@inhuman.tools/turn 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE.md +7 -0
- package/dist/agent-calls/acceptance.d.ts +12 -0
- package/dist/agent-calls/acceptance.d.ts.map +1 -0
- package/dist/agent-calls/acceptance.js +64 -0
- package/dist/agent-calls/acceptance.js.map +1 -0
- package/dist/agent-calls/callbacks.d.ts +14 -0
- package/dist/agent-calls/callbacks.d.ts.map +1 -0
- package/dist/agent-calls/callbacks.js +59 -0
- package/dist/agent-calls/callbacks.js.map +1 -0
- package/dist/agent-calls/delivery.d.ts +7 -0
- package/dist/agent-calls/delivery.d.ts.map +1 -0
- package/dist/agent-calls/delivery.js +16 -0
- package/dist/agent-calls/delivery.js.map +1 -0
- package/dist/agent-calls/index.d.ts +7 -0
- package/dist/agent-calls/index.d.ts.map +1 -0
- package/dist/agent-calls/index.js +6 -0
- package/dist/agent-calls/index.js.map +1 -0
- package/dist/agent-calls/operator.d.ts +21 -0
- package/dist/agent-calls/operator.d.ts.map +1 -0
- package/dist/agent-calls/operator.js +78 -0
- package/dist/agent-calls/operator.js.map +1 -0
- package/dist/agent-calls/runtime.d.ts +99 -0
- package/dist/agent-calls/runtime.d.ts.map +1 -0
- package/dist/agent-calls/runtime.js +245 -0
- package/dist/agent-calls/runtime.js.map +1 -0
- package/dist/agent-calls/types.d.ts +31 -0
- package/dist/agent-calls/types.d.ts.map +1 -0
- package/dist/agent-calls/types.js +2 -0
- package/dist/agent-calls/types.js.map +1 -0
- package/dist/context/compact-floors.d.ts +43 -0
- package/dist/context/compact-floors.d.ts.map +1 -0
- package/dist/context/compact-floors.js +52 -0
- package/dist/context/compact-floors.js.map +1 -0
- package/dist/context/compact.d.ts +42 -0
- package/dist/context/compact.d.ts.map +1 -0
- package/dist/context/compact.js +155 -0
- package/dist/context/compact.js.map +1 -0
- package/dist/context/delivery.d.ts +13 -0
- package/dist/context/delivery.d.ts.map +1 -0
- package/dist/context/delivery.js +6 -0
- package/dist/context/delivery.js.map +1 -0
- package/dist/context/history.d.ts +66 -0
- package/dist/context/history.d.ts.map +1 -0
- package/dist/context/history.js +573 -0
- package/dist/context/history.js.map +1 -0
- package/dist/context/index.d.ts +10 -0
- package/dist/context/index.d.ts.map +1 -0
- package/dist/context/index.js +10 -0
- package/dist/context/index.js.map +1 -0
- package/dist/context/observations.d.ts +7 -0
- package/dist/context/observations.d.ts.map +1 -0
- package/dist/context/observations.js +11 -0
- package/dist/context/observations.js.map +1 -0
- package/dist/context/retention/defaults.d.ts +10 -0
- package/dist/context/retention/defaults.d.ts.map +1 -0
- package/dist/context/retention/defaults.js +47 -0
- package/dist/context/retention/defaults.js.map +1 -0
- package/dist/context/retention/index.d.ts +14 -0
- package/dist/context/retention/index.d.ts.map +1 -0
- package/dist/context/retention/index.js +21 -0
- package/dist/context/retention/index.js.map +1 -0
- package/dist/context/retention/narrow.d.ts +22 -0
- package/dist/context/retention/narrow.d.ts.map +1 -0
- package/dist/context/retention/narrow.js +140 -0
- package/dist/context/retention/narrow.js.map +1 -0
- package/dist/context/retention/render.d.ts +37 -0
- package/dist/context/retention/render.d.ts.map +1 -0
- package/dist/context/retention/render.js +149 -0
- package/dist/context/retention/render.js.map +1 -0
- package/dist/context/retention/resolve.d.ts +51 -0
- package/dist/context/retention/resolve.d.ts.map +1 -0
- package/dist/context/retention/resolve.js +254 -0
- package/dist/context/retention/resolve.js.map +1 -0
- package/dist/context/retention/schema.d.ts +345 -0
- package/dist/context/retention/schema.d.ts.map +1 -0
- package/dist/context/retention/schema.js +149 -0
- package/dist/context/retention/schema.js.map +1 -0
- package/dist/context/retention/stamp.d.ts +25 -0
- package/dist/context/retention/stamp.d.ts.map +1 -0
- package/dist/context/retention/stamp.js +103 -0
- package/dist/context/retention/stamp.js.map +1 -0
- package/dist/context/retention/step.d.ts +33 -0
- package/dist/context/retention/step.d.ts.map +1 -0
- package/dist/context/retention/step.js +74 -0
- package/dist/context/retention/step.js.map +1 -0
- package/dist/context/retention/view.d.ts +57 -0
- package/dist/context/retention/view.d.ts.map +1 -0
- package/dist/context/retention/view.js +121 -0
- package/dist/context/retention/view.js.map +1 -0
- package/dist/context/squeeze.d.ts +45 -0
- package/dist/context/squeeze.d.ts.map +1 -0
- package/dist/context/squeeze.js +182 -0
- package/dist/context/squeeze.js.map +1 -0
- package/dist/context/tools.d.ts +16 -0
- package/dist/context/tools.d.ts.map +1 -0
- package/dist/context/tools.js +73 -0
- package/dist/context/tools.js.map +1 -0
- package/dist/context/transcript.d.ts +151 -0
- package/dist/context/transcript.d.ts.map +1 -0
- package/dist/context/transcript.js +659 -0
- package/dist/context/transcript.js.map +1 -0
- package/dist/policy-processor/bypass.d.ts +95 -0
- package/dist/policy-processor/bypass.d.ts.map +1 -0
- package/dist/policy-processor/bypass.js +188 -0
- package/dist/policy-processor/bypass.js.map +1 -0
- package/dist/policy-processor/classifier.d.ts +47 -0
- package/dist/policy-processor/classifier.d.ts.map +1 -0
- package/dist/policy-processor/classifier.js +671 -0
- package/dist/policy-processor/classifier.js.map +1 -0
- package/dist/policy-processor/cluster.d.ts +7 -0
- package/dist/policy-processor/cluster.d.ts.map +1 -0
- package/dist/policy-processor/cluster.js +32 -0
- package/dist/policy-processor/cluster.js.map +1 -0
- package/dist/policy-processor/evidence.d.ts +26 -0
- package/dist/policy-processor/evidence.d.ts.map +1 -0
- package/dist/policy-processor/evidence.js +204 -0
- package/dist/policy-processor/evidence.js.map +1 -0
- package/dist/policy-processor/explain.d.ts +59 -0
- package/dist/policy-processor/explain.d.ts.map +1 -0
- package/dist/policy-processor/explain.js +224 -0
- package/dist/policy-processor/explain.js.map +1 -0
- package/dist/policy-processor/index.d.ts +6 -0
- package/dist/policy-processor/index.d.ts.map +1 -0
- package/dist/policy-processor/index.js +6 -0
- package/dist/policy-processor/index.js.map +1 -0
- package/dist/policy-processor/license.d.ts +23 -0
- package/dist/policy-processor/license.d.ts.map +1 -0
- package/dist/policy-processor/license.js +47 -0
- package/dist/policy-processor/license.js.map +1 -0
- package/dist/policy-processor/peel-cwd.d.ts +2 -0
- package/dist/policy-processor/peel-cwd.d.ts.map +1 -0
- package/dist/policy-processor/peel-cwd.js +2 -0
- package/dist/policy-processor/peel-cwd.js.map +1 -0
- package/dist/policy-processor/real-path.d.ts +7 -0
- package/dist/policy-processor/real-path.d.ts.map +1 -0
- package/dist/policy-processor/real-path.js +42 -0
- package/dist/policy-processor/real-path.js.map +1 -0
- package/dist/policy-processor/scope.d.ts +111 -0
- package/dist/policy-processor/scope.d.ts.map +1 -0
- package/dist/policy-processor/scope.js +629 -0
- package/dist/policy-processor/scope.js.map +1 -0
- package/dist/policy-processor/self-protect.d.ts +10 -0
- package/dist/policy-processor/self-protect.d.ts.map +1 -0
- package/dist/policy-processor/self-protect.js +48 -0
- package/dist/policy-processor/self-protect.js.map +1 -0
- package/dist/policy-processor/soft-deny.d.ts +75 -0
- package/dist/policy-processor/soft-deny.d.ts.map +1 -0
- package/dist/policy-processor/soft-deny.js +185 -0
- package/dist/policy-processor/soft-deny.js.map +1 -0
- package/dist/policy-processor/unattended-guard.d.ts +28 -0
- package/dist/policy-processor/unattended-guard.d.ts.map +1 -0
- package/dist/policy-processor/unattended-guard.js +145 -0
- package/dist/policy-processor/unattended-guard.js.map +1 -0
- package/dist/session/cancel.d.ts +14 -0
- package/dist/session/cancel.d.ts.map +1 -0
- package/dist/session/cancel.js +32 -0
- package/dist/session/cancel.js.map +1 -0
- package/dist/session/commands.d.ts +41 -0
- package/dist/session/commands.d.ts.map +1 -0
- package/dist/session/commands.js +241 -0
- package/dist/session/commands.js.map +1 -0
- package/dist/session/compact-actor.d.ts +23 -0
- package/dist/session/compact-actor.d.ts.map +1 -0
- package/dist/session/compact-actor.js +91 -0
- package/dist/session/compact-actor.js.map +1 -0
- package/dist/session/compact-env.d.ts +54 -0
- package/dist/session/compact-env.d.ts.map +1 -0
- package/dist/session/compact-env.js +345 -0
- package/dist/session/compact-env.js.map +1 -0
- package/dist/session/compact.d.ts +42 -0
- package/dist/session/compact.d.ts.map +1 -0
- package/dist/session/compact.js +68 -0
- package/dist/session/compact.js.map +1 -0
- package/dist/session/index.d.ts +9 -0
- package/dist/session/index.d.ts.map +1 -0
- package/dist/session/index.js +8 -0
- package/dist/session/index.js.map +1 -0
- package/dist/session/park.d.ts +16 -0
- package/dist/session/park.d.ts.map +1 -0
- package/dist/session/park.js +73 -0
- package/dist/session/park.js.map +1 -0
- package/dist/session/side-channel-reminder.d.ts +41 -0
- package/dist/session/side-channel-reminder.d.ts.map +1 -0
- package/dist/session/side-channel-reminder.js +132 -0
- package/dist/session/side-channel-reminder.js.map +1 -0
- package/dist/session/types.d.ts +44 -0
- package/dist/session/types.d.ts.map +1 -0
- package/dist/session/types.js +2 -0
- package/dist/session/types.js.map +1 -0
- package/dist/tool-catalog/catalog.d.ts +77 -0
- package/dist/tool-catalog/catalog.d.ts.map +1 -0
- package/dist/tool-catalog/catalog.js +380 -0
- package/dist/tool-catalog/catalog.js.map +1 -0
- package/dist/tool-catalog/index.d.ts +4 -0
- package/dist/tool-catalog/index.d.ts.map +1 -0
- package/dist/tool-catalog/index.js +3 -0
- package/dist/tool-catalog/index.js.map +1 -0
- package/dist/tool-catalog/recipes.d.ts +36 -0
- package/dist/tool-catalog/recipes.d.ts.map +1 -0
- package/dist/tool-catalog/recipes.js +121 -0
- package/dist/tool-catalog/recipes.js.map +1 -0
- package/dist/tool-catalog/types.d.ts +103 -0
- package/dist/tool-catalog/types.d.ts.map +1 -0
- package/dist/tool-catalog/types.js +5 -0
- package/dist/tool-catalog/types.js.map +1 -0
- package/dist/tool-runtime/approval/approved.d.ts +13 -0
- package/dist/tool-runtime/approval/approved.d.ts.map +1 -0
- package/dist/tool-runtime/approval/approved.js +20 -0
- package/dist/tool-runtime/approval/approved.js.map +1 -0
- package/dist/tool-runtime/approval/dist.d.ts +6 -0
- package/dist/tool-runtime/approval/dist.d.ts.map +1 -0
- package/dist/tool-runtime/approval/dist.js +28 -0
- package/dist/tool-runtime/approval/dist.js.map +1 -0
- package/dist/tool-runtime/approval/inbound.d.ts +7 -0
- package/dist/tool-runtime/approval/inbound.d.ts.map +1 -0
- package/dist/tool-runtime/approval/inbound.js +48 -0
- package/dist/tool-runtime/approval/inbound.js.map +1 -0
- package/dist/tool-runtime/approval/unattended.d.ts +8 -0
- package/dist/tool-runtime/approval/unattended.d.ts.map +1 -0
- package/dist/tool-runtime/approval/unattended.js +23 -0
- package/dist/tool-runtime/approval/unattended.js.map +1 -0
- package/dist/tool-runtime/blob-port.d.ts +46 -0
- package/dist/tool-runtime/blob-port.d.ts.map +1 -0
- package/dist/tool-runtime/blob-port.js +47 -0
- package/dist/tool-runtime/blob-port.js.map +1 -0
- package/dist/tool-runtime/extra-root.d.ts +3 -0
- package/dist/tool-runtime/extra-root.d.ts.map +1 -0
- package/dist/tool-runtime/extra-root.js +14 -0
- package/dist/tool-runtime/extra-root.js.map +1 -0
- package/dist/tool-runtime/handler.d.ts +29 -0
- package/dist/tool-runtime/handler.d.ts.map +1 -0
- package/dist/tool-runtime/handler.js +460 -0
- package/dist/tool-runtime/handler.js.map +1 -0
- package/dist/tool-runtime/index.d.ts +14 -0
- package/dist/tool-runtime/index.d.ts.map +1 -0
- package/dist/tool-runtime/index.js +14 -0
- package/dist/tool-runtime/index.js.map +1 -0
- package/dist/tool-runtime/peel.d.ts +19 -0
- package/dist/tool-runtime/peel.d.ts.map +1 -0
- package/dist/tool-runtime/peel.js +74 -0
- package/dist/tool-runtime/peel.js.map +1 -0
- package/dist/tool-runtime/plugin-context.d.ts +13 -0
- package/dist/tool-runtime/plugin-context.d.ts.map +1 -0
- package/dist/tool-runtime/plugin-context.js +55 -0
- package/dist/tool-runtime/plugin-context.js.map +1 -0
- package/dist/tool-runtime/recall.d.ts +18 -0
- package/dist/tool-runtime/recall.d.ts.map +1 -0
- package/dist/tool-runtime/recall.js +100 -0
- package/dist/tool-runtime/recall.js.map +1 -0
- package/dist/tool-runtime/run-system-tool.d.ts +13 -0
- package/dist/tool-runtime/run-system-tool.d.ts.map +1 -0
- package/dist/tool-runtime/run-system-tool.js +230 -0
- package/dist/tool-runtime/run-system-tool.js.map +1 -0
- package/dist/tool-runtime/tool-error.d.ts +6 -0
- package/dist/tool-runtime/tool-error.d.ts.map +1 -0
- package/dist/tool-runtime/tool-error.js +6 -0
- package/dist/tool-runtime/tool-error.js.map +1 -0
- package/dist/tool-runtime/worker-tools.d.ts +8 -0
- package/dist/tool-runtime/worker-tools.d.ts.map +1 -0
- package/dist/tool-runtime/worker-tools.js +65 -0
- package/dist/tool-runtime/worker-tools.js.map +1 -0
- package/dist/tool-runtime/write-admit.d.ts +21 -0
- package/dist/tool-runtime/write-admit.d.ts.map +1 -0
- package/dist/tool-runtime/write-admit.js +89 -0
- package/dist/tool-runtime/write-admit.js.map +1 -0
- package/package.json +114 -3
- package/policy/auto-mode-ask.scm +201 -0
- package/policy/bypass-detect.prompt +55 -0
- package/policy/classifier-bash-incomplete.prompt +46 -0
- package/policy/classifier-bash.prompt +45 -0
- package/policy/classifier-mcp.prompt +45 -0
- package/policy/classifier-read.prompt +44 -0
- package/policy/classifier-write-outside.prompt +46 -0
- package/policy/classifier-write-risky.prompt +45 -0
- package/policy/classifier-write-workspace.prompt +46 -0
- package/policy/classifier-write.prompt +45 -0
- package/policy/soft-deny-round1.prompt +51 -0
- package/policy/soft-deny-round2.prompt +60 -0
- package/src/agent-calls/acceptance.ts +71 -0
- package/src/agent-calls/callbacks.ts +75 -0
- package/src/agent-calls/delivery.ts +15 -0
- package/src/agent-calls/index.ts +16 -0
- package/src/agent-calls/operator.ts +99 -0
- package/src/agent-calls/runtime.ts +310 -0
- package/src/agent-calls/types.ts +33 -0
- package/src/context/compact-floors.ts +76 -0
- package/src/context/compact.ts +176 -0
- package/src/context/delivery.ts +15 -0
- package/src/context/history.ts +725 -0
- package/src/context/index.ts +35 -0
- package/src/context/observations.ts +13 -0
- package/src/context/retention/defaults.ts +58 -0
- package/src/context/retention/index.ts +45 -0
- package/src/context/retention/narrow.ts +123 -0
- package/src/context/retention/render.ts +177 -0
- package/src/context/retention/resolve.ts +306 -0
- package/src/context/retention/schema.ts +173 -0
- package/src/context/retention/stamp.ts +121 -0
- package/src/context/retention/step.ts +85 -0
- package/src/context/retention/view.ts +161 -0
- package/src/context/squeeze.ts +218 -0
- package/src/context/tools.ts +92 -0
- package/src/context/transcript.ts +705 -0
- package/src/policy-processor/README.md +43 -0
- package/src/policy-processor/bypass.ts +246 -0
- package/src/policy-processor/classifier.ts +711 -0
- package/src/policy-processor/cluster.ts +31 -0
- package/src/policy-processor/evidence.ts +214 -0
- package/src/policy-processor/explain.ts +310 -0
- package/src/policy-processor/index.ts +6 -0
- package/src/policy-processor/license.ts +45 -0
- package/src/policy-processor/peel-cwd.ts +1 -0
- package/src/policy-processor/real-path.ts +41 -0
- package/src/policy-processor/scope.ts +655 -0
- package/src/policy-processor/self-protect.ts +46 -0
- package/src/policy-processor/soft-deny.ts +225 -0
- package/src/policy-processor/unattended-guard.ts +158 -0
- package/src/session/cancel.ts +34 -0
- package/src/session/commands.ts +292 -0
- package/src/session/compact-actor.ts +132 -0
- package/src/session/compact-env.ts +539 -0
- package/src/session/compact.ts +95 -0
- package/src/session/index.ts +18 -0
- package/src/session/park.ts +73 -0
- package/src/session/side-channel-reminder.ts +148 -0
- package/src/session/types.ts +50 -0
- package/src/tool-catalog/catalog.ts +282 -0
- package/src/tool-catalog/index.ts +26 -0
- package/src/tool-catalog/recipes.ts +154 -0
- package/src/tool-catalog/types.ts +110 -0
- package/src/tool-runtime/approval/approved.ts +20 -0
- package/src/tool-runtime/approval/dist.ts +29 -0
- package/src/tool-runtime/approval/inbound.ts +50 -0
- package/src/tool-runtime/approval/unattended.ts +24 -0
- package/src/tool-runtime/blob-port.ts +64 -0
- package/src/tool-runtime/extra-root.ts +16 -0
- package/src/tool-runtime/handler.ts +576 -0
- package/src/tool-runtime/index.ts +21 -0
- package/src/tool-runtime/peel.ts +91 -0
- package/src/tool-runtime/plugin-context.ts +68 -0
- package/src/tool-runtime/recall.ts +104 -0
- package/src/tool-runtime/run-system-tool.ts +273 -0
- package/src/tool-runtime/tool-error.ts +6 -0
- package/src/tool-runtime/worker-tools.ts +76 -0
- package/src/tool-runtime/write-admit.ts +90 -0
- package/README.md +0 -3
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../../src/policy-processor/classifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,WAAW,EACX,KAAK,EACL,IAAI,GAGL,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EAEV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAA0B,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAGnG,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAIlB,MAAM,gBAAgB,CAAC;AAExB,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;IAChC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAK3C,SAAS,MAAM,CAAC,KAAc;IAC5B,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,OAAO,CAAC;gBACb,KAAK,MAAM;oBACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBAC7B;oBACE,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACvF,CAAC;QACH,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YACvF,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,OAAO,CAAC;gBACb,KAAK,MAAM;oBACT,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB;oBACE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD;YACE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,EAAuC,EACvC,IAAe;IAEf,MAAM,KAAK,GAAG,aAAa,CACzB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAgB,CAAC,EAC7D,WAAW,CAAC,MAAM,CAAC,CACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,CAAC,gBAAgB,CACrB,OAAO,EACP,GAAG,EAAE;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3F,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,CAAC,CAAS,EAAU,EAAE;IAC7D,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,wBAAwB;YAC3B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,KAAK,wBAAwB;YAC3B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,KAAK,yBAAyB;YAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,KAAK,iCAAiC;YACpC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8CAA8C,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,KAAK,mCAAmC;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gDAAgD,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,KAAK,+BAA+B;YAClC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7F,KAAK,uBAAuB;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,KAAK,mCAAmC;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gDAAgD,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,KAAK,yBAAyB;YAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,KAAK,yBAAyB;YAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,KAAK,sBAAsB;YACzB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF;YACE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AASjF,MAAM,UAAU,eAAe,CAC7B,GAAqC,EACrC,IAA0B;IAM1B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpG,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,UAAU,KAAK,EAAE,IAAI,IAAI,EAAE,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,UAAU,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,KAAK,KAAK,EAAE,EAAE,CAAC;AAC/D,CAAC;AA6CD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAsB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAC5C,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EACjF,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,KAA6B;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI,YAAY,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,mHAAmH;AACnH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,GAAgB,EAAE,OAAe;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;IAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;QAC5C,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,eAAe,EAAE,KAAK,CAAC,oBAAoB;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,KAAK,WAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,8DAA8D;IAC9D,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,gGAAgG;QAChG,6DAA6D;QAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAClE,uFAAuF;QACvF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,KAAc;QACpB,MAAM;QACN,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;KAC3B,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAU,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAuE,CAAC;IAC1F,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACrC,OAAO,EAAE,GAAG,CAAC,aAAuE;QACpF,KAAK;QACL,YAAY;QACZ,WAAW;QACX,gBAAgB,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU;QAC7C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAgD;QAC1D,KAAK;QACL,cAAc,EAAE,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE;YACJ,QAAQ;YACR,MAAM;YACN,UAAU;YACV,cAAc,EAAE,QAAQ,CAAC,eAAe,KAAK,EAAE;YAC/C,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACrD,KAAK,EAAE;gBACL,YAAY;gBACZ,WAAW;gBACX,cAAc,EAAE,MAAM;gBACtB,6DAA6D;gBAC7D,YAAY,EAAE,CAAC,CACb,MAAM,CAAC,YAAY,KAAK,KAAK;oBAC7B,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC,CACjE;gBACD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;aAC3B;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,GAAgB,EAChB,QAAwB;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC;IAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;QAC5C,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,eAAe,EAAE,KAAK,CAAC,oBAAoB;KAC5C,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gCAAgC,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpH,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACpC,YAAY,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;YAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,MAAM,EAAE,eAAe;gBACvB,GAAG;gBACH,YAAY,EAAE,KAAK,CAAC,UAAU;gBAC9B,eAAe,EAAE,KAAK,CAAC,KAAK;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YACpD,IAAI,EAAE,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACxF,OAAO,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,uBAAuB,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;IAEY,gBAAgB;;;;;;;;iBAAhB,gBAAgB;;;mCAC1B,UAAU;iCA2CV,MAAM;qCAqNN,MAAM;2CAiBN,MAAM;YAjRK,0KAAS,OAAO,6BAAP,OAAO,yFAAK;YA4CjC,kKAAA,KAAK,6DAwKJ;YA6CD,8KAAA,SAAS,6DAcR;YAGD,gMAAA,eAAe,6DAKd;;;QAhRU,GAAG,GARH,mDAAgB;QAShB,KAAK;QARJ,2EAAmB,CAAC,EAAC;QAArB,IAAS,OAAO,6CAAK;QAArB,IAAS,OAAO,mDAAK;QACjC,MAAM,uDAA4C;QAClD,aAAa,CAA8B;QAC3C,KAAK,CAAgC;QACrC,IAAI,GAAG,CAAC,CAAC;QAET,YACW,GAAgB,EAChB,KAAmB;YADnB,QAAG,GAAH,GAAG,CAAa;YAChB,UAAK,GAAL,KAAK,CAAc;QAC3B,CAAC;QAEJ,KAAK,CAAC,oBAAoB;YACxB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;gBACzE,IAAI,QAAQ,IAAI,IAAI;oBAAE,OAAO,SAAS,CAAC;gBACvC,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;gBACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvD,wFAAwF;gBACxF,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAC/D,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACxC,kGAAkG;gBAClG,OAAO;oBACL,IAAI,CAAC,CAAC,CAAC;oBACP,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,8DAA8D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;iBAC3G,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChE,IAAI,MAAM,IAAI,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,YAAY;oBAAE,OAAO,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,KAAK;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC1D,IAAI,CAAC,KAAK,GAAG,QAAQ,CACnB,GAAmB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EACvE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBACnD,KAAK,CACH,eAAe,EACf,QAAQ,IAAI,CAAC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnI,CAAC;gBACF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,OAAO;wBACV,WAAW,CAAC,GAAG,EAAE;4BACf,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gCAAE,OAAO;4BAC/C,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC;4BAC1C,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;gCACnE,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,0BAA0B,CAAC;4BACpD,CAAC;wBACH,CAAC,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,SAAS;wBACZ,WAAW,CAAC,GAAG,EAAE;4BACf,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gCAAE,OAAO;4BAC/C,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC;4BAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;wBACrC,CAAC,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,WAAW;wBACd,IAAI,CAAC,eAAe,CAClB,4FAA4F,CAC7F,CAAC;wBACF,OAAO;oBACT,KAAK,SAAS;wBACZ,WAAW,CAAC,GAAG,EAAE;4BACf,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gCAAE,OAAO;4BAC/C,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC;4BAC1C,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACpE,CAAC,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,MAAM;wBACT,IAAI,CAAC,eAAe,CAAC,kFAAkF,CAAC,CAAC;wBACzG,OAAO;oBACT,KAAK,WAAW;wBACd,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;wBACtC,OAAO;oBACT,KAAK,OAAO;wBACV,yEAAyE;wBACzE,kEAAkE;wBAClE,IAAI,CAAC,eAAe,CAClB,+FAA+F,CAChG,CAAC;wBACF,OAAO;oBACT,KAAK,QAAQ;wBACX,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC9B,OAAO;oBACT,KAAK,KAAK;wBACR,MAAM;gBACV,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,aAAa,GAAG,IAAI,eAAe,EAAE,CAAC;gBAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,SAAS,IAAI,CAAC,CAAC,CAAC;gBAC7E,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,IAAI,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;oBAC/D,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBACH,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE;4BACnC,YAAY,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;4BAC7D,MAAM,EAAE,YAAY,CAAC,MAAM;4BAC3B,MAAM,EAAE;gCACN,UAAU,EAAE,IAAI,CAAC,UAAU;gCAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,UAAU,EAAE,IAAI,CAAC,MAAM;gCACvB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;oCACzB,CAAC,CAAC,EAAE;oCACJ,CAAC,CAAC;wCACE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;wCACvC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ;wCACrC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ;wCACrC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe;wCACnD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;wCAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;wCAClC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;qCAC/B,CAAC;gCACN,MAAM,EAAE,eAAe;gCACvB,GAAG,EAAE,IAAI,CAAC,GAAG;gCACb,YAAY,EAAE,IAAI,CAAC,UAAU;gCAC7B,eAAe,EAAE,IAAI,CAAC,KAAK;gCAC3B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1E,CAAC;oBACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACzC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gCAC5B,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;4BAChE,CAAC;iCAAM,CAAC;gCACN,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;gCACtD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;oCACrB,IAAI,GAAG,EAAE,IAAI,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;gCAC9C,CAAC;qCAAM,CAAC;oCACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;oCAC/C,IAAI;wCACF,IAAI,KAAK,SAAS;4CAChB,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;4CACrC,CAAC,CAAC,MAAM,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;gCAC9D,CAAC;4BACH,CAAC;wBACH,CAAC;gCAAS,CAAC;4BACT,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACxC,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACtB,KAAK,CAAC,eAAe,EAAE,aAAa,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;wBACxE,OAAO;oBACT,CAAC;oBACD,WAAW,CAAC,GAAG,EAAE;wBACf,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;4BAAE,OAAO;wBAC/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;4BACnB,KAAK,CAAC,eAAe,EAAE,YAAY,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;4BACpF,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gCACvC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gCACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gCAChC,OAAO;4BACT,CAAC;4BACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC1B,OAAO;wBACT,CAAC;wBACD,KAAK,CAAC,eAAe,EAAE,QAAQ,IAAI,CAAC,QAAQ,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;wBACxF,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC;wBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;4BAAE,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;wBAClE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;4BAAE,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;wBAClE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACpE,CAAC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAC9B,KAAK,CACH,eAAe,EACf,aAAa,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;oBACF,WAAW,CAAC,GAAG,EAAE;wBACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACpE,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;4BACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;4BAC3B,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO;wBAAE,YAAY,CAAC,KAAK,EAAE,CAAC;oBACvD,IAAI,IAAI,CAAC,aAAa,KAAK,YAAY;wBAAE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;gBAC1E,CAAC;YACH,CAAC,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CACvD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,SAAS,CACb,MAAkB,EAClB,OAAqC,EACrC,IAAkB;YAElB,MAAM,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,OAAO,EAAE,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,CAAC,OAAwB,EAAE,KAAY,EAAkB,EAAE;gBACxE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB;oBAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBACrG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YACtF,CAAC,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjE,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C;oBACxF,KAAK,EAAE,CAAC;iBACT,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAkB,EAAE,EAAuC,EAAE,KAAY;YACxF,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QAGD,SAAS,CAAC,IAAY;YACpB,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAAE,OAAO;YAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,UAAU,CACtB,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE;gBAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,EACF,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CACxB,CAAC;QACJ,CAAC;QAGD,eAAe,CAAC,IAAY;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI;gBAAE,OAAO;YAC/C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,iBAAiB,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QAED,WAAW;YACT,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO;YACtC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;;;SA9RU,gBAAgB"}
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Strings the agent controls are JSON-encoded here: the judge prompt places them in a
|
|
3
|
+
* labelled "untrusted" block, and encoding keeps a newline-and-label from forging a new section.
|
|
4
|
+
*/
|
|
5
|
+
/** Arguments for the matching `classifier/*` lambda, or undefined if the payload is missing. */
|
|
6
|
+
export declare function classifierArgs(name: string, args: Readonly<Record<string, unknown>> | null): unknown[] | undefined;
|
|
7
|
+
//# sourceMappingURL=cluster.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cluster.d.ts","sourceRoot":"","sources":["../../src/policy-processor/cluster.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,GAAG,SAAS,CAkBlH"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Classifier-lambda payload. Cluster table and args parse live in
|
|
3
|
+
* harness-model. This module keeps the unknown[] shape the remainder
|
|
4
|
+
* ports apply.
|
|
5
|
+
*/
|
|
6
|
+
import { clusterOf, fileQuestion } from "@inhuman.tools/harness-model";
|
|
7
|
+
/**
|
|
8
|
+
* Strings the agent controls are JSON-encoded here: the judge prompt places them in a
|
|
9
|
+
* labelled "untrusted" block, and encoding keeps a newline-and-label from forging a new section.
|
|
10
|
+
*/
|
|
11
|
+
/** Arguments for the matching `classifier/*` lambda, or undefined if the payload is missing. */
|
|
12
|
+
export function classifierArgs(name, args) {
|
|
13
|
+
switch (clusterOf(name)) {
|
|
14
|
+
case "bash": {
|
|
15
|
+
if (typeof args?.command !== "string" || args.command === "")
|
|
16
|
+
return undefined;
|
|
17
|
+
const cwd = typeof args.cwd === "string" && args.cwd !== "" && args.cwd !== "." ? args.cwd : undefined;
|
|
18
|
+
return cwd === undefined
|
|
19
|
+
? [JSON.stringify(args.command)]
|
|
20
|
+
: [JSON.stringify(args.command), `cwd ${JSON.stringify(cwd)}`];
|
|
21
|
+
}
|
|
22
|
+
case "read":
|
|
23
|
+
return [JSON.stringify(fileQuestion(name, args) ?? ".")];
|
|
24
|
+
case "write": {
|
|
25
|
+
const question = fileQuestion(name, args);
|
|
26
|
+
return question == null ? undefined : [JSON.stringify(question)];
|
|
27
|
+
}
|
|
28
|
+
case "mcp":
|
|
29
|
+
return [JSON.stringify(name), JSON.stringify(args ?? {})];
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
//# sourceMappingURL=cluster.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../src/policy-processor/cluster.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;GAGG;AACH,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAA8C;IACzF,QAAQ,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC/E,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,OAAO,GAAG,KAAK,SAAS;gBACtB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM;YACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC3D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,KAAK;YACR,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Classifier request cuts from the job's owning turn. Nested jobs keep
|
|
3
|
+
* that turn; a caller-supplied turn would be the wrong one. Privileged
|
|
4
|
+
* is user prompts on the owning turn and its tail ancestry — continue
|
|
5
|
+
* mints `prompt: ""` with the authorization on the tail. Unattended /
|
|
6
|
+
* eval with no user text: owning ProgrammaticJob expr (approval.md
|
|
7
|
+
* EVIDENCE). The bag itself is not a remainder subject — only inner
|
|
8
|
+
* ToolCallJob leaves.
|
|
9
|
+
*/
|
|
10
|
+
import { SessionTurn, ToolCallJob } from "@inhuman.tools/harness-model";
|
|
11
|
+
export type EvidenceCuts = {
|
|
12
|
+
/** Oldest-first user prompts on the owning turn and its tails (the eval expression when there are none). */
|
|
13
|
+
readonly userMessages?: readonly string[];
|
|
14
|
+
/** The agent's last completed answer before the most recent user message. Round 2 of the soft-deny judge only. */
|
|
15
|
+
readonly agentAnswer?: string;
|
|
16
|
+
readonly privileged: string;
|
|
17
|
+
readonly priorTurn: string;
|
|
18
|
+
readonly quarantined: string;
|
|
19
|
+
readonly policy?: string;
|
|
20
|
+
};
|
|
21
|
+
export declare function evidenceCuts(job: ToolCallJob): EvidenceCuts;
|
|
22
|
+
export declare function evidenceIdentity(cuts: EvidenceCuts): string;
|
|
23
|
+
/** Cluster+payload remainder skip key. */
|
|
24
|
+
export declare function evidencePayloadKey(job: ToolCallJob): string | null;
|
|
25
|
+
export declare function owningTurn(job: ToolCallJob): SessionTurn | null;
|
|
26
|
+
//# sourceMappingURL=evidence.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAKL,WAAW,EAEX,WAAW,EACZ,MAAM,8BAA8B,CAAC;AAGtC,MAAM,MAAM,YAAY,GAAG;IACzB,4GAA4G;IAC5G,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,kHAAkH;IAClH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAsC3D;AAoDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAMlE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI,CAE/D"}
|
|
@@ -0,0 +1,204 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Classifier request cuts from the job's owning turn. Nested jobs keep
|
|
3
|
+
* that turn; a caller-supplied turn would be the wrong one. Privileged
|
|
4
|
+
* is user prompts on the owning turn and its tail ancestry — continue
|
|
5
|
+
* mints `prompt: ""` with the authorization on the tail. Unattended /
|
|
6
|
+
* eval with no user text: owning ProgrammaticJob expr (approval.md
|
|
7
|
+
* EVIDENCE). The bag itself is not a remainder subject — only inner
|
|
8
|
+
* ToolCallJob leaves.
|
|
9
|
+
*/
|
|
10
|
+
import { clusterOf, fileQuestion, ProgrammaticJob, reactChunks, SessionTurn, tapeCompletion, ToolCallJob, } from "@inhuman.tools/harness-model";
|
|
11
|
+
import { parseTirithEvidence, tirithPolicyCut } from "@inhuman.tools/policy-tirith";
|
|
12
|
+
export function evidenceCuts(job) {
|
|
13
|
+
const turn = owningTurn(job);
|
|
14
|
+
const program = owningProgram(job);
|
|
15
|
+
if (turn == null) {
|
|
16
|
+
const expr = program?.expr.trim() || "";
|
|
17
|
+
return {
|
|
18
|
+
userMessages: expr === "" ? [] : [expr],
|
|
19
|
+
agentAnswer: "",
|
|
20
|
+
privileged: expr,
|
|
21
|
+
priorTurn: "",
|
|
22
|
+
quarantined: "",
|
|
23
|
+
policy: policyPipCut(job.policyEvidenceJson),
|
|
24
|
+
};
|
|
25
|
+
}
|
|
26
|
+
const prior = [];
|
|
27
|
+
const quarantined = [];
|
|
28
|
+
for (const chunk of reactChunks(turn)) {
|
|
29
|
+
const completion = tapeCompletion(chunk);
|
|
30
|
+
if (completion != null) {
|
|
31
|
+
if (!completion.isDone || underJob(completion, job))
|
|
32
|
+
continue;
|
|
33
|
+
if (completion.responseText !== "")
|
|
34
|
+
prior.push(completion.responseText);
|
|
35
|
+
continue;
|
|
36
|
+
}
|
|
37
|
+
if (!(chunk instanceof ToolCallJob) || chunk === job)
|
|
38
|
+
continue;
|
|
39
|
+
if (chunk.sealedOutcomeJson() == null)
|
|
40
|
+
continue;
|
|
41
|
+
const text = observationText(chunk.observationPayload());
|
|
42
|
+
if (text === "")
|
|
43
|
+
continue;
|
|
44
|
+
quarantined.push(`${chunk.name} → ${text}`);
|
|
45
|
+
}
|
|
46
|
+
const messages = userPrompts(turn, program);
|
|
47
|
+
return {
|
|
48
|
+
userMessages: messages,
|
|
49
|
+
agentAnswer: agentAnswerBefore(turn),
|
|
50
|
+
privileged: messages.join("\n"),
|
|
51
|
+
priorTurn: prior.join("\n"),
|
|
52
|
+
quarantined: quarantined.join("\n"),
|
|
53
|
+
policy: policyPipCut(job.policyEvidenceJson),
|
|
54
|
+
};
|
|
55
|
+
}
|
|
56
|
+
function policyPipCut(json) {
|
|
57
|
+
if (json == null || json === "")
|
|
58
|
+
return "";
|
|
59
|
+
const report = parseTirithEvidence(json);
|
|
60
|
+
if (report != null)
|
|
61
|
+
return tirithPolicyCut(report);
|
|
62
|
+
return json;
|
|
63
|
+
}
|
|
64
|
+
/** Oldest-first user prompts on `turn` then tails. Expr only when none exist. */
|
|
65
|
+
function userPrompts(turn, program) {
|
|
66
|
+
const seen = new Set();
|
|
67
|
+
const prompts = [];
|
|
68
|
+
let cell = turn;
|
|
69
|
+
while (cell != null && !seen.has(cell)) {
|
|
70
|
+
seen.add(cell);
|
|
71
|
+
const text = cell.prompt.trim();
|
|
72
|
+
if (text !== "")
|
|
73
|
+
prompts.push(text);
|
|
74
|
+
cell = cell.turnTail instanceof SessionTurn ? cell.turnTail : null;
|
|
75
|
+
}
|
|
76
|
+
prompts.reverse();
|
|
77
|
+
if (prompts.length > 0)
|
|
78
|
+
return prompts;
|
|
79
|
+
const expr = program?.expr.trim() || "";
|
|
80
|
+
return expr === "" ? [] : [expr];
|
|
81
|
+
}
|
|
82
|
+
/**
|
|
83
|
+
* The agent's last completed answer that precedes the most recent user message: the proposal a short
|
|
84
|
+
* reply ("let's do it") refers to. Not the current turn's text, never tool output. Empty when there is
|
|
85
|
+
* none (the most recent user message opens the conversation).
|
|
86
|
+
*/
|
|
87
|
+
function agentAnswerBefore(turn) {
|
|
88
|
+
const seen = new Set();
|
|
89
|
+
let cell = turn;
|
|
90
|
+
while (cell != null && !seen.has(cell) && cell.prompt.trim() === "") {
|
|
91
|
+
seen.add(cell);
|
|
92
|
+
cell = cell.turnTail instanceof SessionTurn ? cell.turnTail : null;
|
|
93
|
+
}
|
|
94
|
+
// `cell` carries the most recent user prompt. Its tails hold the answers that came before it.
|
|
95
|
+
let earlier = cell != null && cell.turnTail instanceof SessionTurn ? cell.turnTail : null;
|
|
96
|
+
while (earlier != null && !seen.has(earlier)) {
|
|
97
|
+
seen.add(earlier);
|
|
98
|
+
const chunks = reactChunks(earlier);
|
|
99
|
+
for (const chunk of chunks.toReversed()) {
|
|
100
|
+
const completion = tapeCompletion(chunk);
|
|
101
|
+
if (completion != null && completion.isDone && completion.responseText !== "")
|
|
102
|
+
return completion.responseText;
|
|
103
|
+
}
|
|
104
|
+
earlier = earlier.turnTail instanceof SessionTurn ? earlier.turnTail : null;
|
|
105
|
+
}
|
|
106
|
+
return "";
|
|
107
|
+
}
|
|
108
|
+
export function evidenceIdentity(cuts) {
|
|
109
|
+
return JSON.stringify([cuts.privileged, cuts.priorTurn, cuts.quarantined, cuts.policy ?? "", cuts.agentAnswer ?? ""]);
|
|
110
|
+
}
|
|
111
|
+
/** Cluster+payload remainder skip key. */
|
|
112
|
+
export function evidencePayloadKey(job) {
|
|
113
|
+
const payload = canonicalPayload(job);
|
|
114
|
+
if (payload == null || payload === "")
|
|
115
|
+
return null;
|
|
116
|
+
// The tier and classes are part of the key: a payload that was an ask under one policy and a
|
|
117
|
+
// soft-deny under another must not share a vote.
|
|
118
|
+
return JSON.stringify([clusterOf(job.name), payload, job.policyResult, job.policyClassesJson ?? ""]);
|
|
119
|
+
}
|
|
120
|
+
export function owningTurn(job) {
|
|
121
|
+
return ancestor(job, (parent) => parent instanceof SessionTurn);
|
|
122
|
+
}
|
|
123
|
+
function owningProgram(job) {
|
|
124
|
+
return ancestor(job, (parent) => parent instanceof ProgrammaticJob);
|
|
125
|
+
}
|
|
126
|
+
function ancestor(job, match) {
|
|
127
|
+
const seen = new Set();
|
|
128
|
+
let node = job;
|
|
129
|
+
while (node != null) {
|
|
130
|
+
if (seen.has(node))
|
|
131
|
+
return null;
|
|
132
|
+
seen.add(node);
|
|
133
|
+
const parent = node.parent;
|
|
134
|
+
if (match(parent))
|
|
135
|
+
return parent;
|
|
136
|
+
if (parent instanceof SessionTurn)
|
|
137
|
+
return null;
|
|
138
|
+
node = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
|
|
139
|
+
}
|
|
140
|
+
return null;
|
|
141
|
+
}
|
|
142
|
+
function underJob(node, job) {
|
|
143
|
+
const seen = new Set();
|
|
144
|
+
let cur = node;
|
|
145
|
+
while (cur != null) {
|
|
146
|
+
if (seen.has(cur))
|
|
147
|
+
return false;
|
|
148
|
+
seen.add(cur);
|
|
149
|
+
if (cur === job)
|
|
150
|
+
return true;
|
|
151
|
+
const parent = cur.parent;
|
|
152
|
+
if (parent instanceof SessionTurn)
|
|
153
|
+
return false;
|
|
154
|
+
cur = parent !== null && typeof parent === "object" && "parent" in parent ? parent : null;
|
|
155
|
+
}
|
|
156
|
+
return false;
|
|
157
|
+
}
|
|
158
|
+
function observationText(value) {
|
|
159
|
+
if (typeof value === "string")
|
|
160
|
+
return value;
|
|
161
|
+
if (value === undefined)
|
|
162
|
+
return "";
|
|
163
|
+
try {
|
|
164
|
+
const json = JSON.stringify(value);
|
|
165
|
+
return typeof json === "string" ? json : "";
|
|
166
|
+
}
|
|
167
|
+
catch {
|
|
168
|
+
return String(value);
|
|
169
|
+
}
|
|
170
|
+
}
|
|
171
|
+
function canonicalPayload(job) {
|
|
172
|
+
const args = job.args;
|
|
173
|
+
switch (clusterOf(job.name)) {
|
|
174
|
+
case "bash": {
|
|
175
|
+
const command = args?.command;
|
|
176
|
+
if (typeof command !== "string" || command === "")
|
|
177
|
+
return null;
|
|
178
|
+
const cwd = args?.cwd;
|
|
179
|
+
if (typeof cwd === "string" && cwd !== "" && cwd !== ".")
|
|
180
|
+
return `${command}\ncwd ${cwd}`;
|
|
181
|
+
return command;
|
|
182
|
+
}
|
|
183
|
+
case "read":
|
|
184
|
+
return fileQuestion(job.name, args) ?? ".";
|
|
185
|
+
case "write":
|
|
186
|
+
return fileQuestion(job.name, args);
|
|
187
|
+
case "mcp":
|
|
188
|
+
return `${job.name}\n${stableJson(args ?? {})}`;
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
function sortKeys(value) {
|
|
192
|
+
if (value === null || typeof value !== "object")
|
|
193
|
+
return value;
|
|
194
|
+
if (Array.isArray(value))
|
|
195
|
+
return value.map((item) => sortKeys(item));
|
|
196
|
+
const rec = value;
|
|
197
|
+
return Object.fromEntries(Object.keys(rec)
|
|
198
|
+
.toSorted()
|
|
199
|
+
.map((key) => [key, sortKeys(rec[key])]));
|
|
200
|
+
}
|
|
201
|
+
function stableJson(value) {
|
|
202
|
+
return JSON.stringify(sortKeys(value));
|
|
203
|
+
}
|
|
204
|
+
//# sourceMappingURL=evidence.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/policy-processor/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,SAAS,EACT,YAAY,EACZ,eAAe,EACf,WAAW,EACX,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAapF,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO;YACL,YAAY,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvC,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC9D,IAAI,UAAU,CAAC,YAAY,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC,IAAI,KAAK,KAAK,GAAG;YAAE,SAAS;QAC/D,IAAI,KAAK,CAAC,iBAAiB,EAAE,IAAI,IAAI;YAAE,SAAS;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC;QACpC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,IAAiB,EAAE,OAA+B;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,GAAG,IAAI,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,CAAC;IACD,8FAA8F;IAC9F,IAAI,OAAO,GAAuB,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,OAAO,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,YAAY,KAAK,EAAE;gBAAE,OAAO,UAAU,CAAC,YAAY,CAAC;QAChH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,kBAAkB,CAAC,GAAgB;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,6FAA6F;IAC7F,iDAAiD;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAA6B,EAAE,CAAC,MAAM,YAAY,eAAe,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,QAAQ,CAAI,GAAwB,EAAE,KAAuC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,IAAI,GAA+B,GAAG,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB,EAAE,GAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,GAAG,GAA+B,IAAI,CAAC;IAC3C,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAY,GAAG,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,YAAY,WAAW;YAAE,OAAO,KAAK,CAAC;QAChD,GAAG,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAE,MAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAgB;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,QAAQ,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;gBAAE,OAAO,GAAG,OAAO,SAAS,GAAG,EAAE,CAAC;YAC1F,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAC7C,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,KAAK,KAAK;YACR,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACb,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC"}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
import { type GrantRow, type GrantSubject, type PermissionMode } from "@inhuman.tools/harness-model";
|
|
2
|
+
import { type ClassId } from "@inhuman.tools/policy/floor";
|
|
3
|
+
import { type LicenseScope } from "./scope.js";
|
|
4
|
+
export type ExplainProbe = {
|
|
5
|
+
readonly kind: "shell";
|
|
6
|
+
readonly command: string;
|
|
7
|
+
readonly cwd?: string;
|
|
8
|
+
} | {
|
|
9
|
+
readonly kind: "path";
|
|
10
|
+
readonly cluster: "read" | "write";
|
|
11
|
+
readonly path: string;
|
|
12
|
+
} | {
|
|
13
|
+
readonly kind: "mcp";
|
|
14
|
+
readonly server: string;
|
|
15
|
+
readonly account?: string;
|
|
16
|
+
readonly tool: string;
|
|
17
|
+
} | {
|
|
18
|
+
readonly kind: "tool";
|
|
19
|
+
readonly name: string;
|
|
20
|
+
readonly args?: Readonly<Record<string, unknown>>;
|
|
21
|
+
};
|
|
22
|
+
export type Tier = "block" | "soft-deny" | "ask" | "allow";
|
|
23
|
+
export type Explanation = {
|
|
24
|
+
readonly tier: Tier;
|
|
25
|
+
readonly classes: Array<{
|
|
26
|
+
readonly id: ClassId;
|
|
27
|
+
readonly label: string;
|
|
28
|
+
}>;
|
|
29
|
+
readonly votes: Array<{
|
|
30
|
+
readonly tier: Tier;
|
|
31
|
+
readonly class: ClassId;
|
|
32
|
+
readonly ruleId: string;
|
|
33
|
+
readonly lift?: string;
|
|
34
|
+
}>;
|
|
35
|
+
readonly resolver: {
|
|
36
|
+
readonly kind: "allow" | "judge" | "human" | "deny";
|
|
37
|
+
readonly layer: "dist" | "managed" | "user" | "project" | "session";
|
|
38
|
+
readonly onDeny?: "human" | "deny";
|
|
39
|
+
readonly onFail?: "human" | "deny";
|
|
40
|
+
} | null;
|
|
41
|
+
readonly grant: GrantRow | null;
|
|
42
|
+
readonly grantable: GrantSubject[];
|
|
43
|
+
/** Acknowledgement flags that cover the call in this mode and the stored ack that satisfies them. */
|
|
44
|
+
readonly ack: {
|
|
45
|
+
readonly flags: Array<{
|
|
46
|
+
readonly label: string;
|
|
47
|
+
readonly why?: string;
|
|
48
|
+
readonly layer: string;
|
|
49
|
+
}>;
|
|
50
|
+
readonly satisfiedBy: GrantRow | null;
|
|
51
|
+
} | null;
|
|
52
|
+
readonly outcome: "runs" | "judge-ask" | "judge-soft-deny" | "prompts-you" | "denied" | "blocked";
|
|
53
|
+
readonly reason: string;
|
|
54
|
+
};
|
|
55
|
+
export declare function explainCall(scope: LicenseScope, probe: ExplainProbe, options?: {
|
|
56
|
+
readonly mode?: PermissionMode;
|
|
57
|
+
readonly unattended?: boolean;
|
|
58
|
+
}): Promise<Explanation>;
|
|
59
|
+
//# sourceMappingURL=explain.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"explain.d.ts","sourceRoot":"","sources":["../../src/policy-processor/explain.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,YAAY,EAUjB,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAkC,KAAK,OAAO,EAAqB,MAAM,6BAA6B,CAAC;AAG9G,OAAO,EAA+B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAExG,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;QACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KACpC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IACnC,qGAAqG;IACrG,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjG,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;KACvC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAqBF,wBAAsB,WAAW,CAC/B,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,WAAW,CAAC,CA4GtB"}
|
|
@@ -0,0 +1,224 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* "What would happen to this call right now?" The same floor, grant and resolution code as a real
|
|
3
|
+
* call, with no judge and no effect, so the answer cannot drift from the real path.
|
|
4
|
+
*/
|
|
5
|
+
import nodePath from "node:path";
|
|
6
|
+
import { activeAcks, clusterOf, collectAckFlags, coveringGrants, grantOptionsFor, isShellHatch, layersOf, matchAckFlags, readRootList, resolveAcks, resolveCall, ruleStampFor, } from "@inhuman.tools/harness-model";
|
|
7
|
+
import { CLASSES, classesOf, join, cast } from "@inhuman.tools/policy/floor";
|
|
8
|
+
import { tirithClass, tirithDisposition, tirithFailure } from "@inhuman.tools/policy-tirith";
|
|
9
|
+
import { floorVerdict, withRealRoots } from "./scope.js";
|
|
10
|
+
const TIER = { block: "block", deny: "soft-deny", ask: "ask", policyApprove: "allow" };
|
|
11
|
+
function nameAndArgs(probe) {
|
|
12
|
+
switch (probe.kind) {
|
|
13
|
+
case "shell":
|
|
14
|
+
return {
|
|
15
|
+
name: "shell",
|
|
16
|
+
args: { command: probe.command, ...(probe.cwd === undefined ? {} : { cwd: probe.cwd }) },
|
|
17
|
+
mcpName: "shell",
|
|
18
|
+
};
|
|
19
|
+
case "path":
|
|
20
|
+
return { name: probe.cluster === "read" ? "read_file" : "write_file", args: { path: probe.path }, mcpName: "" };
|
|
21
|
+
case "mcp":
|
|
22
|
+
return { name: `mcp__${probe.server}__${probe.tool}`, args: {}, mcpName: probe.tool };
|
|
23
|
+
case "tool":
|
|
24
|
+
return { name: probe.name, args: { ...probe.args }, mcpName: probe.name };
|
|
25
|
+
}
|
|
26
|
+
}
|
|
27
|
+
export async function explainCall(scope, probe, options = {}) {
|
|
28
|
+
const root = scope.root;
|
|
29
|
+
const { name, args, mcpName } = nameAndArgs(probe);
|
|
30
|
+
const source = root.policyProgram.trim() === "" ? scope.distSource() : root.policyProgram;
|
|
31
|
+
let verdict;
|
|
32
|
+
const layers = layersOf({
|
|
33
|
+
user: root.authorizationUserJson,
|
|
34
|
+
project: root.authorizationProjectJson,
|
|
35
|
+
session: root.authorizationOverlayJson,
|
|
36
|
+
});
|
|
37
|
+
const ruleMcp = probe.kind === "mcp"
|
|
38
|
+
? { server: probe.server, account: probe.account ?? probe.server, tool: probe.tool }
|
|
39
|
+
: undefined;
|
|
40
|
+
const rule = clusterOf(name) === "mcp"
|
|
41
|
+
? ruleStampFor(layers, { tool: name, ...(ruleMcp === undefined ? {} : { mcp: ruleMcp }) })
|
|
42
|
+
: {};
|
|
43
|
+
try {
|
|
44
|
+
const policy = await scope.compiledPolicy(source, await withRealRoots(readRootList(root.readRoots).toSorted()));
|
|
45
|
+
verdict = await floorVerdict(policy, name, args, root.path, mcpName, rule);
|
|
46
|
+
}
|
|
47
|
+
catch (error) {
|
|
48
|
+
verdict = cast("block", "policy-fault", "host:policy-invalid");
|
|
49
|
+
return finish(verdict, null, null, [], `the policy is invalid, so every call is blocked: ${error instanceof Error ? error.message : String(error)}`);
|
|
50
|
+
}
|
|
51
|
+
if (clusterOf(name) === "bash" && typeof args.command === "string") {
|
|
52
|
+
try {
|
|
53
|
+
const report = await scope.checkShell(args.command, {
|
|
54
|
+
cwd: nodePath.resolve(root.path, typeof args.cwd === "string" ? args.cwd : "."),
|
|
55
|
+
});
|
|
56
|
+
verdict = join([
|
|
57
|
+
verdict,
|
|
58
|
+
cast(tirithDisposition(report), tirithClass(report), `tirith:${report.findings.map((f) => f.rule_id).join("+")}`),
|
|
59
|
+
]);
|
|
60
|
+
}
|
|
61
|
+
catch (error) {
|
|
62
|
+
const report = tirithFailure(error);
|
|
63
|
+
verdict = join([verdict, cast(tirithDisposition(report), tirithClass(report), "tirith:error")]);
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
const tierVotes = verdict.votes.filter((vote) => vote.disposition === verdict.disposition);
|
|
67
|
+
const classes = classesOf(verdict);
|
|
68
|
+
const cluster = clusterOf(name);
|
|
69
|
+
const mcp = ruleMcp;
|
|
70
|
+
const hatch = typeof args.command === "string" && isShellHatch(args.command);
|
|
71
|
+
const call = {
|
|
72
|
+
tier: verdict.disposition,
|
|
73
|
+
cluster,
|
|
74
|
+
hatch,
|
|
75
|
+
votes: tierVotes,
|
|
76
|
+
mcp,
|
|
77
|
+
toolName: name,
|
|
78
|
+
};
|
|
79
|
+
const grant = verdict.disposition === "ask" ? (coveringGrants(scope.visibleGrants(), call)?.[0] ?? null) : null;
|
|
80
|
+
const grantable = grantOptionsFor(call).map((option) => option.subject);
|
|
81
|
+
const subject = {
|
|
82
|
+
tool: name,
|
|
83
|
+
units: tierVotes.flatMap((vote) => (vote.unit === undefined ? [] : [vote.unit])),
|
|
84
|
+
paths: tierVotes.flatMap((vote) => (vote.path === undefined ? [] : [vote.path])),
|
|
85
|
+
...(mcp === undefined ? {} : { mcp }),
|
|
86
|
+
};
|
|
87
|
+
const resolution = verdict.disposition === "ask" || verdict.disposition === "deny"
|
|
88
|
+
? resolveCall(layers, {
|
|
89
|
+
mode: options.mode ?? root.permissionMode,
|
|
90
|
+
cluster,
|
|
91
|
+
tier: verdict.disposition,
|
|
92
|
+
classes,
|
|
93
|
+
unattended: options.unattended ?? false,
|
|
94
|
+
subject,
|
|
95
|
+
})
|
|
96
|
+
: null;
|
|
97
|
+
const mode = options.mode ?? root.permissionMode;
|
|
98
|
+
const ackCall = {
|
|
99
|
+
classes,
|
|
100
|
+
...(mcp === undefined ? {} : { mcp }),
|
|
101
|
+
tool: name,
|
|
102
|
+
units: [...(verdict.seen ?? []), ...verdict.votes.flatMap((vote) => (vote.unit === undefined ? [] : [vote.unit]))],
|
|
103
|
+
};
|
|
104
|
+
const active = verdict.disposition === "block" ? [] : activeAcks(matchAckFlags(collectAckFlags(layers), ackCall), mode);
|
|
105
|
+
const acks = resolveAcks(active, scope.visibleAcks(), ackCall);
|
|
106
|
+
const ack = active.length === 0
|
|
107
|
+
? null
|
|
108
|
+
: {
|
|
109
|
+
flags: active.map((flag) => ({
|
|
110
|
+
label: flag.label,
|
|
111
|
+
...(flag.why === undefined ? {} : { why: flag.why }),
|
|
112
|
+
layer: flag.layer,
|
|
113
|
+
})),
|
|
114
|
+
satisfiedBy: acks.state === "satisfied" ? (scope.visibleAcks().find((row) => row.id === acks.ackedBy[0]) ?? null) : null,
|
|
115
|
+
};
|
|
116
|
+
return withAck(finish(verdict, resolution, grant, grantable, undefined, options.unattended ?? false), ack, options.unattended ?? false);
|
|
117
|
+
}
|
|
118
|
+
/**
|
|
119
|
+
* An unsatisfied flag stops a call that would run, and follows one that waits for a judge or a person.
|
|
120
|
+
* `block` and denials are untouched: an acknowledgement never lifts anything.
|
|
121
|
+
*/
|
|
122
|
+
function withAck(base, ack, unattended) {
|
|
123
|
+
if (ack === null || ack.satisfiedBy !== null)
|
|
124
|
+
return { ...base, ack };
|
|
125
|
+
const what = ack.flags.map((flag) => flag.label).join("; ");
|
|
126
|
+
if (base.outcome === "blocked" || base.outcome === "denied")
|
|
127
|
+
return { ...base, ack };
|
|
128
|
+
if (unattended) {
|
|
129
|
+
return {
|
|
130
|
+
...base,
|
|
131
|
+
ack,
|
|
132
|
+
outcome: "denied",
|
|
133
|
+
reason: `${base.reason} It also needs your acknowledgement (${what}); this run is unattended, so it is denied as interaction_required and the run continues.`,
|
|
134
|
+
};
|
|
135
|
+
}
|
|
136
|
+
if (base.outcome === "runs") {
|
|
137
|
+
return {
|
|
138
|
+
...base,
|
|
139
|
+
ack,
|
|
140
|
+
outcome: "prompts-you",
|
|
141
|
+
reason: `${base.reason} It is flagged to need your acknowledgement (${what}), so you are asked before it runs.`,
|
|
142
|
+
};
|
|
143
|
+
}
|
|
144
|
+
return { ...base, ack, reason: `${base.reason} If it is allowed, you are still asked to acknowledge it (${what}).` };
|
|
145
|
+
}
|
|
146
|
+
function finish(verdict, resolution, grant, grantable, forced, unattended = false) {
|
|
147
|
+
const tier = TIER[verdict.disposition] ?? "ask";
|
|
148
|
+
const classes = classesOf(verdict);
|
|
149
|
+
const base = {
|
|
150
|
+
tier,
|
|
151
|
+
classes: classes.map((id) => ({ id, label: CLASSES[id].label })),
|
|
152
|
+
votes: verdict.votes.map((vote) => ({
|
|
153
|
+
tier: TIER[vote.disposition] ?? "ask",
|
|
154
|
+
class: vote.class,
|
|
155
|
+
ruleId: vote.ruleId,
|
|
156
|
+
...(vote.lift === undefined ? {} : { lift: vote.lift }),
|
|
157
|
+
})),
|
|
158
|
+
grant,
|
|
159
|
+
grantable,
|
|
160
|
+
ack: null,
|
|
161
|
+
};
|
|
162
|
+
const what = classes.map((id) => CLASSES[id].label.toLowerCase()).join(", ");
|
|
163
|
+
if (verdict.disposition === "block") {
|
|
164
|
+
return {
|
|
165
|
+
...base,
|
|
166
|
+
resolver: null,
|
|
167
|
+
outcome: "blocked",
|
|
168
|
+
reason: forced ?? `Blocked (${what}). Nothing lifts a block: no mode, grant, judge or answer.`,
|
|
169
|
+
};
|
|
170
|
+
}
|
|
171
|
+
if (resolution === null) {
|
|
172
|
+
return { ...base, resolver: null, outcome: "runs", reason: "The floor allows it." };
|
|
173
|
+
}
|
|
174
|
+
const { resolver, layer, interaction } = resolution;
|
|
175
|
+
const cell = {
|
|
176
|
+
kind: resolver.kind,
|
|
177
|
+
layer,
|
|
178
|
+
...(resolver.kind === "judge" ? { onDeny: resolver.onDeny, onFail: resolver.onFail } : {}),
|
|
179
|
+
};
|
|
180
|
+
const tierName = tier === "soft-deny" ? "Soft-deny" : "Ask";
|
|
181
|
+
if (grant !== null) {
|
|
182
|
+
return {
|
|
183
|
+
...base,
|
|
184
|
+
resolver: cell,
|
|
185
|
+
outcome: "runs",
|
|
186
|
+
reason: `${tierName} (${what}), covered by a stored grant: ${grant.label}.`,
|
|
187
|
+
};
|
|
188
|
+
}
|
|
189
|
+
switch (resolver.kind) {
|
|
190
|
+
case "allow":
|
|
191
|
+
return {
|
|
192
|
+
...base,
|
|
193
|
+
resolver: cell,
|
|
194
|
+
outcome: "runs",
|
|
195
|
+
reason: `${tierName} (${what}); the ${layer} table allows it in this mode.`,
|
|
196
|
+
};
|
|
197
|
+
case "deny":
|
|
198
|
+
return {
|
|
199
|
+
...base,
|
|
200
|
+
resolver: cell,
|
|
201
|
+
outcome: "denied",
|
|
202
|
+
reason: interaction.resolver || (unattended && interaction.onDeny)
|
|
203
|
+
? `${tierName} (${what}) needs a person, and this run is unattended: denied as interaction_required.`
|
|
204
|
+
: `${tierName} (${what}); the ${layer} table denies it.`,
|
|
205
|
+
};
|
|
206
|
+
case "human":
|
|
207
|
+
return {
|
|
208
|
+
...base,
|
|
209
|
+
resolver: cell,
|
|
210
|
+
outcome: "prompts-you",
|
|
211
|
+
reason: `${tierName} (${what}): you are asked${tier === "soft-deny" ? " every time; nothing is remembered" : ""}.`,
|
|
212
|
+
};
|
|
213
|
+
case "judge":
|
|
214
|
+
return {
|
|
215
|
+
...base,
|
|
216
|
+
resolver: cell,
|
|
217
|
+
outcome: tier === "soft-deny" ? "judge-soft-deny" : "judge-ask",
|
|
218
|
+
reason: tier === "soft-deny"
|
|
219
|
+
? `Soft-deny (${what}): the judge decides whether you explicitly asked for exactly this; a "no" ${resolver.onDeny === "human" ? "asks you" : "denies it"}. Grants do not apply.`
|
|
220
|
+
: `Ask (${what}): the judge decides; a "no" ${resolver.onDeny === "human" ? "asks you" : "denies it"}.`,
|
|
221
|
+
};
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
//# sourceMappingURL=explain.js.map
|