@parall/codex-agent 1.43.0 → 1.45.0

package/dist/legacy-workspace-config-migration.js

@@ -0,0 +1,229 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/**
+ * One-shot migration for workspaces last bootstrapped by a pre-protocol-delivery
+ * bridge.
+ *
+ * Those generations (every released bridge up to and including v1.44.0) injected
+ * the system prompt by writing `<workspace>/.codex/config.toml`
+ * (`developer_instructions`) and marking the workspace trusted in the operator's
+ * global codex config. Instructions now ride the app-server's per-thread
+ * `developerInstructions` param, so a leftover bridge-authored file would DOUBLE
+ * the instructions on any workspace codex still considers trusted.
+ *
+ * Deleting a file in someone's workspace is the destructive direction, so the
+ * gate is fail-closed: we remove ONLY what is provably the retired bridge's own
+ * artifact, and preserve (with a warning) everything else. A duplicated prompt
+ * is a degraded agent; a deleted operator file is lost work.
+ *
+ * WHY THIS IS ONE-SHOT AND NOT MERELY IDEMPOTENT. The authorship proof is
+ * `.parall/system-prompt.md`, and the bridge REWRITES that file on every boot.
+ * So it is legacy-era evidence exactly once: on the first protocol-delivery boot,
+ * before anything overwrites it. A gate that merely re-ran each boot would, from
+ * boot 2 on, be comparing the legacy config against a prompt THIS bridge wrote —
+ * evidence it manufactured itself. That is not hypothetical: prompt assembly is
+ * deterministic, so a file the first boot explicitly preserved as "not provably
+ * ours" can match on the next boot and be silently deleted, contradicting the
+ * warning the operator was just given. Fail-closed has to hold across the whole
+ * migration lifecycle, not per function call.
+ *
+ * Hence a versioned, one-way CLAIM (`.parall/legacy-workspace-config-migration.v1`),
+ * created atomically (`wx`) BEFORE any prompt write:
+ *   - exactly one boot ever wins the claim — it alone may delete;
+ *   - every later boot (and every concurrent loser) skips, silently, forever;
+ *   - a claim that cannot be persisted FAILS the boot before the proof is
+ *     overwritten, so a retry still has real evidence;
+ *   - a boot that dies mid-migration leaves the claim behind, so the file is
+ *     preserved forever rather than re-judged against fabricated evidence.
+ *
+ * The whole module is dead code once no workspace can still hold a pre-#1866
+ * artifact — sunset conditions in
+ * docs/tech-debt/codex-legacy-workspace-config-shim.md.
+ */
+/** Relative location of the retired bridge's workspace config. */
+const LEGACY_CONFIG_RELPATH = ['.codex', 'config.toml'];
+/**
+ * The one-way claim. Versioned: a future migration gets its own sentinel rather
+ * than reusing (or re-arming) this one.
+ */
+const MIGRATION_SENTINEL_RELPATH = ['.parall', 'legacy-workspace-config-migration.v1'];
+export function legacyWorkspaceConfigPath(workspaceDir) {
+    return path.join(workspaceDir, ...LEGACY_CONFIG_RELPATH);
+}
+export function migrationSentinelPath(workspaceDir) {
+    return path.join(workspaceDir, ...MIGRATION_SENTINEL_RELPATH);
+}
+/**
+ * Byte-exact reconstruction of the retired serializer. Verified identical across
+ * every released bridge that wrote this file (v1.37.0 … v1.44.0 — the line is
+ * byte-for-byte the same in all of them), so a single reconstruction covers the
+ * whole legacy fleet. The deletion gate compares raw bytes against this: it must
+ * never drift.
+ */
+export function legacyWorkspaceConfigToml(prompt) {
+    return `developer_instructions = """\n${prompt.replace(/\\/g, '\\\\').replace(/"""/g, '\\"""')}\n"""\n`;
+}
+/**
+ * Pure. Decides the fate of the legacy config from filesystem facts alone.
+ *
+ * The only path to `remove` is: plain regular file + exactly one hard link + a
+ * pre-overwrite reference copy exists + raw bytes are EXACTLY the retired
+ * serializer's output for that reference prompt. Every other combination
+ * preserves — including value-level near-misses (an operator file carrying the
+ * same `developer_instructions` value plus a comment would be destroyed together
+ * with the comment by a value-level compare).
+ */
+export function classifyLegacyWorkspaceConfig(facts) {
+    const { entry, rawContent, proof } = facts;
+    if (!entry)
+        return { action: 'none' };
+    if (!entry.isPlainFile)
+        return { action: 'preserve', reason: 'not-a-plain-file' };
+    if (entry.hardLinks !== 1)
+        return { action: 'preserve', reason: 'extra-hard-links' };
+    if (proof.kind === 'absent')
+        return { action: 'preserve', reason: 'no-authorship-proof' };
+    if (proof.kind === 'unreadable') {
+        return { action: 'preserve', reason: 'authorship-proof-unreadable' };
+    }
+    if (rawContent === null)
+        return { action: 'preserve', reason: 'config-unreadable' };
+    if (rawContent !== legacyWorkspaceConfigToml(proof.prompt)) {
+        return { action: 'preserve', reason: 'content-mismatch' };
+    }
+    return { action: 'remove' };
+}
+const PRESERVE_DETAIL = {
+    'not-a-plain-file': 'it is a symlink or directory, not a plain file the bridge could have written',
+    'extra-hard-links': 'the file has more than one hard link, so another path shares this inode',
+    'no-authorship-proof': 'this workspace has no .parall/system-prompt.md from a previous boot, so nothing here can be proven ours',
+    'authorship-proof-unreadable': 'the .parall/system-prompt.md authorship proof exists but could not be read, so ownership cannot be evaluated',
+    'config-unreadable': 'its own bytes could not be read, so authorship cannot be proven',
+    'content-mismatch': 'its bytes are not what the retired bridge would have written',
+};
+const SENTINEL_BODY = `Parall codex bridge — one-shot workspace migration record (v1)
+
+The legacy workspace-config cleanup has been CLAIMED for this workspace. Only the
+boot that created this file was allowed to remove a bridge-authored
+.codex/config.toml, and only under a byte-exact authorship proof.
+
+While this file exists the bridge will NEVER auto-remove .codex/config.toml again.
+Deleting this file does not safely re-arm the migration: the evidence it relied on
+(.parall/system-prompt.md as written by a pre-protocol-delivery bridge) has since
+been overwritten by this bridge, so a re-run could mistake a prompt it wrote itself
+for legacy evidence and delete a file that is not ours.
+
+If a stale .codex/config.toml is still present, remove it by hand.
+`;
+/**
+ * Atomically take the one-way claim. `wx` makes this a single filesystem
+ * operation, so concurrent boots cannot both win.
+ *
+ * THROWS if the claim cannot be persisted (EACCES, EIO, EROFS …). That is
+ * deliberate and load-bearing: the caller runs this BEFORE overwriting
+ * `.parall/system-prompt.md`, so a boot that cannot record its claim must die
+ * with the legacy evidence still intact rather than proceed to manufacture a
+ * prompt that a later boot would mistake for that evidence.
+ */
+export function claimLegacyWorkspaceConfigMigration(workspaceDir) {
+    const sentinel = migrationSentinelPath(workspaceDir);
+    // The module owns its own sentinel, directory included — a caller that has not
+    // created `.parall` yet must still get a real claim, not an ENOENT throw.
+    fs.mkdirSync(path.dirname(sentinel), { recursive: true });
+    try {
+        fs.writeFileSync(sentinel, SENTINEL_BODY, { flag: 'wx' });
+        return 'claimed';
+    }
+    catch (err) {
+        if (err.code === 'EEXIST')
+            return 'already-claimed';
+        throw err;
+    }
+}
+/**
+ * The migration lifecycle: claim, then — only if we won the claim — read the
+ * proof and clean up.
+ *
+ * `readProof` is a THUNK, not a value, and that is the whole point. Reading the
+ * proof is not free of side effects: an unreadable `.parall/system-prompt.md`
+ * warns. Passed as an already-evaluated argument, that warning fires before the
+ * claim is even checked — so an already-claimed later boot, or a concurrent
+ * loser, would emit a migration warning about a decision it is not making. The
+ * thunk makes "only the winner touches the proof" a property of the type rather
+ * than of the caller's evaluation order.
+ *
+ * The caller still owns `.parall/system-prompt.md` and must hand over the
+ * PRE-OVERWRITE copy: the winner evaluates the thunk here, before anything
+ * writes a new prompt.
+ *
+ * A boot that does not win the claim returns silently — it must not delete, it
+ * must not read, and it must not warn: the winner may be deleting the very file
+ * it would warn about, and a stale warning about a file that is already gone is
+ * exactly the misleading diagnostic this module exists to avoid.
+ */
+export function runLegacyWorkspaceConfigMigration(workspaceDir, readProof, log) {
+    if (claimLegacyWorkspaceConfigMigration(workspaceDir) === 'already-claimed')
+        return;
+    cleanupLegacyWorkspaceConfig(workspaceDir, readProof(), log);
+}
+/**
+ * Filesystem execution for the one boot that holds the claim. Reads the facts,
+ * asks the classifier, applies the verdict.
+ *
+ * Never throws: a workspace that cannot be migrated must still boot. Every
+ * non-ENOENT problem warns.
+ */
+function cleanupLegacyWorkspaceConfig(workspaceDir, proof, log) {
+    const configPath = legacyWorkspaceConfigPath(workspaceDir);
+    let entry;
+    try {
+        entry = fs.lstatSync(configPath);
+    }
+    catch (err) {
+        // Only ENOENT means "nothing to clean up". Anything else (EACCES, EIO, …)
+        // leaves an unverifiable file behind — surface it rather than silently
+        // treating it as absent.
+        if (err.code !== 'ENOENT') {
+            log?.warn(`could not inspect legacy workspace codex config ${configPath}: ${String(err)}`);
+        }
+        return;
+    }
+    const isPlainFile = entry.isFile();
+    let rawContent = null;
+    if (isPlainFile) {
+        try {
+            rawContent = fs.readFileSync(configPath, 'utf8');
+        }
+        catch (err) {
+            // Read failure → rawContent stays null → the classifier preserves
+            // ('config-unreadable'). Log the cause here; the verdict warning follows.
+            log?.warn(`could not read legacy workspace codex config ${configPath}: ${String(err)}`);
+        }
+    }
+    const verdict = classifyLegacyWorkspaceConfig({
+        entry: { isPlainFile, hardLinks: entry.nlink },
+        rawContent,
+        proof,
+    });
+    if (verdict.action === 'none')
+        return;
+    if (verdict.action === 'remove') {
+        try {
+            fs.unlinkSync(configPath);
+        }
+        catch (err) {
+            // ENOENT here means the file went away between our lstat and this unlink
+            // — a second bridge booting the same workspace (rapid daemon respawn) got
+            // there first. That is exactly the end state we wanted, so it is not a
+            // failure: warning "could not remove" about a file that is already gone
+            // would send the operator after nothing. Concurrent migrations converge.
+            if (err.code === 'ENOENT')
+                return;
+            log?.warn(`could not remove legacy workspace codex config ${configPath}: ${String(err)}`);
+        }
+        return;
+    }
+    log?.warn(`leaving ${configPath} in place — ${PRESERVE_DETAIL[verdict.reason]}, so it is not provably ` +
+        "the retired bridge's own artifact. Codex loads it for trusted workspaces IN ADDITION to " +
+        'the platform instructions; remove it manually if it is a stale artifact.');
+}

package/dist/turn-sink.d.ts

@@ -0,0 +1,23 @@
+import type { RuntimeEvent } from '@parall/agent-core';
+import { EventMapper } from './event-mapping.js';
+export type TurnEventEnvelope = {
+    kind: 'runtime';
+    event: RuntimeEvent;
+} | {
+    kind: 'turn_end';
+    threadId?: string;
+} | {
+    kind: 'error';
+    message: string;
+};
+/** Per-turn buffered sink backed by an unbounded promise queue. */
+export declare class TurnSink {
+    readonly mapper: EventMapper;
+    private readonly queue;
+    private resolver;
+    private closed;
+    push(envelope: TurnEventEnvelope): void;
+    next(): Promise<TurnEventEnvelope>;
+    close(): void;
+}
+//# sourceMappingURL=turn-sink.d.ts.map

package/dist/turn-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-sink.d.ts","sourceRoot":"","sources":["../src/turn-sink.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,mEAAmE;AACnE,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,cAAqB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IACjD,OAAO,CAAC,QAAQ,CAAqD;IACrE,OAAO,CAAC,MAAM,CAAS;IAEvB,IAAI,CAAC,QAAQ,EAAE,iBAAiB;IAWhC,IAAI,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAelC,KAAK;CAMN"}

package/dist/turn-sink.js

@@ -0,0 +1,40 @@
+import { EventMapper } from './event-mapping.js';
+/** Per-turn buffered sink backed by an unbounded promise queue. */
+export class TurnSink {
+    mapper = new EventMapper();
+    queue = [];
+    resolver = null;
+    closed = false;
+    push(envelope) {
+        if (this.closed)
+            return;
+        if (this.resolver) {
+            const r = this.resolver;
+            this.resolver = null;
+            r(envelope);
+            return;
+        }
+        this.queue.push(envelope);
+    }
+    next() {
+        // Drain any queued envelopes first, even after close(). Otherwise a final
+        // error envelope enqueued right before close() (e.g. by
+        // handleSubprocessClose) is silently dropped because the consumer would
+        // see turn_end before it.
+        const pending = this.queue.shift();
+        if (pending)
+            return Promise.resolve(pending);
+        if (this.closed) {
+            return Promise.resolve({ kind: 'turn_end' });
+        }
+        return new Promise((resolve) => {
+            this.resolver = resolve;
+        });
+    }
+    close() {
+        this.closed = true;
+        const r = this.resolver;
+        this.resolver = null;
+        r?.({ kind: 'turn_end' });
+    }
+}

package/dist/workspace.d.ts

@@ -16,10 +16,10 @@ export declare const CONFIG_LOCK_TIMINGS: {
 };
 /**
  * Advisory cross-process lock serializing `<codexHome>/config.toml`
- * read-modify-write. On a local daemon machine every runtime_auth codex
- * bridge child shares the operator's CODEX_HOME, and the daemon starts them
- * together — without a lock, a whole-file rewrite working from a stale read
- * can erase a trust entry another agent appended in between.
+ * read-modify-write. Several bridge children can share one CODEX_HOME (an
+ * operator-set PRLL_CODEX_HOME reaches every child on the machine), and the
+ * daemon starts them together — without a lock, concurrent whole-file
+ * rewrites working from stale reads lose updates.
  *
  * Queue design (why not wx-create + steal): any scheme that renames or
  * unlinks the SHARED lock path can, between its staleness check and the
@@ -62,11 +62,12 @@ export declare const CONFIG_LOCK_TIMINGS: {
  * eviction and the process re-enqueues. On `waitMs` timeout
  * the mutation proceeds without the lock (warn) — blocking would wedge
  * bridge startup. The lock coordinates bridge processes only; codex itself
- * does not observe it, which is why bridge writes to a shared config are
- * additionally kept rare (the trust write is a no-op after the first boot
- * per workspace, and runtime_auth agents never write the provider block)
- * and whole-file writes are atomic (temp + rename) so codex never reads a
- * truncated file.
+ * does not observe it, which is why bridge writes to the global config are
+ * additionally kept rare — the only remaining mutation is the parall
+ * provider block (runtime_auth agents, which share the operator's ~/.codex,
+ * write nothing at all: platform instructions ride the app-server
+ * `developerInstructions` param) — and whole-file writes are atomic
+ * (temp + rename) so codex never reads a truncated file.
  *
  * Exported for tests.
  */
@@ -84,19 +85,6 @@ export declare const CONFIG_LOCK_TEST_HOOKS: {
     beforeTicketPublish?: () => void;
     beforeTicketEntry?: () => void;
 };
-/**
- * Ensure the workspace directory is marked as trusted in the global Codex
- * config so that project-level `developer_instructions` are loaded at
- * app-server startup.
- *
- * Uses smol-toml for structured reads (avoids substring false-positives),
- * but writes via raw text manipulation (preserves comments and formatting).
- * Failures are swallowed (warn-only) so a trust write issue never blocks
- * the bridge from starting.
- */
-export declare function ensureWorkspaceTrusted(codexHome: string, workspaceDir: string, log?: {
-    warn: (msg: string) => void;
-}): void;
 /**
  * Returns true when the agent is using the Parall LLM proxy (llm_source=parall)
  * rather than a BYO custom provider or runtime_auth. Detected by checking
@@ -117,11 +105,21 @@ export declare function isParallProxyMode(env?: NodeJS.ProcessEnv): boolean;
  *
  * Provider-managed: overwritten on every boot (env vars are the SSOT).
  */
+/**
+ * Escape a value as a TOML basic (double-quoted) string. Needed for Windows
+ * paths (backslashes) in the auth command; harmless hardening everywhere else.
+ */
+export declare function tomlBasicString(value: string): string;
+/** Injectable auth-command inputs — production callers pass nothing. */
+export interface ParallProviderAuthOptions {
+    platform?: NodeJS.Platform;
+    nodeBin?: string;
+}
 export declare function ensureParallProvider(codexHome: string, apiUrl: string, log?: {
     warn: (msg: string) => void;
-}): void;
-export declare function writeCodexSystemPrompt(workspaceDir: string, agentIdentity?: AgentIdentity, capabilityFragments?: string[]): void;
+}, opts?: ParallProviderAuthOptions): void;
+export declare function writeCodexSystemPrompt(workspaceDir: string, agentIdentity?: AgentIdentity, capabilityFragments?: string[]): string;
 export declare function ensureCodexWorkspace(workspaceDir: string, log?: {
     warn: (msg: string) => void;
-}, agentIdentity?: AgentIdentity, capabilityFragments?: string[]): void;
+}, agentIdentity?: AgentIdentity, capabilityFragments?: string[]): string;
 //# sourceMappingURL=workspace.d.ts.map

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,SAAS,EAChD,EAAE,EAAE,MAAM,IAAI,GACb,IAAI,CAkJN;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE;IACnC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B,CAAC;AAuJP;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CAEN;AAqGD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAK/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CAEN;AAoED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,aAAa,EAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAC7B,IAAI,CAqBN;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,EAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAC7B,IAAI,CAQN"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,SAAS,EAChD,EAAE,EAAE,MAAM,IAAI,GACb,IAAI,CAkJN;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE;IACnC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B,CAAC;AAuJP;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAK/E;AAED;;;;;;;;;;;;;GAaG;AACH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAerD;AAED,wEAAwE;AACxE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA0BD,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,IAAI,CAAC,EAAE,yBAAyB,GAC/B,IAAI,CAEN;AAkFD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,aAAa,EAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAC7B,MAAM,CAwBR;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,EAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,GAC7B,MAAM,CA+BR"}