@mongodb-js/agent-engine-runner-shared 0.11.3

package/dist/secure_wrapper.d.ts

@@ -0,0 +1,332 @@
+/**
+ * SecureToolWrapper — routes all tool calls through OE for logging and policy enforcement.
+ *
+ * Provides:
+ *   SecureToolWrapper: wraps tool execution calls to route through OE
+ *   createSecureToolFunction: wraps a tool function with runtime context lookup
+ *   requestOeApproval / reportOeResult: low-level OE HTTP helpers (exported for SecureLLMProxy)
+ *   PolicyDeniedException / ToolExecutionError / LLMInvocationError: exception classes
+ */
+import { type GuardrailMeta, type ToolExecuteResponse } from "./models.js";
+import { type ToolAPIError } from "./tool_api_error.js";
+import { type DurableMemoryState } from "./workflow/index.js";
+/**
+ * Normalized usage shape returned by `extractUsage` / `extractPodUsage`.
+ * Mirrors Python's dict-shaped return so downstream consumers can pass these
+ * fields straight into `reportOeResult`.
+ */
+export interface ExtractedUsage {
+    prompt_tokens: number | null;
+    completion_tokens: number | null;
+    total_tokens: number | null;
+    model: string | null;
+}
+/**
+ * Extract token usage from an LLM response's `response_metadata`.
+ *
+ * Handles provider-variant key names:
+ *   - OpenAI:   `response_metadata.usage.{prompt_tokens, completion_tokens, total_tokens}`
+ *   - Anthropic: `response_metadata.usage.{input_tokens, output_tokens}`
+ *   - Some providers: `response_metadata.token_usage.{...}`
+ *
+ * Returns an object with keys `prompt_tokens`, `completion_tokens`,
+ * `total_tokens`, `model`. All values may be `null` if unavailable.
+ *
+ * Mirrors Python's `agent_engine_runner_shared.secure_wrapper.extract_usage` 1:1.
+ */
+export declare function extractUsage(response: unknown, fallbackModel?: string | null): ExtractedUsage;
+/**
+ * Extract token usage from a tool-pod usage dict into `reportOeResult` kwargs.
+ *
+ * Uses `!= null` checks instead of truthy `||` so a valid `0` token count is
+ * not treated as missing. Computes `total_tokens` when the provider omits it.
+ *
+ * Mirrors Python's `_extract_pod_usage`. Python keeps the leading underscore
+ * as a "private" convention and leaves the function unexported. TS exports
+ * this (TS `noUnusedLocals` flags unused module-level functions, and the
+ * leading-underscore identifier convention doesn't translate cleanly to TS).
+ *
+ * @internal — call sites are expected to live inside the agent-engine-runner-shared
+ * package or downstream framework SDKs; not part of the stable public API.
+ */
+export declare function extractPodUsage(usage: Record<string, unknown> | null | undefined, fallbackModel?: string | null): ExtractedUsage;
+export declare class PolicyDeniedException extends Error {
+    readonly reason: string;
+    /** Guardrail policy identity when the denial came from a guardrail policy. */
+    readonly guardrailMeta: GuardrailMeta | null;
+    constructor(reason: string, guardrailMeta?: GuardrailMeta | null, options?: ErrorOptions);
+}
+/** Raised when tool execution fails. */
+export declare class ToolExecutionError extends Error {
+    readonly error: string;
+    constructor(error: string, options?: ErrorOptions);
+}
+export declare class TerminalExecutionError extends ToolExecutionError {
+    constructor(error: string, options?: ErrorOptions);
+}
+export declare function raiseForOeRejection(reason: string | null | undefined, guardrailMeta?: GuardrailMeta | null): never;
+/**
+ * Raised when a tool call outlives its deadline.
+ *
+ * Distinct from PolicyDeniedException on purpose. A timeout means the call was
+ * permitted and ran — it just ran too long — so reporting it as a denial sends
+ * the developer to debug governance instead of their tool.
+ */
+export declare class ToolCallTimeoutError extends ToolExecutionError {
+    readonly toolName: string;
+    readonly timeoutSeconds: number;
+    readonly elapsedSeconds: number;
+    constructor(toolName: string, timeoutSeconds: number, elapsedSeconds: number, options?: ErrorOptions);
+}
+export declare class ExternalAPICallError extends ToolExecutionError {
+    readonly tool_api_error: ToolAPIError;
+    constructor(error: string, toolApiError: ToolAPIError, options?: ErrorOptions);
+}
+export declare class LLMInvocationError extends Error {
+    readonly error: string;
+    /** Invoke-owner attribution. Only `"llm"` means the provider failed. */
+    readonly source?: string;
+    /**
+     * Machine-readable classification the tool pod stamped on the failure
+     * (e.g. a provider credential rejection), when it did. Travels to the
+     * OE/UI on the ERROR chunk metadata instead of the generic invocation
+     * code so consumers can classify without string-matching prose.
+     */
+    readonly error_code?: string;
+    constructor(error: string, options?: ErrorOptions & {
+        source?: string;
+        error_code?: string;
+    });
+}
+export interface RequestOeApprovalArgs {
+    oeUrl: string;
+    executionId: string;
+    toolName: string;
+    arguments: Record<string, unknown>;
+    step: number;
+    kind?: string | null;
+    isLocal?: boolean;
+    /** Top-level tool argument names to redact from execution logs. */
+    redactFields?: readonly string[];
+    providerType?: string | null;
+    scopes?: readonly string[];
+    metadata?: Record<string, unknown>;
+    /** Stable LLM tool-call id, forwarded to OE for the execution-log join key. */
+    toolCallId?: string;
+    /** Caller-provided headers carried only for this active request. */
+    customHeaders?: Record<string, string>;
+    /**
+     * Overall request deadline in milliseconds. Defaults to `getToolReadTimeout()`.
+     * The LLM proxy passes a longer value (`LLM_READ_TIMEOUT`) for `invoke_llm`,
+     * because OE holds `/tool/execute` open while the LLM call completes — the
+     * analog of Python's `httpx.Timeout(get_request_timeout(), read=LLM_READ_TIMEOUT)`.
+     */
+    timeoutMs?: number;
+}
+/**
+ * Request approval from OE before executing a tool/LLM call.
+ * Any HTTP or network error becomes PolicyDeniedException — fail-safe.
+ */
+export declare function requestOeApproval(args: RequestOeApprovalArgs): Promise<ToolExecuteResponse>;
+/**
+ * Repeat the same /tool/execute while OE says the failure is retryable.
+ * Reservation-loss returns status=error with retryable=true after releasing
+ * the step stamp. Retrying the same step here keeps durable activity from
+ * recording FAILED on a call that can still succeed.
+ */
+export declare function requestOeApprovalRetryable(args: RequestOeApprovalArgs): Promise<ToolExecuteResponse>;
+export interface ReportOeResultArgs {
+    oeUrl: string;
+    executionId: string;
+    toolName: string;
+    step: number;
+    toolCallId?: string;
+    status: string;
+    result?: unknown;
+    error?: string | null;
+    durationMs: number;
+    podName?: string | null;
+    promptTokens?: number | null;
+    completionTokens?: number | null;
+    totalTokens?: number | null;
+    model?: string | null;
+    kind?: string | null;
+    metadata?: Record<string, unknown>;
+    /**
+     * Validated replica-specific OE owner base URL, already checked against
+     * `oeUrl` by the caller. When set, a single owner pre-attempt runs before the
+     * service loop and does not consume the service retry budget; the owner is
+     * best-effort, so any failure — a transport error OR any non-2xx response —
+     * marks the replica unusable and falls through to the trusted `oeUrl` loop.
+     * The owner is never retried and an owner response never throws.
+     */
+    ownerUrl?: string | null;
+    /** Called once when the owner pre-attempt fails, before service fallback. */
+    onOwnerFailure?: (() => void) | null;
+    toolApiError?: ToolAPIError | null;
+}
+/**
+ * Report an execution result and require OE to acknowledge settlement.
+ *
+ * Started as the active span before getCurrentTraceContext() is read below,
+ * so the trace_id/span_id put on the wire reflect this span. Without a span
+ * here, a slow-to-ack OE (or a retried settlement) is invisible: the
+ * surrounding tool-node span just looks slower, with no record of how many
+ * attempts happened.
+ */
+export declare function reportOeResult(args: ReportOeResultArgs): Promise<void>;
+import { CALL_INTERRUPTED_ARTIFACT_KEY } from "./call_interrupted.js";
+import { type DrainRegistry } from "./server/drain.js";
+export { CALL_INTERRUPTED_ARTIFACT_KEY };
+export declare const INTERRUPTED_CALL_CONTENT = "This call was stopped before completing.";
+/**
+ * Process-local operational step_number mint for one AER execution.
+ *
+ * Shared by SecureToolWrapper and SecureLLMProxy so parallel tools and LLM
+ * calls cannot collide under a single AER. Not a multi-OE authority.
+ * Node's single-threaded event loop makes a plain counter
+ * safe across concurrent async tasks as long as minting stays synchronous
+ * before the first await.
+ */
+export interface OperationalStepSource {
+    next(): number;
+    observeAtLeast(n: number): void;
+    current(): number;
+}
+export declare class OperationalStepAllocator implements OperationalStepSource {
+    private n;
+    next(): number;
+    observeAtLeast(n: number): void;
+    current(): number;
+}
+/**
+ * Optional args for {@link SecureToolWrapper.executeTool}, grouped into an
+ * object rather than positional parameters so future additions cannot silently
+ * shift values with overlapping types into the wrong slot.
+ */
+export interface ExecuteToolOptions {
+    metadata?: Record<string, unknown> | undefined;
+    providerType?: string | null | undefined;
+    scopes?: readonly string[] | undefined;
+    toolCallId?: string | undefined;
+    /**
+     * When true, an OE `interrupted` status resolves to the raw `CALL_INTERRUPTED`
+     * sentinel instead of `{ interrupted: true }`. Only the LangGraph tool-wrapping
+     * path (`createSecureToolFunction`) requests this — it coerces the sentinel
+     * into a safe shape immediately, never returning it to the caller.
+     */
+    rawOnInterrupt?: boolean | undefined;
+    /** The tool's `redact_fields` policy, applied to the debug argument dump. */
+    redactFields?: readonly string[] | undefined;
+    /** Whether OE should return the approved call to this AER. */
+    isLocal?: boolean | undefined;
+    /** Invoke the registered tool on the current framework stack. */
+    localExecutor?: (() => unknown | Promise<unknown>) | undefined;
+    /** Identify framework-owned native control-flow errors. */
+    isFrameworkControlFlow?: ((error: unknown) => boolean) | undefined;
+    /**
+     * Declares the tool body honors the per-call stop signal (available to the
+     * body via `getCallAbortSignal()`). Opt-in tools answer a per-call Stop
+     * with `interrupted` and stop at their next signal checkpoint; tools
+     * without it answer `not_cancellable` and run out — Node has no preemptive
+     * cancel, so claiming stoppability the body never honors would report
+     * Stopped while side effects continue.
+     */
+    supportsCallInterrupt?: boolean | undefined;
+}
+export declare class SecureToolWrapper {
+    readonly oeUrl: string;
+    readonly executionId: string;
+    readonly customHeaders: Record<string, string>;
+    /**
+     * Validated replica-specific OE owner base URL, or null. Forwarded
+     * to `reportOeResult` for the in-process (local-callback) tool-result path so
+     * settlement prefers the owning OE replica.
+     */
+    readonly oeOwnerUrl: string | null;
+    private ownerUrlFailed;
+    /** Shared with SecureLLMProxy for this execution (single-AER assumption). */
+    readonly operationalSteps: OperationalStepSource;
+    durableMemory: DurableMemoryState | null;
+    /**
+     * Per-execution drain registry, enabling the per-call abort (POST
+     * /interrupt/call) for tools this wrapper runs locally; null leaves local
+     * calls unaddressable, as before.
+     */
+    private readonly drainRegistry;
+    constructor(oeUrl: string, executionId: string, customHeaders?: Record<string, string>, oeOwnerUrl?: string | null, drainRegistry?: DrainRegistry | null);
+    private currentOeOwnerUrl;
+    private reportOeOwnerFailure;
+    /** Current operational-step watermark for compatibility readers. */
+    get stepCounter(): number;
+    /** Allocate the next operational step_number for this execution. */
+    nextOperationalStep(): number;
+    /** Raise the allocator watermark (e.g. from OE latest_step_number). */
+    observeOperationalStep(n: number): void;
+    close(): Promise<void>;
+    /**
+     * Execute a tool call through OE.
+     *
+     * Flow:
+     *   1. POST /tool/execute — OE approves or denies
+     *   2. OE returns a final outcome or routes the call back in process
+     *   3. Wrapper logs the outcome and converts suspend payloads back into framework interrupts
+     */
+    executeTool(toolName: string, args: Record<string, unknown>, options?: ExecuteToolOptions): Promise<unknown>;
+    private executeToolDurably;
+    private executeToolActivity;
+    private executeToolNative;
+    /** Fire the framework HITL interrupt for an OE-confirmed suspend. */
+    private handleSuspend;
+}
+export type ToolResponseFormat = "content" | "content_and_artifact";
+/**
+ * The subset of the LangChain JS run config a wrapped tool reads. When a tool
+ * is invoked with a ToolCall, ToolNode populates `toolCall` (whose `id` is the
+ * stable tool-call id) and mirrors the id onto `configurable.tool_call_id`.
+ */
+export interface SecureToolRunConfig {
+    toolCall?: {
+        id?: unknown;
+    };
+    configurable?: Record<string, unknown>;
+}
+/**
+ * Optional args for {@link createSecureToolFunction}, grouped into an object
+ * for the same reason as {@link ExecuteToolOptions}.
+ */
+export interface CreateSecureToolFunctionOptions {
+    metadata?: Record<string, unknown> | undefined;
+    providerType?: string | null | undefined;
+    scopes?: readonly string[] | undefined;
+    /** The wire format the caller's StructuredTool is built with. See {@link coerceContentAndArtifact}. */
+    responseFormat?: ToolResponseFormat | undefined;
+    /**
+     * The tool author's own original format, used only to decide whether a
+     * normal result gets shape-matched into a tuple. Defaults to `responseFormat`.
+     */
+    toolDeclaredFormat?: ToolResponseFormat | undefined;
+    /** The tool's `redact_fields` policy, forwarded to the wrapper's debug argument dump. */
+    redactFields?: readonly string[] | undefined;
+    /** Whether to execute the approved tool on the current AER stack. */
+    isLocal?: boolean | undefined;
+    /** Identify framework-owned native control-flow errors. */
+    isFrameworkControlFlow?: ((error: unknown) => boolean) | undefined;
+    /**
+     * Declares the tool body honors the per-call stop signal. See
+     * {@link ExecuteToolOptions.supportsCallInterrupt}.
+     */
+    supportsCallInterrupt?: boolean | undefined;
+}
+/**
+ * Create a wrapped tool function that routes through SecureToolWrapper.
+ *
+ * The wrapper is looked up from AsyncLocalStorage context at call time,
+ * so the tool can be built before execution context exists.
+ *
+ * The registered tool must expose an `invoke` method for both approved local
+ * execution and the direct-execution debugging path. Direct execution is
+ * UNSAFE and only for debugging.
+ */
+export declare function createSecureToolFunction(originalTool: unknown, toolName: string, allowDirect?: boolean, options?: CreateSecureToolFunctionOptions): (kwargs?: Record<string, unknown>, config?: SecureToolRunConfig) => Promise<unknown>;
+//# sourceMappingURL=secure_wrapper.d.ts.map

package/dist/secure_wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure_wrapper.d.ts","sourceRoot":"","sources":["../src/secure_wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAoC7B,OAAO,EAIL,KAAK,kBAAkB,EAQxB,MAAM,qBAAqB,CAAC;AAW7B;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,OAAO,EACjB,aAAa,GAAE,MAAM,GAAG,IAAW,GAClC,cAAc,CAoDhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACjD,aAAa,GAAE,MAAM,GAAG,IAAW,GAClC,cAAc,CAkChB;AAMD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;gBAE3C,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,aAAa,GAAG,IAAW,EAC1C,OAAO,CAAC,EAAE,YAAY;CAOzB;AAWD,wCAAwC;AACxC,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAKlD;AAWD,qBAAa,sBAAuB,SAAQ,kBAAkB;gBAChD,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIlD;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,aAAa,GAAE,aAAa,GAAG,IAAW,GACzC,KAAK,CAMP;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAE9B,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,YAAY;CAazB;AAkGD,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC1D,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;gBAEpC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,YAAY;CAMzB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAE3B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;CAQpE;AAMD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAoID;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CA8D9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB5E;AAqID,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAI9E,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,eAAO,MAAM,wBAAwB,6CACO,CAAC;AA6I7C;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,MAAM,CAAC;IACf,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,IAAI,MAAM,CAAC;CACnB;AAED,qBAAa,wBAAyB,YAAW,qBAAqB;IACpE,OAAO,CAAC,CAAC,CAAK;IAEd,IAAI,IAAI,MAAM;IAKd,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAK/B,OAAO,IAAI,MAAM;CAGlB;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/D,2DAA2D;IAC3D,sBAAsB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,cAAc,CAAS;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD,aAAa,EAAE,kBAAkB,GAAG,IAAI,CAAQ;IAChD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAGnD,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAUtC,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,oBAAoB;IAO5B,oEAAoE;IACpE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,oEAAoE;IACpE,mBAAmB,IAAI,MAAM;IAI7B,uEAAuE;IACvE,sBAAsB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAIjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;;;;;;OAOG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC;YAYL,kBAAkB;YAyDlB,mBAAmB;YAyCnB,iBAAiB;IAuT/B,qEAAqE;IACrE,OAAO,CAAC,aAAa;CAqCtB;AAMD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,sBAAsB,CAAC;AAoDpE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,uGAAuG;IACvG,cAAc,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,yFAAyF;IACzF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,2DAA2D;IAC3D,sBAAsB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,UAAQ,EACnB,OAAO,GAAE,+BAAoC,GAC5C,CACD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,CAAC,EAAE,mBAAmB,KACzB,OAAO,CAAC,OAAO,CAAC,CA4FpB"}