@slaw-ai/server 2026.611.0

package/dist/services/authorization.js

@@ -0,0 +1,608 @@
+import { and, eq } from "drizzle-orm";
+import { agents, squadMemberships, instanceUserRoles, issues, principalPermissionGrants, projects, } from "@slaw-ai/db";
+function squadIdForResource(resource) {
+    return resource.squadId;
+}
+function permissionForAction(action) {
+    if (action === "agent_config:read" || action === "agent_config:update")
+        return "agents:create";
+    if (action === "issue:mutate")
+        return null;
+    return action;
+}
+function canCreateAgentsLegacy(agent) {
+    if (agent.role === "squad_lead")
+        return true;
+    if (!agent.permissions || typeof agent.permissions !== "object")
+        return false;
+    return Boolean(agent.permissions.canCreateAgents);
+}
+function scopeValueList(value) {
+    if (typeof value === "string" && value.trim())
+        return [value.trim()];
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .filter((entry) => typeof entry === "string" && entry.trim().length > 0)
+        .map((entry) => entry.trim());
+}
+function prefixedScopeValues(grantScope, prefix) {
+    return scopeValueList(grantScope.allow)
+        .filter((rule) => rule.startsWith(prefix))
+        .map((rule) => rule.slice(prefix.length))
+        .filter((value) => value.length > 0);
+}
+function scopeValuesForKeys(grantScope, keys) {
+    return keys.flatMap((key) => scopeValueList(grantScope[key]));
+}
+function scopeIncludesId(ids, id) {
+    return Boolean(id && ids.includes(id));
+}
+function isSimpleAssignableAgentStatus(status) {
+    return status !== "pending_approval" && status !== "terminated";
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function objectIsEmpty(value) {
+    return Object.keys(value).length === 0;
+}
+function readPolicyObject(container, key) {
+    if (!isPlainRecord(container))
+        return null;
+    const value = container[key];
+    return isPlainRecord(value) ? value : null;
+}
+function readString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function readBoolean(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function evaluateAuthorizationPolicyForAssignment(policy, label) {
+    if (!policy || objectIsEmpty(policy))
+        return { kind: "none" };
+    const agentVisibility = readPolicyObject(policy, "agentVisibility");
+    const assignmentPolicy = readPolicyObject(policy, "assignmentPolicy");
+    const protectedAgent = readPolicyObject(policy, "protectedAgent");
+    const knownTopLevelKeys = new Set([
+        "agentVisibility",
+        "assignmentPolicy",
+        "protectedAgent",
+        "managedBy",
+    ]);
+    const hasUnknownTopLevelKey = Object.keys(policy).some((key) => !knownTopLevelKeys.has(key));
+    const hasKnownPolicySection = Boolean(agentVisibility || assignmentPolicy || protectedAgent);
+    if (hasUnknownTopLevelKey || !hasKnownPolicySection) {
+        return {
+            kind: "unknown",
+            explanation: `${label} has authorization policy data that core cannot evaluate for task assignment.`,
+        };
+    }
+    const visibilityMode = readString(agentVisibility?.mode);
+    if (visibilityMode && visibilityMode !== "discoverable" && visibilityMode !== "private") {
+        return {
+            kind: "unknown",
+            explanation: `${label} has an unsupported agent visibility policy mode.`,
+        };
+    }
+    const assignmentMode = readString(assignmentPolicy?.mode);
+    if (assignmentMode && assignmentMode !== "squad_default" && assignmentMode !== "protected") {
+        return {
+            kind: "unknown",
+            explanation: `${label} has an unsupported assignment policy mode.`,
+        };
+    }
+    const requiresApproval = readBoolean(protectedAgent?.requiresApproval) === true ||
+        readBoolean(assignmentPolicy?.protectedAgentRequiresApproval) === true;
+    if (requiresApproval) {
+        return {
+            kind: "requires_approval",
+            explanation: `${label} requires approval before task assignment.`,
+        };
+    }
+    if (visibilityMode === "private" ||
+        readBoolean(agentVisibility?.hiddenFromDefaultDirectory) === true) {
+        return {
+            kind: "restricted",
+            explanation: `${label} is private and cannot use simple squad-wide task assignment.`,
+        };
+    }
+    if (assignmentMode === "protected") {
+        return {
+            kind: "restricted",
+            explanation: `${label} is protected and requires an explicit assignment grant.`,
+        };
+    }
+    return { kind: "none" };
+}
+function agentIsInSubtree(agentsById, rootAgentId, targetAgentId) {
+    if (rootAgentId === targetAgentId)
+        return true;
+    let cursor = targetAgentId;
+    for (let depth = 0; cursor && depth < 50; depth += 1) {
+        const current = agentsById.get(cursor);
+        if (!current)
+            return false;
+        if (current.reportsTo === rootAgentId)
+            return true;
+        cursor = current.reportsTo;
+    }
+    return false;
+}
+async function loadSquadAgentHierarchy(db, squadId) {
+    const rows = await db
+        .select({ id: agents.id, reportsTo: agents.reportsTo })
+        .from(agents)
+        .where(eq(agents.squadId, squadId));
+    return new Map(rows.map((agent) => [agent.id, agent]));
+}
+async function isAgentInSubtree(db, squadId, rootAgentId, targetAgentId) {
+    return agentIsInSubtree(await loadSquadAgentHierarchy(db, squadId), rootAgentId, targetAgentId);
+}
+async function scopeAllows(db, squadId, grantScope, requestedScope, options = {}) {
+    if (!grantScope || Object.keys(grantScope).length === 0)
+        return !options.requireStructuredScope;
+    if (!requestedScope)
+        return false;
+    const targetAssigneeAgentId = typeof requestedScope.assigneeAgentId === "string"
+        ? requestedScope.assigneeAgentId
+        : typeof requestedScope.targetAgentId === "string"
+            ? requestedScope.targetAgentId
+            : null;
+    const requestedProjectId = typeof requestedScope.projectId === "string" ? requestedScope.projectId : null;
+    let constrained = false;
+    const projectIds = [
+        ...scopeValueList(grantScope.projectId),
+        ...scopeValueList(grantScope.projectIds),
+        ...prefixedScopeValues(grantScope, "project:"),
+    ];
+    if (projectIds.length > 0) {
+        constrained = true;
+        if (!scopeIncludesId(projectIds, requestedProjectId))
+            return false;
+    }
+    const targetAgentIds = [
+        ...scopeValuesForKeys(grantScope, [
+            "agentId",
+            "agentIds",
+            "assigneeAgentId",
+            "assigneeAgentIds",
+            "targetAgentId",
+            "targetAgentIds",
+        ]),
+        ...prefixedScopeValues(grantScope, "agent:"),
+    ];
+    if (targetAgentIds.length > 0) {
+        constrained = true;
+        if (!scopeIncludesId(targetAgentIds, targetAssigneeAgentId))
+            return false;
+    }
+    const subtreeRootAgentIds = [
+        ...scopeValuesForKeys(grantScope, [
+            "managerAgentId",
+            "managerAgentIds",
+            "managedSubtreeAgentId",
+            "managedSubtreeAgentIds",
+            "subtreeAgentId",
+            "subtreeAgentIds",
+            "subtreeRootAgentId",
+            "subtreeRootAgentIds",
+        ]),
+        ...prefixedScopeValues(grantScope, "subtree:"),
+    ];
+    if (subtreeRootAgentIds.length > 0) {
+        constrained = true;
+        if (!targetAssigneeAgentId)
+            return false;
+        const agentsById = await loadSquadAgentHierarchy(db, squadId);
+        let matchesSubtree = false;
+        for (const rootAgentId of subtreeRootAgentIds) {
+            if (agentIsInSubtree(agentsById, rootAgentId, targetAssigneeAgentId)) {
+                matchesSubtree = true;
+                break;
+            }
+        }
+        if (!matchesSubtree)
+            return false;
+    }
+    // Unknown metadata keys do not constrain the grant. Recognized constraints
+    // return false above when they fail to match the requested assignment scope.
+    return !constrained ? true : constrained;
+}
+function allow(input) {
+    return { ...input, allowed: true };
+}
+function deny(input) {
+    return { ...input, allowed: false };
+}
+export function authorizationService(db) {
+    async function isInstanceAdmin(userId) {
+        if (!userId)
+            return false;
+        if (await db
+            .select({ id: instanceUserRoles.id })
+            .from(instanceUserRoles)
+            .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+            .then((rows) => rows[0] ?? null)) {
+            return true;
+        }
+        return false;
+    }
+    async function getActiveMembership(squadId, principalType, principalId) {
+        return db
+            .select()
+            .from(squadMemberships)
+            .where(and(eq(squadMemberships.squadId, squadId), eq(squadMemberships.principalType, principalType), eq(squadMemberships.principalId, principalId), eq(squadMemberships.status, "active")))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function findGrant(squadId, principalType, principalId, permissionKey) {
+        return db
+            .select()
+            .from(principalPermissionGrants)
+            .where(and(eq(principalPermissionGrants.squadId, squadId), eq(principalPermissionGrants.principalType, principalType), eq(principalPermissionGrants.principalId, principalId), eq(principalPermissionGrants.permissionKey, permissionKey)))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function decidePrincipalGrant(input) {
+        const membership = await getActiveMembership(input.squadId, input.principalType, input.principalId);
+        if (!membership) {
+            return deny({
+                action: input.action,
+                reason: "deny_missing_membership",
+                explanation: `${input.principalType} principal ${input.principalId} is not an active member of squad ${input.squadId}.`,
+            });
+        }
+        const grant = await findGrant(input.squadId, input.principalType, input.principalId, input.permissionKey);
+        if (!grant) {
+            return deny({
+                action: input.action,
+                reason: "deny_missing_grant",
+                explanation: `Missing permission: ${input.permissionKey}.`,
+            });
+        }
+        if (!(await scopeAllows(db, input.squadId, grant.scope, input.scope, {
+            requireStructuredScope: input.permissionKey === "tasks:assign_scope",
+        }))) {
+            return deny({
+                action: input.action,
+                reason: "deny_scope",
+                explanation: `Permission ${input.permissionKey} does not cover the requested scope.`,
+                grant: {
+                    principalType: input.principalType,
+                    principalId: input.principalId,
+                    permissionKey: input.permissionKey,
+                    scope: grant.scope ?? null,
+                },
+            });
+        }
+        return allow({
+            action: input.action,
+            reason: "allow_explicit_grant",
+            explanation: `Allowed by explicit grant ${input.permissionKey}.`,
+            grant: {
+                principalType: input.principalType,
+                principalId: input.principalId,
+                permissionKey: input.permissionKey,
+                scope: grant.scope ?? null,
+            },
+        });
+    }
+    async function loadAgent(agentId) {
+        return db
+            .select({
+            id: agents.id,
+            squadId: agents.squadId,
+            role: agents.role,
+            status: agents.status,
+            reportsTo: agents.reportsTo,
+            permissions: agents.permissions,
+        })
+            .from(agents)
+            .where(eq(agents.id, agentId))
+            .then((rows) => rows[0] ?? null);
+    }
+    async function loadProjectAuthorizationPolicy(squadId, projectId) {
+        const row = await db
+            .select({ executionWorkspacePolicy: projects.executionWorkspacePolicy })
+            .from(projects)
+            .where(and(eq(projects.id, projectId), eq(projects.squadId, squadId)))
+            .then((rows) => rows[0] ?? null);
+        return readPolicyObject(row?.executionWorkspacePolicy, "authorizationPolicy");
+    }
+    async function loadIssueAuthorizationPolicy(squadId, issueId) {
+        const row = await db
+            .select({ executionPolicy: issues.executionPolicy })
+            .from(issues)
+            .where(and(eq(issues.id, issueId), eq(issues.squadId, squadId)))
+            .then((rows) => rows[0] ?? null);
+        return readPolicyObject(row?.executionPolicy, "authorizationPolicy");
+    }
+    async function assignmentTargetIsInSquad(resource) {
+        if (resource.type !== "issue")
+            return true;
+        if (resource.assigneeAgentId) {
+            const target = await loadAgent(resource.assigneeAgentId);
+            return Boolean(target &&
+                target.squadId === resource.squadId &&
+                isSimpleAssignableAgentStatus(target.status));
+        }
+        if (resource.assigneeUserId) {
+            return Boolean(await getActiveMembership(resource.squadId, "user", resource.assigneeUserId));
+        }
+        return true;
+    }
+    async function assignmentPolicyEffect(resource) {
+        if (resource.type !== "issue")
+            return { kind: "none" };
+        const checks = [];
+        if (resource.assigneeAgentId) {
+            checks.push(loadAgent(resource.assigneeAgentId).then((agent) => evaluateAuthorizationPolicyForAssignment(readPolicyObject(agent?.permissions, "authorizationPolicy"), "Target agent")));
+        }
+        if (resource.projectId) {
+            checks.push(loadProjectAuthorizationPolicy(resource.squadId, resource.projectId).then((policy) => evaluateAuthorizationPolicyForAssignment(policy, "Target project")));
+        }
+        if (resource.issueId) {
+            checks.push(loadIssueAuthorizationPolicy(resource.squadId, resource.issueId).then((policy) => evaluateAuthorizationPolicyForAssignment(policy, "Target issue")));
+        }
+        if (resource.parentIssueId && resource.parentIssueId !== resource.issueId) {
+            checks.push(loadIssueAuthorizationPolicy(resource.squadId, resource.parentIssueId).then((policy) => evaluateAuthorizationPolicyForAssignment(policy, "Parent issue")));
+        }
+        if (checks.length === 0)
+            return { kind: "none" };
+        const effects = await Promise.all(checks);
+        return (effects.find((effect) => effect.kind === "unknown") ??
+            effects.find((effect) => effect.kind === "requires_approval") ??
+            effects.find((effect) => effect.kind === "restricted") ??
+            { kind: "none" });
+    }
+    async function isManagerOf(squadId, managerAgentId, assigneeAgentId) {
+        return isAgentInSubtree(db, squadId, managerAgentId, assigneeAgentId);
+    }
+    async function decide(input) {
+        const permissionKey = permissionForAction(input.action);
+        const squadId = squadIdForResource(input.resource);
+        async function decideWithTaskAssignmentGrants(principalType, principalId) {
+            const broadDecision = await decidePrincipalGrant({
+                squadId,
+                principalType,
+                principalId,
+                action: input.action,
+                permissionKey: "tasks:assign",
+                scope: input.scope,
+            });
+            if (broadDecision.allowed || broadDecision.reason === "deny_missing_membership")
+                return broadDecision;
+            const scopedDecision = await decidePrincipalGrant({
+                squadId,
+                principalType,
+                principalId,
+                action: input.action,
+                permissionKey: "tasks:assign_scope",
+                scope: input.scope,
+            });
+            if (scopedDecision.allowed || broadDecision.reason === "deny_missing_grant")
+                return scopedDecision;
+            return broadDecision;
+        }
+        async function denyForAssignmentPolicyIfNeeded(policyEffect) {
+            if (policyEffect.kind === "none" || policyEffect.kind === "restricted")
+                return null;
+            return deny({
+                action: input.action,
+                reason: "deny_policy_restricted",
+                explanation: policyEffect.explanation,
+            });
+        }
+        function denyRestrictedAssignmentPolicy(policyEffect) {
+            return deny({
+                action: input.action,
+                reason: "deny_policy_restricted",
+                explanation: policyEffect.kind === "restricted"
+                    ? policyEffect.explanation
+                    : "Restrictive authorization policy blocks simple squad-wide task assignment.",
+            });
+        }
+        if (input.actor.type === "none") {
+            return deny({
+                action: input.action,
+                reason: "deny_unauthenticated",
+                explanation: "Authentication required.",
+            });
+        }
+        if (input.actor.type === "operator") {
+            let taskAssignmentPolicyEffect = null;
+            if (input.actor.source === "local_implicit") {
+                return allow({
+                    action: input.action,
+                    reason: "allow_local_operator",
+                    explanation: "Allowed because the actor is the local implicit operator.",
+                });
+            }
+            if (input.actor.isInstanceAdmin || await isInstanceAdmin(input.actor.userId)) {
+                return allow({
+                    action: input.action,
+                    reason: "allow_instance_admin",
+                    explanation: "Allowed because the actor is an instance admin.",
+                });
+            }
+            if (!input.actor.userId) {
+                return deny({
+                    action: input.action,
+                    reason: "deny_unauthenticated",
+                    explanation: "Operator user id is required.",
+                });
+            }
+            if (input.action === "tasks:assign") {
+                if (!(await assignmentTargetIsInSquad(input.resource))) {
+                    return deny({
+                        action: input.action,
+                        reason: "deny_squad_boundary",
+                        explanation: "Task assignment target agent is not active in the target squad.",
+                    });
+                }
+                const policyEffect = await assignmentPolicyEffect(input.resource);
+                taskAssignmentPolicyEffect = policyEffect;
+                const policyDeny = await denyForAssignmentPolicyIfNeeded(policyEffect);
+                if (policyDeny)
+                    return policyDeny;
+                const membership = await getActiveMembership(squadId, "user", input.actor.userId);
+                if (policyEffect.kind === "none" && membership && membership.membershipRole !== "viewer") {
+                    return allow({
+                        action: input.action,
+                        reason: "allow_simple_squad_member",
+                        explanation: "Allowed by simple mode squad-wide task assignment default.",
+                    });
+                }
+            }
+            if (!permissionKey) {
+                return deny({
+                    action: input.action,
+                    reason: "deny_unsupported_action",
+                    explanation: `No operator permission mapping exists for ${input.action}.`,
+                });
+            }
+            if (input.action === "tasks:assign") {
+                const grantDecision = await decideWithTaskAssignmentGrants("user", input.actor.userId);
+                if (grantDecision.allowed)
+                    return grantDecision;
+                const policyEffect = taskAssignmentPolicyEffect ?? await assignmentPolicyEffect(input.resource);
+                if (policyEffect.kind === "restricted")
+                    return denyRestrictedAssignmentPolicy(policyEffect);
+                return grantDecision;
+            }
+            return decidePrincipalGrant({
+                squadId,
+                principalType: "user",
+                principalId: input.actor.userId,
+                action: input.action,
+                permissionKey,
+                scope: input.scope,
+            });
+        }
+        const actorAgentId = input.actor.agentId ?? null;
+        if (!actorAgentId) {
+            return deny({
+                action: input.action,
+                reason: "deny_unauthenticated",
+                explanation: "Agent authentication required.",
+            });
+        }
+        if (input.actor.squadId !== squadId) {
+            return deny({
+                action: input.action,
+                reason: "deny_squad_boundary",
+                explanation: "Agent key cannot access another squad.",
+            });
+        }
+        const actorAgent = await loadAgent(actorAgentId);
+        if (!actorAgent || actorAgent.squadId !== squadId) {
+            return deny({
+                action: input.action,
+                reason: "deny_squad_boundary",
+                explanation: "Actor agent was not found in the target squad.",
+            });
+        }
+        if (input.action === "tasks:assign") {
+            if (!isSimpleAssignableAgentStatus(actorAgent.status)) {
+                return deny({
+                    action: input.action,
+                    reason: "deny_missing_membership",
+                    explanation: "Actor agent is not active for simple mode task assignment.",
+                });
+            }
+            if (!(await assignmentTargetIsInSquad(input.resource))) {
+                return deny({
+                    action: input.action,
+                    reason: "deny_squad_boundary",
+                    explanation: "Task assignment target agent is not active in the target squad.",
+                });
+            }
+            const policyEffect = await assignmentPolicyEffect(input.resource);
+            const policyDeny = await denyForAssignmentPolicyIfNeeded(policyEffect);
+            if (policyDeny)
+                return policyDeny;
+            if (policyEffect.kind === "restricted") {
+                const grantDecision = await decideWithTaskAssignmentGrants("agent", actorAgentId);
+                if (grantDecision.allowed)
+                    return grantDecision;
+                return denyRestrictedAssignmentPolicy(policyEffect);
+            }
+            return allow({
+                action: input.action,
+                reason: "allow_simple_squad_member",
+                explanation: "Allowed by simple mode squad-wide task assignment default.",
+            });
+        }
+        if (input.action === "issue:mutate") {
+            const resource = input.resource.type === "issue" ? input.resource : null;
+            if (resource?.assigneeAgentId === actorAgentId) {
+                return allow({
+                    action: input.action,
+                    reason: "allow_self",
+                    explanation: "Allowed because the actor owns the assigned issue.",
+                });
+            }
+            if (!resource?.assigneeAgentId) {
+                return allow({
+                    action: input.action,
+                    reason: "allow_squad_agent",
+                    explanation: "Allowed because the issue has no agent assignee.",
+                });
+            }
+        }
+        if (input.action === "agent_config:update" &&
+            input.resource.type === "agent" &&
+            input.resource.agentId === actorAgentId) {
+            return allow({
+                action: input.action,
+                reason: "allow_self",
+                explanation: "Allowed because the actor is updating its own agent configuration.",
+            });
+        }
+        if (permissionKey) {
+            const grantDecision = await decidePrincipalGrant({
+                squadId,
+                principalType: "agent",
+                principalId: actorAgentId,
+                action: input.action,
+                permissionKey,
+                scope: input.scope,
+            });
+            if (grantDecision.allowed)
+                return grantDecision;
+        }
+        if ((input.action === "agents:create" ||
+            input.action === "agent_config:read" ||
+            input.action === "agent_config:update" ||
+            input.action === "tasks:manage_active_checkouts") &&
+            canCreateAgentsLegacy(actorAgent)) {
+            return allow({
+                action: input.action,
+                reason: "allow_legacy_agent_creator",
+                explanation: "Allowed by legacy agent creator authority.",
+            });
+        }
+        if (input.action === "tasks:manage_active_checkouts" &&
+            input.resource.type === "issue" &&
+            input.resource.assigneeAgentId &&
+            await isManagerOf(squadId, actorAgentId, input.resource.assigneeAgentId)) {
+            return allow({
+                action: input.action,
+                reason: "allow_manager_chain",
+                explanation: "Allowed because the actor manages the issue assignee in the reporting chain.",
+            });
+        }
+        return deny({
+            action: input.action,
+            reason: "deny_missing_grant",
+            explanation: permissionKey
+                ? `Missing permission: ${permissionKey}.`
+                : `No agent permission mapping exists for ${input.action}.`,
+        });
+    }
+    return {
+        decide,
+        decidePrincipalGrant,
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/services/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/services/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,iBAAiB,EACjB,MAAM,EACN,yBAAyB,EACzB,QAAQ,GACT,MAAM,aAAa,CAAC;AA0ErB,SAAS,kBAAkB,CAAC,QAA+B;IACzD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA2B;IACtD,IAAI,MAAM,KAAK,mBAAmB,IAAI,MAAM,KAAK,qBAAqB;QAAE,OAAO,eAAe,CAAC;IAC/F,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgF;IAC7G,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAmC,EAAE,MAAc;IAC9E,OAAO,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAmC,EAAE,IAAc;IAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAa,EAAE,EAA6B;IACnE,OAAO,OAAO,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,6BAA6B,CAAC,MAAiC;IACtE,OAAO,MAAM,KAAK,kBAAkB,IAAI,MAAM,KAAK,YAAY,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAkB,EAAE,GAAW;IACvD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAUD,SAAS,wCAAwC,CAC/C,MAAkD,EAClD,KAAa;IAEb,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAE9D,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAChC,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7F,MAAM,qBAAqB,GAAG,OAAO,CAAC,eAAe,IAAI,gBAAgB,IAAI,cAAc,CAAC,CAAC;IAC7F,IAAI,qBAAqB,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,GAAG,KAAK,+EAA+E;SACrG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,cAAc,IAAI,cAAc,KAAK,cAAc,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,GAAG,KAAK,mDAAmD;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,cAAc,IAAI,cAAc,KAAK,eAAe,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,GAAG,KAAK,6CAA6C;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GACpB,WAAW,CAAC,cAAc,EAAE,gBAAgB,CAAC,KAAK,IAAI;QACtD,WAAW,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,KAAK,IAAI,CAAC;IACzE,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,GAAG,KAAK,4CAA4C;SAClE,CAAC;IACJ,CAAC;IAED,IACE,cAAc,KAAK,SAAS;QAC5B,WAAW,CAAC,eAAe,EAAE,0BAA0B,CAAC,KAAK,IAAI,EACjE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,GAAG,KAAK,+DAA+D;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,GAAG,KAAK,0DAA0D;SAChF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA0C,EAC1C,WAAmB,EACnB,aAAqB;IAErB,IAAI,WAAW,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAE/C,IAAI,MAAM,GAAkB,aAAa,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,SAAS,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAM,EAAE,OAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACtD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,OAAe,EAAE,WAAmB,EAAE,aAAqB;IACjG,OAAO,gBAAgB,CACrB,MAAM,uBAAuB,CAAC,EAAE,EAAE,OAAO,CAAC,EAC1C,WAAW,EACX,aAAa,CACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,EAAM,EACN,OAAe,EACf,UAA0C,EAC1C,cAA0D,EAC1D,UAAgD,EAAE;IAElD,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChG,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,qBAAqB,GACzB,OAAO,cAAc,CAAC,eAAe,KAAK,QAAQ;QAChD,CAAC,CAAC,cAAc,CAAC,eAAe;QAChC,CAAC,CAAC,OAAO,cAAc,CAAC,aAAa,KAAK,QAAQ;YAChD,CAAC,CAAC,cAAc,CAAC,aAAa;YAC9B,CAAC,CAAC,IAAI,CAAC;IACb,MAAM,kBAAkB,GAAG,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACvC,GAAG,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC;QACxC,GAAG,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC;KAC/C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,kBAAkB,CAAC;YAAE,OAAO,KAAK,CAAC;IACrE,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,GAAG,kBAAkB,CAAC,UAAU,EAAE;YAChC,SAAS;YACT,UAAU;YACV,iBAAiB;YACjB,kBAAkB;YAClB,eAAe;YACf,gBAAgB;SACjB,CAAC;QACF,GAAG,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC;KAC7C,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,qBAAqB,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IAED,MAAM,mBAAmB,GAAG;QAC1B,GAAG,kBAAkB,CAAC,UAAU,EAAE;YAChC,gBAAgB;YAChB,iBAAiB;YACjB,uBAAuB;YACvB,wBAAwB;YACxB,gBAAgB;YAChB,iBAAiB;YACjB,oBAAoB;YACpB,qBAAqB;SACtB,CAAC;QACF,GAAG,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC;KAC/C,CAAC;IACF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,qBAAqB;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,KAAK,MAAM,WAAW,IAAI,mBAAmB,EAAE,CAAC;YAC9C,IAAI,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,qBAAqB,CAAC,EAAE,CAAC;gBACrE,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AAC3C,CAAC;AAED,SAAS,KAAK,CAAC,KAA6C;IAC1D,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,IAAI,CAAC,KAA6C;IACzD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAM;IACzC,KAAK,UAAU,eAAe,CAAC,MAAiC;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IACE,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC;aACpC,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;aAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAClC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,aAA4B,EAC5B,WAAmB;QAEnB,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EACrC,EAAE,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,EACjD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtC,CACF;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,aAA4B,EAC5B,WAAmB,EACnB,aAA4B;QAE5B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,yBAAyB,CAAC;aAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9C,EAAE,CAAC,yBAAyB,CAAC,aAAa,EAAE,aAAa,CAAC,EAC1D,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,WAAW,CAAC,EACtD,EAAE,CAAC,yBAAyB,CAAC,aAAa,EAAE,aAAa,CAAC,CAC3D,CACF;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,KAOnC;QACC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACpG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,GAAG,KAAK,CAAC,aAAa,cAAc,KAAK,CAAC,WAAW,qCAAqC,KAAK,CAAC,OAAO,GAAG;aACxH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1G,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,uBAAuB,KAAK,CAAC,aAAa,GAAG;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC/D,sBAAsB,EAAE,KAAK,CAAC,aAAa,KAAK,oBAAoB;SACrE,CAAC,CAAC,EACH,CAAC;YACD,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,cAAc,KAAK,CAAC,aAAa,sCAAsC;gBACpF,KAAK,EAAE;oBACL,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,sBAAsB;YAC9B,WAAW,EAAE,6BAA6B,KAAK,CAAC,aAAa,GAAG;YAChE,KAAK,EAAE;gBACL,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,OAAe;QACtC,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;aAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,8BAA8B,CAAC,OAAe,EAAE,SAAiB;QAC9E,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,EAAE,CAAC;aACvE,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aACrE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,OAAO,gBAAgB,CAAC,GAAG,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,4BAA4B,CAAC,OAAe,EAAE,OAAe;QAC1E,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;aACnD,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;aAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,OAAO,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,UAAU,yBAAyB,CAAC,QAA+B;QACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,OAAO,CACZ,MAAM;gBACN,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;gBACnC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,QAA+B;QACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAEvD,MAAM,MAAM,GAA2C,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACjD,wCAAwC,CACtC,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,CAAC,EAC3D,cAAc,CACf,CACF,CACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,8BAA8B,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACnF,wCAAwC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CACnE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,4BAA4B,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC/E,wCAAwC,CAAC,MAAM,EAAE,cAAc,CAAC,CACjE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,4BAA4B,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrF,wCAAwC,CAAC,MAAM,EAAE,cAAc,CAAC,CACjE,CACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;YACtD,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,cAAsB,EAAE,eAAuB;QACzF,OAAO,gBAAgB,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAKrB;QACC,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnD,KAAK,UAAU,8BAA8B,CAC3C,aAA4B,EAC5B,WAAmB;YAEnB,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;gBAC/C,OAAO;gBACP,aAAa;gBACb,WAAW;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,cAAc;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,yBAAyB;gBAAE,OAAO,aAAa,CAAC;YACtG,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC;gBAChD,OAAO;gBACP,aAAa;gBACb,WAAW;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,oBAAoB;gBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,oBAAoB;gBAAE,OAAO,cAAc,CAAC;YACnG,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,KAAK,UAAU,+BAA+B,CAC5C,YAAoC;YAEpC,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAC;YACpF,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,YAAY,CAAC,WAAW;aACtC,CAAC,CAAC;QACL,CAAC;QAED,SAAS,8BAA8B,CAAC,YAAoC;YAC1E,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EACT,YAAY,CAAC,IAAI,KAAK,YAAY;oBAChC,CAAC,CAAC,YAAY,CAAC,WAAW;oBAC1B,CAAC,CAAC,4EAA4E;aACnF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,sBAAsB;gBAC9B,WAAW,EAAE,0BAA0B;aACxC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,0BAA0B,GAAkC,IAAI,CAAC;YACrE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,sBAAsB;oBAC9B,WAAW,EAAE,2DAA2D;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,CAAC,eAAe,IAAI,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,OAAO,KAAK,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,sBAAsB;oBAC9B,WAAW,EAAE,iDAAiD;iBAC/D,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,sBAAsB;oBAC9B,WAAW,EAAE,+BAA+B;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBACvD,OAAO,IAAI,CAAC;wBACV,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,qBAAqB;wBAC7B,WAAW,EAAE,iEAAiE;qBAC/E,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClE,0BAA0B,GAAG,YAAY,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,UAAU;oBAAE,OAAO,UAAU,CAAC;gBAClC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAClF,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,IAAI,UAAU,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;oBACzF,OAAO,KAAK,CAAC;wBACX,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,2BAA2B;wBACnC,WAAW,EAAE,4DAA4D;qBAC1E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,6CAA6C,KAAK,CAAC,MAAM,GAAG;iBAC1E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvF,IAAI,aAAa,CAAC,OAAO;oBAAE,OAAO,aAAa,CAAC;gBAChD,MAAM,YAAY,GAAG,0BAA0B,IAAI,MAAM,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAChG,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;gBAC5F,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,oBAAoB,CAAC;gBAC1B,OAAO;gBACP,aAAa,EAAE,MAAM;gBACrB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,sBAAsB;gBAC9B,WAAW,EAAE,gCAAgC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,wCAAwC;aACtD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,gDAAgD;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,4DAA4D;iBAC1E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;oBACV,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,qBAAqB;oBAC7B,WAAW,EAAE,iEAAiE;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,MAAM,+BAA+B,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvC,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,aAAa,CAAC,OAAO;oBAAE,OAAO,aAAa,CAAC;gBAChD,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,2BAA2B;gBACnC,WAAW,EAAE,4DAA4D;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,IAAI,QAAQ,EAAE,eAAe,KAAK,YAAY,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,YAAY;oBACpB,WAAW,EAAE,oDAAoD;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,mBAAmB;oBAC3B,WAAW,EAAE,kDAAkD;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IACE,KAAK,CAAC,MAAM,KAAK,qBAAqB;YACtC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;YAC/B,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,YAAY,EACvC,CAAC;YACD,OAAO,KAAK,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,oEAAoE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;gBAC/C,OAAO;gBACP,aAAa,EAAE,OAAO;gBACtB,WAAW,EAAE,YAAY;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,OAAO;gBAAE,OAAO,aAAa,CAAC;QAClD,CAAC;QAED,IACE,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe;YAC/B,KAAK,CAAC,MAAM,KAAK,mBAAmB;YACpC,KAAK,CAAC,MAAM,KAAK,qBAAqB;YACtC,KAAK,CAAC,MAAM,KAAK,+BAA+B,CAAC;YACnD,qBAAqB,CAAC,UAAU,CAAC,EACjC,CAAC;YACD,OAAO,KAAK,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,4BAA4B;gBACpC,WAAW,EAAE,4CAA4C;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IACE,KAAK,CAAC,MAAM,KAAK,+BAA+B;YAChD,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;YAC/B,KAAK,CAAC,QAAQ,CAAC,eAAe;YAC9B,MAAM,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EACxE,CAAC;YACD,OAAO,KAAK,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,8EAA8E;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,oBAAoB;YAC5B,WAAW,EAAE,aAAa;gBACxB,CAAC,CAAC,uBAAuB,aAAa,GAAG;gBACzC,CAAC,CAAC,0CAA0C,KAAK,CAAC,MAAM,GAAG;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM;QACN,oBAAoB;KACrB,CAAC;AACJ,CAAC"}

package/dist/services/botfather/authoring-lock.d.ts

@@ -0,0 +1,17 @@
+import { readBotfatherConfigSection } from "../../config-file.js";
+import { readBotfatherCredentials } from "./credentials.js";
+/**
+ * Tower-only authoring lock predicate. An instance is "tower-governed" — and so
+ * local skill authoring/import is disabled — when a control-tower URL is
+ * configured AND the instance is enrolled (active credentials with an apiKey
+ * exist). Standalone or not-yet-enrolled instances are NOT governed, so their
+ * local skill authoring keeps working exactly as before.
+ *
+ * See DESIGN-skill-registry.md §8.1. Kept tiny + dependency-injectable so the
+ * decision is unit-testable without touching disk.
+ */
+export declare function isTowerGoverned(deps?: {
+    readConfigSection?: typeof readBotfatherConfigSection;
+    readCredentials?: typeof readBotfatherCredentials;
+}): boolean;
+//# sourceMappingURL=authoring-lock.d.ts.map

package/dist/services/botfather/authoring-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-lock.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/authoring-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE;IACJ,iBAAiB,CAAC,EAAE,OAAO,0BAA0B,CAAC;IACtD,eAAe,CAAC,EAAE,OAAO,wBAAwB,CAAC;CAC9C,GACL,OAAO,CAQT"}