@noopolis/daimon 0.1.1 → 0.2.0

package/dist/pi/cliMcpRegistration.d.ts

@@ -0,0 +1,61 @@
+import { type ChildProcess } from "node:child_process";
+/**
+ * Per-wake MCP endpoint registration for the CLI engines that cannot take the
+ * endpoint on their own command line.
+ *
+ * Codex takes `-c mcp_servers.daimon.url=<endpoint>` per invocation and needs
+ * nothing here. AGY is config-file driven, so Daimon registers the ephemeral
+ * endpoint before the turn and removes it afterwards through its own `mcp
+ * add`/`mcp remove` subcommands. Grok no longer uses this path: its project
+ * scope is ignored in untrusted workspaces on 1.0.34, so its endpoint is written
+ * into the agent's Daimon-owned GROK_HOME (`grokHomeMcpRegistration.ts`).
+ *
+ * The registration is deliberately performed by the engine CLI rather than by
+ * writing its config file directly: the file format belongs to the engine, and
+ * a format change absorbed by `mcp add` would silently disable every tool if
+ * Daimon hand-wrote it instead.
+ */
+export type CliMcpRegistration = Readonly<{
+    close: () => Promise<void>;
+}>;
+export type CliMcpRegistrationInput = Readonly<{
+    addArgs: readonly string[];
+    command: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    failureClassifier?: (diagnostic: string) => Error | undefined;
+    onChild: (child: ChildProcess) => void;
+    onChildSettled: (child: ChildProcess) => void;
+    removeArgs: readonly string[];
+    secretValues: readonly string[];
+    verify?: () => Promise<void>;
+}>;
+/**
+ * Registers the endpoint, returning a single-shot remover.
+ *
+ * `verify` is the caller's production authority (the Grok sandbox profile
+ * check); it runs before both the add and the remove so a registration can
+ * never be issued against an unverified engine.
+ */
+export declare const registerCliMcpServer: (input: CliMcpRegistrationInput) => Promise<CliMcpRegistration>;
+/** The MCP server name every CLI engine registers Daimon's per-wake endpoint under. */
+export declare const DAIMON_MCP_SERVER_NAME: "daimon";
+/**
+ * `agy mcp add --type http <name> <url>`.
+ *
+ * AGY has no per-invocation MCP flag, so this writes into the config file AGY
+ * reads at `$HOME/.gemini/config/mcp_config.json`. That is safe to do per wake
+ * because Daimon already gives every AGY agent its own `HOME`
+ * (`runtimeHomePath`, see `cliChildEnvironment`): two agents in one
+ * organization cannot collide, and a developer's real `~/.gemini` is never on
+ * the path a runtime child sees. `add` is an upsert, so a stale entry left by a
+ * crashed wake is replaced rather than duplicated.
+ *
+ * No `--header` is passed: Daimon's tool endpoint is an unauthenticated
+ * loopback listener on an ephemeral port, exactly as Codex and Grok receive it.
+ * Adding a bearer header here would put a secret in `argv` and in a file on the
+ * agent's durable runtime home for no gain.
+ */
+export declare const renderAgyMcpAddArgs: (commandArgs: readonly string[] | undefined, endpoint: string) => string[];
+export declare const renderAgyMcpRemoveArgs: (commandArgs: readonly string[] | undefined) => string[];
+//# sourceMappingURL=cliMcpRegistration.d.ts.map

package/dist/pi/cliMcpRegistration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliMcpRegistration.d.ts","sourceRoot":"","sources":["../../src/pi/cliMcpRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC9D,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACvC,cAAc,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,kBAAkB,CAU5B,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,EAAG,QAAiB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAAM,EACb,CAAC;AAE7F,eAAO,MAAM,sBAAsB,GAAI,aAAa,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,EACvB,CAAC"}

package/dist/pi/cliMcpRegistration.js

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+import { readChild } from "./cliChildOutput.js";
+import { terminateChild, trackCliChild } from "./cliProcess.js";
+/**
+ * `swept` decides whether the session's dispose path may kill this child.
+ *
+ * The *add* is swept: a dispose that arrives while the endpoint is still being
+ * registered should tear that child down with everything else. The *remove* is
+ * deliberately not, because dispose is precisely the caller that is waiting on
+ * it to finish — sweeping it makes the session terminate the cleanup it is
+ * awaiting, and the resulting `CLI engine exited SIGTERM` is then reported as a
+ * failed `stop()` for a wake that was cancelled on purpose. It stays bounded
+ * without the sweep: `readChild`'s 30s deadline aborts and terminates it, and
+ * `trackCliChild` still owns it for process exit.
+ */
+const runRegistrationCommand = async (input, args, swept) => {
+    const child = trackCliChild(spawn(input.command, args, {
+        cwd: input.cwd,
+        env: input.env,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", "pipe", "pipe"]
+    }));
+    if (swept)
+        input.onChild(child);
+    try {
+        await readChild(child, 30_000, input.secretValues, {
+            ...(input.failureClassifier === undefined ? {} : { failureClassifier: input.failureClassifier })
+        });
+    }
+    finally {
+        // An engine CLI may let an auxiliary process outlive its leader. Do not
+        // release the tracked setup child until its detached group is quiescent.
+        await terminateChild(child);
+        if (swept)
+            input.onChildSettled(child);
+    }
+};
+/**
+ * Registers the endpoint, returning a single-shot remover.
+ *
+ * `verify` is the caller's production authority (the Grok sandbox profile
+ * check); it runs before both the add and the remove so a registration can
+ * never be issued against an unverified engine.
+ */
+export const registerCliMcpServer = async (input) => {
+    await input.verify?.();
+    await runRegistrationCommand(input, input.addArgs, true);
+    let closePromise;
+    return {
+        close: () => closePromise ??= (async () => {
+            await input.verify?.();
+            await runRegistrationCommand(input, input.removeArgs, false);
+        })()
+    };
+};
+/** The MCP server name every CLI engine registers Daimon's per-wake endpoint under. */
+export const DAIMON_MCP_SERVER_NAME = "daimon";
+/**
+ * `agy mcp add --type http <name> <url>`.
+ *
+ * AGY has no per-invocation MCP flag, so this writes into the config file AGY
+ * reads at `$HOME/.gemini/config/mcp_config.json`. That is safe to do per wake
+ * because Daimon already gives every AGY agent its own `HOME`
+ * (`runtimeHomePath`, see `cliChildEnvironment`): two agents in one
+ * organization cannot collide, and a developer's real `~/.gemini` is never on
+ * the path a runtime child sees. `add` is an upsert, so a stale entry left by a
+ * crashed wake is replaced rather than duplicated.
+ *
+ * No `--header` is passed: Daimon's tool endpoint is an unauthenticated
+ * loopback listener on an ephemeral port, exactly as Codex and Grok receive it.
+ * Adding a bearer header here would put a secret in `argv` and in a file on the
+ * agent's durable runtime home for no gain.
+ */
+export const renderAgyMcpAddArgs = (commandArgs, endpoint) => [...(commandArgs ?? []), "mcp", "add", "--type", "http", DAIMON_MCP_SERVER_NAME, endpoint];
+export const renderAgyMcpRemoveArgs = (commandArgs) => [...(commandArgs ?? []), "mcp", "remove", DAIMON_MCP_SERVER_NAME];

package/dist/pi/cliProcess.d.ts

@@ -0,0 +1,7 @@
+import type { ChildProcess } from "node:child_process";
+export declare class CliProcessCleanupError extends Error {
+    constructor(operation: string, cause?: unknown);
+}
+export declare const trackCliChild: (child: ChildProcess) => ChildProcess;
+export declare const terminateChild: (child: ChildProcess) => Promise<void>;
+//# sourceMappingURL=cliProcess.d.ts.map

package/dist/pi/cliProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliProcess.d.ts","sourceRoot":"","sources":["../../src/pi/cliProcess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQvD,qBAAa,sBAAuB,SAAQ,KAAK;gBAC5B,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAItD;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,YAAY,KAAG,YAanD,CAAC;AA8FF,eAAO,MAAM,cAAc,GAAU,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAqBtE,CAAC"}

package/dist/pi/cliProcess.js

@@ -0,0 +1,132 @@
+import { readdir, readFile } from "node:fs/promises";
+const childStates = new WeakMap();
+const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+export class CliProcessCleanupError extends Error {
+    constructor(operation, cause) {
+        super(`CLI process cleanup failed while ${operation}`, { cause });
+        this.name = "CliProcessCleanupError";
+    }
+}
+export const trackCliChild = (child) => {
+    if (childStates.has(child))
+        return child;
+    let resolveClose;
+    // Keep the process group id at spawn time. `child.pid` is no longer a useful
+    // source of truth after the leader exits while one of its descendants lives.
+    const state = {
+        closed: false,
+        close: new Promise((resolve) => { resolveClose = resolve; }),
+        ...(process.platform === "win32" || child.pid === undefined ? {} : { pgid: child.pid })
+    };
+    child.once("close", () => { state.closed = true; resolveClose(); });
+    childStates.set(child, state);
+    return child;
+};
+const groupExists = (pgid) => {
+    try {
+        process.kill(-pgid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        throw new CliProcessCleanupError(`inspecting process group ${pgid}`, error);
+    }
+};
+const parseLinuxProcessState = (stat) => {
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0)
+        return undefined;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/u);
+    const group = Number(fields[2]);
+    return fields.length >= 3 && Number.isInteger(group) ? { state: fields[0], group } : undefined;
+};
+const linuxGroupScan = async (pgid, procRoot = "/proc") => {
+    let entries;
+    try {
+        entries = await readdir(procRoot);
+    }
+    catch {
+        return "unknown";
+    }
+    for (const entry of entries) {
+        if (!/^\d+$/u.test(entry))
+            continue;
+        try {
+            const processState = parseLinuxProcessState(await readFile(`${procRoot}/${entry}/stat`, "utf8"));
+            if (processState?.group !== pgid)
+                continue;
+            if (processState.state !== "Z" && processState.state !== "X")
+                return "live";
+        }
+        catch (error) {
+            // ENOENT is the process exiting mid-scan, which is exactly what settling
+            // looks like; anything else means the snapshot cannot be trusted.
+            if (error.code !== "ENOENT")
+                return "unknown";
+        }
+    }
+    return "settled";
+};
+const groupSettled = async (pgid) => {
+    if (!groupExists(pgid))
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    return await linuxGroupScan(pgid) === "settled";
+};
+const signalGroup = (pgid, signal) => {
+    try {
+        process.kill(-pgid, signal);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        throw new CliProcessCleanupError(`signaling process group ${pgid}`, error);
+    }
+};
+const waitForGroupSettled = async (pgid, milliseconds) => {
+    const deadline = Date.now() + milliseconds;
+    while (true) {
+        try {
+            if (await groupSettled(pgid))
+                return true;
+        }
+        catch (error) {
+            // EPERM is not evidence that a group is settled. Keep waiting for
+            // ESRCH or, on Linux, a /proc snapshot containing only exited zombies.
+            if (!isPermissionError(error) || Date.now() >= deadline)
+                throw error;
+        }
+        if (Date.now() >= deadline)
+            return false;
+        await delay(10);
+    }
+};
+const isPermissionError = (error) => error instanceof CliProcessCleanupError
+    && error.cause?.code === "EPERM";
+export const terminateChild = async (child) => {
+    trackCliChild(child);
+    const state = childStates.get(child);
+    const pgid = state.pgid;
+    if (pgid !== undefined && !await groupSettled(pgid)) {
+        if (signalGroup(pgid, "SIGTERM") && !await waitForGroupSettled(pgid, 1_000)) {
+            signalGroup(pgid, "SIGKILL");
+            if (!await waitForGroupSettled(pgid, 1_000)) {
+                throw new CliProcessCleanupError(`waiting for process group ${pgid} to exit`);
+            }
+        }
+    }
+    else if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+    }
+    // A `close` event proves that Node released its pipes. ESRCH, or a Linux
+    // process-group snapshot containing only exited zombies, proves that no
+    // detached descendant can still execute. Both are required for success.
+    if (!state.closed)
+        await state.close;
+    if (pgid !== undefined && !await groupSettled(pgid)) {
+        throw new CliProcessCleanupError(`waiting for process group ${pgid} to exit`);
+    }
+};

package/dist/pi/cliSession.d.ts

@@ -0,0 +1,106 @@
+import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { TurnUsageOutcome } from "../runtime/turnUsageLedger.js";
+import { type AgyTurnUsage } from "./agyHeadlessResult.js";
+import { type CodexTurnUsage } from "./codexHeadlessResult.js";
+import type { PiSessionLike } from "./piAgentHandle.js";
+import type { PiSessionFactoryInput } from "./piHarness.js";
+export type CliEngineKind = "agy" | "codex" | "grok";
+/**
+ * The per-wake tool-call bound for AGY, and the one place it is decided.
+ *
+ * Codex and Grok leave this `undefined` — their only bound is the wake
+ * deadline. AGY does not get that treatment, for a measured reason: its
+ * terminal usage frame is the *sum* over the turn's model steps, and each tool
+ * step resends the whole context. The live capture is 13,796 total tokens for a
+ * tool-free turn and 45,381 for a turn with a single call against an
+ * empty-schema tool — one call roughly triples the wake. An unbounded loop on
+ * the one engine whose subscription quota is currently the operator's only
+ * working credential is a cost hazard, not a capability.
+ *
+ * 16 is chosen so a realistic wake is never truncated (read a few declared MCP
+ * tools, then send one or two Moltnet messages) while the worst case is bounded
+ * at roughly a quarter-million tokens instead of "whatever fits in 180s". The
+ * bound degrades gracefully rather than failing the wake: exceeding it returns
+ * `McpToolTurnLimitError` to the model as a tool *error*, so the agent can still
+ * finish its turn and reply.
+ */
+export declare const AGY_MAX_TOOL_TURNS = 16;
+export { DAIMON_CODEX_WAKE_TIMEOUT_MS_ENV, DAIMON_CODEX_WAKE_TOKEN_CEILING_ENV, DAIMON_ENGINE_WAKE_TIMEOUT_MS_ENV, DAIMON_ENGINE_WAKE_TOKEN_CEILING_ENV, DEFAULT_CODEX_WAKE_TIMEOUT_MS, DEFAULT_CODEX_WAKE_TOKEN_CEILING, resolveCodexWakeTimeoutMs, resolveCodexWakeTokenCeiling, resolveEngineWakeLimitOverrides } from "./engineWakeLimits.js";
+export type CliEngineOptions = {
+    readonly commandArgs?: readonly string[];
+    readonly command?: string;
+    /** Internal production authority: rechecked immediately before each child. */
+    readonly verifyExecutable?: () => Promise<void>;
+    readonly verifyRuntimePaths?: () => Promise<void>;
+    readonly engineHomePath?: string;
+    readonly maxToolTurns?: number;
+    readonly onToolsMounted?: (tools: readonly ToolDefinition[]) => void;
+    readonly timeoutMs?: number;
+    /** Daimon-owned identity envelope prepended exactly once to every wake. */
+    readonly identityPrompt?: string;
+    readonly redactedEnvironmentNames?: readonly string[];
+    /** Internal secret-file authority used only for exact reply redaction. */
+    readonly credentialSecretValues?: () => Promise<readonly string[]>;
+    /** Internal production boundary; confirms the custom kernel profile before every Grok process. */
+    readonly verifyGrokSandbox?: () => Promise<void>;
+    readonly grokSandboxProfile?: string;
+    readonly grokBrokerTurn?: (prompt: string, mcpEndpoint: string, signal: AbortSignal) => Promise<string>;
+    /** Codex only: kills the child and fails the wake once a turn's own reported usage reaches this. */
+    readonly codexTokenCeiling?: number;
+    /** Codex only: pinned model name, rendered as `--model=<value>`. Omitted, Codex resolves its own default. */
+    readonly model?: string;
+    /** Codex only: pinned `model_reasoning_effort`, rendered as `-c model_reasoning_effort=<value>`. */
+    readonly reasoningEffort?: string;
+    readonly codexSandbox?: {
+        readonly mode: "workspace-write";
+        readonly networkAccess: false;
+        readonly webSearch: "disabled";
+    };
+    /** Internal production boundary: absolute host paths denied to Codex model-run local commands. */
+    readonly codexSandboxProtectedPaths?: readonly string[];
+    /** Internal production boundary: own non-secret runtime paths a strict Codex turn may read. */
+    readonly codexSandboxReadablePaths?: readonly string[];
+    /**
+     * Advisory per-turn metering sink for the engines whose headless stream
+     * reports token usage and that do not run behind the Grok engine broker
+     * (which meters its own turns). It never fails a turn that published.
+     *
+     * `outcome` says whether the wake this usage belongs to went on to succeed.
+     * A failed wake spends real money, so it is metered exactly like a
+     * successful one and the reader tells them apart by this field rather than
+     * by the row's absence.
+     */
+    readonly onTurnUsage?: (usage: AgyTurnUsage | CodexTurnUsage, outcome: TurnUsageOutcome) => Promise<void>;
+    /**
+     * Codex only: advisory per-model-request instrumentation, called once per
+     * wake with the thread id Codex announced on `thread.started`.
+     *
+     * The usage ledger's row is one sum per wake and cannot distinguish a cold
+     * prefix replayed per request from a context that grows per request. The
+     * per-request detail exists in the rollout Codex already writes for this
+     * thread; the thread id is the only thing that identifies *which* rollout,
+     * which is why it is carried out of the stream rather than inferred from
+     * whichever file on disk is newest. Errors here never reach the wake.
+     */
+    readonly onCodexTurnRequests?: (threadId: string) => Promise<void>;
+} & ({
+    readonly engine: "codex" | "grok";
+} | {
+    readonly dbusSessionBusAddress?: string;
+    readonly engine: "agy";
+});
+export type CliSessionInput = {
+    readonly cwd: string;
+    readonly customTools?: ToolDefinition[];
+    readonly daimonSecretEnvironmentNames?: readonly string[];
+    readonly runtimeHomePath?: string;
+};
+export declare const prepareCliRuntimeHome: (runtimeHomePath: string | undefined) => Promise<void>;
+export { terminateChild } from "./cliProcess.js";
+export { CLI_ENGINE_MAX_DIAGNOSTIC_BYTES, CLI_ENGINE_MAX_OUTPUT_BYTES, readChild } from "./cliChildOutput.js";
+export declare const createCliSessionFactory: (options: CliEngineOptions) => (input: PiSessionFactoryInput) => Promise<{
+    session: PiSessionLike;
+}>;
+export { runEngine, runEngineDetailed, type EngineRunResult } from "./cliEngineRun.js";
+export { renderAgyArgs, renderCodexArgs, spawnEngine } from "./cliEngineSpawn.js";
+//# sourceMappingURL=cliSession.d.ts.map

package/dist/pi/cliSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliSession.d.ts","sourceRoot":"","sources":["../../src/pi/cliSession.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAWtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AActE,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAI/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG5D,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,OAAO,EACL,gCAAgC,EAAE,mCAAmC,EAAE,iCAAiC,EAAE,oCAAoC,EAC9I,6BAA6B,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,+BAA+B,EAC1J,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACnE,kGAAkG;IAClG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxG,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,6GAA6G;IAC7G,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;KAAE,CAAC;IAC5H,kGAAkG;IAClG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxD,+FAA+F;IAC/F,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,GAAG,cAAc,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1G;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE,GAAG,CAAC;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CACnC,GAAG;IACF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IACxC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC;AAOF,eAAO,MAAM,qBAAqB,GAAU,iBAAiB,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAK7F,CAAC;AAYF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgS9G,eAAO,MAAM,uBAAuB,GAAI,SAAS,gBAAgB,MAC/D,OAAO,qBAAqB,KAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,CAUpC,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}