@try-works/dsh-model-as-tool 0.1.3 → 0.4.0

package/lib/diagnostics.js

@@ -0,0 +1,135 @@
+/**
+ * The settings/diagnostic surface (OBS-04).
+ *
+ * OBS-04 names, item by item, what an operator must be able to SEE. A surface that answers
+ * "is it on?" but not "which client may call what, and exactly why is this not supported here?"
+ * leaves an operator guessing, so each item below is reported with the fact that makes it
+ * actionable rather than a bare boolean.
+ *
+ * DESIGN CONSTRAINTS, because a diagnostic surface is unusually easy to get wrong:
+ *
+ *  - **It reports STATE, never credentials.** It names authorized clients and grants; it
+ *    never echoes a token. A diagnostic surface is the single most likely place for a secret
+ *    to leak, because its whole purpose is to be displayed.
+ *  - **Unsupported is always paired with WHY.** OBS-04 asks for "exact unsupported-platform
+ *    reasons", and a bare `supported: false` sends an operator to the source to find out.
+ *  - **Unknown is its own state.** A fact that cannot be determined is reported as unknown
+ *    rather than defaulted to false, because "not supported" and "not checked" call for
+ *    different actions.
+ *
+ * @module @try-works/dsh-model-as-tool/diagnostics
+ */
+/**
+ * Build the diagnostic report.
+ *
+ * @param inputs - the observed state.
+ * @returns everything OBS-04 names, with a reason wherever something is not available.
+ */
+export function buildDiagnostics(inputs) {
+    const capabilities = [
+        inputs.mcpMounted
+            ? { capability: 'mcp', state: 'available' }
+            : {
+                capability: 'mcp',
+                state: 'unavailable',
+                reason: 'no MCP surface is mounted in this deployment, so no client can call these tools',
+            },
+        /*
+         * The endpoint is reported separately from `mcp` because a mounted surface with no
+         * endpoint is a real state: the host composes tools for its own agent and serves nothing.
+         */
+        inputs.mcpEndpoint === undefined
+            ? { capability: 'mcp-endpoint', state: 'unavailable', reason: 'the mounted MCP surface exposes no network endpoint' }
+            : { capability: 'mcp-endpoint', state: 'available' },
+        inputs.mcpRequiresCredential === true
+            ? { capability: 'mcp-authorization', state: 'available' }
+            : inputs.mcpRequiresCredential === false
+                ? {
+                    capability: 'mcp-authorization',
+                    state: 'unavailable',
+                    reason: 'the endpoint accepts unauthenticated requests, so any local caller may invoke these tools',
+                }
+                // `unknown` rather than `false`: a fact that was not determined is not a fact that is
+                // absent, and the two call for different actions.
+                : { capability: 'mcp-authorization', state: 'unknown', reason: 'the deployment did not report whether a credential is required' },
+    ];
+    if (inputs.codeMode !== undefined) {
+        capabilities.push(inputs.codeMode.permitted && inputs.codeMode.backendReady
+            ? { capability: 'code-mode', state: 'available' }
+            : {
+                capability: 'code-mode',
+                state: 'unavailable',
+                reason: inputs.codeMode.reason
+                    ?? (inputs.codeMode.permitted
+                        ? 'generated-code execution is permitted but no backend is ready to run it'
+                        : 'generated-code execution is not permitted in this deployment'),
+            });
+    }
+    return {
+        platform: inputs.platform,
+        mcp: {
+            mounted: inputs.mcpMounted,
+            endpoint: inputs.mcpEndpoint ?? null,
+            requiresCredential: inputs.mcpRequiresCredential ?? null,
+            authorizedClients: [...(inputs.authorizedClients ?? [])],
+            exportedTools: [...inputs.exportedTools],
+            withheldTools: [...(inputs.withheldTools ?? [])],
+        },
+        preparation: (inputs.preparation ?? []).map(entry => ({
+            modelId: entry.modelId,
+            prepared: entry.prepared,
+            // A prepared model has nothing to explain; an unprepared one must say what is missing.
+            reason: entry.prepared ? null : entry.reason ?? 'no reason was reported, which is itself a defect in the caller',
+        })),
+        implementations: [...(inputs.selectedImplementations ?? [])],
+        extensions: [...(inputs.extensions ?? [])],
+        capabilities,
+        uninstall: inputs.uninstall ?? null,
+        requirements: inputs.requirements ?? null,
+        codeMode: inputs.codeMode ?? null,
+    };
+}
+/**
+ * The exact reason something is unsupported on THIS platform.
+ *
+ * Exists as a function because OBS-04 asks for the reason to be EXACT, and an exact reason has
+ * to name the platform it is about — "unsupported" against an unnamed platform sends an
+ * operator to compare their machine against a document.
+ *
+ * @param subject - what is unsupported.
+ * @param supportedOn - the platforms it does work on.
+ * @param platform - the platform being reported.
+ * @returns a reason naming both sides of the mismatch.
+ */
+export function unsupportedReason(subject, supportedOn, platform) {
+    const supported = supportedOn.map(entry => `${entry.os}/${entry.arch}`);
+    if (supported.length === 0) {
+        // A different sentence, because "no platform supports this" is not a mismatch.
+        return `${subject} declares no supported platform, so it cannot run anywhere`;
+    }
+    return `${subject} supports ${supported.join(', ')} but this host is ${platform.os}/${platform.arch}`;
+}
+/**
+ * Whether the deployment may retain request and response BODIES (OBS-03).
+ *
+ * OBS-03's operative sentence is a refusal, not a preference: where an operator's no-retention
+ * policy cannot be honoured together with DSH's requirement that model-visible inputs be
+ * reconstructable, harness-backed execution must be REFUSED rather than bodies silently
+ * logged or DSH bypassed. This returns the decision so the caller cannot soften it into a
+ * warning.
+ *
+ * @param policy - the deployment's retention policy.
+ * @returns whether harness-backed execution is permitted.
+ */
+export function harnessExecutionDecision(policy) {
+    if (!policy.retainsBodies && policy.requiresReconstructableInputs) {
+        return {
+            permitted: false,
+            reason: 'the deployment does not retain bodies while DSH requires model-visible inputs to be '
+                + 'reconstructable, so harness-backed execution is refused here rather than logging '
+                + 'bodies against the policy or bypassing DSH',
+        };
+    }
+    return { permitted: true };
+}
+//# sourceMappingURL=diagnostics.js.map

package/lib/extension-dependencies.d.ts

@@ -0,0 +1,325 @@
+/**
+ * First-party dependency graphs for developer-mode extension installs (EXT-09).
+ *
+ * Installing a first-party package from its checkout must satisfy the SAME
+ * discipline the SDK applies to a registry install: every declared runtime
+ * dependency is resolved to an exact version, verified by content, and
+ * materialized INSIDE the extension's own immutable installation directory. The
+ * SDK owns that discipline (`installDependencyGraph`); this module supplies the
+ * host half it deliberately leaves injected:
+ *
+ * - the RESOLVER: the exact version of a declared dependency is the one already
+ *   installed in the host's own tree, found by walking `node_modules` upward from
+ *   the source checkout exactly the way Node would. No registry request is made,
+ *   no version is guessed, and a dependency that is not installed refuses the
+ *   install instead of being skipped.
+ * - the ARCHIVE: the resolved package directory is turned into a deterministic
+ *   zip whose SHA-512 is the integrity the SDK verifies before extraction. The
+ *   archive is an ordinary package archive — `node_modules` is excluded because
+ *   the SDK resolves the transitive graph itself, and the package's declared
+ *   install-time scripts are left in place so the SDK's own refusal (EXT-10)
+ *   decides whether the dependency is admissible.
+ *
+ * Two properties matter for truthfulness:
+ *
+ * - **The host's node_modules is READ, never written.** The only write target is
+ *   the SDK's staging directory, which becomes the extension's private
+ *   `node_modules`; the resolver asserts this by construction (it has no write
+ *   path outside the archive bytes).
+ * - **A declaration is never silently dropped.** Every name the extension
+ *   declares is either materialized or the whole install fails with a named
+ *   `DEPENDENCY_UNSATISFIED` reason.
+ *
+ * INTEGRITY NOTE. The SDK's dependency lock records the SHA-512 of the archive
+ * bytes it verified (`verifyIntegrity`), which is what this module computes. The
+ * directory's own identity is additionally checked with the SDK's
+ * `digestInstalledContent` before and after the archive is built, so a checkout
+ * that changes while it is being archived refuses rather than shipping bytes that
+ * no longer match what was resolved.
+ *
+ * @module @try-works/dsh-model-as-tool/extension-dependencies
+ */
+import { DEFAULT_ARCHIVE_LIMITS, type ArchiveSource, type DependencyResolver, type InstallDependencyGraph, type InstallSource } from '@try-works/tool-mode-extension-sdk';
+/**
+ * The dependency archive byte cap.
+ *
+ * The SDK's `installDependencyGraph` calls `fetch` with a 256 MiB bound and
+ * requires the source to enforce it, so this module refuses an archive it could
+ * not truthfully hand over under that contract.
+ */
+export declare const MAX_DEPENDENCY_ARCHIVE_BYTES: number;
+/** One dependency resolved from the host's own installed tree. */
+export interface FirstPartyDependency {
+    /** The package name, as declared. */
+    readonly name: string;
+    /** The EXACT version recorded by the installed copy. */
+    readonly version: string;
+    /** The absolute directory the installed copy occupies. */
+    readonly directory: string;
+}
+/** Where to look for installed dependencies. */
+export interface DependencySearch {
+    /** The checkout whose declared dependency is being installed. */
+    readonly sourcePackageDir: string;
+    /**
+     * Additional package roots searched after the source checkout's own ancestors.
+     *
+     * The host's own module directory is always searched, so a dependency installed
+     * for the host (rather than for the extension checkout) is still found.
+     */
+    readonly extraSearchRoots?: readonly string[];
+}
+/** Bounds and seams for one first-party dependency graph. */
+export interface FirstPartyDependencyGraphOptions extends DependencySearch {
+    /** Total source bytes accepted per dependency; defaults to the SDK archive total bound. */
+    readonly maxSourceBytes?: number;
+    /** Per-file bytes accepted; defaults to the SDK archive per-entry bound. */
+    readonly maxEntryBytes?: number;
+    /** Archive bytes accepted per dependency; defaults to {@link MAX_DEPENDENCY_ARCHIVE_BYTES}. */
+    readonly maxArchiveBytes?: number;
+    /** Forwarded to the SDK graph: maximum dependency depth. */
+    readonly maxDepth?: number;
+    /** Forwarded to the SDK graph: maximum number of dependency packages. */
+    readonly maxPackages?: number;
+    /**
+     * The operator gate for PREINSTALLED dependency content (task-84).
+     *
+     * When true, a dependency resolved from the host's installed tree is supplied as
+     * the already-materialized directory instead of being re-archived as bytes: the
+     * SDK copies it into the extension's own install directory and records
+     * `provenance: 'preinstalled'`, which states that the content arrived from an
+     * operator-completed install and that this installer ran no lifecycle script.
+     * DEFAULT OFF: without the gate, the bytes arm applies and a dependency whose
+     * package.json declares an install-time script refuses exactly as before.
+     */
+    readonly allowPreinstalled?: boolean;
+    /**
+     * The operator-configured root every preinstalled directory must live under.
+     * REQUIRED when {@link FirstPartyDependencyGraphOptions.allowPreinstalled} is true;
+     * the SDK enforces the containment, this factory refuses a gate with no root.
+     */
+    readonly preinstalledRoot?: string;
+}
+/** The pieces, exposed so tests and diagnostics can inspect resolution without materializing. */
+export interface FirstPartyDependencyGraph {
+    /** The graph the SDK's directory installer consumes. */
+    readonly graph: InstallDependencyGraph;
+    /** The resolver half, callable on its own. */
+    readonly resolver: DependencyResolver;
+    /** The archive half, callable on its own. */
+    readonly archive: ArchiveSource;
+}
+/**
+ * Resolve one declared dependency from the host's installed tree.
+ *
+ * The source checkout's own ancestor chain is searched first (the tree whose
+ * `package.json` declared the dependency), then the host's own module chain, then
+ * any explicitly configured roots. The first installed package whose own
+ * `package.json` name matches wins; nothing is downloaded and no version is
+ * inferred.
+ * @param search - where to look.
+ * @param name - the declared dependency name.
+ * @param range - the declared spec, used only in the refusal message.
+ * @returns the installed dependency.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` when it is not installed.
+ */
+export declare function resolveFirstPartyDependency(search: DependencySearch, name: string, range: string): FirstPartyDependency;
+/** The archive built for one resolved dependency. */
+interface BuiltDependencyArchive {
+    /** The exact bytes the graph's archive source will serve. */
+    readonly bytes: Uint8Array;
+    /** SHA-512 of those bytes: the integrity the SDK verifies before extraction. */
+    readonly integrity: string;
+    /** The installed tree's own content digest, checked around the build. */
+    readonly contentDigest: string;
+}
+/**
+ * Build a deterministic zip of one installed dependency directory.
+ *
+ * The result is the archive the SDK's dependency graph fetches and verifies. Its
+ * SHA-512 is the integrity handed to the graph; the directory's own
+ * `digestInstalledContent` is checked before and after the build so a concurrent
+ * change refuses.
+ * @param dependency - the resolved installed dependency.
+ * @param limits - the byte bounds.
+ * @returns the archive bytes, their integrity, and the directory digest.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` for any refusal.
+ */
+export declare function buildDependencyArchive(dependency: FirstPartyDependency, limits: {
+    readonly maxSourceBytes: number;
+    readonly maxEntryBytes: number;
+    readonly maxArchiveBytes: number;
+}): BuiltDependencyArchive;
+/**
+ * How this host can supply one declared dependency.
+ *
+ * This is the narrow seam between the host's resolution policy and the SDK's
+ * dependency graph: `registry-bytes` is the verified-archive path (the SDK verifies
+ * the SHA-512 and extracts the bytes), and `preinstalled` is the operator-gated
+ * path (the SDK copies an already-materialized directory and records
+ * `provenance: 'preinstalled'`, never running a lifecycle script).
+ */
+export type DependencySupply = {
+    /** The host built verified archive bytes for this dependency. */
+    readonly kind: 'registry-bytes';
+    readonly dependency: FirstPartyDependency;
+    /** SHA-512 of exactly the bytes `archive.fetch` will serve. */
+    readonly integrity: string;
+    readonly bytes: Uint8Array;
+} | {
+    /** The host has an already-materialized installation for this dependency. */
+    readonly kind: 'preinstalled';
+    readonly dependency: FirstPartyDependency;
+    /** Documented by the SDK to mean: no lifecycle script was run by this installer. */
+    readonly provenance: 'preinstalled';
+};
+/**
+ * Create the first-party dependency graph supplied to the SDK's directory installer.
+ *
+ * Resolution and archiving happen lazily, one dependency at a time: `resolve`
+ * builds the exact bytes the SDK will verify and `fetch` hands back those same
+ * bytes, so the integrity the lock records is the integrity of the served archive
+ * rather than a value guessed from metadata. Only the most recently built archive
+ * is retained, which matches the SDK's resolve-then-fetch sequence and bounds
+ * memory to one dependency.
+ *
+ * The preinstalled-content gate is OPT-IN and OFF by default, matching the SDK:
+ * without it every dependency is served as verified bytes and EXT-10 applies. With
+ * it, the SDK requires `preinstalledRoot`, copies the resolved directory into the
+ * extension's own `node_modules`, and records `provenance: 'preinstalled'`.
+ * @param options - the search tree, bounds, gate and forwarded graph limits.
+ * @returns the install-dependency graph plus its resolver and archive halves.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` when the gate has no root.
+ */
+export declare function createFirstPartyDependencyGraph(options: FirstPartyDependencyGraphOptions): FirstPartyDependencyGraph;
+/** Re-export for callers that want the size bound wording. */
+export { DEFAULT_ARCHIVE_LIMITS };
+/** The default npm registry. */
+export declare const DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/";
+/** How a registry operation failed. Every code is host-facing and stable. */
+export type RegistryErrorCode = 
+/** No registry URL is configured. */
+'registry-not-configured'
+/** The registry has no such package, version, or dist-tag. */
+ | 'registry-not-found'
+/** Transport failure or 5xx: the registry did not answer usefully. This is the ONLY fallback-eligible failure. */
+ | 'registry-unavailable'
+/** The metadata did not have the npm shape this client can verify. */
+ | 'registry-invalid-metadata'
+/** `dist.integrity` is absent or not a sha512 SRI string: installs are refused, never unverified. */
+ | 'registry-integrity-missing'
+/** The tarball did not download (non-2xx, truncated, aborted). */
+ | 'registry-tarball-fetch-failed'
+/** The tarball is over the configured byte cap. */
+ | 'registry-tarball-too-large'
+/** No published version satisfies the requested range. */
+ | 'registry-no-matching-version';
+/** A named registry failure. */
+export declare class RegistryError extends Error {
+    readonly name = "RegistryError";
+    readonly code: RegistryErrorCode;
+    /** Whether a directory fallback may be considered under `auto`. */
+    readonly transport: boolean;
+    constructor(code: RegistryErrorCode, message: string, options?: {
+        readonly cause?: unknown;
+        readonly transport?: boolean;
+    });
+}
+/** One package version resolved from the registry. */
+export interface RegistryPackageResolution {
+    /** The package name, exactly as requested. */
+    readonly name: string;
+    /** The EXACT published version selected. */
+    readonly version: string;
+    /** The tarball URL from `dist.tarball`. */
+    readonly tarball: string;
+    /** The registry's sha512 SRI string from `dist.integrity` (verified before extraction). */
+    readonly integrity: string;
+    /** The dist-tag that selected this version, when the request named one. */
+    readonly distTag?: string;
+}
+/** What a registry session needs. */
+export interface RegistrySessionOptions {
+    /** Registry base URL, e.g. `https://registry.npmjs.org/`. Empty is allowed and refuses at resolve time. */
+    readonly registryUrl: string;
+    /**
+     * The container decoder for the bytes the registry serves.
+     *
+     * npm serves `.tgz`; the host passes the SDK's tar-gzip ArchiveSource factory.
+     * Injectable so the session (resolution, bounds, integrity plumbing) can be
+     * tested independently of the container implementation.
+     */
+    readonly archiveFactory: (fetcher: (source: InstallSource) => Promise<Uint8Array>) => ArchiveSource;
+    /** Hard cap on one downloaded package tarball; defaults to the SDK archive bound. */
+    readonly maxTarballBytes?: number;
+    /** Request timeout; default 30 s. */
+    readonly timeoutMs?: number;
+    /** Injected fetch, for tests. Defaults to the global fetch. */
+    readonly fetchImpl?: typeof fetch;
+}
+/** A registry session: version resolution plus the tarball archive over the SAME registry. */
+export interface RegistrySession {
+    /** The normalized registry base URL ('' when unconfigured). */
+    readonly registryUrl: string;
+    /** The ArchiveSource the install/dependency pipelines fetch through. */
+    readonly archive: ArchiveSource;
+    /**
+     * Resolve `<name>@<spec>` to one exact published version.
+     * @param name - the package name.
+     * @param spec - a dist-tag (`latest`), an exact version, or a semver range.
+     * @param signal - cancellation.
+     * @returns the exact version, tarball URL and sha512 integrity.
+     */
+    resolve(name: string, spec: string, signal?: AbortSignal): Promise<RegistryPackageResolution>;
+    /**
+     * Download the bytes registered for one archive source, bounded.
+     * @param source - the source returned by a previous resolve.
+     * @param signal - cancellation.
+     * @returns the tarball bytes (NOT yet digest-verified; the caller verifies).
+     */
+    download(source: InstallSource, signal?: AbortSignal): Promise<Uint8Array>;
+}
+/**
+ * Whether one published version satisfies a semver range.
+ *
+ * Supported: exact versions, `^`, `~`, x-ranges (`1.x`, `1.2`), comparison
+ * operators (`>=`, `>`, `<=`, `<`, `=`), hyphen ranges, `||`, and `*`. NOT
+ * supported (refused rather than guessed): prerelease-only ranges and npm's
+ * `tag:` protocol. A prerelease version only matches a range that itself names a
+ * prerelease.
+ * @param versionText - the published version.
+ * @param rangeText - the requested range.
+ * @returns whether the version satisfies the range.
+ */
+export declare function satisfiesRegistryRange(versionText: string, rangeText: string): boolean;
+/**
+ * The highest published version satisfying a range.
+ * @param versions - the published version strings.
+ * @param rangeText - the requested range.
+ * @returns the highest satisfying version exactly as published, or undefined.
+ */
+export declare function highestSatisfyingVersion(versions: readonly string[], rangeText: string): string | undefined;
+/**
+ * Create a registry session over one npm registry.
+ *
+ * The same session serves the extension package and every runtime dependency, so
+ * the tarball map (key → URL) the resolver registers is the map the archive
+ * fetches through. Nothing is downloaded until a caller fetches; nothing is
+ * verified here (the SDK verifies the sha512 before extraction, and this module
+ * refuses metadata without one).
+ * @param options - registry URL, archive factory, bounds and fetch seam.
+ * @returns the session.
+ */
+export declare function createRegistrySession(options: RegistrySessionOptions): RegistrySession;
+/**
+ * Wire a registry session into the SDK dependency-graph contract.
+ *
+ * Every declared dependency is resolved to one exact published version with its
+ * sha512 integrity; the SAME session archive fetches the bytes, so the manifest
+ * the graph verifies is the manifest that was resolved. EXT-10's script refusal is
+ * the SDK's own, unchanged.
+ * @param session - the registry session.
+ * @returns the install-dependency graph.
+ */
+export declare function createRegistryDependencyGraph(session: RegistrySession): InstallDependencyGraph;
+//# sourceMappingURL=extension-dependencies.d.ts.map

package/lib/extension-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-dependencies.d.ts","sourceRoot":"","sources":["../src/extension-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAOH,OAAO,EAEL,sBAAsB,EAItB,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAA;AAU3C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAAoB,CAAA;AAE7D,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C;AAED,6DAA6D;AAC7D,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,2FAA2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AAyED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,oBAAoB,CAsBtB;AAoGD,qDAAqD;AACrD,UAAU,sBAAsB;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE;IACN,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC,GACA,sBAAsB,CAyCxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B,GACD;IACE,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;CACpC,CAAA;AA8CL;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CA+E3B;AAED,8DAA8D;AAC9D,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAMjC,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,gCAAgC,CAAA;AAKjE,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB;AAC3B,qCAAqC;AACnC,yBAAyB;AAC3B,8DAA8D;GAC5D,oBAAoB;AACtB,kHAAkH;GAChH,sBAAsB;AACxB,sEAAsE;GACpE,2BAA2B;AAC7B,qGAAqG;GACnG,4BAA4B;AAC9B,kEAAkE;GAChE,+BAA+B;AACjC,mDAAmD;GACjD,4BAA4B;AAC9B,0DAA0D;GACxD,8BAA8B,CAAA;AAElC,gCAAgC;AAChC,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAkB;IACxC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;gBAEf,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAK3H;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qCAAqC;AACrC,MAAM,WAAW,sBAAsB;IACrC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK,aAAa,CAAA;IACnG,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,qCAAqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAClC;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC3E;AAqMD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsBtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS3G;AA+FD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA4FtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,eAAe,GAAG,sBAAsB,CAe9F"}