@open-everywhere/core 0.1.0

package/dist/agent/tools/post_file.js

@@ -0,0 +1,372 @@
+// post_file delivers workspace FILES into the current surface's active conversation, dispatching on the bound platform: Slack, Discord and Notion post for real, anything else fails loud.
+// The only source shape is a sandbox-relative path, confined to the workspace root, and the post target always comes off the SurfaceBinding — never off tool input. There is deliberately no URL arm.
+import { defineTool } from "eve/tools";
+import { windowGated } from "../access/window-gated.js";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { bridgeSlackReadCall } from "../channels/slack-bridge.js";
+import { surfaceMessageOps } from "../channels/surface-message-ops.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { hostHtmlArtifact, resolveBlobHosting } from "../blob/hosting.js";
+import { confineToWorkspacePath } from "./describe_image.js";
+import { postOnce, outboundKey } from "../operational/post-once.js";
+import { withDuplicateApprovalGuard } from "../access/approval-dedupe.js";
+import { surfaceContextFromAuth } from "../access/connector-scope.js";
+import { unattendedOf } from "../access/request.js";
+import { initiatorBoundResponsePolicy } from "../approvals/eve-response-policy.js";
+const EXT_CONTENT_TYPES = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    svg: "image/svg+xml",
+    bmp: "image/bmp",
+    pdf: "application/pdf",
+    txt: "text/plain",
+    md: "text/markdown",
+    csv: "text/csv",
+    json: "application/json",
+    html: "text/html",
+    htm: "text/html",
+    xml: "application/xml",
+    zip: "application/zip",
+    mp4: "video/mp4",
+    webm: "video/webm",
+    mp3: "audio/mpeg",
+    wav: "audio/wav",
+};
+/** Infer a MIME type from a filename's extension; application/octet-stream when unknown. */
+export function inferContentType(filename) {
+    const dot = filename.lastIndexOf(".");
+    if (dot < 0 || dot === filename.length - 1)
+        return "application/octet-stream";
+    const ext = filename.slice(dot + 1).toLowerCase();
+    return EXT_CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+function isHtmlArtifact(contentType) {
+    return contentType === "text/html";
+}
+// The same 10 MB per-file ceiling describe_image.ts's sandbox-path arm uses — one guard constant across the tool surface rather than a bespoke number per tool.
+const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10 MB per file
+async function resolveBytes(path, ctx) {
+    const sandboxCtx = ctx;
+    if (typeof sandboxCtx.getSandbox !== "function") {
+        throw new Error("post_file: no workspace is bound to this seat — a file can only be posted from a session with a sandbox.");
+    }
+    let sb;
+    try {
+        sb = await sandboxCtx.getSandbox();
+    }
+    catch (err) {
+        throw new Error(`post_file: could not open the workspace to read "${path}" — ${err instanceof Error ? err.message : String(err)}.`);
+    }
+    const confined = confineToWorkspacePath(sb, path);
+    let bytes;
+    try {
+        bytes = new Uint8Array(await Promise.resolve(sb.readBinaryFile({ path: confined })));
+    }
+    catch (err) {
+        throw new Error(`post_file: could not read the workspace file at "${path}" — ${err instanceof Error ? err.message : String(err)}.`);
+    }
+    if (bytes.byteLength > MAX_FILE_BYTES) {
+        throw new Error(`post_file: "${path}" is too large (${bytes.byteLength} bytes; max ${MAX_FILE_BYTES}).`);
+    }
+    return bytes;
+}
+// Returns the posted message's `ts` when chat.postMessage names one, and undefined on any response shape that does not — never an invented id.
+async function postTextToSlack(ctx, text) {
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) {
+        throw new Error("post_file: couldn't resolve this Slack channel's id — try again from a real channel or DM.");
+    }
+    const body = { channel: channelId, text };
+    if (binding.threadTs)
+        body.thread_ts = binding.threadTs;
+    const res = await bridgeSlackReadCall("chat.postMessage", body);
+    return typeof res.ts === "string" ? res.ts : undefined;
+}
+// Resolves the target channel off the binding and hands the text to the registered Discord transport, so core carries no vendor host literal.
+async function postTextToDiscord(ctx, text) {
+    const ops = surfaceMessageOps("discord");
+    if (!ops) {
+        throw new Error("post_file: Discord message transport is not registered — the @open-everywhere/provider-discord bundle isn't wired.");
+    }
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) {
+        throw new Error("post_file: couldn't resolve this Discord channel's id — try again from a real channel or DM.");
+    }
+    return await ops.postText(channelId, text);
+}
+async function postLinkToSurface(ctx, platform, urls, comment) {
+    const text = [comment, ...urls].filter((s) => Boolean(s)).join("\n");
+    if (platform === "slack")
+        return await postTextToSlack(ctx, text);
+    if (platform === "discord")
+        return await postTextToDiscord(ctx, text);
+    return await postTextToNotion(ctx, text);
+}
+// Slack's three-step external upload: getUploadURLExternal per file, PUT the bytes, then one completeUploadExternal that posts them all as a single message in the thread.
+// That last response carries only the uploaded files, never the message `ts` the upload lands under, so this returns undefined rather than a guess.
+async function postFilesToSlack(ctx, files, comment) {
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) {
+        throw new Error("post_file: couldn't resolve this Slack channel's id — try again from a real channel or DM.");
+    }
+    const uploaded = [];
+    for (const file of files) {
+        // HTML may reach here: the attach fallback (the org has not opted in to Blob) uploads the raw `.html` bytes on purpose. The hosted path never does.
+        const res = await bridgeSlackReadCall("files.getUploadURLExternal", { filename: file.filename, length: file.bytes.byteLength });
+        const uploadUrl = typeof res.upload_url === "string" ? res.upload_url : undefined;
+        const fileId = typeof res.file_id === "string" ? res.file_id : undefined;
+        if (!uploadUrl || !fileId) {
+            throw new Error("post_file: Slack files.getUploadURLExternal did not return an upload URL / file id.");
+        }
+        const put = await fetch(uploadUrl, {
+            method: "POST",
+            headers: { "content-type": file.contentType },
+            body: file.bytes,
+        });
+        if (!put.ok)
+            throw new Error(`post_file: uploading "${file.filename}" to Slack failed (HTTP ${put.status}).`);
+        uploaded.push({ id: fileId, title: file.caption ?? file.filename });
+    }
+    const complete = {
+        files: JSON.stringify(uploaded),
+        channel_id: channelId,
+    };
+    if (binding.threadTs)
+        complete.thread_ts = binding.threadTs;
+    if (comment)
+        complete.initial_comment = comment;
+    await bridgeSlackReadCall("files.completeUploadExternal", complete);
+    return undefined; // see the function header — Slack's own response never names the message ts.
+}
+// The multipart create-message lives in the provider-discord bundle; this resolves the target channel off the binding and hands over the resolved bytes.
+async function postFilesToDiscord(ctx, files, comment) {
+    const ops = surfaceMessageOps("discord");
+    if (!ops) {
+        throw new Error("post_file: Discord message transport is not registered — the @open-everywhere/provider-discord bundle isn't wired.");
+    }
+    // `postFiles` is an OPTIONAL op on a surface transport, so this checks the op's own presence rather than assuming it from the registry lookup above.
+    if (!ops.postFiles) {
+        throw new Error("post_file: Discord message transport has no file-upload op registered.");
+    }
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) {
+        throw new Error("post_file: couldn't resolve this Discord channel's id — try again from a real channel or DM.");
+    }
+    return await ops.postFiles(channelId, files, comment);
+}
+// Notion's binding does NOT set `target.channelId` — a Notion turn's `target` is the reply address, a different grain from the stop registry's conversation key.
+// That key rides `binding.anchorChannelId`, which is what the Notion transport expects as its `channelId`; reading `target.channelId` here would always resolve undefined.
+function notionPageChannelId(ctx) {
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.anchorChannelId === "string" && binding.anchorChannelId.length > 0 ? binding.anchorChannelId : undefined;
+    if (!channelId) {
+        throw new Error("post_file: couldn't resolve this Notion page's address — try again from a real page comment.");
+    }
+    return channelId;
+}
+async function postFilesToNotion(ctx, files, comment) {
+    const ops = surfaceMessageOps("notion");
+    if (!ops) {
+        throw new Error("post_file: Notion message transport is not registered — the @open-everywhere/provider-notion bundle isn't wired.");
+    }
+    if (!ops.postFiles) {
+        throw new Error("post_file: Notion message transport has no file-upload op registered.");
+    }
+    return await ops.postFiles(notionPageChannelId(ctx), files, comment);
+}
+async function postTextToNotion(ctx, text) {
+    const ops = surfaceMessageOps("notion");
+    if (!ops) {
+        throw new Error("post_file: Notion message transport is not registered — the @open-everywhere/provider-notion bundle isn't wired.");
+    }
+    return await ops.postText(notionPageChannelId(ctx), text);
+}
+const MAX_FILES = 10;
+// Notion's own per-comment attachment cap, COPIED rather than imported — core never depends on a provider package, only the reverse.
+// Checked up front in execute() so a Notion turn fails loud on file count before a single byte is resolved.
+const NOTION_MAX_POST_FILE_ATTACHMENTS = 3;
+const inputSchema = z.object({
+    files: z
+        .array(z.object({
+        source: z
+            .object({ path: z.string().min(1) })
+            .describe("A file path in THIS session's workspace/sandbox (e.g. a bash-written artifact or an agent-browser screenshot). Read via the bound sandbox; confined to the workspace root; fails closed on a seat with no sandbox."),
+        filename: z.string().min(1).describe("The name the file is posted under (its extension drives contentType inference)."),
+        contentType: z.string().min(1).optional().describe("MIME type; inferred from the filename when omitted."),
+        caption: z.string().min(1).optional().describe("Optional per-file caption/title."),
+    }))
+        .min(1)
+        .max(MAX_FILES)
+        .describe("One or more files to post (max 10), each up to 10 MB."),
+    comment: z.string().min(1).optional().describe("Optional text posted alongside the files."),
+});
+function inputFileIsHtml(f) {
+    return isHtmlArtifact(f.contentType ?? inferContentType(f.filename));
+}
+// An unattended publish is REFUSED, never parked: eve suspends the run on an approval card and nobody is there to click it on a routine fire. There is no lift arm because no standing-permission row names this tool.
+// Fail-soft on an unreadable bag: a surface that will not resolve answers "attended", so the card is still raised — standing down grants nothing.
+const UNATTENDED_PUBLISH_REFUSAL = "post_file: publishing an HTML artifact to a public URL needs approval, and nobody is attending this run. " +
+    "An unattended run cannot wait on an approval card, and no standing permission covers this tool. " +
+    "Ask a person to publish it, or post the file without Blob hosting so it attaches instead. Nothing was published.";
+/**
+ * Attendedness is derived through `unattendedOf` and nothing else — the spelling `lint:principal-gate` rule 5 pins. Reading `binding.principalId` here would answer "a human is present" for every fire.
+ * An ApprovalContext is not bindable as it stands, so `surfaceContextFromAuth` resolves one; every unreadable input fails soft to "attended".
+ */
+async function publishIsUnattended(auth) {
+    if (auth === undefined || auth === null)
+        return false;
+    const ctx = await surfaceContextFromAuth(auth).catch(() => null);
+    if (ctx === null)
+        return false;
+    try {
+        return unattendedOf(ctx);
+    }
+    catch {
+        return false; // an unbindable surface — stand down, and the card still stands
+    }
+}
+// Input-aware: user approval only when the input carries an HTML artifact AND the org has opted in to Blob hosting — exactly the calls that will publish. `resolveBlobHosting` is fail-closed, so an unconfigured org stays ungated.
+// The attendedness read runs LAST, on the publish arm only, so an ungated call pays for no resolve and gains no new way to fail.
+const approvalPolicy = async (approvalCtx) => {
+    const files = approvalCtx.toolInput?.files ?? [];
+    const willPublish = resolveBlobHosting().enabled && files.some(inputFileIsHtml);
+    if (!willPublish)
+        return "not-applicable";
+    if (await publishIsUnattended(approvalCtx.session?.auth)) {
+        return { type: "denied", reason: UNATTENDED_PUBLISH_REFUSAL };
+    }
+    return "user-approval";
+};
+// The HTML sentence states THIS org's real Blob-hosting state. A conditional sentence made the model guess the branch, and gpt-6-luna renamed a page to `.txt` to dodge a publish that could not happen (OPE-2075).
+function htmlPagesSentence(hostingEnabled) {
+    return hostingEnabled
+        ? "HTML pages: this org has opted in to Blob hosting, so an HTML page is published to a public URL. " +
+            "Each publish needs user approval."
+        : "HTML pages: this org has not opted in to Blob hosting. An HTML page is attached as a downloadable " +
+            "file, exactly like any other file. Nothing is ever published or made public. Keep the real " +
+            "filename and extension (`page.html`, `text/html`). Do not rename it to `.txt`.";
+}
+/** The full `post_file` description for an org with Blob hosting on or off. Exported for the test. */
+export function postFileDescription(hostingEnabled) {
+    return ("Post one or more FILES/artifacts (screenshots, images, docs, data) to the current conversation " +
+        "on this surface — the delivery channel for things a text reply can't carry. Give each file a " +
+        "`source: { path }` — a file in THIS session's workspace/sandbox (e.g. a bash-written artifact, " +
+        "or an agent-browser screenshot) — and a `filename`; `contentType` is inferred from the filename " +
+        "if omitted. Each file is capped at 10 MB. Add an optional `comment` to post alongside the files, " +
+        "and a per-file `caption`. Works on Slack, Discord and Notion today (Notion accepts at most 3 " +
+        "files per post — a comment's own vendor cap); on other surfaces it returns a clear " +
+        "'not supported here' error so you can fall back to a text reply. " +
+        htmlPagesSentence(hostingEnabled));
+}
+export default windowGated("post_file", defineTool({
+    // Read once at module load: the tool module loads after the app config is registered, and the reviewed config does not change at runtime.
+    description: postFileDescription(resolveBlobHosting().enabled),
+    inputSchema,
+    outputSchema: z.object({ posted: z.boolean(), count: z.number(), platform: z.string(), urls: z.array(z.string()).optional() }),
+    // Since eve 0.47.3 deleted the follow-up park, the withDuplicateApprovalGuard wrap is the ONLY thing closing a duplicate card, and only for a byte-identical re-proposal — a publish of different files still raises its own.
+    // The response policy binds the click to the session initiator; it can refuse a responder but never deny the request, and a `cancel` click bypasses it entirely.
+    approval: { request: withDuplicateApprovalGuard(approvalPolicy), response: initiatorBoundResponsePolicy() },
+    async execute(input, ctx) {
+        const platform = bindFrom(ctx).platform;
+        if (platform !== "slack" && platform !== "discord" && platform !== "notion") {
+            throw new Error(`post_file: file posting is not supported on "${platform}" yet (supported: Slack, Discord, Notion). ` +
+                "Reply with text, or share a link to an already-hosted file instead.");
+        }
+        if (platform === "notion" && input.files.length > NOTION_MAX_POST_FILE_ATTACHMENTS) {
+            // Fail loud before any bytes are resolved or uploaded; the schema's own MAX_FILES is a cross-surface ceiling, not a Notion-specific one.
+            throw new Error(`post_file: Notion accepts at most ${NOTION_MAX_POST_FILE_ATTACHMENTS} files per post; got ${input.files.length}. Split them across multiple posts.`);
+        }
+        // Resolve every source to bytes + a content type up front, so a bad source fails BEFORE we
+        // start posting (no half-posted batch).
+        const resolved = [];
+        for (const f of input.files) {
+            const contentType = f.contentType ?? inferContentType(f.filename);
+            const bytes = await resolveBytes(f.source.path, ctx);
+            resolved.push({ bytes, filename: f.filename, contentType, caption: f.caption });
+        }
+        const hosting = resolveBlobHosting();
+        const toAttach = [];
+        const hostedUrls = [];
+        for (const file of resolved) {
+            if (isHtmlArtifact(file.contentType) && hosting.enabled) {
+                // Opted in → publish. Fail LOUD on a write/validation error — never silently fall back
+                // to attach, which would hide a Blob misconfig behind a working-looking download.
+                hostedUrls.push(await hostHtmlArtifact(file, { publicPrefix: hosting.publicPrefix }));
+            }
+            else {
+                toAttach.push(file);
+            }
+        }
+        // This execute is one eve step, so an interrupt after a post lands but before the step completes re-runs it on resume. postOnce keys on eve's replayed `callId` plus the content; attach and link posts take SEPARATE keys, because a crash between them must not suppress the second.
+        // The Blob publish is deliberately not wrapped (it is approval-gated), and postOnce fails open, so a dedupe-store outage still posts.
+        const binding = bindFrom(ctx);
+        // Notion's post-back address is `anchorChannelId` rather than `target.channelId`. This is dedupe-key material only, so an absent value makes the key coarser, never incorrect.
+        const channelId = typeof binding.target?.channelId === "string"
+            ? binding.target.channelId
+            : typeof binding.anchorChannelId === "string"
+                ? binding.anchorChannelId
+                : undefined;
+        const callId = typeof ctx.callId === "string" ? ctx.callId : undefined;
+        // `attachId` is the delivered message id, present only when the surface's own response names one — Discord and Notion do, Slack's completeUploadExternal does not.
+        let attachId;
+        if (toAttach.length > 0) {
+            attachId = await postOnce({
+                org: binding.org,
+                key: outboundKey({
+                    surface: platform,
+                    channel: channelId,
+                    threadTs: binding.threadTs,
+                    action: `${platform}.post_file.attach`,
+                    stableId: callId,
+                    payload: `${input.comment ?? ""}\x00${toAttach.map((f) => `${f.filename}:${f.contentType}:${f.bytes.byteLength}`).join(",")}`,
+                }),
+                run: async () => {
+                    if (platform === "slack")
+                        return await postFilesToSlack(ctx, toAttach, input.comment);
+                    if (platform === "discord")
+                        return await postFilesToDiscord(ctx, toAttach, input.comment);
+                    return await postFilesToNotion(ctx, toAttach, input.comment);
+                },
+            });
+        }
+        // Post the hosted URL(s) as a text message. If there were ALSO attachments, the comment
+        // already rode with them, so don't repeat it on the link message. `linkId` is this message's
+        // own id (OPE-932) — both surfaces' text-post response names one.
+        let linkId;
+        if (hostedUrls.length > 0) {
+            linkId = await postOnce({
+                org: binding.org,
+                key: outboundKey({
+                    surface: platform,
+                    channel: channelId,
+                    threadTs: binding.threadTs,
+                    action: `${platform}.post_file.link`,
+                    stableId: callId,
+                    payload: `${toAttach.length > 0 ? "" : (input.comment ?? "")}\x00${hostedUrls.join(",")}`,
+                }),
+                run: () => postLinkToSurface(ctx, platform, hostedUrls, toAttach.length > 0 ? undefined : input.comment),
+            });
+        }
+        // Audit AFTER a successful post: what went where and how many were hosted versus attached, never the bytes, the token or the URL.
+        // A batch that posts both an attach message and a hosted-link message keeps only the attach id — one row cannot attest two independent posts, and the attach message is the one a driver polls for.
+        const deliveredId = attachId ?? linkId;
+        await auditToolAction(ctx, `${platform}.post_file`, {
+            count: resolved.length,
+            filenames: resolved.map((f) => f.filename),
+            hasComment: Boolean(input.comment),
+            hosted: hostedUrls.length,
+            attached: toAttach.length,
+            ...(deliveredId ? { id: deliveredId } : {}),
+        });
+        return { posted: true, count: resolved.length, platform, ...(hostedUrls.length > 0 ? { urls: hostedUrls } : {}) };
+    },
+}));
+//# sourceMappingURL=post_file.js.map

package/dist/agent/tools/post_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post_file.js","sourceRoot":"","sources":["../../../agent/tools/post_file.ts"],"names":[],"mappings":"AAAA,2LAA2L;AAC3L,sMAAsM;AAEtM,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAGnF,MAAM,iBAAiB,GAAqC;IAC1D,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,eAAe;IACnB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC9E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB;IACzC,OAAO,WAAW,KAAK,WAAW,CAAC;AACrC,CAAC;AAQD,gKAAgK;AAChK,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,iBAAiB;AAE1D,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,GAAoB;IAC5D,MAAM,UAAU,GAAG,GAA+D,CAAC;IACnF,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,EAAiB,CAAC;IACtB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mBAAmB,KAAK,CAAC,UAAU,eAAe,cAAc,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,+IAA+I;AAC/I,KAAK,UAAU,eAAe,CAAC,GAAoB,EAAE,IAAY;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,8IAA8I;AAC9I,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAY;IACjE,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,QAAgB,EAChB,IAAuB,EACvB,OAA2B;IAE3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,2KAA2K;AAC3K,oJAAoJ;AACpJ,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,KAA8B,EAAE,OAA2B;IAC/G,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,oJAAoJ;QACpJ,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAChI,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,2BAA2B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QAC9G,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAA2B;QACvC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/B,UAAU,EAAE,SAAS;KACtB,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5D,IAAI,OAAO;QAAE,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC;IAChD,MAAM,mBAAmB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,SAAS,CAAC,CAAC,6EAA6E;AACjG,CAAC;AAED,yJAAyJ;AACzJ,KAAK,UAAU,kBAAkB,CAAC,GAAoB,EAAE,KAA8B,EAAE,OAA2B;IACjH,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACxI,CAAC;IACD,qJAAqJ;IACrJ,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,iKAAiK;AACjK,2KAA2K;AAC3K,SAAS,mBAAmB,CAAC,GAAoB;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1I,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,KAA8B,EAAE,OAA2B;IAChH,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,IAAY;IAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qIAAqI;AACrI,4GAA4G;AAC5G,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;aACnC,QAAQ,CAAC,oNAAoN,CAAC;QACjO,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iFAAiF,CAAC;QACvH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACzG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KACnF,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,SAAS,CAAC;SACd,QAAQ,CAAC,uDAAuD,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CAC5F,CAAC,CAAC;AAGH,SAAS,eAAe,CAAC,CAAiC;IACxD,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,uNAAuN;AACvN,kJAAkJ;AAClJ,MAAM,0BAA0B,GAC9B,2GAA2G;IAC3G,kGAAkG;IAClG,kHAAkH,CAAC;AAErH;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAa;IAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,gEAAgE;IAChF,CAAC;AACH,CAAC;AAED,qOAAqO;AACrO,iIAAiI;AACjI,MAAM,cAAc,GAA4B,KAAK,EAAE,WAAW,EAAE,EAAE;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW;QAAE,OAAO,gBAAgB,CAAC;IAC1C,IAAI,MAAM,mBAAmB,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC,CAAC;AAEF,oNAAoN;AACpN,SAAS,iBAAiB,CAAC,cAAuB;IAChD,OAAO,cAAc;QACnB,CAAC,CAAC,mGAAmG;YACjG,mCAAmC;QACvC,CAAC,CAAC,oGAAoG;YAClG,6FAA6F;YAC7F,gFAAgF,CAAC;AACzF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,mBAAmB,CAAC,cAAuB;IACzD,OAAO,CACL,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,mGAAmG;QACnG,+FAA+F;QAC/F,qFAAqF;QACrF,mEAAmE;QACnE,iBAAiB,CAAC,cAAc,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,eAAe,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC;IACjD,0IAA0I;IAC1I,WAAW,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC;IAC9D,WAAW;IACX,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9H,8NAA8N;IAC9N,iKAAiK;IACjK,QAAQ,EAAE,EAAE,OAAO,EAAE,0BAA0B,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAiB,EAAE;IAC1H,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAsB,CAAC,CAAC,QAAQ,CAAC;QAC3D,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,6CAA6C;gBACnG,qEAAqE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,gCAAgC,EAAE,CAAC;YACnF,yIAAyI;YACzI,MAAM,IAAI,KAAK,CACb,qCAAqC,gCAAgC,wBAAwB,KAAK,CAAC,KAAK,CAAC,MAAM,qCAAqC,CACrJ,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,wCAAwC;QACxC,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAsB,CAAC,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxD,uFAAuF;gBACvF,kFAAkF;gBAClF,UAAU,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,uRAAuR;QACvR,sIAAsI;QACtI,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAsB,CAAC,CAAC;QACjD,+KAA+K;QAC/K,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ;YAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;YAC1B,CAAC,CAAC,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,MAAM,GAAG,OAAQ,GAA4B,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzH,mKAAmK;QACnK,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,GAAG,MAAM,QAAQ,CAAC;gBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,WAAW,CAAC;oBACf,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,GAAG,QAAQ,mBAAmB;oBACtC,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBAC9H,CAAC;gBACF,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,QAAQ,KAAK,OAAO;wBAAE,OAAO,MAAM,gBAAgB,CAAC,GAAsB,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzG,IAAI,QAAQ,KAAK,SAAS;wBAAE,OAAO,MAAM,kBAAkB,CAAC,GAAsB,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC7G,OAAO,MAAM,iBAAiB,CAAC,GAAsB,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,6FAA6F;QAC7F,kEAAkE;QAClE,IAAI,MAA0B,CAAC;QAC/B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,QAAQ,CAAC;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,WAAW,CAAC;oBACf,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,GAAG,QAAQ,iBAAiB;oBACpC,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBAC1F,CAAC;gBACF,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;aAC5H,CAAC,CAAC;QACL,CAAC;QAED,kIAAkI;QAClI,oMAAoM;QACpM,MAAM,WAAW,GAAG,QAAQ,IAAI,MAAM,CAAC;QACvC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,QAAQ,YAAY,EAAE;YAClD,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1C,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAClC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpH,CAAC;CACF,CAAC,CAAC,CAAC"}

package/dist/agent/tools/post_message.d.ts

@@ -0,0 +1,32 @@
+declare const _default: import("eve/tools").DynamicSentinel<(import("eve/tools").ToolDefinition<{
+    container: string;
+    text: string;
+}, {
+    pending: boolean;
+    pendingId?: string | undefined;
+    platform: string;
+    container: string;
+    message: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        container: string;
+        text: string;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        pending: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        platform: string;
+        container: string;
+        message: string;
+    } | {
+        autoApproved?: undefined;
+        pending: boolean;
+        pendingId: string;
+        platform: string;
+        container: string;
+        message: string;
+    }>;
+}) | null>;
+export default _default;
+//# sourceMappingURL=post_message.d.ts.map

package/dist/agent/tools/post_message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post_message.d.ts","sourceRoot":"","sources":["../../../agent/tools/post_message.ts"],"names":[],"mappings":""}

package/dist/agent/tools/post_message.js

@@ -0,0 +1,158 @@
+// post_message PROPOSES posting a message into ANOTHER container in this session's own memory domain — the first chat WRITE that is not bound to the container the turn arrived in. It is not `reply` under a new name: `reply` speaks in the room that asked, takes no destination and needs no grant, while this verb names a DESTINATION and so trips the AUDIENCE axis by definition, interrupting humans who did not ask, in a room that did not ask. It mounts ONLY where config granted a container, so a deployment that declares nothing never sees it.
+// 🔴 The model naming a target is a deliberate relaxation of the rule that a channel id is always host-resolved from the binding — and it is relaxed BEHIND A GATE: the model may only name an address an operator already wrote in a bundle, that address must resolve into the caller's own memory domain, and a human reads the destination and the full body before a byte is posted. The model never reaches the transport; the approval action does, on a click. There is no `approval:` property at all; the consequential gate is the OE approvals plane.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { getConfig } from "../access/config.js";
+import { assertChatWriteAllowed, chatWriteMount, CONTAINER_RESOURCE_TYPE } from "../access/chat-write-grant.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+/** Domains, fail-soft — the shape every mount resolver takes. An empty list makes every gate below
+ *  fail closed, which is the honest direction: no readable domain means no provable in-domain
+ *  target. */
+function safeDomains() {
+    try {
+        return getConfig().loadDomains();
+    }
+    catch {
+        return [];
+    }
+}
+const postMessageEntry = defineTool({
+    description: "Post a message into ANOTHER container your domain owns — not the one you are talking in (use " +
+        "reply for that). Name the container by its granted address, e.g. " +
+        `"slack:${CONTAINER_RESOURCE_TYPE}/C0123ABC". Only containers an operator granted in config and ` +
+        "that belong to this session's own memory domain can be named; anything else refuses and says " +
+        "which boundary stopped it. Consequential: it posts an approval card showing the destination " +
+        "and the exact message — nothing is posted until a human confirms.",
+    inputSchema: z.object({
+        container: z
+            .string()
+            .min(1)
+            .describe(`The destination's granted address, in the form <connector>:${CONTAINER_RESOURCE_TYPE}/<id>.`),
+        text: z.string().min(1).describe("The exact message to post. A human reads this in full on the approval card."),
+    }),
+    outputSchema: z.object({
+        pending: z.boolean(),
+        pendingId: z.string().optional(),
+        platform: z.string(),
+        container: z.string(),
+        message: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    // NO `approval:` — see this file's header; the consequential gate is requestApproval below.
+    async execute(input, ctx) {
+        const bctx = ctx;
+        await requireSessionContinuation(bctx, "post_message");
+        // ONE config read, threaded to BOTH joins: the destination's fence and the card's venue walk
+        // must answer against the SAME domain list, or the gate can admit a container the venue walk
+        // then cannot explain.
+        const domains = safeDomains();
+        // THE FENCE, before any card posts: the grant AND the caller's own domain roster. It returns the
+        // resolved target, so what gets frozen below is exactly what the fence admitted — never a second
+        // parse of the model's string.
+        const target = await assertChatWriteAllowed(bctx, domains, input.container);
+        const binding = bindFrom(ctx);
+        const p = resolvePartition(ctx);
+        // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+        // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+        // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+        // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+        // every unknown, so a single-wake turn is unchanged.
+        // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+        // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+        // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+        // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+        // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+        // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+        // conversation whose envelope is in the seat's shared context, through the reply fence's
+        // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+        // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+        // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+        // the merge road's impossibility.
+        // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+        // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+        // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+        // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+        // own target is a design choice this task does not hold.
+        const proposeScopeKey = await proposalScopeKey(ctx, p);
+        // WHERE THE CARD GOES: this room when it can host one, else a card-capable channel in the SAME
+        // domain (approvals/card-venue.ts). The destination is already frozen and unaffected — the venue
+        // decides who READS the text before it publishes, never where it publishes to.
+        const venueResult = await checkApprovalVenue(binding, p, () => domains);
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "post that message"));
+        }
+        const venue = venueResult.venue;
+        // principal-gate: accountability — somebody NAMEABLE must exist (a card needs an "asked by" line). A fire's attested creator satisfies this, correctly.
+        // PRESENCE would be the WRONG question here, exactly as it is for create_ticket: a routine that
+        // posts a digest into another container is the product, so a fire must pass. What the card needs
+        // is a name to show, and a post attributed to nobody is what the audience axis makes
+        // unacceptable. The unattended case is bounded elsewhere — `post_message` is absent from
+        // JOB_WAKE_TOOLS, so a restricted job wake never holds it.
+        const requestedBy = principalIdOf(ctx);
+        if (!requestedBy) {
+            throw new Error("post_message needs a verified sender to gate the post — no principal id resolved, so there's no requester to show on the approval card.");
+        }
+        const args = {
+            org: p.org,
+            scopeKey: proposeScopeKey,
+            platform: target.platform,
+            container: target.container,
+            grant: target.address,
+            text: input.text,
+            requestedBy,
+            tainted: untrustedIngestedThisTurn(),
+        };
+        const posted = await requestApproval({
+            org: p.org,
+            kind: "chat.post",
+            args,
+            scopeKey: proposeScopeKey,
+            domain: null,
+            requestedBy,
+            channelId: venue.channelId,
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, approvalPostDeps(venue.platform, ctx));
+        const subject = `post into ${target.platform} container ${target.container}`;
+        if (posted.autoApproved) {
+            return {
+                pending: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                platform: target.platform,
+                container: target.container,
+                message: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            pending: true,
+            pendingId: posted.id,
+            platform: target.platform,
+            container: target.container,
+            message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to confirm (pending ${posted.id}).${cardPostedTail(venue, "confirm the post", posted)}`,
+        };
+    },
+});
+preRegisterDynamicEntry("post_message", "_single", postMessageEntry);
+export default defineDynamic({
+    events: {
+        // session.started ONLY — a session's grants and domain cannot change mid-session, so resolving
+        // once is correct and cheaper (the note read_work_channel.ts carries).
+        "session.started": (_event, ctx) => {
+            if (!chatWriteMount(ctx, safeDomains))
+                return null;
+            return postMessageEntry;
+        },
+    },
+});
+//# sourceMappingURL=post_message.js.map

package/dist/agent/tools/post_message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post_message.js","sourceRoot":"","sources":["../../../agent/tools/post_message.ts"],"names":[],"mappings":"AAAA,iiBAAiiB;AACjiB,kiBAAkiB;AAEliB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIpE;;cAEc;AACd,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,UAAU,CAAC;IAClC,WAAW,EACT,+FAA+F;QAC/F,mEAAmE;QACnE,UAAU,uBAAuB,gEAAgE;QACjG,+FAA+F;QAC/F,8FAA8F;QAC9F,mEAAmE;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,8DAA8D,uBAAuB,QAAQ,CAAC;QAC1G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6EAA6E,CAAC;KAChH,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,4FAA4F;IAC5F,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,IAAI,GAAG,GAAsB,CAAC;QACpC,MAAM,0BAA0B,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACvD,6FAA6F;QAC7F,6FAA6F;QAC7F,uBAAuB;QACvB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,iGAAiG;QACjG,iGAAiG;QACjG,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,6FAA6F;QAC7F,8FAA8F;QAC9F,0FAA0F;QAC1F,6FAA6F;QAC7F,qDAAqD;QACrD,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,mGAAmG;QACnG,4FAA4F;QAC5F,+FAA+F;QAC/F,kCAAkC;QAClC,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,yDAAyD;QACzD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,+FAA+F;QAC/F,iGAAiG;QACjG,+EAA+E;QAC/E,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAChC,wJAAwJ;QACxJ,gGAAgG;QAChG,iGAAiG;QACjG,qFAAqF;QACrF,yFAAyF;QACzF,2DAA2D;QAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yIAAyI,CAAC,CAAC;QAC7J,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,OAAO;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW;YACX,OAAO,EAAE,yBAAyB,EAAE;SACrC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,IAAI;YACZ,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC,EACD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACxD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,yCAAyC,MAAM,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE;SAC3J,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAErE,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,+FAA+F;QAC/F,uEAAuE;QACvE,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,CAAC,cAAc,CAAC,GAAsB,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtE,OAAO,gBAAgB,CAAC;QAC1B,CAAC;KACF;CACF,CAAC,CAAC"}