@didim365/agent-cli-core 0.1.0

package/dist/src/policy/shell-safety.test.js

@@ -0,0 +1,438 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+// Mock shell-utils to avoid relying on tree-sitter WASM which is flaky in CI on Windows
+vi.mock('../utils/shell-utils.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    // Static map of test commands to their expected subcommands
+    // This mirrors what the real parser would output for these specific strings
+    const commandMap = {
+        'git log': ['git log'],
+        'git log --oneline': ['git log --oneline'],
+        'git logout': ['git logout'],
+        'git log && rm -rf /': ['git log', 'rm -rf /'],
+        'git log; rm -rf /': ['git log', 'rm -rf /'],
+        'git log || rm -rf /': ['git log', 'rm -rf /'],
+        'git log &&& rm -rf /': [], // Simulates parse failure
+        'echo $(rm -rf /)': ['echo $(rm -rf /)', 'rm -rf /'],
+        'echo $(git log)': ['echo $(git log)', 'git log'],
+        'echo `rm -rf /`': ['echo `rm -rf /`', 'rm -rf /'],
+        'diff <(git log) <(rm -rf /)': [
+            'diff <(git log) <(rm -rf /)',
+            'git log',
+            'rm -rf /',
+        ],
+        'tee >(rm -rf /)': ['tee >(rm -rf /)', 'rm -rf /'],
+        'git log | rm -rf /': ['git log', 'rm -rf /'],
+        'git log --format=$(rm -rf /)': [
+            'git log --format=$(rm -rf /)',
+            'rm -rf /',
+        ],
+        'git log && echo $(git log | rm -rf /)': [
+            'git log',
+            'echo $(git log | rm -rf /)',
+            'git log',
+            'rm -rf /',
+        ],
+        'git log && echo $(git log)': ['git log', 'echo $(git log)', 'git log'],
+        'git log > /tmp/test': ['git log > /tmp/test'],
+        'git log @(Get-Process)': [], // Simulates parse failure (Bash parser vs PowerShell syntax)
+        'git commit -m "msg" && git push': ['git commit -m "msg"', 'git push'],
+        'git status && unknown_command': ['git status', 'unknown_command'],
+        'unknown_command_1 && another_unknown_command': [
+            'unknown_command_1',
+            'another_unknown_command',
+        ],
+        'known_ask_command_1 && known_ask_command_2': [
+            'known_ask_command_1',
+            'known_ask_command_2',
+        ],
+    };
+    return {
+        ...actual,
+        initializeShellParsers: vi.fn(),
+        splitCommands: (command) => {
+            if (Object.prototype.hasOwnProperty.call(commandMap, command)) {
+                return commandMap[command];
+            }
+            const known = commandMap[command];
+            if (known)
+                return known;
+            // Default fallback for unmatched simple cases in development, but explicit map is better
+            return [command];
+        },
+        hasRedirection: (command) => 
+        // Simple regex check sufficient for testing the policy engine's handling of the *result* of hasRedirection
+        /[><]/.test(command),
+    };
+});
+import { PolicyEngine } from './policy-engine.js';
+import { PolicyDecision, ApprovalMode } from './types.js';
+import { buildArgsPatterns } from './utils.js';
+describe('Shell Safety Policy', () => {
+    let policyEngine;
+    // Helper to create a policy engine with a simple command prefix rule
+    function createPolicyEngineWithPrefix(prefix) {
+        const argsPatterns = buildArgsPatterns(undefined, prefix, undefined);
+        // Since buildArgsPatterns returns array of patterns (strings), we pick the first one
+        // and compile it.
+        const argsPattern = new RegExp(argsPatterns[0]);
+        return new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 1.01,
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+            approvalMode: ApprovalMode.DEFAULT,
+        });
+    }
+    beforeEach(() => {
+        policyEngine = createPolicyEngineWithPrefix('git log');
+    });
+    it('SHOULD match "git log" exactly', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ALLOW);
+    });
+    it('SHOULD match "git log" with arguments', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log --oneline' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ALLOW);
+    });
+    it('SHOULD NOT match "git logout" when prefix is "git log" (strict word boundary)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git logout' },
+        };
+        // Desired behavior: Should NOT match "git log" prefix.
+        // If it doesn't match, it should fall back to default decision (ASK_USER).
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow "git log && rm -rf /" completely when prefix is "git log" (compound command safety)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log && rm -rf /' },
+        };
+        // Desired behavior: Should inspect all parts. "rm -rf /" is not allowed.
+        // The "git log" part is ALLOW, but "rm -rf /" is ASK_USER (default).
+        // Aggregate should be ASK_USER.
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow "git log; rm -rf /" (semicolon separator)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log; rm -rf /' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow "git log || rm -rf /" (OR separator)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log || rm -rf /' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow "git log &&& rm -rf /" when prefix is "git log" (parse failure)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log &&& rm -rf /' },
+        };
+        // Desired behavior: Should fail safe (ASK_USER or DENY) because parsing failed.
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow command substitution $(rm -rf /)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'echo $(rm -rf /)' },
+        };
+        // `splitCommands` recursively finds nested commands (e.g., `rm` inside `echo $()`).
+        // The policy engine requires ALL extracted commands to be allowed.
+        // Since `rm` does not match the allowed prefix, this should result in ASK_USER.
+        const echoPolicy = createPolicyEngineWithPrefix('echo');
+        const result = await echoPolicy.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD allow command substitution if inner command is ALSO allowed', async () => {
+        // Both `echo` and `git` allowed.
+        const argsPatternsEcho = buildArgsPatterns(undefined, 'echo', undefined);
+        const argsPatternsGit = buildArgsPatterns(undefined, 'git', undefined); // Allow all git
+        const policyEngineWithBoth = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsEcho[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                },
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsGit[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'echo $(git log)' },
+        };
+        const result = await policyEngineWithBoth.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ALLOW);
+    });
+    it('SHOULD NOT allow command substitution with backticks `rm -rf /`', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'echo `rm -rf /`' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow process substitution <(rm -rf /)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'diff <(git log) <(rm -rf /)' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow process substitution >(rm -rf /)', async () => {
+        // Note: >(...) is output substitution, but syntax is similar.
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'tee >(rm -rf /)' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow piped commands "git log | rm -rf /"', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log | rm -rf /' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow argument injection via --arg=$(rm -rf /)', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log --format=$(rm -rf /)' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD NOT allow complex nested commands "git log && echo $(git log | rm -rf /)"', async () => {
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log && echo $(git log | rm -rf /)' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD allow complex allowed commands "git log && echo $(git log)"', async () => {
+        // Both `echo` and `git` allowed.
+        const argsPatternsEcho = buildArgsPatterns(undefined, 'echo', undefined);
+        const argsPatternsGit = buildArgsPatterns(undefined, 'git', undefined);
+        const policyEngineWithBoth = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsEcho[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                },
+                {
+                    toolName: 'run_shell_command',
+                    // Matches "git" at start of *subcommand*
+                    argsPattern: new RegExp(argsPatternsGit[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log && echo $(git log)' },
+        };
+        const result = await policyEngineWithBoth.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ALLOW);
+    });
+    it('SHOULD NOT allow generic redirection > /tmp/test', async () => {
+        // Current logic downgrades ALLOW to ASK_USER for redirections if redirection is not explicitly allowed.
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log > /tmp/test' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD allow generic redirection > /tmp/test if allowRedirection is true', async () => {
+        // If PolicyRule has allowRedirection: true, it should stay ALLOW
+        const argsPatternsGitLog = buildArgsPatterns(undefined, 'git log', undefined);
+        const policyWithRedirection = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsGitLog[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                    allowRedirection: true,
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log > /tmp/test' },
+        };
+        const result = await policyWithRedirection.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ALLOW);
+    });
+    it('SHOULD NOT allow PowerShell @(...) usage if it implies code execution', async () => {
+        // Bash parser fails on PowerShell syntax @(...) (returns empty subcommands).
+        // The policy engine correctly identifies this as unparseable and falls back to ASK_USER.
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git log @(Get-Process)' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+    });
+    it('SHOULD match DENY rule even if nested/chained with unknown command', async () => {
+        // Scenario:
+        // git commit -m "..." (Unknown/No Rule -> ASK_USER)
+        // git push (DENY -> DENY)
+        // Overall should be DENY.
+        const argsPatternsPush = buildArgsPatterns(undefined, 'git push', undefined);
+        const denyPushPolicy = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsPush[0]),
+                    decision: PolicyDecision.DENY,
+                    priority: 2,
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git commit -m "msg" && git push' },
+        };
+        const result = await denyPushPolicy.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.DENY);
+    });
+    it('SHOULD aggregate ALLOW + ASK_USER to ASK_USER and blame the ASK_USER part', async () => {
+        // Scenario:
+        // `git status` (ALLOW) && `unknown_command` (ASK_USER by default)
+        // Expected: ASK_USER, and the matched rule should be related to the unknown_command
+        const argsPatternsGitStatus = buildArgsPatterns(undefined, 'git status', undefined);
+        const policyEngine = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsGitStatus[0]),
+                    decision: PolicyDecision.ALLOW,
+                    priority: 2,
+                    name: 'allow_git_status_rule', // Give a name to easily identify
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'git status && unknown_command' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+        // Expect the matched rule to be null/undefined since it's the default decision for 'unknown_command'
+        // or the rule that led to the ASK_USER decision. In this case, it should be the rule for 'unknown_command', which is the default decision.
+        // The policy engine's `matchedRule` will be the rule that caused the final decision.
+        // If it's a default ASK_USER, then `result.rule` should be undefined.
+        expect(result.rule).toBeUndefined();
+    });
+    it('SHOULD aggregate ASK_USER (default) + ASK_USER (rule) to ASK_USER and blame the specific ASK_USER rule', async () => {
+        // Scenario:
+        // `unknown_command_1` (ASK_USER by default) && `another_unknown_command` (ASK_USER by explicit rule)
+        // Expected: ASK_USER, and the matched rule should be the explicit ASK_USER rule
+        const argsPatternsAnotherUnknown = buildArgsPatterns(undefined, 'another_unknown_command', undefined);
+        const policyEngine = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsAnotherUnknown[0]),
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 2,
+                    name: 'ask_another_unknown_command_rule',
+                },
+            ],
+            defaultDecision: PolicyDecision.ASK_USER,
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'unknown_command_1 && another_unknown_command' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+        // The first command triggers default ASK_USER (undefined rule).
+        // The second triggers explicit ASK_USER rule.
+        // We attribute to the first cause => undefined.
+        expect(result.rule).toBeUndefined();
+    });
+    it('SHOULD aggregate ASK_USER (rule) + ASK_USER (rule) to ASK_USER and blame the first specific ASK_USER rule in subcommands', async () => {
+        // Scenario:
+        // `known_ask_command_1` (ASK_USER by explicit rule 1) && `known_ask_command_2` (ASK_USER by explicit rule 2)
+        // Expected: ASK_USER, and the matched rule should be explicit ASK_USER rule 1.
+        // The current implementation prioritizes the rule that changes the decision to ASK_USER, if any.
+        // If multiple rules lead to ASK_USER, it takes the first one.
+        const argsPatternsAsk1 = buildArgsPatterns(undefined, 'known_ask_command_1', undefined);
+        const argsPatternsAsk2 = buildArgsPatterns(undefined, 'known_ask_command_2', undefined);
+        const policyEngine = new PolicyEngine({
+            rules: [
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsAsk1[0]),
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 2,
+                    name: 'ask_rule_1',
+                },
+                {
+                    toolName: 'run_shell_command',
+                    argsPattern: new RegExp(argsPatternsAsk2[0]),
+                    decision: PolicyDecision.ASK_USER,
+                    priority: 2,
+                    name: 'ask_rule_2',
+                },
+            ],
+            defaultDecision: PolicyDecision.ALLOW, // Set default to ALLOW to ensure rules are hit
+        });
+        const toolCall = {
+            name: 'run_shell_command',
+            args: { command: 'known_ask_command_1 && known_ask_command_2' },
+        };
+        const result = await policyEngine.check(toolCall, undefined);
+        expect(result.decision).toBe(PolicyDecision.ASK_USER);
+        // Expect the rule that first caused ASK_USER to be blamed
+        expect(result.rule?.name).toBe('ask_rule_1');
+    });
+});
+//# sourceMappingURL=shell-safety.test.js.map

package/dist/src/policy/shell-safety.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-safety.test.js","sourceRoot":"","sources":["../../../src/policy/shell-safety.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,wFAAwF;AACxF,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1D,MAAM,MAAM,GACV,MAAM,cAAc,EAA4C,CAAC;IAEnE,4DAA4D;IAC5D,4EAA4E;IAC5E,MAAM,UAAU,GAA6B;QAC3C,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,mBAAmB,EAAE,CAAC,mBAAmB,CAAC;QAC1C,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,qBAAqB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9C,mBAAmB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC5C,qBAAqB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9C,sBAAsB,EAAE,EAAE,EAAE,0BAA0B;QACtD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC;QACpD,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,SAAS,CAAC;QACjD,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,UAAU,CAAC;QAClD,6BAA6B,EAAE;YAC7B,6BAA6B;YAC7B,SAAS;YACT,UAAU;SACX;QACD,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,UAAU,CAAC;QAClD,oBAAoB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC7C,8BAA8B,EAAE;YAC9B,8BAA8B;YAC9B,UAAU;SACX;QACD,uCAAuC,EAAE;YACvC,SAAS;YACT,4BAA4B;YAC5B,SAAS;YACT,UAAU;SACX;QACD,4BAA4B,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC;QACvE,qBAAqB,EAAE,CAAC,qBAAqB,CAAC;QAC9C,wBAAwB,EAAE,EAAE,EAAE,6DAA6D;QAC3F,iCAAiC,EAAE,CAAC,qBAAqB,EAAE,UAAU,CAAC;QACtE,+BAA+B,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC;QAClE,8CAA8C,EAAE;YAC9C,mBAAmB;YACnB,yBAAyB;SAC1B;QACD,4CAA4C,EAAE;YAC5C,qBAAqB;YACrB,qBAAqB;SACtB;KACF,CAAC;IAEF,OAAO;QACL,GAAG,MAAM;QACT,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC/B,aAAa,EAAE,CAAC,OAAe,EAAE,EAAE;YACjC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,yFAAyF;YACzF,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,cAAc,EAAE,CAAC,OAAe,EAAE,EAAE;QAClC,2GAA2G;QAC3G,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;KACvB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,YAA0B,CAAC;IAE/B,qEAAqE;IACrE,SAAS,4BAA4B,CAAC,MAAc;QAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACrE,qFAAqF;QACrF,kBAAkB;QAClB,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;QAEjD,OAAO,IAAI,YAAY,CAAC;YACtB,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW;oBACX,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,IAAI;iBACf;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;YACxC,YAAY,EAAE,YAAY,CAAC,OAAO;SACnC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SAChC,CAAC;QAEF,uDAAuD;QACvD,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;SACzC,CAAC;QAEF,yEAAyE;QACzE,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;SAC1C,CAAC;QAEF,gFAAgF;QAChF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE;SACtC,CAAC;QACF,oFAAoF;QACpF,mEAAmE;QACnE,gFAAgF;QAChF,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,iCAAiC;QACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB;QAExF,MAAM,oBAAoB,GAAG,IAAI,YAAY,CAAC;YAC5C,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC;oBAC7C,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;iBACZ;gBACD;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC;oBAC5C,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;iBACZ;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACrC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACrC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE;SACjD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,8DAA8D;QAC9D,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SACrC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE;SACxC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE;SAClD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE;SAC3D,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,iCAAiC;QACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAEvE,MAAM,oBAAoB,GAAG,IAAI,YAAY,CAAC;YAC5C,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC;oBAC7C,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;iBACZ;gBACD;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,yCAAyC;oBACzC,WAAW,EAAE,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC;oBAC5C,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;iBACZ;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAChD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,wGAAwG;QACxG,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,iBAAiB,CAC1C,SAAS,EACT,SAAS,EACT,SAAS,CACV,CAAC;QACF,MAAM,qBAAqB,GAAG,IAAI,YAAY,CAAC;YAC7C,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAE,CAAC;oBAC/C,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;oBACX,gBAAgB,EAAE,IAAI;iBACvB;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,6EAA6E;QAC7E,yFAAyF;QACzF,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;SAC5C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,YAAY;QACZ,oDAAoD;QACpD,0BAA0B;QAC1B,0BAA0B;QAC1B,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,SAAS,EACT,UAAU,EACV,SAAS,CACV,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,YAAY,CAAC;YACtC,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC;oBAC7C,QAAQ,EAAE,cAAc,CAAC,IAAI;oBAC7B,QAAQ,EAAE,CAAC;iBACZ;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;SACrD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,YAAY;QACZ,kEAAkE;QAClE,oFAAoF;QACpF,MAAM,qBAAqB,GAAG,iBAAiB,CAC7C,SAAS,EACT,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAE,CAAC;oBAClD,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,CAAC;oBACX,IAAI,EAAE,uBAAuB,EAAE,iCAAiC;iBACjE;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE;SACnD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtD,qGAAqG;QACrG,2IAA2I;QAC3I,qFAAqF;QACrF,sEAAsE;QACtE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,YAAY;QACZ,qGAAqG;QACrG,gFAAgF;QAChF,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,SAAS,EACT,yBAAyB,EACzB,SAAS,CACV,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAE,CAAC;oBACvD,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,QAAQ,EAAE,CAAC;oBACX,IAAI,EAAE,kCAAkC;iBACzC;aACF;YACD,eAAe,EAAE,cAAc,CAAC,QAAQ;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE;SAClE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtD,gEAAgE;QAChE,8CAA8C;QAC9C,gDAAgD;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0HAA0H,EAAE,KAAK,IAAI,EAAE;QACxI,YAAY;QACZ,6GAA6G;QAC7G,+EAA+E;QAC/E,iGAAiG;QACjG,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,SAAS,EACT,qBAAqB,EACrB,SAAS,CACV,CAAC;QACF,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,SAAS,EACT,qBAAqB,EACrB,SAAS,CACV,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;YACpC,KAAK,EAAE;gBACL;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC;oBAC7C,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,QAAQ,EAAE,CAAC;oBACX,IAAI,EAAE,YAAY;iBACnB;gBACD;oBACE,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC;oBAC7C,QAAQ,EAAE,cAAc,CAAC,QAAQ;oBACjC,QAAQ,EAAE,CAAC;oBACX,IAAI,EAAE,YAAY;iBACnB;aACF;YACD,eAAe,EAAE,cAAc,CAAC,KAAK,EAAE,+CAA+C;SACvF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAiB;YAC7B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE;SAChE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtD,0DAA0D;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/policy/stable-stringify.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Produces a stable, deterministic JSON string representation with sorted keys.
+ *
+ * This method is critical for security policy matching. It ensures that the same
+ * object always produces the same string representation, regardless of property
+ * insertion order, which could vary across different JavaScript engines or
+ * runtime conditions.
+ *
+ * Key behaviors:
+ * 1. **Sorted Keys**: Object properties are always serialized in alphabetical order,
+ *    ensuring deterministic output for pattern matching.
+ *
+ * 2. **Circular Reference Protection**: Uses ancestor chain tracking (not just
+ *    object identity) to detect true circular references while correctly handling
+ *    repeated non-circular object references. Circular references are replaced
+ *    with "[Circular]" to prevent stack overflow attacks.
+ *
+ * 3. **JSON Spec Compliance**:
+ *    - undefined values: Omitted from objects, converted to null in arrays
+ *    - Functions: Omitted from objects, converted to null in arrays
+ *    - toJSON methods: Respected and called when present (per JSON.stringify spec)
+ *
+ * 4. **Security Considerations**:
+ *    - Prevents DoS via circular references that would cause infinite recursion
+ *    - Ensures consistent policy rule matching by normalizing property order
+ *    - Respects toJSON for objects that sanitize their output
+ *    - Handles toJSON methods that throw errors gracefully
+ *
+ * @param obj - The object to stringify (typically toolCall.args)
+ * @returns A deterministic JSON string representation
+ *
+ * @example
+ * // Different property orders produce the same output:
+ * stableStringify({b: 2, a: 1}) === stableStringify({a: 1, b: 2})
+ * // Returns: '{"a":1,"b":2}'
+ *
+ * @example
+ * // Circular references are handled safely:
+ * const obj = {a: 1};
+ * obj.self = obj;
+ * stableStringify(obj)
+ * // Returns: '{"a":1,"self":"[Circular]"}'
+ *
+ * @example
+ * // toJSON methods are respected:
+ * const obj = {
+ *   sensitive: 'secret',
+ *   toJSON: () => ({ safe: 'data' })
+ * };
+ * stableStringify(obj)
+ * // Returns: '{"safe":"data"}'
+ */
+export declare function stableStringify(obj: unknown): string;

package/dist/src/policy/stable-stringify.js

@@ -0,0 +1,122 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Produces a stable, deterministic JSON string representation with sorted keys.
+ *
+ * This method is critical for security policy matching. It ensures that the same
+ * object always produces the same string representation, regardless of property
+ * insertion order, which could vary across different JavaScript engines or
+ * runtime conditions.
+ *
+ * Key behaviors:
+ * 1. **Sorted Keys**: Object properties are always serialized in alphabetical order,
+ *    ensuring deterministic output for pattern matching.
+ *
+ * 2. **Circular Reference Protection**: Uses ancestor chain tracking (not just
+ *    object identity) to detect true circular references while correctly handling
+ *    repeated non-circular object references. Circular references are replaced
+ *    with "[Circular]" to prevent stack overflow attacks.
+ *
+ * 3. **JSON Spec Compliance**:
+ *    - undefined values: Omitted from objects, converted to null in arrays
+ *    - Functions: Omitted from objects, converted to null in arrays
+ *    - toJSON methods: Respected and called when present (per JSON.stringify spec)
+ *
+ * 4. **Security Considerations**:
+ *    - Prevents DoS via circular references that would cause infinite recursion
+ *    - Ensures consistent policy rule matching by normalizing property order
+ *    - Respects toJSON for objects that sanitize their output
+ *    - Handles toJSON methods that throw errors gracefully
+ *
+ * @param obj - The object to stringify (typically toolCall.args)
+ * @returns A deterministic JSON string representation
+ *
+ * @example
+ * // Different property orders produce the same output:
+ * stableStringify({b: 2, a: 1}) === stableStringify({a: 1, b: 2})
+ * // Returns: '{"a":1,"b":2}'
+ *
+ * @example
+ * // Circular references are handled safely:
+ * const obj = {a: 1};
+ * obj.self = obj;
+ * stableStringify(obj)
+ * // Returns: '{"a":1,"self":"[Circular]"}'
+ *
+ * @example
+ * // toJSON methods are respected:
+ * const obj = {
+ *   sensitive: 'secret',
+ *   toJSON: () => ({ safe: 'data' })
+ * };
+ * stableStringify(obj)
+ * // Returns: '{"safe":"data"}'
+ */
+export function stableStringify(obj) {
+    const stringify = (currentObj, ancestors) => {
+        // Handle primitives and null
+        if (currentObj === undefined) {
+            return 'null'; // undefined in arrays becomes null in JSON
+        }
+        if (currentObj === null) {
+            return 'null';
+        }
+        if (typeof currentObj === 'function') {
+            return 'null'; // functions in arrays become null in JSON
+        }
+        if (typeof currentObj !== 'object') {
+            return JSON.stringify(currentObj);
+        }
+        // Check for circular reference (object is in ancestor chain)
+        if (ancestors.has(currentObj)) {
+            return '"[Circular]"';
+        }
+        ancestors.add(currentObj);
+        try {
+            // Check for toJSON method and use it if present
+            const objWithToJSON = currentObj;
+            if (typeof objWithToJSON.toJSON === 'function') {
+                try {
+                    const jsonValue = objWithToJSON.toJSON();
+                    // The result of toJSON needs to be stringified recursively
+                    if (jsonValue === null) {
+                        return 'null';
+                    }
+                    return stringify(jsonValue, ancestors);
+                }
+                catch {
+                    // If toJSON throws, treat as a regular object
+                }
+            }
+            if (Array.isArray(currentObj)) {
+                const items = currentObj.map((item) => {
+                    // undefined and functions in arrays become null
+                    if (item === undefined || typeof item === 'function') {
+                        return 'null';
+                    }
+                    return stringify(item, ancestors);
+                });
+                return '[' + items.join(',') + ']';
+            }
+            // Handle objects - sort keys and filter out undefined/function values
+            const sortedKeys = Object.keys(currentObj).sort();
+            const pairs = [];
+            for (const key of sortedKeys) {
+                const value = currentObj[key];
+                // Skip undefined and function values in objects (per JSON spec)
+                if (value !== undefined && typeof value !== 'function') {
+                    pairs.push(JSON.stringify(key) + ':' + stringify(value, ancestors));
+                }
+            }
+            return '{' + pairs.join(',') + '}';
+        }
+        finally {
+            ancestors.delete(currentObj);
+        }
+    };
+    return stringify(obj, new Set());
+}
+//# sourceMappingURL=stable-stringify.js.map

package/dist/src/policy/stable-stringify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stable-stringify.js","sourceRoot":"","sources":["../../../src/policy/stable-stringify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAE,SAAuB,EAAU,EAAE;QACzE,6BAA6B;QAC7B,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,CAAC,2CAA2C;QAC5D,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,0CAA0C;QAC3D,CAAC;QACD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,aAAa,GAAG,UAAwC,CAAC;YAC/D,IAAI,OAAO,aAAa,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;oBACzC,2DAA2D;oBAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC;oBAChB,CAAC;oBACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACpC,gDAAgD;oBAChD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;wBACrD,OAAO,MAAM,CAAC;oBAChB,CAAC;oBACD,OAAO,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACrC,CAAC;YAED,sEAAsE;YACtE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,KAAK,GAAa,EAAE,CAAC;YAE3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAI,UAAsC,CAAC,GAAG,CAAC,CAAC;gBAC3D,gEAAgE;gBAChE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;oBACvD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC"}