@agent-relay/sdk 4.0.2 → 4.0.4

package/dist/workflows/__tests__/e2e-permissions.test.js

@@ -0,0 +1,331 @@
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const fixturePath = fileURLToPath(new URL('./fixtures/permission-test.yaml', import.meta.url));
+const permissionProfiles = {
+    reader: {
+        access: 'readonly',
+        scopes: ['relayfile:fs:read:/**'],
+        summary: { readonly: 4, readwrite: 0, denied: 0, customScopes: 0 },
+    },
+    writer: {
+        access: 'readwrite',
+        scopes: ['relayfile:fs:read:/src/tests/**', 'relayfile:fs:write:/src/tests/**'],
+        summary: { readonly: 0, readwrite: 1, denied: 2, customScopes: 0 },
+    },
+    'admin-lead': {
+        access: 'full',
+        scopes: ['relayfile:fs:read:/**', 'relayfile:fs:write:/**'],
+        summary: { readonly: 0, readwrite: 6, denied: 0, customScopes: 0 },
+    },
+};
+function buildCompiledPermissions(agentName, workspace, profile) {
+    return {
+        agentName,
+        workspace,
+        effectiveAccess: profile.access,
+        inherited: profile.access !== 'full',
+        sources: [{ type: 'yaml', label: 'permissions', ruleCount: profile.scopes.length }],
+        readonlyPatterns: profile.access === 'readonly' ? ['**'] : [],
+        readwritePatterns: profile.access === 'full'
+            ? ['**']
+            : profile.scopes
+                .filter((scope) => scope.startsWith('relayfile:fs:write:'))
+                .map((scope) => scope.split(':').slice(3).join(':')),
+        deniedPatterns: agentName === 'writer' ? ['.env', 'secrets/**'] : [],
+        readonlyPaths: Array.from({ length: profile.summary.readonly }, (_, index) => `readonly-${index}.txt`),
+        readwritePaths: Array.from({ length: profile.summary.readwrite }, (_, index) => `write-${index}.txt`),
+        deniedPaths: Array.from({ length: profile.summary.denied }, (_, index) => `denied-${index}.txt`),
+        scopes: [...profile.scopes],
+        network: undefined,
+        exec: undefined,
+        acl: {},
+        summary: { ...profile.summary },
+    };
+}
+let lastProvisionCall = null;
+let lastProvisionResult = null;
+const mockProvisionWorkflowAgents = vi.fn(async (input) => {
+    lastProvisionCall = input;
+    const agentNames = Object.keys(input.agents ?? {});
+    const tokens = new Map();
+    const scopes = new Map();
+    const agents = Object.fromEntries(agentNames.map((agentName) => {
+        const profile = permissionProfiles[agentName];
+        const token = `jwt-${agentName}`;
+        const compiled = buildCompiledPermissions(agentName, input.workspace, profile);
+        tokens.set(agentName, token);
+        scopes.set(agentName, [...profile.scopes]);
+        return [
+            agentName,
+            {
+                name: agentName,
+                tokenPath: path.join(input.projectDir, '.relay', 'tokens', `${agentName}.jwt`),
+                token,
+                scopes: [...profile.scopes],
+                compiled,
+            },
+        ];
+    }));
+    const result = {
+        agents,
+        agentNames,
+        adminToken: 'jwt-admin',
+        seededFileCount: 0,
+        seededAclCount: 0,
+        summary: agentNames.reduce((acc, agentName) => {
+            const profile = permissionProfiles[agentName];
+            acc.readonly += profile.summary.readonly;
+            acc.readwrite += profile.summary.readwrite;
+            acc.denied += profile.summary.denied;
+            acc.customScopes += profile.summary.customScopes;
+            return acc;
+        }, { readonly: 0, readwrite: 0, denied: 0, customScopes: 0 }),
+        mounts: new Map(),
+        tokens,
+        scopes,
+    };
+    lastProvisionResult = result;
+    return result;
+});
+const mockResolveAgentPermissions = vi.fn((agentName, _permissions, _projectDir, workspace) => buildCompiledPermissions(agentName, workspace, permissionProfiles[agentName]));
+vi.mock('../../provisioner/index.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        provisionWorkflowAgents: mockProvisionWorkflowAgents,
+        resolveAgentPermissions: mockResolveAgentPermissions,
+    };
+});
+const mockFetch = vi.fn().mockResolvedValue({
+    ok: true,
+    json: () => Promise.resolve({ data: { api_key: 'rk_live_test', workspace_id: 'ws-test' } }),
+    text: () => Promise.resolve(''),
+});
+vi.stubGlobal('fetch', mockFetch);
+const mockRelaycastAgent = {
+    send: vi.fn().mockResolvedValue(undefined),
+    heartbeat: vi.fn().mockResolvedValue(undefined),
+    channels: {
+        create: vi.fn().mockResolvedValue(undefined),
+        join: vi.fn().mockResolvedValue(undefined),
+        invite: vi.fn().mockResolvedValue(undefined),
+    },
+};
+const mockRelaycast = {
+    agents: {
+        register: vi.fn().mockResolvedValue({ token: 'token-1' }),
+    },
+    as: vi.fn().mockReturnValue(mockRelaycastAgent),
+};
+class MockRelayError extends Error {
+    code;
+    constructor(code, message, status = 400) {
+        super(message);
+        this.code = code;
+        this.name = 'RelayError';
+        this.status = status;
+    }
+}
+vi.mock('@relaycast/sdk', () => ({
+    RelayCast: vi.fn().mockImplementation(() => mockRelaycast),
+    RelayError: MockRelayError,
+}));
+let waitForExitFn;
+let waitForIdleFn;
+let mockSpawnOutputs = [];
+const mockAgent = {
+    name: 'test-agent-abc',
+    get waitForExit() {
+        return waitForExitFn;
+    },
+    get waitForIdle() {
+        return waitForIdleFn;
+    },
+    release: vi.fn().mockResolvedValue(undefined),
+};
+const mockHuman = {
+    name: 'WorkflowRunner',
+    sendMessage: vi.fn().mockResolvedValue(undefined),
+};
+const defaultSpawnPtyImplementation = async ({ name, task }) => {
+    const queued = mockSpawnOutputs.shift();
+    const stepComplete = task?.match(/STEP_COMPLETE:([^\n]+)/)?.[1]?.trim();
+    const output = queued ?? (stepComplete ? `STEP_COMPLETE:${stepComplete}\n` : 'STEP_COMPLETE:unknown\n');
+    queueMicrotask(() => {
+        if (typeof mockRelayInstance.onWorkerOutput === 'function') {
+            mockRelayInstance.onWorkerOutput({ name, chunk: output });
+        }
+    });
+    return { ...mockAgent, name };
+};
+const mockRelayInstance = {
+    spawnPty: vi.fn().mockImplementation(defaultSpawnPtyImplementation),
+    human: vi.fn().mockReturnValue(mockHuman),
+    shutdown: vi.fn().mockResolvedValue(undefined),
+    onBrokerStderr: vi.fn().mockReturnValue(() => { }),
+    onWorkerOutput: null,
+    onMessageReceived: null,
+    onAgentSpawned: null,
+    onAgentReleased: null,
+    onAgentExited: null,
+    onAgentIdle: null,
+    onDeliveryUpdate: null,
+    listAgentsRaw: vi.fn().mockResolvedValue([]),
+};
+vi.mock('../../relay.js', () => ({
+    AgentRelay: vi.fn().mockImplementation(() => mockRelayInstance),
+}));
+const { WorkflowRunner } = await import('../runner.js');
+const { formatDryRunReport } = await import('../dry-run-format.js');
+function makeDb() {
+    const runs = new Map();
+    const steps = new Map();
+    return {
+        insertRun: vi.fn(async (run) => {
+            runs.set(run.id, { ...run });
+        }),
+        updateRun: vi.fn(async (id, patch) => {
+            const existing = runs.get(id);
+            if (existing)
+                runs.set(id, { ...existing, ...patch });
+        }),
+        getRun: vi.fn(async (id) => {
+            const run = runs.get(id);
+            return run ? { ...run } : null;
+        }),
+        insertStep: vi.fn(async (step) => {
+            steps.set(step.id, { ...step });
+        }),
+        updateStep: vi.fn(async (id, patch) => {
+            const existing = steps.get(id);
+            if (existing)
+                steps.set(id, { ...existing, ...patch });
+        }),
+        getStepsByRunId: vi.fn(async (runId) => {
+            return [...steps.values()].filter((step) => step.runId === runId);
+        }),
+    };
+}
+function never() {
+    return new Promise(() => { });
+}
+function createWorkspace() {
+    const dir = mkdtempSync(path.join(os.tmpdir(), 'relay-workflow-permissions-'));
+    mkdirSync(path.join(dir, 'src', 'tests'), { recursive: true });
+    mkdirSync(path.join(dir, 'src'), { recursive: true });
+    mkdirSync(path.join(dir, 'secrets'), { recursive: true });
+    writeFileSync(path.join(dir, 'README.md'), '# workspace\n');
+    writeFileSync(path.join(dir, 'src', 'index.ts'), 'export const value = 1;\n');
+    writeFileSync(path.join(dir, 'src', 'tests', 'fixture.txt'), 'fixture\n');
+    writeFileSync(path.join(dir, '.env'), 'TOKEN=secret\n');
+    writeFileSync(path.join(dir, 'secrets', 'prod.txt'), 'top-secret\n');
+    return dir;
+}
+async function loadPermissionFixture(runner, options = {}) {
+    const config = await runner.parseYamlFile(fixturePath);
+    config.trajectories = false;
+    if (options.includeLeadStep) {
+        const workflow = config.workflows?.find((entry) => entry.name === 'test');
+        workflow?.steps.push({
+            name: 'lead-step',
+            agent: 'admin-lead',
+            dependsOn: ['read-step', 'write-step'],
+            task: 'Verify admin lead permissions are available and conclude the workflow.',
+        });
+    }
+    return config;
+}
+describe('WorkflowRunner permissions integration', () => {
+    let db;
+    let runner;
+    let workspaceDir;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        waitForExitFn = vi.fn().mockResolvedValue('exited');
+        waitForIdleFn = vi.fn().mockImplementation(() => never());
+        mockSpawnOutputs = [];
+        mockAgent.release.mockResolvedValue(undefined);
+        mockRelayInstance.spawnPty.mockImplementation(defaultSpawnPtyImplementation);
+        mockRelayInstance.onWorkerOutput = null;
+        lastProvisionCall = null;
+        lastProvisionResult = null;
+        workspaceDir = createWorkspace();
+        db = makeDb();
+        runner = new WorkflowRunner({ db, workspaceId: 'ws-test', cwd: workspaceDir });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        rmSync(workspaceDir, { recursive: true, force: true });
+    });
+    it('provisions permissions, propagates agent tokens, and clears workflow tokens after completion', async () => {
+        const config = await loadPermissionFixture(runner, { includeLeadStep: true });
+        const provisionSpy = vi.spyOn(runner, 'provisionAgents');
+        const nonInteractiveCommandSpy = vi
+            .spyOn(WorkflowRunner, 'buildNonInteractiveCommand')
+            .mockImplementation(() => ({
+            cmd: 'sh',
+            args: ['-c', 'printf "RELAY_AGENT_TOKEN=%s" "$RELAY_AGENT_TOKEN"'],
+        }));
+        const run = await runner.execute(config, 'test');
+        const steps = await db.getStepsByRunId(run.id);
+        const stepByName = new Map(steps.map((step) => [step.stepName, step]));
+        const provisionedScopes = lastProvisionResult?.scopes;
+        const spawnCalls = mockRelayInstance.spawnPty.mock.calls.map(([input]) => input);
+        expect(run.status).toBe('completed');
+        expect(provisionSpy).toHaveBeenCalledTimes(1);
+        expect(mockProvisionWorkflowAgents).toHaveBeenCalledTimes(1);
+        expect(lastProvisionCall?.workspace).toBe('ws-test');
+        expect(lastProvisionCall?.projectDir).toBe(workspaceDir);
+        expect(Object.keys(lastProvisionCall?.agents ?? {})).toEqual(['reader', 'writer', 'admin-lead']);
+        expect(provisionedScopes?.get('reader')).toEqual(['relayfile:fs:read:/**']);
+        expect(provisionedScopes?.get('reader')?.some((scope) => scope.includes(':write:'))).toBe(false);
+        expect(provisionedScopes?.get('writer')).toEqual([
+            'relayfile:fs:read:/src/tests/**',
+            'relayfile:fs:write:/src/tests/**',
+        ]);
+        expect(provisionedScopes?.get('writer')?.filter((scope) => scope.includes(':write:'))).toEqual([
+            'relayfile:fs:write:/src/tests/**',
+        ]);
+        expect(provisionedScopes?.get('admin-lead')).toEqual(['relayfile:fs:read:/**', 'relayfile:fs:write:/**']);
+        expect(nonInteractiveCommandSpy).toHaveBeenCalledTimes(2);
+        expect(stepByName.get('read-step')?.output).toBe('RELAY_AGENT_TOKEN=jwt-reader');
+        expect(stepByName.get('write-step')?.output).toBe('RELAY_AGENT_TOKEN=jwt-writer');
+        expect(spawnCalls.length).toBeGreaterThan(0);
+        expect(spawnCalls.every((call) => typeof call.agentToken === 'string' && call.agentToken.length > 0)).toBe(true);
+        expect(spawnCalls[0]?.agentToken).toBe('jwt-admin-lead');
+        expect(runner.agentTokens.size).toBe(0);
+        expect(runner.agentMounts.size).toBe(0);
+    }, 20_000);
+    it('shows a permissions summary in dry-run mode', async () => {
+        const config = await loadPermissionFixture(runner);
+        const report = runner.dryRun(config, 'test');
+        const formatted = formatDryRunReport(report);
+        expect(report.permissions).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                agent: 'reader',
+                access: 'readonly',
+                writePaths: 0,
+            }),
+            expect.objectContaining({
+                agent: 'writer',
+                access: 'readwrite',
+                writePaths: 1,
+            }),
+            expect.objectContaining({
+                agent: 'admin-lead',
+                access: 'full',
+            }),
+        ]));
+        expect(formatted).toContain('Permissions');
+        expect(formatted).toContain('reader');
+        expect(formatted).toContain('writer');
+        expect(formatted).toContain('admin-lead');
+        expect(formatted).toContain('readonly');
+        expect(formatted).toContain('readwrite');
+        expect(formatted).toContain('full');
+    }, 20_000);
+});
+//# sourceMappingURL=e2e-permissions.test.js.map

package/dist/workflows/__tests__/e2e-permissions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-permissions.test.js","sourceRoot":"","sources":["../../../src/workflows/__tests__/e2e-permissions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAMzC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/F,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,CAAC,uBAAuB,CAAC;QACjC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;KACnE;IACD,MAAM,EAAE;QACN,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,CAAC,iCAAiC,EAAE,kCAAkC,CAAC;QAC/E,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;KACnE;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;QAC3D,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;KACnE;CACO,CAAC;AAIX,SAAS,wBAAwB,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAA0B;IAChG,OAAO;QACL,SAAS;QACT,SAAS;QACT,eAAe,EAAE,OAAO,CAAC,MAAM;QAC/B,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM;QACpC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5F,gBAAgB,EAAE,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7D,iBAAiB,EACf,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,CAAC,IAAI,CAAC;YACR,CAAC,CAAC,OAAO,CAAC,MAAM;iBACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;iBAC1D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,cAAc,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,KAAK,MAAM,CAAC;QACtG,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC;QACrG,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,CAAC;QAChG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,IAAI,iBAAiB,GAAmC,IAAI,CAAC;AAC7D,IAAI,mBAAmB,GAA2B,IAAI,CAAC;AAEvD,MAAM,2BAA2B,GAAG,EAAE,CAAC,EAAE,CACvC,KAAK,EAAE,KAA8B,EAA4B,EAAE;IACjE,iBAAiB,GAAG,KAAK,CAAC;IAE1B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAA4C,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,OAAO,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE/E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAE3C,OAAO;YACL,SAAS;YACT;gBACE,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,MAAM,CAAC;gBAC9E,KAAK;gBACL,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC3B,QAAQ;aACT;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAoB;QAC9B,MAAM;QACN,UAAU;QACV,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,UAAU,CAAC,MAAM,CACxB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAA4C,CAAC,CAAC;YACjF,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YACjD,OAAO,GAAG,CAAC;QACb,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAC1D;QACD,MAAM,EAAE,IAAI,GAAG,EAAE;QACjB,MAAM;QACN,MAAM;KACP,CAAC;IAEF,mBAAmB,GAAG,MAAM,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC,CACF,CAAC;AAEF,MAAM,2BAA2B,GAAG,EAAE,CAAC,EAAE,CACvC,CAAC,SAAiB,EAAE,YAAqB,EAAE,WAAmB,EAAE,SAAiB,EAAE,EAAE,CACnF,wBAAwB,CACtB,SAAS,EACT,SAAS,EACT,kBAAkB,CAAC,SAA4C,CAAC,CACjE,CACJ,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC7D,MAAM,MAAM,GAAG,MAAM,cAAc,EAA+C,CAAC;IACnF,OAAO;QACL,GAAG,MAAM;QACT,uBAAuB,EAAE,2BAA2B;QACpD,uBAAuB,EAAE,2BAA2B;KACrD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;IAC1C,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC;IAC3F,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IAC/C,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC5C,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC1C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;KAC7C;CACF,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC1D;IACD,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,kBAAkB,CAAC;CAChD,CAAC;AAEF,MAAM,cAAe,SAAQ,KAAK;IAChC,IAAI,CAAS;IAEb,YAAY,IAAY,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACxB,IAAY,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,CAAC;CACF;AAED,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;IAC1D,UAAU,EAAE,cAAc;CAC3B,CAAC,CAAC,CAAC;AAEJ,IAAI,aAA0E,CAAC;AAC/E,IAAI,aAAsE,CAAC;AAC3E,IAAI,gBAAgB,GAAa,EAAE,CAAC;AAEpC,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,gBAAgB;IACtB,IAAI,WAAW;QACb,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,WAAW;QACb,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;CAC9C,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;CAClD,CAAC;AAEF,MAAM,6BAA6B,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAmC,EAAE,EAAE;IAC9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,YAAY,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAExG,cAAc,CAAC,GAAG,EAAE;QAClB,IAAI,OAAO,iBAAiB,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YAC3D,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,6BAA6B,CAAC;IACnE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC;IACzC,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;IAC9C,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;IACjD,cAAc,EAAE,IAAiE;IACjF,iBAAiB,EAAE,IAAW;IAC9B,cAAc,EAAE,IAAW;IAC3B,eAAe,EAAE,IAAW;IAC5B,aAAa,EAAE,IAAW;IAC1B,WAAW,EAAE,IAAW;IACxB,gBAAgB,EAAE,IAAW;IAC7B,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;CAC7C,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;CAChE,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;AACxD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAEpE,SAAS,MAAM;IACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,OAAO;QACL,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAmB,EAAE,EAAE;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,KAA8B,EAAE,EAAE;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC;QACF,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;YAChD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QACF,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,KAA+B,EAAE,EAAE;YACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;YAC7C,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACpE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAC/E,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC9E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAA2C,EAC3C,UAAyC,EAAE;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAC1E,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;YACtC,IAAI,EAAE,wEAAwE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,IAAI,EAAc,CAAC;IACnB,IAAI,MAA2C,CAAC;IAChD,IAAI,YAAoB,CAAC;IAEzB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,gBAAgB,GAAG,EAAE,CAAC;QACtB,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/C,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAC7E,iBAAiB,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,iBAAiB,GAAG,IAAI,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC;QAC3B,YAAY,GAAG,eAAe,EAAE,CAAC;QACjC,EAAE,GAAG,MAAM,EAAE,CAAC;QACd,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,MAAa,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,wBAAwB,GAAG,EAAE;aAChC,KAAK,CAAC,cAAc,EAAE,4BAA4B,CAAC;aACnD,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;YACzB,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAC,IAAI,EAAE,oDAAoD,CAAC;SACnE,CAAC,CAAC,CAAC;QAEN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,iBAAiB,GAAG,mBAAmB,EAAE,MAAM,CAAC;QACtD,MAAM,UAAU,GAAI,iBAAiB,CAAC,QAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACnE,CAAC,CAAC,KAAK,CAA0C,EAAE,EAAE,CAAC,KAAK,CAC5D,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,CAAC,YAAY,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,2BAA2B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAEjG,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/C,iCAAiC;YACjC,kCAAkC;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,kCAAkC;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAE1G,MAAM,CAAC,wBAAwB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjF,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAElF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CACJ,UAAU,CAAC,KAAK,CACd,CAAC,IAA4B,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CACpG,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzD,MAAM,CAAE,MAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAE,MAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAChC,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CAAC;gBACtB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,CAAC;aACd,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC;gBACtB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC;aACd,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC;gBACtB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,MAAM;aACf,CAAC;SACH,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/workflows/__tests__/permission-types.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permission-types.test.d.ts.map

package/dist/workflows/__tests__/permission-types.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-types.test.d.ts","sourceRoot":"","sources":["../../../src/workflows/__tests__/permission-types.test.ts"],"names":[],"mappings":""}

package/dist/workflows/__tests__/permission-types.test.js

@@ -0,0 +1,124 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { compileAgentScopes, resolveAgentPermissions } from '../../provisioner/compiler.js';
+import { isAgentStep, isDeterministicStep, isRestrictedAgent } from '../types.js';
+const tempDirs = [];
+async function createWorkspace(files) {
+    const dir = await mkdtemp(path.join(tmpdir(), 'relay-workflow-permission-types-'));
+    tempDirs.push(dir);
+    for (const [relativePath, content] of Object.entries(files)) {
+        const filePath = path.join(dir, relativePath);
+        await mkdir(path.dirname(filePath), { recursive: true });
+        await writeFile(filePath, content);
+    }
+    return dir;
+}
+afterEach(async () => {
+    while (tempDirs.length > 0) {
+        await rm(tempDirs.pop(), { recursive: true, force: true });
+    }
+});
+describe('workflow permission types', () => {
+    it('allows agents to omit permissions without becoming restricted', () => {
+        const agent = {
+            name: 'worker',
+            cli: 'codex',
+            task: 'Write tests',
+        };
+        expect(agent.permissions).toBeUndefined();
+        expect(isRestrictedAgent(agent)).toBe(false);
+    });
+    it.each(['readonly', 'readwrite', 'restricted', 'full'])('accepts the %s access preset', async (access) => {
+        const workspace = await createWorkspace({
+            'src/index.ts': 'export const value = 1;\n',
+        });
+        const compiled = compileAgentScopes({
+            agentName: `${access}-agent`,
+            workspace: 'relay-test',
+            projectDir: workspace,
+            permissions: {
+                access,
+                inherit: false,
+            },
+        });
+        expect(compiled.effectiveAccess).toBe(access);
+        expect(isRestrictedAgent({ name: 'agent', cli: 'codex', permissions: { access } })).toBe(access === 'readonly' || access === 'restricted');
+    });
+    it('compiles full permissions with read/write access for all files', async () => {
+        const workspace = await createWorkspace({
+            '.agentignore': 'secret.txt\n',
+            '.agentreadonly': 'locked.txt\n',
+            'locked.txt': 'lock me\n',
+            'secret.txt': 'classified\n',
+            'src/index.ts': 'export const value = 1;\n',
+        });
+        const compiled = compileAgentScopes({
+            agentName: 'lead',
+            workspace: 'relay-test',
+            projectDir: workspace,
+            permissions: {
+                access: 'full',
+                network: false,
+                exec: ['npm test'],
+                scopes: ['custom:relay:debug'],
+            },
+        });
+        expect(compiled.effectiveAccess).toBe('full');
+        expect(compiled.inherited).toBe(false);
+        expect(compiled.readonlyPaths).toEqual([]);
+        expect(compiled.deniedPaths).toEqual([]);
+        expect(compiled.readwritePaths).toEqual([
+            '.agentignore',
+            '.agentreadonly',
+            'locked.txt',
+            'secret.txt',
+            'src/index.ts',
+        ]);
+        expect(compiled.scopes).toContain('relayfile:fs:read:/secret.txt');
+        expect(compiled.scopes).toContain('relayfile:fs:write:/secret.txt');
+        expect(compiled.scopes).toContain('relayfile:fs:read:/src/index.ts');
+        expect(compiled.scopes).toContain('relayfile:fs:write:/src/index.ts');
+        expect(compiled.scopes).toContain('custom:relay:debug');
+        expect(compiled.network).toBe(false);
+        expect(compiled.exec).toEqual(['npm test']);
+        expect(compiled.summary).toEqual({
+            readonly: 0,
+            readwrite: 5,
+            denied: 0,
+            customScopes: 1,
+        });
+    });
+    it('preserves backwards-compatible default resolution when permissions are undefined', async () => {
+        const workspace = await createWorkspace({
+            '.agentignore': 'blocked.txt\n',
+            '.agentreadonly': 'locked.txt\n',
+            'blocked.txt': 'do not read\n',
+            'locked.txt': 'read only\n',
+            'writable.txt': 'can edit\n',
+        });
+        const compiled = resolveAgentPermissions('legacy-worker', undefined, workspace, 'relay-test');
+        expect(compiled.effectiveAccess).toBe('readwrite');
+        expect(compiled.inherited).toBe(true);
+        expect(compiled.readonlyPaths).toEqual(['locked.txt']);
+        expect(compiled.readwritePaths).toEqual(['.agentignore', '.agentreadonly', 'writable.txt']);
+        expect(compiled.deniedPaths).toEqual(['blocked.txt']);
+    });
+    it('keeps legacy workflow step aliases compatible with WorkflowStep guards', () => {
+        const agentStep = {
+            name: 'draft',
+            agent: 'worker',
+            task: 'Draft the summary',
+        };
+        const deterministicStep = {
+            name: 'check',
+            type: 'deterministic',
+            command: 'npm test',
+        };
+        expect(isAgentStep(agentStep)).toBe(true);
+        expect(isDeterministicStep(agentStep)).toBe(false);
+        expect(isDeterministicStep(deterministicStep)).toBe(true);
+    });
+});
+//# sourceMappingURL=permission-types.test.js.map

package/dist/workflows/__tests__/permission-types.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-types.test.js","sourceRoot":"","sources":["../../../src/workflows/__tests__/permission-types.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAO5F,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,QAAQ,GAAa,EAAE,CAAC;AAE9B,KAAK,UAAU,eAAe,CAAC,KAA6B;IAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC,CAAC;IACnF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,OAAO;YACZ,IAAI,EAAE,aAAa;SACpB,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAA4C,CAAC,CACjG,8BAA8B,EAC9B,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;YACtC,cAAc,EAAE,2BAA2B;SAC5C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,GAAG,MAAM,QAAQ;YAC5B,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE;gBACX,MAAM;gBACN,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACtF,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY,CACjD,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;YACtC,cAAc,EAAE,cAAc;YAC9B,gBAAgB,EAAE,cAAc;YAChC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,cAAc;YAC5B,cAAc,EAAE,2BAA2B;SAC5C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE;gBACX,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,MAAM,EAAE,CAAC,oBAAoB,CAAC;aAC/B;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;YACtC,cAAc;YACd,gBAAgB;YAChB,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACpE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACrE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACtE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC/B,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;YACtC,cAAc,EAAE,eAAe;YAC/B,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,eAAe;YAC9B,YAAY,EAAE,aAAa;YAC3B,cAAc,EAAE,YAAY;SAC7B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,uBAAuB,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAE9F,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,SAAS,GAAsB;YACnC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,MAAM,iBAAiB,GAA8B;YACnD,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,UAAU;SACpB,CAAC;QAEF,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/workflows/__tests__/permissions-integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissions-integration.test.d.ts.map

package/dist/workflows/__tests__/permissions-integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-integration.test.d.ts","sourceRoot":"","sources":["../../../src/workflows/__tests__/permissions-integration.test.ts"],"names":[],"mappings":""}