@vibe-agent-toolkit/cli 0.2.0-rc.3 → 0.2.0-rc.5

package/dist/commands/resources/check.d.ts

@@ -0,0 +1,454 @@
+/**
+ * `vat resources check` — run the project's own SQL assertions over its
+ * resource projection.
+ *
+ * ## Why this verb exists when `vat resources query` already runs SQL
+ *
+ * A query answers a question once. A question worth asking twice is a rule, and
+ * a rule that lives in someone's shell history is not enforced — it decays into
+ * a comment. This verb runs the statements a project wrote into
+ * `resources.checks`, turns each violating row into an ordinary validation
+ * finding, and exits non-zero when any of them is an error. That is the whole
+ * difference, and it is the difference between a tool and a gate.
+ *
+ * ## 🔑 A broken check is an ERROR, never a skip
+ *
+ * VAT ships no schema version, so a renamed column simply breaks a check's SQL.
+ * The tempting handling — log it and carry on — is the one thing this must never
+ * do: a check that stopped running looks exactly like a check that passed, and
+ * the project keeps reporting green over an assertion nobody is making any more.
+ * So a statement that will not run is reported as a finding at **error**
+ * severity, with the columns the projection actually has, and it fails the run.
+ *
+ * That report carries its OWN code (`RESOURCE_CHECK_BROKEN`), which no
+ * `validation.severity` entry can reach. A check's severity override is about how
+ * bad a VIOLATION is; while the two shared the code `CUSTOM:<name>`, the
+ * documented way to stand down an inherited check also silenced the news that it
+ * had stopped checking. See the `catch` in `runChecks`.
+ *
+ * ## 🔑 An empty CORPUS is a refusal too, not a pass
+ *
+ * The same class one level further out, and the one that shipped. `checksRun` is
+ * the denominator of RULES; nothing counted the ROWS, so a repository whose
+ * enumeration came back empty — a broad `.gitignore`, a shallow or sparse CI
+ * checkout, a root that resolved somewhere else — ran every declared check over
+ * nothing and reported `status: success` on exit 0 with empty stderr. Population
+ * declines ignored members rather than flagging them, so the tables held no
+ * trace of it either.
+ *
+ * So the population's size is published (`membersEnumerated`), and a run whose
+ * checks executed over zero members is an ERROR under the same non-overridable
+ * code as a broken statement — see {@link emptyCorpusFinding}. A gate that
+ * asserts nothing over nothing has not passed.
+ *
+ * ## 🔑 An unknown `--check` name is a refusal, not an empty pass
+ *
+ * The same failure class one flag over: a filter that matched nothing ran nothing
+ * and exited 0. `requireDeclaredCheck` refuses it before the crawl, naming the
+ * declared set. A gate that cannot fail is worse than no gate.
+ *
+ * ## 🔑 SQL is the surface a user OPTED IN to, so no BUILT-IN check may be SQL
+ *
+ * Every check this verb runs is adopter-declared: {@link checkCommand} reads
+ * `config?.resources?.checks` and nothing else, and warns loudly when a project
+ * declares none. There are no built-ins, and the one way to end that quietly is
+ * to author the first one as SQL. A default-on rule written as a statement makes
+ * the engine, the projection and the population mandatory for everyone who
+ * inherits it, without anybody deciding that. So: **built-ins are TypeScript
+ * predicates over the projection's row model.** SQL stays the two places a user
+ * asked for it — this verb's declared checks, and `vat resources query`.
+ *
+ * ⚠️ The engine today is `node:sqlite`, built into Node, so the thing at stake is
+ * not an install — it is the POPULATION. On an ~11,700-member adopter tree
+ * building the projection is **>99.9%** of a check run (16.5 s cold, ~1.3 s from
+ * the store) against **0.0008–0.004 s** for the statements themselves; see
+ * `vat-knowledge-resources.md`, which carries that measurement. That is exactly
+ * the cost "What this does NOT do" below refuses to put on every adopter's
+ * pre-commit path, and a default-on SQL check would put it there without the
+ * decision. The INSTALL cost is deferred rather than gone: the open question
+ * about a columnar engine is a 108 MB platform binding on a published toolkit,
+ * and this invariant is what keeps that question still answerable either way.
+ *
+ * ## 🔑 The DEFAULT check set belongs to the pipeline, not to the config file
+ *
+ * A directory with no `vibe-agent-toolkit.config.yaml` must run exactly the same
+ * default-on checks as one with a config; config only ADDS to that set or
+ * OVERRIDES a severity in it. This is load-bearing rather than a convenience:
+ * *"'default-on error' is meaningless as a category if being default-on requires
+ * a config file to say so."*
+ *
+ * It is therefore a constraint on WHERE the defaults live in code, not only on
+ * what they are. They cannot be defaulted into the parsed config object, because
+ * an absent config is `undefined` and every default would vanish with it — for
+ * the project that never wrote one, which is the population the category exists
+ * for. The rest of VAT already behaves this way and is the shape to match:
+ * `vat audit` completes its entire scan first and reads config only to apply
+ * severity overrides, warning and CONTINUING when the file cannot be read; and
+ * `loadResourcesWithConfig` hands `vat resources validate` a registry whose
+ * built-in validators run whether `loadConfig` returned a config or nothing.
+ * This verb has no defaults yet, so the invariant is a rule for the first one —
+ * and the day it is written is the easiest day to break it.
+ *
+ * ## Keeping a TypeScript check and its SQL twin: two good reasons, one trap
+ *
+ * The proposal was "write the predicate twice, in TypeScript and in SQL, and run
+ * whichever is faster". Two thirds of it are worth having.
+ *
+ * ✅ **As documentation.** An SQL twin is executable documentation of the row
+ * model, and strictly better than prose about it: prose can describe a column
+ * that no longer exists and never say so, while a statement stops compiling —
+ * which this verb reports as `RESOURCE_CHECK_BROKEN` rather than as a skip.
+ *
+ * ✅ **As a differential oracle.** Run both over the frozen corpus and assert
+ * IDENTICAL findings. That is the only thing which makes a dual implementation
+ * better than a single one rather than worse: two implementations with no
+ * mandatory differential test are simply two places for one rule to be wrong.
+ * Apply it selectively, to genuinely relational checks — done by default, every
+ * new rule costs three artifacts instead of one.
+ *
+ * ⛔ **As a runtime optimizer — rejected, on two INDEPENDENT grounds.** It would
+ * essentially never choose SQL: `buildResourceProjection` hands the rows back in
+ * memory before the ephemeral database exists at all, so the TypeScript arm is a
+ * for-loop over data already in hand, and the SQL arm's whole measured share of a
+ * run is the 0.0008–0.004 s above. A scheduler would be choosing between two
+ * arms of the 0.1%. And it reintroduces the dependency through the back door: an
+ * optimizer that MAY choose SQL means SQL MAY be needed at check time, which for
+ * anyone shipping the thing is the same as needed. **Optionality is not a
+ * property you can keep while also letting a scheduler reach for the optional
+ * thing.**
+ *
+ * ## 🔑 Adopter SQL runs UNSANDBOXED on purpose — and contributed SQL is not adopter SQL
+ *
+ * What a statement may BE is gated hard, and documented where it is enforced:
+ * `assertIsQuery` and `detachForeignSchemas` in
+ * `packages/projection-sqlite/src/store.ts` refuse `ATTACH` and `PRAGMA`, with
+ * the measured cross-repository leak that motivated both, and CHANGELOG.md's
+ * `--budget` entry carries why nothing inside this process can interrupt a
+ * runaway statement. Read those; do not restate them here.
+ *
+ * What is written down nowhere else is that everything PAST those gates is
+ * unsandboxed deliberately. A `.sql` file the adopter points their own config at
+ * is adopter code, at the same trust boundary as their eslint config: they wrote
+ * it or they chose to inherit it, and VAT is not the thing standing between a
+ * project and its own repository.
+ *
+ * 🚨 That reasoning covers exactly ONE trust domain, and the rule scoping it is
+ * the other half: **contributed SQL is a reviewed EXAMPLE, never an
+ * auto-executed check.** A contribution channel is third-party text, and a
+ * statement arriving through one has none of the "they chose it" the paragraph
+ * above rests on. Ship it as documentation an adopter copies into their own
+ * `resources.checks` deliberately. One paragraph must not be stretched to cover
+ * both domains.
+ *
+ * ## What this does NOT do
+ *
+ * It does not fold into `vat resources validate`. That command is on every
+ * adopter's pre-commit path, and adding a store-backed population to it is a
+ * cost and a risk that deserves its own decision with its own evidence. Wiring
+ * this into CI is one line in a workflow; making it unavoidable is not this
+ * change's call to make.
+ */
+import { type ResourceCheck } from '@vibe-agent-toolkit/resources';
+import { type ValidationIssue } from '@vibe-agent-toolkit/schema';
+import { type SeverityOverrides } from '../../utils/issue-severity.js';
+import { type Logger } from '../../utils/logger.js';
+import { type AskProjection, type PopulationExtent, type ProjectionProvenance } from '../../utils/projection-query.js';
+import { type ProgressEntry } from './check-progress.js';
+import { type AbnormalDeath } from './check-supervisor.js';
+/**
+ * Where a supervised run announces what it is doing, one unit at a time.
+ *
+ * A plain callback rather than the writer itself, so the loop knows nothing
+ * about files: the unit suite hands it an array, the supervised child hands it
+ * {@link createProgressWriter}'s append, and `--budget 0` hands it nothing.
+ */
+export type ProgressSink = (entry: ProgressEntry) => void;
+interface CheckOptions {
+    debug?: boolean;
+    /** Run only this check, by its config key. */
+    check?: string;
+    /** `yaml` (default) or `json`. Same document either way. */
+    format?: string;
+    /**
+     * How long the run may go WITHOUT completing a unit of work, in seconds.
+     * `0` removes the bound and keeps everything in this process.
+     */
+    budget?: string;
+    /**
+     * Hidden. Where to append progress — and, by its mere presence, the
+     * instruction to do the work here rather than supervise a child that does.
+     * Set by {@link childArgs} and by nothing else; an operator passing it by hand
+     * gets an unsupervised run and a log file, which is harmless.
+     */
+    costLog?: string;
+}
+/**
+ * What one declared check cost, and what it found.
+ *
+ * ## 🚨 The population is charged to NOBODY, and that is deliberate
+ *
+ * {@link durationMs} is the STATEMENT alone. The git tracker, the projection
+ * build and the load into the ephemeral database happen ONCE and serve every
+ * check in the run, so folding that shared setup into each rule would make N
+ * cheap rules look expensive and make the per-rule numbers sum to N times a cost
+ * paid once. It is published separately instead — `populationSecs` beside
+ * `population` in the document — so a reader can reconcile the parts against
+ * `durationSecs` rather than inferring the remainder and attributing it to
+ * whichever rule they happen to be reading.
+ *
+ * 🪤 This repo has already shipped the opposite mistake once, in another
+ * instrument: `parse ab` reported a pooled arm BACKWARDS because its estimate
+ * was thread-summed, and the report surfaced no caveat that would have told the
+ * reader. A shared cost silently attributed to one participant is the same
+ * defect wearing different clothes. If you ever want the population inside these
+ * numbers, divide it out explicitly and say so in the field name.
+ */
+export interface CheckCost {
+    /** The check's key in `resources.checks`. */
+    readonly name: string;
+    /** Wall time of this check's statement, and of nothing it shares with others. */
+    readonly durationMs: number;
+    /** Rows the statement returned — the violations it selected. Absent when the statement did not run. */
+    readonly rows?: number;
+    /** Set when the statement threw. A statement that did not complete has no row count. */
+    readonly broken?: true;
+}
+/** What one run of the checks produced. */
+interface CheckOutcome extends ProjectionProvenance, PopulationExtent {
+    issues: readonly ValidationIssue[];
+    /**
+     * One record per check that actually ran — the denominator every count below
+     * is read against, and what each of them cost.
+     *
+     * 🔑 A LIST rather than a count beside a list. `checksRun` used to be carried
+     * separately and is now derived from `costs.length`, because two numbers that
+     * must agree are a drift bug with no gate on it: nothing fails when a new
+     * `continue` skips the record but not the counter, and the document then
+     * reports a denominator no published entry accounts for.
+     */
+    costs: readonly CheckCost[];
+}
+export interface CheckPayloadInput extends CheckOutcome {
+    root: string;
+    durationMs: number;
+}
+/**
+ * Build the check report.
+ *
+ * Pure: no file system, no clock, no `process.exit` — the same contract every
+ * other payload builder here follows, so the document's shape stays under unit
+ * test rather than only under a CLI spawn.
+ *
+ * `checksRun` is published beside the counts and is not decoration: zero
+ * findings from four checks and zero findings from **no** checks are the same
+ * document without it, and they mean opposite things. A project whose config key
+ * is misspelled would otherwise read as passing. It is DERIVED from the `checks`
+ * list rather than carried alongside it, so the denominator and the entries that
+ * account for it cannot disagree.
+ *
+ * 🚨 `populationSecs` and the per-check `durationSecs` do not overlap and do not
+ * sum to `durationSecs`. The population is paid once and shared by every check;
+ * see {@link CheckCost} for why it is charged to none of them.
+ *
+ * @param input - The findings and the provenance of the run behind them
+ * @returns The document to serialize
+ */
+export declare function buildCheckOutputData(input: CheckPayloadInput): Record<string, unknown>;
+/**
+ * Refuse a `--check` name the project does not declare.
+ *
+ * 🔑 **An unknown name used to be a silent green.** The filter was a bare
+ * `if (only !== undefined && name !== only) continue;` and nothing compared the
+ * flag against the declared keys, so `--check nope` filtered every check away,
+ * ran none, and exited 0 with `checksRun: 0` and `issues: []` on empty stderr.
+ * The loud "no checks are declared" warning never fired, because it asks whether
+ * the `checks` MAP is empty, never whether the FILTER matched anything.
+ *
+ * That is not a hypothetical typo: `vat resources check --check orphan-skills`
+ * is the example in this command's own help text. Rename or delete that check
+ * and the CI step keeps passing forever while asserting nothing.
+ *
+ * Thrown rather than reported as a finding, because it is an OPERATOR error and
+ * not a content violation — the two have different exit codes in this command's
+ * contract (2 versus 1) and different audiences. Thrown before the projection is
+ * populated, so a mistyped flag costs no crawl.
+ *
+ * @param checks - The project's `resources.checks`
+ * @param only - The `--check` value, or undefined
+ * @throws When `only` names no declared check
+ */
+export declare function requireDeclaredCheck(checks: Readonly<Record<string, ResourceCheck>>, only: string | undefined): void;
+/**
+ * Name every `CUSTOM:` severity override that overrides nothing.
+ *
+ * 🔑 **The same silent-green shape as an unknown `--check` name, one surface
+ * over.** {@link requireDeclaredCheck} refuses `--check nope` because a filter
+ * that matched nothing ran nothing and exited 0. A `validation.severity` entry
+ * keyed `CUSTOM:<name>` for a check that is not declared is the mirror image: it
+ * parses (the schema validates the KEY's shape and cannot see
+ * `resources.checks`), applies to no finding, and says nothing. An adopter
+ * renames a check and leaves the override behind, or mistypes it while standing
+ * down an inherited one — and in the second direction the check they meant to
+ * silence keeps failing their build with no clue why.
+ *
+ * ⚠️ **A warning, not a refusal, and the asymmetry with `--check` is
+ * deliberate.** `--check` is a flag typed for THIS run, so a mistake is an
+ * operator error and exiting 2 costs nothing. A `severity` entry lives in a
+ * committed config that may legitimately be shared across repositories or
+ * outlive a check through a rename in flight; refusing it would be a new
+ * breaking config error, which is exactly the change this release already
+ * decided not to make twice (see `ResourcesConfigSchema`). Stderr, so the
+ * document on stdout stays parseable — the same channel and the same reasoning
+ * as the "no checks are declared" warning in {@link checkCommand}.
+ *
+ * 📌 The registry half of the key space needs no equivalent: a misspelled
+ * REGISTRY code is already refused by `SeverityOverrideCodeSchema`'s enum
+ * branch. Only the open `CUSTOM:` namespace can name something that does not
+ * exist.
+ *
+ * @param checks - The project's `resources.checks`
+ * @param validation - The project's `resources.validation`, or undefined
+ * @param logger - Where the warning goes (stderr)
+ */
+export declare function warnUndeclaredOverrides(checks: Readonly<Record<string, ResourceCheck>>, validation: SeverityOverrides | undefined, logger: Logger): void;
+/**
+ * How a supervised run stopped short of publishing its own document.
+ *
+ * Two endings, and telling them apart is the whole reason this is a type rather
+ * than a number. A watchdog kill means *no progress within the budget*, and the
+ * remedy may genuinely be a larger bound. An abnormal death means *the run
+ * died* — most often out of memory — and there the budget was never involved,
+ * so advice to raise it is a false diagnosis that makes the situation worse.
+ */
+export type CheckRunEnding = {
+    readonly kind: 'budget';
+    readonly budgetSecs: number;
+} | {
+    readonly kind: 'abnormal';
+    readonly death: AbnormalDeath;
+};
+/**
+ * The exit code Node uses for its own fatal abort, on EVERY platform.
+ *
+ * 🚨 **This is measured, and it is NOT the local platform's signal number.** On
+ * macOS and Linux 134 is the shell encoding `128 + SIGABRT`, where `SIGABRT` is
+ * 6. On Windows `os.constants.signals.SIGABRT` is **22** — MSVC numbers it
+ * differently — so deriving the code from that table gives 150 and matches
+ * nothing Node ever emits. A `windows-latest` run of the heap-abort case
+ * reported exactly **134**, the same as Unix: the number comes from Node's own
+ * abort path, not from the platform's signal table.
+ *
+ * 🪤 An earlier version of this file DID derive it from `os.constants.signals`,
+ * and its unit test derived the same way — so the test agreed with the code, the
+ * round-trip passed on every machine, and the pair was wrong together on the one
+ * platform the branch exists for. The value is therefore pinned as a measured
+ * fact, and a test asserts the number itself rather than re-deriving it.
+ *
+ * ⛔ Not a version constant: it decides nothing about whether stored data is
+ * still valid. It is an external protocol value, like an API header.
+ */
+export declare const NODE_FATAL_ABORT_EXIT_CODE = 134;
+/**
+ * Rebuild the document from what an INTERRUPTED run left on disk.
+ *
+ * Both interruptions come here — the watchdog's kill and an abnormal death —
+ * because everything below this line is identical for them: the same recovered
+ * costs, the same non-overridable finding, the same refusal when there is no
+ * population. Only the sentences differ, and {@link CheckRunEnding} carries that.
+ *
+ * 🔑 It feeds {@link buildCheckOutputData}, the SAME builder a completed run
+ * uses. A second payload builder for this lane would be a second shape to
+ * keep in step with every future field — and the failure mode is silent, because
+ * nobody reads an interrupted run's document until the day they need it.
+ *
+ * 🚨 **A run interrupted during POPULATION gets no document at all.** There is no
+ * projection, so `population`, `populationSecs` and `membersEnumerated` have no
+ * honest value — and inventing `membersEnumerated: 0` would be worse than a
+ * blank, because that value already MEANS "this gate ran over an empty corpus",
+ * which is a different and wrong claim. The throw becomes an operator error
+ * (exit 2) through the same `handleCommandError` path everything else here uses.
+ *
+ * @param options - The wreckage
+ * @param options.entries - What `parseProgressLog` recovered
+ * @param options.root - The corpus root the parent resolved
+ * @param options.ending - Which way the run was interrupted
+ * @param options.durationMs - Wall time from spawn to ending
+ * @returns The input to {@link buildCheckOutputData}
+ * @throws When the child never reported a completed population
+ */
+export declare function buildInterruptedCheckInput(options: {
+    entries: readonly ProgressEntry[];
+    root: string;
+    ending: CheckRunEnding;
+    durationMs: number;
+}): CheckPayloadInput;
+/**
+ * Run the declared checks and resolve their severities — the whole of this
+ * verb's logic, with the database taken out.
+ *
+ * Exported and pure so the loop is provable without a spawn. It was not: every
+ * spawned case declared ONE check (the `--check` case declares two and filters
+ * to one, which the loop cannot distinguish), so `checksRun` was never observed
+ * above 1 and a `break` at the end of the loop would have left the suite green.
+ *
+ * Pure in the same sense the payload builder is, with ONE seam: it reads a
+ * clock. That is why the clock is a parameter — the measurement is the point of
+ * the `costs` it returns, and a duration nothing can pin is a number nobody can
+ * trust.
+ *
+ * @param options - The run
+ * @param options.checks - The declared checks
+ * @param options.only - A single check key, or undefined for all
+ * @param options.ask - Runs one statement against the populated projection
+ * @param options.validation - The project's severity overrides, or undefined
+ * @param options.membersEnumerated - How many members the population enumerated.
+ *   Told rather than asked, because no answer can reveal it: an `ask` over an
+ *   empty projection and an `ask` over a clean one both return no rows
+ * @param options.now - The measurement clock in milliseconds, defaulting to
+ *   `performance.now()`. Injected only so a unit test can pin an exact per-check
+ *   duration; nothing in production passes it
+ * @param options.onProgress - Where each check's `start` and cost are announced
+ *   so an outside supervisor can see them, or undefined when the run is not
+ *   supervised. Optional rather than required because `--budget 0` and every
+ *   unit case run with nobody watching
+ * @returns The resolved findings, and one cost record per check that ran
+ */
+export declare function runDeclaredChecks(options: {
+    checks: Readonly<Record<string, ResourceCheck>>;
+    only: string | undefined;
+    ask: AskProjection;
+    validation: SeverityOverrides | undefined;
+    membersEnumerated: number;
+    now?: () => number;
+    onProgress?: ProgressSink | undefined;
+}): {
+    issues: ValidationIssue[];
+    costs: CheckCost[];
+};
+/**
+ * Run the project's declared checks against its projection.
+ *
+ * ## 🚨 Why this verb spawns a child and `vat resources query` does not
+ *
+ * Both verbs run SQL an adopter wrote, over the same projection, through the
+ * same `withQueriedProjection` — which does NOT diverge here, and must not. The
+ * fork is this function and nothing below it.
+ *
+ * `query`'s author is at the keyboard, and Ctrl-C already works for them. It
+ * works for one reason worth stating, because it is fragile: NO signal handler
+ * is installed anywhere on this path. A process blocked in synchronous
+ * `node:sqlite` dies instantly on SIGINT while that remains true, and SURVIVES
+ * SIGINT and SIGTERM the moment a handler exists — the handler is a JS callback
+ * and the event loop that would schedule it is the blocked resource. Adding one
+ * would take Ctrl-C away from `query` without adding anything to `check`.
+ *
+ * `check` runs unattended in CI, where nobody is there to press it. So it gets a
+ * bound enforced from outside itself, and a hang becomes a bounded failure
+ * instead of a job that burns its runner minutes and reports nothing.
+ *
+ * @param pathArg - The corpus root, or omitted for the current directory
+ * @param options - Parsed command-line options
+ */
+export declare function checkCommand(pathArg: string | undefined, options: CheckOptions): Promise<void>;
+export {};
+//# sourceMappingURL=check.d.ts.map

package/dist/commands/resources/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/commands/resources/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqJG;AAIH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D,UAAU,YAAY;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uGAAuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;CACxB;AAED,2CAA2C;AAC3C,UAAU,YAAa,SAAQ,oBAAoB,EAAE,gBAAgB;IACnE,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8DtF;AAiLD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAC/C,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAcN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAC/C,UAAU,EAAE,iBAAiB,GAAG,SAAS,EACzC,MAAM,EAAE,MAAM,GACb,IAAI,CAoBN;AA4DD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAuJjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAmL9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,iBAAiB,CAwBpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAChD,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,GAAG,EAAE,aAAa,CAAC;IACnB,UAAU,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAOnB,UAAU,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACvC,GAAG;IAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,EAAE,CAAA;CAAE,CAmCpD;AA6GD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAkFf"}