@neuralis/brain-core 0.3.2 → 0.4.0

package/dist/src/connectors/inProcessTransport.js

@@ -0,0 +1,447 @@
+/**
+ * The `local` transport of the `host` connector: this process's own
+ * filesystem — a Docker mount, the native project zone, `data`, `packages`, the
+ * App Zone. It clamps every path to the source root (`resolveAndGuard`: no
+ * `..`, no symlink anywhere on the way) and runs the kernel's ONE folder walk
+ * (`folderOps`) on the clamped path; the server additionally searches with a
+ * real search binary (`rg`, `git grep`, `grep`) where the device has only the
+ * JS engine.
+ *
+ * Also the ONE owner of how a local source's ROOT is found on this plane
+ * (`resolveLocalRoot`, the os-mount host pair) — every gate, the shell index,
+ * source-package discovery and `<runtime_stack>` resolve the SAME root.
+ */
+import fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { discoverOsMounts, hostTreeRoot, isPathInside, neuralisTreeRoot } from '@neuralis/package-system/paths';
+import { isPackageFolderPath } from '@neuralis/package-system/contracts';
+import { foldPolicyCase } from '@neuralis/package-system/policies';
+import { countTree, getFsWatchHub, readFileRange, scanContentTree, scanDeltaTree, walkTree, } from '@neuralis/package-system/data';
+import { resolveSearchBinaries } from '../search/binaryResolver.js';
+import { getBrainConfigNumber, resolveWatchRecovery } from '../config/env.js';
+/** PATH-only child env — never this process's env (it carries infra secrets no helper needs). */
+export const CHILD_ENV = { PATH: process.env.PATH ?? '/usr/local/bin:/usr/bin:/bin' };
+const SCAN_TIMEOUT_MS = 120_000;
+const SCAN_MAX_BUFFER = 10 * 1024 * 1024;
+function runSearchBinary(bin, args, cwd) {
+    const scanTimeoutMs = getBrainConfigNumber('brainScanTimeoutMs', undefined, SCAN_TIMEOUT_MS);
+    return new Promise((resolve, reject) => {
+        execFile(bin, args, { cwd, timeout: scanTimeoutMs, maxBuffer: SCAN_MAX_BUFFER, env: CHILD_ENV }, (error, stdout, stderr) => {
+            const code = error && 'code' in error && typeof error.code === 'number' ? error.code : 0;
+            if (error && code !== 1 && code !== 0) {
+                if ('killed' in error && error.killed)
+                    return reject(new Error(`Search timed out after ${scanTimeoutMs}ms`));
+                return reject(new Error(`Search binary failed (${bin}): ${String(stderr || error.message)}`));
+            }
+            resolve(String(stdout ?? ''));
+        });
+    });
+}
+/**
+ * Resolve `target` under `basePath`, refusing `..` and a symlink at ANY segment
+ * (each existing segment is `lstat`ed and real-path re-checked).
+ * `allowMissingTail` lets a create name a path that does not exist yet.
+ *
+ * The real path is the OS's own canonical one (`fs/promises` `realpath` is the
+ * native call: on Windows the on-disk case and the long name, NTFS stream
+ * suffixes dropped). A requested segment whose canonical name differs from it by
+ * MORE than letter case — an 8.3 short name (`NEURAL~1`), an NTFS stream
+ * (`meta.json::$DATA`, `conversations::$INDEX_ALLOCATION`), another Unicode
+ * normalization — is an ALIAS the uri-policy never saw: it is refused exactly
+ * like a missing path, and a create never names a stream (`:` is no file-name
+ * character on Windows). A letter-case difference passes: the policy folds case
+ * itself (`foldPolicyCase`, the one fold both seats use). Linux case-insensitive
+ * mounts (drvfs, CIFS, ext4 casefold) answer the requested spelling, so only
+ * the policy fold applies there.
+ */
+export async function resolveAndGuard(basePath, target, options) {
+    const normalizedTarget = path.isAbsolute(target) ? `.${target}` : target;
+    const normalizedBase = path.resolve(basePath);
+    const rootReal = await fs.realpath(normalizedBase).catch(() => normalizedBase);
+    const resolved = path.resolve(normalizedBase, normalizedTarget);
+    if (!isPathInside(normalizedBase, resolved)) {
+        throw new Error(`Path traversal blocked: "${target}" escapes base "${basePath}"`);
+    }
+    const segments = path.relative(normalizedBase, resolved).split(path.sep).filter(Boolean);
+    let current = rootReal;
+    for (let index = 0; index < segments.length; index += 1) {
+        const segment = segments[index];
+        const candidate = path.join(current, segment);
+        let real;
+        try {
+            const stat = await fs.lstat(candidate);
+            if (stat.isSymbolicLink())
+                throw new Error(`Symlink traversal blocked: "${target}"`);
+            real = await fs.realpath(candidate).catch(() => candidate);
+            if (!isPathInside(rootReal, real)) {
+                throw new Error(`Path traversal blocked: "${target}" escapes base "${basePath}"`);
+            }
+        }
+        catch (error) {
+            if (error.code === 'ENOENT' && options?.allowMissingTail) {
+                const tail = segments.slice(index);
+                if (process.platform === 'win32' && tail.some((name) => name.includes(':')))
+                    throw notFound(candidate);
+                return path.join(current, ...tail);
+            }
+            throw error;
+        }
+        if (foldPolicyCase(path.basename(real)) !== foldPolicyCase(segment))
+            throw notFound(candidate);
+        current = real;
+    }
+    return current;
+}
+/** The error `lstat` raises for a missing path — the alias refusal answers with exactly it. */
+function notFound(candidate) {
+    return Object.assign(new Error(`ENOENT: no such file or directory, lstat '${candidate}'`), {
+        code: 'ENOENT',
+        errno: process.platform === 'win32' ? -4058 : -2,
+        syscall: 'lstat',
+        path: candidate,
+    });
+}
+/**
+ * Structured failure of `resolveOsUri` inside Docker with no host-pair root:
+ * returning a container-internal path would corrupt vector payloads and
+ * `os_uri` fields with paths that do not exist on the machine. Callers skip
+ * the field (`os_uri: undefined`) instead.
+ */
+export class OsUriUnresolvableError extends Error {
+    code;
+    source;
+    uri;
+    constructor(params) {
+        super(`os_uri unresolvable for "${params.uri}" on source "${params.source}": ` +
+            `running in Docker, but the source config has no \`hostRoot\` and no ` +
+            `\`NEURALIS_MOUNT_*\` os-mount covers its root` +
+            (params.root ? ` ("${params.root}")` : '') +
+            `. Refusing to emit container-internal paths into vectors/os_uri. ` +
+            `Add the path via \`neuralis mount add\` (which registers the ` +
+            `host-pair env); a \`sources.privileged\` caller may set \`hostRoot\` on the source.`);
+        this.name = 'OsUriUnresolvableError';
+        this.code = 'os_uri_host_pair_missing';
+        this.source = params.source;
+        this.uri = params.uri;
+    }
+}
+/**
+ * The host-side root of `resolvedRoot` from the os-mount table: the LONGEST
+ * mount whose `containerPath` is the root or a path-boundary-correct ancestor
+ * (`/mounts/repo` matches `/mounts/repo/sub`, never `/mounts/repo2`). Mounts
+ * without a host pair are skipped; no match ⇒ `undefined` (the caller then
+ * fails loud with `OsUriUnresolvableError` in Docker).
+ */
+export function deriveHostRootFromOsMounts(resolvedRoot, mounts) {
+    const target = path.resolve(resolvedRoot);
+    let best;
+    for (const mount of mounts) {
+        if (!mount.hostPath)
+            continue;
+        const container = path.resolve(mount.containerPath);
+        const isMatch = target === container || target.startsWith(`${container}${path.sep}`);
+        if (!isMatch)
+            continue;
+        if (!best || container.length > best.containerPath.length) {
+            const tail = target.slice(container.length);
+            best = { containerPath: container, hostRoot: path.join(path.resolve(mount.hostPath), tail) };
+        }
+    }
+    return best?.hostRoot;
+}
+/**
+ * The ONE logical root a stored folder may carry instead of a path:
+ * `neuralis-tree:<relative path>` — a folder of THIS plane's Neuralis tree
+ * (`neuralisTreeRoot`: the `--neuralis` overlay in Docker, the host's own tree
+ * natively), so a source attached on one plane opens on the other. `<relative
+ * path>` is source-relative (`isPackageFolderPath`: no `..`, never absolute);
+ * `neuralis-tree:` alone is the tree itself. Nothing else is a logical root.
+ */
+export const NEURALIS_TREE_ANCHOR = 'neuralis-tree:';
+/** The anchored path of a stored root, or `null` when the root is not an anchor; a malformed anchor is `false`. */
+export function treeAnchorPath(configured) {
+    if (!configured.startsWith(NEURALIS_TREE_ANCHOR))
+        return null;
+    const rel = configured.slice(NEURALIS_TREE_ANCHOR.length);
+    return rel === '' || isPackageFolderPath(rel) ? rel : false;
+}
+/**
+ * A `neuralis-tree:` root this plane cannot open: Docker without the
+ * `--neuralis` overlay (the image's own folder is never an attachable zone), or
+ * a malformed anchor. The message carries no path.
+ */
+export class SourceAnchorUnresolvableError extends Error {
+    source;
+    code = 'source_anchor_unresolvable';
+    constructor(source) {
+        super(`source "${source}": its Neuralis-tree root is not available on this server`);
+        this.source = source;
+        this.name = 'SourceAnchorUnresolvableError';
+    }
+}
+/**
+ * THE root resolver for an in-process source on THIS plane:
+ *  - a `neuralis-tree:` anchor resolves into this plane's Neuralis tree, or
+ *    THROWS `SourceAnchorUnresolvableError` (never a guess, never the image);
+ *  - a relative `configured` joins onto the plane's own `projectRoot`;
+ *  - an absolute one is the path as written in a container;
+ *  - natively it is the absolute `hostRoot` beside it when there is one (the
+ *    pair's machine half, `domain/sourceRootPair.ts`), else the path as written.
+ * An absolute path is never re-targeted by a segment that spells the project id.
+ */
+export function resolveLocalRoot(params) {
+    const { configured, hostRoot, projectRoot, isDocker } = params;
+    const anchored = treeAnchorPath(configured);
+    if (anchored !== null) {
+        const tree = anchored === false ? null : neuralisTreeRoot({
+            isDocker,
+            osMounts: discoverOsMounts(process.env),
+            neuralisTree: hostTreeRoot(process.cwd()),
+        });
+        if (tree === null)
+            throw new SourceAnchorUnresolvableError(params.source);
+        return { resolvedRoot: path.resolve(tree, anchored) };
+    }
+    if (!path.isAbsolute(configured)) {
+        return { resolvedRoot: projectRoot ? path.join(projectRoot, configured) : configured };
+    }
+    if (!isDocker && typeof hostRoot === 'string' && path.isAbsolute(hostRoot)) {
+        return { resolvedRoot: path.resolve(hostRoot) };
+    }
+    return { resolvedRoot: path.resolve(configured) };
+}
+/**
+ * `resolveLocalRoot` for a LISTING: an anchored root this plane cannot open is
+ * `null` (the row is skipped or shown unreachable), so one such source never
+ * breaks the listing of every other.
+ */
+export function resolvedLocalRootOrNull(params) {
+    try {
+        return resolveLocalRoot(params).resolvedRoot;
+    }
+    catch (error) {
+        if (error instanceof SourceAnchorUnresolvableError)
+            return null;
+        throw error;
+    }
+}
+/** The largest range one local `readRange` serves (the connector loops above it). */
+const LOCAL_MAX_RANGE_BYTES = 64 * 1024 * 1024;
+/** The in-process transport over one source root. */
+export class InProcessTransport {
+    kind = 'local';
+    flavour = (path.sep === '\\' ? 'win32' : 'posix');
+    id = 'local';
+    maxRangeBytes = LOCAL_MAX_RANGE_BYTES;
+    #root;
+    constructor(root) {
+        this.#root = path.resolve(root);
+    }
+    get root() {
+        return this.#root;
+    }
+    /** The clamp: `abs` must name a path under the root, symlink-free. */
+    #guard(abs, allowMissingTail = false) {
+        const rel = path.relative(this.#root, path.resolve(abs));
+        return resolveAndGuard(this.#root, rel === '' ? '.' : rel, allowMissingTail ? { allowMissingTail } : undefined);
+    }
+    available() {
+        return true;
+    }
+    async probe() {
+        try {
+            await fs.access(this.#root, fsConstants.R_OK);
+            return { connected: true };
+        }
+        catch (error) {
+            const code = error.code;
+            return { connected: false, reason: code === 'ENOENT' ? 'fs_unreachable' : 'fs_permission' };
+        }
+    }
+    async localPath(abs) {
+        return this.#guard(abs);
+    }
+    async list(abs) {
+        const dir = await this.#guard(abs);
+        const dirents = await fs.readdir(dir, { withFileTypes: true });
+        const out = [];
+        for (const entry of dirents) {
+            if (entry.isSymbolicLink())
+                continue;
+            const isDirectory = entry.isDirectory();
+            let size;
+            let modifiedAt;
+            if (!isDirectory) {
+                try {
+                    const st = await fs.stat(path.join(dir, entry.name));
+                    size = st.size;
+                    modifiedAt = st.mtime.toISOString();
+                }
+                catch { /* one unreadable entry never fails the listing */ }
+            }
+            out.push({ name: entry.name, isDirectory, ...(size === undefined ? {} : { size }), ...(modifiedAt ? { modifiedAt } : {}) });
+        }
+        return out;
+    }
+    async stat(abs) {
+        let target;
+        try {
+            target = await this.#guard(abs);
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+        try {
+            const info = await fs.lstat(target);
+            return { isDirectory: info.isDirectory(), size: info.size, modifiedAt: info.mtime.toISOString() };
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+    }
+    async readRange(abs, offset, length) {
+        return readFileRange(await this.#guard(abs), offset, Math.min(length, LOCAL_MAX_RANGE_BYTES));
+    }
+    async write(abs, bytes) {
+        const target = await this.#guard(abs, true);
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        await fs.writeFile(target, bytes);
+    }
+    async delete(abs) {
+        await fs.unlink(await this.#guard(abs));
+    }
+    async move(from, to) {
+        const source = await this.#guard(from);
+        const target = await this.#guard(to, true);
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        await fs.rename(source, target);
+    }
+    async mkdir(abs) {
+        await fs.mkdir(await this.#guard(abs, true), { recursive: true });
+    }
+    async rmdir(abs) {
+        // Empty-directory removal only: a populated one throws ENOTEMPTY (the
+        // folder-delete usecase unlinks every contained file first).
+        await fs.rmdir(await this.#guard(abs));
+    }
+    async walk(abs, opts) {
+        return walkTree(await this.#guard(abs), opts);
+    }
+    async scanDelta(abs, opts) {
+        return scanDeltaTree(await this.#guard(abs), opts);
+    }
+    async count(abs, opts) {
+        return countTree(await this.#guard(abs), opts);
+    }
+    /**
+     * The server's content scan: a real search binary (`git grep` inside a
+     * checkout, else `rg`, else `grep`), LITERAL (`-F`) on every engine; the JS
+     * engine only when no binary exists. Paths come back walk-root-relative.
+     */
+    async scanContent(abs, query, opts) {
+        const root = await this.#guard(abs);
+        const bins = await resolveSearchBinaries();
+        const caseSensitive = opts.caseSensitive === true;
+        let hasGit = false;
+        try {
+            hasGit = (await fs.stat(path.join(root, '.git'))).isDirectory();
+        }
+        catch { /* not a checkout */ }
+        if (hasGit && bins.gitGrep) {
+            const args = ['grep', '-n', '--column', '--no-color', '-F'];
+            if (!caseSensitive)
+                args.push('-i');
+            args.push('-e', query, '--');
+            // Pathspecs are case-SENSITIVE by default (`:(icase)` restores -i parity)
+            // and a plain `*` crosses `/` — best-effort parity with rg's globs.
+            for (const pat of opts.includeGlobs ?? [])
+                args.push(caseSensitive ? pat : `:(icase)${pat}`);
+            for (const pat of opts.excludeGlobs ?? [])
+                args.push(`:(exclude)${pat}`);
+            return parseGrepOutput(root, await runSearchBinary(bins.gitGrep, args, root), opts.maxMatches);
+        }
+        if (bins.rg) {
+            const args = ['-n', '--column', '--no-heading', '--color=never', '-F'];
+            if (!caseSensitive)
+                args.push('-i');
+            for (const pat of opts.includeGlobs ?? [])
+                args.push('--glob', pat);
+            for (const pat of opts.excludeGlobs ?? [])
+                args.push('--glob', `!${pat}`);
+            args.push('-e', query, root);
+            return parseGrepOutput(root, await runSearchBinary(bins.rg, args, root), opts.maxMatches);
+        }
+        if (bins.grep) {
+            const args = ['-R', '-n', '--color=never', '-F'];
+            if (!caseSensitive)
+                args.push('-i');
+            // GNU grep `--include` matches the BASENAME only — best-effort.
+            for (const pat of opts.includeGlobs ?? [])
+                args.push(`--include=${pat}`);
+            for (const pat of opts.excludeGlobs ?? [])
+                args.push('--exclude-dir', pat.replace(/\/\*\*$/, '').replace(/^\*\*\//, ''));
+            args.push('-e', query, root);
+            return parseGrepOutput(root, await runSearchBinary(bins.grep, args, root), opts.maxMatches);
+        }
+        return scanContentTree(root, query, opts);
+    }
+    watch(abs, listener, opts) {
+        const watchRoot = path.resolve(abs);
+        if (watchRoot !== this.#root && !watchRoot.startsWith(`${this.#root}${path.sep}`)) {
+            throw new Error('watch root escapes the source root');
+        }
+        // The exclude set is pushed down to the watcher as globs relative to the
+        // WATCHED path (the device broker reads them alike) and compiled by the
+        // kernel's ONE predicate in the hub's worker: excluded trees are never entered.
+        const handle = getFsWatchHub().acquire(watchRoot, (events) => {
+            // One ordered batch, unrolled in order.
+            for (const event of events) {
+                if (event.kind === 'overflow') {
+                    listener({ kind: 'overflow', at: event.at, ...(event.reason ? { reason: event.reason } : {}), ...(event.code ? { code: event.code } : {}) });
+                }
+                else {
+                    listener({ kind: event.kind, path: event.absPath, at: event.at, ...(event.entry ? { entry: event.entry } : {}) });
+                }
+            }
+        }, {
+            ...(opts?.excludeGlobs?.length ? { excludeGlobs: opts.excludeGlobs } : {}),
+            ...(opts?.maxFolders !== undefined ? { maxFolders: opts.maxFolders } : {}),
+            // Per listener: the hub shares one watcher per (root, exclude set) and
+            // keeps the conservative maximum of every live listener's policy.
+            recovery: resolveWatchRecovery(),
+        });
+        return {
+            unsubscribe: () => { void handle.release(); },
+            watchState: () => handle.state(),
+        };
+    }
+}
+/** `path:line[:col]:preview` lines → walk-root-relative matches. Relative output is resolved against `root`. */
+function parseGrepOutput(root, output, maxMatches) {
+    const results = [];
+    for (const line of output.split('\n')) {
+        if (results.length >= maxMatches)
+            break;
+        if (!line)
+            continue;
+        const m = /^(.+?):(\d+)(?::(\d+))?:(.*)$/.exec(line);
+        if (!m)
+            continue;
+        const abs = path.resolve(root, m[1]);
+        const col = m[3] ? Number.parseInt(m[3], 10) : undefined;
+        results.push({
+            rel: isPathInside(root, abs) ? path.relative(root, abs).split(path.sep).join('/') : '',
+            line: Number.parseInt(m[2], 10),
+            ...(col !== undefined && Number.isFinite(col) ? { column: col } : {}),
+            preview: m[4],
+        });
+    }
+    return results;
+}
+//# sourceMappingURL=inProcessTransport.js.map

package/dist/src/connectors/inProcessTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inProcessTransport.js","sourceRoot":"","sources":["../../../src/connectors/inProcessTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAkB9C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,SAAS,EACT,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,QAAQ,GACT,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B,EAAE,CAAC;AAEtF,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,SAAS,eAAe,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IAC/D,MAAM,aAAa,GAAG,oBAAoB,CAAC,oBAAoB,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC7F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACzH,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtC,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,aAAa,IAAI,CAAC,CAAC,CAAC;gBAC7G,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAc,EACd,OAAwC;IAExC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAChE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,mBAAmB,QAAQ,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzF,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,GAAG,CAAC,CAAC;YACrF,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,mBAAmB,QAAQ,GAAG,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;gBACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACvG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC;YAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/F,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+FAA+F;AAC/F,SAAS,QAAQ,CAAC,SAAiB;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,SAAS,GAAG,CAAC,EAAE;QACzF,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAA6B;IACjC,MAAM,CAAS;IACf,GAAG,CAAS;IAErB,YAAY,MAAsD;QAChE,KAAK,CACH,4BAA4B,MAAM,CAAC,GAAG,gBAAgB,MAAM,CAAC,MAAM,KAAK;YACtE,sEAAsE;YACtE,+CAA+C;YAC/C,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,mEAAmE;YACnE,+DAA+D;YAC/D,qFAAqF,CACxF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACxB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,YAAoB,EAAE,MAAiB;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,IAA6D,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,QAAQ,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,mHAAmH;AACnH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,GAAG,KAAK,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEjC,MAAM;IADlB,IAAI,GAAG,4BAAqC,CAAC;IACtD,YAAqB,MAAc;QACjC,KAAK,CAAC,WAAW,MAAM,2DAA2D,CAAC,CAAC;sBADjE,MAAM;QAEzB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC/D,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACxD,QAAQ;YACR,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;YACvC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAkB,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA8C;IACpF,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAA6B;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,qDAAqD;AACrD,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,OAAgB,CAAC;IACxB,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAsB,CAAC;IACvE,EAAE,GAAG,OAAO,CAAC;IACb,aAAa,GAAG,qBAAqB,CAAC;IACtC,KAAK,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,GAAW,EAAE,gBAAgB,GAAG,KAAK;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,IAAwB,CAAC;YAC7B,IAAI,UAA8B,CAAC;YACnC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACrD,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;oBACf,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,MAAc,EAAE,MAAc;QACzD,OAAO,aAAa,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAiB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,EAAU;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAoB;QAC1C,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,IAAyB;QACpD,OAAO,aAAa,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAAgE;QACvF,OAAO,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,IAA2B;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAClD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACvG,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7B,0EAA0E;YAC1E,oEAAoE;YACpE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YAC7F,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YACzE,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACvE,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,gEAAgE;YAChE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YACzE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YACzH,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,QAA2C,EAAE,IAAsB;QACpF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,gFAAgF;QAChF,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3D,wCAAwC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC9B,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/I,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpH,CAAC;YACH,CAAC;QACH,CAAC,EAAE;YACD,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,uEAAuE;YACvE,kEAAkE;YAClE,QAAQ,EAAE,oBAAoB,EAAE;SACjC,CAAC,CAAC;QACH,OAAO;YACL,WAAW,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7C,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;CACF;AAED,gHAAgH;AAChH,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,UAAkB;IACvE,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;QACxC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACtF,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/domain/access/callerPermissions.d.ts

@@ -18,4 +18,33 @@ import type { SourceConfig, SourcePermissions } from '../sourceConfig.js';
  * `$creator` stays the SOURCE's `createdBy` — never the resource creator.
  */
 export declare function resolveCallerPermissions(config: SourceConfig, uri: string, ctx: ExecutionContext, source: string): Promise<SourcePermissions>;
+/**
+ * The LITERAL heads of the path rules that certainly GRANT the caller `read` on
+ * `config` — each a normalized directory uri ending in `/` (`x://a/sec/` for
+ * `x://a/sec/**`; the bare `x://` for a pattern whose first segment is a glob).
+ * The head is the pattern's segments before the first one holding `*` or `?`,
+ * after token resolution; it is what the rule itself SPELLS, so naming it
+ * discloses nothing the grant does not already state.
+ *
+ * "Certainly" is the kernel's own subtree classifier over that one rule alone
+ * (every bit false, the rule re-pointed at `<head>**`): only a rule that turns
+ * `read` on for the WHOLE head, for THIS caller, counts — a role/user/priority
+ * miss, a non-override allow (it cannot lift a `false`) and an undecidable
+ * `$owner` row all read `false`. A floor row never grants. A head the full
+ * config denies uniformly (a floor over it) is dropped too.
+ *
+ * Consumers: source admission and the list-only ancestor reveal. Absent `role`
+ * ⇒ no heads (the weakest interpretation).
+ */
+export declare function callerReadGrantHeads(config: SourceConfig, ctx: ExecutionContext): string[];
+/**
+ * The folder uris a caller's grant heads put on its way: every head and every
+ * strict ancestor of it, as normalized directory uris (`x://a/`, `x://a/sec/`),
+ * never the source root. A LIST may name these folders (names only) and be
+ * scoped into them; nothing else — search, discovery and the git listings —
+ * reads this set.
+ */
+export declare function grantPathFolders(heads: readonly string[]): Set<string>;
+/** A uri as the directory key {@link grantPathFolders} holds: normalized, ending in `/`. */
+export declare function folderKey(uri: string): string;
 //# sourceMappingURL=callerPermissions.d.ts.map

package/dist/src/domain/access/callerPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callerPermissions.d.ts","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAY5B"}
+{"version":3,"file":"callerPermissions.d.ts","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA2B1F;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAStE;AAED,4FAA4F;AAC5F,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7C"}

package/dist/src/domain/access/callerPermissions.js

@@ -1,4 +1,4 @@
-import { resolveResourceOwner } from '@neuralis/package-system/policies';
+import { classifyUriSubtree, normalizePolicyUri, resolvePolicyPatternTokens, resolveResourceOwner, } from '@neuralis/package-system/policies';
 import { resolvePermissions } from '../permissionResolver.js';
 /**
  * The caller's EFFECTIVE per-path permission on `uri` — the ONE place a
@@ -20,14 +20,94 @@ import { resolvePermissions } from '../permissionResolver.js';
 export async function resolveCallerPermissions(config, uri, ctx, source) {
     const resourceOwnerUserId = await resolveResourceOwner({ projectId: ctx.projectId, uri });
     return resolvePermissions(config.permissions, uri, {
+        ...callerPolicyContext(config, ctx, ctx.role ?? 'member'),
+        source,
+        ...(resourceOwnerUserId ? { resourceOwnerUserId } : {}),
+    });
+}
+function callerPolicyContext(config, ctx, role) {
+    return {
         userId: ctx.userId,
-        role: ctx.role ?? 'member',
+        role,
         priority: ctx.priority,
         rolePriorities: ctx.rolePriorities,
         agentId: ctx.agentId,
         creatorUserId: config.createdBy,
-        source,
-        ...(resourceOwnerUserId ? { resourceOwnerUserId } : {}),
-    });
+        source: config.source,
+    };
+}
+const NO_BITS = { read: false, write: false, exec: false };
+/**
+ * The LITERAL heads of the path rules that certainly GRANT the caller `read` on
+ * `config` — each a normalized directory uri ending in `/` (`x://a/sec/` for
+ * `x://a/sec/**`; the bare `x://` for a pattern whose first segment is a glob).
+ * The head is the pattern's segments before the first one holding `*` or `?`,
+ * after token resolution; it is what the rule itself SPELLS, so naming it
+ * discloses nothing the grant does not already state.
+ *
+ * "Certainly" is the kernel's own subtree classifier over that one rule alone
+ * (every bit false, the rule re-pointed at `<head>**`): only a rule that turns
+ * `read` on for the WHOLE head, for THIS caller, counts — a role/user/priority
+ * miss, a non-override allow (it cannot lift a `false`) and an undecidable
+ * `$owner` row all read `false`. A floor row never grants. A head the full
+ * config denies uniformly (a floor over it) is dropped too.
+ *
+ * Consumers: source admission and the list-only ancestor reveal. Absent `role`
+ * ⇒ no heads (the weakest interpretation).
+ */
+export function callerReadGrantHeads(config, ctx) {
+    if (!ctx.role)
+        return [];
+    const policyCtx = callerPolicyContext(config, ctx, ctx.role);
+    const root = `${config.source}://`;
+    const heads = [];
+    for (const rule of config.permissions.paths ?? []) {
+        if (rule.floor === true || rule.permissions.read !== true)
+            continue;
+        const pattern = resolvePolicyPatternTokens(rule.pattern, policyCtx);
+        if (pattern === null)
+            continue;
+        const normalized = normalizePolicyUri(pattern);
+        if (!normalized.startsWith(root))
+            continue;
+        const literal = [];
+        for (const segment of normalized.slice(root.length).split('/')) {
+            if (segment === '' || /[*?]/.test(segment))
+                break;
+            literal.push(segment);
+        }
+        const head = `${root}${literal.map((s) => `${s}/`).join('')}`;
+        const alone = classifyUriSubtree({ default: { ...NO_BITS }, paths: [{ ...rule, pattern: `${head}**` }] }, head, policyCtx, { capabilities: ['read'] });
+        if (alone.kind !== 'uniform' || alone.permissions.read !== true)
+            continue;
+        const whole = classifyUriSubtree(config.permissions, head, policyCtx, { capabilities: ['read'] });
+        if (whole.kind === 'uniform' && whole.permissions.read === false)
+            continue;
+        if (!heads.includes(head))
+            heads.push(head);
+    }
+    return heads;
+}
+/**
+ * The folder uris a caller's grant heads put on its way: every head and every
+ * strict ancestor of it, as normalized directory uris (`x://a/`, `x://a/sec/`),
+ * never the source root. A LIST may name these folders (names only) and be
+ * scoped into them; nothing else — search, discovery and the git listings —
+ * reads this set.
+ */
+export function grantPathFolders(heads) {
+    const folders = new Set();
+    for (const head of heads) {
+        const sep = head.indexOf('://') + 3;
+        for (let at = head.indexOf('/', sep); at !== -1; at = head.indexOf('/', at + 1)) {
+            folders.add(head.slice(0, at + 1));
+        }
+    }
+    return folders;
+}
+/** A uri as the directory key {@link grantPathFolders} holds: normalized, ending in `/`. */
+export function folderKey(uri) {
+    const normalized = normalizePolicyUri(uri);
+    return normalized.endsWith('/') ? normalized : `${normalized}/`;
 }
 //# sourceMappingURL=callerPermissions.js.map

package/dist/src/domain/access/callerPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"callerPermissions.js","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoB,EACpB,GAAW,EACX,GAAqB,EACrB,MAAc;IAEd,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,MAAM,CAAC,SAAS;QAC/B,MAAM;QACN,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"callerPermissions.js","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoB,EACpB,GAAW,EACX,GAAqB,EACrB,MAAc;IAEd,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE;QACjD,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC;QACzD,MAAM;QACN,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB,EAAE,GAAqB,EAAE,IAAY;IACpF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI;QACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,MAAM,CAAC,SAAS;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAE,GAAqB;IAC9E,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM;YAClD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAC9B,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,EACvE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAC5C,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAC1E,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC3E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC;AAClE,CAAC"}