@try-works/dsh-model-as-tool 0.1.3 → 0.4.0

package/lib/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAAO,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE,kBAA4C,EACrD,SAAS,GAAE,SAAS,cAAc,EAAsB,EACxD,MAAM,CAAC,EAAE,cAAc,GACtB,YAAY,GAAG,SAAS,CAqB1B;AAED,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAAO,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE,kBAA4C,EACrD,SAAS,GAAE,SAAS,cAAc,EAAsB,EACxD,MAAM,CAAC,EAAE,cAAc,GACtB,YAAY,GAAG,SAAS,CAoB1B;AAED,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA"}

package/lib/adapters/index.js

@@ -59,10 +59,10 @@ function transportAdapter(entry, transport) {
  */
 export function createAdapter(entry, options = { route: 'npm-native' }, factories = ADAPTER_FACTORIES, bridge) {
     // A declared extension binding is the model's own statement of who implements
-    // it, so it is consulted before any host-side knowledge.
-    if (bridge !== undefined && entry.provider !== undefined) {
-        return bridge.adapterFor(entry);
-    }
+    // it, but only the explicit extension route may use it. This keeps CLI/remote
+    // fallback routes from accidentally trying to load a provider package.
+    if (options.route === 'extension')
+        return bridge?.adapterFor(entry);
     for (const factory of factories) {
         const adapter = factory(entry);
         if (adapter !== undefined)

package/lib/bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,qBAAqB,CAAA;AAElE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,MAAM,CAAA;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACtD;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAA;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAA;IAC1C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CAaxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC,EACvE,IAAI,EAAE,YAAY,EAClB,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,QAAQ,CAYV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC,EACvE,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EACjC,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,iBAAiB,CAoBnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,KAAK,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,EAC7D,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,YAAY,GACjB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAoG3C"}
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,MAAM,CAAA;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACtD;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAA;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAA;IAC1C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CAcxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC,EACvE,IAAI,EAAE,YAAY,EAClB,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,QAAQ,CAYV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,GAAG,OAAO,CAAC,EACvE,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EACjC,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,iBAAiB,CAoBnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IAAE,KAAK,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;KAAE,CAAA;CAAE,EAC7D,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,YAAY,GACjB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAoG3C"}

package/lib/bindings.js

@@ -13,7 +13,7 @@
  * @module @try-works/dsh-model-as-tool/bindings
  */
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { assertValidContract, assertValidInput, assertValidOutput, crossFieldRules, toDshParameters, } from '@try-works/tool-mode-contracts';
+import { assertValidContract, assertValidInput, assertValidOutput, crossFieldRules, projectSchemaToDsh, toDshParameters, } from '@try-works/tool-mode-contracts';
 import { toContractPayload, toNativeArgs } from "./contract-payload.js";
 import { buildInvocationReceipt } from "./receipt.js";
 import { authorizeTool, createInvocationAuthority, } from "./authority.js";
@@ -27,6 +27,7 @@ import { authorizeTool, createInvocationAuthority, } from "./authority.js";
  */
 export function executionLocationOf(route) {
     switch (route) {
+        case 'extension':
         case 'npm-native':
         case 'npm-onnxruntime':
             return 'host';
@@ -124,33 +125,26 @@ export function registerContractTool(ctx, binding, host) {
         parameters: toDshParameters(contract),
         output: {
             /**
-             * An open object schema, and DECL-02 names this as INADEQUATE.
+             * The PROJECTED output schema, closing the DECL-02 advertisement gap.
              *
-             * The requirement says in as many words that an unconstrained
-             * `{type: "object", additionalProperties: true}` is not an adequate implementation
-             * of an ordinary leaf tool's contract. It is right, and this repository cannot yet
-             * do better: the contract's real output schema CANNOT be projected into DSH's
-             * value-schema DSL. Attempting it produced four distinct rejections at
-             * registration, recorded here because the next person will try the same thing:
+             * The registry validates every success against this advertised schema, so it may
+             * never be STRICTER than the contract. `projectSchemaToDsh` only loosens: it drops
+             * keywords the DSH value-schema DSL cannot carry (`items` at depth, non-scalar
+             * `enum`, `minimum`/`pattern`/`minLength`), records each in `runtimeEnforced`, and
+             * keeps every property name, type and closedness. `assertValidOutput` still
+             * enforces the FULL contract at runtime, so the projection is advertisement-only.
              *
-             *   1. `schema.required is not supported by the value schema DSL`
-             *   2. `schema.properties.candidates.items.required is not supported` - so required
-             *      is unsupported at EVERY depth, not merely at the root
-             *   3. `schema.properties.words.items is not supported` - `items` is in the
-             *      documented supported set but its support does not extend to an array nested
-             *      inside an object, which is what every output schema has
-             *   4. `schema.properties.reliability.enum must be a non-empty array of scalar
-             *      values` - and separate attempts to express the union type as `oneOf` were
-             *      rejected too, with `oneOf must be an array of at least two value schemas`
-             *
-             * Stripping each keyword in turn does converge, but it converges on a schema that
-             * advertises almost nothing while APPEARING to be a real declaration - which is
-             * worse than this open object, because a client would trust it. The contract
-             * itself is unchanged and complete: `assertValidOutput` enforces the real schema at
-             * runtime against the untouched contract, so results ARE validated. What is
-             * missing is the ADVERTISEMENT.
+             * The open `{type:"object", additionalProperties:true}` this replaces declared
+             * nothing about any field; the projection names every property, its type and its
+             * requiredness — a genuine declaration. Registration was previously impossible
+             * because the projection mangled scalar enums into objects (`{0:'host',...}`) via
+             * an array/record confusion in stripItems; that defect is fixed and probed.
              */
-            schema: { type: 'object', additionalProperties: true },
+            schema: {
+                type: 'object',
+                properties: projectSchemaToDsh(contract.outputSchema).parameters,
+                additionalProperties: false,
+            },
             render: (_args, value) => {
                 const record = value;
                 return [{ type: 'text', text: renderForModel(contract, record) }];
@@ -189,6 +183,13 @@ export function registerContractTool(ctx, binding, host) {
             // call that failed validation would claim provenance for a result nobody
             // received, so the sink sees only calls that actually completed.
             host.recordReceipt?.(buildReceipt(binding, host, meta));
+            /**
+             * The cast exists because the projected schema's inferred type is a closed
+             * record, while the registry validates the VALUE against the projected schema
+             * (which only LOOSENS the contract) and `assertValidOutput` enforces the full
+             * contract. The value is losslessly JSON and has passed both; the type-level
+             * fiction is contained to this return.
+             */
             return value;
         },
         presentCall(callArgs) {

package/lib/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAWtE;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOrD;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE5E;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IACP,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACvB,GACL,iBAAiB,CA6FnB;AAED,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,OAAO,GAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAM,GACpD,aAAa,EAAE,CAEjB"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAWtE;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOrD;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE5E;AAwBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE;IACP,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACvB,GACL,iBAAiB,CA+GnB;AAED,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,OAAO,GAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAM,GACpD,aAAa,EAAE,CAEjB"}

package/lib/capability.js

@@ -80,6 +80,23 @@ export function resolveCapability(entry, options = {}) {
     // A bridge is checked first among the fallbacks because it is the only route
     // for Apple-only models, which have neither a package nor (for some) a verb.
     const bridgeUsable = remoteEndpoint !== undefined && remoteEndpoint.length > 0 && !entry.closedBeta;
+    if (entry.provider !== undefined && !entry.closedBeta) {
+        const extensionManifest = `${entry.provider.extension}/package.json`;
+        if (resolve(extensionManifest)) {
+            return {
+                runnable: true,
+                route: 'extension',
+                reason: `${entry.name} is implemented by the Tool Mode extension ${entry.provider.extension}; provider readiness is checked through that extension before publication and again for discovery.`,
+                resolved: [extensionManifest],
+            };
+        }
+        return {
+            runnable: false,
+            route: 'unavailable',
+            reason: `${entry.name} declares the Tool Mode extension ${entry.provider.extension}, which is not installed or not resolvable from this host. Install and activate that extension, or correct the catalog binding.`,
+            missing: [extensionManifest],
+        };
+    }
     const pkg = entry.npmPackage;
     // Why the in-process route did not pan out. Kept so the final verdict can name
     // the exact missing piece ("install onnxruntime-node") instead of falling back

package/lib/capture-path.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The full capture path, and the metadata-only profile (OBS-03).
+ *
+ * THE PREMISE OBS-03 STARTS FROM, and it is the uncomfortable one: **this plugin's defaults
+ * cannot guarantee privacy.** A body that is never written by us may still be captured by
+ * ANOTHER DSH logging plugin, because DSH's LLM service requires model-visible inputs to be
+ * reconstructable — so a harness call's prompt necessarily passes through a surface a sibling
+ * plugin can observe. Nothing this plugin does can close that.
+ *
+ * What this plugin CAN do is be honest about it, which is what the requirement asks for in three
+ * parts:
+ *
+ *  1. **Document the full capture path** — every place a body can come to rest, including the
+ *     ones outside this plugin's control. A privacy claim that names only our own writes is
+ *     misleading precisely because the reader will assume it is complete.
+ *  2. **Provide and TEST a metadata-only profile** for the headless local-specialist case, where
+ *     an operator wants the tools without any body retention.
+ *  3. **REFUSE rather than silently log** where a no-retention policy cannot be honoured
+ *     alongside DSH's reconstructability contract. `harnessExecutionDecision` in
+ *     `diagnostics.ts` makes that decision; this module says which profile it applies to.
+ *
+ * @module @try-works/dsh-model-as-tool/capture-path
+ */
+/** Where a request or response body can come to rest. */
+export interface CaptureSurface {
+    /** A stable name for the surface. */
+    readonly surface: string;
+    /**
+     * Whether THIS plugin writes bodies there.
+     *
+     * `false` does not mean the surface is safe — it means this plugin is not the author. That
+     * distinction is the whole reason the field exists: a reader must not mistake "we do not
+     * write here" for "nothing is written here".
+     */
+    readonly writtenByThisPlugin: boolean;
+    /** What actually lands there. */
+    readonly contents: string;
+    /** What an operator can do about it. */
+    readonly control: string;
+}
+/**
+ * The FULL capture path, including surfaces outside this plugin's control.
+ *
+ * Ordered from what this plugin owns to what it does not, so a reader sees the boundary
+ * explicitly rather than inferring it from a list of our own writes.
+ */
+export declare const CAPTURE_PATH: readonly CaptureSurface[];
+/** Which capture policy a deployment runs under (OBS-03). */
+export type CaptureProfile = 
+/** Ordinary operation: receipts and accounting, bodies owned by the surfaces above. */
+'standard'
+/**
+ * Headless local-specialist: METADATA ONLY.
+ *
+ * Composed by an operator who wants the tools without any body retention at all. Everything
+ * this plugin writes is metadata; the profile additionally forbids the one path where this
+ * plugin could be the author of a body, and refuses harness-backed execution when the
+ * deployment's policy cannot satisfy DSH's reconstructability contract.
+ */
+ | 'metadata-only';
+/** What a profile permits. */
+export interface ProfilePolicy {
+    readonly profile: CaptureProfile;
+    /** Whether this profile may serve harness-backed (model-calling) tools at all. */
+    readonly permitsHarnessExecution: boolean;
+    /** Whether this plugin writes any request or response BODY. */
+    readonly writesBodies: boolean;
+    /** Surfaces this profile does not close, so a reader sees the residual risk. */
+    readonly residualSurfaces: readonly string[];
+}
+/**
+ * Describe a profile's policy.
+ *
+ * @param profile - the profile to describe.
+ * @param policy - the deployment's retention facts.
+ * @returns what the profile permits, and what it does not close.
+ */
+export declare function profilePolicy(profile: CaptureProfile, policy: {
+    readonly retainsBodies: boolean;
+    readonly requiresReconstructableInputs: boolean;
+}): ProfilePolicy;
+/**
+ * Whether a profile may serve one tool.
+ *
+ * @param profile - the active profile.
+ * @param policy - the deployment's retention facts.
+ * @param harnessBacked - whether the tool calls a model.
+ * @returns the decision, with the reason when it refuses.
+ */
+export declare function admitsTool(profile: CaptureProfile, policy: {
+    readonly retainsBodies: boolean;
+    readonly requiresReconstructableInputs: boolean;
+}, harnessBacked: boolean): {
+    readonly admitted: boolean;
+    readonly reason?: string;
+};
+//# sourceMappingURL=capture-path.d.ts.map

package/lib/capture-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-path.d.ts","sourceRoot":"","sources":["../src/capture-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAuEjD,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,cAAc;AACxB,uFAAuF;AACrF,UAAU;AACZ;;;;;;;GAOG;GACD,eAAe,CAAA;AAEnB,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,kFAAkF;IAClF,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAA;CAAE,GAC3F,aAAa,CA+Bf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAA;CAAE,EAC5F,aAAa,EAAE,OAAO,GACrB;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiB1D"}

package/lib/capture-path.js

@@ -0,0 +1,152 @@
+/**
+ * The full capture path, and the metadata-only profile (OBS-03).
+ *
+ * THE PREMISE OBS-03 STARTS FROM, and it is the uncomfortable one: **this plugin's defaults
+ * cannot guarantee privacy.** A body that is never written by us may still be captured by
+ * ANOTHER DSH logging plugin, because DSH's LLM service requires model-visible inputs to be
+ * reconstructable — so a harness call's prompt necessarily passes through a surface a sibling
+ * plugin can observe. Nothing this plugin does can close that.
+ *
+ * What this plugin CAN do is be honest about it, which is what the requirement asks for in three
+ * parts:
+ *
+ *  1. **Document the full capture path** — every place a body can come to rest, including the
+ *     ones outside this plugin's control. A privacy claim that names only our own writes is
+ *     misleading precisely because the reader will assume it is complete.
+ *  2. **Provide and TEST a metadata-only profile** for the headless local-specialist case, where
+ *     an operator wants the tools without any body retention.
+ *  3. **REFUSE rather than silently log** where a no-retention policy cannot be honoured
+ *     alongside DSH's reconstructability contract. `harnessExecutionDecision` in
+ *     `diagnostics.ts` makes that decision; this module says which profile it applies to.
+ *
+ * @module @try-works/dsh-model-as-tool/capture-path
+ */
+/**
+ * The FULL capture path, including surfaces outside this plugin's control.
+ *
+ * Ordered from what this plugin owns to what it does not, so a reader sees the boundary
+ * explicitly rather than inferring it from a list of our own writes.
+ */
+export const CAPTURE_PATH = [
+    {
+        surface: 'tool invocation arguments',
+        writtenByThisPlugin: false,
+        contents: 'The arguments a caller passes to a tool. They reach the implementation, and for a '
+            + 'harness-backed tool they become part of the rendered prompt.',
+        control: 'The caller decides what to pass. This plugin adds nothing to the arguments and copies '
+            + 'them nowhere.',
+    },
+    {
+        surface: 'managed-worker stdout/stderr',
+        writtenByThisPlugin: false,
+        contents: 'Whatever an extension process prints. An extension that logs its own inputs puts bodies '
+            + 'into a stream this plugin does not author or read.',
+        control: 'Extension authors control their own logging. The isolation mode is declared in the '
+            + 'manifest, and the diagnostics surface reports it.',
+    },
+    {
+        surface: 'DSH LLM service',
+        writtenByThisPlugin: false,
+        contents: 'THE SURFACE THIS PLUGIN CANNOT CLOSE. DSH requires model-visible inputs to be '
+            + 'reconstructable, so a harness call\'s prompt passes through the LLM service by design.',
+        control: 'An operator-level policy, not a plugin setting. Where no-retention conflicts with '
+            + 'reconstructability, the correct response is to REFUSE harness-backed execution — which '
+            + 'this plugin does rather than logging bodies or bypassing DSH.',
+    },
+    {
+        surface: 'another DSH logging plugin',
+        writtenByThisPlugin: false,
+        contents: 'Any body a sibling plugin observes through a DSH hook. This plugin neither knows what '
+            + 'they capture nor can it prevent them.',
+        control: 'Operator configuration of the OTHER plugin. This is the specific case OBS-03 names, and '
+            + 'it is why the plugin defaults cannot be presented as a privacy guarantee.',
+    },
+    {
+        surface: 'the auxiliary-call journal (section 19)',
+        writtenByThisPlugin: true,
+        contents: 'Harness-backed auxiliary calls, recorded under a SEPARATE authorization from ordinary '
+            + 'tool receipts. The broker refuses to construct without a journal sink, so a '
+            + 'harness-backed run that records nothing cannot exist.',
+        control: 'A deployment composes the sink or the broker refuses. The journal is the mechanism that '
+            + 'makes a harness call auditable without putting its body in an ordinary log.',
+    },
+    {
+        surface: 'invocation accounting',
+        writtenByThisPlugin: true,
+        contents: 'Timings, outcome class and byte SIZES. The record has no field that can hold a payload, '
+            + 'which is asserted structurally rather than promised.',
+        control: 'Always on. There is nothing to configure because there is nothing sensitive in it.',
+    },
+    {
+        surface: 'tool receipts',
+        writtenByThisPlugin: true,
+        contents: 'Identity and provenance — contract, implementation, extension version, content digest, '
+            + 'activation generation, caller scope. No credentials and no bodies.',
+        control: 'Disabled by an explicit configuration flag, which is visible on the diagnostics surface.',
+    },
+];
+/**
+ * Describe a profile's policy.
+ *
+ * @param profile - the profile to describe.
+ * @param policy - the deployment's retention facts.
+ * @returns what the profile permits, and what it does not close.
+ */
+export function profilePolicy(profile, policy) {
+    /**
+     * The surfaces no profile can close, listed for BOTH profiles because the difference between
+     * them is what THIS plugin writes — not what a sibling plugin does.
+     */
+    const residualSurfaces = CAPTURE_PATH
+        .filter(surface => !surface.writtenByThisPlugin)
+        .map(surface => surface.surface);
+    if (profile === 'standard') {
+        return {
+            profile,
+            permitsHarnessExecution: true,
+            writesBodies: false,
+            residualSurfaces,
+        };
+    }
+    /**
+     * METADATA ONLY. The plugin still writes no bodies — it never did — and the profile adds the
+     * REFUSAL: where a no-retention policy conflicts with DSH's reconstructability requirement,
+     * harness-backed execution is not served at all. Logging bodies against the policy and
+     * bypassing DSH are both forbidden, which leaves refusing.
+     */
+    const conflict = !policy.retainsBodies && policy.requiresReconstructableInputs;
+    return {
+        profile,
+        permitsHarnessExecution: !conflict,
+        writesBodies: false,
+        residualSurfaces,
+    };
+}
+/**
+ * Whether a profile may serve one tool.
+ *
+ * @param profile - the active profile.
+ * @param policy - the deployment's retention facts.
+ * @param harnessBacked - whether the tool calls a model.
+ * @returns the decision, with the reason when it refuses.
+ */
+export function admitsTool(profile, policy, harnessBacked) {
+    const described = profilePolicy(profile, policy);
+    /**
+     * A NON-harness tool is admitted under every profile: it calls no model, so there is no body
+     * for the reconstructability contract to be about, and refusing it would remove working
+     * functionality for no privacy gain.
+     */
+    if (!harnessBacked)
+        return { admitted: true };
+    if (described.permitsHarnessExecution)
+        return { admitted: true };
+    return {
+        admitted: false,
+        reason: 'the metadata-only profile refuses harness-backed execution because the deployment does '
+            + 'not retain bodies while DSH requires model-visible inputs to be reconstructable. '
+            + 'Logging bodies against the policy and bypassing DSH are both forbidden, so the tool is '
+            + 'not served.',
+    };
+}
+//# sourceMappingURL=capture-path.js.map

package/lib/diagnostics.d.ts

@@ -0,0 +1,166 @@
+/**
+ * The settings/diagnostic surface (OBS-04).
+ *
+ * OBS-04 names, item by item, what an operator must be able to SEE. A surface that answers
+ * "is it on?" but not "which client may call what, and exactly why is this not supported here?"
+ * leaves an operator guessing, so each item below is reported with the fact that makes it
+ * actionable rather than a bare boolean.
+ *
+ * DESIGN CONSTRAINTS, because a diagnostic surface is unusually easy to get wrong:
+ *
+ *  - **It reports STATE, never credentials.** It names authorized clients and grants; it
+ *    never echoes a token. A diagnostic surface is the single most likely place for a secret
+ *    to leak, because its whole purpose is to be displayed.
+ *  - **Unsupported is always paired with WHY.** OBS-04 asks for "exact unsupported-platform
+ *    reasons", and a bare `supported: false` sends an operator to the source to find out.
+ *  - **Unknown is its own state.** A fact that cannot be determined is reported as unknown
+ *    rather than defaulted to false, because "not supported" and "not checked" call for
+ *    different actions.
+ *
+ * @module @try-works/dsh-model-as-tool/diagnostics
+ */
+/** One capability this deployment either has, lacks, or has not determined. */
+export interface CapabilityReport {
+    /** The capability, in the vocabulary OBS-04 uses. */
+    readonly capability: string;
+    /** Whether it is available HERE. */
+    readonly state: 'available' | 'unavailable' | 'unknown';
+    /**
+     * Why, whenever the state is not `available`.
+     *
+     * Never omitted for `unavailable`: an operator cannot act on a fact they cannot explain,
+     * and OBS-04 asks for the EXACT reason.
+     */
+    readonly reason?: string;
+}
+/** Inputs the surface reports on. */
+export interface DiagnosticInputs {
+    /** Whether the MCP surface is mounted. */
+    readonly mcpMounted: boolean;
+    /** Where it listens, when it does. */
+    readonly mcpEndpoint?: string;
+    /** Whether the endpoint requires a credential. */
+    readonly mcpRequiresCredential?: boolean;
+    /** Client identities currently authorized, if the deployment tracks them. */
+    readonly authorizedClients?: readonly string[];
+    /** Tool names exported to clients. */
+    readonly exportedTools: readonly string[];
+    /** Tools registered on the host but deliberately NOT exported. */
+    readonly withheldTools?: readonly string[];
+    /** Per-model preparation state. */
+    readonly preparation?: readonly {
+        readonly modelId: string;
+        readonly prepared: boolean;
+        readonly reason?: string;
+    }[];
+    /** The implementation each contract currently resolves to. */
+    readonly selectedImplementations?: readonly {
+        readonly contractId: string;
+        readonly implementationId: string;
+    }[];
+    /** Installed extensions and whether they are active. */
+    readonly extensions?: readonly {
+        readonly extensionId: string;
+        readonly version: string;
+        readonly activation: string;
+    }[];
+    /** Whether the deployment can remove an extension, and whether it protects built-ins. */
+    readonly uninstall?: {
+        readonly available: boolean;
+        readonly builtInsProtected: boolean;
+        readonly reason?: string;
+    };
+    /** Location and network requirements. */
+    readonly requirements?: {
+        readonly localOnly: boolean;
+        readonly networkOrigins: readonly string[];
+    };
+    /** Code Mode permission and backend readiness. */
+    readonly codeMode?: {
+        readonly permitted: boolean;
+        readonly backendReady: boolean;
+        readonly reason?: string;
+    };
+    /** Platform facts, so an unsupported reason can name the platform it refers to. */
+    readonly platform: {
+        readonly os: string;
+        readonly arch: string;
+        readonly nodeVersion: string;
+    };
+}
+/** The reported surface. */
+export interface DiagnosticReport {
+    readonly platform: DiagnosticInputs['platform'];
+    readonly mcp: {
+        readonly mounted: boolean;
+        readonly endpoint: string | null;
+        readonly requiresCredential: boolean | null;
+        readonly authorizedClients: readonly string[];
+        readonly exportedTools: readonly string[];
+        readonly withheldTools: readonly string[];
+    };
+    readonly preparation: readonly {
+        readonly modelId: string;
+        readonly prepared: boolean;
+        readonly reason: string | null;
+    }[];
+    readonly implementations: readonly {
+        readonly contractId: string;
+        readonly implementationId: string;
+    }[];
+    readonly extensions: readonly {
+        readonly extensionId: string;
+        readonly version: string;
+        readonly activation: string;
+    }[];
+    readonly capabilities: readonly CapabilityReport[];
+    readonly uninstall: DiagnosticInputs['uninstall'] | null;
+    readonly requirements: DiagnosticInputs['requirements'] | null;
+    readonly codeMode: DiagnosticInputs['codeMode'] | null;
+}
+/**
+ * Build the diagnostic report.
+ *
+ * @param inputs - the observed state.
+ * @returns everything OBS-04 names, with a reason wherever something is not available.
+ */
+export declare function buildDiagnostics(inputs: DiagnosticInputs): DiagnosticReport;
+/**
+ * The exact reason something is unsupported on THIS platform.
+ *
+ * Exists as a function because OBS-04 asks for the reason to be EXACT, and an exact reason has
+ * to name the platform it is about — "unsupported" against an unnamed platform sends an
+ * operator to compare their machine against a document.
+ *
+ * @param subject - what is unsupported.
+ * @param supportedOn - the platforms it does work on.
+ * @param platform - the platform being reported.
+ * @returns a reason naming both sides of the mismatch.
+ */
+export declare function unsupportedReason(subject: string, supportedOn: readonly {
+    readonly os: string;
+    readonly arch: string;
+}[], platform: {
+    readonly os: string;
+    readonly arch: string;
+}): string;
+/**
+ * Whether the deployment may retain request and response BODIES (OBS-03).
+ *
+ * OBS-03's operative sentence is a refusal, not a preference: where an operator's no-retention
+ * policy cannot be honoured together with DSH's requirement that model-visible inputs be
+ * reconstructable, harness-backed execution must be REFUSED rather than bodies silently
+ * logged or DSH bypassed. This returns the decision so the caller cannot soften it into a
+ * warning.
+ *
+ * @param policy - the deployment's retention policy.
+ * @returns whether harness-backed execution is permitted.
+ */
+export declare function harnessExecutionDecision(policy: {
+    readonly retainsBodies: boolean;
+    readonly requiresReconstructableInputs: boolean;
+}): {
+    readonly permitted: boolean;
+    readonly reason?: string;
+};
+//# sourceMappingURL=diagnostics.d.ts.map

package/lib/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,mCAAmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpH,8DAA8D;IAC9D,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAChH,wDAAwD;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACxH,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnH,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IACnG,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7G,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAChG;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAC/C,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QAChC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAA;QAC3C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;QAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;QACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;KAC1C,CAAA;IACD,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAA;IACzH,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvG,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvH,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;IACxD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,GAAG,IAAI,CAAA;IAC9D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,GAAG,IAAI,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAiE3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACtE,QAAQ,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvD,MAAM,CAOR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAW3D"}