@intutic/gate 1.10.1

package/dist/managedAgents.d.ts

@@ -0,0 +1,375 @@
+/**
+ * Anthropic Managed Agents (public beta since 2026-04-08) — a session
+ * confirmation responder, plus guidance for the two execution surfaces this
+ * adapter does NOT cover the same way.
+ *
+ * `@intutic/gate/managed-agents` — the TypeScript twin of the Python SDK's
+ * `intutic_clawde.gate.adapters.managed_agents`. See that module's doc for
+ * the full research trail; this header covers only what differs for the
+ * TypeScript SDK.
+ *
+ * Managed Agents is architecturally different from every other adapter in
+ * this package: the customer's process does not run the tool-call loop.
+ * Anthropic hosts a "session" that emits an event stream, and the customer's
+ * backend answers it. There is no local function call to wrap the way
+ * `wrapTools()` wraps a Mastra tool.
+ *
+ * ## The veto mechanism — CONFIRMED against a real install
+ *
+ * `@anthropic-ai/sdk@0.117.1` (the latest published release at the time this
+ * adapter was built) was installed as a devDependency of this package and its
+ * shipped `.d.ts` read directly (not inferred from docs alone; the Python
+ * twin was checked the same way against `anthropic==0.122.0`, its own
+ * latest):
+ *
+ *   * `resources/beta/sessions/events.d.ts` — every request this module
+ *     issues (`.list()`, `.send()`, `.stream()`) carries
+ *     `anthropic-beta: managed-agents-2026-04-01` automatically (the real
+ *     client sets it); {@link MANAGED_AGENTS_BETA} documents the value for a
+ *     caller building a raw request.
+ *   * `BetaManagedAgentsUserToolConfirmationEventParams` — the wire shape
+ *     this module builds: `{ type: 'user.tool_confirmation', tool_use_id,
+ *     result: 'allow' | 'deny', deny_message?, session_thread_id? }`.
+ *   * `BetaManagedAgentsAgentToolUseEvent` and
+ *     `BetaManagedAgentsAgentMCPToolUseEvent` both carry
+ *     `evaluated_permission?: 'allow' | 'ask' | 'deny'`. A call the server
+ *     evaluated to `'ask'` (e.g. because its `permission_policy` is
+ *     `always_ask` — Anthropic's docs mark MCP toolsets as `always_ask` by
+ *     default; the SDK types do not encode a default for built-in
+ *     agent-toolset tools, so check current docs) PAUSES the session —
+ *     Anthropic's own docs: "Denied tools do not run." A `'deny'` verdict
+ *     means the SERVER already denied the call (no confirmation is expected
+ *     or accepted); `'allow'` or unset means the call never paused at all.
+ *     **This is the real, documented pre-execution veto this module answers
+ *     — it is not observe-only.**
+ *   * `lib/tools/SessionToolRunner.d.ts` is Anthropic's OWN reference
+ *     dispatcher: it executes `agent.tool_use` / `agent.custom_tool_use`
+ *     calls and posts results, but it does **not** decide `allow`/`deny` for
+ *     an `ask`-gated call itself — it holds until *something* sends the
+ *     matching `user.tool_confirmation` event. That "something" is what this
+ *     module provides: {@link confirmationForEvent} /
+ *     {@link IntuticSessionConfirmer} turn a paused `agent.tool_use` /
+ *     `agent.mcp_tool_use` event into a `Gate.guard()`-driven verdict.
+ *   * `lib/environments/worker.d.ts`'s `EnvironmentWorker` (the self-hosted
+ *     sandbox driver) is built on `SessionToolRunner` for built-in
+ *     agent-toolset tools (bash, edit, read, write, glob, grep, web_fetch,
+ *     web_search). **Self-hosted built-in tools therefore pause and resolve
+ *     through the IDENTICAL `agent.tool_use` / `evaluated_permission` /
+ *     `user.tool_confirmation` mechanism as hosted ones** — this adapter
+ *     covers them the same way. What differs for self-hosted is only WHERE
+ *     the tool body executes (the customer's own worker process), not how
+ *     the pre-execution veto works.
+ *   * `agent.mcp_tool_use` is explicitly excluded from `SessionToolRunner`'s
+ *     own dispatch (its own doc comment: "Server-side `agent.mcp_tool_use`
+ *     calls are intentionally excluded — the runner does not handle them" —
+ *     MCP tools run server-side at Anthropic). But the confirmation gate is a
+ *     SEPARATE mechanism from execution: `BetaManagedAgentsAgentMCPToolUseEvent`
+ *     carries `evaluated_permission` exactly like the built-in event does, so
+ *     this module answers MCP pauses too, even though nothing in the official
+ *     SDK dispatches their execution locally.
+ *
+ * ## What this module does NOT cover the same way — custom tools
+ *
+ * `BetaManagedAgentsAgentCustomToolUseEvent` has **no** `evaluated_permission`
+ * field and no `permission_policy` concept at all: a custom tool always
+ * executes wherever the client that owns its name is listening, with no
+ * pause. It is answered with `user.custom_tool_result`
+ * (`custom_tool_use_id` + `content` + `is_error`), not
+ * `user.tool_confirmation`. This is the "customer's own process runs the
+ * call" surface the phase brief anticipated — the natural integration point
+ * IS this package's `wrapTools()`/`wrapTool()`, exactly as the brief
+ * guessed. BUT verify the shape, because the generic helper does not apply
+ * as-is: `BetaRunnableTool` (`lib/tools/BetaRunnableTool.d.ts`, what
+ * `SessionToolRunner` dispatches against) exposes a `run(args, context)`
+ * method, not the `execute(input)` method `wrapTools()`'s object branch looks
+ * for (`wrapTools.ts` only recognises `.execute`) — handing it a
+ * `BetaRunnableTool` throws a `TypeError` rather than silently skipping
+ * governance, but it still means the generic helper needs a `.run`-aware
+ * sibling rather than "just works". {@link wrapManagedAgentsCustomTool} /
+ * {@link wrapManagedAgentsCustomTools} are that sibling — same throw-based
+ * refusal contract, applied to `.run` instead of `.execute`.
+ *
+ * ## What this module does NOT cover at all — the sandbox tool BODY
+ *
+ * The self-hosted `EnvironmentWorker` gates tool PAUSES exactly like the
+ * hosted path (see above) — but the tool's actual execution runs inside the
+ * customer's own worker process, outside this adapter's reach, same as every
+ * other Intutic adapter's posture toward a framework's built-in tool bodies
+ * (see openai.ts's module doc for the precedent). This module governs
+ * WHETHER the call runs; it does not — and cannot — inspect or modify what
+ * the tool body does once allowed.
+ *
+ * ## Webhook vs. streamed/polled delivery — both are real, verified live
+ *
+ * `resources/beta/webhooks.d.ts`: `client.beta.webhooks.unwrap(body, {
+ * headers, key })` verifies the HMAC signature and returns a typed event
+ * (synchronously — no network call); for a pause it is
+ * `session.requires_action`, which carries only `id` (the session id),
+ * `organization_id`, `workspace_id` — NOT the tool call itself. A webhook is
+ * therefore a NOTIFICATION to re-poll, not a self-contained payload —
+ * {@link IntuticSessionConfirmer.handleWebhook} does exactly that: re-lists
+ * the session's unanswered events and answers them. `events.stream()` /
+ * `events.list()` are the poll/stream alternative this module also supports
+ * directly via {@link IntuticSessionConfirmer.poll} /
+ * {@link IntuticSessionConfirmer.watch}.
+ *
+ * ## Fail-closed posture
+ *
+ * Matches every other adapter in this package: no gate configured, or an
+ * unexpected exception out of `Gate.guard()`, both produce a `'deny'` verdict
+ * — never a silently-allowed, unevaluated call. Only `IntuticGateRefusal` is
+ * distinguished (its own message becomes `deny_message`); anything else is
+ * wrapped in a generic "gate crashed" `deny_message`.
+ *
+ * ## What this module does NOT import
+ *
+ * Deliberately no runtime dependency on `@anthropic-ai/sdk` — the types below
+ * are narrow structural copies of only the shapes this adapter touches, same
+ * policy as openai.ts / mastra.ts / vercel.ts (see openai.ts's module doc for
+ * the full rationale). The real package is a devDependency used by
+ * `__tests__/managedAgents.test.ts` to type-check these structural types
+ * against the real shipped ones.
+ *
+ * @module
+ */
+import { Gate } from './gate.js';
+/** The beta header every Sessions-API request needs. The real SDK sets this
+ *  on every `.list()`/`.send()`/`.stream()` call automatically — this
+ *  constant exists for callers building their own request against the
+ *  endpoint directly. */
+export declare const MANAGED_AGENTS_BETA = "managed-agents-2026-04-01";
+/** Slice of `BetaManagedAgentsAgentToolUseEvent` this module reads. */
+export interface AgentToolUseEventLike {
+    id: string;
+    type: 'agent.tool_use';
+    name: string;
+    input: Record<string, unknown>;
+    evaluated_permission?: 'allow' | 'ask' | 'deny' | null;
+    session_thread_id?: string | null;
+}
+/** Slice of `BetaManagedAgentsAgentMCPToolUseEvent` this module reads. */
+export interface AgentMcpToolUseEventLike {
+    id: string;
+    type: 'agent.mcp_tool_use';
+    name: string;
+    mcp_server_name: string;
+    input: Record<string, unknown>;
+    evaluated_permission?: 'allow' | 'ask' | 'deny' | null;
+    session_thread_id?: string | null;
+}
+/** Slice of `BetaManagedAgentsAgentCustomToolUseEvent` — carries no
+ *  `evaluated_permission`: custom tools never pause (see module doc). */
+export interface AgentCustomToolUseEventLike {
+    id: string;
+    type: 'agent.custom_tool_use';
+    name: string;
+    input: Record<string, unknown>;
+    session_thread_id?: string | null;
+}
+/** Any session event — this module inspects only `.type` (and, for the
+ *  confirmable two, the fields above) so a wider real event passes through
+ *  this structural type untouched. */
+export type ManagedAgentsSessionEventLike = AgentToolUseEventLike | AgentMcpToolUseEventLike | AgentCustomToolUseEventLike | {
+    id?: string;
+    type: string;
+    tool_use_id?: string;
+    [key: string]: unknown;
+};
+/** Structural copy of `BetaManagedAgentsUserToolConfirmationEventParams` —
+ *  exactly what this module sends via `events.send()`. */
+export interface UserToolConfirmationParams {
+    type: 'user.tool_confirmation';
+    tool_use_id: string;
+    result: 'allow' | 'deny';
+    deny_message?: string;
+    session_thread_id?: string;
+}
+/** Structural slice of `client.beta.sessions.events` — only the three
+ *  methods this module calls, positional-argument-compatible with the real
+ *  SDK's `list(sessionID, params?, options?)` / `send(sessionID, params,
+ *  options?)` / `stream(sessionID, params?, options?)`. */
+export interface ManagedAgentsSessionEventsClientLike {
+    list(sessionId: string, params?: {
+        limit?: number;
+        types?: string[];
+    }): AsyncIterable<ManagedAgentsSessionEventLike>;
+    send(sessionId: string, params: {
+        events: UserToolConfirmationParams[];
+    }): Promise<unknown>;
+    stream(sessionId: string): Promise<AsyncIterable<ManagedAgentsSessionEventLike>>;
+}
+/** Structural slice of the Anthropic client this module needs:
+ *  `client.beta.sessions.events`. */
+export interface ManagedAgentsClientLike {
+    beta: {
+        sessions: {
+            events: ManagedAgentsSessionEventsClientLike;
+        };
+    };
+}
+export interface ManagedAgentsWrapOptions {
+    /** Overrides the process-wide installed gate (`install(new Gate(...))`). */
+    gate?: Gate;
+}
+/**
+ * Build the `user.tool_confirmation` params answering `event`, or `null` if
+ * `event` needs no answer from this module.
+ *
+ * `null` covers three cases, all correct to send nothing for: the event
+ * isn't `agent.tool_use`/`agent.mcp_tool_use` (including
+ * `agent.custom_tool_use` — see the module doc); its `evaluated_permission`
+ * is `'allow'` or unset (the call never paused); or it is already `'deny'`
+ * (the SERVER already resolved it — sending a confirmation for an id the
+ * server considers closed would just error).
+ *
+ * Anything else — `'ask'`, or a permission value this module doesn't
+ * recognise — is treated as a pause needing a verdict, matching
+ * `SessionToolRunner`'s own fail-closed handling of unrecognised wire values
+ * (hold/deny rather than dispatch).
+ *
+ * ASYNC: `Gate.guard()` is async in this package (unlike the Python SDK's
+ * synchronous twin) — every caller must `await` this.
+ */
+export declare function confirmationForEvent(event: ManagedAgentsSessionEventLike, opts?: ManagedAgentsWrapOptions): Promise<UserToolConfirmationParams | null>;
+/**
+ * Attaches Intutic governance to one Managed Agents session's confirmation
+ * pauses.
+ *
+ * Duck-typed on `client`: only `client.beta.sessions.events.list(sessionId,
+ * ...)`, `.send(sessionId, { events })`, and `.stream(sessionId)` are ever
+ * called — pass a real `Anthropic` client, or a test double satisfying
+ * {@link ManagedAgentsClientLike}.
+ *
+ * Usage — polling (e.g. right after creating a session, or from a
+ * cron/worker loop):
+ *
+ * ```ts
+ * import { Anthropic } from '@anthropic-ai/sdk'
+ * import { Gate, install } from '@intutic/gate'
+ * import { IntuticSessionConfirmer } from '@intutic/gate/managed-agents'
+ *
+ * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
+ * const client = new Anthropic()
+ * const confirmer = new IntuticSessionConfirmer(client, session.id)
+ * await confirmer.poll() // answers every currently-pending tool_use/mcp_tool_use pause
+ * ```
+ *
+ * Usage — webhook (`session.requires_action`):
+ *
+ * ```ts
+ * const event = client.beta.webhooks.unwrap(rawBody, { headers })
+ * if (event.data.type === 'session.requires_action') {
+ *   await new IntuticSessionConfirmer(client, event.data.id).poll()
+ * }
+ * ```
+ *
+ * Usage — live stream. `watch()` reconnects with capped backoff and re-polls
+ * after every reconnect, so a pause raised while the stream was down is
+ * still answered (see {@link watch} and {@link WatchOptions}):
+ *
+ * ```ts
+ * const ac = new AbortController()
+ * for await (const sent of confirmer.watch({ signal: ac.signal, idleTimeoutMs: 120_000 })) {
+ *   console.log(sent.tool_use_id, sent.result)
+ * }
+ * ```
+ */
+/** Options for {@link IntuticSessionConfirmer.watch} (TD-428). */
+export interface WatchOptions {
+    /** Reconnects allowed after the first connection; unbounded by default. */
+    maxReconnects?: number;
+    backoffStartMs?: number;
+    backoffCapMs?: number;
+    /** Drop and reopen a stream that has been silent this long. */
+    idleTimeoutMs?: number;
+    /** Aborting ends `watch()` at the next opportunity. */
+    signal?: AbortSignal;
+}
+/** 400–499 except 408 (timeout) and 429 (rate limit): a retry cannot help. */
+export declare function isFatal4xx(err: unknown): boolean;
+export declare class IntuticSessionConfirmer {
+    readonly sessionId: string;
+    private readonly client;
+    private readonly gate;
+    /** Tool-call event ids already answered (by this instance), so a `poll()`
+     *  that overlaps a live `watch()` — or a re-delivered webhook — never
+     *  double-sends a confirmation for the same id. */
+    private readonly answered;
+    constructor(client: ManagedAgentsClientLike, sessionId: string, opts?: ManagedAgentsWrapOptions);
+    private noteConfirmationEvent;
+    /** Answer one event if it needs an answer; returns the sent params, or
+     *  `null` if nothing was sent (already answered, or
+     *  {@link confirmationForEvent} returned `null` — see its doc). */
+    handleEvent(event: ManagedAgentsSessionEventLike): Promise<UserToolConfirmationParams | null>;
+    /**
+     * List recent events and answer every unanswered
+     * `agent.tool_use`/`agent.mcp_tool_use` pause found. Returns the sent
+     * confirmations, in event order.
+     */
+    poll(opts?: {
+        limit?: number;
+    }): Promise<UserToolConfirmationParams[]>;
+    /**
+     * Answer the pause a `session.requires_action` webhook signalled.
+     *
+     * `unwrapped` is what `client.beta.webhooks.unwrap(rawBody, { headers })`
+     * returns (or its `.data`, or a plain object of the same shape). Anything
+     * other than a `session.requires_action` payload is a no-op (`[]`): this
+     * module only ever answers tool-confirmation pauses, so every other
+     * webhook event type is intentionally ignored here.
+     *
+     * The webhook payload carries only the session id — it does NOT carry the
+     * tool call itself — so this always falls through to a {@link poll}.
+     */
+    handleWebhook(unwrapped: {
+        data?: {
+            type?: string;
+            id?: string;
+        };
+        type?: string;
+        id?: string;
+    }): Promise<UserToolConfirmationParams[]>;
+    /**
+     * Catch up on anything already pending, then follow the live event
+     * stream, yielding each confirmation as it is sent, reconnecting when the
+     * stream drops (TD-428).
+     *
+     * Modelled on the SDK's own `SessionToolRunner#streamLoop`: open the
+     * stream FIRST, then reconcile with `poll()` — an event emitted in the gap
+     * is buffered on the stream rather than lost, and `answered` dedups
+     * anything that shows up on both. On end or error the loop sleeps
+     * (backoff doubling from `backoffStartMs` to `backoffCapMs`, reset on any
+     * received event) and reopens. A fatal 4xx (anything 400–499 other than
+     * 408 and 429) rethrows: the session is gone or the key is wrong, and
+     * retrying would loop forever. `idleTimeoutMs` drops a stream that has
+     * gone silent and reopens it, which re-polls. Ends only on a terminal
+     * event, `signal` abort, or `maxReconnects` exhausted (unbounded by
+     * default, the SDK's own choice).
+     */
+    watch(opts?: WatchOptions): AsyncGenerator<UserToolConfirmationParams>;
+}
+/** Structural slice of `BetaRunnableTool` — the shape
+ *  `SessionToolRunner`/`EnvironmentWorker` dispatch custom tools against
+ *  (`lib/tools/BetaRunnableTool.d.ts`). Note the method is `run`, not
+ *  `execute` — the reason `wrapTools()`'s generic object branch cannot be
+ *  used as-is here (see module doc). */
+export interface ManagedAgentsRunnableToolLike {
+    name: string;
+    run: (args: Record<string, unknown>, context?: unknown) => unknown;
+    [key: string]: unknown;
+}
+/**
+ * Wrap one Managed Agents custom tool (`BetaRunnableTool` shape) so
+ * `Gate.guard()` runs before `run()` executes.
+ *
+ * Returns a NEW object (a shallow copy with `run` replaced); does not mutate
+ * the one passed in. On refusal the wrapped `run()` THROWS
+ * `IntuticGateRefusal` before the real implementation ever runs — the same
+ * throw-based contract `wrapTool()` uses. Already-wrapped tools pass through
+ * unchanged.
+ */
+export declare function wrapManagedAgentsCustomTool<T extends ManagedAgentsRunnableToolLike>(tool: T, opts?: ManagedAgentsWrapOptions): T;
+/** Wrap a collection of Managed Agents custom tools in one call — see
+ *  {@link wrapManagedAgentsCustomTool}. */
+export declare function wrapManagedAgentsCustomTools<T extends ManagedAgentsRunnableToolLike>(tools: readonly T[], opts?: ManagedAgentsWrapOptions): T[];
+//# sourceMappingURL=managedAgents.d.ts.map

package/dist/managedAgents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managedAgents.d.ts","sourceRoot":"","sources":["../src/managedAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqIG;AAEH,OAAO,EAAE,IAAI,EAAwB,MAAM,WAAW,CAAA;AAYtD;;;yBAGyB;AACzB,eAAO,MAAM,mBAAmB,8BAA8B,CAAA;AAE9D,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,gBAAgB,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,oBAAoB,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAA;IACtD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;yEACyE;AACzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,uBAAuB,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;sCAEsC;AACtC,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAA;AAE/E;0DAC0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;2DAG2D;AAC3D,MAAM,WAAW,oCAAoC;IACnD,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC5C,aAAa,CAAC,6BAA6B,CAAC,CAAA;IAC/C,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QAAE,MAAM,EAAE,0BAA0B,EAAE,CAAA;KAAE,GAC/C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC,CAAA;CACjF;AAED;qCACqC;AACrC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE;QACJ,QAAQ,EAAE;YACR,MAAM,EAAE,oCAAoC,CAAA;SAC7C,CAAA;KACF,CAAA;CACF;AAaD,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CA2C5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAMD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGhD;AAkCD,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC;;uDAEmD;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;gBAEjC,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,wBAA6B;IAMnG,OAAO,CAAC,qBAAqB;IAK7B;;uEAEmE;IAC7D,WAAW,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAUnG;;;;OAIG;IACG,IAAI,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAiBhF;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAC5G,0BAA0B,EAAE,CAC7B;IAaD;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,cAAc,CAAC,0BAA0B,CAAC;CAsClF;AAID;;;;wCAIwC;AACxC,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAA;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,6BAA6B,EACjF,IAAI,EAAE,CAAC,EACP,IAAI,GAAE,wBAA6B,GAClC,CAAC,CAeH;AAED;2CAC2C;AAC3C,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,6BAA6B,EAClF,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,IAAI,GAAE,wBAA6B,GAClC,CAAC,EAAE,CAEL"}