@melra/policy-core 0.3.0-alpha.12 → 0.3.0-alpha.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -3
- package/dist/index.d.ts +11 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +234 -61
- package/dist/index.js.map +1 -1
- package/dist/network-policy.d.ts +11 -3
- package/dist/network-policy.d.ts.map +1 -1
- package/dist/network-policy.js +57 -5
- package/dist/network-policy.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -16,9 +16,12 @@ const policy = createDefaultPolicy(process.cwd());
|
|
|
16
16
|
const { decision, challenge } = evaluatePolicy(taskId, request, policy);
|
|
17
17
|
```
|
|
18
18
|
|
|
19
|
-
An `allow` runs. A `confirm` returns a `challenge`
|
|
20
|
-
|
|
21
|
-
|
|
19
|
+
An `allow` runs. A `confirm` returns a `challenge` bound to the task and to a
|
|
20
|
+
digest of the operation — so a plan cannot be swapped for a different action
|
|
21
|
+
after approval. In developer mode its exact phrase must be echoed back before
|
|
22
|
+
execution; with `mode: "enforced"` it carries no phrase, and `validateApproval`
|
|
23
|
+
accepts nothing for it, because only an operator's out-of-band decision may
|
|
24
|
+
approve it. A `deny`
|
|
22
25
|
never reaches a runtime.
|
|
23
26
|
|
|
24
27
|
## Defaults worth knowing
|
package/dist/index.d.ts
CHANGED
|
@@ -17,7 +17,12 @@ export interface LocalPolicy {
|
|
|
17
17
|
*/
|
|
18
18
|
popups: "allow" | "block";
|
|
19
19
|
mutations: "deny" | "confirm";
|
|
20
|
-
|
|
20
|
+
/**
|
|
21
|
+
* How long an approval challenge stays open, and a recorded decision usable.
|
|
22
|
+
* Absent, it follows the mode (`approvalTtl`): an operator approving out of
|
|
23
|
+
* band in enforced mode needs longer than someone answering in the chat.
|
|
24
|
+
*/
|
|
25
|
+
approvalTtlMs?: number;
|
|
21
26
|
maxFileBytes: number;
|
|
22
27
|
/**
|
|
23
28
|
* How long unreachable memory rows are kept before compaction reclaims them,
|
|
@@ -148,6 +153,8 @@ export declare function classifyCommand(command: string, args: readonly string[]
|
|
|
148
153
|
traits: CapabilityTrait[];
|
|
149
154
|
};
|
|
150
155
|
export declare function createDefaultPolicy(workspaceRoot: string): LocalPolicy;
|
|
156
|
+
/** The approval window a policy gives: its own, or 5 minutes in developer mode and 30 in enforced. */
|
|
157
|
+
export declare function approvalTtl(policy: Pick<LocalPolicy, "approvalTtlMs" | "mode">): number;
|
|
151
158
|
export declare function loadPolicy(path: string | undefined, workspaceRoot: string): Promise<LocalPolicy>;
|
|
152
159
|
export declare function classifyOperation(operation: Operation): {
|
|
153
160
|
effect: Effect;
|
|
@@ -157,6 +164,8 @@ export declare function classifyOperation(operation: Operation): {
|
|
|
157
164
|
traits: CapabilityTrait[];
|
|
158
165
|
/** What the caller declared this operation moves, when it declared one. */
|
|
159
166
|
spend?: DeclaredSpend;
|
|
167
|
+
/** Where a move puts the file; a grant has to cover it as well as `target`. */
|
|
168
|
+
destination?: string;
|
|
160
169
|
};
|
|
161
170
|
/**
|
|
162
171
|
* Evidence a mutation must satisfy when the caller declared none.
|
|
@@ -203,6 +212,7 @@ type ClassifiedForGrant = {
|
|
|
203
212
|
effect: Effect;
|
|
204
213
|
capability: string;
|
|
205
214
|
target: string;
|
|
215
|
+
destination?: string;
|
|
206
216
|
spend?: DeclaredSpend;
|
|
207
217
|
};
|
|
208
218
|
/** Milliseconds in the rolling window `provider.dailyMax` is measured over. */
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAUzB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;;;;;OASG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD;;;;;;;;;;OAUG;IACH,cAAc,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;;;;;OASG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqDD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAuG1B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CA2C9C;AA+ID,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,CAuCtE;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CAAC,GAAG,MAAM,CAEvF;AAID,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAiDtB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAsKA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,iBAAiB,EAAE,CAoDrB;AAmFD;;;;;;GAMG;AACH;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK;IACvD,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAuBF,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,QAAsB,CAAC;AAyCrD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,eAAe,CA4DjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,gBAAgB,CAyGlB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAI5E;AAYD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc9C;AAED,cAAc,qBAAqB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
// Copyright 2026 XAGI Labs Private Limited
|
|
2
2
|
// SPDX-License-Identifier: Apache-2.0
|
|
3
3
|
import { readFile } from "node:fs/promises";
|
|
4
|
-
import { basename, resolve } from "node:path";
|
|
4
|
+
import { basename, dirname, isAbsolute, normalize, relative, resolve, sep } from "node:path";
|
|
5
5
|
import { createHash, randomUUID } from "node:crypto";
|
|
6
6
|
import { hostOf } from "./network-policy.js";
|
|
7
|
-
import { CapabilityGrantSchema, CredentialsSchema, deploymentMode, LOCAL_IDENTITY, principalRef, } from "@melra/protocol";
|
|
7
|
+
import { CapabilityGrantSchema, CredentialsSchema, deploymentMode, LOCAL_IDENTITY, principalRef, terminalArgumentPaths, } from "@melra/protocol";
|
|
8
8
|
const READ_ONLY_GIT_ACTIONS = new Set([
|
|
9
9
|
"branch",
|
|
10
10
|
"diff",
|
|
@@ -64,56 +64,34 @@ export { CredentialBroker, } from "./credentials.js";
|
|
|
64
64
|
*
|
|
65
65
|
* Anything unlisted falls in between: a mutation, but not an install — `npm
|
|
66
66
|
* run build` writes to the workspace and reaches nothing.
|
|
67
|
+
*
|
|
68
|
+
* Only npm has reads. Every other manager checked has a way for a "read" to
|
|
69
|
+
* run code or write, through its own options or a file a cloned repository
|
|
70
|
+
* carries: pnpm runs .pnpmfile.cjs and yarn its `yarnPath` on every command;
|
|
71
|
+
* go switches to the toolchain go.mod names and rustup to the one
|
|
72
|
+
* rust-toolchain.toml names, downloading and running it; `pip --python` runs
|
|
73
|
+
* that interpreter and `--log` writes anywhere; `gem --config-file` loads
|
|
74
|
+
* plugins; `brew outdated` updates Homebrew; `apt -o` sets hooks that run shell
|
|
75
|
+
* commands; uv and cargo write their lockfiles. A read skips approval, so it
|
|
76
|
+
* has to be one for every argument and every repository.
|
|
67
77
|
*/
|
|
68
78
|
const PACKAGE_MANAGERS = {
|
|
69
79
|
npm: {
|
|
70
80
|
install: new Set(["install", "i", "add", "ci", "update", "up", "publish"]),
|
|
81
|
+
// `config` is a read only as `config get`/`config list`; see readOnlyCall.
|
|
71
82
|
read: new Set(["ls", "list", "view", "info", "outdated", "why", "config"]),
|
|
72
83
|
},
|
|
73
|
-
pnpm: {
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
},
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
},
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
},
|
|
85
|
-
pip3: {
|
|
86
|
-
install: new Set(["install", "download", "wheel"]),
|
|
87
|
-
read: new Set(["list", "show", "freeze", "check"]),
|
|
88
|
-
},
|
|
89
|
-
uv: {
|
|
90
|
-
install: new Set(["add", "sync", "install", "pip", "tool", "publish"]),
|
|
91
|
-
read: new Set(["tree", "lock", "version"]),
|
|
92
|
-
},
|
|
93
|
-
cargo: {
|
|
94
|
-
install: new Set(["install", "add", "update", "publish", "fetch"]),
|
|
95
|
-
read: new Set(["tree", "metadata", "search"]),
|
|
96
|
-
},
|
|
97
|
-
gem: {
|
|
98
|
-
install: new Set(["install", "update", "push"]),
|
|
99
|
-
read: new Set(["list", "info", "which"]),
|
|
100
|
-
},
|
|
101
|
-
brew: {
|
|
102
|
-
install: new Set(["install", "upgrade", "reinstall", "tap"]),
|
|
103
|
-
read: new Set(["list", "info", "search", "outdated"]),
|
|
104
|
-
},
|
|
105
|
-
apt: {
|
|
106
|
-
install: new Set(["install", "upgrade", "full-upgrade", "update"]),
|
|
107
|
-
read: new Set(["list", "show", "search", "policy"]),
|
|
108
|
-
},
|
|
109
|
-
"apt-get": {
|
|
110
|
-
install: new Set(["install", "upgrade", "dist-upgrade", "update"]),
|
|
111
|
-
read: new Set(["show", "download"]),
|
|
112
|
-
},
|
|
113
|
-
go: {
|
|
114
|
-
install: new Set(["install", "get", "mod"]),
|
|
115
|
-
read: new Set(["list", "version", "env", "vet"]),
|
|
116
|
-
},
|
|
84
|
+
pnpm: { install: new Set(["install", "i", "add", "update", "up", "publish", "dlx"]) },
|
|
85
|
+
yarn: { install: new Set(["install", "add", "up", "upgrade", "publish", "dlx"]) },
|
|
86
|
+
pip: { install: new Set(["install", "download", "wheel"]) },
|
|
87
|
+
pip3: { install: new Set(["install", "download", "wheel"]) },
|
|
88
|
+
uv: { install: new Set(["add", "sync", "install", "pip", "tool", "publish"]) },
|
|
89
|
+
cargo: { install: new Set(["install", "add", "update", "publish", "fetch"]) },
|
|
90
|
+
gem: { install: new Set(["install", "update", "push"]) },
|
|
91
|
+
brew: { install: new Set(["install", "upgrade", "reinstall", "tap"]) },
|
|
92
|
+
apt: { install: new Set(["install", "upgrade", "full-upgrade", "update"]) },
|
|
93
|
+
"apt-get": { install: new Set(["install", "upgrade", "dist-upgrade", "update"]) },
|
|
94
|
+
go: { install: new Set(["install", "get", "mod"]) },
|
|
117
95
|
};
|
|
118
96
|
/** `npx`/`pnpx` fetch and execute a package by name; there is no read form. */
|
|
119
97
|
const ALWAYS_INSTALLING = new Set(["npx", "pnpx", "uvx", "pipx"]);
|
|
@@ -200,7 +178,7 @@ export function classifyCommand(command, args) {
|
|
|
200
178
|
traits.add("package-install");
|
|
201
179
|
traits.add("network");
|
|
202
180
|
}
|
|
203
|
-
if (manager.read
|
|
181
|
+
if (manager.read?.has(subcommand) === true && readOnlyCall(command, name, subcommand, args)) {
|
|
204
182
|
// A read subcommand of a package manager still queries the registry in
|
|
205
183
|
// the general case, so it keeps `network` while dropping the mutation.
|
|
206
184
|
return { read: true, traits: [...traits, "network"] };
|
|
@@ -218,12 +196,161 @@ export function classifyCommand(command, args) {
|
|
|
218
196
|
"wc",
|
|
219
197
|
"where",
|
|
220
198
|
]);
|
|
221
|
-
const read = READ_COMMANDS.has(name) ||
|
|
222
|
-
(name
|
|
223
|
-
subcommand !== undefined &&
|
|
224
|
-
READ_ONLY_GIT_ACTIONS.has(subcommand));
|
|
199
|
+
const read = (READ_COMMANDS.has(name) || name === "git") &&
|
|
200
|
+
readOnlyCall(command, name, subcommand, args);
|
|
225
201
|
return { read, traits: [...traits] };
|
|
226
202
|
}
|
|
203
|
+
/**
|
|
204
|
+
* Whether a call to a read-classified program is still only a read once its
|
|
205
|
+
* arguments are taken into account.
|
|
206
|
+
*
|
|
207
|
+
* A read is the one classification that skips approval, so it is a positive
|
|
208
|
+
* claim that has to hold for the whole argument list, not just the program
|
|
209
|
+
* name or subcommand. Before this, `git -c core.fsmonitor=<cmd> status` and
|
|
210
|
+
* `rg --pre <cmd>` ran commands, `git log --output=<path>` wrote anywhere,
|
|
211
|
+
* `git branch -D` deleted refs, and `npm config set` rewrote configuration,
|
|
212
|
+
* all classified as reads and run with no approval. Anything not proven
|
|
213
|
+
* harmless here falls back to a mutation, which needs approval: the cautious
|
|
214
|
+
* answer, at the cost of an approval for an unusual but harmless spelling.
|
|
215
|
+
*
|
|
216
|
+
* Reading outside the workspace through these tools stays a developer-mode
|
|
217
|
+
* residual. Enforced mode asks a person first (`read_outside_workspace`), and
|
|
218
|
+
* the terminal runtime refuses MELRA's own files in every mode.
|
|
219
|
+
*/
|
|
220
|
+
function readOnlyCall(command, name, subcommand, args) {
|
|
221
|
+
// A path-qualified program is whatever file sits at that path, which the
|
|
222
|
+
// name says nothing about: `tools/ls` can be a link to `/bin/sh`.
|
|
223
|
+
if (/[\\/]/.test(command))
|
|
224
|
+
return false;
|
|
225
|
+
if (args.some(namesNetworkPath))
|
|
226
|
+
return false;
|
|
227
|
+
if (name === "git")
|
|
228
|
+
return gitReadOnly(args);
|
|
229
|
+
if (name === "rg")
|
|
230
|
+
return !args.some(rgRunsOrDecompresses);
|
|
231
|
+
// `/D:` and `/F:` take the directories and files to search from a list no
|
|
232
|
+
// argument shows, and `--files0-from` the files to count.
|
|
233
|
+
if (name === "findstr" && args.some((arg) => /^[-/][df]:/i.test(arg)))
|
|
234
|
+
return false;
|
|
235
|
+
if (name === "wc" && args.some((arg) => /^--files0-from(=|$)/.test(arg)))
|
|
236
|
+
return false;
|
|
237
|
+
// `/s <computer>` queries another machine, as the logged-on user.
|
|
238
|
+
if (name === "tasklist")
|
|
239
|
+
return !args.some((arg) => /^[-/][sup](:|$)/i.test(arg));
|
|
240
|
+
// `--logs-dir <path>` creates that directory and writes npm's log into it.
|
|
241
|
+
if (name === "npm" && args.some((arg) => /^--logs-dir(=|$)/i.test(arg)))
|
|
242
|
+
return false;
|
|
243
|
+
if (subcommand === "config" && PACKAGE_MANAGERS[name] !== undefined) {
|
|
244
|
+
const action = args[args.findIndex((arg) => arg.toLowerCase() === "config") + 1];
|
|
245
|
+
return action !== undefined && ["get", "list", "ls"].includes(action.toLowerCase());
|
|
246
|
+
}
|
|
247
|
+
return true;
|
|
248
|
+
}
|
|
249
|
+
/**
|
|
250
|
+
* A Windows UNC or device path (`\\host\share`, `//host/share`, `\\?\UNC\...`,
|
|
251
|
+
* `\??\UNC\...`), alone or inside an option (`--file=`, `/G:`, `-f\\host`).
|
|
252
|
+
* Opening one connects to that host over SMB or WebDAV and authenticates as the
|
|
253
|
+
* logged-on user, so a "read" of it sends the user's credentials to whoever the
|
|
254
|
+
* caller named. Two separators in a row anywhere count, which also catches a
|
|
255
|
+
* URL in a search pattern (`rg https://x`); that then needs approval, the
|
|
256
|
+
* cautious side.
|
|
257
|
+
*/
|
|
258
|
+
function namesNetworkPath(arg) {
|
|
259
|
+
return /[\\/]{2}/.test(arg) || arg.includes("\\??\\");
|
|
260
|
+
}
|
|
261
|
+
/**
|
|
262
|
+
* `--pre <cmd>` and `--hostname-bin <cmd>` run programs; `-z` runs
|
|
263
|
+
* decompressors; `-L`/`--follow` follow links to files no argument names, the
|
|
264
|
+
* data directory included.
|
|
265
|
+
*/
|
|
266
|
+
function rgRunsOrDecompresses(arg) {
|
|
267
|
+
if (/^--(pre|pre-glob|hostname-bin|search-zip|follow)(=|$)/i.test(arg))
|
|
268
|
+
return true;
|
|
269
|
+
return /^-[^-]/.test(arg) && /[zL]/.test(arg.slice(1));
|
|
270
|
+
}
|
|
271
|
+
/** Whether a terminal command names a path outside the workspace, by spelling. Links are the runtime's half. */
|
|
272
|
+
function namesPathOutside(operation, root) {
|
|
273
|
+
if (operation.kind !== "terminal")
|
|
274
|
+
return false;
|
|
275
|
+
const cwd = resolve(root, operation.cwd ?? ".");
|
|
276
|
+
return terminalArgumentPaths(operation.args).some((path) => {
|
|
277
|
+
// A bare switch (`/S`, `/I`, `/?`) is not a path on Windows. One with a
|
|
278
|
+
// value attached (`/G:x`) still has that value judged.
|
|
279
|
+
if (process.platform === "win32" && /^\/[a-z?]+$/i.test(path))
|
|
280
|
+
return false;
|
|
281
|
+
const rel = relative(root, resolve(cwd, path));
|
|
282
|
+
return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
|
|
283
|
+
});
|
|
284
|
+
}
|
|
285
|
+
/** `diff`/`log`/`show` options that write files, run configured programs, or leave the repository. */
|
|
286
|
+
const GIT_UNSAFE_OPTION = /^--(output|ext-diff|textconv|no-index|exec|upload-pack|receive-pack)(=|$)/i;
|
|
287
|
+
/**
|
|
288
|
+
* Options of `git branch` and `git tag` that only list. Any other option
|
|
289
|
+
* creates, moves, deletes, or signs. `--color`, `--column` and `--abbrev` take
|
|
290
|
+
* a value only when it is attached (`--color=always`): git reads
|
|
291
|
+
* `--color -D x` as two options and a name, so the next argument is never theirs.
|
|
292
|
+
*/
|
|
293
|
+
const GIT_LISTING_FLAGS = new Set([
|
|
294
|
+
"-a", "--all", "-r", "--remotes", "-v", "-vv", "--verbose", "-n", "-i",
|
|
295
|
+
"--ignore-case", "--show-current", "--color", "--no-color", "--column",
|
|
296
|
+
"--no-column", "--abbrev", "--no-abbrev", "--omit-empty",
|
|
297
|
+
]);
|
|
298
|
+
/**
|
|
299
|
+
* Listing options that take a value. Unless it is attached, git takes the next
|
|
300
|
+
* argument as the value whatever it looks like (`--contains -D` asks about a
|
|
301
|
+
* commit named `-D`); only as the last argument does `--contains` and the like
|
|
302
|
+
* default to HEAD.
|
|
303
|
+
*/
|
|
304
|
+
const GIT_LISTING_VALUE_FLAGS = new Set([
|
|
305
|
+
"--sort", "--format", "--contains", "--no-contains", "--merged", "--no-merged",
|
|
306
|
+
"--points-at",
|
|
307
|
+
]);
|
|
308
|
+
function gitReadOnly(args) {
|
|
309
|
+
// Global options (`-c`, `-C`, `--exec-path`, `--git-dir`, ...) come before
|
|
310
|
+
// the subcommand and change what any subcommand does, so a read is only a
|
|
311
|
+
// call that names the subcommand first.
|
|
312
|
+
const [first, ...rest] = args;
|
|
313
|
+
if (first === undefined || first.startsWith("-"))
|
|
314
|
+
return false;
|
|
315
|
+
const subcommand = first.toLowerCase();
|
|
316
|
+
if (!READ_ONLY_GIT_ACTIONS.has(subcommand))
|
|
317
|
+
return false;
|
|
318
|
+
if (rest.some((arg) => GIT_UNSAFE_OPTION.test(arg)))
|
|
319
|
+
return false;
|
|
320
|
+
if (subcommand !== "branch" && subcommand !== "tag")
|
|
321
|
+
return true;
|
|
322
|
+
// `git branch x` and `git tag v1` create; listing is the read. Arguments are
|
|
323
|
+
// split the way git's option parser splits them, and only then is a name
|
|
324
|
+
// allowed, as a pattern under `-l`/`--list`. Deciding "listing" from the raw
|
|
325
|
+
// list let `--format -l x` through: git takes `-l` as the format and creates x.
|
|
326
|
+
//
|
|
327
|
+
// `git tag -l` has always listed, but `git branch -l` meant --create-reflog
|
|
328
|
+
// before git 2.20 (Ubuntu 18.04 ships 2.17), so there `-l x` creates x. Only
|
|
329
|
+
// `--list` turns on listing for a branch name; a bare `-l` with no name is a
|
|
330
|
+
// listing either way.
|
|
331
|
+
let listing = false;
|
|
332
|
+
let names = 0;
|
|
333
|
+
for (let index = 0; index < rest.length; index += 1) {
|
|
334
|
+
const arg = rest[index];
|
|
335
|
+
const equals = arg.indexOf("=");
|
|
336
|
+
const flag = equals === -1 ? arg : arg.slice(0, equals);
|
|
337
|
+
if (arg === "--list" || (arg === "-l" && subcommand === "tag"))
|
|
338
|
+
listing = true;
|
|
339
|
+
else if (arg === "-l" || GIT_LISTING_FLAGS.has(arg) || /^-n\d+$/.test(arg))
|
|
340
|
+
continue;
|
|
341
|
+
else if (equals !== -1 && /^--(color|column|abbrev)$/.test(flag))
|
|
342
|
+
continue;
|
|
343
|
+
else if (GIT_LISTING_VALUE_FLAGS.has(flag)) {
|
|
344
|
+
if (equals === -1)
|
|
345
|
+
index += 1;
|
|
346
|
+
}
|
|
347
|
+
else if (arg.startsWith("-"))
|
|
348
|
+
return false;
|
|
349
|
+
else
|
|
350
|
+
names += 1;
|
|
351
|
+
}
|
|
352
|
+
return listing || names === 0;
|
|
353
|
+
}
|
|
227
354
|
export function createDefaultPolicy(workspaceRoot) {
|
|
228
355
|
return {
|
|
229
356
|
version: "1",
|
|
@@ -254,7 +381,6 @@ export function createDefaultPolicy(workspaceRoot) {
|
|
|
254
381
|
allowLocalhost: true,
|
|
255
382
|
popups: "block",
|
|
256
383
|
mutations: "confirm",
|
|
257
|
-
approvalTtlMs: 5 * 60_000,
|
|
258
384
|
maxFileBytes: 10 * 1024 * 1024,
|
|
259
385
|
memoryRetention: { maxAgeDays: 30, maxPerScope: 0 },
|
|
260
386
|
deniedTraits: [],
|
|
@@ -265,15 +391,30 @@ export function createDefaultPolicy(workspaceRoot) {
|
|
|
265
391
|
mode: "developer",
|
|
266
392
|
};
|
|
267
393
|
}
|
|
394
|
+
/** The approval window a policy gives: its own, or 5 minutes in developer mode and 30 in enforced. */
|
|
395
|
+
export function approvalTtl(policy) {
|
|
396
|
+
return policy.approvalTtlMs ?? (policy.mode === "enforced" ? 30 * 60_000 : 5 * 60_000);
|
|
397
|
+
}
|
|
398
|
+
const MAX_APPROVAL_TTL_MS = 24 * 60 * 60_000;
|
|
268
399
|
export async function loadPolicy(path, workspaceRoot) {
|
|
269
400
|
const defaults = createDefaultPolicy(workspaceRoot);
|
|
270
401
|
if (path === undefined)
|
|
271
402
|
return defaults;
|
|
272
403
|
const parsed = JSON.parse(await readFile(path, "utf8"));
|
|
404
|
+
// A window of zero, a negative one or a string would leave every challenge
|
|
405
|
+
// expired, or never expiring; refused loudly rather than read as a default.
|
|
406
|
+
if (parsed.approvalTtlMs !== undefined &&
|
|
407
|
+
!(Number.isInteger(parsed.approvalTtlMs) && parsed.approvalTtlMs >= 1 && parsed.approvalTtlMs <= MAX_APPROVAL_TTL_MS)) {
|
|
408
|
+
throw new Error(`policy_approval_ttl_invalid: approvalTtlMs must be a whole number of milliseconds from 1 to ${MAX_APPROVAL_TTL_MS} (24 hours)`);
|
|
409
|
+
}
|
|
273
410
|
return {
|
|
274
411
|
...defaults,
|
|
275
412
|
...parsed,
|
|
276
|
-
|
|
413
|
+
// A relative root is relative to the file, not to whatever directory the
|
|
414
|
+
// server happened to start in: Claude Desktop starts servers in `/`.
|
|
415
|
+
workspaceRoot: parsed.workspaceRoot === undefined
|
|
416
|
+
? resolve(workspaceRoot)
|
|
417
|
+
: resolve(dirname(path), parsed.workspaceRoot),
|
|
277
418
|
allowedCommands: parsed.allowedCommands ?? defaults.allowedCommands,
|
|
278
419
|
allowedDomains: parsed.allowedDomains ?? defaults.allowedDomains,
|
|
279
420
|
// Spread, not replace: a file naming only `maxPerScope` should not silently
|
|
@@ -308,7 +449,10 @@ export function classifyOperation(operation) {
|
|
|
308
449
|
effect: destructive ? "destructive" : read ? "read" : "mutate",
|
|
309
450
|
risk: destructive ? "high" : read ? "low" : "medium",
|
|
310
451
|
capability: `file.${operation.action}`,
|
|
311
|
-
target: operation.path,
|
|
452
|
+
target: grantPath(operation.path),
|
|
453
|
+
...(operation.action === "move" && operation.destination !== undefined
|
|
454
|
+
? { destination: grantPath(operation.destination) }
|
|
455
|
+
: {}),
|
|
312
456
|
traits: [],
|
|
313
457
|
};
|
|
314
458
|
}
|
|
@@ -541,6 +685,13 @@ function isCommandAllowed(operation, policy) {
|
|
|
541
685
|
// written as `powershell`, and an operator's allowlist matches either spelling.
|
|
542
686
|
if (ALWAYS_DENIED_COMMANDS.has(command))
|
|
543
687
|
return false;
|
|
688
|
+
// A bare entry (`ls`) allows the program found on PATH, never a file that
|
|
689
|
+
// happens to share its name: `tools/ls` may be a link to `/bin/sh`. A
|
|
690
|
+
// path-qualified command is allowed only by an entry naming that same path.
|
|
691
|
+
if (/[\\/]/.test(operation.command)) {
|
|
692
|
+
const spelled = operation.command.replaceAll("\\", "/");
|
|
693
|
+
return policy.allowedCommands.some((allowed) => /[\\/]/.test(allowed) && allowed.replaceAll("\\", "/") === spelled);
|
|
694
|
+
}
|
|
544
695
|
return policy.allowedCommands.some((allowed) => normalizeCommandName(allowed) === command);
|
|
545
696
|
}
|
|
546
697
|
function domainAllowed(operation, policy) {
|
|
@@ -567,6 +718,22 @@ function domainAllowed(operation, policy) {
|
|
|
567
718
|
* `file.*` and `/repo/build/*`, and small enough that a policy author can
|
|
568
719
|
* predict what it matches.
|
|
569
720
|
*/
|
|
721
|
+
/**
|
|
722
|
+
* A file path as the file runtime will resolve it, for matching against a
|
|
723
|
+
* grant's target. Raw, `docs/../.env` matched a `docs/*` grant and then read
|
|
724
|
+
* `.env`. Normalised by this platform's rules, the ones the runtime resolves
|
|
725
|
+
* with: a backslash separates on Windows and is part of a name elsewhere, and
|
|
726
|
+
* splitting on one where the runtime does not let a `..` cancel a different
|
|
727
|
+
* segment than the one the runtime cancels. A trailing slash names the
|
|
728
|
+
* directory itself, so it goes too.
|
|
729
|
+
*/
|
|
730
|
+
function grantPath(path) {
|
|
731
|
+
return normalize(path).split(sep).join("/").replace(/(?<=.)\/$/, "");
|
|
732
|
+
}
|
|
733
|
+
/** A file grant's target in the same spelling `grantPath` gives the path. */
|
|
734
|
+
function grantTarget(pattern, classified) {
|
|
735
|
+
return classified.capability.startsWith("file.") ? grantPath(pattern) : pattern;
|
|
736
|
+
}
|
|
570
737
|
function patternMatches(pattern, value) {
|
|
571
738
|
if (pattern === "*")
|
|
572
739
|
return true;
|
|
@@ -637,7 +804,9 @@ export function capabilityCheck(classified, identity, policy, usage) {
|
|
|
637
804
|
const holder = principalRef(identity.principal);
|
|
638
805
|
const candidates = policy.capabilities.filter((grant) => patternMatches(grant.capability, classified.capability) &&
|
|
639
806
|
grant.effects.includes(classified.effect) &&
|
|
640
|
-
patternMatches(grant.target, classified.target) &&
|
|
807
|
+
patternMatches(grantTarget(grant.target, classified), classified.target) &&
|
|
808
|
+
(classified.destination === undefined ||
|
|
809
|
+
patternMatches(grantTarget(grant.target, classified), classified.destination)) &&
|
|
641
810
|
patternMatches(grant.principal, holder));
|
|
642
811
|
const matching = candidates.filter((grant) => providerCovers(grant, classified.spend));
|
|
643
812
|
if (matching.length === 0) {
|
|
@@ -745,23 +914,27 @@ export function evaluatePolicy(taskId, request, policy, usage) {
|
|
|
745
914
|
return { decision: decide("deny", "mutation_requires_evidence") };
|
|
746
915
|
}
|
|
747
916
|
if (classified.effect === "read") {
|
|
748
|
-
|
|
917
|
+
// Enforced mode asserts MELRA is the only door, so a read that leaves the
|
|
918
|
+
// workspace is shown to a person first.
|
|
919
|
+
if (policy.mode !== "enforced" || !namesPathOutside(request.operation, policy.workspaceRoot)) {
|
|
920
|
+
return { decision: decide("allow", "read_only_operation"), ...metered };
|
|
921
|
+
}
|
|
749
922
|
}
|
|
750
|
-
if (policy.mutations === "deny") {
|
|
923
|
+
else if (policy.mutations === "deny") {
|
|
751
924
|
return { decision: decide("deny", "mutations_disabled") };
|
|
752
925
|
}
|
|
753
926
|
const digest = digestOperation(taskId, request.operation);
|
|
754
927
|
const approvalId = randomUUID();
|
|
755
928
|
const phrase = `APPROVE ${digest.slice(0, 12)}`;
|
|
756
929
|
return {
|
|
757
|
-
decision: decide("confirm", "explicit_approval_required"),
|
|
930
|
+
decision: decide("confirm", classified.effect === "read" ? "read_outside_workspace" : "explicit_approval_required"),
|
|
758
931
|
...metered,
|
|
759
932
|
challenge: {
|
|
760
933
|
approvalId,
|
|
761
934
|
taskId,
|
|
762
935
|
actionDigest: digest,
|
|
763
|
-
phrase,
|
|
764
|
-
expiresAt: new Date(Date.now() + policy
|
|
936
|
+
...(policy.mode === "enforced" ? {} : { phrase }),
|
|
937
|
+
expiresAt: new Date(Date.now() + approvalTtl(policy)).toISOString(),
|
|
765
938
|
},
|
|
766
939
|
};
|
|
767
940
|
}
|
|
@@ -788,7 +961,7 @@ export function validateApproval(challenge, response) {
|
|
|
788
961
|
if (challenge.approvalId !== response.approvalId) {
|
|
789
962
|
return { ok: false, reason: "approval_id_mismatch" };
|
|
790
963
|
}
|
|
791
|
-
if (challenge.phrase !== response.phrase) {
|
|
964
|
+
if (challenge.phrase === undefined || challenge.phrase !== response.phrase) {
|
|
792
965
|
return { ok: false, reason: "approval_phrase_mismatch" };
|
|
793
966
|
}
|
|
794
967
|
if (Date.parse(challenge.expiresAt) <= Date.now()) {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAiB7C,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,YAAY,GACb,MAAM,iBAAiB,CAAC;AAmHzB,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,WAAW;IACX,MAAM;IACN,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,KAAK;IACL,MAAM;IACN,WAAW;IACX,YAAY;IACZ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,KAAK;CACN,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAqBD,OAAO,EACL,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,gBAAgB,GAGlB;IACF,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KAC3E;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;KAC7E;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACvE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;KACnD;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;KACnD;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;KACnD;IACD,EAAE,EAAE;QACF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;KAC3C;IACD,KAAK,EAAE;QACL,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;KAC9C;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;KACtD;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KACpD;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;KACpC;IACD,EAAE,EAAE;QACF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KACjD;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAElE,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,OAAO;IACP,OAAO;IACP,UAAU;IACV,aAAa;IACb,IAAI;IACJ,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,IAAuB;IAEvB,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE1C,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,KAAK;QACL,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,MAAM;QACN,UAAU;QACV,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,MAAM,IAAI,GACR,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QACvB,CAAC,IAAI,KAAK,KAAK;YACb,UAAU,KAAK,SAAS;YACxB,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACrC,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,eAAe,EAAE;YACf,KAAK;YACL,MAAM;YACN,SAAS;YACT,KAAK;YACL,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,MAAM;YACN,KAAK;YACL,IAAI;YACJ,MAAM;YACN,UAAU;YACV,IAAI;YACJ,OAAO;SACR;QACD,cAAc,EAAE,CAAC,GAAG,CAAC;QACrB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,CAAC,GAAG,MAAM;QACzB,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC9B,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;QACnD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,WAAW;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,aAAqB;IAErB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;IAChF,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,MAAM;QACT,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC;QAC7D,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;QACnE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;QAChE,4EAA4E;QAC5E,0EAA0E;QAC1E,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE;QAC3E,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE;QACxE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;QAC1D,0EAA0E;QAC1E,sEAAsE;QACtE,2CAA2C;QAC3C,YAAY,EACV,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,4DAA4D;QAC5D,WAAW,EACT,MAAM,CAAC,WAAW,KAAK,SAAS;YAC9B,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;QACjD,4EAA4E;QAC5E,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAoB;IASpD,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,QAAQ,SAAS,CAAC,MAAM,EAAE;gBACtC,MAAM,EAAE,SAAS,CAAC,IAAI;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;oBAC1C,MAAM,EAAE,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC7C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,0EAA0E;YAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,eAAe;oBAC3B,MAAM,EAAE,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC7C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CACtC,SAAS,CAAC,OAAO,IAAI,EAAE,EACvB,SAAS,CAAC,IAAI,CACf,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,qEAAqE;gBACrE,uEAAuE;gBACvE,uEAAuE;gBACvE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;oBACtC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI;wBACJ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,QAAQ;gBACd,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,MAAM,EACJ,SAAS,CAAC,MAAM,KAAK,MAAM;oBACzB,CAAC,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBACvC,CAAC,CAAC,WAAW,OAAO,EAAE;gBAC1B,MAAM;aACP,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yEAAyE;YACzE,iEAAiE;YACjE,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,cAAc;YACd,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;gBACnB,UAAU;gBACV,MAAM;gBACN,SAAS;gBACT,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,YAAY;gBACZ,MAAM;gBACN,SAAS;gBACT,YAAY;gBACZ,QAAQ;aACT,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC7B,UAAU,EAAE,WAAW,SAAS,CAAC,MAAM,EAAE;gBACzC,MAAM,EACJ,SAAS,CAAC,GAAG,KAAK,SAAS;oBACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ;wBAC1B,SAAS,CAAC,MAAM,EAAE,IAAI;wBACtB,aAAa;oBACf,CAAC,CAAC,CAAC,GAAG,EAAE;wBACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACtC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;wBACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC3B,CAAC,CAAC,EAAE;gBACV,oEAAoE;gBACpE,sEAAsE;gBACtE,MAAM,EAAE,CAAC,SAAS,CAAC;aACpB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC;YAClF,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE;gBACxC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,IAC5C,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,IAAI,GACnC,EAAE;gBACF,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GACR,SAAS,CAAC,MAAM,KAAK,cAAc;gBACnC,SAAS,CAAC,MAAM,KAAK,SAAS;gBAC9B,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC;YACpC,MAAM,UAAU,GACd,SAAS,CAAC,MAAM,KAAK,OAAO;gBAC5B,SAAS,CAAC,MAAM,KAAK,MAAM;gBAC3B,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC3B,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,+DAA+D;gBAC/D,uEAAuE;gBACvE,qEAAqE;gBACrE,+BAA+B;gBAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;oBACtB,CAAC,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE;oBAC3E,CAAC,CAAC,UAAU;wBACV,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,EAAE;wBAC5E,CAAC,CAAC,gBAAgB;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC7B,UAAU,EAAE,QAAQ,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;gBACpD,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,CAAC,SAAS,CAAC;gBACnB,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aACrE,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ;YACX,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,aAAa;gBACzB,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAoB;IAEpB,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9D,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,OAAO,CAAC;gBACb,KAAK,OAAO;oBACV,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,QAAQ;oBACX,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,MAAM;oBACT,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS;wBACxC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;4BAC7C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE;yBACrD,CAAC;gBACR;oBACE,OAAO,EAAE,CAAC;YACd,CAAC;QACH,KAAK,QAAQ;YACX,2EAA2E;YAC3E,uEAAuE;YACvE,mEAAmE;YACnE,4BAA4B;YAC5B,OAAO,SAAS,CAAC,MAAM,KAAK,KAAK;gBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC3D,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,uEAAuE;YACvE,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,UAAU;YACb,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM;gBAChC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACxD,CAAC,CAAC,EAAE,CAAC;QACT;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoB,EAAE,MAAmB;IACjE,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAChC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,OAAO,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,SAAoB,EAAE,MAAmB;IAC9D,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,GAAG,GACP,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QACvD,CAAC,CAAC,SAAS,CAAC,GAAG;QACf,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC;IACtF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,GAAG;QACd,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACtC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAqCD;;;;;;;GAOG;AACH,SAAS,cAAc,CACrB,KAAsB,EACtB,KAAkC;IAElC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ;QACtC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;YACnC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAsB,EACtB,KAAkC,EAClC,KAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrD,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;QACjC,SAAS,KAAK,SAAS;QACvB,QAAQ,KAAK,SAAS,EACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,gCAAgC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QAClD,OAAO,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;QACjC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,EACvC,CAAC;QACD,OAAO,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;QACpE,OAAO,mCAAmC,KAAK,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA8B,EAC9B,QAAkB,EAClB,MAAmB,EACnB,KAA6B;IAE7B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CACR,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QACvD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QACzC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;QAC/C,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3C,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CACxC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EACL,UAAU,CAAC,KAAK,KAAK,SAAS;oBAC5B,CAAC,CAAC,iCAAiC,UAAU,CAAC,UAAU,EAAE;oBAC1D,CAAC,CAAC,gCAAgC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,0BAA0B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;QAC7B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YAChC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC,CAC5C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAClD,CAAC;QACF,OAAO;YACL,OAAO,EACL,KAAK,EAAE,aAAa,KAAK,SAAS;gBAChC,CAAC,CAAC,sCAAsC,KAAK,CAAC,EAAE,EAAE;gBAClD,CAAC,CAAC,sBAAsB,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACxD,SAAS,KAAK,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B,EAC9B,QAAkB,EAClB,MAAmB,EACnB,KAA6B;IAE7B,OAAO,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAoB,EACpB,MAAmB,EACnB,KAA6B;IAE7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,CACb,OAAkC,EAClC,MAAc,EACd,OAAa,UAAU,CAAC,IAAI,EACZ,EAAE,CAAC,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI;QACJ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,sCAAsC,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,EACV,OAAO,CAAC,QAAQ,IAAI,cAAc,EAClC,MAAM,EACN,KAAK,CACN,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpE,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CACpC,CAAC;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,WAAW,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,EAAE,UAAU,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,EAAE,MAAM,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,4BAA4B,CAAC;QACzD,GAAG,OAAO;QACV,SAAS,EAAE;YACT,UAAU;YACV,MAAM;YACN,YAAY,EAAE,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;SACrE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAoB;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAwC,EACxC,QAAsC;IAEtC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,cAAc,qBAAqB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAiB7C,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAwHzB,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,WAAW;IACX,MAAM;IACN,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,KAAK;IACL,MAAM;IACN,WAAW;IACX,YAAY;IACZ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,KAAK;CACN,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAqBD,OAAO,EACL,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,gBAAgB,GAGlB;IACF,GAAG,EAAE;QACH,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1E,2EAA2E;QAC3E,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KAC3E;IACD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE;IACrF,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE;IACjF,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE;IAC3D,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE;IAC5D,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE;IAC9E,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE;IAC7E,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE;IACxD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE;IACtE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,EAAE;IAC3E,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,EAAE;IACjF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE;CACpD,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAElE,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,OAAO;IACP,OAAO;IACP,UAAU;IACV,aAAa;IACb,IAAI;IACJ,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,IAAuB;IAEvB,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE1C,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5F,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,KAAK;QACL,SAAS;QACT,MAAM;QACN,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,MAAM;QACN,UAAU;QACV,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,MAAM,IAAI,GACR,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC;QAC3C,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,IAAY,EACZ,UAA8B,EAC9B,IAAuB;IAEvB,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,kEAAkE;IAClE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,2EAA2E;IAC3E,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,IAAI,UAAU,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,gHAAgH;AAChH,SAAS,gBAAgB,CAAC,SAAoB,EAAE,IAAY;IAC1D,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAChD,OAAO,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzD,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,iBAAiB,GAAG,4EAA4E,CAAC;AAEvG;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI;IACtE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU;IACtE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc;CACzD,CAAC,CAAC;AACH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa;IAC9E,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,IAAuB;IAC1C,2EAA2E;IAC3E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,gFAAgF;IAChF,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;aAC1E,IAAI,GAAG,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;aAChF,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;aACtE,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;;YACxC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACrC,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,eAAe,EAAE;YACf,KAAK;YACL,MAAM;YACN,SAAS;YACT,KAAK;YACL,MAAM;YACN,IAAI;YACJ,MAAM;YACN,KAAK;YACL,KAAK;YACL,MAAM;YACN,KAAK;YACL,IAAI;YACJ,MAAM;YACN,UAAU;YACV,IAAI;YACJ,OAAO;SACR;QACD,cAAc,EAAE,CAAC,GAAG,CAAC;QACrB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,SAAS;QACpB,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC9B,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;QACnD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,WAAW;KAClB,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,MAAmD;IAC7E,OAAO,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAwB,EACxB,aAAqB;IAErB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;IAChF,2EAA2E;IAC3E,4EAA4E;IAC5E,IACE,MAAM,CAAC,aAAa,KAAK,SAAS;QAClC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC,EACrH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,mBAAmB,aAAa,CAChI,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,MAAM;QACT,yEAAyE;QACzE,qEAAqE;QACrE,aAAa,EACX,MAAM,CAAC,aAAa,KAAK,SAAS;YAChC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC;QAClD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;QACnE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;QAChE,4EAA4E;QAC5E,0EAA0E;QAC1E,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE;QAC3E,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE;QACxE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;QAC1D,0EAA0E;QAC1E,sEAAsE;QACtE,2CAA2C;QAC3C,YAAY,EACV,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,4DAA4D;QAC5D,WAAW,EACT,MAAM,CAAC,WAAW,KAAK,SAAS;YAC9B,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;QACjD,4EAA4E;QAC5E,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAoB;IAWpD,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,QAAQ,SAAS,CAAC,MAAM,EAAE;gBACtC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS;oBACpE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;oBAC1C,MAAM,EAAE,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC7C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,0EAA0E;YAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,eAAe;oBAC3B,MAAM,EAAE,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC7C,MAAM,EAAE,EAAE;iBACX,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CACtC,SAAS,CAAC,OAAO,IAAI,EAAE,EACvB,SAAS,CAAC,IAAI,CACf,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,qEAAqE;gBACrE,uEAAuE;gBACvE,uEAAuE;gBACvE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;oBACtC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI;wBACJ,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,QAAQ;gBACd,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,MAAM,EACJ,SAAS,CAAC,MAAM,KAAK,MAAM;oBACzB,CAAC,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE;oBACvC,CAAC,CAAC,WAAW,OAAO,EAAE;gBAC1B,MAAM;aACP,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,yEAAyE;YACzE,iEAAiE;YACjE,yEAAyE;YACzE,wEAAwE;YACxE,yEAAyE;YACzE,cAAc;YACd,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;gBACnB,UAAU;gBACV,MAAM;gBACN,SAAS;gBACT,QAAQ;gBACR,SAAS;gBACT,MAAM;gBACN,YAAY;gBACZ,MAAM;gBACN,SAAS;gBACT,YAAY;gBACZ,QAAQ;aACT,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC7B,UAAU,EAAE,WAAW,SAAS,CAAC,MAAM,EAAE;gBACzC,MAAM,EACJ,SAAS,CAAC,GAAG,KAAK,SAAS;oBACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ;wBAC1B,SAAS,CAAC,MAAM,EAAE,IAAI;wBACtB,aAAa;oBACf,CAAC,CAAC,CAAC,GAAG,EAAE;wBACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACtC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;wBACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC3B,CAAC,CAAC,EAAE;gBACV,oEAAoE;gBACpE,sEAAsE;gBACtE,MAAM,EAAE,CAAC,SAAS,CAAC;aACpB,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC;YAClF,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,UAAU,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE;gBACxC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,IAC5C,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,IAAI,GACnC,EAAE;gBACF,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GACR,SAAS,CAAC,MAAM,KAAK,cAAc;gBACnC,SAAS,CAAC,MAAM,KAAK,SAAS;gBAC9B,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC;YACpC,MAAM,UAAU,GACd,SAAS,CAAC,MAAM,KAAK,OAAO;gBAC5B,SAAS,CAAC,MAAM,KAAK,MAAM;gBAC3B,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC3B,UAAU,EAAE,YAAY,SAAS,CAAC,MAAM,EAAE;gBAC1C,+DAA+D;gBAC/D,uEAAuE;gBACvE,qEAAqE;gBACrE,+BAA+B;gBAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;oBACtB,CAAC,CAAC,WAAW,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE;oBAC3E,CAAC,CAAC,UAAU;wBACV,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,IAAI,GAAG,EAAE;wBAC5E,CAAC,CAAC,gBAAgB;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC7B,UAAU,EAAE,QAAQ,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;gBACpD,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,CAAC,SAAS,CAAC;gBACnB,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aACrE,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ;YACX,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,aAAa;gBACzB,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,EAAE;aACX,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAoB;IAEpB,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC9D,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM;YACT,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzB,KAAK,OAAO,CAAC;gBACb,KAAK,OAAO;oBACV,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,QAAQ;oBACX,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,MAAM;oBACT,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS;wBACxC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;4BAC7C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE;yBACrD,CAAC;gBACR;oBACE,OAAO,EAAE,CAAC;YACd,CAAC;QACH,KAAK,QAAQ;YACX,2EAA2E;YAC3E,uEAAuE;YACvE,mEAAmE;YACnE,4BAA4B;YAC5B,OAAO,SAAS,CAAC,MAAM,KAAK,KAAK;gBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC3D,CAAC,CAAC,EAAE,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,uEAAuE;YACvE,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,UAAU;YACb,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM;gBAChC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACxD,CAAC,CAAC,EAAE,CAAC;QACT;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoB,EAAE,MAAmB;IACjE,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAChC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,OAAO,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAChC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,OAAO,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,SAAoB,EAAE,MAAmB;IAC9D,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,GAAG,GACP,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QACvD,CAAC,CAAC,SAAS,CAAC,GAAG;QACf,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC;IACtF,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,GAAG;QACd,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAe,EAAE,UAA8B;IAClE,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACtC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAsCD;;;;;;;GAOG;AACH,SAAS,cAAc,CACrB,KAAsB,EACtB,KAAkC;IAElC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ;QACtC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;YACnC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAsB,EACtB,KAAkC,EAClC,KAAwC;IAExC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrD,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;QACjC,SAAS,KAAK,SAAS;QACvB,QAAQ,KAAK,SAAS,EACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,gCAAgC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QAClD,OAAO,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;QACjC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,EACvC,CAAC;QACD,OAAO,8BAA8B,KAAK,CAAC,EAAE,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;QACpE,OAAO,mCAAmC,KAAK,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA8B,EAC9B,QAAkB,EAClB,MAAmB,EACnB,KAA6B;IAE7B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CACR,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QACvD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QACzC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACxE,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;YACnC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAChF,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3C,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CACxC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,OAAO,EACL,UAAU,CAAC,KAAK,KAAK,SAAS;oBAC5B,CAAC,CAAC,iCAAiC,UAAU,CAAC,UAAU,EAAE;oBAC1D,CAAC,CAAC,gCAAgC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,0BAA0B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;QAC7B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YAChC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAAC,CAC5C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,CAClD,CAAC;QACF,OAAO;YACL,OAAO,EACL,KAAK,EAAE,aAAa,KAAK,SAAS;gBAChC,CAAC,CAAC,sCAAsC,KAAK,CAAC,EAAE,EAAE;gBAClD,CAAC,CAAC,sBAAsB,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,UAAU,CAAC,UAAU,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACxD,SAAS,KAAK,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B,EAC9B,QAAkB,EAClB,MAAmB,EACnB,KAA6B;IAE7B,OAAO,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAoB,EACpB,MAAmB,EACnB,KAA6B;IAE7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,CACb,OAAkC,EAClC,MAAc,EACd,OAAa,UAAU,CAAC,IAAI,EACZ,EAAE,CAAC,CAAC;QACpB,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI;QACJ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,sCAAsC,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,eAAe,CAC7B,UAAU,EACV,OAAO,CAAC,QAAQ,IAAI,cAAc,EAClC,MAAM,EACN,KAAK,CACN,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpE,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CACpC,CAAC;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,WAAW,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,EAAE,UAAU,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,EAAE,MAAM,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,MAAM,CACd,SAAS,EACT,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,4BAA4B,CACvF;QACD,GAAG,OAAO;QACV,SAAS,EAAE;YACT,UAAU;YACV,MAAM;YACN,YAAY,EAAE,MAAM;YACpB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YACjD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;SACpE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,SAAoB;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAwC,EACxC,QAAsC;IAEtC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,cAAc,qBAAqB,CAAC"}
|
package/dist/network-policy.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { type LookupFunction } from "node:net";
|
|
1
2
|
export declare function isPrivateAddress(address: string): boolean;
|
|
2
3
|
export interface NetworkPolicy {
|
|
3
4
|
allowedDomains: string[];
|
|
@@ -19,9 +20,16 @@ export interface NetworkPolicy {
|
|
|
19
20
|
*/
|
|
20
21
|
export interface SafeDestination {
|
|
21
22
|
url: URL;
|
|
22
|
-
/** The
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
/** The host to connect to: the name, or an IP literal without brackets. */
|
|
24
|
+
host: string;
|
|
25
|
+
/**
|
|
26
|
+
* A `lookup` for `net`/`http`/`https` that answers only with the addresses
|
|
27
|
+
* this check accepted, so the socket never resolves the name again. Every
|
|
28
|
+
* answer is offered, not just the first, so Node can fall back between them:
|
|
29
|
+
* `localhost` answering `::1` first must still reach a server that listens
|
|
30
|
+
* only on 127.0.0.1.
|
|
31
|
+
*/
|
|
32
|
+
lookup: LookupFunction;
|
|
25
33
|
}
|
|
26
34
|
/** The URL's host, lowercased, with an IPv6 literal's brackets removed. */
|
|
27
35
|
export declare function hostOf(url: URL): string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAmErD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsCzD;AASD,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAWD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,GAAG,CAAC;IACT,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,cAAc,CAAC;CACxB;AAcD,2EAA2E;AAC3E,wBAAgB,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAEvC;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,GAAG,CAAC,CAEd"}
|
package/dist/network-policy.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
// Copyright 2026 XAGI Labs Private Limited
|
|
2
2
|
// SPDX-License-Identifier: Apache-2.0
|
|
3
3
|
import { isIP } from "node:net";
|
|
4
|
+
import { lookup as dnsLookup } from "node:dns";
|
|
4
5
|
import { lookup } from "node:dns/promises";
|
|
5
6
|
function ipv4Number(address) {
|
|
6
7
|
return address
|
|
@@ -32,6 +33,40 @@ function mappedIpv4Address(address) {
|
|
|
32
33
|
low & 0xff,
|
|
33
34
|
].join(".");
|
|
34
35
|
}
|
|
36
|
+
/** The eight 16-bit groups of an IPv6 address, an embedded IPv4 tail included. */
|
|
37
|
+
function ipv6Groups(address) {
|
|
38
|
+
let text = address.toLowerCase();
|
|
39
|
+
// The dotted tail, if any, found without a regular expression: one that
|
|
40
|
+
// backtracks on long digit runs is a way to stall the destination check.
|
|
41
|
+
const tail = text.slice(text.lastIndexOf(":") + 1);
|
|
42
|
+
if (isIP(tail) === 4) {
|
|
43
|
+
const [a, b, c, d] = tail.split(".").map(Number);
|
|
44
|
+
text = `${text.slice(0, -tail.length)}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
|
|
45
|
+
}
|
|
46
|
+
const [head = "", rest] = text.split("::");
|
|
47
|
+
const left = head === "" ? [] : head.split(":");
|
|
48
|
+
const right = rest === undefined || rest === "" ? [] : rest.split(":");
|
|
49
|
+
const missing = 8 - left.length - right.length;
|
|
50
|
+
if (missing < 0 || (rest === undefined && missing !== 0))
|
|
51
|
+
return undefined;
|
|
52
|
+
return [...left, ...Array(missing).fill("0"), ...right].map((group) => Number.parseInt(group, 16));
|
|
53
|
+
}
|
|
54
|
+
/**
|
|
55
|
+
* The IPv4 address a NAT64 address stands for, or whether it is a local-use
|
|
56
|
+
* translation (RFC 8215 `64:ff9b:1::/48`), which only ever reaches a private
|
|
57
|
+
* network. `64:ff9b::a00:5` is 10.0.0.5 on a host behind NAT64.
|
|
58
|
+
*/
|
|
59
|
+
function nat64(address) {
|
|
60
|
+
const groups = ipv6Groups(address);
|
|
61
|
+
if (groups === undefined || groups[0] !== 0x64 || groups[1] !== 0xff9b)
|
|
62
|
+
return undefined;
|
|
63
|
+
if (groups[2] === 1)
|
|
64
|
+
return { localUse: true };
|
|
65
|
+
if (groups.slice(2, 6).some((group) => group !== 0))
|
|
66
|
+
return undefined;
|
|
67
|
+
const [high, low] = [groups[6], groups[7]];
|
|
68
|
+
return { ipv4: [high >>> 8, high & 0xff, low >>> 8, low & 0xff].join("."), localUse: false };
|
|
69
|
+
}
|
|
35
70
|
export function isPrivateAddress(address) {
|
|
36
71
|
const version = isIP(address);
|
|
37
72
|
if (version === 4) {
|
|
@@ -54,6 +89,10 @@ export function isPrivateAddress(address) {
|
|
|
54
89
|
const mapped = mappedIpv4Address(normalized);
|
|
55
90
|
if (mapped !== undefined)
|
|
56
91
|
return isPrivateAddress(mapped);
|
|
92
|
+
const translated = nat64(normalized);
|
|
93
|
+
if (translated !== undefined) {
|
|
94
|
+
return translated.localUse || isPrivateAddress(translated.ipv4);
|
|
95
|
+
}
|
|
57
96
|
return (normalized === "::" ||
|
|
58
97
|
normalized === "::1" ||
|
|
59
98
|
normalized.startsWith("fc") ||
|
|
@@ -78,6 +117,20 @@ function domainAllowed(host, allowed) {
|
|
|
78
117
|
host === entry.toLowerCase() ||
|
|
79
118
|
host.endsWith(`.${entry.toLowerCase()}`));
|
|
80
119
|
}
|
|
120
|
+
function pinnedLookup(addresses) {
|
|
121
|
+
const answers = addresses.map((address) => ({ address, family: isIP(address) }));
|
|
122
|
+
return (_hostname, options, callback) => {
|
|
123
|
+
const family = { IPv4: 4, IPv6: 6 }[String(options.family)] ?? options.family;
|
|
124
|
+
const wanted = answers.filter((answer) => !family || answer.family === family);
|
|
125
|
+
if (wanted.length === 0) {
|
|
126
|
+
callback(Object.assign(new Error("destination_no_address"), { code: "ENOTFOUND" }), "", 0);
|
|
127
|
+
}
|
|
128
|
+
else if (options.all)
|
|
129
|
+
callback(null, wanted);
|
|
130
|
+
else
|
|
131
|
+
callback(null, wanted[0].address, wanted[0].family);
|
|
132
|
+
};
|
|
133
|
+
}
|
|
81
134
|
/** The URL's host, lowercased, with an IPv6 literal's brackets removed. */
|
|
82
135
|
export function hostOf(url) {
|
|
83
136
|
return url.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
|
|
@@ -87,7 +140,7 @@ export async function assertSafeDestination(rawUrl, policy) {
|
|
|
87
140
|
// Unhinged mode still parses the URL — a value the browser cannot navigate to
|
|
88
141
|
// is a bug either way — but asserts nothing about where it points.
|
|
89
142
|
if (policy.unhinged)
|
|
90
|
-
return { url,
|
|
143
|
+
return { url, host: hostOf(url), lookup: dnsLookup };
|
|
91
144
|
if (!["http:", "https:"].includes(url.protocol)) {
|
|
92
145
|
throw new Error("destination_protocol_not_allowed");
|
|
93
146
|
}
|
|
@@ -112,7 +165,7 @@ export async function assertSafeDestination(rawUrl, policy) {
|
|
|
112
165
|
!(policy.allowLocalhost && isLoopbackAddress(host))) {
|
|
113
166
|
throw new Error("destination_private_blocked");
|
|
114
167
|
}
|
|
115
|
-
return { url,
|
|
168
|
+
return { url, host, lookup: pinnedLookup([host]) };
|
|
116
169
|
}
|
|
117
170
|
const addresses = await lookup(host, { all: true, verbatim: true });
|
|
118
171
|
if (addresses.length === 0 ||
|
|
@@ -120,9 +173,8 @@ export async function assertSafeDestination(rawUrl, policy) {
|
|
|
120
173
|
!(policy.allowLocalhost && isLoopbackAddress(item.address)))) {
|
|
121
174
|
throw new Error("destination_private_blocked");
|
|
122
175
|
}
|
|
123
|
-
// Every answer passed, so
|
|
124
|
-
|
|
125
|
-
return { url, address: addresses[0].address };
|
|
176
|
+
// Every answer passed, so all of them are safe to pin, in the resolver's order.
|
|
177
|
+
return { url, host, lookup: pinnedLookup(addresses.map((item) => item.address)) };
|
|
126
178
|
}
|
|
127
179
|
export async function assertSafeUrl(rawUrl, policy) {
|
|
128
180
|
return (await assertSafeDestination(rawUrl, policy)).url;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,IAAI,EAAuB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,KAAK,CAAC;QACV,IAAI,GAAG,IAAI;QACX,GAAG,KAAK,CAAC;QACT,GAAG,GAAG,IAAI;KACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;QACrF,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,CAAC,SAAS,EAAE,CAAC,CAAC;YACd,CAAC,UAAU,EAAE,CAAC,CAAC;YACf,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,EAAE,CAAC;YACjB,CAAC,aAAa,EAAE,EAAE,CAAC;YACnB,CAAC,YAAY,EAAE,EAAE,CAAC;YAClB,CAAC,WAAW,EAAE,CAAC,CAAC;YAChB,CAAC,WAAW,EAAE,CAAC,CAAC;SACjB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAc,EAAE,IAAc,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,QAAQ,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAK,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CACL,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK;YACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAaD,SAAS,aAAa,CAAC,IAAY,EAAE,OAAiB;IACpD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,GAAG;QACb,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAC3C,CAAC;AACJ,CAAC;AAwBD,SAAS,YAAY,CAAC,SAA4B;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;;YAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,GAAQ;IAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,MAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,IACE,gBAAgB,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IACE,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,gFAAgF;IAChF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,MAAqB;IAErB,OAAO,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@melra/policy-core",
|
|
3
|
-
"version": "0.3.0-alpha.
|
|
3
|
+
"version": "0.3.0-alpha.14",
|
|
4
4
|
"description": "Policy evaluation and scoped approval primitives for MELRA.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -21,7 +21,7 @@
|
|
|
21
21
|
"dist"
|
|
22
22
|
],
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@melra/protocol": "0.3.0-alpha.
|
|
24
|
+
"@melra/protocol": "0.3.0-alpha.14"
|
|
25
25
|
},
|
|
26
26
|
"scripts": {
|
|
27
27
|
"build": "tsc -p tsconfig.json",
|