@try-works/dsh-model-as-tool 0.1.2 → 0.3.6

package/lib/invocation-accounting.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Invocation accounting: timings, outcome class and sizes (OBS-01, OBS-05).
+ *
+ * The receipt already carries identity — contract, implementation, extension version,
+ * content digest, activation generation, caller scope. OBS-01 asks for four things it did
+ * not have:
+ *
+ *   - **queue / load / inference / total time**, separated, because a slow call has three
+ *     very different causes and a single duration cannot tell them apart;
+ *   - **a cancellation/failure CLASS**, so an operations reader can group failures rather
+ *     than reading prose;
+ *   - **sizes**, measured rather than estimated;
+ *   - and all of it **without credentials or bodies**, which is why the sizes are NUMBERS
+ *     and there is deliberately nowhere to put a payload.
+ *
+ * The last point is the design constraint rather than a disclaimer: this module has no
+ * field that can hold request or response content, so a future change cannot start logging
+ * bodies by accident. A `Record<string, unknown>` "details" bag would have undone that in
+ * one commit.
+ *
+ * OBS-05 is the other half: what is recorded is MEASURED, with the runtime that measured
+ * it, so a vendor's published figure can never be mistaken for this machine's.
+ *
+ * @module @try-works/dsh-model-as-tool/invocation-accounting
+ */
+/**
+ * Why an invocation ended.
+ *
+ * Deliberately coarse and closed: a reader groups by these, and an open string would make
+ * every dashboard a list of one-off messages.
+ */
+export type FailureClass = 
+/** The call completed. */
+'none'
+/** The caller cancelled, or an imported signal aborted. */
+ | 'cancelled'
+/** Policy or the contract refused before work began. */
+ | 'refused'
+/** A deadline expired. */
+ | 'timeout'
+/** An extension or provider failed. */
+ | 'failed'
+/** Authorization denied. */
+ | 'policy-denied';
+/** Where the time went, in milliseconds. */
+export interface InvocationTimings {
+    /**
+     * Time waiting for admission — a queue, a pool, or a load already in flight.
+     *
+     * Separated from load time because "the model is already loading for someone else" and
+     * "the model is slow to load" are different problems with different fixes.
+     */
+    readonly queuedMs: number;
+    /** Time spent preparing or loading, when the invocation had to. */
+    readonly loadMs: number;
+    /** Time the implementation spent on the work itself. */
+    readonly inferenceMs: number;
+    /**
+     * Wall time from admission attempt to result.
+     *
+     * NOT asserted equal to the sum: phases can overlap, and forcing equality would make the
+     * record wrong whenever they do.
+     */
+    readonly totalMs: number;
+}
+/** Byte sizes, measured rather than estimated. */
+export interface InvocationSizes {
+    /** Serialized request size in bytes. */
+    readonly inputBytes: number;
+    /** Serialized result size in bytes. */
+    readonly outputBytes: number;
+    /** Bytes read from assets during this invocation, when any were. */
+    readonly assetBytes: number;
+}
+/** The runtime that produced the measurements (OBS-05). */
+export interface MeasurementContext {
+    /** Platform, e.g. `win32`. */
+    readonly platform: string;
+    /** Architecture, e.g. `x64`. */
+    readonly architecture: string;
+    /** Node version. */
+    readonly nodeVersion: string;
+    /** The engine or runtime version actually used. */
+    readonly engineVersion: string;
+}
+/** One invocation's accounting record. */
+export interface InvocationAccounting {
+    /** Correlation id, matching the receipt. */
+    readonly receiptId: string;
+    readonly timings: InvocationTimings;
+    readonly sizes: InvocationSizes;
+    readonly failureClass: FailureClass;
+    /** A short class-level reason, never a payload. */
+    readonly reason: string | null;
+    /**
+     * How the timings were obtained.
+     *
+     * `measured` for this process's own clock; the alternative exists so an imported figure
+     * can never be presented as one taken here.
+     */
+    readonly timingSource: 'measured' | 'reported-by-implementation';
+    /** The runtime the measurement belongs to. */
+    readonly measuredOn: MeasurementContext;
+    /**
+     * The CALLER'S grant identity, present only for external MCP calls (SEC-04).
+     *
+     * Identity, never payload: the operator can tell WHICH client called, while the
+     * record still has no field that can hold request or response content.
+     */
+    readonly grantId?: string;
+    /** The authenticated client identity, present with {@link grantId}. */
+    readonly clientId?: string;
+}
+/**
+ * A phase timer.
+ *
+ * Records the phases as they HAPPEN rather than inferring them afterwards, because a
+ * duration measured by subtraction cannot distinguish a slow load from a slow queue.
+ */
+export declare class PhaseTimer {
+    #private;
+    constructor(now?: () => number);
+    /** Begin a phase, closing any phase already open. */
+    begin(name: 'queued' | 'load' | 'inference'): void;
+    /** Close the open phase, if any. Idempotent. */
+    end(): void;
+    /** The timings recorded so far. */
+    finish(): InvocationTimings;
+}
+/** Classify an outcome from what was observed (OBS-01). */
+export declare function classifyOutcome(input: {
+    readonly ok: boolean;
+    readonly aborted?: boolean;
+    readonly timedOut?: boolean;
+    readonly denied?: boolean;
+    readonly refused?: boolean;
+}): FailureClass;
+/**
+ * The runtime this process is measuring on (OBS-05).
+ *
+ * Read from the process rather than configured, so a record cannot claim a platform it was
+ * not produced on. That is the specific defect OBS-05 names: Apple Neural Engine figures
+ * presented as Windows performance.
+ * @param engineVersion - the engine actually used for this invocation.
+ * @returns the measurement context.
+ */
+export declare function measurementContext(engineVersion: string): MeasurementContext;
+/**
+ * Build an accounting record (OBS-01).
+ *
+ * Sizes are computed from the SERIALIZED forms because that is what crossed the boundary;
+ * an object's in-memory size is not what a caller paid for.
+ * @param request - what to record.
+ * @returns the accounting record.
+ */
+export declare function accountInvocation(request: {
+    readonly receiptId: string;
+    readonly timings: InvocationTimings;
+    readonly failureClass: FailureClass;
+    readonly reason?: string;
+    readonly input: unknown;
+    readonly output?: unknown;
+    readonly assetBytes?: number;
+    readonly engineVersion: string;
+    /** The external caller's grant identity, when the call was external (SEC-04). */
+    readonly grantId?: string;
+    readonly clientId?: string;
+}): InvocationAccounting;
+//# sourceMappingURL=invocation-accounting.d.ts.map

package/lib/invocation-accounting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocation-accounting.d.ts","sourceRoot":"","sources":["../src/invocation-accounting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY;AACtB,0BAA0B;AACxB,MAAM;AACR,2DAA2D;GACzD,WAAW;AACb,wDAAwD;GACtD,SAAS;AACX,0BAA0B;GACxB,SAAS;AACX,uCAAuC;GACrC,QAAQ;AACV,4BAA4B;GAC1B,eAAe,CAAA;AAEnB,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gCAAgC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,oBAAoB;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,UAAU,GAAG,4BAA4B,CAAA;IAChE,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;GAKG;AACH,qBAAa,UAAU;;gBAKT,GAAG,GAAE,MAAM,MAAiB;IAOxC,qDAAqD;IACrD,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,IAAI;IAKlD,gDAAgD;IAChD,GAAG,IAAI,IAAI;IAQX,mCAAmC;IACnC,MAAM,IAAI,iBAAiB;CAS5B;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B,GAAG,YAAY,CAcf;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,kBAAkB,CAO5E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,oBAAoB,CAmBvB"}

package/lib/invocation-accounting.js

@@ -0,0 +1,148 @@
+/**
+ * Invocation accounting: timings, outcome class and sizes (OBS-01, OBS-05).
+ *
+ * The receipt already carries identity — contract, implementation, extension version,
+ * content digest, activation generation, caller scope. OBS-01 asks for four things it did
+ * not have:
+ *
+ *   - **queue / load / inference / total time**, separated, because a slow call has three
+ *     very different causes and a single duration cannot tell them apart;
+ *   - **a cancellation/failure CLASS**, so an operations reader can group failures rather
+ *     than reading prose;
+ *   - **sizes**, measured rather than estimated;
+ *   - and all of it **without credentials or bodies**, which is why the sizes are NUMBERS
+ *     and there is deliberately nowhere to put a payload.
+ *
+ * The last point is the design constraint rather than a disclaimer: this module has no
+ * field that can hold request or response content, so a future change cannot start logging
+ * bodies by accident. A `Record<string, unknown>` "details" bag would have undone that in
+ * one commit.
+ *
+ * OBS-05 is the other half: what is recorded is MEASURED, with the runtime that measured
+ * it, so a vendor's published figure can never be mistaken for this machine's.
+ *
+ * @module @try-works/dsh-model-as-tool/invocation-accounting
+ */
+/**
+ * A phase timer.
+ *
+ * Records the phases as they HAPPEN rather than inferring them afterwards, because a
+ * duration measured by subtraction cannot distinguish a slow load from a slow queue.
+ */
+export class PhaseTimer {
+    #start;
+    #phases = new Map();
+    #current = null;
+    constructor(now = Date.now) {
+        this.#now = now;
+        this.#start = now();
+    }
+    #now;
+    /** Begin a phase, closing any phase already open. */
+    begin(name) {
+        this.end();
+        this.#current = { name, startedAt: this.#now() };
+    }
+    /** Close the open phase, if any. Idempotent. */
+    end() {
+        if (this.#current === null)
+            return;
+        const elapsed = this.#now() - this.#current.startedAt;
+        // Phases ACCUMULATE: a call may load, infer, and resume the same phase after a retry.
+        this.#phases.set(this.#current.name, (this.#phases.get(this.#current.name) ?? 0) + elapsed);
+        this.#current = null;
+    }
+    /** The timings recorded so far. */
+    finish() {
+        this.end();
+        return {
+            queuedMs: this.#phases.get('queued') ?? 0,
+            loadMs: this.#phases.get('load') ?? 0,
+            inferenceMs: this.#phases.get('inference') ?? 0,
+            totalMs: this.#now() - this.#start,
+        };
+    }
+}
+/** Classify an outcome from what was observed (OBS-01). */
+export function classifyOutcome(input) {
+    /**
+     * ORDER MATTERS, and it is the caller's intent that wins.
+     *
+     * A deadline that fires will usually also surface as an abort, so checking `aborted`
+     * first would report every timeout as a cancellation and hide the deadline. Likewise a
+     * denial is a policy decision rather than a failure of the work.
+     */
+    if (input.ok)
+        return 'none';
+    if (input.denied === true)
+        return 'policy-denied';
+    if (input.refused === true)
+        return 'refused';
+    if (input.timedOut === true)
+        return 'timeout';
+    if (input.aborted === true)
+        return 'cancelled';
+    return 'failed';
+}
+/**
+ * The runtime this process is measuring on (OBS-05).
+ *
+ * Read from the process rather than configured, so a record cannot claim a platform it was
+ * not produced on. That is the specific defect OBS-05 names: Apple Neural Engine figures
+ * presented as Windows performance.
+ * @param engineVersion - the engine actually used for this invocation.
+ * @returns the measurement context.
+ */
+export function measurementContext(engineVersion) {
+    return {
+        platform: process.platform,
+        architecture: process.arch,
+        nodeVersion: process.version,
+        engineVersion,
+    };
+}
+/**
+ * Build an accounting record (OBS-01).
+ *
+ * Sizes are computed from the SERIALIZED forms because that is what crossed the boundary;
+ * an object's in-memory size is not what a caller paid for.
+ * @param request - what to record.
+ * @returns the accounting record.
+ */
+export function accountInvocation(request) {
+    return {
+        receiptId: request.receiptId,
+        timings: request.timings,
+        sizes: {
+            inputBytes: byteLengthOf(request.input),
+            // An absent output is ZERO bytes rather than unknown: nothing crossed the boundary,
+            // and reporting `null` would invite a reader to treat it as unmeasured.
+            outputBytes: request.output === undefined ? 0 : byteLengthOf(request.output),
+            assetBytes: request.assetBytes ?? 0,
+        },
+        failureClass: request.failureClass,
+        reason: request.reason ?? null,
+        timingSource: 'measured',
+        measuredOn: measurementContext(request.engineVersion),
+        ...request.grantId === undefined
+            ? {}
+            : { grantId: request.grantId, ...request.clientId === undefined ? {} : { clientId: request.clientId } },
+    };
+}
+/** Serialized byte length, with a defined answer for values that cannot serialize. */
+function byteLengthOf(value) {
+    try {
+        const serialized = JSON.stringify(value);
+        // `undefined` and functions serialize to `undefined`, which is zero bytes on the wire.
+        return serialized === undefined ? 0 : Buffer.byteLength(serialized, 'utf8');
+    }
+    catch {
+        /**
+         * A cyclic or otherwise unserializable value did cross the boundary, but its size is
+         * unknown — and reporting `0` would understate it. Recorded as `-1`, which no real
+         * payload can produce, so a reader sees "unmeasured" rather than "empty".
+         */
+        return -1;
+    }
+}
+//# sourceMappingURL=invocation-accounting.js.map

package/lib/legacy-migration.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The startup hook that migrates a legacy model-id era `state.json` into the
+ * versioned world (BASE-09, BASE-10), ONCE per profile — as a REAL
+ * transaction with crash recovery, not a read-then-overwrite.
+ *
+ * Before this module the migration table existed only as an SDK library with
+ * tests: nothing in the host's production startup ever ran it, so a real
+ * upgrade kept reading the old-world document forever. This module is the
+ * production caller. Its guarantees:
+ *
+ * - ONCE-ANCHOR + COMMIT: a non-secret sidecar marker
+ *   (`<stateFile>.migrated.json`) is the commit record, written ATOMICALLY
+ *   (temp + fsync + rename) as the LAST step of the transaction. The host's
+ *   own state document keeps its exact shape — the store's writes are
+ *   untouched and no parallel format is written. A marker is VALIDATED on
+ *   every read (parse + exact version + list shape): a corrupt or
+ *   foreign-version marker FAILS CLOSED instead of silently counting the
+ *   profile as migrated;
+ * - IMMUTABLE JOURNAL: before ANY mutation, the original legacy document is
+ *   journaled to `<stateFile>.legacy-backup.json` with EXCLUSIVE creation
+ *   (`wx`). The journal is the legacy INPUT for every recovery. Its
+ *   first-write-wins behavior is guaranteed BY THE TRANSACTION LOCK (the
+ *   exists-check before the rename is advisory, not a lock);
+ * - RECOVERY: a crash between the host write and the marker leaves a journal
+ *   WITHOUT a committed marker. The next boot detects that state and re-runs
+ *   the transaction FROM THE VALIDATED JOURNAL — never from the already-
+ *   rewritten state file, which has lost the staged enables, provider picks
+ *   and prepared-asset facts. The host write MERGES with the current
+ *   document (current enables are operator-era facts and are preserved;
+ *   legacy disables are added), so an operator change after the crash is
+ *   never discarded. A corrupt journal with no marker FAILS CLOSED;
+ * - TRANSACTION LOCK: the whole transaction runs under an exclusive lock
+ *   file with an ownership token and pid. A stale lock is NEVER taken over
+ *   automatically — the read-then-remove sequence is not atomic and two
+ *   concurrent reapers could delete a successor's fresh lock — so a held lock
+ *   FAILS CLOSED at the deadline and the operator removes it deliberately;
+ *   release removes only a token-owned lock (the same discipline as the
+ *   credential store);
+ * - the SDK profile half runs THROUGH the SDK's own
+ *   `migrateLegacyProfileState` (its lock, idempotence, version gate) BEFORE
+ *   the host document is written;
+ * - DISABLED legacy choices are preserved — ALL of them, mapped or not: an
+ *   unmapped disabled id that vanished from the host state would let a later
+ *   package restore silently enable what the operator turned off. Unresolved
+ *   ids are REPORTED separately, never enabled;
+ * - legacy ENABLES are STAGED, never granted (BASE-10: a legacy enable is
+ *   not consent to install, activate or prepare third-party code);
+ * - every persisted artifact (marker, journal, lock) is NON-SECRET by
+ *   construction: model ids, provider identifiers and counts, never a secret.
+ *
+ * @module @try-works/dsh-model-as-tool/legacy-migration
+ */
+import { type PersistedState, type StateStore } from './state.ts';
+/** The marker version this host writes; equality, never a lower bound. */
+export declare const MIGRATION_MARKER_VERSION: 1;
+/** What the startup hook did. */
+export interface LegacyStartupOutcome {
+    /** False when there was nothing to migrate (marker present, or fresh profile). */
+    readonly ran: boolean;
+    /** The host choices to adopt after the run (the caller replaces its persisted copy). */
+    readonly hostState: PersistedState;
+    /** Legacy model ids that were ENABLED and are therefore STAGED, never granted. */
+    readonly staged: readonly string[];
+    /** Legacy ids the table could not map; reported, never enabled. */
+    readonly unresolved: readonly string[];
+    /** A non-secret one-line summary for the startup log, when anything happened. */
+    readonly logLine: string | undefined;
+    /** True when this run RECOVERED an interrupted transaction from the journal. */
+    readonly recovered: boolean;
+}
+/** The marker path for one state file. */
+export declare function migrationMarkerPath(stateFile: string): string;
+/** The backup path for one state file. */
+export declare function legacyBackupPath(stateFile: string): string;
+/** The transaction lock path for one state file. */
+export declare function migrationLockPath(stateFile: string): string;
+/**
+ * Run the one-time legacy startup migration (with crash recovery).
+ *
+ * @param options.stateFile - the host's configured isolated state path.
+ * @param options.store - the host's state store over that path.
+ * @param options.extensionStoreDir - when the deployment mounts an extension
+ *   store, the SDK profile migration runs there too.
+ * @param options.log - a non-secret log sink (the host's logger).
+ * @returns the outcome; the caller ALWAYS adopts `hostState` (the hook returns
+ * a fresh post-lock read on every path, so adopting it never re-applies a
+ * pre-hook snapshot).
+ */
+export declare function runLegacyStartupMigration(options: {
+    readonly stateFile: string;
+    readonly store: StateStore;
+    readonly extensionStoreDir?: string;
+    readonly log?: (line: string) => void;
+}): Promise<LegacyStartupOutcome>;
+//# sourceMappingURL=legacy-migration.d.ts.map

package/lib/legacy-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-migration.d.ts","sourceRoot":"","sources":["../src/legacy-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAqBH,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAGjE,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AA2BD,0CAA0C;AAC1C,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AA+ND;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC"}