@yadsh/dsh-qa-surface 0.17.0 → 0.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -25
- package/compatibility.json +1 -1
- package/lib/account-remotes.js +4 -0
- package/lib/account-remotes.js.map +1 -1
- package/lib/accounts/database.js +86 -1
- package/lib/accounts/database.js.map +1 -1
- package/lib/accounts/file.js.map +1 -1
- package/lib/accounts/store.js +111 -5
- package/lib/accounts/store.js.map +1 -1
- package/lib/accounts/token.js +8 -2
- package/lib/accounts/token.js.map +1 -1
- package/lib/admin/metrics.js +15 -2
- package/lib/admin/metrics.js.map +1 -1
- package/lib/admin/read-budget.js +28 -0
- package/lib/admin/read-budget.js.map +1 -0
- package/lib/admin/service.js +135 -40
- package/lib/admin/service.js.map +1 -1
- package/lib/admin/session-log.js +63 -4
- package/lib/admin/session-log.js.map +1 -1
- package/lib/attachment-access.js +147 -0
- package/lib/attachment-access.js.map +1 -0
- package/lib/chat-sharing/native-fence.js +20 -0
- package/lib/chat-sharing/native-fence.js.map +1 -1
- package/lib/chat-sharing/search.js +89 -0
- package/lib/chat-sharing/search.js.map +1 -0
- package/lib/chat-sharing/transport.js +10 -9
- package/lib/chat-sharing/transport.js.map +1 -1
- package/lib/chat-sharing/uploads.js +79 -6
- package/lib/chat-sharing/uploads.js.map +1 -1
- package/lib/cli.js +13 -0
- package/lib/cli.js.map +1 -1
- package/lib/client/QaAccountsController.js +61 -0
- package/lib/client/QaAccountsController.js.map +1 -1
- package/lib/client/QaRouteController.js +3 -1
- package/lib/client/QaRouteController.js.map +1 -1
- package/lib/client/QaSessionController.js +141 -35
- package/lib/client/QaSessionController.js.map +1 -1
- package/lib/client/QaSurface.js +43 -13
- package/lib/client/QaSurface.js.map +1 -1
- package/lib/client/account-sessions.js +74 -8
- package/lib/client/account-sessions.js.map +1 -1
- package/lib/client/admin/CapabilityPicker.js +50 -0
- package/lib/client/admin/CapabilityPicker.js.map +1 -0
- package/lib/client/admin/CoverageNotice.js +9 -0
- package/lib/client/admin/CoverageNotice.js.map +1 -0
- package/lib/client/admin/QaAdmin.js +3 -150
- package/lib/client/admin/QaAdmin.js.map +1 -1
- package/lib/client/admin/RoleEditor.js +46 -0
- package/lib/client/admin/RoleEditor.js.map +1 -0
- package/lib/client/admin/capability-selection.js +63 -0
- package/lib/client/admin/capability-selection.js.map +1 -0
- package/lib/client/admin/pages/Conversations.js +35 -17
- package/lib/client/admin/pages/Conversations.js.map +1 -1
- package/lib/client/admin/pages/Overview.js +3 -2
- package/lib/client/admin/pages/Overview.js.map +1 -1
- package/lib/client/admin/pages/Quality.js +77 -20
- package/lib/client/admin/pages/Quality.js.map +1 -1
- package/lib/client/admin/pages/SkillFiles.js +14 -3
- package/lib/client/admin/pages/SkillFiles.js.map +1 -1
- package/lib/client/admin/shared.js +68 -3
- package/lib/client/admin/shared.js.map +1 -1
- package/lib/client/components/QaAuthGate.js +31 -28
- package/lib/client/components/QaAuthGate.js.map +1 -1
- package/lib/client/components/QaChangelog.js +71 -0
- package/lib/client/components/QaChangelog.js.map +1 -1
- package/lib/client/components/QaComposer.js +27 -4
- package/lib/client/components/QaComposer.js.map +1 -1
- package/lib/client/components/QaFormItem.js +63 -0
- package/lib/client/components/QaFormItem.js.map +1 -0
- package/lib/client/components/QaInputForm.js +281 -0
- package/lib/client/components/QaInputForm.js.map +1 -0
- package/lib/client/components/QaModal.js +17 -4
- package/lib/client/components/QaModal.js.map +1 -1
- package/lib/client/components/QaRequestWait.js +15 -0
- package/lib/client/components/QaRequestWait.js.map +1 -0
- package/lib/client/forms-styles.js +14 -0
- package/lib/client/forms-styles.js.map +1 -0
- package/lib/client/forms.js +40 -0
- package/lib/client/forms.js.map +1 -0
- package/lib/client/index.js +18 -2
- package/lib/client/index.js.map +1 -1
- package/lib/client/oidc-browser.js +39 -0
- package/lib/client/oidc-browser.js.map +1 -0
- package/lib/client/panels/PanelHost.js +23 -1
- package/lib/client/panels/PanelHost.js.map +1 -1
- package/lib/client/project-session-state.js.map +1 -1
- package/lib/client/request-wait-styles.js +7 -0
- package/lib/client/request-wait-styles.js.map +1 -0
- package/lib/client/settings/sections/interface.js +2 -1
- package/lib/client/settings/sections/interface.js.map +1 -1
- package/lib/client/settings/sections/status.js +3 -1
- package/lib/client/settings/sections/status.js.map +1 -1
- package/lib/client/styles.js +5 -3
- package/lib/client/styles.js.map +1 -1
- package/lib/client/types.js.map +1 -1
- package/lib/client.js +471 -72918
- package/lib/client.js.map +1 -1
- package/lib/config-resolvers/accounts.js +5 -4
- package/lib/config-resolvers/accounts.js.map +1 -1
- package/lib/config-resolvers/defaults.js +16 -0
- package/lib/config-resolvers/defaults.js.map +1 -1
- package/lib/config-resolvers/oidc.js +53 -0
- package/lib/config-resolvers/oidc.js.map +1 -0
- package/lib/config.js +71 -0
- package/lib/config.js.map +1 -1
- package/lib/filesystem-intent.js +39 -0
- package/lib/filesystem-intent.js.map +1 -0
- package/lib/forms/attachments.js +230 -0
- package/lib/forms/attachments.js.map +1 -0
- package/lib/forms/errors.js +37 -0
- package/lib/forms/errors.js.map +1 -0
- package/lib/forms/fingerprint.js +21 -0
- package/lib/forms/fingerprint.js.map +1 -0
- package/lib/forms/gate.js +125 -0
- package/lib/forms/gate.js.map +1 -0
- package/lib/forms/schema.js +182 -0
- package/lib/forms/schema.js.map +1 -0
- package/lib/forms/service.js +220 -0
- package/lib/forms/service.js.map +1 -0
- package/lib/forms/store.js +194 -0
- package/lib/forms/store.js.map +1 -0
- package/lib/forms/types.js +2 -0
- package/lib/forms/types.js.map +1 -0
- package/lib/forms/validation.js +113 -0
- package/lib/forms/validation.js.map +1 -0
- package/lib/index.js +271 -81
- package/lib/index.js.map +1 -1
- package/lib/oidc/http.js +30 -0
- package/lib/oidc/http.js.map +1 -0
- package/lib/oidc/service.js +250 -0
- package/lib/oidc/service.js.map +1 -0
- package/lib/qa-tools/activation-manager.js +24 -2
- package/lib/qa-tools/activation-manager.js.map +1 -1
- package/lib/qa-tools/catalog.js +11 -1
- package/lib/qa-tools/catalog.js.map +1 -1
- package/lib/qa-tools/index.js +27 -0
- package/lib/qa-tools/index.js.map +1 -1
- package/lib/qa-tools/request-user-form.js +121 -0
- package/lib/qa-tools/request-user-form.js.map +1 -0
- package/lib/request-scheduler.js +235 -0
- package/lib/request-scheduler.js.map +1 -0
- package/lib/resolve-config.js +2 -0
- package/lib/resolve-config.js.map +1 -1
- package/lib/secure-session.js +60 -60
- package/lib/secure-session.js.map +1 -1
- package/lib/session-create.js +125 -0
- package/lib/session-create.js.map +1 -0
- package/lib/typert.host.js +4636 -1103
- package/lib/typert.remote-client.d.ts +135 -5
- package/lib/typert.remote-client.js +4502 -1095
- package/lib/types/accounts/database.d.ts +8 -0
- package/lib/types/accounts/file.d.ts +2 -0
- package/lib/types/accounts/store.d.ts +17 -0
- package/lib/types/accounts/token.d.ts +3 -1
- package/lib/types/admin/metrics.d.ts +5 -1
- package/lib/types/admin/read-budget.d.ts +8 -0
- package/lib/types/admin/service.d.ts +17 -0
- package/lib/types/admin/session-log.d.ts +30 -1
- package/lib/types/attachment-access.d.ts +29 -0
- package/lib/types/chat-sharing/search.d.ts +5 -0
- package/lib/types/chat-sharing/uploads.d.ts +2 -1
- package/lib/types/client/QaAccountsController.d.ts +4 -0
- package/lib/types/client/QaRouteController.d.ts +1 -0
- package/lib/types/client/QaSessionController.d.ts +24 -12
- package/lib/types/client/QaSurface.d.ts +2 -0
- package/lib/types/client/admin/CapabilityPicker.d.ts +14 -0
- package/lib/types/client/admin/CoverageNotice.d.ts +6 -0
- package/lib/types/client/admin/RoleEditor.d.ts +15 -0
- package/lib/types/client/admin/capability-selection.d.ts +27 -0
- package/lib/types/client/admin/shared.d.ts +39 -1
- package/lib/types/client/components/QaAuthGate.d.ts +2 -0
- package/lib/types/client/components/QaFormItem.d.ts +20 -0
- package/lib/types/client/components/QaInputForm.d.ts +18 -0
- package/lib/types/client/components/QaRequestWait.d.ts +6 -0
- package/lib/types/client/forms-styles.d.ts +2 -0
- package/lib/types/client/forms.d.ts +23 -0
- package/lib/types/client/oidc-browser.d.ts +12 -0
- package/lib/types/client/project-session-state.d.ts +2 -4
- package/lib/types/client/request-wait-styles.d.ts +2 -0
- package/lib/types/client/types.d.ts +10 -4
- package/lib/types/config-resolvers/oidc.d.ts +3 -0
- package/lib/types/filesystem-intent.d.ts +12 -0
- package/lib/types/forms/attachments.d.ts +51 -0
- package/lib/types/forms/errors.d.ts +11 -0
- package/lib/types/forms/fingerprint.d.ts +9 -0
- package/lib/types/forms/gate.d.ts +33 -0
- package/lib/types/forms/schema.d.ts +72 -0
- package/lib/types/forms/service.d.ts +15 -0
- package/lib/types/forms/store.d.ts +25 -0
- package/lib/types/forms/types.d.ts +215 -0
- package/lib/types/forms/validation.d.ts +20 -0
- package/lib/types/index.d.ts +33 -12
- package/lib/types/oidc/http.d.ts +5 -0
- package/lib/types/oidc/service.d.ts +30 -0
- package/lib/types/oidc.js +2 -0
- package/lib/types/oidc.js.map +1 -0
- package/lib/types/qa-tools/activation-manager.d.ts +5 -0
- package/lib/types/qa-tools/catalog.d.ts +4 -1
- package/lib/types/qa-tools/index.d.ts +5 -1
- package/lib/types/qa-tools/request-user-form.d.ts +5 -0
- package/lib/types/request-scheduler.d.ts +28 -0
- package/lib/types/secure-session.d.ts +13 -26
- package/lib/types/session-create.d.ts +29 -0
- package/lib/types/types/accounts.d.ts +2 -0
- package/lib/types/types/admin.d.ts +6 -0
- package/lib/types/types/config.d.ts +6 -0
- package/lib/types/types/oidc.d.ts +36 -0
- package/lib/types/types/session.d.ts +8 -0
- package/lib/types/types.d.ts +2 -0
- package/lib/types/user-workspace.d.ts +4 -6
- package/lib/user-workspace.js +13 -67
- package/lib/user-workspace.js.map +1 -1
- package/package.json +66 -62
|
@@ -19,7 +19,12 @@ export interface QaToolActivationManagerOptions {
|
|
|
19
19
|
export declare class QaToolActivationManager implements QaToolActivation {
|
|
20
20
|
private readonly options;
|
|
21
21
|
private readonly states;
|
|
22
|
+
private readonly activeAgents;
|
|
23
|
+
private catalog;
|
|
22
24
|
constructor(options: QaToolActivationManagerOptions);
|
|
25
|
+
/** Reconcile feature switches only for scopes which already earned activation. */
|
|
26
|
+
replaceCatalog(catalog: readonly QaToolDescriptor[]): void;
|
|
27
|
+
disposeAll(): void;
|
|
23
28
|
/**
|
|
24
29
|
* Register the whole catalog on one agent, all or nothing.
|
|
25
30
|
*
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { Agent } from "@deepseek-ai/dsh-agent";
|
|
2
2
|
import type { QaToolDescriptor } from "./types.js";
|
|
3
|
+
import type { QaFormGate } from "../forms/gate.js";
|
|
3
4
|
/**
|
|
4
5
|
* Deterministic catalog identity. The durable activation marker is derived from
|
|
5
6
|
* the session log rather than stored, so this version is not compared against a
|
|
@@ -8,9 +9,11 @@ import type { QaToolDescriptor } from "./types.js";
|
|
|
8
9
|
*
|
|
9
10
|
* Bump it whenever the catalog's tool set or their schemas change.
|
|
10
11
|
*/
|
|
11
|
-
export declare const QA_TOOL_CATALOG_VERSION = "
|
|
12
|
+
export declare const QA_TOOL_CATALOG_VERSION = "4";
|
|
12
13
|
/** What the catalog's definitions read, beyond the execution record. */
|
|
13
14
|
export interface QaToolsSelfcheckDeps {
|
|
15
|
+
readonly forms?: QaFormGate;
|
|
16
|
+
readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
|
|
14
17
|
readonly catalogVersion: string;
|
|
15
18
|
readonly activationMode: string;
|
|
16
19
|
/** Names the catalog contributes, in catalog order. */
|
|
@@ -3,6 +3,9 @@ import type { Context } from "@deepseek-ai/cordis";
|
|
|
3
3
|
import type { PluginLogger } from "@yadsh/dsh-plugin-log";
|
|
4
4
|
import type { QaToolActivation } from "./types.js";
|
|
5
5
|
export interface QaToolsOptions {
|
|
6
|
+
readonly forms?: import("../forms/gate.js").QaFormGate;
|
|
7
|
+
readonly formsEnabled?: () => boolean;
|
|
8
|
+
readonly formProjection?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>;
|
|
6
9
|
readonly logger: PluginLogger;
|
|
7
10
|
readonly dynamicActivation: boolean;
|
|
8
11
|
readonly activationSkill: string;
|
|
@@ -31,12 +34,13 @@ export declare class QaTools implements QaToolActivation {
|
|
|
31
34
|
private readonly manager;
|
|
32
35
|
private readonly detector;
|
|
33
36
|
private readonly lifecycle;
|
|
34
|
-
private
|
|
37
|
+
private catalogTools;
|
|
35
38
|
constructor(ctx: Context, options: QaToolsOptions);
|
|
36
39
|
/** Names currently registered on one agent; the admission guard reads this per call. */
|
|
37
40
|
activeToolNames(agent: Agent): readonly string[];
|
|
38
41
|
/** Shipped scope-local names, including entries not activated on an agent yet. */
|
|
39
42
|
catalogToolNames(): readonly string[];
|
|
43
|
+
refreshForms(): void;
|
|
40
44
|
dispose(): void;
|
|
41
45
|
/**
|
|
42
46
|
* The preset gate. An empty `activationPresets` leaves it open, which is only
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import type { ToolDefinition } from "@deepseek-ai/dsh-tools";
|
|
2
|
+
import type { QaFormGate } from "../forms/gate.js";
|
|
3
|
+
/** Build only; the QA activation manager owns registration and role admission. */
|
|
4
|
+
export declare function createRequestUserFormTool(gate: QaFormGate, project?: (submission: import("../forms/types.js").QaFormSubmission, sessionId: string) => Promise<unknown>): ToolDefinition;
|
|
5
|
+
//# sourceMappingURL=request-user-form.d.ts.map
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import type { Context } from "@deepseek-ai/cordis";
|
|
2
|
+
import type { Agent } from "@deepseek-ai/dsh-agent";
|
|
3
|
+
import type { QaQueueStatus } from "./types.js";
|
|
4
|
+
/** A FIFO admission lease covers a complete root turn, including its experts. */
|
|
5
|
+
export declare class QaRequestScheduler {
|
|
6
|
+
private readonly limit;
|
|
7
|
+
private readonly roots;
|
|
8
|
+
private readonly now;
|
|
9
|
+
private readonly familyBusy;
|
|
10
|
+
private readonly active;
|
|
11
|
+
private readonly waiting;
|
|
12
|
+
private readonly completed;
|
|
13
|
+
private readonly retiring;
|
|
14
|
+
private closed;
|
|
15
|
+
constructor(limit: () => number, roots: () => readonly Agent[], now?: () => number, familyBusy?: (agent: Agent) => boolean);
|
|
16
|
+
install(ctx: Context): () => void;
|
|
17
|
+
acquire(agent: Agent, signal: AbortSignal): Promise<void>;
|
|
18
|
+
release(agent: Agent, completed?: boolean): void;
|
|
19
|
+
private pump;
|
|
20
|
+
status(sessionId?: string): QaQueueStatus;
|
|
21
|
+
private estimate;
|
|
22
|
+
dispose(): void;
|
|
23
|
+
}
|
|
24
|
+
/** Include background descendants whose root has already ended its own turn. */
|
|
25
|
+
export declare function qaRequestFamilyBusy(ctx: Context, root: Agent): boolean;
|
|
26
|
+
/** Older optional compositions may lack the registry, but cannot enforce a cap. */
|
|
27
|
+
export declare function qaRequestRoots(ctx: Context, required: boolean): readonly Agent[];
|
|
28
|
+
//# sourceMappingURL=request-scheduler.d.ts.map
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { Agent } from "@deepseek-ai/dsh-agent";
|
|
2
2
|
import type { Context } from "@deepseek-ai/cordis";
|
|
3
|
+
import { type QaAttachmentRecovery } from "./attachment-access.js";
|
|
3
4
|
import type { PluginLogger } from "@yadsh/dsh-plugin-log";
|
|
4
5
|
import { type QaSessionFacts } from "./accounts/store.js";
|
|
5
6
|
import type { QaIntegrationPrincipalBindings } from "./integration-principals.js";
|
|
@@ -71,12 +72,10 @@ export declare class QaPolicyAdmission {
|
|
|
71
72
|
* one set answers for the whole chat.
|
|
72
73
|
*/
|
|
73
74
|
private readonly attested;
|
|
75
|
+
private readonly rejected;
|
|
76
|
+
private readonly questionWarnings;
|
|
74
77
|
private readonly workspaceAccess;
|
|
75
|
-
|
|
76
|
-
* Removers of the document input roots granted per session, so a grant lives
|
|
77
|
-
* exactly as long as the workspace access that justified it.
|
|
78
|
-
*/
|
|
79
|
-
private readonly documentInputRoots;
|
|
78
|
+
private readonly attachmentAccess;
|
|
80
79
|
/**
|
|
81
80
|
* Every name reachable anywhere in one QA conversation, keyed by session id.
|
|
82
81
|
*
|
|
@@ -115,7 +114,7 @@ export declare class QaPolicyAdmission {
|
|
|
115
114
|
* deliberately not a delegation); {@link secureSessionForUser} has no token
|
|
116
115
|
* to compare, so it fills it here, against the ownership record it checked.
|
|
117
116
|
*/
|
|
118
|
-
principals?: QaIntegrationPrincipalBindings | undefined);
|
|
117
|
+
principals?: QaIntegrationPrincipalBindings | undefined, attachmentRecovery?: QaAttachmentRecovery);
|
|
119
118
|
/**
|
|
120
119
|
* Add tools whose own executor resolves the QA principal server-side.
|
|
121
120
|
* Enabling the contributing plugin is the operator decision; model arguments
|
|
@@ -129,29 +128,17 @@ export declare class QaPolicyAdmission {
|
|
|
129
128
|
* newly-created, permanently unusable chat behind.
|
|
130
129
|
*/
|
|
131
130
|
preflightDeployment(): void;
|
|
131
|
+
/** Keep a failed creation fenced even when its Host teardown cannot finish. */
|
|
132
|
+
rejectSession(sessionId: string): void;
|
|
133
|
+
/** Called only after failed creation confirms resource and ownership cleanup. */
|
|
134
|
+
forgetRejectedSession(sessionId: string): void;
|
|
132
135
|
/**
|
|
133
|
-
* The
|
|
134
|
-
*
|
|
135
|
-
*
|
|
136
|
-
* points it at. A backend without a resolvable root simply keeps the fence
|
|
137
|
-
* closed — attachments then only work where reads are not fenced per user.
|
|
138
|
-
* Source preview asks for the same root, so one upload is readable by both.
|
|
136
|
+
* The backend location used to validate exact file capabilities. The root
|
|
137
|
+
* itself grants no read access; only this conversation's Host-admitted
|
|
138
|
+
* user-message references and verified submitted form resources do.
|
|
139
139
|
*/
|
|
140
140
|
attachmentRoot(): string | undefined;
|
|
141
|
-
|
|
142
|
-
* Carry the fence's attachment exemption into the document pipeline.
|
|
143
|
-
*
|
|
144
|
-
* The guard above lets a single-file read reach the mounted store: an upload
|
|
145
|
-
* is content-addressed, immutable, outside every workspace, and the prompt
|
|
146
|
-
* hands the model exactly that path. The document pipeline keeps its own
|
|
147
|
-
* read scope and knew nothing about the store, so `document_*` refused the
|
|
148
|
-
* very file the model was allowed to read — the panel's own Word preview hit
|
|
149
|
-
* the same wall. The grant is the missing hand-over, made where the access it
|
|
150
|
-
* mirrors is made: per admitted session, and revoked with it.
|
|
151
|
-
*/
|
|
152
|
-
private grantDocumentInputRoots;
|
|
153
|
-
/** Drop one session's document grant, if the pipeline still holds it. */
|
|
154
|
-
private revokeDocumentInputRoots;
|
|
141
|
+
grantAttachmentFile(sessionId: string, file: string): void;
|
|
155
142
|
/**
|
|
156
143
|
* The live agent for one session, resuming a Session the Host has not
|
|
157
144
|
* materialized in this process.
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
import type { Context } from "@deepseek-ai/cordis";
|
|
2
|
+
import type { PluginLogger } from "@yadsh/dsh-plugin-log";
|
|
3
|
+
import type { QaStoredSessionEraser } from "./admin/session-log.js";
|
|
4
|
+
import type { QaSessionModelPolicy } from "./access/model-policy.js";
|
|
5
|
+
import type { ResolvedQaSurfaceConfig } from "./types.js";
|
|
6
|
+
export interface QaSessionCreateOptions {
|
|
7
|
+
readonly ctx: Context;
|
|
8
|
+
readonly config: ResolvedQaSurfaceConfig;
|
|
9
|
+
readonly logger: PluginLogger;
|
|
10
|
+
readonly sessionFiles: QaStoredSessionEraser;
|
|
11
|
+
reserve(id: string): {
|
|
12
|
+
readonly id: string;
|
|
13
|
+
} | undefined;
|
|
14
|
+
release(owner: string, id: string): void;
|
|
15
|
+
modelPolicy(id: string): QaSessionModelPolicy;
|
|
16
|
+
preflight(): void;
|
|
17
|
+
admit(id: string): Promise<unknown>;
|
|
18
|
+
attest(id: string, owner: string | undefined): void;
|
|
19
|
+
reject(id: string): void;
|
|
20
|
+
/** Drop failure-only metadata after resource and ownership cleanup succeeds. */
|
|
21
|
+
forget(id: string): void;
|
|
22
|
+
}
|
|
23
|
+
/**
|
|
24
|
+
* Admit inside the native factory's serial publication callback. A failure is
|
|
25
|
+
* rolled back by the Host's lifecycle owner before we erase this UUID's log;
|
|
26
|
+
* native preset composition and dynamic default-model hooks stay intact.
|
|
27
|
+
*/
|
|
28
|
+
export declare function createQaSession(options: QaSessionCreateOptions): Promise<string>;
|
|
29
|
+
//# sourceMappingURL=session-create.d.ts.map
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
import type { QaAccountRole } from "./policy.js";
|
|
2
2
|
/** The account fields projected to browsers; never includes credentials. */
|
|
3
3
|
export interface QaAccountUserPublic {
|
|
4
|
+
/** Corporate passwords are managed outside QA. Absent on legacy/local accounts. */
|
|
5
|
+
readonly authMethod?: "oidc";
|
|
4
6
|
readonly id: string;
|
|
5
7
|
readonly email: string;
|
|
6
8
|
readonly displayName: string;
|
|
@@ -196,6 +196,12 @@ export interface QaQualityTrendPoint {
|
|
|
196
196
|
readonly negative: number;
|
|
197
197
|
}
|
|
198
198
|
export interface QaQualityMetrics {
|
|
199
|
+
/** Counts derived from journals are incomplete until every journal was read. */
|
|
200
|
+
readonly coverage?: {
|
|
201
|
+
readonly complete: boolean;
|
|
202
|
+
readonly readConversations: number;
|
|
203
|
+
readonly totalConversations: number;
|
|
204
|
+
};
|
|
199
205
|
readonly conversations: number;
|
|
200
206
|
readonly activeUsers: number;
|
|
201
207
|
readonly assistantMessages: number;
|
|
@@ -94,6 +94,7 @@ export interface QaNotesConfig {
|
|
|
94
94
|
};
|
|
95
95
|
}
|
|
96
96
|
export interface QaSurfaceConfig {
|
|
97
|
+
readonly forms?: Partial<import("../forms/types.js").QaFormPolicy>;
|
|
97
98
|
readonly enabled?: boolean;
|
|
98
99
|
readonly route?: {
|
|
99
100
|
readonly path?: string;
|
|
@@ -237,6 +238,8 @@ export interface QaSurfaceConfig {
|
|
|
237
238
|
readonly frameAncestors?: string | null;
|
|
238
239
|
};
|
|
239
240
|
readonly accounts?: {
|
|
241
|
+
readonly localLogin?: boolean;
|
|
242
|
+
readonly oidc?: import("./oidc.js").QaOidcConfig;
|
|
240
243
|
/** Opt-in; the QA gate stays off until the deployment turns this on. */
|
|
241
244
|
readonly enabled?: boolean;
|
|
242
245
|
readonly allowRegistration?: boolean;
|
|
@@ -372,6 +375,7 @@ export interface QaAttachmentsConfig {
|
|
|
372
375
|
readonly extensions?: readonly string[];
|
|
373
376
|
}
|
|
374
377
|
export interface ResolvedQaSurfaceConfig {
|
|
378
|
+
readonly forms: Readonly<import("../forms/types.js").QaFormPolicy>;
|
|
375
379
|
readonly enabled: boolean;
|
|
376
380
|
readonly route: {
|
|
377
381
|
readonly path: string;
|
|
@@ -441,6 +445,8 @@ export interface ResolvedQaSurfaceConfig {
|
|
|
441
445
|
readonly frameAncestors: string | null;
|
|
442
446
|
};
|
|
443
447
|
readonly accounts: {
|
|
448
|
+
readonly localLogin: boolean;
|
|
449
|
+
readonly oidc: import("./oidc.js").ResolvedQaOidcConfig;
|
|
444
450
|
readonly enabled: boolean;
|
|
445
451
|
readonly allowRegistration: boolean;
|
|
446
452
|
readonly sessionTtlDays: number;
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/** Server OIDC configuration. Secrets are referenced by environment name only. */
|
|
2
|
+
export interface QaOidcConfig {
|
|
3
|
+
readonly enabled?: boolean;
|
|
4
|
+
readonly issuer?: string;
|
|
5
|
+
readonly clientId?: string;
|
|
6
|
+
readonly clientSecretEnv?: string;
|
|
7
|
+
/** Exact public HTTPS callback URL, including any reverse proxy prefix. */
|
|
8
|
+
readonly redirectUri?: string;
|
|
9
|
+
readonly buttonLabel?: string;
|
|
10
|
+
readonly autoProvision?: boolean;
|
|
11
|
+
/** Client roles included in the signed ID token's resource_access claim. */
|
|
12
|
+
readonly requiredRole?: string;
|
|
13
|
+
readonly adminRole?: string;
|
|
14
|
+
readonly reviewerRole?: string;
|
|
15
|
+
/** Upper bound on QA access before another OIDC authentication. */
|
|
16
|
+
readonly sessionTtlSeconds?: number;
|
|
17
|
+
}
|
|
18
|
+
export interface ResolvedQaOidcConfig {
|
|
19
|
+
readonly enabled: boolean;
|
|
20
|
+
readonly issuer: string;
|
|
21
|
+
readonly clientId: string;
|
|
22
|
+
readonly clientSecretEnv: string;
|
|
23
|
+
readonly redirectUri: string;
|
|
24
|
+
readonly buttonLabel: string;
|
|
25
|
+
readonly autoProvision: boolean;
|
|
26
|
+
readonly requiredRole: string;
|
|
27
|
+
readonly adminRole: string;
|
|
28
|
+
readonly reviewerRole: string;
|
|
29
|
+
readonly sessionTtlSeconds: number;
|
|
30
|
+
}
|
|
31
|
+
/** The browser retains completionKey in sessionStorage before leaving QA. */
|
|
32
|
+
export interface QaOidcStart {
|
|
33
|
+
readonly authorizationUrl: string;
|
|
34
|
+
readonly completionKey: string;
|
|
35
|
+
}
|
|
36
|
+
//# sourceMappingURL=oidc.d.ts.map
|
|
@@ -331,6 +331,14 @@ export interface QaQueueStatus {
|
|
|
331
331
|
readonly active: number;
|
|
332
332
|
/** Whether one more turn fits; false while no ceiling is set. */
|
|
333
333
|
readonly full: boolean;
|
|
334
|
+
/** The Host enforces admission and starts queued turns automatically. */
|
|
335
|
+
readonly managed?: boolean;
|
|
336
|
+
readonly queued?: number;
|
|
337
|
+
/** Present only for the authorized chat whose status was requested. */
|
|
338
|
+
readonly waiting?: boolean;
|
|
339
|
+
readonly position?: number | null;
|
|
340
|
+
/** Approximate delay derived from completed turns, or null without a sample. */
|
|
341
|
+
readonly estimatedWaitMs?: number | null;
|
|
334
342
|
}
|
|
335
343
|
export interface QaSessionState {
|
|
336
344
|
readonly chatAccess?: import("../chat-sharing/types.js").QaChatAccess;
|
package/lib/types/types.d.ts
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
export type * from "./types/policy.js";
|
|
2
|
+
export type * from "./forms/types.js";
|
|
2
3
|
export type * from "./types/capability.js";
|
|
3
4
|
export type * from "./types/access.js";
|
|
4
5
|
export type * from "./types/accounts.js";
|
|
6
|
+
export type * from "./types/oidc.js";
|
|
5
7
|
export type * from "./types/skills.js";
|
|
6
8
|
export type * from "./types/expert-memory.js";
|
|
7
9
|
export type * from "./types/config.js";
|
|
@@ -10,6 +10,8 @@ export interface QaToolExecutionLike {
|
|
|
10
10
|
export interface QaUserWorkspaceReadPolicy {
|
|
11
11
|
/** Shared directories exposed only to read-only filesystem tools. */
|
|
12
12
|
readonly sharedReadOnlyRoots?: readonly string[];
|
|
13
|
+
/** Exact canonical files derived from this conversation's trusted references. */
|
|
14
|
+
readonly attachmentFiles?: readonly string[];
|
|
13
15
|
}
|
|
14
16
|
export declare function pathIsInside(target: string, root: string): boolean;
|
|
15
17
|
/**
|
|
@@ -31,12 +33,8 @@ export declare function existingQaUserWorkspace(workspaceRoot: string, userId: s
|
|
|
31
33
|
* fences model-controlled file paths for both reads and writes, rejects tools
|
|
32
34
|
* whose implementation can walk above cwd, and enforces bounded scratch use.
|
|
33
35
|
*
|
|
34
|
-
* `attachmentRoot`
|
|
35
|
-
*
|
|
36
|
-
* workspace, and the model reaches it exactly as the harness intends (the
|
|
37
|
-
* prompt carries the stored path). Reads of a single such file are allowed;
|
|
38
|
-
* directory-wide tools stay confined because the store is shared by every
|
|
39
|
-
* account, and writes are never exempted.
|
|
36
|
+
* `attachmentRoot` identifies the storage backend, never authority to read it.
|
|
37
|
+
* Only regular files in `attachmentFiles` may cross the workspace boundary.
|
|
40
38
|
*/
|
|
41
39
|
export declare function qaUserWorkspaceDenial(execution: QaToolExecutionLike, root: string, attachmentRoot?: string, readPolicy?: QaUserWorkspaceReadPolicy): string | undefined;
|
|
42
40
|
//# sourceMappingURL=user-workspace.d.ts.map
|
package/lib/user-workspace.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, } from "node:fs";
|
|
2
2
|
import path from "node:path";
|
|
3
|
+
import { qaFilesystemIntent } from "./filesystem-intent.js";
|
|
3
4
|
/** Stable, non-workspace child used to keep account directories out of sight. */
|
|
4
5
|
export const QA_USER_WORKSPACES_DIRECTORY = ".qa-users";
|
|
5
6
|
/** Conservative fixed budgets; there is deliberately no browser override. */
|
|
@@ -105,49 +106,6 @@ function record(value) {
|
|
|
105
106
|
? value
|
|
106
107
|
: undefined;
|
|
107
108
|
}
|
|
108
|
-
function requestedPaths(execution) {
|
|
109
|
-
const args = record(execution.arguments);
|
|
110
|
-
if (args === undefined)
|
|
111
|
-
return [];
|
|
112
|
-
switch (execution.name) {
|
|
113
|
-
case "read":
|
|
114
|
-
case "read_image":
|
|
115
|
-
case "write":
|
|
116
|
-
case "edit": {
|
|
117
|
-
return typeof args.file_path === "string" ? [args.file_path] : [];
|
|
118
|
-
}
|
|
119
|
-
case "glob":
|
|
120
|
-
case "grep": {
|
|
121
|
-
return [typeof args.path === "string" ? args.path : "."];
|
|
122
|
-
}
|
|
123
|
-
case "str_replace_editor": {
|
|
124
|
-
return typeof args.path === "string" ? [args.path] : [];
|
|
125
|
-
}
|
|
126
|
-
default:
|
|
127
|
-
return [];
|
|
128
|
-
}
|
|
129
|
-
}
|
|
130
|
-
/**
|
|
131
|
-
* Whether the named path is only read. Directory-wide tools stay confined even
|
|
132
|
-
* for reads: the attachment store is shared by every account, and only the
|
|
133
|
-
* exact file an upload produced is meant to be reachable.
|
|
134
|
-
*/
|
|
135
|
-
function readsSharedRoot(execution) {
|
|
136
|
-
if (execution.name === "read" ||
|
|
137
|
-
execution.name === "read_image" ||
|
|
138
|
-
execution.name === "glob" ||
|
|
139
|
-
execution.name === "grep") {
|
|
140
|
-
return true;
|
|
141
|
-
}
|
|
142
|
-
return (execution.name === "str_replace_editor" &&
|
|
143
|
-
record(execution.arguments)?.command === "view");
|
|
144
|
-
}
|
|
145
|
-
function readsSingleFile(execution) {
|
|
146
|
-
if (execution.name === "read" || execution.name === "read_image")
|
|
147
|
-
return true;
|
|
148
|
-
return (execution.name === "str_replace_editor" &&
|
|
149
|
-
record(execution.arguments)?.command === "view");
|
|
150
|
-
}
|
|
151
109
|
function directoryBytes(root, stopAfter) {
|
|
152
110
|
let total = 0;
|
|
153
111
|
const pending = [root];
|
|
@@ -167,24 +125,13 @@ function directoryBytes(root, stopAfter) {
|
|
|
167
125
|
}
|
|
168
126
|
return total;
|
|
169
127
|
}
|
|
170
|
-
function requestedWriteBytes(execution) {
|
|
171
|
-
const args = record(execution.arguments);
|
|
172
|
-
if (args === undefined)
|
|
173
|
-
return 0;
|
|
174
|
-
const values = [args.content, args.new_string, args.new_str];
|
|
175
|
-
return values.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value) : 0), 0);
|
|
176
|
-
}
|
|
177
128
|
/**
|
|
178
129
|
* Monotonic guard used in addition to DSH's workspace-write sandbox. It
|
|
179
130
|
* fences model-controlled file paths for both reads and writes, rejects tools
|
|
180
131
|
* whose implementation can walk above cwd, and enforces bounded scratch use.
|
|
181
132
|
*
|
|
182
|
-
* `attachmentRoot`
|
|
183
|
-
*
|
|
184
|
-
* workspace, and the model reaches it exactly as the harness intends (the
|
|
185
|
-
* prompt carries the stored path). Reads of a single such file are allowed;
|
|
186
|
-
* directory-wide tools stay confined because the store is shared by every
|
|
187
|
-
* account, and writes are never exempted.
|
|
133
|
+
* `attachmentRoot` identifies the storage backend, never authority to read it.
|
|
134
|
+
* Only regular files in `attachmentFiles` may cross the workspace boundary.
|
|
188
135
|
*/
|
|
189
136
|
export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolicy = {}) {
|
|
190
137
|
const args = record(execution.arguments);
|
|
@@ -202,35 +149,34 @@ export function qaUserWorkspaceDenial(execution, root, attachmentRoot, readPolic
|
|
|
202
149
|
execution.name === "apply_patch") {
|
|
203
150
|
return PATH_DENIAL;
|
|
204
151
|
}
|
|
205
|
-
const
|
|
206
|
-
const readsOneFile = readsSingleFile(execution);
|
|
152
|
+
const intent = qaFilesystemIntent(execution.name, args);
|
|
207
153
|
try {
|
|
208
154
|
const sharedReadOnlyRoots = (readPolicy.sharedReadOnlyRoots ?? []).map(canonicalCandidate);
|
|
209
|
-
for (const requested of
|
|
155
|
+
for (const requested of intent === undefined ? [] : [intent.path]) {
|
|
210
156
|
const absolute = path.isAbsolute(requested)
|
|
211
157
|
? requested
|
|
212
158
|
: path.resolve(root, requested);
|
|
213
159
|
const canonical = canonicalCandidate(absolute);
|
|
214
160
|
if (pathIsInside(canonical, root))
|
|
215
161
|
continue;
|
|
216
|
-
if (
|
|
162
|
+
if (intent?.kind === "read" &&
|
|
217
163
|
sharedReadOnlyRoots.some((readRoot) => pathIsInside(canonical, readRoot))) {
|
|
218
164
|
continue;
|
|
219
165
|
}
|
|
220
166
|
// Resolved only for a path the fence would otherwise refuse, so the
|
|
221
167
|
// common case pays no extra filesystem walk.
|
|
222
|
-
if (
|
|
168
|
+
if (intent?.kind === "read" &&
|
|
169
|
+
intent.fileOnlyGrant &&
|
|
223
170
|
attachmentRoot !== undefined &&
|
|
224
|
-
pathIsInside(canonical, canonicalCandidate(attachmentRoot))
|
|
171
|
+
pathIsInside(canonical, canonicalCandidate(attachmentRoot)) &&
|
|
172
|
+
(readPolicy.attachmentFiles ?? []).some((file) => samePath(canonical, file)) &&
|
|
173
|
+
statSync(canonical).isFile()) {
|
|
225
174
|
continue;
|
|
226
175
|
}
|
|
227
176
|
return PATH_DENIAL;
|
|
228
177
|
}
|
|
229
|
-
if (
|
|
230
|
-
|
|
231
|
-
(execution.name === "str_replace_editor" &&
|
|
232
|
-
record(execution.arguments)?.command !== "view")) {
|
|
233
|
-
const requested = requestedWriteBytes(execution);
|
|
178
|
+
if (intent?.kind === "write") {
|
|
179
|
+
const requested = intent.bytes;
|
|
234
180
|
if (requested > QA_USER_WORKSPACE_MAX_WRITE_BYTES ||
|
|
235
181
|
directoryBytes(root, QA_USER_WORKSPACE_MAX_BYTES) + requested >
|
|
236
182
|
QA_USER_WORKSPACE_MAX_BYTES) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"user-workspace.js","sourceRoot":"","sources":["../src/user-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,MAAM,eAAe,GACnB,6EAA6E,CAAC;AAChF,MAAM,WAAW,GACf,+DAA+D,CAAC;AAClE,MAAM,YAAY,GAAG,gDAAgD,CAAC;AActE,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,KAAK,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,IACE,CAAC,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrD,CAAC,YAAY,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;QACpD,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8B,EAC9B,IAAY,EACZ,cAAuB,EACvB,UAAU,GAA8B,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IACE,IAAI,EAAE,mBAAmB,KAAK,SAAS;QACvC,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;YACxB,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,EAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;QACzB,SAAS,CAAC,IAAI,KAAK,OAAO;QAC1B,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACjC,SAAS,CAAC,IAAI,KAAK,UAAU;QAC7B,SAAS,CAAC,IAAI,KAAK,KAAK;QACxB,SAAS,CAAC,IAAI,KAAK,aAAa,EAChC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,kBAAkB,CACnB,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAC5C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAClC,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,oEAAoE;YACpE,6CAA6C;YAC7C,IACE,MAAM,EAAE,IAAI,KAAK,MAAM;gBACvB,MAAM,CAAC,aAAa;gBACpB,cAAc,KAAK,SAAS;gBAC5B,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBAC3D,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAC1B;gBACD,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAC5B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YAC/B,IACE,SAAS,GAAG,iCAAiC;gBAC7C,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,GAAG,SAAS;oBAC3D,2BAA2B,EAC7B,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC"}
|