@neuralis/brain-core 0.3.1 → 0.4.0

package/skills/manage-uri-policy/SKILL.md

@@ -1,7 +1,7 @@
 ---
-requiredFeatures: [drive.policy]
+requiredFeatures: [sources.policy]
 name: manage-uri-policy
-description: "Inspect and patch role-aware read, write, and execute URI policy for any source. Use when a legitimate path is denied or access must be narrowed; patching needs the drive.policy feature, and prefer the smallest explicit exception over broad defaults."
+description: "Inspect and patch role-aware read, write, and execute URI policy for any source. Use when a legitimate path is denied or access must be narrowed; patching needs the sources.policy feature, and prefer the smallest explicit exception over broad defaults."
 allowed-tools: execute
 ---
 
@@ -66,22 +66,25 @@ undone.
 # 0. Read the policy you are about to change, so you can prove you restored it.
 neuralis request GET @neuralis/brain-core/policies/uri/data
 # 1. Add the rule (LIVE — members lose read on this subtree immediately).
-neuralis request POST @neuralis/brain-core/policies/uri --input - <<<'{"source":"data","addPaths":[{"pattern":"data://agent-core/admin/**","permissions":{"read":false},"roles":["member"]}]}'
+echo '{"source":"data","addPaths":[{"pattern":"data://agent-core/admin/**","permissions":{"read":false},"roles":["member"]}]}' | neuralis request POST @neuralis/brain-core/policies/uri --input -
 # 2. Take it back — same source, same pattern, byte for byte.
-neuralis request POST @neuralis/brain-core/policies/uri --input - <<<'{"source":"data","removePatterns":["data://agent-core/admin/**"]}'
+echo '{"source":"data","removePatterns":["data://agent-core/admin/**"]}' | neuralis request POST @neuralis/brain-core/policies/uri --input -
 ```
 
 To keep a rule, run step 1 and stop; step 2 exists so the example is reversible
 rather than a permanent edit to a live source's access policy.
 
 Body: `source` (slug, required) plus either `addPaths` — rules of `{pattern,
-permissions, roles?}`, where `pattern` takes `**` wildcards, `permissions` maps
-`read`/`write`/`exec` to `false` (deny) or `true` (allow) and `roles` scopes the
-rule — or `removePatterns` (the patterns to take back).
+permissions, roles?, priority?, override?}`, where `pattern` takes `**` wildcards, `permissions` maps
+`read`/`write`/`exec` to `false` (deny) or `true` (allow), `roles` scopes the
+rule to named project roles (each must exist in the project, else 400) and
+`priority: 2` to callers whose role priority is 2 or stronger — admin and owner,
+lower = stronger (an integer 1..99, only on a grant row: `override: true` with every
+listed bit `true`); present fields all apply — or `removePatterns` (the patterns to take back).
 
 `exec` decides whether a shell may START in that directory — on an exec-capable
 source (a virtual desktop or any other one whose connector runs commands) as
-well as in the container. A caller also needs that plane's entry feature; the
+well as on the app's own machine. A caller also needs that plane's entry feature; the
 policy row alone does not grant one, and the entry alone does not grant the row.
 So a source whose owner reports "I hold the feature and the shell is still
 refused" usually needs an `exec` ALLOW row for their role or agent here.
@@ -100,24 +103,24 @@ package's seed.
 
 - **Two arms, both keyed on FEATURES — there is no role-name check on this
   route.** Reading (`GET policies/uri/...`) is
-  the module feature `drive.read`, which every built-in role holds down to
+  the module feature `files.read`, which every built-in role holds down to
   `viewer`. Patching (`POST policies/uri`) escalates in-handler to
-  `drive.policy` and otherwise returns
-  `403 Missing feature: drive.policy (URI policy editing)`. `drive.policy` has
+  `sources.policy` and otherwise returns
+  `403 Missing feature: sources.policy (URI policy editing)`. `sources.policy` has
   no grant below the `admin` tier (enumerated for `admin`, `'*'` for `owner`)
   and is grantable to any custom role — so a custom role can hold it and a
   built-in one can lack it.
 - **Being able to SEE this skill is not the route gate.** Its
-  `requiredFeatures: [drive.policy]` frontmatter hides the bundle from anyone
+  `requiredFeatures: [sources.policy]` frontmatter hides the bundle from anyone
   without that feature; that is the ADVERTISEMENT layer. The session ticket
   carries your real identity to the route, and there is no synthetic owner
   upgrade anywhere.
 - **Patching SOMEONE ELSE'S user- or agent-scoped source additionally needs scope
   WRITE.** The POST runs `canAccessScope(..., 'write')` on the owning scope, which
   passes unconditionally for a project-scoped source and for your OWN user/agent
-  scope — so on the common path `drive.policy` is the whole answer. Only a
-  CROSS-scope patch consults `filesystem.modifyScoped`; an
-  `observeScoped`-but-not-`modifyScoped` holder gets
+  scope — so on the common path `sources.policy` is the whole answer. Only a
+  CROSS-scope patch consults `files.writeOthers`; an
+  `files.readOthers`-but-not-`files.writeOthers` holder gets
   `403 Forbidden for source scope` there.
 - **Manifest baselines are not edited by this skill.** Package
   manifests ship `permissions.uriPolicies` as the read-only baseline;

package/skills/organize/SKILL.md

@@ -1,5 +1,5 @@
 ---
-requiredFeatures: [drive.write]
+requiredFeatures: [files.write]
 name: organize
 description: "Analyze a workspace for duplicate, misplaced, stale, or poorly indexed material and design a safer information architecture. Use when asked to clean up or reorganize; inspect references and propose or preview moves before mutating shared files."
 allowed-tools: fs_search fs_write fs_list fs_read

package/skills/sync/SKILL.md

@@ -1,5 +1,5 @@
 ---
-requiredFeatures: [drive.sync]
+requiredFeatures: [sources.sync]
 name: sync
 description: "Run and verify brain-core delta synchronization for configured sources. Use when live connector content and the vector index may differ, files are stale or unindexed, or changes must become searchable; inspect completion and index state instead of trusting dispatch alone."
 allowed-tools: fs_list fs_read execute
@@ -12,9 +12,9 @@ Trigger a delta sync for the brain-core filesystem.
 ## Steps
 
 1. Use `fs_list` with no `uri` first to identify configured sources, scopes, current sync status, and recent errors.
-2. Call the brain-core source sync route for the intended source. The route answers 202 + a queue job snapshot — the sync runs in the background. Explicit sync requires `drive.sync`; source create/update/delete uses `drive.mount`; file writes use `drive.write`.
+2. Call the brain-core source sync route for the intended source. The route answers 202 + a queue job snapshot — the sync runs in the background. Explicit sync requires `sources.sync`; source create/update/delete uses `sources.mount`; file writes use `files.write`.
 3. Poll `GET /sources/sync-status?source=<slug>` until the job finishes, then report the job `result` counts: `filesAdded`, `filesUpdated`, `filesRemoved`, `filesSkipped`, `filesMoved`, `chunksRemoved`, `chunksEmbedded` and `chunksSkipped` plus `embeddingDegraded` (safe, deduplicated embedding stop reasons). Payload indexing can succeed with missing/stale embeddings; report that debt separately. Read the two flags before interpreting completion. `cancelled: true` is not a failure, but the run stopped early: the counts are partial and a re-run converges. `truncated: true` means the walk stopped at `filesScanCap`, so files past the cap were never examined and no deletion or move was inferred — call that a partial pass, never a completed sync.
-4. If any errors occur, list them clearly with the affected source, scope, and file path.
+4. If any errors occur, list them clearly with the affected source, scope, and file path. Two job errors are fixed codes and removed nothing: `root_unreachable` (the source root cannot be reached — unmounted, renamed, device offline; fix the mount, then sync again) and `root_empty` (the root answers but holds no file while the index still holds some). Re-send `confirmEmpty:true` with the sync only after the user confirms the folder really is empty — that one pass removes its files from the index.
 5. Distinguish live connector data, indexed payload and embedding freshness. Provider outage or disabled embedding preserves metadata/full-text indexing; semantic results may be old, or the response may fall back to filter search. Ordinary sync completion does not settle all embedding debt. Use `manage-sources` explicit debt catchup; terminal `paused` carries `result.embedding.pausedReason`, and Resume creates a new authorized job from durable debt.
 
 ## What a sync will and will not index

package/tools/fs_list.json

@@ -73,7 +73,7 @@
     "transport": "embedded",
     "requires": {
       "features": [
-        "drive.read"
+        "files.read"
       ]
     },
     "defaults": {

package/tools/fs_read.json

@@ -70,7 +70,7 @@
     "transport": "embedded",
     "requires": {
       "features": [
-        "drive.read"
+        "files.read"
       ]
     },
     "defaults": {},

package/tools/fs_search.json

@@ -80,7 +80,7 @@
     "transport": "embedded",
     "requires": {
       "features": [
-        "drive.search"
+        "files.search"
       ]
     },
     "defaults": {

package/tools/fs_write.json

@@ -226,7 +226,7 @@
     "transport": "embedded",
     "requires": {
       "features": [
-        "drive.write"
+        "files.write"
       ]
     },
     "askOnKeys": [

package/workflows/sources-digest.json

@@ -27,5 +27,5 @@
   ],
   "defaultStateMode": "fresh",
   "delivery": { "mode": "none" },
-  "requires": { "features": ["drive.search"] }
+  "requires": { "features": ["files.search"] }
 }

package/dist/src/connectors/LocalDiskConnector.d.ts

@@ -1,171 +0,0 @@
-import type { ConnectorPort, ConnectorCapability, ConnectorListItem, ConnectorReadResult, ConnectorReadRawOpts, ConnectorReadRawResult, ConnectorStatResult, ConnectorMoveResult, ConnectorWriteResult, ConnectorDeltaRequest, ConnectorDeltaResult, ConnectorCountOpts, ConnectorWalkOpts, ScanContentOpts, ScanContentResult, ConnectorFactoryContext, ConnectorChangeEvent, ConnectorEventSubscription, ConnectorSubscribeOpts, ConnectorConnectionProbe } from '@neuralis/package-system/contracts';
-import { ConnectorRootAccessError } from '@neuralis/package-system/contracts';
-import { type OsMount } from '@neuralis/package-system/paths';
-/**
- * Concrete root-access error thrown by the local-disk connector. Routes +
- * services catch the abstract base (`ConnectorRootAccessError`), not this
- * class specifically — so every future connector that touches a real FS
- * surface can share the same structured-warning pathway.
- */
-export declare class LocalDiskRootAccessError extends ConnectorRootAccessError {
-    constructor(code: 'ROOT_MISSING' | 'ROOT_PERMISSION_DENIED', rootPath: string, uri: string, cause?: unknown);
-}
-/**
- * The capability set the local on-disk connector implements. This MUST stay
- * byte-equal to the `local` connector's `capabilities` array in
- * `package.json#neuralis.connectors` — `SourceLoader.instantiateConnector`
- * fails closed (`ConnectorCapabilityMismatch`) on any divergence, and for a
- * first-party connector `wiring.ts` now re-throws that (boot-fatal) instead of
- * silently degrading the kind. `localDiskCapabilities.test.ts` is the
- * derive-and-verify drift guard that catches a mismatch at TEST time.
- */
-export declare const LOCAL_DISK_CAPABILITIES: readonly ConnectorCapability[];
-/**
- * Structured failure thrown by `LocalDiskConnector.resolveOsUri` when the
- * connector is running inside a Docker container but no host-pair root has
- * been configured. Returning a container-internal path here would corrupt
- * vector payloads + filesystem-node `os_uri` fields with paths that do not
- * exist on the host. Callers (sync runner, the write engine) catch this
- * and either skip the upsert or persist `os_uri: undefined` instead.
- */
-export declare class OsUriUnresolvableError extends Error {
-    readonly code: 'os_uri_host_pair_missing';
-    readonly source: string;
-    readonly uri: string;
-    constructor(params: {
-        source: string;
-        uri: string;
-        root?: string;
-    });
-}
-/**
- * Connector for local filesystem access — URI-native.
- *
- * Contributed by brain-core via `neuralis.connectors[]` manifest entry
- * `{ kind: 'local', configSchema: { root, hostRoot? } }`. The package loader
- * instantiates it via `createLocalDiskConnector(ctx)` for each source binding.
- */
-export declare class LocalDiskConnector implements ConnectorPort {
-    #private;
-    readonly kind = "local";
-    readonly source: string;
-    readonly portVersion: 4;
-    constructor(root: string, source: string, hostRoot?: string, isDocker?: boolean);
-    capabilities(): ReadonlySet<ConnectorCapability>;
-    /** Expose the resolved root path for diagnostics / wiring logs. */
-    get root(): string;
-    probeRoot(): Promise<{
-        rootPath: string;
-        exists: boolean;
-        readable: boolean;
-        error?: string;
-    }>;
-    /**
-     * Connector-owned liveness — whether the backing host directory is reachable.
-     * Wraps {@link probeRoot} but maps to the fixed `SourceLiveReason` enum and
-     * DISCARDS the raw `rootPath`/`error` (those carry the absolute host-mount
-     * path — leaking them to a member via the tone-title is a path-disclosure
-     * regression). UI-tone + `<runtime_stack>` signal only; never gates access.
-     */
-    probeConnection(): Promise<ConnectorConnectionProbe>;
-    list(uri: string): Promise<ConnectorListItem[]>;
-    /**
-     * Existence + metadata, on the SAME guarded path as `read` and without
-     * transferring a byte of content. `null` = the path resolved but nothing is
-     * there (`ENOENT`, from either the guard's per-segment walk or the `lstat`);
-     * every other failure THROWS exactly as `read` would — a traversal/symlink
-     * refusal, an EACCES, a root-access error — so the caller's existing
-     * "gone vs. could-not-ask" split keeps working unchanged.
-     *
-     * `lstat`, never `stat`: `resolveAndGuard` REFUSES a symlink rather than
-     * resolving through it, so following one here would answer for a target the
-     * read path would never have served.
-     */
-    stat(uri: string): Promise<ConnectorStatResult | null>;
-    /**
-     * The sync media lane's PDF read — NOT a kernel `ConnectorPort` member (only
-     * a connector that holds the file on its own disk can render it; the lane
-     * treats a connector without it as "unavailable"). The raw bytes' sha256
-     * (the point's `content_hash`) and pages `first..last` rendered by the ONE
-     * renderer — none when the hash equals `unlessHash`, so an unchanged PDF is
-     * never re-rendered. `null` when `pdftoppm` is not installed; the same
-     * containment and read cap as `read`.
-     */
-    renderPdfPages(uri: string, opts: {
-        first: number;
-        last: number;
-        unlessHash?: string;
-    }): Promise<{
-        contentHash: string;
-        pages: Array<{
-            page: number;
-            png: Buffer;
-        }>;
-    } | null>;
-    /**
-     * The byte-exact read. Same guarded resolver as `read`; the cap is
-     * `min(opts.maxBytes, brainMaxReadFileMb)`, checked on the OPENED
-     * descriptor's size before any byte is buffered, and the read itself pulls
-     * at most that size+1 bytes — a file that grew after the size check is
-     * refused (over the cap: the too-large refusal), never cut.
-     */
-    readRaw(uri: string, opts: ConnectorReadRawOpts): Promise<ConnectorReadRawResult>;
-    read(uri: string): Promise<ConnectorReadResult>;
-    write(uri: string, content: string | Uint8Array): Promise<ConnectorWriteResult>;
-    delete(uri: string): Promise<void>;
-    move(fromUri: string, toUri: string): Promise<ConnectorMoveResult>;
-    mkdir(uri: string): Promise<void>;
-    rmdir(uri: string): Promise<void>;
-    /**
-     * OS-level change events under `rootUri`, fed by the shared FsWatchHub
-     * (D6: ONE watcher substrate). Catches EVERY background change — shell
-     * writes, host edits, git checkouts, external programs — not just app
-     * writes. URI mapping happens here (the hub only knows absolute paths);
-     * exclude filtering and debounce are the SUBSCRIBER's job. An `overflow`
-     * event means "event delivery can no longer be trusted — full reconcile".
-     */
-    subscribeEvents(rootUri: string, listener: (event: ConnectorChangeEvent) => void, opts?: ConnectorSubscribeOpts): ConnectorEventSubscription;
-    scanDelta(request: ConnectorDeltaRequest): Promise<ConnectorDeltaResult>;
-    resolveOsUri(uri: string): string;
-    peekCount(rootUri: string, opts?: ConnectorCountOpts): number | undefined;
-    walk(rootUri: string, opts?: ConnectorWalkOpts): Promise<ConnectorListItem[]>;
-    walkWithStatus(rootUri: string, opts?: ConnectorWalkOpts): Promise<{
-        items: ConnectorListItem[];
-        complete: boolean;
-        truncated: boolean;
-    }>;
-    count(rootUri: string, opts?: ConnectorCountOpts): Promise<number>;
-    scanContent(rootUri: string, query: string, opts?: ScanContentOpts): Promise<ScanContentResult[]>;
-}
-/**
- * Factory: builds a LocalDiskConnector instance for a specific source binding.
- *
- * Resolves `config.root` against the current projectRoot
- * (`resolveLocalRoot`): a relative path joins onto `ctx.projectRoot`, an
- * absolute one is the container path as written.
- */
-export declare function createLocalDiskConnector(ctx: ConnectorFactoryContext): ConnectorPort;
-/**
- * Derive a host-side root for `resolvedRoot` from the os-mount table. Returns
- * the host path for the *longest* matching mount whose `containerPath` is the
- * root itself or a path-boundary-correct ancestor (`/mounts/repo` matches
- * `/mounts/repo` and `/mounts/repo/sub`, but NOT `/mounts/repo2`). Mounts
- * without a `hostPath` (no `NEURALIS_MOUNT_HOST_*` pair) are skipped. Returns
- * `undefined` when nothing matches, so the caller falls through to the
- * fail-loud `OsUriUnresolvableError` path in Docker.
- */
-export declare function deriveHostRootFromOsMounts(resolvedRoot: string, mounts: OsMount[]): string | undefined;
-/**
- * Canonical container-root resolution for a local source's configured root.
- * Exported so the brain-core API can hand agent-core's shell uri-policy gate
- * the SAME resolved roots the connector itself mounts — the two branches
- * (relative under the project root, absolute as written) are never re-typed.
- */
-export declare function resolveLocalRoot(params: {
-    configured: string;
-    projectRoot: string;
-    source: string;
-}): {
-    resolvedRoot: string;
-};
-//# sourceMappingURL=LocalDiskConnector.d.ts.map

package/dist/src/connectors/LocalDiskConnector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalDiskConnector.d.ts","sourceRoot":"","sources":["../../../src/connectors/LocalDiskConnector.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,aAAa,EAEb,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EAEpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,wBAAwB,EACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,gCAAgC,CAAC;AA0IhF;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,wBAAwB;IACpE,YACE,IAAI,EAAE,cAAc,GAAG,wBAAwB,EAC/C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,OAAO,EAYhB;CACF;AAiHD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,mBAAmB,EAIjE,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,YAAY,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAcjE;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,aAAa;;IACtD,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,IAAyD;IAO7E,YAAY,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAM9E;IAED,YAAY,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAE/C;IAED,mEAAmE;IACnE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAEK,SAAS,IAAI,OAAO,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAaD;IAED;;;;;;OAMG;IACG,eAAe,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAIzD;IAeK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA0DpD;IAED;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAqB3D;IAED;;;;;;;;OAQG;IACG,cAAc,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAUtF;IAED;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgCtF;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoFpD;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAYpF;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvC;IAEK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAQvE;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItC;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,EAC/C,IAAI,CAAC,EAAE,sBAAsB,GAC5B,0BAA0B,CAiD5B;IAEK,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgD7E;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAchC;IAUD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAKxE;IAEK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAElF;IAEK,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;QACvE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;KACnE,CAAC,CAED;IA2GK,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDvE;IAEK,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoFtG;CAyGF;AAWD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,GAAG,aAAa,CAkBpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,EAAE,GAChB,MAAM,GAAG,SAAS,CAcpB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAQ3B"}