@office-ai/aioncli-core 0.8.1 → 0.18.5

package/dist/src/policy/policies/read-only.toml

@@ -0,0 +1,56 @@
+# Priority system for policy rules:
+# - Higher priority numbers win over lower priority numbers
+# - When multiple rules match, the highest priority rule is applied
+# - Rules are evaluated in order of priority (highest first)
+#
+# Priority bands (tiers):
+# - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
+# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+#
+# This ensures Admin > User > Default hierarchy is always preserved,
+# while allowing user-specified priorities to work within each tier.
+#
+# Settings-based and dynamic rules (all in user tier 2.x):
+#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   2.9:  MCP servers excluded list (security: persistent server blocks)
+#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   2.2:  MCP servers with trust=true (persistent trusted servers)
+#   2.1:  MCP servers allowed list (persistent general server allows)
+#
+# TOML policy priorities (before transformation):
+#   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
+#   15: Auto-edit tool override (becomes 1.015 in default tier)
+#   50: Read-only tools (becomes 1.050 in default tier)
+#   999: YOLO mode allow-all (becomes 1.999 in default tier)
+
+[[rule]]
+toolName = "glob"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "search_file_content"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "list_directory"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "read_file"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "read_many_files"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "google_web_search"
+decision = "allow"
+priority = 50

package/dist/src/policy/policies/write.toml

@@ -0,0 +1,73 @@
+# Priority system for policy rules:
+# - Higher priority numbers win over lower priority numbers
+# - When multiple rules match, the highest priority rule is applied
+# - Rules are evaluated in order of priority (highest first)
+#
+# Priority bands (tiers):
+# - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
+# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+#
+# This ensures Admin > User > Default hierarchy is always preserved,
+# while allowing user-specified priorities to work within each tier.
+#
+# Settings-based and dynamic rules (all in user tier 2.x):
+#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   2.9:  MCP servers excluded list (security: persistent server blocks)
+#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   2.2:  MCP servers with trust=true (persistent trusted servers)
+#   2.1:  MCP servers allowed list (persistent general server allows)
+#
+# TOML policy priorities (before transformation):
+#   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
+#   15: Auto-edit tool override (becomes 1.015 in default tier)
+#   50: Read-only tools (becomes 1.050 in default tier)
+#   999: YOLO mode allow-all (becomes 1.999 in default tier)
+
+[[rule]]
+toolName = "replace"
+decision = "ask_user"
+priority = 10
+
+[[rule]]
+toolName = "replace"
+decision = "allow"
+priority = 15
+modes = ["autoEdit"]
+
+[rule.safety_checker]
+type = "in-process"
+name = "allowed-path"
+required_context = ["environment"]
+
+[[rule]]
+toolName = "save_memory"
+decision = "ask_user"
+priority = 10
+
+[[rule]]
+toolName = "run_shell_command"
+decision = "ask_user"
+priority = 10
+
+[[rule]]
+toolName = "write_file"
+decision = "ask_user"
+priority = 10
+
+[[rule]]
+toolName = "write_file"
+decision = "allow"
+priority = 15
+modes = ["autoEdit"]
+
+[rule.safety_checker]
+type = "in-process"
+name = "allowed-path"
+required_context = ["environment"]
+
+[[rule]]
+toolName = "web_fetch"
+decision = "ask_user"
+priority = 10

package/dist/src/policy/policies/yolo.toml

@@ -0,0 +1,31 @@
+# Priority system for policy rules:
+# - Higher priority numbers win over lower priority numbers
+# - When multiple rules match, the highest priority rule is applied
+# - Rules are evaluated in order of priority (highest first)
+#
+# Priority bands (tiers):
+# - Default policies (TOML): 1 + priority/1000 (e.g., priority 100 → 1.100)
+# - User policies (TOML): 2 + priority/1000 (e.g., priority 100 → 2.100)
+# - Admin policies (TOML): 3 + priority/1000 (e.g., priority 100 → 3.100)
+#
+# This ensures Admin > User > Default hierarchy is always preserved,
+# while allowing user-specified priorities to work within each tier.
+#
+# Settings-based and dynamic rules (all in user tier 2.x):
+#   2.95: Tools that the user has selected as "Always Allow" in the interactive UI
+#   2.9:  MCP servers excluded list (security: persistent server blocks)
+#   2.4:  Command line flag --exclude-tools (explicit temporary blocks)
+#   2.3:  Command line flag --allowed-tools (explicit temporary allows)
+#   2.2:  MCP servers with trust=true (persistent trusted servers)
+#   2.1:  MCP servers allowed list (persistent general server allows)
+#
+# TOML policy priorities (before transformation):
+#   10: Write tools default to ASK_USER (becomes 1.010 in default tier)
+#   15: Auto-edit tool override (becomes 1.015 in default tier)
+#   50: Read-only tools (becomes 1.050 in default tier)
+#   999: YOLO mode allow-all (becomes 1.999 in default tier)
+
+[[rule]]
+decision = "allow"
+priority = 999
+modes = ["yolo"]

package/dist/src/policy/policy-engine.d.ts

@@ -4,20 +4,28 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type FunctionCall } from '@google/genai';
-import { PolicyDecision, type PolicyEngineConfig, type PolicyRule } from './types.js';
+import { PolicyDecision, type PolicyEngineConfig, type PolicyRule, type SafetyCheckerRule } from './types.js';
+import type { CheckerRunner } from '../safety/checker-runner.js';
 export declare class PolicyEngine {
     private rules;
+    private checkers;
     private readonly defaultDecision;
     private readonly nonInteractive;
-    constructor(config?: PolicyEngineConfig);
+    private readonly checkerRunner?;
+    constructor(config?: PolicyEngineConfig, checkerRunner?: CheckerRunner);
     /**
      * Check if a tool call is allowed based on the configured policies.
+     * Returns the decision and the matching rule (if any).
      */
-    check(toolCall: FunctionCall): PolicyDecision;
+    check(toolCall: FunctionCall, serverName: string | undefined): Promise<{
+        decision: PolicyDecision;
+        rule?: PolicyRule;
+    }>;
     /**
      * Add a new rule to the policy engine.
      */
     addRule(rule: PolicyRule): void;
+    addChecker(checker: SafetyCheckerRule): void;
     /**
      * Remove rules for a specific tool.
      */
@@ -26,5 +34,6 @@ export declare class PolicyEngine {
      * Get all current rules.
      */
     getRules(): readonly PolicyRule[];
+    getCheckers(): readonly SafetyCheckerRule[];
     private applyNonInteractiveMode;
 }

package/dist/src/policy/policy-engine.js

@@ -6,12 +6,22 @@
 import {} from '@google/genai';
 import { PolicyDecision, } from './types.js';
 import { stableStringify } from './stable-stringify.js';
-function ruleMatches(rule, toolCall, stringifiedArgs) {
+import { debugLogger } from '../utils/debugLogger.js';
+import { SafetyCheckDecision } from '../safety/protocol.js';
+function ruleMatches(rule, toolCall, stringifiedArgs, serverName) {
     // Check tool name if specified
     if (rule.toolName) {
         // Support wildcard patterns: "serverName__*" matches "serverName__anyTool"
         if (rule.toolName.endsWith('__*')) {
             const prefix = rule.toolName.slice(0, -3); // Remove "__*"
+            if (serverName !== undefined) {
+                // Robust check: if serverName is provided, it MUST match the prefix exactly.
+                // This prevents "malicious-server" from spoofing "trusted-server" by naming itself "trusted-server__malicious".
+                if (serverName !== prefix) {
+                    return false;
+                }
+            }
+            // Always verify the prefix, even if serverName matched
             if (!toolCall.name || !toolCall.name.startsWith(prefix + '__')) {
                 return false;
             }
@@ -36,30 +46,79 @@ function ruleMatches(rule, toolCall, stringifiedArgs) {
 }
 export class PolicyEngine {
     rules;
+    checkers;
     defaultDecision;
     nonInteractive;
-    constructor(config = {}) {
+    checkerRunner;
+    constructor(config = {}, checkerRunner) {
         this.rules = (config.rules ?? []).sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        this.checkers = (config.checkers ?? []).sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
         this.defaultDecision = config.defaultDecision ?? PolicyDecision.ASK_USER;
         this.nonInteractive = config.nonInteractive ?? false;
+        this.checkerRunner = checkerRunner;
     }
     /**
      * Check if a tool call is allowed based on the configured policies.
+     * Returns the decision and the matching rule (if any).
      */
-    check(toolCall) {
+    async check(toolCall, serverName) {
         let stringifiedArgs;
         // Compute stringified args once before the loop
-        if (toolCall.args && this.rules.some((rule) => rule.argsPattern)) {
+        if (toolCall.args &&
+            (this.rules.some((rule) => rule.argsPattern) ||
+                this.checkers.some((checker) => checker.argsPattern))) {
             stringifiedArgs = stableStringify(toolCall.args);
         }
+        debugLogger.debug(`[PolicyEngine.check] toolCall.name: ${toolCall.name}, stringifiedArgs: ${stringifiedArgs}`);
         // Find the first matching rule (already sorted by priority)
+        let matchedRule;
+        let decision;
         for (const rule of this.rules) {
-            if (ruleMatches(rule, toolCall, stringifiedArgs)) {
-                return this.applyNonInteractiveMode(rule.decision);
+            if (ruleMatches(rule, toolCall, stringifiedArgs, serverName)) {
+                debugLogger.debug(`[PolicyEngine.check] MATCHED rule: toolName=${rule.toolName}, decision=${rule.decision}, priority=${rule.priority}, argsPattern=${rule.argsPattern?.source || 'none'}`);
+                matchedRule = rule;
+                decision = this.applyNonInteractiveMode(rule.decision);
+                break;
+            }
+        }
+        if (!decision) {
+            // No matching rule found, use default decision
+            debugLogger.debug(`[PolicyEngine.check] NO MATCH - using default decision: ${this.defaultDecision}`);
+            decision = this.applyNonInteractiveMode(this.defaultDecision);
+        }
+        // If decision is not DENY, run safety checkers
+        if (decision !== PolicyDecision.DENY && this.checkerRunner) {
+            for (const checkerRule of this.checkers) {
+                if (ruleMatches(checkerRule, toolCall, stringifiedArgs, serverName)) {
+                    debugLogger.debug(`[PolicyEngine.check] Running safety checker: ${checkerRule.checker.name}`);
+                    try {
+                        const result = await this.checkerRunner.runChecker(toolCall, checkerRule.checker);
+                        if (result.decision === SafetyCheckDecision.DENY) {
+                            debugLogger.debug(`[PolicyEngine.check] Safety checker denied: ${result.reason}`);
+                            return {
+                                decision: PolicyDecision.DENY,
+                                rule: matchedRule,
+                            };
+                        }
+                        else if (result.decision === SafetyCheckDecision.ASK_USER) {
+                            debugLogger.debug(`[PolicyEngine.check] Safety checker requested ASK_USER: ${result.reason}`);
+                            decision = PolicyDecision.ASK_USER;
+                        }
+                    }
+                    catch (error) {
+                        debugLogger.debug(`[PolicyEngine.check] Safety checker failed: ${error}`);
+                        return {
+                            decision: PolicyDecision.DENY,
+                            rule: matchedRule,
+                        };
+                    }
+                }
             }
         }
-        // No matching rule found, use default decision
-        return this.applyNonInteractiveMode(this.defaultDecision);
+        return {
+            decision: this.applyNonInteractiveMode(decision),
+            rule: matchedRule,
+        };
     }
     /**
      * Add a new rule to the policy engine.
@@ -69,6 +128,10 @@ export class PolicyEngine {
         // Re-sort rules by priority
         this.rules.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
     }
+    addChecker(checker) {
+        this.checkers.push(checker);
+        this.checkers.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+    }
     /**
      * Remove rules for a specific tool.
      */
@@ -81,6 +144,9 @@ export class PolicyEngine {
     getRules() {
         return this.rules;
     }
+    getCheckers() {
+        return this.checkers;
+    }
     applyNonInteractiveMode(decision) {
         // In non-interactive mode, ASK_USER becomes DENY
         if (this.nonInteractive && decision === PolicyDecision.ASK_USER) {

package/dist/src/policy/policy-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAqB,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,SAAS,WAAW,CAClB,IAAgB,EAChB,QAAsB,EACtB,eAAmC;IAEnC,+BAA+B;IAC/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,iFAAiF;QACjF,IACE,eAAe,KAAK,SAAS;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,YAAY;IACf,KAAK,CAAe;IACX,eAAe,CAAiB;IAChC,cAAc,CAAU;IAEzC,YAAY,SAA6B,EAAE;QACzC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,cAAc,CAAC,QAAQ,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAsB;QAC1B,IAAI,eAAmC,CAAC;QACxC,gDAAgD;QAChD,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAgB;QACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,4BAA4B;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAgB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,uBAAuB,CAAC,QAAwB;QACtD,iDAAiD;QACjD,IAAI,IAAI,CAAC,cAAc,IAAI,QAAQ,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAChE,OAAO,cAAc,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../../src/policy/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAqB,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,cAAc,GAIf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,SAAS,WAAW,CAClB,IAAoC,EACpC,QAAsB,EACtB,eAAmC,EACnC,UAA8B;IAE9B,+BAA+B;IAC/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,6EAA6E;gBAC7E,gHAAgH;gBAChH,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;oBAC1B,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,iFAAiF;QACjF,IACE,eAAe,KAAK,SAAS;YAC7B,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,YAAY;IACf,KAAK,CAAe;IACpB,QAAQ,CAAsB;IACrB,eAAe,CAAiB;IAChC,cAAc,CAAU;IACxB,aAAa,CAAiB;IAE/C,YAAY,SAA6B,EAAE,EAAE,aAA6B;QACxE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAChD,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,cAAc,CAAC,QAAQ,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,QAAsB,EACtB,UAA8B;QAK9B,IAAI,eAAmC,CAAC;QACxC,gDAAgD;QAChD,IACE,QAAQ,CAAC,IAAI;YACb,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EACvD,CAAC;YACD,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,WAAW,CAAC,KAAK,CACf,uCAAuC,QAAQ,CAAC,IAAI,sBAAsB,eAAe,EAAE,CAC5F,CAAC;QAEF,4DAA4D;QAC5D,IAAI,WAAmC,CAAC;QACxC,IAAI,QAAoC,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC7D,WAAW,CAAC,KAAK,CACf,+CAA+C,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,QAAQ,cAAc,IAAI,CAAC,QAAQ,iBAAiB,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,MAAM,EAAE,CACxK,CAAC;gBACF,WAAW,GAAG,IAAI,CAAC;gBACnB,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,+CAA+C;YAC/C,WAAW,CAAC,KAAK,CACf,2DAA2D,IAAI,CAAC,eAAe,EAAE,CAClF,CAAC;YACF,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,CAAC;QAED,+CAA+C;QAC/C,IAAI,QAAQ,KAAK,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3D,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC;oBACpE,WAAW,CAAC,KAAK,CACf,gDAAgD,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAC3E,CAAC;oBACF,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,QAAQ,EACR,WAAW,CAAC,OAAO,CACpB,CAAC;wBAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;4BACjD,WAAW,CAAC,KAAK,CACf,+CAA+C,MAAM,CAAC,MAAM,EAAE,CAC/D,CAAC;4BACF,OAAO;gCACL,QAAQ,EAAE,cAAc,CAAC,IAAI;gCAC7B,IAAI,EAAE,WAAW;6BAClB,CAAC;wBACJ,CAAC;6BAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,CAAC,QAAQ,EAAE,CAAC;4BAC5D,WAAW,CAAC,KAAK,CACf,2DAA2D,MAAM,CAAC,MAAM,EAAE,CAC3E,CAAC;4BACF,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;wBACrC,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,WAAW,CAAC,KAAK,CACf,+CAA+C,KAAK,EAAE,CACvD,CAAC;wBACF,OAAO;4BACL,QAAQ,EAAE,cAAc,CAAC,IAAI;4BAC7B,IAAI,EAAE,WAAW;yBAClB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;YAChD,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAgB;QACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,4BAA4B;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,OAA0B;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAgB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,uBAAuB,CAAC,QAAwB;QACtD,iDAAiD;QACjD,IAAI,IAAI,CAAC,cAAc,IAAI,QAAQ,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAChE,OAAO,cAAc,CAAC,IAAI,CAAC;QAC7B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}