@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/dist/activities/execute-cursor/hook-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuJG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC3H,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAEhF,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,uEAAuE;AACvE,oEAAoE;AACpE,oGAAoG;AACpG,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GACxC,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,YAAY,CAAC;AAEf,0EAA0E;AAC1E,0EAA0E;AAC1E,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,CAAC,MAAM,4BAA4B,GACvC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AACjE,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,2EAA2E;IAC3E,qCAAqC,CAAC;AAExC,2EAA2E;AAC3E,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,+BAA+B;AAC/B,MAAM,+BAA+B,GACnC,iFAAiF;IACjF,kFAAkF;IAClF,eAAe,CAAC;AAElB;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,2BAA2B;QAC3B,8DAA8D;QAC9D,2FAA2F;QAC3F,8BAA8B;QAC9B,4DAA4D;QAC5D,wBAAwB;QACxB,8GAA8G;QAC9G,2FAA2F;QAC3F,qCAAqC;QACrC,wBAAwB;QACxB,qBAAqB;QACrB,oIAAoI;QACpI,oEAAoE;QACpE,uEAAuE;QACvE,gEAAgE;QAChE,oBAAoB;QACpB,wGAAwG;QACxG,kEAAkE;QAClE,uJAAuJ;QACvJ,mBAAmB;QACnB,KAAK;KACN,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAS,oBAAoB;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO;QACL,mCAAmC;QACnC,MAAM;QACN,0EAA0E;QAC1E,sHAAsH;QACtH,+BAA+B;QAC/B,4FAA4F;QAC5F,kCAAkC;QAClC,aAAa,qBAAqB,CAAC,QAAQ,EAAE,IAAI;QACjD,yHAAyH;QACzH,2BAA2B;QAC3B,gEAAgE;QAChE,kBAAkB;QAClB,gBAAgB;QAChB,wBAAwB;QACxB,UAAU;QACV,0DAA0D;QAC1D,sCAAsC;QACtC,4DAA4D;QAC5D,mGAAmG;QACnG,mBAAmB;QACnB,6BAA6B,SAAS,KAAK;QAC3C,uDAAuD;QACvD,gDAAgD;QAChD,eAAe,QAAQ,GAAG;QAC1B,YAAY,OAAO,UAAU;QAC7B,gBAAgB,QAAQ,6DAA6D;QACrF,+BAA+B;QAC/B,uEAAuE;QACvE,GAAG;QACH,iBAAiB,OAAO,wDAAwD;QAChF,4BAA4B;QAC5B,yEAAyE;QACzE,6GAA6G;QAC7G,GAAG;QACH,gBAAgB,OAAO,0DAA0D;QACjF,4BAA4B;QAC5B,yEAAyE;QACzE,uJAAuJ;QACvJ,2EAA2E,YAAY,IAAI,UAAU,kCAAkC;QACvI,GAAG;QACH,GAAG;QACH,UAAU;QACV,sCAAsC,WAAW,gBAAgB;QACjE,yIAAyI;QACzI,SAAS,SAAS,mBAAmB;QACrC,cAAc;QACd,GAAG;QACH,GAAG;QACH,mCAAmC;KACpC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,qEAAqE;QACrE,oBAAoB,EAAE;QACtB,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB;QACpB,sEAAsE;QACtE,sEAAsE;QACtE,YAAY;QACZ,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,qDAAqD;QACrD,sBAAsB;QACtB,sDAAsD;QACtD,0CAA0C;QAC1C,aAAa,sBAAsB,0FAA0F;QAC7H,qPAAqP;KACtP,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;GAKG;AACH,SAAS,eAAe,CAAC,kBAA0B;IACjD,OAAO,6BAA6B,CAAC,OAAO,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;;YAgBG,OAAO;eACJ,iBAAiB;;;;;;;;;;;;;;;YAepB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAoGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsC5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAiCkD,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDA4CpC,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAmF7B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAqDR,oBAAoB;;;;;;;;;;+EAUd,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;sDAwBzC,4BAA4B;;;;;;;;;;;;;;;;;oDAiB9B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;sCAuB7C,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;2FAoBU,oBAAoB;;wCAEvE,wBAAwB;mFACmB,wBAAwB;;;;;;;;;;;;;;;;kDAgBzD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAgCjE,eAAe,CAAC,YAAY,CAAC;;;;;;;;;;;;sDAYY,6BAA6B;;;;oDAI/B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAyCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAmC9B,6BAA6B;;;;gDAI/B,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}

package/dist/activities/execute-cursor/hook-server.d.ts

@@ -0,0 +1,152 @@
+/**
+ * The Cursor engine's hook server: where an agent's hooks run on this
+ * engine. The turn's evaluator (`shared/hooks/evaluate.ts`) runs inside the
+ * runner, and the approval gate's bash script (`hook-script.ts`) reaches it
+ * over a local socket for every call it is asked about.
+ *
+ * WHY IN THE RUNNER. Everything the evaluator needs already lives here: the
+ * plugins' tamper guards, whose reference is kept in memory because the
+ * agent's shell can rewrite any file on disk; the hook leases; the run's
+ * values; the turn's stop; and the activity the stall watchdog reads, which
+ * a hook's pulses must reach so a long hook is not taken for a hung engine.
+ * A separate process would need all of that written to disk.
+ *
+ * THE SOCKET. A Unix socket (`hooks.sock`, mode 0600) in a directory of
+ * its own under the system's temporary directory, created for the turn
+ * (mode 0700) and removed with the server, which opens when the gate is
+ * installed for an agent with hooks and closes with it. Not in the gate's
+ * directory under the home directory: a socket's path has a short platform
+ * limit, and a home directory can be long. The script finds the socket
+ * through the active-turn pointer, and a request carries a per-turn random
+ * token from the same pointer; one without it is refused. The agent's shell
+ * can read that pointer too, and all the token gains it is running the
+ * agent's own hooks on calls it makes up: a real call's answer is the
+ * script's to act on, and the script is not the shell's. Requests are
+ * served independently: the evaluator keeps no per-call state.
+ *
+ * THE PROTOCOL. One JSON line in, one JSON line out. A `pre` request carries
+ * the hook payload of a `preToolUse` (a built-in) or `beforeMCPExecution`
+ * (an MCP tool, the event that names its server), and the identity tokens
+ * the script computed for the call (its own, its coarse one, and the exact
+ * one a hook's ask is granted or refused under); the reply is the decision and the
+ * ready-made answers the script prints for each outcome, so the bash side
+ * only chooses. A `post` request carries a `postToolUse` payload and is
+ * answered with the context the hooks hand back to the model, under the
+ * same heading the native engine appends.
+ *
+ * A call a person skipped or rejected earlier this run is answered
+ * `refused` when a hook would allow it or ask on it again, with the
+ * person's own decision as the model's reason: a person's refusal binds on
+ * the model's retry, as on the native engine. A refusal of a hook's ask
+ * binds that exact call, as its approval would have. Only a hook's deny
+ * comes before it.
+ *
+ * A hook that moves a write or a deletion to another file is checked
+ * again, as the native engine checks a rewrite: onto a secret-like path the
+ * call is blocked as the gate blocks such a write; in capture mode it is
+ * refused, since capture reviewed the path the model wrote.
+ *
+ * A hook that asks and also rewrites the call is refused unless the run is
+ * trusted whole: this engine's card is the model's own call, so a person
+ * would approve arguments other than the ones that run, and the grant that
+ * approval leaves would let the rewrite through on the retry.
+ *
+ * Every allow and ask is recorded ({@link HookDecisionLog}) under the
+ * call's identity, so the translator can name the deciding hook on the row
+ * of a call that ran.
+ */
+import { type Socket } from "node:net";
+import type { PolicySource } from "../../shared/approval-policy.js";
+import type { HookEvaluator } from "../../shared/hooks/evaluate.js";
+import { type PersonRefusal } from "./approval-state.js";
+/** A hook's decision on a call that may run, as the row of that call is stamped. */
+export interface HookDecisionRecord {
+    readonly provenance: PolicySource;
+    readonly hook: string;
+}
+/**
+ * The hooks' decisions on the calls of this turn, by the call's coarse
+ * identity (`grantToken` of its key and salient) and, when a hook rewrote
+ * the call, the identity of the call as rewritten; oldest first. The
+ * translator takes each when the call's row shows up on the stream. A row
+ * that names the same path relatively, where the hook saw it absolute, is
+ * the same call; a row of the same tool on anything else is not.
+ */
+export declare class HookDecisionLog {
+    private readonly records;
+    record(tokens: readonly string[], record: HookDecisionRecord): void;
+    /** The decision on a streamed call, consumed; `undefined` when no hook decided it. */
+    take(name: string, mcpServerSlug: string, input: Record<string, unknown>): HookDecisionRecord | undefined;
+}
+/** Why a hook's ask with a rewrite is refused; the agent reads it. */
+export declare function askWithRewriteMessage(hook: string): string;
+/** What the script receives for a `pre` request; every answer is the JSON it prints. */
+export interface PreReply {
+    readonly decision: "allow" | "deny" | "ask" | "refused" | "none";
+    /** The deciding plugin's slug (`""` for the agent's own block); absent when no hook decided, or for `refused`. */
+    readonly hook?: string;
+    readonly allow?: string;
+    readonly deny?: string;
+    readonly approval?: string;
+    readonly unattended?: string;
+    /** The refusal (deny, refused) or the card's message (ask), for the ledger. */
+    readonly message?: string;
+}
+/** The turn's hook server. */
+export interface HookServer {
+    readonly socketPath: string;
+    readonly token: string;
+    readonly decisions: HookDecisionLog;
+    /** Stops serving and removes the socket; idempotent. */
+    close(): Promise<void>;
+}
+/** What of the turn's approval state the server's answers depend on. */
+export interface HookTurnMode {
+    /** The turn captures its file changes for review (`TurnWorkspace.captureMode`). */
+    readonly captureMode: boolean;
+    /** "Trust this whole run" is armed: every ask is satisfied, and its row says so. */
+    readonly globalBypass: boolean;
+}
+export interface HookServerParams extends HookTurnMode {
+    readonly evaluator: HookEvaluator;
+    /** The calls a person skipped or rejected this run, by identity token (`buildPersonRefusals`). */
+    readonly refusals: ReadonlyMap<string, PersonRefusal>;
+}
+/** A socket path the platform cannot bind: an infrastructure fault, never a silent skip. */
+export declare class HookSocketPathError extends Error {
+    constructor(path: string);
+}
+/** Start serving the turn's hooks. */
+export declare function startHookServer(params: HookServerParams): Promise<HookServer>;
+/** Answers the script's requests; exported for the module's tests. */
+export declare class HookRequestHandler {
+    private readonly evaluator;
+    private readonly refusals;
+    private readonly decisions;
+    private readonly turn;
+    private readonly maxRequestBytes;
+    private readonly tokenBytes;
+    /** Each MCP call's server, by tool and arguments, from its `beforeMCPExecution`: `postToolUse` names no server ({@link rememberMcpServer}). */
+    private readonly mcpServers;
+    constructor(evaluator: HookEvaluator, refusals: ReadonlyMap<string, PersonRefusal>, decisions: HookDecisionLog, token: string, turn?: HookTurnMode, maxRequestBytes?: number);
+    serve(socket: Socket): void;
+    /** One request line to its reply; a request without the turn's token is refused. */
+    answer(line: string): Promise<unknown>;
+    private authorized;
+    private pre;
+    /** A write or a deletion a hook moved to another file, refused or blocked, naming the hook; `undefined` when it stays put. */
+    private movedFile;
+    private post;
+    /** The call a pre-execution payload asks about; `undefined` for an event the server does not answer. */
+    private callOf;
+    /**
+     * An MCP call that may run, by tool and arguments, for its `postToolUse`,
+     * which names no server. A refused call never runs, so it is not
+     * remembered; the newest is taken first, since a call's `postToolUse`
+     * follows its own `beforeMCPExecution`, and each list keeps only the
+     * latest few (a call held for a person, or refused by the default gate,
+     * stays behind).
+     */
+    private rememberMcpServer;
+    private takeMcpServer;
+}

package/dist/activities/execute-cursor/hook-server.js

@@ -0,0 +1,422 @@
+/**
+ * The Cursor engine's hook server: where an agent's hooks run on this
+ * engine. The turn's evaluator (`shared/hooks/evaluate.ts`) runs inside the
+ * runner, and the approval gate's bash script (`hook-script.ts`) reaches it
+ * over a local socket for every call it is asked about.
+ *
+ * WHY IN THE RUNNER. Everything the evaluator needs already lives here: the
+ * plugins' tamper guards, whose reference is kept in memory because the
+ * agent's shell can rewrite any file on disk; the hook leases; the run's
+ * values; the turn's stop; and the activity the stall watchdog reads, which
+ * a hook's pulses must reach so a long hook is not taken for a hung engine.
+ * A separate process would need all of that written to disk.
+ *
+ * THE SOCKET. A Unix socket (`hooks.sock`, mode 0600) in a directory of
+ * its own under the system's temporary directory, created for the turn
+ * (mode 0700) and removed with the server, which opens when the gate is
+ * installed for an agent with hooks and closes with it. Not in the gate's
+ * directory under the home directory: a socket's path has a short platform
+ * limit, and a home directory can be long. The script finds the socket
+ * through the active-turn pointer, and a request carries a per-turn random
+ * token from the same pointer; one without it is refused. The agent's shell
+ * can read that pointer too, and all the token gains it is running the
+ * agent's own hooks on calls it makes up: a real call's answer is the
+ * script's to act on, and the script is not the shell's. Requests are
+ * served independently: the evaluator keeps no per-call state.
+ *
+ * THE PROTOCOL. One JSON line in, one JSON line out. A `pre` request carries
+ * the hook payload of a `preToolUse` (a built-in) or `beforeMCPExecution`
+ * (an MCP tool, the event that names its server), and the identity tokens
+ * the script computed for the call (its own, its coarse one, and the exact
+ * one a hook's ask is granted or refused under); the reply is the decision and the
+ * ready-made answers the script prints for each outcome, so the bash side
+ * only chooses. A `post` request carries a `postToolUse` payload and is
+ * answered with the context the hooks hand back to the model, under the
+ * same heading the native engine appends.
+ *
+ * A call a person skipped or rejected earlier this run is answered
+ * `refused` when a hook would allow it or ask on it again, with the
+ * person's own decision as the model's reason: a person's refusal binds on
+ * the model's retry, as on the native engine. A refusal of a hook's ask
+ * binds that exact call, as its approval would have. Only a hook's deny
+ * comes before it.
+ *
+ * A hook that moves a write or a deletion to another file is checked
+ * again, as the native engine checks a rewrite: onto a secret-like path the
+ * call is blocked as the gate blocks such a write; in capture mode it is
+ * refused, since capture reviewed the path the model wrote.
+ *
+ * A hook that asks and also rewrites the call is refused unless the run is
+ * trusted whole: this engine's card is the model's own call, so a person
+ * would approve arguments other than the ones that run, and the grant that
+ * approval leaves would let the rewrite through on the retry.
+ *
+ * Every allow and ask is recorded ({@link HookDecisionLog}) under the
+ * call's identity, so the translator can name the deciding hook on the row
+ * of a call that ran.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { HOOK_FEEDBACK_HEADING, hookAskMessage, hookLabel, hookRefusalMessage, personDecisionSentence } from "../../shared/hooks/messages.js";
+import { grantToken, toolIdentity } from "./approval-state.js";
+import { extractArgKey } from "./approval-policy.js";
+import { rowNameOf } from "./hook-views.js";
+import { isSecretLikePath } from "../../shared/filereview/secret-paths.js";
+import { APPROVAL_REQUIRED_AGENT_MESSAGE, SECRET_BLOCKED_AGENT_MESSAGE, UNATTENDED_SKIP_AGENT_MESSAGE } from "./hook-script.js";
+const SOCKET_FILE = "hooks.sock";
+/** The longest socket path the platform takes (`sun_path`: 104 bytes on macOS, 108 on Linux). */
+const MAX_SOCKET_PATH_BYTES = process.platform === "darwin" ? 103 : 107;
+/** The most servers remembered for one MCP tool and its arguments. */
+const MAX_REMEMBERED_SERVERS = 8;
+/** The most a request may carry; a call's payload is far smaller. */
+const MAX_REQUEST_BYTES = 64 * 1024 * 1024;
+/**
+ * The hooks' decisions on the calls of this turn, by the call's coarse
+ * identity (`grantToken` of its key and salient) and, when a hook rewrote
+ * the call, the identity of the call as rewritten; oldest first. The
+ * translator takes each when the call's row shows up on the stream. A row
+ * that names the same path relatively, where the hook saw it absolute, is
+ * the same call; a row of the same tool on anything else is not.
+ */
+export class HookDecisionLog {
+    records = [];
+    record(tokens, record) {
+        const ids = tokens.map(identityOfToken);
+        this.records.push({ tokens, key: ids[0]?.key ?? "", salients: ids.map((id) => id.salient), record });
+    }
+    /** The decision on a streamed call, consumed; `undefined` when no hook decided it. */
+    take(name, mcpServerSlug, input) {
+        const id = toolIdentity(name, mcpServerSlug, input);
+        const token = grantToken(id.key, id.salient);
+        let index = this.records.findIndex((r) => r.tokens.includes(token));
+        if (index === -1)
+            index = this.records.findIndex((r) => r.key === id.key && r.salients.some((salient) => samePath(salient, id.salient)));
+        if (index === -1)
+            return undefined;
+        const [taken] = this.records.splice(index, 1);
+        return taken.record;
+    }
+}
+/** Why a hook's ask with a rewrite is refused; the agent reads it. */
+export function askWithRewriteMessage(hook) {
+    return `${hookLabel(hook)} asked for approval of this call and rewrote it too. An approval here would show the call as written, not as rewritten, so the call was refused.`;
+}
+/** How a hook's allow or ask is stamped on its row, as the native gate stamps it. */
+function provenanceOf(decision, leased, globalBypass) {
+    if (decision === "ask" && globalBypass)
+        return "auto_approve_all";
+    return leased ? "approval_lease" : "hook";
+}
+function identityOfToken(token) {
+    const [key = "", salient = ""] = Buffer.from(token, "base64").toString("utf-8").split("\n");
+    return { key, salient };
+}
+/** One path spelled absolute and the other relative to a root it ends in. */
+function samePath(absolute, relative) {
+    const rel = relative.replace(/^\.\//, "");
+    return absolute.startsWith("/") && rel !== "" && !rel.startsWith("/") && absolute.endsWith(`/${rel}`);
+}
+/** A socket path the platform cannot bind: an infrastructure fault, never a silent skip. */
+export class HookSocketPathError extends Error {
+    constructor(path) {
+        super(`the hook server's socket path is longer than this platform allows (${Buffer.byteLength(path)} bytes): ${path}`);
+        this.name = "HookSocketPathError";
+    }
+}
+/** Start serving the turn's hooks. */
+export async function startHookServer(params) {
+    const socketDir = await mkdtemp(join(tmpdir(), "stigmer-hooks-"));
+    const socketPath = join(socketDir, SOCKET_FILE);
+    if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
+        await rm(socketDir, { recursive: true, force: true });
+        throw new HookSocketPathError(socketPath);
+    }
+    const token = randomBytes(32).toString("hex");
+    const decisions = new HookDecisionLog();
+    const handler = new HookRequestHandler(params.evaluator, params.refusals, decisions, token, {
+        captureMode: params.captureMode,
+        globalBypass: params.globalBypass,
+    });
+    // Every served connection, so closing never waits on one a client holds open.
+    const sockets = new Set();
+    const server = createServer((socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+        handler.serve(socket);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(socketPath, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    await chmod(socketPath, 0o600);
+    let closed = false;
+    return {
+        socketPath,
+        token,
+        decisions,
+        close: async () => {
+            if (closed)
+                return;
+            closed = true;
+            const closing = closeServer(server);
+            for (const socket of sockets)
+                socket.destroy();
+            await closing;
+            await rm(socketDir, { recursive: true, force: true });
+        },
+    };
+}
+function closeServer(server) {
+    return new Promise((resolve) => server.close(() => resolve()));
+}
+/** Answers the script's requests; exported for the module's tests. */
+export class HookRequestHandler {
+    evaluator;
+    refusals;
+    decisions;
+    turn;
+    maxRequestBytes;
+    tokenBytes;
+    /** Each MCP call's server, by tool and arguments, from its `beforeMCPExecution`: `postToolUse` names no server ({@link rememberMcpServer}). */
+    mcpServers = new Map();
+    constructor(evaluator, refusals, decisions, token, turn = { captureMode: false, globalBypass: false }, maxRequestBytes = MAX_REQUEST_BYTES) {
+        this.evaluator = evaluator;
+        this.refusals = refusals;
+        this.decisions = decisions;
+        this.turn = turn;
+        this.maxRequestBytes = maxRequestBytes;
+        this.tokenBytes = Buffer.from(token, "utf-8");
+    }
+    serve(socket) {
+        let buffer = "";
+        socket.setEncoding("utf-8");
+        socket.on("error", () => socket.destroy());
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > this.maxRequestBytes) {
+                socket.destroy();
+                return;
+            }
+            const newline = buffer.indexOf("\n");
+            if (newline === -1)
+                return;
+            const line = buffer.slice(0, newline);
+            buffer = "";
+            socket.pause();
+            void this.answer(line).then((reply) => socket.end(`${JSON.stringify(reply)}\n`), (err) => {
+                console.warn(`[hooks] the hook server could not answer: ${err instanceof Error ? err.message : String(err)}`);
+                socket.destroy();
+            });
+        });
+    }
+    /** One request line to its reply; a request without the turn's token is refused. */
+    async answer(line) {
+        const request = parseObject(line);
+        if (request === undefined || !this.authorized(request["token"]))
+            return { error: "unauthorized" };
+        const payload = request["payload"];
+        if (!isObject(payload))
+            return { error: "no payload" };
+        if (request["mode"] === "post")
+            return { response: await this.post(payload) };
+        const identity = typeof request["identity"] === "string" ? request["identity"] : "";
+        const coarse = typeof request["coarse"] === "string" ? request["coarse"] : "";
+        const exact = typeof request["exact"] === "string" ? request["exact"] : "";
+        return this.pre(payload, identity, coarse, exact);
+    }
+    authorized(token) {
+        if (typeof token !== "string")
+            return false;
+        const given = Buffer.from(token, "utf-8");
+        return given.length === this.tokenBytes.length && timingSafeEqual(given, this.tokenBytes);
+    }
+    async pre(payload, identity, coarse, exact) {
+        const call = this.callOf(payload);
+        if (call === undefined)
+            return { decision: "none" };
+        const outcome = await this.evaluator.preToolUse(call, {});
+        const toolName = this.evaluator.viewOf(call)?.toolName ?? call.name;
+        const context = outcome.additionalContext.length > 0 ? `${HOOK_FEEDBACK_HEADING}\n${outcome.additionalContext.join("\n\n")}` : undefined;
+        const allow = JSON.stringify({
+            permission: "allow",
+            ...(outcome.updatedArgs !== undefined ? { updated_input: outcome.updatedArgs } : {}),
+            ...(context !== undefined ? { additional_context: context } : {}),
+        });
+        switch (outcome.decision) {
+            case undefined:
+                this.rememberMcpServer(call);
+                return { decision: "none" };
+            case "deny": {
+                const message = hookRefusalMessage(outcome.hook, outcome.reason);
+                return { decision: "deny", hook: outcome.hook, deny: denyAnswer(message), message };
+            }
+            case "allow":
+            case "ask": {
+                if (outcome.decision === "ask" && outcome.updatedArgs !== undefined && !this.turn.globalBypass) {
+                    const message = askWithRewriteMessage(outcome.hook);
+                    return { decision: "deny", hook: outcome.hook, deny: denyAnswer(message), message };
+                }
+                const moved = this.movedFile(call, outcome.updatedArgs, outcome.hook);
+                if (moved !== undefined)
+                    return moved;
+                const refusal = this.refusals.get(identity) ?? this.refusals.get(coarse) ?? (exact !== "" ? this.refusals.get(exact) : undefined);
+                if (refusal !== undefined) {
+                    const message = personDecisionSentence(refusal.toolName, refusal.action, refusal.comment);
+                    return { decision: "refused", deny: denyAnswer(message), message };
+                }
+                const record = { provenance: provenanceOf(outcome.decision, outcome.leased, this.turn.globalBypass), hook: outcome.hook };
+                const called = coarse || identity;
+                const rewritten = outcome.updatedArgs !== undefined ? [grantToken(identityOfToken(called).key, extractArgKey(outcome.updatedArgs))] : [];
+                this.decisions.record([called, ...rewritten], record);
+                this.rememberMcpServer(call);
+                if (outcome.decision === "allow")
+                    return { decision: "allow", hook: outcome.hook, allow };
+                const message = outcome.reason || hookAskMessage(outcome.hook, toolName);
+                return {
+                    decision: "ask",
+                    hook: outcome.hook,
+                    allow,
+                    approval: JSON.stringify({ permission: "deny", agent_message: APPROVAL_REQUIRED_AGENT_MESSAGE, user_message: message }),
+                    unattended: JSON.stringify({
+                        permission: "deny",
+                        agent_message: UNATTENDED_SKIP_AGENT_MESSAGE,
+                        user_message: `Skipped (approval not available on this surface): ${call.name}`,
+                    }),
+                    message,
+                };
+            }
+            /* v8 ignore start -- @preserve: the never arm; the compiler proves no decision reaches it */
+            default: {
+                const exhaustive = outcome.decision;
+                throw new Error(`hook server: unknown decision ${String(exhaustive)}`);
+            }
+            /* v8 ignore stop */
+        }
+    }
+    /** A write or a deletion a hook moved to another file, refused or blocked, naming the hook; `undefined` when it stays put. */
+    movedFile(call, rewrite, hook) {
+        if ((call.name !== "Write" && call.name !== "Delete") || rewrite === undefined)
+            return undefined;
+        // A write's or a deletion's rewrite here can only move its path
+        // (`hook-views.ts`), and an unchanged one is none (`evaluate.ts`).
+        const target = rewrite["file_path"];
+        if (typeof target === "string" && isSecretLikePath(target)) {
+            return { decision: "deny", hook, deny: JSON.stringify({ permission: "deny", agent_message: SECRET_BLOCKED_AGENT_MESSAGE, user_message: SECRET_BLOCKED_AGENT_MESSAGE }), message: SECRET_BLOCKED_AGENT_MESSAGE };
+        }
+        if (this.turn.captureMode) {
+            const message = "A hook moved this file change to another file, which this turn's review cannot follow, so the call was refused.";
+            return { decision: "deny", hook, deny: denyAnswer(message), message };
+        }
+        return undefined;
+    }
+    async post(payload) {
+        const name = typeof payload["tool_name"] === "string" ? payload["tool_name"] : "";
+        const input = isObject(payload["tool_input"]) ? payload["tool_input"] : {};
+        const output = outputText(payload["tool_output"]);
+        let call;
+        if (name.startsWith("MCP:")) {
+            const tool = name.slice("MCP:".length);
+            const server = this.takeMcpServer(tool, input);
+            if (server === undefined)
+                return "{}";
+            call = { id: "", name: tool, args: input, serverSlug: server };
+        }
+        else {
+            const id = typeof payload["tool_use_id"] === "string" ? payload["tool_use_id"] : "";
+            call = { id, name, args: input, serverSlug: "" };
+        }
+        const outcome = await this.evaluator.postToolUse(call, {}, output);
+        for (const error of outcome.errors)
+            console.warn(`[hooks] a PostToolUse hook failed: ${error}`);
+        const feedback = [...outcome.blockReasons, ...outcome.additionalContext];
+        return feedback.length === 0 ? "{}" : JSON.stringify({ additional_context: `${HOOK_FEEDBACK_HEADING}\n${feedback.join("\n\n")}` });
+    }
+    /** The call a pre-execution payload asks about; `undefined` for an event the server does not answer. */
+    callOf(payload) {
+        const name = typeof payload["tool_name"] === "string" ? payload["tool_name"] : "";
+        if (name === "")
+            return undefined;
+        switch (payload["hook_event_name"]) {
+            case "preToolUse": {
+                const args = isObject(payload["tool_input"]) ? payload["tool_input"] : {};
+                const id = typeof payload["tool_use_id"] === "string" ? payload["tool_use_id"] : "";
+                const call = { id, name, args, serverSlug: "" };
+                return { ...call, rowName: rowNameOf(call) };
+            }
+            case "beforeMCPExecution": {
+                const raw = payload["tool_input"];
+                const args = typeof raw === "string" ? (parseObject(raw) ?? {}) : isObject(raw) ? raw : {};
+                const server = typeof payload["mcp_server_name"] === "string" ? payload["mcp_server_name"] : "";
+                if (server === "")
+                    return undefined;
+                return { id: "", name, args, serverSlug: server, rowName: name };
+            }
+            default:
+                return undefined;
+        }
+    }
+    /**
+     * An MCP call that may run, by tool and arguments, for its `postToolUse`,
+     * which names no server. A refused call never runs, so it is not
+     * remembered; the newest is taken first, since a call's `postToolUse`
+     * follows its own `beforeMCPExecution`, and each list keeps only the
+     * latest few (a call held for a person, or refused by the default gate,
+     * stays behind).
+     */
+    rememberMcpServer(call) {
+        if (call.serverSlug === "")
+            return;
+        const key = `${call.name}\n${JSON.stringify(call.args)}`;
+        const servers = this.mcpServers.get(key) ?? [];
+        servers.push(call.serverSlug);
+        this.mcpServers.set(key, servers.slice(-MAX_REMEMBERED_SERVERS));
+    }
+    takeMcpServer(tool, args) {
+        const key = `${tool}\n${JSON.stringify(args)}`;
+        const servers = this.mcpServers.get(key);
+        const server = servers?.pop();
+        if (servers !== undefined && servers.length === 0)
+            this.mcpServers.delete(key);
+        return server;
+    }
+}
+/** The answer that refuses a call, the reason given to the model and the person alike. */
+function denyAnswer(message) {
+    return JSON.stringify({ permission: "deny", agent_message: message, user_message: message });
+}
+/** The text a tool returned, from `postToolUse`'s `tool_output` (a JSON string): a shell's output, an MCP tool's text. */
+function outputText(raw) {
+    if (typeof raw !== "string")
+        return "";
+    const parsed = parseObject(raw);
+    if (parsed === undefined)
+        return raw;
+    if (typeof parsed["output"] === "string")
+        return parsed["output"];
+    const content = parsed["content"];
+    if (Array.isArray(content)) {
+        return content
+            .flatMap((block) => (isObject(block) && typeof block["text"] === "string" ? [block["text"]] : []))
+            .join("\n");
+    }
+    return raw;
+}
+function parseObject(text) {
+    try {
+        const value = JSON.parse(text);
+        return isObject(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=hook-server.js.map

package/dist/activities/execute-cursor/hook-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-server.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC9I,OAAO,EAAE,UAAU,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAEhI,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,iGAAiG;AACjG,MAAM,qBAAqB,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAExE,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ3C;;;;;;;GAOG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,GAA8I,EAAE,CAAC;IAEzK,MAAM,CAAC,MAAyB,EAAE,MAA0B;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,sFAAsF;IACtF,IAAI,CAAC,IAAY,EAAE,aAAqB,EAAE,KAA8B;QACtE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzI,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9C,OAAO,KAAM,CAAC,MAAM,CAAC;IACvB,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,kJAAkJ,CAAC;AAC9K,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,QAAyB,EAAE,MAAe,EAAE,YAAqB;IACrF,IAAI,QAAQ,KAAK,KAAK,IAAI,YAAY;QAAE,OAAO,kBAAkB,CAAC;IAClE,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5F,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,QAAgB,EAAE,QAAgB;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;AACxG,CAAC;AAsCD,4FAA4F;AAC5F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,sEAAsE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACvH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAwB;IAC5D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,qBAAqB,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1F,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE/B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,UAAU;QACV,KAAK;QACL,SAAS;QACT,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,OAAO,CAAC;YACd,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,kBAAkB;IAMV;IACA;IACA;IAEA;IACA;IAVF,UAAU,CAAS;IACpC,+IAA+I;IAC9H,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1D,YACmB,SAAwB,EACxB,QAA4C,EAC5C,SAA0B,EAC3C,KAAa,EACI,OAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAChE,kBAAkB,iBAAiB;QALnC,cAAS,GAAT,SAAS,CAAe;QACxB,aAAQ,GAAR,QAAQ,CAAoC;QAC5C,cAAS,GAAT,SAAS,CAAiB;QAE1B,SAAI,GAAJ,IAAI,CAA4D;QAChE,oBAAe,GAAf,eAAe,CAAoB;QAEpD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAc;QAClB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,OAAO;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,GAAG,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EACnD,CAAC,GAAY,EAAE,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9G,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,UAAU,CAAC,KAAc;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,OAAgC,EAAE,QAAgB,EAAE,MAAc,EAAE,KAAa;QACjG,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,KAAK,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,UAAU,EAAE,OAAO;YACnB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;QAEH,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,SAAS;gBACZ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;YACtF,CAAC;YACD,KAAK,OAAO,CAAC;YACb,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC/F,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;gBACtF,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC1F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;gBACrE,CAAC;gBACD,MAAM,MAAM,GAAuB,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC9I,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;gBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzE,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,+BAA+B,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;oBACvH,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;wBACzB,UAAU,EAAE,MAAM;wBAClB,aAAa,EAAE,6BAA6B;wBAC5C,YAAY,EAAE,qDAAqD,IAAI,CAAC,IAAI,EAAE;qBAC/E,CAAC;oBACF,OAAO;iBACR,CAAC;YACJ,CAAC;YACD,6FAA6F;YAC7F,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC,QAAQ,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,oBAAoB;QACtB,CAAC;IACH,CAAC;IAED,8HAA8H;IACtH,SAAS,CAAC,IAAkB,EAAE,OAA4C,EAAE,IAAY;QAC9F,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjG,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,4BAA4B,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;QAClN,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,iHAAiH,CAAC;YAClI,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAgC;QACjD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAClD,IAAI,IAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,GAAG,qBAAqB,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACrI,CAAC;IAED,wGAAwG;IAChG,MAAM,CAAC,OAAgC;QAC7C,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAClC,QAAQ,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnC,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;gBAChD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChG,IAAI,MAAM,KAAK,EAAE;oBAAE,OAAO,SAAS,CAAC;gBACpC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YACD;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,IAAkB;QAC1C,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE;YAAE,OAAO;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,aAAa,CAAC,IAAY,EAAE,IAA6B;QAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,0HAA0H;AAC1H,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO;aACX,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACjG,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}