@try-works/dsh-model-as-tool 0.1.3 → 0.4.0

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/tar-gzip-source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A real, npm-tarball-backed {@link ArchiveSource} (gzip + POSIX tar).
+ *
+ * npm publishes `.tgz` files; the ZIP reader cannot serve them. This reader
+ * applies the SAME defense discipline as the ZIP path, plus the inflate-time
+ * bound that a zip bomb's metadata makes unnecessary there:
+ *
+ * - gzip inflation is STREAMED under a byte cap (the cap fires BEFORE the
+ *   inflated payload is allocated), then the expansion ratio is checked;
+ * - tar headers are parsed per block (regular/directory/symlink/hardlink, GNU
+ *   longname 'L'/'K', pax 'x'/'g' path records); symlinks and hardlinks are
+ *   reported as links so the entry-list validator REFUSES them — never resolved;
+ * - the entry list then flows through the shared `validateArchiveEntries`
+ *   defenses (traversal, absolute paths, Windows device names, duplicates,
+ *   case collisions, count/byte/ratio caps) exactly like the ZIP reader;
+ * - npm roots everything under `package/`: that one leading segment is
+ *   stripped, the bare `package` directory entry is ignored, and a MIXED
+ *   layout (entries both under and outside `package/`) is refused as
+ *   ambiguous rather than guessed at;
+ * - truncation and malformed headers refuse with named codes.
+ *
+ * Like the ZIP reader, it carries no fetcher of its own: a caller supplies
+ * the tarball bytes (a host wraps its registry transport), and a test
+ * supplies bytes directly.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/tar-gzip-source
+ */
+import type { ArchiveSource, InstallSource } from './staged.ts';
+/** Bounds for the inflate side of a tarball. */
+export interface TarGzipLimits {
+    /** Maximum inflated bytes, enforced DURING inflation before allocation. */
+    readonly maxInflatedBytes: number;
+    /** Maximum inflated-to-compressed ratio, checked before the payload is kept. */
+    readonly maxExpansionRatio: number;
+}
+/**
+ * Build an {@link ArchiveSource} over npm `.tgz` (gzip+tar) bytes.
+ *
+ * @param fetchBytes - the tarball transport; absent, `fetch` refuses (the SDK
+ *   carries no network stack — a host supplies its registry fetch).
+ * @param limits - inflate-time bounds, mirroring the shared archive defaults.
+ */
+export declare function createTarGzipArchiveSource(fetchBytes?: (source: InstallSource) => Promise<Uint8Array>, limits?: TarGzipLimits): ArchiveSource;
+//# sourceMappingURL=tar-gzip-source.d.ts.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/tar-gzip-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-gzip-source.d.ts","sourceRoot":"","sources":["../../src/install/tar-gzip-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAc/D,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CACnC;AA2LD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,UAAU,CAAC,EAC3D,MAAM,GAAE,aAAuC,GAC9C,aAAa,CAkCf"}

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/tar-gzip-source.js

@@ -0,0 +1,243 @@
+/**
+ * A real, npm-tarball-backed {@link ArchiveSource} (gzip + POSIX tar).
+ *
+ * npm publishes `.tgz` files; the ZIP reader cannot serve them. This reader
+ * applies the SAME defense discipline as the ZIP path, plus the inflate-time
+ * bound that a zip bomb's metadata makes unnecessary there:
+ *
+ * - gzip inflation is STREAMED under a byte cap (the cap fires BEFORE the
+ *   inflated payload is allocated), then the expansion ratio is checked;
+ * - tar headers are parsed per block (regular/directory/symlink/hardlink, GNU
+ *   longname 'L'/'K', pax 'x'/'g' path records); symlinks and hardlinks are
+ *   reported as links so the entry-list validator REFUSES them — never resolved;
+ * - the entry list then flows through the shared `validateArchiveEntries`
+ *   defenses (traversal, absolute paths, Windows device names, duplicates,
+ *   case collisions, count/byte/ratio caps) exactly like the ZIP reader;
+ * - npm roots everything under `package/`: that one leading segment is
+ *   stripped, the bare `package` directory entry is ignored, and a MIXED
+ *   layout (entries both under and outside `package/`) is refused as
+ *   ambiguous rather than guessed at;
+ * - truncation and malformed headers refuse with named codes.
+ *
+ * Like the ZIP reader, it carries no fetcher of its own: a caller supplies
+ * the tarball bytes (a host wraps its registry transport), and a test
+ * supplies bytes directly.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/tar-gzip-source
+ */
+import { gunzipSync } from 'node:zlib';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+import { ManagementError } from "./../errors.js";
+import { DEFAULT_ARCHIVE_LIMITS } from "./archive.js";
+/** The npm tarball wrapper directory. */
+const NPM_ROOT = 'package';
+/** The inflate bounds, mirrored from the shared archive defaults. */
+const DEFAULT_TAR_GZIP_LIMITS = {
+    maxInflatedBytes: DEFAULT_ARCHIVE_LIMITS.maxTotalBytes,
+    maxExpansionRatio: DEFAULT_ARCHIVE_LIMITS.maxExpansionRatio,
+};
+/** Refuse a malformed or hostile tarball with one named, distinct message. */
+function refuse(why) {
+    throw new ManagementError('INVALID_EXTENSION', 'install', `the npm tarball is refused: ${why}`, 'Repack the package so its tarball is a plain gzip+tar with package-relative regular files only.');
+}
+/**
+ * Inflate a gzip payload under a byte cap enforced DURING inflation.
+ *
+ * `gunzipSync`'s `maxOutputLength` makes zlib refuse the moment the inflated
+ * stream would pass the bound — inside the C++ inflate loop, BEFORE the full
+ * payload is ever allocated — which is the bomb defense a post-hoc check
+ * cannot provide. The expansion ratio is then checked against the compressed
+ * size before the payload is kept.
+ */
+function gunzipBounded(bytes, limits) {
+    let payload;
+    try {
+        payload = gunzipSync(bytes, { maxOutputLength: limits.maxInflatedBytes });
+    }
+    catch (error) {
+        if (error instanceof Error && error.code === 'ERR_BUFFER_TOO_LARGE') {
+            throw new ManagementError('INVALID_EXTENSION', 'install', `the npm tarball inflates past the ${limits.maxInflatedBytes}-byte bound (the cap fired BEFORE the payload was allocated)`, 'A tarball this large is not a package; it is a bomb or a mistake.');
+        }
+        refuse(`the gzip stream is malformed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (payload.byteLength / Math.max(1, bytes.byteLength) > limits.maxExpansionRatio) {
+        refuse(`the tarball expands ${(payload.byteLength / bytes.byteLength).toFixed(1)}x, over the ${limits.maxExpansionRatio}x ratio limit`);
+    }
+    return payload;
+}
+/** Parse an octal field (size/mode), refusing malformed values. */
+function parseOctal(buffer, offset, length, what) {
+    const raw = buffer.subarray(offset, offset + length).toString('utf8').replace(/\0.*$/, '').trim();
+    if (raw.length === 0)
+        return 0;
+    if (!/^[0-7]+$/.test(raw))
+        refuse(`the ${what} field is not octal: ${JSON.stringify(raw)}`);
+    const value = parseInt(raw, 8);
+    if (!Number.isFinite(value) || value < 0)
+        refuse(`the ${what} field is invalid`);
+    return value;
+}
+/** Read a NUL- or length-terminated string field. */
+function parseString(buffer, offset, length) {
+    const end = buffer.indexOf(0, offset);
+    const last = end === -1 || end > offset + length ? offset + length : end;
+    return buffer.subarray(offset, last).toString('utf8');
+}
+/** Parse one 512-byte tar header block. */
+function parseHeader(block) {
+    const name = parseString(block, 0, 100);
+    const prefix = parseString(block, 345, 155);
+    const size = parseOctal(block, 124, 12, 'size');
+    const typeflag = parseString(block, 156, 1);
+    const linkname = parseString(block, 157, 100);
+    return { name, prefix, size, typeflag, linkname };
+}
+/** Parse every tar entry's header, walking the data blocks (bounded payload). */
+function parseTar(payload) {
+    const entries = [];
+    let offset = 0;
+    let pendingLongName;
+    const paxPathOverrides = [];
+    let globalPaxPath;
+    while (offset + 512 <= payload.byteLength) {
+        const block = payload.subarray(offset, offset + 512);
+        if (block.every(byte => byte === 0))
+            break;
+        const header = parseHeader(block);
+        const dataOffset = offset + 512;
+        const padded = Math.ceil(header.size / 512) * 512;
+        if (dataOffset + padded > payload.byteLength)
+            refuse(`the header for ${JSON.stringify(header.name)} claims ${header.size} bytes that the tarball does not contain (truncated)`);
+        offset = dataOffset + padded;
+        if (offset > payload.byteLength)
+            refuse('the tarball ends inside an entry (truncated)');
+        const flag = header.typeflag === '' ? '0' : header.typeflag;
+        if (flag === 'L') {
+            pendingLongName = payload.subarray(dataOffset, dataOffset + header.size).toString('utf8').replace(/\0.*$/, '');
+            continue;
+        }
+        if (flag === 'K') {
+            // GNU longlink: the link target is replaced by the record's data.
+            const target = payload.subarray(dataOffset, dataOffset + header.size).toString('utf8').replace(/\0.*$/, '');
+            const last = entries[entries.length - 1];
+            if (last !== undefined)
+                entries[entries.length - 1] = { ...last, linkname: target };
+            continue;
+        }
+        if (flag === 'x' || flag === 'g') {
+            const record = payload.subarray(dataOffset, dataOffset + header.size).toString('utf8');
+            for (const line of record.split('\n')) {
+                const match = line.match(/^\d+ path=(.*)$/);
+                if (match !== null) {
+                    if (flag === 'g')
+                        globalPaxPath = match[1];
+                    else
+                        paxPathOverrides.push(match[1]);
+                }
+            }
+            continue;
+        }
+        if (flag === '0') {
+            const name = pendingLongName ?? header.name;
+            const paxPath = flag === '0' ? paxPathOverrides.shift() ?? globalPaxPath : undefined;
+            pendingLongName = undefined;
+            entries.push({
+                path: paxPath ?? `${header.prefix.length > 0 ? `${header.prefix}/` : ''}${name}`,
+                size: header.size,
+                kind: 'file',
+                linkname: header.linkname,
+                dataOffset,
+            });
+            continue;
+        }
+        if (flag === '5') {
+            const name = pendingLongName ?? header.name;
+            pendingLongName = undefined;
+            entries.push({ path: `${header.prefix.length > 0 ? `${header.prefix}/` : ''}${name}`, size: 0, kind: 'directory', linkname: '', dataOffset });
+            continue;
+        }
+        if (flag === '2') {
+            entries.push({ path: `${header.prefix.length > 0 ? `${header.prefix}/` : ''}${header.name}`, size: 0, kind: 'symlink', linkname: header.linkname, dataOffset });
+            continue;
+        }
+        if (flag === '1') {
+            entries.push({ path: `${header.prefix.length > 0 ? `${header.prefix}/` : ''}${header.name}`, size: 0, kind: 'hardlink', linkname: header.linkname, dataOffset });
+            continue;
+        }
+        refuse(`the typeflag ${JSON.stringify(flag)} is not supported (only regular files, directories and refused links are admitted)`);
+    }
+    return entries;
+}
+/**
+ * Strip the npm `package/` wrapper: allowed only when EVERY entry sits under
+ * it (or is the wrapper directory itself); a mixed layout is refused.
+ * @returns the stripped entries, or the entries unchanged when no wrapper exists.
+ */
+function stripNpmRoot(entries) {
+    const tops = new Set();
+    for (const entry of entries) {
+        const segments = entry.path.split('/').filter(segment => segment.length > 0);
+        const first = segments[0];
+        if (first !== undefined)
+            tops.add(first);
+    }
+    if (!tops.has(NPM_ROOT))
+        return entries;
+    if (tops.size > 1) {
+        refuse(`the tarball mixes entries under ${JSON.stringify(NPM_ROOT + '/')} with entries outside it (${[...tops].map(entry => JSON.stringify(entry)).join(', ')}) — the layout is ambiguous`);
+    }
+    return entries
+        .map(entry => ({ ...entry, path: entry.path.slice(NPM_ROOT.length + 1) }))
+        .filter(entry => entry.path.length > 0);
+}
+/** Read one file entry's payload from the parsed tar (bounded by the entry size). */
+function readFileData(payload, entry) {
+    return payload.subarray(entry.dataOffset, entry.dataOffset + entry.size);
+}
+/**
+ * Build an {@link ArchiveSource} over npm `.tgz` (gzip+tar) bytes.
+ *
+ * @param fetchBytes - the tarball transport; absent, `fetch` refuses (the SDK
+ *   carries no network stack — a host supplies its registry fetch).
+ * @param limits - inflate-time bounds, mirroring the shared archive defaults.
+ */
+export function createTarGzipArchiveSource(fetchBytes, limits = DEFAULT_TAR_GZIP_LIMITS) {
+    return {
+        async fetch(source) {
+            if (fetchBytes === undefined) {
+                throw new Error(`no fetcher configured for source ${source.requested}`);
+            }
+            return fetchBytes(source);
+        },
+        list(bytes) {
+            const payload = gunzipBounded(bytes, limits);
+            const entries = stripNpmRoot(parseTar(payload));
+            return entries.map((entry) => ({
+                path: entry.path,
+                size: entry.size,
+                kind: entry.kind,
+            }));
+        },
+        extract(bytes, destination, root) {
+            const payload = gunzipBounded(bytes, limits);
+            const entries = stripNpmRoot(parseTar(payload));
+            const prefix = root.length > 0 ? `${root}/` : '';
+            const target = resolve(destination);
+            for (const entry of entries) {
+                if (entry.kind !== 'file')
+                    continue;
+                const name = entry.path.startsWith(prefix) ? entry.path.slice(prefix.length) : entry.path;
+                if (name.length === 0)
+                    continue;
+                // Confinement re-asserted at the write, exactly like the ZIP extractor.
+                const out = resolve(join(target, name));
+                if (out !== target && !out.startsWith(target + sep))
+                    continue;
+                mkdirSync(dirname(out), { recursive: true });
+                writeFileSync(out, readFileData(payload, entry));
+            }
+        },
+    };
+}
+//# sourceMappingURL=tar-gzip-source.js.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/update-flow.d.ts

@@ -0,0 +1,185 @@
+/**
+ * EXT-30 staged update and rollback (slices 1+2 of the approved design,
+ * docs/tool-mode/EXT-30-UPDATE-DESIGN.md).
+ *
+ * The two properties this module exists to enforce:
+ *
+ * - **Side-by-side, never in place.** A new version is fetched into
+ *   `staging/`, validated as DATA (manifest, integrity, schema/license/
+ *   permission deltas, structural-static self-tests), approved by an operator,
+ *   and only then promoted to its OWN version directory. The currently active
+ *   version's bytes are never mutated.
+ * - **The active version is a POINTER, committed atomically.** The profile
+ *   state document carries `activeVersions`/`previousVersions` maps written by
+ *   the store's single atomic writer under the store lock. Rollback restores
+ *   the pointer; it never copies bytes over a live install, never re-enables
+ *   disabled tools, never undoes revocations (those facts live beside the
+ *   pointer and are not touched).
+ *
+ * A post-commit rebind failure rolls the pointer back AUTOMATICALLY and names
+ * the reason. A corrupted version directory fails closed everywhere.
+ *
+ * Slice 1's self-tests are STRUCTURAL/STATIC only (manifest, referenced files,
+ * schema JSON parses): host-executed self-tests arrive with slice 3, and this
+ * module never executes extension code.
+ *
+ * @module @try-works/tool-mode-extension-sdk/install/update-flow
+ */
+import { type ArchiveSource, type InstallLimits, type InstallSource } from './staged.ts';
+/** One schema compatibility finding (EXT-30's schema recheck). */
+export interface SchemaDelta {
+    readonly toolName: string;
+    readonly file: 'input' | 'output';
+    /** True when a pinned composition would silently change meaning. */
+    readonly breaking: boolean;
+    readonly detail: string;
+}
+/** The staged update's validation report (EXT-30's gates, slice 1). */
+export interface UpdateValidationReport {
+    readonly manifestOk: boolean;
+    /** The current version the deltas were computed against. */
+    readonly comparedAgainst: string;
+    readonly schemaDeltas: readonly SchemaDelta[];
+    /** Set when the manifest licence declaration changed. */
+    readonly licenseDelta?: string;
+    /** Permission EXPANSIONS, one entry per expansion (AT-35). */
+    readonly permissionDeltas: readonly string[];
+    readonly selfTests: {
+        readonly kind: 'structural-static';
+        readonly passed: boolean;
+        readonly detail: string;
+    };
+    /** True when an operator approval is required before the commit. */
+    readonly requiresApproval: boolean;
+}
+/** The outcome of a successful stage (nothing is visible or active yet). */
+export interface UpdateStageResult {
+    readonly extensionId: string;
+    readonly stagedVersion: string;
+    /** Absolute path of the staged extraction (not the installed pool). */
+    readonly stagedPath: string;
+    readonly report: UpdateValidationReport;
+}
+/** The outcome of a commit (the pointer moved; the old pointer is the rollback target). */
+export interface UpdateCommitResult {
+    readonly extensionId: string;
+    readonly activeVersion: string;
+    readonly previousVersion?: string;
+}
+/** The outcome of a rollback (pointer restore only). */
+export interface UpdateRollbackResult {
+    readonly extensionId: string;
+    readonly activeVersion: string;
+    readonly previousVersion?: string;
+    /**
+     * The rebindRestored hook's own failure, when it threw or rejected. The hook
+     * is a POST-RESTORE observer: its error is reported here, never thrown — the
+     * pointer restore has already committed and must not be rolled back again.
+     */
+    readonly hookFailure?: string;
+}
+/**
+ * Stage an update (EXT-30 slice 1).
+ *
+ * Fetch → integrity → entry validation → extract into `staging/` → manifest
+ * discovery → schema/licence/permission deltas against the current version →
+ * structural-static self-tests. A BREAKING schema delta or an unparseable
+ * schema REFUSES the stage (the staged directory is removed); a licence or
+ * permission delta only marks the stage as requiring approval. The installed
+ * version is never touched.
+ *
+ * @param options - the source, store, injected archive source, and limits.
+ * @returns the staged update and its validation report.
+ * @throws ManagementError for every rejection path.
+ */
+export declare function stageUpdate(options: {
+    readonly storeDir: string;
+    readonly source: InstallSource;
+    readonly archive: ArchiveSource;
+    readonly expectedSha512?: string;
+    /** The comparison base; defaults to the highest recorded version. */
+    readonly currentVersion?: string;
+    readonly limits?: InstallLimits;
+}): Promise<UpdateStageResult>;
+/**
+ * Record ONE operator approval decision for a staged update (EXT-30).
+ *
+ * The record is retained for the store's lifetime and is write-once per staged
+ * version (see {@link ExtensionStore.recordApproval}).
+ * @param options - the store, the staged identity, and the decision.
+ */
+export declare function recordApproval(options: {
+    readonly storeDir: string;
+    readonly extensionId: string;
+    readonly stagedVersion: string;
+    readonly decision: {
+        approved: true;
+    } | {
+        approved: false;
+        reason: string;
+    };
+}): void;
+/**
+ * Commit a staged, approved update (EXT-30, two-phase seam).
+ *
+ * Under the store lock, in order: verify the approval → verify the staged
+ * bytes (digest re-check, fail-closed) → verify the CURRENT active version's
+ * directory (fail-closed) → admit the staged version to its OWN version
+ * directory (never the live one) → **quiescePrevious** (the host stops
+ * old-generation admissions BEFORE the pointer moves; a failure aborts the
+ * commit with the pointer unchanged) → commit the pointer atomically via the
+ * profile-state writer → **rebindNext** (the host republishes the new
+ * generation; a failure rolls the pointer back AUTOMATICALLY and names the
+ * reason).
+ *
+ * REBIND-REVERT CONTRACT: the automatic rollback after a rebindNext failure
+ * runs NO further hooks — quiescePrevious is not re-run and no restore hook
+ * fires. A host whose rebind needs its own revert must supply it INSIDE its
+ * all-or-nothing rebindNext wrapper; the SDK never re-enters host hooks.
+ *
+ * NO-SEAM REFUSAL: a commit with no rebindNext REFUSES by default (the durable
+ * pointer must not advance while nothing republishes the surface). Pass
+ * `pointerOnly: true` as the explicit, documented deployment opt-out.
+ *
+ * @param options - the store, profile, staged identity, and the two-phase hooks.
+ * @returns the committed pointer and the previous one.
+ * @throws ManagementError for every rejection path.
+ */
+export declare function commitUpdate(options: {
+    readonly storeDir: string;
+    readonly profile: string;
+    readonly extensionId: string;
+    readonly stagedVersion: string;
+    /** Explicit opt-out: commit the pointer with NO hooks (deployment tooling only). */
+    readonly pointerOnly?: boolean;
+    readonly hooks?: {
+        /** Runs under the store lock BEFORE the pointer write; a failure aborts the commit. */
+        readonly quiescePrevious?: (previousVersion: string) => Promise<void>;
+        /** Runs AFTER the pointer write; a failure auto-rolls the pointer back. */
+        readonly rebindNext?: (stagedVersion: string) => Promise<void>;
+    };
+}): Promise<UpdateCommitResult>;
+/**
+ * Roll back one extension to its previous active version (EXT-30 slice 2).
+ *
+ * POINTER RESTORE ONLY: no bytes are copied over any live install, disabled
+ * tools stay disabled, revocations stay revoked (those facts live in the
+ * profile state beside the pointer). The previous version's directory is
+ * verified first; a corrupt previous version refuses the rollback (quarantine,
+ * the current pointer stays).
+ *
+ * The optional `rebindRestored` hook (the host's republish of the restored
+ * generation) runs AFTER the pointer restore. Its failure is REPORTED on the
+ * result as `hookFailure` — the restore stands and no second rollback runs.
+ *
+ * @param options - the store, profile, extension, and the optional restore hook.
+ * @returns the restored pointer.
+ */
+export declare function rollback(options: {
+    readonly storeDir: string;
+    readonly profile: string;
+    readonly extensionId: string;
+    /** Runs AFTER the pointer restore; a failure is reported, never rolled back again. */
+    readonly rebindRestored?: (restoredVersion: string) => Promise<void>;
+}): Promise<UpdateRollbackResult>;
+//# sourceMappingURL=update-flow.d.ts.map

package/node_modules/@try-works/tool-mode-extension-sdk/lib/install/update-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-flow.d.ts","sourceRoot":"","sources":["../../src/install/update-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAA0B,MAAM,aAAa,CAAA;AAEhI,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACjC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAA;IAC7C,yDAAyD;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7G,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;CACnC;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACxC;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,wDAAwD;AACxD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAwJD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,qEAAqE;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAChC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmG7B;AA4CD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5E,GAAG,IAAI,CAEP;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,uFAAuF;QACvF,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrE,2EAA2E;QAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/D,CAAA;CACF,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuL9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACrE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwDhC"}