@open-everywhere/core 0.1.0

package/dist/agent/access/resolver.d.ts

@@ -0,0 +1,120 @@
+import type { AwsRoleGrant, Binding, Bundle, Connection, ConnectorContentOriginSpec, HttpMethod } from "./bundle.js";
+import { type RepoCapability } from "./repo-capabilities.js";
+import { type ResourceCapability } from "./resource-capabilities.js";
+import type { OperatorApprover } from "./approver-chain.js";
+import { type ResolvedPreApprovalRule } from "./pre-approval-rules.js";
+import type { PluginRegistry } from "../plugins/types.js";
+import { type ConnectorCredentials, type ResolvedConnectorCredential } from "./connector-credentials.js";
+export type SessionMode = "channel" | "dm" | "mpim";
+export interface ResolveRequest {
+    readonly mode: SessionMode;
+    readonly platform: string;
+    readonly workspace: string;
+    readonly channel: string;
+    /** Domain names this surface belongs to (memory/config/domains.ts) — for `domain`-scoped
+     *  bindings. Computed by the caller (domainsForSurface) so the resolver stays pure. */
+    readonly domains?: readonly string[];
+    /** Calling principal, as the PLATFORM-NATIVE id (same raw vocabulary as the coordinates
+     *  above) — used to scope DM access to the caller. The resolver qualifies it with
+     *  `platform` before comparing it to a `principal` binding; never pre-qualify it here. */
+    readonly principalId?: string;
+    /** Person-group names this caller belongs to, computed by the caller so the resolver stays pure. Fail-closed by construction in both directions: absent or empty means in no group, and only confirmed accounts expand, so a failed read resolves strictly less access. Consulted in DM mode only. */
+    readonly groups?: readonly string[];
+    /** The confirmed, active link-set ids this caller belongs to, for a principal binding addressed as a link-set reference, computed by the caller so the resolver stays pure. Fail-closed by construction: absent or empty means in no link-set, and it is consulted in DM mode only. */
+    readonly principalLinkSets?: readonly string[];
+    /** The member-plane grant set, computed by the caller so the resolver stays pure. Fail-closed when absent, it admits the named connector and credential pairs only, and resolving a binding is still not permission to use it: the per-turn controls run at the mint site. */
+    readonly memberPlane?: readonly string[];
+    /** The own-account ask this session runs under. Its one effect is subtractive, withholding that vendor's credentialed hosts from the reach; it can never add a host, and absent means no ask, which is also what an unreadable context resolves to. */
+    readonly ownAccountAsk?: {
+        readonly connector: string;
+    };
+}
+/** A host the session may reach, and (if credentialed) via which connection. */
+export interface ReachableHost {
+    readonly host: string;
+    /** Connection id whose credential is sent to this host; null = credential-less (Domains tab). */
+    readonly viaConnection: string | null;
+    readonly methods?: readonly HttpMethod[];
+    readonly pathPrefixes?: readonly string[];
+}
+export interface InstructionLayer {
+    readonly source: string;
+    readonly text: string;
+}
+export interface EffectiveAccess {
+    readonly mode: SessionMode;
+    readonly scopeKey: string;
+    /** An echo of the request's domains, not a grant: no binding contributes to it, nothing narrows it, and empty is never a wildcard. Its authority is inherited from the deployer-owned domain registry, so any rule standing on it weakens if domain membership ever becomes editable by someone else. */
+    readonly domains: readonly string[];
+    /** Echoes of the request's tenant and surface keys, computed by the same two functions scopeMatches uses, so a rule and a binding can never disagree about the key form. In DM mode they name the conversation, so a service-plane rule must test mode rather than read them as a room. */
+    readonly tenantKey: string;
+    readonly surfaceKey: string;
+    /** Narrowest-wins credential set, keyed by connection id. */
+    readonly connections: readonly Connection[];
+    /** Two-surface egress: credentialed (allowedWebsites) ∪ credential-less (domains). */
+    readonly reachableHosts: readonly ReachableHost[];
+    readonly repos: readonly string[];
+    /** Per-repo capability expansions, unioned across matching bundles; a repo absent here carries the closed per-plane job set, which is the default. An entry only ever adds families the in-code table maps and can never narrow a job set. */
+    readonly repoCapabilities: Readonly<Record<string, readonly RepoCapability[]>>;
+    /** Per-resource capabilities granted by this scope's bindings, unioned. An address absent here carries no grant, and an entry is reach only: a cross-domain post is still refused by access/chat-write-grant.ts. */
+    readonly resourceCapabilities: Readonly<Record<string, readonly ResourceCapability[]>>;
+    /** AWS roles across matching scopes, deduped by roleArn with narrowest-wins. Narrowest-wins replaces the WHOLE grant object for that ARN, so a narrower grant that omits allow drops back to unrestricted rather than inheriting the wider one's; empty means no AWS access. */
+    readonly awsRoles: readonly AwsRoleGrant[];
+    /** L1 operator approvers for this scope, concatenated widest to narrowest in declaration order. Deliberately not deduped: two bundles may both bring a policy element, and every element is evaluated anyway. */
+    readonly approvers: readonly OperatorApprover[];
+    /** Plugin grants by name (audit/preview); each expands to the connectors/skills/subagents below. */
+    readonly plugins: readonly string[];
+    /** Skill names this session may see — scoped visibility (agent/skills/scoped.ts). */
+    readonly skills: readonly string[];
+    /** Subagent names the granted plugins contribute, for audit and preview only. eve compiles every subagent into one static graph with no session input, so an extracted plugin subagent is reachable from every session once deployed, whatever this list says. */
+    readonly subagents: readonly string[];
+    /** Connector plane: connector slugs granted — every `connectors` grant that RESOLVED its credential,
+     *  plus the connectors the granted plugins carry. A grant whose credential does not resolve is not
+     *  here: the fail-closed answer is no connector, never the connector without its identity. */
+    readonly connectors: readonly string[];
+    /** The content origin each granted connector's grant declares, keyed by connection name. Sparse on purpose: a connector with no key here declared nothing, which is marked assumed rather than external, and a connector granted only through a plugin is never in here. */
+    readonly connectorContentOrigin: Readonly<Record<string, ConnectorContentOriginSpec>>;
+    /** Per-surface credential binding for every granted connector, narrowest-wins per slug. Every slug in connectors has an entry except the ones a plugin contributed, which fall back to their own static secretRef. */
+    readonly connectorCredentials: Readonly<Record<string, ResolvedConnectorCredential>>;
+    /** Ordered org→tenant→domain→surface; render verbatim, later layers outrank earlier. */
+    readonly instructionStack: readonly InstructionLayer[];
+    /**
+     * ADMIN-AUTHORED PRE-APPROVAL RULES for this scope (OPE-512), assembled widest → narrowest and
+     * ADDITIVE — a domain's rules add to the org's, never replace them. The approval judge reads
+     * these as curated context; a rule can pre-approve a routine action and can never remove an ask
+     * that policy code forces. Empty for every deployment that authored none.
+     */
+    readonly preApprovalRules: readonly ResolvedPreApprovalRule[];
+    /** One entry per credentialed host this resolve withheld because the requester asked to act with their own account; absent means nothing was withheld. The reach is already narrowed, so a consumer that ignores this field is denied and silent rather than answered on the wrong key. */
+    readonly ownAccountEgressRefusals?: readonly OwnAccountEgressRefusal[];
+    /** Non-fatal issues (unknown bundle refs, broad grants). A host collision is NOT here: since
+     *  OPE-1658 it throws {@link EgressHostCollisionError} rather than resolving with a warning. */
+    readonly warnings: readonly string[];
+}
+/** `platform/<tenant-id>` for this request — the form a `tenant` binding is written in. */
+export declare function tenantKeyOf(req: Pick<ResolveRequest, "platform" | "workspace">): string;
+/** `platform/<tenant-id>/<container-id>` for this request — the form a `surface` binding
+ *  is written in, and the same key memory domains list under `reach`. */
+export declare function surfaceKeyOf(req: Pick<ResolveRequest, "platform" | "workspace" | "channel">): string;
+/** The resolve-time refusal when two grants claim one host, given its own class so an incident reader can tell a config defect from a secret that would not resolve. The parties are not always two connections, since the git read-broker and a declared browser host also stamp a host, so this text stays neutral. */
+export declare class EgressHostCollisionError extends Error {
+    /** One entry per collision, in the order the reach was assembled, each naming the host and its two
+     *  parties — `"<host> (connections <a>, <b>)"`, or the git read-broker / a declared browser host. */
+    readonly collisions: readonly string[];
+    constructor(collisions: readonly string[]);
+}
+/** One credentialed host WITHHELD from a session's reach because its requester asked to act with
+ *  their own account there. Carried on {@link EffectiveAccess} so the caller that read the ask can
+ *  audit the refusal and say it in words — see {@link EffectiveAccess.ownAccountEgressRefusals}. */
+export interface OwnAccountEgressRefusal {
+    /** The connector the ask named, e.g. `notion`. */
+    readonly connector: string;
+    /** The normalised host withheld from the reach. */
+    readonly host: string;
+    /** The connection whose credential WOULD have been stamped on it. */
+    readonly viaConnection: string;
+}
+/** The prose for one withheld host; it names the route as well as the refusal. It appears in the egress.own_account_refusal audit row and the host-side reach refusal, and nothing renders it into a chat reply. */
+export declare function ownAccountEgressRefusalText(refusal: OwnAccountEgressRefusal): string;
+export declare function resolveAccess(req: ResolveRequest, bundles: readonly Bundle[], bindings: readonly Binding[], registry?: PluginRegistry, connectorCredentialsConfig?: readonly ConnectorCredentials[]): EffectiveAccess;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/agent/access/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../agent/access/resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,EAAE,UAAU,EAAS,MAAM,aAAa,CAAC;AAG5H,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAwB,KAAK,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE/H,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAM3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;2FACuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;8FAE0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sSAAsS;IACtS,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uRAAuR;IACvR,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8QAA8Q;IAC9Q,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,uPAAuP;IACvP,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,ySAAyS;IACzS,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,2RAA2R;IAC3R,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,sFAAsF;IACtF,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8OAA8O;IAC9O,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IAC/E,oNAAoN;IACpN,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACvF,gRAAgR;IAChR,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,iNAAiN;IACjN,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kQAAkQ;IAClQ,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;kGAE8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,4QAA4Q;IAC5Q,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACtF,sNAAsN;IACtN,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACrF,wFAAwF;IACxF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC9D,2RAA2R;IAC3R,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACvE;oGACgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAUD,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,WAAW,CAAC,GAAG,MAAM,CAEvF;AAED;yEACyE;AACzE,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,GAAG,MAAM,CAEpG;AAgDD,yTAAyT;AACzT,qBAAa,wBAAyB,SAAQ,KAAK;IACjD;yGACqG;IACrG,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,YAAY,UAAU,EAAE,SAAS,MAAM,EAAE,EASxC;CACF;AAED;;oGAEoG;AACpG,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,oNAAoN;AACpN,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAQpF;AA2CD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,QAAQ,GAAE,cAAmB,EAC7B,0BAA0B,GAAE,SAAS,oBAAoB,EAAO,GAC/D,eAAe,CAkVjB"}

package/dist/agent/access/resolver.js

@@ -0,0 +1,447 @@
+// The pure access resolver: additive grants union across matching scopes, credentials resolve narrowest-wins with no fallback, instructions concatenate org to surface, and a DM applies only the caller's own principal and group bindings. A reach carrying two credentials for one host throws EgressHostCollisionError instead of resolving, so every caller falls closed.
+import { connectorGrantName, connectorGrantContentOrigin, connectorGrantCredential, egressHostsOverlap, normaliseEgressHost, repoGrantName, repoGrantCapabilities } from "./bundle.js";
+import { GIT_BROKER_HOSTS } from "./reserved-hosts.js";
+import { unionRepoCapabilities } from "./repo-capabilities.js";
+import { unionResourceCapabilities } from "./resource-capabilities.js";
+import { resourceGrantCapabilities } from "./resource-grant.js";
+import { assemblePreApprovalRules, PRE_APPROVAL_RULES_MAX_ASSEMBLED, } from "./pre-approval-rules.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { isLinkSetRef, parseLinkSetRef } from "../identity/link-set-ref.js";
+import { expandConnectorGrant } from "./connector-credentials.js";
+// Scope specificity for narrowest-wins; higher is narrower. The container ladder and the personal levels never co-resolve, and inside one DM the personal universe is three rungs, group then principal-via-link-set then principal-exact, so an individual grant beats a group one.
+const SPECIFICITY = { org: 0, tenant: 1, domain: 2, surface: 3, group: 4, principal: 5 };
+/** The two finer rungs the DM branch assigns a matched `principal` binding, splitting the static
+ *  `SPECIFICITY.principal` (5) so an exact-id binding is narrower than a link-set one. `group` (4)
+ *  stays below both. */
+const PRINCIPAL_LINKSET_SPECIFICITY = 5;
+const PRINCIPAL_EXACT_SPECIFICITY = 6;
+/** `platform/<tenant-id>` for this request — the form a `tenant` binding is written in. */
+export function tenantKeyOf(req) {
+    return `${req.platform}/${req.workspace}`;
+}
+/** `platform/<tenant-id>/<container-id>` for this request — the form a `surface` binding
+ *  is written in, and the same key memory domains list under `reach`. */
+export function surfaceKeyOf(req) {
+    return `${req.platform}/${req.workspace}/${req.channel}`;
+}
+function scopeLabel(s) {
+    switch (s.level) {
+        case "org":
+            return "org";
+        case "tenant":
+            return `tenant:${s.tenant}`;
+        case "domain":
+            return `domain:${s.domain}`;
+        case "surface":
+            return `surface:${s.surface}`;
+        case "group":
+            return `group:${s.group}`;
+        case "principal":
+            return `principal:${s.principal}`;
+    }
+}
+// Does a binding's scope bind to this request? Org matches everything; tenant matches
+// its platform-qualified tenant key; domain matches if the surface is a member of that
+// domain (no tenant qualifier — domains are cross-platform); surface matches its
+// fully-qualified surface key. `group` and `principal` NEVER match here: they are the DM
+// universe, applied only by the DM branch in resolveAccess. (A group grants PEOPLE, not
+// rooms — gating a channel's bundle on the wake author's group membership would be a
+// per-wake access dimension this resolver does not have, and is explicitly out of scope.)
+function scopeMatches(s, req) {
+    switch (s.level) {
+        case "org":
+            return true;
+        case "tenant":
+            return s.tenant === tenantKeyOf(req);
+        case "domain":
+            return req.domains?.includes(s.domain) ?? false;
+        case "surface":
+            return s.surface === surfaceKeyOf(req);
+        case "group":
+            return false;
+        case "principal":
+            return false;
+    }
+}
+// Normalize a host pattern for overlap comparison. ONE spelling, shared with the config lint that
+// refuses a host collision before deploy — see access/bundle.ts `normaliseEgressHost` for why the
+// two sites must never carry separate copies.
+const normHost = normaliseEgressHost;
+/** The resolve-time refusal when two grants claim one host, given its own class so an incident reader can tell a config defect from a secret that would not resolve. The parties are not always two connections, since the git read-broker and a declared browser host also stamp a host, so this text stays neutral. */
+export class EgressHostCollisionError extends Error {
+    /** One entry per collision, in the order the reach was assembled, each naming the host and its two
+     *  parties — `"<host> (connections <a>, <b>)"`, or the git read-broker / a declared browser host. */
+    collisions;
+    constructor(collisions) {
+        super(`two grants claim one host in this session's reach — one credential per host per session: ${collisions.join("; ")}. ` +
+            `The egress policy stamps ONE bearer per host, so the second grant is dead config and the room would authenticate with whichever the config lists last. ` +
+            `Give each grant its own host: a bundle connection declares its reach in agent/access/bundles.ts, a browse target in agent/access/browser-hosts.ts. ` +
+            `Two bundles may instead be bound at scopes that never resolve together.`);
+        this.name = "EgressHostCollisionError";
+        this.collisions = collisions;
+    }
+}
+/** The prose for one withheld host; it names the route as well as the refusal. It appears in the egress.own_account_refusal audit row and the host-side reach refusal, and nothing renders it into a chat reply. */
+export function ownAccountEgressRefusalText(refusal) {
+    return (`This route cannot use your own ${refusal.connector} account. ` +
+        `The sandbox firewall stamps one credential per host, and ${refusal.host} is bound to this room's ${refusal.connector} connection ("${refusal.viaConnection}"). ` +
+        `Answering "use my own account" here would mean a second key on that host, which this deployment never allows. ` +
+        `So ${refusal.host} is withheld from this session instead of being reached on the team key. ` +
+        `Ask again in your DM with me, where a personal grant can be minted for your own account.`);
+}
+/** Withholds the asked-for vendor's credentialed hosts from the reach, in place, and reports what was taken. Subtractive only, so no path through it can put a key on a host, and a credential-less host is left alone because it stamps nothing. */
+function withheldForOwnAccountAsk(ask, hostMap, connections, catalogues) {
+    if (ask === undefined)
+        return [];
+    const catalogue = catalogues.find((c) => c.connector === ask.connector);
+    if (catalogue === undefined)
+        return [];
+    const vendorHosts = catalogue.credentials.flatMap((c) => (c.endpoints?.hosts ?? []).map((h) => normHost(h)));
+    if (vendorHosts.length === 0)
+        return [];
+    // WITHHOLD BY CONNECTION, NOT BY HOST. A connection carries ONE key, and a connection that
+    // reaches a host the vendor's catalogue names IS holding that vendor's key. Withholding only the
+    // catalogue's own host names would leave every OTHER host that same connection reaches — a
+    // `www.vendor.net` beside an `api.vendor.com`, or a `*.vendor.com` the catalogue's exact names
+    // never match — still stamped with the team key, which is the substitution this refuses.
+    const vendorConnections = new Set(connections
+        .filter((c) => c.allowedWebsites.some((h) => vendorHosts.some((v) => egressHostsOverlap(normHost(h), v))))
+        .map((c) => c.id));
+    const withheld = [];
+    for (const [host, entry] of [...hostMap]) {
+        if (entry.viaConnection === null || !vendorConnections.has(entry.viaConnection))
+            continue;
+        withheld.push({ connector: ask.connector, host, viaConnection: entry.viaConnection });
+        hostMap.delete(host);
+    }
+    return withheld.sort((a, b) => a.host.localeCompare(b.host));
+}
+/** A canonical, order-insensitive identity for one contentOrigin declaration: two specs share a key only if they answer identically for every tool name. Printing the keys is also how the warning names the two declarations that collided. */
+function contentOriginKey(spec) {
+    if (typeof spec === "string")
+        return spec;
+    const except = Object.keys(spec.except)
+        .sort()
+        .map((tool) => `${tool}=${spec.except[tool]}`)
+        .join(",");
+    return `${spec.default}{${except}}`;
+}
+export function resolveAccess(req, bundles, bindings, registry = {}, connectorCredentialsConfig = []) {
+    const warnings = [];
+    const byName = new Map(bundles.map((b) => [b.name, b]));
+    // DM mode applies only principal bindings naming this caller, never service bundles: personal connectors apply in DMs, the service identity in channels. The comparison is against the qualified principal key, because a bare id can name different people on different platforms.
+    const callerKey = req.principalId !== undefined ? tryPrincipalKey(req.platform, req.workspace, req.principalId) : undefined;
+    // The caller's PERSON-GROUPS (phase G), precomputed by the caller so this stays pure — the same
+    // arrangement as `req.domains`. A group binding applies in a member's DM and nowhere else, which
+    // is why this is read ONLY inside the DM branch below: a group grants people, not rooms.
+    // Empty/absent ⇒ member of nothing (fail-closed); it is never a wildcard.
+    const callerGroups = new Set(req.groups ?? []);
+    // The caller's CONFIRMED/ACTIVE link-set ids (C2.2), precomputed by the caller so this stays pure —
+    // the same arrangement as `req.groups`. Consulted ONLY inside the DM branch, for a `principal`
+    // binding whose address is a `linkSet:<id>` reference. Empty/absent ⇒ member of no link-set
+    // (fail-closed); never a wildcard.
+    const callerLinkSets = new Set(req.principalLinkSets ?? []);
+    // Does this `principal`-level binding apply in the caller's DM, and at what specificity rung?
+    // Returns undefined when it does not apply. An exact `platform/<id>` match is NARROWER than a
+    // link-set match (C2.2 tie-break), so the personal universe is three-rung: group <
+    // principal-via-link-set < principal-exact.
+    const principalMatch = (scope) => {
+        if (callerKey === undefined || scope.principal === undefined)
+            return undefined;
+        if (scope.principal === callerKey)
+            return PRINCIPAL_EXACT_SPECIFICITY;
+        if (isLinkSetRef(scope.principal)) {
+            const id = parseLinkSetRef(scope.principal);
+            if (id !== undefined && callerLinkSets.has(id))
+                return PRINCIPAL_LINKSET_SPECIFICITY;
+        }
+        return undefined;
+    };
+    // Resolve applicable bindings to their bundle definitions, each tagged with the specificity it
+    // matched AT (the DM personal rungs are finer than the static level; see principalMatch).
+    const applied = [];
+    for (const binding of bindings) {
+        let specificity;
+        if (req.mode === "dm") {
+            if (binding.scope.level === "principal") {
+                specificity = principalMatch(binding.scope);
+            }
+            else if (
+            // The caller-key guard is repeated deliberately: `req.groups` is DERIVED from the caller's
+            // key, so an unattested turn has none — but a hand-built request carrying groups and no
+            // principal must resolve nothing rather than "everybody's groups".
+            callerKey !== undefined &&
+                binding.scope.level === "group" &&
+                binding.scope.group !== undefined &&
+                callerGroups.has(binding.scope.group)) {
+                specificity = SPECIFICITY.group;
+            }
+        }
+        else if (scopeMatches(binding.scope, req)) {
+            specificity = SPECIFICITY[binding.scope.level];
+        }
+        if (specificity === undefined)
+            continue;
+        const bundle = byName.get(binding.bundle);
+        if (!bundle) {
+            warnings.push(`binding references unknown bundle "${binding.bundle}" — ignored`);
+            continue;
+        }
+        applied.push({ scope: binding.scope, bundle, specificity });
+    }
+    // Order widest → narrowest for additive concatenation and narrowest-wins override.
+    const ordered = [...applied].sort((a, b) => a.specificity - b.specificity);
+    const connById = new Map();
+    for (const { bundle } of ordered) {
+        for (const c of bundle.connections ?? []) {
+            connById.set(c.id, c); // narrower scope (later) overrides
+        }
+    }
+    const connections = [...connById.values()];
+    const hostMap = new Map();
+    for (const d of ordered.flatMap(({ bundle }) => bundle.domains ?? [])) {
+        const key = normHost(d);
+        if (!hostMap.has(key))
+            hostMap.set(key, { host: key, viaConnection: null });
+    }
+    // One credential per host per session: the sandbox policy stamps one bearer per host, so a second claim is refused here rather than merged, and a credential-less host is not a party to it. The test is host overlap, not string equality, and the throw compiles to deny-all with the message on the egress.policy audit row.
+    const claims = connections.flatMap((c) => c.allowedWebsites.map((h) => ({ host: normHost(h), via: c.id })));
+    const collisions = [];
+    const reported = new Set();
+    for (let i = 0; i < claims.length; i++) {
+        for (let j = i + 1; j < claims.length; j++) {
+            const a = claims[i];
+            const b = claims[j];
+            if (a.via === b.via)
+                continue; // one connection is one credential, however it spells its reach
+            if (!egressHostsOverlap(a.host, b.host))
+                continue;
+            const ids = [a.via, b.via].sort();
+            const hosts = [a.host, b.host].sort();
+            const key = `${ids[0]} ${ids[1]} ${hosts[0]} ${hosts[1]}`;
+            if (reported.has(key))
+                continue;
+            reported.add(key);
+            const where = a.host === b.host ? hosts[0] : `${hosts[0]} overlaps ${hosts[1]}`;
+            collisions.push(`${where} (connections ${ids.join(", ")})`);
+        }
+    }
+    // The second seam: the git read-broker replaces its reserved hosts' rules mid-turn with an installation token, so a connection claiming one holds a key checkout_repo displaces. It is reported through the same error, naming the broker rather than a second connection id.
+    for (const claim of claims) {
+        for (const reserved of GIT_BROKER_HOSTS) {
+            const host = normHost(reserved);
+            if (!egressHostsOverlap(claim.host, host))
+                continue;
+            const where = claim.host === host ? host : `${claim.host} overlaps ${host}`;
+            const key = `broker ${claim.via} ${where}`;
+            if (reported.has(key))
+                continue;
+            reported.add(key);
+            collisions.push(`${where} (connection ${claim.via}, and the git read-broker, which replaces that host's rules mid-turn)`);
+        }
+    }
+    if (collisions.length > 0)
+        throw new EgressHostCollisionError(collisions);
+    for (const c of connections) {
+        for (const h of c.allowedWebsites) {
+            hostMap.set(normHost(h), {
+                host: normHost(h),
+                viaConnection: c.id,
+                methods: c.methods,
+                pathPrefixes: c.pathPrefixes,
+            });
+        }
+    }
+    // An own-account ask cannot be answered on the sandbox route: the firewall stamps the deployment's key per host, so swapping a personal key in would put a second credential on that host and would reach every worker. The vendor's credentialed hosts are withheld instead, read from the connector's own catalogue, and the firewall then denies the call.
+    const ownAccountEgressRefusals = withheldForOwnAccountAsk(req.ownAccountAsk, hostMap, connections, connectorCredentialsConfig);
+    const reachableHosts = [...hostMap.values()].sort((a, b) => a.host.localeCompare(b.host));
+    // Repo names are an additive union across matching scopes, with both grant spellings read through the one reader.
+    const repos = [...new Set(ordered.flatMap(({ bundle }) => (bundle.repos ?? []).map(repoGrantName)))].sort();
+    // Repo CAPABILITIES (OPE-1024): repo → the UNION of every named capability set any matching
+    // bundle opted that repo into. Union, not narrowest-wins, because an expansion is additive
+    // config: two bundles that both grant one repo grant the sum of what each opted into, exactly as
+    // the repo list itself is a union. A repo nobody expanded is ABSENT from this map, which is the
+    // same statement as the empty list — the per-plane default job set, unchanged.
+    const repoCapabilityMap = new Map();
+    for (const { bundle } of ordered) {
+        for (const grant of bundle.repos ?? []) {
+            const caps = repoGrantCapabilities(grant);
+            if (caps.length === 0)
+                continue;
+            const name = repoGrantName(grant);
+            repoCapabilityMap.set(name, unionRepoCapabilities(repoCapabilityMap.get(name) ?? [], caps));
+        }
+    }
+    const repoCapabilities = {};
+    for (const name of [...repoCapabilityMap.keys()].sort())
+        repoCapabilities[name] = repoCapabilityMap.get(name);
+    // RESOURCE capabilities (OPE-1064): address → the UNION of every capability any matching bundle
+    // granted it. Union for the reason the repo map above is one — a grant is additive config, so two
+    // bundles that both name a container grant the sum. A row with no `capabilities` key contributes
+    // the default (resourceGrantCapabilities), which is what makes an unadorned row a working grant.
+    const resourceCapabilityMap = new Map();
+    for (const { bundle } of ordered) {
+        for (const grant of bundle.resourceGrants ?? []) {
+            const caps = resourceGrantCapabilities(grant);
+            for (const address of grant.resources ?? []) {
+                resourceCapabilityMap.set(address, unionResourceCapabilities(resourceCapabilityMap.get(address) ?? [], caps));
+            }
+        }
+    }
+    const resourceCapabilities = {};
+    for (const address of [...resourceCapabilityMap.keys()].sort())
+        resourceCapabilities[address] = resourceCapabilityMap.get(address);
+    // AWS roles are additive across matching scopes and deduped by roleArn. A narrower bundle's grant for the same ARN replaces the wider one's entire grant object, region, audience and allow list together; it is a replace, never a merge.
+    const awsRoleMap = new Map();
+    for (const { bundle } of ordered) {
+        for (const grant of bundle.awsRoles ?? [])
+            awsRoleMap.set(grant.roleArn, grant);
+    }
+    const awsRoles = [...awsRoleMap.values()].sort((a, b) => a.roleArn.localeCompare(b.roleArn));
+    // L1 operator approvers (OPE-296): additive concatenation, widest→narrowest, declaration order
+    // within each bundle — the config-ordered band. Never deduped (see the EffectiveAccess doc).
+    const approvers = ordered.flatMap(({ bundle }) => bundle.approvers ?? []);
+    // Plugins are granted by NAME and expand (via the registry) to their underlying
+    // connectors/skills/subagents — the coupling unit. An unknown name contributes
+    // nothing (fail-closed) and warns. Their connectors fold into the connector grant.
+    const plugins = [...new Set(ordered.flatMap(({ bundle }) => bundle.plugins ?? []))].sort();
+    const pluginConnectors = new Set();
+    const skillSet = new Set();
+    const subagentSet = new Set();
+    for (const name of plugins) {
+        const entry = registry[name];
+        if (!entry) {
+            warnings.push(`bundle grants unknown plugin "${name}" — not in the plugin registry; contributes nothing`);
+            continue;
+        }
+        for (const c of entry.connectors ?? [])
+            pluginConnectors.add(c);
+        for (const s of entry.skills ?? [])
+            skillSet.add(s);
+        for (const a of entry.subagents ?? [])
+            subagentSet.add(a);
+    }
+    const skills = [...skillSet].sort();
+    const subagents = [...subagentSet].sort();
+    // Connector grants expand widest to narrowest, so a narrower bundle's credential binding overrides a wider one for the same slug. A grant that resolves no credential grants no connector, which is the fail-closed answer, and the member-plane key set is precomputed by the caller.
+    const memberPlaneKeys = req.memberPlane === undefined || req.memberPlane.length === 0 ? undefined : new Set(req.memberPlane);
+    const catalogueByConnector = new Map(connectorCredentialsConfig.map((c) => [c.connector, c]));
+    const connectorCredentials = {};
+    const grantedConnectors = new Set();
+    for (const { bundle } of ordered) {
+        for (const grant of bundle.connectors ?? []) {
+            const name = connectorGrantName(grant);
+            const credential = connectorGrantCredential(grant);
+            if (credential === undefined) {
+                // The bare-slug spelling, which assertBundlesValid refuses. The resolver is PURE and does
+                // not validate, so it still has to answer for config that never passed the check: it names
+                // no identity, so it grants nothing.
+                warnings.push(`bundle "${bundle.name}": connector grant "${name}" names no credential — a grant must name the identity it reaches the connector as; ignored`);
+                continue;
+            }
+            const { resolved, warnings: gw } = expandConnectorGrant({ name, credential }, catalogueByConnector.get(name), {
+                dm: req.mode === "dm",
+                ...(memberPlaneKeys === undefined ? {} : { memberPlane: memberPlaneKeys }),
+            });
+            for (const w of gw)
+                warnings.push(`bundle "${bundle.name}": ${w}`);
+            if (resolved) {
+                grantedConnectors.add(resolved.connector);
+                connectorCredentials[resolved.connector] = resolved; // narrower (later) overrides
+            }
+        }
+    }
+    // A PLUGIN's connectors stay bare slugs — that vocabulary carries neither a credential nor a
+    // content origin, so those connections resolve through their own static secretRef exactly as
+    // before and never appear in `connectorCredentials`.
+    const connectors = [...new Set([...grantedConnectors, ...pluginConnectors])].sort();
+    // Content origin is not narrowest-wins: an Eve connection is one global instance, so two different declarations are contradictory and collapse to a flat external with a warning, while silence never overrides a declaration. Only a grant that actually granted may declare one.
+    const declaredByName = new Map();
+    for (const { bundle } of ordered) {
+        for (const grant of bundle.connectors ?? []) {
+            const declared = connectorGrantContentOrigin(grant);
+            if (declared === undefined)
+                continue;
+            const name = connectorGrantName(grant);
+            if (!grantedConnectors.has(name))
+                continue;
+            const byShape = declaredByName.get(name) ?? new Map();
+            byShape.set(contentOriginKey(declared), declared);
+            declaredByName.set(name, byShape);
+        }
+    }
+    const connectorContentOrigin = {};
+    for (const [name, declared] of [...declaredByName.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        if (declared.size > 1) {
+            warnings.push(`connector "${name}" is declared with DIFFERENT \`contentOrigin\` values (${[...declared.keys()].sort().join(" vs ")}) by bundles bound to this scope — an Eve connection is one global instance, so these are contradictory claims about the same thing; resolving to "external" (fail-closed). Make the declarations agree.`);
+            connectorContentOrigin[name] = "external";
+            continue;
+        }
+        connectorContentOrigin[name] = [...declared.values()][0];
+    }
+    // --- Pre-approval rules for the approval judge (OPE-512) -------------------
+    // ADD, NEVER REPLACE, widest → narrowest — the same additive shape as the instruction stack
+    // below, and deliberately NOT narrowest-wins. A narrower scope EXTENDS the org's rule set and can
+    // never shrink it, so the only way to remove a rule is to delete it from the config repo. These
+    // are curated context for the judge, never a verdict: see access/pre-approval-rules.ts.
+    const preApprovalRules = assemblePreApprovalRules(ordered
+        .filter(({ bundle }) => (bundle.preApprovalRules?.length ?? 0) > 0)
+        .map(({ scope, bundle }) => ({ scope: scopeLabel(scope), rules: bundle.preApprovalRules })));
+    if (preApprovalRules.dropped > 0) {
+        warnings.push(`${preApprovalRules.dropped} pre-approval rule(s) exceeded the assembled ceiling of ${PRE_APPROVAL_RULES_MAX_ASSEMBLED} and were dropped (narrowest scope first, so the org's reviewed baseline survives) — reduce the rules bound to this scope.`);
+    }
+    const instructionStack = ordered
+        .filter(({ bundle }) => bundle.instructions && bundle.instructions.trim().length > 0)
+        .map(({ scope, bundle }) => ({ source: scopeLabel(scope), text: bundle.instructions.trim() }));
+    // Only org and tenant scopes are broad here, and this loop only appends warnings. A domain binding can be as broad, but deciding that needs the domain registry this pure module never sees, so the claim-aware verdict is a hard CI failure in access/lint.ts: fix it there, not here.
+    for (const { scope, bundle } of ordered) {
+        if (scope.level !== "org" && scope.level !== "tenant")
+            continue;
+        const where = scopeLabel(scope);
+        if ((bundle.repos?.length ?? 0) > 0) {
+            warnings.push(`broad grant: bundle "${bundle.name}" grants ${bundle.repos.length} repo(s) at ${where} scope — every surface under it inherits them (incl. future/public surfaces). Bind repo grants to a domain or specific surface instead.`);
+        }
+        if ((bundle.connections?.length ?? 0) > 0) {
+            warnings.push(`broad grant: bundle "${bundle.name}" binds ${bundle.connections.length} credential(s) at ${where} scope — their credentials are reachable from every surface under it. Bind sensitive credentials to a domain or specific surface instead.`);
+        }
+        if ((bundle.connectors?.length ?? 0) > 0) {
+            warnings.push(`broad grant: bundle "${bundle.name}" grants ${bundle.connectors.length} connector(s) at ${where} scope — every surface under it may invoke those host-side connections with the credential each grant names. Bind connector grants to a domain or specific surface instead.`);
+        }
+        if ((bundle.plugins?.length ?? 0) > 0) {
+            warnings.push(`broad grant: bundle "${bundle.name}" grants ${bundle.plugins.length} plugin(s) at ${where} scope — every surface under it gets those plugins' skills + connectors. Bind plugin grants to a domain or specific surface instead.`);
+        }
+        if ((bundle.awsRoles?.length ?? 0) > 0) {
+            warnings.push(`broad grant: bundle "${bundle.name}" grants ${bundle.awsRoles.length} AWS role(s) at ${where} scope — every surface under it may assume those roles host-side. Bind AWS-role grants to a domain or specific surface instead.`);
+        }
+    }
+    const scopeKey = req.mode === "dm" && req.principalId
+        ? `dm:${req.principalId}`
+        : `${req.platform}/${req.workspace}/${req.channel}`;
+    return {
+        mode: req.mode,
+        scopeKey,
+        // Echoed, not computed — see the field's doc. `?? []` rather than a spread so the absent case
+        // is an empty list and never `undefined`, which a membership test would silently throw on.
+        domains: req.domains ?? [],
+        tenantKey: tenantKeyOf(req),
+        surfaceKey: surfaceKeyOf(req),
+        connections,
+        reachableHosts,
+        repos,
+        repoCapabilities,
+        resourceCapabilities,
+        awsRoles,
+        approvers,
+        plugins,
+        skills,
+        subagents,
+        connectors,
+        connectorContentOrigin,
+        connectorCredentials,
+        instructionStack,
+        preApprovalRules: preApprovalRules.rules,
+        ...(ownAccountEgressRefusals.length > 0 ? { ownAccountEgressRefusals } : {}),
+        warnings,
+    };
+}
+//# sourceMappingURL=resolver.js.map

package/dist/agent/access/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../agent/access/resolver.ts"],"names":[],"mappings":"AAAA,+WAA+W;AAG/W,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACvL,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAuB,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAA2B,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GAEjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,oBAAoB,EAA+D,MAAM,4BAA4B,CAAC;AAgG/H,qRAAqR;AACrR,MAAM,WAAW,GAAmC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACzH;;wBAEwB;AACxB,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAEtC,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,GAAmD;IAC7E,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,YAAY,CAAC,GAA+D;IAC1F,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAQ;IAC1B,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,WAAW;YACd,OAAO,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,uFAAuF;AACvF,iFAAiF;AACjF,yFAAyF;AACzF,wFAAwF;AACxF,qFAAqF;AACrF,0FAA0F;AAC1F,SAAS,YAAY,CAAC,CAAQ,EAAE,GAAmB;IACjD,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,QAAQ;YACX,OAAO,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAO,CAAC,IAAI,KAAK,CAAC;QACnD,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,WAAW;YACd,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,kGAAkG;AAClG,8CAA8C;AAC9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC,yTAAyT;AACzT,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;yGACqG;IAC5F,UAAU,CAAoB;IACvC,YAAY,UAA6B;QACvC,KAAK,CACH,4FAA4F,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnH,yJAAyJ;YACzJ,qJAAqJ;YACrJ,yEAAyE,CAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAcD,oNAAoN;AACpN,MAAM,UAAU,2BAA2B,CAAC,OAAgC;IAC1E,OAAO,CACL,kCAAkC,OAAO,CAAC,SAAS,YAAY;QAC/D,4DAA4D,OAAO,CAAC,IAAI,4BAA4B,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,aAAa,MAAM;QACjK,gHAAgH;QAChH,MAAM,OAAO,CAAC,IAAI,2EAA2E;QAC7F,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,qPAAqP;AACrP,SAAS,wBAAwB,CAC/B,GAAoC,EACpC,OAAmC,EACnC,WAAkC,EAClC,UAA2C;IAE3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,2FAA2F;IAC3F,iGAAiG;IACjG,2FAA2F;IAC3F,+FAA+F;IAC/F,yFAAyF;IACzF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,WAAW;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpB,CAAC;IACF,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;YAAE,SAAS;QAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,gPAAgP;AAChP,SAAS,gBAAgB,CAAC,IAAgC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;SACpC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,GAAG,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAmB,EACnB,OAA0B,EAC1B,QAA4B,EAC5B,QAAQ,GAAmB,EAAE,EAC7B,0BAA0B,GAAoC,EAAE;IAEhE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,oRAAoR;IACpR,MAAM,SAAS,GACb,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5G,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE/C,oGAAoG;IACpG,+FAA+F;IAC/F,4FAA4F;IAC5F,mCAAmC;IACnC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAE5D,8FAA8F;IAC9F,8FAA8F;IAC9F,mFAAmF;IACnF,4CAA4C;IAC5C,MAAM,cAAc,GAAG,CAAC,KAAY,EAAsB,EAAE;QAC1D,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,2BAA2B,CAAC;QACtE,IAAI,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,EAAE,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,6BAA6B,CAAC;QACvF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,OAAO,GAA4D,EAAE,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,WAA+B,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACxC,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,CAAC;iBAAM;YACL,2FAA2F;YAC3F,wFAAwF;YACxF,mEAAmE;YACnE,SAAS,KAAK,SAAS;gBACvB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO;gBAC/B,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;gBACjC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EACrC,CAAC;gBACD,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,mFAAmF;IACnF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,mCAAmC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,gUAAgU;IAChU,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;gBAAE,SAAS,CAAC,gEAAgE;YAC/F,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,iBAAiB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,8QAA8Q;IAC9Q,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,aAAa,IAAI,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,UAAU,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,gBAAgB,KAAK,CAAC,GAAG,uEAAuE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;gBACvB,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACjB,aAAa,EAAE,CAAC,CAAC,EAAE;gBACnB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,YAAY,EAAE,CAAC,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8VAA8V;IAC9V,MAAM,wBAAwB,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC/H,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1F,kHAAkH;IAClH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5G,4FAA4F;IAC5F,2FAA2F;IAC3F,iGAAiG;IACjG,gGAAgG;IAChG,+EAA+E;IAC/E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAqC,CAAC;IACvE,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAClC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,GAA8C,EAAE,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAE/G,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/E,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;gBAC5C,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,oBAAoB,GAAkD,EAAE,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;IAEpI,2OAA2O;IAC3O,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7F,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE1E,gFAAgF;IAChF,+EAA+E;IAC/E,mFAAmF;IACnF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,iCAAiC,IAAI,qDAAqD,CAC3F,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE;YAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,uRAAuR;IACvR,MAAM,eAAe,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7H,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,oBAAoB,GAAgD,EAAE,CAAC;IAC7E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,0FAA0F;gBAC1F,2FAA2F;gBAC3F,qCAAqC;gBACrC,QAAQ,CAAC,IAAI,CACX,WAAW,MAAM,CAAC,IAAI,uBAAuB,IAAI,6FAA6F,CAC/I,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;gBAC5G,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI;gBACrB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;aAC3E,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,EAAE;gBAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,QAAQ,EAAE,CAAC;gBACb,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC1C,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,CAAC,6BAA6B;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,6FAA6F;IAC7F,qDAAqD;IACrD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpF,mRAAmR;IACnR,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmD,CAAC;IAClF,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAsC,CAAC;YAC1F,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YAClD,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,MAAM,sBAAsB,GAA+C,EAAE,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CACX,cAAc,IAAI,0DAA0D,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,0MAA0M,CAC/T,CAAC;YACF,sBAAsB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5D,CAAC;IAED,8EAA8E;IAC9E,4FAA4F;IAC5F,kGAAkG;IAClG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,gBAAgB,GAAG,wBAAwB,CAC/C,OAAO;SACJ,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SAClE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAiB,EAAE,CAAC,CAAC,CAC/F,CAAC;IACF,IAAI,gBAAgB,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CAAC,OAAO,2DAA2D,gCAAgC,4HAA4H,CACnP,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAuB,OAAO;SACjD,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACpF,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,YAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAElG,wRAAwR;IACxR,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,KAAM,CAAC,MAAM,eAAe,KAAK,yIAAyI,CACjO,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,WAAY,CAAC,MAAM,qBAAqB,KAAK,2IAA2I,CAC9O,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,UAAW,CAAC,MAAM,oBAAoB,KAAK,6KAA6K,CAC/Q,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,OAAQ,CAAC,MAAM,iBAAiB,KAAK,sIAAsI,CAClO,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,IAAI,YAAY,MAAM,CAAC,QAAS,CAAC,MAAM,mBAAmB,KAAK,iIAAiI,CAChO,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW;QAClC,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE;QACzB,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ;QACR,8FAA8F;QAC9F,2FAA2F;QAC3F,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;QAC1B,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;QAC3B,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;QAC7B,WAAW;QACX,cAAc;QACd,KAAK;QACL,gBAAgB;QAChB,oBAAoB;QACpB,QAAQ;QACR,SAAS;QACT,OAAO;QACP,MAAM;QACN,SAAS;QACT,UAAU;QACV,sBAAsB;QACtB,oBAAoB;QACpB,gBAAgB;QAChB,gBAAgB,EAAE,gBAAgB,CAAC,KAAK;QACxC,GAAG,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,QAAQ;KACT,CAAC;AACJ,CAAC"}