@connexum/ai-governance 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/esm/cli/governance-projection-writer.js

@@ -0,0 +1,253 @@
+/**
+ * Governance-projection writer — write-back RFC F2 (§3.1, §4, §10.C).
+ *
+ * The downward half of the loop: after the identity/token passes, `sync`
+ * fetches each agent's effective-governance projection from
+ * GET /api/v1/cli/agent-governance and writes
+ *
+ *   <agent>/.connexum/governance.json   machine-readable projection (3.1)
+ *   <agent>/.connexum/GOVERNANCE.md     human/LLM-readable rendering (3.2)
+ *
+ * Both files are DERIVED, REGENERABLE, SECRET-FREE — safe to commit, never
+ * hand-edited.
+ *
+ * File semantics (normative, §10.C):
+ *  - All writes are atomic (temp → renameSync). No chmod — non-secret.
+ *  - checksum covers the canonical POLICY body only (shared module —
+ *    generatedAt/score/version/staleAfter excluded), so a score refresh or
+ *    re-sync of unchanged policy never perturbs hand-edit detection.
+ *  - Existing file whose stored checksum mismatches its own body ⇒ HAND-EDITED
+ *    ⇒ WARN + skip, never clobber (W4). An ABSENT file (user deleted) is
+ *    written fresh without WARN — absent ≠ hand-edited.
+ *  - Unchanged policy (new checksum === pristine existing checksum) ⇒ skip the
+ *    rewrite entirely: byte-identical files (W6) and generatedAt keeps meaning
+ *    "when the policy last changed".
+ *  - Fetch failure ⇒ caller never reaches the writer ⇒ prior files retained
+ *    (Invariant 2 — never delete on failure).
+ *
+ * Traversal guard is REUSED from per-folder-identity.ts (Shield S-W2) — the
+ * same realpath-compared guard B1 writes identities through.
+ *
+ * @connexum/ai-governance  governance-writeback-f2
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { spawnSync } from 'child_process';
+import { resolveGuardedAgentFolder } from './per-folder-identity.js';
+import { pickCanonicalPolicyBody, computeProjectionChecksum, computeProjectionVersion, } from '../governance/governance-projection-canonical.js';
+import { renderGovernanceMd } from './governance-md-renderer.js';
+/**
+ * Fetch the batch governance projection. Same transport posture as the token
+ * fetch in sync.ts: HTTPS via curl, Authorization in a 0600 tmpfile (never on
+ * argv), NEVER throws — server unreachable returns {agents:null} and the
+ * caller leaves prior files intact (Invariant 2/3).
+ */
+export function fetchAgentGovernance(govServerUrl, installToken, timeoutSec = 15) {
+    const url = `${govServerUrl.replace(/\/$/, '')}/api/v1/cli/agent-governance`;
+    let authTmpFile = null;
+    try {
+        const tmpDir = process.env['TMPDIR'] || process.env['TMP'] || process.env['TEMP'] || '/tmp';
+        const tmpPath = path.join(tmpDir, `gov-proj-auth-${crypto.randomBytes(8).toString('hex')}.hdr`);
+        fs.writeFileSync(tmpPath, `Authorization: Bearer ${installToken}\n`, { mode: 0o600 });
+        try {
+            fs.chmodSync(tmpPath, 0o600);
+        }
+        catch { /* best-effort on Windows */ }
+        authTmpFile = tmpPath;
+    }
+    catch {
+        console.warn('[gov-sync] WARNING: auth tmpfile write failed; falling back to token-on-argv (less secure). Check TMPDIR permissions.');
+        authTmpFile = null;
+    }
+    const authArgs = authTmpFile
+        ? ['-H', `@${authTmpFile}`]
+        : ['-H', `Authorization: Bearer ${installToken}`];
+    try {
+        const result = spawnSync('curl', [
+            '--silent', '--show-error',
+            '--max-time', String(timeoutSec),
+            '--connect-timeout', '5',
+            '--fail-with-body',
+            ...authArgs,
+            '-H', 'Accept: application/json',
+            url,
+        ], { encoding: 'utf8', timeout: (timeoutSec + 5) * 1000 });
+        if (result.status !== 0) {
+            const detail = result.stderr?.trim() || `curl exit ${result.status}`;
+            return { agents: null, error: `Governance projection fetch failed: ${detail}` };
+        }
+        if (!result.stdout)
+            return { agents: null, error: 'Empty response from server.' };
+        let parsed;
+        try {
+            parsed = JSON.parse(result.stdout);
+        }
+        catch {
+            return { agents: null, error: 'Could not parse governance response as JSON.' };
+        }
+        const obj = parsed;
+        if (typeof obj?.['error'] === 'string')
+            return { agents: null, error: `Server error: ${obj['error']}` };
+        if (!Array.isArray(obj?.['agents']))
+            return { agents: null, error: 'Server response missing agents[].' };
+        const agents = [];
+        for (const a of obj['agents']) {
+            const e = a;
+            if (typeof e?.['agentId'] === 'string' &&
+                e?.['effectiveGovernance'] && typeof e['effectiveGovernance'] === 'object' &&
+                e?.['scoreSummary'] && typeof e['scoreSummary'] === 'object' &&
+                typeof e?.['projectionVersion'] === 'string') {
+                agents.push({
+                    agentId: e['agentId'],
+                    effectiveGovernance: e['effectiveGovernance'],
+                    scoreSummary: e['scoreSummary'],
+                    projectionVersion: e['projectionVersion'],
+                });
+            }
+        }
+        const staleRaw = obj['staleAfterDays'];
+        return {
+            agents,
+            staleAfterDays: typeof staleRaw === 'number' && Number.isFinite(staleRaw) ? staleRaw : 7,
+        };
+    }
+    catch (err) {
+        return { agents: null, error: `Request failed: ${err.message}` };
+    }
+    finally {
+        if (authTmpFile) {
+            try {
+                fs.unlinkSync(authTmpFile);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+}
+const SCHEMA_VERSION = '1.0';
+/** Compose the full governance.json file object for one agent (RFC §3.1). */
+function buildFileObject(input, generatedAt, staleAfter) {
+    const policy = pickCanonicalPolicyBody({
+        ...input.effectiveGovernance,
+        agentId: input.agentId,
+    });
+    const checksum = computeProjectionChecksum(policy);
+    return {
+        schemaVersion: SCHEMA_VERSION,
+        generated: true,
+        generatedAt,
+        staleAfter,
+        effectiveGovernanceVersion: input.projectionVersion,
+        ...policy,
+        score: { ...input.scoreSummary },
+        checksum,
+    };
+}
+/**
+ * Write governance.json + GOVERNANCE.md into each agent's .connexum/ folder.
+ * Never throws (Invariant 2): every failure is a per-agent skip + advisory.
+ */
+export function writeGovernanceProjections(projectDir, inputs, opts = {}) {
+    const warn = opts.warn ?? ((m) => console.warn(m));
+    const result = { written: [], unchanged: [], skipped: [] };
+    if (inputs.length === 0)
+        return result;
+    const generatedAt = opts.generatedAt ?? new Date().toISOString();
+    const staleDays = Math.min(Math.max(1, Math.floor(opts.staleAfterDays ?? 7)), 30);
+    const staleAfter = new Date(Date.parse(generatedAt) + staleDays * 24 * 3600 * 1000).toISOString();
+    for (const input of inputs) {
+        // Same realpath traversal guard as B1 (Shield S-W2 reuse requirement).
+        const guarded = resolveGuardedAgentFolder(projectDir, input.filePath);
+        if (!guarded.folder) {
+            result.skipped.push({ agentId: input.agentId, reason: guarded.error ?? 'path-traversal: folder outside project root' });
+            warn(`[connexum] governance projection skipped for ${input.agentId}: resolved folder escapes project root (${input.filePath})`);
+            continue;
+        }
+        try {
+            const dir = path.join(guarded.folder, '.connexum');
+            const jsonFile = path.join(dir, 'governance.json');
+            const mdFile = path.join(dir, 'GOVERNANCE.md');
+            const fileObj = buildFileObject(input, generatedAt, staleAfter);
+            const newChecksum = fileObj['checksum'];
+            // Hand-edit / unchanged detection against the existing file (W4/W6).
+            let existingPristineChecksum = null;
+            if (fs.existsSync(jsonFile)) {
+                let handEdited = true;
+                try {
+                    const existing = JSON.parse(fs.readFileSync(jsonFile, 'utf-8'));
+                    const recomputed = computeProjectionChecksum(pickCanonicalPolicyBody(existing));
+                    if (typeof existing['checksum'] === 'string' && existing['checksum'] === recomputed) {
+                        handEdited = false;
+                        existingPristineChecksum = recomputed;
+                    }
+                }
+                catch {
+                    // unparseable ⇒ treat as hand-edited: clobbering an operator's file
+                    // is the harm the guard exists to prevent.
+                }
+                if (handEdited) {
+                    result.skipped.push({ agentId: input.agentId, reason: 'hand-edited: checksum mismatch on existing governance.json' });
+                    warn(`[connexum] governance.json for ${input.agentId} differs from its recorded checksum — it was edited by hand. Leaving it (and GOVERNANCE.md) untouched. Delete the file and re-run sync to regenerate.`);
+                    continue;
+                }
+            }
+            // Pristine + same policy ⇒ nothing to do (byte-identical idempotency).
+            if (existingPristineChecksum === newChecksum && fs.existsSync(mdFile)) {
+                result.unchanged.push(input.agentId);
+                continue;
+            }
+            fs.mkdirSync(dir, { recursive: true });
+            // When policy is unchanged but GOVERNANCE.md is missing, re-render from
+            // the EXISTING file's timestamps so governance.json stays byte-identical.
+            // Stern C-1 (PR #1716 review): the stored score block is OUR write, but
+            // guard its shape anyway — a malformed score falls back to the freshly
+            // fetched fileObj (json then gets rewritten, which is the safe direction).
+            let effective = fileObj;
+            if (existingPristineChecksum === newChecksum) {
+                const stored = JSON.parse(fs.readFileSync(jsonFile, 'utf-8'));
+                const storedScore = stored['score'];
+                if (storedScore && typeof storedScore['band'] === 'string' && Array.isArray(storedScore['openFindings'])) {
+                    effective = stored;
+                }
+            }
+            if (existingPristineChecksum !== newChecksum) {
+                atomicWrite(jsonFile, `${JSON.stringify(fileObj, null, 2)}\n`);
+            }
+            const md = renderGovernanceMd({
+                policy: pickCanonicalPolicyBody(effective),
+                score: effective['score'],
+                generatedAt: String(effective['generatedAt']),
+                staleAfter: String(effective['staleAfter']),
+                effectiveGovernanceVersion: String(effective['effectiveGovernanceVersion']),
+            });
+            atomicWrite(mdFile, md.endsWith('\n') ? md : `${md}\n`);
+            result.written.push(input.agentId);
+        }
+        catch (err) {
+            result.skipped.push({ agentId: input.agentId, reason: `write-failed: ${err.message}` });
+            warn(`[connexum] governance projection write failed for ${input.agentId}: ${err.message}`);
+        }
+    }
+    return result;
+}
+/** Atomic non-secret write: temp → rename (POSIX-atomic replace).
+ * Shield Condition-2 (PR #1716 review): clear any orphaned .tmp left by a
+ * crash between write and rename on a prior run, so .connexum/ never
+ * accumulates stale files an operator could mistake for current data. */
+function atomicWrite(file, content) {
+    const tmp = `${file}.tmp`;
+    try {
+        fs.unlinkSync(tmp);
+    }
+    catch { /* no orphan */ }
+    fs.writeFileSync(tmp, content);
+    fs.renameSync(tmp, file);
+}
+/**
+ * Sanity re-export so callers can verify a projection version locally without
+ * importing the canonical module path directly.
+ */
+export function computeLocalProjectionVersion(policy) {
+    return computeProjectionVersion(policy);
+}
+//# sourceMappingURL=governance-projection-writer.js.map

package/dist/esm/cli/governance-projection-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-projection-writer.js","sourceRoot":"","sources":["../../../src/cli/governance-projection-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,GAEzB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAA2B,MAAM,6BAA6B,CAAC;AAgB1F;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,YAAoB,EACpB,UAAU,GAAG,EAAE;IAEf,MAAM,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC;IAE7E,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,yBAAyB,YAAY,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC5E,WAAW,GAAG,OAAO,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,uHAAuH,CAAC,CAAC;QACtI,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,QAAQ,GAAa,WAAW;QACpC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,IAAI,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CACtB,MAAM,EACN;YACE,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;YAChC,mBAAmB,EAAE,GAAG;YACxB,kBAAkB;YAClB,GAAG,QAAQ;YACX,IAAI,EAAE,0BAA0B;YAChC,GAAG;SACJ,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CACvD,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,MAAM,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAElF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAC3C,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAAC,CAAC;QAEzF,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,IAAI,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QAEzG,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAc,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;YACvC,IACE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ;gBAClC,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,CAAC,qBAAqB,CAAC,KAAK,QAAQ;gBAC1E,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAC5D,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,EAC5C,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,CAAC,CAAC,SAAS,CAAW;oBAC/B,mBAAmB,EAAE,CAAC,CAAC,qBAAqB,CAAyB;oBACrE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAuB;oBACrD,iBAAiB,EAAE,CAAC,CAAC,mBAAmB,CAAW;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvC,OAAO;YACL,MAAM;YACN,cAAc,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AA0BD,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B,6EAA6E;AAC7E,SAAS,eAAe,CACtB,KAAoC,EACpC,WAAmB,EACnB,UAAkB;IAElB,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACrC,GAAI,KAAK,CAAC,mBAA0D;QACpE,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO;QACL,aAAa,EAAE,cAAc;QAC7B,SAAS,EAAE,IAAI;QACf,WAAW;QACX,UAAU;QACV,0BAA0B,EAAE,KAAK,CAAC,iBAAiB;QACnD,GAAI,MAA6C;QACjD,KAAK,EAAE,EAAE,GAAI,KAAK,CAAC,YAAmD,EAAE;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,MAAuC,EACvC,OAA0C,EAAE;IAE5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAqC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAElG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,uEAAuE;QACvE,MAAM,OAAO,GAAG,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,6CAA6C,EAAE,CAAC,CAAC;YACxH,IAAI,CAAC,gDAAgD,KAAK,CAAC,OAAO,2CAA2C,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;YAChI,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAW,CAAC;YAElD,qEAAqE;YACrE,IAAI,wBAAwB,GAAkB,IAAI,CAAC;YACnD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,IAAI,UAAU,GAAG,IAAI,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;oBAC3F,MAAM,UAAU,GAAG,yBAAyB,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChF,IAAI,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;wBACpF,UAAU,GAAG,KAAK,CAAC;wBACnB,wBAAwB,GAAG,UAAU,CAAC;oBACxC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,2CAA2C;gBAC7C,CAAC;gBACD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC,CAAC;oBACtH,IAAI,CAAC,kCAAkC,KAAK,CAAC,OAAO,uJAAuJ,CAAC,CAAC;oBAC7M,SAAS;gBACX,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,IAAI,wBAAwB,KAAK,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,2EAA2E;YAC3E,IAAI,SAAS,GAA4B,OAAO,CAAC;YACjD,IAAI,wBAAwB,KAAK,WAAW,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;gBACzF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAwC,CAAC;gBAC3E,IAAI,WAAW,IAAI,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACzG,SAAS,GAAG,MAAM,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,IAAI,wBAAwB,KAAK,WAAW,EAAE,CAAC;gBAC7C,WAAW,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,EAAE,GAAG,kBAAkB,CAAC;gBAC5B,MAAM,EAAE,uBAAuB,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE,SAAS,CAAC,OAAO,CAAuB;gBAC/C,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC7C,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC3C,0BAA0B,EAAE,MAAM,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;aAC5E,CAAC,CAAC;YACH,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,qDAAqD,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;yEAGyE;AACzE,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA4B;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}