@synapsor/runner 1.4.123 → 1.5.0

package/CHANGELOG.md

@@ -1,6 +1,41 @@
 # Changelog
 
-## 1.4.123 (prepared, not published)
+## 1.5.0 (prepared, not published)
+
+### Complete guarded-action developer proof
+
+- Adds `synapsor-runner try` as a no-account, no-database, no-Docker proof of
+  scoped evidence, an exact business-data proposal, external approval, guarded
+  commit, restart-safe retry, stale-state refusal, receipt, and non-mutating
+  replay. `try --prove` also verifies changed-intent collision rejection.
+- Adds explicit `application_scope`, `postgres_rls`, and `tenant_bound`
+  assurance modes. PostgreSQL hardened mode binds tenant/principal
+  transaction-locally, checks RLS and role prerequisites, and fails closed
+  rather than silently downgrading.
+- Productizes strict local shadow studies, authoritative human-outcome
+  comparison, deterministic readiness reports, and effect-level JSON/JUnit
+  regression fixtures without activating policy or mutating source data.
+- Adds a standard display-only MCP App proposal resource with exact effect,
+  evidence, scope, policy, and review-state presentation. Approval and apply
+  remain absent from MCP, with terminal and standalone local-UI fallbacks.
+- Extends static MCP risk audit into disabled review candidates, and adds
+  review-only Prisma, Drizzle, and OpenAPI generators that emit canonical
+  contracts without importing or executing adopter code.
+- Promotes `examples/support-billing-agent` as a disposable PostgreSQL/RLS
+  proof covering tenant and principal scope, kept-out fields, exact $55
+  proposal, approval/apply, idempotent retry, stale conflict, replay, strict
+  shadow, human comparison, and effect regression.
+- Keeps app-owned handler writers least-privileged when their receipt table is
+  pre-provisioned: the helper checks for the table before attempting DDL, and
+  the live source and packed examples verify transactional apply and retry.
+- Rewrites the README around the complete `try --prove` outcome, keeps MCP
+  audit immediately second, names each isolation boundary precisely, and
+  reconciles release documentation with the live npm registry.
+- Stages only `@synapsor/runner@1.5.0`; `@synapsor/spec@1.4.2`,
+  `@synapsor/dsl@1.4.3`, and `@synapsor/cli@0.1.0-beta.1` remain unchanged.
+  Nothing is published by this change.
+
+## 1.4.123 (2026-07-17)
 
 ### Advisory capability-surface fitness lint
 
@@ -13,10 +48,10 @@
 - Adds stable structured details and surface metrics to JSON/SARIF output, plus
   a concise text summary. No database connection, environment value, source
   row, or probabilistic classifier is involved.
-- Stages only `@synapsor/runner@1.4.123`; `@synapsor/spec@1.4.2`,
+- Published only `@synapsor/runner@1.4.123`; `@synapsor/spec@1.4.2`,
   `@synapsor/dsl@1.4.3`, and `@synapsor/cli@0.1.0-beta.1` are unchanged.
 
-## 1.4.122 (2026-07-16)
+## 1.4.122 (2026-07-17)
 
 ### Trusted principal row scope and Cloud-linked governance
 
@@ -42,7 +77,7 @@
 - Published `@synapsor/spec@1.4.2`, `@synapsor/dsl@1.4.3`, and
   `@synapsor/runner@1.4.122`.
 
-## 1.4.121 (prepared, not published)
+## 1.4.121 (2026-07-15)
 
 ### Contract trust surface and bounded-set parser correctness
 
@@ -78,10 +113,10 @@
 - Proves additive Spec/DSL/Runner/C++ aggregate and enum parity, shared Postgres
   recommendation durability, and transient PostgreSQL/MySQL timeout
   classification.
-- Stages `@synapsor/spec@1.4.1`, `@synapsor/dsl@1.4.2`, and
-  `@synapsor/runner@1.4.121`. Nothing is published by this change.
+- Published `@synapsor/spec@1.4.1`, `@synapsor/dsl@1.4.2`, and
+  `@synapsor/runner@1.4.121`.
 
-## 1.4.12 (prepared, not published)
+## 1.4.12 (2026-07-14)
 
 ### Runtime-store smoke-call consistency
 
@@ -97,10 +132,10 @@
 - Adds focused no-fallback coverage and a disposable two-process fleet proof
   covering ownership, approval/apply, one source receipt, replay, and safe
   ledger unavailability.
-- Stages only `@synapsor/runner@1.4.12`; `@synapsor/dsl` remains `1.4.1` and
-  `@synapsor/spec` remains `1.4.0`. Nothing is published by this change.
+- Published only `@synapsor/runner@1.4.12`; `@synapsor/dsl` remains `1.4.1`
+  and `@synapsor/spec` remains `1.4.0`.
 
-## 1.4.1 (prepared, not published)
+## 1.4.1 (2026-07-14)
 
 ### Canonical Bounded-Set Digest Verification
 
@@ -127,11 +162,11 @@
   structural authorization, explains where SQL authority lives, and documents
   the approval, receipt, replay, and compensation layer without claiming
   prompt-injection prevention or compliance certification.
-- Stages `@synapsor/runner@1.4.1` and `@synapsor/dsl@1.4.1`;
+- Published `@synapsor/runner@1.4.1` and `@synapsor/dsl@1.4.1`;
   `@synapsor/spec` remains `1.4.0` because the public contract schema did not
-  change. Nothing is published by this change.
+  change.
 
-## 1.4.0 (prepared, not published)
+## 1.4.0 (2026-07-14)
 
 ### Reviewed Reversible Change Sets
 
@@ -155,8 +190,8 @@
   conformance fixtures, owner-authorized resources, local UI/doctor/preview
   state, bounded metrics, crash-reconciliation tests, and the disposable
   `corepack pnpm test:reversible` gate.
-- Stages `@synapsor/spec@1.4.0`, `@synapsor/dsl@1.4.0`, and
-  `@synapsor/runner@1.4.0`. No npm package is published by this change.
+- Published `@synapsor/spec@1.4.0`, `@synapsor/dsl@1.4.0`, and
+  `@synapsor/runner@1.4.0`.
 
 ## 1.3.0 (prepared, not published)
 
@@ -233,7 +268,8 @@
   metadata so a leaked handle does not become bearer authority.
 - Adds shared-store and Streamable HTTP regressions proving owner access still
   works while cross-session resource reads fail closed.
-- Stages only `@synapsor/runner@1.1.1`; canonical Spec and DSL remain `1.1.0`.
+- Published only `@synapsor/runner@1.1.1`; canonical Spec and DSL remain
+  `1.1.0`.
 
 ## 1.1.0
 
@@ -257,8 +293,8 @@
 - Adds verified dead-letter list/show/requeue/discard, shared-ledger
   backup/digest/restore, archive-before-retention, and a repeatable two-Runner
   kill/recovery test over synthetic Postgres/MySQL.
-- Stages `@synapsor/spec@1.1.0`, `@synapsor/dsl@1.1.0`, and
-  `@synapsor/runner@1.1.0`. Nothing is published by this change.
+- Published `@synapsor/spec@1.1.0`, `@synapsor/dsl@1.1.0`, and
+  `@synapsor/runner@1.1.0`.
 
 ## 1.0.0
 
@@ -280,7 +316,7 @@
   and Streamable HTTP mTLS.
 - Declares the first semver contract for the documented CLI, schema, contract,
   MCP result, writeback, approval, metrics, and replay surfaces.
-- Stages `@synapsor/spec@1.0.0`, `@synapsor/dsl@1.0.0`, and
+- Published `@synapsor/spec@1.0.0`, `@synapsor/dsl@1.0.0`, and
   `@synapsor/runner@1.0.0`.
 
 ## 0.1.16

package/README.md

@@ -4,21 +4,37 @@
 [![license: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![ci](https://github.com/Synapsor/Synapsor-Runner/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Synapsor/Synapsor-Runner/actions/workflows/ci.yml?query=branch%3Amain)
 
-Stop giving AI agents `execute_sql`. Give them reviewed business actions.
+**Approve the exact business effect, not an opaque tool call.**
 
-Synapsor Runner is an open-source, local-first MCP runtime for Postgres and
-MySQL. It exposes semantic tools such as `billing.inspect_invoice` and
-`billing.propose_late_fee_waiver`, saves risky changes as proposals, and keeps
-database credentials, approval, and writeback outside the model-facing tool
-surface.
+Synapsor Runner is an open-source MCP runtime for Postgres and MySQL. It
+gives agents reviewed business actions instead of `execute_sql`, saves risky
+changes as proposals, and keeps database credentials, approval, and writeback
+outside the model-facing surface.
 
 ## Prove It In 60 Seconds
 
-Path: **audit** MCP risk, **demo** the boundary, then **connect** staging. The
-first two commands touch only a local fixture.
+First, prove the boundary without a database, Docker, config, MCP client, LLM,
+or account:
 
-First, inspect the risk in a typical raw-SQL database MCP server. This works
-even if you never adopt Runner:
+```bash
+npx -y @synapsor/runner try --prove
+```
+
+The embedded source requests a $55 waiver and shows:
+
+```text
+Proposed effect: late_fee_cents: 5500 -> 0
+Source changed before approval: No
+Guarded commit: 1 row, receipt recorded
+Restart-safe retry: yes; duplicate mutations: 0
+Stale apply refused: yes
+```
+
+Review happens outside the model-facing tools. The command stores inspectable
+state under `./.synapsor/try/` and does not test your database connection.
+`demo --quick` remains a noninteractive compatibility alias.
+
+Next, audit a typical raw-SQL MCP server:
 
 ```bash
 npx -y @synapsor/runner audit --example dangerous-db-mcp
@@ -35,15 +51,7 @@ model-facing approval/writeback, and missing conflict or idempotency signals.
 It does not call business tools. See [MCP Database Risk
 Review](docs/mcp-audit.md) for supported workflows and limits.
 
-Then see the proposal, approval boundary, evidence, and replay loop. It needs no
-database, Docker, config file, MCP client, or Synapsor account:
-
-```bash
-npx -y @synapsor/runner demo --quick
-```
-
-The quick demo creates a fixture ledger at `./.synapsor/quick-demo.db`. It
-teaches the boundary; it does not claim to test your database connection.
+Then [connect a staging database](#connect-a-staging-database).
 
 ## Safety Model
 
@@ -75,30 +83,29 @@ approval, apply, or revert tools. A human or trusted operator approves outside
 MCP, then Runner performs a guarded write or routes the proposal to an
 app-owned executor.
 
-Contracts constrain tools, trusted context, visible and writable columns,
-bounds, transitions, and approvals. Proposals separate model intent from commit
-authority; evidence, query audit, receipts, and replay preserve the reviewed
-lifecycle. Runner does not make raw SQL tools, hosts, or
-prompt-injection-prone clients safe.
+Contracts fix trusted context, fields, bounds, transitions, and approvals;
+evidence, query audit, receipts, and replay preserve the lifecycle. Runner does
+not make raw SQL or prompt-injection-prone clients safe.
 
-## Why Not Just Use A Prompt And App Code?
+## Choose An Isolation Mode
 
-Prompts are not an authorization boundary. First ask who produces the SQL:
-
-- **The model produces SQL:** validation must understand arbitrary queries,
-  scope, and side effects. That is `execute_sql` behind a parser.
-- **Trusted app code produces fixed, parameterized SQL:** good. You have built
-  a semantic tool, and that may be enough for a small read-only application.
+| Mode | Boundary |
+| --- | --- |
+| Embedded `try` | Synthetic source; proves the lifecycle, not your database. |
+| `application_scope` | Shared role plus Runner predicates. A Runner bug or compromised process can cross scope; retain database controls. |
+| `postgres_rls` | PostgreSQL also checks transaction-bound tenant/principal scope. Arbitrary trusted-context or credential control remains outside this guarantee. |
+| `tenant_bound` | Authenticated context selects a restricted per-tenant credential or process. |
 
-Runner adds one reviewed contract for trusted scope, field controls, evidence,
-approval outside MCP, guarded writeback, receipts, replay, and compensation.
-Use your own code when you do not need that lifecycle. See the [build-vs-adopt
-guide](docs/why-synapsor-vs-app-guardrails.md).
+Stdio commonly trusts process environment; shared HTTP must use verified signed
+claims. Model arguments, query parameters, and arbitrary tenant headers are
+never trusted. MySQL has no native RLS; use restricted views or tenant
+credentials. See [Database scope] and the
+[build-vs-adopt guide](docs/why-synapsor-vs-app-guardrails.md).
 
 ## Connect A Staging Database
 
-Start with a staging or disposable database and a read-only credential. Keep
-database permissions, restricted views, and row-level security in place.
+Start with staging and a read-only credential. Keep database permissions,
+views, and RLS.
 
 ```bash
 npm install -g @synapsor/runner
@@ -106,10 +113,12 @@ export DATABASE_URL="postgresql://runner_reader:REPLACE_ME@db.example.com:5432/a
 synapsor-runner start --from-env DATABASE_URL --schema public
 ```
 
-The guided command inspects metadata, asks you to choose one table or view,
-creates trusted context, generates reviewed capabilities, previews the MCP tool
-surface, and prints the next smoke and serve commands. It stores environment
-variable names, not connection strings.
+The wizard inspects metadata, generates reviewed capabilities, previews MCP
+tools, and prints smoke/serve commands. It stores environment-variable names,
+not connection strings.
+
+[Generate disabled review candidates from Prisma, Drizzle, or
+OpenAPI.](docs/schema-api-candidates.md)
 
 The generated capability is a tenant-scoped read with an explicit column
 allowlist and required evidence. See the [own-database
@@ -165,10 +174,9 @@ compensation.
 
 ## Review And Prove Your Contract
 
-Before serving a contract, use `contract explain` for a reviewer-readable
-boundary, `contract lint --strict` for deterministic surface-fitness CI checks,
-and `contract test` for adopter-owned allow/deny/redaction cases. The built-in language
-server supplies diagnostics, completion, hover, and formatting for
+Before serving, use `contract explain`, `contract lint --strict`, and `contract
+test` for reviewer-readable boundaries and allow/deny/redaction cases. The
+built-in language server supplies diagnostics, completion, hover, and formatting for
 `.synapsor.sql` and legacy `.synapsor` files. See [Contract
 Review](docs/contract-review.md) and [Contract
 Testing](docs/contract-testing.md).
@@ -212,6 +220,8 @@ least-privilege database access, host security, or application authorization.
 See [Security Boundary](docs/security-boundary.md) and
 [Current Limitations](docs/limitations.md).
 
+[Database scope]: docs/database-enforced-scope.md
+
 ## Operate The Approval Loop
 
 Policies combine per-proposal and daily ceilings; exceeding one routes to human
@@ -264,7 +274,7 @@ guide](https://github.com/Synapsor/Synapsor-Runner/blob/main/docs/cloud-cli.md).
 ## Next Steps
 
 - Follow the [step-by-step Synapsor Tutorial](https://github.com/sandeshtiwari/Synapsor-Tutorial).
-- Run the [`support-plan-credit` flagship example](examples/support-plan-credit).
+- Run the [`support-billing-agent` flagship example](examples/support-billing-agent).
 - Connect [Claude, Cursor, OpenAI Agents SDK, or another MCP client](docs/mcp-clients.md).
 - Author and [push a validated contract to Cloud](docs/cloud-push.md).
 - Browse the [task-first documentation index](docs/README.md).

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAkU,KAAK,WAAW,EAA0H,MAAM,6BAA6B,CAAC;AAIvf,OAAO,EAkBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAqG,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAEhY,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAWL,KAAK,yBAAyB,EAG/B,MAAM,8BAA8B,CAAC;AA8UtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgE1D;AA0FD,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2YjB;AA4mHD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/H;AAojBD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,IAAI,CAAC,CAgGf;AA0lCD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAoX,KAAK,WAAW,EAAyJ,MAAM,6BAA6B,CAAC;AAIxkB,OAAO,EAsBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAmI,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAqG,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAEnY,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAaL,KAAK,yBAAyB,EAG/B,MAAM,8BAA8B,CAAC;AA+VtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkE1D;AAwID,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA2YjB;AA6xID,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAc/H;AAojBD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,IAAI,CAAC,CAgGf;AA8lCD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}

package/dist/local-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAE,aAAa,EAA6E,MAAM,iCAAiC,CAAC;AAK3I,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C7F"}
+{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAKjG,OAAO,EAAE,aAAa,EAAgD,MAAM,iCAAiC,CAAC;AAK9G,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgD7F"}