI,MAAM,CAA2C;IACrE;gEAC4D;IAC5D,IAAI,MAAM,IAAI,eAAe,CA6B5B;IAED;uDACmD;IACnD,mBAAmB,IAAI,SAAS,MAAM,EAAE;IAKxC;;;yEAGqE;IACrE,qBAAqB,IAAI,qBAAqB;gBAKlC,GAAG,EAAE,OAAO;IA8DxB;;wCAEoC;IACpC,kBAAkB,IAAI,IAAI;IA+D1B,OAAO,CAAC,YAAY;IAKpB;;;OAGG;IACH,cAAc,IAAI,cAAc;IAKhC,2EAA2E;IAC3E,QAAQ,IAAI,mBAAmB;IAK/B,OAAO,CAAC,KAAK;IAeb,OAAO,CAAC,WAAW;IA2FnB;;;OAGG;IACH,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAChC,yBAAyB;IAa5B;;yEAEqE;IACrE,aAAa,CACX,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,EACxD,KAAK,CAAC,EAAE,MAAM,GACb,yBAAyB;IA0D5B;;;;;;OAMG;IACH,iBAAiB,CACf,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,GACxC,MAAM,OAAO;IAoDhB;;;;;;;;;;;MAWE;IACF,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAC9E,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAmMtG;;;;OAIG;IACH,SAAS,IAAI,MAAM,EAAE;CAMtB;AAqBD;8EAC8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AA2BD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,yBAAyB,CAAA;CAC7B;AAED;;mEAEmE;AACnE,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,KAAK,CACH,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,yBAAyB,CAAA;CAC7B;AAED;sFACsF;AACtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,IAAI,0BAA0B,GAAG,SAAS,CAAA;IAChD,WAAW,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAA;CACnD;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GACxD,+BAA+B,GAAG,SAAS,CAmB7C;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GACxD,oBAAoB,GAAG,SAAS,CAUlC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAUrH;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,wDAiBtF;AA0BD,eAAO,MAAM,IAAI,wBAAwB,CAAA;AAEzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAaxC"}

package/lib/types/dsh-adapter/plugin-host.js

@@ -57,6 +57,7 @@ import { installDecisionGuard, decisionHandlerMetadataOf, probeDecisionEventFeat
 import { bindComponentIdentity, declaresCommand, requiresDecisionEvents, requiresContract, requireComponentIdentity, } from './component-identity.js';
 import { activationContext, activationFiber, assertCallerContext, bindCallerEffect, compositionRoot, concreteService, withHostRootCapability } from './host-access.js';
 import { bindHostGrantStore } from './host-grants.js';
+import { probeBackendAdmission } from './backend-registry.js';
 import { registerCommandLiveProbe } from '../adapter/kernel/host-probe-access.js';
 /** `ctx.tuiPluginHost` — plugin-interop anchor (generation, grants, descriptor). */
 export class TuiPluginHostRuntime extends Service {
@@ -97,6 +98,14 @@ export class TuiPluginHostRuntime extends Service {
         this.assertEffect('host.decision.probe');
         return probeDecisionEventFeatures(hostContextFor(this));
     }
+    /** Read-only backend admission probe. Read-only and side-effect free: it
+     * exercises the family validator and the host's admission facts on a
+     * synthetic declaration and reports the verdict, so the descriptor never
+     * claims the `Backend` coordinate off a mere mounted service row. */
+    probeBackendAdmission() {
+        this.assertEffect('host.backend.probe');
+        return probeBackendAdmission();
+    }
     constructor(ctx) {
         super(ctx, 'tuiPluginHost');
         const runtime = adapterRuntimeFor(ctx);
@@ -139,7 +148,12 @@ export class TuiPluginHostRuntime extends Service {
             // Defer until after the apply() body has mounted storage/observer
             // siblings, so the live refresh observes the complete production
             // topology.
-            setTimeout(() => this.startKernelRuntime(), 0);
+            // An effect of this row's fiber: unloading the row first cancels a start
+            // that has not happened (nothing mounted, nothing to report).
+            ctx.effect(() => {
+                const timer = setTimeout(() => this.startKernelRuntime(), 0);
+                return () => clearTimeout(timer);
+            });
         }
         bindHostGrantStore(concreteService(this), rawGrants);
         // The host row may be mounted without the extensions row or a channel;
@@ -152,8 +166,8 @@ export class TuiPluginHostRuntime extends Service {
         }
     }
     /** @internal Start the Kernel after the whole plugin-host row (including
-     * sibling storage/observer services) is mounted. Called from `apply()`; not
-     * part of the public plugin surface. */
+     * sibling storage/observer services) is mounted. Triggered only by the
+     * constructor's deferred effect. */
     startKernelRuntime() {
         const state = hostStateFor(this);
         const kernelRuntime = state.kernelRuntime;
@@ -290,7 +304,21 @@ export class TuiPluginHostRuntime extends Service {
         const storageMounted = host.get('tuiPluginStorage') !== undefined;
         const observerMounted = host.get('tuiMessageObserver') !== undefined;
         const decisionEventsMounted = probeDecisionEventFeatures(host).length > 0;
-        const topology = `${Number(commandsMounted)}:${Number(storageMounted)}:${Number(observerMounted)}:${Number(decisionEventsMounted)}`;
+        // The `Backend` admission machine is a process-wide module registry, not a
+        // sibling row: the legacy topology can read it directly, exactly like the
+        // DecisionEvents guard probe above. Without this the default (legacy) boot
+        // would never publish the coordinate, which is the "declares support, cannot
+        // deliver" state W-2 exists to end. A machine that cannot admit a contribution
+        // is not evidence — and it must not take the descriptor build down with it, so
+        // the refusal is reported the way the neighbouring exclusions are.
+        let backendMounted = false;
+        try {
+            backendMounted = probeBackendAdmission().verdict === 'compatible';
+        }
+        catch (error) {
+            host.logger.warn(`dsh-tui: host descriptor: tui.dsh/v1alpha1#Backend excluded — the backend admission machine did not answer (${error instanceof Error ? error.message : String(error)})`);
+        }
+        const topology = `${Number(commandsMounted)}:${Number(storageMounted)}:${Number(observerMounted)}:${Number(decisionEventsMounted)}:${Number(backendMounted)}`;
         if (state.descriptorBuild === undefined || state.descriptorTopology !== topology) {
             const supported = HOST_SUPPORTED_CONTRACTS.filter(contract => {
                 if (contract.kind === 'Command')
@@ -301,6 +329,8 @@ export class TuiPluginHostRuntime extends Service {
                     return observerMounted;
                 if (contract.kind === 'DecisionEvents')
                     return decisionEventsMounted;
+                if (contract.kind === 'Backend')
+                    return backendMounted;
                 return false;
             });
             state.descriptorBuild = buildLegacyHostDescriptor({
@@ -755,8 +785,4 @@ export function apply(ctx) {
     // messages.observe (C-042): the grant-gated observation broker the
     // channel publishes mapped session events into.
     ctx.plugin(TuiMessageObserverRuntime);
-    // All sibling services are mounted now; start the kernel live refresh /
-    // driver mount so probes observe the complete production topology.
-    const host = ctx.get('tuiPluginHost');
-    host?.startKernelRuntime();
 }

package/lib/types/dsh-adapter/plugin-install.d.ts

@@ -0,0 +1,160 @@
+/**
+ * `/plugin install <spec>`: the write half of the plugin command (Stage C-4).
+ *
+ * The flow owns the whole conversation with the host service — what a spec
+ * names, gate 1's pre-install notice, gate 3's trust routing, pnpm's progress,
+ * cancellation, the build-script approval, the version-exemption escape and
+ * the final report — and it produces the transcript lines for all of it.
+ *
+ * What it does not do is ask. Every point where a person decides comes back as
+ * a {@link PluginInstallStep}; the UI renders it and answers by calling the
+ * next method. That keeps key handling where every other overlay keeps it
+ * (`Chat.tsx`) and the domain here, and it lets a regression drive the whole
+ * flow through a fake service without a terminal.
+ *
+ * Three rules the service's own semantics force:
+ *
+ * - `installBundle` resolves only once the run is over and the profile was
+ *   restored or changed, so the promise IS the result. The service deletes a
+ *   request the moment it settles, which makes `waitForInstall` a recovery path
+ *   for a caller that lost the promise — not a mailbox to collect from, and not
+ *   something this flow needs (it never lets go).
+ * - A failure arrives in-band: the service folds every error into
+ *   `application: 'failed'` with `result.error`. Only a lock or disposal error
+ *   rejects, so the flow contains both shapes.
+ * - Everything asynchronous is fenced to the binding that asked. A `/new` or a
+ *   resume mid-install must not write pnpm output into the new session's
+ *   transcript; the run itself is a profile-level operation and keeps going.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ChangeResult, IncompatiblePlugin, InstallSpecKind, PluginInstallRequestId, Registry } from '@deepseek-ai/dsh-plugin-manager/types';
+import { type PluginInstallNotice } from './plugin-declaration.js';
+import { type FirstPartyFeedLoad, type FirstPartyVerdict } from './plugin-feed.js';
+import { type PluginInstallEvents, type PluginManagerView } from './plugin-manager.js';
+/** How many lines of pnpm's output the failure report keeps. */
+export declare const INSTALL_LOG_TAIL = 6;
+/** What a spec names, once the service has read it. */
+export interface PluginArtifact {
+    readonly name?: string | undefined;
+    readonly version?: string | undefined;
+    readonly kind: InstallSpecKind;
+    readonly bundle: boolean | null;
+    readonly registry: Registry;
+    readonly host?: string | undefined;
+}
+/** What the profile's compatibility file currently exempts. */
+export type VersionExemptions = ReturnType<PluginManagerView['listVersionExemptions']>;
+/** Stable display shape across the host's peers → requirements rename. */
+export type IncompatiblePackage = Pick<IncompatiblePlugin, 'name' | 'version' | 'runtimeVersion'> & {
+    readonly peers: Readonly<Record<string, string>>;
+};
+/**
+ * What `/plugin install` has to say next. `done` means the flow has reported
+ * everything it is going to report: refused, finished, failed or cancelled.
+ */
+export type PluginInstallStep = {
+    readonly kind: 'confirm';
+    readonly artifact: PluginArtifact;
+    /** Gate 3: whether the feed vouches for this exact artifact. */
+    readonly trust: FirstPartyVerdict;
+    /** Gate 1: what could be read about the package's declarations, before it lands. */
+    readonly notice: PluginInstallNotice;
+}
+/** pnpm was blocked by build scripts this profile has not approved. */
+ | {
+    readonly kind: 'build-blocked';
+    readonly builds: readonly string[];
+}
+/** The running host refuses this exact version; the exemption is the escape. */
+ | {
+    readonly kind: 'incompatible';
+    readonly packages: readonly IncompatiblePackage[];
+    readonly exemptions: VersionExemptions;
+} | {
+    readonly kind: 'done';
+};
+/** What the caller of a flow supplies that only the UI knows. */
+export interface PluginInstallSink {
+    /** The session the flow's output belongs to; see `binding` below. */
+    readonly binding: () => number;
+    /** Whether a turn is running; see `busy` on the flow's options. */
+    readonly busy: () => boolean;
+    /** Where the flow's transcript lines go (already sanitized and capped). */
+    readonly onLines: (lines: readonly string[]) => void;
+}
+export interface PluginInstallFlowOptions {
+    readonly manager: PluginManagerView;
+    readonly spec: string;
+    /** The feed the trust verdict reads (loaded once by the caller). */
+    readonly feed: FirstPartyFeedLoad;
+    /** Gate 1's evidence for one target; `declarationNoticeFor` in the wiring. */
+    readonly noticeOf: (target: {
+        readonly name?: string | undefined;
+        readonly directory?: string | undefined;
+    }) => PluginInstallNotice;
+    /** Resolve a path spec to a directory, when the caller knows the profile root. */
+    readonly specDirectory?: ((spec: string) => string | undefined) | undefined;
+    /** The binding generation that asked; every asynchronous write is fenced to it. */
+    readonly binding: () => number;
+    /**
+     * Whether a turn is running. Installing changes the profile, and the change
+     * applies or reloads plugins under whatever is running, so the flow refuses
+     * while this is true — before the inspection, and again before the write.
+     */
+    readonly busy: () => boolean;
+    /** Where the flow's transcript lines go (already sanitized and capped). */
+    readonly onLines: (lines: readonly string[]) => void;
+    /** The manager's install events, when the caller has a context to subscribe on. */
+    readonly events?: PluginInstallEvents | undefined;
+    /** This package's running version — the other side of the drift check. */
+    readonly ownVersion?: string | undefined;
+    /** The profile an installation belongs to, for the manual commands. */
+    readonly profileName?: string | undefined;
+    /** The registry asked first. */
+    readonly registry?: Registry | undefined;
+    /** Injectable for a regression; a fresh process-unique id otherwise. */
+    readonly requestId?: PluginInstallRequestId | undefined;
+}
+export interface PluginInstallFlow {
+    readonly requestId: PluginInstallRequestId;
+    /** Read the spec, judge it, and either ask (gate 1 / gate 3) or install straight away. */
+    begin(): Promise<PluginInstallStep>;
+    /** Answer a `confirm` step: proceed. */
+    confirm(): Promise<PluginInstallStep>;
+    /** Answer a `build-blocked` step: allow these scripts and retry. */
+    approve(builds: readonly string[]): Promise<PluginInstallStep>;
+    /** Answer an `incompatible` step: exempt these exact versions and retry. */
+    acceptRisk(): Promise<PluginInstallStep>;
+    /** Stop pending work and await profile writes already started; repeated calls share the wait. */
+    cancel(): Promise<PluginInstallStep>;
+    /** Release the event subscriptions. */
+    dispose(): void;
+}
+/**
+ * The reason line for a result that failed, from the most specific field it
+ * carries. Exported because the lifecycle flow (`./plugin-manage.ts`) writes
+ * through the same `change()` funnel and reports the same shapes — and because
+ * the credential reasoning below is exactly the kind of rule that must not exist
+ * in two copies: a removal runs pnpm too.
+ */
+export declare function failureReasonOf(result: ChangeResult): string;
+export declare function createPluginInstallFlow(options: PluginInstallFlowOptions): PluginInstallFlow;
+/**
+ * The `/plugin install` entry the screen calls: `/plugin`'s argument text in, a
+ * flow out — or `undefined` for anything that is not an install form, and for a
+ * launch with no profile plugin service to install through (the screen then
+ * runs the read-only report, which is where the CLI route is printed).
+ *
+ * This is the one place that knows how the flow is wired to the running
+ * composition: the host service and its events, the packaged feed, gate 1's
+ * declaration reader, and the profile-relative resolution of a `install <path>`
+ * spec. It lives beside the flow rather than in the entry so a regression can
+ * drive the real wiring with a fixture context — the parts that only exist here
+ * (the feed load, the declaration read, the `file:` base URL) are exactly the
+ * ones a fixture-only battery would otherwise never touch.
+ */
+export declare function createPluginInstallEntry(ctx: Context, options?: {
+    readonly profileName?: string | undefined;
+    readonly ownVersion?: string | undefined;
+}): (args: string, sink: PluginInstallSink) => PluginInstallFlow | undefined;
+//# sourceMappingURL=plugin-install.d.ts.map

package/lib/types/dsh-adapter/plugin-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-install.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAElB,eAAe,EACf,sBAAsB,EAEtB,QAAQ,EACT,MAAM,uCAAuC,CAAA;AAK9C,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACvF,OAAO,EAAE,KAAK,kBAAkB,EAAqB,KAAK,iBAAiB,EAAsB,MAAM,kBAAkB,CAAA;AACzH,OAAO,EAA6D,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAGjJ,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAIjC,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAEtF,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAAC,GAAG;IAClG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACjD,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CACrC;AACD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AACxE,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,GAC5H;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7B,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,MAAM,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAA;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,KAAK,mBAAmB,CAAA;IACnI,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IAC3E,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,MAAM,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAA;IACpD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAA;IACjD,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACxC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAA;CACxD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAA;IAC1C,0FAA0F;IAC1F,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACnC,wCAAwC;IACxC,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACrC,oEAAoE;IACpE,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC9D,4EAA4E;IAC5E,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxC,iGAAiG;IACjG,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACpC,uCAAuC;IACvC,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAe5D;AA+BD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAoY5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GACpG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,KAAK,iBAAiB,GAAG,SAAS,CA0B1E"}