@openagentsy/hooks 0.0.0-stage → 0.2.1

package/dist/rules.test.js

@@ -0,0 +1,488 @@
+import { mkdir, mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createApprovalStore } from './approvals.js';
+import { defaultRules, isProtected } from './rules.js';
+// The fixture is assembled from segments on purpose: the value is the real
+// shape the rule pins, and the source carries no contiguous secret for a
+// scanner to flag. It is not a credential.
+const SECRET_VALUE = ['aB3dF6hJ', '9kM2nP5rT', '8vW1xZ4cE', '7gH0'].join('');
+const SECRET_CONTENT = `api_key = ${SECRET_VALUE}`;
+/** The name of the workspace fixture, so the worktree path can be pinned. */
+const WORKSPACE_NAME = 'oa-workspace-fixture';
+/** The reason a result carries, when it stops the call. */
+function reasonOf(result) {
+    return 'reason' in result ? result.reason : undefined;
+}
+/** Whether a result lets the call through. */
+function continues(result) {
+    return 'continue' in result ? result.continue : true;
+}
+let workspace;
+let stateRoot;
+let rules;
+beforeEach(async () => {
+    const base = await mkdtemp(join(tmpdir(), 'oa-wt-'));
+    workspace = join(base, WORKSPACE_NAME);
+    await mkdir(workspace, { recursive: true });
+    stateRoot = await mkdtemp(join(tmpdir(), 'oa-state-'));
+    rules = defaultRules({ workspace, stateRoot, home: '/home/dev' });
+});
+function ruleOf(id) {
+    const found = rules.find((rule) => rule.id === id);
+    if (found === undefined)
+        throw new Error(`no rule called ${id}`);
+    return found;
+}
+async function decide(id, event) {
+    return ruleOf(id).handler(event);
+}
+/** The event a shell call arrives as. */
+function shell(command, extra = {}) {
+    return { toolName: 'bash', args: {}, files: [], command, ...extra };
+}
+/** The event a file write arrives as. */
+function write(path, content = '') {
+    return { toolName: 'write', args: { filePath: path, content }, files: [{ path }] };
+}
+describe('the default rules', () => {
+    it('is the seven rules of the plan, in the plan order', () => {
+        expect(rules.map((rule) => rule.id)).toEqual([
+            'no-skip-git-hooks',
+            'package-manager',
+            'workspace-writes-only',
+            'protect-policy',
+            'human-only-decisions',
+            'secret-scan-writes',
+            'destructive-needs-approval',
+        ]);
+    });
+    it('blocks every one of them', () => {
+        for (const rule of rules)
+            expect(rule.block).toBe(true);
+    });
+    it('is checked before a tool call', () => {
+        for (const rule of rules)
+            expect(rule.event).toBe('PreToolCall');
+    });
+});
+describe('no-skip-git-hooks', () => {
+    it('blocks a commit that skips the hooks', async () => {
+        const result = await decide('no-skip-git-hooks', shell('git commit --no-verify -m "wip"'));
+        expect(continues(result)).toBe(false);
+    });
+    it('blocks a bare -n right after git commit', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -n')))).toBe(false);
+    });
+    it('blocks the -n behind the message', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -m "wip" -n')))).toBe(false);
+    });
+    it('blocks the -n behind another flag', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -a -n')))).toBe(false);
+    });
+    it('blocks the -n behind an amend', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit --amend -n')))).toBe(false);
+    });
+    it('blocks the -n in a flag cluster', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -nm "wip"')))).toBe(false);
+    });
+    it('blocks the husky switch', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('HUSKY=0 git commit -m "wip"')))).toBe(false);
+    });
+    it('lets a commit that only talks about -n through', async () => {
+        const result = await decide('no-skip-git-hooks', shell('git commit -m "fix -n handling"'));
+        expect(continues(result)).toBe(true);
+    });
+    it('lets a commit whose message names the long flag through', async () => {
+        const result = await decide('no-skip-git-hooks', shell('git commit -m "docs: note --no-verify"'));
+        expect(continues(result)).toBe(true);
+    });
+    it('blocks a commit that is passed as a quoted argument', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('bash -c "git commit -n"')))).toBe(false);
+        expect(continues(await decide('no-skip-git-hooks', shell('bash -c "git commit --no-verify"')))).toBe(false);
+        expect(continues(await decide('no-skip-git-hooks', shell('bash -c "HUSKY=0 git commit -m x"')))).toBe(false);
+    });
+    it('blocks the abbreviations of the long flag', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit --no-verif -m x')))).toBe(false);
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit --no-veri -m x')))).toBe(false);
+    });
+    it('lets the options that only look like the flag through', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit --no-verbose -m x')))).toBe(true);
+        expect(continues(await decide('no-skip-git-hooks', shell('git merge --no-verify-signatures')))).toBe(true);
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit --no-ver -m x')))).toBe(true);
+    });
+    it('lets a -n that belongs to another command through', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git merge -n')))).toBe(true);
+        expect(continues(await decide('no-skip-git-hooks', shell('git rebase -n')))).toBe(true);
+        expect(continues(await decide('no-skip-git-hooks', shell('sudo -n git commit -m x')))).toBe(true);
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -m add -- -n')))).toBe(true);
+    });
+    it('lets an ordinary commit through', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -m "wip"')))).toBe(true);
+    });
+});
+describe('package-manager', () => {
+    it('blocks another package manager', async () => {
+        expect(continues(await decide('package-manager', shell('pnpm add x')))).toBe(false);
+        expect(continues(await decide('package-manager', shell('npm install')))).toBe(false);
+        expect(continues(await decide('package-manager', shell('yarn add x')))).toBe(false);
+    });
+    it('blocks another package manager behind a path', async () => {
+        expect(continues(await decide('package-manager', shell('/usr/local/bin/pnpm add x')))).toBe(false);
+        expect(continues(await decide('package-manager', shell('./node_modules/.bin/pnpm add x')))).toBe(false);
+    });
+    it('blocks another package manager in another case', async () => {
+        expect(continues(await decide('package-manager', shell('PNPM add x')))).toBe(false);
+    });
+    it('lets bun through', async () => {
+        expect(continues(await decide('package-manager', shell('bun add x')))).toBe(true);
+    });
+});
+describe('workspace-writes-only', () => {
+    it('blocks a write outside the workspace', async () => {
+        const result = await decide('workspace-writes-only', write('/elsewhere/file.ts'));
+        expect(continues(result)).toBe(false);
+    });
+    it('lets a write inside the workspace through', async () => {
+        const result = await decide('workspace-writes-only', write(join(workspace, 'src/a.ts')));
+        expect(continues(result)).toBe(true);
+    });
+    it('lets a write inside a worktree of the project through', async () => {
+        // The path is pinned, so the test fails when the rule looks in the
+        // wrong place.
+        const result = await decide('workspace-writes-only', {
+            toolName: 'write',
+            args: { filePath: '/home/dev/.openagentsy/worktrees/oa-workspace-fixture/src/a.ts' },
+            files: [],
+        });
+        expect(continues(result)).toBe(true);
+    });
+    it('lets a read of a file through', async () => {
+        const result = await decide('workspace-writes-only', {
+            toolName: 'read',
+            args: { filePath: '/etc/passwd' },
+            files: [],
+        });
+        expect(continues(result)).toBe(true);
+    });
+    it('lets a search through', async () => {
+        const result = await decide('workspace-writes-only', {
+            toolName: 'grep',
+            args: { path: '/tmp' },
+            files: [],
+        });
+        expect(continues(result)).toBe(true);
+    });
+    it('lets a read of a file through, even when the host says which file it read', async () => {
+        const path = '.opencode/skills/openagentsy-review/SKILL.md';
+        const result = await decide('workspace-writes-only', {
+            toolName: 'read',
+            args: { filePath: path },
+            files: [{ path }],
+        });
+        expect(continues(result)).toBe(true);
+        const protectedResult = await decide('protect-policy', {
+            toolName: 'read',
+            args: { filePath: path },
+            files: [{ path }],
+        });
+        expect(continues(protectedResult)).toBe(true);
+    });
+    it('knows the tools a host composes', async () => {
+        for (const tool of ['write_file', 'create_file']) {
+            const result = await decide('workspace-writes-only', {
+                toolName: tool,
+                args: { filePath: '/elsewhere/file.ts' },
+                files: [],
+            });
+            expect(continues(result), tool).toBe(false);
+        }
+    });
+    it('lets a call that touches no file through', async () => {
+        expect(continues(await decide('workspace-writes-only', shell('ls -la')))).toBe(true);
+    });
+});
+describe('protect-policy', () => {
+    it('blocks the files a person changes', async () => {
+        const protectedPaths = [
+            'roles.yaml',
+            'openagentsy.models.lock.json',
+            'opencode.jsonc',
+            'biome.jsonc',
+            'turbo.json',
+            'bun.lock',
+            '.opencode/agents/lead.md',
+            '.husky/pre-commit',
+            '.github/workflows/check.yml',
+            'templates/.opencode/skills/x/SKILL.md',
+            '.openagentsy/lessons/one.json',
+            '.openagentsy/quality/waivers.json',
+            '.openagentsy/approvals.json',
+        ];
+        for (const path of protectedPaths) {
+            const result = await decide('protect-policy', write(join(workspace, path)));
+            expect(continues(result), path).toBe(false);
+        }
+    });
+    it('blocks a directory that is named without its slash', async () => {
+        for (const path of ['.opencode', 'templates', 'roles.yaml/']) {
+            expect(isProtected(path), path).toBe(true);
+            const result = await decide('protect-policy', write(path));
+            expect(continues(result), path).toBe(false);
+        }
+    });
+    it('blocks the lock of the approval store', async () => {
+        expect(isProtected('.openagentsy/approvals.json.lock')).toBe(true);
+        const result = await decide('protect-policy', write('.openagentsy/approvals.json.lock'));
+        expect(continues(result)).toBe(false);
+    });
+    it('lets a read of a policy file through', async () => {
+        const result = await decide('protect-policy', {
+            toolName: 'read',
+            args: { filePath: '.opencode/skills/openagentsy-review/SKILL.md' },
+            files: [],
+        });
+        expect(continues(result)).toBe(true);
+    });
+    it('lets an ordinary file through', async () => {
+        const result = await decide('protect-policy', write(join(workspace, 'src/a.ts')));
+        expect(continues(result)).toBe(true);
+    });
+});
+describe('human-only-decisions', () => {
+    it('blocks the three decision tools', async () => {
+        for (const tool of [
+            'oa_lesson_decide',
+            'oa_quality_waive',
+            'openagentsy_oa_quality_waive',
+            'oa_memory_decide',
+        ]) {
+            const result = await decide('human-only-decisions', { toolName: tool, args: {}, files: [] });
+            expect(continues(result), tool).toBe(false);
+        }
+    });
+    it('blocks a decision tool behind a server prefix', async () => {
+        const result = await decide('human-only-decisions', {
+            toolName: 'openagentsy-lessons_oa_lesson_decide',
+            args: {},
+            files: [],
+        });
+        expect(continues(result)).toBe(false);
+    });
+    it('lets an ordinary tool through', async () => {
+        const result = await decide('human-only-decisions', {
+            toolName: 'oa_task_list',
+            args: {},
+            files: [],
+        });
+        expect(continues(result)).toBe(true);
+    });
+});
+describe('secret-scan-writes', () => {
+    it('blocks content that carries a secret', async () => {
+        const result = await decide('secret-scan-writes', write(join(workspace, 'src/a.ts'), SECRET_CONTENT));
+        expect(continues(result)).toBe(false);
+        expect(reasonOf(result)).toContain('credential');
+    });
+    it('lets clean content through', async () => {
+        const result = await decide('secret-scan-writes', write(join(workspace, 'src/a.ts'), 'export const answer = 42;'));
+        expect(continues(result)).toBe(true);
+    });
+    it('scans the content of the tools a host composes', async () => {
+        for (const tool of ['write_file', 'create_file']) {
+            const result = await decide('secret-scan-writes', {
+                toolName: tool,
+                args: { content: SECRET_CONTENT },
+                files: [],
+            });
+            expect(continues(result), tool).toBe(false);
+        }
+    });
+    it('finds a secret in the lines a patch adds', async () => {
+        const patch = ['*** Update File: src/a.ts', '@@', `+const api_key = '${SECRET_VALUE}';`].join('\n');
+        const result = await decide('secret-scan-writes', {
+            toolName: 'apply_patch',
+            args: { patchText: patch },
+            files: [{ path: 'src/a.ts' }],
+        });
+        expect(continues(result)).toBe(false);
+    });
+});
+describe('destructive-needs-approval', () => {
+    it('blocks a destructive command and names the escape hatch', async () => {
+        const result = await decide('destructive-needs-approval', shell('rm -rf /', { callID: 'call-9' }));
+        expect(continues(result)).toBe(false);
+        expect(reasonOf(result)).toContain('/oa approve <callID>');
+    });
+    it('blocks the destructive flags in any order', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm -fr /')))).toBe(false);
+        expect(continues(await decide('destructive-needs-approval', shell('rm -r -f /')))).toBe(false);
+    });
+    it('blocks the destructive flags in their long form', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm --recursive --force /')))).toBe(false);
+    });
+    it('blocks a destructive command behind a separator', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('ls;rm -rf /')))).toBe(false);
+        expect(continues(await decide('destructive-needs-approval', shell('ls && rm -rf /')))).toBe(false);
+    });
+    it('blocks a forced push and a hard reset', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('git push --force')))).toBe(false);
+        expect(continues(await decide('destructive-needs-approval', shell('git reset --hard HEAD')))).toBe(false);
+    });
+    it('lets an approved call through once', async () => {
+        await createApprovalStore(stateRoot).approve('call-9', Date.now(), 60_000);
+        const first = await decide('destructive-needs-approval', shell('rm -rf /', { callID: 'call-9' }));
+        expect(continues(first)).toBe(true);
+        const second = await decide('destructive-needs-approval', shell('rm -rf /', { callID: 'call-9' }));
+        expect(continues(second)).toBe(false);
+    });
+    it('blocks a removal whose flags come after the operand', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm build -rf')))).toBe(false);
+        expect(continues(await decide('destructive-needs-approval', shell('rm -r build -f')))).toBe(false);
+        expect(continues(await decide('destructive-needs-approval', shell('rm -r build --force')))).toBe(false);
+    });
+    it('lets a message that talks about a removal through', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('git commit -m "docs: explain rm -rf /"')))).toBe(true);
+        expect(continues(await decide('destructive-needs-approval', shell('git commit -m "never git push --force"')))).toBe(true);
+        expect(continues(await decide('destructive-needs-approval', shell('git commit -m "drop table in a migration"')))).toBe(true);
+    });
+    it('lets a removal that is not both recursive and forced through', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm -r build')))).toBe(true);
+        expect(continues(await decide('destructive-needs-approval', shell('rm -R build')))).toBe(true);
+        expect(continues(await decide('destructive-needs-approval', shell('rm -f /tmp/x')))).toBe(true);
+    });
+    it('blocks a recursive and forced removal in any spelling', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm -Rf /')))).toBe(false);
+    });
+    it('blocks a destructive command inside a substitution', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('echo $(rm -rf /)')))).toBe(false);
+    });
+    it('blocks a destructive command inside a quoted argument', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('bash -c "rm -rf /"')))).toBe(false);
+    });
+    it('lets an ordinary command through', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm build/output.txt')))).toBe(true);
+    });
+});
+describe('the raw host shape', () => {
+    it('reads the command out of the arguments', async () => {
+        const result = await decide('no-skip-git-hooks', {
+            toolName: 'bash',
+            args: { command: 'git commit --no-verify' },
+            files: [],
+        });
+        expect(continues(result)).toBe(false);
+    });
+    it('reads the file out of the arguments', async () => {
+        const result = await decide('workspace-writes-only', {
+            toolName: 'write',
+            args: { filePath: '/etc/passwd' },
+            files: [],
+        });
+        expect(continues(result)).toBe(false);
+    });
+    it('reads the content out of the arguments', async () => {
+        const result = await decide('secret-scan-writes', {
+            toolName: 'write',
+            args: { content: SECRET_CONTENT },
+            files: [],
+        });
+        expect(continues(result)).toBe(false);
+    });
+});
+describe('the commands that hide their payload', () => {
+    it('blocks a removal that hides in a substitution', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('git commit -m "$(rm -rf /tmp/victim)"')))).toBe(false);
+    });
+    it('blocks a hook skip that hides in a substitution', async () => {
+        expect(continues(await decide('no-skip-git-hooks', shell('git commit -m "$(git commit -n)"')))).toBe(false);
+    });
+    it('blocks a removal that hides in a process substitution', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('git commit -F <(rm -rf /)')))).toBe(false);
+    });
+    it('blocks a removal behind another command', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('unshare -m rm -rf /tmp/x')))).toBe(false);
+    });
+    it('blocks another package manager that hides in a substitution', async () => {
+        expect(continues(await decide('package-manager', shell('echo $(pnpm add x)')))).toBe(false);
+    });
+});
+describe('the removals of two segments', () => {
+    it('lets them through when neither is dangerous', async () => {
+        expect(continues(await decide('destructive-needs-approval', shell('rm -r build; rm -f /tmp/x')))).toBe(true);
+        expect(continues(await decide('destructive-needs-approval', shell('rm build && tar -rf archive.tar file')))).toBe(true);
+    });
+});
+describe('the tools a host composes', () => {
+    it('treats an unknown name that carries files as a writer', async () => {
+        const path = '.opencode/skills/openagentsy-review/SKILL.md';
+        const copy = await decide('protect-policy', {
+            toolName: 'copy_file',
+            args: { filePath: path },
+            files: [{ path }],
+        });
+        expect(continues(copy)).toBe(false);
+    });
+    it('blocks a write outside the workspace', async () => {
+        for (const tool of ['push_files', 'upload_file']) {
+            const result = await decide('workspace-writes-only', {
+                toolName: tool,
+                args: { filePath: '/elsewhere/a.ts' },
+                files: [{ path: '/elsewhere/a.ts' }],
+            });
+            expect(continues(result), tool).toBe(false);
+        }
+    });
+    it('scans the content of a tool it does not know', async () => {
+        const result = await decide('secret-scan-writes', {
+            toolName: 'save_file',
+            args: { content: SECRET_CONTENT, filePath: 'a.ts' },
+            files: [{ path: 'a.ts' }],
+        });
+        expect(continues(result)).toBe(false);
+    });
+    it('blocks a directory a person changes', async () => {
+        const result = await decide('protect-policy', {
+            toolName: 'create_directory',
+            args: { filePath: '.opencode/skills' },
+            files: [{ path: '.opencode/skills' }],
+        });
+        expect(continues(result)).toBe(false);
+    });
+});
+describe('the removals in a subshell', () => {
+    it('blocks a removal behind the punctuation of the shell', async () => {
+        const commands = [
+            '(rm -rf /tmp/victim)',
+            'bash -c "(rm -rf /tmp/victim)"',
+            "sh -c '(rm -rf /tmp/victim)'",
+            'time (rm -rf /tmp/victim)',
+            '\\rm -rf /tmp/victim',
+            '( rm -rf /tmp/victim )',
+        ];
+        for (const command of commands) {
+            const result = await decide('destructive-needs-approval', shell(command));
+            expect(continues(result), command).toBe(false);
+        }
+    });
+});
+describe('a name the matcher does not know', () => {
+    it('treats a call that carries files as a writer', async () => {
+        const result = await decide('protect-policy', {
+            toolName: 'some_new_tool',
+            args: { filePath: '.opencode/skills/openagentsy-review/SKILL.md' },
+            files: [{ path: '.opencode/skills/openagentsy-review/SKILL.md' }],
+        });
+        expect(continues(result)).toBe(false);
+    });
+    it('treats a call that carries content as a writer', async () => {
+        const result = await decide('secret-scan-writes', {
+            toolName: 'some_new_tool',
+            args: { content: SECRET_CONTENT },
+            files: [],
+        });
+        expect(continues(result)).toBe(false);
+    });
+});
+//# sourceMappingURL=rules.test.js.map

package/dist/rules.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.test.js","sourceRoot":"","sources":["../src/rules.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvD,2EAA2E;AAC3E,yEAAyE;AACzE,2CAA2C;AAC3C,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7E,MAAM,cAAc,GAAG,aAAa,YAAY,EAAE,CAAC;AAEnD,6EAA6E;AAC7E,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,MAAqB;IACrC,OAAO,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,8CAA8C;AAC9C,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,IAAI,SAAiB,CAAC;AACtB,IAAI,SAAiB,CAAC;AACtB,IAAI,KAAa,CAAC;AAElB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACvC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,KAAK,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,EAAU;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAU,EAAE,KAAc;IAC9C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,yCAAyC;AACzC,SAAS,KAAK,CAAC,OAAe,EAAE,QAAiC,EAAE;IACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,yCAAyC;AACzC,SAAS,KAAK,CAAC,IAAY,EAAE,OAAO,GAAG,EAAE;IACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,mBAAmB;YACnB,iBAAiB;YACjB,uBAAuB;YACvB,gBAAgB;YAChB,sBAAsB;YACtB,oBAAoB;YACpB,4BAA4B;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,mBAAmB,EACnB,KAAK,CAAC,wCAAwC,CAAC,CAChD,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;QACF,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CACzF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5F,KAAK,CACN,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1F,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;QACF,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CACpF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,mEAAmE;QACnE,eAAe;QACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,gEAAgE,EAAE;YACpF,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACjC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACtB,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,IAAI,GAAG,8CAA8C,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;YACrD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;gBACnD,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE;gBACxC,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,cAAc,GAAG;YACrB,YAAY;YACZ,8BAA8B;YAC9B,gBAAgB;YAChB,aAAa;YACb,YAAY;YACZ,UAAU;YACV,0BAA0B;YAC1B,mBAAmB;YACnB,6BAA6B;YAC7B,uCAAuC;YACvC,+BAA+B;YAC/B,mCAAmC;YACnC,6BAA6B;SAC9B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;YAC5C,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,8CAA8C,EAAE;YAClE,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,KAAK,MAAM,IAAI,IAAI;YACjB,kBAAkB;YAClB,kBAAkB;YAClB,8BAA8B;YAC9B,kBAAkB;SACnB,EAAE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE;YAClD,QAAQ,EAAE,sCAAsC;YAChD,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE;YAClD,QAAQ,EAAE,cAAc;YACxB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,oBAAoB,EACpB,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,CACnD,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,oBAAoB,EACpB,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAChE,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE;gBAChD,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACjC,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,KAAK,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,qBAAqB,YAAY,IAAI,CAAC,CAAC,IAAI,CAC3F,IAAI,CACL,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE;YAChD,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC1B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,4BAA4B,EAC5B,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACxC,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CACzF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChG,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,KAAK,CACN,CAAC;QACF,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CACtF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CACxB,4BAA4B,EAC5B,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACxC,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,4BAA4B,EAC5B,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACxC,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,KAAK,CACN,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;QACF,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACpF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CACJ,SAAS,CACP,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAC5F,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,SAAS,CACP,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAC5F,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,SAAS,CACP,MAAM,MAAM,CACV,4BAA4B,EAC5B,KAAK,CAAC,2CAA2C,CAAC,CACnD,CACF,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE;YAC/C,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;YAC3C,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACjC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE;YAChD,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACjC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,CACJ,SAAS,CACP,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAC3F,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAC1F,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CACzF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CACJ,SAAS,CAAC,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAC1F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,SAAS,CACP,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAC1F,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,8CAA8C,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;YAC1C,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE;gBACnD,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE;gBACrC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;aACrC,CAAC,CAAC;YACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE;YAChD,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;YACnD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;YAC5C,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;YACtC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG;YACf,sBAAsB;YACtB,gCAAgC;YAChC,8BAA8B;YAC9B,2BAA2B;YAC3B,sBAAsB;YACtB,wBAAwB;SACzB,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE;YAC5C,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,EAAE,QAAQ,EAAE,8CAA8C,EAAE;YAClE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE;YAChD,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACjC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The redaction every stored thing goes through.
+ *
+ * The patterns live in core, because the memory slice needed them first
+ * and two copies of a secret pattern are two things to keep in step. This
+ * is the one door: a board record, a harvested memory candidate, a lesson
+ * summary. The count is what the Accountability block shows.
+ *
+ * The known gap stays where the plan records it: the entropy guard is
+ * strictly above 4.0 bits per character, so a pure-hex value of 32
+ * characters is never flagged. The helper is core's, and 2f owns the fix.
+ */
+export declare function redactForStorage(s: string): {
+    text: string;
+    count: number;
+};
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAE3E"}

package/dist/secrets.js

@@ -0,0 +1,17 @@
+import { redact } from '@openagentsy/core';
+/**
+ * The redaction every stored thing goes through.
+ *
+ * The patterns live in core, because the memory slice needed them first
+ * and two copies of a secret pattern are two things to keep in step. This
+ * is the one door: a board record, a harvested memory candidate, a lesson
+ * summary. The count is what the Accountability block shows.
+ *
+ * The known gap stays where the plan records it: the entropy guard is
+ * strictly above 4.0 bits per character, so a pure-hex value of 32
+ * characters is never flagged. The helper is core's, and 2f owns the fix.
+ */
+export function redactForStorage(s) {
+    return redact(s);
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../src/secrets.test.ts"],"names":[],"mappings":""}

package/dist/secrets.test.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { redactForStorage } from './secrets.js';
+// The fixture is assembled from segments on purpose: the value is the real
+// shape the helper pins, and the source carries no contiguous secret for a
+// scanner to flag. It is not a credential.
+const OPENAI_KEY = ['sk', '-ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'].join('');
+describe('redactForStorage', () => {
+    it('redacts a secret and reports the count', () => {
+        const result = redactForStorage(`the key is ${OPENAI_KEY}`);
+        expect(result.count).toBe(1);
+        expect(result.text).not.toContain('ABCDEFGH');
+        expect(result.text).toContain('«redacted:openai-key»');
+    });
+    it('leaves clean text alone', () => {
+        const result = redactForStorage('the build is green');
+        expect(result.count).toBe(0);
+        expect(result.text).toBe('the build is green');
+    });
+});
+//# sourceMappingURL=secrets.test.js.map

package/dist/secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.js","sourceRoot":"","sources":["../src/secrets.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,2EAA2E;AAC3E,2EAA2E;AAC3E,2CAA2C;AAC3C,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE5E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/shell-env.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The environment every agent shell sees.
+ *
+ * The shell env hook tightens only: it removes the switches that skip the
+ * hooks and the keys that belong to the board, and it marks the shell as
+ * an agent's. It never adds a credential, because a credential in a shell
+ * is a credential in every log the shell writes.
+ */
+/** The variables that are removed. */
+export declare const STRIPPED_ENV_VARS: readonly ["HUSKY", "HUSKY_SKIP_HOOKS", "SKIP_SIMPLE_GIT_HOOKS", "TOGETHER_API_KEY", "TYPESAFE_API_KEY"];
+/**
+ * Apply the policy to a shell environment.
+ *
+ * The environment is changed in place, because that is the shape the host
+ * hands over: the shell env hook fills an object and the shell reads it, and
+ * the V2 shell domain hands the plugin the same object before the child is
+ * spawned.
+ *
+ * The values are optional, because the V2 event types the environment of a
+ * shell that way. A key that is absent is a key that is not there.
+ */
+export declare function applyShellEnvPolicy(env: Record<string, string | undefined>): void;
+//# sourceMappingURL=shell-env.d.ts.map

package/dist/shell-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-env.d.ts","sourceRoot":"","sources":["../src/shell-env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,yGAMpB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAIjF"}