@try-works/dsh-tool-mode 0.0.0-stage → 0.5.45

package/lib/index.d.ts

@@ -0,0 +1,546 @@
+/**
+ * dsh-tool-mode — install on-device models as DSH tools and skills.
+ *
+ * The plugin composes five layers: a JSON catalog describing every model, a
+ * capability resolver that decides which of them can run in this process, an
+ * adapter per runnable model, a registrar that turns each one into a DSH tool,
+ * and a skill per tool that teaches the agent when to reach for it.
+ *
+ * Nothing is imported from a model package at plugin load, so a deployment that
+ * installs none of them still starts cleanly and reports exactly what is
+ * missing. A model only becomes a tool when its adapter can really invoke it.
+ *
+ * @module @try-works/dsh-tool-mode
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { type ResolvedModel } from './capability.ts';
+import { type HarnessModelConfig } from './harness-llm.ts';
+import { type JevConfig } from './jev.ts';
+import { type LlmProvider } from '@try-works/tool-mode-recipes';
+import type { AcquisitionSource } from './asset-acquisition.ts';
+import type { ClientGrantConfig } from './mcp/client-grant.ts';
+export declare const name = "model-tools";
+export declare const inject: string[];
+/** Plugin configuration. */
+export interface Config {
+    /** Catalog document to load; defaults to the bundled Desert Ant catalog. */
+    catalogFile?: string;
+    /** Playbook document to load; defaults to the bundled playbooks. */
+    playbookFile?: string;
+    /**
+     * Model ids to expose. An empty list (the default) means every model that can
+     * run here; a non-empty list is intersected with what can run, so naming an
+     * unsupported model never registers a tool that would fail at call time.
+     *
+     * The field is an empty array rather than `undefined` when unset: the config
+     * schema materializes a declared array, so the code treats empty as "no
+     * explicit allowlist" instead of "expose nothing".
+     */
+    models?: string[];
+    /** Model ids to exclude, applied after `models`. */
+    exclude?: string[];
+    /**
+     * Register a tool for a model whose runtime is missing, so the failure is
+     * reported at call time instead of the tool being absent. Off by default:
+     * exposing a tool that cannot work wastes a model turn.
+     */
+    exposeUnavailable?: boolean;
+    /** Publish one skill per registered tool. Default true. */
+    registerSkills?: boolean;
+    /** Register the `model_tools` inspection tool. Default true. */
+    registerControlTool?: boolean;
+    /**
+     * Register the separate management tool (`model_tools_manage`). Default false:
+     * discovery (`model_tools`) is read-only unless the operator explicitly grants
+     * model/extension/credential mutations.
+     */
+    managementGrant?: boolean;
+    /**
+     * Tool names whose canonical result is confidential (MCP-11). They are blocked at
+     * the MCP and Code Mode boundaries before any value is returned; native callers
+     * unaffected by this external-surface policy.
+     */
+    confidentialTools?: string[];
+    /**
+     * The operator's CONSENT to hosted code execution (CODE-10).
+     *
+     * Code execution is a SEPARATE consent from ordinary model-tool access, and it
+     * ships disabled until granted. This flag is the grant: the operator turns it
+     * on explicitly. It is checked in addition to — never instead of — the
+     * confinement gate (CODE-09), which remains closed until the confinement
+     * acceptance tests pass, so flipping this flag alone cannot expose the runtime.
+     * Default false.
+     */
+    hostedCode?: boolean;
+    /**
+     * LIC-04: a strict no-network deployment. Extensions whose DECLARED network
+     * behaviour is not eligible are refused at activation, rather than having their
+     * telemetry silently suppressed. Default `any`.
+     */
+    networkPolicy?: 'any' | 'no-network';
+    /**
+     * The Desert Ant CLI transport, which runs on macOS and Linux and can reach
+     * every shipping model — including the Apple-only ones that have no npm
+     * package.
+     */
+    cli?: {
+        /** Whether the CLI may be used when it is found on PATH. Default true. */
+        enabled?: boolean;
+        /** Command name or absolute path. Default `desertant`. */
+        command?: string;
+    };
+    /**
+     * A user-hosted bridge, reached over HTTP, for models this machine cannot run
+     * itself — most importantly the Apple-only models.
+     *
+     * The plugin does not run this service; the user does, on a machine that can
+     * execute the model. The licence forbids re-hosting the models as a service,
+     * so point this at your own machine.
+     */
+    remote?: {
+        /** Bridge base URL, for example `http://mac-studio.local:8787`. */
+        endpoint?: string;
+        /** Optional bearer token sent to the bridge. */
+        token?: string;
+    };
+    /**
+     * Whether in-process npm packages may be used. Set false to force every call
+     * through the CLI or the bridge. Default true.
+     */
+    allowNpm?: boolean;
+    /**
+     * Where the user's enable/disable choices are persisted. Defaults to
+     * `<DSH_HOME>/model-as-tool/state.json`.
+     */
+    stateFile?: string;
+    /**
+     * Root of the profile-scoped custom-tool store. Defaults to
+     * `<dirname(stateFile)>/custom-tools`.
+     */
+    customToolsDir?: string;
+    /** Whether the custom-tools service loads and registers tools. Default true. */
+    customToolsEnabled?: boolean;
+    /**
+     * Where generated external MCP client credentials are persisted (SEC-01).
+     *
+     * Defaults to `<DSH_HOME>/model-as-tool/credentials.json`, next to the state file,
+     * so the store inherits the operator profile's owner-only protection. A deployment
+     * that disables persistence refuses generation rather than issuing a credential a
+     * restart would forget.
+     */
+    credentialsFile?: string;
+    /**
+     * Directory of the operator-owned EXTENSION store.
+     *
+     * When set, the host mounts the extension lifecycle and restores the extensions the
+     * operator approved as active. Left unset, no extension is mounted and behaviour is
+     * exactly as before - which is why this is a directory rather than a boolean: an
+     * absent directory is a deployment that has no extensions, not one that forbade them.
+     */
+    extensionStore?: string;
+    /**
+     * Directory that holds first-party extension PACKAGE checkouts, one directory per
+     * package, for the Settings → Model as Tool install path.
+     *
+     * A package lives in the directory named by its final identity segment: a package
+     * `@try-works/extension-laya` is installed from
+     * `<extensionSourceDir>/extension-laya`. Left empty, no first-party source is
+     * advertised and `describe()` reports `sourceDir: null`; an install then needs an
+     * explicit source directory.
+     *
+     * This is DEVELOPER MODE (EXT-06): the directory is only ever used when
+     * `extensions.allowSourceDirectories` explicitly allows it, the installer copies
+     * the tree rather than linking it, and the installation lands INACTIVE.
+     */
+    extensionSourceDir?: string;
+    /**
+     * How an install with no explicit source directory gets its package bytes.
+     *
+     * - `registry`: resolve the package from the npm registry (`extensionRegistry`),
+     *   verify the registry-declared sha512 and install the tarball.
+     * - `directory`: the developer-mode source-directory path above.
+     * - `auto` (default): prefer the registry; fall back to the source directory
+     *   ONLY when the registry is unreachable (transport/timeout/5xx/unconfigured)
+     *   and `extensions.allowSourceDirectories` is on. A package-level registry
+     *   refusal (404, missing integrity, bad tarball, digest mismatch) is always a
+     *   named error and is NEVER silently retried against a local directory.
+     */
+    extensionInstallSource?: 'registry' | 'directory' | 'auto';
+    /**
+     * The npm registry registry installs resolve against. Defaults to the public
+     * npm registry; set it empty to disable the registry route (directory installs
+     * still need `extensions.allowSourceDirectories`).
+     */
+    extensionRegistry?: string;
+    /** Hard cap on one registry package tarball download. Default 256 MiB. */
+    extensionTarballMaxBytes?: number;
+    /**
+     * IDLE timeout for one registry tarball download, in ms. Default 10 minutes.
+     * Applies only when NO bytes arrive; a slow large download is not aborted.
+     */
+    extensionTarballTimeoutMs?: number;
+    /** Registry packument/metadata timeout in ms. Default 30 s. */
+    extensionMetadataTimeoutMs?: number;
+    /**
+     * Dependency-graph depth bound for registry installs. Default 12.
+     *
+     * Preinstalled dependencies are leaves (their own tree travels with them);
+     * registry-resolved graphs are bounded by this, and a refusal names the level
+     * and the package.
+     */
+    extensionDependencyDepth?: number;
+    /**
+     * Package-count bound for dependency graphs (both arms). Default 256: the SDK
+     * default of 64 refused the real transformers/minilm engine trees.
+     */
+    extensionDependencyPackages?: number;
+    /**
+     * Operator gate: allow dependency content that arrived already materialized.
+     *
+     * OFF by default. When off, a declared dependency whose package.json carries
+     * install-time scripts refuses (EXT-10), exactly as before. When on, the
+     * resolver may supply the host's installed tree for such a dependency (for
+     * example onnxruntime-node after the operator's npm ran its postinstall); the
+     * SDK copies it into the extension's own installation directory and records
+     * `provenance: 'preinstalled'` with the source — stating that the installer
+     * did NOT run the scripts, rather than silently skipping them.
+     */
+    allowPreinstalledDependencies?: boolean;
+    /**
+     * The root a preinstalled dependency directory must live under.
+     *
+     * Required when {@link allowPreinstalledDependencies} is on: the SDK refuses a
+     * preinstalled directory outside it as a path escape. Point it at a root that
+     * contains the host dependency tree (for example the repository or profile
+     * root); never a world-writable location.
+     */
+    preinstalledDependenciesRoot?: string;
+    /**
+     * Exact `name@version` dependencies whose published tarball ships prebuilt
+     * runtime artifacts. Their lifecycle-script declarations are admitted but the
+     * scripts are NEVER executed. Defaults to the first-party allowlist; an empty
+     * array restores the strict EXT-10 refusal for every package.
+     */
+    trustedPrebuiltDependencies?: string[];
+    /**
+     * The operator's STANDING RES-02 approval for executable asset preparation
+     * initiated from the client/Remote path (Settings → Model as Tool → Prepare).
+     *
+     * DEFAULT FALSE. With it off, a preparation plan that contains an executable
+     * asset returns the exact RES-02 refusal: acquiring a downloaded engine is a
+     * separate approval from approving a model download, not a checkbox riding along
+     * with it. With it on, the Remote `prepare` call is the operator's approval for
+     * every executable asset of the digest-pinned, first-party plans the host
+     * resolves — which is why it should be enabled only for such engines, never for
+     * an arbitrary package source. The management channel (`model_tools`
+     * `extensions-prepare`) keeps its own PER-CALL `allowExecutable` flag and is not
+     * affected by this setting.
+     */
+    allowExecutablePreparation?: boolean;
+    /**
+     * SEC-09: require an explicit operator approval for extension ACTIVATION.
+     *
+     * OPT-IN, default false, and deliberately so for this slice: mounting the gate
+     * unconditionally would turn the Settings Enable action — and every existing host
+     * composition — into a pending refusal, because no approval UI/management path ships
+     * yet. A deployment that has one turns this on; the default is the documented
+     * PRE-APPROVED direct path, not a silent bypass (the switch is explicit).
+     */
+    requireActivationApproval?: boolean;
+    /** INTERNAL TEST SEAM: the acquisition source extensions-prepare uses instead
+     * of the ranged HTTP source. A suite injects a local file source so the
+     * acquisition path is exercised with ZERO network; a deployment never sets
+     * this, and the default stays the real opt-in source. */
+    assetSourceFactory?: () => AcquisitionSource;
+    /** TASK-99 test seams: the bounded-retry interval/cap (defaults 250 ms / 30 s). */
+    harnessRetryIntervalMs?: number;
+    harnessRetryCapMs?: number;
+    /**
+     * TASK-127 test seam: the retry SCHEDULER. A suite injects a fake
+     * {setInterval, clearInterval} so the tests advance the retry by explicit
+     * ticks instead of wall-clock (deterministic under full-suite load). A
+     * deployment never sets this; the default is the global scheduler, so the
+     * product behavior is byte-identical.
+     */
+    harnessRetryScheduler?: {
+        setInterval: (handler: () => void, ms: number) => unknown;
+        clearInterval: (handle: unknown) => void;
+    };
+    /**
+     * TASK-131 (RC2): the prepared-assets cache root. Defaults to the
+     * state-file-adjacent `asset-cache` directory; set it to a volume with room
+     * for the planned asset set (the embeddinggemma set is ~3.2 GB). The
+     * prepare preflight refuses with `extension-asset-space-insufficient` when
+     * the free space cannot hold the missing bytes.
+     */
+    assetCacheRoot?: string;
+    /** TASK-131 test seam: the free-space probe the prepare preflight uses. */
+    assetFreeSpaceProbe?: (path: string) => number;
+    /** §12 config v3: the nested shape + the fixed-false flags (see the zod). */
+    schemaVersion?: number;
+    extensions?: {
+        protocolMajor?: number;
+        manifestVersion?: string;
+        registry?: string;
+        allowHttpsArchives?: boolean;
+        allowLocalArchives?: boolean;
+        allowSourceDirectories?: boolean;
+        automaticUpdates?: boolean;
+        runInstallScripts?: boolean;
+    };
+    mcpV3?: {
+        enabled?: boolean;
+        protocolVersions?: string[];
+        legacyCompatibility?: boolean;
+        host?: string;
+        port?: number;
+        path?: string;
+        /**
+         * A file holding the operator bearer token, trimmed on read.
+         *
+         * DSH_TOOL_MODE_MCP_TOKEN still wins when set (a launch override); the file exists
+         * so a desktop-launched host, whose environment the operator does not control, can
+         * serve MCP with a durable credential. The raw token never enters this config.
+         */
+        tokenFile?: string;
+        allowedOrigins?: string[];
+        /**
+         * MCP-only export allowlist, separate from the native `models` selection.
+         * `['*']` (the default) preserves the full surface; an empty list exports no
+         * inference tools; otherwise only the exact listed names are published.
+         */
+        exportTools?: string[];
+        /** Operator client-grant policy passed to the MCP server (see ClientGrantConfig). */
+        grants?: ClientGrantConfig;
+        catalogTtlMs?: number;
+        catalogCacheScope?: string;
+        auth?: {
+            mode?: string;
+            authorizationServerProfile?: string | null;
+        };
+    };
+    compositionV3?: {
+        enabled?: boolean;
+        defaultTimeoutMs?: number;
+        maxTimeoutMs?: number;
+        maxToolCalls?: number;
+        maxConcurrentBindings?: number;
+        maxHarnessModelCalls?: number;
+    };
+    multimodalV3?: {
+        defaultDimensions?: number;
+        defaultOverflow?: string;
+        maxVideoFrames?: number;
+        audioSampleRateHz?: number;
+        selectiveEncoderLoading?: boolean;
+    };
+    harnessExecutorV3?: {
+        enabled?: boolean;
+        nativeSelection?: string;
+        externalDefaultProfile?: string | null;
+        profiles?: Readonly<Record<string, unknown>>[];
+        defaultMaxAttempts?: number;
+        defaultRepairAttempts?: number;
+        defaultMaxOutputTokens?: number;
+        defaultTimeoutMs?: number;
+        inheritConversation?: boolean;
+        allowModelToolCalls?: boolean;
+    };
+    recipesV3?: {
+        schemaVersion?: string;
+        allowLocalAuthoring?: boolean;
+        automaticActivation?: boolean;
+        allowExecutableTemplates?: boolean;
+    };
+    clientsV3?: Readonly<Record<string, unknown>>[];
+    captureV3?: {
+        bodies?: boolean;
+        retentionDays?: number;
+        maxBytes?: number;
+        auxiliaryLlmJournal?: {
+            enabled?: boolean;
+            retentionDays?: number;
+        };
+    };
+    /**
+     * Whether `enable`/`disable` persist across restarts. Default true; false
+     * restores the earlier session-scoped behaviour.
+     */
+    persist?: boolean;
+    /**
+     * Which model serves each standard contract, as `{ "stt.transcribe": "voz" }`.
+     *
+     * Provider selection is host configuration (BASE-02), not something a caller
+     * chooses per call. An override naming a model that cannot run here is ignored
+     * in favour of the first eligible implementation rather than silently
+     * registering a tool that would fail.
+     */
+    providers?: Record<string, string>;
+    /**
+     * Register the deprecated per-model compatibility aliases.
+     *
+     * Off by default so they stay out of the default catalog and a caller sees one
+     * transcription tool rather than two (BASE-03). When on, the alias keeps its
+     * original argument and result contract through a tested adapter — it is never
+     * silently reinterpreted as the new contract.
+     */
+    legacyAliases?: boolean;
+    /**
+     * Filesystem roots this deployment authorizes (SEC-06).
+     *
+     * Empty by default, which fails closed: a path-bearing tool then refuses every
+     * call rather than admitting an arbitrary path. An operator adds the roots this
+     * machine may read from.
+     */
+    approvedRoots?: string[];
+    /** Grant identity recorded in receipts; defaults to `local-interactive`. */
+    grantId?: string;
+    /** Whether receipts may be recorded (SEC-03); default true. */
+    recordReceipts?: boolean;
+    /**
+     * The CODE-11 repair-attempt ceiling for bounded-repair tools.
+     *
+     * The FLAT key is the deprecated-alias-compatible spelling that drives
+     * behaviour; `harnessExecutorV3.defaultRepairAttempts` is its v3 equivalent.
+     * An integer 0..8; 0 disables repairs. Default 1. An invalid value refuses
+     * at config parse, never silently clamps.
+     */
+    repairAttempts?: number;
+    /**
+     * Which capture profile this deployment runs under (OBS-03).
+     *
+     * `standard` is the default. `metadata-only` is for a headless local-specialist deployment: it
+     * REFUSES harness-backed execution where a no-retention policy cannot be honoured alongside
+     * DSH's requirement that model-visible inputs be reconstructable — rather than logging bodies
+     * against the policy or bypassing DSH, both of which are forbidden.
+     */
+    captureProfile?: 'standard' | 'metadata-only';
+    /**
+     * The deployment's harness provider, for executing DECLARATIVE packages (HLM-01).
+     *
+     * Supplied by the DEPLOYMENT rather than constructed here, because which model answers a
+     * harness call is not this plugin's business — and the architecture gate forbids
+     * model-specific code in the host. Absent means a declarative package resolves but is not
+     * served, and the refusal says so at preparation rather than at the first invocation.
+     */
+    harnessProvider?: LlmProvider;
+    /**
+     * Operator-bound logical executor profiles for approved-profile recipes
+     * (HLM-02/RCP-05). Each binding is a provider plus the version the operator
+     * approved; an unresolved profile makes the recipe's tool unavailable.
+     */
+    harnessProfiles?: Readonly<Record<string, {
+        readonly provider: LlmProvider;
+        readonly version: string;
+    }>>;
+    /**
+     * Opt the host INTO a REAL DSH-backed harness provider (HLM-01/02/03).
+     *
+     * DEFAULT OFF: absent, nothing is wired and every existing test and packed probe is
+     * unchanged. When set, the host builds a {@link DshLlmProvider} over the deployment's
+     * DSH LLM surface (`ctx.llm`), reading the model's OWN capability descriptor, and uses
+     * it for declarative recipes — with the image transport minted only when the DSH
+     * attachment service is reachable, otherwise capabilities honestly report `unknown`
+     * and the broker refuses image recipes rather than dropping them. An explicit
+     * `harnessProvider` wins over this option (test doubles and prebuilt providers).
+     */
+    harnessModel?: HarnessModelConfig;
+    /**
+     * Optional remote Jev (TypeSafe System One) provider (TOOL-02, DEC-07).
+     *
+     * Jev is a remote typed-question API, never local weights. When `enabled`, the
+     * host registers `decision_choose_jev` on the standard `decision.choose`
+     * contract. The key comes from `apiKey`, then the DSH credentials service
+     * (`credentialRef`, default `jev/api-key`), then `apiKeyEnv` (default
+     * `TYPESAFE_API_KEY`); a missing key is a diagnostic, never a fake answer.
+     */
+    jev?: JevConfig;
+    /**
+     * Opt the host INTO routing extension invocations through managed worker
+     * processes (EXT-20).
+     *
+     * DEFAULT OFF: absent, every extension runs in-process exactly as before, and no
+     * child process is ever spawned by this plugin. When set, each extension's module
+     * entry runs in a scrubbed-environment managed process — ONE process per extension
+     * per activation generation, disposed when the generation advances — and the host's
+     * dispatch discipline is unchanged: grant authorization and schema validation stay
+     * HOST-side before the worker call, and the worker's result is validated against
+     * the declared output schema exactly like the in-process path.
+     */
+    managedWorkers?: boolean;
+    /** Maximum one managed-worker invoke may wait before it is failed and disposed. */
+    managedWorkerInvokeTimeoutMs?: number;
+    /**
+     * Extension ids the operator switched OFF in Settings.
+     *
+     * The store still holds them and their desired activation is unchanged; the
+     * host simply does not restore them, so their tools never register. Removing
+     * an id re-activates the extension on the next load.
+     */
+    disabledExtensions?: string[];
+    /**
+     * Environment names to pass through to managed workers, on top of the SDK's
+     * bootstrap allowlist. Explicit names only — never `process.env` wholesale.
+     */
+    workerEnvPassthrough?: string[];
+    /** Hard resource limits overriding the conservative defaults. */
+    limits?: {
+        maxInputBytes?: number;
+        maxAudioSeconds?: number;
+        maxResultBytes?: number;
+        maxModelCalls?: number;
+        maxOutputTokens?: number;
+        maxImages?: number;
+        deadlineMs?: number;
+    };
+}
+export declare const Config: z<Config>;
+/**
+ * §12: the spec's fixed-false flags REJECT unsupported values instead of being
+ * accepted as ineffective flags. A config that sets any of them to true fails
+ * the configuration with the named flag, never silently ignores it.
+ * @param config - the parsed configuration.
+ * @throws Error naming the first flag set to an unsupported value.
+ */
+export declare function assertConfigV3DisabledFlags(config: Config): void;
+/**
+ * The CODE-11 repair-attempt ceiling for one configuration (task-74).
+ *
+ * The flat `repairAttempts` key drives; the v3 nested spelling
+ * `harnessExecutorV3.defaultRepairAttempts` is its equivalent; absent both,
+ * the default is 1. An out-of-range value is a REFUSAL, never a silent clamp:
+ * a ceiling the operator did not write is a budget nobody approved.
+ * @param config - the parsed configuration.
+ * @throws Error naming the invalid value.
+ */
+export declare function repairCeilingOf(config: Config): number;
+/** One model as the `model_tools` control tool reports it. */
+export interface ModelDescriptor {
+    readonly id: string;
+    readonly name: string;
+    readonly summary: string;
+    readonly capability: string;
+    readonly input: string;
+    readonly tool: string;
+    readonly skill: string;
+    readonly runnable: boolean;
+    readonly route: string;
+    readonly reason: string;
+    readonly languages: number | null;
+    readonly license: string;
+    readonly docs: string;
+}
+/** Render the model list the control tool returns, and the plugin logs. */
+export declare function describeModels(resolved: readonly ResolvedModel[]): ModelDescriptor[];
+export declare function apply(ctx: Context, config?: Config): Promise<void>;
+export { loadCatalog, CatalogError, DEFAULT_CATALOG_FILE } from './catalog.ts';
+export { resolveCapability, resolveCatalog, canResolve, packageSpecifier, type ResolvedModel } from './capability.ts';
+export { createAdapter, ADAPTER_FACTORIES } from './adapters/index.ts';
+export { buildArgv, commandExists, createCliTransport, createRemoteTransport, parseBridgeResponse, parseCliOutcome, splitArguments, BRIDGE_PATH, DEFAULT_CLI_COMMAND, type CommandRunner, type CommandTransport, type HttpPost, type TransportOptions, } from './transport.ts';
+export { renderSkillBody } from './skills.ts';
+export { EmbeddingIndex, IncompatibleEmbeddingSpace, openMemoryEmbeddingIndex, type EmbeddingRecord, type EmbeddingSpaceIdentity, } from './embedding-index.ts';
+export { loadPlaybooks, DEFAULT_PLAYBOOK_FILE, type ModelPlaybook } from './playbook.ts';
+export { createFileStateStore, createMemoryStateStore, defaultStateFile, parseState, resolveSelection, withChoice, EMPTY_STATE, StateError, type PersistedState, type StateStore, } from './state.ts';
+export type { CapabilityVerdict, ModelCatalogEntry, ModelInput, ModelParam, ModelParamType, ModelRoute, ModelToolSpec, ModelSkillSpec, WindowsSupport, } from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAMxC,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAyBvE,OAAO,EAAoH,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC5K,OAAO,EAAsF,KAAK,SAAS,EAAE,MAAM,UAAU,CAAA;AAG7H,OAAO,EAAoG,KAAK,WAAW,EAAuB,MAAM,8BAA8B,CAAA;AA8CtL,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAa/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAiC9D,eAAO,MAAM,IAAI,gBAAgB,CAAA;AACjC,eAAO,MAAM,MAAM,UAAY,CAAA;AAmB/B,4BAA4B;AAC5B,MAAM,WAAW,MAAM;IACrB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,YAAY,CAAA;IACpC;;;;OAIG;IACH,GAAG,CAAC,EAAE;QACJ,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,0DAA0D;QAC1D,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,mEAAmE;QACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,gDAAgD;QAChD,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,CAAA;IAC1D;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,+DAA+D;IAC/D,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC;;;;;;;;;;OAUG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IACvC;;;;;;;OAOG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;IACtC;;;;;;;;;;;;;OAaG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;IACpC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC;;;6DAGyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,iBAAiB,CAAA;IAC5C,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE;QACtB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;QACzD,aAAa,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;KACzC,CAAA;IACD;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE;QACX,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;QAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAA;QAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC,gBAAgB,CAAC,EAAE,OAAO,CAAA;QAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAC5B,CAAA;IACD,KAAK,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;QAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb;;;;;;WAMG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;QACzB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;QACtB,qFAAqF;QACrF,MAAM,CAAC,EAAE,iBAAiB,CAAA;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KACrE,CAAA;IACD,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,qBAAqB,CAAC,EAAE,MAAM,CAAA;QAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,uBAAuB,CAAC,EAAE,OAAO,CAAA;KAClC,CAAA;IACD,iBAAiB,CAAC,EAAE;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACtC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;QAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAA;QAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAA;QAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,mBAAmB,CAAC,EAAE,OAAO,CAAA;QAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAC9B,CAAA;IACD,SAAS,CAAC,EAAE;QACV,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,mBAAmB,CAAC,EAAE,OAAO,CAAA;QAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAA;QAC7B,wBAAwB,CAAC,EAAE,OAAO,CAAA;KACnC,CAAA;IACD,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAA;IAC/C,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,mBAAmB,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACpE,CAAA;IACD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,UAAU,GAAG,eAAe,CAAA;IAC7C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,WAAW,CAAA;IAC7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;IACxG;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,mFAAmF;IACnF,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,iEAAiE;IACjE,MAAM,CAAC,EAAE;QACP,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAkBD,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CA+L3B,CAAA;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAStD;AAYD,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,EAAE,CAgBpF;AAkCD,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAugK5E;AAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EACL,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EACL,cAAc,EAAE,0BAA0B,EAAE,wBAAwB,EACpE,KAAK,eAAe,EAAE,KAAK,sBAAsB,GAClD,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AACxF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAA"}