@intentius/chant-lexicon-aws 0.44.9 → 0.44.12

package/dist/agentcore/trace-fetch.d.ts

@@ -0,0 +1,332 @@
+/**
+ * `awsAgentCoreFetchTrace` — pull a Bedrock AgentCore session history and
+ * render it as dogwood replay-trace text (#1685, follow-on from #1682).
+ *
+ * Contributed the way the fly lexicon contributes `flyApply` and the cedar
+ * lexicon contributes `dogwoodReplay`: a plain exported async function taking
+ * one args object, re-exported from `src/op/activities/index.ts`, resolved **by
+ * name** by core's activity registry when a project lists the `aws` lexicon.
+ * No Temporal import beneath it, so the local executor runs it unchanged and a
+ * Temporal worker registers the same function. Transport is injectable through
+ * the same `AwsReadHttp` seam `src/api/read-client.ts` already uses, so tests
+ * never touch the network and `endpoint` retargets the whole thing.
+ *
+ * The output is text. The cedar lexicon's `PolicyReplayOp` reads a trace from
+ * `tracePath`, so `outPath` here is the handoff — and it is the *only* handoff.
+ * Neither package imports the other; the decoupling contract is the grammar.
+ *
+ * ## Which AgentCore surface actually carries decision history
+ *
+ * Investigated before building, because the answer changes what can be shipped.
+ * Verified against the live API reference and devguide on 2026-08-10:
+ *
+ * - **There is no `GetTrace`, no `GetSession`, and no `ListRuntimeSessions`.**
+ *   The `bedrock-agentcore` data plane (API version 2024-02-28) publishes
+ *   `StopRuntimeSession` with no read counterpart — a runtime session can be
+ *   killed but not enumerated. `bedrock-agentcore-control` (2023-06-05) is
+ *   resource CRUD only.
+ *   <https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_Operations.html>
+ * - **AgentCore Memory is the one fetchable session history**, and it is what
+ *   this module reads: `ListSessions`
+ *   (`POST /memories/{memoryId}/actor/{actorId}/sessions`) and `ListEvents`
+ *   (`POST /memories/{memoryId}/actor/{actorId}/sessions/{sessionId}`), both
+ *   paginated, with a `payload[]` of `conversational` (roles `ASSISTANT`,
+ *   `USER`, `TOOL`, `OTHER`) or `blob` members.
+ *   <https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_ListEvents.html>
+ *   <https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_PayloadType.html>
+ *   The caveat is load-bearing and is repeated in {@link AgentCoreMemorySource}:
+ *   Memory holds what the agent *wrote* via `CreateEvent`. It is a store, not a
+ *   service-side audit. An agent that never writes leaves nothing to replay.
+ * - **The service's own per-tool-call and per-decision records are CloudWatch
+ *   Logs, not an API.** Gateway `tools/call` bodies land in
+ *   `/aws/vendedlogs/bedrock-agentcore/gateway/APPLICATION_LOGS/{gateway_id}`;
+ *   the allow/deny itself lives in `aws/spans` span attributes
+ *   (`aws.agentcore.policy.authorization_decision` = `ALLOW`|`DENY`,
+ *   `…determining_policies`, `…effects`, `…temporal.event_timestamp_ns`).
+ *   <https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-gateway-metrics.html>
+ *   <https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-policy-metrics.html>
+ *   Both are reachable only through CloudWatch Logs Insights / X-Ray
+ *   Transaction Search, and the gateway record's `requestBody` is a Java map
+ *   `toString` (`{id=1, jsonrpc=2.0, method=tools/call, params={…}}`) rather
+ *   than JSON. Those two sources are therefore *named and refused* here rather
+ *   than guessed at — see {@link AgentCoreTraceUnavailableError}. An honest
+ *   partial beats an invented API.
+ * - **No emulator serves any of it.** Floci's service index lists no
+ *   `bedrock-agentcore` at all (its only Bedrock entry is a `bedrock-runtime`
+ *   stub), and MiniStack implements twelve control-plane runtime/endpoint
+ *   operations and states that Memory, Gateway, Identity and the rest are not
+ *   implemented. A control-plane emulator is structurally incapable of serving
+ *   decision history anyway, since every per-call record lives in CloudWatch.
+ *   So the testable path today is the injected transport, and the mocked
+ *   fixtures in `./trace-fetch.test.ts` are the contract.
+ *
+ * ## Signing
+ *
+ * SigV4 through `read-client.ts`'s `requestHeaders`, which is the same seam its
+ * own CloudFormation and Cloud Control calls use (#1686). Signed when
+ * credentials resolve and the target is real AWS; scope-only against an
+ * endpoint override, since an emulator does not verify signatures and requiring
+ * credentials to read a local lane would be a tax with nothing behind it.
+ * `signEndpointOverride: true` opts back in for an override that *is* real AWS.
+ */
+import { type AwsCredentialSource, type AwsReadHttp } from "../api/read-client.js";
+import { type AgentCoreFields, type AgentCoreSessionEvent, type AgentCoreTimeOrigin, type AgentCoreTraceIssue, type AgentCoreTraceIssueKind } from "./trace-render.js";
+/**
+ * Where a history is read from.
+ *
+ * Only `memory` is implemented, and the reason the other two are named rather
+ * than omitted is that "which surface carries this" is the question #1685 asked
+ * first. A caller who reaches for `spans` gets the finding, not a 404.
+ */
+export type AgentCoreTraceSource = 
+/** AgentCore Memory `ListEvents`. The one fetchable session history. */
+"memory"
+/** Gateway vended `tools/call` logs. CloudWatch-only, and not JSON. */
+ | "gateway-logs"
+/** `aws/spans` policy-decision span attributes. CloudWatch/X-Ray-only. */
+ | "spans";
+/** Marker type for the documented Memory caveat. See the module header. */
+export type AgentCoreMemorySource = Extract<AgentCoreTraceSource, "memory">;
+/**
+ * A source that exists in AWS but is not reachable the way this module reads.
+ *
+ * The message names the finding and the surface, so a caller who hits it knows
+ * whether they are blocked on chant or on AWS. Both current cases are the
+ * latter: the record is real, it is in CloudWatch Logs, and getting at it is a
+ * Logs Insights integration rather than an AgentCore API call.
+ */
+export declare class AgentCoreTraceUnavailableError extends Error {
+    readonly source: AgentCoreTraceSource;
+    constructor(source: AgentCoreTraceSource, message: string);
+}
+/** One `payload[]` member, as `ListEvents` returns it. */
+export interface MemoryPayloadMember {
+    readonly conversational?: {
+        readonly role?: string;
+        readonly content?: unknown;
+    };
+    readonly blob?: unknown;
+}
+/** One event, as `ListEvents` returns it. Fields this module does not read are ignored. */
+export interface MemoryEvent {
+    readonly eventId?: string;
+    readonly sessionId?: string;
+    readonly actorId?: string;
+    readonly memoryId?: string;
+    /** restJson1 timestamp: epoch seconds (possibly fractional) or an ISO-8601 string. */
+    readonly eventTimestamp?: number | string;
+    readonly metadata?: unknown;
+    readonly payload?: readonly MemoryPayloadMember[];
+    readonly branch?: {
+        readonly name?: string;
+        readonly rootEventId?: string;
+    };
+}
+/**
+ * Epoch milliseconds from whatever the wire carried.
+ *
+ * restJson1 renders a `timestamp` shape as epoch **seconds**, possibly
+ * fractional, but the docs' examples and several SDK paths show ISO-8601, so
+ * both are accepted. A bare number is disambiguated by magnitude: anything at
+ * or beyond 1e12 is already milliseconds (1e12 ms is 2001; 1e12 s is the year
+ * 33658), so the heuristic has no realistic collision. Anything else throws
+ * rather than being coerced — a guessed timestamp puts every temporal window in
+ * the replay in the wrong place.
+ */
+export declare function toEpochMs(value: unknown, what: string): number;
+/** What to do with a payload key the trace grammar cannot spell. */
+export type NonIdentifierFieldPolicy = "rename" | "fail";
+/** `tool-name` → `tool_name`, `2fa` → `f_2fa`. Deterministic, so goldens hold. */
+export declare function identifierFor(key: string): string;
+/** A key the coercion had to rewrite, reported so a rename is never silent. */
+export interface FieldRename {
+    readonly path: string;
+    readonly from: string;
+    readonly to: string;
+}
+/**
+ * A non-integer JS number as a decimal literal the Cedar surface accepts.
+ *
+ * `String(1e-7)` is `"1e-7"`, which is not a decimal literal, so a legitimate
+ * small payload number would otherwise abort the whole fetch. `toFixed(20)` is
+ * the widest non-exponential rendering JS offers, and the trailing zeros it
+ * pads with come back off.
+ *
+ * A value too small for even that rounds to `0.0`, and a trace that says a
+ * policy compared against zero when the agent saw something else is the whole
+ * failure class this module exists to prevent — so it throws instead, naming
+ * the field.
+ */
+export declare function decimalText(value: number, context?: string): string;
+/**
+ * Coerce arbitrary JSON into trace values.
+ *
+ * A non-integer number becomes a Cedar decimal rather than being rounded,
+ * because the scale is the thing a policy compares against. `null` and
+ * `undefined` are dropped from *records*, because Cedar has no null and an
+ * invented sentinel would be matched by a predicate that meant something else.
+ * And a key the grammar cannot spell is renamed — every rename is returned, so
+ * a caller can see it, and `onNonIdentifierField: "fail"` refuses instead.
+ *
+ * Two things throw rather than being smoothed over, and both are the same
+ * failure this module refuses everywhere else — data that changes meaning
+ * without saying so. A `null` *inside an array* would shift every later index,
+ * so a predicate on `args[1]` would start matching `args[0]`'s value. And two
+ * payload keys that rewrite to the same identifier (`tool-name` and `tool.name`
+ * both become `tool_name`) would silently drop one of them.
+ */
+export declare function coerceFields(value: unknown, options?: {
+    onNonIdentifierField?: NonIdentifierFieldPolicy;
+}, path?: string, renames?: FieldRename[]): {
+    fields: AgentCoreFields;
+    renames: FieldRename[];
+};
+/**
+ * How a `conversational` role becomes an action and an event kind.
+ *
+ * The default is a convention, not a contract AWS publishes — `Conversational`
+ * carries a role and content and nothing else, so the tool name, if there is
+ * one, is inside the content the agent wrote. Override it per project.
+ */
+export interface RoleMapping {
+    readonly action: string;
+    readonly kind: string;
+}
+/** Default role mapping. `TOOL` is a decision-kind `request`: it is the call being authorized. */
+export declare const DEFAULT_ROLE_MAPPING: Readonly<Record<string, RoleMapping>>;
+/**
+ * The `blob` convention this module reads.
+ *
+ * A `blob` payload is arbitrary JSON, so there is nothing to parse until
+ * someone agrees on a shape. This is that shape, and it is the one worth
+ * writing from `CreateEvent`: `action` and `kind` decide the trace's grammar
+ * slots, `input`/`output`/`error` become the payload groups that land in both
+ * bags, and everything else becomes `attributes`. Every key is optional; an
+ * absent `action` falls back to the role mapping's `OTHER`.
+ */
+export declare const BLOB_KEYS: readonly ["action", "kind", "input", "output", "error"];
+/** Options shared by the normalizer and the activity. */
+export interface AgentCoreNormalizeOptions {
+    /** Overrides merged over {@link DEFAULT_ROLE_MAPPING}. */
+    readonly roles?: Readonly<Record<string, RoleMapping>>;
+    /** Cedar resource id for every event. Default: the event's `memoryId`. */
+    readonly target?: string;
+    /** Default `"rename"`. */
+    readonly onNonIdentifierField?: NonIdentifierFieldPolicy;
+}
+/** A normalized history plus whatever the coercion had to rewrite. */
+export interface NormalizedHistory {
+    readonly events: readonly AgentCoreSessionEvent[];
+    readonly renames: readonly FieldRename[];
+}
+/**
+ * `ListEvents` output → the renderer's normalized events. Pure: no transport.
+ *
+ * One event with N payload members becomes N normalized events sharing the
+ * event's timestamp, with `#0`, `#1`, … appended to the id — the trace's
+ * `requestId` has to identify a decision point, and a two-member event is two
+ * decision points. A member that is neither `conversational` nor `blob` is a
+ * shape this module does not know, and it throws rather than being skipped:
+ * a silently dropped tool call is a temporal predicate that silently misses.
+ */
+export declare function normalizeMemoryEvents(events: readonly MemoryEvent[], options?: AgentCoreNormalizeOptions): NormalizedHistory;
+/** Where to read from, how to reach it, and what to sign with. */
+export interface AgentCoreReadOptions {
+    /** Endpoint override. Omit for the real regional host. */
+    readonly endpoint?: string;
+    /** Default `us-east-1`. */
+    readonly region?: string;
+    /**
+     * What to sign with: literal credentials, or a resolver that decides.
+     * Omitted, the environment answers; with nothing there, the request goes out
+     * carrying the credential scope and no signature.
+     */
+    readonly credentials?: AwsCredentialSource;
+    /** Environment the credential fallback reads. Defaults to `process.env`; injectable for tests. */
+    readonly env?: Record<string, string | undefined>;
+    /** Sign even against an endpoint override — for an override that is real AWS. */
+    readonly signEndpointOverride?: boolean;
+    /** Signing clock. Injected by tests so a signature is reproducible. */
+    readonly now?: Date;
+}
+/** What {@link listMemoryEvents} takes. */
+export interface ListMemoryEventsArgs extends AgentCoreReadOptions {
+    readonly memoryId: string;
+    readonly actorId: string;
+    readonly sessionId: string;
+    /** Stop after this many events. Default 1000 — a runaway session is not a trace. */
+    readonly maxEvents?: number;
+}
+/**
+ * `ListEvents` for one session, paginated to exhaustion or to `maxEvents`.
+ *
+ * `includePayloads` is always true: without it the response carries event ids
+ * and timestamps and nothing to match a predicate against, which is a trace
+ * that replays green and proves nothing.
+ */
+export declare function listMemoryEvents(args: ListMemoryEventsArgs, signal?: AbortSignal, http?: AwsReadHttp): Promise<MemoryEvent[]>;
+/** What {@link awsAgentCoreFetchTrace} takes. */
+export interface AwsAgentCoreFetchTraceArgs extends AgentCoreReadOptions, AgentCoreNormalizeOptions {
+    /** Default `"memory"`. The other two are named and refused — see the module header. */
+    readonly source?: AgentCoreTraceSource;
+    /** AgentCore Memory resource id. */
+    readonly memoryId: string;
+    /** Actor whose sessions are being read. */
+    readonly actorId: string;
+    /** The session to replay. */
+    readonly sessionId: string;
+    /**
+     * Window start, inclusive. Read by {@link toEpochMs}, the same function the
+     * event timestamps go through — so epoch seconds, epoch milliseconds, or
+     * anything `Date.parse` reads, and a bound is never on a different scale
+     * from the events it is being compared against.
+     */
+    readonly since?: number | string;
+    /** Window end, inclusive. Read the same way as {@link since}. */
+    readonly until?: number | string;
+    /** Cap on events fetched before the window filter. Default 1000. */
+    readonly maxEvents?: number;
+    /** Cedar namespace for actions and entity types. Default `"AgentCore"`. */
+    readonly namespace?: string;
+    /** Entity type for the actor. Default `"Actor"`. */
+    readonly principalType?: string;
+    /** Entity type for the target. Default `"Runtime"`. */
+    readonly resourceType?: string;
+    /** Default `"epoch-seconds"`. */
+    readonly origin?: AgentCoreTimeOrigin;
+    /** Kinds that build a Cedar request. Default `["request"]`. */
+    readonly decisionKinds?: readonly string[];
+    /** Weakenings to tolerate. Empty by default. */
+    readonly allow?: readonly AgentCoreTraceIssueKind[];
+    /** Write the rendered trace here — what `PolicyReplayOp`'s `tracePath` reads. */
+    readonly outPath?: string;
+    /** Throw when the window produced no events. Default `true`. */
+    readonly requireEvents?: boolean;
+}
+/** What {@link awsAgentCoreFetchTrace} returns. */
+export interface AwsAgentCoreFetchTraceResult {
+    readonly source: AgentCoreTraceSource;
+    readonly sessionId: string;
+    /** The rendered trace, one event per line, newline-terminated. */
+    readonly text: string;
+    /** Lines in the trace — decision points plus history-only events. */
+    readonly lineCount: number;
+    /** Events `ListEvents` returned before the window filter. */
+    readonly fetched: number;
+    /** Absolute path written, when `outPath` was given. */
+    readonly outPath?: string;
+    /** Payload keys the trace grammar could not spell, rewritten and reported. */
+    readonly renames: readonly FieldRename[];
+    /** Weakenings the caller allowed. Empty unless `allow` named something. */
+    readonly issues: readonly AgentCoreTraceIssue[];
+}
+/**
+ * Fetch an AgentCore session history and render it as dogwood trace text.
+ *
+ * The window is applied client-side because `ListEvents`' `filter` takes a
+ * branch and event metadata and has no time predicate, so a server-side window
+ * is not on offer. `maxEvents` bounds the fetch; `since`/`until` bound what is
+ * normalized and rendered.
+ */
+export declare function awsAgentCoreFetchTrace(args: AwsAgentCoreFetchTraceArgs, signal?: AbortSignal, http?: AwsReadHttp): Promise<AwsAgentCoreFetchTraceResult>;
+//# sourceMappingURL=trace-fetch.d.ts.map

package/dist/agentcore/trace-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-fetch.d.ts","sourceRoot":"","sources":["../../src/agentcore/trace-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAIH,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AASxB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB;AAC9B,wEAAwE;AACtE,QAAQ;AACV,uEAAuE;GACrE,cAAc;AAChB,0EAA0E;GACxE,OAAO,CAAC;AAEZ,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IAErD,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAA5B,MAAM,EAAE,oBAAoB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAuBD,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAW9D;AAID,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAIzD,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAanE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,wBAAwB,CAAA;CAAO,EACjE,IAAI,SAAK,EACT,OAAO,GAAE,WAAW,EAAO,GAC1B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CA6BrD;AAmDD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAKtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,yDAA0D,CAAC;AAEjF,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAC1D;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,GAAE,yBAA8B,GACtC,iBAAiB,CAgFnB;AASD,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AA2CD,2CAA2C;AAC3C,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAAyB,GAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,CAiCxB;AAID,iDAAiD;AACjD,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB,EAAE,yBAAyB;IACjG,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAEpD,iFAAiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACjD;AAOD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAAyB,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CAqDvC"}

package/dist/agentcore/trace-render.d.ts

@@ -0,0 +1,256 @@
+/**
+ * Render an AgentCore session history as dogwood replay-trace text (#1685).
+ *
+ * This module is pure: normalized events in, text out, no transport and no
+ * filesystem. It exists separately from `./trace-fetch.ts` for two reasons.
+ * The Bedrock AgentCore observability surface is in preview and moving, so the
+ * thing most likely to be rewritten is the fetch, and the grammar it renders
+ * into is the thing least likely to move. And the line grammar has two traps in
+ * it that are worth testing byte-for-byte without a mock HTTP stack in the way.
+ *
+ * ## The grammar
+ *
+ * From the #1657 verification (§6, read from
+ * `dogwood-language/src/interpreter/log_parse.rs` at the pinned SHA
+ * `5063bcc2d6d6cf5024d1b0498e6cc8ef52cbcf0c`), one event per line:
+ *
+ * ```
+ * @<timestamp> [scope(principal: <uid>, resource: <uid>)]
+ *              [entities(<uid>: { <attrs> } [in [<uid>, …]], …)]
+ *              [request_context(<group>: { … }, …)]
+ *              <Ns>::Action::"<Name>"::<kind>(<field>: <value>, …)
+ * ```
+ *
+ * The three envelopes are optional and must appear in that order; the trailing
+ * group is the logged record. Blank lines are skipped and there is no comment
+ * syntax, so a `//` inside a value survives.
+ *
+ * ## The two traps
+ *
+ * 1. **`request_context(…)` and the logged record are different bags.** The
+ *    Cedar request is built from the first, temporal predicates match against
+ *    the second, and a field supplied to only one weakens either the Cedar
+ *    check or the temporal check while the replay still exits 0 with a verdict
+ *    that looks authoritative. So every payload group an event carries is
+ *    written to *both*, always — there is no per-event opt-out here, because an
+ *    AgentCore history has no way to express "this field is deliberately
+ *    Cedar-invisible". A decision-kind event with no payload at all is a
+ *    refusal, not a shrug: see {@link renderAgentCoreTrace}.
+ * 2. **Actions must be fully qualified.** `AgentCore::Action::"Transfer"`,
+ *    never `Transfer` — a short name leaves the temporal predicate unmatched
+ *    while Cedar still authorizes. A bare tool name from the history is
+ *    qualified here; an already-qualified one is validated and passed through.
+ *
+ * ## Decoupling
+ *
+ * Nothing here imports the cedar lexicon, and the cedar lexicon imports nothing
+ * from here. The contract between them is the text. The value and event types
+ * below are deliberately shaped so an object built here is *structurally*
+ * assignable to the cedar side's `TraceValue`/`TraceEvent` for anyone who wants
+ * that, but neither package depends on the other to get it, and the rendering
+ * is implemented twice on purpose. Where a choice was free — the space inside
+ * `{ … }`, the `, ` between fields, the order of the record's own injections —
+ * it matches `lexicons/cedar/src/dogwood/trace.ts` byte for byte, so a trace
+ * fetched from AWS and a trace built by hand look the same to a reader and to
+ * the parser.
+ */
+/** `Ns::Type::"id"` in value position. */
+export interface AgentCoreEntityRef {
+    readonly traceValue: "entity";
+    readonly uid: string;
+}
+/** `1.50` — Cedar's decimal surface form, which a JS number cannot carry. */
+export interface AgentCoreDecimal {
+    readonly traceValue: "decimal";
+    readonly text: string;
+}
+/** Surface text passed through untouched — the escape hatch, used sparingly. */
+export interface AgentCoreRaw {
+    readonly traceValue: "raw";
+    readonly text: string;
+}
+/** A tagged value: one rendered specially rather than by JS type. */
+export type AgentCoreTagged = AgentCoreEntityRef | AgentCoreDecimal | AgentCoreRaw;
+/** Anything that can sit in a trace field, in Cedar surface forms. */
+export type AgentCoreTraceValue = string | number | boolean | AgentCoreTagged | readonly AgentCoreTraceValue[] | {
+    readonly [key: string]: AgentCoreTraceValue;
+};
+/** A named group of fields — what one `request_context` envelope entry holds. */
+export type AgentCoreFields = {
+    readonly [key: string]: AgentCoreTraceValue;
+};
+/**
+ * A history that cannot become an honest trace.
+ *
+ * Thrown rather than worked around. Every case this covers is one where the
+ * alternative is a trace that replays green and proves less than it looks like
+ * it proves, which is the failure mode the whole module is arranged against.
+ */
+export declare class AgentCoreTraceError extends Error {
+    /** 0-based position in the event list, when one event is to blame. */
+    readonly index?: number | undefined;
+    constructor(message: string, 
+    /** 0-based position in the event list, when one event is to blame. */
+    index?: number | undefined);
+}
+/** `Ns::Type::"id"`. Validated at construction, so a short name cannot slip through. */
+export declare function agentCoreEntityRef(uid: string): AgentCoreEntityRef;
+/**
+ * A Cedar decimal, written as it should appear (`"1.50"`).
+ *
+ * `context` names the field it came from when there is one, so a payload that
+ * cannot be represented says *where* rather than only *what*.
+ */
+export declare function agentCoreDecimal(text: string, context?: string): AgentCoreDecimal;
+/** Surface text, rendered verbatim. For values this module has no shape for. */
+export declare function agentCoreRaw(text: string): AgentCoreRaw;
+/** Render one value in the Cedar surface form the trace parser reads. */
+export declare function renderValue(value: AgentCoreTraceValue): string;
+/** `{ a: 1, b: "x" }` — a record body, braces included. */
+export declare function renderFields(fields: AgentCoreFields): string;
+/**
+ * One decision-relevant thing that happened in an AgentCore session, in the
+ * shape the fetch normalizes to and the renderer reads.
+ *
+ * This is deliberately *not* the dogwood event shape. It is the semantic shape
+ * of an agent session — who acted, on what, with which payload — so that a
+ * change to the observability surface under preview churn is a change to the
+ * mapping in `./trace-fetch.ts` and not to the grammar below.
+ */
+export interface AgentCoreSessionEvent {
+    /** When it happened, epoch **milliseconds**. Converted to the trace's i64 here. */
+    readonly timeMs: number;
+    /** The session it belongs to. Lands in the logged record as `sessionId`. */
+    readonly sessionId: string;
+    /** Unique within the session. Lands in the logged record as `requestId`. */
+    readonly eventId: string;
+    /**
+     * The dogwood event kind. `request` / `response` / `error` conventionally;
+     * the truth is whichever kinds the project's `.dwschema` marks `decision`,
+     * and that file is not visible from here.
+     */
+    readonly kind: string;
+    /**
+     * The tool or operation. A bare name (`"Transfer"`) is qualified with the
+     * namespace; an already-qualified `Ns::Action::"Name"` is validated and used
+     * as-is. Never rendered short.
+     */
+    readonly action: string;
+    /** Who acted — an actor id, or a fully qualified uid to override the type. */
+    readonly actor: string;
+    /** What was acted on — a runtime/gateway id, or a fully qualified uid. */
+    readonly target: string;
+    /** The call's input payload. Lands in both bags as the `input` group. */
+    readonly input?: AgentCoreFields;
+    /** The call's result. Lands in both bags as the `output` group. */
+    readonly output?: AgentCoreFields;
+    /** A failure's detail. Lands in both bags as the `error` group. */
+    readonly error?: AgentCoreFields;
+    /**
+     * Anything the source carried that has no field of its own. Lands in both
+     * bags as the `attributes` group.
+     */
+    readonly attributes?: AgentCoreFields;
+}
+/** How `@<i64>` is derived from `timeMs`. */
+export type AgentCoreTimeOrigin = 
+/** Epoch seconds. Absolute, comparable across sessions, large numbers. */
+"epoch-seconds"
+/** Seconds since the earliest event, so the first line reads `@0`. */
+ | "relative-seconds";
+/** What {@link renderAgentCoreTrace} takes. */
+export interface AgentCoreTraceOptions {
+    /** Cedar namespace for actions and entity types. Default `"AgentCore"`. */
+    readonly namespace?: string;
+    /** Entity type for `actor`. Default `"Actor"`. */
+    readonly principalType?: string;
+    /** Entity type for `target`. Default `"Runtime"`. */
+    readonly resourceType?: string;
+    /** Default `"epoch-seconds"`. */
+    readonly origin?: AgentCoreTimeOrigin;
+    /**
+     * Kinds that produce a decision, and so build a Cedar request. Default
+     * `["request"]`, the convention the default event schema follows. A
+     * history-only event never becomes a Cedar request, so an absent payload on
+     * one is not a weakening.
+     */
+    readonly decisionKinds?: readonly string[];
+    /** Weakenings to tolerate. Empty by default — see {@link renderAgentCoreTrace}. */
+    readonly allow?: readonly AgentCoreTraceIssueKind[];
+}
+/** What {@link auditAgentCoreEvents} can find. */
+export type AgentCoreTraceIssueKind = 
+/** A decision-kind event with no payload: the Cedar request carries no context. */
+"no-request-context"
+/** Two events in one session sharing an id: `requestId` stops identifying anything. */
+ | "duplicate-event-id";
+/** One finding against a normalized history. */
+export interface AgentCoreTraceIssue {
+    readonly kind: AgentCoreTraceIssueKind;
+    /** 0-based position in the *sorted* event list. */
+    readonly index: number;
+    readonly timeMs: number;
+    readonly message: string;
+}
+/**
+ * `Ns::Action::"Name"` from a bare tool name, or a qualified action validated.
+ *
+ * The fully-qualified requirement is the second §6 trap: a short name leaves
+ * every temporal predicate unmatched while Cedar still authorizes, so the
+ * replay is green and blind.
+ */
+export declare function qualifyAction(action: string, namespace: string, index?: number): string;
+/** `Ns::Type::"id"` from a bare id, or a qualified uid validated. */
+export declare function qualifyUid(id: string, namespace: string, type: string, what: string, index?: number): string;
+/**
+ * The weakening checks, applied to a normalized history.
+ *
+ * Everything here is something that makes a replay *weaker* rather than
+ * something that makes it fail, which is exactly the class a green replay run
+ * hides. Structural malformation throws instead: see {@link AgentCoreTraceError}.
+ */
+export declare function auditAgentCoreEvents(events: readonly AgentCoreSessionEvent[], options?: AgentCoreTraceOptions): AgentCoreTraceIssue[];
+/** One line's worth: the envelopes and the logged record, fully resolved. */
+export interface AgentCoreTraceLine {
+    readonly timestamp: number;
+    readonly action: string;
+    readonly kind: string;
+    readonly scope: {
+        readonly principal: string;
+        readonly resource: string;
+    };
+    readonly requestContext: AgentCoreFields;
+    readonly record: AgentCoreFields;
+}
+/**
+ * Resolve one normalized event into the envelopes and the logged record.
+ *
+ * Both bags get every payload group; the record additionally gets the event
+ * schema's own injections (`callerPrincipal`, `callerResource`, `sessionId`,
+ * `requestId`), which are never part of the Cedar request. Field order matches
+ * the §6 example line: groups first, then the injections.
+ */
+export declare function toTraceLine(event: AgentCoreSessionEvent, timestamp: number, options?: AgentCoreTraceOptions, index?: number): AgentCoreTraceLine;
+/** One line as the trace parser reads it. Never ends in a newline. */
+export declare function renderTraceLine(line: AgentCoreTraceLine): string;
+/** A rendered trace, and what the audit tolerated on the way. */
+export interface AgentCoreTrace {
+    /** The text, one event per line, newline-terminated. */
+    readonly text: string;
+    /** The resolved lines, in render order. */
+    readonly lines: readonly AgentCoreTraceLine[];
+    /** Findings the caller allowed. Empty unless `allow` named something. */
+    readonly issues: readonly AgentCoreTraceIssue[];
+}
+/**
+ * Render a normalized AgentCore history as dogwood trace text.
+ *
+ * The inversion of the §6 traps: every payload group lands in both bags, every
+ * action comes out fully qualified, the history is ordered the way the
+ * interpreter reads it, and a history that would produce a weakened trace
+ * throws instead. Naming a kind in `allow` is how a caller says the weakening
+ * is the point — the alternative was a trace that replays green and proves
+ * less than it looks like it proves.
+ */
+export declare function renderAgentCoreTrace(events: readonly AgentCoreSessionEvent[], options?: AgentCoreTraceOptions): AgentCoreTrace;
+//# sourceMappingURL=trace-render.d.ts.map

package/dist/agentcore/trace-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-render.d.ts","sourceRoot":"","sources":["../../src/agentcore/trace-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAuBnF,sEAAsE;AACtE,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,OAAO,GACP,eAAe,GACf,SAAS,mBAAmB,EAAE,GAC9B;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAEpD,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAO9E;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;gBAFvB,OAAO,EAAE,MAAM;IACf,sEAAsE;IAC7D,KAAK,CAAC,EAAE,MAAM,YAAA;CAK1B;AAmBD,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAMjF;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEvD;AAgBD,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAiC9D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAK5D;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACvC;AAED,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB;AAC7B,0EAA0E;AACxE,eAAe;AACjB,sEAAsE;GACpE,kBAAkB,CAAC;AAEvB,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACrD;AAED,kDAAkD;AAClD,MAAM,MAAM,uBAAuB;AACjC,mFAAmF;AACjF,oBAAoB;AACtB,uFAAuF;GACrF,oBAAoB,CAAC;AAEzB,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAsBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CASvF;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5G;AAyCD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,qBAAqB,EAAE,EACxC,OAAO,GAAE,qBAA0B,GAClC,mBAAmB,EAAE,CA6BvB;AAID,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,qBAAqB,EAC5B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,qBAA0B,EACnC,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,CAgCpB;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAmBhE;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,qBAAqB,EAAE,EACxC,OAAO,GAAE,qBAA0B,GAClC,cAAc,CA4BhB"}