agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/proxy/dist/server.d.ts

@@ -0,0 +1,327 @@
+import type { CanonicalRequest, CanonicalResponse, RetrievalRule, Usage } from '@agenticreplay/plugin-api';
+import { type Dialect } from './dialects.js';
+import { type RecordedRetrieval, type RetrievalStore } from './retrieval.js';
+import { type NetExchange, type NetRequest, type TlsInterceptOptions } from './intercept.js';
+import { type Divergence } from './matching.js';
+export type { InterceptDecision, InterceptFailure, InterceptForward, InterceptResponse, NetExchange, NetRequest, TlsInterceptOptions, TunnelRecord, } from './intercept.js';
+/**
+ * The interception point.
+ *
+ * Exact, fork and compare are not three subsystems — they are this one server with a cursor: the
+ * position in the recorded stream where it stops serving from disk and starts serving from the
+ * network. `record` puts the cursor before everything, `replay` after everything, `hybrid` at
+ * `forkAt`.
+ */
+export type ProxyMode = 'record' | 'replay' | 'hybrid';
+/** `anthropic-beta` with the recorded model's entitlements taken out, or undefined if empty. */
+export declare function betasForModelChange(value: string): string | undefined;
+/**
+ * An origin with the parts a credential rides in taken out.
+ *
+ * `agenticreplay setup --gateway` accepts whatever URL it is handed and stores it in `~/.agenticreplay/config.json`,
+ * and a gateway that authenticates by URL rather than by header is handed one that carries the key:
+ * `https://user:pw@gw.example` or `https://gw.example?key=…`. The proxy has to *send* that — it is
+ * how the request authenticates — but recording it verbatim would have written the key into every
+ * trace made on that machine, breaking the promise stated where the key is read:
+ *
+ *   > the proxy adds it to the outbound request only, while what gets recorded is derived from the
+ *   > *incoming* request with auth stripped, so a gateway key agenticreplay injects is invisible to the
+ *   > recording by construction rather than by a rule someone has to remember.
+ *
+ * So the stripping happens here, in the one place an exchange is built, rather than at each call
+ * site — for the same reason that sentence gives.
+ *
+ * The path is kept. It is not a credential, and it is load-bearing: a gateway serving tenants at
+ * `/team-a/v1` and `/team-b/v1` answers from two different places, and the exchange's own `path`
+ * is the *client's* (`/chat/completions`), not the upstream's base. Only userinfo, query and
+ * fragment come out.
+ *
+ * An origin that will not parse is dropped rather than passed through: it cannot be sanitised, and
+ * absent already means "not recorded".
+ */
+export declare function recordableOrigin(origin: string | undefined): string | undefined;
+/**
+ * Why a string cannot be used as an origin at all, or nothing if it can.
+ *
+ * Narrower than it first was, because the first version refused configurations that work. A
+ * gateway that authenticates by query — `https://gw.example/v1?key=…` — is an ordinary way to
+ * configure one, and undici sends it without complaint; refusing it broke a working setup to close
+ * a leak that was never about sending. Userinfo is the same story one step along: undici does
+ * reject `https://u:pw@gw` at request time, but it is *sanitisable* — {@link recordableOrigin}
+ * removes it cleanly — and the recording path already accepts it and keeps it out of the trace.
+ *
+ * What is left is the case where there is nothing to sanitise, because there is no origin. A
+ * gateway typed without a scheme parses with the username as the protocol:
+ *
+ *     new URL('myuser:PASSWORD@gw.example/v1')   // protocol 'myuser:', pathname the rest
+ *
+ * so {@link recordableOrigin} answers `myuser://PASSWORD@gw.example/v1` — a value, which means a
+ * caller guarding with `?? url` never notices, and the password is on the line anyway. There is no
+ * fixing that by rewriting: with no scheme there is no telling which half of `a:b` was meant as
+ * the host. And nothing refused here could have worked — undici cannot parse it either.
+ */
+export declare function unusableOrigin(origin: string): string | undefined;
+/**
+ * Free text with the credential taken out of any URL it names.
+ *
+ * For error messages, which nobody composes and everybody prints. A failed `fetch` reports the URL
+ * it was given, so an origin configured as `https://user:pw@gw` or `https://gw?key=…` arrives
+ * inside the exception text and goes straight to a terminal:
+ *
+ *     warn gateway.unreachable why="Request cannot be constructed from a URL that includes
+ *       credentials: http://someone:PASSWORD@127.0.0.1:50164/v1/models"
+ *
+ * {@link recordableOrigin} cannot help there — it takes a URL, and this is prose with a URL in it.
+ *
+ * The query goes as well as the userinfo. That loses the occasional harmless parameter from an
+ * error message, which is the right trade: a key in a query is the commonest way a gateway
+ * authenticates by URL, and an error string is not where anyone should be reading parameters back.
+ */
+export declare function withoutCredentials(text: string): string;
+/**
+ * An origin agenticreplay could not parse, reduced to the host it names and nothing else.
+ *
+ * Three rounds of review here, each finding a shape the last one let through, and the lesson is
+ * the same each time: a string no parser accepted has no structure to rely on, so nothing may be
+ * kept because of where it sits — only because of what it is made of.
+ *
+ * `withoutCredentials` went first. It is written for prose and its rules need prose shapes: a
+ * dotted host for the scheme-less query rule, no whitespace inside userinfo. `gw?key=SECRET123`,
+ * `localhost?key=…`, `192.168.0.1?key=…` and `https://user:pa ss@gw` all went through it whole.
+ *
+ * Cutting by position went second, and left `https://gw key=SECRET123`: a secret in a
+ * whitespace-separated token after the host is still "after the last `@`", so it was kept as part
+ * of the host.
+ *
+ * So the last step is a whitelist — the characters a host and a port are made of, and the first
+ * one that is not ends it. A path is not returned at all: the success branch of `originParts`
+ * gives `url.hostname`, the exchange records its request path in its own field, and a path that
+ * reached here unparsed could carry a secret as easily as a query could.
+ *
+ * An origin with no host left — `https://user:pass@` — yields the empty string, which is the
+ * honest answer: there was no host in it to name.
+ *
+ * `redactString` still runs over the result at the call site, as a backstop for a long key rather
+ * than the thing doing the work: its shape rules and 20-character entropy floor catch neither
+ * `hunter2` nor `SECRET123`.
+ */
+export declare function scrubOrigin(origin: string): string;
+export interface RecordedExchange {
+    seq: number;
+    requestId?: string;
+    requestStartedAt?: number;
+    dialect: string;
+    path: string;
+    /** Verbatim request body. Keeping it is what makes exact replay exact. */
+    rawRequest: string;
+    /** Verbatim response body, SSE included. */
+    rawResponse: string;
+    status: number;
+    streamed: boolean;
+    canonicalRequest: CanonicalRequest;
+    canonicalResponse?: CanonicalResponse;
+    usage?: Usage;
+    requestHeaders?: Record<string, string>;
+    /**
+     * Which application protocol carried it: `h2`, `http/1.1`, or absent where agenticreplay did not
+     * establish the connection itself and so cannot say. Only interception knows this -- the
+     * base-URL route hands the call to `fetch`, which chooses for itself and does not report back.
+     */
+    alpn?: string;
+    /**
+     * The `content-encoding` agenticreplay decoded away before recording the response, when there was one.
+     * Interception only, for the same reason: on the base-URL route the HTTP client decompresses
+     * before agenticreplay sees a body, so there is nothing agenticreplay could truthfully claim to have removed.
+     */
+    responseDecodedFrom?: string;
+    /**
+     * The origin that actually answered this call.
+     *
+     * A run's destination is not one value that could live in the manifest: the origin is chosen per
+     * request, from an explicit `--upstream-*`, the gateway `agenticreplay setup` configured, a `/forward/`
+     * base the client announced, or the dialect's vendor default — and a fork that changes provider
+     * changes it again mid-run. So it is recorded where it is decided, once per exchange.
+     *
+     * The trace could say what was sent and what came back but not who answered it, which is the
+     * question asked first when a recording looks wrong: a gateway left over in `~/.agenticreplay/config.json`
+     * redirects every run on the machine, and nothing in the run said so.
+     */
+    upstream?: string;
+    durationMs?: number;
+}
+export interface ProxyOptions {
+    mode: ProxyMode;
+    /** Recorded exchanges, for replay and hybrid. */
+    exchanges?: RecordedExchange[];
+    /** Index at which hybrid mode stops replaying and goes live. */
+    forkAt?: number;
+    /** Model to substitute on live requests — the whole point of `--model` on a fork. */
+    forkModel?: string;
+    /** Continue live instead of halting when replay finds no match. */
+    loose?: boolean;
+    upstream?: Record<string, string>;
+    dialects?: Dialect[];
+    onExchange?: (e: RecordedExchange) => void;
+    onRequestStart?: (request: NetRequest) => void | Promise<void>;
+    /** Maximum bytes retained per request or response body. */
+    maxCapturedBytes?: number;
+    /** Aggregate retained body bytes across concurrent TLS exchanges. */
+    maxBufferedBytes?: number;
+    onDivergence?: (d: Divergence & {
+        seq: number;
+    }) => void;
+    /** Called once per live call that carried a model substitution. See {@link RouteDecision}. */
+    onRoute?: (decision: RouteDecision) => void;
+    /**
+     * Called when strict replay refuses a request. Separate from `onDivergence` because it is not a
+     * divergence: nothing was served, and the run is over. A count alone leaves the operator staring
+     * at `unmatched: 12` with no reason, which is how this failure stayed invisible.
+     */
+    onUnmatched?: (u: {
+        seq: number;
+        index: number;
+        reason: string;
+    }) => void;
+    fetchImpl?: typeof fetch;
+    host?: string;
+    port?: number;
+    /** Extra headers attached to live upstream calls, and the origin they belong to. */
+    upstreamHeaders?: Record<string, string>;
+    /**
+     * The origin {@link upstreamHeaders} are meant for, when they belong to one.
+     *
+     * The gateway's key goes on requests to the gateway and on nothing else: a forwarded request
+     * can name a destination the gateway is not, and attaching the credential anyway would hand a
+     * third party a key they were never meant to see. Unset keeps the old behaviour — headers on
+     * every live call — for callers that attach them per purpose rather than per origin.
+     */
+    upstreamHeadersOrigin?: string;
+    /**
+     * Where to send a POST whose path no dialect claims.
+     *
+     * AgenticReplay pointed the harness's base URL at itself, so every call the harness makes arrives here —
+     * including the ones agenticreplay has no translator for. Refusing those does not mean "not captured", it
+     * means the agent gets an error for a call that would have worked, from a tool whose whole job is
+     * not to change the run it is watching. Left unset, an origin is inferred; see `passthroughOrigin`.
+     */
+    passthroughUpstream?: string;
+    /**
+     * An exchange agenticreplay forwarded but could not interpret.
+     *
+     * Deliberately the same type the TLS interceptor reports unrecognised traffic with, so both
+     * arrive in the trace as `net.request` / `net.response` and a reader does not have to learn a
+     * second shape for the same fact. TLS traffic keeps reporting through `tls.onNetExchange`; this
+     * is the plain-HTTP channel, so a caller wiring both never sees one exchange twice.
+     */
+    onNetExchange?: (e: NetExchange) => void;
+    /**
+     * Endpoints whose answer is a function of their request — embeddings, rerank — so a recording
+     * can serve them back without a dialect. Defaults to {@link defaultRetrievalRules}; pass an
+     * empty array to turn the whole mechanism off and have these calls pass through as before.
+     */
+    retrievalRules?: RetrievalRule[];
+    /** Recorded retrieval calls, for replay and hybrid. See {@link RecordedRetrieval}. */
+    retrievals?: RecordedRetrieval[];
+    /**
+     * Whether a recorded retrieval call keeps its response body or only a digest of it.
+     *
+     * `full` is the default and the only one that can be replayed. `digest` exists because the
+     * bodies are large in a way chat responses are not — six paragraphs at 768 dimensions is 98 KB
+     * of JSON floats, and an index build makes thousands of those calls — so a run recorded to
+     * check consistency rather than to reproduce can keep the hash and none of the vectors.
+     */
+    retrievalStore?: RetrievalStore;
+    /**
+     * Terminate TLS for a named set of hosts, for a harness that ignores base-URL variables.
+     *
+     * Absent by default, and absence is the whole safety story: with no `tls` block the server
+     * registers no `'connect'` listener at all, so there is no code path that could decrypt
+     * anything. Opting in is what creates the capability.
+     */
+    tls?: TlsInterceptOptions;
+}
+export interface ProxyStats {
+    mode: ProxyMode;
+    recorded: number;
+    matchedExact: number;
+    /** Served from the recording, but only after the ladder had to approximate. */
+    matchedInexact: number;
+    divergences: number;
+    liveCalls: number;
+    unmatched: number;
+    /** Decrypted HTTPS exchanges. Zero unless TLS interception was asked for. */
+    intercepted: number;
+    /** Connections passed through as opaque bytes because their host was not on the list. */
+    tunnelled: number;
+    /** Requests forwarded on a path no dialect claims — captured, but not replayable. */
+    passedThrough: number;
+    /**
+     * Retrieval calls served from the recording, and how many the recording holds.
+     *
+     * A separate axis from `matchedExact` on purpose. `exact` is a statement about a matching
+     * ladder these calls never climb — they are looked up by their own request, because the answer
+     * is a function of it — and folding them in would make a recording look more faithfully
+     * reproduced the more embeddings it happened to make. Reported as `retrieval=served/total`.
+     */
+    retrievalServed: number;
+    retrievalTotal: number;
+    /** Retrieval calls the recording could not answer and the run had to make live. */
+    retrievalLive: number;
+    /**
+     * Retrieval calls served from a recorded batch whose items arrived in a different order.
+     *
+     * Counted apart from the rest because the bytes were rebuilt rather than handed back: each text
+     * got the vector recorded for that exact text, at its new position. Exact, and worth saying.
+     */
+    retrievalReordered: number;
+    /**
+     * Exchanges served from a position other than the cursor — held from earlier, or stepped over
+     * to. Not a fidelity loss: either the request was byte-identical or it carried a divergence of
+     * its own. It says the run's *order* differed, which is what a worker pool does.
+     */
+    reordered: number;
+}
+/** What a run needs to tell the operator, and to tell the child process, about interception. */
+/**
+ * One routing decision: which model, which wire format serves it, and where it was sent.
+ *
+ * `recorded` is the dialect the agent's own request used, which is what makes a cross-provider fork
+ * legible — without it, "target: openai" leaves a reader unable to tell a substitution from a run
+ * that was OpenAI all along.
+ */
+export interface RouteDecision {
+    model: string;
+    /** Dialect that will serve it. */
+    target: string;
+    /** Dialect the agent's request arrived in. */
+    recorded: string;
+    /**
+     * Where the call went, sanitised the way an exchange's `upstream` is: userinfo and query out,
+     * path kept. Absent when the configured origin cannot be sanitised into one, because absent
+     * already means "not recorded" — see {@link recordableOrigin}.
+     */
+    origin?: string;
+    crossProvider: boolean;
+    reason: string;
+}
+export interface TlsInterceptInfo {
+    /** The hosts that will be decrypted, as written. */
+    hosts: string;
+    /** SHA-256 of the run CA, so the certificate on disk can be matched to this run. */
+    fingerprint: string;
+    caCertPath: string;
+    /** The run CA plus the system roots, for clients whose trust variable replaces the store. */
+    caBundlePath: string;
+}
+export interface ProxyHandle {
+    url: string;
+    port: number;
+    stats(): ProxyStats;
+    exchanges(): RecordedExchange[];
+    /** Present only when TLS interception is on. */
+    tls?: TlsInterceptInfo;
+    close: () => Promise<void>;
+}
+export declare function defaultDialects(): Dialect[];
+export declare function createProxy(options: ProxyOptions): Promise<ProxyHandle>;
+//# sourceMappingURL=server.d.ts.map

package/node_modules/@agenticreplay/proxy/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,KAAK,EACN,MAAM,2BAA2B,CAAC;AAsBnC,OAAO,EAML,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;;GAOG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AA0JvD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrE;AAoBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAW/E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAajE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAclD;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,iDAAiD;IACjD,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACzD,8FAA8F;IAC9F,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;IAC5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC1E,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,IAAI,CAAC;IACzC;;;;OAIG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,sFAAsF;IACtF,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,mBAAmB,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gGAAgG;AAChG;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,UAAU,CAAC;IACpB,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAChC,gDAAgD;IAChD,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAsCD,wBAAgB,eAAe,IAAI,OAAO,EAAE,CA6B3C;AA0DD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqkE7E"}