@oh-my-matrix/autopilot 2.1.2 → 3.0.2

package/dist/src/permission-policy.js

@@ -1,265 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveReal = resolveReal;
-exports.classifyCommand = classifyCommand;
-exports.decidePermission = decidePermission;
-/**
- * M2.4: Permission policy + Command Classifier
- *
- * Determines whether a tool call is allowed, requires approval, or is blocked
- * based on the current permission mode (Guarded YOLO / Full YOLO / Manual Approval).
- */
-const fs_1 = require("fs");
-const path_1 = require("path");
-/**
- * Resolve a path to its canonical real path, normalising symlinks.
- * Falls back to path.resolve (which at least normalises `.`, `..`, and
- * redundant separators) when the path does not exist on disk.
- *
- * Exported for unit-testing.
- */
-function resolveReal(p) {
-    try {
-        return (0, fs_1.realpathSync)(p);
-    }
-    catch {
-        return (0, path_1.resolve)(p);
-    }
-}
-/**
- * Classify a command/tool call into a CommandClass category.
- */
-function classifyCommand(tool, args = [], toolKind) {
-    const toolLower = tool.toLowerCase();
-    // If toolKind is explicitly provided, trust it — but cross-check destructive_git
-    // against toolName to prevent plugin injection (e.g. toolKind='destructive_git' on 'rm').
-    if (toolKind) {
-        // Normalize common aliases
-        const kindNormalized = toolKind === 'read' ? 'read_only' : toolKind;
-        const validKinds = [
-            'read_only', 'workspace_write', 'validation', 'safe_git',
-            'worktree_create', 'workspace_cleanup', 'destructive_git',
-            'network', 'credential_access', 'system_write',
-        ];
-        if (validKinds.includes(kindNormalized)) {
-            // Security: destructive_git may only be claimed by git itself.
-            // Widen to git.exe (Windows) and common wrappers (hub, gh).
-            // Any other toolName claiming this class falls through to name-based classification.
-            const GIT_TOOLS = new Set(['git', 'git.exe', 'hub', 'gh']);
-            if (kindNormalized === 'destructive_git' && !GIT_TOOLS.has(toolLower)) {
-                // fall through to name-based classification below
-            }
-            else {
-                return kindNormalized;
-            }
-        }
-    }
-    // ─── Generic exec tools: classify by first arg ────────────
-    // When toolName is a generic executor (e.g., code_mode_exec),
-    // the actual command is in the args array.
-    const genericExecTools = ['code_mode_exec', 'shell_exec', 'terminal', 'bash', 'sh', 'exec'];
-    if (genericExecTools.includes(toolLower) && args.length > 0) {
-        // Reclassify using the first arg as the actual tool
-        const [actualTool, ...restArgs] = args;
-        return classifyCommand(actualTool, restArgs, toolKind);
-    }
-    // ─── System commands ─────────────────────────────────────
-    if (toolLower === 'sudo')
-        return 'system_write';
-    if (toolLower === 'chmod' || toolLower === 'chown')
-        return 'system_write';
-    if (toolLower === 'launchctl')
-        return 'system_write';
-    // Disk-level destructive commands: format, partition, overwrite — same risk as sudo
-    if (['dd', 'mkfs', 'mkfs.ext4', 'mkfs.vfat', 'mkfs.ntfs', 'fdisk', 'parted', 'wipefs'].includes(toolLower)) {
-        return 'system_write';
-    }
-    // Windows system-level dangerous commands (X-3, X-6)
-    // Privilege escalation (= sudo): runas
-    if (toolLower === 'runas')
-        return 'system_write';
-    // ACL/ownership management (= chmod/chown): icacls, cacls, takeown
-    if (['icacls', 'cacls', 'takeown'].includes(toolLower))
-        return 'system_write';
-    // Service management (= launchctl/systemctl): sc, sc.exe, schtasks, net (X-6: net start/stop)
-    if (['sc', 'sc.exe', 'schtasks', 'schtasks.exe', 'net', 'net.exe'].includes(toolLower))
-        return 'system_write';
-    // Disk-level destructive (= mkfs/fdisk): format, diskpart
-    if (['format', 'diskpart'].includes(toolLower))
-        return 'system_write';
-    // Registry modification — no Unix equivalent, equally dangerous
-    if (toolLower === 'reg' || toolLower === 'reg.exe' || toolLower === 'regedit')
-        return 'system_write';
-    // ─── Credential access ───────────────────────────────────
-    if (toolLower.includes('credential') || toolLower.includes('keychain') || toolLower.includes('ssh-key')) {
-        return 'credential_access';
-    }
-    // ─── Git commands ────────────────────────────────────────
-    if (toolLower === 'git' && args.length > 0) {
-        const sub = args[0];
-        // worktree subcommands
-        if (sub === 'worktree') {
-            if (args[1] === 'add')
-                return 'worktree_create';
-            if (args[1] === 'remove')
-                return 'workspace_cleanup';
-        }
-        // destructive git
-        if (sub === 'reset' && args.includes('--hard'))
-            return 'destructive_git';
-        if (sub === 'clean')
-            return 'destructive_git';
-        if (sub === 'checkout' && args.includes('--'))
-            return 'destructive_git';
-        // network git
-        if (sub === 'push' || sub === 'fetch' || sub === 'pull' || sub === 'clone')
-            return 'network';
-        // safe git
-        const safeGitSubs = ['status', 'diff', 'log', 'branch', 'show', 'rev-parse', 'remote', 'stash', 'tag', 'add', 'commit', 'reset'];
-        if (safeGitSubs.includes(sub))
-            return 'safe_git';
-    }
-    // ─── Package managers ────────────────────────────────────
-    if (toolLower === 'pnpm' || toolLower === 'npm' || toolLower === 'yarn') {
-        const sub = args[0];
-        if (sub === 'install' || sub === 'add' || sub === 'update')
-            return 'network';
-        if (sub === 'test' || sub === 'run')
-            return 'validation';
-        if (sub === 'exec')
-            return 'validation';
-        return 'unknown';
-    }
-    if (toolLower === 'npx')
-        return 'validation';
-    // ─── Network tools ───────────────────────────────────────
-    if (toolLower === 'curl' || toolLower === 'wget')
-        return 'network';
-    // ─── Filesystem destructive commands ─────────────────────
-    if (['rm', 'rmdir', 'shred'].includes(toolLower)) {
-        return 'workspace_cleanup';
-    }
-    // Windows equivalents (X-4): del/erase (= rm), rd (= rmdir)
-    if (['del', 'erase', 'rd'].includes(toolLower)) {
-        return 'workspace_cleanup';
-    }
-    // ─── B-4: env <cmd> passes through to the actual command ────
-    if (toolLower === 'env' && args.length > 0) {
-        return classifyCommand(args[0], args.slice(1), toolKind);
-    }
-    // ─── Read-only tools ─────────────────────────────────────
-    const readOnlyTools = [
-        'rg', 'grep', 'ls', 'find', 'cat', 'head', 'tail', 'wc', 'sort', 'uniq',
-        'file', 'stat', 'which', 'echo', 'pwd', 'env',
-        // Windows equivalents (X-5): dir=ls, type=cat, where=which, findstr=grep
-        'dir', 'type', 'where', 'findstr', 'more',
-        // Common agent tool names for reading files/content
-        'read_file', 'read', 'view', 'get_file', 'open_file', 'list_files',
-        'list_directory', 'glob', 'search_files',
-    ];
-    if (readOnlyTools.includes(toolLower))
-        return 'read_only';
-    return 'unknown';
-}
-/**
- * Decide permission for a tool call based on classification.
- */
-function decidePermission(input) {
-    const { toolName, toolKind, command = [], cwd, workspacePath, workflowAllowsDestructiveGit } = input;
-    const cmdClass = classifyCommand(toolName, command, toolKind);
-    // ─── Unconditional blocks ─────────────────────────────────
-    if (cmdClass === 'credential_access') {
-        return {
-            outcome: 'block',
-            reason: 'Credential/keychain access is always blocked',
-            message: 'Credential access commands are not allowed in any mode',
-        };
-    }
-    if (cmdClass === 'system_write') {
-        return {
-            outcome: 'block',
-            reason: 'System-level write operations are always blocked',
-            message: 'System write commands (sudo, chmod, chown, etc.) are not allowed',
-        };
-    }
-    // ─── Allowed commands ────────────────────────────────────
-    if (cmdClass === 'read_only') {
-        return { outcome: 'allow', reason: `Read-only command: ${toolName}`, audit: true };
-    }
-    if (cmdClass === 'safe_git') {
-        return { outcome: 'allow', reason: `Safe git command: ${command.join(' ')}`, audit: true };
-    }
-    if (cmdClass === 'validation') {
-        return { outcome: 'allow', reason: `Validation command: ${command.join(' ')}`, audit: true };
-    }
-    if (cmdClass === 'workspace_write') {
-        return { outcome: 'allow', reason: `Workspace write: ${toolName}`, audit: true };
-    }
-    if (cmdClass === 'worktree_create') {
-        return { outcome: 'allow', reason: 'Worktree creation by workspace manager', audit: true };
-    }
-    // ─── Destructive git ─────────────────────────────────────
-    if (cmdClass === 'destructive_git') {
-        if (workflowAllowsDestructiveGit) {
-            // Verify cwd is within workspace — use resolveReal to handle symlinks
-            // (e.g. macOS /tmp → /private/tmp) and normalise paths before comparing.
-            // We also require a path-separator boundary so that /workspace-evil does
-            // not falsely match /workspace.
-            if (workspacePath && cwd) {
-                const realCwd = resolveReal(cwd);
-                const realWorkspace = resolveReal(workspacePath);
-                // Containment check — must handle both Unix and Windows paths correctly (X-1).
-                //
-                // Strategy: normalise backslashes to forward slashes first (handles C:\foo\bar),
-                // then use path.relative() for the containment check (separator-agnostic, handles
-                // symlinks and avoids the /workspace-evil false-positive of naive startsWith).
-                const normCwd = realCwd.replace(/\\/g, '/');
-                const normWorkspace = realWorkspace.replace(/\\/g, '/');
-                const rel = (0, path_1.relative)(normWorkspace, normCwd);
-                const isContained = rel === '' || (!rel.startsWith('..') && !(0, path_1.isAbsolute)(rel));
-                if (isContained) {
-                    return {
-                        outcome: 'allow',
-                        reason: `Destructive git allowed by workflow config in workspace: ${command.join(' ')}`,
-                        audit: true,
-                    };
-                }
-            }
-        }
-        return {
-            outcome: 'block',
-            reason: `Destructive git command blocked: ${command.join(' ')}`,
-            message: 'Destructive git commands are blocked',
-        };
-    }
-    // ─── Network ─────────────────────────────────────────────
-    // Auto-execute network commands (npm install, git push/fetch/pull/clone, curl/wget).
-    // credential_access is still blocked above (separate class).
-    if (cmdClass === 'network') {
-        return {
-            outcome: 'allow',
-            reason: `Network command allowed: ${command.join(' ')}`,
-            audit: true,
-        };
-    }
-    // ─── Workspace cleanup ───────────────────────────────────
-    // rm/rmdir/shred are catastrophic + unrecoverable — blocked, user must perform manually.
-    if (cmdClass === 'workspace_cleanup') {
-        return {
-            outcome: 'block',
-            reason: `Workspace cleanup blocked: ${command.join(' ')}`,
-            message: 'rm/rmdir/shred commands are blocked in autopilot — perform them manually',
-        };
-    }
-    // ─── Unknown / unclassified ──────────────────────────────
-    // Blacklist strategy: dangerous operations are explicitly blocked above.
-    // Anything not recognized is allowed by default — a whitelist approach would
-    // block every new tool or wrapper the gateway introduces, causing "Approval
-    // timed out" errors that are indistinguishable from real failures.
-    return {
-        outcome: 'allow',
-        reason: `Unclassified command allowed by default: ${toolName} ${command.join(' ')}`,
-        audit: true,
-    };
-}
-//# sourceMappingURL=permission-policy.js.map

package/dist/src/permission-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-policy.js","sourceRoot":"","sources":["../../src/permission-policy.ts"],"names":[],"mappings":";;AAiBA,kCAMC;AAmBD,0CAiIC;AAKD,4CA4GC;AA5RD;;;;;GAKG;AACH,2BAAkC;AAClC,+BAAqD;AAGrD;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC;QACH,OAAO,IAAA,iBAAY,EAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAA,cAAO,EAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAgBD;;GAEG;AACH,SAAgB,eAAe,CAC7B,IAAY,EACZ,OAAiB,EAAE,EACnB,QAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAErC,iFAAiF;IACjF,0FAA0F;IAC1F,IAAI,QAAQ,EAAE,CAAC;QACb,2BAA2B;QAC3B,MAAM,cAAc,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpE,MAAM,UAAU,GAAmB;YACjC,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU;YACxD,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB;YACzD,SAAS,EAAE,mBAAmB,EAAE,cAAc;SAC/C,CAAC;QACF,IAAI,UAAU,CAAC,QAAQ,CAAC,cAA8B,CAAC,EAAE,CAAC;YACxD,+DAA+D;YAC/D,4DAA4D;YAC5D,qFAAqF;YACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,cAAc,KAAK,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,kDAAkD;YACpD,CAAC;iBAAM,CAAC;gBACN,OAAO,cAA8B,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,8DAA8D;IAC9D,2CAA2C;IAC3C,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,oDAAoD;QACpD,MAAM,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QACvC,OAAO,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAChD,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAC1E,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC;IACrD,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3G,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,qDAAqD;IACrD,uCAAuC;IACvC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IACjD,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9E,8FAA8F;IAC9F,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9G,0DAA0D;IAC1D,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,cAAc,CAAC;IACtE,gEAAgE;IAChE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAErG,4DAA4D;IAC5D,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxG,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,uBAAuB;QACvB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,mBAAmB,CAAC;QACvD,CAAC;QAED,kBAAkB;QAClB,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACzE,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,iBAAiB,CAAC;QAC9C,IAAI,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,CAAC;QAExE,cAAc;QACd,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAE7F,WAAW;QACX,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjI,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;IACnD,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,YAAY,CAAC;QACzD,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IAE7C,4DAA4D;IAC5D,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEnE,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,4DAA4D;IAC5D,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;QACvE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;QAC7C,yEAAyE;QACzE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM;QACzC,oDAAoD;QACpD,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY;QAClE,gBAAgB,EAAE,MAAM,EAAE,cAAc;KACzC,CAAC;IACF,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,4BAA4B,EAAE,GAAG,KAAK,CAAC;IACrG,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE9D,6DAA6D;IAC7D,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,8CAA8C;YACtD,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,kEAAkE;SAC5E,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC7F,CAAC;IAED,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC7F,CAAC;IAED,4DAA4D;IAC5D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,IAAI,4BAA4B,EAAE,CAAC;YACjC,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,gCAAgC;YAChC,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;gBACjD,+EAA+E;gBAC/E,EAAE;gBACF,iFAAiF;gBACjF,kFAAkF;gBAClF,+EAA+E;gBAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,IAAA,eAAQ,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBAC7C,MAAM,WAAW,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,iBAAU,EAAC,GAAG,CAAC,CAAC,CAAC;gBAC9E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO;wBACL,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,4DAA4D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;wBACvF,KAAK,EAAE,IAAI;qBACZ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC/D,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,qFAAqF;IACrF,6DAA6D;IAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,4BAA4B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACvD,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,yFAAyF;IACzF,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,8BAA8B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACzD,OAAO,EAAE,0EAA0E;SACpF,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,4CAA4C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnF,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC"}