@cleocode/core 2026.6.12 → 2026.6.14

package/dist/llm/pi/pi-execution-env.js

@@ -0,0 +1,406 @@
+/**
+ * Guarded Pi `ExecutionEnv` (T11761 · S1 · T11897).
+ *
+ * Pi's agent loop performs ALL filesystem + shell work through a single
+ * pluggable seam: `ExecutionEnv extends FileSystem, Shell`. This module supplies
+ * Cleo's implementation of that seam — {@link GuardedExecutionEnv} — which routes
+ * every operation through the deny-first {@link ToolGuard} chokepoint and an
+ * injected **workspace boundary**, so Pi can touch nothing outside the
+ * allowlisted roots and runs no command on the denylist.
+ *
+ * Two layers of confinement (deny-first):
+ * 1. **Workspace boundary** — every fs path is canonicalized with SYMLINK
+ *    RESOLUTION (`fs.realpath` on the nearest existing ancestor) and the REAL
+ *    target MUST fall under the injected `workspaceRoot`; a `../` escape, an
+ *    out-of-root absolute path, OR a symlink (file or parent dir) whose real
+ *    target leaves the root is rejected as a Pi `Result.err(FileError)` BEFORE
+ *    the guard is consulted. A purely lexical check is symlink-blind, so the
+ *    boundary resolves symlinks first. (The guard's own `allowedRoots` is a
+ *    second, ALSO-symlink-resolving net.)
+ * 2. **ToolGuard** — the allowed operations delegate to the `ToolGuard` surface
+ *    (`readFileText`/`writeFileAtomic`/`pathExists`/`executeShell`/`runGit`),
+ *    which applies the project's symlink-resolved path allowlist + shell
+ *    denylist + subprocess-env scrub. A `GuardDeniedError` from enforce-mode is
+ *    CAUGHT and converted to a Pi `Result.err` — Pi's `FileSystem`/`Shell` ops
+ *    must NEVER throw. The guard MUST be constructed in `enforce` mode (the
+ *    factory asserts it) — in `warn` mode its allowlist/denylist are advisory
+ *    and confinement would collapse to the workspace boundary alone.
+ *
+ * Every other capability (binary reads, raw temp/dir mutation, listing, …) for
+ * which there is no atomic primitive in v0 is DENIED with a typed error rather
+ * than reaching the real filesystem. The structural Pi interfaces are declared
+ * locally here (the `@earendil-works/pi-agent-core` package is not yet a
+ * dependency); S2 replaces these with the real type-only imports — the shapes
+ * match `@earendil-works/pi-agent-core@0.78.1` `harness/types.ts:268-332`.
+ *
+ * Scope discipline (S1): NO `pi-ai`/`pi-agent-core` imports, NO DB access, NO
+ * LLM calls. Import-time side-effect free.
+ *
+ * @epic T10403
+ * @task T11761
+ * @task T11897
+ */
+import { isAbsolute, relative, resolve as resolvePath } from 'node:path';
+import { scrubSubprocessEnv } from '../../tools/env-scrub.js';
+import { canonicalizePath } from '../../tools/fs.js';
+import { GuardDeniedError } from '../../tools/guard.js';
+// ---------------------------------------------------------------------------
+// Result constructors
+// ---------------------------------------------------------------------------
+/** Build a successful {@link PiResult}. */
+function ok(value) {
+    return { ok: true, value };
+}
+/** Build a failed {@link PiResult} with a {@link PiFileError}. */
+function fsErr(code, message, path) {
+    return { ok: false, error: { code, message, ...(path !== undefined ? { path } : {}) } };
+}
+/** Build a failed {@link PiResult} with a {@link PiExecutionError}. */
+function execErr(code, message) {
+    return { ok: false, error: { code, message } };
+}
+/**
+ * Whether `err` is a "file does not exist" failure (`ENOENT`). Used by
+ * {@link GuardedExecutionEnv.appendFile} to treat append-to-missing as
+ * append-creates (empty prefix) while still propagating every OTHER failure
+ * (guard denial, permission, …).
+ */
+function isMissingFileError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        'code' in err &&
+        err.code === 'ENOENT');
+}
+/**
+ * Deny-first {@link PiExecutionEnv} backed by the Cleo {@link ToolGuard} surface
+ * and a workspace boundary.
+ *
+ * - File reads/writes/existence checks route through the guard's atomic
+ *   primitives, confined to `workspaceRoot`.
+ * - `exec` routes through the guard's `executeShell` (shell denylist applies).
+ * - Capabilities with no atomic primitive in v0 (binary read, `listDir`,
+ *   `createDir`, `remove`, temp dir/file) are DENIED with a typed
+ *   `Result.err` — they never reach the real filesystem.
+ * - Pure path arithmetic (`cwd`/`absolutePath`/`joinPath`) is computed locally
+ *   (no fs access), anchored to `workspaceRoot`.
+ *
+ * Every method honours the Pi contract: it returns a {@link PiResult} and never
+ * throws — a {@link GuardDeniedError} from the guard is caught and converted.
+ */
+export class GuardedExecutionEnv {
+    #guard;
+    #root;
+    /**
+     * @param deps - The guard surface + the workspace root to confine to.
+     */
+    constructor(deps) {
+        this.#guard = deps.guard;
+        this.#root = resolvePath(deps.workspaceRoot);
+    }
+    /**
+     * Lexically resolve a (possibly relative) path against the workspace root and
+     * assert it does not climb out. This is the fast FIRST gate only — it is
+     * symlink-blind, so {@link #confine} additionally re-checks the REAL target.
+     *
+     * @returns the lexically-resolved absolute path, or `null` on a `../`/absolute
+     *   escape.
+     */
+    #lexicalConfine(path) {
+        const abs = isAbsolute(path) ? resolvePath(path) : resolvePath(this.#root, path);
+        const rel = relative(this.#root, abs);
+        if (rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)))
+            return abs;
+        return null;
+    }
+    /**
+     * Resolve a (possibly relative) path against the workspace root and assert its
+     * REAL filesystem target stays inside the boundary. Two gates:
+     * 1. lexical (`#lexicalConfine`) — rejects `../` / out-of-root absolute paths;
+     * 2. SYMLINK resolution (`canonicalizePath`) — follows every symlink component
+     *    (incl. a symlinked parent of a fresh write target) and re-checks
+     *    containment against the REAL path, defeating the classic symlink/TOCTOU
+     *    escape that a purely lexical check is blind to.
+     *
+     * @returns the symlink-resolved absolute path, or `null` when it escapes.
+     */
+    async #confine(path) {
+        const lexical = this.#lexicalConfine(path);
+        if (lexical === null)
+            return null;
+        const real = await canonicalizePath(lexical);
+        // Compare against the REAL root too, so a workspace whose own path traverses
+        // a symlink does not spuriously reject its own contained files.
+        const realRoot = await canonicalizePath(this.#root);
+        const rel = relative(realRoot, real);
+        // The REAL target must not climb out of the (also-real) root.
+        if (rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)))
+            return real;
+        return null;
+    }
+    // --- pure path arithmetic (no fs access) ---------------------------------
+    /** The workspace root (the in-process Pi run's working directory). */
+    cwd() {
+        return this.#root;
+    }
+    /** Resolve `path` to an absolute path anchored at the workspace root. */
+    absolutePath(path) {
+        return isAbsolute(path) ? resolvePath(path) : resolvePath(this.#root, path);
+    }
+    /** Join path segments (pure). */
+    joinPath(...segments) {
+        return resolvePath(this.#root, ...segments);
+    }
+    // --- file reads ----------------------------------------------------------
+    /** Read a file's text, confined to the workspace + guarded. */
+    async readTextFile(path) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const res = await this.#guard.readFileText({ path: abs });
+            return ok(res.content);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Read a file's text as an array of lines. */
+    async readTextLines(path) {
+        const res = await this.readTextFile(path);
+        return res.ok ? ok(res.value.split(/\r?\n/)) : res;
+    }
+    /**
+     * Binary read — DENIED in v0. The atomic `readFileText` primitive is
+     * text-only (`ReadFileInput.encoding` has no binary variant); a binary
+     * primitive must be added under `core/src/tools` (Gate 11) before this is
+     * supported. Deny-first: never reaches the filesystem.
+     */
+    async readBinaryFile(path) {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'binary read is not supported in v0', path);
+    }
+    // --- file writes ---------------------------------------------------------
+    /** Atomically write a file, confined to the workspace + guarded. */
+    async writeFile(path, content) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            await this.#guard.writeFileAtomic({ path: abs, content });
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /**
+     * Append to a file. The atomic surface offers only whole-file atomic writes,
+     * so this reads-then-writes the concatenation (still confined + guarded). A
+     * missing file is treated as empty.
+     *
+     * Confinement happens EXACTLY ONCE here, then the read + write delegate
+     * straight to the guard with the already-resolved `abs`. Re-entering the
+     * public `readTextFile`/`writeFile` would re-`#confine` the value `#confine`
+     * just returned — and because `#confine` yields the SYMLINK-RESOLVED real path
+     * (e.g. macOS `/tmp`→`/private/tmp`, or a symlinked workspace root), that real
+     * path is `../`-outside the lexical `workspaceRoot`, so the second lexical
+     * gate would spuriously reject it (`E_PI_FS_DENIED`). Reading once through the
+     * guard — whose own allowlist canonicalizes both sides — avoids the
+     * double-confine while keeping the symlink-escape denial intact.
+     */
+    async appendFile(path, content) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        // Read existing content directly via the guard (a missing file → ENOENT,
+        // treated as empty). Do NOT route through readTextFile: that would re-confine
+        // the resolved real path against the lexical root and falsely reject it.
+        let prefix = '';
+        try {
+            const res = await this.#guard.readFileText({ path: abs });
+            prefix = res.content;
+        }
+        catch (err) {
+            // A missing file is the only non-fatal case (append-creates). Any other
+            // failure (guard denial, permission, …) propagates as the Pi error.
+            if (!isMissingFileError(err))
+                return this.#toFsErr(err, abs);
+        }
+        try {
+            await this.#guard.writeFileAtomic({ path: abs, content: prefix + content });
+            return ok(undefined);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    // --- metadata ------------------------------------------------------------
+    /** Report whether a path is a file or directory, confined + guarded. */
+    async fileInfo(path) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const res = await this.#guard.pathExists({ path: abs });
+            if (!res.exists)
+                return fsErr('E_PI_FS_NOT_FOUND', 'path does not exist', abs);
+            return ok({ isFile: res.kind === 'file', isDirectory: res.kind === 'directory' });
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /** Whether a path exists, confined + guarded. */
+    async exists(path) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        try {
+            const res = await this.#guard.pathExists({ path: abs });
+            return ok(res.exists);
+        }
+        catch (err) {
+            return this.#toFsErr(err, abs);
+        }
+    }
+    /**
+     * Canonicalize a path inside the workspace. SYMLINK-RESOLVING: `#confine`
+     * follows every symlink component via `fs.realpath`, so the returned value is
+     * the REAL on-disk location (matching Pi's `NodeExecutionEnv.canonicalPath`
+     * contract), and a path whose real target escapes the workspace is denied.
+     */
+    async canonicalPath(path) {
+        const abs = await this.#confine(path);
+        if (abs === null)
+            return fsErr('E_PI_FS_DENIED', 'path escapes workspace boundary', path);
+        return ok(abs);
+    }
+    // --- denied fs-mutating / listing ops (no atomic primitive in v0) --------
+    /** DENIED in v0 — no `listDir` atomic primitive. */
+    async listDir(path) {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'directory listing is not supported in v0', path);
+    }
+    /** DENIED in v0 — no `createDir` atomic primitive. */
+    async createDir(path) {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'directory creation is not supported in v0', path);
+    }
+    /** DENIED in v0 — no `remove` atomic primitive. */
+    async remove(path) {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'remove is not supported in v0', path);
+    }
+    /** DENIED in v0 — no temp-dir atomic primitive. */
+    async createTempDir() {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'temp dir creation is not supported in v0');
+    }
+    /** DENIED in v0 — no temp-file atomic primitive. */
+    async createTempFile() {
+        return fsErr('E_PI_FS_UNSUPPORTED', 'temp file creation is not supported in v0');
+    }
+    // --- shell ---------------------------------------------------------------
+    /**
+     * Execute a command through the guard's shell surface (denylist applies). The
+     * Pi `command` string is a bare executable name (args are passed by Pi via the
+     * loop, but the v0 seam takes only `command`); we forward it as the guard's
+     * `command` with empty args. `cwd` is symlink-confined to the workspace.
+     *
+     * ## Env is SCRUBBED before it leaves this seam (T11897 · security)
+     *
+     * Pi's `options.env` is UNTRUSTED model-driven input. Forwarding it verbatim
+     * would let Pi set `LD_PRELOAD`/`NODE_OPTIONS`/`GIT_SSH_COMMAND` (arbitrary
+     * native code execution outside any allowlist) or hijack `PATH` to make a
+     * workspace-resident impostor satisfy an allowed command basename. So the env
+     * is run through {@link scrubSubprocessEnv} HERE — forbidden keys (loader
+     * hooks, `PATH`, secrets) are dropped and `PATH` is pinned to a trusted value
+     * — before it reaches the guard (which scrubs again as a redundant net, as
+     * does `defaultShellExecutor`). This also prevents the daemon's own secrets
+     * from leaking into the child (the scrubbed env never inherits `process.env`).
+     */
+    async exec(command, options) {
+        const cwd = options?.cwd ? await this.#confine(options.cwd) : this.#root;
+        if (cwd === null) {
+            return execErr('E_PI_EXEC_DENIED', 'cwd escapes workspace boundary');
+        }
+        // Scrub Pi-supplied env to a minimal allowlist at the seam (defense in depth
+        // — the guard + executor scrub again). Pi can NOT inject a loader hook,
+        // hijack PATH, or read inherited daemon secrets through this channel.
+        const env = scrubSubprocessEnv({ extra: options?.env });
+        try {
+            const res = await this.#guard.executeShell({
+                command,
+                cwd,
+                env,
+                ...(options?.timeout !== undefined ? { timeoutMs: options.timeout } : {}),
+            });
+            return ok({ stdout: res.stdout, stderr: res.stderr, exitCode: res.code });
+        }
+        catch (err) {
+            if (err instanceof GuardDeniedError) {
+                return execErr('E_PI_EXEC_DENIED', err.message);
+            }
+            const message = err instanceof Error ? err.message : String(err);
+            return execErr('E_PI_EXEC_FAILED', message);
+        }
+    }
+    // --- cleanup (best-effort, must not throw) -------------------------------
+    /** Best-effort cleanup; the guarded surface owns no resources, so a no-op. */
+    async cleanup() {
+        // no-op — required on both FileSystem + Shell; owns nothing to release.
+    }
+    // --- error mapping -------------------------------------------------------
+    /** Convert a thrown error from the guarded surface into a Pi `Result.err`. */
+    #toFsErr(err, path) {
+        if (err instanceof GuardDeniedError) {
+            return fsErr('E_PI_FS_DENIED', err.message, path);
+        }
+        const code = typeof err === 'object' && err !== null && 'code' in err
+            ? String(err.code)
+            : 'E_PI_FS_FAILED';
+        const message = err instanceof Error ? err.message : String(err);
+        return fsErr(code, message, path);
+    }
+}
+/**
+ * Thrown by {@link createGuardedExecutionEnv} when the injected guard is NOT in
+ * `enforce` mode. In `warn` mode the guard's path allowlist + command denylist
+ * are advisory (log-and-proceed), so the second confinement net does not exist
+ * and the boundary would collapse to the workspace check alone. The Pi adapter
+ * therefore REFUSES a non-enforce guard rather than running untrusted Pi work
+ * behind an advisory boundary.
+ */
+export class PiGuardModeError extends Error {
+    /** Machine-readable code. */
+    code = 'E_PI_GUARD_NOT_ENFORCING';
+    /**
+     * @param mode - The (non-enforce) mode the guard was constructed with.
+     */
+    constructor(mode) {
+        super(`Pi ExecutionEnv requires an enforce-mode ToolGuard; got "${mode}". ` +
+            'In warn mode the path allowlist + command denylist are advisory and provide no boundary.');
+        this.name = 'PiGuardModeError';
+    }
+}
+/**
+ * Construct a deny-first {@link GuardedExecutionEnv}.
+ *
+ * REQUIRES an `enforce`-mode guard: a `warn`-mode guard's allowlist/denylist are
+ * advisory, so handing untrusted Pi work behind one would leave confinement to
+ * the workspace boundary alone. The factory ASSERTS the mode and throws
+ * {@link PiGuardModeError} otherwise — the Pi adapter never silently degrades to
+ * an advisory boundary.
+ *
+ * @param deps - The guard surface + the workspace root to confine to.
+ * @returns A {@link PiExecutionEnv} safe to hand to Pi's agent loop.
+ * @throws {PiGuardModeError} When `deps.guard.mode !== 'enforce'`.
+ *
+ * @example
+ * ```ts
+ * const guard = createToolGuard({ allowedRoots: [projectRoot], mode: 'enforce' });
+ * const env = createGuardedExecutionEnv({ guard, workspaceRoot: projectRoot });
+ * ```
+ */
+export function createGuardedExecutionEnv(deps) {
+    if (deps.guard.mode !== 'enforce') {
+        throw new PiGuardModeError(deps.guard.mode);
+    }
+    return new GuardedExecutionEnv(deps);
+}
+//# sourceMappingURL=pi-execution-env.js.map

package/dist/llm/pi/pi-execution-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-execution-env.js","sourceRoot":"","sources":["../../../src/llm/pi/pi-execution-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAkC,MAAM,sBAAsB,CAAC;AAyGxF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,2CAA2C;AAC3C,SAAS,EAAE,CAAI,KAAQ;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,kEAAkE;AAClE,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe,EAAE,IAAa;IACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,uEAAuE;AACvE,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAY;IAClB,KAAK,CAAS;IAEvB;;OAEG;IACH,YAAY,IAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,8DAA8D;QAC9D,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAE5E,sEAAsE;IACtE,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,YAAY,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,iCAAiC;IACjC,QAAQ,CAAC,GAAG,QAAkB;QAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,4EAA4E;IAE5E,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,OAAO,KAAK,CAAC,qBAAqB,EAAE,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,4EAA4E;IAE5E,oEAAoE;IACpE,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAe;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,yEAAyE;QACzE,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,wEAAwE;IACxE,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC;QAC1F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,4EAA4E;IAE5E,oDAAoD;IACpD,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,KAAK,CAAC,qBAAqB,EAAE,0CAA0C,EAAE,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,OAAO,KAAK,CAAC,qBAAqB,EAAE,2CAA2C,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,KAAK,CAAC,qBAAqB,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,aAAa;QACjB,OAAO,KAAK,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAClF,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,cAAc;QAClB,OAAO,KAAK,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAAuB;QAEvB,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACzE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBACzC,OAAO;gBACP,GAAG;gBACH,GAAG;gBACH,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,8EAA8E;IAC9E,KAAK,CAAC,OAAO;QACX,wEAAwE;IAC1E,CAAC;IAED,4EAA4E;IAE5E,8EAA8E;IAC9E,QAAQ,CAAC,GAAY,EAAE,IAAY;QACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG;YACtD,CAAC,CAAC,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,gBAAgB,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,6BAA6B;IACpB,IAAI,GAAG,0BAA0B,CAAC;IAC3C;;OAEG;IACH,YAAY,IAAe;QACzB,KAAK,CACH,4DAA4D,IAAI,KAAK;YACnE,0FAA0F,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA6B;IACrE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}