@namzu/sdk 27.1.0 → 28.0.0

package/dist/types/authorization/index.d.ts

@@ -0,0 +1,634 @@
+import { z } from 'zod';
+export type GateDecision = 'allow' | 'deny' | 'review';
+export interface GateEvaluationResult {
+    readonly decision: GateDecision;
+    readonly matchedRule: AuthorizationRule | null;
+    readonly reason: string;
+}
+export type AuthorizationRule = {
+    /**
+     * Categories this allowance does not reach, even when
+     * `isTrustedReadOnly` says the read-only CLAIM is trustworthy.
+     * `isTrustedReadOnly` has no notion of category — it answers
+     * whether the claim can be believed, never what channel the call
+     * travelled over. See `evaluateRule`'s `allow_read_only` case for
+     * the category that actually needs this.
+     */
+    type: 'allow_read_only';
+    excludeCategories?: string[];
+} | {
+    type: 'deny_dangerous_patterns';
+} | {
+    type: 'allow_by_category';
+    categories: string[];
+} | {
+    type: 'allow_by_name';
+    toolNames: string[];
+} | {
+    type: 'deny_by_name';
+    toolNames: string[];
+} | {
+    /**
+     * Match a regular expression against the tool's NAME, the
+     * serialised arguments, or both concatenated.
+     *
+     * Read `target: 'args'` carefully before writing one: it tests
+     * `JSON.stringify(toolInput)`, so the subject is the JSON TEXT of
+     * the whole argument object — `{"command":"git push origin main"}`
+     * — and not any single argument. The name suggests otherwise, and
+     * that is what makes it a trap: an anchored pattern like
+     * `^git push.*$` is a natural thing to write and can never match,
+     * so the rule silently decides nothing. `'both'` PREFIXES the tool
+     * name to that text rather than requiring it, so it is not a scope
+     * either — a rule written with `bash` in mind still sees every
+     * other tool's arguments.
+     *
+     * When you mean "this tool, this argument", use
+     * {@link AuthorizationRule} `argument_pattern` instead. This one
+     * stays for the case it is actually good at: matching anywhere in
+     * the serialised input without caring where.
+     */
+    type: 'custom_pattern';
+    pattern: string;
+    target: 'name' | 'args' | 'both';
+    decision: 'allow' | 'deny';
+} | {
+    /**
+     * Match a regular expression against ONE named argument of ONE
+     * named set of tools.
+     *
+     * This exists because `custom_pattern` could express neither half.
+     * It carries no tool scope, so a rule an operator wrote about
+     * `bash` decided `edit` calls too; and its argument target tests
+     * the serialised object, so pinning the tool cost the ability to
+     * anchor and anchoring cost the tool scope. Every pattern rule was
+     * therefore one of those two wrong things.
+     *
+     * The subject here is the argument's own VALUE, so `^git push`
+     * means what it looks like it means.
+     *
+     * A rule whose tool is not called, or whose argument is absent,
+     * decides nothing — the rule's precondition simply is not met. So
+     * does one whose argument holds an object or an array: a pattern
+     * cannot say anything true about a structured value, and pretending
+     * otherwise by matching its serialisation would reintroduce exactly
+     * the confusion this rule was added to remove. If you need to
+     * refuse a tool over the SHAPE of its input rather than a string in
+     * it, deny it by name.
+     */
+    type: 'argument_pattern';
+    toolNames: string[];
+    /** The argument key, at the top level of the tool's input. */
+    argument: string;
+    pattern: string;
+    decision: 'allow' | 'deny';
+} | {
+    type: 'allow_by_tier';
+    tiers: string[];
+};
+export declare const AuthorizationRuleSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"allow_read_only">;
+    excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_read_only";
+    excludeCategories?: string[] | undefined;
+}, {
+    type: "allow_read_only";
+    excludeCategories?: string[] | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"deny_dangerous_patterns">;
+}, "strip", z.ZodTypeAny, {
+    type: "deny_dangerous_patterns";
+}, {
+    type: "deny_dangerous_patterns";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_category">;
+    categories: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_category";
+    categories: string[];
+}, {
+    type: "allow_by_category";
+    categories: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_name">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_name";
+    toolNames: string[];
+}, {
+    type: "allow_by_name";
+    toolNames: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"deny_by_name">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "deny_by_name";
+    toolNames: string[];
+}, {
+    type: "deny_by_name";
+    toolNames: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"custom_pattern">;
+    pattern: z.ZodString;
+    target: z.ZodEnum<["name", "args", "both"]>;
+    decision: z.ZodEnum<["allow", "deny"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "custom_pattern";
+    pattern: string;
+    target: "name" | "args" | "both";
+    decision: "allow" | "deny";
+}, {
+    type: "custom_pattern";
+    pattern: string;
+    target: "name" | "args" | "both";
+    decision: "allow" | "deny";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"argument_pattern">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+    argument: z.ZodString;
+    pattern: z.ZodString;
+    decision: z.ZodEnum<["allow", "deny"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "argument_pattern";
+    toolNames: string[];
+    pattern: string;
+    decision: "allow" | "deny";
+    argument: string;
+}, {
+    type: "argument_pattern";
+    toolNames: string[];
+    pattern: string;
+    decision: "allow" | "deny";
+    argument: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_tier">;
+    tiers: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_tier";
+    tiers: string[];
+}, {
+    type: "allow_by_tier";
+    tiers: string[];
+}>]>;
+export declare const AuthorizationGateConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"allow_read_only">;
+        excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    }, {
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"deny_dangerous_patterns">;
+    }, "strip", z.ZodTypeAny, {
+        type: "deny_dangerous_patterns";
+    }, {
+        type: "deny_dangerous_patterns";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_category">;
+        categories: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_category";
+        categories: string[];
+    }, {
+        type: "allow_by_category";
+        categories: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_name">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_name";
+        toolNames: string[];
+    }, {
+        type: "allow_by_name";
+        toolNames: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"deny_by_name">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "deny_by_name";
+        toolNames: string[];
+    }, {
+        type: "deny_by_name";
+        toolNames: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"custom_pattern">;
+        pattern: z.ZodString;
+        target: z.ZodEnum<["name", "args", "both"]>;
+        decision: z.ZodEnum<["allow", "deny"]>;
+    }, "strip", z.ZodTypeAny, {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    }, {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"argument_pattern">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+        argument: z.ZodString;
+        pattern: z.ZodString;
+        decision: z.ZodEnum<["allow", "deny"]>;
+    }, "strip", z.ZodTypeAny, {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    }, {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_tier">;
+        tiers: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_tier";
+        tiers: string[];
+    }, {
+        type: "allow_by_tier";
+        tiers: string[];
+    }>]>, "many">>;
+    allowReadOnlyTools: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Narrows the LAST-resort `allow_read_only` rule the gate appends for
+     * {@link allowReadOnlyTools}. A category listed here falls through to
+     * whatever comes next — another rule, or review — even for a call
+     * `isTrustedReadOnly` would otherwise allow.
+     *
+     * `.optional()` for the reason `AllowReadOnlySchema.excludeCategories` is.
+     */
+    allowReadOnlyExcludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    denyDangerousPatterns: z.ZodDefault<z.ZodBoolean>;
+    logDecisions: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    rules: ({
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    } | {
+        type: "deny_dangerous_patterns";
+    } | {
+        type: "allow_by_category";
+        categories: string[];
+    } | {
+        type: "allow_by_name";
+        toolNames: string[];
+    } | {
+        type: "deny_by_name";
+        toolNames: string[];
+    } | {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    } | {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    } | {
+        type: "allow_by_tier";
+        tiers: string[];
+    })[];
+    allowReadOnlyTools: boolean;
+    denyDangerousPatterns: boolean;
+    logDecisions: boolean;
+    allowReadOnlyExcludeCategories?: string[] | undefined;
+}, {
+    enabled?: boolean | undefined;
+    rules?: ({
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    } | {
+        type: "deny_dangerous_patterns";
+    } | {
+        type: "allow_by_category";
+        categories: string[];
+    } | {
+        type: "allow_by_name";
+        toolNames: string[];
+    } | {
+        type: "deny_by_name";
+        toolNames: string[];
+    } | {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    } | {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    } | {
+        type: "allow_by_tier";
+        tiers: string[];
+    })[] | undefined;
+    allowReadOnlyTools?: boolean | undefined;
+    allowReadOnlyExcludeCategories?: string[] | undefined;
+    denyDangerousPatterns?: boolean | undefined;
+    logDecisions?: boolean | undefined;
+}>;
+export type AuthorizationGateConfig = z.infer<typeof AuthorizationGateConfigSchema>;
+/**
+ * Old spellings, live for one deprecation window.
+ *
+ * A reader who saw `VerificationGate` expected something that verifies a
+ * claim — checks a signature, confirms an output matches a schema. This is
+ * a rule engine that decides, BEFORE a tool runs, whether the call is
+ * permitted: allow / deny / review, by name, category, tier or a pattern
+ * over the arguments. Every rule variant says so.
+ *
+ * The misreading was not academic. The module sat beside real guardrail and
+ * HITL neighbours, where "verification" actively suggests the post-hoc
+ * double-check the guardrails do.
+ */
+/**
+ * The two schemas below carry aliases too, and the task that specified this
+ * rename said they would not need any: `public-runtime.ts` records that they
+ * are deliberately not re-exported, so they looked unreachable.
+ *
+ * They were not. `public-types.ts` re-exports this module with
+ * `export type *`, which exports every name in TYPE position — including a
+ * `const`. So `import type { VerificationRuleSchema } from '@namzu/sdk'`
+ * compiled and `typeof VerificationRuleSchema` was a usable type, while
+ * importing it as a value failed with TS1362. Checked by compiling both
+ * forms against the built package rather than reading the barrel.
+ *
+ * Declared as `const` rather than `type` on purpose: a `type` alias would
+ * break `typeof`, which is the only way these were ever usable.
+ */
+/** @deprecated Renamed to {@link AuthorizationRuleSchema}. Removed in the next major. */
+export declare const VerificationRuleSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"allow_read_only">;
+    excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_read_only";
+    excludeCategories?: string[] | undefined;
+}, {
+    type: "allow_read_only";
+    excludeCategories?: string[] | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"deny_dangerous_patterns">;
+}, "strip", z.ZodTypeAny, {
+    type: "deny_dangerous_patterns";
+}, {
+    type: "deny_dangerous_patterns";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_category">;
+    categories: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_category";
+    categories: string[];
+}, {
+    type: "allow_by_category";
+    categories: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_name">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_name";
+    toolNames: string[];
+}, {
+    type: "allow_by_name";
+    toolNames: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"deny_by_name">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "deny_by_name";
+    toolNames: string[];
+}, {
+    type: "deny_by_name";
+    toolNames: string[];
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"custom_pattern">;
+    pattern: z.ZodString;
+    target: z.ZodEnum<["name", "args", "both"]>;
+    decision: z.ZodEnum<["allow", "deny"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "custom_pattern";
+    pattern: string;
+    target: "name" | "args" | "both";
+    decision: "allow" | "deny";
+}, {
+    type: "custom_pattern";
+    pattern: string;
+    target: "name" | "args" | "both";
+    decision: "allow" | "deny";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"argument_pattern">;
+    toolNames: z.ZodArray<z.ZodString, "many">;
+    argument: z.ZodString;
+    pattern: z.ZodString;
+    decision: z.ZodEnum<["allow", "deny"]>;
+}, "strip", z.ZodTypeAny, {
+    type: "argument_pattern";
+    toolNames: string[];
+    pattern: string;
+    decision: "allow" | "deny";
+    argument: string;
+}, {
+    type: "argument_pattern";
+    toolNames: string[];
+    pattern: string;
+    decision: "allow" | "deny";
+    argument: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"allow_by_tier">;
+    tiers: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    type: "allow_by_tier";
+    tiers: string[];
+}, {
+    type: "allow_by_tier";
+    tiers: string[];
+}>]>;
+/** @deprecated Renamed to {@link AuthorizationGateConfigSchema}. Removed in the next major. */
+export declare const VerificationGateConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    rules: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"allow_read_only">;
+        excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    }, {
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"deny_dangerous_patterns">;
+    }, "strip", z.ZodTypeAny, {
+        type: "deny_dangerous_patterns";
+    }, {
+        type: "deny_dangerous_patterns";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_category">;
+        categories: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_category";
+        categories: string[];
+    }, {
+        type: "allow_by_category";
+        categories: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_name">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_name";
+        toolNames: string[];
+    }, {
+        type: "allow_by_name";
+        toolNames: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"deny_by_name">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "deny_by_name";
+        toolNames: string[];
+    }, {
+        type: "deny_by_name";
+        toolNames: string[];
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"custom_pattern">;
+        pattern: z.ZodString;
+        target: z.ZodEnum<["name", "args", "both"]>;
+        decision: z.ZodEnum<["allow", "deny"]>;
+    }, "strip", z.ZodTypeAny, {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    }, {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"argument_pattern">;
+        toolNames: z.ZodArray<z.ZodString, "many">;
+        argument: z.ZodString;
+        pattern: z.ZodString;
+        decision: z.ZodEnum<["allow", "deny"]>;
+    }, "strip", z.ZodTypeAny, {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    }, {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"allow_by_tier">;
+        tiers: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        type: "allow_by_tier";
+        tiers: string[];
+    }, {
+        type: "allow_by_tier";
+        tiers: string[];
+    }>]>, "many">>;
+    allowReadOnlyTools: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Narrows the LAST-resort `allow_read_only` rule the gate appends for
+     * {@link allowReadOnlyTools}. A category listed here falls through to
+     * whatever comes next — another rule, or review — even for a call
+     * `isTrustedReadOnly` would otherwise allow.
+     *
+     * `.optional()` for the reason `AllowReadOnlySchema.excludeCategories` is.
+     */
+    allowReadOnlyExcludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    denyDangerousPatterns: z.ZodDefault<z.ZodBoolean>;
+    logDecisions: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    rules: ({
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    } | {
+        type: "deny_dangerous_patterns";
+    } | {
+        type: "allow_by_category";
+        categories: string[];
+    } | {
+        type: "allow_by_name";
+        toolNames: string[];
+    } | {
+        type: "deny_by_name";
+        toolNames: string[];
+    } | {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    } | {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    } | {
+        type: "allow_by_tier";
+        tiers: string[];
+    })[];
+    allowReadOnlyTools: boolean;
+    denyDangerousPatterns: boolean;
+    logDecisions: boolean;
+    allowReadOnlyExcludeCategories?: string[] | undefined;
+}, {
+    enabled?: boolean | undefined;
+    rules?: ({
+        type: "allow_read_only";
+        excludeCategories?: string[] | undefined;
+    } | {
+        type: "deny_dangerous_patterns";
+    } | {
+        type: "allow_by_category";
+        categories: string[];
+    } | {
+        type: "allow_by_name";
+        toolNames: string[];
+    } | {
+        type: "deny_by_name";
+        toolNames: string[];
+    } | {
+        type: "custom_pattern";
+        pattern: string;
+        target: "name" | "args" | "both";
+        decision: "allow" | "deny";
+    } | {
+        type: "argument_pattern";
+        toolNames: string[];
+        pattern: string;
+        decision: "allow" | "deny";
+        argument: string;
+    } | {
+        type: "allow_by_tier";
+        tiers: string[];
+    })[] | undefined;
+    allowReadOnlyTools?: boolean | undefined;
+    allowReadOnlyExcludeCategories?: string[] | undefined;
+    denyDangerousPatterns?: boolean | undefined;
+    logDecisions?: boolean | undefined;
+}>;
+/** @deprecated Renamed to {@link AuthorizationRule}. Removed in the next major. */
+export type VerificationRule = AuthorizationRule;
+/** @deprecated Renamed to {@link AuthorizationGateConfig}. Removed in the next major. */
+export type VerificationGateConfig = AuthorizationGateConfig;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,iBAAiB,GAC1B;IACA;;;;;;;OAOG;IACH,IAAI,EAAE,iBAAiB,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GACD;IAAE,IAAI,EAAE,yBAAyB,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7C;IACA;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAChC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;CACzB,GACD;IACA;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,EAAE,kBAAkB,CAAA;IACxB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;CACzB,GACD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AA6C7C,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IASlC,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAIzC;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIF,CAAA;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEnF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;GAcG;AAEH,yFAAyF;AACzF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA0B,CAAA;AAC7D,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAhDxC;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCqE,CAAA;AAEzE,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAChD,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,CAAA"}