salt-agent-sdk 0.1.0 → 0.18.0

package/dist/device/host.d.ts

@@ -0,0 +1,222 @@
+import { DeviceProtocolError, type AppsResult, type ClickArgs, type DeviceCountClass, type DeviceErrorCode, type DeviceOp, type DevicePauseReason, type FileResult, type KeyArgs, type ObservationResult, type ObserveArgs, type Progress, type ScrollArgs, type SubmitArgs, type TaskArgs, type TaskResult } from "./protocol.js";
+import type { LaneReaders } from "./client.js";
+import { type SaltId } from "../ids.js";
+/** The seams. The desktop app implements every method; the host calls one only
+ *  after it has passed every gate below. A handler may throw -- the host turns
+ *  a throw into an `error { code: "failed" }` and counts it as an error. */
+export interface DeviceHostHandlers {
+    observe(args: ObserveArgs): Promise<ObservationResult>;
+    click(args: ClickArgs): Promise<HandlerResult>;
+    type(args: {
+        text: string;
+    }): Promise<HandlerResult>;
+    key(args: KeyArgs): Promise<HandlerResult>;
+    scroll(args: ScrollArgs): Promise<HandlerResult>;
+    submit(args: SubmitArgs): Promise<HandlerResult>;
+    focusApp(args: {
+        app: string;
+    }): Promise<HandlerResult>;
+    listApps(): Promise<AppsResult>;
+    readFile(args: {
+        path: string;
+    }): Promise<FileResult>;
+    writeFile(args: {
+        path: string;
+        content_b64: string;
+    }): Promise<HandlerResult>;
+    /** Do ONE whole task (op `task`, capability `device.task`). Optional: a host without it
+     *  answers `unsupported`. The host holds the device lock for the whole run. What comes back
+     *  is allow-listed field by field into a `TaskResult` (see `normalizeTaskResult`), so an
+     *  extra field never reaches the agent. Let a `DeviceBudgetSpentError` from `ctx.spend`
+     *  bubble: it ends the task and the session. */
+    task?(args: TaskArgs, ctx: DeviceTaskContext): Promise<TaskResult>;
+}
+/** What `ctx.spend` counts a task step as. `act` is counted as a `click` (the closest of the
+ *  existing classes: a press of a control) and `apps` as `app_focus`. */
+export type TaskSpendClass = "command" | "look" | "act" | "observe" | "apps";
+/** What a `task` handler is given besides its arguments. */
+export interface DeviceTaskContext {
+    /** Aborts when the agent cancels the task (`reason` "cancelled"), when `timeout_s` runs out
+     *  ("timeout") and when the session ends ("session_ended"). A handler that ignores it is cut
+     *  off 15 s after `timeout_s` with a `timeout` result and the device lock is released. */
+    signal: AbortSignal;
+    /** Tell the agent (and keep the session alive) with one plain line. The host allow-lists the
+     *  fields, cuts `line` to 140 and sends at most one every 2 s (the newest waiting one goes
+     *  out when the gap is over). Never throws. Call it at least once a minute on a long task:
+     *  Salt ends a session that has run nothing for 2 minutes (5 when a person supervises). */
+    progress(p: Progress): void;
+    /** Count one step toward the grant's budget and the metadata counts, and keep the session
+     *  alive. Throws `DeviceBudgetSpentError` when `max_actions` is already spent: let it bubble. */
+    spend(cls: TaskSpendClass): void;
+    /** Why the session is paused (the person has the computer), or null. A task must not act
+     *  while this is non-null. */
+    paused(): DevicePauseReason | null;
+    /** Resolves `running` at once when not paused, or when the pause ends; `paused_out` when the
+     *  task's own time runs out first (finish with status `paused_out`); `stopped` when the task
+     *  is cancelled or the session ends. */
+    waitWhilePaused(): Promise<"running" | "paused_out" | "stopped">;
+    /** The `device.task` rule's mode: `ask` means every command asks the person first (Limited
+     *  grant), `auto` runs it, `notify` runs it and tells them. The host does not ask for the
+     *  task as a whole; the handler asks per command. */
+    mode: DeviceCapRule["mode"];
+    /** The grant's other rules (`device.observe`, `device.act`, `device.apps`, ...), read-only. */
+    caps: Readonly<Partial<Record<string, DeviceCapRule>>>;
+}
+/** `ctx.spend` when the grant's `max_actions` is already spent. A `DeviceProtocolError` with
+ *  code `out_of_scope`, so a handler that lets it bubble answers the agent "action budget
+ *  spent" and the host ends the session `budget_exhausted`. */
+export declare class DeviceBudgetSpentError extends DeviceProtocolError {
+    constructor();
+}
+/** What a mutating handler may hand back: nothing, or a record about how the action went
+ *  (a typed text reports `typed`, `method`, `verified`, `note`). Only those four fields ride
+ *  into the ack, each with its own type, so the agent learns what the computer really did and
+ *  nothing else (never a field's text, a screen, or any other handler-supplied field). */
+export type HandlerResult = void | Record<string, unknown>;
+/** The ack body: the allow-listed handler fields (typed: finite number, method: string,
+ *  verified: boolean, note: string capped at 300), then `ok: true` (which a handler cannot
+ *  override, so an old agent that only reads `ok` sees the same wire it always did). */
+export declare function ackBody(result: unknown): Record<string, unknown>;
+/** What the server told the device about this session in the
+ *  `device_session_request` delivery. The device trusts this snapshot and
+ *  re-checks it on EVERY command; it never widens it (only the person, locally,
+ *  can widen a mandate, and that produces a new snapshot). */
+export interface DeviceCapsSnapshot {
+    sessionId: SaltId;
+    agentId: SaltId;
+    /** Armored public keys of every lane reader; results are encrypted for all. */
+    readers: LaneReaders;
+    /** The capabilities granted, keyed by `device.*`. A command whose op maps to
+     *  a capability not present here is `out_of_scope`. */
+    caps: Partial<Record<string, DeviceCapRule>>;
+    budget?: {
+        maxActions?: number;
+        maxDurationS?: number;
+    };
+    /** ISO8601; past it, the session ends `mandate_expired`. */
+    expiresAt?: string;
+}
+export interface DeviceCapRule {
+    /** auto = run; ask = ask the person at the machine first; notify = run and
+     *  tell them. The device holds this decision, never the server. */
+    mode: "auto" | "ask" | "notify";
+    /** For device.apps: the only bundle ids / exe names in scope (empty/omitted
+     *  = any app the floor allows). */
+    apps?: string[];
+    /** For device.files.*: the only path prefixes in scope. A file op outside
+     *  every root is `out_of_scope`. */
+    fileRoots?: string[];
+}
+export interface DeviceHostTransport {
+    /** Encrypt `plaintext` for the lane readers and POST it as one lane message. */
+    postResult(plaintext: string, readers: LaneReaders): Promise<void>;
+    /** POST /device_sessions/:sid/beat. A 409 means the session is over: the
+     *  transport should throw a DeviceBeatOverError so the host stops at once. */
+    beat(sessionId: SaltId, report?: DeviceBeatReport): Promise<void>;
+    /** PATCH /device_sessions/:sid/counts with whole-number per-class counts and
+     *  the newest executed seq. Salt extends an agent's lease ONLY from these
+     *  device reports (it never sees commands). */
+    reportCounts(sessionId: SaltId, counts: Partial<Record<DeviceCountClass, number>>, report?: {
+        last_seq?: number;
+    }): Promise<void>;
+    /** POST /device_sessions/:sid/stop with an end reason (subtract-only). */
+    stop(sessionId: SaltId, reason: string): Promise<void>;
+    /** POST /device_sessions/:sid/pause `{reason}` (device key). Optional: a
+     *  transport without it still pauses locally. The only place the pause
+     *  endpoint's shape lives is httpDeviceHostTransport (http.ts). */
+    pause?(sessionId: SaltId, reason: DevicePauseReason): Promise<void>;
+    /** POST /device_sessions/:sid/resume (device key). */
+    resume?(sessionId: SaltId): Promise<void>;
+}
+/** The optional body of a beat: when the device last executed a command
+ *  (ISO8601) and that command's seq. Sent on every beat once one has run. */
+export interface DeviceBeatReport {
+    last_command_at?: string;
+    last_seq?: number;
+    /** True on every beat while a `task` handler is running: one model call can take two minutes, and a
+     *  plain beat does not keep the session alive past the idle lease. */
+    task_running?: true;
+}
+export declare class DeviceBeatOverError extends Error {
+}
+/** A FIFO async mutex. One of these guards every mutating command (click /
+ *  type / key / scroll / focus_app) on the machine, whichever session sent it.
+ *  `sharedDeviceLock` is the process-wide instance every host uses by default,
+ *  so two sessions on one machine can never interleave input. salt-device may
+ *  pass its own via `options.deviceLock` (e.g. to also hold it around local
+ *  tray actions that inject input). */
+export declare class DeviceLock {
+    private tail;
+    /** Resolves with a release function once every earlier holder released. */
+    acquire(): Promise<() => void>;
+    /** Run `fn` while holding the lock. */
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}
+/** The process-wide device mutex (default for every host). */
+export declare const sharedDeviceLock: DeviceLock;
+export interface DeviceHostCallbacks {
+    /** The LOCAL approval prompt for an `ask`-mode command. Resolves true if the
+     *  person at the machine approved. The host shows `needs_approval` until it
+     *  does. The DESKTOP APP owns this UI; absent, every ask-mode op is refused. */
+    requestLocalApproval?(op: DeviceOp, args: unknown, opts?: {
+        timeoutMs: number;
+    }): Promise<boolean>;
+    /** Told after a `notify`-mode command runs, so the app can surface it. */
+    onNotify?(op: DeviceOp, args: unknown): void;
+    /** Told when the host ends the session itself (budget, duration, lost beat,
+     *  a stop command). The app updates its indicator and writes its audit line. */
+    onEnded?(reason: string): void;
+    /** Every gate decision, for the app's append-only on-disk audit log. Content
+     *  is the caller's to redact; the host passes op + decision + reason only. */
+    onAudit?(entry: DeviceAuditEntry): void;
+}
+export interface DeviceAuditEntry {
+    at: number;
+    commandId: string;
+    op: string;
+    decision: "ran" | "refused" | "needs_approval" | "ended";
+    code?: DeviceErrorCode;
+    reason?: string;
+}
+/** Apps the floor never allows a command to target, whatever a mandate says:
+ *  password managers and keychains. The desktop app extends this with its own
+ *  Salt windows (which it also blanks in the capture handler). Browsers are
+ *  deliberately NOT here (owner: browsers full, no deny-list). */
+export declare const NEVER_ALLOWED_APPS: readonly string[];
+export interface DeviceHost {
+    /** Feed a decrypted lane message in. Non-device lines and results from
+     *  elsewhere return false and are ignored. A command is answered (ack /
+     *  observation / error / ...) via the transport. */
+    handleCommand(plaintext: string): Promise<boolean>;
+    /** Start the live heartbeat + budget/duration watch. The desktop app calls
+     *  this once the session is active. */
+    start(): void;
+    /** End the session locally (subtract-only) and tell the server. */
+    stop(reason?: string): Promise<void>;
+    /** The spent count of budgeted actions, for the indicator. */
+    actionsSpent(): number;
+    /** Pause the session: every command (except `stop` and `cancel`) is refused
+     *  `paused` with `reason` until resume(). Takes effect synchronously; the
+     *  returned promise settles when Salt has been told (a failed report never
+     *  un-pauses). Idempotent; a second reason replaces the first. Does not
+     *  interrupt a command already executing. */
+    pause(reason: DevicePauseReason): Promise<void>;
+    /** Clear the pause and tell Salt. No-op when not paused. */
+    resume(): Promise<void>;
+    /** The current pause reason, or null. */
+    pausedReason(): DevicePauseReason | null;
+}
+export declare function createDeviceHost(snapshot: DeviceCapsSnapshot, handlers: DeviceHostHandlers, transport: DeviceHostTransport, callbacks?: DeviceHostCallbacks, options?: {
+    beatIntervalMs?: number;
+    neverAllowedApps?: readonly string[];
+    /** Device-wide mutex for mutating ops. Default: the process-wide
+     *  `sharedDeviceLock`, so every host in this process shares one. */
+    deviceLock?: DeviceLock;
+    /** Clock, for tests. */
+    now?: () => number;
+    /** Least gap between two `progress` lines of a task (default PROGRESS_MIN_INTERVAL_MS). */
+    progressMinIntervalMs?: number;
+    /** How long past `timeout_s` a task handler may run before it is cut off (default 15 s). */
+    taskGraceMs?: number;
+}): DeviceHost;
+//# sourceMappingURL=host.d.ts.map

package/dist/device/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/device/host.ts"],"names":[],"mappings":"AAiCA,OAAO,EAKL,mBAAmB,EAenB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAEpB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAEhD;;4EAE4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,GAAG,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E;;;;oDAIgD;IAChD,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpE;AAED;yEACyE;AACzE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;AAU7E,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC;;8FAE0F;IAC1F,MAAM,EAAE,WAAW,CAAC;IACpB;;;+FAG2F;IAC3F,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5B;qGACiG;IACjG,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC;kCAC8B;IAC9B,MAAM,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACnC;;4CAEwC;IACxC,eAAe,IAAI,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC,CAAC;IACjE;;yDAEqD;IACrD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,+FAA+F;IAC/F,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;CACxD;AAED;;+DAE+D;AAC/D,qBAAa,sBAAuB,SAAQ,mBAAmB;;CAK9D;AAED;;;0FAG0F;AAC1F,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAI3D;;wFAEwF;AACxF,wBAAgB,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWhE;AAED;;;8DAG8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,OAAO,EAAE,WAAW,CAAC;IACrB;2DACuD;IACvD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B;uEACmE;IACnE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAChC;uCACmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;wCACoC;IACpC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;kFAC8E;IAC9E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;mDAE+C;IAC/C,YAAY,CACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,EACjD,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,0EAA0E;IAC1E,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;uEAEmE;IACnE,KAAK,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,sDAAsD;IACtD,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED;6EAC6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;0EACsE;IACtE,YAAY,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;uCAKuC;AACvC,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAoC;IAChD,2EAA2E;IAC3E,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;IAO9B,uCAAuC;IACjC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAQ/C;AAUD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,YAAmB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC;;oFAEgF;IAChF,oBAAoB,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnG,0EAA0E;IAC1E,QAAQ,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C;oFACgF;IAChF,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;kFAC8E;IAC9E,OAAO,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,KAAK,GAAG,SAAS,GAAG,gBAAgB,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;kEAGkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAc/C,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB;;wDAEoD;IACpD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD;2CACuC;IACvC,KAAK,IAAI,IAAI,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,8DAA8D;IAC9D,YAAY,IAAI,MAAM,CAAC;IACvB;;;;iDAI6C;IAC7C,KAAK,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,4DAA4D;IAC5D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,yCAAyC;IACzC,YAAY,IAAI,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,mBAAmB,EAC9B,SAAS,GAAE,mBAAwB,EACnC,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;wEACoE;IACpE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2FAA2F;IAC3F,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,GACL,UAAU,CA+tBZ"}