@inhuman.tools/policy 0.1.0 → 0.3.0

package/dist/tirith.js

@@ -1,311 +0,0 @@
-/**
- * Host-side command inspection. The command is data, never shell source
- * for the child. `analysis_incomplete` is not one threat: intel-gap
- * (offline package lookup) is not a vote, nested-incomplete-only is
- * remainder ask, concrete rules and scanner error keep today's map.
- */
-import { execFile } from "node:child_process";
-import { mkdtemp, realpath, rm } from "node:fs/promises";
-import { createRequire } from "node:module";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { findingSchema, outputSchema } from "./schemas/tirith.js";
-import { tirithUnits } from "./tirith-units.js";
-const policyRoot = fileURLToPath(new URL("../tirith-policy/", import.meta.url));
-const policyPath = path.join(policyRoot, ".tirith", "policy.yaml");
-const codes = { allow: 0, warn: 2, block: 1 };
-export function parseTirithOutput(stdout, code) {
-    const output = outputSchema.parse(JSON.parse(stdout));
-    if (codes[output.action] !== code)
-        throw new Error(`Tirith verdict disagrees with exit code ${code}`);
-    return output;
-}
-export function tirithFailure(error) {
-    return { action: "error", findings: [], error: error instanceof Error ? error.message : String(error) };
-}
-const INCOMPLETE_RULE = "analysis_incomplete";
-const INTERNAL_COPY = /tirith|getvet\.sh|policy\.yaml|scan\.require|operator policy|capsule command|--suggest/i;
-const BUDGET_NOTE = /nested body suffix omitted|bounded analysis|coverage gap/i;
-const INCOMPLETE_MESSAGE = "Policy safeguards were unable to classify this shell script's safety. It may be correct to use, but it is too complex for static analysis; try to produce a simpler or more explicit shell script that will do the same thing.";
-export function tirithCoverage(report) {
-    if (report.action === "error")
-        return "error";
-    if (report.findings.length === 0)
-        return "none";
-    if (report.findings.some((finding) => finding.rule_id !== INCOMPLETE_RULE))
-        return "concrete";
-    if (report.findings.every(isIntelGapFinding))
-        return "intel-gap";
-    return "incomplete";
-}
-function isIntelGapFinding(finding) {
-    const evidence = finding.evidence ?? [];
-    return evidence.length > 0 && evidence.every((item) => item.type === "threat_intel");
-}
-/** A block only when a finding is the attack itself. A coarse shape stays a question. */
-const HARD_BLOCK = new Set([
-    "pipe_to_interpreter",
-    "curl_pipe_shell",
-    "wget_pipe_shell",
-    "httpie_pipe_shell",
-    "xh_pipe_shell",
-    "base64_decode_execute",
-    "sudo_download_install",
-    "reverse_shell",
-    "proc_mem_access",
-    "docker_remote_priv_esc",
-    "plain_http_to_sink",
-    "schemeless_to_sink",
-    "insecure_tls_flags",
-    "userinfo_trick",
-    "non_ascii_hostname",
-    "shortened_url",
-    "metadata_endpoint",
-    "private_network_access",
-    "data_exfiltration",
-    "dotfile_overwrite",
-    "private_key_exposed",
-    "sudo_shell_spawn",
-    "sudo_env_preserve_sensitive",
-    "sudo_tee_system_file",
-    "sudo_recursive_perms_broad_path",
-    "blast_writes_system_path",
-    "blast_find_delete",
-    "blast_rsync_delete",
-    "wrapper_chain_too_deep",
-]);
-function hardBlock(report) {
-    return report.findings.some((finding) => HARD_BLOCK.has(finding.rule_id));
-}
-export function tirithDisposition(report) {
-    switch (tirithCoverage(report)) {
-        case "error":
-            return "block";
-        case "intel-gap":
-        case "none":
-            return "approve";
-        case "incomplete":
-            return "ask";
-        case "concrete":
-            if (report.action === "allow")
-                return "approve";
-            if (report.action === "warn")
-                return "ask";
-            return hardBlock(report) ? "block" : "ask";
-    }
-}
-/** Model-facing. Scanner identity stays in `policyEvidenceJson`. */
-export function tirithMessage(report) {
-    switch (tirithCoverage(report)) {
-        case "error":
-            return "Policy safeguards could not inspect this command.";
-        case "intel-gap":
-        case "none":
-            return null;
-        case "incomplete":
-            return withFragments(INCOMPLETE_MESSAGE, commandSnippets(report.findings));
-        case "concrete": {
-            const concrete = report.findings.filter((finding) => finding.rule_id !== INCOMPLETE_RULE);
-            const parts = concrete.map(findingAdvice).filter((part) => part !== "");
-            return parts.length === 0 ? null : parts.join("\n\n");
-        }
-    }
-}
-/** Classifier PIP. Concrete findings only — no-verdicts are not threats. */
-export function tirithPolicyCut(report) {
-    if (tirithCoverage(report) !== "concrete")
-        return "";
-    return tirithMessage(report) ?? "";
-}
-export function parseTirithEvidence(json) {
-    if (json == null || json === "")
-        return null;
-    try {
-        const parsed = JSON.parse(json);
-        if (!isRecord(parsed))
-            return null;
-        return asReport(parsed.tirith);
-    }
-    catch {
-        return null;
-    }
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function asReport(value) {
-    if (!isRecord(value))
-        return null;
-    const action = value.action;
-    if (action !== "allow" && action !== "warn" && action !== "block" && action !== "error")
-        return null;
-    if (!Array.isArray(value.findings))
-        return null;
-    const findings = [];
-    for (const item of value.findings) {
-        const parsed = findingSchema.safeParse(item);
-        if (!parsed.success)
-            return null;
-        findings.push(parsed.data);
-    }
-    const error = value.error;
-    return typeof error === "string" ? { action, findings, error } : { action, findings };
-}
-function recoveryScript(ruleId) {
-    if (ruleId === "interpreter_suspicious_inline_exec") {
-        return "Drop the spawn, socket, or eval, or move that part into a file and run the file. A one-liner that only computes is already allowed.";
-    }
-    if (ruleId === "mass_file_deletion") {
-        return "Delete fewer than three files in one step, or name the build directory you mean (node_modules, dist, target). Do not chain the rest into one command.";
-    }
-    return "";
-}
-function findingAdvice(finding) {
-    const body = modelSentences(finding.description) || modelSentences(finding.title);
-    const rem = finding.remediation === undefined ? "" : modelSentences(finding.remediation);
-    const snips = commandSnippets([finding]);
-    const hit = finding.evidence?.find((item) => item.pattern != null && item.pattern !== "")?.pattern;
-    const parts = [];
-    if (body !== "")
-        parts.push(body);
-    if (snips.length > 0)
-        parts.push(`This fragment:\n${snips.map((snip) => `  ${snip}`).join("\n")}`);
-    if (hit !== undefined)
-        parts.push(`Why: it matches ${hit}.`);
-    const script = recoveryScript(finding.rule_id);
-    if (script !== "")
-        parts.push(script);
-    else if (rem !== "" && rem !== body)
-        parts.push(rem);
-    return parts.join("\n");
-}
-function withFragments(lead, snips) {
-    if (snips.length === 0)
-        return lead;
-    return `${lead}\n\nThis fragment could not be classified:\n${snips.map((snip) => `  ${snip}`).join("\n")}`;
-}
-function commandSnippets(findings) {
-    const seen = new Set();
-    const out = [];
-    for (const finding of findings) {
-        for (const item of finding.evidence ?? []) {
-            const text = item.matched ?? item.raw;
-            if (text == null || text === "" || BUDGET_NOTE.test(text) || seen.has(text))
-                continue;
-            seen.add(text);
-            out.push(text);
-        }
-    }
-    return out;
-}
-function modelSentences(text) {
-    return text
-        .split(/(?<=\.)\s+/)
-        .filter((sentence) => sentence !== "" && !INTERNAL_COPY.test(sentence))
-        .join(" ")
-        .trim();
-}
-function binaryPath() {
-    const require = createRequire(import.meta.url);
-    const fromTirith = createRequire(require.resolve("tirith/package.json"));
-    const platform = `${process.platform}-${process.arch}`;
-    if (!["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-x64"].includes(platform)) {
-        throw new Error(`Unsupported Tirith platform: ${platform}`);
-    }
-    const root = path.dirname(fromTirith.resolve(`@sheeki03/tirith-${platform}/package.json`));
-    return path.join(root, "bin", process.platform === "win32" ? "tirith.exe" : "tirith");
-}
-/** Do not inherit TIRITH*, loader injection, user allowlists, or project policy discovery. */
-function scannerEnv(state) {
-    const env = {
-        HOME: state,
-        USERPROFILE: state,
-        XDG_CONFIG_HOME: state,
-        XDG_DATA_HOME: state,
-        XDG_CACHE_HOME: state,
-        APPDATA: state,
-        LOCALAPPDATA: state,
-        TIRITH_POLICY_ROOT: policyRoot,
-        TIRITH_LOG: "0",
-        TIRITH_OFFLINE: "1",
-    };
-    for (const name of ["PATH", "SystemRoot", "SYSTEMROOT", "WINDIR", "TMPDIR", "TEMP", "TMP"]) {
-        if (process.env[name] !== undefined)
-            env[name] = process.env[name];
-    }
-    return env;
-}
-function joinTirithReports(reports) {
-    const findings = reports.flatMap((report) => report.findings);
-    if (reports.some((report) => report.action === "block"))
-        return { action: "block", findings };
-    const failed = reports.find((report) => report.action === "error");
-    if (failed !== undefined)
-        return { action: "error", findings, error: failed.error };
-    if (reports.some((report) => report.action === "warn"))
-        return { action: "warn", findings };
-    return { action: "allow", findings };
-}
-function inspectCommand(binary, command, cwd, env, signal) {
-    return new Promise((resolve, reject) => {
-        execFile(binary, ["check", "--format", "json", "--non-interactive", "--no-daemon", "--offline", "--shell", "posix", "--", command], {
-            cwd,
-            env,
-            signal,
-            timeout: 5000,
-            killSignal: "SIGKILL",
-            maxBuffer: 1024 * 1024,
-            encoding: "utf8",
-            windowsHide: true,
-        }, (error, stdout) => {
-            try {
-                if (error == null) {
-                    resolve(parseTirithOutput(stdout, 0));
-                    return;
-                }
-                const code = error.code;
-                if (error.killed || error.signal || typeof code !== "number")
-                    throw error;
-                resolve(parseTirithOutput(stdout, code));
-            }
-            catch (error_) {
-                reject(error_);
-            }
-        });
-    });
-}
-export const checkTirith = async (command, { cwd, signal }) => {
-    let state;
-    try {
-        signal?.throwIfAborted();
-        const binary = binaryPath();
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- fixed package asset, never caller input
-        await realpath(policyPath);
-        const home = await mkdtemp(path.join(tmpdir(), "harness-tirith-"));
-        state = home;
-        signal?.throwIfAborted();
-        const env = scannerEnv(home);
-        const reports = await Promise.all(tirithUnits(command).map(async (unit) => {
-            try {
-                const output = await inspectCommand(binary, unit, cwd, env, signal);
-                if (!output.policy_path_used) {
-                    throw new Error("Tirith did not use the package-owned policy");
-                }
-                return { action: output.action, findings: output.findings };
-            }
-            catch (error) {
-                return tirithFailure(error);
-            }
-        }));
-        return joinTirithReports(reports);
-    }
-    catch (error) {
-        return tirithFailure(error);
-    }
-    finally {
-        if (state !== undefined)
-            await rm(state, { recursive: true, force: true });
-    }
-};
-//# sourceMappingURL=tirith.js.map

package/dist/tirith.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tirith.js","sourceRoot":"","sources":["../src/tirith.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAyC,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYhD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACnE,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAEvD,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAmB;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,aAAa,GAAG,yFAAyF,CAAC;AAChH,MAAM,WAAW,GAAG,2DAA2D,CAAC;AAEhF,MAAM,kBAAkB,GACtB,gOAAgO,CAAC;AAInO,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9F,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,OAAO,WAAW,CAAC;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AACvF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,uBAAuB;IACvB,uBAAuB;IACvB,eAAe;IACf,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,gBAAgB;IAChB,oBAAoB;IACpB,eAAe;IACf,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;IACrB,kBAAkB;IAClB,6BAA6B;IAC7B,sBAAsB;IACtB,iCAAiC;IACjC,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAoB;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,QAAQ,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;QACf,KAAK,UAAU;YACb,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,QAAQ,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,mDAAmD,CAAC;QAC7D,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,YAAY;YACf,OAAO,aAAa,CAAC,kBAAkB,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACrD,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAA+B;IACjE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,KAAK,oCAAoC,EAAE,CAAC;QACpD,OAAO,qIAAqI,CAAC;IAC/I,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,uJAAuJ,CAAC;IACjK,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC;IACnG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAwB;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,GAAG,IAAI,+CAA+C,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CAAC,QAAkC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC;YACtC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACtE,IAAI,CAAC,GAAG,CAAC;SACT,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,oBAAoB,QAAQ,eAAe,CAAC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,UAAU;QAC9B,UAAU,EAAE,GAAG;QACf,cAAc,EAAE,GAAG;KACpB,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3F,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,OAAe,EACf,GAAW,EACX,GAAsB,EACtB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,MAAM,EACN,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EACjH;YACE,GAAG;YACH,GAAG;YACH,MAAM;YACN,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,IAAI,GAAG,IAAI;YACtB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;gBACxB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC1E,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAiB,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1E,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,8GAA8G;QAC9G,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACnE,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAyB,CAAC;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC,CAAC"}