@provos/ironcurtain 0.6.0 → 0.7.1

package/dist/trusted-process/policy-engine.js

@@ -12,30 +12,9 @@
  *          The most restrictive result wins: deny > escalate > allow.
  *          Roles already resolved by sandbox containment are skipped.
  */
-import { getPathRoles, getUrlRoles, getRoleDefinition, resolveRealPath, SANDBOX_SAFE_PATH_ROLES, } from '../types/argument-roles.js';
-import { domainMatchesAllowlist, isIpAddress, resolveGitRemote, extractDomainForRole } from './domain-utils.js';
+import { getPathRoles, getUrlRoles, getRoleDefinition, resolveRealPath, resolveStoredAnnotation, SANDBOX_SAFE_PATH_ROLES, } from '../types/argument-roles.js';
+import { domainMatchesAllowlist, isIpAddress, resolveGitRemote, resolveDefaultGitRemote, extractDomainForRole, } from './domain-utils.js';
 import { getListMatcher } from '../pipeline/dynamic-list-types.js';
-/**
- * Heuristically extracts filesystem paths from tool call arguments.
- * Any string value starting with '/', '.', or '~' is treated as a path.
- * Handles both single string values and arrays of strings.
- */
-function extractPathsHeuristic(args) {
-    const paths = [];
-    for (const value of Object.values(args)) {
-        if (typeof value === 'string' && (value.startsWith('/') || value.startsWith('.') || value.startsWith('~'))) {
-            paths.push(value);
-        }
-        else if (Array.isArray(value)) {
-            for (const item of value) {
-                if (typeof item === 'string' && (item.startsWith('/') || item.startsWith('.') || item.startsWith('~'))) {
-                    paths.push(item);
-                }
-            }
-        }
-    }
-    return paths;
-}
 /**
  * Extracts string values from arguments based on annotation roles.
  * Only returns values for arguments whose annotated roles intersect
@@ -239,6 +218,16 @@ function expandListReferences(policy, lists) {
     });
     return { ...policy, rules: expandedRules };
 }
+/** Sentinel result returned when no rule matches (default-deny). */
+const DEFAULT_DENY_RESULT = Object.freeze({
+    decision: 'deny',
+    rule: 'default-deny',
+    reason: 'No matching policy rule -- denied by default',
+});
+/** Converts a matched compiled rule into an EvaluationResult. */
+function ruleToResult(rule) {
+    return { decision: rule.then, rule: rule.name, reason: rule.reason };
+}
 export class PolicyEngine {
     annotationMap;
     compiledPolicy;
@@ -264,17 +253,97 @@ export class PolicyEngine {
         }
         return map;
     }
-    /** Returns the annotation for a tool, or undefined if unknown. */
-    getAnnotation(serverName, toolName) {
+    /**
+     * Returns the resolved annotation for a specific tool call,
+     * with conditional role specs evaluated against the call arguments.
+     * Returns undefined for unknown tools.
+     */
+    getAnnotation(serverName, toolName, callArgs) {
+        const stored = this.annotationMap.get(`${serverName}__${toolName}`);
+        if (!stored)
+            return undefined;
+        return resolveStoredAnnotation(stored, callArgs);
+    }
+    /**
+     * Returns the stored (unresolved) annotation for a tool.
+     * Conditional role specs are not evaluated.
+     * Used by pipeline stages that need the raw conditional structure.
+     */
+    getStoredAnnotation(serverName, toolName) {
         return this.annotationMap.get(`${serverName}__${toolName}`);
     }
     evaluate(request) {
-        // Structural checks (may resolve some roles via sandbox containment)
-        const structural = this.evaluateStructuralInvariants(request);
+        // Resolve conditional roles once against the actual tool call arguments.
+        // After this point, `annotation` has the standard shape: args: Record<string, ArgumentRole[]>
+        const annotation = this.getAnnotation(request.serverName, request.toolName, request.arguments);
+        // Structural checks first (protected-path deny, sandbox containment).
+        // Git enrichment runs AFTER structural invariants so that protected-path
+        // checks and sandbox containment are evaluated on the raw request before
+        // any filesystem access (git config reads) occurs.
+        const structural = this.evaluateStructuralInvariants(request, annotation);
         if (structural.decision)
             return structural.decision;
+        // Git remote enrichment: when a git push/pull/fetch omits the remote arg,
+        // resolve the repo's configured default remote URL from the filesystem so
+        // the domain gate and compiled domains conditions can evaluate it.
+        // Safe to run now: structural checks have confirmed paths are within sandbox.
+        const effectiveRequest = this.enrichGitRequest(request, annotation);
         // Compiled rule evaluation (skipping sandbox-resolved roles)
-        return this.evaluateCompiledRules(request, structural.sandboxResolvedRoles);
+        return this.evaluateCompiledRules(effectiveRequest, structural.sandboxResolvedRoles, annotation);
+    }
+    /**
+     * Enriches a git tool call by resolving absent git-remote-url arguments
+     * to the repository's default remote URL.
+     *
+     * When an agent calls git_push/git_pull/git_fetch without an explicit
+     * remote, git uses the branch's configured upstream (or 'origin'). This
+     * method makes that implicit remote explicit so URL-aware policy checks
+     * (the structural domain gate and compiled domains conditions) fire correctly.
+     *
+     * Only applies to the 'git' server. No-ops when the remote arg is already
+     * present, when resolution fails, or when there is no annotation.
+     */
+    enrichGitRequest(request, annotation) {
+        if (request.serverName !== 'git' || !annotation)
+            return request;
+        // Collect git-remote-url annotated args whose value is absent or empty.
+        const missingUrlArgNames = [];
+        for (const [argName, roles] of Object.entries(annotation.args)) {
+            if (!roles.includes('git-remote-url'))
+                continue;
+            const value = request.arguments[argName];
+            const isAbsent = !(argName in request.arguments) || value === null || value === undefined || value === '';
+            if (isAbsent)
+                missingUrlArgNames.push(argName);
+        }
+        if (missingUrlArgNames.length === 0)
+            return request;
+        // Only attempt enrichment when a valid path is provided. Falling back to
+        // '.' would resolve the default remote from the trusted process working
+        // directory, which may point at an unrelated repository.
+        if (typeof request.arguments.path !== 'string')
+            return request;
+        // Gate on sandbox containment: only read git config from repos inside the
+        // allowed directory. Without this, an attacker-controlled path could trigger
+        // filesystem reads from arbitrary locations in the trusted process.
+        if (this.allowedDirectory) {
+            try {
+                const realPath = resolveRealPath(request.arguments.path);
+                if (!isWithinDirectory(realPath, this.allowedDirectory))
+                    return request;
+            }
+            catch {
+                return request; // path doesn't exist or can't be resolved
+            }
+        }
+        const resolvedUrl = resolveDefaultGitRemote(request.arguments.path);
+        if (resolvedUrl === undefined)
+            return request;
+        const enrichedArgs = { ...request.arguments };
+        for (const argName of missingUrlArgNames) {
+            enrichedArgs[argName] = resolvedUrl;
+        }
+        return { ...request, arguments: enrichedArgs };
     }
     /**
      * Hardcoded structural invariants.
@@ -285,20 +354,14 @@ export class PolicyEngine {
      * 3. Untrusted domain gate for url-category roles (escalate)
      * 4. Unknown tool denial (deny)
      *
-     * Uses the union of heuristic and annotation-based path extraction
-     * for defense-in-depth. Returns a StructuralResult with either a
-     * final decision or a set of roles resolved by sandbox containment.
+     * Returns a StructuralResult with either a final decision or a set
+     * of roles resolved by sandbox containment.
      */
-    evaluateStructuralInvariants(request) {
-        // Extract paths using both methods for defense-in-depth
-        const heuristicPaths = extractPathsHeuristic(request.arguments);
-        const annotation = this.annotationMap.get(`${request.serverName}__${request.toolName}`);
+    evaluateStructuralInvariants(request, annotation) {
         // Protected path check and sandbox containment use path-category roles only (not URL roles)
         const pathRoles = getPathRoles();
         const annotatedPaths = annotation ? extractAnnotatedPaths(request.arguments, annotation, pathRoles) : [];
-        // Union of both extraction methods, deduplicated
-        const allPaths = [...new Set([...heuristicPaths, ...annotatedPaths])];
-        const resolvedPaths = allPaths.map((p) => resolveRealPath(p));
+        const resolvedPaths = annotatedPaths.map((p) => resolveRealPath(p));
         // Protected path check -- any match is an immediate deny.
         for (const rp of resolvedPaths) {
             if (isProtectedPath(rp, this.protectedPaths, this.protectedPathExclusions)) {
@@ -326,17 +389,13 @@ export class PolicyEngine {
         }
         // Filesystem sandbox containment (path-category roles)
         //
-        // The sandbox auto-allow decision uses annotated paths when annotations
-        // exist (not heuristic paths). An arg annotated as 'none' should not
-        // grant sandbox containment even if the value looks like a path.
-        // Heuristic paths are only used for defense-in-depth on the deny side
-        // (protected path check).
-        //
-        // Only SANDBOX_SAFE_PATH_ROLES (read-path, write-path, delete-path) can
-        // be auto-resolved by sandbox containment. Higher-risk path roles like
-        // write-history and delete-history always fall through to compiled rule evaluation.
+        // Only SANDBOX_SAFE_PATH_ROLES (read-path, write-path, delete-path,
+        // write-history, delete-history) can be auto-resolved by sandbox containment.
+        // Rationale: if the agent can freely read/write/delete files in the sandbox,
+        // it can already manipulate .git/ contents directly, so history roles within
+        // the sandbox add no additional risk.
         const sandboxResolvedRoles = new Set();
-        const resolvedSandboxPaths = annotation ? annotatedPaths.map((p) => resolveRealPath(p)) : resolvedPaths;
+        const resolvedSandboxPaths = resolvedPaths;
         // Extract URL args once for use in both sandbox containment (fast-path guard) and untrusted domain gate
         const urlArgs = annotation ? extractAnnotatedUrls(request.arguments, annotation, getUrlRoles()) : [];
         // Determine if the tool has any non-sandbox-safe path roles
@@ -346,13 +405,14 @@ export class PolicyEngine {
             : false;
         if (this.allowedDirectory && resolvedSandboxPaths.length > 0) {
             const sandboxDir = this.allowedDirectory;
-            // Sandbox containment is only a structural allow for filesystem operations.
-            // For other servers, paths are locators (e.g. "which repo dir") — the
-            // operation itself needs compiled-rule evaluation regardless of path location.
             const isFilesystem = request.serverName === 'filesystem';
-            // Fast path: all annotated paths within sandbox -> auto-allow (filesystem only)
-            // Only fires when ALL path roles are sandbox-safe and no URL roles need checking
+            const isGit = request.serverName === 'git';
             const allWithinSandbox = resolvedSandboxPaths.every((rp) => isWithinDirectory(rp, sandboxDir));
+            // Fast path: all paths within sandbox, all roles sandbox-safe, no URL roles
+            // → auto-allow without compiled rule evaluation.
+            // Applies only to the filesystem server. Git operations can have
+            // non-filesystem side effects (e.g., network, credentials), so they must
+            // always pass through compiled-rule evaluation.
             if (isFilesystem && allWithinSandbox && urlArgs.length === 0 && !toolHasUnsafePathRoles) {
                 return finalDecision({
                     decision: 'allow',
@@ -360,11 +420,15 @@ export class PolicyEngine {
                     reason: `All paths are within the sandbox directory: ${sandboxDir}`,
                 });
             }
-            // Partial sandbox resolution (filesystem only): check each path role
-            // independently. A role is "sandbox-resolved" if every path for that
-            // role is within the sandbox. Only sandbox-safe roles can be resolved.
-            // Roles with zero extracted paths are not resolved.
-            if (isFilesystem && annotation) {
+            // Partial sandbox resolution: check each path role independently.
+            // A role is "sandbox-resolved" if every path for that role is within the
+            // sandbox, removing it from compiled-rule evaluation. Remaining roles
+            // (e.g., git-remote-url) still run through compiled rules.
+            //
+            // Applied to filesystem and git. For git tools with URL roles
+            // (e.g., git_clone with write-path + git-remote-url), the path role is
+            // sandbox-resolved while the URL role goes to compiled rules independently.
+            if ((isFilesystem || isGit) && annotation) {
                 for (const role of pathRoles) {
                     if (!SANDBOX_SAFE_PATH_ROLES.has(role))
                         continue;
@@ -393,7 +457,21 @@ export class PolicyEngine {
                 // to block structurally." URL roles are NOT marked as resolved;
                 // compiled rules still evaluate the operation (e.g. "escalate all git push").
             }
-            // If no allowlist, URL roles are not structurally restricted -- fall through to compiled rule evaluation
+            // KNOWN GAP: when no allowlist is configured for a server (e.g. the git
+            // server's allowedDomains is currently disabled — see mcp-servers.json
+            // _comment — due to a Linux SSH/sandbox-runtime limitation), the
+            // structural domain gate does not fire. In that case, compiled "allow"
+            // rules without a URL/domain constraint (e.g. allow-git-push-default-remote,
+            // allow-git-fetch-no-remote) will match even when an explicit unauthorized
+            // remote URL is supplied, because the rule was designed as a no-remote
+            // fallback but has no condition to distinguish the two cases.
+            //
+            // The correct long-term fix is Option A (skip no-constraint allow rules
+            // when concrete URL values are present during URL-role evaluation).
+            // Option C (structural gate) is the intended primary defense here, but
+            // requires allowedDomains to be configured. Until the sandbox-runtime
+            // SSH issue is resolved and allowedDomains can be re-enabled for the git
+            // server, this gap exists. See Issue 2 in the policy engine design notes.
         }
         // Unknown tool denial
         if (!annotation) {
@@ -416,8 +494,7 @@ export class PolicyEngine {
      * For tools with no roles (e.g., list_allowed_directories), the chain is
      * evaluated once without role filtering.
      */
-    evaluateCompiledRules(request, sandboxResolvedRoles) {
-        const annotation = this.annotationMap.get(`${request.serverName}__${request.toolName}`);
+    evaluateCompiledRules(request, sandboxResolvedRoles, annotation) {
         if (!annotation) {
             throw new Error(`Missing annotation for ${request.serverName}/${request.toolName} in compiled rule evaluation`);
         }
@@ -458,18 +535,10 @@ export class PolicyEngine {
     evaluateRulesUnscoped(request, annotation) {
         for (const rule of this.compiledPolicy.rules) {
             if (this.ruleMatches(rule, request, annotation)) {
-                return {
-                    decision: rule.then,
-                    rule: rule.name,
-                    reason: rule.reason,
-                };
+                return ruleToResult(rule);
             }
         }
-        return {
-            decision: 'deny',
-            rule: 'default-deny',
-            reason: 'No matching policy rule -- denied by default',
-        };
+        return DEFAULT_DENY_RESULT;
     }
     /**
      * Evaluates the rule chain for a single role.
@@ -495,18 +564,10 @@ export class PolicyEngine {
                 continue;
             }
             if (this.ruleMatches(rule, request, annotation, evaluatingRole)) {
-                return {
-                    decision: rule.then,
-                    rule: rule.name,
-                    reason: rule.reason,
-                };
+                return ruleToResult(rule);
             }
         }
-        return {
-            decision: 'deny',
-            rule: 'default-deny',
-            reason: 'No matching policy rule -- denied by default',
-        };
+        return DEFAULT_DENY_RESULT;
     }
     /**
      * Per-element path evaluation for roles with multiple paths.
@@ -548,22 +609,14 @@ export class PolicyEngine {
             // Discharge matched paths and record decision
             for (const p of matched)
                 remainingPaths.delete(p);
-            const result = {
-                decision: rule.then,
-                rule: rule.name,
-                reason: rule.reason,
-            };
+            const result = ruleToResult(rule);
             if (!mostRestrictive || DECISION_SEVERITY[result.decision] > DECISION_SEVERITY[mostRestrictive.decision]) {
                 mostRestrictive = result;
             }
         }
         // Any undischarged paths -> default-deny
         if (remainingPaths.size > 0) {
-            return {
-                decision: 'deny',
-                rule: 'default-deny',
-                reason: 'No matching policy rule -- denied by default',
-            };
+            return DEFAULT_DENY_RESULT;
         }
         if (!mostRestrictive) {
             throw new Error('unreachable: all paths discharged but no result was produced');
@@ -638,7 +691,11 @@ export class PolicyEngine {
         // Check lists conditions (non-domain list matching)
         if (cond.lists !== undefined) {
             for (const listCond of cond.lists) {
-                const extractRoles = evaluatingRole ? [evaluatingRole] : listCond.roles;
+                // Scope extraction to the evaluating role only when this list condition
+                // targets that role. Otherwise use the condition's own roles — this is
+                // necessary for multi-identifier rules (e.g. github-owner + github-repo)
+                // where each list condition targets a different role.
+                const extractRoles = evaluatingRole && listCond.roles.includes(evaluatingRole) ? [evaluatingRole] : listCond.roles;
                 const extractedValues = extractAnnotatedPaths(request.arguments, annotation, extractRoles);
                 // Zero values extracted = condition not satisfied, rule does not match
                 if (extractedValues.length === 0)

package/dist/trusted-process/policy-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../src/trusted-process/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAA6B;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3G,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACvG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAA6B,EAC7B,UAA0B,EAC1B,WAA2B;IAE3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,SAAiB;IAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,YAAoB,EAAE,cAAwB,EAAE,aAAuB,EAAE;IAChG,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAE/C,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEpC,gDAAgD;IAChD,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,iBAAiB,GAA8B,IAAI,GAAG,EAAE,CAAC;AAE/D,8DAA8D;AAC9D,SAAS,aAAa,CAAC,QAA0B;IAC/C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;AAC/D,CAAC;AAED,sFAAsF;AACtF,MAAM,iBAAiB,GAAyC;IAC9D,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;GAGG;AACH,SAAS,oBAAoB,CAAC,UAA0B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,oBAAoB;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,IAA6B,EAC7B,UAA0B,EAC1B,WAA2B;IAE3B,MAAM,IAAI,GAA0E,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY;YAAE,SAAS;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,KAAa,EACb,IAAkB,EAClB,OAAuB,EACvB,OAAgC;IAEhC,MAAM,QAAQ,GAAG,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;AAEtE;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,OAAO,CACL,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;QAC3B,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;QAC3B,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS;QAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAkB,EAAE,IAAkB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,KAAuB;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAA6B,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8DAA8D;YACtF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA0B,EAAE,KAAuB;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9C,IAAI,YAAY,GAAG,IAAI,CAAC;QAExB,uCAAuC;QACvC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YACpC,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5D,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAChF,CAAC;YACF,YAAY,GAAG;gBACb,GAAG,YAAY;gBACf,EAAE,EAAE;oBACF,GAAG,YAAY,CAAC,EAAE;oBAClB,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE;iBACtD;aACF,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACnD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC;gBACtE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAChF,CAAC;gBACF,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,YAAY,GAAG;gBACb,GAAG,YAAY;gBACf,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;aACjD,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,YAAY;IACf,aAAa,CAA8B;IAC3C,cAAc,CAAqB;IACnC,cAAc,CAAW;IACzB,uBAAuB,CAAW;IAClC,gBAAgB,CAAU;IAC1B,sBAAsB,CAAyC;IAEvE,YACE,cAAkC,EAClC,eAAoC,EACpC,cAAwB,EACxB,gBAAyB,EACzB,sBAA+D,EAC/D,YAA+B;QAE/B,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACzG,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,IAAI,IAAI,GAAG,EAAE,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAEO,kBAAkB,CAAC,WAAgC;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,kEAAkE;IAClE,aAAa,CAAC,UAAkB,EAAE,QAAgB;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,OAAwB;QAC/B,qEAAqE;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAEpD,6DAA6D;QAC7D,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,4BAA4B,CAAC,OAAwB;QAC3D,wDAAwD;QACxD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAExF,4FAA4F;QAC5F,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzG,iDAAiD;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9D,0DAA0D;QAC1D,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC3E,OAAO,aAAa,CAAC;oBACnB,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,2BAA2B;oBACjC,MAAM,EAAE,0CAA0C,EAAE,EAAE;iBACvD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,IACE,OAAO,CAAC,QAAQ,KAAK,0BAA0B;YAC/C,OAAO,CAAC,UAAU,KAAK,YAAY;YACnC,UAAU;YACV,CAAC,UAAU,CAAC,WAAW;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;YACD,OAAO,aAAa,CAAC;gBACnB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,2DAA2D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,sEAAsE;QACtE,0BAA0B;QAC1B,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,oFAAoF;QACpF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAgB,CAAC;QACrD,MAAM,oBAAoB,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAExG,wGAAwG;QACxG,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAErG,4DAA4D;QAC5D,MAAM,sBAAsB,GAAG,UAAU;YACvC,CAAC,CAAC,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC7E;YACH,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAEzC,4EAA4E;YAC5E,sEAAsE;YACtE,+EAA+E;YAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,YAAY,CAAC;YAEzD,gFAAgF;YAChF,iFAAiF;YACjF,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;YAE/F,IAAI,YAAY,IAAI,gBAAgB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACxF,OAAO,aAAa,CAAC;oBACnB,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,+CAA+C,UAAU,EAAE;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,oDAAoD;YACpD,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;gBAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACjD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;oBAClF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;wBAC3F,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAEtE,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;oBAC/C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;oBACjF,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;wBAC/C,OAAO,aAAa,CAAC;4BACnB,QAAQ,EAAE,UAAU;4BACpB,IAAI,EAAE,4BAA4B;4BAClC,MAAM,EAAE,eAAe,MAAM,yCAAyC,OAAO,CAAC,UAAU,GAAG;yBAC5F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,mEAAmE;gBACnE,gEAAgE;gBAChE,8EAA8E;YAChF,CAAC;YACD,yGAAyG;QAC3G,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,aAAa,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,iBAAiB,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAC5G,CAAC;IAED;;;;;;;;;;OAUG;IACK,qBAAqB,CAC3B,OAAwB,EACxB,oBAA+C;QAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,8BAA8B,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAElD,2DAA2D;QAC3D,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7E,mDAAmD;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,6DAA6D;YAC7D,0DAA0D;YAC1D,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,eAA6C,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,CAAC,eAAe,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzG,eAAe,GAAG,MAAM,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,OAAwB,EAAE,UAA0B;QAChF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBAChD,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,oBAAoB,CAC1B,OAAwB,EACxB,UAA0B,EAC1B,cAA4B;QAE5B,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACzF,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;gBAChE,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,0BAA0B,CAChC,OAAwB,EACxB,UAA0B,EAC1B,IAAkB,EAClB,KAAe;QAEf,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAA6C,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM;YAErC,uCAAuC;YACvC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEzE,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC;gBAAE,SAAS;YAE5E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,OAAiB,CAAC;YAEtB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,uEAAuE;gBACvE,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,IAAI,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;YACrC,CAAC;iBAAM,CAAC;gBACN,0DAA0D;gBAC1D,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;YAChC,CAAC;YAED,8CAA8C;YAC9C,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAElD,MAAM,MAAM,GAAqB;gBAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;YACF,IAAI,CAAC,eAAe,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzG,eAAe,GAAG,MAAM,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAkB,EAClB,OAAwB,EACxB,UAA0B;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC5C,CAAC;YACF,IAAI,CAAC,mBAAmB;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CACjB,IAAkB,EAClB,OAAwB,EACxB,UAA0B,EAC1B,cAA6B;QAE7B,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhF,wBAAwB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;YACzE,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAErF,sEAAsE;YACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEzC,wEAAwE;YACxE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;QAC/B,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;YACjC,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC;YAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAElF,yEAAyE;YACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBACjF,OAAO,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC9B,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxE,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAE3F,uEAAuE;gBACvE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAE/C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,cAAc;oBAAE,OAAO,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"policy-engine.js","sourceRoot":"","sources":["../../src/trusted-process/policy-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAcH,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAA6B,EAC7B,UAA0B,EAC1B,WAA2B;IAE3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,SAAiB;IAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,YAAoB,EAAE,cAAwB,EAAE,aAAuB,EAAE;IAChG,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAE/C,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEpC,gDAAgD;IAChD,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAeD,MAAM,iBAAiB,GAA8B,IAAI,GAAG,EAAE,CAAC;AAE/D,8DAA8D;AAC9D,SAAS,aAAa,CAAC,QAA0B;IAC/C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;AAC/D,CAAC;AAED,sFAAsF;AACtF,MAAM,iBAAiB,GAAyC;IAC9D,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;GAGG;AACH,SAAS,oBAAoB,CAAC,UAA0B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,oBAAoB;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,IAA6B,EAC7B,UAA0B,EAC1B,WAA2B;IAE3B,MAAM,IAAI,GAA0E,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY;YAAE,SAAS;QAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,KAAa,EACb,IAAkB,EAClB,OAAuB,EACvB,OAAgC;IAEhC,MAAM,QAAQ,GAAG,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;AAEtE;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,OAAO,CACL,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;QAC3B,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;QAC3B,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS;QAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAkB,EAAE,IAAkB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,KAAuB;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAA6B,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8DAA8D;YACtF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA0B,EAAE,KAAuB;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9C,IAAI,YAAY,GAAG,IAAI,CAAC;QAExB,uCAAuC;QACvC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;YACpC,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5D,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAChF,CAAC;YACF,YAAY,GAAG;gBACb,GAAG,YAAY;gBACf,EAAE,EAAE;oBACF,GAAG,YAAY,CAAC,EAAE;oBAClB,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE;iBACtD;aACF,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACnD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC;gBACtE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAChF,CAAC;gBACF,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,YAAY,GAAG;gBACb,GAAG,YAAY;gBACf,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;aACjD,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC7C,CAAC;AAED,oEAAoE;AACpE,MAAM,mBAAmB,GAAqB,MAAM,CAAC,MAAM,CAAC;IAC1D,QAAQ,EAAE,MAAM;IAChB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,8CAA8C;CACvD,CAAqB,CAAC;AAEvB,iEAAiE;AACjE,SAAS,YAAY,CAAC,IAAkB;IACtC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,YAAY;IACf,aAAa,CAAoC;IACjD,cAAc,CAAqB;IACnC,cAAc,CAAW;IACzB,uBAAuB,CAAW;IAClC,gBAAgB,CAAU;IAC1B,sBAAsB,CAAyC;IAEvE,YACE,cAAkC,EAClC,eAA0C,EAC1C,cAAwB,EACxB,gBAAyB,EACzB,sBAA+D,EAC/D,YAA+B;QAE/B,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACzG,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,uBAAuB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,IAAI,IAAI,GAAG,EAAE,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAEO,kBAAkB,CAAC,WAAsC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;QACpD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkB,EAAE,QAAgB,EAAE,QAAiC;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,UAAkB,EAAE,QAAgB;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,OAAwB;QAC/B,yEAAyE;QACzE,8FAA8F;QAC9F,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/F,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1E,IAAI,UAAU,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,CAAC;QAEpD,0EAA0E;QAC1E,0EAA0E;QAC1E,mEAAmE;QACnE,8EAA8E;QAC9E,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEpE,6DAA6D;QAC7D,OAAO,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,UAAU,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;;;;;OAWG;IACK,gBAAgB,CAAC,OAAwB,EAAE,UAAsC;QACvF,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC;QAEhE,wEAAwE;QACxE,MAAM,kBAAkB,GAAa,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1G,IAAI,QAAQ;gBAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAEpD,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,IAAI,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QAE/D,0EAA0E;QAC1E,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACzD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC;oBAAE,OAAO,OAAO,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,CAAC,0CAA0C;YAC5D,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEpE,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE9C,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;OAWG;IACK,4BAA4B,CAClC,OAAwB,EACxB,UAAsC;QAEtC,4FAA4F;QAC5F,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpE,0DAA0D;QAC1D,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC3E,OAAO,aAAa,CAAC;oBACnB,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,2BAA2B;oBACjC,MAAM,EAAE,0CAA0C,EAAE,EAAE;iBACvD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,IACE,OAAO,CAAC,QAAQ,KAAK,0BAA0B;YAC/C,OAAO,CAAC,UAAU,KAAK,YAAY;YACnC,UAAU;YACV,CAAC,UAAU,CAAC,WAAW;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;YACD,OAAO,aAAa,CAAC;gBACnB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,2DAA2D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,EAAE;QACF,oEAAoE;QACpE,8EAA8E;QAC9E,6EAA6E;QAC7E,6EAA6E;QAC7E,sCAAsC;QACtC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAgB,CAAC;QACrD,MAAM,oBAAoB,GAAG,aAAa,CAAC;QAE3C,wGAAwG;QACxG,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAErG,4DAA4D;QAC5D,MAAM,sBAAsB,GAAG,UAAU;YACvC,CAAC,CAAC,SAAS,CAAC,IAAI,CACZ,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC7E;YACH,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACzC,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,YAAY,CAAC;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;YAC3C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;YAE/F,4EAA4E;YAC5E,iDAAiD;YACjD,iEAAiE;YACjE,yEAAyE;YACzE,gDAAgD;YAChD,IAAI,YAAY,IAAI,gBAAgB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACxF,OAAO,aAAa,CAAC;oBACnB,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,+CAA+C,UAAU,EAAE;iBACpE,CAAC,CAAC;YACL,CAAC;YAED,kEAAkE;YAClE,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,EAAE;YACF,8DAA8D;YAC9D,uEAAuE;YACvE,4EAA4E;YAC5E,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC1C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACjD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;oBAClF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;wBAC3F,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAEtE,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;oBAC/C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;oBACjF,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;wBAC/C,OAAO,aAAa,CAAC;4BACnB,QAAQ,EAAE,UAAU;4BACpB,IAAI,EAAE,4BAA4B;4BAClC,MAAM,EAAE,eAAe,MAAM,yCAAyC,OAAO,CAAC,UAAU,GAAG;yBAC5F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,mEAAmE;gBACnE,gEAAgE;gBAChE,8EAA8E;YAChF,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,iEAAiE;YACjE,uEAAuE;YACvE,6EAA6E;YAC7E,2EAA2E;YAC3E,uEAAuE;YACvE,8DAA8D;YAC9D,EAAE;YACF,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;QAC5E,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,aAAa,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,iBAAiB,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAC5G,CAAC;IAED;;;;;;;;;;OAUG;IACK,qBAAqB,CAC3B,OAAwB,EACxB,oBAA+C,EAC/C,UAAsC;QAEtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,8BAA8B,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAElD,2DAA2D;QAC3D,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7E,mDAAmD;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,6DAA6D;YAC7D,0DAA0D;YAC1D,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,eAA6C,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,CAAC,eAAe,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzG,eAAe,GAAG,MAAM,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,OAAwB,EAAE,UAA0B;QAChF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBAChD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,oBAAoB,CAC1B,OAAwB,EACxB,UAA0B,EAC1B,cAA4B;QAE5B,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACzF,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;gBACzE,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;gBAChE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACK,0BAA0B,CAChC,OAAwB,EACxB,UAA0B,EAC1B,IAAkB,EAClB,KAAe;QAEf,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,eAA6C,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM;YAErC,uCAAuC;YACvC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEzE,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC;gBAAE,SAAS;YAE5E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,OAAiB,CAAC;YAEtB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,uEAAuE;gBACvE,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,IAAI,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;YACrC,CAAC;iBAAM,CAAC;gBACN,0DAA0D;gBAC1D,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;YAChC,CAAC;YAED,8CAA8C;YAC9C,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAElD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,eAAe,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzG,eAAe,GAAG,MAAM,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,4BAA4B,CAClC,IAAkB,EAClB,OAAwB,EACxB,UAA0B;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC5C,CAAC;YACF,IAAI,CAAC,mBAAmB;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACK,WAAW,CACjB,IAAkB,EAClB,OAAwB,EACxB,UAA0B,EAC1B,cAA6B;QAE7B,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhF,wBAAwB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7B,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;YACzE,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAErF,sEAAsE;YACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEzC,wEAAwE;YACxE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;QAC/B,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;YACjC,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC;YAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YAElF,yEAAyE;YACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBACjF,OAAO,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC9B,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClC,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,sDAAsD;gBACtD,MAAM,YAAY,GAChB,cAAc,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAChG,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;gBAE3F,uEAAuE;gBACvE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAE/C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC7G,IAAI,CAAC,cAAc;oBAAE,OAAO,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/trusted-process/tool-description-hints.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Loads tool description hints from a JSON config file and applies them
+ * to proxied tool descriptions before exposing tools to agents.
+ *
+ * Hints help agents use MCP tool parameters correctly — e.g. avoiding
+ * CLI flags in structured parameters or remembering required options.
+ */
+import type { ProxiedTool } from './mcp-proxy-server.js';
+/**
+ * Loads hints from `src/config/tool-description-hints.json` (or its
+ * `dist/config/` equivalent). Returns an empty array if the file is
+ * missing or malformed.
+ */
+export declare function loadToolDescriptionHints(): Map<string, string>;
+/**
+ * Returns a new tool list with hints appended to matching tool descriptions.
+ * Tools without a matching hint are returned unchanged.
+ */
+export declare function applyToolDescriptionHints(tools: ProxiedTool[], hints: Map<string, string>): ProxiedTool[];

package/dist/trusted-process/tool-description-hints.js

@@ -0,0 +1,53 @@
+/**
+ * Loads tool description hints from a JSON config file and applies them
+ * to proxied tool descriptions before exposing tools to agents.
+ *
+ * Hints help agents use MCP tool parameters correctly — e.g. avoiding
+ * CLI flags in structured parameters or remembering required options.
+ */
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Loads hints from `src/config/tool-description-hints.json` (or its
+ * `dist/config/` equivalent). Returns an empty array if the file is
+ * missing or malformed.
+ */
+export function loadToolDescriptionHints() {
+    const hintsPath = resolve(__dirname, '..', 'config', 'tool-description-hints.json');
+    try {
+        const raw = JSON.parse(readFileSync(hintsPath, 'utf-8'));
+        const file = raw;
+        if (!Array.isArray(file.hints))
+            return new Map();
+        const map = new Map();
+        for (const h of file.hints) {
+            if (typeof h.server === 'string' && typeof h.tool === 'string' && typeof h.hint === 'string') {
+                map.set(`${h.server}__${h.tool}`, h.hint);
+            }
+        }
+        return map;
+    }
+    catch {
+        return new Map();
+    }
+}
+/**
+ * Returns a new tool list with hints appended to matching tool descriptions.
+ * Tools without a matching hint are returned unchanged.
+ */
+export function applyToolDescriptionHints(tools, hints) {
+    if (hints.size === 0)
+        return tools;
+    return tools.map((t) => {
+        const hint = hints.get(`${t.serverName}__${t.name}`);
+        if (!hint)
+            return t;
+        return {
+            ...t,
+            description: t.description ? `${t.description}\n\n${hint}` : hint,
+        };
+    });
+}
+//# sourceMappingURL=tool-description-hints.js.map

package/dist/trusted-process/tool-description-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-description-hints.js","sourceRoot":"","sources":["../../src/trusted-process/tool-description-hints.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAY1D;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAgB,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7F,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB,EAAE,KAA0B;IACxF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO;YACL,GAAG,CAAC;YACJ,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/types/argument-roles.d.ts

@@ -14,7 +14,7 @@
  *   - opaque: no structural invariant (semantic meaning only)
  */
 export type RoleCategory = 'path' | 'url' | 'identifier' | 'opaque';
-export type ArgumentRole = 'read-path' | 'write-path' | 'delete-path' | 'write-history' | 'delete-history' | 'fetch-url' | 'git-remote-url' | 'github-owner' | 'branch-name' | 'commit-message' | 'none';
+export type ArgumentRole = 'read-path' | 'write-path' | 'delete-path' | 'write-history' | 'delete-history' | 'fetch-url' | 'git-remote-url' | 'github-owner' | 'github-repo' | 'branch-name' | 'commit-message' | 'none';
 export interface RoleDefinition {
     readonly description: string;
     readonly isResourceIdentifier: boolean;
@@ -86,3 +86,35 @@ export declare function getIdentifierRoles(): ArgumentRole[];
  * to check for those roles before auto-allowing.
  */
 export declare const SANDBOX_SAFE_PATH_ROLES: ReadonlySet<ArgumentRole>;
+import type { ArgumentRoleSpec, ConditionalRoles, StoredToolAnnotation, StoredToolAnnotationsFile, ToolAnnotation, ToolAnnotationsFile } from '../pipeline/types.js';
+/** Type guard: returns true if an ArgumentRoleSpec is a conditional block. */
+export declare function isConditionalRoles(spec: ArgumentRoleSpec): spec is ConditionalRoles;
+/**
+ * Extracts the static/default roles from an ArgumentRoleSpec.
+ * For static arrays, returns them directly.
+ * For conditional specs, returns the default (most-restrictive) roles.
+ *
+ * Used by pipeline stages that inspect annotations without a tool call context.
+ */
+export declare function extractDefaultRoles(spec: ArgumentRoleSpec): ArgumentRole[];
+/**
+ * Resolves a StoredToolAnnotation (which may contain conditional role specs)
+ * into a plain ToolAnnotation (where all args are ArgumentRole[]).
+ *
+ * This is the sole boundary where conditionals are evaluated. Every consumer
+ * downstream receives a ToolAnnotation with static role arrays.
+ *
+ * @param stored - The stored annotation (from JSON file / annotation map)
+ * @param callArgs - The actual tool call arguments
+ * @returns A ToolAnnotation with all conditional specs resolved
+ */
+export declare function resolveStoredAnnotation(stored: StoredToolAnnotation, callArgs: Record<string, unknown>): ToolAnnotation;
+/**
+ * Resolves an entire StoredToolAnnotationsFile to a plain ToolAnnotationsFile
+ * by flattening all conditional role specs to their default roles.
+ *
+ * This is the correct entry point for the policy compilation pipeline, which
+ * never has actual call arguments and should only see the flat ToolAnnotation
+ * shape. The policy engine resolves conditionals at evaluation time instead.
+ */
+export declare function resolveStoredAnnotationsFile(stored: StoredToolAnnotationsFile): ToolAnnotationsFile;