@qduc/term2 0.9.3 → 0.10.0

package/dist/services/agent-runtime/scope-resolver.js

@@ -0,0 +1,607 @@
+import path from 'node:path';
+import { realpathSync } from 'node:fs';
+import { realpath, stat } from 'node:fs/promises';
+// ─── Workspace root ──────────────────────────────────────────────
+/**
+ * Cached workspace root for path normalization.
+ * Defaults to the current working directory but can be overridden for testing.
+ */
+let workspaceRoot;
+export function setWorkspaceRoot(root) {
+    const resolved = path.resolve(root);
+    // Resolve symlinks in the root itself (e.g. macOS /var -> /private/var)
+    // so it stays consistent with the realpath'd descendants that
+    // resolveRealToolPath compares against.
+    try {
+        workspaceRoot = realpathSync(resolved);
+    }
+    catch {
+        workspaceRoot = resolved;
+    }
+}
+export function getWorkspaceRoot() {
+    return workspaceRoot ?? process.cwd();
+}
+// ─── Path safety ─────────────────────────────────────────────────
+/**
+ * Normalize a tool-targeted file path against the workspace root.
+ * Rejects traversal (..) that escapes the workspace, absolute paths outside
+ * the workspace, and paths containing null bytes.
+ *
+ * Returns the normalized absolute path, or null if the path is unsafe.
+ */
+export function normalizeToolPath(rawPath) {
+    if (!rawPath || rawPath.includes('\0'))
+        return null;
+    const root = getWorkspaceRoot();
+    const resolved = path.resolve(root, rawPath);
+    // Reject if the resolved path escapes the workspace root
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+        return null;
+    }
+    return resolved;
+}
+/**
+ * Check if a raw path (from a tool invocation) is within the workspace.
+ * Returns true if the normalized path is safe.
+ */
+export function isPathWithinWorkspace(rawPath) {
+    return normalizeToolPath(rawPath) !== null;
+}
+/**
+ * Symlink-safe resolution of a tool-targeted path.
+ *
+ * Uses fs.realpath to resolve symlinks in the path. For paths that
+ * don't yet exist (writes to new files), resolves the nearest existing
+ * ancestor and checks that the final composed path stays within the
+ * root/scope.
+ *
+ * Returns the real absolute path, or null if:
+ * - The path escapes the workspace root
+ * - A symlink points outside the workspace
+ * - The composed path (for nonexistent targets) would escape
+ */
+export async function resolveRealToolPath(rawPath) {
+    if (!rawPath || rawPath.includes('\0'))
+        return null;
+    const root = getWorkspaceRoot();
+    // First, normalize the raw path to an absolute path
+    const nominal = path.resolve(root, rawPath);
+    // Reject if the nominal path escapes the workspace root
+    if (nominal !== root && !nominal.startsWith(root + path.sep)) {
+        return null;
+    }
+    // Try realpath to resolve symlinks
+    try {
+        const real = await realpath(nominal);
+        // Check that the real path stays within root
+        if (real !== root && !real.startsWith(root + path.sep)) {
+            return null;
+        }
+        return real;
+    }
+    catch {
+        // Path doesn't exist (e.g., write target).
+        // Resolve the nearest existing ancestor.
+        return resolveNonexistentTarget(nominal, root);
+    }
+}
+/**
+ * Resolve a nonexistent target path by finding the nearest existing
+ * ancestor via realpath, then composing the remaining segments and
+ * verifying the final path stays within root.
+ */
+async function resolveNonexistentTarget(target, root) {
+    let current = target;
+    const missingSegments = [];
+    while (current !== root && current !== path.dirname(current)) {
+        try {
+            await stat(current);
+            // Current segment exists, resolve its real path
+            const real = await realpath(current);
+            if (real !== root && !real.startsWith(root + path.sep)) {
+                return null;
+            }
+            // Compose the full path
+            const composed = path.join(real, ...missingSegments.reverse());
+            // Normalize and verify
+            const normalized = path.resolve(composed);
+            if (normalized !== root && !normalized.startsWith(root + path.sep)) {
+                return null;
+            }
+            return normalized;
+        }
+        catch {
+            // Segment doesn't exist, go up one level
+            missingSegments.push(path.basename(current));
+            current = path.dirname(current);
+        }
+    }
+    // If we reached root without finding an existing ancestor,
+    // the closest existing thing is root
+    const real = await realpath(root);
+    const composed = path.join(real, ...missingSegments.reverse());
+    const normalized = path.resolve(composed);
+    if (normalized !== real && !normalized.startsWith(real + path.sep)) {
+        return null;
+    }
+    return normalized;
+}
+/**
+ * Symlink-safe version of isPathInScope.
+ * Resolves the actual filesystem path (following symlinks) and
+ * checks it against the scope patterns.
+ */
+export async function isPathInScopeSafe(rawPath, scopePatterns) {
+    if (scopePatterns.length === 0)
+        return true;
+    const real = await resolveRealToolPath(rawPath);
+    if (!real)
+        return false;
+    const root = getWorkspaceRoot();
+    const relative = path.relative(root, real);
+    if (relative.startsWith('..'))
+        return false;
+    return scopePatterns.some((pattern) => matchGlobPattern(relative, pattern));
+}
+// ─── Filesystem scope normalization ──────────────────────────────
+/**
+ * Normalize a filesystem scope pattern.
+ * - Strips leading/trailing whitespace
+ * - Normalizes to forward slashes
+ * - Rejects patterns with traversal (..)
+ * - Rejects absolute patterns (must be relative)
+ * - Rejects empty patterns after trimming
+ *
+ * Returns the normalized relative pattern, or null if invalid.
+ */
+export function normalizeScopePattern(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    // Must be a relative path pattern
+    if (path.isAbsolute(trimmed))
+        return null;
+    // Reject traversal
+    const segments = trimmed.split(/[/\\]/);
+    if (segments.some((s) => s === '..'))
+        return null;
+    // Normalize to forward slashes
+    return segments.join('/');
+}
+export function resolveFilesystemScopes(child, parent) {
+    const errors = [];
+    /**
+     * Normalize a list of scope patterns.
+     * Returns the normalized list (empty array if all invalid or input was []) or undefined if input was absent.
+     */
+    function normalizeList(patterns, field) {
+        if (patterns === undefined)
+            return undefined; // not present
+        const normalized = [];
+        for (const p of patterns) {
+            const n = normalizeScopePattern(p);
+            if (n === null) {
+                errors.push({
+                    code: 'invalid_scope_pattern',
+                    field,
+                    pattern: p,
+                    message: `Invalid filesystem scope pattern "${p}" for ${field}. Patterns must be relative, non-empty, and must not contain traversal (..).`,
+                });
+                continue;
+            }
+            normalized.push(n);
+        }
+        return normalized;
+    }
+    const childHasRead = child?.read !== undefined;
+    const childHasWrite = child?.write !== undefined;
+    const parentHasRead = parent?.read !== undefined;
+    const parentHasWrite = parent?.write !== undefined;
+    const childReadNorm = normalizeList(child?.read, 'filesystem.read');
+    const childWriteNorm = normalizeList(child?.write, 'filesystem.write');
+    const parentReadNorm = normalizeList(parent?.read, 'filesystem.read');
+    const parentWriteNorm = normalizeList(parent?.write, 'filesystem.write');
+    // If child has no scopes defined at all, inherit parent
+    if (!childHasRead && !childHasWrite) {
+        if (!parentHasRead && !parentHasWrite) {
+            return { resolved: undefined, errors };
+        }
+        return {
+            resolved: {
+                read: parentReadNorm ?? [],
+                write: parentWriteNorm ?? [],
+            },
+            errors,
+        };
+    }
+    // Child has explicit scopes — resolve each axis
+    let resolvedRead;
+    let resolvedWrite;
+    // Resolve read axis
+    if (childHasRead) {
+        if (parentHasRead) {
+            // Both present — intersect. Empty parent ([]) means no authority.
+            resolvedRead = parentReadNorm.length === 0 ? [] : intersectFilePatterns(childReadNorm ?? [], parentReadNorm);
+        }
+        else {
+            // No parent restriction
+            resolvedRead = childReadNorm ?? [];
+        }
+    }
+    else if (parentHasRead) {
+        resolvedRead = parentReadNorm ?? [];
+    }
+    else {
+        resolvedRead = [];
+    }
+    // Resolve write axis
+    if (childHasWrite) {
+        if (parentHasWrite) {
+            resolvedWrite =
+                parentWriteNorm.length === 0 ? [] : intersectFilePatterns(childWriteNorm ?? [], parentWriteNorm);
+        }
+        else {
+            resolvedWrite = childWriteNorm ?? [];
+        }
+    }
+    else if (parentHasWrite) {
+        resolvedWrite = parentWriteNorm ?? [];
+    }
+    else {
+        resolvedWrite = [];
+    }
+    return {
+        resolved: { read: resolvedRead, write: resolvedWrite },
+        errors,
+    };
+}
+/**
+ * Check if a child pattern is covered by any parent pattern.
+ * A parent pattern covers a child pattern if the child's path prefix matches
+ * the parent pattern prefix (before any wildcard).
+ *
+ * Example: parent "src/**" covers child "src/lib/**" but NOT child "test/**"
+ */
+function isSubPattern(child, parent) {
+    // Exact match
+    if (child === parent)
+        return true;
+    // Extract the literal prefix of the parent pattern (before any wildcard)
+    const parentPrefix = parent.replace(/[*?].*$/, '');
+    const childPrefix = child.replace(/[*?].*$/, '');
+    // Child must start with parent prefix and not escape
+    if (parentPrefix.endsWith('/')) {
+        return childPrefix.startsWith(parentPrefix);
+    }
+    // If parent has a glob at the root (like "**.ts"), match by extension/base
+    if (parent.startsWith('*')) {
+        return child.startsWith('*') || childPrefix.startsWith(parentPrefix) || (parentPrefix === '' && childPrefix !== '');
+    }
+    // Child must be within parent directory or match exactly
+    if (childPrefix === parentPrefix)
+        return true;
+    if (childPrefix.startsWith(parentPrefix + '/'))
+        return true;
+    // Child glob pattern might match files within parent directory
+    const childDir = childPrefix.substring(0, childPrefix.lastIndexOf('/'));
+    if (childDir && childDir.startsWith(parentPrefix + '/'))
+        return true;
+    return false;
+}
+function intersectFilePatterns(child, parent) {
+    if (parent.length === 0)
+        return []; // Parent with empty scopes denies everything
+    if (child.length === 0)
+        return []; // Child with empty scopes has no authority
+    return child.filter((c) => parent.some((p) => isSubPattern(c, p)));
+}
+// ─── Filesystem scope enforcement ────────────────────────────────
+/**
+ * Check if a tool-targeted file path is within the given filesystem scope patterns.
+ *
+ * @param rawPath - The raw path from a tool invocation
+ * @param scopePatterns - Resolved scope patterns (relative to workspace root)
+ * @returns true if the path matches at least one scope pattern
+ */
+export function isPathInScope(rawPath, scopePatterns) {
+    if (scopePatterns.length === 0)
+        return true; // Empty patterns = no restriction (but coarse flags may still deny)
+    const normalized = normalizeToolPath(rawPath);
+    if (!normalized)
+        return false;
+    const root = getWorkspaceRoot();
+    const relative = path.relative(root, normalized);
+    if (relative.startsWith('..'))
+        return false;
+    return scopePatterns.some((pattern) => matchGlobPattern(relative, pattern));
+}
+/**
+ * Simple glob matching for filesystem scopes.
+ * Supports:
+ * - `**` matches any number of path segments
+ * - `*` matches any characters within a single segment except `/`
+ * - Literal text matches exactly
+ */
+function matchGlobPattern(target, pattern) {
+    // Normalize separators
+    const normalizedTarget = target.replace(/\\/g, '/');
+    const normalizedPattern = pattern.replace(/\\/g, '/');
+    return matchGlobSegments(normalizedTarget, normalizedPattern);
+}
+function matchGlobSegments(target, pattern) {
+    const tSegs = target.split('/');
+    const pSegs = pattern.split('/');
+    // DP: match position i in target with position j in pattern
+    const dp = Array.from({ length: tSegs.length + 1 }, () => new Array(pSegs.length + 1).fill(false));
+    dp[0][0] = true;
+    // Handle leading ** that can match zero segments
+    for (let j = 1; j <= pSegs.length; j++) {
+        if (pSegs[j - 1] === '**') {
+            dp[0][j] = dp[0][j - 1];
+        }
+    }
+    for (let i = 1; i <= tSegs.length; i++) {
+        for (let j = 1; j <= pSegs.length; j++) {
+            const tSeg = tSegs[i - 1];
+            const pSeg = pSegs[j - 1];
+            if (pSeg === '**') {
+                // ** matches zero or more segments
+                dp[i][j] = dp[i][j - 1] || dp[i - 1][j];
+            }
+            else if (matchSingleSegment(tSeg, pSeg)) {
+                dp[i][j] = dp[i - 1][j - 1];
+            }
+        }
+    }
+    // Also match file patterns without directory prefix
+    // (e.g., pattern "*.ts" should match "src/foo.ts")
+    if (!pattern.includes('/') || (pSegs.length === 1 && !dp[tSegs.length][pSegs.length])) {
+        // Try matching just the last segment
+        const lastSeg = tSegs[tSegs.length - 1];
+        if (pSegs.length === 1 && matchSingleSegment(lastSeg, pSegs[0])) {
+            return true;
+        }
+    }
+    return dp[tSegs.length][pSegs.length];
+}
+function matchSingleSegment(segment, pattern) {
+    if (pattern === '*')
+        return true;
+    if (pattern === '**')
+        return true;
+    // Convert glob pattern to regex for the segment
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    const re = new RegExp(`^${escaped}$`);
+    return re.test(segment);
+}
+// ─── Network host normalization ──────────────────────────────────
+/**
+ * Normalize a network host pattern.
+ * - Lowercase
+ * - Strip protocol prefix if present
+ * - Strip trailing slash
+ * - Parse hostname and optional port
+ * - Reject invalid characters, empty hostname, IP addresses with ports
+ *
+ * Returns normalized `hostname[:port]` or null if invalid.
+ */
+export function normalizeHostPattern(raw) {
+    const trimmed = raw.trim().toLowerCase();
+    if (!trimmed)
+        return null;
+    // Strip protocol if present
+    let hostPort = trimmed;
+    if (hostPort.startsWith('https://') || hostPort.startsWith('http://')) {
+        hostPort = hostPort.slice(hostPort.indexOf('://') + 3);
+    }
+    // Strip trailing slash
+    if (hostPort.endsWith('/')) {
+        hostPort = hostPort.slice(0, -1);
+    }
+    // Reject path components
+    if (hostPort.includes('/'))
+        return null;
+    // Reject empty hostname
+    if (!hostPort)
+        return null;
+    // Parse hostname:port
+    const colonIdx = hostPort.lastIndexOf(':');
+    let hostname;
+    let port;
+    if (colonIdx > 0) {
+        hostname = hostPort.slice(0, colonIdx);
+        port = hostPort.slice(colonIdx + 1);
+        // Validate port is a number
+        if (!/^\d{1,5}$/.test(port))
+            return null;
+        const portNum = parseInt(port, 10);
+        if (portNum < 1 || portNum > 65535)
+            return null;
+    }
+    else {
+        hostname = hostPort;
+    }
+    // Validate hostname
+    if (!isValidHostname(hostname))
+        return null;
+    return port ? `${hostname}:${port}` : hostname;
+}
+function isValidHostname(hostname) {
+    if (hostname.length === 0 || hostname.length > 253)
+        return false;
+    // Allow wildcard at start for subdomain matching
+    const isWildcard = hostname.startsWith('*.');
+    const nameToCheck = isWildcard ? hostname.slice(2) : hostname;
+    // Each label must be 1-63 chars, alphanumeric + hyphens, not starting/ending with hyphen
+    const labels = nameToCheck.split('.');
+    if (labels.length === 0)
+        return false;
+    for (const label of labels) {
+        if (label.length === 0 || label.length > 63)
+            return false;
+        if (label.startsWith('-') || label.endsWith('-'))
+            return false;
+        if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(label) && !/^[a-z0-9]$/.test(label))
+            return false;
+    }
+    return true;
+}
+/**
+ * Check if a target hostname matches an allowed host pattern.
+ * Strict: `evil-example.com` must NOT match `example.com`.
+ * Wildcard: `*.example.com` matches `sub.example.com` but NOT `example.com`.
+ */
+export function isHostInScope(targetUrl, allowedPatterns) {
+    if (allowedPatterns.length === 0)
+        return true; // No restriction
+    // The literal '*' wildcard means "all hosts".
+    if (allowedPatterns.includes('*'))
+        return true;
+    const urlStr = targetUrl.trim().toLowerCase();
+    // Extract hostname from URL
+    let hostname;
+    let port;
+    if (urlStr.startsWith('https://') || urlStr.startsWith('http://')) {
+        try {
+            const url = new URL(urlStr);
+            hostname = url.hostname;
+            port = url.port || undefined;
+        }
+        catch {
+            return false;
+        }
+    }
+    else {
+        // Treat as bare hostname
+        const colonIdx = urlStr.lastIndexOf(':');
+        if (colonIdx > 0) {
+            hostname = urlStr.slice(0, colonIdx);
+            port = urlStr.slice(colonIdx + 1);
+        }
+        else {
+            hostname = urlStr;
+        }
+    }
+    if (!isValidHostname(hostname))
+        return false;
+    return allowedPatterns.some((pattern) => {
+        // Check if pattern includes port
+        const colonIdx = pattern.lastIndexOf(':');
+        let patternHost;
+        let patternPort;
+        if (colonIdx > 0 && /^\d{1,5}$/.test(pattern.slice(colonIdx + 1))) {
+            patternHost = pattern.slice(0, colonIdx);
+            patternPort = pattern.slice(colonIdx + 1);
+        }
+        else {
+            patternHost = pattern;
+        }
+        // Port must match if specified in pattern
+        if (patternPort && patternPort !== port)
+            return false;
+        // Wildcard matching: *.example.com
+        if (patternHost.startsWith('*.')) {
+            const suffix = patternHost.slice(2); // "example.com"
+            // Must match subdomain, not the exact domain
+            return hostname.endsWith('.' + suffix) && hostname !== suffix;
+        }
+        // Exact hostname match
+        return hostname === patternHost;
+    });
+}
+// ─── Network scope resolution ────────────────────────────────────
+export function resolveNetworkScopes(child, parent) {
+    const errors = [];
+    function normalizeHostList(hosts, field) {
+        if (!hosts)
+            return undefined;
+        const normalized = [];
+        for (const h of hosts) {
+            const n = normalizeHostPattern(h);
+            if (n === null) {
+                errors.push({
+                    code: 'invalid_scope_pattern',
+                    field,
+                    pattern: h,
+                    message: `Invalid network host pattern "${h}". Hosts must be valid hostnames with optional port (e.g., "api.example.com:443").`,
+                });
+                continue;
+            }
+            normalized.push(n);
+        }
+        return normalized.length > 0 ? normalized : undefined;
+    }
+    const childHosts = child?.hosts;
+    const parentHosts = parent?.hosts;
+    // If child has no host scopes defined, inherit parent
+    if (childHosts === undefined) {
+        if (parentHosts !== undefined) {
+            const normalized = normalizeHostList(parentHosts, 'network.hosts');
+            return { resolved: normalized ?? [], errors };
+        }
+        return { resolved: undefined, errors };
+    }
+    // Child has explicit host scopes
+    const childNormalized = normalizeHostList(childHosts, 'network.hosts');
+    if (parentHosts !== undefined) {
+        const parentNormalized = normalizeHostList(parentHosts, 'network.hosts');
+        if (parentNormalized && childNormalized) {
+            // Intersect: child hosts must be in parent's list
+            const intersected = childNormalized.filter((c) => parentNormalized.some((p) => hostCoveredBy(c, p)));
+            return { resolved: intersected, errors };
+        }
+        if (parentNormalized && parentNormalized.length > 0) {
+            // Parent has hosts but child has none → empty
+            return { resolved: [], errors };
+        }
+    }
+    return { resolved: childNormalized ?? [], errors };
+}
+/**
+ * Check if a child host pattern is covered by a parent host pattern.
+ * - Exact match
+ * - Parent wildcard covers child exact (parent `*.example.com` covers child `sub.example.com`)
+ */
+function hostCoveredBy(child, parent) {
+    if (child === parent)
+        return true;
+    const colonIdxP = parent.lastIndexOf(':');
+    const parentHost = colonIdxP > 0 && /^\d{1,5}$/.test(parent.slice(colonIdxP + 1)) ? parent.slice(0, colonIdxP) : parent;
+    const parentPort = colonIdxP > 0 && /^\d{1,5}$/.test(parent.slice(colonIdxP + 1)) ? parent.slice(colonIdxP + 1) : undefined;
+    const colonIdxC = child.lastIndexOf(':');
+    const childHost = colonIdxC > 0 && /^\d{1,5}$/.test(child.slice(colonIdxC + 1)) ? child.slice(0, colonIdxC) : child;
+    const childPort = colonIdxC > 0 && /^\d{1,5}$/.test(child.slice(colonIdxC + 1)) ? child.slice(colonIdxC + 1) : undefined;
+    // Port must match if parent specifies one
+    if (parentPort && parentPort !== childPort)
+        return false;
+    // Wildcard coverage
+    if (parentHost.startsWith('*.')) {
+        const suffix = parentHost.slice(2);
+        return childHost.endsWith('.' + suffix) && childHost !== suffix;
+    }
+    return childHost === parentHost;
+}
+// ─── Empty scope utilities ───────────────────────────────────────
+/**
+ * Check if filesystem scopes are explicitly empty (no authority).
+ * Used to determine if tool invocation should be denied even if
+ * coarse flags would otherwise allow it.
+ */
+export function isFilesystemScopeEmpty(scope) {
+    if (!scope)
+        return false; // Not defined = no restriction
+    return scope.read.length === 0 && scope.write.length === 0;
+}
+/**
+ * Check if network scopes are explicitly empty (no authority).
+ */
+export function isNetworkScopeEmpty(scope) {
+    if (!scope)
+        return false; // Not defined = no restriction
+    return scope.length === 0;
+}
+//# sourceMappingURL=scope-resolver.js.map

package/dist/services/agent-runtime/scope-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-resolver.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/scope-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAuClD,oEAAoE;AAEpE;;;GAGG;AACH,IAAI,aAAiC,CAAC;AAEtC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,wEAAwE;IACxE,8DAA8D;IAC9D,wCAAwC;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACxC,CAAC;AAED,oEAAoE;AAEpE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAEhC,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE5C,wDAAwD;IACxD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,6CAA6C;QAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,yCAAyC;QACzC,OAAO,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,IAAY;IAClE,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,wBAAwB;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,uBAAuB;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;YACzC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,qCAAqC;IACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAuB;IAC9E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,oEAAoE;AAEpE;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,kCAAkC;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,mBAAmB;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,+BAA+B;IAC/B,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAyBD,MAAM,UAAU,uBAAuB,CACrC,KAA6C,EAC7C,MAA8C;IAE9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C;;;OAGG;IACH,SAAS,aAAa,CAAC,QAA8B,EAAE,KAAa;QAClE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,CAAC,cAAc;QAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,KAAK;oBACL,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,qCAAqC,CAAC,SAAS,KAAK,8EAA8E;iBAC5I,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC;IAC/C,MAAM,aAAa,GAAG,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC;IAEnD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAEzE,wDAAwD;IACxD,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,OAAO;YACL,QAAQ,EAAE;gBACR,IAAI,EAAE,cAAc,IAAI,EAAE;gBAC1B,KAAK,EAAE,eAAe,IAAI,EAAE;aAC7B;YACD,MAAM;SACP,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,IAAI,YAAsB,CAAC;IAC3B,IAAI,aAAuB,CAAC;IAE5B,oBAAoB;IACpB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,aAAa,EAAE,CAAC;YAClB,kEAAkE;YAClE,YAAY,GAAG,cAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,IAAI,EAAE,EAAE,cAAe,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,YAAY,GAAG,aAAa,IAAI,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,YAAY,GAAG,cAAc,IAAI,EAAE,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,cAAc,EAAE,CAAC;YACnB,aAAa;gBACX,eAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,IAAI,EAAE,EAAE,eAAgB,CAAC,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,cAAc,IAAI,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,aAAa,GAAG,eAAe,IAAI,EAAE,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE;QACtD,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IACjD,cAAc;IACd,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAElC,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEjD,qDAAqD;IACrD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,yDAAyD;IACzD,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5D,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAe,EAAE,MAAgB;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,6CAA6C;IACjF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,2CAA2C;IAE9E,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,oEAAoE;AAEpE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,aAAuB;IACpE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,oEAAoE;IAEjH,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,uBAAuB;IACvB,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtD,OAAO,iBAAiB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,OAAe;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,4DAA4D;IAC5D,MAAM,EAAE,GAAgB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAEhB,iDAAiD;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAE1B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,mCAAmC;gBACnC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC1C,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,mDAAmD;IACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtF,qCAAqC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,OAAe;IAC1D,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,gDAAgD;IAChD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,oEAAoE;AAEpE;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,4BAA4B;IAC5B,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,wBAAwB;IACxB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,sBAAsB;IACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAwB,CAAC;IAE7B,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEpC,4BAA4B;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAEjE,iDAAiD;IACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9D,yFAAyF;IACzF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChG,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,eAAyB;IACxE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAEhE,8CAA8C;IAC9C,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,4BAA4B;IAC5B,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAwB,CAAC;IAE7B,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACxB,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,CAAC;QACN,yBAAyB;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,WAAmB,CAAC;QACxB,IAAI,WAA+B,CAAC;QAEpC,IAAI,QAAQ,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACzC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QAED,0CAA0C;QAC1C,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEtD,mCAAmC;QACnC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;YACrD,6CAA6C;YAC7C,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,QAAQ,KAAK,MAAM,CAAC;QAChE,CAAC;QAED,uBAAuB;QACvB,OAAO,QAAQ,KAAK,WAAW,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AAEpE,MAAM,UAAU,oBAAoB,CAClC,KAA4B,EAC5B,MAA6B;IAE7B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,SAAS,iBAAiB,CAAC,KAA2B,EAAE,KAAa;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,KAAK;oBACL,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,iCAAiC,CAAC,oFAAoF;iBAChI,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAK,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,EAAE,KAAK,CAAC;IAElC,sDAAsD;IACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YACnE,OAAO,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,iCAAiC;IACjC,MAAM,eAAe,GAAG,iBAAiB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,gBAAgB,IAAI,eAAe,EAAE,CAAC;YACxC,kDAAkD;YAClD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,8CAA8C;YAC9C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,MAAc;IAClD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GACd,SAAS,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvG,MAAM,UAAU,GACd,SAAS,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3G,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpH,MAAM,SAAS,GACb,SAAS,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzG,0CAA0C;IAC1C,IAAI,UAAU,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEzD,oBAAoB;IACpB,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,SAAS,KAAK,MAAM,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,KAAK,UAAU,CAAC;AAClC,CAAC;AAED,oEAAoE;AAEpE;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA+B;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA4B;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACzD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/services/agent-runtime/skill-resolver.d.ts

@@ -0,0 +1,29 @@
+import type { SkillsService } from '../skills/skills-service.js';
+export interface SkillResolutionResult {
+    /** Concatenated instruction bodies from resolved skills. */
+    instructions: string;
+    /** Errors for skills that could not be resolved. */
+    errors: SkillResolutionError[];
+}
+export interface SkillResolutionError {
+    code: 'unknown_skill' | 'unsupported_contribution';
+    skillName: string;
+    message: string;
+}
+/**
+ * Resolve a list of skill names into their instruction bodies and
+ * collect errors for unknown or unsupported skills.
+ *
+ * **Capability guard**: Skills only contribute instruction bodies (`body`).
+ * The current SkillInfo type has no fields for tool definitions, resource
+ * grants, output contracts, or permission elevation, so skills cannot
+ * grant or widen authority. If SkillInfo is extended in the future, any
+ * new authority-bearing field must be explicitly validated here and
+ * rejected with `unsupported_contribution` unless the runtime supports it.
+ *
+ * The MVP only supports instruction contributions. Any skill requesting
+ * tool definitions, resource grants, output contracts, or permission
+ * elevation is rejected with `unsupported_contribution`.
+ */
+export declare function resolveSkills(skillNames: ReadonlyArray<string> | undefined, skillsService: SkillsService): SkillResolutionResult;
+//# sourceMappingURL=skill-resolver.d.ts.map

package/dist/services/agent-runtime/skill-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolver.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/skill-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,eAAe,GAAG,0BAA0B,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,EAC7C,aAAa,EAAE,aAAa,GAC3B,qBAAqB,CA2BvB"}