@aimarket/warden 0.15.0 → 0.17.0

package/dist/declare.js

@@ -0,0 +1,449 @@
+/**
+ * `warden-mcp declare` — for a server's publisher: the tool sets it lists under conditions HISTOR's
+ * sandbox does not have (a launcher's runner installed, one runner per operating system, a real
+ * key), written the way HISTOR reads them.
+ *
+ * A declaration goes in the server.json published to the official MCP registry
+ * (`_meta` → `io.modelcontextprotocol.registry/publisher-provided` → `dev.modelmarket.histor/tool-sets`),
+ * or in a file on the publisher's own domain that the entry points at with `url`. The file changes
+ * with every runner release without a new registry entry; HISTOR reads it every hour.
+ *
+ *   warden-mcp declare --when "runner 1.4, macOS" --out mcp-tool-sets.json -- npx -y @acme/launcher
+ *   warden-mcp declare --server-json --link https://acme.dev/.well-known/mcp-tool-sets.json
+ *   warden-mcp declare --check https://acme.dev/.well-known/mcp-tool-sets.json --name dev.acme/launcher
+ *
+ * The rules here are HISTOR's (histor/histor/declared.py), so what this command accepts HISTOR takes.
+ */
+import { readFile, writeFile, rename } from 'node:fs/promises';
+import { fetchServer, McpClientError } from './mcp-client.js';
+import { mtlToolSetDigest, MtlError } from './mtl.js';
+import { packageVersion } from './mcp-rpc.js';
+import { displaySafe } from './sanitize.js';
+export const PUBLISHER_PROVIDED = 'io.modelcontextprotocol.registry/publisher-provided';
+export const DECLARATION_FIELD = 'dev.modelmarket.histor/tool-sets';
+/** In the registry entry: the registry keeps ~4 KB of publisher-provided metadata. */
+export const MAX_ENTRY_SETS = 8;
+/** In a file on the publisher's domain: runner versions × operating systems. */
+export const MAX_FILE_SETS = 64;
+export const MAX_WHEN = 200;
+export const MAX_FILE_BYTES = 64 * 1024;
+const MAX_TOOLS = 5000;
+const SRI = /^sha256-[A-Za-z0-9+/]{43}=$/;
+const GITHUB_USER = /^[a-z0-9](?:[a-z0-9-]{0,38})$/;
+export class DeclareError extends Error {
+    constructor(message) { super(message); this.name = 'DeclareError'; }
+}
+/** The condition as one line of visible text: control and format characters (zero-width, bidi overrides) dropped. */
+export function cleanWhen(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const text = value.replace(/[\t\r\n]/g, ' ').replace(/[\p{Cc}\p{Cf}\p{Cs}\p{Co}\p{Cn}]/gu, '').split(/\s+/).filter(Boolean).join(' ');
+    return text ? [...text].slice(0, MAX_WHEN).join('') : undefined;
+}
+/**
+ * Why HISTOR will not read a declaration file at `url` for `serverName`, or undefined. The file must
+ * be on the domain the registry verified for the server's namespace or a subdomain (`ai.acme/x` →
+ * acme.ai); for `io.github.<user>/x`, on `<user>.github.io` or under `/<user>/` on raw or gist files.
+ */
+export function urlRefusal(url, serverName) {
+    if (typeof url !== 'string' || !url || url.length > 2000)
+        return '"url" must be an https URL';
+    // Scheme first, as HISTOR's urlsplit does: "not a url" is an answer about https, not about parsing.
+    if (!/^https:/i.test(url))
+        return '"url" must be https';
+    let parts;
+    try {
+        parts = new URL(url);
+    }
+    catch {
+        return '"url" does not parse';
+    }
+    if (parts.username || parts.password)
+        return '"url" must not carry credentials';
+    if (parts.port && parts.port !== '443')
+        return '"url" must use the default https port';
+    const host = parts.hostname.toLowerCase().replace(/\.$/, '');
+    const namespace = serverName.split('/', 1)[0].trim().toLowerCase();
+    if (namespace.startsWith('io.github.')) {
+        const user = namespace.slice('io.github.'.length);
+        if (!GITHUB_USER.test(user))
+            return 'the server name has no GitHub user HISTOR can bind the file to';
+        const path = parts.pathname.toLowerCase();
+        if (host === `${user}.github.io` || (['raw.githubusercontent.com', 'gist.githubusercontent.com'].includes(host) && path.startsWith(`/${user}/`)))
+            return undefined;
+        return `"url" must be on ${user}.github.io or under /${user}/ on raw.githubusercontent.com, the account the registry verified`;
+    }
+    const labels = namespace.split('.').filter(Boolean);
+    if (labels.length < 2)
+        return 'the server name has no domain HISTOR can bind the file to';
+    const domain = [...labels].reverse().join('.');
+    if (host === domain || host.endsWith(`.${domain}`))
+        return undefined;
+    return `"url" must be on ${domain} or a subdomain, the domain the registry verified for ${namespace}`;
+}
+/** Validated sets from a `sets` list, and why any entry was skipped — HISTOR's rules. */
+export function parseSets(entries, limit) {
+    if (!Array.isArray(entries) || !entries.length)
+        return { sets: [], ignored: ['"sets" must be a non-empty list'] };
+    const sets = [], ignored = [], seen = new Set();
+    for (let i = 0; i < entries.length; i++) {
+        if (sets.length === limit) {
+            ignored.push(`sets[${i}:]: more than ${limit} sets`);
+            break;
+        }
+        const e = entries[i];
+        if (!e || typeof e !== 'object' || Array.isArray(e)) {
+            ignored.push(`sets[${i}]: not an object`);
+            continue;
+        }
+        if (typeof e.digest !== 'string' || !SRI.test(e.digest)) {
+            ignored.push(`sets[${i}]: digest is not an MTL/1 tool-set digest (sha256-<base64>)`);
+            continue;
+        }
+        if (seen.has(e.digest)) {
+            ignored.push(`sets[${i}]: the same digest twice`);
+            continue;
+        }
+        if (e.count !== undefined && e.count !== null && (typeof e.count !== 'number' || !Number.isInteger(e.count) || e.count < 0 || e.count > MAX_TOOLS)) {
+            ignored.push(`sets[${i}]: count must be an integer from 0 to ${MAX_TOOLS}`);
+            continue;
+        }
+        seen.add(e.digest);
+        const out = { digest: e.digest };
+        if (typeof e.count === 'number')
+            out.count = e.count;
+        const when = cleanWhen(e.when);
+        if (when)
+            out.when = when;
+        sets.push(out);
+    }
+    return { sets, ignored };
+}
+/** A declaration file, read the way HISTOR reads it. Throws when HISTOR would take nothing from it. */
+export function parseDeclarationFile(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch {
+        throw new DeclareError('the file is not JSON');
+    }
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+        throw new DeclareError('the file is not a JSON object');
+    const d = doc;
+    if (d.mtl !== '1')
+        throw new DeclareError('"mtl" must be "1"');
+    if (Array.isArray(d.sets) && d.sets.length === 0)
+        return { sets: [], ignored: [] };
+    const parsed = parseSets(d.sets, MAX_FILE_SETS);
+    if (!parsed.sets.length)
+        throw new DeclareError(parsed.ignored.slice(0, 3).join('; ') || 'no valid sets');
+    return parsed;
+}
+/** `file` with `set` in it: a set with the same digest is replaced, the others are kept in order. */
+export function withSet(file, set, limit = MAX_FILE_SETS) {
+    const sets = (file?.sets ?? []).filter(s => s.digest !== set.digest);
+    const at = (file?.sets ?? []).findIndex(s => s.digest === set.digest);
+    if (at >= 0)
+        sets.splice(at, 0, set);
+    else
+        sets.push(set);
+    if (sets.length > limit)
+        throw new DeclareError(`the file would hold ${sets.length} sets; HISTOR reads at most ${limit}. Remove sets for runners nobody uses any more.`);
+    return { mtl: '1', sets };
+}
+/** The server.json `_meta` block for the registry entry. */
+export function serverJsonBlock(sets, url) {
+    if (sets.length > MAX_ENTRY_SETS)
+        throw new DeclareError(`a registry entry holds at most ${MAX_ENTRY_SETS} sets; put them in a file and link it with --link`);
+    const block = { mtl: '1' };
+    if (sets.length)
+        block.sets = sets;
+    if (url)
+        block.url = url;
+    return { _meta: { [PUBLISHER_PROVIDED]: { [DECLARATION_FIELD]: block } } };
+}
+/** The set this machine gets from a server, ready to declare. */
+export function setFrom(fetched, when) {
+    let digest;
+    try {
+        digest = mtlToolSetDigest(fetched.tools);
+    }
+    catch (err) {
+        throw new DeclareError(`the tool set has no MTL/1 digest (${err instanceof MtlError ? err.code : String(err)}), so it cannot be declared or compared`);
+    }
+    const set = { digest, count: fetched.tools.length };
+    const w = cleanWhen(when);
+    if (w)
+        set.when = w;
+    return set;
+}
+export const DECLARE_USAGE = `Usage:
+  warden-mcp declare [--when TEXT] [--out FILE] -- COMMAND [ARGS...]
+  warden-mcp declare [--when TEXT] [--out FILE] --url URL
+  warden-mcp declare --server-json [--link URL] [--when TEXT] [-- COMMAND ... | --url URL]
+  warden-mcp declare --check URL --name SERVER_NAME
+  warden-mcp declare --check FILE
+
+Starts the server the way a client would, digests its tools/list (MTL/1) and prints the set to
+declare, so HISTOR and WARDEN can tell it apart from a set nobody has seen.
+
+  --when TEXT        the condition this set needs, in your words (at most ${MAX_WHEN} characters),
+                     e.g. "runner 1.4, macOS"
+  --out FILE         add the set to this declaration file (created if missing; other sets kept,
+                     the same digest replaced). Publish it on your own domain and link it from
+                     server.json with "url" (--server-json --link prints that block)
+  --server-json      print the server.json _meta block instead (sets inline, at most ${MAX_ENTRY_SETS})
+  --link URL         with --server-json: point the entry at your declaration file
+  --check URL --name SERVER_NAME
+                     read a published declaration file the way HISTOR will: the domain must be the
+                     one the registry verified for SERVER_NAME, https, no redirects, at most 64 KiB
+  --check FILE       check a local declaration file's format
+  --timeout MS       how long to wait for the server (default 60000)
+
+Details: https://github.com/alexar76/histor/blob/main/docs/api.md#declaring-tool-sets-publishers`;
+export class DeclareUsage extends Error {
+}
+export function parseDeclareArgs(argv) {
+    const opts = { mode: 'set', timeoutMs: 60_000 };
+    const dash = argv.indexOf('--');
+    const own = dash >= 0 ? argv.slice(0, dash) : argv;
+    const command = dash >= 0 ? argv.slice(dash + 1) : [];
+    let url;
+    for (let i = 0; i < own.length; i++) {
+        const a = own[i];
+        const value = () => { const v = own[++i]; if (v === undefined || v.startsWith('--'))
+            throw new DeclareError(`${a} needs a value`); return v; };
+        switch (a) {
+            case '-h':
+            case '--help': throw new DeclareUsage();
+            case '--when':
+                opts.when = value();
+                break;
+            case '--out':
+                opts.out = value();
+                break;
+            case '--server-json':
+                opts.serverJson = true;
+                break;
+            case '--link':
+                opts.link = value();
+                break;
+            case '--url':
+                url = value();
+                break;
+            case '--check':
+                opts.mode = 'check';
+                opts.check = value();
+                break;
+            case '--name':
+                opts.name = value();
+                break;
+            case '--timeout': {
+                const n = Number(value());
+                if (!Number.isInteger(n) || n < 1000 || n > 600_000)
+                    throw new DeclareError('--timeout must be 1000..600000 ms');
+                opts.timeoutMs = n;
+                break;
+            }
+            default: throw new DeclareError(`unknown option ${a}`);
+        }
+    }
+    if (opts.mode === 'check') {
+        if (command.length || url || opts.out || opts.serverJson)
+            throw new DeclareError('--check reads a declaration file; it does not start a server');
+        if (/^https?:\/\//i.test(opts.check) && !opts.name)
+            throw new DeclareError('--check URL needs --name, the server name in the registry (e.g. ai.acme/launcher)');
+        return opts;
+    }
+    if (opts.out && opts.serverJson)
+        throw new DeclareError('--out writes a declaration file, --server-json prints the registry block: pick one');
+    if (opts.link && !opts.serverJson)
+        throw new DeclareError('--link goes with --server-json');
+    if (command.length && url)
+        throw new DeclareError('give a command after -- or --url, not both');
+    if (command.length)
+        opts.ref = { id: 'declare', name: command.join(' '), transport: 'stdio', command: command[0], args: command.slice(1) };
+    else if (url) {
+        if (!/^https?:\/\//i.test(url))
+            throw new DeclareError('--url must be an http(s) URL');
+        opts.ref = { id: 'declare', name: url, transport: 'http', url };
+    }
+    else if (!(opts.serverJson && opts.link))
+        throw new DeclareError('give the server: a command after --, or --url');
+    return opts;
+}
+async function httpGet(url, timeoutMs) {
+    const res = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(timeoutMs), headers: { accept: 'application/json', 'user-agent': `warden-mcp/${packageVersion()}` } });
+    if (!res.body)
+        return { status: res.status, body: '' };
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        size += value.length;
+        if (size > MAX_FILE_BYTES) {
+            await reader.cancel();
+            break;
+        }
+    }
+    return { status: res.status, body: Buffer.concat(chunks).toString('utf8') };
+}
+async function atomicWrite(path, text) {
+    const tmp = `${path}.${process.pid}.tmp`;
+    await writeFile(tmp, text);
+    await rename(tmp, path);
+}
+/** Runs one `declare`; returns the exit code (0 ok, 1 refused or failed). */
+export async function runDeclare(opts, deps = {}) {
+    const out = deps.out ?? (t => process.stdout.write(t + '\n'));
+    const err = deps.err ?? (t => process.stderr.write(t + '\n'));
+    const read = deps.readFile ?? (p => readFile(p, 'utf8'));
+    const write = deps.writeFile ?? atomicWrite;
+    if (opts.mode === 'check') {
+        const target = opts.check;
+        let text;
+        if (/^https?:\/\//i.test(target)) {
+            const refusal = urlRefusal(target, opts.name);
+            if (refusal) {
+                err(`HISTOR will not read this file: ${refusal}.`);
+                return 1;
+            }
+            let got;
+            try {
+                got = await (deps.get ?? httpGet)(target, opts.timeoutMs);
+            }
+            catch (e) {
+                err(`HISTOR could not read this file: the request failed (${displaySafe(e instanceof Error ? e.message : String(e), 200)}).`);
+                return 1;
+            }
+            if (got.status >= 300 && got.status < 400) {
+                err(`HISTOR will not read this file: http-${got.status}, and redirects are not followed. Serve it at this address.`);
+                return 1;
+            }
+            if (got.status !== 200) {
+                err(`HISTOR could not read this file: http-${got.status}.`);
+                return 1;
+            }
+            if (Buffer.byteLength(got.body) > MAX_FILE_BYTES) {
+                err(`HISTOR will not read this file: it is larger than ${MAX_FILE_BYTES / 1024} KiB.`);
+                return 1;
+            }
+            text = got.body;
+        }
+        else {
+            try {
+                text = await read(target);
+            }
+            catch (e) {
+                err(`cannot read ${displaySafe(target, 300)}: ${displaySafe(e instanceof Error ? e.message : String(e), 200)}`);
+                return 1;
+            }
+        }
+        let parsed;
+        try {
+            parsed = parseDeclarationFile(text);
+        }
+        catch (e) {
+            err(`HISTOR will not take this file: ${e instanceof Error ? e.message : String(e)}.`);
+            return 1;
+        }
+        for (const why of parsed.ignored)
+            err(`skipped: ${why}`);
+        out(parsed.sets.length
+            ? `OK: HISTOR will take ${parsed.sets.length} set${parsed.sets.length === 1 ? '' : 's'} from this file${parsed.ignored.length ? ` (${parsed.ignored.length} skipped, above)` : ''}.`
+            : 'OK: an empty "sets" list. HISTOR will withdraw every set this file declared before.');
+        for (const s of parsed.sets)
+            out(`  ${s.digest}${s.count !== undefined ? ` · ${s.count} tools` : ''}${s.when ? ` · "${s.when}"` : ''}`);
+        return 0;
+    }
+    let set;
+    if (opts.ref) {
+        let fetched;
+        try {
+            fetched = deps.fetch ? await deps.fetch(opts.ref, opts.timeoutMs)
+                : await fetchServer(opts.ref, { timeoutMs: opts.timeoutMs, clientVersion: packageVersion(), cwd: process.cwd() });
+        }
+        catch (e) {
+            const msg = e instanceof McpClientError ? e.message : e instanceof Error ? e.message : String(e);
+            err(`the server did not answer tools/list: ${displaySafe(msg, 400)}`);
+            return 1;
+        }
+        try {
+            set = setFrom(fetched, opts.when);
+        }
+        catch (e) {
+            err(e instanceof Error ? e.message : String(e));
+            return 1;
+        }
+        err(`${set.count} tool${set.count === 1 ? '' : 's'} · ${set.digest}${set.when ? ` · "${set.when}"` : ''}`);
+    }
+    if (opts.serverJson) {
+        if (opts.link) {
+            // The domain can only be checked against the server's registry name; say what the rule is.
+            err(`"url" must be on the domain the registry verified for your server's namespace (ai.acme/x → acme.ai) or a subdomain; check it with --check ${opts.link} --name <server name>.`);
+        }
+        try {
+            out(JSON.stringify(serverJsonBlock(set ? [set] : [], opts.link), null, 2));
+        }
+        catch (e) {
+            err(e instanceof Error ? e.message : String(e));
+            return 1;
+        }
+        return 0;
+    }
+    if (opts.out) {
+        let existing;
+        let text;
+        try {
+            text = await read(opts.out);
+        }
+        catch {
+            text = undefined;
+        }
+        if (text !== undefined) {
+            try {
+                existing = { mtl: '1', sets: parseDeclarationFile(text).sets };
+            }
+            catch (e) {
+                err(`${displaySafe(opts.out, 300)} is not a declaration file HISTOR would read (${e instanceof Error ? e.message : String(e)}); not overwriting it.`);
+                return 1;
+            }
+        }
+        let next;
+        try {
+            next = withSet(existing, set);
+        }
+        catch (e) {
+            err(e instanceof Error ? e.message : String(e));
+            return 1;
+        }
+        await write(opts.out, JSON.stringify(next, null, 2) + '\n');
+        const replaced = existing?.sets.some(s => s.digest === set.digest);
+        out(`${replaced ? 'Updated' : 'Added'} the set in ${opts.out} (${next.sets.length} set${next.sets.length === 1 ? '' : 's'}). Publish it on your domain; HISTOR reads it every hour.`);
+        return 0;
+    }
+    out(JSON.stringify(set, null, 2));
+    return 0;
+}
+/** `warden-mcp declare …` — returns the process exit code. */
+export async function runDeclareCli(argv) {
+    let opts;
+    try {
+        opts = parseDeclareArgs(argv);
+    }
+    catch (e) {
+        if (e instanceof DeclareUsage) {
+            process.stdout.write(DECLARE_USAGE + '\n');
+            return 0;
+        }
+        process.stderr.write(`warden-mcp declare: ${displaySafe(e instanceof Error ? e.message : String(e), 1000)}\nRun warden-mcp declare --help for options.\n`);
+        return 2;
+    }
+    return runDeclare(opts);
+}
+//# sourceMappingURL=declare.js.map

package/dist/declare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declare.js","sourceRoot":"","sources":["../src/declare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AACpE,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAC1C,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAKpD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;CAC7E;AAED,qHAAqH;AACrH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtI,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,UAAkB;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAC9F,oGAAoG;IACpG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACxD,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,sBAAsB,CAAC;IAAC,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,kCAAkC,CAAC;IAChF,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,uCAAuC,CAAC;IACvF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,IAAI,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,gEAAgE,CAAC;QACrG,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,IAAI,KAAK,GAAG,IAAI,YAAY,IAAI,CAAC,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACnK,OAAO,oBAAoB,IAAI,wBAAwB,IAAI,mEAAmE,CAAC;IACjI,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,2DAA2D,CAAC;IAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,oBAAoB,MAAM,yDAAyD,SAAS,EAAE,CAAC;AACxG,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAa;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,iCAAiC,CAAC,EAAE,CAAC;IAClH,MAAM,IAAI,GAAkB,EAAE,EAAE,OAAO,GAAa,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAmC,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5J,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACxF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC;YACnJ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;YAAC,SAAS;QACxF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,GAAG,GAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAAC,CAAC;IACzF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,OAAO,CAAC,IAAiC,EAAE,GAAgB,EAAE,KAAK,GAAG,aAAa;IAChG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;;QAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,IAAI,CAAC,MAAM,+BAA+B,KAAK,iDAAiD,CAAC,CAAC;IACzK,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAmB,EAAE,GAAY;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,YAAY,CAAC,kCAAkC,cAAc,mDAAmD,CAAC,CAAC;IAC9J,MAAM,KAAK,GAA4B,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACnC,IAAI,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,OAAO,CAAC,OAAsB,EAAE,IAAa;IAC3D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACjD,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,qCAAqC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAAC,CAAC;IACvK,MAAM,GAAG,GAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;4EAU+C,QAAQ;;;;;uFAKG,cAAc;;;;;;;;iGAQJ,CAAC;AAElG,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,GAAuB,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/I,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,CAAC;YAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YACnD,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YAC1C,KAAK,OAAO;gBAAE,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YACxC,KAAK,eAAe;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBAAC,MAAM;YACpD,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YAC1C,KAAK,OAAO;gBAAE,GAAG,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YACnC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;gBAAC,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YACjE,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM;YAC1C,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,CAAC,CAAC;gBACjH,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC5B,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;QACjJ,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,mFAAmF,CAAC,CAAC;QACjK,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,oFAAoF,CAAC,CAAC;IAC9I,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,gCAAgC,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SACvI,IAAI,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAClE,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACpH,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,SAAiB;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,cAAc,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtL,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACzC,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM;QAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB,EAAE,OAAoB,EAAE;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;IAE5C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAM,CAAC;QAC3B,IAAI,IAAY,CAAC;QACjB,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAK,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBAAC,GAAG,CAAC,mCAAmC,OAAO,GAAG,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAC9E,IAAI,GAAqC,CAAC;YAC1C,IAAI,CAAC;gBAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAClE,OAAO,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,wDAAwD,WAAW,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACtJ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,wCAAwC,GAAG,CAAC,MAAM,6DAA6D,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAC9K,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,yCAAyC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAClG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC;gBAAC,GAAG,CAAC,qDAAqD,cAAc,GAAG,IAAI,OAAO,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACvJ,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBAAC,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,eAAe,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;QAC7K,CAAC;QACD,IAAI,MAAkD,CAAC;QACvD,IAAI,CAAC;YAAC,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC5C,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,mCAAmC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC9G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO;YAAE,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;YACpB,CAAC,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,EAAE,GAAG;YACpL,CAAC,CAAC,qFAAqF,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxI,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjG,GAAG,CAAC,yCAAyC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC;YAAC,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,QAAQ,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,2FAA2F;YAC3F,GAAG,CAAC,6IAA6I,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACtL,CAAC;QACD,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACnF,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,QAAqC,CAAC;QAC1C,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC;QAAC,CAAC;QAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YACvE,OAAO,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAC;YAAC,CAAC;QAChL,CAAC;QACD,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC;QAAC,CAAC;QACvC,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAI,CAAC,MAAM,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,eAAe,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,2DAA2D,CAAC,CAAC;QACtL,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,WAAW,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC3J,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/flow-guard.d.ts

@@ -0,0 +1,133 @@
+export type FlowLabel = 'private' | 'untrusted' | 'outbound' | 'destructive';
+export type FlowMode = 'ask' | 'deny' | 'audit' | 'off';
+export interface FlowPolicy {
+    mode: FlowMode;
+    /** Tool-name globs → the labels an operator assigns; replaces the built-in guess for that tool. */
+    labels: Record<string, FlowLabel[]>;
+    /** Hosts whose content does not taint the session (docs you trust). `*.example.com` covers subdomains. */
+    trustedSources: string[];
+    /** Hosts an outbound call may reach in a tainted session without asking. Fingerprint checks still apply. */
+    allowedDestinations: string[];
+    /** Treat every local file the agent reads as outside text (strict). Default: only foreign paths. */
+    taintLocalFiles: boolean;
+    /** Tool-name globs → argument names whose values are destinations or targets (recipient, file id). */
+    destinationArgs: Record<string, string[]>;
+    /** Explicitly trusted, read-only contact lookup tools. Results must contain structured name/email records. */
+    contactTools?: string[];
+}
+export interface FlowSource {
+    tool: string;
+    src: string;
+    at: string;
+}
+export interface FlowState {
+    v: 1;
+    untrusted: FlowSource[];
+    private: Array<FlowSource & {
+        secret: boolean;
+    }>;
+    notified: boolean;
+    /** Fingerprint store reached its cap: later private reads are not fingerprinted. */
+    full: boolean;
+    /** What the user typed this session (normalized, capped): a destination named here is the user's choice. */
+    intent?: string[];
+    /** The same, lower-cased with spacing kept, for whole-word matches of short names and numbers. */
+    intentRaw?: string[];
+    /** Addresses resolved by explicitly trusted contact tools, bound to full display names. */
+    resolved?: Array<{
+        v: string;
+        names: string[];
+    }>;
+    resolvedVersion?: 2;
+}
+export interface Classified {
+    labels: Set<FlowLabel>;
+    /** Hosts named in the call (URLs, ssh/scp targets). */
+    hosts: string[];
+    /** For results: a short description of where the text came from. */
+    src: string;
+    /** Private read of a credential path. */
+    secret: boolean;
+    /** The call writes WARDEN's policy/state or Claude Code's hook/MCP settings. */
+    protectedTouch: boolean;
+    /** Shell code that is not a small literal read-only command. Destination exemptions never apply. */
+    opaqueShell?: boolean;
+}
+export interface FlowDecision {
+    permissionDecision: 'ask' | 'deny';
+    permissionDecisionReason: string;
+}
+/** Set by the integration, never by tool arguments. A proxy cannot display an approval dialog. */
+export type FlowPresentation = 'hook' | 'refuse' | 'audit';
+export declare const DEFAULT_POLICY: FlowPolicy;
+export declare function stateDir(env?: NodeJS.ProcessEnv): string;
+export declare function flowPaths(dir: string, sessionId: string): {
+    dir: string;
+    state: string;
+    fp: string;
+    secret: string;
+    pii: string;
+    log: string;
+};
+export declare function isSecretPath(path: string): boolean;
+/** Files that, if the agent could change them, would let it switch the guard off. */
+export declare function isProtectedPath(path: string, cwd: string, env?: NodeJS.ProcessEnv): boolean;
+/** User-level policy only (`<state dir>/flow-policy.json`): a project file is something the agent can edit. */
+export declare function loadPolicy(env?: NodeJS.ProcessEnv): FlowPolicy;
+export declare function hostMatches(host: string, patterns: readonly string[]): boolean;
+export declare function hostsIn(texts: readonly string[]): string[];
+export declare function classifyShell(command: string): {
+    labels: Set<FlowLabel>;
+    hosts: string[];
+    local: boolean;
+};
+export declare function classifyCall(toolName: string, input: Record<string, unknown>, cwd: string, policy: FlowPolicy, env?: NodeJS.ProcessEnv): Classified;
+export declare function destinations(toolName: string, input: Record<string, unknown>, policy: FlowPolicy, hosts: readonly string[]): string[];
+/**
+ * The operator named this tool's destination arguments and the call sets none of them: it acts on an
+ * existing relationship (change the amount of a standing order, not its payee), so no new party is reached.
+ * Unconfigured tools never qualify: without the operator's word, an absent argument proves nothing.
+ */
+export declare function keepsDestination(toolName: string, input: Record<string, unknown>, policy: FlowPolicy): boolean;
+/** Only structured records from explicitly configured contact tools may resolve a full display name.
+ * Arbitrary prose, YAML, capitalized words and local file reads cannot create authority. */
+export declare function resolvedContacts(value: unknown, depth?: number): Array<{
+    v: string;
+    names: string[];
+}>;
+export declare function namedByUser(dests: readonly string[], intent: readonly string[] | undefined, intentRaw?: readonly string[], resolved?: FlowState['resolved']): boolean;
+export declare function resultTaints(toolName: string, input: Record<string, unknown>, responseText: string, cwd: string, policy: FlowPolicy, classified: Classified): {
+    untrusted: boolean;
+    private: boolean;
+    src: string;
+};
+export declare function normalizeText(s: string): string;
+/** Windows of the private text at every STRIDE-th position: any leaked run of WINDOW+STRIDE-1 normalized chars hits one. */
+export declare function fingerprints(text: string): string[];
+/** The texts an outbound call could be carrying: raw, URL-decoded, and base64/hex runs decoded. */
+export declare function candidates(texts: readonly string[]): string[];
+export declare function piiTokens(text: string): string[];
+export declare function secretPattern(texts: readonly string[]): string | undefined;
+export interface LeakCheck {
+    secret?: string;
+    private?: boolean;
+    pii?: boolean;
+}
+/** `typed`: what the user typed this session. A value the user typed is theirs to send; it is skipped
+ * for ordinary private text, never for secrets. */
+export declare function checkLeak(paths: ReturnType<typeof flowPaths>, input: Record<string, unknown>, typed?: readonly string[]): LeakCheck;
+export declare function readFlowState(path: string): FlowState;
+export declare function updateFlowState(path: string, change: (s: FlowState) => void): FlowState;
+export declare function flowPre(input: Record<string, unknown>, env?: NodeJS.ProcessEnv, presentation?: FlowPresentation): FlowDecision | undefined;
+export interface FlowPostOutput {
+    systemMessage?: string;
+    additionalContext?: string;
+}
+export declare function flowPost(input: Record<string, unknown>, env?: NodeJS.ProcessEnv): FlowPostOutput | undefined;
+/** UserPromptSubmit: remember what the user asked for, so destinations they named are theirs. */
+export declare function flowPrompt(input: Record<string, unknown>, env?: NodeJS.ProcessEnv): void;
+/** Hook runner shared by the CLI and the plugin script: `pre` or `post`, hook JSON on stdin, decision JSON on stdout. */
+export declare function runFlowHook(event: string, stdin: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function flowGuardMain(argv?: string[]): void;
+export declare function flowStateExists(sessionId: string, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=flow-guard.d.ts.map

package/dist/flow-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard.d.ts","sourceRoot":"","sources":["../src/flow-guard.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,mGAAmG;IACnG,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,0GAA0G;IAC1G,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,4GAA4G;IAC5G,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oGAAoG;IACpG,eAAe,EAAE,OAAO,CAAC;IACzB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,8GAA8G;IAC9G,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,SAAS;IACxB,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,OAAO,EAAE,KAAK,CAAC,UAAU,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,IAAI,EAAE,OAAO,CAAC;IACd,4GAA4G;IAC5G,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,gFAAgF;IAChF,cAAc,EAAE,OAAO,CAAC;IACxB,oGAAoG;IACpG,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAAG,kBAAkB,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAA;CAAE;AACtG,kGAAkG;AAClG,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAY3D,eAAO,MAAM,cAAc,EAAE,UAAkI,CAAC;AAKhK,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErE;AAMD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;EAIvD;AA+BD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAID,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAaxG;AAOD,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAwB3E;AAOD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E;AAaD,wBAAgB,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAM1D;AAiCD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CA0B1G;AAmCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAuDhK;AAUD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAmBrI;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAO9G;AASD;4FAC4F;AAC5F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,KAAK,CAAC;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiBjG;AAwBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAoBrK;AAKD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAkBnN;AAID,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAMD,4HAA4H;AAC5H,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CASnD;AAED,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAe7D;AAMD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBhD;AAoBD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAG1E;AAMD,MAAM,WAAW,SAAS;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE;AAChF;mDACmD;AACnD,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,CAiBvI;AAMD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CASrD;AA0BD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,GAAG,SAAS,CASvF;AA2ED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,YAAY,GAAE,gBAAyB,GAAG,YAAY,GAAG,SAAS,CAoE/J;AAED,MAAM,WAAW,cAAc;IAAG,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE;AAEtF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,GAAG,SAAS,CAoDzH;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAiBrG;AAED,yHAAyH;AACzH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAelH;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,IAAI,CAY1E;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEhG"}