agentfootprint 9.87.1 → 9.89.0

package/dist/lib/time-travel/receipt.js

@@ -0,0 +1,442 @@
+"use strict";
+/**
+ * receipt — what the model was actually handed, recorded at the stop where it
+ * was handed it.
+ *
+ * Role:  Fold. This module owns the receipt's SHAPE and the one function that
+ *        mints one (`buildReceipt`); the agent's request assembly calls it and
+ *        commits the result under the scope key `receipt`, so the record lands
+ *        in the call-llm bundle that already exists. Nothing here executes,
+ *        reads scope, or emits.
+ * Reads: its arguments.
+ * Emits: N/A.
+ *
+ * ── THE FIRST LAW: NO AUTHORITY OMISSIONS ──────────────────────────────────
+ * A receipt never names — and never counts — what a caller's ROLE was not
+ * allowed to see. Committed state is readable by the trace toolpack's
+ * debugging tools, so a receipt carrying `hiddenSkillIds`, or even "3 skills
+ * withheld", would turn a permission decision into a leak path: the thing the
+ * check exists to hide, restated one layer down where nobody is checking. A
+ * reader that needs those ids reads them from the fold (`hiddenSkillIds` is
+ * committed state, and reading it is governed where it is read), not from
+ * here.
+ *
+ * ATTENTION omissions are a different fact and MAY ride the receipt:
+ * `omittedForAttention` says a slot's budget dropped content. Nobody was
+ * refused anything — the request simply did not fit — and a reader chasing "why
+ * did it not know that?" needs to see it. Even there the summaries are hashed,
+ * never quoted, for the same reason everything else on a receipt is.
+ *
+ * Measured on 9.88.0, NO chart shape supplies it: a slot writes its drops to
+ * `slotCompositions` inside its own subflow and no boundary bubbles that record
+ * out, so the agent's request assembly has nothing to pass. The field is on the
+ * shape because `buildReceipt` is a pure exported mint a caller can hand the
+ * fact to, and because the law it obeys is worth stating once rather than the
+ * day the record starts crossing. What is NOT done is go looking for it: a
+ * tracked read of an always-absent key is a read edge the trace then has to
+ * explain.
+ *
+ * ── THE SECOND LAW: HASHES AND REFERENCES, NEVER BYTES ─────────────────────
+ * A receipt is a fingerprint, not a copy. It records that a piece of a given
+ * shape and size was in a given position, and nothing about what it said. The
+ * bytes are already governed — `recordSystemPrompt` is opt-in for exactly this
+ * reason, redaction patterns scrub the committed mirror, and a window strategy
+ * decides what survives. A receipt that carried content would quietly reopen
+ * all three.
+ *
+ * ── THE THIRD LAW: HASHES ARE SALTED WITH THE RUN ID ───────────────────────
+ * `hash = sha256(runId + '\u001f' + content)`, first 16 hex characters. The
+ * salt is what stops a short piece from being fingerprinted ACROSS runs: an
+ * unsalted hash of a one-line system prompt, a tool schema, or a two-word user
+ * turn is a dictionary lookup away from being read back, and the receipt is
+ * committed state that travels in recordings. Salted per run, the same
+ * sentence in two runs has two hashes, so the fingerprint answers "is this the
+ * same as THAT piece of THIS run?" — which is the only question the
+ * conformance law asks — and answers nothing else.
+ *
+ * Hashes are NOT redacted, and the salt is what makes shipping THEM safe — not
+ * an assumption that something scrubbed them. It says nothing about the rest of
+ * the recording, and this law must not be read as if it did.
+ *
+ * WHAT A RECORDING ACTUALLY CONTAINS. An agent run is not redacted:
+ * `Agent.create(...)` has no redaction door, so a secret in a system prompt is
+ * in the commit log and in `servedAt(k).system.text`, verbatim. Redaction in
+ * this library is EXECUTOR-level — `flowchartAsTool({ redact })` /
+ * `runbookAsTool({ redact })` set a policy on an inner run, and footprintjs
+ * scrubs at COMMIT time, so a redacted key never enters that inner commit log
+ * (the same snapshot's live `sharedState` is a different view and is not
+ * scrubbed). A snapshot taken with `redact: true` also omits `initialState`,
+ * so folding it reports `basis: 'log-only'` and `servedView.ts` raises
+ * `no-fold-base` rather than rebuilding a short view in silence. Treat a
+ * recording as the plaintext it is; the salt protects the fingerprints, and
+ * only the fingerprints.
+ *
+ * ── THE FOURTH LAW: THE RECEIPT IS MINTED AT THE PROVIDER PORT ─────────────
+ * Everything on a receipt describes the request AS HANDED TO
+ * `LLMProvider.complete` — the port, not the wire. Anything downstream of that
+ * boundary is outside what this record can witness: a decorated provider, a
+ * vendor adapter's own serializer, a consumer's hand-written `complete`, or the
+ * vendor's server-side defaults. `RECEIPT_BOUNDARY` states it in one sentence
+ * for a renderer to print, and `servedView.ts` · `SERVED_GAPS` names the two
+ * places a reader is most likely to mistake it for wire-level proof.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReceipt = exports.messageDigestInput = exports.toolDigestInput = exports.stableJson = exports.receiptHash = exports.RECEIPT_HASH_CHARS = exports.FORCED_OUTPUT_TOOL_KEY = exports.RECEIPT_KEY = exports.RECEIPT_BOUNDARY = exports.UNSERIALIZABLE = void 0;
+const sha256_js_1 = require("./sha256.js");
+/**
+ * The separator between two fields inside one digest input — ASCII UNIT
+ * SEPARATOR, which no prompt, tool name or JSON payload can contain (`JSON.
+ * stringify` escapes it). Written as an escape rather than a literal control
+ * character so a reader can see it and a formatter cannot eat it.
+ *
+ * Without it a digest is a bare concatenation, and a bare concatenation is
+ * ambiguous: `role + content` cannot tell `'user' + 'x'` from `'use' + 'rx'`.
+ */
+const SEP = '\u001F';
+/** The separator between two tool calls inside one message's digest. */
+const CALL_SEP = '\u001C';
+/** The separator between the fields of ONE tool call. */
+const CALL_FIELD_SEP = '\u001D';
+/** The separator between the top-level parts of a message's digest. */
+const FIELD_SEP = '\u001E';
+/**
+ * What a digest input records in place of a value JSON cannot express — a
+ * cycle, a `BigInt`, anything `stableJson` refuses. It is a MARK, not an empty
+ * string: two unserializable values are recorded as unserializable rather than
+ * as identical, which is what stops the cache comparison claiming "the strategy
+ * changed nothing" about two requests it could not read.
+ */
+exports.UNSERIALIZABLE = '\u001F<unserializable>';
+/**
+ * The boundary every receipt field is true at, in one sentence — exported so a
+ * renderer prints the library's own wording instead of inferring a stronger
+ * claim from a `null`.
+ *
+ * WHY IT IS A CONSTANT AND NOT A COMMENT. A reader who sees
+ * `cache.transform: 'unchanged'` will conclude "this request was not rewritten"
+ * unless something on the screen says otherwise, and the person who reads the
+ * screen is rarely the person who read the source. Print it beside the record.
+ *
+ * ── THE MECHANISM, WHICH THE PRINTED SENTENCE NO LONGER NAMES (9.88.0) ─────
+ * `buildReceipt` is called from `stages/callLLM.ts` with the request about to
+ * be passed to `LLMProvider.complete` — the PORT, this library's last sight of
+ * it. Three things sit downstream of that call and none of them is on the
+ * record: a provider decorated by the consumer (`complete()` wrapping
+ * `complete()`), a vendor adapter's own serializer, and the vendor's
+ * server-side defaults. `test/lib/time-travel/receipt-conformance.test.ts`
+ * reproduces the first of those — a decorator that appends a system suffix and
+ * a ghost tool after the mint, with `cache.transform` still reading
+ * `'unchanged'`, correctly.
+ *
+ * The sentence below used to say all of that, and it was PRINTED beside a
+ * trace by renderers that append it to a gap. A printed sentence names no
+ * module, function or call: it says which fields, what they mean here, and
+ * what to do — the rule in `test/helpers/gapProseClaims.ts`. So the mechanism
+ * lives in this comment, where a maintainer reads it and review catches its
+ * rot, and the constant says only the thing a reader must not get wrong.
+ *
+ * @example
+ * ```ts
+ * import { RECEIPT_BOUNDARY, receiptAt } from 'agentfootprint';
+ *
+ * const receipt = receiptAt(agent.getSnapshot()!, 1)!;
+ * if (receipt.cache.transform === 'unchanged') {
+ *   console.log(`the cache strategy changed nothing. ${RECEIPT_BOUNDARY}`);
+ * }
+ * ```
+ */
+exports.RECEIPT_BOUNDARY = 'A receipt describes the request as this library last saw it. Whatever ' +
+    'handled it after that could have changed it, and nothing on the receipt ' +
+    'would show that.';
+/** The scope key the receipt is committed under. */
+exports.RECEIPT_KEY = 'receipt';
+/** The scope key holding the name of the tool a `'tool-forced'` output
+ *  strategy put on the wire. `seed` commits it; `servedView.ts` · `servedAt`
+ *  reads it — so a rebuild can NAME the forced tool without reading the
+ *  receipt it is being checked against. */
+exports.FORCED_OUTPUT_TOOL_KEY = 'forcedOutputToolName';
+/** How many hex characters of the digest a receipt keeps. 16 — 64 bits, which
+ *  is far past collision range for the few dozen pieces of one run, and short
+ *  enough to read in a terminal. */
+exports.RECEIPT_HASH_CHARS = 16;
+/**
+ * The receipt's hash: run-salted SHA-256, first {@link RECEIPT_HASH_CHARS} hex
+ * characters. Exported because it is half of the conformance law — a reader
+ * that rebuilds a served view proves the rebuild by hashing it the same way.
+ *
+ * @example
+ * ```ts
+ * import { receiptAt, receiptHash, servedAt } from 'agentfootprint';
+ *
+ * const view = servedAt(agent.getSnapshot()!, 1)!;
+ * const receipt = receiptAt(agent.getSnapshot()!, 1)!;
+ * receiptHash(receipt.basis.runId, view.system.text) === receipt.system.hash; // true
+ * ```
+ */
+function receiptHash(runId, content) {
+    return (0, sha256_js_1.sha256Hex)(`${runId}${SEP}${content}`).slice(0, exports.RECEIPT_HASH_CHARS);
+}
+exports.receiptHash = receiptHash;
+/**
+ * JSON with object keys in sorted order, at every depth — so two structurally
+ * equal values hash the same however they were built. Property order survives
+ * `structuredClone`, but it does NOT survive every path a value takes through
+ * a delta-encoded commit log and back, and a fingerprint that depends on
+ * insertion order is a fingerprint that reports a change nobody made.
+ *
+ * Returns `undefined` — never `''` — for anything JSON cannot express (a
+ * cycle, a `BigInt`, a value whose `toJSON` throws). It does not throw,
+ * because a receipt is bookkeeping and must never be able to stop a run; and
+ * it does not collapse, because `''` made every unreadable value equal to
+ * every other one. Two requests that both failed to serialize compared EQUAL,
+ * and the receipt wrote `transformHash: null` — "the cache strategy changed
+ * nothing" — about a pair it had not read. Callers substitute
+ * {@link UNSERIALIZABLE} where a digest needs bytes, and branch where a
+ * comparison needs truth.
+ */
+function stableJson(value) {
+    const canonical = (input) => {
+        if (Array.isArray(input))
+            return input.map(canonical);
+        if (input !== null && typeof input === 'object') {
+            const source = input;
+            const out = {};
+            for (const key of Object.keys(source).sort()) {
+                const next = canonical(source[key]);
+                if (next === undefined)
+                    continue;
+                out[key] = next;
+            }
+            return out;
+        }
+        return input;
+    };
+    try {
+        return JSON.stringify(canonical(value)) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+exports.stableJson = stableJson;
+/** `stableJson`, with the unreadable marked rather than dropped — the form a
+ *  digest input takes. */
+function digestJson(value) {
+    return stableJson(value) ?? exports.UNSERIALIZABLE;
+}
+/**
+ * The bytes a tool schema's hash covers: the whole `LLMToolSchema` — `name`,
+ * `description`, `inputSchema` — as sorted-key JSON, so two schemas that are
+ * structurally the same hash the same however they were built, and with a
+ * schema JSON cannot express (a cycle, a `BigInt`) marked {@link UNSERIALIZABLE}
+ * rather than dropped or thrown on.
+ *
+ * WHAT TO PASS (9.89.0). The receipt hashes each tool AS HANDED TO THE PORT:
+ * `buildReceipt` is given the request's tool list, and that list is the
+ * `dynamicToolSchemas` the run committed, plus a forced answer tool when an
+ * output strategy adds one. `servedAt(k).tools.schemas[i]` is that committed
+ * list read back — the same shape, the same bytes — so a consumer holding a
+ * served view already holds the object this function takes. It does not take
+ * the served view, a `Tool`, or a `defineTool` definition: those carry an
+ * `execute`, `wants` and other fields the model never saw.
+ *
+ * WHY IT IS EXPORTED. A reader that rebuilds a served view proves the rebuild
+ * by hashing it the way the receipt did. `receiptHash` and `messageDigestInput`
+ * were exported in 9.88.0 for the system text, the pieces and the messages,
+ * and a consumer could verify all of them — and NOT the tools, because the
+ * serializer behind `schemaHashes` was internal. Its only options were to copy
+ * `stableJson` (a second owner of the rule, which drifts the day the digest
+ * gains a field, as the message digest did in 9.88.0) or to leave the schema
+ * rows unverified. This is the third digest half of the law, beside its two
+ * siblings, and the ONLY spelling of the schema rule: `buildReceipt` calls it
+ * too. `stableJson` stays off the root barrel for the same reason — a consumer
+ * composing `hash(stableJson(tool))` would be writing the rule a second time.
+ *
+ * @example verify every schema row of a receipt from outside
+ * ```ts
+ * import { receiptAt, receiptHash, servedAt, toolDigestInput } from 'agentfootprint';
+ *
+ * const snapshot = agent.getSnapshot()!;
+ * const view = servedAt(snapshot, 1)!;
+ * const receipt = receiptAt(snapshot, 1)!;
+ * for (const tool of view.tools.schemas) {
+ *   receiptHash(receipt.basis.runId, toolDigestInput(tool)) ===
+ *     receipt.tools.schemaHashes[tool.name]; // true, for every tool of every epoch
+ * }
+ * // A forced answer tool is in `schemaHashes` and NOT in `schemas` — its body
+ * // is a declared gap (`forced-tool-schema`), so there is no row to check.
+ * ```
+ */
+function toolDigestInput(tool) {
+    return digestJson(tool);
+}
+exports.toolDigestInput = toolDigestInput;
+/**
+ * The bytes a message's hash covers, each field behind a separator: its role,
+ * its text, its `toolCallId`, its `toolName`, the calls it asked for (id, name,
+ * arguments and `providerMeta`) and its `thinkingBlocks`.
+ *
+ * WHY `toolCallId` (9.88.0). It is the JOIN KEY — `tool_use_id` on Anthropic's
+ * wire, `tool_call_id` on OpenAI's — that pairs a tool result to the call that
+ * asked for it. Two parallel calls whose results happen to have identical text
+ * hashed the SAME without it, so a mis-pairing (the answer to `c1` filed under
+ * `c2`) was invisible to the law: exactly the defect a receipt exists to catch.
+ *
+ * WHY `toolName` TOO (9.88.0). On two shipped providers the id is not the join
+ * key at all. `adapters/llm/GeminiProvider.ts` · `toGeminiContents` pairs a
+ * `functionResponse` to its call BY NAME and says so in its own comment; the
+ * id is optional there and dropped when it is not a real one.
+ * `adapters/llm/OllamaProvider.ts` · `toOllamaMessages` puts `tool_name` on
+ * the wire and only falls back to the id. So on those providers a receipt that
+ * covered `toolCallId` alone still could not see the very mis-pairing the
+ * field was added for: two `role:'tool'` messages with identical text and
+ * SWAPPED names fingerprinted identically. It rides as its own field behind
+ * the separator, beside the id, so a name moving between two results changes
+ * both hashes and neither can absorb the other's bytes.
+ *
+ * WHY `thinkingBlocks` and `providerMeta` (9.88.0). `adapters/types.ts` is
+ * explicit that a signed thinking block MUST be echoed byte-exact or the API
+ * rejects the turn, and `providerMeta` round-trips vendor state (Gemini's
+ * `thoughtSignature`, without which the turn after a tool call is refused).
+ * Both are things the model receives; a fingerprint that omitted them said two
+ * requests were the same when one of them would be rejected. They enter as a
+ * `stableJson` FINGERPRINT, so nothing quotable is added — a signature is an
+ * opaque token, not content.
+ *
+ * Still deliberately NOT covered: `injectedBy` (stripped before the request
+ * exists) and `ephemeral` (a persistence flag, invisible to the model). Two
+ * messages that hash the same are the same thing said to the model.
+ */
+function messageDigestInput(message) {
+    const calls = (message.toolCalls ?? []).map((call) => [
+        call.id,
+        call.name,
+        digestJson(call.args),
+        call.providerMeta === undefined ? '' : digestJson(call.providerMeta),
+    ].join(CALL_FIELD_SEP));
+    return [
+        message.role,
+        message.content,
+        message.toolCallId ?? '',
+        message.toolName ?? '',
+        calls.join(CALL_SEP),
+        message.thinkingBlocks === undefined || message.thinkingBlocks.length === 0
+            ? ''
+            : digestJson(message.thinkingBlocks),
+    ].join(FIELD_SEP);
+}
+exports.messageDigestInput = messageDigestInput;
+/**
+ * The sampling knobs off the request the port was handed.
+ *
+ * Duck-typed and value-conditional: an agent that set no dial records no key,
+ * so `params` is `{}` rather than a row of `undefined`s claiming defaults the
+ * library never sent.
+ */
+function paramsOf(request) {
+    if (request === null || typeof request !== 'object')
+        return {};
+    const req = request;
+    const stop = Array.isArray(req.stop) ? req.stop.filter((s) => typeof s === 'string') : undefined;
+    return {
+        ...(typeof req.temperature === 'number' && { temperature: req.temperature }),
+        ...(typeof req.maxTokens === 'number' && { maxTokens: req.maxTokens }),
+        ...(typeof req.thinking?.budget === 'number' && { thinkingBudget: req.thinking.budget }),
+        ...(stop !== undefined && stop.length > 0 && { stop }),
+        ...(typeof req.toolChoice?.type === 'string' && {
+            toolChoice: {
+                type: req.toolChoice.type,
+                ...(typeof req.toolChoice.name === 'string' && { name: req.toolChoice.name }),
+            },
+        }),
+    };
+}
+/**
+ * Mint the receipt for one composed request.
+ *
+ * Pure and total: every branch here is arithmetic over what it was handed, so
+ * a receipt cannot fail a call. The one judgement it makes is the cache
+ * comparison, and it makes it in three values rather than two: `'unchanged'`
+ * exactly when the strategy handed back a request that serializes identically
+ * to the one it was given, `'rewritten'` when it did not, and `'unknown'` when
+ * either request could not be serialized at all — because "I could not read
+ * them" is not the same claim as "they were the same".
+ *
+ * Every value it produces is true AT THE PROVIDER PORT and nowhere past it —
+ * see {@link RECEIPT_BOUNDARY}.
+ */
+function buildReceipt(input) {
+    const hash = (content) => receiptHash(input.runId, content);
+    const schemaHashes = {};
+    for (const tool of input.tools)
+        schemaHashes[tool.name] = hash(toolDigestInput(tool));
+    // The cache verdict, three-valued. A pair the receipt could not read is
+    // 'unknown' — never 'unchanged', which is what `''` used to make it.
+    const base = stableJson(input.baseRequest);
+    const prepared = stableJson(input.preparedRequest);
+    const comparable = base !== undefined && prepared !== undefined;
+    const transform = !comparable
+        ? 'unknown'
+        : base === prepared
+            ? 'unchanged'
+            : 'rewritten';
+    return {
+        system: {
+            hash: hash(input.systemText),
+            chars: input.systemText.length,
+            pieces: input.systemPieces.map((piece) => ({
+                hash: hash(piece.text),
+                slot: piece.slot,
+                source: piece.source,
+            })),
+        },
+        messages: {
+            count: input.messages.length + input.requestOnly.length,
+            entries: input.messages.map((message) => ({
+                role: message.role,
+                hash: hash(messageDigestInput(message)),
+                ...(message.toolCallId !== undefined && { key: message.toolCallId }),
+            })),
+            requestOnly: input.requestOnly.map((line) => ({
+                role: line.message.role,
+                hash: hash(messageDigestInput(line.message)),
+                reason: line.reason,
+            })),
+        },
+        tools: {
+            names: input.tools.map((tool) => tool.name),
+            schemaHashes,
+            forced: input.forced,
+            withheld: input.withheld,
+        },
+        cache: {
+            transform,
+            transformHash: transform === 'rewritten' ? hash(prepared) : null,
+            markersApplied: (input.markersApplied ?? []).map((marker) => ({
+                field: marker.field,
+                boundaryIndex: marker.boundaryIndex,
+                ttl: marker.ttl,
+            })),
+        },
+        // The PREPARED request, not the base one: the port is handed what the cache
+        // strategy returned, and a strategy that rewrote maxTokens must not leave
+        // five receipt fields describing a request nobody sent. See
+        // {@link RECEIPT_BOUNDARY} — this is the boundary those fields are true at.
+        params: paramsOf(input.preparedRequest),
+        ...(input.omittedForAttention !== undefined &&
+            input.omittedForAttention.count > 0 && {
+            omittedForAttention: {
+                count: input.omittedForAttention.count,
+                hashes: input.omittedForAttention.summaries.map((summary) => hash(summary)),
+            },
+        }),
+        basis: {
+            epoch: input.epoch,
+            runId: input.runId,
+            model: input.model,
+            provider: input.provider,
+        },
+    };
+}
+exports.buildReceipt = buildReceipt;
+//# sourceMappingURL=receipt.js.map

package/dist/lib/time-travel/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../../src/lib/time-travel/receipt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;;;AAIH,2CAAwC;AAExC;;;;;;;;GAQG;AACH,MAAM,GAAG,GAAG,QAAQ,CAAC;AAErB,wEAAwE;AACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAE1B,yDAAyD;AACzD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,uEAAuE;AACvE,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;;;;;GAMG;AACU,QAAA,cAAc,GAAG,wBAAwB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACU,QAAA,gBAAgB,GAC3B,wEAAwE;IACxE,0EAA0E;IAC1E,kBAAkB,CAAC;AAErB,oDAAoD;AACvC,QAAA,WAAW,GAAG,SAAS,CAAC;AAErC;;;2CAG2C;AAC9B,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D;;oCAEoC;AACvB,QAAA,kBAAkB,GAAG,EAAE,CAAC;AAoLrC;;;;;;;;;;;;;GAaG;AACH,SAAgB,WAAW,CAAC,KAAa,EAAE,OAAe;IACxD,OAAO,IAAA,qBAAS,EAAC,GAAG,KAAK,GAAG,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,0BAAkB,CAAC,CAAC;AAC5E,CAAC;AAFD,kCAEC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAc;IACvC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpC,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACjC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AApBD,gCAoBC;AAED;0BAC0B;AAC1B,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,sBAAc,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,SAAgB,eAAe,CAAC,IAAmB;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAFD,0CAEC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,kBAAkB,CAAC,OAAmB;IACpD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD;QACE,IAAI,CAAC,EAAE;QACP,IAAI,CAAC,IAAI;QACT,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;KACrE,CAAC,IAAI,CAAC,cAAc,CAAC,CACvB,CAAC;IACF,OAAO;QACL,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,UAAU,IAAI,EAAE;QACxB,OAAO,CAAC,QAAQ,IAAI,EAAE;QACtB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpB,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC;KACvC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpB,CAAC;AAnBD,gDAmBC;AAiDD;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,OAAgB;IAChC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,OAMX,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,OAAO;QACL,GAAG,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI;YAC9C,UAAU,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI;gBACzB,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;aAC9E;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE5E,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC;IAChE,MAAM,SAAS,GAA0C,CAAC,UAAU;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC5B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;YAC9B,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;SACJ;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM;YACvD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACxC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;SACJ;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,YAAY;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;QACD,KAAK,EAAE;YACL,SAAS;YACT,aAAa,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,cAAc,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC5D,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC,CAAC;SACJ;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,4DAA4D;QAC5D,4EAA4E;QAC5E,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,KAAK,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,IAAI;YACrC,mBAAmB,EAAE;gBACnB,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK;gBACtC,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC5E;SACF,CAAC;QACJ,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB;KACF,CAAC;AACJ,CAAC;AA1ED,oCA0EC"}