@try-works/dsh-tool-mode 0.0.0-stage → 0.5.45

package/lib/harness-serving.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Serving a declarative package's recipes through a deployment-supplied harness provider.
+ *
+ * THE LAST LINK OF SLICE 3, and the reason it is a module rather than a few lines in the host:
+ * this is where a resolved RECIPE becomes a callable TOOL, and the pieces have to be joined in a
+ * specific order for the authorization to mean anything.
+ *
+ * WHAT THIS DELIBERATELY IS NOT. It does not construct an `LlmProvider`. Which model answers a
+ * harness call is a deployment's business, and this plugin holds no model-specific code — that
+ * is an architectural rule the repository enforces with a gate. Instead a deployment SUPPLIES a
+ * provider and this module does the joining: authorize the recipe's tool name, run through the
+ * broker, and refuse honestly when no provider was supplied.
+ *
+ * WHY THE REFUSAL IS STILL THE DEFAULT. A declarative package resolves and its recipes parse,
+ * and without a provider nothing can call a model. Serving the tool anyway would present a tool
+ * that fails at invocation, so the refusal happens at RESOLUTION — where a reader can see why —
+ * rather than at the first call.
+ *
+ * @module @try-works/dsh-tool-mode/harness-serving
+ */
+import { type BrokerErrorCode, type BrokerHostPolicy, type BrokerRecord, type LlmProvider } from '@try-works/tool-mode-recipes';
+/** A deployment's harness composition. */
+export interface HarnessComposition {
+    /**
+     * The provider that answers harness calls, supplied by the DEPLOYMENT.
+     *
+     * Absent when a deployment composes none — which is the state this plugin ships in, and the
+     * state the refusal exists for.
+     */
+    readonly provider?: LlmProvider;
+    /**
+     * Where invocation records go.
+     *
+     * The broker REFUSES TO CONSTRUCT without one, because a broker that records nothing cannot be
+     * audited. Making it required here means a caller cannot compose a harness path that silently
+     * reports nothing — the failure is at construction rather than at audit time.
+     */
+    readonly journal: (record: BrokerRecord) => void;
+    /**
+     * Operator-bound logical executor profiles (HLM-02/RCP-05). A recipe selecting
+     * `approved-profile` resolves ONLY through this map; the version is visible so a
+     * profile change is auditable.
+     */
+    readonly profiles?: Readonly<Record<string, {
+        readonly provider: LlmProvider;
+        readonly version: string;
+    }>>;
+}
+/**
+ * A harness call the caller CANCELLED.
+ *
+ * Distinct from `HarnessFailedError` on purpose: a caller who walked away is not a malfunction,
+ * and conflating the two makes every cancellation look like a fault. The same discipline the
+ * invocation accounting applies to `cancelled`.
+ */
+export declare class HarnessCancelledError extends Error {
+    readonly toolName: string;
+    readonly reason: string;
+    readonly name = "HarnessCancelledError";
+    constructor(toolName: string, reason: string);
+}
+/**
+ * A harness call that FAILED, carrying the broker's machine-readable code.
+ *
+ * The code is preserved rather than flattened into a message, so a caller branches on the CAUSE
+ * instead of matching prose.
+ */
+export declare class HarnessFailedError extends Error {
+    readonly toolName: string;
+    readonly code: BrokerErrorCode;
+    readonly reason: string;
+    readonly name = "HarnessFailedError";
+    constructor(toolName: string, code: BrokerErrorCode, reason: string);
+}
+/** A recipe made callable. */
+export interface ServedRecipe {
+    readonly implementationId: string;
+    /** The operator-bound profile used, when the recipe selected one. */
+    readonly providerProfile?: {
+        readonly name: string;
+        readonly version: string;
+    };
+    readonly contractId: string;
+    readonly toolName: string;
+    /** DECL-08: sha256 of the installed recipe bytes. */
+    readonly recipeDigest?: string;
+    /** Run the recipe. Throws with the broker's own reason when it cannot. */
+    readonly invoke: (args: Record<string, unknown>, signal?: AbortSignal, grantOptions?: {
+        readonly policy?: BrokerHostPolicy;
+        readonly deadlineMs?: number;
+    }) => Promise<unknown>;
+}
+/** The outcome of preparing a declarative package's recipes. */
+export type ServeOutcome = {
+    readonly ok: true;
+    readonly served: readonly ServedRecipe[];
+} | {
+    readonly ok: false;
+    readonly code: 'no-provider' | 'recipe-rejected';
+    readonly detail: string;
+};
+/**
+ * Prepare a declarative package's resolved recipes for serving.
+ *
+ * @param composition - the deployment's harness composition.
+ * @param resolved - the recipes resolved through the convention.
+ * @returns the served recipes, or the reason none can be served.
+ */
+export declare function prepareDeclarative(composition: HarnessComposition, resolved: readonly {
+    readonly id: string;
+    readonly contractId: string;
+    readonly recipe: unknown;
+    readonly recipeDigest?: string;
+}[]): ServeOutcome;
+//# sourceMappingURL=harness-serving.d.ts.map

package/lib/harness-serving.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-serving.d.ts","sourceRoot":"","sources":["../src/harness-serving.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,WAAW,EAEjB,MAAM,8BAA8B,CAAA;AAErC,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAC3G;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAElC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;IAD9D,SAAkB,IAAI,2BAA0B;gBAC3B,QAAQ,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAG/D;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAE/B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;IAD9F,SAAkB,IAAI,wBAAuB;gBACxB,QAAQ,EAAE,MAAM,EAAW,IAAI,EAAE,eAAe,EAAW,MAAM,EAAE,MAAM;CAG/F;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,EACpB,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAChF,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB;AAED,gEAAgE;AAChE,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAErG;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAClI,YAAY,CAgHd"}

package/lib/harness-serving.js

@@ -0,0 +1,176 @@
+/**
+ * Serving a declarative package's recipes through a deployment-supplied harness provider.
+ *
+ * THE LAST LINK OF SLICE 3, and the reason it is a module rather than a few lines in the host:
+ * this is where a resolved RECIPE becomes a callable TOOL, and the pieces have to be joined in a
+ * specific order for the authorization to mean anything.
+ *
+ * WHAT THIS DELIBERATELY IS NOT. It does not construct an `LlmProvider`. Which model answers a
+ * harness call is a deployment's business, and this plugin holds no model-specific code — that
+ * is an architectural rule the repository enforces with a gate. Instead a deployment SUPPLIES a
+ * provider and this module does the joining: authorize the recipe's tool name, run through the
+ * broker, and refuse honestly when no provider was supplied.
+ *
+ * WHY THE REFUSAL IS STILL THE DEFAULT. A declarative package resolves and its recipes parse,
+ * and without a provider nothing can call a model. Serving the tool anyway would present a tool
+ * that fails at invocation, so the refusal happens at RESOLUTION — where a reader can see why —
+ * rather than at the first call.
+ *
+ * @module @try-works/dsh-tool-mode/harness-serving
+ */
+import { HarnessBroker, parseRecipe, } from '@try-works/tool-mode-recipes';
+/**
+ * A harness call the caller CANCELLED.
+ *
+ * Distinct from `HarnessFailedError` on purpose: a caller who walked away is not a malfunction,
+ * and conflating the two makes every cancellation look like a fault. The same discipline the
+ * invocation accounting applies to `cancelled`.
+ */
+export class HarnessCancelledError extends Error {
+    toolName;
+    reason;
+    name = 'HarnessCancelledError';
+    constructor(toolName, reason) {
+        super(`the harness recipe ${toolName} was cancelled: ${reason}`);
+        this.toolName = toolName;
+        this.reason = reason;
+    }
+}
+/**
+ * A harness call that FAILED, carrying the broker's machine-readable code.
+ *
+ * The code is preserved rather than flattened into a message, so a caller branches on the CAUSE
+ * instead of matching prose.
+ */
+export class HarnessFailedError extends Error {
+    toolName;
+    code;
+    reason;
+    name = 'HarnessFailedError';
+    constructor(toolName, code, reason) {
+        super(`the harness recipe ${toolName} failed (${code}): ${reason}`);
+        this.toolName = toolName;
+        this.code = code;
+        this.reason = reason;
+    }
+}
+/**
+ * Prepare a declarative package's resolved recipes for serving.
+ *
+ * @param composition - the deployment's harness composition.
+ * @param resolved - the recipes resolved through the convention.
+ * @returns the served recipes, or the reason none can be served.
+ */
+export function prepareDeclarative(composition, resolved) {
+    /**
+     * NO PROVIDER MEANS NO SERVING, and the refusal names the composition rather than the package.
+     * A reader who is told "the package is declarative" would look in the wrong place: the package
+     * is complete and its recipes resolve.
+     */
+    if (composition.provider === undefined && composition.profiles === undefined) {
+        return {
+            ok: false,
+            code: 'no-provider',
+            detail: 'this deployment composes no harness LlmProvider, so a declarative package\'s recipes '
+                + 'cannot be executed. The recipes resolved and the broker is available; what is absent '
+                + 'is the provider that would answer a model call.',
+        };
+    }
+    const broker = new HarnessBroker({ record: composition.journal });
+    const served = [];
+    for (const entry of resolved) {
+        /**
+         * THE RECIPE IS VALIDATED HERE, and it previously was not — a HIGH-severity gap found by
+         * adversarial review.
+         *
+         * This line used to be a bare cast: `entry.recipe as RecipeManifest`. The production resolver
+         * hands over raw `JSON.parse` output, so NOTHING validated the file between disk and
+         * execution. The review took `text-title.json` and applied one mutation at a time — an
+         * unexpected `tools` array, a `systemPrompt`, a `${process.env.SECRET_KEY}` interpolation, an
+         * uppercase or path-like tool name, `__proto__`, an absurd `maxOutputTokens`, a missing
+         * `policy`, a missing `inputs`. `parseRecipe` REFUSED ALL TEN; `prepareDeclarative` SERVED ALL
+         * TEN, and they executed. The validator was available and imported by the test that was
+         * supposed to cover this path — and bypassed by the only path that runs a recipe.
+         *
+         * A cast is a claim about a value the compiler cannot check, and here the claim was false for
+         * exactly the inputs an untrusted package would supply.
+         */
+        const parsed = parseRecipe(entry.recipe);
+        if (!parsed.ok) {
+            return {
+                ok: false,
+                code: 'recipe-rejected',
+                detail: `${entry.id}: the recipe did not validate: ${JSON.stringify(parsed).slice(0, 300)}`,
+            };
+        }
+        const recipe = parsed.recipe;
+        /**
+         * AUTHORIZATION IS PER TOOL NAME, and it happens BEFORE anything is served. A recipe whose
+         * name was never authorized must not become callable, or the broker would refuse at
+         * invocation — a failure far from its cause.
+         */
+        const toolName = recipe.tool.name;
+        let recipeProvider = composition.provider;
+        let providerProfile;
+        if (recipe.modelSelection?.strategy === 'approved-profile') {
+            const binding = composition.profiles?.[recipe.modelSelection.profile];
+            // An unresolved logical profile makes the tool UNAVAILABLE, never routable to
+            // another provider and never a silent fallback (RCP-05/HLM-02).
+            if (binding === undefined)
+                continue;
+            recipeProvider = binding.provider;
+            providerProfile = { name: recipe.modelSelection.profile, version: binding.version };
+        }
+        if (recipeProvider === undefined)
+            continue;
+        try {
+            broker.authorize(toolName, recipeProvider);
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: 'recipe-rejected',
+                detail: `${entry.id}: the broker refused to authorize ${toolName}: `
+                    + `${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        served.push({
+            implementationId: entry.id,
+            contractId: entry.contractId,
+            toolName,
+            ...providerProfile === undefined ? {} : { providerProfile },
+            ...entry.recipeDigest === undefined ? {} : { recipeDigest: entry.recipeDigest },
+            async invoke(args, signal, grantOptions) {
+                const outcome = await broker.run(recipe, args, {
+                    ...signal === undefined ? {} : { signal },
+                    ...grantOptions?.policy === undefined ? {} : { policy: grantOptions.policy },
+                    ...grantOptions?.deadlineMs === undefined ? {} : { deadlineMs: grantOptions.deadlineMs },
+                });
+                if (outcome.kind === 'completed')
+                    return outcome.text;
+                /**
+                 * THE BROKER'S NON-COMPLETED VARIANTS ARE `failed` AND `cancelled` — and an earlier
+                 * version of this comment named `refused`, `truncated` and `tool_call` instead.
+                 *
+                 * Those are variants of `LlmCompletion`, the PROVIDER's reply, not of `BrokerOutcome`,
+                 * what `run` returns. They were plausible and wrong, and the difference is not academic:
+                 * a reader trusting the comment would handle cases that cannot occur here and miss the
+                 * one that can.
+                 *
+                 * CANCELLATION IS NOT A FAILURE, and it used to be thrown as an indistinguishable Error.
+                 * The same discipline applies here as in the invocation accounting: a caller who walked
+                 * away must be able to tell that from a malfunction, or every cancellation inflates the
+                 * error rate. `HarnessCancelledError` exists so it can.
+                 */
+                if (outcome.kind === 'cancelled') {
+                    throw new HarnessCancelledError(toolName, outcome.reason);
+                }
+                // `failed` carries the broker's own machine-readable code, so a caller can branch on the
+                // CAUSE rather than matching on a message.
+                throw new HarnessFailedError(toolName, outcome.code, outcome.reason);
+            },
+        });
+    }
+    return { ok: true, served };
+}
+//# sourceMappingURL=harness-serving.js.map

package/lib/headless.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The REAL headless `serve` composition entry (RUN-03, task-74).
+ *
+ * Composes the host services the plugin needs WITHOUT the DSH CLI context:
+ * config load (file/env), the extension-store-less operator surface, the model
+ * catalog with capability resolution, the standard-contract bindings with the
+ * SAME selection rule the plugin applies (providers override, else the first
+ * eligible implementation), the MCP host over those bindings plus `model_tools`
+ * and the `tool_mode_run` contract, and a bounded graceful shutdown on
+ * SIGINT/SIGTERM.
+ *
+ * Two boundaries are deliberate and named, not faked:
+ * - `tool_mode_run` is REGISTERED (its contract appears on tools/list) but its
+ *   execution refuses: a headless process composes no DSH hosted-code runtime
+ *   (the plugin's ProgramRunner needs the DSH PtcHostContext), and pretending
+ *   otherwise would claim a confinement the deployment does not have.
+ * - Extension-routed models resolve through the same bridge as the plugin; a
+ *   model the headless deployment cannot run simply has no tool, exactly like
+ *   the plugin.
+ *
+ * @module @try-works/dsh-tool-mode/headless
+ */
+/** The headless config document (the same Config surface, parsed loosely). */
+interface HeadlessConfig {
+    readonly catalogFile?: string;
+    readonly allowNpm?: boolean;
+    readonly providers?: Record<string, string>;
+    readonly grantId?: string;
+    readonly recordReceipts?: boolean;
+    readonly approvedRoots?: string[];
+    readonly cli?: {
+        enabled?: boolean;
+        command?: string;
+    };
+    readonly remote?: {
+        endpoint?: string;
+        token?: string;
+    };
+    readonly registerControlTool?: boolean;
+    readonly mcpV3?: {
+        host?: string;
+        port?: number;
+        path?: string;
+    };
+    readonly repairAttempts?: number;
+    readonly harnessExecutorV3?: {
+        defaultRepairAttempts?: number;
+    };
+    readonly [key: string]: unknown;
+}
+/** A named headless-configuration error. */
+export declare class HeadlessConfigError extends Error {
+    readonly name = "HeadlessConfigError";
+}
+/** Read and validate the headless config document. */
+export declare function readHeadlessConfig(configPath: string | undefined, env: NodeJS.ProcessEnv): {
+    config: HeadlessConfig;
+    path: string;
+};
+/** One started headless serve, with its shutdown. */
+export interface HeadlessServe {
+    /** The URL clients should use. */
+    readonly url: string;
+    /** The host/port actually bound. */
+    readonly host: string;
+    readonly port: number;
+    /** Close the server and settle owned resources (bounded). */
+    close(): Promise<void>;
+}
+/**
+ * Start the headless serve composition (RUN-03).
+ *
+ * @param configPath - the config file path; falls back to DSH_TOOL_MODE_CONFIG
+ *   then ./tool-mode.json.
+ * @returns the bound endpoint and a shutdown handle.
+ * @throws HeadlessConfigError for a missing/invalid configuration.
+ */
+export declare function startHeadlessServe(configPath?: string): Promise<HeadlessServe>;
+/**
+ * Run the headless serve as a PROCESS (the launcher entry): prints the bound
+ * endpoint and waits for SIGINT/SIGTERM, then exits 0 after a bounded shutdown.
+ *
+ * @param options - the config path and the JSON-mode flag.
+ * @param io - output sinks (injected for tests).
+ * @returns the process exit code.
+ */
+export declare function runHeadlessServe(options: {
+    readonly configPath?: string;
+    readonly json?: boolean;
+}, io: {
+    readonly out: (line: string) => void;
+    readonly err: (line: string) => void;
+}, signals?: {
+    once(name: 'SIGINT' | 'SIGTERM', handler: () => void): void;
+}): Promise<number>;
+export {};
+//# sourceMappingURL=headless.d.ts.map

package/lib/headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../src/headless.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA2BH,8EAA8E;AAC9E,UAAU,cAAc;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED,4CAA4C;AAC5C,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,yBAAwB;CAC/C;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IAC1F,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb,CAoCA;AAqDD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,6DAA6D;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgNpF;AAwBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EAClE,EAAE,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAClF,OAAO,GAAE;IAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAA;CAAY,GACjF,OAAO,CAAC,MAAM,CAAC,CA6BjB"}