@try-works/dsh-tool-mode 0.0.0-stage → 0.5.44

package/lib/extension-dependencies.d.ts

@@ -0,0 +1,355 @@
+/**
+ * First-party dependency graphs for developer-mode extension installs (EXT-09).
+ *
+ * Installing a first-party package from its checkout must satisfy the SAME
+ * discipline the SDK applies to a registry install: every declared runtime
+ * dependency is resolved to an exact version, verified by content, and
+ * materialized INSIDE the extension's own immutable installation directory. The
+ * SDK owns that discipline (`installDependencyGraph`); this module supplies the
+ * host half it deliberately leaves injected:
+ *
+ * - the RESOLVER: the exact version of a declared dependency is the one already
+ *   installed in the host's own tree, found by walking `node_modules` upward from
+ *   the source checkout exactly the way Node would. No registry request is made,
+ *   no version is guessed, and a dependency that is not installed refuses the
+ *   install instead of being skipped.
+ * - the ARCHIVE: the resolved package directory is turned into a deterministic
+ *   zip whose SHA-512 is the integrity the SDK verifies before extraction. The
+ *   archive is an ordinary package archive — `node_modules` is excluded because
+ *   the SDK resolves the transitive graph itself, and the package's declared
+ *   install-time scripts are left in place so the SDK's own refusal (EXT-10)
+ *   decides whether the dependency is admissible.
+ *
+ * Two properties matter for truthfulness:
+ *
+ * - **The host's node_modules is READ, never written.** The only write target is
+ *   the SDK's staging directory, which becomes the extension's private
+ *   `node_modules`; the resolver asserts this by construction (it has no write
+ *   path outside the archive bytes).
+ * - **A declaration is never silently dropped.** Every name the extension
+ *   declares is either materialized or the whole install fails with a named
+ *   `DEPENDENCY_UNSATISFIED` reason.
+ *
+ * INTEGRITY NOTE. The SDK's dependency lock records the SHA-512 of the archive
+ * bytes it verified (`verifyIntegrity`), which is what this module computes. The
+ * directory's own identity is additionally checked with the SDK's
+ * `digestInstalledContent` before and after the archive is built, so a checkout
+ * that changes while it is being archived refuses rather than shipping bytes that
+ * no longer match what was resolved.
+ *
+ * @module @try-works/dsh-tool-mode/extension-dependencies
+ */
+import { DEFAULT_ARCHIVE_LIMITS, type ArchiveSource, type DependencyResolver, type InstallDependencyGraph, type InstallSource } from '@try-works/tool-mode-extension-sdk';
+/**
+ * The dependency archive byte cap.
+ *
+ * The SDK's `installDependencyGraph` calls `fetch` with a 256 MiB bound and
+ * requires the source to enforce it, so this module refuses an archive it could
+ * not truthfully hand over under that contract.
+ */
+export declare const MAX_DEPENDENCY_ARCHIVE_BYTES: number;
+/** One dependency resolved from the host's own installed tree. */
+export interface FirstPartyDependency {
+    /** The package name, as declared. */
+    readonly name: string;
+    /** The EXACT version recorded by the installed copy. */
+    readonly version: string;
+    /** The absolute directory the installed copy occupies. */
+    readonly directory: string;
+}
+/** Where to look for installed dependencies. */
+export interface DependencySearch {
+    /** The checkout whose declared dependency is being installed. */
+    readonly sourcePackageDir: string;
+    /**
+     * Additional package roots searched after the source checkout's own ancestors.
+     *
+     * The host's own module directory is always searched, so a dependency installed
+     * for the host (rather than for the extension checkout) is still found.
+     */
+    readonly extraSearchRoots?: readonly string[];
+}
+/** Bounds and seams for one first-party dependency graph. */
+export interface FirstPartyDependencyGraphOptions extends DependencySearch {
+    /** Total source bytes accepted per dependency; defaults to the SDK archive total bound. */
+    readonly maxSourceBytes?: number;
+    /** Per-file bytes accepted; defaults to the SDK archive per-entry bound. */
+    readonly maxEntryBytes?: number;
+    /** Archive bytes accepted per dependency; defaults to {@link MAX_DEPENDENCY_ARCHIVE_BYTES}. */
+    readonly maxArchiveBytes?: number;
+    /**
+     * Forwarded to the SDK graph: maximum dependency depth.
+     *
+     * OPTIONAL only because the SDK accepts its own default; omitting it means the
+     * SDK's 3-level bound, which a real host tree exceeds — the installed
+     * onnxruntime-node tree reaches `define-data-property` at depth 4 and
+     * `es-define-property` at depth 5, and the SDK walks a preinstalled package's
+     * declared dependencies just like registry bytes. A caller that resolves a host
+     * tree therefore passes its configured bound explicitly; the SDK still enforces
+     * it (and its independent 64-package bound) at install time.
+     */
+    readonly maxDepth?: number;
+    /** Forwarded to the SDK graph: maximum number of dependency packages. */
+    readonly maxPackages?: number;
+    /**
+     * The operator gate for PREINSTALLED dependency content (task-84).
+     *
+     * When true, a dependency resolved from the host's installed tree is supplied as
+     * the already-materialized directory instead of being re-archived as bytes: the
+     * SDK copies it into the extension's own install directory and records
+     * `provenance: 'preinstalled'`, which states that the content arrived from an
+     * operator-completed install and that this installer ran no lifecycle script.
+     * DEFAULT OFF: without the gate, the bytes arm applies and a dependency whose
+     * package.json declares an install-time script refuses exactly as before.
+     */
+    readonly allowPreinstalled?: boolean;
+    /**
+     * The operator-configured root every preinstalled directory must live under.
+     * REQUIRED when {@link FirstPartyDependencyGraphOptions.allowPreinstalled} is true;
+     * the SDK enforces the containment, this factory refuses a gate with no root.
+     */
+    readonly preinstalledRoot?: string;
+    /**
+     * Exact `name@version` pairs whose published tarball ships prebuilt artifacts.
+     * Their lifecycle-script declaration is admitted but NEVER executed; every
+     * unlisted package keeps the EXT-10 refusal. This is an allowlist of known
+     * prebuilt content, not a general script-execution gate.
+     */
+    readonly trustedPrebuiltDependencies?: readonly string[];
+}
+/** The pieces, exposed so tests and diagnostics can inspect resolution without materializing. */
+export interface FirstPartyDependencyGraph {
+    /** The graph the SDK's directory installer consumes. */
+    readonly graph: InstallDependencyGraph;
+    /** The resolver half, callable on its own. */
+    readonly resolver: DependencyResolver;
+    /** The archive half, callable on its own. */
+    readonly archive: ArchiveSource;
+}
+/**
+ * Resolve one declared dependency from the host's installed tree.
+ *
+ * The source checkout's own ancestor chain is searched first (the tree whose
+ * `package.json` declared the dependency), then the host's own module chain, then
+ * any explicitly configured roots. The first installed package whose own
+ * `package.json` name matches wins; nothing is downloaded and no version is
+ * inferred.
+ * @param search - where to look.
+ * @param name - the declared dependency name.
+ * @param range - the declared spec, used only in the refusal message.
+ * @returns the installed dependency.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` when it is not installed.
+ */
+export declare function resolveFirstPartyDependency(search: DependencySearch, name: string, range: string): FirstPartyDependency;
+/** The archive built for one resolved dependency. */
+interface BuiltDependencyArchive {
+    /** The exact bytes the graph's archive source will serve. */
+    readonly bytes: Uint8Array;
+    /** SHA-512 of those bytes: the integrity the SDK verifies before extraction. */
+    readonly integrity: string;
+    /** The installed tree's own content digest, checked around the build. */
+    readonly contentDigest: string;
+}
+/**
+ * Build a deterministic zip of one installed dependency directory.
+ *
+ * The result is the archive the SDK's dependency graph fetches and verifies. Its
+ * SHA-512 is the integrity handed to the graph; the directory's own
+ * `digestInstalledContent` is checked before and after the build so a concurrent
+ * change refuses.
+ * @param dependency - the resolved installed dependency.
+ * @param limits - the byte bounds.
+ * @returns the archive bytes, their integrity, and the directory digest.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` for any refusal.
+ */
+export declare function buildDependencyArchive(dependency: FirstPartyDependency, limits: {
+    readonly maxSourceBytes: number;
+    readonly maxEntryBytes: number;
+    readonly maxArchiveBytes: number;
+}): BuiltDependencyArchive;
+/**
+ * How this host can supply one declared dependency.
+ *
+ * This is the narrow seam between the host's resolution policy and the SDK's
+ * dependency graph: `registry-bytes` is the verified-archive path (the SDK verifies
+ * the SHA-512 and extracts the bytes), and `preinstalled` is the operator-gated
+ * path (the SDK copies an already-materialized directory and records
+ * `provenance: 'preinstalled'`, never running a lifecycle script).
+ */
+export type DependencySupply = {
+    /** The host built verified archive bytes for this dependency. */
+    readonly kind: 'registry-bytes';
+    readonly dependency: FirstPartyDependency;
+    /** SHA-512 of exactly the bytes `archive.fetch` will serve. */
+    readonly integrity: string;
+    readonly bytes: Uint8Array;
+} | {
+    /** The host has an already-materialized installation for this dependency. */
+    readonly kind: 'preinstalled';
+    readonly dependency: FirstPartyDependency;
+    /** Documented by the SDK to mean: no lifecycle script was run by this installer. */
+    readonly provenance: 'preinstalled';
+};
+/**
+ * Create the first-party dependency graph supplied to the SDK's directory installer.
+ *
+ * Resolution and archiving happen lazily, one dependency at a time: `resolve`
+ * builds the exact bytes the SDK will verify and `fetch` hands back those same
+ * bytes, so the integrity the lock records is the integrity of the served archive
+ * rather than a value guessed from metadata. Only the most recently built archive
+ * is retained, which matches the SDK's resolve-then-fetch sequence and bounds
+ * memory to one dependency.
+ *
+ * The preinstalled-content gate is OPT-IN and OFF by default, matching the SDK:
+ * without it every dependency is served as verified bytes and EXT-10 applies. With
+ * it, the SDK requires `preinstalledRoot`, copies the resolved directory into the
+ * extension's own `node_modules`, and records `provenance: 'preinstalled'`.
+ * @param options - the search tree, bounds, gate and forwarded graph limits.
+ * @returns the install-dependency graph plus its resolver and archive halves.
+ * @throws ManagementError `DEPENDENCY_UNSATISFIED` when the gate has no root.
+ */
+export declare function createFirstPartyDependencyGraph(options: FirstPartyDependencyGraphOptions): FirstPartyDependencyGraph;
+/** Re-export for callers that want the size bound wording. */
+export { DEFAULT_ARCHIVE_LIMITS };
+/** The default npm registry. */
+export declare const DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/";
+/** How a registry operation failed. Every code is host-facing and stable. */
+export type RegistryErrorCode = 
+/** No registry URL is configured. */
+'registry-not-configured'
+/** The registry has no such package, version, or dist-tag. */
+ | 'registry-not-found'
+/** Transport failure or 5xx: the registry did not answer usefully. This is the ONLY fallback-eligible failure. */
+ | 'registry-unavailable'
+/** The metadata did not have the npm shape this client can verify. */
+ | 'registry-invalid-metadata'
+/** `dist.integrity` is absent or not a sha512 SRI string: installs are refused, never unverified. */
+ | 'registry-integrity-missing'
+/** The tarball did not download (non-2xx, truncated, aborted). */
+ | 'registry-tarball-fetch-failed'
+/** The tarball is over the configured byte cap. */
+ | 'registry-tarball-too-large'
+/** No published version satisfies the requested range. */
+ | 'registry-no-matching-version';
+/** A named registry failure. */
+export declare class RegistryError extends Error {
+    readonly name = "RegistryError";
+    readonly code: RegistryErrorCode;
+    /** Whether a directory fallback may be considered under `auto`. */
+    readonly transport: boolean;
+    constructor(code: RegistryErrorCode, message: string, options?: {
+        readonly cause?: unknown;
+        readonly transport?: boolean;
+    });
+}
+/** One package version resolved from the registry. */
+export interface RegistryPackageResolution {
+    /** The package name, exactly as requested. */
+    readonly name: string;
+    /** The EXACT published version selected. */
+    readonly version: string;
+    /** The tarball URL from `dist.tarball`. */
+    readonly tarball: string;
+    /** The registry's sha512 SRI string from `dist.integrity` (verified before extraction). */
+    readonly integrity: string;
+    /** The dist-tag that selected this version, when the request named one. */
+    readonly distTag?: string;
+}
+/** What a registry session needs. */
+export interface RegistrySessionOptions {
+    /** Registry base URL, e.g. `https://registry.npmjs.org/`. Empty is allowed and refuses at resolve time. */
+    readonly registryUrl: string;
+    /**
+     * The container decoder for the bytes the registry serves.
+     *
+     * npm serves `.tgz`; the host passes the SDK's tar-gzip ArchiveSource factory.
+     * Injectable so the session (resolution, bounds, integrity plumbing) can be
+     * tested independently of the container implementation.
+     */
+    readonly archiveFactory: (fetcher: (source: InstallSource) => Promise<Uint8Array>) => ArchiveSource;
+    /** Hard cap on one downloaded package tarball; defaults to the SDK archive bound. */
+    readonly maxTarballBytes?: number;
+    /** Packument/metadata request timeout (wall clock); default 30 s. */
+    readonly metadataTimeoutMs?: number;
+    /**
+     * Tarball IDLE timeout: abort only after this long with NO bytes arriving.
+     *
+     * A large dependency (onnxruntime-node is hundreds of MB) must not be aborted
+     * by the short metadata budget; the sha512 is verified after the transfer, so
+     * the byte cap is the real bound and a slow-but-moving stream is fine.
+     * Default 10 minutes.
+     */
+    readonly tarballTimeoutMs?: number;
+    /** Injected fetch, for tests. Defaults to the global fetch. */
+    readonly fetchImpl?: typeof fetch;
+}
+/** A registry session: version resolution plus the tarball archive over the SAME registry. */
+export interface RegistrySession {
+    /** The normalized registry base URL ('' when unconfigured). */
+    readonly registryUrl: string;
+    /** The ArchiveSource the install/dependency pipelines fetch through. */
+    readonly archive: ArchiveSource;
+    /**
+     * Resolve `<name>@<spec>` to one exact published version.
+     * @param name - the package name.
+     * @param spec - a dist-tag (`latest`), an exact version, or a semver range.
+     * @param signal - cancellation.
+     * @returns the exact version, tarball URL and sha512 integrity.
+     */
+    resolve(name: string, spec: string, signal?: AbortSignal): Promise<RegistryPackageResolution>;
+    /**
+     * Download the bytes registered for one archive source, bounded.
+     * @param source - the source returned by a previous resolve.
+     * @param signal - cancellation.
+     * @returns the tarball bytes (NOT yet digest-verified; the caller verifies).
+     */
+    download(source: InstallSource, signal?: AbortSignal): Promise<Uint8Array>;
+}
+/** The default packument timeout: metadata is small and must answer promptly. */
+export declare const DEFAULT_REGISTRY_METADATA_TIMEOUT_MS = 30000;
+/** The default tarball IDLE timeout: a large dependency may transfer for minutes. */
+export declare const DEFAULT_REGISTRY_TARBALL_TIMEOUT_MS: number;
+/**
+ * Whether one published version satisfies a semver range.
+ *
+ * Supported: exact versions, `^`, `~`, x-ranges (`1.x`, `1.2`), comparison
+ * operators (`>=`, `>`, `<=`, `<`, `=`), hyphen ranges, `||`, and `*`. NOT
+ * supported (refused rather than guessed): prerelease-only ranges and npm's
+ * `tag:` protocol. A prerelease version only matches a range that itself names a
+ * prerelease.
+ * @param versionText - the published version.
+ * @param rangeText - the requested range.
+ * @returns whether the version satisfies the range.
+ */
+export declare function satisfiesRegistryRange(versionText: string, rangeText: string): boolean;
+/**
+ * The highest published version satisfying a range.
+ * @param versions - the published version strings.
+ * @param rangeText - the requested range.
+ * @returns the highest satisfying version exactly as published, or undefined.
+ */
+export declare function highestSatisfyingVersion(versions: readonly string[], rangeText: string): string | undefined;
+/**
+ * Create a registry session over one npm registry.
+ *
+ * The same session serves the extension package and every runtime dependency, so
+ * the tarball map (key → URL) the resolver registers is the map the archive
+ * fetches through. Nothing is downloaded until a caller fetches; nothing is
+ * verified here (the SDK verifies the sha512 before extraction, and this module
+ * refuses metadata without one).
+ * @param options - registry URL, archive factory, bounds and fetch seam.
+ * @returns the session.
+ */
+export declare function createRegistrySession(options: RegistrySessionOptions): RegistrySession;
+/**
+ * Wire a registry session into the SDK dependency-graph contract.
+ *
+ * Every declared dependency is resolved to one exact published version with its
+ * sha512 integrity; the SAME session archive fetches the bytes, so the manifest
+ * the graph verifies is the manifest that was resolved. EXT-10's script refusal is
+ * the SDK's own, unchanged.
+ * @param session - the registry session.
+ * @returns the install-dependency graph.
+ */
+export declare function createRegistryDependencyGraph(session: RegistrySession): InstallDependencyGraph;
+//# sourceMappingURL=extension-dependencies.d.ts.map

package/lib/extension-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-dependencies.d.ts","sourceRoot":"","sources":["../src/extension-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAOH,OAAO,EAEL,sBAAsB,EAItB,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAA;AAU3C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAAoB,CAAA;AAE7D,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C;AAED,6DAA6D;AAC7D,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,2FAA2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzD;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AA0ED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,oBAAoB,CAsBtB;AAoGD,qDAAqD;AACrD,UAAU,sBAAsB;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE;IACN,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC,GACA,sBAAsB,CAyCxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B,GACD;IACE,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;CACpC,CAAA;AAmDL;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,yBAAyB,CAmF3B;AAED,8DAA8D;AAC9D,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAMjC,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,gCAAgC,CAAA;AAKjE,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB;AAC3B,qCAAqC;AACnC,yBAAyB;AAC3B,8DAA8D;GAC5D,oBAAoB;AACtB,kHAAkH;GAChH,sBAAsB;AACxB,sEAAsE;GACpE,2BAA2B;AAC7B,qGAAqG;GACnG,4BAA4B;AAC9B,kEAAkE;GAChE,+BAA+B;AACjC,mDAAmD;GACjD,4BAA4B;AAC9B,0DAA0D;GACxD,8BAA8B,CAAA;AAElC,gCAAgC;AAChC,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAkB;IACxC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;gBAEf,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAK3H;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,qCAAqC;AACrC,MAAM,WAAW,sBAAsB;IACrC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK,aAAa,CAAA;IACnG,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAClC;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC3E;AAeD,iFAAiF;AACjF,eAAO,MAAM,oCAAoC,QAAS,CAAA;AAE1D,qFAAqF;AACrF,eAAO,MAAM,mCAAmC,QAAc,CAAA;AAwV9D;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAsBtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS3G;AA+FD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA4FtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,eAAe,GAAG,sBAAsB,CAe9F"}