@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/lib/dsh-adapter/realm-skill-bridge.d.ts

@@ -0,0 +1,365 @@
+/**
+ * realm-skill-bridge — Realm-aware skill and tool isolation for dsh-edge-agent.
+ *
+ * Reads a user-editable JSON config (`skill-realms.json`) that maps skill/tool
+ * names (or glob patterns) to LOCAL | CLOUD realms. Tags every discovered skill
+ * and tool accordingly, then enforces the mapping at three enforcement points:
+ *
+ *   Layer 1 (agent/pre-step): filter the <available_skills> catalog so each
+ *     agent only sees skills in its own realm. Skills tagged `hidden` are
+ *     invisible to every agent.
+ *
+ *   Layer 1.5-replacement (system-prompt/assemble): filter the tool schema
+ *     list BEFORE dsh-agent-loop wraps it in deepFreeze and passes to the
+ *     LLM. Replaces the deleted `llm/stream` tools probe — `payload.tools`
+ *     at llm/stream is already frozen (dsh-agent-loop/lib/index.js:729
+ *     `markAgentLoopRequest(deepFreeze({ ... tools: header.tools, ... }))`)
+ *     so splice/defineProperty mutations silently fail there. The
+ *     system-prompt/assemble waterfall value IS authoritative (per the dsh
+ *     type declaration: "the returned value is authoritative") and tools are
+ *     a plain array at that point. After this layer the LLM never sees
+ *     out-of-realm tools.
+ *
+ *   Layer 3 (tools/pre-execute): deny tool execution when the tool's realm
+ *     does not match the calling agent's realm (defense-in-depth — also
+ *     catches tools added via runtime registrations that bypass assembly).
+ *
+ * The config file is hot-reloaded via stat-polling (same pattern as
+ * privacy-policy.ts) so changes take effect without a restart.
+ *
+ * @module dsh-edge-agent/realm-skill-bridge
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "realm-skill-bridge";
+export declare const inject: readonly ["auditLog", "skills", "edgeTools", "tools"];
+/** Realm tag for skills and tools. 'hidden' means invisible to all agents. */
+export type RealmTag = 'LOCAL' | 'CLOUD' | 'SANITIZED' | 'hidden';
+/**
+ * §7.93 Phase 2 (2026-09-24,§7.93.1 通用化 2026-09-25): intent categories
+ * function-call-external may request tool schemas for. REJECT never reaches
+ * the external caller (4xx before dispatch) and 'hidden' agents get no tools
+ * at all, so both are excluded from the input type; CLOUD is included for
+ * completeness even though the external path skips CLOUD intents
+ * (decision #4) — callers gate, this method stays total.
+ */
+export type ExternalToolCallIntent = 'LOCAL' | 'CLOUD' | 'SANITIZED';
+/**
+ * §7.93 Phase 2 (§7.93.1 通用化): one tool schema in the external caller's
+ * flat wire format (cactus-needle 3.0.1 / `~/work/needle/API.md` v1.1 §4.5:
+ * `{name, description, parameters}` —
+ * NOT the OpenAI `{type:'function', function:{...}}` envelope). This matches
+ * dsh-llm's own `ToolSchema` projection (`schemas()` whitelists exactly
+ * name/description/parameters), so the conversion is a shape check, not a
+ * translation.
+ */
+export interface ExternalToolSchema {
+    name: string;
+    description: string;
+    parameters: Record<string, unknown>;
+}
+export interface Config {
+    /** Path to the skill-realms.json config file. */
+    configPath: string;
+    /** Whether to hot-reload the config on file change (via stat polling). */
+    hotReload: boolean;
+    /** Polling interval in ms for config change detection. */
+    watchIntervalMs: number;
+}
+export declare const Config: Schema<Config>;
+/**
+ * Parsed shape of skill-realms.json.
+ *
+ * `skills` maps skill name or glob pattern (e.g. "lark-*") to a realm.
+ * `tools` maps tool name to a realm (overrides hard-coded DSH_NATIVE_REALM_MAP).
+ * `defaultRealm` applies to anything not explicitly matched. "hidden" = invisible.
+ *
+ * §7.150: `tools` 的值**允许** 'hidden'。运行时一直支持（既有测试就写着
+ * `tools: { secret_admin: 'hidden' }`，`loadConfig` 也不校验取值），只是这里
+ * 的类型比实际用法窄 —— 于是任何想屏蔽一个工具的写法都编译不过。类型跟实际
+ * 对齐，而不是让调用方绕道。
+ */
+export interface RealmConfig {
+    skills: Record<string, RealmTag>;
+    tools: Record<string, RealmTag>;
+    defaultRealm: RealmTag;
+}
+interface AuditLogLike {
+    log(entry: {
+        level: string;
+        kind: string;
+        source: string;
+        payload?: Record<string, unknown>;
+    }): void;
+}
+/** Module augmentation: expose the service on ctx. */
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        realmSkillBridge: RealmSkillBridgeService;
+        /** From @deepseek-ai/dsh-skill — augmented here to avoid importing the package. */
+        skills: {
+            list(options?: unknown): Promise<ReadonlyArray<{
+                name: string;
+                description?: string;
+            }>>;
+            snapshot(options?: unknown): Promise<{
+                skills: ReadonlyArray<{
+                    name: string;
+                    description?: string;
+                }>;
+                complete: boolean;
+            }>;
+        };
+    }
+}
+/**
+ * Minimal glob matcher — supports `*` as "any sequence of characters".
+ * We do not pull in the `minimatch` dependency for this; the only patterns
+ * used in skill-realms.json are simple suffix globs like "lark-*".
+ */
+export declare function globMatch(pattern: string, value: string): boolean;
+/**
+ * 把工具返回的 error message 变成一行可读的摘要。
+ *
+ * §7.151（2026-10-29）修：原来只有 `typeof message === 'string'` 才记内容，
+ * 否则一律打 `'unknown'`。但宿主的工具失败**大多数不是字符串** ——
+ * `deepseek-harness/docs/subsystems/user-questions.md:212` 明确写着
+ * `UserQuestionError` 继承 `HarnessError`，`ctx.tools.execute()` 保留
+ * `{ name, code }`（`NO_PROVIDER` / `BAD_INTENT` / `EMPTY_QUESTIONS` /
+ * `ASK_ABORTED`）。这些是**对象**，于是每一次这类失败在 ops log 里都只留下
+ * `errorKind=unknown` —— 真实错误码被吞掉，排查时无从下手
+ * （本轮就是这样误判了 ask_user_question 的失败原因）。
+ *
+ * 现在：字符串直接截断；对象/数组 JSON 序列化后截断；取不到就退回
+ * `String(message)`。**信息不能因为形态不是字符串就丢。**
+ */
+export declare function describeToolError(message: unknown): string;
+export declare class RealmSkillBridgeService extends Service {
+    private readonly config;
+    private readonly auditLog;
+    /** Skill name → realm tag (including 'hidden'). */
+    private readonly skillRealms;
+    /** Tool name → set of realm tags. A tool can belong to multiple realms. */
+    private readonly toolRealms;
+    /** Session id → realm. Written by http-api after intent classification. */
+    private readonly sessionRealms;
+    /** sessionRealms 的 LRU 上限；活跃会话远小于此（http-api 默认 8）。 */
+    private static readonly SESSION_REALMS_CAP;
+    /** Parsed realm config. Refreshed on hot-reload. */
+    private realmConfig;
+    /** mtime of the config file at last load (for stat-polling). */
+    private lastMtime;
+    /** Hot-reload timer handle. */
+    private watchTimer;
+    constructor(ctx: Context, config: Config, auditLog: AuditLogLike | undefined);
+    /** Boot: ensure config file exists, load it, tag skills/tools. */
+    start(): Promise<void>;
+    /** Stop hot-reload timer. */
+    stop(): void;
+    /** Drop all per-session realm tags (plugin dispose path). */
+    clearSessionRealms(): void;
+    /** Set the realm for a session (called by http-api after intent classification). */
+    setSessionRealm(sessionId: string, realm: RealmTag): void;
+    /** Resolve the realm for an agent by looking up its session.
+     *  §7.36 / §7.37 (2026-09-04): prefer `session.id` — input-guard registers
+     *  via `payload.agent.session.id` (input-guard.ts:537) and that is the
+     *  only key under which sessionRealms holds the realm. Reading
+     *  `session.header.id` first was a wrong assumption that caused layer-1.5
+     *  (llm/stream tools filter) to silently no-op: getAgentRealm returned
+     *  undefined → filterToolsField skipped → tools.filtered never fired. */
+    getAgentRealm(agent: AgentLike | undefined): RealmTag | undefined;
+    /**
+     * Resolve realm directly from a sessionId string. Used by llm/stream hook
+     * where the agent's session.id path is unreliable and payload.sessionId
+     * is the canonical key.
+     */
+    getSessionRealm(sessionId: string | undefined): RealmTag | undefined;
+    /** Look up the realm tag for a skill name.
+     *  Prefers the cached tag (populated by tagSkills on skills/change), but
+     *  falls back to resolveSkillRealm so skills not yet discovered still get
+     *  the correct realm from the config file. */
+    skillRealm(name: string): RealmTag;
+    /** Look up the realm tags for a tool name. Returns undefined if no realm
+     *  constraint is configured (tool is unconstrained). */
+    toolRealm(name: string): Set<RealmTag> | undefined;
+    private reloadConfig;
+    private checkForUpdates;
+    /**
+     * Resolve the realm for a skill by name.
+     * Priority:
+     *   1. skill-realms.json exact name match
+     *   2. skill-realms.json glob match (in declaration order)
+     *   3. defaultRealm
+     *
+     * Note: SKILL.md frontmatter `metadata.realm` is intentionally NOT consumed
+     * here — the config file is the single source of truth. This avoids a
+     * dependency on `ctx.skills.get()` (which reads the full markdown body)
+     * during the hot-path tag loop.
+     */
+    private resolveSkillRealm;
+    /** Re-scan ctx.skills.list() and tag each skill by realm. */
+    private tagSkills;
+    /** Synchronous variant for await contexts. */
+    private tagSkillsAsync;
+    private logTaggingResult;
+    /** Apply tool realm tags from skill-realms.json to ctx.edgeTools. */
+    private tagToolsFromConfig;
+    /**
+     * Filter the <available_skills> catalog so the agent only sees skills in
+     * its realm. Skills tagged 'hidden' are removed from every agent's catalog.
+     *
+     * §7.37 (2026-09-04): Two message shapes carry the catalog:
+     *   (a) standalone UserMessage with source.kind === 'skill-catalog'
+     *       (string content).
+     *   (b) dsh-system-prompt plugin snapshot with
+     *       source.kind === 'plugin' && source.plugin ===
+     *       '@deepseek-ai/dsh-system-prompt' (array content blocks,
+     *       one of which is type:'text' containing `<available_skills>`).
+     * Both must be filtered or the catalog leaks. (a) is the canonical
+     * skill-catalog shape; (b) is what TUI / WebUI actually see because
+     * dsh-system-prompt co-locates the catalog with sandbox/approval policy
+     * snapshots — without this filter, LLM sees ALL 32 skills regardless
+     * of realm.
+     *
+     * We parse each ` - \`skill-name\`: Description` line, look up the skill's
+     * realm, and drop disallowed ones.
+     */
+    filterSkillCatalog(messages: readonly MessageLike[], agentRealm: RealmTag): readonly MessageLike[];
+    /**
+     * §7.46 (2026-09-11): 返回 `{ messages, droppedCount }` 让 pre-step
+     * listener 能 emit `catalogDropped=N` 到 ops log（§7.44.1 chat-finished
+     * line 加 realm/duration 时同步加的；详见 PROGRESS §7.46）。返回 messages
+     * 是 filterSkillCatalog 的同一引用，方便测试不破坏。
+     */
+    filterSkillCatalogDetailed(messages: readonly MessageLike[], agentRealm: RealmTag): {
+        messages: readonly MessageLike[];
+        droppedCount: number;
+    };
+    /**
+     * Pure function: parse `<available_skills>` content, drop lines whose
+     * skill name resolves to a realm other than `agentRealm` (or 'hidden').
+     * Returns `{ text, changed }` so the caller can short-circuit on no-op.
+     *
+     * §7.45 (2026-09-11): SANITIZED agents see every non-hidden skill —
+     * matches `filterToolsField`'s SANITIZED branch below. Before this
+     * fix, `skillRealm(name)` only returns `LOCAL`/`CLOUD`/`hidden` (never
+     * `'SANITIZED'`), so `realm !== agentRealm` was always true for SANITIZED
+     * agents and the entire catalog was dropped (audit observed
+     * `droppedCount=33` for a session whose agentRealm=SANITIZED — LLM saw
+     * zero skills and silently answered "no mibao tool available"). Skill
+     * realm tag is fail-closed (default 'hidden'), so SANITIZED must
+     * explicitly opt out of the strict-equality check.
+     *
+     * §7.47.1 (2026-09-12): Same dual fix for LOCAL/CLOUD. The catalog
+     * filter uses `skillRealm` (single realm), but tools are tagged with a
+     * realm SET (`toolRealms: Set<RealmTag>`). `bash` skill.realm = 'LOCAL'
+     * yet bash.toolRealms = {LOCAL, CLOUD}. Before this fix, a CLOUD agent
+     * (e.g. news query) saw every LOCAL skill dropped — `droppedCount=11`
+     * for news session, identical to the SANITIZED bug. Symmetric for
+     * LOCAL agent: CLOUD skill (e.g. web_search, web_fetch) was dropped.
+     * The fix extends SANITIZED's opt-in to ALL agent realms: any
+     * non-'hidden' skill is kept in the catalog. Layer 3 (tools/pre-execute)
+     * remains the authoritative gate, mirroring `filterToolsField`'s
+     * semantics where any non-hidden tool is offered to the LLM and only
+     * blocked at execution time.
+     */
+    private filterCatalogText;
+    /**
+     * Pure function: filter the `tools` array carried on llm/stream payload so
+     * that the LLM does not see tools whose realm set does not include
+     * `agentRealm`. Tools whose realm is undefined (not in our config) are
+     * preserved (fail-closed: we only restrict what we explicitly tagged).
+     * Returns `{ tools, changed, removed }` so callers can short-circuit.
+     *
+     * SANITIZED special case: an agent whose input was sanitized may safely
+     * use both LOCAL tools (file ops don't leak) and CLOUD tools (input was
+     * already redacted). So SANITIZED agents see every non-hidden tool.
+     *
+     * §7.93 Phase 2 (§7.93.1 通用化): `options.audit === false` suppresses the
+     * `realm-skill-bridge.tools.filtered` audit entry. Used by
+     * getToolSchemasForExternal() so the LLM-path filter audit isn't duplicated
+     * per external call — function-call-external emits its own `external.*`
+     * audit kinds. Default (omitted) keeps the existing audited behavior.
+     */
+    filterToolsField(tools: ReadonlyArray<unknown>, agentRealm: RealmTag, options?: {
+        audit?: boolean;
+        sessionId?: string;
+    }): {
+        tools: unknown[];
+        changed: boolean;
+        removed: string[];
+    };
+    /**
+     * Build the external caller's wire-format tool schemas for one intent's realm.
+     *
+     * Pipeline: registry projection → realm filter (filterToolsField semantics,
+     * audit suppressed — caller emits `external.*` audit) → shape normalization.
+     *
+     * Failure contract: registry unavailable (cordis proxy throw before the
+     * `tools` service mounts, §7.92.2 trap) or empty → returns []. Callers MUST
+     * treat [] as "no external caller" and fall through to the LLM
+     * self-extraction path — never POST an empty tools array to the external
+     * caller (it would echo/hallucinate).
+     */
+    getToolSchemasForExternal(intent: ExternalToolCallIntent): ExternalToolSchema[];
+    /**
+     * Defensive read of `ctx.tools.schemas()` (global view). Returns [] when
+     * the service is not mounted yet or throws — the cordis proxy raises
+     * "cannot get property tools without inject" on unbound fibers, and
+     * tools/change re-fires tagging once available (same pattern as
+     * tagToolsFromConfig, §7.92.2).
+     */
+    private readRegistrySchemas;
+    /**
+     * Check whether a tool call is allowed in the calling agent's realm.
+     * Returns a deny reason string, or undefined if the call is allowed.
+     * A tool can belong to multiple realms (e.g. bash → LOCAL+CLOUD); the call
+     * is allowed if the agent's realm is in the tool's realm set.
+     */
+    checkToolRealm(toolName: string, agentRealm: RealmTag | undefined): string | undefined;
+    /** Log a realm denial to the audit log (security level). */
+    private auditDeny;
+}
+/**
+ * Normalize registry projections onto the external caller's flat wire contract
+ * (`{name, description, parameters}`; current cactus-needle 3.0.1 impl follows
+ * `~/work/needle/API.md` v1.1 §4.5):
+ *
+ * - entries without a non-empty string `name` are dropped (caller keys
+ *   function_calls by name — a nameless schema is unexecutable)
+ * - missing/non-string `description` → '' (caller tolerates it; the tool
+ *   name + parameters carry the selection signal)
+ * - missing/non-object `parameters` → permissive `{type:'object',
+ *   properties:{}}` root (an unconstrained-args tool, e.g. no-arg status
+ *   probes; JSON Schema semantics: absent properties = any object)
+ *
+ * Defensive by design: the registry projection is already whitelisted
+ * upstream, but a runtime-registered tool with a hand-rolled shape must not
+ * crash the external path — worst case it is dropped and the LLM path covers it.
+ */
+export declare function normalizeExternalToolSchemas(tools: ReadonlyArray<unknown>): ExternalToolSchema[];
+interface AgentLike {
+    session?: {
+        header?: {
+            id?: string;
+            cwd?: string;
+        };
+        id?: string;
+    };
+}
+interface MessageLike {
+    content?: unknown;
+    source?: {
+        kind?: string;
+        form?: string;
+        plugin?: string;
+        entries?: ReadonlyArray<{
+            name?: string;
+        }>;
+    };
+    role?: string;
+}
+export declare function apply(ctx: Context, config: Config): Promise<() => Promise<void>>;
+export {};
+//# sourceMappingURL=realm-skill-bridge.d.ts.map

package/lib/dsh-adapter/realm-skill-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-skill-bridge.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/realm-skill-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAI7C,eAAO,MAAM,IAAI,uBAAuB,CAAA;AAKxC,eAAO,MAAM,MAAM,uDAAwD,CAAA;AAE3E,8EAA8E;AAC9E,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEjE;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAA;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAA;IAClB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAShC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC/B,YAAY,EAAE,QAAQ,CAAA;CACvB;AAED,UAAU,YAAY;IACpB,GAAG,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAA;CACrG;AAED,sDAAsD;AACtD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,gBAAgB,EAAE,uBAAuB,CAAA;QACzC,mFAAmF;QACnF,MAAM,EAAE;YACN,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAA;YACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;gBAAE,MAAM,EAAE,aAAa,CAAC;oBAAE,IAAI,EAAE,MAAM,CAAC;oBAAC,WAAW,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAC,CAAC;gBAAC,QAAQ,EAAE,OAAO,CAAA;aAAE,CAAC,CAAA;SAC3H,CAAA;KACF;CACF;AAMD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAOjE;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAY1D;AAkID,qBAAa,uBAAwB,SAAQ,OAAO;IAkBhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAlB3B,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmC;IAC9D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA8B;IAC5D,sDAAsD;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAM;IAChD,oDAAoD;IACpD,OAAO,CAAC,WAAW,CAAqC;IACxD,gEAAgE;IAChE,OAAO,CAAC,SAAS,CAAI;IACrB,+BAA+B;IAC/B,OAAO,CAAC,UAAU,CAA4C;gBAG5D,GAAG,EAAE,OAAO,EACK,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,YAAY,GAAG,SAAS;IAKrD,kEAAkE;IAC5D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B,6BAA6B;IAC7B,IAAI,IAAI,IAAI;IAOZ,6DAA6D;IAC7D,kBAAkB,IAAI,IAAI;IAM1B,oFAAoF;IACpF,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IAezD;;;;;;6EAMyE;IACzE,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAMjE;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAKpE;;;kDAG8C;IAC9C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ;IAIlC;4DACwD;IACxD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,SAAS;YAMpC,YAAY;YAgBZ,eAAe;IAkB7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAezB,6DAA6D;IAC7D,OAAO,CAAC,SAAS;IAmBjB,8CAA8C;YAChC,cAAc;IAsC5B,OAAO,CAAC,gBAAgB;IASxB,qEAAqE;IACrE,OAAO,CAAC,kBAAkB;IAqF1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,kBAAkB,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,GAAG,SAAS,WAAW,EAAE;IAIlG;;;;;OAKG;IACH,0BAA0B,CACxB,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,UAAU,EAAE,QAAQ,GACnB;QAAE,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAoC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,iBAAiB;IA+CzB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CACd,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,EAC7B,UAAU,EAAE,QAAQ,EACpB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IA6D5D;;;;;;;;;;;OAWG;IACH,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,EAAE;IAO/E;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IAatF,4DAA4D;IAC5D,OAAO,CAAC,SAAS;CAUlB;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAehG;AAMD,UAAU,SAAS;IACjB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE;AAED,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,CAAC,EAAE,aAAa,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC3C,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAgDD,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA6StF"}