@axtary/actionpass 0.1.0 → 0.3.0

package/dist/dev-key.js

@@ -0,0 +1,104 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// Dev keypair helper (PRD §8.2 developer experience; mega-plan M8.2)
+//
+// The SDK facade signs ActionPasses with an issuer key. In production a
+// developer supplies their own key (or a hosted issuer); for local development
+// we want zero manual JWK plumbing while still producing passes that verify
+// across process restarts (an ephemeral per-process key cannot).
+//
+// `devKeypair()` resolves a stable ES256 keypair with no key code:
+//   1. caller-supplied env     — optional AXTARY_DEV_SIGNING_KEY for CI/containers
+//   2. a local keyring file    — default .axtary/sdk-dev-keyring.json (0600, gitignored)
+// Both survive restarts. Spread the result directly into createAxtary():
+//   const sdk = createAxtary(await devKeypair());
+//
+// This adds no new authorization or token/ledger/policy shape; it only produces
+// the same { signingKey, verificationKey } the facade already accepts, reusing
+// the existing persistent issuer-keyring primitive (status-list.ts).
+// ─────────────────────────────────────────────────────────────────────────────
+import { createPrivateKey, createPublicKey } from "node:crypto";
+import { join } from "node:path";
+import { exportJWK } from "jose";
+import { issuerSigningKey, loadOrCreateIssuerKeyring } from "./status-list.js";
+/** Env var holding an ES256 private key (PEM, or base64-encoded PEM). */
+export const AXTARY_DEV_SIGNING_KEY_ENV = "AXTARY_DEV_SIGNING_KEY";
+/** Optional env var overriding the dev key id (`kid`). */
+export const AXTARY_DEV_KEY_ID_ENV = "AXTARY_DEV_KEY_ID";
+/** Env var pointing the local keyring at a directory other than ./.axtary. */
+export const AXTARY_HOME_ENV = "AXTARY_HOME";
+/** Filename of the file-backed dev keyring inside the resolved home dir. */
+export const AXTARY_DEV_KEYRING_FILENAME = "sdk-dev-keyring.json";
+/** Default `kid` for an env-backed dev key when none is supplied. */
+export const AXTARY_DEFAULT_DEV_KEY_ID = "axtary-dev";
+/**
+ * Resolve the file-backed dev keyring path: an explicit override, else
+ * `$AXTARY_HOME/sdk-dev-keyring.json`, else project-local
+ * `.axtary/sdk-dev-keyring.json`.
+ */
+export function resolveDevKeyringPath(options = {}) {
+    if (options.path) {
+        return options.path;
+    }
+    const env = options.env ?? {};
+    const home = env[AXTARY_HOME_ENV];
+    if (home && home.trim().length > 0) {
+        return join(home, AXTARY_DEV_KEYRING_FILENAME);
+    }
+    return join(".axtary", AXTARY_DEV_KEYRING_FILENAME);
+}
+function pemFromEnvValue(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.includes("-----BEGIN")) {
+        return trimmed;
+    }
+    // Single-line base64 / base64url-encoded PEM (env-var friendly).
+    return Buffer.from(trimmed, "base64").toString("utf8");
+}
+async function envBackedKey(env) {
+    const raw = env[AXTARY_DEV_SIGNING_KEY_ENV];
+    if (!raw || raw.trim().length === 0) {
+        return null;
+    }
+    const signingKey = createPrivateKey(pemFromEnvValue(raw));
+    const verificationKey = await exportJWK(createPublicKey(signingKey));
+    verificationKey.alg = "ES256";
+    const keyId = env[AXTARY_DEV_KEY_ID_ENV];
+    return {
+        signingKey,
+        verificationKey,
+        signingKeyId: keyId && keyId.trim().length > 0 ? keyId : AXTARY_DEFAULT_DEV_KEY_ID,
+        algorithm: "ES256",
+        source: "env",
+    };
+}
+/**
+ * Resolve a stable, persistent ES256 dev keypair with zero manual JWK code.
+ * Resolution order: caller-supplied AXTARY_DEV_SIGNING_KEY (env-backed, shared
+ * across processes) → a local keyring file (default
+ * `.axtary/sdk-dev-keyring.json`, `0600`, gitignored). Both verify across
+ * process restarts. Pass the result straight to the SDK:
+ * `createAxtary(await devKeypair())`.
+ *
+ * This is a development convenience. For production use a real issuer key or a
+ * hosted issuer; the file-backed key never leaves the machine and the env-backed
+ * key is whatever the operator provisions.
+ */
+export async function devKeypair(options = {}) {
+    const env = options.env ?? {};
+    const fromEnv = await envBackedKey(env);
+    if (fromEnv) {
+        return fromEnv;
+    }
+    const path = resolveDevKeyringPath(options);
+    const keyring = await loadOrCreateIssuerKeyring(path);
+    const signer = issuerSigningKey(keyring);
+    return {
+        signingKey: signer.privateKey,
+        verificationKey: { ...signer.publicJwk, alg: "ES256" },
+        signingKeyId: signer.kid,
+        algorithm: "ES256",
+        source: "file",
+        path,
+    };
+}
+//# sourceMappingURL=dev-key.js.map

package/dist/dev-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-key.js","sourceRoot":"","sources":["../src/dev-key.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,mFAAmF;AACnF,yFAAyF;AACzF,yEAAyE;AACzE,kDAAkD;AAClD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,qEAAqE;AACrE,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAA4B,MAAM,MAAM,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAClE,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AA4BtD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA6B,EAAE;IACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IAClC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,iEAAiE;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAuC;IAEvC,MAAM,GAAG,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,eAAe,CAAC,GAAG,GAAG,OAAO,CAAC;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzC,OAAO;QACL,UAAU;QACV,eAAe;QACf,YAAY,EACV,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAyB;QACtE,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE;QACtD,YAAY,EAAE,MAAM,CAAC,GAAG;QACxB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/explain.d.ts

@@ -0,0 +1,12 @@
+import type { PolicyDecision } from "./index.js";
+export type PolicyDecisionExplanation = {
+    label: string;
+    summary: string;
+    reviewerAction: "none" | "block" | "approval_required";
+    reasonDetails: Array<{
+        reason: string;
+        detail: string;
+    }>;
+};
+export declare function explainDecision(decisionInput: PolicyDecision): PolicyDecisionExplanation;
+//# sourceMappingURL=explain.d.ts.map

package/dist/explain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.d.ts","sourceRoot":"","sources":["../src/explain.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,mBAAmB,CAAC;IACvD,aAAa,EAAE,KAAK,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ,CAAC;AAEF,wBAAgB,eAAe,CAC7B,aAAa,EAAE,cAAc,GAC5B,yBAAyB,CAqB3B"}

package/dist/explain.js

@@ -0,0 +1,156 @@
+// Deterministic, human-readable explanation of a policy decision.
+//
+// This is the canonical reason→prose map for Axtary. It lives in the base
+// `@axtary/actionpass` package so both the SDK facade (`axtary.explain`) and the
+// policy/CLI surfaces share one source of truth instead of duplicating prose.
+// `@axtary/policy` re-exports `explainPolicyDecision` from here for backward
+// compatibility. It is intentionally deterministic — no model call — so the same
+// decision always produces the same explanation.
+export function explainDecision(decisionInput) {
+    const reviewerAction = decisionInput.decision === "allow"
+        ? "none"
+        : decisionInput.decision === "step_up"
+            ? "approval_required"
+            : "block";
+    const label = decisionInput.decision === "allow"
+        ? "Allowed"
+        : decisionInput.decision === "step_up"
+            ? "Step-up required"
+            : "Denied";
+    return {
+        label,
+        reviewerAction,
+        summary: decisionSummary(decisionInput),
+        reasonDetails: decisionInput.reasons.map((reason) => ({
+            reason,
+            detail: reasonDetail(reason),
+        })),
+    };
+}
+function decisionSummary(decisionInput) {
+    if (decisionInput.decision === "allow") {
+        return "The normalized action is inside the active policy and can proceed through ActionPass issuance.";
+    }
+    if (decisionInput.decision === "step_up") {
+        return "The normalized action is in scope only after exact payload-bound reviewer approval.";
+    }
+    return "The normalized action is outside the active policy and must not execute.";
+}
+function reasonDetail(reason) {
+    if (reason === "github_pr_inside_policy") {
+        return "Base branch, changed paths, file count, and test evidence satisfy the GitHub PR rule.";
+    }
+    if (reason === "github_content_write_inside_policy") {
+        return "The write path and branch are inside the configured repository guardrails.";
+    }
+    if (reason === "github_review_protected_path_step_up") {
+        return "The inline review targets a protected path and requires exact payload-bound approval.";
+    }
+    if (reason === "github_review_comment_inside_policy") {
+        return "The inline review target and exact comment body satisfy the repository guardrails.";
+    }
+    if (reason === "github_check_run_inside_policy") {
+        return "The check name, commit SHA, state, conclusion, and output are structurally valid and payload-bound.";
+    }
+    if (reason === "github_issue_comment_inside_policy") {
+        return "The issue number and exact outbound comment body are structurally valid and payload-bound.";
+    }
+    if (reason === "postgres_select_inside_policy") {
+        return "The parameterized SELECT, database, tables, functions, predicate, and row cap are inside the configured read scope.";
+    }
+    if (reason === "postgres_unpredicated_scan_step_up") {
+        return "The SELECT has no row predicate and requires exact payload-bound approval before the adapter can connect.";
+    }
+    if (reason === "postgres_select_only") {
+        return "Only one parsed SELECT statement is executable through the Postgres connector.";
+    }
+    if (reason === "postgres_table_not_allowed") {
+        return "At least one referenced table is outside the configured Postgres allowlist.";
+    }
+    if (reason === "github_branch_inside_policy") {
+        return "The branch creation request is tied to the configured base branch.";
+    }
+    if (reason === "content_read_denied_path") {
+        return "The requested file path matches a protected content-read prefix.";
+    }
+    if (reason === "payload_touches_denied_path") {
+        return "The payload touches a path prefix that policy blocks outright.";
+    }
+    if (reason === "payload_touches_step_up_path") {
+        return "The payload touches a protected path prefix that requires exact review.";
+    }
+    if (reason === "payload_touches_protected_path") {
+        return "The payload touches a protected path prefix and requires exact review.";
+    }
+    if (reason === "file_count_exceeds_policy_limit") {
+        return "The PR changes more files than the active policy allows without review.";
+    }
+    if (reason === "tests_required_before_pr") {
+        return "The PR payload does not include passing test evidence required by policy.";
+    }
+    if (reason === "payload_declares_production_impact") {
+        return "The action declares production impact, so reviewer approval is required.";
+    }
+    if (reason === "slack_channel_not_allowed") {
+        return "The Slack channel is not in the configured allowlist.";
+    }
+    if (reason === "slack_external_recipient_step_up") {
+        return "The message reaches external recipients and must be reviewed exactly.";
+    }
+    if (reason === "provenance_unknown_egress") {
+        return "A covered outbound field has no authority-stamped source lineage, so policy fails closed.";
+    }
+    if (reason === "provenance_untrusted_egress") {
+        return "A covered outbound field derives from untrusted document or tool output and requires exact review.";
+    }
+    if (reason === "linear_status_requires_step_up") {
+        return "The Linear status transition targets a configured protected status.";
+    }
+    if (reason === "jira_status_requires_step_up") {
+        return "The Jira status transition targets a configured protected status.";
+    }
+    if (reason.endsWith("_project_not_allowed")) {
+        return "The issue project key is outside the configured tracker allowlist.";
+    }
+    if (reason === "docs_search_inside_policy") {
+        return "The document search request stays inside the configured workspace and result limit.";
+    }
+    if (reason === "docs_read_inside_policy") {
+        return "The document path and requested byte limit are inside the configured documentation scope.";
+    }
+    if (reason === "docs_workspace_not_allowed") {
+        return "The document workspace is outside the configured allowlist.";
+    }
+    if (reason === "docs_path_denied") {
+        return "The requested document path matches a protected documentation prefix.";
+    }
+    if (reason === "docs_path_not_allowed") {
+        return "The requested document path is outside the configured documentation prefixes.";
+    }
+    if (reason === "docs_result_limit_exceeds_policy") {
+        return "The search request asks for more document results than policy allows.";
+    }
+    if (reason === "docs_read_bytes_exceeds_policy") {
+        return "The read request asks for more document bytes than policy allows.";
+    }
+    if (reason === "payload_is_inside_current_actionpass_constraints") {
+        return "The payload is inside the constraints carried by the current ActionPass.";
+    }
+    if (reason.startsWith("unsupported_tool:")) {
+        return "The tool is not supported by the native policy evaluator and fails closed.";
+    }
+    if (reason.startsWith("base_branch_mismatch:")) {
+        return "The requested base branch differs from the configured branch and needs review.";
+    }
+    if (reason === "approval_payload_hash_mismatch") {
+        return "The payload differs from the exact payload the human approval was granted on, so execution is denied.";
+    }
+    if (reason === "approval_action_hash_mismatch") {
+        return "The action differs from the exact action the human approval was granted on, so execution is denied.";
+    }
+    if (reason.startsWith("approved_payload_hash:")) {
+        return "The payload hash the human approval was actually bound to, kept as evidence beside the mismatch.";
+    }
+    return "The active native policy emitted this reason for the normalized action.";
+}
+//# sourceMappingURL=explain.js.map

package/dist/explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.js","sourceRoot":"","sources":["../src/explain.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AACjF,iDAAiD;AAcjD,MAAM,UAAU,eAAe,CAC7B,aAA6B;IAE7B,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,KAAK,OAAO;QACvD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,OAAO,CAAC;IACd,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,KAAK,OAAO;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS;YACpC,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,QAAQ,CAAC;IAEf,OAAO;QACL,KAAK;QACL,cAAc;QACd,OAAO,EAAE,eAAe,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM;YACN,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,aAA6B;IACpD,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,gGAAgG,CAAC;IAC1G,CAAC;IAED,IAAI,aAAa,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IAED,OAAO,0EAA0E,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,OAAO,uFAAuF,CAAC;IACjG,CAAC;IAED,IAAI,MAAM,KAAK,oCAAoC,EAAE,CAAC;QACpD,OAAO,4EAA4E,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,KAAK,sCAAsC,EAAE,CAAC;QACtD,OAAO,uFAAuF,CAAC;IACjG,CAAC;IAED,IAAI,MAAM,KAAK,qCAAqC,EAAE,CAAC;QACrD,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IAED,IAAI,MAAM,KAAK,gCAAgC,EAAE,CAAC;QAChD,OAAO,qGAAqG,CAAC;IAC/G,CAAC;IAED,IAAI,MAAM,KAAK,oCAAoC,EAAE,CAAC;QACpD,OAAO,4FAA4F,CAAC;IACtG,CAAC;IAED,IAAI,MAAM,KAAK,+BAA+B,EAAE,CAAC;QAC/C,OAAO,qHAAqH,CAAC;IAC/H,CAAC;IAED,IAAI,MAAM,KAAK,oCAAoC,EAAE,CAAC;QACpD,OAAO,2GAA2G,CAAC;IACrH,CAAC;IAED,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;QACtC,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IAED,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,OAAO,6EAA6E,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,KAAK,6BAA6B,EAAE,CAAC;QAC7C,OAAO,oEAAoE,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC1C,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IAED,IAAI,MAAM,KAAK,6BAA6B,EAAE,CAAC;QAC7C,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,KAAK,8BAA8B,EAAE,CAAC;QAC9C,OAAO,yEAAyE,CAAC;IACnF,CAAC;IAED,IAAI,MAAM,KAAK,gCAAgC,EAAE,CAAC;QAChD,OAAO,wEAAwE,CAAC;IAClF,CAAC;IAED,IAAI,MAAM,KAAK,iCAAiC,EAAE,CAAC;QACjD,OAAO,yEAAyE,CAAC;IACnF,CAAC;IAED,IAAI,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC1C,OAAO,2EAA2E,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,KAAK,oCAAoC,EAAE,CAAC;QACpD,OAAO,0EAA0E,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,OAAO,uDAAuD,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;QAClD,OAAO,uEAAuE,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,OAAO,2FAA2F,CAAC;IACrG,CAAC;IAED,IAAI,MAAM,KAAK,6BAA6B,EAAE,CAAC;QAC7C,OAAO,oGAAoG,CAAC;IAC9G,CAAC;IAED,IAAI,MAAM,KAAK,gCAAgC,EAAE,CAAC;QAChD,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,KAAK,8BAA8B,EAAE,CAAC;QAC9C,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,oEAAoE,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IAED,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,OAAO,2FAA2F,CAAC;IACrG,CAAC;IAED,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,OAAO,6DAA6D,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClC,OAAO,uEAAuE,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,OAAO,+EAA+E,CAAC;IACzF,CAAC;IAED,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;QAClD,OAAO,uEAAuE,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,KAAK,gCAAgC,EAAE,CAAC;QAChD,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,kDAAkD,EAAE,CAAC;QAClE,OAAO,0EAA0E,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,4EAA4E,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IAED,IAAI,MAAM,KAAK,gCAAgC,EAAE,CAAC;QAChD,OAAO,uGAAuG,CAAC;IACjH,CAAC;IAED,IAAI,MAAM,KAAK,+BAA+B,EAAE,CAAC;QAC/C,OAAO,qGAAqG,CAAC;IAC/G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAChD,OAAO,kGAAkG,CAAC;IAC5G,CAAC;IAED,OAAO,yEAAyE,CAAC;AACnF,CAAC"}