@intutic/gate 1.10.1

package/dist/gate.js

@@ -0,0 +1,274 @@
+/**
+ * The enforcement point.
+ *
+ * Port of `packages/intutic-clawde/intutic_clawde/gate/gate.py`.
+ *
+ * Intutic ships PreToolUse hooks for the harnesses it has a native adapter
+ * for; frameworks outside that list (Mastra, the Vercel AI SDK, LangChain.js,
+ * a hand-rolled loop) have no adapter, and the sync-daemon writes no
+ * PreToolUse hook for them. This package is that enforcement point: the
+ * missing adapter, written against Intutic's own published gate contract.
+ *
+ * Four tiers, in order — identical precedence to the Python SDK:
+ *
+ *   A1  policy snapshot   port of intuticGate()          fails CLOSED
+ *   A3  SOP rules         authored in the product        fails OPEN (A2 covers it)
+ *   A2  image integrity   local check                    fails CLOSED
+ *   B   POST /hook-gate   control-plane check             fail posture set by GateClient
+ *
+ * A1 and A2 are load-bearing and local. Tier B contributes the DLP regexes
+ * and workspace policy from the control plane; whether an unreachable control
+ * plane blocks is the client's `failClosed` setting (default true).
+ *
+ * Tier A3 applies rules written in the SOP register rather than in code. It
+ * runs BEFORE A2 so that a block, when both would fire, is attributed to the
+ * authored policy rather than to the hardcoded one. It fails open because A2
+ * covers the identical case and fails closed: A3 moves where the policy is
+ * *written*, and is not what makes the run safe. See soprules.ts.
+ *
+ * ## Naming note for callers porting from other Intutic SDKs
+ *
+ * This is NOT the "static floor" tier the compiled shell/JS gate emitters
+ * carry (`staticFloorPatterns()` in
+ * `services/sync-daemon/src/harness/protectedPaths.ts`, concatenated ahead of
+ * the snapshot's own rules in `gateBody.ts`'s `intuticGate()`). Like the
+ * Python SDK it ports, this package's Tier A1 reads ONLY
+ * `~/.intutic/hooks/policy-snapshot.rules` — the compiled-in bypass/secret/
+ * skill-surface patterns never reach that file (only SOP-authored rules, the
+ * destructive-command tier, and the tier-promoted skill-surface rules do, via
+ * `buildSnapshotRules` in `services/sync-daemon/src/lib/policySnapshot.ts`).
+ * A workspace relying on this SDK for governance therefore gets a strict
+ * SUBSET of what a shipped shell/JS harness gate enforces. That gap already
+ * exists in the Python SDK this package ports; it is not introduced here. See
+ * `src/__tests__/fidelity.test.ts` for the parts of the shipped contract this
+ * package's Tier A1 DOES reproduce exactly (the destructive-command and
+ * skill-surface pattern tables, as they would arrive via a real snapshot).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { isDeploy, touchesInfra } from './actions.js';
+import { IntuticGateRefusal } from './errors.js';
+import * as imagecheck from './imagecheck.js';
+import * as snapshot from './snapshot.js';
+import * as soprules from './soprules.js';
+/** Tools that cannot change anything. They still get the local snapshot check
+ *  (Tier A1), but skip the remote gate call (Tier B). */
+export const READ_ONLY_TOOLS = new Set([
+    'read_file',
+    'list_files',
+    'read',
+    'cat',
+    'view',
+]);
+function resolveConfig(cfg) {
+    return {
+        repoRoot: cfg.repoRoot ?? '.',
+        workspaceId: cfg.workspaceId ?? '',
+        allowlistPath: cfg.allowlistPath ?? '.intutic/image-allowlist.json',
+        enforce: cfg.enforce ?? true,
+        useHookGate: cfg.useHookGate ?? true,
+        useSopRules: cfg.useSopRules ?? true,
+    };
+}
+export class Gate {
+    cfg;
+    client;
+    _snapshot = null;
+    _snapshotReported = false;
+    _policy = null;
+    /** `null` = not fetched yet. A failed fetch caches `[]` so one unreachable
+     *  control plane does not add a timeout to every subsequent tool call. */
+    _sopRules = null;
+    constructor(cfg = {}, client = null) {
+        this.cfg = resolveConfig(cfg);
+        this.client = client;
+    }
+    allowlistAbs() {
+        const p = this.cfg.allowlistPath;
+        return isAbsolutePath(p) ? p : joinPath(this.cfg.repoRoot, p);
+    }
+    // ------------------------------------------------------------ loading
+    getSnapshot() {
+        if (this._snapshot === null) {
+            this._snapshot = snapshot.loadSnapshot(this.cfg.workspaceId);
+        }
+        return this._snapshot;
+    }
+    /**
+     * Load the image allowlist.
+     *
+     * A missing or malformed allowlist is NOT treated as "allow everything".
+     * An empty policy with `require_digest` still refuses every unpinned
+     * image, which is the safe direction; a policy we cannot read at all
+     * throws, and the caller turns that into a block.
+     */
+    getPolicy() {
+        if (this._policy === null) {
+            const path = this.allowlistAbs();
+            if (!existsSync(path)) {
+                throw new IntuticGateRefusal(`[image-integrity] ${imagecheck.E_MANIFEST_UNPARSEABLE}: image allowlist not found at ` +
+                    `${path}; refusing to approve an image against a policy that does not exist`, imagecheck.E_MANIFEST_UNPARSEABLE);
+            }
+            try {
+                this._policy = JSON.parse(readFileSync(path, 'utf-8'));
+            }
+            catch (exc) {
+                const name = exc instanceof Error ? exc.constructor.name : 'Error';
+                throw new IntuticGateRefusal(`[image-integrity] ${imagecheck.E_MANIFEST_UNPARSEABLE}: image allowlist at ${path} is ` +
+                    `unreadable (${name})`, imagecheck.E_MANIFEST_UNPARSEABLE);
+            }
+        }
+        return this._policy;
+    }
+    /**
+     * Active SOP rules, fetched once per process.
+     *
+     * Deliberately not refreshed on a timer: a rule set that changes mid-run
+     * makes a verdict depend on when the fetch landed. Construct a new `Gate`
+     * (or clear the cache) to refresh.
+     */
+    async getSopRules() {
+        if (this._sopRules === null) {
+            let fetched = null;
+            if (this.client !== null) {
+                fetched = await soprules.fetchRules(this.client.baseUrl, this.client.apiKey, this.cfg.workspaceId);
+            }
+            if (fetched === null) {
+                // Could not read the register. Say so once, then stay quiet — Tier
+                // A2 still fails closed on the same condition.
+                await this.emit('tool_flagged', 'sop_rules', 'SOP rule register unreachable; SOP-rule tier inactive for this run ' +
+                    '(image-integrity check unaffected)');
+                fetched = [];
+            }
+            this._sopRules = fetched;
+        }
+        return this._sopRules;
+    }
+    // ------------------------------------------------------------ emitting
+    async emit(event, tool, reason = '', toolInput, incidentId, filePath) {
+        if (this.client !== null) {
+            await this.client.emit(event, tool, reason, toolInput, incidentId, filePath);
+        }
+    }
+    /**
+     * Report snapshot condition exactly once per process — otherwise these
+     * states are computed and never read, and an operator cannot distinguish
+     * "snapshot missing on 400 machines" from "snapshot healthy".
+     */
+    async reportSnapshotHealthOnce(tool) {
+        if (this._snapshotReported)
+            return;
+        this._snapshotReported = true;
+        const snap = this.getSnapshot();
+        if (snap.state !== 'ok') {
+            await this.emit(`snapshot_${snap.state}`, tool, snap.healthMessage);
+        }
+    }
+    // --------------------------------------------------------------- guard
+    /** Throws {@link IntuticGateRefusal} if this call must not run. Resolves to allow. */
+    async guard(toolName, toolInput) {
+        if (!this.cfg.enforce)
+            return;
+        const target = String(toolInput.path ?? toolInput.file_path ?? '');
+        const command = String(toolInput.command ?? '');
+        await this.reportSnapshotHealthOnce(toolName);
+        // ---- Tier A1: policy snapshot -------------------------------------
+        const disabled = snapshot.guardDisabledFromEnv();
+        if (disabled) {
+            await this.emit('guards_disabled', toolName, 'INTUTIC_GUARD_DISABLE=1 — policy-snapshot rules skipped; built-in protections still active');
+        }
+        const d = snapshot.evaluate(toolName, target, command, this.getSnapshot(), disabled);
+        if (d.severity === snapshot.SEV_BLOCK) {
+            await this.emit('tool_blocked', toolName, d.reason, toolInput);
+            throw new IntuticGateRefusal(d.reason, 'SNAPSHOT');
+        }
+        if (d.severity === snapshot.SEV_WARN) {
+            await this.emit('tool_flagged', toolName, d.reason, toolInput);
+        }
+        else if (d.severity === snapshot.SEV_SHADOW) {
+            await this.emit('tool_would_block', toolName, d.reason, toolInput);
+        }
+        // ---- Tier A3: SOP rules authored in the product --------------------
+        //
+        // Runs before A2 on purpose. When both would fire, the block should be
+        // attributed to the policy someone wrote in the register, not to the one
+        // hardcoded here.
+        if (this.cfg.useSopRules && !READ_ONLY_TOOLS.has(toolName)) {
+            const rule = soprules.firstMatch(await this.getSopRules(), toolName, toolInput);
+            if (rule !== null) {
+                const reason = `[sop:${rule.id}] ${rule.reason}`;
+                if (rule.action === soprules.ACTION_BLOCK) {
+                    await this.emit('tool_blocked', toolName, reason, toolInput);
+                    throw new IntuticGateRefusal(reason, 'SOP_RULE');
+                }
+                if (rule.action === soprules.ACTION_APPROVAL) {
+                    // No human is at the keyboard during an agent run, so an approval
+                    // that cannot be granted is a block.
+                    await this.emit('tool_blocked', toolName, `${reason} (approval required; no reviewer in an unattended run)`, toolInput);
+                    throw new IntuticGateRefusal(reason, 'SOP_RULE_APPROVAL');
+                }
+                await this.emit('tool_flagged', toolName, reason, toolInput);
+            }
+        }
+        // ---- Tier A2: image integrity -------------------------------------
+        if (isDeploy(toolName, toolInput)) {
+            const verdict = imagecheck.checkCommand(command, this.cfg.repoRoot, this.getPolicy());
+            if (!verdict.ok) {
+                const reason = `${imagecheck.verdictReason(verdict)} — policy ${this.cfg.allowlistPath}`;
+                await this.emit('tool_blocked', toolName, reason, toolInput);
+                throw new IntuticGateRefusal(reason, verdict.code);
+            }
+        }
+        // A write to infrastructure gets the same check one turn earlier, as a
+        // flag rather than a block: the dashboard then shows the bad manifest
+        // being authored before it is applied.
+        if (target && touchesInfra(target) && 'content' in toolInput) {
+            const v = imagecheck.checkWrittenManifest(target, String(toolInput.content), this.getPolicy());
+            if (!v.ok) {
+                await this.emit('tool_flagged', toolName, `${imagecheck.verdictReason(v)} (authoring-time check; the apply will be refused)`, toolInput, undefined, target);
+            }
+        }
+        // ---- Tier B: control plane gate -----------------------------------
+        //
+        // Skipped for read-only tools — a network round trip whose checks are
+        // DLP regexes over the arguments and SOP rules, neither of which can say
+        // anything useful about a directory listing.
+        if (this.cfg.useHookGate && this.client !== null && !READ_ONLY_TOOLS.has(toolName)) {
+            const resp = await this.client.hookGate(toolName, toolInput);
+            if (!resp.allowed) {
+                await this.emit('tool_blocked', toolName, resp.reason, toolInput, resp.incidentId);
+                throw new IntuticGateRefusal(resp.reason, 'HOOK_GATE', resp.incidentId);
+            }
+        }
+        if (!READ_ONLY_TOOLS.has(toolName)) {
+            await this.emit('tool_allowed', toolName, '', toolInput);
+        }
+    }
+}
+function isAbsolutePath(p) {
+    return p.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(p);
+}
+function trimTrailingSlashes(s) {
+    let end = s.length;
+    while (end > 0 && s[end - 1] === '/')
+        end--;
+    return s.slice(0, end);
+}
+function trimLeadingSlashes(s) {
+    let start = 0;
+    while (start < s.length && s[start] === '/')
+        start++;
+    return s.slice(start);
+}
+function joinPath(a, b) {
+    return `${trimTrailingSlashes(a)}/${trimLeadingSlashes(b)}`;
+}
+// Module-level active gate, so wrapped tools do not need the instance
+// threaded through every call site.
+let _active = null;
+export function install(gate) {
+    _active = gate;
+}
+export function active() {
+    return _active;
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;yDACyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,WAAW;IACX,YAAY;IACZ,MAAM;IACN,KAAK;IACL,MAAM;CACP,CAAC,CAAA;AAoBF,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,+BAA+B;QACnE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;KACrC,CAAA;AACH,CAAC;AAID,MAAM,OAAO,IAAI;IACN,GAAG,CAAgB;IACnB,MAAM,CAAmB;IAC1B,SAAS,GAA6B,IAAI,CAAA;IAC1C,iBAAiB,GAAG,KAAK,CAAA;IACzB,OAAO,GAAkC,IAAI,CAAA;IACrD;8EAC0E;IAClE,SAAS,GAA8B,IAAI,CAAA;IAEnD,YAAY,MAAkB,EAAE,EAAE,SAA4B,IAAI;QAChE,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,YAAY;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAA;QAChC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,uEAAuE;IAEvE,WAAW;QACT,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,iCAAiC;oBACrF,GAAG,IAAI,qEAAqE,EAC9E,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA2B,CAAA;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;gBAClE,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,UAAU,CAAC,sBAAsB,wBAAwB,IAAI,MAAM;oBACtF,eAAe,IAAI,GAAG,EACxB,UAAU,CAAC,sBAAsB,CAClC,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,GAA8B,IAAI,CAAA;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpG,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,WAAW,EACX,qEAAqE;oBACnE,oCAAoC,CACvC,CAAA;gBACD,OAAO,GAAG,EAAE,CAAA;YACd,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,wEAAwE;IAEhE,KAAK,CAAC,IAAI,CAChB,KAAa,EACb,IAAY,EACZ,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,IAAY;QACjD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAM;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,sFAAsF;IACtF,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,SAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAM;QAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAE/C,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAA;QAE7C,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,oBAAoB,EAAE,CAAA;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CACb,iBAAiB,EACjB,QAAQ,EACR,4FAA4F,CAC7F,CAAA;QACH,CAAC;QAED,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;QACpF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACpE,CAAC;QAED,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,kBAAkB;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;gBAChD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;oBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;gBAClD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;oBAC7C,kEAAkE;oBAClE,qCAAqC;oBACrC,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,MAAM,wDAAwD,EACjE,SAAS,CACV,CAAA;oBACD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAA;gBACxF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,QAAQ,EACR,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oDAAoD,EAClF,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAA;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClF,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IACpD,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED,sEAAsE;AACtE,oCAAoC;AACpC,IAAI,OAAO,GAAgB,IAAI,CAAA;AAE/B,MAAM,UAAU,OAAO,CAAC,IAAiB;IACvC,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,OAAO,CAAA;AAChB,CAAC"}