@try-works/dsh-tool-mode 0.0.0-stage → 0.5.45

package/lib/capability.js

@@ -0,0 +1,192 @@
+/**
+ * Capability resolution: decide whether a catalog model can actually run in
+ * this DSH process, and by which route.
+ *
+ * The rule this module enforces is that a model becomes a tool only when an
+ * adapter can really invoke it. Every other model stays catalogued and
+ * reportable, so `model_tools` can explain what is missing instead of the agent
+ * discovering a broken tool at call time.
+ *
+ * @module @try-works/dsh-tool-mode/capability
+ */
+import { createRequire } from 'node:module';
+import { DEFAULT_CLI_COMMAND } from "./transport.js";
+/**
+ * Node resolution context for this plugin.
+ *
+ * The plugin must resolve model packages from the DSH installation that is
+ * hosting it, not from its own nested `node_modules`, so that an operator who
+ * installs `@desert-ant-labs/tongue` into the profile gets a working tool.
+ */
+const requireFromHere = createRequire(import.meta.url);
+/**
+ * Whether a package specifier resolves from this plugin's installation.
+ *
+ * Resolution deliberately does not load the module: importing a model package
+ * pulls in a WASM or native runtime, and capability probing must stay cheap
+ * enough to run at plugin load.
+ * @param specifier - package name, optionally with a subpath.
+ * @returns whether Node can resolve the specifier.
+ */
+export function canResolve(specifier) {
+    try {
+        requireFromHere.resolve(specifier);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Join a package and its documented subpath into one specifier. */
+export function packageSpecifier(pkg, subpath) {
+    return subpath === null ? pkg : `${pkg}${subpath}`;
+}
+/** Reason text for a model that has no runnable route on any platform. */
+function unavailableReason(entry) {
+    if (entry.closedBeta) {
+        return `${entry.name} is in closed beta: the weights are published at ${entry.hfRepo} but no SDK ships them yet, so it cannot be installed as a tool.`;
+    }
+    if (entry.appleOnly) {
+        return `${entry.name} is Apple-only (Core ML/MLX through the Swift package); there is no JavaScript SDK, so it cannot run in a Node process. Point \`remote.endpoint\` at a bridge on an Apple machine to reach it.`;
+    }
+    if (entry.npmPackage === null && entry.cliVerb === null) {
+        return `${entry.name} has no npm package and no CLI verb, so no transport can reach it.`;
+    }
+    if (entry.npmPackage === null) {
+        return `${entry.name} has no npm package; run it through the Desert Ant CLI (macOS/Linux) with \`cli.enabled\`, or through a bridge with \`remote.endpoint\`.`;
+    }
+    return `${entry.name} has no runtime available to this process.`;
+}
+/** Whether the CLI can carry this model at all. */
+function cliCapable(entry) {
+    return entry.cliVerb !== null && !entry.closedBeta;
+}
+/**
+ * Resolve how (and whether) one model can run here.
+ *
+ * Transport preference is deliberate: an in-process package is fastest and
+ * needs no external service, so it wins; the CLI is local but out-of-process;
+ * the bridge is last because it depends on another machine. A user who would
+ * rather route everything through a bridge can disable the other two.
+ * @param entry - the catalog entry to resolve.
+ * @param options - overrides for testing; `resolve`, `platform` and the transport switches replace the process facts.
+ * @returns the verdict, including the reason for every negative one.
+ */
+export function resolveCapability(entry, options = {}) {
+    const resolve = options.resolve ?? canResolve;
+    const platform = options.platform ?? process.platform;
+    const allowNpm = options.allowNpm ?? true;
+    const remoteEndpoint = options.remoteEndpoint;
+    // A bridge is checked first among the fallbacks because it is the only route
+    // for Apple-only models, which have neither a package nor (for some) a verb.
+    const bridgeUsable = remoteEndpoint !== undefined && remoteEndpoint.length > 0 && !entry.closedBeta;
+    if (entry.provider !== undefined && !entry.closedBeta) {
+        const extensionManifest = `${entry.provider.extension}/package.json`;
+        if (resolve(extensionManifest)) {
+            return {
+                runnable: true,
+                route: 'extension',
+                reason: `${entry.name} is implemented by the Tool Mode extension ${entry.provider.extension}; provider readiness is checked through that extension before publication and again for discovery.`,
+                resolved: [extensionManifest],
+            };
+        }
+        return {
+            runnable: false,
+            route: 'unavailable',
+            reason: `${entry.name} declares the Tool Mode extension ${entry.provider.extension}, which is not installed or not resolvable from this host. Install and activate that extension, or correct the catalog binding.`,
+            missing: [extensionManifest],
+        };
+    }
+    const pkg = entry.npmPackage;
+    // Why the in-process route did not pan out. Kept so the final verdict can name
+    // the exact missing piece ("install onnxruntime-node") instead of falling back
+    // to a generic sentence once the CLI and bridge have also been ruled out.
+    let npmMiss;
+    if (pkg !== null && allowNpm) {
+        const missingRuntimes = entry.requiresRuntime.filter(name => !resolve(name));
+        if (missingRuntimes.length > 0) {
+            npmMiss = {
+                reason: `${entry.name} needs ${missingRuntimes.join(', ')} to run here; install it beside the plugin (npm i ${missingRuntimes.join(' ')}).`,
+                missing: missingRuntimes,
+            };
+        }
+        else {
+            const native = packageSpecifier(pkg, entry.npmSubpath);
+            const onnx = entry.requiresRuntime.length > 0;
+            // A declared ONNX runtime wins over the package's own default entry: for
+            // these packages the default import is the browser build, which refuses
+            // to initialize in Node.
+            if (onnx) {
+                if (resolve(pkg)) {
+                    return {
+                        runnable: true,
+                        route: 'npm-onnxruntime',
+                        reason: `${entry.name} runs through ${entry.requiresRuntime.join(', ')}.`,
+                        resolved: [...entry.requiresRuntime, pkg],
+                    };
+                }
+                npmMiss = {
+                    reason: `${entry.name} requires the ${pkg} package, which is not installed.`,
+                    missing: [pkg],
+                };
+            }
+            else if (platform === 'win32' && entry.windowsSupport === 'browser-only') {
+                npmMiss = {
+                    reason: `${entry.name} has no prebuilt native build for win32-${process.arch}: ${native} supports linux-x64, linux-arm64 and darwin-arm64 only.`,
+                    missing: [native],
+                };
+            }
+            else if (resolve(native)) {
+                return {
+                    runnable: true,
+                    route: 'npm-native',
+                    reason: `${entry.name} resolves ${native} for this platform.`,
+                    resolved: [native],
+                };
+            }
+            else {
+                npmMiss = {
+                    reason: `${entry.name} requires the ${native} package, which is not installed.`,
+                    missing: [native],
+                };
+            }
+        }
+    }
+    // The CLI runs every shipping model on macOS and Linux, so it is checked
+    // before giving up — including for models whose npm prebuild is missing here.
+    if (cliCapable(entry) && (options.cliAvailable ?? false)) {
+        return {
+            runnable: true,
+            route: 'cli',
+            reason: `${entry.name} runs through the Desert Ant CLI (\`${DEFAULT_CLI_COMMAND} ${entry.cliVerb}\`).`,
+            resolved: [DEFAULT_CLI_COMMAND],
+        };
+    }
+    if (bridgeUsable) {
+        return {
+            runnable: true,
+            route: 'remote',
+            reason: `${entry.name} is reached through the bridge at ${remoteEndpoint}.`,
+            resolved: [remoteEndpoint],
+        };
+    }
+    if (npmMiss !== undefined && !entry.closedBeta && !entry.appleOnly) {
+        return {
+            runnable: false,
+            route: 'unavailable',
+            reason: npmMiss.reason,
+            missing: npmMiss.missing,
+        };
+    }
+    return { runnable: false, route: 'unavailable', reason: unavailableReason(entry) };
+}
+/**
+ * Resolve every catalog entry.
+ * @param entries - validated catalog entries.
+ * @param options - resolution overrides, forwarded to {@link resolveCapability}.
+ * @returns one record per entry, in catalog order.
+ */
+export function resolveCatalog(entries, options = {}) {
+    return entries.map(entry => ({ entry, verdict: resolveCapability(entry, options) }));
+}
+//# sourceMappingURL=capability.js.map

package/lib/capture-path.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The full capture path, and the metadata-only profile (OBS-03).
+ *
+ * THE PREMISE OBS-03 STARTS FROM, and it is the uncomfortable one: **this plugin's defaults
+ * cannot guarantee privacy.** A body that is never written by us may still be captured by
+ * ANOTHER DSH logging plugin, because DSH's LLM service requires model-visible inputs to be
+ * reconstructable — so a harness call's prompt necessarily passes through a surface a sibling
+ * plugin can observe. Nothing this plugin does can close that.
+ *
+ * What this plugin CAN do is be honest about it, which is what the requirement asks for in three
+ * parts:
+ *
+ *  1. **Document the full capture path** — every place a body can come to rest, including the
+ *     ones outside this plugin's control. A privacy claim that names only our own writes is
+ *     misleading precisely because the reader will assume it is complete.
+ *  2. **Provide and TEST a metadata-only profile** for the headless local-specialist case, where
+ *     an operator wants the tools without any body retention.
+ *  3. **REFUSE rather than silently log** where a no-retention policy cannot be honoured
+ *     alongside DSH's reconstructability contract. `harnessExecutionDecision` in
+ *     `diagnostics.ts` makes that decision; this module says which profile it applies to.
+ *
+ * @module @try-works/dsh-tool-mode/capture-path
+ */
+/** Where a request or response body can come to rest. */
+export interface CaptureSurface {
+    /** A stable name for the surface. */
+    readonly surface: string;
+    /**
+     * Whether THIS plugin writes bodies there.
+     *
+     * `false` does not mean the surface is safe — it means this plugin is not the author. That
+     * distinction is the whole reason the field exists: a reader must not mistake "we do not
+     * write here" for "nothing is written here".
+     */
+    readonly writtenByThisPlugin: boolean;
+    /** What actually lands there. */
+    readonly contents: string;
+    /** What an operator can do about it. */
+    readonly control: string;
+}
+/**
+ * The FULL capture path, including surfaces outside this plugin's control.
+ *
+ * Ordered from what this plugin owns to what it does not, so a reader sees the boundary
+ * explicitly rather than inferring it from a list of our own writes.
+ */
+export declare const CAPTURE_PATH: readonly CaptureSurface[];
+/** Which capture policy a deployment runs under (OBS-03). */
+export type CaptureProfile = 
+/** Ordinary operation: receipts and accounting, bodies owned by the surfaces above. */
+'standard'
+/**
+ * Headless local-specialist: METADATA ONLY.
+ *
+ * Composed by an operator who wants the tools without any body retention at all. Everything
+ * this plugin writes is metadata; the profile additionally forbids the one path where this
+ * plugin could be the author of a body, and refuses harness-backed execution when the
+ * deployment's policy cannot satisfy DSH's reconstructability contract.
+ */
+ | 'metadata-only';
+/** What a profile permits. */
+export interface ProfilePolicy {
+    readonly profile: CaptureProfile;
+    /** Whether this profile may serve harness-backed (model-calling) tools at all. */
+    readonly permitsHarnessExecution: boolean;
+    /** Whether this plugin writes any request or response BODY. */
+    readonly writesBodies: boolean;
+    /** Surfaces this profile does not close, so a reader sees the residual risk. */
+    readonly residualSurfaces: readonly string[];
+}
+/**
+ * Describe a profile's policy.
+ *
+ * @param profile - the profile to describe.
+ * @param policy - the deployment's retention facts.
+ * @returns what the profile permits, and what it does not close.
+ */
+export declare function profilePolicy(profile: CaptureProfile, policy: {
+    readonly retainsBodies: boolean;
+    readonly requiresReconstructableInputs: boolean;
+}): ProfilePolicy;
+/**
+ * Whether a profile may serve one tool.
+ *
+ * @param profile - the active profile.
+ * @param policy - the deployment's retention facts.
+ * @param harnessBacked - whether the tool calls a model.
+ * @returns the decision, with the reason when it refuses.
+ */
+export declare function admitsTool(profile: CaptureProfile, policy: {
+    readonly retainsBodies: boolean;
+    readonly requiresReconstructableInputs: boolean;
+}, harnessBacked: boolean): {
+    readonly admitted: boolean;
+    readonly reason?: string;
+};
+//# sourceMappingURL=capture-path.d.ts.map

package/lib/capture-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-path.d.ts","sourceRoot":"","sources":["../src/capture-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAuEjD,CAAA;AAED,6DAA6D;AAC7D,MAAM,MAAM,cAAc;AACxB,uFAAuF;AACrF,UAAU;AACZ;;;;;;;GAOG;GACD,eAAe,CAAA;AAEnB,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,kFAAkF;IAClF,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAA;CAAE,GAC3F,aAAa,CA+Bf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE;IAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAA;CAAE,EAC5F,aAAa,EAAE,OAAO,GACrB;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiB1D"}

package/lib/capture-path.js

@@ -0,0 +1,152 @@
+/**
+ * The full capture path, and the metadata-only profile (OBS-03).
+ *
+ * THE PREMISE OBS-03 STARTS FROM, and it is the uncomfortable one: **this plugin's defaults
+ * cannot guarantee privacy.** A body that is never written by us may still be captured by
+ * ANOTHER DSH logging plugin, because DSH's LLM service requires model-visible inputs to be
+ * reconstructable — so a harness call's prompt necessarily passes through a surface a sibling
+ * plugin can observe. Nothing this plugin does can close that.
+ *
+ * What this plugin CAN do is be honest about it, which is what the requirement asks for in three
+ * parts:
+ *
+ *  1. **Document the full capture path** — every place a body can come to rest, including the
+ *     ones outside this plugin's control. A privacy claim that names only our own writes is
+ *     misleading precisely because the reader will assume it is complete.
+ *  2. **Provide and TEST a metadata-only profile** for the headless local-specialist case, where
+ *     an operator wants the tools without any body retention.
+ *  3. **REFUSE rather than silently log** where a no-retention policy cannot be honoured
+ *     alongside DSH's reconstructability contract. `harnessExecutionDecision` in
+ *     `diagnostics.ts` makes that decision; this module says which profile it applies to.
+ *
+ * @module @try-works/dsh-tool-mode/capture-path
+ */
+/**
+ * The FULL capture path, including surfaces outside this plugin's control.
+ *
+ * Ordered from what this plugin owns to what it does not, so a reader sees the boundary
+ * explicitly rather than inferring it from a list of our own writes.
+ */
+export const CAPTURE_PATH = [
+    {
+        surface: 'tool invocation arguments',
+        writtenByThisPlugin: false,
+        contents: 'The arguments a caller passes to a tool. They reach the implementation, and for a '
+            + 'harness-backed tool they become part of the rendered prompt.',
+        control: 'The caller decides what to pass. This plugin adds nothing to the arguments and copies '
+            + 'them nowhere.',
+    },
+    {
+        surface: 'managed-worker stdout/stderr',
+        writtenByThisPlugin: false,
+        contents: 'Whatever an extension process prints. An extension that logs its own inputs puts bodies '
+            + 'into a stream this plugin does not author or read.',
+        control: 'Extension authors control their own logging. The isolation mode is declared in the '
+            + 'manifest, and the diagnostics surface reports it.',
+    },
+    {
+        surface: 'DSH LLM service',
+        writtenByThisPlugin: false,
+        contents: 'THE SURFACE THIS PLUGIN CANNOT CLOSE. DSH requires model-visible inputs to be '
+            + 'reconstructable, so a harness call\'s prompt passes through the LLM service by design.',
+        control: 'An operator-level policy, not a plugin setting. Where no-retention conflicts with '
+            + 'reconstructability, the correct response is to REFUSE harness-backed execution — which '
+            + 'this plugin does rather than logging bodies or bypassing DSH.',
+    },
+    {
+        surface: 'another DSH logging plugin',
+        writtenByThisPlugin: false,
+        contents: 'Any body a sibling plugin observes through a DSH hook. This plugin neither knows what '
+            + 'they capture nor can it prevent them.',
+        control: 'Operator configuration of the OTHER plugin. This is the specific case OBS-03 names, and '
+            + 'it is why the plugin defaults cannot be presented as a privacy guarantee.',
+    },
+    {
+        surface: 'the auxiliary-call journal (section 19)',
+        writtenByThisPlugin: true,
+        contents: 'Harness-backed auxiliary calls, recorded under a SEPARATE authorization from ordinary '
+            + 'tool receipts. The broker refuses to construct without a journal sink, so a '
+            + 'harness-backed run that records nothing cannot exist.',
+        control: 'A deployment composes the sink or the broker refuses. The journal is the mechanism that '
+            + 'makes a harness call auditable without putting its body in an ordinary log.',
+    },
+    {
+        surface: 'invocation accounting',
+        writtenByThisPlugin: true,
+        contents: 'Timings, outcome class and byte SIZES. The record has no field that can hold a payload, '
+            + 'which is asserted structurally rather than promised.',
+        control: 'Always on. There is nothing to configure because there is nothing sensitive in it.',
+    },
+    {
+        surface: 'tool receipts',
+        writtenByThisPlugin: true,
+        contents: 'Identity and provenance — contract, implementation, extension version, content digest, '
+            + 'activation generation, caller scope. No credentials and no bodies.',
+        control: 'Disabled by an explicit configuration flag, which is visible on the diagnostics surface.',
+    },
+];
+/**
+ * Describe a profile's policy.
+ *
+ * @param profile - the profile to describe.
+ * @param policy - the deployment's retention facts.
+ * @returns what the profile permits, and what it does not close.
+ */
+export function profilePolicy(profile, policy) {
+    /**
+     * The surfaces no profile can close, listed for BOTH profiles because the difference between
+     * them is what THIS plugin writes — not what a sibling plugin does.
+     */
+    const residualSurfaces = CAPTURE_PATH
+        .filter(surface => !surface.writtenByThisPlugin)
+        .map(surface => surface.surface);
+    if (profile === 'standard') {
+        return {
+            profile,
+            permitsHarnessExecution: true,
+            writesBodies: false,
+            residualSurfaces,
+        };
+    }
+    /**
+     * METADATA ONLY. The plugin still writes no bodies — it never did — and the profile adds the
+     * REFUSAL: where a no-retention policy conflicts with DSH's reconstructability requirement,
+     * harness-backed execution is not served at all. Logging bodies against the policy and
+     * bypassing DSH are both forbidden, which leaves refusing.
+     */
+    const conflict = !policy.retainsBodies && policy.requiresReconstructableInputs;
+    return {
+        profile,
+        permitsHarnessExecution: !conflict,
+        writesBodies: false,
+        residualSurfaces,
+    };
+}
+/**
+ * Whether a profile may serve one tool.
+ *
+ * @param profile - the active profile.
+ * @param policy - the deployment's retention facts.
+ * @param harnessBacked - whether the tool calls a model.
+ * @returns the decision, with the reason when it refuses.
+ */
+export function admitsTool(profile, policy, harnessBacked) {
+    const described = profilePolicy(profile, policy);
+    /**
+     * A NON-harness tool is admitted under every profile: it calls no model, so there is no body
+     * for the reconstructability contract to be about, and refusing it would remove working
+     * functionality for no privacy gain.
+     */
+    if (!harnessBacked)
+        return { admitted: true };
+    if (described.permitsHarnessExecution)
+        return { admitted: true };
+    return {
+        admitted: false,
+        reason: 'the metadata-only profile refuses harness-backed execution because the deployment does '
+            + 'not retain bodies while DSH requires model-visible inputs to be reconstructable. '
+            + 'Logging bodies against the policy and bypassing DSH are both forbidden, so the tool is '
+            + 'not served.',
+    };
+}
+//# sourceMappingURL=capture-path.js.map

package/lib/catalog.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Loads and validates the Desert Ant Labs model catalog.
+ *
+ * The catalog is plain JSON shipped beside the plugin so that a deployment can
+ * inspect or override it without rebuilding: `catalogFile` points at another
+ * document with the same shape.
+ *
+ * @module @try-works/dsh-tool-mode/catalog
+ */
+import type { ModelCatalogEntry } from './types.ts';
+/** Absolute path of the catalog document shipped with this package. */
+export declare const DEFAULT_CATALOG_FILE: string;
+/** Raised when the catalog document is missing, unparseable, or malformed. */
+export declare class CatalogError extends Error {
+    readonly name = "CatalogError";
+}
+/**
+ * Parse and validate one catalog entry. Validation is strict on purpose: every
+ * downstream decision (which tool to register, whether it can run, what the
+ * model sees) reads these fields, so a malformed entry must fail at load rather
+ * than become a silently missing tool.
+ * @param raw - one decoded JSON object.
+ * @param source - description of where the document came from, for messages.
+ * @param index - position in the array, for entries with no usable id.
+ * @returns the validated entry.
+ */
+export declare function parseCatalogEntry(raw: unknown, source: string, index: number): ModelCatalogEntry;
+/**
+ * Load the catalog from a JSON document.
+ * @param file - absolute path of the catalog document.
+ * @returns every validated entry, in document order.
+ * @throws CatalogError when the file cannot be read, is not valid JSON, is not an array, or holds a malformed entry.
+ */
+export declare function loadCatalog(file?: string): ModelCatalogEntry[];
+/** Index a catalog by model id. */
+export declare function indexCatalog(entries: readonly ModelCatalogEntry[]): Map<string, ModelCatalogEntry>;
+//# sourceMappingURL=catalog.d.ts.map

package/lib/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAA0D,MAAM,YAAY,CAAA;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,QAEhC,CAAA;AAWD,8EAA8E;AAC9E,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,kBAAiB;CACxC;AAyGD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAuGhG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAA6B,GAAG,iBAAiB,EAAE,CA6BpF;AAED,mCAAmC;AACnC,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAElG"}