@try-works/dsh-model-as-tool 0.1.3 → 0.4.0

package/lib/title-proposal.js

@@ -0,0 +1,244 @@
+/**
+ * Title and description proposal (TOOL-06), with the language-evidence rule from
+ * TOOL-03.
+ *
+ * TOOL-06 is mostly a list of things a title generator must NOT do, and the sharpest of
+ * them is this: **a refusal or an incomplete generation must not become a valid empty
+ * title.** That failure is easy to ship and hard to notice, because the shape of the
+ * response is correct — `{ title: "" }` looks like a result — and a caller writing it
+ * into a document produces an empty heading rather than an error.
+ *
+ * The other rules here are enforced rather than described:
+ *
+ * - **No invented facts.** A number in a proposed title that does not appear in the
+ *   source is a claim the source does not support. This is checkable, so it is checked.
+ * - **No changed source meaning.** Enforced through the same provenance check plus a
+ *   refusal to accept a title with no overlap with the source.
+ * - **No calling another tool.** Structural: the response shape carries no tool-call
+ *   field, so there is nothing to dispatch.
+ * - **Maximum lengths in the schema**, which the contract states and this enforces.
+ *
+ * @module @try-works/dsh-model-as-tool/title-proposal
+ */
+/**
+ * The evaluated defaults for a section title (TOOL-06).
+ *
+ * Stated in the contract rather than chosen per call, because "define maximum
+ * title/description lengths in the schema and evaluated recipe" means a caller cannot
+ * widen them by asking.
+ */
+export const SECTION_TITLE_LIMITS = {
+    // A heading is scanned, not read; beyond this it wraps and stops being a heading.
+    maxTitleChars: 80,
+    maxDescriptionChars: 240,
+    maxRepairs: 1,
+};
+/**
+ * The contract limits for one configuration's CODE-11 repair ceiling.
+ *
+ * The title/description lengths stay contract-stated; the repair ceiling is
+ * the operator's configured number (an integer 0..8, default 1). An invalid
+ * ceiling is a REFUSAL, never a silent clamp — the recorded lineage must show
+ * the budget the operator actually approved.
+ * @param repairCeiling - the configured ceiling; absent means the default 1.
+ * @returns the limits the repair decision and lineage honor.
+ */
+export function titleLimitsFor(repairCeiling) {
+    const ceiling = repairCeiling ?? SECTION_TITLE_LIMITS.maxRepairs;
+    if (!Number.isInteger(ceiling) || ceiling < 0 || ceiling > 8) {
+        throw new Error(`the repair ceiling must be an integer between 0 and 8 (CODE-11); received ${JSON.stringify(ceiling)}`);
+    }
+    return {
+        maxTitleChars: SECTION_TITLE_LIMITS.maxTitleChars,
+        maxDescriptionChars: SECTION_TITLE_LIMITS.maxDescriptionChars,
+        maxRepairs: ceiling,
+    };
+}
+/** Every number appearing in a string, as written. */
+function numbersIn(text) {
+    return text.match(/\d+(?:[.,]\d+)*/g) ?? [];
+}
+/** Content words, lowercased, for the overlap check. */
+function contentWords(text) {
+    const stop = new Set([
+        'a', 'an', 'the', 'and', 'or', 'of', 'to', 'in', 'on', 'for', 'with', 'your', 'you',
+        'this', 'that', 'is', 'are', 'be', 'it', 'at', 'by', 'as', 'how', 'what', 'why',
+    ]);
+    return new Set(text.toLowerCase().match(/[a-z][a-z'-]{2,}/g)?.filter(word => !stop.has(word)) ?? []);
+}
+/**
+ * Accept or refuse a title proposal (TOOL-06).
+ *
+ * @param response - the model's raw response.
+ * @param source - the text the title was proposed for, used for provenance.
+ * @param limits - the lengths the contract states.
+ * @returns the outcome, which is an error rather than an empty title whenever the
+ *   response was not a usable one.
+ */
+export function acceptTitle(response, source, limits = SECTION_TITLE_LIMITS) {
+    // A REFUSAL IS AN ERROR. This is the rule the requirement states most sharply, and it
+    // is checked first so a refusal can never fall through to the empty-title path.
+    if (response.refused === true) {
+        return {
+            kind: 'refused',
+            reason: response.refusalReason ?? 'the model declined to propose a title',
+        };
+    }
+    if (response.incomplete === true) {
+        return { kind: 'incomplete', reason: 'the generation was cut short, so no title was completed' };
+    }
+    const title = response.title;
+    if (typeof title !== 'string') {
+        return { kind: 'invalid', reason: 'the response carried no title field' };
+    }
+    // AN EMPTY TITLE IS NOT A VALID EMPTY TITLE. A caller writing one into a document
+    // produces a blank heading rather than an error, which is why this is refused.
+    if (title.trim().length === 0) {
+        return {
+            kind: 'rejected',
+            reason: 'the title is empty; an empty title is an error, not a valid empty result',
+        };
+    }
+    if (title.length > limits.maxTitleChars) {
+        return {
+            kind: 'rejected',
+            reason: `the title is ${title.length} characters, over the ${limits.maxTitleChars} the contract states`,
+        };
+    }
+    const description = response.description ?? '';
+    if (description.length > limits.maxDescriptionChars) {
+        return {
+            kind: 'rejected',
+            reason: `the description is ${description.length} characters, over the ${limits.maxDescriptionChars} the contract states`,
+        };
+    }
+    /**
+     * NO INVENTED FACTS: a number in the title must appear in the source.
+     *
+     * "10 Ways to Improve Performance" over a source that never says ten is a claim the
+     * source does not support, and it is exactly the kind of plausible embellishment a
+     * summariser adds. This is checkable, so it is checked rather than requested.
+     */
+    const sourceNumbers = new Set(numbersIn(source));
+    for (const number of numbersIn(title)) {
+        if (!sourceNumbers.has(number)) {
+            return {
+                kind: 'rejected',
+                reason: `the title states "${number}", which does not appear in the source`,
+            };
+        }
+    }
+    for (const number of numbersIn(description)) {
+        if (!sourceNumbers.has(number)) {
+            return {
+                kind: 'rejected',
+                reason: `the description states "${number}", which does not appear in the source`,
+            };
+        }
+    }
+    /**
+     * NO CHANGED SOURCE MEANING, approximated as a real overlap requirement.
+     *
+     * A title sharing no content word with its source is not a title FOR that source; it
+     * is a different claim wearing the shape of one.
+     */
+    const sourceWords = contentWords(source);
+    const titleWords = contentWords(title);
+    if (sourceWords.size > 0 && titleWords.size > 0) {
+        const overlap = [...titleWords].some(word => sourceWords.has(word));
+        if (!overlap) {
+            return {
+                kind: 'rejected',
+                reason: 'the title shares no content word with the source, so it is not a title for it',
+            };
+        }
+    }
+    return { kind: 'proposed', title: title.trim(), description: description.trim(), repairs: 0 };
+}
+/**
+ * Whether a repair attempt may run (TOOL-06).
+ *
+ * The requirement says to COUNT repair attempts when they are enabled, so the count is
+ * returned rather than kept internally — an uncounted retry is how a budget silently
+ * becomes unbounded.
+ * @param limits - the contract's limits.
+ * @param repairsSoFar - repairs already consumed.
+ * @param previous - what the previous attempt produced.
+ * @returns whether to repair, and how many repairs would then be consumed.
+ */
+export function mayRepairTitle(limits, repairsSoFar, previous) {
+    if (previous.kind === 'proposed') {
+        return { repair: false, repairs: repairsSoFar };
+    }
+    if (repairsSoFar >= limits.maxRepairs) {
+        // Reported as an exhausted budget rather than as a failure to produce a title, so
+        // the caller can tell the two apart.
+        return {
+            repair: false,
+            repairs: repairsSoFar,
+            reason: `the repair budget of ${limits.maxRepairs} is exhausted; the last outcome was ${previous.kind}`,
+        };
+    }
+    return { repair: true, repairs: repairsSoFar + 1 };
+}
+/**
+ * Record one repair decision into the lineage (CODE-11, pure and testable).
+ * @param lineage - the lineage so far (mutated in place, then returned).
+ * @param decision - the `mayRepairTitle` decision for this attempt.
+ * @param previousKind - the previous outcome kind.
+ * @param budgetBefore - the budget the decision was made against.
+ * @returns the updated lineage.
+ */
+export function recordRepairLineage(lineage, decision, previousKind, budgetBefore) {
+    const outcome = decision.repair
+        ? 'repaired'
+        : decision.repairs >= budgetBefore && previousKind !== 'proposed'
+            ? 'exhausted'
+            : 'not-needed';
+    lineage.push({
+        repairIndex: lineage.length + 1,
+        budgetBefore,
+        // The budget AFTER the decision is the budget before minus the one
+        // attempt a repair consumed — the lineage's own contract ("one lower
+        // when a repair ran"), never the consumed count relabelled.
+        budgetAfter: budgetBefore - (decision.repair ? 1 : 0),
+        previousKind,
+        outcome,
+    });
+    return lineage;
+}
+/**
+ * Whether a tool may call another tool to fulfil this contract (TOOL-06).
+ *
+ * It may not: "do not call another tool". Returns false so the prohibition is asserted,
+ * and the response shape carries no tool-call field for one to be dispatched from.
+ * @returns always false.
+ */
+export function mayCallAnotherTool() {
+    return false;
+}
+/**
+ * Whether a language result may be cited as evidence for a medium (TOOL-03).
+ *
+ * A text detector's result is evidence about the TEXT it processed and nothing else.
+ * The requirement forbids using it as evidence of the language SPOKEN in audio it has
+ * not processed, and the refusal is per-medium rather than per-result because the result
+ * itself is sound — only its use as audio evidence is not.
+ * @param examined - what the result examined.
+ * @param claimed - the medium being claimed.
+ * @returns whether the claim is supported.
+ */
+export function supportsLanguageClaim(examined, claimed) {
+    return examined === claimed;
+}
+/**
+ * Describe what a language result is evidence for (TOOL-03).
+ * @param examined - what the result examined.
+ * @returns a description that does not overstate the result.
+ */
+export function describeLanguageEvidence(examined) {
+    return examined === 'text'
+        ? 'the language of the supplied text; this is not evidence of the language spoken in audio'
+        : 'the language of the supplied audio';
+}
+//# sourceMappingURL=title-proposal.js.map

package/lib/tool-mode-run.d.ts

@@ -0,0 +1,235 @@
+/**
+ * The ONE authorized program-execution pipeline (CODE-02, CODE-03, CODE-08, ARCH-05).
+ *
+ * THE DEFECT THIS FIXES, found by adversarial review rather than by a test:
+ * `ptc-authority.ts` and `ptc-runtime.ts` had **zero callers outside tests**. Everything in
+ * them was correct and thoroughly covered — `buildToolBindings`, the guarded mount,
+ * `mayExposeToClients()` — and none of it ran in production. `tool_mode_run` did not exist,
+ * the mount guard never executed, and the exposure gate guarded nothing because there was
+ * no caller to refuse.
+ *
+ * A security control with no callers is not a control; it is a symbol. This module is the
+ * caller.
+ *
+ * The wiring enforces three things the directive requires and nothing else did:
+ *
+ * 1. **ONE pipeline.** Native PTC and any external `tool_mode_run` reach tools through the
+ *    SAME `buildToolBindings` call, so authorization cannot differ between the two doors.
+ * 2. **The grant is the grant.** The requested names are intersected with the host's own
+ *    `allowedTools` and the live registry, and the whole request is refused if anything is
+ *    unattainable.
+ * 3. **The exposure gate has a caller.** `mayExposeToClients()` returning false now
+ *    actually refuses something, with the reason attached.
+ *
+ * @module @try-works/dsh-model-as-tool/tool-mode-run
+ */
+import { PTC_SERVICE, type PtcHostContext } from './ptc-runtime.ts';
+import type { ToolBinding } from './ptc-authority.ts';
+/** The runtime surface this module needs, narrowed so it is testable. */
+export interface ProgramRuntime {
+    resolve(request: Record<string, unknown>): unknown;
+    run(spec: unknown): Promise<{
+        readonly value?: unknown;
+        readonly logs?: readonly string[];
+        readonly error?: {
+            readonly kind?: string;
+            readonly message?: string;
+        };
+    }>;
+}
+/** How to reach the tools a program may call. */
+export interface RunnerEnvironment {
+    /** The host's context, for the guarded mount. */
+    readonly context: PtcHostContext;
+    /**
+     * The backend plugin, or undefined when it could not be resolved. May be a
+     * thunk: the host resolves the backend LAZILY so a deployment without the
+     * package still loads the plugin, and `prepare()` materializes it at most once.
+     */
+    readonly backend: unknown | (() => Promise<unknown>);
+    /**
+     * The grant a program's sub-calls authorize against, READ PER RUN.
+     *
+     * A FUNCTION rather than a value because of SEC-04's composition rule: an
+     * external client's `tool_mode_run` call must compose under the CLIENT's grant,
+     * not the host's — otherwise a client granted only `tool_mode_run` could reach
+     * every host-granted tool through a program. The host wires this to an
+     * {@link ExternalGrantContext}, which returns the caller's grant when the run
+     * happens inside an external call and the host's own grant otherwise.
+     */
+    readonly grant: () => readonly string[];
+    /** The tool names currently registered, read at RUN time so late registrations are visible. */
+    readonly visible: () => readonly string[];
+    /** Resolves one authorized name to its implementation. */
+    readonly resolve: (name: string) => ToolBinding | undefined;
+    /** The runtime, once mounted. */
+    readonly runtime: () => ProgramRuntime | undefined;
+    /** Whether the OPERATOR granted hosted code execution (CODE-10), read at check time. */
+    readonly operatorGranted: () => boolean;
+}
+/**
+ * The per-call external grant carrier (SEC-04, composition).
+ *
+ * `AsyncLocalStorage` rather than a module global: the context travels with the
+ * async chain of ONE call, so two concurrent external clients cannot see each
+ * other's grants, and the native/interactive path (no context) reads the host's
+ * own grant — unchanged behavior.
+ */
+export interface ExternalGrantContext {
+    /** Run work with an external client's grant in force. */
+    run<T>(grant: readonly string[], work: () => Promise<T>): Promise<T>;
+    /** The grant in force, or undefined on the host/interactive path. */
+    current(): readonly string[] | undefined;
+}
+/** Create the per-call external grant carrier. */
+export declare function createExternalGrantContext(): ExternalGrantContext;
+/** A request to run a program. */
+export interface ProgramRequest {
+    /** The program source. */
+    readonly program: string;
+    /** The tool names the program declares it will call. */
+    readonly requested: readonly string[];
+    /** Cancellation, propagated to the runtime. */
+    readonly signal?: AbortSignal;
+    /** A requested budget, CLAMPED rather than honoured. */
+    readonly timeoutMs?: number | null;
+    readonly cwd?: string;
+}
+/** The outcome of a run. */
+export type ProgramOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+    readonly logs: readonly string[];
+    readonly toolCalls: number;
+} | {
+    readonly ok: false;
+    readonly code: 'unavailable' | 'unauthorized' | 'cancelled' | 'failed';
+    readonly message: string;
+};
+/** The runner the host uses. */
+export interface ProgramRunner {
+    /** Mount the backend at most once, through the guard. */
+    prepare(): Promise<{
+        readonly mounted: boolean;
+        readonly reason?: string;
+    }>;
+    /** Run one program through the authorized pipeline. */
+    run(request: ProgramRequest): Promise<ProgramOutcome>;
+    /** Whether an EXTERNAL caller may be served generated-code execution (CODE-08). */
+    externalExposurePermitted(): boolean;
+    /** Why not, when it is not. */
+    externalExposureReason(): string;
+}
+/**
+ * Create the runner.
+ *
+ * @param environment - how to reach tools and the runtime.
+ * @returns the runner.
+ */
+export declare function createProgramRunner(environment: RunnerEnvironment): ProgramRunner;
+/**
+ * The refusal an EXTERNAL caller receives (CODE-08).
+ *
+ * A separate function so the gate has a single enforcement point rather than a condition
+ * repeated at each call site — the shape that let the original gate go unused.
+ * @param runner - the runner.
+ * @returns the refusal, or undefined when exposure is permitted.
+ */
+export declare function externalRefusal(runner: ProgramRunner): {
+    readonly message: string;
+} | undefined;
+/** The service key the runner depends on, re-exported so a caller need not import both. */
+export { PTC_SERVICE };
+/** What the CODE-02 tool returns for one run. */
+export interface RunReport {
+    readonly result: unknown;
+    readonly logs: readonly string[];
+    readonly meta: {
+        readonly receiptId: string;
+        readonly elapsedMs: number;
+        readonly toolCalls: number;
+        readonly catalogRevision: string;
+        readonly warnings: readonly string[];
+    };
+}
+/**
+ * The `tool_mode_run` MCP contract, in the ToolContract shape (CODE-02).
+ *
+ * ONE definition serves the MCP export surface and the conformance test, so the
+ * two cannot drift the way an inline object at the export site would: the test
+ * validates this shape's MCP projection against the pinned schema before it ever
+ * ships on a live tools/list.
+ */
+export declare const TOOL_MODE_RUN_CONTRACT: {
+    readonly contract: "hosted.tool_mode_run";
+    readonly version: "1.0.0";
+    readonly toolName: "tool_mode_run";
+    readonly description: "Run a program that calls Tool Mode tools (CODE-02).";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["description", "code", "tools"];
+        readonly properties: {
+            readonly description: {
+                readonly type: "string";
+            };
+            readonly code: {
+                readonly type: "string";
+            };
+            readonly input: {};
+            readonly tools: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+            };
+            readonly timeout_ms: {
+                readonly type: "integer";
+            };
+        };
+    };
+    readonly outputSchema: {
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly properties: {
+            readonly result: {};
+            readonly logs: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+            };
+            readonly meta: {
+                readonly type: "object";
+            };
+        };
+    };
+    readonly semantics: {
+        readonly deterministic: false;
+        readonly readsInputs: true;
+    };
+    readonly limits: {};
+    readonly unsupported: readonly ["no access to management or installer bindings"];
+};
+/**
+ * Serve one CODE-02 request through the authorized pipeline (CODE-02/04).
+ *
+ * This is the `tool_mode_run` served path: the caller's arguments are validated
+ * into the CODE-02 shape, the program runs through the SAME runner native PTC
+ * uses, and the report carries the receipt, elapsed time, call count, catalog
+ * revision and warnings the interface promises.
+ *
+ * `input` is refused when the pinned runtime cannot bind it structurally: CODE-04
+ * forbids string interpolation into source, and the current PTC runtime has no
+ * data-global path, so an input-bearing program gets a precise refusal naming
+ * that limitation rather than a silently interpolated program.
+ * @param args - the caller's arguments.
+ * @param runner - the prepared runner.
+ * @param report - the report-shaped facts the host owns (receipt id, revision).
+ * @returns the report.
+ */
+export declare function serveProgram(args: Record<string, unknown>, runner: ProgramRunner, report: {
+    readonly receiptId: string;
+    readonly catalogRevision: string;
+}): Promise<RunReport>;
+//# sourceMappingURL=tool-mode-run.d.ts.map

package/lib/tool-mode-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-mode-run.d.ts","sourceRoot":"","sources":["../src/tool-mode-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAML,WAAW,EACX,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGrD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAA;IAClD,GAAG,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACjC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACvE,CAAC,CAAA;CACH;AAED,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACpD;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,SAAS,MAAM,EAAE,CAAA;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,CAAA;IACzC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAA;IAC3D,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,cAAc,GAAG,SAAS,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAA;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpE,qEAAqE;IACrE,OAAO,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CACzC;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,IAAI,oBAAoB,CAUjE;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,4BAA4B;AAC5B,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5G;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,WAAW,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5H,gCAAgC;AAChC,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,OAAO,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,uDAAuD;IACvD,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACrD,mFAAmF;IACnF,yBAAyB,IAAI,OAAO,CAAA;IACpC,+BAA+B;IAC/B,sBAAsB,IAAI,MAAM,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,GAAG,aAAa,CAuHjF;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAG/F;AAED,2FAA2F;AAC3F,OAAO,EAAE,WAAW,EAAE,CAAA;AAEtB,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;QAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,CAAA;CACF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzB,CAAA;AAEV;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACvE,OAAO,CAAC,SAAS,CAAC,CAsDpB"}