@open-everywhere/core 0.1.0

package/dist/agent/routines/collector.js

@@ -0,0 +1,389 @@
+// PRE-RUN DATA COLLECTION (OPE-151 §1) — the declared reads a routine's fire runs BEFORE the
+// session starts, so a run opens on current inputs instead of on the model's assumptions.
+//
+// THE GAP THIS CLOSES. A fired turn's opening message was `firePreamble` + the prompt and nothing
+// else (routines/watch.ts renderScheduledMessage). A fire also has no `bash` and no wide read kit —
+// a triggered fire lands at THREAD grain (routines/fire-window.ts TRIGGERED_FIRE_GRAIN), and the
+// wide kit is a `task` row (access/window-gate-manifest.ts). So a 03:00 routine that needs to know
+// what changed had exactly two options: guess, or ask a human who is asleep. The one case where
+// data DID arrive with a wake was the event leg (routines/events.ts eventPrompt), and that data
+// comes from the delivery rather than from anything the routine chose to look at.
+//
+// THE SHAPE, and why every half of it is where it is:
+//
+//   • A COLLECTOR IS A DECLARED READ, DECLARED IN GIT. The tool it calls, the arguments it calls it
+//     with and the name a routine spells are TRACKED LITERALS in the deployment's own config
+//     (`agent/routines/collectors.ts`), registered at boot through {@link registerRoutineCollectors}.
+//     Never env, and never model-authored: a collector a fire could name or shape is a fire choosing
+//     its own reads, which is the thing the declared-permission plane exists to stop.
+//   • THE ROUTINE NAMES IT, AND NOTHING MORE. {@link Routine.collectors} carries names off this
+//     registry. A name is inert on its own — it permits nothing and reaches nothing that is not
+//     already declared here and permitted below.
+//   • IT RUNS UNDER THE ROUTINE'S DECLARED PERMISSION AND NOTHING WIDER. The permission a collector
+//     needs is the ordinary per-tool declaration `tool:<the tool>` (approvals/session-grant.ts
+//     routinePermissionKind), so a collector reaches exactly what a human declared on the routine's
+//     creation card or approved on its permission card — the same rows, the same key, the same death
+//     on `edit_routine`. A collector whose declaration the routine does not hold is REFUSED, and the
+//     refusal is recorded on the run rather than swallowed ({@link collectRoutineInputs}).
+//   • READ TIER ONLY. {@link assertCollectorDeclarable} refuses any tool the static tier classifier
+//     (access/consequence.ts) does not call `read`. "Collect data before the run" is a read by
+//     definition, and an unrecognised verb fails closed to the delete tier there — so a collector
+//     that is not provably a read never registers at all, on any deployment.
+//   • EVERY READ HAS A DEADLINE, AND THE DEADLINE IS DECLARED. A collector runs INLINE on the
+//     dispatcher's tick and inside the event fan-out's match loop, so a host reader whose socket
+//     never closes would stall that whole tick — every OTHER tenant's due routines with it. That is
+//     the same blast radius {@link import("./pre-fire.js").runPreFire}'s never-throws contract exists
+//     to close, and a count bound ({@link MAX_ROUTINE_COLLECTORS}) bounds fan-out, not duration. So
+//     each read is raced against {@link RoutineCollectorDef.timeoutMs} — a tracked literal like
+//     everything else about a collector — and a read that loses the race is a NAMED failure.
+//     🔴 THE RACE UNBLOCKS THE TICK; IT DOES NOT CANCEL THE READ. A promise cannot be revoked, so a
+//     lost read may still be in flight afterwards. The reader is handed an `AbortSignal` that fires
+//     at the deadline so a well-behaved one can drop its socket, and the tick proceeds either way.
+//   • A FAILURE IS NAMED, NEVER A SILENT EMPTY. Every collector that refuses, throws, or times out
+//     produces a FAILED result, the fire still happens, and {@link renderCollectedBlock} writes the
+//     failure into the fire's own message. A run that silently saw nothing and a run that saw
+//     nothing because the read broke are the same reading of the world, and a routine that reports
+//     "no new incidents" off a collector that 500'd is the exact defect this rule removes.
+//     🔴 THE NAMED FAILURE IS A CLOSED-SET REASON AND NOTHING ELSE. What a failing read THREW is
+//     external text — a connector that rejects a non-2xx typically carries the upstream body in the
+//     error message — so it never reaches the model. It rides {@link CollectedInput.detail}, which
+//     only the audit row reads, capped at {@link COLLECTOR_DETAIL_MAX_CHARS}. Putting it in the
+//     failure LINE would place an outside party's bytes in the fire's TRUSTED region, unfenced and
+//     with no taint stamp, since a fire whose reads all failed carries no collected data at all.
+//   • THE OUTPUT IS UNTRUSTED. Collected bytes are whatever an external system said, so the block is
+//     fenced with `wrapUntrusted` and the fire is stamped tainted at the dispatch site
+//     (access/taint-signal.ts taintedFireAttrs) — the same pairing routines/ingress.ts uses for an
+//     event fire. The fence is applied HERE, at render time, by a process that is not the consuming
+//     turn; the stamp is what makes the consuming turn treat itself as tainted.
+//
+// Framework-free (no eve imports), matching routine.ts / watch.ts / job.ts, so the dispatcher, the
+// tools and the tests all share it without pulling the runtime.
+import { wrapUntrusted } from "../access/untrusted.js";
+import { classifyConnectorOpTier } from "../access/consequence.js";
+import { connectorToolPermissionKind, routinePermissionKind } from "../approvals/session-grant.js";
+/** Grammar for a collector name — the same shape a config id takes elsewhere in the tree, kept
+ *  tight so a name can be rendered on a card and read back out of an audit row unambiguously. */
+const COLLECTOR_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/**
+ * How many collectors one routine may name. A pre-run collection is serial work on the dispatcher's
+ * own tick, ahead of a delivery that has to happen inside it, so the bound is on latency as much as
+ * on legibility — and a routine that needs a dozen reads to start is a routine whose prompt should
+ * be doing the reading. The same argument routines/declared-permissions.ts makes about a card a
+ * human will not read applies to the block a fire will not attend to.
+ *
+ * 🔴 IT BOUNDS THE COUNT; {@link COLLECTOR_MAX_TIMEOUT_MS} BOUNDS THE DURATION. Read them together:
+ * a count alone bounds nothing about a tick's lateness, because one hung read is unbounded on its
+ * own. The worst case one routine can add to a tick is this many reads at that deadline each.
+ */
+export const MAX_ROUTINE_COLLECTORS = 4;
+/** Ceiling on ONE collector's collected body, in characters. A fire's opening message is a prompt,
+ *  not a document store: an unbounded read would push the routine's own instruction — and the
+ *  standing-rules block above it — out of the model's attention with external bytes. Oversize is
+ *  TRUNCATED with a visible marker rather than dropped, because a silently shortened read and a
+ *  complete one must never look the same. */
+export const COLLECTOR_BODY_MAX_CHARS = 4000;
+/** Ceiling on the recorded CAUSE of a failed read, in characters. It reaches one audit row and no
+ *  model, so it is short by intent: an operator needs the first line of a stack or a status line, not
+ *  a page of vendor HTML in the audit chain. */
+export const COLLECTOR_DETAIL_MAX_CHARS = 300;
+/** How long a collector read may take when its entry declares nothing. Short by intent: this runs
+ *  inline on a tick that must reach every due routine on the deployment, and a read that has not
+ *  answered in ten seconds is one the run is better off being told it did not get. */
+export const COLLECTOR_DEFAULT_TIMEOUT_MS = 10_000;
+/** The longest deadline a collector entry may declare. `MAX_ROUTINE_COLLECTORS` × this is the worst
+ *  case one routine can add to a tick, so the two bounds are read together: four collectors at a
+ *  minute each would be four minutes of one tick, which is not a bound anybody would recognise. */
+export const COLLECTOR_MAX_TIMEOUT_MS = 60_000;
+// --- the registry (tracked config, registered at boot) ------------------------------------------
+let REGISTERED = new Map();
+/**
+ * REFUSE a collector declaration that could never run as one. Fail-loud at REGISTER time, which is
+ * boot: a deployment whose collector config is wrong should fail its build rather than discover it
+ * at 03:00 on a fire nobody is watching (the same posture `defineSurface` and `assertWebhooksValid`
+ * take for their own config-as-code).
+ *
+ * 🔴 THE READ-TIER CHECK IS THE LOAD-BEARING ONE. `classifyConnectorOpTier` fails CLOSED — an
+ * unrecognised verb classifies `destructive` — so this admits only a tool whose name the classifier
+ * positively recognises as a read. That is what makes "a collector is a declared READ" a checked
+ * property of the config rather than a promise in a comment, and it is checked on the deployment
+ * that will run it.
+ */
+export function assertCollectorDeclarable(def) {
+    if (!COLLECTOR_NAME.test(def.name)) {
+        throw new Error(`Routine collector name "${def.name}" is not usable: use lowercase letters, digits, ".", "-" or "_", 1–64 characters.`);
+    }
+    if (def.describe.trim().length === 0) {
+        throw new Error(`Routine collector "${def.name}" needs a one-line \`describe\` — it is what a human reads on the routine's card.`);
+    }
+    if (routinePermissionKind(collectorDeclaration(def)) === null) {
+        throw new Error(`Routine collector "${def.name}" names "${def.tool}", which is not a declarable tool permission. ` +
+            `Name the tool exactly as it is called, with its connection segment — e.g. "notion__search". ` +
+            `A bare verb or a connection slug on its own names no tool.`);
+    }
+    if (def.timeoutMs !== undefined && (!Number.isInteger(def.timeoutMs) || def.timeoutMs < 1 || def.timeoutMs > COLLECTOR_MAX_TIMEOUT_MS)) {
+        throw new Error(`Routine collector "${def.name}" declares a timeout of ${def.timeoutMs}ms, which is not usable: give a whole number of milliseconds between 1 and ${COLLECTOR_MAX_TIMEOUT_MS}. ` +
+            `A collector runs inline on the dispatcher's tick, so its deadline is a bound on every OTHER routine's lateness too.`);
+    }
+    if (classifyConnectorOpTier(def.tool) !== "read") {
+        throw new Error(`Routine collector "${def.name}" names "${def.tool}", which this build does not classify as a READ ` +
+            `(access/consequence.ts). A collector runs unattended, before the session exists, so it may only READ — ` +
+            `and an unrecognised verb fails closed to the delete tier, so a tool whose name does not read as a read is refused here.`);
+    }
+}
+/**
+ * Register the deployment's collector menu, REPLACING whatever was registered before. Called once at
+ * boot from `agent/routines/collectors.ts` (the tracked config), and by tests that need their own
+ * menu.
+ *
+ * Replacing rather than merging is deliberate: the menu is one tracked literal in one file, so a
+ * second registration is either a test or a re-import, and in both cases the last value written is
+ * the whole truth. A merge would let a stale entry survive a config change that deleted it.
+ */
+export function registerRoutineCollectors(defs) {
+    const next = new Map();
+    for (const def of defs) {
+        assertCollectorDeclarable(def);
+        if (next.has(def.name))
+            throw new Error(`Routine collector "${def.name}" is declared twice — one name, one read.`);
+        next.set(def.name, def);
+    }
+    REGISTERED = next;
+}
+/** The collector this name declares, or undefined. An unknown name is a real answer — a routine can
+ *  outlive the config entry it named — and {@link collectRoutineInputs} reports it as a FAILURE
+ *  rather than as an empty read. */
+export function resolveRoutineCollector(name) {
+    return REGISTERED.get(name);
+}
+/** Every registered collector, in registration order — for the capability doc and for the
+ *  create-time check that a routine names a collector this deployment actually has. */
+export function listRoutineCollectors() {
+    return [...REGISTERED.values()];
+}
+/** The declared permission a collector needs: the ordinary per-tool declaration, spelled exactly as
+ *  a human would read it on the routine's creation card. */
+export function collectorDeclaration(def) {
+    return `tool:${def.tool}`;
+}
+/**
+ * Validate a routine's PROPOSED collector list at CREATE time, against this deployment's registered
+ * menu and the permissions the same proposal declares. Throws, naming what is wrong and what the
+ * legal values are — the create-time-is-the-primary-gate posture `validateSubscription` and
+ * `declaredPermissionKinds` both take: a declaration that could never work must be refused where the
+ * author can fix it, never armed and left inert on the card.
+ *
+ * 🔴 THE PERMISSION CHECK HAPPENS HERE TOO, AND IT IS NOT A DUPLICATE OF THE FIRE-TIME ONE. This one
+ * reads the routine's own PROPOSED declaration list, so a card can never promise a collection the
+ * routine was never given the permission for — the human reads one coherent card. The fire-time
+ * check ({@link collectRoutineInputs}) reads the LIVE rows, so a permission later revoked stops its
+ * collector even though this one passed. Neither bounds the other: this one is about the card being
+ * honest, that one is about the run being permitted.
+ *
+ * Returns the trimmed, de-duplicated list to freeze onto the pending's args.
+ */
+export function validateRoutineCollectors(names, declaredPermissions) {
+    const out = [];
+    for (const raw of names) {
+        const name = raw.trim();
+        if (name.length === 0)
+            continue;
+        if (out.includes(name))
+            continue;
+        const def = resolveRoutineCollector(name);
+        if (!def) {
+            const menu = listRoutineCollectors();
+            throw new Error(`"${name}" is not a pre-run collector this deployment declares. ` +
+                (menu.length === 0
+                    ? "This deployment declares none at all, so a routine cannot name one — leave `collectors` out."
+                    : `The declared collectors are: ${menu.map((d) => `"${d.name}" (${d.describe})`).join(", ")}.`));
+        }
+        const needed = collectorDeclaration(def);
+        if (!declaredPermissions.map((d) => d.trim()).includes(needed)) {
+            throw new Error(`The "${name}" collector reads with the "${def.tool}" tool, so this routine has to declare "${needed}" in its ` +
+                `permissions — a collector runs under the routine's declared permission and nothing wider. Add it, or drop the collector.`);
+        }
+        out.push(name);
+    }
+    if (out.length > MAX_ROUTINE_COLLECTORS) {
+        throw new Error(`A routine may name at most ${MAX_ROUTINE_COLLECTORS} pre-run collectors (got ${out.length}) — every one of them runs before the fire, on the dispatcher's own tick.`);
+    }
+    return out;
+}
+let READER;
+/** Register (or replace) the host's collector reader. */
+export function registerRoutineCollectorReader(reader) {
+    READER = reader;
+}
+/**
+ * The one-line reason a failed collector carries into the fire's block and the audit row.
+ *
+ * 🔴 EVERY ARM IS HOST-COMPOSED, and the only interpolation is `configValue` — a TOOL NAME or a
+ * DECLARED DEADLINE, both off this deployment's own tracked config. Nothing an external system said
+ * may enter this string — see {@link CollectedInput} for where a failing read's cause goes instead.
+ */
+export function describeCollectorFailure(failure, configValue) {
+    switch (failure) {
+        case "unknown_collector":
+            return "this deployment declares no collector by that name";
+        case "permission_refused":
+            return `this routine holds no declared permission for ${configValue ? `"${configValue}"` : "that tool"}`;
+        case "no_reader":
+            return "this deployment has no collector reader wired";
+        case "timeout":
+            return `the read did not answer within ${configValue ?? COLLECTOR_DEFAULT_TIMEOUT_MS}ms and was abandoned`;
+        case "read_failed":
+            return "the read failed";
+        case "collection_failed":
+            return "the pre-fire collection step broke before this read ran";
+    }
+}
+/** The loss of a race, distinguishable from anything the reader itself threw. Module-private: no
+ *  caller constructs one, so `instanceof` here cannot be spoofed by a reader that throws its own. */
+class CollectorDeadline extends Error {
+}
+/**
+ * Run ONE reader against its declared deadline. Resolves with the body, or rejects — with a
+ * {@link CollectorDeadline} when the deadline won, or with whatever the reader threw.
+ *
+ * 🔴 THE TIMER IS NOT `unref`'d, and that is a correction, not an oversight. An unref'd timer does
+ * not keep the event loop alive, so in a process whose only outstanding work IS the hung read — a
+ * never-settling promise holds nothing open by itself — Node exits before the deadline can fire and
+ * the race is decided by luck. Measured: the first version of this function unref'd the timer, and
+ * the deadline test below died with "unsettled top-level await" instead of timing out. The timer is
+ * always `clearTimeout`'d in the `finally` instead, so it lives exactly as long as the read it is
+ * timing, which is work the process should stay alive for.
+ */
+async function readWithDeadline(reader, input) {
+    const ms = input.collector.timeoutMs ?? COLLECTOR_DEFAULT_TIMEOUT_MS;
+    const ac = new AbortController();
+    let timer;
+    try {
+        return await Promise.race([
+            reader({ ...input, signal: ac.signal }),
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    // Abort FIRST, so a reader that honours the signal starts unwinding before we stop waiting.
+                    ac.abort();
+                    reject(new CollectorDeadline(`collector "${input.collector.name}" exceeded ${ms}ms`));
+                }, ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** Cap one collected body, reporting whether the cap bit. */
+function capBody(body) {
+    return body.length <= COLLECTOR_BODY_MAX_CHARS
+        ? { body, truncated: false }
+        : { body: body.slice(0, COLLECTOR_BODY_MAX_CHARS), truncated: true };
+}
+/**
+ * Run a routine's declared collectors, in the order the routine names them, and return one result
+ * each.
+ *
+ * 🔴 IT NEVER THROWS AND IT NEVER RETURNS A SHORT LIST. Every named collector produces exactly one
+ * result, ok or failed, so the caller cannot mistake "the read was refused" for "the routine named
+ * nothing" — and a collector that breaks can never stop a fire that would otherwise have happened.
+ * That direction is deliberate: a pre-run read is an INPUT to the run, and losing an input is a fact
+ * the run should be told, not a reason to cancel it. The CONDITION GATE (routines/gate.ts) is where
+ * a run is stopped, and it reads these results including their failures.
+ *
+ * `heldKinds` is the routine's LIVE declared-permission set — the raw memo kinds, from
+ * routines/declared-permissions.ts `routinePermissionKinds`. Passing the live set rather than the
+ * routine's frozen declaration list is what makes a REVOKED permission stop its collector on the
+ * very next fire.
+ */
+export async function collectRoutineInputs(input) {
+    const out = [];
+    for (const name of input.names) {
+        const def = resolveRoutineCollector(name);
+        if (!def) {
+            out.push({ name, ok: false, failure: describeCollectorFailure("unknown_collector") });
+            continue;
+        }
+        if (!input.heldKinds.includes(connectorToolPermissionKind(def.tool))) {
+            out.push({ name, ok: false, failure: describeCollectorFailure("permission_refused", def.tool) });
+            continue;
+        }
+        const reader = READER;
+        if (!reader) {
+            out.push({ name, ok: false, failure: describeCollectorFailure("no_reader") });
+            continue;
+        }
+        try {
+            const raw = await readWithDeadline(reader, { org: input.org, routineId: input.routineId, collector: def });
+            const { body, truncated } = capBody(raw);
+            out.push({ name, ok: true, describe: def.describe, body, truncated });
+        }
+        catch (err) {
+            if (err instanceof CollectorDeadline) {
+                // A separate arm from `read_failed`, because they call for different answers: a read that
+                // threw is broken, a read that ran out of time may be healthy and slow. Only the deadline —
+                // this deployment's own tracked literal — is interpolated; nothing the reader produced is.
+                out.push({ name, ok: false, failure: describeCollectorFailure("timeout", def.timeoutMs ?? COLLECTOR_DEFAULT_TIMEOUT_MS) });
+                continue;
+            }
+            // 🔴 THE CAUSE DOES NOT GO IN `failure`. What the reader threw is external text — a connector
+            // that rejects a non-2xx call typically carries the upstream response body in its message — and
+            // `failure` is rendered OUTSIDE the untrusted fence as our own prose. It rides `detail`
+            // instead, capped, and only the audit row reads it.
+            out.push({ name, ok: false, failure: describeCollectorFailure("read_failed"), detail: String(err).slice(0, COLLECTOR_DETAIL_MAX_CHARS) });
+        }
+    }
+    return out;
+}
+// --- rendering ----------------------------------------------------------------------------------
+/** The block tag, named here so the renderer and its tests cannot drift. */
+export const COLLECTED_BLOCK_TAG = "[collected]";
+/** Did any collector return data? — what decides whether the fire carries external bytes, and
+ *  therefore whether the dispatch site stamps the fire TAINTED. A run whose every collector FAILED
+ *  carries only host-composed prose, so it is not tainted, for the same reason a `trigger-only`
+ *  webhook fire is not (access/taint-signal.ts taintedFireAttrs). */
+export function collectionCarriesData(results) {
+    return results.some((r) => r.ok);
+}
+/**
+ * The `[collected]` section of a fire's message: one trusted host-composed line per collector saying
+ * what it is and whether it worked, then the collected bodies inside ONE untrusted fence.
+ *
+ * 🔴 THE FAILURE LINES ARE OUTSIDE THE FENCE AND THE BODIES ARE INSIDE IT, and that split is the
+ * security property. A failure line is OURS — one of {@link describeCollectorFailure}'s closed-set
+ * lines, whose only interpolation is a tool name off this deployment's own tracked config — and a
+ * fire must be able to read "this read did not happen" as fact. A body is whatever an external
+ * system returned, so it sits below the fence with every other byte we did not write. Nothing here
+ * reads {@link CollectedInput.detail}, and nothing ever may: a failing read's cause is external
+ * text, and this region has neither a fence nor a taint stamp behind it. `wrapUntrusted` rather than `ingestUntrusted`
+ * because this renders on the DISPATCHER's tick, not inside the consuming turn: marking the
+ * dispatcher's own turn tainted would be meaningless, and the consuming turn is seeded instead from
+ * the host-set fire stamp (hooks/spawn-taint.ts TAINT_SEED_ATTRS).
+ *
+ * Empty string for a routine that named no collectors, so every fire without them renders
+ * byte-identically to its pre-OPE-151 shape.
+ */
+export function renderCollectedBlock(results) {
+    if (results.length === 0)
+        return "";
+    const lines = [
+        `${COLLECTED_BLOCK_TAG} These reads ran before this fire started, so you are looking at current inputs, ` +
+            `not remembered ones. Each line below says whether its read WORKED. A read that failed returned NOTHING — ` +
+            `do not treat its absence as an observation, and say so if the run needed it.`,
+    ];
+    const bodies = [];
+    for (const r of results) {
+        if (r.ok) {
+            lines.push(`  • ${r.name} — ${r.describe}: collected${r.truncated ? ` (truncated at ${COLLECTOR_BODY_MAX_CHARS} characters)` : ""}`);
+            bodies.push(`### ${r.name}\n${r.body}`);
+        }
+        else {
+            lines.push(`  • ${r.name} — NOT COLLECTED: ${r.failure}`);
+        }
+    }
+    const head = lines.join("\n");
+    if (bodies.length === 0)
+        return head;
+    return `${head}\n\n${wrapUntrusted(bodies.join("\n\n"), { source: "routine collector" })}`;
+}
+//# sourceMappingURL=collector.js.map

package/dist/agent/routines/collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../../agent/routines/collector.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,gGAAgG;AAChG,kFAAkF;AAClF,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,sGAAsG;AACtG,qGAAqG;AACrG,sFAAsF;AACtF,gGAAgG;AAChG,gGAAgG;AAChG,iDAAiD;AACjD,oGAAoG;AACpG,+FAA+F;AAC/F,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,2FAA2F;AAC3F,oGAAoG;AACpG,+FAA+F;AAC/F,kGAAkG;AAClG,6EAA6E;AAC7E,8FAA8F;AAC9F,iGAAiG;AACjG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,gGAAgG;AAChG,6FAA6F;AAC7F,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,mGAAmG;AACnG,2FAA2F;AAC3F,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,qGAAqG;AACrG,uFAAuF;AACvF,mGAAmG;AACnG,oGAAoG;AACpG,gFAAgF;AAChF,EAAE;AACF,mGAAmG;AACnG,gEAAgE;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAwBnG;iGACiG;AACjG,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;6CAI6C;AAC7C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;gDAEgD;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C;;sFAEsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD;;mGAEmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,mGAAmG;AAEnG,IAAI,UAAU,GAA6C,IAAI,GAAG,EAAE,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAwB;IAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,IAAI,mFAAmF,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,IAAI,mFAAmF,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,gDAAgD;YAChG,8FAA8F;YAC9F,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,wBAAwB,CAAC,EAAE,CAAC;QACvI,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,2BAA2B,GAAG,CAAC,SAAS,8EAA8E,wBAAwB,IAAI;YAC9K,qHAAqH,CACxH,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,kDAAkD;YAClG,yGAAyG;YACzG,yHAAyH,CAC5H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAoC;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACnH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED;;oCAEoC;AACpC,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;uFACuF;AACvF,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,GAAsC;IACzE,OAAO,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAwB,EAAE,mBAAsC;IACxG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,yDAAyD;gBAC/D,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBAChB,CAAC,CAAC,8FAA8F;oBAChG,CAAC,CAAC,gCAAgC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,QAAQ,IAAI,+BAA+B,GAAG,CAAC,IAAI,2CAA2C,MAAM,WAAW;gBAC7G,0HAA0H,CAC7H,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,8BAA8B,sBAAsB,4BAA4B,GAAG,CAAC,MAAM,2EAA2E,CACtK,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD,IAAI,MAA0C,CAAC;AAE/C,yDAAyD;AACzD,MAAM,UAAU,8BAA8B,CAAC,MAA0C;IACvF,MAAM,GAAG,MAAM,CAAC;AAClB,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAyB,EAAE,WAA6B;IAC/F,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,mBAAmB;YACtB,OAAO,oDAAoD,CAAC;QAC9D,KAAK,oBAAoB;YACvB,OAAO,iDAAiD,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3G,KAAK,WAAW;YACd,OAAO,+CAA+C,CAAC;QACzD,KAAK,SAAS;YACZ,OAAO,kCAAkC,WAAW,IAAI,4BAA4B,sBAAsB,CAAC;QAC7G,KAAK,aAAa;YAChB,OAAO,iBAAiB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,OAAO,yDAAyD,CAAC;IACrE,CAAC;AACH,CAAC;AAED;qGACqG;AACrG,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAA8B,EAAE,KAAyE;IACvI,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACrE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACtC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,4FAA4F;oBAC5F,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,iBAAiB,CAAC,cAAc,KAAK,CAAC,SAAS,CAAC,IAAI,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;gBACxF,CAAC,EAAE,EAAE,CAAC,CAAC;YACT,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,MAAM,IAAI,wBAAwB;QAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IACC,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3G,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,0FAA0F;gBAC1F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,4BAA4B,CAAC,EAAE,CAAC,CAAC;gBAC3H,SAAS;YACX,CAAC;YACD,8FAA8F;YAC9F,gGAAgG;YAChG,wFAAwF;YACxF,oDAAoD;YACpD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AAEnG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;;;qEAGqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,OAAkC;IACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAkC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAa;QACtB,GAAG,mBAAmB,mFAAmF;YACvG,2GAA2G;YAC3G,8EAA8E;KACjF,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,wBAAwB,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,GAAG,IAAI,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC"}