@event4u/agent-config 14.8.0 → 14.9.0

package/dist/scripts/_lib/spawn_env.js

@@ -0,0 +1,129 @@
+/**
+ * Hardened environment for spawned subprocesses
+ * (road-to-runtime-security-hardening Phase 1).
+ *
+ * agent-config shells out to external CLIs (the AI-council transport spawns
+ * `codex` / `claude` / `gemini`; hooks spawn `git`). By default `spawnSync`
+ * inherits the full parent `process.env`, so any attacker-influenced env var in
+ * the parent becomes a code-execution vector the moment the child (or a `git`
+ * it invokes internally) runs:
+ *
+ *   - dynamic-loader preload/search-path (CWE-426 untrusted search path):
+ *     LD_PRELOAD, LD_LIBRARY_PATH, DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH,
+ *     GCONV_PATH — load attacker code into any spawned ELF/Mach-O.
+ *   - git command-injection (CWE-88): GIT_EXTERNAL_DIFF, GIT_SSH,
+ *     GIT_SSH_COMMAND, GIT_PROXY_COMMAND, any GIT_*_COMMAND, GIT_PAGER, PAGER —
+ *     git runs these as shell commands (`core.pager` / external-diff RCE).
+ *   - git config-injection (CWE-88): the GIT_CONFIG* family (GIT_CONFIG,
+ *     GIT_CONFIG_GLOBAL/_SYSTEM, and inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n>
+ *     / GIT_CONFIG_VALUE_<n>) sets ANY git config — `core.fsmonitor` runs shell
+ *     on every `git status`; GIT_ALTERNATE_OBJECT_DIRECTORIES / HOSTALIASES
+ *     redirect object stores / hostname resolution.
+ *   - runtime auto-exec hooks: NODE_OPTIONS (`--require attacker.js`),
+ *     BASH_ENV / ENV (sourced by non-interactive shells), PYTHONPATH /
+ *     PYTHONSTARTUP / PYTHONINSPECT, PERL5OPT / PERL5LIB, RUBYOPT.
+ *   - IFS — classic shell field-splitting hijack.
+ *
+ * This is the Least-Agency the `tool-safety` rule preaches, applied to our own
+ * transport. We scrub by *family* (prefix + exact name), NOT via an allowlist:
+ * the CLIs legitimately need arbitrary env (ANTHROPIC_API_KEY, XDG config
+ * paths, proxy settings), so an allowlist would break them and rot as new
+ * good vars appear. Deny-by-family removes the known execution vectors and
+ * preserves everything else. This is standard, publicly-documented OWASP/CWE
+ * knowledge — independently implemented here.
+ */
+/** Exact env-var names removed unconditionally. */
+const DENY_EXACT = new Set([
+    // dynamic loader
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FRAMEWORK_PATH',
+    'GCONV_PATH',
+    // git command-injection
+    'GIT_EXTERNAL_DIFF',
+    'GIT_SSH',
+    'GIT_SSH_COMMAND',
+    'GIT_PROXY_COMMAND',
+    'GIT_PAGER',
+    'PAGER',
+    // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
+    // attacker-controlled object stores; the GIT_CONFIG* family is handled by
+    // prefix below (it is a general arbitrary-config-injection primitive).
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // git path-redirection: GIT_DIR / GIT_INDEX_FILE / GIT_NAMESPACE point a
+    // child's git at an attacker-controlled repo, index file, or ref namespace
+    // — ordinary git ops then read and write attacker state (low severity,
+    // same family as GIT_ALTERNATE_OBJECT_DIRECTORIES above).
+    'GIT_DIR',
+    'GIT_INDEX_FILE',
+    'GIT_NAMESPACE',
+    // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
+    // redirecting any network fetch the child performs (CWE-427-adjacent).
+    'HOSTALIASES',
+    // runtime auto-exec hooks
+    'NODE_OPTIONS',
+    'BASH_ENV',
+    'ENV',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'PYTHONINSPECT',
+    'PERL5OPT',
+    'PERL5LIB',
+    'RUBYOPT',
+    // shell field-splitting
+    'IFS',
+]);
+/**
+ * Prefix families removed by pattern. `LD_` / `DYLD_` cover loader variants we
+ * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook; the
+ * `GIT_CONFIG` family (GIT_CONFIG, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, and the
+ * inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> trio) is a
+ * general arbitrary-config-injection primitive — an attacker can set ANY git
+ * config key, e.g. `core.fsmonitor` / `core.pager` / `core.sshCommand` /
+ * `core.hooksPath` / `alias.*`, all of which git executes as shell on ordinary
+ * operations (`git status` alone runs `core.fsmonitor`). The plain `GIT_*_COMMAND`
+ * check missed it (no `_COMMAND` suffix), so it is denied by its own prefix.
+ * (GIT_ASKPASS is intentionally NOT denied — it is a path, not a shell command,
+ * and legitimate credential helpers need it; the *_COMMAND family is the
+ * shell-executed one.)
+ */
+function isDeniedByFamily(name) {
+    if (name.startsWith('LD_') || name.startsWith('DYLD_'))
+        return true;
+    if (name.startsWith('GIT_') && name.endsWith('_COMMAND'))
+        return true;
+    if (name === 'GIT_CONFIG' || name.startsWith('GIT_CONFIG_'))
+        return true;
+    return false;
+}
+/**
+ * Return a copy of the current environment with code-execution-injection
+ * vectors scrubbed, then `overrides` applied. Pass the result as
+ * `spawnSync`/`spawn`'s `env:` option.
+ *
+ * @param overrides values to set AFTER scrubbing (e.g. a scoped PATH or a
+ *   package-root marker). Overrides win over both the inherited env and the
+ *   deny-list, so a caller can deliberately re-supply a scrubbed var if it
+ *   genuinely needs one — that is an explicit, reviewable decision at the call
+ *   site, never an ambient inheritance.
+ */
+export function hardenedSpawnEnv(overrides = {}) {
+    const out = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value === undefined)
+            continue;
+        if (DENY_EXACT.has(key))
+            continue;
+        if (isDeniedByFamily(key))
+            continue;
+        out[key] = value;
+    }
+    for (const [key, value] of Object.entries(overrides)) {
+        out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=spawn_env.js.map

package/dist/scripts/_lib/spawn_env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn_env.js","sourceRoot":"","sources":["../../../src/scripts/_lib/spawn_env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,mDAAmD;AACnD,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC5C,iBAAiB;IACjB,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,uBAAuB;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,YAAY;IACZ,wBAAwB;IACxB,mBAAmB;IACnB,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,OAAO;IACP,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,kCAAkC;IAClC,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,0DAA0D;IAC1D,SAAS;IACT,gBAAgB;IAChB,eAAe;IACf,sEAAsE;IACtE,uEAAuE;IACvE,aAAa;IACb,0BAA0B;IAC1B,cAAc;IACd,UAAU;IACV,KAAK;IACL,YAAY;IACZ,eAAe;IACf,eAAe;IACf,UAAU;IACV,UAAU;IACV,SAAS;IACT,wBAAwB;IACxB,KAAK;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC5B,YAAoC,EAAE;IAEtC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/scripts/ai_council/modes.js

@@ -0,0 +1,199 @@
+/**
+ * Mode resolution for council members (Phase 2b).
+ *
+ * Ported from the retired Python `src/scripts/ai_council/modes.py` (ADR-200 —
+ * Python→TS migration, Phase 1). Pure resolver — never touches the
+ * filesystem or environment. Callers pass in already-loaded values from
+ * `.agent-settings.yml`.
+ *
+ * Each council member runs in exactly one transport mode per invocation:
+ *
+ * - `api`      — direct SDK call against the provider's API (billable).
+ * - `manual`   — copy-paste loop with the user as transport (free).
+ * - `cli`      — shell out to a locally-installed provider CLI under the
+ *                user's subscription auth. `billable=False`.
+ * - `auto`     — resolve per provider per invocation (cli → api → unavailable).
+ *                Accepted here as a VALUE; the concrete transport is chosen by
+ *                `transport_resolver.ts`, which owns the chain and the billing
+ *                classification. `manual` is never part of the auto chain.
+ *
+ * Resolution precedence — first non-empty wins:
+ *
+ *     1. Invocation flag      e.g. `/council mode:manual`
+ *     2. Per-member setting   `ai_council.members.<name>.mode`
+ *     3. Global setting       `ai_council.mode` OR `ai_council.defaults.mode`
+ *                             (see `resolve_global_mode` — both shapes reach
+ *                             this resolver, and they must agree)
+ *     4. Built-in default     `manual`
+ *
+ * ## Two distinct defaults — the reconciliation (road-to-zero-ceremony-detection)
+ *
+ * The contract used to describe a single fallback (`"api"`) while this module
+ * implemented `manual`. Both were right about different layers, and the docs
+ * conflated them. They are now named separately:
+ *
+ * - **Loader default** — when a config file omits `defaults.mode` entirely,
+ *   `config.ts::_build_defaults` fills `auto` (road-to-always-on-orchestration
+ *   Phase 3.1 — CLI-first is now the owner-set transport doctrine; before this
+ *   flip the loader default was `api`). This is what every real config
+ *   observes, because the loader always populates the key.
+ * - **Built-in fallback** — when NO layer supplies a mode at all (a settings
+ *   dict handed straight to the resolver, no config file involved), the answer
+ *   is `manual`, below. That is the fail-closed direction the no-silent-spend
+ *   Iron Law requires: a caller who supplied no transport preference has not
+ *   asked to spend money, so the free transport wins.
+ *
+ * ### Why `DEFAULT_MODE` did NOT flip to `auto` alongside the loader default
+ *
+ * `auto` still resolves to a paying rung (the api fallback) when no CLI is
+ * usable — it is a routing rule, not a free transport. `DEFAULT_MODE` is only
+ * reached by a caller that bypasses the config loader entirely (no
+ * `.ai-council.yml`, a hand-built settings dict handed straight to
+ * `resolve_mode`/`resolve_modes`). Flipping it to `auto` would let such a
+ * caller spend money on a config that never asked for `auto` in the first
+ * place — the same no-silent-spend violation the built-in fallback exists to
+ * prevent. Every real, file-backed config always has `defaults.mode`
+ * populated by the loader (now `auto`), so `DEFAULT_MODE` is never consulted
+ * on that path — verified in modes.test.ts and config.test.ts.
+ */
+export const VALID_MODES = new Set(['api', 'manual', 'cli', 'auto']);
+/**
+ * Built-in fallback when no layer supplies a mode. `manual` — free, no key,
+ * no spend. NOT the same as the loader's `defaults.mode` default (`auto`
+ * since road-to-always-on-orchestration Phase 3.1); see the module header.
+ */
+export const DEFAULT_MODE = 'manual';
+/** Raised when a configured / invoked mode is not in `VALID_MODES`. */
+export class InvalidModeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidModeError';
+    }
+}
+/** Mirror Python `sorted(VALID_MODES)` for error messages: ['api','cli','manual']. */
+function _sortedValidModes() {
+    return Array.from(VALID_MODES).sort();
+}
+function _normalise(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const s = value.trim().toLowerCase();
+    return s || null;
+}
+function _validate(mode, source) {
+    if (mode === null) {
+        return null;
+    }
+    if (!VALID_MODES.has(mode)) {
+        throw new InvalidModeError(`${source} requested mode=${_pyRepr(mode)}; ` +
+            `expected one of: ${_pyReprList(_sortedValidModes())}`);
+    }
+    return mode;
+}
+/** Python repr() for a string: single-quoted. */
+function _pyRepr(s) {
+    return `'${s}'`;
+}
+/** Python repr() for a list of strings: ['a', 'b']. */
+function _pyReprList(items) {
+    return `[${items.map((i) => _pyRepr(i)).join(', ')}]`;
+}
+/**
+ * Extract the global transport mode from an `ai_council` block, accepting BOTH
+ * shapes the block legitimately arrives in.
+ *
+ * `council_cli.ts::_synthesize_ai_council_block` FLATTENS the loader's
+ * `defaults.mode` onto a top-level `mode` key, so the normal path presents the
+ * flat shape. But `build_members` is on the exported surface, and callers that
+ * hand it a RAW `.ai-council.yml`-shaped dict present the nested shape. Reading
+ * only the flat key silently dropped the configured default on that path and
+ * fell through to `DEFAULT_MODE`.
+ *
+ * Flat wins when both are present — it is the synthesized, already-resolved
+ * value. Returns `null` when neither shape carries a usable string, letting the
+ * precedence chain continue to the built-in.
+ */
+export function resolve_global_mode(aiBlock) {
+    if (aiBlock === null || aiBlock === undefined) {
+        return null;
+    }
+    const flat = _normalise(_settingsGet(aiBlock, 'mode'));
+    if (flat !== null) {
+        return flat;
+    }
+    const defaults = _settingsGet(aiBlock, 'defaults');
+    if (defaults === null || defaults === undefined) {
+        return null;
+    }
+    if (!(defaults instanceof Map) && typeof defaults !== 'object') {
+        return null;
+    }
+    if (Array.isArray(defaults)) {
+        return null;
+    }
+    return _normalise(_settingsGet(defaults, 'mode'));
+}
+function _settingsGet(settings, key) {
+    if (settings === null || settings === undefined) {
+        return undefined;
+    }
+    if (settings instanceof Map) {
+        return settings.get(key);
+    }
+    return settings[key];
+}
+/**
+ * Resolve the effective transport mode for one member.
+ *
+ * Returns one of `VALID_MODES`. Never `null`.
+ *
+ * Throws `InvalidModeError` if any non-empty layer requests a mode not
+ * in `VALID_MODES`. The earliest layer (highest priority) is checked
+ * first; later layers are not validated when an earlier one already won.
+ */
+export function resolve_mode(memberName, opts = {}) {
+    const invocationMode = opts.invocationMode ?? null;
+    const memberSettings = opts.memberSettings ?? null;
+    const globalMode = opts.globalMode ?? null;
+    const inv = _validate(_normalise(invocationMode), `/council mode= for ${_pyRepr(memberName)}`);
+    if (inv !== null) {
+        return inv;
+    }
+    let memberModeRaw = null;
+    if (memberSettings !== null) {
+        const v = _settingsGet(memberSettings, 'mode');
+        memberModeRaw = v === undefined ? null : v;
+    }
+    const member = _validate(_normalise(memberModeRaw), `ai_council.members.${memberName}.mode`);
+    if (member !== null) {
+        return member;
+    }
+    const glob = _validate(_normalise(globalMode), 'ai_council.mode');
+    if (glob !== null) {
+        return glob;
+    }
+    return DEFAULT_MODE;
+}
+/**
+ * Resolve modes for a batch of members. Convenience wrapper.
+ *
+ * `membersSettings` is the full `ai_council.members` mapping; each
+ * member's sub-dict is forwarded to `resolve_mode()`.
+ */
+export function resolve_modes(memberNames, opts = {}) {
+    const out = {};
+    const settings = opts.membersSettings ?? {};
+    for (const name of memberNames) {
+        out[name] = resolve_mode(name, {
+            invocationMode: opts.invocationMode ?? null,
+            memberSettings: _settingsGet(settings, name) ?? null,
+            globalMode: opts.globalMode ?? null,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=modes.js.map

package/dist/scripts/ai_council/modes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modes.js","sourceRoot":"","sources":["../../../src/scripts/ai_council/modes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,uEAAuE;AACvE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACnC,CAAC;CACJ;AAED,sFAAsF;AACtF,SAAS,iBAAiB;IACtB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,IAAmB,EAAE,MAAc;IAClD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CACtB,GAAG,MAAM,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI;YACzC,oBAAoB,WAAW,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAC7D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,iDAAiD;AACjD,SAAS,OAAO,CAAC,CAAS;IACtB,OAAO,IAAI,CAAC,GAAG,CAAC;AACpB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,KAAe;IAChC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAC/B,OAAkF;IAElF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,YAAY,GAAG,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CACb,YAAY,CAAC,QAAkE,EAAE,MAAM,CAAC,CAC3F,CAAC;AACN,CAAC;AAQD,SAAS,YAAY,CACjB,QAAmF,EACnF,GAAW;IAEX,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,QAAQ,YAAY,GAAG,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAQ,QAAoC,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAE,OAA2B,EAAE;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAE3C,MAAM,GAAG,GAAG,SAAS,CACjB,UAAU,CAAC,cAAc,CAAC,EAC1B,sBAAsB,OAAO,CAAC,UAAU,CAAC,EAAE,CAC9C,CAAC;IACF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACf,CAAC;IAED,IAAI,aAAa,GAAY,IAAI,CAAC;IAClC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC/C,aAAa,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CACpB,UAAU,CAAC,aAAa,CAAC,EACzB,sBAAsB,UAAU,OAAO,CAC1C,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,YAAY,CAAC;AACxB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CACzB,WAAqB,EACrB,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;YAC3C,cAAc,EAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAG5B,IAAI,IAAI;YACxB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;SACtC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}