@buyong/pi-codex-auto-review 0.0.0-stage → 0.2.2

package/dist/policy/index.js

@@ -0,0 +1,521 @@
+import { readFile, stat } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createProfile, decision, digest, EMPTY_DELTA, GuardError, immutable, TOOL_NAMES, } from "../contracts.js";
+import { reviewPolicy } from "../review/policy.js";
+import { isDomainPattern, isNetworkHost, matchesDomain, normalizeHost, } from "./domains.js";
+import { canonicalPath, isWithin, resolveToolPath } from "./paths.js";
+import { evaluateRules, matchesRule, ruleCommands, } from "./rules.js";
+import { analyzeShell, matchesPrefix } from "./shell.js";
+export { analyzeShell, canonicalPath, isWithin, matchesPrefix, resolveToolPath, };
+export const DEFAULT_SETTINGS = immutable({
+    mode: "workspace-write",
+    commandRules: [],
+    allowedDomains: [],
+    reviewTimeoutMs: 20_000,
+    approvalTimeoutMs: 60_000,
+    executionTimeoutSeconds: 120,
+    trustedTools: [],
+    approvalPolicy: "on-request",
+    approvalsReviewer: "auto_review",
+    reviewModel: null,
+    reviewPolicy: null,
+    reviewMaxRounds: 4,
+    reviewMaxOutputTokens: 2048,
+    reviewContextChars: 60000,
+    ruleFiles: [],
+    writableRoots: [],
+    excludeSlashTmp: false,
+    excludeTmpdir: false,
+    projectDocMaxBytes: 32768,
+    projectDocFallbackFilenames: [],
+    projectRootMarkers: null,
+});
+export function validateSettings(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new GuardError("INVALID_SETTINGS", "Settings must be an object");
+    const raw = value;
+    for (const key of Object.keys(raw))
+        if (!Object.hasOwn(DEFAULT_SETTINGS, key))
+            throw new GuardError("INVALID_SETTINGS", `Unknown setting: ${key}`);
+    const settings = { ...DEFAULT_SETTINGS, ...raw };
+    if (!["read-only", "workspace-write"].includes(settings.mode))
+        throw new GuardError("INVALID_SETTINGS", "Unknown mode");
+    for (const key of [
+        "reviewTimeoutMs",
+        "approvalTimeoutMs",
+        "executionTimeoutSeconds",
+    ])
+        if (!Number.isFinite(settings[key]) || settings[key] <= 0)
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    if (!Array.isArray(settings.allowedDomains) ||
+        settings.allowedDomains.some((x) => !isDomainPattern(x)))
+        throw new GuardError("INVALID_SETTINGS", "Invalid domains");
+    if (!Array.isArray(settings.trustedTools) ||
+        settings.trustedTools.some((x) => typeof x !== "string" || !x))
+        throw new GuardError("INVALID_SETTINGS", "Invalid trusted tools");
+    const approval = settings.approvalPolicy;
+    if (approval !== "on-request" &&
+        approval !== "never" &&
+        (!approval ||
+            typeof approval !== "object" ||
+            Array.isArray(approval) ||
+            Object.keys(approval).some((key) => !["sandbox", "rules", "mcp_elicitations"].includes(key)) ||
+            typeof approval.sandbox !== "boolean" ||
+            typeof approval.rules !== "boolean" ||
+            (approval.mcp_elicitations !== undefined &&
+                typeof approval.mcp_elicitations !== "boolean")))
+        throw new GuardError("INVALID_SETTINGS", "Invalid approval policy");
+    if (!["auto_review", "user"].includes(settings.approvalsReviewer))
+        throw new GuardError("INVALID_SETTINGS", "Invalid approvals reviewer");
+    if (settings.reviewModel !== null &&
+        (!settings.reviewModel ||
+            typeof settings.reviewModel !== "object" ||
+            Array.isArray(settings.reviewModel) ||
+            Object.keys(settings.reviewModel).some((key) => !["provider", "id"].includes(key)) ||
+            ![settings.reviewModel.provider, settings.reviewModel.id].every((value) => typeof value === "string" &&
+                value.trim().length > 0 &&
+                !/[\0\r\n]/.test(value))))
+        throw new GuardError("INVALID_SETTINGS", "Invalid review model");
+    if (settings.reviewPolicy !== null &&
+        (typeof settings.reviewPolicy !== "string" ||
+            !settings.reviewPolicy.trim() ||
+            settings.reviewPolicy.length > 100000))
+        throw new GuardError("INVALID_SETTINGS", "Invalid reviewer policy");
+    for (const [key, maximum] of [
+        ["reviewMaxRounds", 16],
+        ["reviewMaxOutputTokens", 16384],
+        ["reviewContextChars", 500000],
+    ])
+        if (!Number.isInteger(settings[key]) ||
+            settings[key] < 1 ||
+            settings[key] > maximum)
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    for (const key of ["ruleFiles", "writableRoots"])
+        if (!Array.isArray(settings[key]) ||
+            settings[key].some((value) => typeof value !== "string" || !value || value.includes("\0")))
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    for (const key of ["excludeSlashTmp", "excludeTmpdir"])
+        if (typeof settings[key] !== "boolean")
+            throw new GuardError("INVALID_SETTINGS", `Invalid ${key}`);
+    if (!Number.isSafeInteger(settings.projectDocMaxBytes) ||
+        settings.projectDocMaxBytes < 0 ||
+        settings.projectDocMaxBytes > 1000000)
+        throw new GuardError("INVALID_SETTINGS", "Invalid project document byte budget");
+    for (const values of [
+        settings.projectDocFallbackFilenames,
+        settings.projectRootMarkers ?? [],
+    ])
+        if (!Array.isArray(values) ||
+            values.some((value) => typeof value !== "string"))
+            throw new GuardError("INVALID_SETTINGS", "Invalid context discovery filenames");
+    if (!Array.isArray(settings.commandRules))
+        throw new GuardError("INVALID_SETTINGS", "Invalid command rules");
+    for (const rule of settings.commandRules) {
+        if (!rule ||
+            !["allow", "ask", "deny"].includes(rule.decision) ||
+            !Array.isArray(rule.prefix) ||
+            !rule.prefix.length ||
+            rule.prefix.some((x) => typeof x !== "string" || !x || /[\0\n]/.test(x)))
+            throw new GuardError("INVALID_SETTINGS", "Invalid command rule");
+        if (Object.keys(rule).some((k) => !["prefix", "decision"].includes(k)))
+            throw new GuardError("INVALID_SETTINGS", "Unknown command rule field");
+    }
+    return immutable(JSON.parse(JSON.stringify(settings)));
+}
+export async function loadSettings(path) {
+    try {
+        return validateSettings(JSON.parse(await readFile(path, "utf8")));
+    }
+    catch (error) {
+        throw new GuardError("INVALID_SETTINGS", "Permission settings could not be loaded", { cause: error });
+    }
+}
+export async function defaultProfile(cwd, settings, controlPaths = [], trustedExtensionPaths = []) {
+    const workspace = await canonicalPath(cwd, cwd), home = homedir();
+    const hardRead = [
+        join(home, ".ssh"),
+        join(home, ".aws"),
+        join(home, ".codex"),
+        join(home, ".pi", "agent"),
+        ...controlPaths,
+        ...settings.ruleFiles,
+    ];
+    const hardWrite = [
+        ...hardRead,
+        join(workspace, ".pi", "guard"),
+        fileURLToPath(new URL("../", import.meta.url)),
+    ];
+    const roots = [
+        ...new Set(await Promise.all([
+            workspace,
+            ...settings.writableRoots,
+            ...(!settings.excludeSlashTmp ? ["/tmp"] : []),
+            ...(!settings.excludeTmpdir ? [tmpdir()] : []),
+        ].map((path) => canonicalPath(path, cwd)))),
+    ];
+    const readOnlyPaths = [];
+    for (const input of trustedExtensionPaths) {
+        const path = await canonicalPath(input, cwd);
+        // A trusted module can import sibling modules; protect its containing code directory.
+        hardWrite.push((await stat(path)).isDirectory() ? path : dirname(path));
+    }
+    for (const root of roots) {
+        const git = join(root, ".git");
+        readOnlyPaths.push(await canonicalPath(git, cwd));
+        try {
+            if ((await stat(git)).isFile()) {
+                const pointer = /^gitdir:\s*(.+)\s*$/m.exec(await readFile(git, "utf8"));
+                if (pointer?.[1])
+                    readOnlyPaths.push(await canonicalPath(resolve(root, pointer[1]), cwd));
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        for (const name of [".agents", ".codex"]) {
+            const path = join(root, name);
+            try {
+                if ((await stat(path)).isDirectory())
+                    readOnlyPaths.push(await canonicalPath(path, cwd));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        readOnlyPaths.push(await canonicalPath(join(root, ".pi"), cwd));
+        hardWrite.push(...["mcp.json", "settings.json", "extensions", "guard"].map((name) => join(root, ".pi", name)));
+    }
+    return createProfile({
+        mode: settings.mode,
+        readRoots: ["/"],
+        writeRoots: settings.mode === "workspace-write" ? roots : [],
+        denyRead: await Promise.all(hardRead.map((p) => canonicalPath(p, cwd))),
+        denyWrite: await Promise.all(hardWrite.map((p) => canonicalPath(p, cwd))),
+        readOnlyPaths,
+        allowedDomains: [...settings.allowedDomains],
+        deniedDomains: [],
+    });
+}
+export class PolicyEngine {
+    settings;
+    rules;
+    isInitialized;
+    ruleSources = [];
+    compiledRules;
+    matchCache = new Map();
+    effectiveProfile;
+    get profile() {
+        return this.effectiveProfile;
+    }
+    get revision() {
+        return digest({
+            settings: this.settings,
+            profile: this.profile,
+            rules: this.rules,
+            ruleSources: this.ruleSources,
+            compiledRules: this.compiledRules ?? null,
+            reviewPolicyDigest: reviewPolicy(this.settings.reviewPolicy).digest,
+        });
+    }
+    constructor(settings, profile) {
+        this.settings = settings;
+        this.effectiveProfile = profile;
+        this.rules = settings.commandRules.map((rule) => ({
+            pattern: rule.prefix,
+            decision: rule.decision === "ask"
+                ? "prompt"
+                : rule.decision === "deny"
+                    ? "forbidden"
+                    : "allow",
+        }));
+        this.isInitialized = settings.ruleFiles.length === 0;
+    }
+    async initialize(cwd = process.cwd()) {
+        if (this.isInitialized)
+            return;
+        this.ruleSources = immutable(await Promise.all(this.settings.ruleFiles.map(async (path) => ({
+            name: resolve(cwd, path),
+            source: await readFile(resolve(cwd, path), "utf8"),
+        }))));
+        this.compiledRules = await evaluateRules(this.ruleSources);
+        const allowed = this.compiledRules.allowedDomains, denied = this.compiledRules.deniedDomains;
+        this.effectiveProfile = createProfile({
+            ...this.profile,
+            allowedDomains: [
+                ...new Set([
+                    ...this.profile.allowedDomains.filter((host) => !denied.includes(host)),
+                    ...allowed,
+                ]),
+            ],
+            deniedDomains: [
+                ...new Set([...this.profile.deniedDomains, ...denied]),
+            ],
+        });
+        this.isInitialized = true;
+    }
+    async evaluate(action, signal) {
+        if (!this.isInitialized)
+            return decision(action, "deny", "Command rules have not been loaded", EMPTY_DELTA, true);
+        if (action.policyRevision !== this.revision ||
+            action.permissionDigest !== digest(this.profile))
+            return decision(action, "deny", "Stale policy or permission profile", EMPTY_DELTA, true);
+        if (!TOOL_NAMES.includes(action.tool))
+            return decision(action, "ask", "Unknown tool: annotations do not establish permission");
+        if (action.tool === "bash")
+            return this.shellDecision(action, signal);
+        const input = action.args.path ?? action.cwd;
+        if (typeof input !== "string")
+            return decision(action, "deny", "Invalid path input", EMPTY_DELTA, true);
+        const target = await canonicalPath(await resolveToolPath(input, action.cwd, action.tool === "read"), action.cwd);
+        const profile = await this.resolvedProfile(action.cwd);
+        const isWrite = action.tool === "write" || action.tool === "edit";
+        if (profile.denyRead.some((p) => isWithin(target, p)) ||
+            (isWrite && profile.denyWrite.some((p) => isWithin(target, p))))
+            return decision(action, "deny", "Protected path", EMPTY_DELTA, true);
+        const canRead = profile.readRoots.some((p) => isWithin(target, p));
+        const canWrite = !isWrite ||
+            (profile.writeRoots.some((p) => isWithin(target, p)) &&
+                !(profile.readOnlyPaths ?? []).some((p) => isWithin(target, p)));
+        if (canRead && canWrite)
+            return decision(action, "allow", "Within current filesystem permissions");
+        return decision(action, "ask", "Action outside the ordinary approval scope", {
+            readPaths: canRead ? [] : [target],
+            writePaths: canWrite ? [] : [target],
+            domains: [],
+        });
+    }
+    async shellDecision(action, signal) {
+        const profile = await this.resolvedProfile(action.cwd);
+        const command = action.args.command;
+        if (typeof command !== "string")
+            return decision(action, "deny", "Invalid command input", EMPTY_DELTA, true);
+        const analysis = analyzeShell(command);
+        let shouldAsk = !analysis.isSupported;
+        const delta = { readPaths: [], writePaths: [], domains: [] };
+        const commandGroups = ruleCommands(command, typeof action.args.shellPath === "string"
+            ? action.args.shellPath
+            : "/bin/bash");
+        const key = digest(commandGroups);
+        let compiledMatches = this.matchCache.get(key);
+        if (!compiledMatches && this.ruleSources.length) {
+            compiledMatches = (await evaluateRules(this.ruleSources, commandGroups, signal)).matches;
+            if (this.matchCache.size >= 256) {
+                const oldestKey = this.matchCache.keys().next().value;
+                if (oldestKey !== undefined)
+                    this.matchCache.delete(oldestKey);
+            }
+            this.matchCache.set(key, compiledMatches);
+        }
+        const matches = commandGroups.map((argv, index) => [
+            ...this.rules.filter((rule) => matchesRule(argv, rule)),
+            ...(compiledMatches?.[index] ?? []),
+        ]);
+        const forbidden = matches
+            .flat()
+            .find((rule) => rule.decision === "forbidden");
+        if (forbidden)
+            return decision(action, "deny", forbidden.justification ?? "Command forbidden by trusted rule", EMPTY_DELTA, true);
+        const prompted = matches
+            .flat()
+            .find((rule) => rule.decision === "prompt");
+        const isRuleAllowed = !prompted &&
+            matches.length > 0 &&
+            matches.every((group) => group.some((rule) => rule.decision === "allow"));
+        if (prompted)
+            shouldAsk = true;
+        if (action.args.sandbox_permissions !== undefined &&
+            !["use_default", "require_escalated"].includes(String(action.args.sandbox_permissions)))
+            return decision(action, "deny", "Invalid sandbox permission request", EMPTY_DELTA, true);
+        const explicit = action.args.additional_permissions;
+        if (explicit !== undefined) {
+            if (!explicit ||
+                typeof explicit !== "object" ||
+                Array.isArray(explicit) ||
+                Object.keys(explicit).some((key) => !["readPaths", "writePaths", "domains"].includes(key)))
+                return decision(action, "deny", "Invalid additional permissions", EMPTY_DELTA, true);
+            for (const key of ["readPaths", "writePaths", "domains"]) {
+                const values = explicit[key] ?? [];
+                if (!Array.isArray(values) ||
+                    values.some((value) => typeof value !== "string" ||
+                        !value ||
+                        value.includes("\0")))
+                    return decision(action, "deny", "Invalid permission list", EMPTY_DELTA, true);
+                delta[key].push(...values);
+            }
+            shouldAsk = true;
+        }
+        for (const item of analysis.commands) {
+            const executable = basename(item.argv[0] ?? "");
+            const isSafeRead = [
+                "pwd",
+                "echo",
+                "printf",
+                "ls",
+                "cat",
+                "head",
+                "tail",
+                "wc",
+                "rg",
+                "grep",
+                "find",
+                "stat",
+                "true",
+                "false",
+            ].includes(executable);
+            if (!isSafeRead &&
+                ![
+                    "touch",
+                    "mkdir",
+                    "rmdir",
+                    "rm",
+                    "truncate",
+                    "tee",
+                    "chmod",
+                    "chown",
+                    "cp",
+                    "mv",
+                    "git",
+                    "curl",
+                    "wget",
+                ].includes(executable))
+                shouldAsk = true;
+            const operands = item.argv
+                .slice(1)
+                .filter((arg) => !arg.startsWith("-"));
+            const reads = [...item.reads], writes = [...item.writes];
+            if (analysis.isSupported) {
+                if (isSafeRead &&
+                    !["echo", "printf", "true", "false", "pwd"].includes(executable))
+                    reads.push(...operands);
+                if ([
+                    "touch",
+                    "mkdir",
+                    "rmdir",
+                    "rm",
+                    "truncate",
+                    "tee",
+                    "chmod",
+                    "chown",
+                ].includes(executable))
+                    writes.push(...operands);
+                if (["cp", "mv"].includes(executable)) {
+                    reads.push(...operands.slice(0, -1));
+                    writes.push(...operands.slice(-1));
+                    if (executable === "mv")
+                        writes.push(...operands.slice(0, -1));
+                }
+                if (executable === "git" &&
+                    ![
+                        "status",
+                        "diff",
+                        "log",
+                        "show",
+                        "ls-files",
+                        "rev-parse",
+                    ].includes(item.argv[1] ?? ""))
+                    writes.push(...(profile.readOnlyPaths ?? []).filter((path) => path === join(action.cwd, ".git") ||
+                        path.includes("/.git/")));
+            }
+            for (const path of writes) {
+                const target = await canonicalPath(path, action.cwd);
+                if ([...profile.denyRead, ...profile.denyWrite].some((root) => isWithin(target, root)))
+                    return decision(action, "deny", "Command writes a protected path", EMPTY_DELTA, true);
+                if (!profile.writeRoots.some((root) => isWithin(target, root)) ||
+                    (profile.readOnlyPaths ?? []).some((root) => isWithin(target, root))) {
+                    shouldAsk = true;
+                    delta.writePaths.push(target);
+                }
+            }
+            for (const path of reads) {
+                const target = await canonicalPath(path, action.cwd);
+                if (profile.denyRead.some((root) => isWithin(target, root)))
+                    return decision(action, "deny", "Command reads a protected path", EMPTY_DELTA, true);
+                if (!profile.readRoots.some((root) => isWithin(target, root))) {
+                    shouldAsk = true;
+                    delta.readPaths.push(target);
+                }
+            }
+            if (analysis.isSupported && ["curl", "wget"].includes(executable)) {
+                const urls = item.argv
+                    .slice(1)
+                    .filter((arg) => /^https?:\/\//.test(arg));
+                // A destination hidden in a config file or a schemeless URL still needs review.
+                const hasIndirectDestination = item.argv
+                    .slice(1)
+                    .some((arg) => executable === "curl"
+                    ? /^(?:--config(?:=|$)|-K)/.test(arg)
+                    : /^(?:--input-file(?:=|$)|-i)/.test(arg));
+                if (!urls.length || hasIndirectDestination)
+                    shouldAsk = true;
+                for (const text of urls) {
+                    const domain = normalizeHost(new URL(text).hostname);
+                    if (profile.deniedDomains.some((pattern) => matchesDomain(domain, pattern)))
+                        return decision(action, "deny", "Network domain denied", EMPTY_DELTA, true);
+                    if (!profile.allowedDomains.some((pattern) => matchesDomain(domain, pattern))) {
+                        delta.domains.push(domain);
+                        shouldAsk = true;
+                    }
+                }
+            }
+        }
+        for (const key of ["readPaths", "writePaths"])
+            delta[key] = [
+                ...new Set(await Promise.all(delta[key].map((path) => canonicalPath(path, action.cwd)))),
+            ];
+        if (delta.readPaths.some((path) => profile.denyRead.some((root) => isWithin(path, root))) ||
+            delta.writePaths.some((path) => [...profile.denyRead, ...profile.denyWrite].some((root) => isWithin(path, root))) ||
+            delta.domains.some((host) => !isNetworkHost(host) ||
+                profile.deniedDomains.some((pattern) => matchesDomain(host, pattern))))
+            return decision(action, "deny", "Requested permissions target an absolute deny", EMPTY_DELTA, true);
+        const boundDelta = {
+            ...delta,
+            domains: [...new Set(delta.domains.map(normalizeHost))],
+        };
+        if (isRuleAllowed)
+            return immutable({
+                ...decision(action, "allow", "Trusted prefix rule authorizes this command", boundDelta),
+                authority: {
+                    kind: "command-rule",
+                    actionDigest: action.digest,
+                    ruleDigest: digest(matches),
+                },
+            });
+        const isFullRequest = action.args.sandbox_permissions === "require_escalated" &&
+            explicit === undefined;
+        shouldAsk ||= action.args.sandbox_permissions === "require_escalated";
+        const reason = prompted?.justification ??
+            (shouldAsk
+                ? "Command requires approval review"
+                : "Within the ordinary approval scope");
+        return immutable({
+            ...decision(action, shouldAsk ? "ask" : "allow", reason, boundDelta),
+            approvalCategory: prompted ? "rules" : "sandbox",
+            ...(isFullRequest
+                ? {
+                    authority: {
+                        kind: "reviewed-command",
+                        actionDigest: action.digest,
+                    },
+                }
+                : {}),
+        });
+    }
+    async resolvedProfile(cwd) {
+        const result = { ...this.profile };
+        for (const key of [
+            "readRoots",
+            "writeRoots",
+            "denyRead",
+            "denyWrite",
+        ])
+            result[key] = await Promise.all(this.profile[key].map((path) => canonicalPath(path, cwd)));
+        if (this.profile.readOnlyPaths)
+            result.readOnlyPaths = await Promise.all(this.profile.readOnlyPaths.map((path) => canonicalPath(path, cwd)));
+        return result;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAEH,aAAa,EACb,QAAQ,EACR,MAAM,EACN,WAAW,EAEX,UAAU,EACV,SAAS,EAGT,UAAU,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACH,eAAe,EACf,aAAa,EACb,aAAa,EACb,aAAa,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAEH,aAAa,EACb,WAAW,EAIX,YAAY,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACH,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,aAAa,EACb,eAAe,GAClB,CAAC;AAiCF,MAAM,CAAC,MAAM,gBAAgB,GAAkB,SAAS,CAAC;IACrD,IAAI,EAAE,iBAAiB;IACvB,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAClB,eAAe,EAAE,MAAM;IACvB,iBAAiB,EAAE,MAAM;IACzB,uBAAuB,EAAE,GAAG;IAC5B,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,YAAY;IAC5B,iBAAiB,EAAE,aAAa;IAChC,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,CAAC;IAClB,qBAAqB,EAAE,IAAI;IAC3B,kBAAkB,EAAE,KAAK;IACzB,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,EAAE;IACjB,eAAe,EAAE,KAAK;IACtB,aAAa,EAAE,KAAK;IACpB,kBAAkB,EAAE,KAAK;IACzB,2BAA2B,EAAE,EAAE;IAC/B,kBAAkB,EAAE,IAAI;CAC3B,CAAC,CAAC;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,GAAG,EAAmB,CAAC;IAClE,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI;QACd,iBAAiB;QACjB,mBAAmB;QACnB,yBAAyB;KACnB;QACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACnE,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IAChE,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;QAE9D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;IACzC,IACI,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,OAAO;QACpB,CAAC,CAAC,QAAQ;YACN,OAAO,QAAQ,KAAK,QAAQ;YAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACJ,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC9D;YACD,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;YACrC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS;YACnC,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;gBACpC,OAAO,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC;QAExD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC7D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC3E,IACI,QAAQ,CAAC,WAAW,KAAK,IAAI;QAC7B,CAAC,CAAC,QAAQ,CAAC,WAAW;YAClB,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACxC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAClC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7C;YACD,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAC3D,CAAC,KAAK,EAAE,EAAE,CACN,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAC9B,CAAC;QAEN,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACrE,IACI,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,CAAC,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACtC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;YAC7B,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1C,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI;QACzB,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,CAAC,uBAAuB,EAAE,KAAK,CAAC;QAChC,CAAC,oBAAoB,EAAE,MAAM,CAAC;KACxB;QACN,IACI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO;YAEvB,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAU;QACrD,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CACd,CAAC,KAAK,EAAE,EAAE,CACN,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAClE;YAED,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAU;QAC3D,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;YAClC,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACnE,IACI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClD,QAAQ,CAAC,kBAAkB,GAAG,CAAC;QAC/B,QAAQ,CAAC,kBAAkB,GAAG,OAAO;QAErC,MAAM,IAAI,UAAU,CAChB,kBAAkB,EAClB,sCAAsC,CACzC,CAAC;IACN,KAAK,MAAM,MAAM,IAAI;QACjB,QAAQ,CAAC,2BAA2B;QACpC,QAAQ,CAAC,kBAAkB,IAAI,EAAE;KACpC;QACG,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAEjD,MAAM,IAAI,UAAU,CAChB,kBAAkB,EAClB,qCAAqC,CACxC,CAAC;IACV,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IACI,CAAC,IAAI;YACL,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAClE;YAED,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,UAAU,CAChB,kBAAkB,EAClB,4BAA4B,CAC/B,CAAC;IACV,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC3C,IAAI,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAChB,kBAAkB,EAClB,yCAAyC,EACzC,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAW,EACX,QAAuB,EACvB,eAAkC,EAAE,EACpC,wBAA2C,EAAE;IAE7C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAC3C,IAAI,GAAG,OAAO,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAG;QACb,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;QAC1B,GAAG,YAAY;QACf,GAAG,QAAQ,CAAC,SAAS;KACxB,CAAC;IACF,MAAM,SAAS,GAAG;QACd,GAAG,QAAQ;QACX,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;QAC/B,aAAa,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACjD,CAAC;IACF,MAAM,KAAK,GAAG;QACV,GAAG,IAAI,GAAG,CACN,MAAM,OAAO,CAAC,GAAG,CACb;YACI,SAAS;YACT,GAAG,QAAQ,CAAC,aAAa;YACzB,GAAG,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAC5C,CACJ;KACJ,CAAC;IACF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7C,sFAAsF;QACtF,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CACvC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAC9B,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;oBACZ,aAAa,CAAC,IAAI,CACd,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CACtD,CAAC;YACV,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACxE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;oBAChC,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAClD,MAAM,KAAK,CAAC;YACpB,CAAC;QACL,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,SAAS,CAAC,IAAI,CACV,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,GAAG,CACvD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CACpC,CACJ,CAAC;IACN,CAAC;IACD,OAAO,aAAa,CAAC;QACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC5D,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,SAAS,EAAE,MAAM,OAAO,CAAC,GAAG,CACxB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC9C;QACD,aAAa;QACb,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC5C,aAAa,EAAE,EAAE;KACpB,CAAC,CAAC;AACP,CAAC;AACD,MAAM,OAAO,YAAY;IAwBR;IAvBL,KAAK,CAAwB;IAC7B,aAAa,CAAU;IACvB,WAAW,GAA0B,EAAE,CAAC;IACxC,aAAa,CAAiB;IACrB,UAAU,GAAG,IAAI,GAAG,EAGlC,CAAC;IACI,gBAAgB,CAAoB;IAC5C,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACjC,CAAC;IACD,IAAI,QAAQ;QACR,OAAO,MAAM,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACzC,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM;SACtE,CAAC,CAAC;IACP,CAAC;IACD,YACa,QAAuB,EAChC,OAA0B;QADjB,aAAQ,GAAR,QAAQ,CAAe;QAGhC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,QAAQ,EACJ,IAAI,CAAC,QAAQ,KAAK,KAAK;gBACnB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACxB,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,OAAO;SACtB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,WAAW,GAAG,SAAS,CACxB,MAAM,OAAO,CAAC,GAAG,CACb,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YACxB,MAAM,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;SACrD,CAAC,CAAC,CACN,CACJ,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAC7C,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC;YAClC,GAAG,IAAI,CAAC,OAAO;YACf,cAAc,EAAE;gBACZ,GAAG,IAAI,GAAG,CAAC;oBACP,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC;oBACD,GAAG,OAAO;iBACb,CAAC;aACL;YACD,aAAa,EAAE;gBACX,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC;aACzD;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,QAAQ,CACV,MAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,aAAa;YACnB,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,oCAAoC,EACpC,WAAW,EACX,IAAI,CACP,CAAC;QACN,IACI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ;YACvC,MAAM,CAAC,gBAAgB,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAEhD,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,oCAAoC,EACpC,WAAW,EACX,IAAI,CACP,CAAC;QACN,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAa,CAAC;YAC1C,OAAO,QAAQ,CACX,MAAM,EACN,KAAK,EACL,uDAAuD,CAC1D,CAAC;QACN,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,oBAAoB,EACpB,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,aAAa,CAC9B,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAChE,MAAM,CAAC,GAAG,CACb,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;QAClE,IACI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACjD,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAE/D,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GACV,CAAC,OAAO;YACR,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChD,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CACtB,CAAC,CAAC;QACX,IAAI,OAAO,IAAI,QAAQ;YACnB,OAAO,QAAQ,CACX,MAAM,EACN,OAAO,EACP,uCAAuC,CAC1C,CAAC;QACN,OAAO,QAAQ,CACX,MAAM,EACN,KAAK,EACL,4CAA4C,EAC5C;YACI,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,EAAE;SACd,CACJ,CAAC;IACN,CAAC;IACO,KAAK,CAAC,aAAa,CACvB,MAAmB,EACnB,MAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,uBAAuB,EACvB,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtC,MAAM,KAAK,GAIP,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,YAAY,CAC9B,OAAO,EACP,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS;YACvB,CAAC,CAAC,WAAW,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC9C,eAAe,GAAG,CACd,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAC/D,CAAC,OAAO,CAAC;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACtD,IAAI,SAAS,KAAK,SAAS;oBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,GAAG,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO;aACpB,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;QACnD,IAAI,SAAS;YACT,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,SAAS,CAAC,aAAa,IAAI,mCAAmC,EAC9D,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO;aACnB,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAChD,MAAM,aAAa,GACf,CAAC,QAAQ;YACT,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACpB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAClD,CAAC;QACN,IAAI,QAAQ;YAAE,SAAS,GAAG,IAAI,CAAC;QAC/B,IACI,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAC7C,CAAC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAC1C;YAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,oCAAoC,EACpC,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,IACI,CAAC,QAAQ;gBACT,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC5D;gBAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,gCAAgC,EAChC,WAAW,EACX,IAAI,CACP,CAAC;YACN,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtB,MAAM,CAAC,IAAI,CACP,CAAC,KAAK,EAAE,EAAE,CACN,OAAO,KAAK,KAAK,QAAQ;wBACzB,CAAC,KAAK;wBACN,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3B;oBAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,yBAAyB,EACzB,WAAW,EACX,IAAI,CACP,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAI,MAAmB,CAAC,CAAC;YAC7C,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG;gBACf,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,OAAO;aACV,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvB,IACI,CAAC,UAAU;gBACX,CAAC;oBACG,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,UAAU;oBACV,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,IAAI;oBACJ,KAAK;oBACL,MAAM;oBACN,MAAM;iBACT,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAEtB,SAAS,GAAG,IAAI,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI;iBACrB,KAAK,CAAC,CAAC,CAAC;iBACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EACzB,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvB,IACI,UAAU;oBACV,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAChD,UAAU,CACb;oBAED,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC5B,IACI;oBACI,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,UAAU;oBACV,KAAK;oBACL,OAAO;oBACP,OAAO;iBACV,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAEtB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC7B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACpC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,UAAU,KAAK,IAAI;wBACnB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBACD,IACI,UAAU,KAAK,KAAK;oBACpB,CAAC;wBACG,QAAQ;wBACR,MAAM;wBACN,KAAK;wBACL,MAAM;wBACN,UAAU;wBACV,WAAW;qBACd,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAE9B,MAAM,CAAC,IAAI,CACP,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CACL,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;wBACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC9B,CACJ,CAAC;YACV,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrD,IACI,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACtD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB;oBAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,iCAAiC,EACjC,WAAW,EACX,IAAI,CACP,CAAC;gBACN,IACI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB;oBACD,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB,EACH,CAAC;oBACC,SAAS,GAAG,IAAI,CAAC;oBACjB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACvD,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,gCAAgC,EAChC,WAAW,EACX,IAAI,CACP,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC5D,SAAS,GAAG,IAAI,CAAC;oBACjB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;qBACjB,KAAK,CAAC,CAAC,CAAC;qBACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/C,gFAAgF;gBAChF,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI;qBACnC,KAAK,CAAC,CAAC,CAAC;qBACR,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACV,UAAU,KAAK,MAAM;oBACjB,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;oBACrC,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAChD,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,sBAAsB;oBAAE,SAAS,GAAG,IAAI,CAAC;gBAC7D,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACrD,IACI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACnC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CACjC;wBAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,uBAAuB,EACvB,WAAW,EACX,IAAI,CACP,CAAC;oBACN,IACI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CACjC,EACH,CAAC;wBACC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC3B,SAAS,GAAG,IAAI,CAAC;oBACrB,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAU;YAClD,KAAK,CAAC,GAAG,CAAC,GAAG;gBACT,GAAG,IAAI,GAAG,CACN,MAAM,OAAO,CAAC,GAAG,CACb,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAClC,CACJ,CACJ;aACJ,CAAC;QACN,IACI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACxD;YACD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACtD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CACvB,CACJ;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,CACd,CAAC,IAAI,EAAE,EAAE,CACL,CAAC,aAAa,CAAC,IAAI,CAAC;gBACpB,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACnC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAC/B,CACR;YAED,OAAO,QAAQ,CACX,MAAM,EACN,MAAM,EACN,+CAA+C,EAC/C,WAAW,EACX,IAAI,CACP,CAAC;QACN,MAAM,UAAU,GAAG;YACf,GAAG,KAAK;YACR,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;SAC1D,CAAC;QACF,IAAI,aAAa;YACb,OAAO,SAAS,CAAC;gBACb,GAAG,QAAQ,CACP,MAAM,EACN,OAAO,EACP,6CAA6C,EAC7C,UAAU,CACb;gBACD,SAAS,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,YAAY,EAAE,MAAM,CAAC,MAAM;oBAC3B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;iBAC9B;aACJ,CAAC,CAAC;QACP,MAAM,aAAa,GACf,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB;YACvD,QAAQ,KAAK,SAAS,CAAC;QAC3B,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;QACtE,MAAM,MAAM,GACR,QAAQ,EAAE,aAAa;YACvB,CAAC,SAAS;gBACN,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC;YACb,GAAG,QAAQ,CACP,MAAM,EACN,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAC3B,MAAM,EACN,UAAU,CACb;YACD,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAChD,GAAG,CAAC,aAAa;gBACb,CAAC,CAAC;oBACI,SAAS,EAAE;wBACP,IAAI,EAAE,kBAAkB;wBACxB,YAAY,EAAE,MAAM,CAAC,MAAM;qBAC9B;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC,CAAC;IACP,CAAC;IACO,KAAK,CAAC,eAAe,CAAC,GAAW;QACrC,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI;YACd,WAAW;YACX,YAAY;YACZ,UAAU;YACV,WAAW;SACL;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAC5D,CAAC;QACN,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa;YAC1B,MAAM,CAAC,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAC3B,CACJ,CAAC;QACN,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ"}

package/dist/policy/paths.d.ts

@@ -0,0 +1,5 @@
+export declare function isWithin(path: string, root: string): boolean;
+/** Pi 0.99.1 file-input semantics, including its screenshot filename variants. */
+export declare function resolveToolPath(input: string, cwd: string, isRead?: boolean, homeDir?: string): Promise<string>;
+/** Resolve existing ancestors as well as missing write targets, never just string prefixes. */
+export declare function canonicalPath(path: string, cwd: string): Promise<string>;

package/dist/policy/paths.js

@@ -0,0 +1,67 @@
+import { access, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { GuardError } from "../contracts.js";
+export function isWithin(path, root) {
+    const rel = relative(root, path);
+    return (rel === "" ||
+        (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel)));
+}
+/** Pi 0.99.1 file-input semantics, including its screenshot filename variants. */
+export async function resolveToolPath(input, cwd, isRead = false, homeDir = homedir()) {
+    if (typeof input !== "string" || input.includes("\0"))
+        throw new GuardError("INVALID_PATH", "Invalid file input");
+    let path = input
+        .replace(/[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g, " ")
+        .replace(/^@/, "");
+    if (path === "~")
+        path = homeDir;
+    else if (path.startsWith("~/"))
+        path = join(homeDir, path.slice(2));
+    else if (path.startsWith("file://"))
+        path = fileURLToPath(path);
+    const resolved = resolve(cwd, path);
+    if (!isRead)
+        return resolved;
+    const nfd = resolved.normalize("NFD");
+    for (const candidate of [
+        ...new Set([
+            resolved,
+            resolved.replace(/ (AM|PM)\./gi, "\u202F$1."),
+            nfd,
+            resolved.replace(/'/g, "\u2019"),
+            nfd.replace(/'/g, "\u2019"),
+        ]),
+    ]) {
+        try {
+            await access(candidate);
+            return candidate;
+        }
+        catch { }
+    }
+    return resolved;
+}
+/** Resolve existing ancestors as well as missing write targets, never just string prefixes. */
+export async function canonicalPath(path, cwd) {
+    if (typeof path !== "string" || !path || path.includes("\0"))
+        throw new GuardError("INVALID_PATH", "Invalid path");
+    const absolute = resolve(cwd, path);
+    let ancestor = absolute;
+    for (;;) {
+        try {
+            return resolve(await realpath(ancestor), relative(ancestor, absolute));
+        }
+        catch (error) {
+            if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                throw error;
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                throw new GuardError("INVALID_PATH", "Cannot resolve path", {
+                    cause: error,
+                });
+            ancestor = parent;
+        }
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/policy/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/policy/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,CACH,GAAG,KAAK,EAAE;QACV,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CACpE,CAAC;AACN,CAAC;AACD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,KAAa,EACb,GAAW,EACX,MAAM,GAAG,KAAK,EACd,OAAO,GAAG,OAAO,EAAE;IAEnB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAC/D,IAAI,IAAI,GAAG,KAAK;SACX,OAAO,CAAC,0CAA0C,EAAE,GAAG,CAAC;SACxD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,GAAG;QAAE,IAAI,GAAG,OAAO,CAAC;SAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI;QACpB,GAAG,IAAI,GAAG,CAAC;YACP,QAAQ;YACR,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;YAC7C,GAAG;YACH,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC9B,CAAC;KACL,EAAE,CAAC;QACA,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AACD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,IAAY,EACZ,GAAW;IAEX,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,SAAS,CAAC;QACN,IAAI,CAAC;YACD,OAAO,OAAO,CACV,MAAM,QAAQ,CAAC,QAAQ,CAAC,EACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC/B,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IACI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAC1B,KAA+B,CAAC,IAAI,IAAI,EAAE,CAC9C;gBAED,MAAM,KAAK,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBACnB,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,qBAAqB,EAAE;oBACxD,KAAK,EAAE,KAAK;iBACf,CAAC,CAAC;YACP,QAAQ,GAAG,MAAM,CAAC;QACtB,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/policy/rule-engine.d.ts

@@ -0,0 +1,2 @@
+import { type CompiledRules, type RuleSource } from "./rule-types.js";
+export declare function evaluateRuleSources(sources: readonly RuleSource[], commands?: readonly (readonly string[])[]): CompiledRules;