@try-works/dsh-model-as-tool 0.1.3 → 0.3.6

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/archive.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Archive defenses (EXT-11).
+ *
+ * An extension archive is attacker-controlled input. This module validates its
+ * ENTRY LIST before a single byte is extracted, because every defense here is
+ * cheaper and safer to apply to a list than to a filesystem: a traversal entry
+ * rejected here never reaches a path-join, and a symlink never exists to be
+ * followed.
+ *
+ * The rules are deliberately blunt where ambiguity helps an attacker:
+ *
+ * - Symlinks and hardlinks are REFUSED, not resolved. A link is the mechanism by
+ *   which an in-package path reaches out of the package, and no legitimate
+ *   extension needs one to ship code and schemas.
+ * - Duplicate and case-colliding entries are refused rather than last-write-wins.
+ *   On a case-insensitive filesystem `A.js` and `a.js` are the same file, so an
+ *   archive containing both extracts differently depending on the host — a
+ *   discrepancy an attacker can use to make the validated bytes differ from the
+ *   executed ones.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/archive
+ */
+/** What one archive entry is. */
+export type ArchiveEntryKind = 'file' | 'directory' | 'symlink' | 'hardlink';
+/** One entry as reported by an archive reader, before extraction. */
+export interface ArchiveEntry {
+    /** The path exactly as recorded in the archive, using `/` separators. */
+    readonly path: string;
+    /** Uncompressed size in bytes; 0 for directories and links. */
+    readonly size: number;
+    /** The entry type. Readers that cannot tell must report `file`. */
+    readonly kind: ArchiveEntryKind;
+    /** Compressed size when the reader knows it, for expansion-ratio checks. */
+    readonly compressedSize?: number;
+}
+/** Bounds applied to an archive before extraction (EXT-11). */
+export interface ArchiveLimits {
+    /** Maximum number of entries. */
+    readonly maxEntries: number;
+    /** Maximum total uncompressed bytes. */
+    readonly maxTotalBytes: number;
+    /** Maximum uncompressed bytes for a single entry. */
+    readonly maxEntryBytes: number;
+    /**
+     * Maximum ratio of uncompressed to compressed across the archive.
+     *
+     * A compression bomb is small on the wire and enormous on disk, so the byte
+     * cap alone does not catch it before allocation.
+     */
+    readonly maxExpansionRatio: number;
+}
+/** Conservative defaults: generous for real extensions, hostile to bombs. */
+export declare const DEFAULT_ARCHIVE_LIMITS: ArchiveLimits;
+/**
+ * Validate an archive's entry list before extraction (EXT-11).
+ *
+ * @param entries - the entries as reported by the reader.
+ * @param limits - the bounds to apply.
+ * @returns the normalized entry paths, in archive order.
+ * @throws ManagementError when any entry, or the archive as a whole, is inadmissible.
+ */
+export declare function validateArchiveEntries(entries: readonly ArchiveEntry[], limits?: ArchiveLimits): string[];
+/**
+ * Locate the package root inside an archive.
+ *
+ * An archive may wrap everything in a single directory, which is normal for
+ * source archives. Anything else — zero roots, or files at the root alongside
+ * several directories — has no unambiguous package root and is refused.
+ * @param paths - the normalized entry paths.
+ * @returns the package root prefix, or '' when the package is at the archive root.
+ * @throws ManagementError when the root is ambiguous or the package.json is missing.
+ */
+export declare function findPackageRoot(paths: readonly string[]): string;
+/**
+ * Verify an archive against its declared integrity (EXT-08, EXT-12).
+ *
+ * Integrity is not trust: a matching digest says the bytes are the ones the
+ * operator approved, not that they are safe. It is still checked first, because a
+ * mismatch means nothing downstream is worth doing.
+ * @param bytes - the fetched archive bytes.
+ * @param expectedSha512 - the declared digest, lowercase hex or base64.
+ * @returns the computed digest, lowercase hex.
+ * @throws ManagementError with `INTEGRITY_MISMATCH`.
+ */
+export declare function verifyIntegrity(bytes: Uint8Array, expectedSha512: string): string;
+//# sourceMappingURL=archive.d.ts.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../src/install/archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,iCAAiC;AACjC,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAA;AAE5E,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACnC;AAED,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,EAAE,aAKpC,CAAA;AAiDD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,MAAM,GAAE,aAAsC,GAC7C,MAAM,EAAE,CA4FV;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAoBhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAkBjF"}

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/archive.js

@@ -0,0 +1,185 @@
+/**
+ * Archive defenses (EXT-11).
+ *
+ * An extension archive is attacker-controlled input. This module validates its
+ * ENTRY LIST before a single byte is extracted, because every defense here is
+ * cheaper and safer to apply to a list than to a filesystem: a traversal entry
+ * rejected here never reaches a path-join, and a symlink never exists to be
+ * followed.
+ *
+ * The rules are deliberately blunt where ambiguity helps an attacker:
+ *
+ * - Symlinks and hardlinks are REFUSED, not resolved. A link is the mechanism by
+ *   which an in-package path reaches out of the package, and no legitimate
+ *   extension needs one to ship code and schemas.
+ * - Duplicate and case-colliding entries are refused rather than last-write-wins.
+ *   On a case-insensitive filesystem `A.js` and `a.js` are the same file, so an
+ *   archive containing both extracts differently depending on the host — a
+ *   discrepancy an attacker can use to make the validated bytes differ from the
+ *   executed ones.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/archive
+ */
+import { createHash } from 'node:crypto';
+import { ManagementError } from "./../errors.js";
+/** Conservative defaults: generous for real extensions, hostile to bombs. */
+export const DEFAULT_ARCHIVE_LIMITS = {
+    maxEntries: 4096,
+    maxTotalBytes: 512 * 1024 * 1024,
+    maxEntryBytes: 128 * 1024 * 1024,
+    maxExpansionRatio: 200,
+};
+/** Windows device names, which resolve to hardware rather than to a file. */
+const WINDOWS_RESERVED = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\..*)?$/i;
+/** A path segment that would escape its parent. */
+function isTraversalSegment(segment) {
+    return segment === '..';
+}
+/**
+ * Normalize an archive entry path for comparison and containment, or reject it.
+ *
+ * @param entryPath - the path as recorded.
+ * @returns the normalized segments.
+ * @throws ManagementError when the path is inadmissible.
+ */
+function normalizeEntryPath(entryPath) {
+    const fail = (why) => {
+        throw new ManagementError('INVALID_EXTENSION', 'install', `the archive entry ${JSON.stringify(entryPath)} is refused: ${why}`, 'Repack the extension so every entry is a package-relative path with no links.');
+    };
+    if (entryPath.length === 0)
+        fail('the path is empty');
+    if (entryPath.includes('\0'))
+        fail('the path contains a NUL byte');
+    // Checked before the absolute-path case: a UNC path also begins with a
+    // separator, and reporting it as merely "absolute" would understate what it is.
+    if (entryPath.startsWith('//'))
+        fail('the path is a UNC path');
+    // A backslash is a separator on Windows and a filename character elsewhere, so
+    // the same archive would extract to different trees. Refuse rather than guess.
+    if (entryPath.includes('\\'))
+        fail('the path contains a backslash, which extracts differently per platform');
+    if (entryPath.startsWith('/'))
+        fail('the path is absolute');
+    if (/^[A-Za-z]:/.test(entryPath))
+        fail('the path carries a drive letter');
+    const segments = entryPath.split('/').filter(segment => segment.length > 0 && segment !== '.');
+    for (const segment of segments) {
+        if (isTraversalSegment(segment))
+            fail('the path traverses out of the package');
+        if (WINDOWS_RESERVED.test(segment))
+            fail(`the segment ${JSON.stringify(segment)} is a reserved Windows device name`);
+        // A trailing dot or space is silently stripped by Windows, so `evil.` and
+        // `evil` collide there while remaining distinct elsewhere.
+        if (/[ .]$/.test(segment))
+            fail(`the segment ${JSON.stringify(segment)} ends in a dot or space`);
+    }
+    if (segments.length === 0)
+        fail('the path names nothing');
+    return segments;
+}
+/**
+ * Validate an archive's entry list before extraction (EXT-11).
+ *
+ * @param entries - the entries as reported by the reader.
+ * @param limits - the bounds to apply.
+ * @returns the normalized entry paths, in archive order.
+ * @throws ManagementError when any entry, or the archive as a whole, is inadmissible.
+ */
+export function validateArchiveEntries(entries, limits = DEFAULT_ARCHIVE_LIMITS) {
+    if (entries.length > limits.maxEntries) {
+        throw new ManagementError('INVALID_EXTENSION', 'install', `the archive holds ${entries.length} entries, over the ${limits.maxEntries} limit`, 'Reduce the number of files, or raise the operator limit deliberately.');
+    }
+    const normalized = [];
+    // Two collision keys: exact, and case/separator-folded for Windows.
+    const exact = new Set();
+    const folded = new Map();
+    let totalBytes = 0;
+    let totalCompressed = 0;
+    for (const entry of entries) {
+        const segments = normalizeEntryPath(entry.path);
+        if (entry.kind === 'symlink' || entry.kind === 'hardlink') {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the archive entry ${JSON.stringify(entry.path)} is a ${entry.kind}; links are refused`, 'Ship real files. An extension does not need links to deliver code, schemas or assets.');
+        }
+        if (!Number.isFinite(entry.size) || entry.size < 0) {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the archive entry ${JSON.stringify(entry.path)} declares an invalid size`, 'Repack the archive.');
+        }
+        if (entry.size > limits.maxEntryBytes) {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the archive entry ${JSON.stringify(entry.path)} is ${entry.size} bytes, over the per-entry limit`, 'Split the asset, or raise the operator limit deliberately.');
+        }
+        const key = segments.join('/');
+        if (exact.has(key)) {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the archive declares ${JSON.stringify(key)} more than once`, 'Repack the archive with unique entries; last-write-wins is not admitted.');
+        }
+        exact.add(key);
+        const caseKey = key.toLowerCase();
+        const prior = folded.get(caseKey);
+        if (prior !== undefined && prior !== key) {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the archive entries ${JSON.stringify(prior)} and ${JSON.stringify(key)} collide on a case-insensitive filesystem`, 'Rename one of them; the archive would otherwise extract differently per host.');
+        }
+        folded.set(caseKey, key);
+        normalized.push(key);
+        totalBytes += entry.size;
+        totalCompressed += entry.compressedSize ?? 0;
+    }
+    if (totalBytes > limits.maxTotalBytes) {
+        throw new ManagementError('INVALID_EXTENSION', 'install', `the archive expands to ${totalBytes} bytes, over the ${limits.maxTotalBytes} limit`, 'Reduce the package contents, or raise the operator limit deliberately.');
+    }
+    // Only meaningful when the reader reports compressed sizes; without them the
+    // byte caps above still apply, so this cannot be used to bypass them.
+    if (totalCompressed > 0 && totalBytes / totalCompressed > limits.maxExpansionRatio) {
+        throw new ManagementError('INVALID_EXTENSION', 'install', `the archive expands ${(totalBytes / totalCompressed).toFixed(1)}x, over the ${limits.maxExpansionRatio}x ratio limit`, 'Repack without extreme compression; a high ratio is the signature of an expansion bomb.');
+    }
+    return normalized;
+}
+/**
+ * Locate the package root inside an archive.
+ *
+ * An archive may wrap everything in a single directory, which is normal for
+ * source archives. Anything else — zero roots, or files at the root alongside
+ * several directories — has no unambiguous package root and is refused.
+ * @param paths - the normalized entry paths.
+ * @returns the package root prefix, or '' when the package is at the archive root.
+ * @throws ManagementError when the root is ambiguous or the package.json is missing.
+ */
+export function findPackageRoot(paths) {
+    const topLevel = new Set();
+    for (const path of paths) {
+        const [first] = path.split('/');
+        if (first !== undefined)
+            topLevel.add(first);
+    }
+    const hasRootPackageJson = paths.includes('package.json');
+    if (hasRootPackageJson)
+        return '';
+    const roots = [...topLevel].filter(candidate => paths.includes(`${candidate}/package.json`));
+    if (roots.length === 1)
+        return roots[0];
+    throw new ManagementError('INVALID_EXTENSION', 'install', roots.length === 0
+        ? 'the archive contains no package.json at its root or in a single top-level directory'
+        : `the archive contains ${roots.length} candidate package roots, which is ambiguous`, 'Pack the extension so package.json sits at the archive root or inside exactly one top-level directory.');
+}
+/**
+ * Verify an archive against its declared integrity (EXT-08, EXT-12).
+ *
+ * Integrity is not trust: a matching digest says the bytes are the ones the
+ * operator approved, not that they are safe. It is still checked first, because a
+ * mismatch means nothing downstream is worth doing.
+ * @param bytes - the fetched archive bytes.
+ * @param expectedSha512 - the declared digest, lowercase hex or base64.
+ * @returns the computed digest, lowercase hex.
+ * @throws ManagementError with `INTEGRITY_MISMATCH`.
+ */
+export function verifyIntegrity(bytes, expectedSha512) {
+    const digest = createHash('sha512').update(bytes).digest('hex');
+    const expected = expectedSha512.trim().toLowerCase().replace(/^sha512-/, '');
+    // Accept base64 as well as hex, because registry metadata uses base64 while a
+    // manifest is easier to read in hex; compare on the decoded form.
+    const expectedHex = /^[0-9a-f]+$/.test(expected)
+        ? expected
+        : Buffer.from(expected, 'base64').toString('hex');
+    if (digest !== expectedHex) {
+        throw new ManagementError('INTEGRITY_MISMATCH', 'install', 'the fetched archive does not match its declared SHA-512', 'Do not retry blindly: re-fetch from the declared source and confirm the expected digest with the publisher.');
+    }
+    return digest;
+}
+//# sourceMappingURL=archive.js.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/dependencies.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Installer-owned dependency graphs (EXT-09).
+ *
+ * An extension's runtime dependencies are resolved through the operator's
+ * registry EXACTLY ONCE (ranges lock to exact versions), fetched, verified
+ * against their registry-recorded SHA-512, and materialized into the
+ * extension's OWN immutable installation directory — never the host's
+ * node_modules, never the user's workspace. Lifecycle scripts are refused,
+ * never silently skipped or run: a dependency whose package declares
+ * `prepare`/`preinstall`/`install`/`postinstall` refuses the install with a
+ * named error. The resolved graph (name, exact version, integrity, requested
+ * spec) is recorded in the install record (EXT-12).
+ *
+ * The registry half is INJECTED, like the archive source: the SDK owns the
+ * graph discipline, the host supplies the configured registry and the tarball
+ * transport. An extension's runtime can only import what this installer
+ * materialized — undeclared resolution attempts fail at module load, because
+ * the runtime SDK link is the only bridge into the host tree.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/dependencies
+ */
+import type { ArchiveSource, InstallSource } from './staged.ts';
+/** One locked runtime dependency (EXT-12's dependency-lock record). */
+export interface LockedDependency {
+    /** The package name, e.g. `@acme/lib`. */
+    readonly name: string;
+    /** The EXACT version the range resolved to. */
+    readonly version: string;
+    /**
+     * Registry arm: the registry-recorded SHA-512 that was verified.
+     * Preinstalled arm: the SHA-256 content digest of the EXACT bytes the
+     * installer copied into the extension's own tree (never a digest the
+     * resolver supplied, so the record covers what was actually materialized).
+     */
+    readonly integrity: string;
+    /** The requested spec, recorded verbatim for the audit trail. */
+    readonly resolvedFrom: string;
+    /**
+     * How the content arrived. ABSENT means the registry arm — existing locks
+     * and install records stay valid without this field.
+     *
+     * `'preinstalled'` IS the "scripts were not run by the installer" statement:
+     * the content arrived already materialized by a completed host install, so
+     * this installer ran NO lifecycle script on it — the package.json's scripts
+     * field is left untouched, never stripped and never executed (EXT-10's
+     * never-silently-skip rule is honored by provenance, not by editing bytes).
+     */
+    readonly provenance?: 'registry' | 'preinstalled';
+    /**
+     * Present exactly when `provenance` is `'preinstalled'`: the operator-supplied
+     * source directory the content was copied from, as the resolver returned it.
+     */
+    readonly preinstalledFrom?: string;
+}
+/** One dependency the resolver supplies: registry bytes or preinstalled content. */
+export type DependencyContent = {
+    readonly name: string;
+    readonly version: string;
+    readonly tarball: InstallSource;
+    readonly integrity: string;
+    readonly provenance?: 'registry';
+} | {
+    readonly name: string;
+    readonly version: string;
+    readonly dir: string;
+    readonly provenance: 'preinstalled';
+};
+/** The injected registry half: resolve a name/range to an exact dependency. */
+export interface DependencyResolver {
+    /**
+     * Resolve a name and version spec ONCE to an exact version. The registry arm
+     * returns the tarball source and the registry-recorded integrity; the
+     * preinstalled arm returns an operator-approved materialized directory — the
+     * installer copies it and computes its own digest from the copied bytes.
+     * @param name - the package name.
+     * @param range - the declared spec (an exact version or a range).
+     */
+    resolve(name: string, range: string): Promise<DependencyContent>;
+}
+/** Bounds and providers for one dependency installation. */
+export interface InstallDependencyGraph {
+    readonly resolver: DependencyResolver;
+    readonly archive: ArchiveSource;
+    readonly maxDepth?: number;
+    readonly maxPackages?: number;
+    /**
+     * The OPT-IN operator gate for preinstalled content. ABSENT (the default)
+     * means any preinstalled-armed resolve result REFUSES by name — a normal
+     * install of script-declaring registry bytes still refuses under EXT-10.
+     */
+    readonly allowPreinstalled?: boolean;
+    /**
+     * The operator-configured root every preinstalled directory must live
+     * under. REQUIRED when `allowPreinstalled` is true; the installer refuses a
+     * directory outside it (path-escape refusal) rather than copying.
+     */
+    readonly preinstalledRoot?: string;
+    /** One preinstalled copy's size bound in bytes. Default 512 MiB. */
+    readonly maxPreinstalledBytes?: number;
+    /** One preinstalled copy's file-count bound. Default 10 000. */
+    readonly maxPreinstalledFiles?: number;
+}
+/** Refuse a dependency whose package declares install-time lifecycle scripts. */
+export declare function refuseInstallScripts(packageDir: string, name: string, version: string): void;
+/**
+ * Resolve, fetch, verify and materialize one extension's dependency graph.
+ *
+ * Bounded BFS: ranges resolve exactly once, registry tarballs verify against
+ * their registry integrity, scripts are refused on the registry arm, and the
+ * graph is flattened into the extension's own `node_modules` (a private root —
+ * no hoisting into any other tree). Version conflicts within one graph are
+ * REFUSED rather than silently duplicated; the count and depth caps refuse
+ * runaway graphs by name.
+ *
+ * The PREINSTALLED arm is operator-gated: only when `allowPreinstalled` is set
+ * does a resolver-supplied directory get copied (bounded, path-escape-checked
+ * against `preinstalledRoot`, reparse-point-refused) into the extension's own
+ * tree, with the record's provenance stating that the installer ran no
+ * lifecycle script on it.
+ *
+ * @param packageDir - the extracted extension package directory.
+ * @param graph - the injected resolver/archive plus the bounds and the gate.
+ * @returns the locked dependency records, in materialization order.
+ */
+export declare function installDependencyGraph(packageDir: string, graph: InstallDependencyGraph): Promise<readonly LockedDependency[]>;
+//# sourceMappingURL=dependencies.d.ts.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/install/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE/D,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,cAAc,CAAA;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GACzB;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;CACpC,CAAA;AAEH,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACjE;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,gEAAgE;IAChE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CACvC;AAkDD,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAyB5F;AAgFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CA0KtC"}