@machina.ai/cell-cli-core 1.4.0-rc2 → 1.6.1-rc1

package/dist/src/policy/policy-engine.test.js

@@ -0,0 +1,470 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { PolicyEngine } from './policy-engine.js';
+import { PolicyDecision, } from './types.js';
+describe('PolicyEngine', () => {
+    let engine;
+    beforeEach(() => {
+        engine = new PolicyEngine();
+    });
+    describe('constructor', () => {
+        it('should use default config when none provided', () => {
+            const decision = engine.check({ name: 'test' });
+            expect(decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should respect custom default decision', () => {
+            engine = new PolicyEngine({ defaultDecision: PolicyDecision.DENY });
+            const decision = engine.check({ name: 'test' });
+            expect(decision).toBe(PolicyDecision.DENY);
+        });
+        it('should sort rules by priority', () => {
+            const rules = [
+                { toolName: 'tool1', decision: PolicyDecision.DENY, priority: 1 },
+                { toolName: 'tool2', decision: PolicyDecision.ALLOW, priority: 10 },
+                { toolName: 'tool3', decision: PolicyDecision.ASK_USER, priority: 5 },
+            ];
+            engine = new PolicyEngine({ rules });
+            const sortedRules = engine.getRules();
+            expect(sortedRules[0].priority).toBe(10);
+            expect(sortedRules[1].priority).toBe(5);
+            expect(sortedRules[2].priority).toBe(1);
+        });
+    });
+    describe('check', () => {
+        it('should match tool by name', () => {
+            const rules = [
+                { toolName: 'shell', decision: PolicyDecision.ALLOW },
+                { toolName: 'edit', decision: PolicyDecision.DENY },
+            ];
+            engine = new PolicyEngine({ rules });
+            expect(engine.check({ name: 'shell' })).toBe(PolicyDecision.ALLOW);
+            expect(engine.check({ name: 'edit' })).toBe(PolicyDecision.DENY);
+            expect(engine.check({ name: 'other' })).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should match by args pattern', () => {
+            const rules = [
+                {
+                    toolName: 'shell',
+                    argsPattern: /rm -rf/,
+                    decision: PolicyDecision.DENY,
+                },
+                {
+                    toolName: 'shell',
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const dangerousCall = {
+                name: 'shell',
+                args: { command: 'rm -rf /' },
+            };
+            const safeCall = {
+                name: 'shell',
+                args: { command: 'ls -la' },
+            };
+            expect(engine.check(dangerousCall)).toBe(PolicyDecision.DENY);
+            expect(engine.check(safeCall)).toBe(PolicyDecision.ALLOW);
+        });
+        it('should apply rules by priority', () => {
+            const rules = [
+                { toolName: 'shell', decision: PolicyDecision.DENY, priority: 1 },
+                { toolName: 'shell', decision: PolicyDecision.ALLOW, priority: 10 },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Higher priority rule (ALLOW) should win
+            expect(engine.check({ name: 'shell' })).toBe(PolicyDecision.ALLOW);
+        });
+        it('should apply wildcard rules (no toolName)', () => {
+            const rules = [
+                { decision: PolicyDecision.DENY }, // Applies to all tools
+                { toolName: 'safe-tool', decision: PolicyDecision.ALLOW, priority: 10 },
+            ];
+            engine = new PolicyEngine({ rules });
+            expect(engine.check({ name: 'safe-tool' })).toBe(PolicyDecision.ALLOW);
+            expect(engine.check({ name: 'any-other-tool' })).toBe(PolicyDecision.DENY);
+        });
+        it('should handle non-interactive mode', () => {
+            const config = {
+                nonInteractive: true,
+                rules: [
+                    { toolName: 'interactive-tool', decision: PolicyDecision.ASK_USER },
+                    { toolName: 'allowed-tool', decision: PolicyDecision.ALLOW },
+                ],
+            };
+            engine = new PolicyEngine(config);
+            // ASK_USER should become DENY in non-interactive mode
+            expect(engine.check({ name: 'interactive-tool' })).toBe(PolicyDecision.DENY);
+            // ALLOW should remain ALLOW
+            expect(engine.check({ name: 'allowed-tool' })).toBe(PolicyDecision.ALLOW);
+            // Default ASK_USER should also become DENY
+            expect(engine.check({ name: 'unknown-tool' })).toBe(PolicyDecision.DENY);
+        });
+    });
+    describe('addRule', () => {
+        it('should add a new rule and maintain priority order', () => {
+            engine.addRule({
+                toolName: 'tool1',
+                decision: PolicyDecision.ALLOW,
+                priority: 5,
+            });
+            engine.addRule({
+                toolName: 'tool2',
+                decision: PolicyDecision.DENY,
+                priority: 10,
+            });
+            engine.addRule({
+                toolName: 'tool3',
+                decision: PolicyDecision.ASK_USER,
+                priority: 1,
+            });
+            const rules = engine.getRules();
+            expect(rules).toHaveLength(3);
+            expect(rules[0].priority).toBe(10);
+            expect(rules[1].priority).toBe(5);
+            expect(rules[2].priority).toBe(1);
+        });
+        it('should apply newly added rules', () => {
+            expect(engine.check({ name: 'new-tool' })).toBe(PolicyDecision.ASK_USER);
+            engine.addRule({ toolName: 'new-tool', decision: PolicyDecision.ALLOW });
+            expect(engine.check({ name: 'new-tool' })).toBe(PolicyDecision.ALLOW);
+        });
+    });
+    describe('removeRulesForTool', () => {
+        it('should remove rules for specific tool', () => {
+            engine.addRule({ toolName: 'tool1', decision: PolicyDecision.ALLOW });
+            engine.addRule({ toolName: 'tool2', decision: PolicyDecision.DENY });
+            engine.addRule({
+                toolName: 'tool1',
+                decision: PolicyDecision.ASK_USER,
+                priority: 10,
+            });
+            expect(engine.getRules()).toHaveLength(3);
+            engine.removeRulesForTool('tool1');
+            const remainingRules = engine.getRules();
+            expect(remainingRules).toHaveLength(1);
+            expect(remainingRules.some((r) => r.toolName === 'tool1')).toBe(false);
+            expect(remainingRules.some((r) => r.toolName === 'tool2')).toBe(true);
+        });
+        it('should handle removing non-existent tool', () => {
+            engine.addRule({ toolName: 'existing', decision: PolicyDecision.ALLOW });
+            expect(() => engine.removeRulesForTool('non-existent')).not.toThrow();
+            expect(engine.getRules()).toHaveLength(1);
+        });
+    });
+    describe('getRules', () => {
+        it('should return readonly array of rules', () => {
+            const rules = [
+                { toolName: 'tool1', decision: PolicyDecision.ALLOW },
+                { toolName: 'tool2', decision: PolicyDecision.DENY },
+            ];
+            engine = new PolicyEngine({ rules });
+            const retrievedRules = engine.getRules();
+            expect(retrievedRules).toHaveLength(2);
+            expect(retrievedRules[0].toolName).toBe('tool1');
+            expect(retrievedRules[1].toolName).toBe('tool2');
+        });
+    });
+    describe('complex scenarios', () => {
+        it('should handle multiple matching rules with different priorities', () => {
+            const rules = [
+                { decision: PolicyDecision.DENY, priority: 0 }, // Default deny all
+                { toolName: 'shell', decision: PolicyDecision.ASK_USER, priority: 5 },
+                {
+                    toolName: 'shell',
+                    argsPattern: /"command":"ls/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 10,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Matches highest priority rule (ls command)
+            expect(engine.check({ name: 'shell', args: { command: 'ls -la' } })).toBe(PolicyDecision.ALLOW);
+            // Matches middle priority rule (shell without ls)
+            expect(engine.check({ name: 'shell', args: { command: 'pwd' } })).toBe(PolicyDecision.ASK_USER);
+            // Matches lowest priority rule (not shell)
+            expect(engine.check({ name: 'edit' })).toBe(PolicyDecision.DENY);
+        });
+        it('should handle tools with no args', () => {
+            const rules = [
+                {
+                    toolName: 'read',
+                    argsPattern: /secret/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Tool call without args should not match pattern
+            expect(engine.check({ name: 'read' })).toBe(PolicyDecision.ASK_USER);
+            // Tool call with args not matching pattern
+            expect(engine.check({ name: 'read', args: { file: 'public.txt' } })).toBe(PolicyDecision.ASK_USER);
+            // Tool call with args matching pattern
+            expect(engine.check({ name: 'read', args: { file: 'secret.txt' } })).toBe(PolicyDecision.DENY);
+        });
+        it('should match args pattern regardless of property order', () => {
+            const rules = [
+                {
+                    toolName: 'shell',
+                    // Pattern matches the stable stringified format
+                    argsPattern: /"command":"rm[^"]*-rf/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Same args with different property order should both match
+            const args1 = { command: 'rm -rf /', path: '/home' };
+            const args2 = { path: '/home', command: 'rm -rf /' };
+            expect(engine.check({ name: 'shell', args: args1 })).toBe(PolicyDecision.DENY);
+            expect(engine.check({ name: 'shell', args: args2 })).toBe(PolicyDecision.DENY);
+            // Verify safe command doesn't match
+            const safeArgs = { command: 'ls -la', path: '/home' };
+            expect(engine.check({ name: 'shell', args: safeArgs })).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should handle nested objects in args with stable stringification', () => {
+            const rules = [
+                {
+                    toolName: 'api',
+                    argsPattern: /"sensitive":true/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Nested objects with different key orders should match consistently
+            const args1 = {
+                data: { sensitive: true, value: 'secret' },
+                method: 'POST',
+            };
+            const args2 = {
+                method: 'POST',
+                data: { value: 'secret', sensitive: true },
+            };
+            expect(engine.check({ name: 'api', args: args1 })).toBe(PolicyDecision.DENY);
+            expect(engine.check({ name: 'api', args: args2 })).toBe(PolicyDecision.DENY);
+        });
+        it('should handle circular references without stack overflow', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /\[Circular\]/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const circularArgs = {
+                name: 'test',
+                data: {},
+            };
+            // Create circular reference - TypeScript allows this since data is Record<string, unknown>
+            circularArgs.data['self'] =
+                circularArgs.data;
+            // Should not throw stack overflow error
+            expect(() => engine.check({ name: 'test', args: circularArgs })).not.toThrow();
+            // Should detect the circular reference pattern
+            expect(engine.check({ name: 'test', args: circularArgs })).toBe(PolicyDecision.DENY);
+            // Non-circular object should not match
+            const normalArgs = { name: 'test', data: { value: 'normal' } };
+            expect(engine.check({ name: 'test', args: normalArgs })).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should handle deep circular references', () => {
+            const rules = [
+                {
+                    toolName: 'deep',
+                    argsPattern: /\[Circular\]/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const deepCircular = {
+                level1: {
+                    level2: {
+                        level3: {},
+                    },
+                },
+            };
+            // Create circular reference with proper type assertions
+            const level3 = deepCircular.level1.level2.level3;
+            level3['back'] = deepCircular.level1;
+            // Should handle without stack overflow
+            expect(() => engine.check({ name: 'deep', args: deepCircular })).not.toThrow();
+            // Should detect the circular reference
+            expect(engine.check({ name: 'deep', args: deepCircular })).toBe(PolicyDecision.DENY);
+        });
+        it('should handle repeated non-circular objects correctly', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /\[Circular\]/,
+                    decision: PolicyDecision.DENY,
+                },
+                {
+                    toolName: 'test',
+                    argsPattern: /"value":"shared"/,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 10,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Create an object with repeated references but no cycles
+            const sharedObj = { value: 'shared' };
+            const args = {
+                first: sharedObj,
+                second: sharedObj,
+                third: { nested: sharedObj },
+            };
+            // Should NOT mark repeated objects as circular, and should match the shared value pattern
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+        });
+        it('should omit undefined and function values from objects', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /"definedValue":"test"/,
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const args = {
+                definedValue: 'test',
+                undefinedValue: undefined,
+                functionValue: () => 'hello',
+                nullValue: null,
+            };
+            // Should match pattern with defined value, undefined and functions omitted
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+            // Check that the pattern would NOT match if undefined was included
+            const rulesWithUndefined = [
+                {
+                    toolName: 'test',
+                    argsPattern: /undefinedValue/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules: rulesWithUndefined });
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ASK_USER);
+            // Check that the pattern would NOT match if function was included
+            const rulesWithFunction = [
+                {
+                    toolName: 'test',
+                    argsPattern: /functionValue/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules: rulesWithFunction });
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should convert undefined and functions to null in arrays', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /\["value",null,null,null\]/,
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const args = {
+                array: ['value', undefined, () => 'hello', null],
+            };
+            // Should match pattern with undefined and functions converted to null
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+        });
+        it('should produce valid JSON for all inputs', () => {
+            const testCases = [
+                { input: { simple: 'string' }, desc: 'simple object' },
+                {
+                    input: { nested: { deep: { value: 123 } } },
+                    desc: 'nested object',
+                },
+                { input: { data: [1, 2, 3] }, desc: 'simple array' },
+                { input: { mixed: [1, { a: 'b' }, null] }, desc: 'mixed array' },
+                {
+                    input: { undef: undefined, func: () => { }, normal: 'value' },
+                    desc: 'object with undefined and function',
+                },
+                {
+                    input: { data: ['a', undefined, () => { }, null] },
+                    desc: 'array with undefined and function',
+                },
+            ];
+            for (const { input } of testCases) {
+                const rules = [
+                    {
+                        toolName: 'test',
+                        argsPattern: /.*/,
+                        decision: PolicyDecision.ALLOW,
+                    },
+                ];
+                engine = new PolicyEngine({ rules });
+                // Should not throw when checking (which internally uses stableStringify)
+                expect(() => engine.check({ name: 'test', args: input })).not.toThrow();
+                // The check should succeed
+                expect(engine.check({ name: 'test', args: input })).toBe(PolicyDecision.ALLOW);
+            }
+        });
+        it('should respect toJSON methods on objects', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /"sanitized":"safe"/,
+                    decision: PolicyDecision.ALLOW,
+                },
+                {
+                    toolName: 'test',
+                    argsPattern: /"dangerous":"data"/,
+                    decision: PolicyDecision.DENY,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            // Object with toJSON that sanitizes output
+            const args = {
+                data: {
+                    dangerous: 'data',
+                    toJSON: () => ({ sanitized: 'safe' }),
+                },
+            };
+            // Should match the sanitized pattern, not the dangerous one
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+        });
+        it('should handle toJSON that returns primitives', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /"value":"string-value"/,
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const args = {
+                value: {
+                    complex: 'object',
+                    toJSON: () => 'string-value',
+                },
+            };
+            // toJSON returns a string, which should be properly stringified
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+        });
+        it('should handle toJSON that throws an error', () => {
+            const rules = [
+                {
+                    toolName: 'test',
+                    argsPattern: /"fallback":"value"/,
+                    decision: PolicyDecision.ALLOW,
+                },
+            ];
+            engine = new PolicyEngine({ rules });
+            const args = {
+                data: {
+                    fallback: 'value',
+                    toJSON: () => {
+                        throw new Error('toJSON error');
+                    },
+                },
+            };
+            // Should fall back to regular object serialization when toJSON throws
+            expect(engine.check({ name: 'test', args })).toBe(PolicyDecision.ALLOW);
+        });
+    });
+});
+//# sourceMappingURL=policy-engine.test.js.map

package/dist/src/policy/policy-engine.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.test.js","sourceRoot":"","sources":["../../../src/policy/policy-engine.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AAGpB,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,MAAoB,CAAC;IAEzB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACjE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACnE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE;aACtE,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAEtC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBACrD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE;aACpD,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,OAAO;oBACjB,WAAW,EAAE,QAAQ;oBACrB,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;gBACD;oBACE,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,aAAa,GAAiB;gBAClC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;aAC9B,CAAC;YAEF,MAAM,QAAQ,GAAiB;gBAC7B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;aAC5B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACjE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;aACpE,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,0CAA0C;YAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,uBAAuB;gBAC1D,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;aACxE,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CACnD,cAAc,CAAC,IAAI,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAuB;gBACjC,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;oBACnE,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;iBAC7D;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAElC,sDAAsD;YACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CACrD,cAAc,CAAC,IAAI,CACpB,CAAC;YACF,4BAA4B;YAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1E,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,OAAO,CAAC;gBACb,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc,CAAC,KAAK;gBAC9B,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC;gBACb,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc,CAAC,IAAI;gBAC7B,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC;gBACb,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEzE,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YAEzE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,OAAO,CAAC;gBACb,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAEnC,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QACxB,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE;gBACrD,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE;aACrD,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,KAAK,GAAiB;gBAC1B,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,mBAAmB;gBACnE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE;gBACrE;oBACE,QAAQ,EAAE,OAAO;oBACjB,WAAW,EAAE,eAAe;oBAC5B,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,EAAE;iBACb;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,6CAA6C;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,cAAc,CAAC,KAAK,CACrB,CAAC;YAEF,kDAAkD;YAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACpE,cAAc,CAAC,QAAQ,CACxB,CAAC;YAEF,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,QAAQ;oBACrB,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,kDAAkD;YAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAErE,2CAA2C;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,cAAc,CAAC,QAAQ,CACxB,CAAC;YAEF,uCAAuC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACvE,cAAc,CAAC,IAAI,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,OAAO;oBACjB,gDAAgD;oBAChD,WAAW,EAAE,uBAAuB;oBACpC,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,4DAA4D;YAC5D,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAErD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACvD,cAAc,CAAC,IAAI,CACpB,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACvD,cAAc,CAAC,IAAI,CACpB,CAAC;YAEF,oCAAoC;YACpC,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1D,cAAc,CAAC,QAAQ,CACxB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,kBAAkB;oBAC/B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,qEAAqE;YACrE,MAAM,KAAK,GAAG;gBACZ,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAC1C,MAAM,EAAE,MAAM;aACf,CAAC;YACF,MAAM,KAAK,GAAG;gBACZ,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;aAC3C,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACrD,cAAc,CAAC,IAAI,CACpB,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACrD,cAAc,CAAC,IAAI,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAMrC,MAAM,YAAY,GAAiB;gBACjC,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE;aACT,CAAC;YACF,2FAA2F;YAC1F,YAAY,CAAC,IAAgC,CAAC,MAAM,CAAC;gBACpD,YAAY,CAAC,IAAI,CAAC;YAEpB,wCAAwC;YACxC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CACnD,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAEhB,+CAA+C;YAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7D,cAAc,CAAC,IAAI,CACpB,CAAC;YAEF,uCAAuC;YACvC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC3D,cAAc,CAAC,QAAQ,CACxB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAUrC,MAAM,YAAY,GAAiB;gBACjC,MAAM,EAAE;oBACN,MAAM,EAAE;wBACN,MAAM,EAAE,EAAE;qBACX;iBACF;aACF,CAAC;YACF,wDAAwD;YACxD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAO,CAAC,MAAO,CAAC,MAAO,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;YAErC,uCAAuC;YACvC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CACnD,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAEhB,uCAAuC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7D,cAAc,CAAC,IAAI,CACpB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;gBACD;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,kBAAkB;oBAC/B,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,EAAE;iBACb;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,0DAA0D;YAC1D,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG;gBACX,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;aAC7B,CAAC;YAEF,0FAA0F;YAC1F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,uBAAuB;oBACpC,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG;gBACX,YAAY,EAAE,MAAM;gBACpB,cAAc,EAAE,SAAS;gBACzB,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO;gBAC5B,SAAS,EAAE,IAAI;aAChB,CAAC;YAEF,2EAA2E;YAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAExE,mEAAmE;YACnE,MAAM,kBAAkB,GAAiB;gBACvC;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,gBAAgB;oBAC7B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YACF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC/C,cAAc,CAAC,QAAQ,CACxB,CAAC;YAEF,kEAAkE;YAClE,MAAM,iBAAiB,GAAiB;gBACtC;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,eAAe;oBAC5B,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YACF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC/C,cAAc,CAAC,QAAQ,CACxB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,4BAA4B;oBACzC,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG;gBACX,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;aACjD,CAAC;YAEF,sEAAsE;YACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,SAAS,GACb;gBACE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;gBACtD;oBACE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;oBAC3C,IAAI,EAAE,eAAe;iBACtB;gBACD,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;gBACpD,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;gBAChE;oBACE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC5D,IAAI,EAAE,oCAAoC;iBAC3C;gBACD;oBACE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,CAAC,EAAE;oBACjD,IAAI,EAAE,mCAAmC;iBAC1C;aACF,CAAC;YAEJ,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,SAAS,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAiB;oBAC1B;wBACE,QAAQ,EAAE,MAAM;wBAChB,WAAW,EAAE,IAAI;wBACjB,QAAQ,EAAE,cAAc,CAAC,KAAK;qBAC/B;iBACF,CAAC;gBACF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAErC,yEAAyE;gBACzE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAExE,2BAA2B;gBAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACtD,cAAc,CAAC,KAAK,CACrB,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,oBAAoB;oBACjC,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;gBACD;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,oBAAoB;oBACjC,QAAQ,EAAE,cAAc,CAAC,IAAI;iBAC9B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,2CAA2C;YAC3C,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE;oBACJ,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;iBACtC;aACF,CAAC;YAEF,4DAA4D;YAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,wBAAwB;oBACrC,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG;gBACX,KAAK,EAAE;oBACL,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc;iBAC7B;aACF,CAAC;YAEF,gEAAgE;YAChE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,KAAK,GAAiB;gBAC1B;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,oBAAoB;oBACjC,QAAQ,EAAE,cAAc,CAAC,KAAK;iBAC/B;aACF,CAAC;YAEF,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE;oBACJ,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,GAAG,EAAE;wBACX,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;oBAClC,CAAC;iBACF;aACF,CAAC;YAEF,sEAAsE;YACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/policy/stable-stringify.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Produces a stable, deterministic JSON string representation with sorted keys.
+ *
+ * This method is critical for security policy matching. It ensures that the same
+ * object always produces the same string representation, regardless of property
+ * insertion order, which could vary across different JavaScript engines or
+ * runtime conditions.
+ *
+ * Key behaviors:
+ * 1. **Sorted Keys**: Object properties are always serialized in alphabetical order,
+ *    ensuring deterministic output for pattern matching.
+ *
+ * 2. **Circular Reference Protection**: Uses ancestor chain tracking (not just
+ *    object identity) to detect true circular references while correctly handling
+ *    repeated non-circular object references. Circular references are replaced
+ *    with "[Circular]" to prevent stack overflow attacks.
+ *
+ * 3. **JSON Spec Compliance**:
+ *    - undefined values: Omitted from objects, converted to null in arrays
+ *    - Functions: Omitted from objects, converted to null in arrays
+ *    - toJSON methods: Respected and called when present (per JSON.stringify spec)
+ *
+ * 4. **Security Considerations**:
+ *    - Prevents DoS via circular references that would cause infinite recursion
+ *    - Ensures consistent policy rule matching by normalizing property order
+ *    - Respects toJSON for objects that sanitize their output
+ *    - Handles toJSON methods that throw errors gracefully
+ *
+ * @param obj - The object to stringify (typically toolCall.args)
+ * @returns A deterministic JSON string representation
+ *
+ * @example
+ * // Different property orders produce the same output:
+ * stableStringify({b: 2, a: 1}) === stableStringify({a: 1, b: 2})
+ * // Returns: '{"a":1,"b":2}'
+ *
+ * @example
+ * // Circular references are handled safely:
+ * const obj = {a: 1};
+ * obj.self = obj;
+ * stableStringify(obj)
+ * // Returns: '{"a":1,"self":"[Circular]"}'
+ *
+ * @example
+ * // toJSON methods are respected:
+ * const obj = {
+ *   sensitive: 'secret',
+ *   toJSON: () => ({ safe: 'data' })
+ * };
+ * stableStringify(obj)
+ * // Returns: '{"safe":"data"}'
+ */
+export declare function stableStringify(obj: unknown): string;