@axtary/policy 0.1.0 → 0.3.0

package/README.md

@@ -12,9 +12,23 @@ npm install @axtary/policy
 
 - Evaluates normalized Axtary actions against a local policy config.
 - Returns `allow`, `deny`, or `step_up` decisions.
-- Ships first guardrails for GitHub PRs, GitHub content reads/writes, Slack posts, and Linear/Jira issue actions.
+- Supports named multi-rule policies with wildcard tool/resource/actor matchers,
+  deny-overrides precedence, and default-deny.
+- Attaches enforceable obligations: narrowed TTL, approver roles, blocked paths,
+  UTC time windows, and per-process rate windows.
+- Ships guardrails for GitHub PRs/reviews/checks and content reads/writes,
+  Slack posts (channel allowlists + external-recipient step-up), Linear/Jira
+  issue actions, Postgres scoped SELECT analysis (write statements denied
+  before execution), Google Drive file reads, and MCP tool calls pinned by
+  definition hash (same-name definition drift denies).
 - Maps the same normalized action into Cedar-style principal/action/resource/context.
-- Exposes OPA/Rego-compatible input JSON.
+- Exposes OPA/Rego-compatible input JSON, with an executable `--parity` harness
+  that fails on any cross-engine disagreement.
+- Exposes a thin Agent Control-style `pre_tool_call` / `post_tool_call` shim
+  that maps tool-call snapshots into normalized Axtary actions and fails closed
+  on malformed envelopes.
+- Emits an offline AgentCore Cedar-shaped Gateway authorization request mapping
+  for parity fixtures. This is an export shape, not a live AWS deployment.
 
 ## Quickstart
 
@@ -32,8 +46,76 @@ console.log(decision.decision, decision.reasons);
 console.log(explainPolicyDecision(decision).summary);
 ```
 
+## Multi-rule policies
+
+`axtary.yml` may define a top-level `policies:` block. When `rules` is empty,
+the existing provider guardrail preset remains active for compatibility.
+When one or more rules are present, only the explicit rules apply and unmatched
+actions deny.
+
+```yaml
+policies:
+  defaultDecision: deny
+  rules:
+    - id: review-repo-writes
+      match:
+        tools: github.contents.write
+        resources: repo:company/*
+        actors:
+          runtimes: [codex-*, claude-*]
+      effect: step_up
+      reason: repository_write_requires_review
+      obligations:
+        expiresInSeconds: 60
+        requiredApproverRoles: [security-reviewer]
+        blockedPathPrefixes: [.env, secrets/]
+```
+
+All matching rules are evaluated. `deny` outranks `step_up`, which outranks
+`allow`; obligations are merged toward the narrower result. Use
+`simulatePolicy` for the complete match/mismatch trace.
+
 ## Design Notes
 
 The normalized action schema from `@axtary/actionpass` remains the source of truth. Policy evaluation is deterministic and fail-closed for unknown protected tools.
 
+## Deterministic provenance guard
+
+Set `policy.provenance.enabled: true` to require authority-stamped lineage for
+covered outbound/content fields. Missing or unknown lineage denies with
+`provenance_unknown_egress`. Untrusted document/tool-output lineage steps up
+with `provenance_untrusted_egress` by default, or can be configured to deny.
+The guard runs after the underlying native, Cedar, or Rego decision and can
+only preserve or restrict it—never turn a deny into an allow.
+
+Coverage is intentionally explicit (`PROVENANCE_COVERAGE`) rather than generic
+DLP or semantic prompt-injection detection.
+
 This package stays format-agnostic. `@axtary/config` loads YAML and passes the parsed policy object into this evaluator so the same deterministic decision path can be used by tests, the local proxy, and future MCP wrappers.
+
+## Standards adapters
+
+The ACS shim lives at `@axtary/policy/acs`:
+
+```ts
+import {
+  createAxtaryAcsManifest,
+  evaluateAcsIntervention,
+} from "@axtary/policy/acs";
+
+const manifest = createAxtaryAcsManifest();
+const result = evaluateAcsIntervention({
+  manifest,
+  interventionPoint: "pre_tool_call",
+  snapshot,
+});
+```
+
+`allow` maps to `allow`, `step_up` maps to `escalate`, and `deny` maps to
+`deny`. Invalid manifests or malformed snapshots return deny-style
+`runtime_error:*` reasons.
+
+AgentCore/Cedar export helpers live at `@axtary/policy/parity` and are also
+included in `axtary test-policy --parity --json`. They emit Cedar-shaped
+Gateway requests with Axtary action and payload hashes, but do not claim live
+AWS AgentCore enforcement.

package/dist/acs.d.ts

@@ -0,0 +1,103 @@
+import { type JsonValue, type NormalizedAction, type PolicyDecision } from "@axtary/actionpass";
+import { z } from "zod";
+import { type PolicyConfigPatch } from "./index.js";
+export declare const AXTARY_ACS_MANIFEST_VERSION = "axtary.acs_manifest.v0";
+export declare const AXTARY_ACS_SNAPSHOT_VERSION = "axtary.acs_snapshot.v0";
+export type AcsInterventionPoint = "pre_tool_call" | "post_tool_call";
+export type AcsVerdict = "allow" | "warn" | "deny" | "escalate" | "transform";
+export declare const AcsPolicySchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        custom: "custom";
+        cedar: "cedar";
+        rego: "rego";
+        test: "test";
+    }>;
+    adapter: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const AcsInterventionConfigSchema: z.ZodObject<{
+    policy: z.ZodString;
+    policy_target: z.ZodString;
+    policy_target_kind: z.ZodOptional<z.ZodString>;
+    tool_name_from: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const AcsManifestSchema: z.ZodObject<{
+    agent_control_specification_version: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
+    policies: z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodEnum<{
+            custom: "custom";
+            cedar: "cedar";
+            rego: "rego";
+            test: "test";
+        }>;
+        adapter: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    intervention_points: z.ZodRecord<z.ZodString, z.ZodObject<{
+        policy: z.ZodString;
+        policy_target: z.ZodString;
+        policy_target_kind: z.ZodOptional<z.ZodString>;
+        tool_name_from: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>>;
+    annotators: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>>;
+    approval: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
+}, z.core.$strict>;
+export type AcsManifest = z.infer<typeof AcsManifestSchema>;
+export declare const AcsToolCallSnapshotSchema: z.ZodObject<{
+    schemaVersion: z.ZodOptional<z.ZodLiteral<"axtary.acs_snapshot.v0">>;
+    actor: z.ZodObject<{
+        agentId: z.ZodString;
+        humanOwner: z.ZodString;
+        runtime: z.ZodString;
+        tenant: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    intent: z.ZodObject<{
+        taskId: z.ZodString;
+        declaredGoal: z.ZodString;
+    }, z.core.$strip>;
+    tool_call: z.ZodObject<{
+        tool: z.ZodString;
+        resource: z.ZodString;
+        arguments: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
+        toolDefinition: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
+    }, z.core.$strip>;
+    tool_result: z.ZodOptional<z.ZodObject<{
+        status: z.ZodEnum<{
+            error: "error";
+            ok: "ok";
+        }>;
+        outputHash: z.ZodOptional<z.ZodString>;
+        errorReason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type AcsToolCallSnapshot = z.infer<typeof AcsToolCallSnapshotSchema>;
+export type AcsEvaluationResult = {
+    schemaVersion: "axtary.acs_evaluation.v0";
+    interventionPoint: AcsInterventionPoint;
+    verdict: AcsVerdict;
+    reason: string;
+    reasons: string[];
+    policyTargetKind: string;
+    normalizedAction?: NormalizedAction;
+    policyDecision?: PolicyDecision;
+    evidence: {
+        adapter: "axtary.policy";
+        actionHash?: string;
+        payloadHash?: string;
+        resultHash?: string;
+    };
+};
+export declare function createAxtaryAcsManifest(input?: {
+    version?: string;
+    name?: string;
+}): AcsManifest;
+export declare function actionFromAcsToolCallSnapshot(snapshotInput: unknown): NormalizedAction;
+export declare function evaluateAcsIntervention(input: {
+    manifest: unknown;
+    interventionPoint: AcsInterventionPoint;
+    snapshot: unknown;
+    config?: PolicyConfigPatch;
+}): AcsEvaluationResult;
+//# sourceMappingURL=acs.d.ts.map

package/dist/acs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../src/acs.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,gBAAgB,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;AAa9E,eAAO,MAAM,eAAe;;;;;;;;;kBAMjB,CAAC;AAEZ,eAAO,MAAM,2BAA2B;;;;;kBAO7B,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;kBA0C1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2B3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,0BAA0B,CAAC;IAC1C,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,EAAE;QACR,OAAO,EAAE,eAAe,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,KAAK,GAAE;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACV,GAAG,WAAW,CA8BnB;AAED,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,OAAO,GACrB,gBAAgB,CAelB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,OAAO,CAAC;IAClB,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,GAAG,mBAAmB,CA+CtB"}

package/dist/acs.js

@@ -0,0 +1,207 @@
+import { hashAction, hashPayload, NormalizedActionSchema, } from "@axtary/actionpass";
+import { z } from "zod";
+import { evaluatePolicy, } from "./index.js";
+export const AXTARY_ACS_MANIFEST_VERSION = "axtary.acs_manifest.v0";
+export const AXTARY_ACS_SNAPSHOT_VERSION = "axtary.acs_snapshot.v0";
+const JsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema),
+]));
+export const AcsPolicySchema = z
+    .object({
+    type: z.enum(["custom", "cedar", "rego", "test"]),
+    adapter: z.string().min(1).optional(),
+    source: z.string().min(1).optional(),
+})
+    .strict();
+export const AcsInterventionConfigSchema = z
+    .object({
+    policy: z.string().min(1),
+    policy_target: z.string().min(1),
+    policy_target_kind: z.string().min(1).optional(),
+    tool_name_from: z.string().min(1).optional(),
+})
+    .strict();
+export const AcsManifestSchema = z
+    .object({
+    agent_control_specification_version: z.string().min(1),
+    metadata: z.record(z.string(), JsonValueSchema).optional(),
+    policies: z.record(z.string(), AcsPolicySchema),
+    intervention_points: z.record(z.string(), AcsInterventionConfigSchema),
+    tools: z.record(z.string(), z.record(z.string(), JsonValueSchema)).optional(),
+    annotators: z.record(z.string(), z.record(z.string(), JsonValueSchema)).optional(),
+    approval: z.record(z.string(), JsonValueSchema).optional(),
+})
+    .strict()
+    .superRefine((manifest, ctx) => {
+    if (Object.keys(manifest.policies).length === 0) {
+        ctx.addIssue({
+            code: "custom",
+            message: "policies_required",
+            path: ["policies"],
+        });
+    }
+    if (Object.keys(manifest.intervention_points).length === 0) {
+        ctx.addIssue({
+            code: "custom",
+            message: "intervention_points_required",
+            path: ["intervention_points"],
+        });
+    }
+    for (const [name, config] of Object.entries(manifest.intervention_points)) {
+        if (!["pre_tool_call", "post_tool_call"].includes(name)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `unsupported_intervention_point:${name}`,
+                path: ["intervention_points", name],
+            });
+        }
+        if (!manifest.policies[config.policy]) {
+            ctx.addIssue({
+                code: "custom",
+                message: `undefined_policy:${config.policy}`,
+                path: ["intervention_points", name, "policy"],
+            });
+        }
+    }
+});
+export const AcsToolCallSnapshotSchema = z
+    .object({
+    schemaVersion: z.literal(AXTARY_ACS_SNAPSHOT_VERSION).optional(),
+    actor: z.object({
+        agentId: z.string().min(1),
+        humanOwner: z.string().min(1),
+        runtime: z.string().min(1),
+        tenant: z.string().min(1).optional(),
+    }),
+    intent: z.object({
+        taskId: z.string().min(1),
+        declaredGoal: z.string().min(1),
+    }),
+    tool_call: z.object({
+        tool: z.string().min(1),
+        resource: z.string().min(1),
+        arguments: z.record(z.string(), JsonValueSchema).default({}),
+        toolDefinition: z.record(z.string(), JsonValueSchema).optional(),
+    }),
+    tool_result: z
+        .object({
+        status: z.enum(["ok", "error"]),
+        outputHash: z.string().min(1).optional(),
+        errorReason: z.string().min(1).optional(),
+    })
+        .optional(),
+})
+    .strict();
+export function createAxtaryAcsManifest(input = {}) {
+    return AcsManifestSchema.parse({
+        agent_control_specification_version: input.version ?? "0.3.1-beta",
+        metadata: {
+            schemaVersion: AXTARY_ACS_MANIFEST_VERSION,
+            name: input.name ?? "Axtary ActionPass enforcement",
+            note: "Thin ACS shim: pre_tool_call maps into Axtary normalized actions; the host/proxy enforces the returned verdict.",
+        },
+        policies: {
+            axtary_actionpass: {
+                type: "custom",
+                adapter: "axtary.policy",
+            },
+        },
+        intervention_points: {
+            pre_tool_call: {
+                policy: "axtary_actionpass",
+                policy_target: "$.tool_call",
+                policy_target_kind: "axtary.normalized_action",
+                tool_name_from: "$.tool_call.tool",
+            },
+            post_tool_call: {
+                policy: "axtary_actionpass",
+                policy_target: "$.tool_result",
+                policy_target_kind: "axtary.tool_result",
+                tool_name_from: "$.tool_call.tool",
+            },
+        },
+    });
+}
+export function actionFromAcsToolCallSnapshot(snapshotInput) {
+    const snapshot = AcsToolCallSnapshotSchema.parse(snapshotInput);
+    return NormalizedActionSchema.parse({
+        schemaVersion: "axtary.action.v0",
+        actor: snapshot.actor,
+        intent: snapshot.intent,
+        capability: {
+            tool: snapshot.tool_call.tool,
+            resource: snapshot.tool_call.resource,
+            payload: snapshot.tool_call.arguments,
+        },
+        ...(snapshot.tool_call.toolDefinition
+            ? { toolDefinition: snapshot.tool_call.toolDefinition }
+            : {}),
+    });
+}
+export function evaluateAcsIntervention(input) {
+    const manifest = AcsManifestSchema.safeParse(input.manifest);
+    if (!manifest.success) {
+        return acsRuntimeDeny(input.interventionPoint, "runtime_error:manifest_invalid");
+    }
+    const point = manifest.data.intervention_points[input.interventionPoint];
+    if (!point) {
+        return acsRuntimeDeny(input.interventionPoint, "runtime_error:intervention_point_unknown");
+    }
+    let action;
+    try {
+        action = actionFromAcsToolCallSnapshot(input.snapshot);
+    }
+    catch {
+        return acsRuntimeDeny(input.interventionPoint, "runtime_error:request_invalid");
+    }
+    const decision = evaluatePolicy(action, input.config);
+    const payloadHash = hashPayload(action.capability.payload);
+    const verdict = decisionToAcsVerdict(decision.decision);
+    const primaryReason = decision.reasons[0] ?? "policy_default_deny";
+    const snapshot = AcsToolCallSnapshotSchema.parse(input.snapshot);
+    return {
+        schemaVersion: "axtary.acs_evaluation.v0",
+        interventionPoint: input.interventionPoint,
+        verdict,
+        reason: primaryReason,
+        reasons: decision.reasons,
+        policyTargetKind: point.policy_target_kind ??
+            (input.interventionPoint === "pre_tool_call"
+                ? "axtary.normalized_action"
+                : "axtary.tool_result"),
+        normalizedAction: action,
+        policyDecision: decision,
+        evidence: {
+            adapter: "axtary.policy",
+            actionHash: hashAction(action),
+            payloadHash,
+            resultHash: snapshot.tool_result?.outputHash,
+        },
+    };
+}
+function decisionToAcsVerdict(decision) {
+    if (decision === "allow")
+        return "allow";
+    if (decision === "step_up")
+        return "escalate";
+    return "deny";
+}
+function acsRuntimeDeny(interventionPoint, reason) {
+    return {
+        schemaVersion: "axtary.acs_evaluation.v0",
+        interventionPoint,
+        verdict: "deny",
+        reason,
+        reasons: [reason],
+        policyTargetKind: "axtary.runtime_error",
+        evidence: {
+            adapter: "axtary.policy",
+        },
+    };
+}
+//# sourceMappingURL=acs.js.map

package/dist/acs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acs.js","sourceRoot":"","sources":["../src/acs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,cAAc,GAEf,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAKpE,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACxD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;IAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;IACtE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8BAA8B;YACvC,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,kCAAkC,IAAI,EAAE;gBACjD,IAAI,EAAE,CAAC,qBAAqB,EAAE,IAAI,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oBAAoB,MAAM,CAAC,MAAM,EAAE;gBAC5C,IAAI,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACrC,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChC,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;KACjE,CAAC;IACF,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAqBZ,MAAM,UAAU,uBAAuB,CAAC,QAGpC,EAAE;IACJ,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC7B,mCAAmC,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY;QAClE,QAAQ,EAAE;YACR,aAAa,EAAE,2BAA2B;YAC1C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,+BAA+B;YACnD,IAAI,EACF,iHAAiH;SACpH;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE;gBACjB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe;aACzB;SACF;QACD,mBAAmB,EAAE;YACnB,aAAa,EAAE;gBACb,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,aAAa;gBAC5B,kBAAkB,EAAE,0BAA0B;gBAC9C,cAAc,EAAE,kBAAkB;aACnC;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,eAAe;gBAC9B,kBAAkB,EAAE,oBAAoB;gBACxC,cAAc,EAAE,kBAAkB;aACnC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,aAAsB;IAEtB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAChE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,aAAa,EAAE,kBAAkB;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI;YAC7B,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ;YACrC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS;SACtC;QACD,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc;YACnC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,cAAc,CAAC,KAAK,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,cAAc,CACnB,KAAK,CAAC,iBAAiB,EACvB,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,KAAK,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC;IACnE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEjE,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO;QACP,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,gBAAgB,EACd,KAAK,CAAC,kBAAkB;YACxB,CAAC,KAAK,CAAC,iBAAiB,KAAK,eAAe;gBAC1C,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,oBAAoB,CAAC;QAC3B,gBAAgB,EAAE,MAAM;QACxB,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE;YACR,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9B,WAAW;YACX,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAoC;IAChE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,iBAAuC,EACvC,MAAc;IAEd,OAAO;QACL,aAAa,EAAE,0BAA0B;QACzC,iBAAiB;QACjB,OAAO,EAAE,MAAM;QACf,MAAM;QACN,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,sBAAsB;QACxC,QAAQ,EAAE;YACR,OAAO,EAAE,eAAe;SACzB;KACF,CAAC;AACJ,CAAC"}