@yadsh/dsh-qa-surface 0.1.1 → 0.2.0

package/capability-policy.json

@@ -0,0 +1,5 @@
+{
+  "version": 1,
+  "description": "Reviewed capabilities in the shipped default QA tool allow-list.",
+  "tools": []
+}

package/compatibility.json

@@ -8,7 +8,13 @@
       "connection.api.sessions",
       "sessions.binding",
       "settingsScope",
-      "webServer.register"
+      "webServer.register",
+      "typert.remote",
+      "agentPresets.composedPreset",
+      "permissionPresets.set",
+      "tools.restrict",
+      "tools.guard",
+      "workspaceRegistry.get"
     ]
   },
   "node": "^22.19.0 || >=24.0.0"

package/cordis.patch.yml

@@ -7,3 +7,14 @@
         route:
           path: /qa
           matchChildren: true
+        ui:
+          showReset: false
+        lockdown:
+          enabled: true
+          sandboxMode: read-only
+          approvalPolicy: never
+          permissionPreset: qa-read-only
+          allowSessionReset: false
+          toolPolicy:
+            mode: allow-list
+            allow: []

package/docs/ARCHITECTURE.md

@@ -4,20 +4,62 @@ The Host half validates the Loader configuration, registers the `qa-surface`
 settings namespace and owns one narrow GET/HEAD route for the configured QA
 path. Published DSH `0.1.1-rc.2` returns 404 for unknown frontend paths, so the
 route redirects navigation through the canonical `/` index with an encoded
-same-origin path marker. It does not serve HTML, create another server, replace
-the frontend fallback, or touch API/plugin routes. The browser removes the
+same-origin path marker. It also exposes one typed
+`secureSession(sessionId)` operation whose policy is read only from Host
+settings. The entry delegates that operation to `QaPolicyAdmission`
+(`secure-session.ts`), the Host-side admission boundary. It does not serve
+HTML, create another server, replace the frontend fallback, or touch
+API/plugin routes. The browser removes the
 marker and restores the requested path with `history.replaceState` before
-route matching. The Host creates no sessions.
+route matching. The Host creates no sessions itself.
 
 The browser half registers `QaSurface` in the root-scoped `shell.overlay` list.
 `QaRouteController` keeps that entry dormant outside the configured path and
 reversibly observes `pushState`, `replaceState` and `popstate`.
 
-`QaSessionController` is the only DSH session-coupled module. It uses
+`QaSessionController` is the only browser-side DSH session-coupled module. It uses
 `connection.api.sessions.create/selectModel` for creation policy and the public
-`SessionFace` for prompt, cancel and snapshots. `QaTranscriptAdapter` projects
-those snapshots to plugin-local messages, excluding reasoning, tool arguments,
-tool results, system context and raw failures.
+`SessionFace` for prompt, cancel and snapshots; the shared client contracts and
+the idle state live in `client/types.ts`. Its supporting modules are pure
+helpers: `client/wait-for.ts` waits on observable stores, `client/chat-index.ts`
+(`QaChatIndex`) keeps the browser-local chat index and persisted active
+session in storage, and `client/attestation.ts` parses Host reason markers and
+validates proofs against the deployed lockdown config. `QaTranscriptAdapter`
+projects session snapshots to plugin-local messages. "New chat" enters a
+draft that materializes an attested session only when the first prompt is
+sent, and the chat list orders by the host's `updatedAt`. The log is
+append-only and there is no truncation seam, so regeneration prompts a
+hidden instruction and projects the follow-up turns as variants of one
+question; the same projection flattens tool activity into the sources
+drawer (web targets, searches, files read). Subagent delegation, when the
+deployment opts it in, renders launches and settlement notices inline, and
+the agents drawer opens a child session as a read-only live transcript: the
+binding skips attestation and every send path stays closed. By default it excludes
+reasoning, tool arguments and tool results. When explicitly enabled, it
+correlates assistant blocks, paired tool results, running calls and turn
+timings into one plugin-local work group per turn; `QaWorkGroup` owns
+disclosure state and collapses the group when the turn completes. System
+context and raw failures remain excluded.
+
+In locked mode the Host operation verifies immutable session composition,
+refuses to adopt a non-QA session with user history, validates the named
+permission preset, installs `ToolRestriction.allow`, installs an agent-scoped
+monotonic execution guard, selects the permission preset, and returns only a
+sanitized proof. The controller remains non-writable until every proof field
+matches its Host-delivered config and repeats the check before prompt
+admission. No private RPC handler, slash command, direct provider API, or DSH
+core patch is used.
+
+This narrows a QA agent's effective session/tool policy, but a route overlay on
+a shared privileged Host is not an authorization boundary for other DSH
+clients. Strong isolation requires a dedicated process/profile, restricted
+identity and network boundary.
+
+All interaction colors come from the company interaction palette
+("Цвета взаимодействия"), defined once as the `QA_BRAND_PALETTE` object at the
+top of `styles.ts` and emitted as `--dsh-qa-*` custom properties on the
+overlay root; surfaces and typography keep using the themed `--dsw-alias-*`
+tokens so light and dark hosts stay coherent.
 
 The overlay locks document scrolling and contains keyboard focus while active.
 It does not locate AppFrame through generated CSS classes and does not dispose

package/docs/COMPATIBILITY.md

@@ -1,12 +1,13 @@
 # Compatibility
 
-| Plugin version | Tested DSH release | Required public contracts                                                                             |
-| -------------- | ------------------ | ----------------------------------------------------------------------------------------------------- |
-| 0.1.x          | 0.1.1-rc.2         | `shell.overlay`, `settingsScope`, `connection.api.sessions`, `sessions.binding`, `webServer.register` |
+| Plugin version | Tested DSH release | Required public contracts                                                                                                                                                              |
+| -------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 0.1.x          | 0.1.1-rc.2         | `shell.overlay`, Typert remote, `agentPresets.composedPreset`, `permissionPresets`, agent-scoped `tools.restrict/guard`, `workspaceRegistry`, session/model APIs, `webServer.register` |
 
 DSH is developer-preview software. Compatibility-sensitive calls are isolated
 in `QaSessionController`, `QaTranscriptAdapter`, `QaConfigController` and
-`QaRouteController`. The Host navigation adapter also works around this tested
+`QaRouteController`; Host lockdown coupling is isolated in
+`QaSurface.secureSession`. The Host navigation adapter also works around this tested
 release's exact-index static serving: `/qa` is redirected through `/`, then the
 client restores the original pathname. Missing settings fall back to default
 browser config; missing required client services prevent the browser plugin

package/docs/CONFIGURATION.md

@@ -10,9 +10,103 @@ rules are:
 - `maxContentWidth` is an integer from 480 through 1600;
 - duplicate/blank suggested questions are removed;
 - approval and question policies are fixed to safe blocking behavior;
-- reasoning display cannot be enabled in the 0.1.x MVP.
+- reasoning and tool details are opt-in through `ui.showReasoning` and
+  `ui.showToolActivity`; enable them only where those contents are appropriate
+  for the QA audience;
+- lockdown defaults to enabled and requires a non-empty permission preset;
+- the preset must resolve on the Host to exactly `read-only` + `never`;
+- permission, slash-command, settings, rename, delete and arbitrary-open
+  capability flags cannot be enabled;
+- `showReset` requires the independent `allowSessionReset` opt-in;
+- the tool policy is an allow-list; unknown configured tool names fail closed.
+  A name only resolves while its tool is actually mounted: MCP tools
+  (`mcp__<server>__*`) exist only while their server is reachable, so keep
+  them out of the allow list on hosts that cannot reach the server. Tools
+  mounted by an agent preset live in that preset's ancestor scope; the Host
+  validates and restricts the complete agent-scoped view, not just globals.
+
+## Pinning chats to a directory
+
+By default a QA chat is created against the Host working directory. Two
+mutually exclusive pins anchor every new chat (and its subagents) to the
+deployment's own directory:
+
+- `session.cwd: "D:/qa-docs"` - an absolute directory used directly as the
+  session cwd; no registration needed. Attestation compares the session's
+  recorded cwd case- and separator-insensitively on Windows.
+- `session.workspaceId: "<uuid>"` - a registered DSH workspace (created in
+  the web UI or via the workspace API; the id is a generated uuid, not the
+  path). Sessions attach to the workspace, so they group under it in the
+  host UI. When the id does not resolve, attestation refuses with
+  `reason: workspace-unavailable` instead of an opaque mismatch.
+
+With `lockdown.enforceFixedWorkspace: true` (the default) a chat created
+anywhere else refuses to attest, so the QA audience can never pull the
+assistant out of the pinned directory.
 
 Browser persistence stores only the DSH session id under
-`<storageKey>:v1:<route>:session`. Transcript content, credentials and tool
+`<storageKey>:v1:<route>:session`, plus — when `ui.showSessionList` is
+enabled — a per-browser chat index under `<storageKey>:v1:<route>:chats`
+(session ids only, capped at 50). Transcript content, credentials and tool
 results remain in the Host-owned DSH Session and are never copied to browser
 storage.
+
+When either work-detail flag is enabled, the QA transcript groups reasoning,
+intermediate assistant progress, and tool rows by DSH turn. Running work is
+expanded. Completed work is collapsed behind a duration summary and can be
+reopened; each tool row can separately reveal its formatted input and output.
+These controls change presentation only and never widen the Host allow-list.
+
+The browser cannot override lockdown settings. Before binding and immediately
+before every prompt, it requests a Host attestation for the selected session.
+Any unproved agent preset, workspace, model, permission bundle or tool policy
+disables Send with the generic message `Настройки помощника недоступны.`
+Detailed mismatch facts are written only to Host logs; the
+browser console additionally prints one line with a stable coarse reason code
+(`reason: unknown-tools`, `workspace-unavailable`, `composition-mismatch`, `permission-preset`,
+`adoption-refused`, `proof-mismatch` or `attestation-failed`) plus an operator
+hint, so a refused surface can be diagnosed without Host log access.
+
+The built-in branding, controls, status messages and accessibility labels are
+Russian. The default quick questions are rendered directly above the composer
+only while the current chat is empty. Set `suggestedQuestions: []` to hide
+them, or provide a deployment-specific list to replace them.
+
+When adding tools, update the deployment's reviewed capability inventory as
+part of the same change. The package's
+[default inventory](../capability-policy.json) is intentionally empty, matching
+the default `toolPolicy.allow`.
+
+## Configuration channel over the LAN
+
+The browser normally reads the effective configuration from the Host-owned
+`qa-surface` settings namespace. DSH pins settings RPCs to loopback, so a
+browser served over the LAN always sees that namespace as unavailable. In
+that case the client calls the plugin's `qaSurface/describe` Host Remote and
+uses the returned effective configuration; a rejected call falls back to the
+client defaults with the same `unavailable` status as before. Only one
+describe request runs per page load, and a settled answer survives scope
+updates — the namespace (when readable) stays the authority and keeps
+delivering live changes.
+
+Host-side enforcement never depended on the browser's read path: `secureSession`
+attestation re-derives everything from the Host-owned configuration on every
+bind and every prompt.
+
+## Skill catalog scope
+
+The deployment's agent preset controls which skills the QA assistant sees.
+The shipped `qa-research` preset mounts the skill filesystem with
+`includeDefaultRoots: false`: project-root skills (for example the harness
+checkout's own `.dsh/skills`) and user-home skills stay out of the catalog,
+and skills enter only through plugin providers or an explicit
+`customSkillDirs` list in the preset. Keep the QA catalog to exactly the
+skills the audience is meant to use.
+
+## Deleting chats
+
+The sidebar delete control removes a chat from this browser's index only;
+the Host session stays on disk. Deleting the chat that is currently open
+continues in a fresh attested session when `lockdown.allowSessionReset` is
+enabled. There is no Host session-deletion API in DSH 0.1.x for the plugin
+to call.

package/lib/attestation.js

@@ -0,0 +1,10 @@
+/** Host rejection whose wire message carries the coarse reason marker. */
+export class QaAttestationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "QaAttestationError";
+    }
+}
+//# sourceMappingURL=attestation.js.map

package/lib/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAmBA,0EAA0E;AAC1E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC,MAAM;IADjB,YACW,MAA2B,EACpC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/lib/client/QaConfigController.js

@@ -1,14 +1,29 @@
 import { DEFAULT_QA_SURFACE_CONFIG, resolveConfig } from "../resolve-config.js";
-/** Browser projection of the Host-owned qa-surface settings namespace. */
+/**
+ * Browser projection of the Host-owned qa-surface settings namespace.
+ *
+ * The DSH gateway pins settings RPCs to loopback, so a browser served over the
+ * LAN always sees the namespace as `unavailable`. When the caller supplies the
+ * `qaSurface/describe` Remote as a fallback, that channel answers instead: the
+ * projection waits in `loading` until it settles, then reports the Host-owned
+ * configuration as `ready`. A rejected fallback returns the projection to
+ * `unavailable`, exactly as when no fallback exists.
+ */
 export class QaConfigController {
     scope;
     listeners = new Set();
     snapshot;
     unsubscribe;
-    constructor(scope) {
+    fallback;
+    fallbackState = "idle";
+    fallbackConfig;
+    disposed = false;
+    constructor(scope, fallback) {
         this.scope = scope;
+        this.fallback = fallback;
         this.snapshot = this.project();
         this.unsubscribe = scope.subscribe(() => this.refresh());
+        this.refresh();
     }
     getSnapshot = () => this.snapshot;
     subscribe = (listener) => {
@@ -16,6 +31,7 @@ export class QaConfigController {
         return () => this.listeners.delete(listener);
     };
     dispose() {
+        this.disposed = true;
         this.unsubscribe();
         this.listeners.clear();
     }
@@ -29,6 +45,22 @@ export class QaConfigController {
             };
         }
         if (settings.status === "unavailable") {
+            if ((this.fallbackState === "ready" ||
+                this.fallbackState === "refreshing") &&
+                this.fallbackConfig !== undefined) {
+                return {
+                    status: "ready",
+                    config: this.fallbackConfig,
+                    error: null,
+                };
+            }
+            if (this.fallbackState === "pending") {
+                return {
+                    status: "loading",
+                    config: DEFAULT_QA_SURFACE_CONFIG,
+                    error: null,
+                };
+            }
             return {
                 status: "unavailable",
                 config: DEFAULT_QA_SURFACE_CONFIG,
@@ -46,12 +78,16 @@ export class QaConfigController {
             return {
                 status: "error",
                 config: DEFAULT_QA_SURFACE_CONFIG,
-                error: "The assistant configuration is unavailable.",
+                error: "Настройки помощника недоступны.",
             };
         }
     }
     refresh() {
-        const next = this.project();
+        this.requestFallbackIfNeeded();
+        const projected = this.project();
+        const next = JSON.stringify(projected.config) === JSON.stringify(this.snapshot.config)
+            ? { ...projected, config: this.snapshot.config }
+            : projected;
         if (next.status === this.snapshot.status &&
             next.config === this.snapshot.config &&
             next.error === this.snapshot.error) {
@@ -61,5 +97,76 @@ export class QaConfigController {
         for (const listener of this.listeners)
             listener();
     }
+    /**
+     * Re-read the Host configuration after a Host reconnect. Without this, an
+     * open page keeps the configuration it fetched at load time: after the Host
+     * restarts with a changed deployment config, the next attestation compares
+     * its proof against the stale client copy and refuses. While re-reading,
+     * the previous answer stays projected — no loading flicker; the snapshot
+     * updates only when the answer actually changed.
+     */
+    refreshFallback() {
+        if (this.disposed ||
+            this.fallback === undefined ||
+            this.fallbackState === "idle" ||
+            this.fallbackState === "pending" ||
+            this.scope.getSnapshot().status === "ready") {
+            return;
+        }
+        this.fallbackState = "refreshing";
+        void this.fallback().then((config) => {
+            if (this.disposed)
+                return;
+            try {
+                this.fallbackConfig = resolveConfig(config);
+            }
+            catch {
+                // A malformed answer must not wipe a working previous one.
+            }
+            this.fallbackState = "ready";
+            // refresh() keeps the old projection when the answer is unchanged.
+            this.refresh();
+        }, (error) => {
+            if (this.disposed)
+                return;
+            console.warn("dsh-qa-surface: Host configuration refresh failed", error);
+            this.fallbackState = "ready";
+        });
+    }
+    /**
+     * The fallback trigger rides every refresh: the scope flips to
+     * `unavailable` whenever the browser is served over the LAN, which a
+     * constructor-time check can miss. The state guard makes repeats a no-op,
+     * so one fetch runs per controller lifetime; the recursive refresh lets the
+     * pending state surface before the first notification pass.
+     */
+    requestFallbackIfNeeded() {
+        if (this.disposed ||
+            this.fallback === undefined ||
+            this.fallbackState !== "idle" ||
+            this.scope.getSnapshot().status !== "unavailable") {
+            return;
+        }
+        this.fallbackState = "pending";
+        this.refresh();
+        void this.fallback().then((config) => {
+            if (this.disposed)
+                return;
+            try {
+                this.fallbackConfig = resolveConfig(config);
+                this.fallbackState = "ready";
+            }
+            catch {
+                this.fallbackState = "failed";
+            }
+            this.refresh();
+        }, (error) => {
+            if (this.disposed)
+                return;
+            console.warn("dsh-qa-surface: Host configuration is unavailable", error);
+            this.fallbackState = "failed";
+            this.refresh();
+        });
+    }
 }
 //# sourceMappingURL=QaConfigController.js.map

package/lib/client/QaConfigController.js.map

@@ -1 +1 @@
-{"version":3,"file":"QaConfigController.js","sourceRoot":"","sources":["../../src/client/QaConfigController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAShF,0EAA0E;AAC1E,MAAM,OAAO,kBAAkB;IAKA,KAAK;IAJjB,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,QAAQ,CAAmB;IAClB,WAAW,CAAa;IAEzC,YAA6B,KAAqC;qBAArC,KAAK;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,WAAW,GAAG,GAAqB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;IAEpD,SAAS,GAAG,CAAC,QAAoB,EAAgB,EAAE;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,OAAO;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,6CAA6C;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IACE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAClC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"QaConfigController.js","sourceRoot":"","sources":["../../src/client/QaConfigController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAYhF;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAWV,KAAK;IAVP,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,QAAQ,CAAmB;IAClB,WAAW,CAAa;IACxB,QAAQ,CAA+B;IAChD,aAAa,GACsC,MAAM,CAAC;IAC1D,cAAc,CAAsC;IACpD,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACmB,KAAqC,EACtD,QAA2B;qBADV,KAAK;QAGtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,WAAW,GAAG,GAAqB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;IAEpD,SAAS,GAAG,CAAC,QAAoB,EAAgB,EAAE;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,OAAO;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACtC,IACE,CAAC,IAAI,CAAC,aAAa,KAAK,OAAO;gBAC7B,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC;gBACtC,IAAI,CAAC,cAAc,KAAK,SAAS,EACjC,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,IAAI,CAAC,cAAc;oBAC3B,KAAK,EAAE,IAAI;iBACZ,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,yBAAyB;oBACjC,KAAK,EAAE,IAAI;iBACZ,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,iCAAiC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GACR,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACvE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IACE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAClC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe;QACb,IACE,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,OAAO,EAC3C,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE;YACT,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;YAC7B,mEAAmE;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,OAAO,CAAC,IAAI,CACV,mDAAmD,EACnD,KAAK,CACN,CAAC;YACF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC/B,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB;QAC7B,IACE,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,aAAa,EACjD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE;YACT,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC5C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,OAAO,CAAC,IAAI,CACV,mDAAmD,EACnD,KAAK,CACN,CAAC;YACF,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}