orbit-agent-runtime 0.8.0

package/dist/src/core/orbitRuntimeHost.d.ts

@@ -0,0 +1,349 @@
+import { ChannelHub } from "@orbit/core-hub";
+import { TraceJournal } from "@orbit/core-hub";
+import { PluginSandboxGuard } from "@orbit/core-hub";
+import { PluginPactVerifier } from "@orbit/core-hub";
+import { SandboxPool } from "@orbit/sandbox-runtime";
+import { ImpactDomainGraph } from "@orbit/sandbox-runtime";
+import { CostRouter } from "@orbit/core-hub";
+import { RecordJournal } from "@orbit/core-hub";
+import { ReplayEngine } from "@orbit/core-hub";
+import { CapabilityGateway } from "@orbit/core-hub";
+import { TokenBudgetEngine } from "@orbit/core-hub";
+import { RateLimiter } from "@orbit/core-hub";
+import { BehaviorCollector } from "@orbit/core-hub";
+import { PaeAdapterRegistry } from "@orbit/pae-engine";
+import { PaeChannel } from "@orbit/pae-engine";
+import type { IPaeAdapter, PaeFidelity, PaeToolDescriptor } from "@orbit/pae-engine";
+import type { AuditChainReport } from "@orbit/core-hub";
+import type { AgentSandbox } from "@orbit/sandbox-runtime";
+import { ChannelKind, ChannelCallCtx, PluginUnitPact, AgentBoxConfig, ReplayMode } from "@orbit/infra-common";
+import { type GovernanceProfile, type GovernanceProfileName } from "@orbit/infra-common";
+import type { RunVersionFingerprint } from "@orbit/infra-common";
+import type { ClockSource } from "@orbit/infra-common";
+import type { DomainTransportFactory } from "@orbit/sandbox-runtime";
+import type { IsolationDomainPlan } from "@orbit/sandbox-runtime";
+import type { DomainReconciliation, DomainTransaction } from "@orbit/sandbox-runtime";
+export interface OrbitRuntimeHostOptions {
+    /** Durable audit/behavior journal (trace) WAL path. */
+    traceJournalPath?: string;
+    /** Durable recording-window journal WAL path (recovered on boot). */
+    recordJournalPath?: string;
+    /**
+     * Wall-clock source for every time-dependent decision that reaches a recorded
+     * value (trip cooldown, channel TTLs). Injecting a frozen clock makes a
+     * recording window reproducible; omitting it keeps the real clock, which is
+     * the previous behaviour.
+     */
+    clock?: ClockSource;
+    /**
+     * Retention bound for the durable audit journal: keep at most this many
+     * newest entries. An append-only audit log that grows without limit
+     * eventually fills the disk, and a full disk is an outage — so the bound is
+     * explicit and operator-chosen rather than an implicit default. Applied at
+     * boot (after recovery) and at shutdown. Omit for unbounded retention.
+     */
+    auditRetention?: number;
+    /**
+     * W29: governance tier (VISION §3.1). `standard` is the default and resolves
+     * to the kernel's pre-W29 numbers verbatim. `sandbox` disables token
+     * compression, widens rate limits, admits every PAE adapter kind and keeps
+     * the trace in memory. `strict` narrows rate limits, trips earlier, compresses
+     * aggressively, admits NO foreign adapters and REQUIRES a durable trace path
+     * (construction fails without one). The profile name is hashed into the run
+     * fingerprint, so a trace recorded under one tier refuses to replay under
+     * another (`RunFingerprintDriftError`).
+     */
+    governanceProfile?: GovernanceProfileName;
+    /**
+     * W30: HMAC-SHA256 signing key for the audit hash chain (VISION §3.1's
+     * "落盘 + 签名"). When provided, every audit entry is linked with
+     * `prevHash`/`chainHash` and `host.verifyAuditChain()` can prove the trail
+     * has not been tampered with. Without a key the journal records no chain
+     * fields at all (pre-W30 behaviour). The `strict` governance tier REQUIRES
+     * a signing key — a compliance tier must be able to prove its audit trail.
+     */
+    auditSigningKey?: string;
+}
+/**
+ * Top-level assembly: wires every component bottom-up and owns the host
+ * lifecycle. Components stay public for advanced scenarios (custom channels,
+ * audit), but day-to-day use should go through the facade methods below.
+ */
+export declare class OrbitRuntimeHost {
+    readonly channelHub: ChannelHub;
+    readonly traceJournal: TraceJournal;
+    readonly pluginSandboxGuard: PluginSandboxGuard;
+    readonly pluginPactVerifier: PluginPactVerifier;
+    readonly sandboxPool: SandboxPool;
+    /** M3: dependency graph feeding isolation decisions. */
+    readonly impactGraph: ImpactDomainGraph;
+    /** M4: cost profiles and budget routing. */
+    readonly costRouter: CostRouter;
+    /** W8: pure-function token budget + context compressor (single source of truth). */
+    readonly tokenBudget: TokenBudgetEngine;
+    /** W11: pure-function rate limiter (call-count budget, replay-safe). */
+    readonly rateLimiter: RateLimiter;
+    /** W11: behavior collector (record / live-proposal / replay-bypass). */
+    readonly behaviorCollector: BehaviorCollector;
+    /** W7: unified gateway entry — the determinism boundary (capabilityInvoke). */
+    readonly gateway: CapabilityGateway;
+    /** W15: registry of foreign-runtime adapters (the adaptation surface). */
+    readonly paeRegistry: PaeAdapterRegistry;
+    /** W15: the channel that publishes the adaptation surface to the hub. */
+    readonly paeChannel: PaeChannel;
+    /** W8: kinds served by a PAE adapter; routing flips to "pae" when non-empty. */
+    private readonly paeAdapterKinds;
+    /**
+     * W20: the physical layer — isolation domains allocated from the impact
+     * graph. Created lazily: a host that never allocates domains keeps its
+     * previous hub surface and fingerprint byte for byte.
+     */
+    private domainManager;
+    /** W20: the gateway surface over the domain manager's units. */
+    private domainChannel;
+    /** W20: the graph changed since the last allocation (plan needs a re-sync). */
+    private domainsStaleFlag;
+    /** W27: durable recording-window journal WAL path, if configured. */
+    private readonly recordJournalPath?;
+    /** Injected clock, threaded to every time-dependent decision that is recorded. */
+    private readonly clock?;
+    /** W27: the recording window currently attached to the gateway (for flush). */
+    private activeRecordJournal;
+    /**
+     * W27: the same instance as {@link traceJournal}, held at its durable type.
+     * `traceJournal` stays declared as the base class on purpose — call sites must
+     * not depend on durability — so retention/compaction needs its own handle.
+     */
+    private readonly durableTraceJournal;
+    /** W27: audit retention bound; undefined means unbounded. */
+    private readonly auditRetention?;
+    /** W29: resolved governance tier; drives limiter / trip / compression / PAE / durability. */
+    private readonly governanceProfile;
+    /** W30: HMAC key for the audit hash chain; undefined = unsigned journal. */
+    private readonly auditSigningKey?;
+    constructor(opts?: OrbitRuntimeHostOptions);
+    /**
+     * Capability required by a channel method. Native channels map statically;
+     * PAE tools are resolved through the registry so a foreign tool is governed
+     * at the same granularity as a native method (read vs write), never wholesale.
+     * An unknown tool is treated as a write — the conservative default — so a
+     * mis-registered surface fails closed.
+     */
+    private requiredCapabilityFor;
+    /** Host-private trip pre-check delegating to the gateway's per-plugin map. */
+    private tripPreCheckFor;
+    /**
+     * The run-version fingerprint a recorded trace carries (W7, extended W15/W20).
+     *
+     * Both optional fields are **omitted rather than empty**: a host that never
+     * registers an adapter or allocates a domain produces exactly the fingerprint
+     * it produced before those layers existed, so a trace recorded on an older
+     * kernel is reported as configuration drift — never as a mystery digest
+     * mismatch.
+     */
+    runFingerprint(): RunVersionFingerprint;
+    /**
+     * W29: the resolved governance tier and its concrete numbers. Read-only —
+     * the tier is a construction-time decision; switching it means constructing
+     * a host with `governanceProfile`.
+     */
+    get currentGovernanceProfile(): GovernanceProfile;
+    bootHost(): Promise<void>;
+    /**
+     * W30: prove the audit trail has not been tampered with. Recomputes the
+     * hash chain from the genesis seed and reports the first broken entry.
+     * An unsigned journal (no key configured) reports `signed: false` and is
+     * vacuously consistent.
+     */
+    verifyAuditChain(): AuditChainReport;
+    /**
+     * W27: enforce the configured audit-retention bound and compact the WAL.
+     *
+     * Called automatically at boot and shutdown; exposed so an operator can prune
+     * a long-running host on demand without a restart.
+     *
+     * @returns the number of audit entries retained.
+     */
+    pruneAuditLog(): Promise<number>;
+    /** Reverse-order teardown: pool -> pact -> guards -> channels -> journal -> graph. */
+    shutdownHost(): Promise<void>;
+    /** Register a plugin; its declared channel deps feed the impact graph (M3). */
+    registerPlugin(pact: PluginUnitPact): void;
+    /** Spawn an agent sandbox; its channel deps feed the impact graph (M3). */
+    spawnAgentBox(cfg: AgentBoxConfig): AgentSandbox;
+    /**
+     * W8: declare a PAE adapter for a channel kind. Once any adapter is
+     * registered the gateway's `route` decision becomes "pae" for governed
+     * calls, and the run fingerprint's `paeEnabled` flips — so a trace recorded
+     * before PAE existed is detected as config drift, never as a digest mismatch.
+     */
+    registerPaeAdapter(kind: ChannelKind): void;
+    /**
+     * W15: attach a real foreign-runtime adapter.
+     *
+     * The adapter is validated, indexed and published as tools on the PAE
+     * channel, and a **dynamic pact** is derived from its declared surface and
+     * registered like any hand-written plugin manifest. That is what keeps the
+     * promise of "MCP-grade ecosystem reach without a governance downgrade": the
+     * foreign tool now passes the same capability check, trip protection, budget
+     * accounting and recording as a native channel method, because it *is* one.
+     *
+     * @returns the derived pact (already registered unless `registerPact: false`).
+     */
+    registerPaeToolAdapter(adapter: IPaeAdapter, opts?: {
+        registerPact?: boolean;
+        requireHostMinEdition?: string;
+    }): PluginUnitPact;
+    /**
+     * W29+W31: the governance gate for foreign adapters — kind admission
+     * (`paeAdmission`) and isolation cap (`maxIsolationLevel`, the trust
+     * assumption). `strict` admits no kind at all and caps isolation at L1; a
+     * denied adapter is rejected outright rather than half-connected.
+     */
+    private assertPaeAdmitted;
+    /**
+     * Register an adapter whose surface is only knowable *after* a handshake.
+     *
+     * `registerPaeToolAdapter` resolves the capability surface at registration
+     * time, which presupposes that the surface already exists. An MCP server
+     * announces its tools over the wire, so there is nothing to resolve until the
+     * connection is up. This variant connects first, lets the adapter discover
+     * what the peer actually exposes, and then registers exactly that.
+     *
+     * The handshake is not a governance bypass: registration still runs the same
+     * static validation and still derives a dynamic pact from the *discovered*
+     * surface, so a server that later announces a new tool is configuration drift
+     * on the next replay rather than a silently expanded capability.
+     */
+    connectPaeToolAdapter(adapter: IPaeAdapter, opts?: {
+        registerPact?: boolean;
+        requireHostMinEdition?: string;
+        maxWaitMs?: number;
+    }): Promise<PluginUnitPact>;
+    /**
+     * Detach an adapter: its tools stop being dispatchable, its derived pact is
+     * revoked, and the routing flag clears once the surface is empty. A trace
+     * recorded while it was present then replays as configuration drift, not as
+     * a mysterious digest mismatch.
+     *
+     * Resources held by the adapter are released in the background; use
+     * `releasePaeToolAdapter` when you need to wait for that to complete (for
+     * example before the process exits, or in a test that asserts a subprocess
+     * is gone).
+     */
+    unregisterPaeToolAdapter(adapterId: string): void;
+    /**
+     * Detach an adapter and await its release.
+     *
+     * Same as `unregisterPaeToolAdapter`, plus a wait for `teardown` to finish —
+     * the difference matters for adapters that own an OS process (MCP), where
+     * "unregistered" and "peer actually shut down" are separated by real time.
+     */
+    releasePaeToolAdapter(adapterId: string): Promise<void>;
+    /**
+     * Connect adapters registered after `bootHost`. Idempotent — adapters that
+     * are already connected are skipped, so it is safe to call after every batch
+     * of registrations.
+     */
+    bootPaeAdapters(): Promise<void>;
+    /**
+     * Capability negotiation for a foreign tool: returns the descriptor when the
+     * mapping is at least as faithful as required, otherwise throws. Callers make
+     * an informed choice instead of silently receiving a degraded result.
+     */
+    negotiatePaeTool(toolName: string, minFidelity?: PaeFidelity): PaeToolDescriptor;
+    /**
+     * M2: open a recording window; sandboxes running in "record" mode fill it.
+     *
+     * W27: when the host was constructed with `recordJournalPath`, the window is
+     * durable — every recorded call is mirrored to the WAL. Opening a *new* window
+     * truncates that WAL first (a fresh window must not inherit the previous
+     * run's calls); use {@link resumeRecording} to continue a prior window instead.
+     */
+    beginRecording(): RecordJournal;
+    /**
+     * W27: reopen the durable recording window persisted by a previous process.
+     *
+     * Recovers the WAL (crash-safe: a truncated trailing line is dropped) and
+     * re-attaches it, so `orderIndex` continues from the recovered length and the
+     * combined journal replays as one uninterrupted run. Without a configured
+     * `recordJournalPath` this degrades to a plain in-memory window.
+     */
+    resumeRecording(): Promise<RecordJournal>;
+    /**
+     * W27: the recording window currently attached to the gateway, or `null` if
+     * none was ever opened. After a boot with `recordJournalPath` configured this
+     * is the journal recovered from the WAL, so callers can inspect or replay a
+     * window persisted by a previous process without reopening it.
+     */
+    currentRecordJournal(): RecordJournal | null;
+    /** M2: attach a replay engine over a previously recorded journal. */
+    attachReplayEngine(journal: RecordJournal): ReplayEngine;
+    /** W7: the unified gateway entry — deterministic boundary for governed calls. */
+    capabilityInvoke<T>(params: {
+        kind: ChannelKind;
+        pluginId?: string;
+        funcName: string;
+        args: unknown[];
+        mode: ReplayMode;
+        ctx?: Partial<ChannelCallCtx>;
+    }): Promise<T>;
+    /**
+     * W31: gateway-side parameter validation for PAE tools that declare a
+     * schema. The error is raised as a plain Error (user-classified 400 by the
+     * console bridge); the recorded call never happens, so nothing to replay.
+     */
+    private assertArgsAgainstSchema;
+    /** M3: nodes that would be affected if the given node fails (reachability closure). */
+    isolationDomain(nodeId: string): string[];
+    /** M3: isolation theorem query — two nodes are provably independent. */
+    areIsolated(a: string, b: string): boolean;
+    /** M4: choose the cheapest channel that fits the budget and latency target. */
+    routeChannel(kinds: ChannelKind[], budget: number, maxLatencyMs: number): ChannelKind | undefined;
+    /** Whether the impact graph changed since the last domain allocation. */
+    domainsStale(): boolean;
+    /**
+     * Allocate isolation domains from the current impact graph and publish their
+     * unit surface on the gateway (W19 channel, W20 host state).
+     *
+     * Idempotent for a given graph: the sync is a diff, so re-running after a
+     * no-op graph change neither restarts child processes nor perturbs the plan
+     * hash. Registering the channel happens here and only here — a host that
+     * never allocates domains keeps its previous hub surface and fingerprint.
+     */
+    allocateIsolationDomains(opts?: {
+        transportFactory?: DomainTransportFactory;
+        clock?: ClockSource;
+        maxImpactClosure?: number;
+        maxDomainSize?: number;
+        defaultTimeoutMs?: number;
+    }): Promise<IsolationDomainPlan>;
+    /** The current domain plan, or `null` before the first allocation. */
+    domainPlan(): IsolationDomainPlan | null;
+    /** Running domains: id, units and isolation level, sorted. */
+    domains(): Array<{
+        domainId: string;
+        units: string[];
+        isolation: string;
+    }>;
+    /**
+     * Invoke a unit in its domain through the gateway — the cross-domain hop.
+     * Recorded and replayed like any other governed call; settled in the domain
+     * transaction ledger either way.
+     */
+    invokeDomainUnit<T>(unitId: string, tool: string, args?: unknown[], opts?: {
+        pluginUnitId?: string;
+        mode?: ReplayMode;
+        ctx?: Partial<ChannelCallCtx>;
+    }): Promise<T>;
+    /** The cross-domain transaction ledger (decision → execution → result). */
+    domainLedger(): readonly DomainTransaction[];
+    /** Reconcile the ledger — cross-domain events must balance (VISION 2.2). */
+    reconcileDomainTransactions(): DomainReconciliation;
+    /** Tear down every domain and release its host process. */
+    releaseIsolationDomains(): Promise<void>;
+    /** Context for domain synchronization calls. */
+    private domainCtx;
+    private newHostCtx;
+}
+//# sourceMappingURL=orbitRuntimeHost.d.ts.map

package/dist/src/core/orbitRuntimeHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orbitRuntimeHost.d.ts","sourceRoot":"","sources":["../../../src/core/orbitRuntimeHost.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAyB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAA0B,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAA+B,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,WAAW,EAA6B,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAMrF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAiB,UAAU,EACvF,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAgBtF,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,SAAgB,UAAU,EAAE,UAAU,CAAC;IACvC,SAAgB,YAAY,EAAE,YAAY,CAAC;IAC3C,SAAgB,kBAAkB,EAAE,kBAAkB,CAAC;IACvD,SAAgB,kBAAkB,EAAE,kBAAkB,CAAC;IACvD,SAAgB,WAAW,EAAE,WAAW,CAAC;IACzC,wDAAwD;IACxD,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,4CAA4C;IAC5C,SAAgB,UAAU,EAAE,UAAU,CAAC;IACvC,oFAAoF;IACpF,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,wEAAwE;IACxE,SAAgB,WAAW,EAAE,WAAW,CAAC;IACzC,wEAAwE;IACxE,SAAgB,iBAAiB,EAAE,iBAAiB,CAAC;IACrD,+EAA+E;IAC/E,SAAgB,OAAO,EAAE,iBAAiB,CAAC;IAC3C,0EAA0E;IAC1E,SAAgB,WAAW,EAAE,kBAAkB,CAAC;IAChD,yEAAyE;IACzE,SAAgB,UAAU,EAAE,UAAU,CAAC;IACvC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D;;;;OAIG;IACH,OAAO,CAAC,aAAa,CAAuC;IAC5D,gEAAgE;IAChE,OAAO,CAAC,aAAa,CAA8B;IACnD,+EAA+E;IAC/E,OAAO,CAAC,gBAAgB,CAAS;IACjC,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAS;IAC5C,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAc;IACrC,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB,CAA8B;IACzD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAwB;IAC5D,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAS;gBAEvB,IAAI,CAAC,EAAE,uBAAuB;IAwGjD;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAa7B,8EAA8E;IAC9E,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACI,cAAc,IAAI,qBAAqB;IAiB9C;;;;OAIG;IACH,IAAW,wBAAwB,IAAI,iBAAiB,CAEvD;IAEY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BtC;;;;;OAKG;IACI,gBAAgB,IAAI,gBAAgB;IAO3C;;;;;;;OAOG;IACU,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAO7C,sFAAsF;IACzE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAyC1C,+EAA+E;IACxE,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAiBjD,2EAA2E;IACpE,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY;IAWvD;;;;;OAKG;IACI,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAIlD;;;;;;;;;;;OAWG;IACI,sBAAsB,CAC3B,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAO,GACpE,cAAc;IAgBjB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAChC,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACxF,OAAO,CAAC,cAAc,CAAC;IAgB1B;;;;;;;;;;OAUG;IACI,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAYxD;;;;;;OAMG;IACU,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7C;;;;OAIG;IACI,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,GAAE,WAAoB,GAAG,iBAAiB;IAI/F;;;;;;;OAOG;IACI,cAAc,IAAI,aAAa;IAUtC;;;;;;;OAOG;IACU,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC;IAatD;;;;;OAKG;IACI,oBAAoB,IAAI,aAAa,GAAG,IAAI;IAInD,qEAAqE;IAC9D,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY;IAO/D,iFAAiF;IACpE,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE;QACvC,IAAI,EAAE,WAAW,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,EAAE,CAAC;QAChB,IAAI,EAAE,UAAU,CAAC;QACjB,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,CAAC,CAAC;IAad;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAY/B,uFAAuF;IAChF,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAIhD,wEAAwE;IACjE,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO;IAIjD,+EAA+E;IACxE,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAQxG,yEAAyE;IAClE,YAAY,IAAI,OAAO;IAI9B;;;;;;;;OAQG;IACU,wBAAwB,CACnC,IAAI,GAAE;QACJ,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;QAC1C,KAAK,CAAC,EAAE,WAAW,CAAC;QACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACtB,GACL,OAAO,CAAC,mBAAmB,CAAC;IAwB/B,sEAAsE;IAC/D,UAAU,IAAI,mBAAmB,GAAG,IAAI;IAI/C,8DAA8D;IACvD,OAAO,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjF;;;;OAIG;IACI,gBAAgB,CAAC,CAAC,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,OAAO,EAAO,EACpB,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;KAAO,GACrF,OAAO,CAAC,CAAC,CAAC;IAWb,2EAA2E;IACpE,YAAY,IAAI,SAAS,iBAAiB,EAAE;IAInD,4EAA4E;IACrE,2BAA2B,IAAI,oBAAoB;IAY1D,2DAA2D;IAC9C,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IASrD,gDAAgD;IAChD,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,UAAU;CAGnB"}