@open-everywhere/core 0.1.0

package/dist/agent/access/approver-chain.js

@@ -0,0 +1,585 @@
+// Any deny wins, order-independent, and the only way to lift one is a reviewed config diff to the element that denies.
+// Otherwise the first opinion in the CODE-PINNED level order wins: config fills slots within a level and can never reorder the levels.
+// Modes, taint and unattendedness are post-resolution transforms that only move allow/ask; a lowered verdict is still bounded by egress, the credential planes, IAM, spend caps and the audit ledger.
+import { declaredStandingWrites } from "../routines/declared-permissions.js";
+import { classifyConnectorOp, isConnectorOpTool, judgeDeferredTool, postTurnSurfaceFloors, RESUME_TOOL, TOOL_CONSEQUENCE } from "./consequence.js";
+import { awsCommandVerdict } from "./aws-screen.js";
+import { untrustedIngestedThisTurn, taintKindsThisTurn } from "./taint-signal.js";
+import { taintMode } from "./taint-enforcement.js";
+// The DEFER-MODEL judge (OPE-318 phase 2). Runtime edge runs ONE way — this module calls the
+// judge; approval-judge.ts imports only TYPES from here (erased), so no cycle.
+import { approvalJudgeAdminDisarmed, approvalJudgeMode, judgeContextOf, judgeVerdictCacheKey, JUDGE_ENFORCE_TIMEOUT_MS, runApprovalJudge, APPROVAL_JUDGE_ADMIN_DISARM, } from "./approval-judge.js";
+// Runtime-safe, no cycle: config.ts's own imports are all type-only, and resolver.ts imports this
+// module type-only (erased) — the runtime edges run one way, from here outward.
+import { getConfig } from "./config.js";
+import { resolveAccess } from "./resolver.js";
+/**
+ * The ONE place this chain reads the turn-taint signal. Fail-soft like the underlying slot: no session context ⇒ untainted.
+ * What the chain does with it: fire `taint:ask` at the sinks that arm or disarm a post-turn surface, and put `tainted` plus the kinds on the audit row. Nothing else.
+ */
+export function chainTaintSignal() {
+    return untrustedIngestedThisTurn();
+}
+/** The DISCLOSURE breakdown for the audit row + the card line — which classes of source this turn
+ *  ingested. May be empty on a tainted turn (an auth-attribute seed knows the bit, not the kinds). */
+export function chainTaintKinds() {
+    return taintKindsThisTurn();
+}
+function taintedOf(req) {
+    return req.tainted ?? chainTaintSignal();
+}
+/**
+ * Written onto the row ONLY when taint is off, so an `on` deployment's rows stay byte-identical: `tainted: false` otherwise cannot be told from "the model is not running".
+ * 🔴 Not a frozen field, unlike `req.tainted` — the posture belongs to the process resolving the chain, and reading it live stops a row minted after a revert claiming settings that no longer hold.
+ */
+function taintModeNote() {
+    const mode = taintMode();
+    return mode === "off" ? { taintMode: mode } : {};
+}
+/** A declared constant, never an emergent property of import order. Config orders elements WITHIN L1 only; a genuinely new element class needs a code change and a re-review of this order. */
+export const APPROVER_LEVEL_ORDER = ["custom", "surface", "classifier", "registry"];
+/**
+ * Connector-supplied and remote elements are RAISE-ONLY unless config grants `mayAllow`; the registry is terminal and may not defer.
+ * An out-of-clamp verdict is treated as `defer` and the row carries `clamped: true` — never an error, never trusted.
+ */
+export const ELEMENT_CLAMPS = {
+    operator: ["allow", "deny", "ask", "defer"],
+    surface: ["allow", "deny", "ask", "defer"],
+    classifier: ["allow", "deny", "ask", "defer"],
+    registry: ["allow", "deny", "ask"],
+    connector: ["deny", "ask", "defer"],
+    remote: ["deny", "ask", "defer"],
+};
+/**
+ * The registry's verdict for one tool — TERMINAL, never defers: an `open` row allows, a `gate:*` row asks, and a qualified connector op maps through the verb classifier.
+ * A name known to neither plane resolves `ask`, fail-closed.
+ */
+export function registryVerdictOf(tool) {
+    if (isConnectorOpTool(tool))
+        return classifyConnectorOp(tool) === "open" ? "allow" : "ask";
+    const row = TOOL_CONSEQUENCE[tool];
+    if (row === undefined)
+        return "ask"; // fail-closed terminal for an unknown name
+    return row.tier === "open" ? "allow" : "ask";
+}
+/**
+ * The per-sink taint tolerance, in source order: a connector op (writes "disclose", reads none), then a row's declared `taint` column, then a gated row with no column ("gate", fail closed) and an open row with no column (no tolerance).
+ * The open-row arm is a deliberate reading: the fail-closed default is scoped to SINKS, because applying it to every row would card `reply` on any tainted turn.
+ * 🔴 Only "gate" reaches a transform — "disclose" and `undefined` are indistinguishable to {@link TRANSFORM_TABLE}; the column still says which sinks treat provenance as material.
+ * 🔴 `postTurnSurface: "arms"|"disarms"` outranks the column and is read FIRST, so the floor is the UNION of both and removing the column from an arming row would not lift it.
+ */
+export function taintToleranceOf(tool) {
+    if (isConnectorOpTool(tool))
+        return classifyConnectorOp(tool) === "open" ? undefined : "disclose";
+    return taintToleranceOfRow(TOOL_CONSEQUENCE[tool]);
+}
+/** {@link taintToleranceOf}'s decision over ONE row, split out to be testable: the `postTurnSurface` precedence is redundant on the shipped table, so only a crafted row (arming plus a "disclose" column) can pin it. */
+export function taintToleranceOfRow(row) {
+    if (row === undefined)
+        return "gate";
+    if (postTurnSurfaceFloors(row.postTurnSurface))
+        return "gate";
+    if (row.taint !== undefined)
+        return row.taint;
+    return row.tier === "open" ? undefined : "gate";
+}
+/**
+ * glossary: Transform order: mode → taint → floor → unattended.
+ * 🔴 `unattended` runs LAST so a taint-raised ask cannot survive into an empty room; it is safe there because every arrow after `mode` only tightens.
+ * `taint` and `floor` run after `mode` so DANGEROUSLY_BYPASS can lift neither: no unattended run may arm those sinks off fetched content, and nothing upstream may leave a beneficiary-clicker kind auto-approved.
+ */
+export const TRANSFORM_STAGE_ORDER = ["mode", "taint", "floor", "unattended"];
+/** The runner honours EXACTLY these arrows; there is no transform logic outside this table. Every arrow tightens or kills cards, and none can affect a deny, because a deny never reaches them. */
+export const TRANSFORM_TABLE = [
+    {
+        // Kills CARDS only: it does not touch deny (structurally unreachable), egress, credentials, IAM, spend caps or audit.
+        // 🔴 `resume` is EXEMPT ({@link RESUME_TOOL}): without this, a model turn inside one bypass domain would lift the deployment's org-wide halt with no admin click, and a per-domain setting must never lift an org-wide stop.
+        name: "mode:DANGEROUSLY_BYPASS",
+        stage: "mode",
+        from: ["ask"],
+        fires: (req) => req.mode?.mode === "DANGEROUSLY_BYPASS" && req.tool !== RESUME_TOOL,
+        to: () => "allow",
+    },
+    {
+        // Floor-to-ask with restorations: every allow becomes ask EXCEPT names on the mode's explicit
+        // allowlist, which keep the REGISTRY default (not the resolved verdict — a config-lowered allow
+        // on an allowlisted name goes back to what the registry says, which only ever tightens).
+        name: "mode:APPROVE_ALL",
+        stage: "mode",
+        from: ["allow"],
+        fires: (req) => req.mode?.mode === "APPROVE_ALL",
+        to: (req, registryVerdict) => ((req.mode?.allowlist ?? []).includes(req.tool) ? registryVerdict : "ask"),
+    },
+    {
+        // DENY_ALL's exact arrow is unstated in every source ruling; implemented as the element-equivalent `* → deny`, which satisfies the one stated constraint that it only ever tightens.
+        // Practical scope: the chain is consulted at the gated seams, so a DENY_ALL domain still converses. Operator review may narrow this to `ask → deny`.
+        name: "mode:DENY_ALL",
+        stage: "mode",
+        from: ["allow", "ask"],
+        reason: "mode-deny-all",
+        fires: (req) => req.mode?.mode === "DENY_ALL",
+        to: () => "deny",
+    },
+    {
+        // The break-glass halt: the same stage and arrow as `mode:DENY_ALL`, differing only in SOURCE — a runtime store row an operator writes during an incident, addressed to a surface, tenant, domain, person or the whole org.
+        // 🔴 `resume` is EXEMPT ({@link RESUME_TOOL}), and that is why this is a separate row: `resume` is `gate:admin` and routes through this chain, so without the exemption a halt would deny its own lift. Every other verb, `halt` included, is denied while halted.
+        // The control-MCP `resume` never touches this chain — it is the door that works when the chat door does not.
+        name: "mode:HALT",
+        stage: "mode",
+        from: ["allow", "ask"],
+        reason: "halt",
+        fires: (req) => req.halted === true && req.tool !== RESUME_TOOL,
+        to: () => "deny",
+    },
+    {
+        // Unattended `ask → deny` (plan §5): a card in an empty room is toxic; a deny is KIND — the
+        // fire continues instead of stalling, and the deny row feeds OPE-297's homeostasis loop
+        // (deny hits → a proposed grant-diff PR). Keys off UNATTENDEDNESS, never sessionMode.
+        name: "unattended",
+        stage: "unattended",
+        from: ["ask"],
+        reason: "ask-unattended",
+        fires: (req) => req.unattended,
+        to: () => "deny",
+    },
+    {
+        // The ONLY taint arrow: a per-sink FLOOR TO ASK for the sinks whose `postTurnSurface` arms or disarms. Everywhere else a tainted turn changes no verdict and its provenance is only disclosed.
+        // It stops a LOWERING — a custom approver, a config allow, a judge allow, a bypass domain — from taking one of those sinks below a human decision on a turn that read external content.
+        // Why only these: their output is trusted text on an unwitnessed future run, or a durable external wake path. Attended, a human reads a card carrying the provenance; unattended, the `unattended` arrow denies it.
+        // THE SET IS DERIVED, NEVER TYPED (OPE-419). `postTurnSurface: "arms" | "disarms"` is the predicate, and the predicate answers gate for 11 rows of
+        // TOOL_CONSEQUENCE today, so no reader needs to trust a count somebody typed.
+        name: "taint:ask",
+        stage: "taint",
+        from: ["allow"],
+        reason: "taint-ask",
+        fires: (req) => taintedOf(req) && taintToleranceOf(req.tool) === "gate",
+        to: () => "ask",
+    },
+    {
+        // A beneficiary-clicker kind's execute() mints live material and destroys what it replaces, and a lowered verdict records `chain:<element>` as the decider — a silent, completed, undecided credential rotation. The kind is therefore structurally card-only.
+        // `to` reads the REGISTRY baseline rather than a hardcoded ask, which keeps the arrow a no-op on a beneficiary kind the registry itself marks open.
+        name: "beneficiary-clicker-floor",
+        stage: "floor",
+        from: ["allow"],
+        reason: "beneficiary-clicker",
+        fires: (req) => req.beneficiaryClicker === true,
+        to: (_req, registryVerdict) => registryVerdict,
+    },
+];
+// 🔴 Session grants are NOT an element of this chain and must not become one by accident: a live "Approve for session" grant short-circuits BEFORE the propose plane — the tool reads the memo, publishes through the same execute, and audits the act.
+// An element for it sat at L2 for trace legibility, no caller ever fed it, and it is deleted; anyone adding one must first give the chain a caller that supplies the grant.
+const AWS_SURFACE_ELEMENT = {
+    // The AWS host-side command screen (plan §8.2) — fires only when the request carries the aws
+    // payload (the `aws` tool's consult). Deny on any screen violation, defer when clean: the
+    // registry terminal supplies the allow, so this element can only ever REFUSE, never widen.
+    name: "aws-allow-list",
+    level: "surface",
+    clazz: "surface",
+    evaluate: (req) => {
+        if (req.aws === undefined)
+            return undefined;
+        return awsCommandVerdict(req.aws).ok ? undefined : "deny";
+    },
+};
+const CONNECTOR_OPS_RAISE_ELEMENT = {
+    // The bundle `connectorOps` raise (access/bundle.ts) — raise-only today, and it KEEPS that
+    // clamp: the element answers only `ask` (or defers). A raise names an op the operator wants
+    // gated regardless of the verb heuristic's opinion.
+    name: "connector-ops-raise",
+    level: "surface",
+    clazz: "surface",
+    evaluate: (req) => (req.connectorOpRaise !== undefined ? "ask" : undefined),
+};
+const VERB_CLASSIFIER_ELEMENT = {
+    // The built-in verb classifier (L3) — connector ops only: reads open, writes gated. Defers on
+    // every authored/framework tool (the registry owns those).
+    name: "verb-classifier",
+    level: "classifier",
+    clazz: "classifier",
+    evaluate: (req) => {
+        if (!isConnectorOpTool(req.tool))
+            return undefined;
+        return classifyConnectorOp(req.tool) === "open" ? "allow" : "ask";
+    },
+};
+const REGISTRY_ELEMENT = {
+    // L4 — TERMINAL. Never defers, so the positional walk always terminates with allow or ask.
+    name: "registry",
+    level: "registry",
+    clazz: "registry",
+    evaluate: (req) => registryVerdictOf(req.tool),
+};
+const LEVEL_RANK = Object.fromEntries(APPROVER_LEVEL_ORDER.map((l, i) => [l, i]));
+function clampVerdict(raw, clazz, mayAllow) {
+    const verdict = raw === undefined ? "defer" : raw;
+    const permitted = new Set(ELEMENT_CLAMPS[clazz]);
+    if (mayAllow === true && (clazz === "connector" || clazz === "remote"))
+        permitted.add("allow");
+    if (permitted.has(verdict))
+        return { verdict };
+    return { verdict: "defer", clamped: true };
+}
+/**
+ * Why the armed judge may NOT lift this request, or undefined when it may. The ONE eligibility
+ * question the chain asks about a request's own shape before a consult.
+ *
+ * 🔴 RULINGS (Tommy, 2026-09-23, OPE-2101 and OPE-2103): a `routine.create` that declares a
+ * standing unattended WRITE — a connector write or `pr.open` — is armed by a person's click on the
+ * creation card, and by nothing else. The judge
+ * lift would write the same `routine.grant` rows under `chain:judge`, with no person in the loop,
+ * for a permission that then acts on its own on every future fire. So the class is decided here by
+ * capability — `pr.open`, or the declared tool's tier (routines/declared-permissions.ts
+ * `declaredStandingWrites`) — and never by platform. A declaration of reads only keeps the
+ * ordinary judge path.
+ *
+ * The reason names the declarations. They are model-authored, but they are the text the creation
+ * card renders verbatim, and an operator needs them to read the row.
+ */
+export function judgeHumanOnlyReason(req) {
+    if (req.action !== ROUTINE_CREATE_ACTION)
+        return undefined;
+    const raw = req.args?.permissions;
+    const declared = Array.isArray(raw) ? raw.filter((d) => typeof d === "string") : [];
+    const writes = declaredStandingWrites(declared);
+    if (writes.length === 0)
+        return undefined;
+    return (`human-only: this routine declares a standing unattended write (${writes.join(", ")}), ` +
+        "and only a person's click on the creation card may arm one — the judge is not consulted (OPE-2101, OPE-2103)");
+}
+/** The ActionKind whose frozen `permissions` arm standing routine permissions on execute. */
+const ROUTINE_CREATE_ACTION = "routine.create";
+/** EVALUATE-ALL, not short-circuit: the audit rule requires every element's verdict on the row, and the deny-invariant requires seeing all denies (measured at ~3µs over a 6-element chain). */
+export async function resolveApproverChain(req, opts = {}) {
+    const evaluated = [];
+    // 1. Build the element list: L1 (config-ordered) ++ L2 ++ L3 ++ L4. L4 always present, always last.
+    const elements = [
+        ...(opts.approvers ?? []).map((a) => ({
+            name: `custom:${a.name}`,
+            level: "custom",
+            clazz: (a.source === "connector" ? "connector" : a.source === "remote" ? "remote" : "operator"),
+            mayAllow: a.mayAllow,
+            run: a.approve,
+        })),
+        ...[AWS_SURFACE_ELEMENT, CONNECTOR_OPS_RAISE_ELEMENT, VERB_CLASSIFIER_ELEMENT, REGISTRY_ELEMENT].map((e) => ({
+            name: e.name,
+            level: e.level,
+            clazz: e.clazz,
+            run: (r) => e.evaluate(r),
+        })),
+    ];
+    // 2. Evaluate EVERY element; clamp each verdict; element error ⇒ ask (fail-closed, §3.6).
+    let order = 0;
+    for (const el of elements) {
+        let raw;
+        let error;
+        try {
+            raw = await el.run(req);
+        }
+        catch {
+            raw = "ask";
+            error = true;
+        }
+        const { verdict, clamped } = error === undefined ? clampVerdict(raw, el.clazz, el.mayAllow) : { verdict: "ask" };
+        evaluated.push({
+            element: el.name,
+            level: el.level,
+            verdict,
+            ...(clamped !== undefined ? { clamped } : {}),
+            ...(error !== undefined ? { error } : {}),
+            rank: LEVEL_RANK[el.level],
+            order: order++,
+        });
+    }
+    const results = evaluated.map(({ rank: _r, order: _o, ...rest }) => rest);
+    const registryBaseline = registryVerdictOf(req.tool);
+    // 3. DENY IS ABSOLUTE — and it SKIPS the transforms structurally (a transform may never lift it).
+    const denies = evaluated.filter((e) => e.verdict === "deny").sort((a, b) => a.rank - b.rank || a.order - b.order);
+    if (denies.length > 0) {
+        return {
+            verdict: "deny",
+            resolvedBy: denies[0].element, // first in level order, for the row — the OUTCOME is order-independent
+            registryVerdict: registryBaseline,
+            elements: results,
+            transforms: [],
+            tainted: taintedOf(req),
+            denyAbsolute: true,
+        };
+    }
+    // 4. Positional resolve: first non-defer in level order. The registry is terminal, so this
+    //    always lands — the fallback ask below is unreachable by construction and exists fail-closed.
+    const positional = evaluated.filter((e) => e.verdict !== "defer").sort((a, b) => a.rank - b.rank || a.order - b.order);
+    const first = positional[0];
+    let verdict = first === undefined || first.verdict === "ask" ? "ask" : "allow";
+    let resolvedBy = first?.element ?? "registry";
+    // Consulted only when every gate agrees: the caller opted in, the ask came from a PER-VERB DEFAULT (an operator or surface ask is pinned policy), the row is defer-flipped, and the deployment is armed.
+    // Runs BEFORE the transforms, so every clamp — including unattended's ask→deny — applies to what the judge resolved.
+    let judgeRun;
+    if (opts.judge === true &&
+        verdict === "ask" &&
+        (resolvedBy === "registry" || resolvedBy === "verb-classifier") &&
+        judgeDeferredTool(req.tool) &&
+        approvalJudgeMode() === "enforce") {
+        const humanOnly = judgeHumanOnlyReason(req);
+        if (humanOnly !== undefined) {
+            // THE HUMAN-ONLY CLASS (OPE-2101): no model is called, and the verdict stays the ask that
+            // lands on a card. Recorded as a consult (source `human-only`) so the audit row says why.
+            judgeRun = {
+                verdict: "defer",
+                source: "human-only",
+                reasoning: humanOnly,
+                cacheKey: judgeVerdictCacheKey(req.tool),
+                cacheHit: false,
+                passes: 0,
+            };
+        }
+        else if (await approvalJudgeAdminDisarmed(req.domain, req.org)) {
+            // An operator turned the judge off for this address, so the chain degrades to its pre-judge self. Recorded as a consult (source `admin-disarm`) so the disarm is queryable per affected row.
+            // A domain-less request reads the ORG-WIDE address, so the reasoning names which address an operator must re-arm.
+            judgeRun = {
+                verdict: "defer",
+                source: "admin-disarm",
+                reasoning: req.domain === undefined
+                    ? `judge disarmed org-wide for domain-less actions by an operator (${APPROVAL_JUDGE_ADMIN_DISARM}) — re-arm with the control plane's rearm_approval_judge with orgWide: true`
+                    : `judge disarmed for this domain by an operator (${APPROVAL_JUDGE_ADMIN_DISARM}) — re-arm with the control plane's rearm_approval_judge`,
+                cacheKey: judgeVerdictCacheKey(req.tool),
+                cacheHit: false,
+                passes: 0,
+            };
+        }
+        else {
+            judgeRun = await runApprovalJudge(judgeContextOf(req, { registryVerdict: registryBaseline }, opts.rules), {
+                enforce: true,
+                timeoutMs: JUDGE_ENFORCE_TIMEOUT_MS,
+            });
+            if (judgeRun.verdict === "deny") {
+                // A judge deny is FINAL like any element's — it skips the transform pipeline the same
+                // structural way an element deny does. NOTE (the ticket's rollout ask): the FIRST LIVE
+                // DENY this branch produces deserves individual review — pull its
+                // `approval.judge.verdict` row and check the reasoning before trusting the class.
+                return {
+                    verdict: "deny",
+                    resolvedBy: "judge",
+                    registryVerdict: registryBaseline,
+                    elements: results,
+                    transforms: [],
+                    tainted: taintedOf(req),
+                    denyAbsolute: true,
+                    judge: judgeRun,
+                };
+            }
+            if (judgeRun.verdict === "allow") {
+                verdict = "allow";
+                resolvedBy = "judge";
+            }
+            // ask/defer/timeout: the last-resort ask — the row lands exactly where it was before its
+            // flip, and the transforms below (taint, floor, unattended) treat it as the ask it is.
+        }
+    }
+    // 5. Transforms, in stage order, each only where its arrow's precondition matches. A transform
+    //    error (fires/to throwing) leaves the verdict UNCHANGED — recorded nowhere as a verdict
+    //    change, exactly the "no-fire" posture.
+    const transforms = [];
+    for (const stage of TRANSFORM_STAGE_ORDER) {
+        for (const row of TRANSFORM_TABLE) {
+            if (row.stage !== stage)
+                continue;
+            let firing = false;
+            try {
+                firing = row.fires(req);
+            }
+            catch {
+                continue; // transform error ⇒ verdict unchanged
+            }
+            if (!firing || !row.from.includes(verdict))
+                continue;
+            let next;
+            try {
+                next = row.to(req, registryBaseline);
+            }
+            catch {
+                continue; // transform error ⇒ verdict unchanged
+            }
+            if (next === verdict)
+                continue; // no movement — not an applied transform
+            transforms.push({ name: row.name, from: verdict, to: next, ...(row.reason !== undefined ? { reason: row.reason } : {}) });
+            if (next === "deny") {
+                // A transform-produced deny ends the pipeline: later arrows only move allow/ask, and
+                // nothing may move a deny (same invariant as step 3, now from the tightening side).
+                return {
+                    verdict: "deny",
+                    resolvedBy,
+                    registryVerdict: registryBaseline,
+                    elements: results,
+                    transforms,
+                    tainted: taintedOf(req),
+                    ...(judgeRun !== undefined ? { judge: judgeRun } : {}),
+                };
+            }
+            verdict = next;
+        }
+    }
+    return {
+        verdict,
+        ...(verdict === "ask" ? { askVariant: "blocking" } : {}),
+        resolvedBy,
+        registryVerdict: registryBaseline,
+        elements: results,
+        transforms,
+        tainted: taintedOf(req),
+        ...(judgeRun !== undefined ? { judge: judgeRun } : {}),
+    };
+}
+/** One producer for the `approval.chain` audit row and for the simulator's trace, so the retrospective row and the prospective simulation can never drift. It answers "why was there no card?" with `resolvedBy` plus `transforms`. */
+export function chainAuditDetail(req, res) {
+    return {
+        tool: req.tool,
+        ...(req.action !== undefined ? { action: req.action } : {}),
+        verdict: res.verdict,
+        ...(res.askVariant !== undefined ? { askVariant: res.askVariant } : {}),
+        resolvedBy: res.resolvedBy,
+        registryVerdict: res.registryVerdict,
+        elements: res.elements.map((e) => ({
+            element: e.element,
+            level: e.level,
+            verdict: e.verdict,
+            ...(e.clamped !== undefined ? { clamped: e.clamped } : {}),
+            ...(e.error !== undefined ? { error: e.error, reason: "element-error" } : {}),
+        })),
+        transforms: res.transforms.map((t) => ({ name: t.name, from: t.from, to: t.to, ...(t.reason !== undefined ? { reason: t.reason } : {}) })),
+        ...(res.denyAbsolute !== undefined ? { denyAbsolute: true } : {}),
+        // The judge CONSULT (OPE-318 phase 2), when one happened — a summary here beside the chain
+        // facts; the per-consult `approval.judge.verdict` row (flow.ts) carries the full record.
+        ...(res.judge !== undefined
+            ? {
+                judge: {
+                    verdict: res.judge.verdict,
+                    source: res.judge.source,
+                    passes: res.judge.passes,
+                    cacheHit: res.judge.cacheHit,
+                    ...(res.judge.pass1 !== undefined ? { pass1: res.judge.pass1 } : {}),
+                },
+            }
+            : {}),
+        unattended: req.unattended,
+        // THE DISCLOSURE PAIR (OPE-307). `tainted` is the fact; `taintKinds` is what makes it usable —
+        // a row saying only "tainted: true" cannot answer "from what?", which is the whole question once
+        // taint stopped changing the verdict. Omitted when empty rather than written as `[]`, so an
+        // untainted row (and a seeded row with no breakdown) is byte-identical to before.
+        tainted: taintedOf(req),
+        ...(taintedOf(req) && chainTaintKinds().length > 0 ? { taintKinds: [...chainTaintKinds()] } : {}),
+        // OPE-399: and WHY it is false, when the answer is "the model is off". Omitted on an `on`
+        // deployment, so the row every existing query reads is unchanged.
+        ...taintModeNote(),
+        ...(req.mode !== undefined ? { mode: req.mode.mode } : {}),
+        ...(req.domain !== undefined ? { domain: req.domain } : {}),
+    };
+}
+/** The human-readable resolution trace — `explain_permission`'s renderer, derived from {@link chainAuditDetail}'s fields so both surfaces and the audit row stay one vocabulary. */
+export function renderChainResolution(req, res) {
+    const lines = [];
+    lines.push(`${req.tool}${req.action !== undefined ? ` (action ${req.action})` : ""} → ${res.verdict.toUpperCase()}${res.askVariant !== undefined ? ` (${res.askVariant})` : ""}`);
+    lines.push(`resolved by: ${res.resolvedBy}${res.denyAbsolute !== undefined ? " — DENY IS ABSOLUTE (transforms skipped)" : ""}`);
+    lines.push(`registry baseline: ${res.registryVerdict}${res.verdict !== res.registryVerdict ? "  ⚠ diverged — see elements/transforms" : ""}`);
+    if (res.judge !== undefined) {
+        lines.push(`judge consult: ${res.judge.verdict} (${res.judge.source}, ${res.judge.passes} pass${res.judge.passes === 1 ? "" : "es"}${res.judge.cacheHit ? ", cache hit" : ""}) — ${res.judge.reasoning}`);
+    }
+    lines.push("elements (level order):");
+    for (const e of res.elements) {
+        const marks = [e.clamped !== undefined ? "clamped→defer" : undefined, e.error !== undefined ? "element-error→ask" : undefined]
+            .filter((m) => m !== undefined)
+            .join(", ");
+        lines.push(`  [${e.level}] ${e.element}: ${e.verdict}${marks.length > 0 ? ` (${marks})` : ""}`);
+    }
+    if (res.transforms.length === 0) {
+        lines.push("transforms: (none applied)");
+    }
+    else {
+        lines.push("transforms (in order):");
+        for (const t of res.transforms)
+            lines.push(`  ${t.name}: ${t.from} → ${t.to}${t.reason !== undefined ? ` (${t.reason})` : ""}`);
+    }
+    // A supplied `req.tainted` is a bit from elsewhere (a simulation input, or a value frozen at propose time), while {@link chainTaintKinds} always reads the turn that RESOLVES the chain.
+    // So a supplied bit carries NO breakdown and names itself, and the live signal prints beside it rather than replacing it.
+    const supplied = req.tainted !== undefined;
+    const kinds = !supplied && taintedOf(req) ? chainTaintKinds() : [];
+    const liveTainted = chainTaintSignal();
+    const liveKinds = supplied && liveTainted ? chainTaintKinds() : [];
+    const context = [
+        `unattended: ${req.unattended}`,
+        // The taint-off suffix is what stops `explain_permission` from telling a reader "tainted: false"
+        // on a deployment where that sentence could never have said anything else (OPE-399).
+        `tainted: ${taintedOf(req)}${kinds.length > 0 ? ` (${kinds.join(", ")})` : ""}` +
+            (supplied ? ` — supplied by the caller, not this turn's own signal (this turn: ${liveTainted}${liveKinds.length > 0 ? ` (${liveKinds.join(", ")})` : ""})` : "") +
+            (taintMode() === "off" ? " — taint.mode: off (the model is not running)" : ""),
+        ...(req.mode !== undefined ? [`mode: ${req.mode.mode}`] : []),
+        // Printed only when the halt is ON: a request that resolved no halt and one that resolved "not halted" are both nothing to say, and `halt: false` would claim the reader asked a question this request may never have asked.
+        ...(req.halted === true ? ["halt: ON"] : []),
+    ];
+    lines.push(`context: ${context.join(" · ")}`);
+    return lines;
+}
+/** No domain, no config or no declared mode ⇒ undefined, so no transform fires. Fail-soft on a missing config registration, because a mode can only ever be deliberate, registered config. */
+export function approvalModeForDomain(domain) {
+    if (domain === undefined)
+        return undefined;
+    try {
+        return getConfig().loadDomains().find((d) => d.name === domain)?.approvalMode;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The L1 operator approvers bound to `scopeKey`, resolved through the REAL access resolver so the band is exactly what the scope's bundles grant. A non-surface key or a missing config resolves the EMPTY band, never a guess.
+ * ⚠️ Resolved in `channel` mode deliberately: the approvers plane is org policy, so a DM-proposed action still answers to the org's approvers.
+ */
+export function approversForScopeKey(scopeKey, domain) {
+    if (scopeKey === undefined)
+        return [];
+    const parts = scopeKey.split("/");
+    if (parts.length !== 3 || parts.some((p) => p.length === 0))
+        return [];
+    const [platform, workspace, channel] = parts;
+    try {
+        const cfg = getConfig();
+        const domains = domain !== undefined ? [domain] : cfg.domainsForSurface({ workspaceKey: `${platform}/${workspace}`, surface: channel });
+        return resolveAccess({ mode: "channel", platform, workspace, channel, domains }, cfg.loadBundles(), cfg.loadBindings(), cfg.pluginRegistry, cfg.loadConnectorCredentials?.() ?? []).approvers;
+    }
+    catch {
+        return []; // fail-soft to the built-in levels — an unresolvable scope must not crash a propose
+    }
+}
+/**
+ * The scope's admin-authored pre-approval rules, resolved through the REAL access resolver; a non-surface key or a missing config resolves the EMPTY set, never a guess.
+ * 🔴 The only source is the config repo's bundles — this takes a scope key, never a path, so a repository the agent checked out to work on can never contribute a rule.
+ */
+export function preApprovalRulesForScopeKey(scopeKey, domain) {
+    if (scopeKey === undefined)
+        return [];
+    const parts = scopeKey.split("/");
+    if (parts.length !== 3 || parts.some((p) => p.length === 0))
+        return [];
+    const [platform, workspace, channel] = parts;
+    try {
+        const cfg = getConfig();
+        const domains = domain !== undefined ? [domain] : cfg.domainsForSurface({ workspaceKey: `${platform}/${workspace}`, surface: channel });
+        return resolveAccess({ mode: "channel", platform, workspace, channel, domains }, cfg.loadBundles(), cfg.loadBindings(), cfg.pluginRegistry, cfg.loadConnectorCredentials?.() ?? []).preApprovalRules;
+    }
+    catch {
+        return []; // fail-soft: an unresolvable scope means no authored rules, never a guessed one
+    }
+}
+let kindToTool;
+/** The tool whose `TOOL_CONSEQUENCE` row names this ActionKind. Undefined for the non-tool kinds, where the caller falls back to the kind string and an unknown name resolves fail-closed `ask` at the terminal. */
+export function toolForActionKind(kind) {
+    if (kindToTool === undefined) {
+        const m = new Map();
+        for (const [tool, entry] of Object.entries(TOOL_CONSEQUENCE)) {
+            if (entry.via.kind === "action-kind")
+                m.set(entry.via.action, tool);
+        }
+        kindToTool = m;
+    }
+    return kindToTool.get(kind);
+}
+//# sourceMappingURL=approver-chain.js.map

package/dist/agent/access/approver-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approver-chain.js","sourceRoot":"","sources":["../../../agent/access/approver-chain.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,uIAAuI;AACvI,sMAAsM;AAEtM,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC1K,OAAO,EAAE,iBAAiB,EAAuB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAkB,MAAM,wBAAwB,CAAC;AACnE,6FAA6F;AAC7F,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAE7B,kGAAkG;AAClG,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA6D9C;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED;sGACsG;AACtG,MAAM,UAAU,eAAe;IAC7B,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,GAAyB;IAC1C,OAAO,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAID,+LAA+L;AAC/L,MAAM,CAAC,MAAM,oBAAoB,GAA6B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAS9G;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA8D;IACvF,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;IAC1C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;IAC7C,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;CACjC,CAAC;AA2DF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,MAAM,GAAG,GAAiC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,2CAA2C;IAChF,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAClG,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,0NAA0N;AAC1N,MAAM,UAAU,mBAAmB,CAAC,GAAiC;IACnE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC9C,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAazG,mMAAmM;AACnM,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD;QACE,sHAAsH;QACtH,6NAA6N;QAC7N,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,oBAAoB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QACnF,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO;KAClB;IACD;QACE,8FAA8F;QAC9F,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,aAAa;QAChD,EAAE,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;KACzG;IACD;QACE,qLAAqL;QACrL,qJAAqJ;QACrJ,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU;QAC7C,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM;KACjB;IACD;QACE,4NAA4N;QAC5N,mQAAmQ;QACnQ,6GAA6G;QAC7G,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAC/D,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM;KACjB;IACD;QACE,4FAA4F;QAC5F,wFAAwF;QACxF,sFAAsF;QACtF,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU;QAC9B,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM;KACjB;IACD;QACE,+LAA+L;QAC/L,wLAAwL;QACxL,oNAAoN;QACpN,mJAAmJ;QACnJ,8EAA8E;QAC9E,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM;QACvE,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK;KAChB;IACD;QACE,+PAA+P;QAC/P,oJAAoJ;QACpJ,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAC/C,EAAE,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC,eAAe;KAC/C;CACF,CAAC;AASF,wPAAwP;AACxP,4KAA4K;AAE5K,MAAM,mBAAmB,GAAmB;IAC1C,6FAA6F;IAC7F,0FAA0F;IAC1F,2FAA2F;IAC3F,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAChB,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;CACF,CAAC;AAEF,MAAM,2BAA2B,GAAmB;IAClD,2FAA2F;IAC3F,4FAA4F;IAC5F,oDAAoD;IACpD,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;CAC5E,CAAC;AAEF,MAAM,uBAAuB,GAAmB;IAC9C,8FAA8F;IAC9F,2DAA2D;IAC3D,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAChB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,CAAC;CACF,CAAC;AAEF,MAAM,gBAAgB,GAAmB;IACvC,2FAA2F;IAC3F,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;CAC/C,CAAC;AAEF,MAAM,UAAU,GAA4C,MAAM,CAAC,WAAW,CAC5E,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACV,CAAC;AAEnC,SAAS,YAAY,CACnB,GAAoB,EACpB,KAAmB,EACnB,QAA6B;IAE7B,MAAM,OAAO,GAAmB,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAiB,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/F,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC;AAWD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAkD;IACrF,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAI,GAAG,CAAC,IAAqD,EAAE,WAAW,CAAC;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,CACL,kEAAkE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACxF,8GAA8G,CAC/G,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C,gMAAgM;AAChM,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAyB,EACzB,IAAI,GAAwB,EAAE;IAM9B,MAAM,SAAS,GAAgB,EAAE,CAAC;IAElC,oGAAoG;IACpG,MAAM,QAAQ,GAA8G;QAC1H,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE;YACxB,KAAK,EAAE,QAAiB;YACxB,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAiB;YAC/G,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,EAAE,CAAC,CAAC,OAAO;SACf,CAAC,CAAC;QACH,GAAG,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3G,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;SAChD,CAAC,CAAC;KACJ,CAAC;IAEF,0FAA0F;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,GAAoB,CAAC;QACzB,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,KAAK,CAAC;YACZ,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAuB,EAAE,CAAC;QACnI,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,EAAE,CAAC,IAAI;YAChB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;YAC1B,KAAK,EAAE,KAAK,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAyB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAErD,kGAAkG;IAClG,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAClH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,uEAAuE;YACvG,eAAe,EAAE,gBAAgB;YACjC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;YACvB,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,kGAAkG;IAClG,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,OAAO,GAAoB,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,IAAI,UAAU,GAAG,KAAK,EAAE,OAAO,IAAI,UAAU,CAAC;IAE9C,yMAAyM;IACzM,qHAAqH;IACrH,IAAI,QAAsC,CAAC;IAC3C,IACE,IAAI,CAAC,KAAK,KAAK,IAAI;QACnB,OAAO,KAAK,KAAK;QACjB,CAAC,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,iBAAiB,CAAC;QAC/D,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC3B,iBAAiB,EAAE,KAAK,SAAS,EACjC,CAAC;QACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,0FAA0F;YAC1F,0FAA0F;YAC1F,QAAQ,GAAG;gBACT,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,YAAY;gBACpB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;gBACxC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;aACV,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,6LAA6L;YAC7L,kHAAkH;YAClH,QAAQ,GAAG;gBACT,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,cAAc;gBACtB,SAAS,EACP,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,CAAC,CAAC,mEAAmE,2BAA2B,6EAA6E;oBAC7K,CAAC,CAAC,kDAAkD,2BAA2B,0DAA0D;gBAC7I,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;gBACxC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;aACV,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,gBAAgB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACxG,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,wBAAwB;aACpC,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAChC,sFAAsF;gBACtF,uFAAuF;gBACvF,kEAAkE;gBAClE,kFAAkF;gBAClF,OAAO;oBACL,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,OAAO;oBACnB,eAAe,EAAE,gBAAgB;oBACjC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;oBACvB,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,QAAQ;iBAChB,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO,GAAG,OAAO,CAAC;gBAClB,UAAU,GAAG,OAAO,CAAC;YACvB,CAAC;YACD,yFAAyF;YACzF,uFAAuF;QACzF,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,4FAA4F;IAC5F,4CAA4C;IAC5C,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,SAAS;YAClC,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,sCAAsC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAE,GAAG,CAAC,IAA0B,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC5E,IAAI,IAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,sCAAsC;YAClD,CAAC;YACD,IAAI,IAAI,KAAK,OAAO;gBAAE,SAAS,CAAC,yCAAyC;YACzE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1H,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,qFAAqF;gBACrF,oFAAoF;gBACpF,OAAO;oBACL,OAAO,EAAE,MAAM;oBACf,UAAU;oBACV,eAAe,EAAE,gBAAgB;oBACjC,QAAQ,EAAE,OAAO;oBACjB,UAAU;oBACV,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;oBACvB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,UAAU;QACV,eAAe,EAAE,gBAAgB;QACjC,QAAQ,EAAE,OAAO;QACjB,UAAU;QACV,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,uOAAuO;AACvO,MAAM,UAAU,gBAAgB,CAAC,GAAyB,EAAE,GAAoB;IAC9E,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1I,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,2FAA2F;QAC3F,yFAAyF;QACzF,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;oBAC1B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;oBACxB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;oBACxB,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;oBAC5B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,+FAA+F;QAC/F,iGAAiG;QACjG,4FAA4F;QAC5F,kFAAkF;QAClF,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,0FAA0F;QAC1F,kEAAkE;QAClE,GAAG,aAAa,EAAE;QAClB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,oLAAoL;AACpL,MAAM,UAAU,qBAAqB,CAAC,GAAyB,EAAE,GAAoB;IACnF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClL,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChI,KAAK,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5M,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;aAC3H,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,yLAAyL;IACzL,0HAA0H;IAC1H,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,WAAW,GAAG,gBAAgB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG;QACd,eAAe,GAAG,CAAC,UAAU,EAAE;QAC/B,iGAAiG;QACjG,qFAAqF;QACrF,YAAY,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7E,CAAC,QAAQ,CAAC,CAAC,CAAC,qEAAqE,WAAW,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChK,CAAC,SAAS,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,6NAA6N;QAC7N,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8LAA8L;AAC9L,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B,EAAE,MAA0B;IAC3F,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,KAAiC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,YAAY,EAAE,GAAG,QAAQ,IAAI,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxI,OAAO,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC;IAChM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,oFAAoF;IACjG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA4B,EAC5B,MAA0B;IAE1B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,KAAiC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,YAAY,EAAE,GAAG,QAAQ,IAAI,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxI,OAAO,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC;IACvM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,gFAAgF;IAC7F,CAAC;AACH,CAAC;AAED,IAAI,UAAmD,CAAC;AAExD,oNAAoN;AACpN,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;QACD,UAAU,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}