@yadsh/dsh-qa-surface 0.6.1 → 0.7.1

package/README.md

@@ -22,6 +22,9 @@ Session and Agent Loop.
 - pins locked sessions to the configured `read-only` or isolated
   `workspace-write` policy plus `approval=never` before Send is enabled;
 - applies a Host-side tool allow-list plus a monotonic execution guard;
+- separates account authorization (`admin`/`user`) from the QA agent's active
+  subrole, with server-owned Common, per-role Tools and Skills, immutable
+  session snapshots, and a dedicated administration page at `/qa/admin`;
 - attaches its own QA tool catalog per agent only after the activation skill
   loads (`tools.dynamicActivation`), keeping every QA schema out of the initial
   request and restoring the catalog on resume from the session's own journal;
@@ -44,14 +47,17 @@ Session and Agent Loop.
 - ships an operator settings card (Settings → Plugins → plugin configuration →
   «Помощник QA») that edits the `qa-surface` namespace in place — route,
   branding, session, interface, lockdown, accounts, sources, attachments,
-  documents, embedding — and reports the configuration the running Host
+  embedding — and reports the configuration the running Host
   resolved;
-- registers four document tools (`document_create`, `document_to_markdown`,
-  `document_convert`, `document_inspect`) behind `documents.enabled`: the agent
-  writes Markdown and receives DOCX/PDF, or hands over a DOCX/PDF and receives
-  Markdown, while the pipeline owns every backend command line, keeps source,
-  assets, outputs and a manifest in one artifact bundle, and is visible to a QA
-  chat only through the tool allow-list;
+- no longer owns the document pipeline: `document_create`,
+  `document_to_markdown`, `document_from_url`, `document_convert` and
+  `document_inspect` come from [`@yadsh/dsh-documents`](https://github.com/xarleyn/dsh-plugins/tree/main/plugins/dsh-documents#readme),
+  which a QA chat reaches exactly as before — same tool names, same allow-list
+  entry, same artifact layout. What moved with it is the configuration: the
+  pipeline is configured in that plugin's own `documents` namespace and card
+  (`QA_DOCUMENTS_*` environment variables became `DSH_DOCUMENTS_*`), and a
+  leftover `documents:` section under `qa-surface` is ignored with a
+  `documents.moved` warning in the Host log;
 - uses the existing same-origin DSH connection and trust boundary.
 
 It does not add another HTTP server, provider proxy, permissive CORS rule, or
@@ -571,6 +577,33 @@ export function apply(ctx: Context) {
 }
 ```
 
+### The signed-in account outside the dialog
+
+A card mounted in the host's own settings (`settings.plugin.item`) has no panel
+props to read the account from, so the same contract also publishes the session
+as the `qaUserSession` client service: `checking`, `anonymous` or `authed` with
+the bearer credential the principal-scoped QA remotes authorize with. It follows
+the same account controller the pages use, so a card and the dialog never
+disagree. Subscribe to it with `useSyncExternalStore` and render account-bound
+controls only for `authed` — without an account every call would be refused, and
+the credential is transport authentication only: never persist it, log it, or
+put it in a URL, a tool argument or any model-visible value.
+
+```ts
+import type { Context } from "@deepseek-ai/cordis"
+
+export const inject = ["qaUserSession", "slots"]
+
+export function apply(ctx: Context) {
+  ctx.effect(() =>
+    ctx.slots.inject("settings.plugin.item", () =>
+      ctx.slots.register(
+        { name: "settings.plugin.item", key: "my-namespace" },
+        MyCard,
+      )))
+}
+```
+
 Subagents: the deployment may opt the delegation family (`subagent`,
 `subagent_fork`, `send_message`, `list_agents`, `interrupt_agent`) into the
 lockdown allow-list; the preset must mount them. Launches then render as
@@ -662,6 +695,129 @@ Host-installed integration plugins may add their own narrowly scoped tool names
 through the QA Surface service; those executors must independently resolve the
 owner-attested root principal and fail closed for unowned or child sessions.
 
+## Subroles and capability policies
+
+With `accounts.enabled: true`, every QA session has exactly one active agent
+subrole. The Host resolves its effective capabilities as the union of the
+minimal system-required set, Common capabilities, and that one subrole; it
+never unions all roles assigned to the user. The chosen role and effective
+snapshot are stored with session ownership. Existing conversations never gain
+new capabilities after an administrator edits a role, while a capability that
+disappears from the running registry is revoked immediately.
+
+Administrators manage subroles, Common Tools/Skills, user assignments and the
+audit trail at `/qa/admin`. Capability choices come from the live tool and
+skill registries; configured-but-missing entries remain visible and are not
+deleted. Admin authorization affects only the management API and never grants
+agent capabilities. `Preview as role` creates an ordinary session using the
+selected role's real server-enforced policy and shows a persistent preview
+banner.
+
+The configuration lives in `$DSH_HOME/qa-capability-policies.json`; user
+assignments and session snapshots stay with the existing account store. Tools
+are filtered with an agent-scoped restriction and a pre-execution gate. Skills
+use an agent-scoped `skill` consumer that publishes only the allow-listed
+catalog and rejects direct out-of-policy loads with `SKILL_NOT_AVAILABLE`.
+The browser selector is hidden for a single assigned role. Switching roles
+after a meaningful turn requires confirmation and creates a new conversation.
+
+### Tools that arrive with a skill
+
+A role's tools are split into two classes. `always` tools are visible from the
+first model step. `skillGrantable` tools are a ceiling, not a grant: they stay
+out of the model's tool list until an activated skill requires them, which
+keeps a large catalog such as browser automation out of every step of every
+conversation. An older flat `tools: []` list is read as `always`, so an
+upgraded deployment never hands out more than it did before.
+
+### Skills declare their own audience
+
+A skill describes itself inside the ordinary `metadata` block of its
+`SKILL.md`, so the file stays a valid Agent Skill outside a QA deployment and
+no upstream schema is forked:
+
+```yaml
+---
+name: browser-research
+description: Research websites through browser automation
+
+metadata:
+  qa-surface:
+    version: 1
+    audience:
+      type: subroles        # or: type: common
+      include: [analyst, presales]
+    tools:
+      requires: [browser_open, browser_click]
+      grant:
+        lifecycle: session  # the only lifecycle in v1
+        requireAll: true
+---
+```
+
+The audience decides visibility; the role ceiling decides what a skill may ever
+receive. A load intersects the two, so a skill cannot widen its own access. A
+skill that declares nothing stays `Unassigned` until an administrator assigns
+it, which is safer than treating every new skill as Common.
+
+Loading the instructions and widening the toolset is one operation. A strict
+skill (`requireAll: true`) refuses to activate when one of its tools is
+unavailable, and a best-effort skill activates with a visible warning that
+names what it did not receive. The model's `skill` call and a typed
+`/skill-name` activate the same grant; a `/name` naming a skill outside the
+subrole is withdrawn before the step is assembled. Grants last for the current
+agent, and several loaded skills union their tools — activating a second skill
+never revokes what the first one still holds.
+
+Administrators edit assignments as an overlay, never by rewriting `SKILL.md`: a
+role can be added to or withdrawn from a declared audience, a skill can be
+forced on for every role or disabled outright, and the Skills page shows the
+declared audience next to the effective one with a
+`Healthy`/`Degraded`/`Blocked` state. Every activation is recorded on the
+session record with the requested, granted and denied tools, so a later review
+can see what a conversation actually gained.
+## Administrative console
+
+`/qa/admin` is the review and administration surface. It is part of the QA page
+itself, not a separate application, and it is open to `admin` and `reviewer`
+accounts. Reviewer sees conversations, the review queue, feedback and
+analytics; only an administrator sees users, capability policies and audit.
+
+The console covers the quality loop end to end:
+
+- **Overview** — conversation, rating and review counters, the items that need
+  attention, and the newest signals.
+- **Users** — authorization role, enabled/disabled status, assigned QA subroles
+  and the default one, plus per-account activity. Disabling an account is the
+  operation to reach for: historical conversations, feedback and reviews stay
+  attributed to their author, and the last enabled administrator cannot be
+  demoted, disabled or removed.
+- **Conversations** — every conversation the deployment knows, filterable by
+  user, subrole, date range, rating and review state, with a viewer that reads
+  the stored transcript: messages in recorded order, tool calls with their
+  arguments, results and errors, per-message feedback, and the capability
+  snapshot frozen when the session started. A link can point at one message
+  (`/qa/admin/conversations/<id>/<seq>`).
+- **Review queue** — what needs attention, derived from unanswered negative
+  feedback, explicitly queued conversations and failed tool calls. A reviewer
+  classifies issues across answer, context, tools, skills and access, sets a
+  severity, writes notes and names the remediation target.
+- **Feedback** — every rating against the exact answer it judged, with the
+  optional reason and comment the user gave.
+- **Analytics** — rating coverage, positive share overall and per subrole,
+  issue distribution and a daily trend. These are user-satisfaction signals;
+  the console never presents them as accuracy.
+- **Audit** — one timeline of authorization changes, account status, subrole
+  assignments, policy edits and review verdicts, each with its before/after
+  image.
+
+Authorization is a permission table, not an `isAdmin` flag, and every
+administrative entry point names the permission it needs; the Host re-checks it
+on the call it serves, so a hidden control is convenience rather than the
+boundary. Review material is the most sensitive data the package handles, so
+tool arguments and results are bounded previews with credential shapes masked,
+behind a redactor a deployment can replace.
+
 ## Security and deployment
 
 `/qa` is a presentation boundary, not an authentication boundary. Protect it

package/capability-policy.json

@@ -1,5 +1,5 @@
 {
   "version": 1,
-  "description": "Reviewed capabilities in the shipped default QA tool allow-list.",
+  "description": "Minimal system-required tools inherited by every QA subrole. Common and role-specific grants are managed in /qa/admin.",
   "tools": []
 }

package/lib/access/capability-catalog.js

@@ -0,0 +1,144 @@
+import { parseQaSkillMetadata } from "./skill-metadata.js";
+function toolSource(name) {
+    if (name.startsWith("mcp__")) {
+        const server = name.slice(5).split("__", 1)[0];
+        return { kind: "mcp", ...(server === "" ? {} : { name: server }) };
+    }
+    if (name.startsWith("qa_") || name.startsWith("document_")) {
+        return { kind: "plugin", name: "dsh-qa-surface" };
+    }
+    return { kind: "core" };
+}
+function skillSource(skill) {
+    const kind = skill.provider.includes("filesystem") || skill.source.includes("project")
+        ? "filesystem"
+        : skill.source === "runtime"
+            ? "runtime"
+            : "plugin";
+    return { kind, name: skill.provider || skill.source };
+}
+/** Read-only adapter over the current DSH registries. */
+export class QaCapabilityCatalog {
+    ctx;
+    additionalToolNames;
+    knownSubroles;
+    constructor(ctx, additionalToolNames = () => [], 
+    /** Role ids used to report unknown subrole ids in skill metadata. */
+    knownSubroles = () => []) {
+        this.ctx = ctx;
+        this.additionalToolNames = additionalToolNames;
+        this.knownSubroles = knownSubroles;
+    }
+    async snapshot(agent) {
+        const toolDescriptors = this.ctx.tools
+            .schemas(agent)
+            .map((schema) => ({
+            type: "tool",
+            id: schema.name,
+            title: schema.name,
+            ...(schema.description === undefined
+                ? {}
+                : { description: schema.description }),
+            source: toolSource(schema.name),
+            status: "available",
+        }));
+        const mountedToolIds = new Set(toolDescriptors.map(({ id }) => id));
+        for (const id of this.additionalToolNames()) {
+            if (mountedToolIds.has(id))
+                continue;
+            mountedToolIds.add(id);
+            toolDescriptors.push({
+                type: "tool",
+                id,
+                title: id,
+                source: toolSource(id),
+                status: "available",
+            });
+        }
+        const registry = this.ctx.get("skills");
+        const lookup = {
+            ...(agent === undefined ? {} : { scope: agent }),
+            ...(agent?.session.header.cwd === undefined
+                ? {}
+                : { cwd: agent.session.header.cwd }),
+        };
+        const skillList = registry === undefined ? [] : (await registry.snapshot(lookup)).skills;
+        const skills = new Map(skillList.map((skill) => [skill.name, skill]));
+        const skillDescriptors = skillList.map((skill) => ({
+            type: "skill",
+            id: skill.name,
+            title: skill.name,
+            description: skill.description,
+            source: skillSource(skill),
+            status: "available",
+            modelInvocable: skill.invocation.modelInvocable,
+            userInvocable: skill.invocation.userInvocable,
+        }));
+        const descriptors = [...toolDescriptors, ...skillDescriptors].sort((left, right) => left.type.localeCompare(right.type) || left.id.localeCompare(right.id));
+        return Object.freeze({
+            descriptors: Object.freeze(descriptors),
+            toolIds: new Set(toolDescriptors.map(({ id }) => id)),
+            skillIds: new Set(skillList
+                .filter(({ invocation }) => invocation.modelInvocable)
+                .map(({ name }) => name)),
+            userSkillIds: new Set(skillList
+                .filter(({ invocation }) => invocation.userInvocable)
+                .map(({ name }) => name)),
+            skills,
+            skillMetadata: registry === undefined
+                ? new Map()
+                : await this.readSkillMetadata(registry, skillList, lookup),
+        });
+    }
+    /**
+     * Read `metadata.qa-surface` of every discovered skill.
+     *
+     * The registry exposes metadata on loaded definitions only, so discovery has
+     * to fetch each body once. A provider that fails or a skill that disappears
+     * between the two reads degrades to the fail-closed descriptor instead of
+     * failing the whole catalog.
+     */
+    async readSkillMetadata(registry, skillList, lookup) {
+        const known = new Set(this.knownSubroles());
+        const metadata = new Map();
+        for (const skill of skillList) {
+            let definition;
+            try {
+                definition = await registry.get(skill.name, lookup);
+            }
+            catch {
+                definition = undefined;
+            }
+            metadata.set(skill.name, parseQaSkillMetadata(skill.name, definition?.metadata, known));
+        }
+        return metadata;
+    }
+}
+export function withMissingCapabilities(descriptors, configuredTools, configuredSkills) {
+    const keys = new Set(descriptors.map(({ type, id }) => `${type}:${id}`));
+    const missing = [];
+    for (const id of configuredTools) {
+        if (!keys.has(`tool:${id}`)) {
+            missing.push({
+                type: "tool",
+                id,
+                title: id,
+                source: { kind: "plugin" },
+                status: "missing",
+            });
+        }
+    }
+    for (const id of configuredSkills) {
+        if (!keys.has(`skill:${id}`)) {
+            missing.push({
+                type: "skill",
+                id,
+                title: id,
+                source: { kind: "plugin" },
+                status: "missing",
+            });
+        }
+    }
+    return Object.freeze([...descriptors, ...missing]);
+}
+//# sourceMappingURL=capability-catalog.js.map

package/lib/access/capability-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-catalog.js","sourceRoot":"","sources":["../../src/access/capability-catalog.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAc3D,SAAS,UAAU,CAAC,IAAY;IAI9B,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ,CAAC;IACjB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,yDAAyD;AACzD,MAAM,OAAO,mBAAmB;IAEX,GAAG;IACH,mBAAmB;IAEnB,aAAa;IAJhC,YACmB,GAAY,EACZ,mBAAmB,GAA4B,GAAG,EAAE,CAAC,EAAE;IACxE,qEAAqE;IACpD,aAAa,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAHjD,GAAG;mCACH,mBAAmB;6BAEnB,aAAa;IAC7B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,eAAe,GAA6B,IAAI,CAAC,GAAG,CAAC,KAAK;aAC7D,OAAO,CAAC,KAAK,CAAC;aACd,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,IAAI,EAAE,MAAe;YACrB,EAAE,EAAE,MAAM,CAAC,IAAI;YACf,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,WAAoB;SAC7B,CAAC,CAAC,CAAC;QACN,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM;gBACZ,EAAE;gBACF,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAkC,CAAC;QACzE,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;SACvC,CAAC;QACF,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAA6B,SAAS,CAAC,GAAG,CAC9D,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACV,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,KAAK,CAAC,IAAI;YACd,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;YAC/C,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;SAC9C,CAAC,CACH,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAChE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,OAAO,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACrD,QAAQ,EAAE,IAAI,GAAG,CACf,SAAS;iBACN,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;iBACrD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC3B;YACD,YAAY,EAAE,IAAI,GAAG,CACnB,SAAS;iBACN,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;iBACpD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC3B;YACD,MAAM;YACN,aAAa,EACX,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,IAAI,GAAG,EAA6B;gBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAC7B,QAA2B,EAC3B,SAAkC,EAClC,MAAyD;QAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,UAAyD,CAAC;YAC9D,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;YACD,QAAQ,CAAC,GAAG,CACV,KAAK,CAAC,IAAI,EACV,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,WAA8C,EAC9C,eAAkC,EAClC,gBAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,EAAE;gBACF,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,EAAE;gBACF,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC"}