@mongodb-js/agent-engine-runner-shared 0.11.3

package/dist/tool_api_error.js

@@ -0,0 +1,399 @@
+/**
+ * Classify external API call failures into structured, safe metadata.
+ *
+ * Mirrors Python's `agent_engine_runner_shared/tool_api_error.py`.
+ *
+ * Native `fetch` (Node ≥ 24, backed by Undici) does NOT throw on non-2xx
+ * responses — it only rejects for transport/abort failures. So HTTP-status
+ * classification requires a thrown error that retains a numeric `status`,
+ * `statusCode`, or `response.status` property (e.g. an Axios-shaped error
+ * or a custom wrapper around a fetch Response). Transport failures
+ * (timeout, connection refused) are classified from error names and
+ * `cause.code` values that Undici/Node produces.
+ */
+import { z } from "zod";
+import { getCurrentAuthorization } from "./context.js";
+import { redactText } from "./error_reporting.js";
+import { tenantEnvVars } from "./utils.js";
+const MAX_ERROR_CODE_LEN = 128;
+const MAX_REASON_LEN = 256;
+const STATUS_CLASSIFICATIONS = {
+    401: ["AUTH_FAILED", false],
+    403: ["AUTH_FAILED", false],
+    429: ["RATE_LIMITED", true],
+    503: ["PROVIDER_UNAVAILABLE", true],
+};
+const TIMEOUT_CODES = new Set([
+    "ETIMEDOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_BODY_TIMEOUT",
+    "UND_ERR_CONNECT_TIMEOUT",
+]);
+const CONNECTION_CODES = new Set([
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "UND_ERR_SOCKET",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+]);
+const MAX_ENVELOPE_BODY = 4096;
+// Rudimentary URL drop: a scheme-bearing URL or a protocol-relative reference
+// with a non-whitespace authority. Encoded or nested spellings are accepted
+// risk, not chased.
+const PROTOCOL_RELATIVE_URL = /(?<![A-Za-z0-9])\/\/(?=\S)/;
+/**
+ * Request-local credential values that must never be surfaced. Combines the
+ * tenant environment secrets with the delegated authorization token installed
+ * for this execution; both are values a provider can echo.
+ *
+ * Reads pod-level tenant env; the ToolServer runs with secret restriction
+ * disabled (merge, no restore), so these values persist for the request. If
+ * per-request apply/restore is ever re-enabled, capture the values inside the
+ * credential window instead of reading them at classification time.
+ */
+export function requestCredentialValues() {
+    const values = Object.values(tenantEnvVars()).filter((value) => value);
+    const token = getCurrentAuthorization()?.token;
+    if (token && !values.includes(token))
+        values.push(token);
+    return values;
+}
+// Name segments marking a tenant env var's value as credential-bearing. Env
+// names are conventionally SCREAMING_SNAKE with the credential kind last
+// (OPENAI_API_KEY, GITHUB_TOKEN, DB_PASSWORD), so the name is what selects
+// credential values. Selecting on the value's shape instead -- its length, or
+// whether it looks alphanumeric -- cannot separate a 7-character token from the
+// working directory or the string "1", and redacting those shreds the message
+// the redaction exists to make readable.
+const CREDENTIAL_NAME_MARKERS = [
+    "KEY",
+    "TOKEN",
+    "SECRET",
+    "PASSWORD",
+    "CREDENTIAL",
+    "CREDS",
+    "AUTH",
+];
+/**
+ * Credential values a name marks as secrets, at any length.
+ *
+ * A narrower view of `requestCredentialValues`: ordinary tenant env (`PATH`,
+ * `HOSTNAME`, `SHLVL`) is excluded, while a value under a credential-named
+ * variable is treated as a credential however short it is. Use this where the
+ * value is inserted into text a human reads, so that redaction cannot corrupt
+ * the message; use `requestCredentialValues` where the sink tolerates a blunt
+ * replacement. The delegated authorization token counts as credential-named.
+ */
+export function requestNamedCredentialValues() {
+    const values = Object.entries(tenantEnvVars())
+        .filter(([name, value]) => Boolean(value) &&
+        CREDENTIAL_NAME_MARKERS.some((marker) => name.toUpperCase().includes(marker)))
+        .map(([, value]) => value);
+    const token = getCurrentAuthorization()?.token;
+    if (token && !values.includes(token))
+        values.push(token);
+    return values;
+}
+export const ToolAPIErrorSchema = z.object({
+    provider_type: z.string().nullish().describe("Provider identity when known"),
+    classification: z
+        .string()
+        .describe("AUTH_FAILED, RATE_LIMITED, PROVIDER_UNAVAILABLE, TIMEOUT, CONNECTION_ERROR, or UNKNOWN"),
+    http_status: z
+        .number()
+        .int()
+        .nullish()
+        .describe("HTTP status when the failure was an HTTP response"),
+    retryable: z
+        .boolean()
+        .describe("Provider-condition guidance only. Must not trigger replay of an already-dispatched tool call."),
+    error_code: z
+        .string()
+        .nullish()
+        .describe("Bounded redacted provider error code"),
+    reason: z
+        .string()
+        .nullish()
+        .describe("Bounded redacted provider reason; URLs dropped"),
+});
+/**
+ * Walk the `.cause` chain of an error, yielding each node up to a
+ * cycle-safe maximum depth of five. Non-Error objects with a `cause`
+ * property are included — Undici wraps transport failures as
+ * `TypeError("fetch failed")` with a plain-object `cause` carrying the
+ * relevant `code`.
+ */
+function* walkCauseChain(error, maxDepth = 5) {
+    let current = error;
+    let depth = 0;
+    const seen = new Set();
+    while (current != null && depth < maxDepth && !seen.has(current)) {
+        seen.add(current);
+        yield current;
+        current = current?.cause;
+        depth++;
+    }
+}
+function isNum(v) {
+    return typeof v === "number" && Number.isFinite(v);
+}
+function findHttpStatus(error) {
+    for (const node of walkCauseChain(error)) {
+        if (isNum(node["status"]))
+            return node["status"];
+        if (isNum(node["statusCode"]))
+            return node["statusCode"];
+        const resp = node["response"];
+        if (resp && typeof resp === "object") {
+            const r = resp;
+            if (isNum(r["status"]))
+                return r["status"];
+            if (isNum(r["statusCode"]))
+                return r["statusCode"];
+        }
+    }
+    return null;
+}
+function findResponse(error) {
+    for (const node of walkCauseChain(error)) {
+        const resp = node["response"];
+        if (resp != null)
+            return resp;
+    }
+    return null;
+}
+function extractFromBody(body, credentials = []) {
+    return [
+        envelopeErrorCode(body, credentials),
+        envelopeReason(body, credentials),
+    ];
+}
+function envelopeErrorCode(body, credentials = []) {
+    const rawCode = body["errorCode"];
+    if (typeof rawCode === "string") {
+        return safeEnvelopeText(rawCode, MAX_ERROR_CODE_LEN, credentials);
+    }
+    const nested = asRecord(body["error"]);
+    if (nested && typeof nested["code"] === "string") {
+        return safeEnvelopeText(nested["code"], MAX_ERROR_CODE_LEN, credentials);
+    }
+    return null;
+}
+/**
+ * The provider's own explanation from a recognized error envelope. Shapes
+ * follow the common conventions: Atlas `reason`, Jira `errorMessages`/`errors`,
+ * a top-level `message`, and a nested `error.message` (OpenAI/Stripe/Anthropic).
+ */
+function envelopeReason(body, credentials = []) {
+    const candidates = [];
+    const rawReason = body["reason"];
+    if (typeof rawReason === "string")
+        candidates.push(rawReason);
+    const messages = body["errorMessages"];
+    if (Array.isArray(messages)) {
+        for (const message of messages) {
+            if (typeof message === "string")
+                candidates.push(message);
+        }
+    }
+    const errors = asRecord(body["errors"]);
+    if (errors) {
+        for (const value of Object.values(errors)) {
+            if (typeof value === "string")
+                candidates.push(value);
+        }
+    }
+    const rawMessage = body["message"];
+    if (typeof rawMessage === "string")
+        candidates.push(rawMessage);
+    const nested = asRecord(body["error"]);
+    if (nested && typeof nested["message"] === "string") {
+        candidates.push(nested["message"]);
+    }
+    for (const candidate of candidates) {
+        const safe = safeEnvelopeText(candidate, MAX_REASON_LEN, credentials);
+        if (safe)
+            return safe;
+    }
+    return null;
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * Rudimentary hygiene for one provider-authored string. Best-effort, not a
+ * guarantee: control characters are dropped, URL-shaped text is rejected,
+ * exact credential values are redacted, and the result is bounded. Other
+ * encodings and provider-specific content are accepted risk.
+ */
+function safeEnvelopeText(text, maxLen, credentials = []) {
+    let printable = text.replace(/\p{C}/gu, "");
+    if (printable.includes("://") || PROTOCOL_RELATIVE_URL.test(printable)) {
+        return null;
+    }
+    const ordered = credentials
+        .filter((value) => value)
+        .sort((a, b) => b.length - a.length);
+    for (const value of ordered) {
+        printable = printable.split(value).join("<redacted>");
+    }
+    const out = redactText(printable).slice(0, maxLen);
+    return out || null;
+}
+async function extractEnvelope(response, credentials = []) {
+    if (!response || typeof response !== "object")
+        return [null, null];
+    const r = response;
+    // Axios-shaped: response.data is the already-parsed body. It gets the same
+    // encoded-size limit as a native streamed body, so an oversized document
+    // cannot supply a visible reason.
+    const data = r["data"];
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+        if (!isWithinEnvelopeLimit(data))
+            return [null, null];
+        return extractFromBody(data, credentials);
+    }
+    const body = await boundedJsonBody(r);
+    if (body && typeof body === "object" && !Array.isArray(body)) {
+        return extractFromBody(body, credentials);
+    }
+    return [null, null];
+}
+// The 4 KB limit is a per-binding heuristic: Axios exposes only parsed data,
+// so this measures the re-serialized document rather than wire bytes, while
+// streamed and Python bodies are measured on raw bytes.
+function isWithinEnvelopeLimit(value) {
+    try {
+        const encoded = JSON.stringify(value);
+        if (typeof encoded !== "string")
+            return false;
+        return new TextEncoder().encode(encoded).byteLength <= MAX_ENVELOPE_BODY;
+    }
+    catch {
+        return false;
+    }
+}
+async function boundedJsonBody(r) {
+    const stream = r["body"];
+    if (stream && typeof stream.getReader === "function") {
+        const reader = stream.getReader();
+        const chunks = [];
+        let n = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                n += value.byteLength;
+                if (n > MAX_ENVELOPE_BODY) {
+                    await reader.cancel();
+                    return null;
+                }
+                chunks.push(value);
+            }
+        }
+        catch {
+            return null;
+        }
+        try {
+            return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function classifyTransport(error) {
+    for (const node of walkCauseChain(error)) {
+        const name = node["name"];
+        if (name === "TimeoutError") {
+            return { classification: "TIMEOUT", retryable: true };
+        }
+        const code = node["code"];
+        if (typeof code === "string") {
+            if (TIMEOUT_CODES.has(code)) {
+                return { classification: "TIMEOUT", retryable: true };
+            }
+            if (CONNECTION_CODES.has(code)) {
+                return { classification: "CONNECTION_ERROR", retryable: true };
+            }
+        }
+    }
+    return null;
+}
+function msg(providerType, detail) {
+    return `${providerType || "External"} API call failed: ${detail}`;
+}
+/**
+ * Return structured metadata and a safe message, or `undefined` when the
+ * error is not a recognized HTTP or transport failure.
+ *
+ * `credentials` are the request-local secret values applied for this call;
+ * they are matched exactly against recognized provider text so a provider
+ * echoing an unlabeled credential cannot surface it.
+ */
+export async function classifyToolAPIError(error, providerType, credentials = []) {
+    const transport = classifyTransport(error);
+    if (transport) {
+        return {
+            toolApiError: {
+                provider_type: providerType ?? null,
+                classification: transport.classification,
+                http_status: null,
+                retryable: transport.retryable,
+            },
+            message: msg(providerType, transport.classification),
+        };
+    }
+    const httpStatus = findHttpStatus(error);
+    if (httpStatus !== null) {
+        const response = findResponse(error);
+        const [errorCode, reason] = await extractEnvelope(response, credentials);
+        const [classification, retryable] = STATUS_CLASSIFICATIONS[httpStatus] ?? [
+            "UNKNOWN",
+            false,
+        ];
+        const base = msg(providerType, `HTTP ${httpStatus} ${classification}`);
+        return {
+            toolApiError: {
+                provider_type: providerType ?? null,
+                classification,
+                http_status: httpStatus,
+                retryable,
+                error_code: errorCode,
+                reason,
+            },
+            // The provider's own explanation is the fastest path to the cause; it
+            // reaches the user and the agent, and is bounded/redacted above.
+            message: reason ? `${base} — ${reason}` : base,
+        };
+    }
+    return undefined;
+}
+function providerTypeFromToolDef(toolDef) {
+    const providerType = toolDef && typeof toolDef === "object"
+        ? toolDef["provider_type"]
+        : undefined;
+    return typeof providerType === "string" ? providerType : undefined;
+}
+/** Error `ToolPodExecuteResponse` for a thrown tool, with classification when recognized. */
+export async function executeErrorResponse(error, toolDef, podName, metadata, credentials = []) {
+    const classified = await classifyToolAPIError(error, providerTypeFromToolDef(toolDef), credentials);
+    return {
+        status: "error",
+        error: classified
+            ? classified.message
+            : error instanceof Error
+                ? error.message
+                : String(error),
+        pod_name: podName,
+        kind: metadata["memory"] ? "memory" : undefined,
+        metadata,
+        ...(classified ? { tool_api_error: classified.toolApiError } : {}),
+    };
+}

package/dist/tool_memory_ownership.d.ts

@@ -0,0 +1,10 @@
+/** Request-local ownership for Memory reads performed by registered Tools. */
+/** Whether a live registered Tool callback owns the current Memory read. */
+export declare function isMemoryReadOwnedByTool(): boolean;
+/**
+ * Run a registered Tool callback as the owner of Memory reads it performs.
+ * The mutable holder invalidates ownership in async descendants after the
+ * callback returns or its promise settles.
+ */
+export declare function runWithToolMemoryReadOwnership<T>(fn: () => T): T;
+//# sourceMappingURL=tool_memory_ownership.d.ts.map

package/dist/tool_memory_ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool_memory_ownership.d.ts","sourceRoot":"","sources":["../src/tool_memory_ownership.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAoB9E,4EAA4E;AAC5E,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAehE"}

package/dist/tool_memory_ownership.js

@@ -0,0 +1,36 @@
+/** Request-local ownership for Memory reads performed by registered Tools. */
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+function isPromiseLike(value) {
+    if (value === null ||
+        (typeof value !== "object" && typeof value !== "function")) {
+        return false;
+    }
+    return typeof value.then === "function";
+}
+/** Whether a live registered Tool callback owns the current Memory read. */
+export function isMemoryReadOwnedByTool() {
+    return storage.getStore()?.active === true;
+}
+/**
+ * Run a registered Tool callback as the owner of Memory reads it performs.
+ * The mutable holder invalidates ownership in async descendants after the
+ * callback returns or its promise settles.
+ */
+export function runWithToolMemoryReadOwnership(fn) {
+    const ownership = { active: true };
+    try {
+        const result = storage.run(ownership, fn);
+        if (!isPromiseLike(result)) {
+            ownership.active = false;
+            return result;
+        }
+        return Promise.resolve(result).finally(() => {
+            ownership.active = false;
+        });
+    }
+    catch (error) {
+        ownership.active = false;
+        throw error;
+    }
+}

package/dist/toolpod_handlers.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Built-in Tool Pod handler functions (TypeScript port of Python's
+ * `toolpod_handlers.py`).
+ *
+ * These handlers execute filesystem and shell operations inside the Tool Pod.
+ * They are registered at startup via `registerBuiltinTools` (gated on
+ * `features.deep_agent`) and dispatched by `ToolServer` when requests arrive
+ * from `AgentEngineToolPodBackend` through the OE secure path.
+ *
+ * All handlers accept a single named-argument object (the `ServerToolFn`
+ * contract), return a JSON-serializable object, and catch their own
+ * exceptions (returning `{error: ...}` on failure). `shell_execute` and
+ * `filesystem_glob` are async (the latter streams matches via
+ * `fs.promises.glob` so a broad pattern never materializes a huge list); the
+ * rest are synchronous.
+ *
+ * Return formats match what `AgentEngineToolPodBackend` expects to parse:
+ * - filesystem_ls       -> {entries: [{path, is_dir}], truncated}
+ * - filesystem_read     -> {content, encoding: "utf-8"}
+ * - filesystem_write    -> {path}
+ * - filesystem_edit     -> {occurrences}
+ * - filesystem_glob     -> {matches: [{path, is_dir}], truncated}
+ * - filesystem_grep     -> {matches: [{path, line, text}], truncated}
+ * - filesystem_download -> {path, content_base64, encoding: "base64"}
+ * - shell_execute       -> {output, exit_code, truncated}
+ *
+ * Read-only skill roots resolve lazily at first use / startup, not at
+ * import, so a static SDK import before the agent root is set still works.
+ */
+import type { ITenantRuntime } from "./server/base.js";
+export declare const WORKSPACE_DIR: string;
+/**
+ * Canonical set of built-in tool names registered by `registerBuiltinTools`.
+ * Consumed by `ToolServer.onStartup`'s completeness assertion and by tests so
+ * the callsites can't drift silently.
+ */
+export declare const BUILTIN_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * List directory contents, sorted by name. When the directory has more than
+ * MAX_LS_ENTRIES entries, `truncated=true` and the returned subset is the
+ * readdir-order first MAX_LS_ENTRIES entries (filesystem-defined), then sorted
+ * by path. The early break is intentional — sorting all entries first would
+ * defeat the memory cap on directories with hundreds of thousands of entries.
+ */
+export declare function filesystemLs(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Read file content as text with line-based slicing (lines
+ * `[offset, offset+limit)`). Rejects files larger than
+ * FILESYSTEM_READ_MAX_BYTES upfront so pathologically large files cannot
+ * exhaust pod memory.
+ */
+export declare function filesystemRead(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Write *content* to a new file, creating parent directories. Per
+ * `BackendProtocol.write` this is create-only: if the file exists the call
+ * fails. Agents modify existing files via filesystem_edit (which has a
+ * unique-match guard).
+ */
+export declare function filesystemWrite(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Find and replace text in a file, returning the number of occurrences
+ * replaced. When *replace_all* is false the match must be unique — a non-unique
+ * `old_string` is rejected so a caller cannot silently corrupt the wrong
+ * region. Files larger than FILESYSTEM_READ_MAX_BYTES (before or after the
+ * edit) are rejected to mirror filesystem_read's memory guard.
+ */
+export declare function filesystemEdit(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Match files using a glob pattern under *path* (workspace-relative, default
+ * `"."`). Supports recursive `**` patterns. Bounded by MAX_GLOB_MATCHES.
+ * Absolute patterns and `..` traversal segments are rejected so they cannot
+ * bypass the sandbox; returned matches are also filtered through
+ * `isWithinReadableRoot` for defense-in-depth against symlinks.
+ */
+export declare function filesystemGlob(args: Record<string, unknown>): Promise<Record<string, unknown>>;
+/**
+ * Search file contents for a literal substring (per `BackendProtocol.grep`,
+ * not a regex). Walks the tree under *path* (default `"."`); when *glob* is
+ * given only files whose names match are searched. Binary files are skipped.
+ * Bounded by MAX_GREP_MATCHES and MAX_GREP_SECONDS so a deep-tree walk cannot
+ * peg a worker indefinitely.
+ */
+export declare function filesystemGrep(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Download a file's raw bytes base64-encoded so the JSON transport can carry
+ * arbitrary binary content. `AgentEngineToolPodBackend.downloadFiles` base64-decodes
+ * this to produce the response bytes.
+ */
+export declare function filesystemDownload(args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Run a shell command and capture its output. Per
+ * `SandboxBackendProtocol.execute`, *timeout* is `null` = "use the backend
+ * default" (SHELL_DEFAULT_TIMEOUT_SECONDS), not "no timeout".
+ *
+ * Threat model: `shell: true` is intentional — agents need pipes, redirects,
+ * globs. The sandbox is the Tool Pod itself.
+ *
+ * Per-session isolation gap: unlike the filesystem handlers (which enforce the
+ * workspace boundary via `resolvePath()` + `isWithinWorkspace()` realpath
+ * checks), `cwd` here is only the spawned shell's default working directory —
+ * the process is not OS-confined, so `..`/absolute paths can reach sibling
+ * sessions or arbitrary pod paths. Treat as session-shared until the
+ * bubblewrap sandbox lands. There is no upstream approval gate on the command
+ * string; treat the content as agent-authored. This means shell_execute does
+ * NOT match the per-session filesystem isolation the fs handlers enforce —
+ * an accepted, tracked risk, not local path validation.
+ *
+ * Output handling: stdout/stderr are drained as they stream. Each stream stops
+ * *appending* once SHELL_OUTPUT_MAX_BYTES is captured but the stream is never
+ * paused, so the child never blocks on a full pipe — a runaway `yes` runs to
+ * its timeout without OOMing the pod. Partial output is preserved on timeout.
+ * Framework errors (e.g. missing `/bin/sh`) return
+ * `exit_code = EXIT_CODE_FRAMEWORK_ERROR`, distinct from the timeout sentinel.
+ */
+export declare function shellExecute(args: Record<string, unknown>): Promise<Record<string, unknown>>;
+/**
+ * Register all built-in tool handlers on *runtime* (callable lookup +
+ * metadata for all 8 handlers). Called by `ToolServer.onStartup` when
+ * `features.deep_agent` is on.
+ *
+ * If a user `@app.tool()` registered a tool with a reserved built-in name,
+ * this logs a WARNING and overrides it with the built-in — without the warning
+ * the collision was silent and surfaced only when the built-in was invoked.
+ */
+export declare function registerBuiltinTools(runtime: ITenantRuntime): void;
+//# sourceMappingURL=toolpod_handlers.d.ts.map

package/dist/toolpod_handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolpod_handlers.d.ts","sourceRoot":"","sources":["../src/toolpod_handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAyDrE,eAAO,MAAM,aAAa,QAEzB,CAAC;AA6HF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CASjD,CAAC;AAwKH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6BzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8BzB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuDzB;AAcD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwClC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgDzB;AA4DD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyJlC;AAgED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAyClE"}