@open-everywhere/core 0.1.0

package/dist/agent/channels/control-mcp.js

@@ -0,0 +1,35 @@
+// Deployment mount for the control plane's MCP WRITE transport and the small OAuth 2.1
+// authorization server that guards it (OPE-72). All behaviour lives in control/mcp-route.ts,
+// control/oauth-route.ts and control/oauth-resource.ts.
+//
+// FAIL-CLOSED AS A WHOLE, AT TWO CONDITIONS AND THEN A THIRD. Every route here answers 404 unless
+// BOTH OE_CONTROL_OAUTH_SIGNING_SECRET is set (and at least 32 characters) AND CONTROL_OAUTH_ISSUER
+// is declared in tracked config (control/oauth-clients.ts) — until then the plane is off and does
+// not disclose that the seam exists. With both set, the routes exist: the discovery documents are
+// published and the mount answers 401. A caller still needs an access token this deployment's own
+// authorization server minted for a registered client, and that registry is EMPTY until a pull
+// request adds one — so arming the secret and the issuer alone issues nothing.
+//
+// This mount is the WRITE side. The read side (channels/control-read.ts) keeps its own disjoint
+// service-token family and is untouched by this plane — neither credential opens the other's door.
+import { defineChannel, DELETE, GET, POST } from "eve/channels";
+import { CONTROL_MCP_PATH, handleControlMcpRequest } from "../control/mcp-route.js";
+import { CONTROL_PROTECTED_RESOURCE_METADATA_PATH } from "../control/oauth-resource.js";
+import { CONTROL_OAUTH_AUTHORIZE_PATH, CONTROL_OAUTH_SERVER_METADATA_PATH, CONTROL_OAUTH_TOKEN_PATH, handleAuthorize, handleAuthorizationServerMetadata, handleProtectedResourceMetadata, handleToken, } from "../control/oauth-route.js";
+export default defineChannel({
+    routes: [
+        // RFC 8414 / RFC 9728 discovery — unauthenticated by design (both documents are public
+        // metadata), but still 404 while the plane is unarmed.
+        GET(CONTROL_OAUTH_SERVER_METADATA_PATH, async (req) => handleAuthorizationServerMetadata(req)),
+        GET(CONTROL_PROTECTED_RESOURCE_METADATA_PATH, async (req) => handleProtectedResourceMetadata(req)),
+        // The authorization server.
+        GET(CONTROL_OAUTH_AUTHORIZE_PATH, async (req) => handleAuthorize(req)),
+        POST(CONTROL_OAUTH_TOKEN_PATH, async (req) => handleToken(req)),
+        // The resource server. GET and DELETE are part of the MCP Streamable HTTP contract (stream
+        // re-attach and session teardown); both pass the same token gate as POST.
+        POST(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+        GET(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+        DELETE(CONTROL_MCP_PATH, async (req) => handleControlMcpRequest(req)),
+    ],
+});
+//# sourceMappingURL=control-mcp.js.map

package/dist/agent/channels/control-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-mcp.js","sourceRoot":"","sources":["../../../agent/channels/control-mcp.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,6FAA6F;AAC7F,wDAAwD;AACxD,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,+FAA+F;AAC/F,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,wCAAwC,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wBAAwB,EACxB,eAAe,EACf,iCAAiC,EACjC,+BAA+B,EAC/B,WAAW,GACZ,MAAM,2BAA2B,CAAC;AAEnC,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,uFAAuF;QACvF,uDAAuD;QACvD,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAC9F,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;QAClG,4BAA4B;QAC5B,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/D,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACnE,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;KACtE;CACF,CAAC,CAAC"}

package/dist/agent/channels/control-read.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=control-read.d.ts.map

package/dist/agent/channels/control-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-read.d.ts","sourceRoot":"","sources":["../../../agent/channels/control-read.ts"],"names":[],"mappings":""}

package/dist/agent/channels/control-read.js

@@ -0,0 +1,21 @@
+// Deployment mount for the control plane's READ side; all behaviour lives in control/read-route.ts.
+// Every route is service-token-authed (OE_CONTROL_READ_TOKENS) and fails closed with a 404 when no token is configured. GET only, and read-route.ts imports no write tool, so the write side is structurally unreachable from this mount.
+import { defineChannel, GET } from "eve/channels";
+import { CONTROL_READ_AUDIT_PATH, CONTROL_READ_USAGE_PATH, CONTROL_READ_UNIFIED_AUDIT_PATH, CONTROL_READ_TRANSCRIPT_PATH, CONTROL_READ_RUNTIME_SIGNAL_PATH, CONTROL_READ_MODEL_CALLS_PATH, CONTROL_READ_MODEL_CALL_SESSIONS_PATH, handleAuditWindowRead, handleUsageWindowRead, handleUnifiedAuditRead, handleSessionTranscriptRead, handleRuntimeSignalRead, handleSessionModelCallsRead, handleModelCallSessionsRead, } from "../control/read-route.js";
+export default defineChannel({
+    routes: [
+        GET(CONTROL_READ_USAGE_PATH, async (req) => handleUsageWindowRead(req)),
+        GET(CONTROL_READ_AUDIT_PATH, async (req) => handleAuditWindowRead(req)),
+        GET(CONTROL_READ_UNIFIED_AUDIT_PATH, async (req) => handleUnifiedAuditRead(req)),
+        // `:sessionId` matches into `args.params` (routes.d.ts); `args.attachSession` is eve's public
+        // read-only session API (eve/channels). Read-only, self-audited, fail-closed like the siblings.
+        GET(CONTROL_READ_TRANSCRIPT_PATH, async (req, { attachSession, params }) => handleSessionTranscriptRead(req, attachSession, params)),
+        // The deploy-time signal `deploy:census` reads for the dynamic-tool-roster refresh.
+        GET(CONTROL_READ_RUNTIME_SIGNAL_PATH, async (req) => handleRuntimeSignalRead(req)),
+        // The soak lane's prefix-replay harvest — empty unless `soak.capture` was armed for the run, transcript-grade when it was, and gated identically to its siblings.
+        GET(CONTROL_READ_MODEL_CALLS_PATH, async (req, { params }) => handleSessionModelCallsRead(req, params)),
+        // The retention operator's session-discovery read: it lists which sessions hold captures, and returns no body byte.
+        GET(CONTROL_READ_MODEL_CALL_SESSIONS_PATH, async (req) => handleModelCallSessionsRead(req)),
+    ],
+});
+//# sourceMappingURL=control-read.js.map

package/dist/agent/channels/control-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-read.js","sourceRoot":"","sources":["../../../agent/channels/control-read.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,0OAA0O;AAE1O,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,gCAAgC,EAChC,6BAA6B,EAC7B,qCAAqC,EACrC,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvE,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvE,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChF,8FAA8F;QAC9F,gGAAgG;QAChG,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACpI,oFAAoF;QACpF,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAClF,kKAAkK;QAClK,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvG,oHAAoH;QACpH,GAAG,CAAC,qCAAqC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;KAC5F;CACF,CAAC,CAAC"}

package/dist/agent/channels/credential-intake-page.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=credential-intake-page.d.ts.map

package/dist/agent/channels/credential-intake-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-intake-page.d.ts","sourceRoot":"","sources":["../../../agent/channels/credential-intake-page.ts"],"names":[],"mappings":""}

package/dist/agent/channels/credential-intake-page.js

@@ -0,0 +1,11 @@
+// Deployment mount for the credential-intake page; the behaviour lives in credentials/intake-page.ts.
+// Both routes fail closed (404) until the credential vault is armed, and the signing key is memoised per process — a rotation reaches a warm process only at restart.
+import { defineChannel, GET, POST } from "eve/channels";
+import { INTAKE_PAGE_PATH, handleIntakePageGet, handleIntakePagePost } from "../credentials/intake-page.js";
+export default defineChannel({
+    routes: [
+        GET(INTAKE_PAGE_PATH, async (req) => handleIntakePageGet(req)),
+        POST(INTAKE_PAGE_PATH, async (req) => handleIntakePagePost(req)),
+    ],
+});
+//# sourceMappingURL=credential-intake-page.js.map

package/dist/agent/channels/credential-intake-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-intake-page.js","sourceRoot":"","sources":["../../../agent/channels/credential-intake-page.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,sKAAsK;AAEtK,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE5G,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;KACjE;CACF,CAAC,CAAC"}

package/dist/agent/channels/delegated-provenance.d.ts

@@ -0,0 +1,129 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type ConnectorRead } from "./reply-provenance.js";
+import type { TaskWakeInstall } from "./task-wake.js";
+/** WHICH RECORD one carried read pulled, and the label the room may see for it. Written by the
+ *  BORROW door alone — see ground 3 in this file's header for why that door proves the room's
+ *  entitlement where the connector door cannot. */
+export interface DelegatedReadRecord {
+    /** The record's kind — `credential-grant` for the one door that writes this. Keyed on by
+     *  `rememberRecordName`, so it must be the same string `channels/read-reach.ts` records. */
+    readonly kind: string;
+    /** The record's id — the GRANT ROW's id, which is an id in a ledger of ids. */
+    readonly id: string;
+    /** The record's display label — the grant's PINNED TARGET, host-admitted and never vendor bytes.
+     *  It is the only display text this whole module stores. */
+    readonly name: string;
+}
+/** One read a worker made, as little of it as the seat's footer needs. IDS AND VERBS, plus the ONE
+ *  label the borrow door proves a room is entitled to — see this file's header for the two fields
+ *  that are deliberately absent, the taint mark first among them. */
+export interface DelegatedRead {
+    /** The connection the op ran under — the operator-chosen connector name (`notion`, `linear`),
+     *  which is the display name too. Never a credential id and never a record id. */
+    readonly connection: string;
+    /** The op verb (`get_page`, `list_issues`). The durable `reply.provenance` row keeps it; the
+     *  footer never shows it. */
+    readonly op: string;
+    /** The record this read pulled, where the door that made it proved the room may be told its name.
+     *  ABSENT is the ordinary case — every connector-door read, and every borrowed read whose grant
+     *  row holds no recoverable pinned label — and it renders the connection name alone. */
+    readonly record?: DelegatedReadRecord;
+}
+/** The PARENT SESSION and CALL one worker was dispatched under, or `null` when this context names no
+ *  delegating parent. */
+export interface DelegatingParentLink {
+    readonly sessionId: string;
+    readonly callId: string;
+}
+/**
+ * The delegating parent of THIS context, from eve's continuation token first and its typed session
+ * linkage second.
+ *
+ * 🔴 CONSERVATIVE ON BOTH ARMS, AND THE TOKEN PARSE IS COLON-FREE BY CONSTRUCTION. eve mints the
+ * token as `subagent:<parentSessionId>:<callId>`, and a greedy parse of an id that itself contains a
+ * colon yields a pair naming no session — which would key a store row nothing ever reads, or worse,
+ * one another delegation reads. Anything ambiguous is declined, and a declined link means no
+ * carriage: the fail-soft direction on both edges.
+ *
+ * `hooks/spawn-taint.ts` reads the SAME answer for the taint plane's own call-keyed marker, so the
+ * two planes cannot disagree about which delegation a worker belongs to.
+ */
+export declare function delegatingParentLink(ctx: unknown): DelegatingParentLink | null;
+/** The store key for one delegation's read list. */
+export declare function delegatedProvenanceKey(childToken: string): string;
+/**
+ * Record that a WORKER read something through a connector, for the delegating seat's reply footer.
+ *
+ * Called beside every `noteConnectorRead` — `hooks/connector-audit.ts` for a connector op and
+ * `channels/read-reach.ts` for an authored read tool — so a read reaches the seat by whichever door
+ * it was made through. A NO-OP outside a subagent child, which is what keeps a seat's own read off
+ * this store entirely: the turn-local ledger already holds it, and a seat has no parent to carry it
+ * to.
+ *
+ * 🔴 `record` IS THE BORROW DOOR'S ALONE (OPE-2026). The caller passes one only where it has proved
+ * the delegating room may be told the name — which today is the borrow door, off the grant row's own
+ * pinned target. Every other caller omits it, and the carried read then renders as the connection
+ * name alone. A half-shaped record (an empty kind, id or label) is dropped rather than stored, so
+ * the row can never name a record it cannot identify.
+ *
+ * Fire-and-forget and never throws: a read that cannot be recorded is still a read that happened.
+ */
+export declare function noteDelegatedRead(bind: BindableContext, connection: string, op: string, record?: DelegatedReadRecord): void;
+/** What one settlement did with a delegation's recorded reads.
+ *
+ *  The two numbers are separate because they answer different questions, and an operator reading a
+ *  footerless reply needs both: `found` says whether the WORKER end recorded anything at all, and
+ *  `carried` says whether the SEAT could attribute it. `found > 0` with `carried === 0` is a
+ *  withheld settlement, which is a decision, not a fault. */
+export interface DelegatedReadSettlement {
+    readonly found: number;
+    readonly carried: number;
+}
+/**
+ * The inherited stamp, admitted as a read's SECOND address or withheld (OPE-1869). Exported so the
+ * settlement edge states the rule in one call AND so the suite can drive the rule directly —
+ * `delegated-provenance-test.ts` §10 asserts each of the four refusal arms below against it, because
+ * one settlement drive can only ever exercise one of them.
+ *
+ * `undefined` in, `undefined` out — a settlement with no inherited stamp, or one the wake map cannot
+ * place in the task's own conversation, carries the task wake alone.
+ */
+export declare function delegatedSecondAddress(input: {
+    readonly org: string;
+    /** The task's own minted wake — the id `stampReadReach` put on the carried reads. */
+    readonly taskWakeId: string | null;
+    /** `inheritedWakeStampOf` — the raw delivery stamp the seat will reply under. */
+    readonly inheritedWakeId: string | undefined;
+    /** `installTaskWake`'s verdict. Only `installed` means this turn adopted THIS task's wake; on
+     *  `already` a sibling task took the turn first and on `ingressed` the turn brought its own
+     *  delivery.
+     *  🔴 THIS CHECK IS LOAD-BEARING, NOT A RESTATEMENT OF `wakeProvable`. That guard compares
+     *  `install.wakeId` against `reach.wakeId`, which is `addressedWakeThisTurn(turnId) ??
+     *  currentWakeId(ctx)`. On the `currentWakeId` arm it does withhold `already` and `ingressed`. On
+     *  the ADDRESSED arm it does not: a turn that addressed this task's own minted wake before the
+     *  settle satisfies `wakeProvable` on either outcome, and this check is the only thing left
+     *  withholding. Deleting it would still be origin-proved, and it would widen the admitted set with
+     *  nothing covering the widening.
+     *  Typed as the install's own union so a rename of the literal reds a typecheck rather than
+     *  silently turning the second address off for good. */
+    readonly outcome: TaskWakeInstall["outcome"];
+}): Promise<string | undefined>;
+export declare function settleDelegatedReads(input: {
+    readonly org: string;
+    /** `TaskCallLink.childToken` — the dispatch join row's own copy of the token the worker wrote
+     *  under. Read off the row rather than rebuilt, so the seat never guesses which call it settled. */
+    readonly childToken: string;
+    /** The SEAT's own eve session — `currentSessionId` on the settling turn, the same expression
+     *  `replyAuditFor` reads for the reply. It is the other half of the key a carried record's display
+     *  label is stored under (OPE-2026): `rememberRecordName`'s map is PROCESS-GLOBAL and eve repeats
+     *  `turn_0` across sessions, so a label stored under the turn alone would be resolved for another
+     *  session's turn. Absent stores no label, and the footer then names the connection alone. */
+    readonly sessionId: string | undefined;
+    /** The PARENT turn the reads are being attributed to — `currentTurnId` on the settling turn. */
+    readonly turnId: string | undefined;
+    /** The proof THIS SEAT can offer for the room it is about to reply into, stamped fresh by
+     *  `stampReadReach` at the settle — never the worker's own (see this file's header). `undefined`
+     *  withholds: the row is spent and nothing reaches the ledger. */
+    readonly reach: Pick<ConnectorRead, "proof" | "surfaceKey" | "wakeId" | "alsoWakeId"> | undefined;
+}): Promise<DelegatedReadSettlement>;
+//# sourceMappingURL=delegated-provenance.d.ts.map

package/dist/agent/channels/delegated-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-provenance.d.ts","sourceRoot":"","sources":["../../../agent/channels/delegated-provenance.ts"],"names":[],"mappings":"AAmHA,OAAO,EAAyC,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAIlG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAsBtD;;mDAEmD;AACnD,MAAM,WAAW,mBAAmB;IAClC;gGAC4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;gEAC4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;qEAEqE;AACrE,MAAM,WAAW,aAAa;IAC5B;sFACkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;iCAC6B;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;4FAEwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED;yBACyB;AACzB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAiB9E;AAUD,oDAAoD;AACpD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjE;AA0FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAiB3H;AAED;;;;;6DAK6D;AAC7D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAgED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;;;;;;;4DAWwD;IACxD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;CAC9C,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM9B;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;wGACoG;IACpG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;kGAI8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;sEAEkE;IAClE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC,GAAG,SAAS,CAAC;CACnG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA+BnC"}